3dbrew - User contributions [en]

PTM:GetStepHistory

2017-09-29T20:00:48Z

Mailwl: Created page with "=Request= {| class="wikitable" border="1" |- ! Index Word ! Description |- | 0 | Header code [0x000B00C2] |- | 1 | Number of hours |- | 2-3 | DateTime start of (3ds date fro..."

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x000B00C2]
|-
| 1
| Number of hours
|-
| 2-3
| DateTime start of (3ds date from 2000y)
|-
| 4
| Translated size of output buffer
|-
| 5
| short* buffer for number of hours
|}

PTM Services

2017-09-29T19:41:51Z

Mailwl: /* User PTM Service "ptm:u" / PTM services */

A total of 24 sessions can be open for each of these services combined. The commands for each service are handled by the PTM module main() thread.

=User PTM Service "ptm:u" / PTM services=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010002
| RegisterAlarmClient
|-
| 0x00020080
| SetRtcAlarm
|-
| 0x00030000
| GetRtcAlarm
|-
| 0x00040000
| CancelRtcAlarm
|-
| 0x00050000
| [[PTM:GetAdapterState|GetAdapterState]]
|-
| 0x00060000
| [[PTM:GetShellState|GetShellState]]
|-
| 0x00070000
| [[PTM:GetBatteryLevel|GetBatteryLevel]]
|-
| 0x00080000
| [[PTM:GetBatteryChargeState|GetBatteryChargeState]]
|-
| 0x00090000
| [[PTM:GetPedometerState|GetPedometerState]]
|-
| 0x000A0042
| GetStepHistoryEntry
|-
| 0x000B00C2
| [[PTM:GetStepHistory|GetStepHistory]]
|-
| 0x000C0000
| [[PTM:GetTotalStepCount|GetTotalStepCount]]
|-
| 0x000D0040
| SetPedometerRecordingMode
|-
| 0x000E0000
| GetPedometerRecordingMode
|-
| 0x000F0084
| GetStepHistoryAll
|}

The above commands are available for all PTM services, except the SetSystemTime service.

=PlayHistory PTM Service "ptm:play" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x08070082
| [[PTM:GetPlayHistory|GetPlayHistory]]
|-
| 0x08080000
| GetPlayHistoryStart
|-
| 0x08090000
| GetPlayHistoryLength
|-
| 0x080B0080
| CalcPlayHistoryStart
|}

=SystemControl PTM Service "ptm:s"=
Identical to the below "ptm:sysm"

=SysMenu PTM Service "ptm:sysm"=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x040100C0
| SetRtcAlarmEx
|-
| 0x04020042
| ReplySleepQuery
|-
| 0x04030042
| NotifySleepPreparationComplete
|-
| 0x04040102
| SetWakeupTrigger
|-
| 0x04050000
| GetAwakeReason
|-
| 0x04060000
| RequestSleep
|-
| 0x040700C0
| [[PTM:ShutdownAsync|ShutdownAsync]]
|-
| 0x04080000
| Awake
|-
| 0x04090080
| [[PTMSYSM:LaunchFIRMRebootSystem|RebootAsync]]
|-
| 0x040A0000
| [[PTMSYSM:CheckNew3DS|CheckNew3DS]] (Added with [[8.0.0-18]])
|-
| 0x08010640
| [[PTMSYSM:SetInfoLEDPattern|SetInfoLEDPattern]] (These 4 LED commands are used for the notification LED, see [[MCU]] regarding boot fail with invalid parameters)
|-
| 0x08020040
| [[PTMSYSM:SetInfoLEDPatternHeader|SetInfoLEDPatternHeader]]
|-
| 0x08030000
| [[PTMSYSM:GetInfoLEDStatus|GetInfoLEDStatus]]
|-
| 0x08040040
| [[PTMSYSM:SetBatteryEmptyLEDPattern|SetBatteryEmptyLEDPattern]]
|-
| 0x08050000
| ClearStepHistory
|-
| 0x080600C2
| SetStepHistory
|-
| 0x08070082
| [[PTM:GetPlayHistory|GetPlayHistory]]
|-
| 0x08080000
| GetPlayHistoryStart
|-
| 0x08090000
| GetPlayHistoryLength
|-
| 0x080A0000
| ClearPlayHistory
|-
| 0x080B0080
| CalcPlayHistoryStart
|-
| 0x080C0080
| SetUserTime
|-
| 0x080D0000
| InvalidateSystemTime
|-
| 0x080E0140
| [[PTMSYSM:NotifyPlayEvent|NotifyPlayEvent]]
|-
| 0x080F0000
| [[PTMSYSM:GetSoftwareClosedFlag|GetSoftwareClosedFlag]]
|-
| 0x08100000
| [[PTMSYSM:ClearSoftwareClosedFlag|ClearSoftwareClosedFlag]]
|-
| 0x08110000
| GetShellStatus
|-
| 0x08120000
| IsShutdownByBatteryEmpty
|-
| 0x08130000
| FormatSavedata
|-
| 0x08140000
| GetLegacyJumpProhibitedFlag
|-
| 0x0815...
| unknown
|-
| 0x0816....
| Abstraction for mcu::RTC::GetSystemClock
|-
| 0x0817....
| Abstraction for mcu::RTC::SetSystemClock
|-
| 0x08180040
| [[PTMSYSM:ConfigureNew3DSCPU|ConfigureNew3DSCPU]]
|-
|}

=GetSystemTime PTM Service "ptm:gets"=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x04010000
| GetSystemTime
|-
|}

=SetSystemTime PTM Service "ptm:sets"=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010080
| SetSystemTime
|-
|}

=PTM [[System_SaveData]]=
During system boot PTM attempts to open the PTM savedata, if this fails it will repeatedly keep trying to open the archive. When opening the archive is failing due to savedata corruption, PTM eventually(during system boot) deletes the savedata then creates it again.

Savedata contents:
* "/Pedometer.dat"
* "/PlayHistory.dat" Filesize is 0xD5DE8.

==PlayHistory.dat==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Start entry index.
|-
| 0x4
| 0x4
| Total PlayHistory entries.
|-
| 0x8
| 0xD5DE0
| 0x11D28 PlayHistory entries, 0xC-bytes each.
|}

===PlayHistory entry===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| u64 programID
|-
| 0x8
| 0x4
| u32, probably timestamp.
|}

DLP Services

2017-08-09T11:12:12Z

Mailwl: /* Download Play Client Service "dlp:CLNT" */

Download Play services are not used by the Download Play child application at all(the title which runs on the Download Play clients). This is used instead: [[APT:GetWirelessRebootInfo]]. The DLP-child is launched by the dlplay system-application the same way as any other system-application->system-application launching(besides using [[NSS:SetWirelessRebootInfo]]).

There can only be one session open for each individual DLP service at a time.

=Download Play Client Service "dlp:CLNT"=
{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Description
|-
| 0x000100C3
| ?
| Initialize
|-
| 0x00020000
| ?
| Finalize
|-
| 0x00030000
| ?
| GetEventDesc. Writes 0x18-bytes of output starting at cmdreply[2].
|-
| 0x00040000
| ?
| GetChannel. Writes an output u16 to cmdreply[2].
|-
| 0x00050180
| ?
| StartScan
|-
| 0x00060000
| ?
| StopScan
|-
| 0x00070080
| ?
| GetServerInfo
|-
| 0x00080100
| ?
| GetTitleInfo
|-
| 0x00090040
| ?
| GetTitleInfoInOrder
|-
| 0x000A0080
| ?
| DeleteScanInfo
|-
| 0x000B0100
| ?
| PrepareForSystemDownload
|-
| 0x000C0000
| ?
| StartSystemDownload
|-
| 0x000D0100
| ?
| StartTitleDownload
|-
| 0x000E0000
| ?
| GetMyStatus
|-
| 0x000F0040
| ?
| GetConnectingNodes
|-
| 0x00100040
| ?
| GetNodeInfo
|-
| 0x00110000
| ?
| [[DLP:GetWirelessRebootPassphrase|GetWirelessRebootPassphrase]]
|-
| 0x00120000
| ?
| StopSession
|-
| 0x00130100
| ?
| GetCupVersion
|-
| 0x00140100
| ?
| GetDupAvailability
|}

=Download Play Server Service "dlp:SRVR"=
{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Description
|-
| 0x00010183
|
| [[DLPSRVR:Initialize|Initialize]]
|-
| 0x00020000
|
| Finalize
|-
| 0x00030000
|
| GetServerState
|-
| 0x00040000
|
| GetEventDescription
|-
| 0x00050080
|
| StartAccepting
|-
| 0x00060000
|
| EndAccepting
|-
| 0x00070000
|
| StartDistribution
|-
| 0x000800C0
|
| [[DLPSRVR:SendWirelessRebootPassphrase|SendWirelessRebootPassphrase]]
|-
| 0x00090040
|
| AcceptClient
|-
| 0x000A0040
|
| DisconnectClient
|-
| 0x000B0042
|
| GetConnectingClients
|-
| 0x000C0040
|
| GetClientInfo
|-
| 0x000D0040
|
| GetClientState
|-
| 0x000E0040
|
| IsChild
|-
| 0x000F0303
|
| InitializeWithName
|-
| 0x00100000
|
| GetDupNoticeNeed
|}

=Download Play Fake Client Service "dlp:FKCL"=
{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Description
|-
| 0x00010083
| ?
| Initialize
|-
| 0x00020000
| ?
| Finalize
|-
| 0x00030000
| ?
| GetEventDesc
|-
| 0x00040000
| ?
| GetChannels
|-
| 0x00050180
| ?
| StartScan
|-
| 0x00060000
| ?
| StopScan
|-
| 0x00070080
| ?
| GetServerInfo
|-
| 0x00080100
| ?
| GetTitleInfo
|-
| 0x00090040
| ?
| GetTitleInfoInOrder
|-
| 0x000A0080
| ?
| DeleteScanInfo
|-
| 0x000B0100
| ?
| StartFakeSession
|-
| 0x000C0000
| ?
| GetMyStatus
|-
| 0x000D0040
| ?
| GetConnectingNodes
|-
| 0x000E0040
| ?
| GetNodeInfo
|-
| 0x000F0000
| ?
| [[DLP:GetWirelessRebootPassphrase|GetWirelessRebootPassphrase]]
|-
| 0x00100000
| ?
| Same as dlp:CLNT cmd12 (StopSession).
|-
| 0x00110203
| ?
| Calls the same function as DLPFKCL:Initialize.
|}

=WirelessRebootPassphrase=
This 9-byte UDS passphrase is sent by the DLP host application to the DLP clients via [[DLPSRVR:SendWirelessRebootPassphrase]]. The dlplay client system-application then loads it via [[DLP:GetWirelessRebootPassphrase]] for [[NSS:SetWirelessRebootInfo|setting]] the NS [[NS_and_APT_Services#WirelessRebootInfo|WirelessRebootInfo]]. Afterwards once launched, the DLP child application can then use [[APT:GetWirelessRebootInfo]] to load that data.

Normally this a randomly-generated ASCII hex string, however it can be arbitrary. These strings are less than 9-bytes for some titles, the unused bytes are cleared to zero. This is the passphrase for the new UDS network which will be used by the clients and host for communicating, once the DLP child titles on those clients launch. This entire 9-byte passphrase is passed directly to the [[NWM_Services|UDS]] network connection/creation commands.

Friend Services

2017-07-20T07:19:48Z

Mailwl: /* "frd:a" */

[[Category:Services]]
= Friend Service "frd:u" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010000
| [[FRDU:HasLoggedIn|HasLoggedIn]]
|-
| 0x00020000
| [[FRDU:IsOnline|IsOnline]]
|-
| 0x00030002
| [[FRDU:Login|Login]]
|-
| 0x00040000
| [[FRDU:Logout|Logout]]
|-
| 0x00050000
| [[FRDU:GetMyFriendKey|GetMyFriendKey]]
|-
| 0x00060000
| [[FRDU:GetMyPreference|GetMyPreference]]
|-
| 0x00070000
| [[FRDU:GetMyProfile|GetMyProfile]]
|-
| 0x00080000
| [[FRDU:GetMyPresence|GetMyPresence]]
|-
| 0x00090000
| [[FRDU:GetMyScreenName|GetMyScreenName]]
|-
| 0x000A0000
| [[FRDU:GetMyMii|GetMyMii]]
|-
| 0x000B0000
| [[FRDU:GetMyLocalAccountId|GetMyLocalAccountId]]
|-
| 0x000C0000
| [[FRDU:GetMyPlayingGame|GetMyPlayingGame]]
|-
| 0x000D0000
| [[FRDU:GetMyFavoriteGame|GetMyFavoriteGame]]
|-
| 0x000E0000
| [[FRDU:GetMyNcPrincipalId|GetMyNcPrincipalId]]
|-
| 0x000F0000
| [[FRDU:GetMyComment|GetMyComment]]
|-
| 0x00100040
| [[FRDU:GetMyPassword|GetMyPassword]]
|-
| 0x00110080
| [[FRDU:GetFriendKeyList|GetFriendKeyList]]
|-
| 0x00120042
| [[FRDU:GetFriendPresence|GetFriendPresence]]
|-
| 0x00130142
| [[FRDU:GetFriendScreenName|GetFriendScreenName]]
|-
| 0x00140044
| [[FRDU:GetFriendMii|GetFriendMii]]
|-
| 0x00150042
| [[FRDU:GetFriendProfile|GetFriendProfile]]
|-
| 0x00160042
| [[FRDU:GetFriendRelationship|GetFriendRelationship]]
|-
| 0x00170042
| [[FRDU:GetFriendAttributeFlags|GetFriendAttributeFlags]]
|-
| 0x00180044
| [[FRDU:GetFriendPlayingGame|GetFriendPlayingGame]]
|-
| 0x00190042
| [[FRDU:GetFriendFavoriteGame|GetFriendFavoriteGame]]
|-
| 0x001A00C4
| [[FRDU:GetFriendInfo|GetFriendInfo]]
|-
| 0x001B0080
| [[FRDU:IsIncludedInFriendList|IsIncludedInFriendList]]
|-
| 0x001C0042
| [[FRDU:UnscrambleLocalFriendCode|UnscrambleLocalFriendCode]]
|-
| 0x001D0002
| [[FRDU:UpdateGameModeDescription|UpdateGameModeDescription]]
|-
| 0x001E02C2
| [[FRDU:UpdateGameMode|UpdateGameMode]]
|-
| 0x001F0042
| [[FRDU:SendInvitation|SendInvitation]]
|-
| 0x00200002
| [[FRDU:AttachToEventNotification|AttachToEventNotification]]
|-
| 0x00210040
| [[FRDU:SetNotificationMask|SetNotificationMask]]
|-
| 0x00220040
| [[FRDU:GetEventNotification|GetEventNotification]]
|-
| 0x00230000
| [[FRDU:GetLastResponseResult|GetLastResponseResult]]
|-
| 0x00240040
| [[FRDU:PrincipalIdToFriendCode|PrincipalIdToFriendCode]]
|-
| 0x00250080
| [[FRDU:FriendCodeToPrincipalId|FriendCodeToPrincipalId]]
|-
| 0x00260080
| [[FRDU:IsValidFriendCode|IsValidFriendCode]]
|-
| 0x00270040
| [[FRDU:ResultToErrorCode|ResultToErrorCode]]
|-
| 0x00280244
| [[FRDU:RequestGameAuthentication|RequestGameAuthentication]]
|-
| 0x00290000
| [[FRDU:GetGameAuthenticationData|GetGameAuthenticationData]]
|-
| 0x002A0204
| [[FRDU:RequestServiceLocator|RequestServiceLocator]]
|-
| 0x002B0000
| [[FRDU:GetServiceLocatorData|GetServiceLocatorData]]
|-
| 0x002C0002
| [[FRDU:DetectNatProperties|DetectNatProperties]]
|-
| 0x002D0000
| [[FRDU:GetNatProperties|GetNatProperties]]
|-
| 0x002E0000
| [[FRDU:GetServerTimeInterval|GetServerTimeInterval]]
|-
| 0x002F0040
| [[FRDU:AllowHalfAwake|AllowHalfAwake]]
|-
| 0x00300000
| [[FRDU:GetServerTypes|GetServerTypes]]
|-
| 0x00310082
| [[FRDU:GetFriendComment|GetFriendComment]]
|-
| 0x00320042
| [[FRDU:SetClientSdkVersion|SetClientSdkVersion]]
|-
| 0x00330000
| [[FRDU:GetMyApproachContext|GetMyApproachContext]]
|-
| 0x00340046
| [[FRDU:AddFriendWithApproach|AddFriendWithApproach]]
|-
| 0x00350082
| [[FRDU:DecryptApproachContext|DecryptApproachContext]]
|}

= "frd:n" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010000
| ?
|-
| 0x00020000
| ?
|-
| 0x00030040
| ?
|-
| 0x00040000
| ?
|}

= "frd:a" =

This contains a similar (probably the same) command handler from 0x0001.... to 0x002F.... as them in frd:u. In addition, it also contains

{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x04050000
| Used in creating the user Mii. No cmdbuff parameters.
|-
| 0x040C0800
| Used in creating the user Mii. 128-byte struct as cmdbuff parameters.
|}

=HTTPS Requests=

==Trusted RootCAs==
No RootCertChain(s) are used. For the nasc site, friends-module uses [[HTTPC:AddDefaultCert]] with the following certIDs: 0x1, 0x2, and 0x3.

Friend Services

2017-07-20T06:50:04Z

Mailwl: /* "frd:a" */

[[Category:Services]]
= Friend Service "frd:u" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010000
| [[FRDU:HasLoggedIn|HasLoggedIn]]
|-
| 0x00020000
| [[FRDU:IsOnline|IsOnline]]
|-
| 0x00030002
| [[FRDU:Login|Login]]
|-
| 0x00040000
| [[FRDU:Logout|Logout]]
|-
| 0x00050000
| [[FRDU:GetMyFriendKey|GetMyFriendKey]]
|-
| 0x00060000
| [[FRDU:GetMyPreference|GetMyPreference]]
|-
| 0x00070000
| [[FRDU:GetMyProfile|GetMyProfile]]
|-
| 0x00080000
| [[FRDU:GetMyPresence|GetMyPresence]]
|-
| 0x00090000
| [[FRDU:GetMyScreenName|GetMyScreenName]]
|-
| 0x000A0000
| [[FRDU:GetMyMii|GetMyMii]]
|-
| 0x000B0000
| [[FRDU:GetMyLocalAccountId|GetMyLocalAccountId]]
|-
| 0x000C0000
| [[FRDU:GetMyPlayingGame|GetMyPlayingGame]]
|-
| 0x000D0000
| [[FRDU:GetMyFavoriteGame|GetMyFavoriteGame]]
|-
| 0x000E0000
| [[FRDU:GetMyNcPrincipalId|GetMyNcPrincipalId]]
|-
| 0x000F0000
| [[FRDU:GetMyComment|GetMyComment]]
|-
| 0x00100040
| [[FRDU:GetMyPassword|GetMyPassword]]
|-
| 0x00110080
| [[FRDU:GetFriendKeyList|GetFriendKeyList]]
|-
| 0x00120042
| [[FRDU:GetFriendPresence|GetFriendPresence]]
|-
| 0x00130142
| [[FRDU:GetFriendScreenName|GetFriendScreenName]]
|-
| 0x00140044
| [[FRDU:GetFriendMii|GetFriendMii]]
|-
| 0x00150042
| [[FRDU:GetFriendProfile|GetFriendProfile]]
|-
| 0x00160042
| [[FRDU:GetFriendRelationship|GetFriendRelationship]]
|-
| 0x00170042
| [[FRDU:GetFriendAttributeFlags|GetFriendAttributeFlags]]
|-
| 0x00180044
| [[FRDU:GetFriendPlayingGame|GetFriendPlayingGame]]
|-
| 0x00190042
| [[FRDU:GetFriendFavoriteGame|GetFriendFavoriteGame]]
|-
| 0x001A00C4
| [[FRDU:GetFriendInfo|GetFriendInfo]]
|-
| 0x001B0080
| [[FRDU:IsIncludedInFriendList|IsIncludedInFriendList]]
|-
| 0x001C0042
| [[FRDU:UnscrambleLocalFriendCode|UnscrambleLocalFriendCode]]
|-
| 0x001D0002
| [[FRDU:UpdateGameModeDescription|UpdateGameModeDescription]]
|-
| 0x001E02C2
| [[FRDU:UpdateGameMode|UpdateGameMode]]
|-
| 0x001F0042
| [[FRDU:SendInvitation|SendInvitation]]
|-
| 0x00200002
| [[FRDU:AttachToEventNotification|AttachToEventNotification]]
|-
| 0x00210040
| [[FRDU:SetNotificationMask|SetNotificationMask]]
|-
| 0x00220040
| [[FRDU:GetEventNotification|GetEventNotification]]
|-
| 0x00230000
| [[FRDU:GetLastResponseResult|GetLastResponseResult]]
|-
| 0x00240040
| [[FRDU:PrincipalIdToFriendCode|PrincipalIdToFriendCode]]
|-
| 0x00250080
| [[FRDU:FriendCodeToPrincipalId|FriendCodeToPrincipalId]]
|-
| 0x00260080
| [[FRDU:IsValidFriendCode|IsValidFriendCode]]
|-
| 0x00270040
| [[FRDU:ResultToErrorCode|ResultToErrorCode]]
|-
| 0x00280244
| [[FRDU:RequestGameAuthentication|RequestGameAuthentication]]
|-
| 0x00290000
| [[FRDU:GetGameAuthenticationData|GetGameAuthenticationData]]
|-
| 0x002A0204
| [[FRDU:RequestServiceLocator|RequestServiceLocator]]
|-
| 0x002B0000
| [[FRDU:GetServiceLocatorData|GetServiceLocatorData]]
|-
| 0x002C0002
| [[FRDU:DetectNatProperties|DetectNatProperties]]
|-
| 0x002D0000
| [[FRDU:GetNatProperties|GetNatProperties]]
|-
| 0x002E0000
| [[FRDU:GetServerTimeInterval|GetServerTimeInterval]]
|-
| 0x002F0040
| [[FRDU:AllowHalfAwake|AllowHalfAwake]]
|-
| 0x00300000
| [[FRDU:GetServerTypes|GetServerTypes]]
|-
| 0x00310082
| [[FRDU:GetFriendComment|GetFriendComment]]
|-
| 0x00320042
| [[FRDU:SetClientSdkVersion|SetClientSdkVersion]]
|-
| 0x00330000
| [[FRDU:GetMyApproachContext|GetMyApproachContext]]
|-
| 0x00340046
| [[FRDU:AddFriendWithApproach|AddFriendWithApproach]]
|-
| 0x00350082
| [[FRDU:DecryptApproachContext|DecryptApproachContext]]
|}

= "frd:n" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010000
| ?
|-
| 0x00020000
| ?
|-
| 0x00030040
| ?
|-
| 0x00040000
| ?
|}

= "frd:a" =

This contains a similar (probably the same) command handler from 0x0001.... to 0x0035.... as them in frd:u. In addition, it also contains

{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x04050000
| Used in creating the user Mii. No cmdbuff parameters.
|-
| 0x040C0800
| Used in creating the user Mii. 128-byte struct as cmdbuff parameters.
|}

=HTTPS Requests=

==Trusted RootCAs==
No RootCertChain(s) are used. For the nasc site, friends-module uses [[HTTPC:AddDefaultCert]] with the following certIDs: 0x1, 0x2, and 0x3.

Circle Pad Pro

2017-02-28T08:10:11Z

Mailwl: /* Read Input */

Also known as CTR-009, it sends the commands to the console through the IR interface on the back of the console.

[http://what-games.golog.jp/archives/1350330.html Pictures of its contents].

== Usage Instructions ==

[[File:Circle pad pro instructions.jpg]]

== IR Protocol ==
Communications with this device is done via the [[IR_Services|ir:USER]] service, which uses obfuscation implemented in software. The [[IRU:SetBitRate|bitrate-value]] passed to IRUSER is 0x04, hence the actual bps is 96000.

The application sends requests via [[IRUSER:SendIrnop]] and receives response from Circle Pad Pro via [[IRUSER:ReceiveIrnop]] (or read data from the [[IRUSER_Shared_Memory|shared memory]]). The request and response data structures below are payloads in packets.

=== Read Input ===

Request (3 bytes):
{| class="wikitable" border="1"
|-
! offset
! Size
! Description
|-
| 0x0
| 0x1
| Request ID (fixed value 1)
|-
| 0x1
| 0x1
| Response period in ms
|-
| 0x2
| 0x1
| Unknown
|}

Response (6 bytes):
This Response will be sent repeatedly by the specified period.
{| class="wikitable" border="1"
|-
! offset
! Size
! Description
|-
| 0x0
| 0x1
| Response ID? Fixed value 0x11 (Really 0x11? Should be 0x10)
|-
| 0x1
| 0x3
| Right circle pad position.
This three bytes are two little-endian 12-bit fields. The first one is for x-axis and the second one is for y-axis.
|-
| 0x4
| 0x2
| bit[0:4] battery level?
bit[5] ZL button

bit[6] ZR button

bit[7] R button

Note that for the three button fields, the bit is set when the button is NOT pressed.
|}

=== Read Calibration Data? ===

Request (6 bytes):
{| class="wikitable" border="1"
|-
! offset
! Size
! Description
|-
| 0x0
| 0x1
| Request ID (fixed value 2)
|-
| 0x1
| 0x1
| Expected response time in ms?
|-
| 0x2
| 0x2
| Data offset? (aligned to 0x10?)
|-
| 0x4
| 0x2
| Data size (aligned to 0x10?)
|}

Response (5 bytes + requested size)
{| class="wikitable" border="1"
|-
! offset
! Size
! Description
|-
| 0x0
| 0x1
| Response ID? Fixed value 0x11
|-
| 0x1
| 0x2
| Unknown. Same as request+0x2
|-
| 0x2
| 0x2
| Data size
|-
| 0x4
| data size
| calibration data?
|}

IRUSER Shared Memory

2017-02-28T07:54:05Z

Mailwl: /* ReceiveBufferInfo/SendBufferInfo */

This is the shared-memory for [[IR_Services|"ir:USER"]], which is provided by the application via [[IRUSER:InitializeIrnop|InitializeIrnop]] or [[IRUSER:InitializeIrnopShared|InitializeIrnopShared]]. The size of the shared memory is determined by parameters of the Init functions above.

=Overall Structure=

The shared memory consists of 2 or 5 components, depending on which Init function is called. For InitializeIrnopShared, ir service puts more information to the shared memory and applications can read it directly; for InitializeIrnop, ir service puts less information and store the rest in its local storage. All these components are adjacent to each other, without any padding, which means the data can be unaligned if the size specified in Init is unaligned.
{| class="wikitable" border="1"
|-
! Size
! Description
|-
| 0x10
| StatusInfo. Only presents when InitializeIrnopShared is called
|-
| 0x10
| ReceiveBufferInfo. Only presents when InitializeIrnopShared is called
|-
| (specified by Init paramter)
| ReceiveBuffer
|-
| 0x10
| SendBufferInfo. Only presents when InitializeIrnopShared is called
|-
| (specified by Init paramter)
| SendBuffer
|}

=StatusInfo=
{| class="wikitable" border="1"
|-
! Relative offset
! Size
! Description
|-
| 0x0
| 0x4
| Latest receive error result. Read by [[IRUSER:GetLatestReceiveErrorResult]]
|-
| 0x4
| 0x4
| Latest Send error result. Read by [[IRUSER:GetLatestSendErrorResult]]
|-
| 0x8
| 0x1
| Connection status. Read by [[IRUSER:GetConnectionStatus]]
|-
| 0x9
| 0x1
| Trying to connect status. Read by [[IRUSER:GetTryingToConnectStatus]]
|-
| 0xA
| 0x1
| Connection role. Read by [[IRUSER:GetConnectionRole]]
|-
| 0xB
| 0x1
| Machine ID. Set by [[IRUSER:SetOwnMachineId]]
|-
| 0xC
| 0x1
| Unknown. Value 1 is observed after connection
|-
| 0xD
| 0x1
| Network ID? Seems like a randomly distributed number after connection
|-
| 0xE
| 0x1
| Unknown. Value 1 is observed after initialization
|-
| 0xF
| 0x1
| Unknown
|}

=ReceiveBufferInfo/SendBufferInfo=
(Information below is poorly verified against real hardware. Please help me verify them -- [[User:Wwylele|Wwylele]] ([[User talk:Wwylele|talk]]))

The BufferInfo sections store data validity information for the two buffers

{| class="wikitable" border="1"
|-
! Relative offset
! Size
! Description
|-
| 0x0
| 0x4
| Read index of valid packets
|-
| 0x4
| 0x4
| End index of valid packets
|-
| 0x8
| 0x8
| Number of valid packets
|}

=ReceiveBuffer/SendBuffer=

{| class="wikitable" border="1"
|-
! Relative offset
! Size
! Description
|-
| 0x0
| 0x8 * packet_count (specified in Init parameter)
| PacketInfo{u32 offset_to_data_buffer, u32 data_length}
|-
| 0x8 * packet_count
| buffer_size - 0x8 * packet_count
| Data buffer
|}

The buffers are two circular buffers. A new packet is added to the end of previous packet in the data buffer, with packet info added to PacketInfo[end_index++]. Note that if an added packet exceeds the end of the buffer, the exceeding data will be wrapped around to the beginning of the data buffer.

==Packet structure==
A packet in the data buffer consists of a header, payload and a crc8 checksum
{| class="wikitable" border="1"
|-
! Relative offset
! Size
! Description
|-
| 0x0
| 0x1
| Fixed value 0xA5?
|-
| 0x1
| 0x1
| Destination network ID?
|-
| 0x2
| 0x1
| The highest bit is unknown.
When second highest bit is clear, the rest bit[0:5] of this byte is the payload length; otherwise bit[0:5] is the higher byte of the payload length
|-
| 0x3
| 0x1
| When bit[6] of previous byte is set, this byte is the lower byte of the payload length; other wise this byte doesn't present
|-
| 0x3 or 0x4
| payload length
| payload
|-
| 0x3 or 0x4 +payload_length
| 0x1
| [[CRC-8-CCITT]] over data above (header + payload)
|-
|}

Talk:Services API

2017-01-24T07:46:12Z

Mailwl:

<s>there is yet another service: MP ("mp:u"), maybe add it to the list?</s>

Talk:Setting up Development Environment

2017-01-13T05:05:50Z

Mailwl:

IDE for windows, i tryed: CodeLite (a little better than Sublime, IMHO)

<strike>Should we have instructions for setting up the WSL? --[[User:Thejsa|Thejsa]] ([[User talk:Thejsa|talk]]) 10:39, 5 August 2016 (CEST)</strike>
* This is redundant now we have the MSDN link. Added note about not requiring Windows Insider status. --[[User:Thejsa|Thejsa]] ([[User talk:Thejsa|talk]]) 10:45, 5 August 2016 (CEST)

ACTU:GetErrorCode

2017-01-12T12:43:18Z

Mailwl: /* Response */

=Request=
{{IPC/Request}}
{{#vardefine:ipc_offset|0}}
{{IPC/RequestEntry|Header code [0x00020040]}}
{{IPC/RequestEntry|u32 input error code}}
{{IPC/RequestEnd}}

=Response=
{{IPC/Request}}
{{#vardefine:ipc_offset|0}}
{{IPC/RequestEntry|Header code}}
{{IPC/RequestEntry|Result code}}
{{IPC/RequestEntry|u32 Output value (not Result type)}}
{{IPC/RequestEnd}}

ACTU:GetErrorCode

2017-01-12T12:31:10Z

Mailwl: /* Response */

ACTU:GetErrorCode

2017-01-12T12:30:36Z

Mailwl: /* Request */

ACTU:GetErrorCode

2017-01-12T12:26:38Z

Mailwl: /* ACT:GetErrorCode first commit */

=Request=
{{IPC/Request}}
{{#vardefine:ipc_offset|0}}
{{IPC/RequestEntry|Header code [0x00020040]}}
{{IPC/RequestEnd}}

=Response=
{{IPC/Request}}
{{#vardefine:ipc_offset|0}}
{{IPC/RequestEntry|Header code}}
{{IPC/RequestEntry|Result code}}
{{IPC/RequestEntry|u32 Output value}}
{{IPC/RequestEnd}}

ACT Services

2017-01-12T12:20:41Z

Mailwl: /* ACT service "act:u" GetErrorCode*/

[[Category:Services]]

The ACT module handles NNID accounts.

= ACT service "act:u" =
These commands are common to both act:u and act:a

{| class="wikitable" border="1"
|-
! Command Header
! Available since system-version
! Description
|-
| 0x00010084
|
| [[ACT:Initialize|Initialize]]
|-
| 0x00020040
|
| [[ACT:GetErrorCode|GetErrorCode]]
|-
| 0x000600C2
|
| [[ACTU:GetAccountDataBlock|GetAccountDataBlock]]
|-
| 0x000B0042
|
| AcquireEulaList
|-
| 0x000D0040
|
| GenerateUuid
|}

= ACT service "act:a" =
These commands are exclusive to act:a

{| class="wikitable" border="1"
|-
! Command Header
! Available since system-version
! Description
|-
| 0x041300C2
|
| UpdateMiiImage
|-
| 0x041B0142
|
| AgreeEula
|-
| 0x04210042
|
| UploadMii
|-
| 0x04230082
|
| ValidateMailAddress
|}

This is the service used by regular applications.

=HTTPS Requests=

With each request, ACT-sysmodule specifies request-header "X-Nintendo-Device-Model". This is the only *dedicated* request-header that's contains anything Old3DS/New3DS specific. This was implemented with [[9.0.0-20|9.0.0-X]], and presumably [[8.1.0-0_New3DS]]. The value is from a string initialized during ACT-sysmodule startup. The value-string is the [[Cfg:GetSystemModel|codename]] string for all 5 of the model values from [[Cfg:GetSystemModel]]. When the output from GetSystemModel is >=5(switch statement default case), it runs this: "len = snprintf(outstr, outmaxsize, "3DS-%u", model);"

==Trusted Root CAs==
ACT module uses a [[HTTP_Services|RootCertChain]] for all HTTPS requests, the only trusted root CA is [[SSLC:RootCertChainAddDefaultCert|default]] CertID 0x3.

=New3DS=
Even though ACT-sysmodule uses [[PTM_Services|ptm:s]], it doesn't use CheckNew3DS at all.

ACTU:GetAccountDataBlock

2016-12-30T06:49:43Z

Mailwl: /* DataBlocks */

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x000600C2]
|-
| 1
| Unknown, usually 0xFE?
|-
| 2
| Size
|-
| 3
| BlkID
|-
| 4
| (Size<<4) <nowiki>|</nowiki> 12
|-
| 5
| Output buffer ptr
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code
|-
| 1
| Result code
|}

=Description=
This returns NNID account info.

=DataBlocks=
{| class="wikitable" border="1"
|-
! BlkID
! Size
! Description
|-
| 0x8
| 0x11
| ASCII NUL-terminated Nintendo Network ID
|-
| 0xB
| 0x3
| ASCII NUL-terminated Country Name
|-
| 0xC
| 0x4
| Principal ID
|-
| 0x13
| 0x1
| Gender
|-
| 0x19
| 0x8
| UTC offset
|-
| 0x1E
| 0x41
| ASCII Time Zone Location
|-
| 0x2C
| 0x2
| Age
|-
| 0x2F
| 0x4
| [[Config_Savegame#CountryInfo|CountryInfo]]
|}

NFC Services

2016-12-29T18:43:00Z

Mailwl: /* 9.3.0-X */

The New3DS NFC module was added with [[8.1.0-0_New3DS]]. The Old3DS NFC module was added with [[9.3.0-21|9.3.0-X]].

On New3DS NFC module uses the [[I2C_Registers|NFC]] hardware via the [[I2C_Services|i2c::NFC]] and [[GPIO_Services|gpio:NFC]] services. On Old3DS NFC module communicates with a NFC peripheral via IR with the IRUSER service.

A total of 6 sessions can be open simultaneously for all of these services combined.

=NFC services=
==NFC user service "nfc:u"==
This is the NFC service used by regular applications, for the NFP API.

This was first seen in the Super Smash Bros eShop demo (only in the exheader, the demo doesn't actually use it), but at that time no system-module was available for NFC on CDN. The first regular application to use this service was Super Smash Bros, with the v1.0.5 game-update, which used the new 9.3.0-X command set.

==NFC management service "nfc:m"==
{| class="wikitable" border="1"
|-
! Command Header
! Available since system-version
! Name
! Input
! Output
! Notes
|-
| 0x040100C2
| Unknown, <[[9.3.0-21|9.3.0-X]]
| ???
| u32 unknownA, u32 unknownB, u32 unknownC, u32 (sizeof(*buffer) << 14 <nowiki>|</nowiki> 0x402), void * buffer
| s32 result
|
|-
| 0x04020000
| [[9.3.0-21|9.3.0-X]]
| ???
| void
| s32 result, u32 unknownA[16]
| Output seems to be a struct
|-
| 0x04030000
| [[9.3.0-21|9.3.0-X]]
| ???
| void
| s32 result, u32 unknownA[41]
|
|-
| 0x04040A40
| [[9.3.0-21|9.3.0-X]]
| [[NFCM:SetAmiiboSettings|SetAmiiboSettings]]
|
|
|
|-
| 0x04060000
| [[9.3.0-21|9.3.0-X]]
| ???
| void
| s32 result
|
|-
| 0x04070000
| [[9.3.0-21|9.3.0-X]]
| ???
| void
| s32 result, u32 unknownA
|
|-
| 0x04080000
| [[9.3.0-21|9.3.0-X]]
| ???
| void
| s32 result, u32 unknownA
|
|-
| 0x040C0000
| [[9.3.0-21|9.3.0-X]]
| ?
| None
| s32 result
| Among other things, this will eventually call the savedata writing code referenced in the below savedata section.
|-
| 0x040D0000
| [[9.3.0-21|9.3.0-X]]
| ???
| void
| s32 result
|
|-
| 0x040E0000
| [[9.3.0-21|9.3.0-X]]
| ???
| void
| s32 result, u32 unknownA, u32 unknownB
| Again, amiibo applet ignores value unknownA.
|-
| 0x040F0000
| [[9.3.0-21|9.3.0-X]]
| ???
| void
| s32 result, u32 unknownA, u32 unknownB
|
|}

This is used by the [[amiibo Settings]] applet. This service has the above commands, in addition to the command-set listed below.

==NFC development service "nfc:dev"==
This service seems to be intended for use only on dev-units(or at least some of the command(s)).

Unlike the New3DS NFC-module, at least some of these commands are stubbed in the Old3DS NFC-module(only returns an error).

==NFC service "nfc:p"==
This service is used by the mint library-applet, starting with [[9.3.0-21]]. This service was added to the mint service-access-control list with [[9.0.0-20]].
The mint process is the only known eShop-related process using this service([[eShop]]-application and NIM-module don't use it). Presumably used for NFC card payments in JPN [[eShop]](the v16384 mint title is ''identical'' for USA/JPN besides programIDs in the NCCH header/exheader).

==NFC service "nfc:r"==
This service has no known use.

==NFC service "nfc:s"==
{| class="wikitable" border="1"
|-
! Command header
! Available since system-version
! Description
|-
| 0x00230000
|
| This writes the following command request data to [[I2C_Registers|I2C]], without reading any response: 10 20 00 01 01.
|-
| 0x00240000
|
| This writes the following command request data to [[I2C_Registers|I2C]], without reading any response: 10 40 00 03 00 0F 01.
|}

This service has no known use.

Unlike the New3DS NFC-module, at least some of these commands are stubbed in the Old3DS NFC-module(only returns an error).

="nfc:u" and "nfc:m" command set=
There are at least two different revisions of the NFC module. First version was introduced on New3DS only with firmware [[8.1.0-0_New3DS]]. Second version made its appearance with [[9.3.0-21|9.3.0-X]], on both Old3DS and New3DS.

These two versions are not interchangeable and not compatible, since the newer version uses a different command set and has no implemented commands from the older version. This does not introduce compatibility problems since no retail software used the NFC module, before the system titles added with [[9.3.0-21]] which use NFC.

==9.3.0-X==
{| class="wikitable" border="1"
|-
! Command Header
! Available since system-version
! Name
! Input
! Output
! Notes
|-
| 0x00010040
|
| [[NFC:Initialize|Initialize]]
| u8 inputval
| s32 result
|
|-
| 0x00020040
|
| [[NFC:Shutdown|Shutdown]]
| u8 inputval
| s32 result
|
|-
| 0x00030000
|
| [[NFC:StartCommunication|StartCommunication]]
| void
| s32 result
|
|-
| 0x00040000
|
| [[NFC:StopCommunication|StopCommunication]]
| void
| s32 result
|
|-
| 0x00050040
|
| [[NFC:StartTagScanning|StartTagScanning]]
| u16 inval
| s32 result
|
|-
| 0x00060000
|
| [[NFC:StopTagScanning|StopTagScanning]]
| void
| s32 result
|
|-
| 0x00070000
|
| [[NFC:LoadAmiiboData|LoadAmiiboData]]
|
|
|
|-
| 0x00080000
|
| [[NFC:ResetTagScanState|ResetTagScanState]]
|
|
|
|-
| 0x00090002
|
| [[NFC:UpdateStoredAmiiboData|UpdateStoredAmiiboData]]
|
|
|
|-
| 0x000A0000
|
| ???
| void
| s32 result
|
|-
| 0x000B0000
|
| GetTagInRangeEvent(?)
| void
| s32 result, u32 copy handle descriptor, Handle event
| amiibo applet ignores value 'descriptor'. It doesn't even read it from the command buffer.
|-
| 0x000C0000
|
| GetTagOutOfRangeEvent(?)
| void
| s32 result, u32 copy handle descriptor, Handle event
| amiibo applet also ignores value 'descriptor' for this command.
|-
| 0x000D0000
|
| [[NFC:GetTagState|GetTagState]]
| void
| s32 result, u8 outval
|
|-
| 0x000F0000
|
| [[NFC:CommunicationGetStatus|CommunicationGetStatus]]
|
|
|
|-
| 0x00100000
|
| [[NFC:GetTagInfo2|GetTagInfo2]]
|
|
|
|-
| 0x00110000
|
| [[NFC:GetTagInfo|GetTagInfo]]
|
|
|
|-
| 0x00120000
|
| [[NFC:CommunicationGetResult|CommunicationGetResult]]
|
|
|
|-
| 0x00130040
|
| [[NFC:OpenAppData|OpenAppData]]
|
|
|
|-
| 0x00140384
|
| [[NFC:InitializeWriteAppData|InitializeWriteAppData]]
|
|
|
|-
| 0x00150040
|
| [[NFC:ReadAppData|ReadAppData]]
|
|
|
|-
| 0x00160242
|
| [[NFC:WriteAppData|WriteAppData]]
|
|
|
|-
| 0x00170000
|
| [[NFC:GetAmiiboSettings|GetAmiiboSettings]]
|
|
|
|-
| 0x00180000
|
| [[NFC:GetAmiiboConfig|GetAmiiboConfig]]
|
|
|
|-
| 0x00190000
|
| [[NFC:GetAppDataInitStruct|GetAppDataInitStruct]]
|
|
|
|-
| 0x001A0000
|
|
| None
| No additional output.
|
|-
| 0x001B0000
|
|
| None
| 0x36-byte output structure starting at cmdreply[2].
|
|-
| 0x001C0040
| [[9.6.0-24|9.6.0-X]]
|
| u8 inputval
| No additional output.
| ?
|-
| 0x001D0040
| [[9.6.0-24|9.6.0-X]]
|
| u32 inputval
| No additional output.
| ?
|-
| 0x001E0040
| [[9.6.0-24|9.6.0-X]]
|
| u8 inputval
| u8 outval at cmdreply[2].
| ?
|}

==Pre-9.3.0-X==
{| class="wikitable" border="1"
|-
! Pre-9.3.0-X command header
! Command header starting with 9.3.0-X
! Available since system-version
! Description
|-
| 0x00010000
| ?
| [[8.1.0-0_New3DS]]
| Initialize
|-
| 0x00020000
| ?
| [[8.1.0-0_New3DS]]
| Shutdown
|-
| 0x00030000
| ?
| [[8.1.0-0_New3DS]]
| GetNFCState. This writes an output u8 to cmdreply[2]: 0 = not initialized, 1 = just initialized, 5 = data transfer ready, ...
|-
| 0x00040000
| 0x000B0000
| [[8.1.0-0_New3DS]]
| This writes an output handle to cmdreply[3].
|-
| 0x00050000
| 0x000C0000
| [[8.1.0-0_New3DS]]
| This writes an output handle to cmdreply[3].
|-
| 0x00060040
| ?
| [[8.1.0-0_New3DS]]
| (u8 input)
|-
| 0x00070000
| ?
| [[8.1.0-0_New3DS]]
| The user process must setup the output-buffer hdr+ptr data @ TLS+0x180 when using this. cmdreply[2] = actual output data size?
|-
| 0x00080100
| ?
| [[8.1.0-0_New3DS]]
| (<0x10-bytes starting at cmdreq[1]>)
|-
| 0x00090000
| ?
| [[8.1.0-0_New3DS]]
|
|-
| 0x000A0000
| ?
| [[8.1.0-0_New3DS]]
| The user process must setup the output-buffer hdr+ptr data @ TLS+0x180 when using this.
|-
| 0x000B0042
| ?
| [[8.1.0-0_New3DS]]
| (u32 size, ((Size<<14) <nowiki>|</nowiki> 2), inbufptr)
|-
| 0x000C0044
| ?
| [[8.1.0-0_New3DS]]
| (u32 size, 0x20, <procid set by kernel>, ((Size<<14) <nowiki>|</nowiki> 0x402), inbufptr)
|-
| 0x000D0040
| ?
| [[8.1.0-0_New3DS]]
| (u16 in)
|-
| 0x000E0000
| ?
| [[8.1.0-0_New3DS]]
|
|-
| 0x000F00C2
| ?
| [[8.1.0-0_New3DS]]
| (u32 unk0, u32 unk1, u32 unk2, ((Size<<14) <nowiki>|</nowiki> 0x802), inbufptr)
|-
| 0x00100040
| ?
| [[8.1.0-0_New3DS]]
| (u32 in)
|-
| 0x00110040
| ?
| [[8.1.0-0_New3DS]]
| (u32 in)
|-
| 0x00120040
| ?
| [[8.1.0-0_New3DS]]
| (u32 in)
|-
| 0x00130000
| ?
| [[8.1.0-0_New3DS]]
| Writes an output u32 to cmdreply[2].
|-
| 0x00140000
| ?
| [[8.1.0-0_New3DS]]
| This writes an output 0x30-byte struct starting at cmdreply[2].
|-
| 0x00150000
| 0x00110000
| [[8.1.0-0_New3DS]]
| This writes an output 0x2C-byte struct starting at cmdreply[2].
|-
| 0x00160000
| ?
| [[8.1.0-0_New3DS]]
|
|-
| 0x00170000
| ?
| [[8.1.0-0_New3DS]]
|
|}

=NFC services error codes=
{| class="wikitable" border="1"
|-
! Error-code
! Description
|-
| 0xc8a17600
| The current NFC tag [[NFC:GetTagState|state]], or other NFC state, is invalid with the NFC command which was used.
|}

=NFC module savedata=
* "/nfp_backup.dat" This contains raw data from the [[Amiibo]] NFC data pages. The filesize is 0x001fbd20-bytes. Certain service cmds will trigger writing to this savedata. This entire file is read during [[amiibo Settings]] startup, it's unknown what command(s) actually triggers that. It seems the Amiibo data here is updated each time the Amiibo NFC data is updated, and read each time the Amiibo NFC data is read. Data is written into this savedata when the Amiibo was never scanned on this system before. The data here is probably also updated when the scanned Amiibo NFC data doesn't match the data stored here.

During NFC writing, the NFC data being written can become corrupted if the Amiibo figure is moved outside of range during writing. When this happens, this nfp_backup data can be used to restore a previous version of that data prior to the last failed write.

==nfp_backup.dat structure==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x20
| Header
|-
| 0x20
| 0x800
| Amiibo data table header
|-
| 0x7D20
| 0x21C
| The NFC data for the first stored Amiibo is located here. This is the entire raw data from all 0x87 NFC data pages.
|}

===Header structure===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| Unknown, normally the following data? "00 00 02 00 02 00 00 00" (as little-endian u32s: 0x20000, 0x2)
|-
| 0x8
| 0x14
| Unknown, normally all-zero?
|-
| 0x1C
| 0x4
| Unknown. CRC32 / checksum maybe?
|}

===Amiibo data table header===
This is an array with 0x40(?) entries, where the size of each entry is 0x20-bytes. Entry structure:
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| First 8-bytes from [[Amiibo]] NFC serial-number.
|-
| 0x8
| 0x3
| Unknown, normally zero?
|-
| 0xB
| 0x2
| u16 little-endian date value for when this Amiibo was initially written into this savedata, with the same format from [[Amiibo|here]].
|-
| 0xD
| 0xF
| Unknown, normally zero?
|-
| 0x1C
| 0x4
| Unknown. CRC32 / checksum maybe?
|}

=NFC module versions=
{| class="wikitable" border="1"
|-
! System version
! New3DS title-version
! Old3DS title-version
! Changes
|-
| [[9.6.0-24|9.6.0-X]]
| v4102
| v4106
| New3DS and Old3DS: the only changes regarding new commands is that new commands were added for the nfcu/nfcm command-set and new commands for an unknown cmd-handler were added. It's unknown if there's other changes.
|}

=Errors=
{| class="wikitable" border="1"
|-
! Error code
! Description
|-
| 0xC8A17600
| This is returned when the current state is invalid for this command.
|-
| 0xC8A17620
| This is returned by [[NFC:OpenAppData]] when the appdata is uninitialized since [[NFC:InitializeWriteAppData]] wasn't used previously.
|-
| 0xC8A17628
| This is returned by [[NFC:GetAmiiboSettings]] when the amiibo wasn't setup by the amiibo Settings applet.
|-
| 0xC8A17638
| This is returned by [[NFC:OpenAppData]] when the input AppID doesn't match the actual Amiibo AppID.
|-
| 0xC8C1760C
| Returned for HMAC-hash mismatch(data corruption), with HMAC-calculation input_buffer_size=0x34.
|-
| 0xC8A17618
| HMAC-hash mismatch with input_buffer_size=0x1DF(see [[Amiibo|here]]).
|}

Talk:Services API

2016-12-27T05:21:43Z

Mailwl: Created page with "there is yet another service: MP ("mp:u"), maybe add it to the list?"

there is yet another service: MP ("mp:u"), maybe add it to the list?

I2C Services

2016-12-23T09:08:16Z

Mailwl: /* I2C Service */

[[Category:Services]]
= I2C Service Names =
{| class="wikitable" border="1"
|-
! Service names
! Notes
! Accessible [[I2C_Registers|deviceIDs]]
|-
| "i2c::MCU"
|
| 0, 3
|-
| "i2c::CAM"
|
| 1, 2, 4
|-
| "i2c::LCD"
|
| 5, 6
|-
| "i2c::DEB"
|
| 7, 8
|-
| "i2c::HID"
|
| 9, 10, 11, 12
|-
| "i2c::IR"
|
| 13, and additionally for New3DS i2c module: 17
|-
| "i2c::EEP"
|
| 14
|-
| "i2c::NFC"
| Only available via the New3DS i2c sysmodule.
| 15
|-
| "i2c::QTM"
| Only available via the New3DS i2c sysmodule.
| 16
|}

Each I2C service can only access certain I2C [[I2C_Registers|device(s)]]. When the specified deviceid isn't accessible, error 0xE0A02FEA is returned.

= I2C Service =
{| class="wikitable" border="1"
|-
! Command Header
! Available since system-version
! Description
|-
| 0x00010100
|
| SetRegisterBits8 (u8 devid, u8 regid, u8 regdata, u8 mask)
|-
| 0x000200C0
|
| EnableRegisterBits8 (u8 devid, u8 regid, u8 enablemask)
|-
| 0x000300C0
|
| DisableRegisterBits8 (u8 devid, u8 regid, u8 disablemask)
|-
| 0x00040102
|
| MultiSetRegisterBits16 (u16 regid, u16 regdata, u16 mask, devcount, u8* devidlistptr)
|-
| 0x000500C0
|
| WriteRegister8 (u8 devid, u8 regid, u8 regdata)
|-
| 0x00060080
|
| WriteCommand8 (u8 devid, u8 cmdid)
|-
| 0x0007....
|
| WriteRegister16 (u8 devid, u16 regid, u16 regdata)
|-
| 0x000800C2
|
| MultiWriteRegister16 (u16 regid, u16 regdata, devcount, u8* devidlistptr)
|-
| 0x00090080
|
| u8 ReadRegister8 (u8 devid, u8 regid)
|-
| 0x000A....
|
| u16 ReadRegister16 (u8 devid, u16 regid)
|-
| 0x000B00C2
|
| WriteRegisterBuffer8 (u8 devid, u8 regid, buffersize, (buffersize << 14) <nowiki>|</nowiki> 0x402, u8* bufferptr)
|-
| 0x000C00C2
|
| WriteRegisterBuffer16 (u8 devid, u16 regid, buffersize, (buffersize << 15) <nowiki>|</nowiki> 0x402, u16* bufferptr)
|-
| 0x000D00C0
|
| ReadRegisterBuffer8 (u8 devid, u8 regid, buffersize, +0x180: (buffersize << 14) <nowiki>|</nowiki> 2, +0x184: u8 bufferptr)
|-
| 0x000E00C2
|
| WriteRegisterBuffer8_again? (u8 devid, u8 regid, buffersize, u8* bufferptr)
|-
| 0x000F00C0
|
|
|-
| 0x0010....
|
|
|-
| 0x001100C2
|
| WriteRegisterBuffer(u8 devid, u16 regid, buffersize, u8 *buff)
|-
| 0x001200C2
|
| ReadRegisterBuffer(u8 devid, u16 regid, buffersize, u8 *buff)
|-
| 0x00130040
| [[8.0.0-18]]
| ReadDeviceRaw8(u8 devid) Writes the output read u8 I2C data to cmdreply[2]. After successfully selecting the I2C device, it writes 0xE1 to CNT then loads the output u8 I2C data from the DATA register.
|-
| 0x00140082
| [[8.0.0-18]]
| WriteDeviceRaw(u8 devid, u32 buffersize, (buffersize << 14) <nowiki>|</nowiki> 0x402, bufferptr) This is basically the write-data version of command 0x00150080.
|-
| 0x00150080
| [[8.0.0-18]]
| ReadDeviceRaw(u8 devid, u32 buffersize, +0x180: (buffersize << 14) <nowiki>|</nowiki> 2, +0x184: bufferptr) This is the >1-byte version of command 0x00130040, except value 0xF0 is used for CNT instead of 0xE1.
|}

Commands 0x00130040..0x00150080 are only usable with the New3DS i2c module: on Old3DS the actual command-handler function for each of these commands just return an error. Commands 0x00140082 and 0x00150080 are used by [[NFC_Services|NFC]] module.

IRRST:Initialize

2016-12-23T06:20:27Z

Mailwl: /* Response */

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x00020080]
|-
| 1
| u32, unknown
|-
| 2
| u8, unknown
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x00020040]
|-
| 1
| Result code
|}

IRRST:GetHandles

2016-12-23T06:17:29Z

Mailwl: /* Response */

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x00010000]
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x00010043]
|-
| 1
| Result code
|-
| 2
| 0x4000000, translate-header used by ARM11-kernel.
|-
| 3
| Output [[IRRST_Shared_Memory|shared-memory]] handle.
|-
| 4
| Output event handle.
|}

NWM Services

2016-12-22T06:44:42Z

Mailwl: /* NWM service "nwm::EXT" update command IDs*/

[[Category:Services]]

These NWM services are used for local-WLAN communications, NWM module handles regular wifi APs as well. These services are used for creating/connecting to networks, and for sending/receiving data over the network etc. NWM module uses the wifi SDIO hardware via the IO registers for this.

=NWM local-WLAN service "nwm::UDS"=
{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Description
|-
| 0x00010442
|
| Initialize Deprecated. Appears to be handled about the same way as [[NWMUDS:InitializeWithVersion]], except this uses version=0x100 internally instead of loading it from the command request.
|-
| 0x00020000
|
| Scrap Not used by sub-wars. This sets a state value to 0x2 then signals an event. This is probably some sort of shutdown command since this state write will result in all UDS commands returning an error if used afterwards.
|-
| 0x00030000
|
| [[NWMUDS:Shutdown|Shutdown]]
|-
| 0x00040402
|
| CreateNetwork Deprecated. Only used by very old titles.
|-
| 0x00050040
|
| [[NWMUDS:EjectClient|EjectClient]]
|-
| 0x00060000
|
| [[NWMUDS:EjectSpectator|EjectSpectator]]
|-
| 0x00070080
|
| [[NWMUDS:UpdateNetworkAttribute|UpdateNetworkAttribute]]
|-
| 0x00080000
|
| [[NWMUDS:DestroyNetwork|DestroyNetwork]]
|-
| 0x00090442
|
| ConnectNetwork Deprecated. Only used by very old titles.
|-
| 0x000A0000
|
| [[NWMUDS:DisconnectNetwork|DisconnectNetwork]]
|-
| 0x000B0000
|
| [[NWMUDS:GetConnectionStatus|GetConnectionStatus]]
|-
| 0x000C0000
|
| This writes two output u8 values to cmdreply[2] +0/+1. Not used by sub-wars.
|-
| 0x000D0040
|
| [[NWMUDS:GetNodeInformation|GetNodeInformation]]
|-
| 0x000E0006
|
| ''Identical'' to [[NWMUDS:DecryptBeaconData|DecryptBeaconData]]. Deprecated, only used by old titles.
|-
| 0x000F0404
|
| [[NWMUDS:RecvBeaconBroadcastData|RecvBeaconBroadcastData]]
|-
| 0x00100042
|
| [[NWMUDS:SetApplicationData|SetApplicationData]]
|-
| 0x00110040
|
| [[NWMUDS:GetApplicationData|GetApplicationData]]
|-
| 0x00120100
|
| [[NWMUDS:Bind|Bind]]
|-
| 0x00130040
|
| [[NWMUDS:Unbind|Unbind]]
|-
| 0x001400C0
|
| [[NWMUDS:PullPacket|PullPacket]]
|-
| 0x00150080
|
| SetMaxSendDelay(u64 unk) Not used by sub-wars.
|-
| 0x00160040
|
| (u8 inputval) Unknown. Not used by sub-wars.
|-
| 0x00170182
|
| [[NWMUDS:SendTo|SendTo]]
|-
| 0x00180040
|
| (u16 inputval) Unknown. Not used by sub-wars.
|-
| 0x00190040
|
| (u32 inputval) Unknown. Not used by sub-wars.
|-
| 0x001A0000
|
| [[NWMUDS:GetChannel|GetChannel]]
|-
| 0x001B0302
|
| [[NWMUDS:InitializeWithVersion|InitializeWithVersion]]
|-
| 0x001C0040
|
| (u8 inputval) Unknown. Not used by sub-wars.
|-
| 0x001D0044
| Unknown, >[[2.0.0-2]]
| [[NWMUDS:BeginHostingNetwork|BeginHostingNetwork]] This is a replacement for the original network-creation command.
|-
| 0x001E0084
| Unknown, >[[2.0.0-2]]
| [[NWMUDS:ConnectToNetwork|ConnectToNetwork]] This is a replacement for the original network-connection command.
|-
| 0x001F0006
| Unknown, >[[2.0.0-2]]
| [[NWMUDS:DecryptBeaconData|DecryptBeaconData]]
|-
| 0x00200040
| Unknown, >[[2.0.0-2]]
| Flush (u8 data_frame_index) Unknown. Not used by sub-wars.
|-
| 0x00210080
| Unknown, >[[2.0.0-2]]
| [[NWMUDS:SetProbeResponseParam|SetProbeResponseParam]]
|-
| 0x00220402
| Unknown, >[[2.0.0-2]]
| [[NWMUDS:ScanOnConnection|ScanOnConnection]]
|-
| 0x00230000
| Unknown, >[[2.0.0-2]]
| This writes an output u16 value to cmdreply[2]. Unknown. Not used by sub-wars.
|}

PullPacket is used for receiving data over the network and SendTo is for sending data over the network.

=NWM infrastructure service "nwm::INF"=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010000
| ?
|-
| 0x00020000
| ?
|-
| 0x00030000
| ?
|-
| 0x00040000
| ?
|-
| 0x00050000
| ?
|-
| 0x000603C4
| [[NWMINF:RecvBeaconBroadcastData|RecvBeaconBroadcastData]]
|-
| 0x00070742
| [[NWMINF:ConnectToEncryptedAP|ConnectToEncryptedAP]]
|-
| 0x00080302
| [[NWMINF:ConnectToAP|ConnectToAP]]
|-
| 0x00090000
| ?
|-
| 0x000A0000
| ?
|-
| 0x000B0000
| ?, return event handle in cmdbuf[3]
|-
| 0x000C0040
| ?
|-
| 0x000D0000
| ?
|-
| 0x000E0002
| ?
|-
| 0x000F0082
| ?
|-
| 0x00100040
| ?
|}

=NWM socket service "nwm::SOC"=

=NWM service "nwm::SAP"=

=NWM local-WLAN [[StreetPass]] service "nwm::CEC"=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00060002
| Unknown, called by CECD module, cmdbuf[2] takes an event handle.
|-
| 0x000D0082
| [[NWMCEC:SendProbeRequest|SendProbeRequest]]
|}

=NWM service "nwm::EXT"=
{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Description
|-
| 0x00010000
| <=[[2.0.0-2]]
| ?
|-
| 0x00020000
| <=[[2.0.0-2]]
| ?
|-
| 0x00030000
| <=[[2.0.0-2]]
| ?
|-
| 0x00040040
| <=[[2.0.0-2]]
| ?
|-
| 0x00050002
| <=[[2.0.0-2]]
| ?
|-
| 0x00060000
| <=[[2.0.0-2]]
| ?
|-
| 0x00070000
| <=[[2.0.0-2]]
| This copies 0x1C-bytes from NWM-module state to the data starting at cmdreply[2].
|-
| 0x00080040
| <=[[2.0.0-2]]
| [[NWMEXT:ControlWirelessEnabled|ControlWirelessEnabled]]
|-
| 0x00090000
| <=[[2.0.0-2]]
| ?
|}

=NWM service "nwm::TST"=

=BeaconDataReply Structure=
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Max output size, from the command request.
|-
| 0x4
| 0x4
| Total amount of output data written relative to struct+0. 0xC when there's no entries.
|-
| 0x8
| 0x4
| Total entries, 0 for none.
|-
| 0xC
| <Rest of the structure>
| Beacon entries.
|}

Beacon entry:
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Size of this entire entry. The next entry starts at curentry_startoffset+curentry_size.
|-
| 0x4
| 0x1
| ?
|-
| 0x5
| 0x1
| AP wifi channel.
|-
| 0x6
| 0x1
| ?
|-
| 0x7
| 0x1
| ?
|-
| 0x8
| 0x6
| AP MAC address.
|-
| 0xE
| 0x6
| ?
|-
| 0x14
| 0x4
| ?
|-
| 0x18
| 0x4
| Value 0x1C(size of this header and/or offset to the actual beacon data).
|-
| 0x1C
| Entry_size - 0x1C
| The actual beacon data is located here, starting at the 802.11 management frame header.
|}

This section describes the structure returned by [[NWMINF:RecvBeaconBroadcastData]] and [[NWMUDS:RecvBeaconBroadcastData]].

=ScanInputStruct=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Two unknown u16s.
|-
| 1
| Two unknown u16s.
|-
| 2-3
| Host MAC address. The 6-bytes located here are normally all 0xFF, for all hosts. Otherwise when not set to broadcast-MAC, the command will only return info for the specified host MAC address.
|-
| 4-12
| Uninitialized for UDS.
|}

This section describes the 0x34-byte input structure used by [[NWMINF:RecvBeaconBroadcastData]] and [[NWMUDS:RecvBeaconBroadcastData]].

=Local-WLAN=
UDS is used for 3DS<>3DS local-WLAN communications, and for 3DS<>Wii U communications. The latter is mainly only used for multi-player in games.

All UDS local-WLAN communications have the CCMP key for data encryption generated via NWM module. The CCMP key passed to nwm::CEC commands(stored in a 0x44-byte input structure) for [[StreetPass]] is generated by the CECD module. The input data used with [[Process_Services|EncryptDecryptAes]] with [[PSPXI:EncryptDecryptAes|keytype1]] is a MD5 hash over the input passphrase. This input passphrase is fixed for [[Download Play]], it's unique per local-WLAN application. The CTR is a MD5 hash over the below 0x10-byte structure. The output from encrypting that data with AES-CTR is the final CCMP key. This passphrase is a raw input buffer: while the passphrase specified by user-processes is normally a string with the NUL-terminator included, it can be anything(like the [[DLP_Services|WirelessRebootPassphrase]] for example).

The maximum number of nodes(including the host) which can be on an UDS network is 16.

==NodeID==
There are two types of client connections: regular Client, and Spectator. The latter ''never'' sends ''any'' 802.11 frame at all to the host, hence ''nothing'' actually connected to the network(including the host) can know about any spectators. Once a spectator is "connected" to a network, it can only receive broadcasted data, no sending.

DLP-client connects to the network as a spectator during DLP scanning to get various [[Download_Play|metadata]] including icon data.

===NetworkNodeID===
This is the network u16 ID for each device on the UDS network. NodeID 0xFFFF is a broadcast alias. 0x1 is for the host, the 0x2 for the first client, 0x3 for the second client, and so on.

The spectator doesn't have a NetworkNodeID, since it can't [[NWMUDS:SendTo|send]] any data.

NetworkNodeIDs for clients do not change when any clients disconnect, likewise for the encrypted node-listing stored in the wifi beacons. When a client disconnects, the corresponding NetworkNodeID bit in the [[NWMUDS:GetConnectionStatus|node_bitmask]] is cleared. When a client is connecting, the client is assigned the NetworkNodeID with the lowest corresponding clear-bit in the [[NWMUDS:GetConnectionStatus|node_bitmask]], then that bit is set.

===BindNodeID===
This u32 is an ID only used on the local device. How many devices are on the network or which device this system is does not affect this ID.

The spectator uses BindNodeID 0x1. DLP uses BindNodeID 0x3 when connecting as an actual client. Hence, it seems BindNodeID bit0 is spectator-related. All normal nodes(host/client) start with BindNodeID 0x2. When connecting to a network again(and probably with network creation) without reinitializing NWMUDS, official user processes increase the used BindNodeID by 0x2.

BindNodeID value 0x0 is invalid. The maximum number of BindNodeIDs which can be open at the same time is 16.

==Application data transfer==
The protocol used for sending/receiving data over the network with UDS by official applications is [[PRUDP]](in some cases at least). Mario Kart 7 uses PRUDP here. Triforce Heroes uses plaintext for whatever protocol it uses for UDS.

The UDS version of [[PRUDP]] is different from the normal UDP version it appears(no afa1/a1af data for example).

==Data frames==
Data is transferred over the network using [[NWMUDS:PullPacket]]/[[NWMUDS:SendTo]]. That data is transferred using 802.11 data frames using CCMP encryption. The encrypted data contained in the frame starts with the 0x10-byte LLC header, then the 0xE-byte NWM header, followed by the actual application data from the previously mentioned commands. When [[NWMUDS:SendTo]] was used with dst_NodeID = broadcast, the data frame is sent to the 802.11 broadcast MAC address. Otherwise with a specific NodeID, the data frame is sent to the actual MAC address for that device.

Official application data is normally stored here as big-endian.

==Structure used for generating the CTR for CCMP key generation==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| wlancommID
|-
| 0x4
| 0x4
| networkID
|-
| 0x8
| 0x6
| Host MAC address.
|-
| 0xE
| 0x2
| id8
|}

This data is stored as little-endian.

==CTR used for beacon tags crypto==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x6
| Host MAC address
|-
| 0x6
| 0x4
| wlancommID
|-
| 0xA
| 0x1
| id8
|-
| 0xB
| 0x1
| Padding, value zero.
|-
| 0xC
| 0x4
| networkID
|}

This data is stored as little-endian. All data here is all-zero except for the MAC address, when the u8 at offset 0x8 in the network-struct is 0.

==Network structure==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x6
| This is the MAC address of the host. This is used for when [[NWMUDS:ConnectToNetwork|connecting]] to the network.
|-
| 0x6
| 0x1
| This is actually written as an u16 without byte-swapping. This is the network wifi channel. When connecting this is normally non-zero. When hosting, this can be 0 to automatically select a channel, otherwise the specified channel is used. When non-zero official user-processes require this value to be one of the following when hosting: 1, 6, or 11.
|-
| 0x7
| 0x1
| Padding
|-
| 0x8
| 0x1
| Initialized flag. Must be non-zero otherwise NWM-module will use value 0x0 for most/all(?) fields in this structure when reading these fields.
|-
| 0xC
| 0x3
| This is the OUI value for use with the beacon tags. Normally this is 001F32.
|-
| 0xF
| 0x1
| OUI type (21/0x15)
|-
| 0x10
| 0x4
| wlancommID. Local-WLAN communication ID, normally this is: (user_process [[Title_list|uniqueID]] << 8) | val. Where val is 0x10 on retail([[Configuration_Memory|configmem]] UNITINFO bit0 set), 0x90 for devunit. Official software includes an input bool flag parameter for setting bit0 in this wlancommID, normally that flag isn't set. For [[Download Play]], this is always 0x2810 on retail(0x2890 on devunit).

This wlancommID can have the side affect of region-locking when the title uses the uniqueID for the current title(hard-coded in .text normally), instead of using a fixed input uniqueID for each region of the title.
|-
| 0x14
| 0x1
| id8. ID, for [[Download Play]] this is 0x55. 0x55/'U' seems to be used for networks where Wii U can host it(Download Play, Smash Bros, ...) - this value isn't known to be actually checked anywhere however.
|-
| 0x15
| 0x1
| Some sort of counter for how many times this network was connected to?
|-
| 0x16
| 0x2
| This network attributes u16 bitmask can be written via [[NWMUDS:UpdateNetworkAttribute]].
Bitmasks:
* 0x1: When set, spectators are not allowed to connect(see [[NWMUDS:EjectSpectator|here]]). Checked by official user-processes before using [[NWMUDS:ConnectToNetwork]], when connecting as a Spectator. Must be clear otherwise that code returns error 0xE10113EA. If the initialized_flag at offset 0x8 is zero, this code handles it the same way as if this bit was set. The latest NWM-module handles checking this bit itself however.
* 0x2: When set, new regular-clients are not allowed to connect.
* 0x4: Unknown, has no affect on new clients/spectators connecting. Official software has an option for setting this bit via an input flag from the same code using bitmask 0x2. Official software always clears bitmask 0x6 when unblocking new connections.
|-
| 0x18
| 0x4
| u32 networkID, randomly-generated when creating the network. The network SSID used when a client connects to the network is sprintf(out, "%08X", networkID).
|-
| 0x1C
| 0x1
| Total number of currently connected nodes, including the host.
|-
| 0x1D
| 0x1
| Maximum number of nodes, including the host. This also is the total number of entries stored under the array in the encrypted beacon data.
|-
| 0x1E
| 0x1
| ?
|-
| 0x1F
| 0x1
| ?
|-
| 0x3F
| 0x1
| Size of appdata.
|-
| 0x40
| 0xC8
| Appdata(Application data), if any. Size of the appdata is specified via the u8 at offset 0x3F. This data is not used when the size-field is zero.
|}

This 0x108-byte structure is used for [[NWMUDS:BeginHostingNetwork]], [[NWMUDS:ConnectToNetwork]], etc. This data is stored as big-endian.

==NodeInfo structure==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| u64 ID, this is the UDS version of the FriendCodeSeed. This is loaded from BlkID 0x00090000 in the [[Config_Savegame|system-config]] via [[CfgS:GetConfigInfoBlk2]].
|-
| 0x8
| 0x14
| The first 0x18-bytes from BlkID 0x000A0000 in the [[Config_Savegame|system-config]] loaded via [[CfgS:GetConfigInfoBlk2]] is written here by user-processes. However, the data at +0x14(absolute offset 0x1C) is written by NWM-module later.
|-
| 0x1C
| 0x2
| u16, unknown. Set to 0x0 with the output from [[NWMUDS:DecryptBeaconData]].
|-
| 0x1E
| 0x1
| u8 flag, unknown. Originates from the u16 bitmask in the beacon node-list header. This flag is normally 0 since that bitmask is normally 0?
|-
| 0x1F
| 0x1
| Padding?
|-
| 0x20
| 0x2
| u16 NetworkNodeID
|-
| 0x22
| 0x6
| Normally zero?
|}

The first 0x20-bytes are written by the user-process before using this structure with [[NWMUDS:InitializeWithVersion]]. The data starting at offset 0x8 is only initialized by NWM-module.

== UDS Beacons ==
The UDS host broadcasts a beacon containing at least two Nintendo-vendor tags(tag number 0xDD, see above for the OUI), normally the data stored in these tags are static. The second tag contains the big-endian u32 networkID, used by the clients when connecting to the host and for the above CCMP key generation. The Nintendo-vendor tag(s) following the first two are unique to the process using UDS, these tags are used for broadcasting metadata regarding the host.

A tool for these beacons is available here: [https://github.com/yellows8/ctr-wlanbeacontool]

=== UDS Beacon Tags ===
The following is the structure of each tag, starting at the OUI. The order of the tags is the same as listed below. All data stored under these tags are stored as big-endian.

==== OUI Type 20 ====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x3
| OUI, see above.
|-
| 0x3
| 0x1
| OUI type (20/0x14)
|-
| 0x4
| 0x3
| Sample data: 0a 00 00
|}

Normally the size of this tag(from the tag size field) is 0x07.

==== OUI Type 21 ====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1F
| This is the network structure starting at offset 0xC, with the first 0x1F-bytes from there.
|-
| 0x1F
| 0x14
| SHA1 hash. When doing the hashing, this hash is cleared to zero. The hash data starts at offset 0x0(OUI), and the size is 0x34 + <value of the u8 at offset 0x33>.
|-
| 0x33
| 0x1
| Size of appdata. Normally zero. When non-zero this appdata is located at offset 0x34.
|}

Normally the size of this tag(from the tag size field) is 0x34, not including appdata.

==== OUI Type 24 ====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x3
| OUI, see above.
|-
| 0x3
| 0x1
| OUI type (24/0x18)
|-
| 0x4
| See below
| Encrypted data
|}

This is the tag0 used with [[NWMUDS:DecryptBeaconData]]. The size of data stored under this tag has a maximum size of 0xFA-bytes, however normally the size is smaller than that. Additional encrypted data, if any, is stored under the below tag1.

==== OUI Type 25 ====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x3
| OUI, see above.
|-
| 0x3
| 0x1
| OUI type (25/0x19)
|-
| 0x4
| See above
| Encrypted data
|}

When this exists in the beacon, this is the tag1 used with [[NWMUDS:DecryptBeaconData]]. The data stored here is the 0xFA-bytes following the previous encrypted data in tag0, for more space for storing the encrypted data.

==== Encrypted beacon data ====
The following structure is for the plaintext version of the encrypted data, stored as big-endian.

This data is encrypted with AES-CTR, by NWM module in software. The AES key is stored in NWM module itself. See above for the CTR. The size of this encrypted data is 0x12 + (0x1E*val), where val is the u8 from networkstruct offset 0x1D.

===== Structure =====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x10
| MD5 over the rest of the data following this(plaintext).
|-
| 0x10
| 0x2
| u16 bitmask. Unknown, normally 0? Bit0 is for entry0, bit1 for entry1, and so on.
|-
| 0x12
| 0x1E * <total array entries>
| This is an array of entries for each of the devices on this network, the first entry is for the host and the rest is for the client(s).
|}

===== Array entry =====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1C
| This is the first 0x1C-bytes of the NodeInfo structure, stored as big-endian.
|-
| 0x1C
| 0x2
| u16 NetworkNodeID, stored as big-endian.
|}

Each entry is for a node.

= Mapped IO =
''All'' of the [[IO_Registers|IO]] mapped under the NWM-module process is listed below:

{| class="wikitable" border="1"
|-
! Userland address
! Physical address
! Size
! Description
|-
| 0x1EC22000
| 0x10122000
| 0x1000
| [[WIFI_Registers]]
|-
| 0x1EC40000
| 0x10140000
| 0x1000
| [[PDN_Registers]]
|-
| 0x1EE22000
| 0x10322000
| 0x1000
|
|}

=Errors=
{| class="wikitable" border="1"
|-
! Error code
! Description
|-
| 0xC8A06C0D
| The operation being performed is already done (e.g., if you run NWMEXT_ControlWirelessEnabled to turn wifi on when it's on already, you can't turn it on again).
|-
| 0xC8A113EA
| Returned when the command isn't allowed to be used on this device.
|-
| 0xC90113FA
| Node doesn't exist / invalid NetworkNodeID?
|-
| 0xC92113FB
| Returned when trying to connect to a host when the host has the specified connection-type blocked via the network attributes. There might be other causes too.
|-
| 0xE10113E9
| Returned when the input size is invalid. Returned by [[NWMUDS:PullPacket]] when the input size is smaller than the frame_size.
|-
| 0xE10113EA
| Invalid bind / data_channel is invalid(0x0).
|}

NWM Services

2016-12-22T06:36:27Z

Mailwl: /* NWM infrastructure service "nwm::INF", add command IDS */

[[Category:Services]]

These NWM services are used for local-WLAN communications, NWM module handles regular wifi APs as well. These services are used for creating/connecting to networks, and for sending/receiving data over the network etc. NWM module uses the wifi SDIO hardware via the IO registers for this.

=NWM local-WLAN service "nwm::UDS"=
{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Description
|-
| 0x00010442
|
| Initialize Deprecated. Appears to be handled about the same way as [[NWMUDS:InitializeWithVersion]], except this uses version=0x100 internally instead of loading it from the command request.
|-
| 0x00020000
|
| Scrap Not used by sub-wars. This sets a state value to 0x2 then signals an event. This is probably some sort of shutdown command since this state write will result in all UDS commands returning an error if used afterwards.
|-
| 0x00030000
|
| [[NWMUDS:Shutdown|Shutdown]]
|-
| 0x00040402
|
| CreateNetwork Deprecated. Only used by very old titles.
|-
| 0x00050040
|
| [[NWMUDS:EjectClient|EjectClient]]
|-
| 0x00060000
|
| [[NWMUDS:EjectSpectator|EjectSpectator]]
|-
| 0x00070080
|
| [[NWMUDS:UpdateNetworkAttribute|UpdateNetworkAttribute]]
|-
| 0x00080000
|
| [[NWMUDS:DestroyNetwork|DestroyNetwork]]
|-
| 0x00090442
|
| ConnectNetwork Deprecated. Only used by very old titles.
|-
| 0x000A0000
|
| [[NWMUDS:DisconnectNetwork|DisconnectNetwork]]
|-
| 0x000B0000
|
| [[NWMUDS:GetConnectionStatus|GetConnectionStatus]]
|-
| 0x000C0000
|
| This writes two output u8 values to cmdreply[2] +0/+1. Not used by sub-wars.
|-
| 0x000D0040
|
| [[NWMUDS:GetNodeInformation|GetNodeInformation]]
|-
| 0x000E0006
|
| ''Identical'' to [[NWMUDS:DecryptBeaconData|DecryptBeaconData]]. Deprecated, only used by old titles.
|-
| 0x000F0404
|
| [[NWMUDS:RecvBeaconBroadcastData|RecvBeaconBroadcastData]]
|-
| 0x00100042
|
| [[NWMUDS:SetApplicationData|SetApplicationData]]
|-
| 0x00110040
|
| [[NWMUDS:GetApplicationData|GetApplicationData]]
|-
| 0x00120100
|
| [[NWMUDS:Bind|Bind]]
|-
| 0x00130040
|
| [[NWMUDS:Unbind|Unbind]]
|-
| 0x001400C0
|
| [[NWMUDS:PullPacket|PullPacket]]
|-
| 0x00150080
|
| SetMaxSendDelay(u64 unk) Not used by sub-wars.
|-
| 0x00160040
|
| (u8 inputval) Unknown. Not used by sub-wars.
|-
| 0x00170182
|
| [[NWMUDS:SendTo|SendTo]]
|-
| 0x00180040
|
| (u16 inputval) Unknown. Not used by sub-wars.
|-
| 0x00190040
|
| (u32 inputval) Unknown. Not used by sub-wars.
|-
| 0x001A0000
|
| [[NWMUDS:GetChannel|GetChannel]]
|-
| 0x001B0302
|
| [[NWMUDS:InitializeWithVersion|InitializeWithVersion]]
|-
| 0x001C0040
|
| (u8 inputval) Unknown. Not used by sub-wars.
|-
| 0x001D0044
| Unknown, >[[2.0.0-2]]
| [[NWMUDS:BeginHostingNetwork|BeginHostingNetwork]] This is a replacement for the original network-creation command.
|-
| 0x001E0084
| Unknown, >[[2.0.0-2]]
| [[NWMUDS:ConnectToNetwork|ConnectToNetwork]] This is a replacement for the original network-connection command.
|-
| 0x001F0006
| Unknown, >[[2.0.0-2]]
| [[NWMUDS:DecryptBeaconData|DecryptBeaconData]]
|-
| 0x00200040
| Unknown, >[[2.0.0-2]]
| Flush (u8 data_frame_index) Unknown. Not used by sub-wars.
|-
| 0x00210080
| Unknown, >[[2.0.0-2]]
| [[NWMUDS:SetProbeResponseParam|SetProbeResponseParam]]
|-
| 0x00220402
| Unknown, >[[2.0.0-2]]
| [[NWMUDS:ScanOnConnection|ScanOnConnection]]
|-
| 0x00230000
| Unknown, >[[2.0.0-2]]
| This writes an output u16 value to cmdreply[2]. Unknown. Not used by sub-wars.
|}

PullPacket is used for receiving data over the network and SendTo is for sending data over the network.

=NWM infrastructure service "nwm::INF"=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010000
| ?
|-
| 0x00020000
| ?
|-
| 0x00030000
| ?
|-
| 0x00040000
| ?
|-
| 0x00050000
| ?
|-
| 0x000603C4
| [[NWMINF:RecvBeaconBroadcastData|RecvBeaconBroadcastData]]
|-
| 0x00070742
| [[NWMINF:ConnectToEncryptedAP|ConnectToEncryptedAP]]
|-
| 0x00080302
| [[NWMINF:ConnectToAP|ConnectToAP]]
|-
| 0x00090000
| ?
|-
| 0x000A0000
| ?
|-
| 0x000B0000
| ?, return event handle in cmdbuf[3]
|-
| 0x000C0040
| ?
|-
| 0x000D0000
| ?
|-
| 0x000E0002
| ?
|-
| 0x000F0082
| ?
|-
| 0x00100040
| ?
|}

=NWM socket service "nwm::SOC"=

=NWM service "nwm::SAP"=

=NWM local-WLAN [[StreetPass]] service "nwm::CEC"=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00060002
| Unknown, called by CECD module, cmdbuf[2] takes an event handle.
|-
| 0x000D0082
| [[NWMCEC:SendProbeRequest|SendProbeRequest]]
|}

=NWM service "nwm::EXT"=
{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Description
|-
| 0x0001....
| <=[[2.0.0-2]]
| ?
|-
| 0x0002....
| <=[[2.0.0-2]]
| ?
|-
| 0x0003....
| <=[[2.0.0-2]]
| ?
|-
| 0x0004....
| <=[[2.0.0-2]]
| ?
|-
| 0x0005....
| <=[[2.0.0-2]]
| ?
|-
| 0x0006....
| <=[[2.0.0-2]]
| ?
|-
| 0x00070000
| <=[[2.0.0-2]]
| This copies 0x1C-bytes from NWM-module state to the data starting at cmdreply[2].
|-
| 0x00080040
| <=[[2.0.0-2]]
| [[NWMEXT:ControlWirelessEnabled|ControlWirelessEnabled]]
|-
| 0x0009....
| <=[[2.0.0-2]]
| ?
|}

=NWM service "nwm::TST"=

=BeaconDataReply Structure=
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Max output size, from the command request.
|-
| 0x4
| 0x4
| Total amount of output data written relative to struct+0. 0xC when there's no entries.
|-
| 0x8
| 0x4
| Total entries, 0 for none.
|-
| 0xC
| <Rest of the structure>
| Beacon entries.
|}

Beacon entry:
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Size of this entire entry. The next entry starts at curentry_startoffset+curentry_size.
|-
| 0x4
| 0x1
| ?
|-
| 0x5
| 0x1
| AP wifi channel.
|-
| 0x6
| 0x1
| ?
|-
| 0x7
| 0x1
| ?
|-
| 0x8
| 0x6
| AP MAC address.
|-
| 0xE
| 0x6
| ?
|-
| 0x14
| 0x4
| ?
|-
| 0x18
| 0x4
| Value 0x1C(size of this header and/or offset to the actual beacon data).
|-
| 0x1C
| Entry_size - 0x1C
| The actual beacon data is located here, starting at the 802.11 management frame header.
|}

This section describes the structure returned by [[NWMINF:RecvBeaconBroadcastData]] and [[NWMUDS:RecvBeaconBroadcastData]].

=ScanInputStruct=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Two unknown u16s.
|-
| 1
| Two unknown u16s.
|-
| 2-3
| Host MAC address. The 6-bytes located here are normally all 0xFF, for all hosts. Otherwise when not set to broadcast-MAC, the command will only return info for the specified host MAC address.
|-
| 4-12
| Uninitialized for UDS.
|}

This section describes the 0x34-byte input structure used by [[NWMINF:RecvBeaconBroadcastData]] and [[NWMUDS:RecvBeaconBroadcastData]].

=Local-WLAN=
UDS is used for 3DS<>3DS local-WLAN communications, and for 3DS<>Wii U communications. The latter is mainly only used for multi-player in games.

All UDS local-WLAN communications have the CCMP key for data encryption generated via NWM module. The CCMP key passed to nwm::CEC commands(stored in a 0x44-byte input structure) for [[StreetPass]] is generated by the CECD module. The input data used with [[Process_Services|EncryptDecryptAes]] with [[PSPXI:EncryptDecryptAes|keytype1]] is a MD5 hash over the input passphrase. This input passphrase is fixed for [[Download Play]], it's unique per local-WLAN application. The CTR is a MD5 hash over the below 0x10-byte structure. The output from encrypting that data with AES-CTR is the final CCMP key. This passphrase is a raw input buffer: while the passphrase specified by user-processes is normally a string with the NUL-terminator included, it can be anything(like the [[DLP_Services|WirelessRebootPassphrase]] for example).

The maximum number of nodes(including the host) which can be on an UDS network is 16.

==NodeID==
There are two types of client connections: regular Client, and Spectator. The latter ''never'' sends ''any'' 802.11 frame at all to the host, hence ''nothing'' actually connected to the network(including the host) can know about any spectators. Once a spectator is "connected" to a network, it can only receive broadcasted data, no sending.

DLP-client connects to the network as a spectator during DLP scanning to get various [[Download_Play|metadata]] including icon data.

===NetworkNodeID===
This is the network u16 ID for each device on the UDS network. NodeID 0xFFFF is a broadcast alias. 0x1 is for the host, the 0x2 for the first client, 0x3 for the second client, and so on.

The spectator doesn't have a NetworkNodeID, since it can't [[NWMUDS:SendTo|send]] any data.

NetworkNodeIDs for clients do not change when any clients disconnect, likewise for the encrypted node-listing stored in the wifi beacons. When a client disconnects, the corresponding NetworkNodeID bit in the [[NWMUDS:GetConnectionStatus|node_bitmask]] is cleared. When a client is connecting, the client is assigned the NetworkNodeID with the lowest corresponding clear-bit in the [[NWMUDS:GetConnectionStatus|node_bitmask]], then that bit is set.

===BindNodeID===
This u32 is an ID only used on the local device. How many devices are on the network or which device this system is does not affect this ID.

The spectator uses BindNodeID 0x1. DLP uses BindNodeID 0x3 when connecting as an actual client. Hence, it seems BindNodeID bit0 is spectator-related. All normal nodes(host/client) start with BindNodeID 0x2. When connecting to a network again(and probably with network creation) without reinitializing NWMUDS, official user processes increase the used BindNodeID by 0x2.

BindNodeID value 0x0 is invalid. The maximum number of BindNodeIDs which can be open at the same time is 16.

==Application data transfer==
The protocol used for sending/receiving data over the network with UDS by official applications is [[PRUDP]](in some cases at least). Mario Kart 7 uses PRUDP here. Triforce Heroes uses plaintext for whatever protocol it uses for UDS.

The UDS version of [[PRUDP]] is different from the normal UDP version it appears(no afa1/a1af data for example).

==Data frames==
Data is transferred over the network using [[NWMUDS:PullPacket]]/[[NWMUDS:SendTo]]. That data is transferred using 802.11 data frames using CCMP encryption. The encrypted data contained in the frame starts with the 0x10-byte LLC header, then the 0xE-byte NWM header, followed by the actual application data from the previously mentioned commands. When [[NWMUDS:SendTo]] was used with dst_NodeID = broadcast, the data frame is sent to the 802.11 broadcast MAC address. Otherwise with a specific NodeID, the data frame is sent to the actual MAC address for that device.

Official application data is normally stored here as big-endian.

==Structure used for generating the CTR for CCMP key generation==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| wlancommID
|-
| 0x4
| 0x4
| networkID
|-
| 0x8
| 0x6
| Host MAC address.
|-
| 0xE
| 0x2
| id8
|}

This data is stored as little-endian.

==CTR used for beacon tags crypto==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x6
| Host MAC address
|-
| 0x6
| 0x4
| wlancommID
|-
| 0xA
| 0x1
| id8
|-
| 0xB
| 0x1
| Padding, value zero.
|-
| 0xC
| 0x4
| networkID
|}

This data is stored as little-endian. All data here is all-zero except for the MAC address, when the u8 at offset 0x8 in the network-struct is 0.

==Network structure==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x6
| This is the MAC address of the host. This is used for when [[NWMUDS:ConnectToNetwork|connecting]] to the network.
|-
| 0x6
| 0x1
| This is actually written as an u16 without byte-swapping. This is the network wifi channel. When connecting this is normally non-zero. When hosting, this can be 0 to automatically select a channel, otherwise the specified channel is used. When non-zero official user-processes require this value to be one of the following when hosting: 1, 6, or 11.
|-
| 0x7
| 0x1
| Padding
|-
| 0x8
| 0x1
| Initialized flag. Must be non-zero otherwise NWM-module will use value 0x0 for most/all(?) fields in this structure when reading these fields.
|-
| 0xC
| 0x3
| This is the OUI value for use with the beacon tags. Normally this is 001F32.
|-
| 0xF
| 0x1
| OUI type (21/0x15)
|-
| 0x10
| 0x4
| wlancommID. Local-WLAN communication ID, normally this is: (user_process [[Title_list|uniqueID]] << 8) | val. Where val is 0x10 on retail([[Configuration_Memory|configmem]] UNITINFO bit0 set), 0x90 for devunit. Official software includes an input bool flag parameter for setting bit0 in this wlancommID, normally that flag isn't set. For [[Download Play]], this is always 0x2810 on retail(0x2890 on devunit).

This wlancommID can have the side affect of region-locking when the title uses the uniqueID for the current title(hard-coded in .text normally), instead of using a fixed input uniqueID for each region of the title.
|-
| 0x14
| 0x1
| id8. ID, for [[Download Play]] this is 0x55. 0x55/'U' seems to be used for networks where Wii U can host it(Download Play, Smash Bros, ...) - this value isn't known to be actually checked anywhere however.
|-
| 0x15
| 0x1
| Some sort of counter for how many times this network was connected to?
|-
| 0x16
| 0x2
| This network attributes u16 bitmask can be written via [[NWMUDS:UpdateNetworkAttribute]].
Bitmasks:
* 0x1: When set, spectators are not allowed to connect(see [[NWMUDS:EjectSpectator|here]]). Checked by official user-processes before using [[NWMUDS:ConnectToNetwork]], when connecting as a Spectator. Must be clear otherwise that code returns error 0xE10113EA. If the initialized_flag at offset 0x8 is zero, this code handles it the same way as if this bit was set. The latest NWM-module handles checking this bit itself however.
* 0x2: When set, new regular-clients are not allowed to connect.
* 0x4: Unknown, has no affect on new clients/spectators connecting. Official software has an option for setting this bit via an input flag from the same code using bitmask 0x2. Official software always clears bitmask 0x6 when unblocking new connections.
|-
| 0x18
| 0x4
| u32 networkID, randomly-generated when creating the network. The network SSID used when a client connects to the network is sprintf(out, "%08X", networkID).
|-
| 0x1C
| 0x1
| Total number of currently connected nodes, including the host.
|-
| 0x1D
| 0x1
| Maximum number of nodes, including the host. This also is the total number of entries stored under the array in the encrypted beacon data.
|-
| 0x1E
| 0x1
| ?
|-
| 0x1F
| 0x1
| ?
|-
| 0x3F
| 0x1
| Size of appdata.
|-
| 0x40
| 0xC8
| Appdata(Application data), if any. Size of the appdata is specified via the u8 at offset 0x3F. This data is not used when the size-field is zero.
|}

This 0x108-byte structure is used for [[NWMUDS:BeginHostingNetwork]], [[NWMUDS:ConnectToNetwork]], etc. This data is stored as big-endian.

==NodeInfo structure==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| u64 ID, this is the UDS version of the FriendCodeSeed. This is loaded from BlkID 0x00090000 in the [[Config_Savegame|system-config]] via [[CfgS:GetConfigInfoBlk2]].
|-
| 0x8
| 0x14
| The first 0x18-bytes from BlkID 0x000A0000 in the [[Config_Savegame|system-config]] loaded via [[CfgS:GetConfigInfoBlk2]] is written here by user-processes. However, the data at +0x14(absolute offset 0x1C) is written by NWM-module later.
|-
| 0x1C
| 0x2
| u16, unknown. Set to 0x0 with the output from [[NWMUDS:DecryptBeaconData]].
|-
| 0x1E
| 0x1
| u8 flag, unknown. Originates from the u16 bitmask in the beacon node-list header. This flag is normally 0 since that bitmask is normally 0?
|-
| 0x1F
| 0x1
| Padding?
|-
| 0x20
| 0x2
| u16 NetworkNodeID
|-
| 0x22
| 0x6
| Normally zero?
|}

The first 0x20-bytes are written by the user-process before using this structure with [[NWMUDS:InitializeWithVersion]]. The data starting at offset 0x8 is only initialized by NWM-module.

== UDS Beacons ==
The UDS host broadcasts a beacon containing at least two Nintendo-vendor tags(tag number 0xDD, see above for the OUI), normally the data stored in these tags are static. The second tag contains the big-endian u32 networkID, used by the clients when connecting to the host and for the above CCMP key generation. The Nintendo-vendor tag(s) following the first two are unique to the process using UDS, these tags are used for broadcasting metadata regarding the host.

A tool for these beacons is available here: [https://github.com/yellows8/ctr-wlanbeacontool]

=== UDS Beacon Tags ===
The following is the structure of each tag, starting at the OUI. The order of the tags is the same as listed below. All data stored under these tags are stored as big-endian.

==== OUI Type 20 ====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x3
| OUI, see above.
|-
| 0x3
| 0x1
| OUI type (20/0x14)
|-
| 0x4
| 0x3
| Sample data: 0a 00 00
|}

Normally the size of this tag(from the tag size field) is 0x07.

==== OUI Type 21 ====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1F
| This is the network structure starting at offset 0xC, with the first 0x1F-bytes from there.
|-
| 0x1F
| 0x14
| SHA1 hash. When doing the hashing, this hash is cleared to zero. The hash data starts at offset 0x0(OUI), and the size is 0x34 + <value of the u8 at offset 0x33>.
|-
| 0x33
| 0x1
| Size of appdata. Normally zero. When non-zero this appdata is located at offset 0x34.
|}

Normally the size of this tag(from the tag size field) is 0x34, not including appdata.

==== OUI Type 24 ====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x3
| OUI, see above.
|-
| 0x3
| 0x1
| OUI type (24/0x18)
|-
| 0x4
| See below
| Encrypted data
|}

This is the tag0 used with [[NWMUDS:DecryptBeaconData]]. The size of data stored under this tag has a maximum size of 0xFA-bytes, however normally the size is smaller than that. Additional encrypted data, if any, is stored under the below tag1.

==== OUI Type 25 ====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x3
| OUI, see above.
|-
| 0x3
| 0x1
| OUI type (25/0x19)
|-
| 0x4
| See above
| Encrypted data
|}

When this exists in the beacon, this is the tag1 used with [[NWMUDS:DecryptBeaconData]]. The data stored here is the 0xFA-bytes following the previous encrypted data in tag0, for more space for storing the encrypted data.

==== Encrypted beacon data ====
The following structure is for the plaintext version of the encrypted data, stored as big-endian.

This data is encrypted with AES-CTR, by NWM module in software. The AES key is stored in NWM module itself. See above for the CTR. The size of this encrypted data is 0x12 + (0x1E*val), where val is the u8 from networkstruct offset 0x1D.

===== Structure =====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x10
| MD5 over the rest of the data following this(plaintext).
|-
| 0x10
| 0x2
| u16 bitmask. Unknown, normally 0? Bit0 is for entry0, bit1 for entry1, and so on.
|-
| 0x12
| 0x1E * <total array entries>
| This is an array of entries for each of the devices on this network, the first entry is for the host and the rest is for the client(s).
|}

===== Array entry =====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1C
| This is the first 0x1C-bytes of the NodeInfo structure, stored as big-endian.
|-
| 0x1C
| 0x2
| u16 NetworkNodeID, stored as big-endian.
|}

Each entry is for a node.

= Mapped IO =
''All'' of the [[IO_Registers|IO]] mapped under the NWM-module process is listed below:

{| class="wikitable" border="1"
|-
! Userland address
! Physical address
! Size
! Description
|-
| 0x1EC22000
| 0x10122000
| 0x1000
| [[WIFI_Registers]]
|-
| 0x1EC40000
| 0x10140000
| 0x1000
| [[PDN_Registers]]
|-
| 0x1EE22000
| 0x10322000
| 0x1000
|
|}

=Errors=
{| class="wikitable" border="1"
|-
! Error code
! Description
|-
| 0xC8A06C0D
| The operation being performed is already done (e.g., if you run NWMEXT_ControlWirelessEnabled to turn wifi on when it's on already, you can't turn it on again).
|-
| 0xC8A113EA
| Returned when the command isn't allowed to be used on this device.
|-
| 0xC90113FA
| Node doesn't exist / invalid NetworkNodeID?
|-
| 0xC92113FB
| Returned when trying to connect to a host when the host has the specified connection-type blocked via the network attributes. There might be other causes too.
|-
| 0xE10113E9
| Returned when the input size is invalid. Returned by [[NWMUDS:PullPacket]] when the input size is smaller than the frame_size.
|-
| 0xE10113EA
| Invalid bind / data_channel is invalid(0x0).
|}

NFC Services

2016-12-16T05:24:57Z

Mailwl: /* 9.3.0-X */

The New3DS NFC module was added with [[8.1.0-0_New3DS]]. The Old3DS NFC module was added with [[9.3.0-21|9.3.0-X]].

On New3DS NFC module uses the [[I2C_Registers|NFC]] hardware via the [[I2C_Services|i2c::NFC]] and [[GPIO_Services|gpio:NFC]] services. On Old3DS NFC module communicates with a NFC peripheral via IR with the IRUSER service.

A total of 6 sessions can be open simultaneously for all of these services combined.

=NFC services=
==NFC user service "nfc:u"==
This is the NFC service used by regular applications, for the NFP API.

This was first seen in the Super Smash Bros eShop demo (only in the exheader, the demo doesn't actually use it), but at that time no system-module was available for NFC on CDN. The first regular application to use this service was Super Smash Bros, with the v1.0.5 game-update, which used the new 9.3.0-X command set.

==NFC management service "nfc:m"==
{| class="wikitable" border="1"
|-
! Command Header
! Available since system-version
! Name
! Input
! Output
! Notes
|-
| 0x040100C2
| Unknown, <[[9.3.0-21|9.3.0-X]]
| ???
| u32 unknownA, u32 unknownB, u32 unknownC, u32 (sizeof(*buffer) << 14 <nowiki>|</nowiki> 0x402), void * buffer
| s32 result
|
|-
| 0x04020000
| [[9.3.0-21|9.3.0-X]]
| ???
| void
| s32 result, u32 unknownA[16]
| Output seems to be a struct
|-
| 0x04030000
| [[9.3.0-21|9.3.0-X]]
| ???
| void
| s32 result, u32 unknownA[41]
|
|-
| 0x04040A40
| [[9.3.0-21|9.3.0-X]]
| [[NFCM:SetAmiiboSettings|SetAmiiboSettings]]
|
|
|
|-
| 0x04060000
| [[9.3.0-21|9.3.0-X]]
| ???
| void
| s32 result
|
|-
| 0x04070000
| [[9.3.0-21|9.3.0-X]]
| ???
| void
| s32 result, u32 unknownA
|
|-
| 0x04080000
| [[9.3.0-21|9.3.0-X]]
| ???
| void
| s32 result, u32 unknownA
|
|-
| 0x040C0000
| [[9.3.0-21|9.3.0-X]]
| ?
| None
| s32 result
| Among other things, this will eventually call the savedata writing code referenced in the below savedata section.
|-
| 0x040D0000
| [[9.3.0-21|9.3.0-X]]
| ???
| void
| s32 result
|
|-
| 0x040E0000
| [[9.3.0-21|9.3.0-X]]
| ???
| void
| s32 result, u32 unknownA, u32 unknownB
| Again, amiibo applet ignores value unknownA.
|-
| 0x040F0000
| [[9.3.0-21|9.3.0-X]]
| ???
| void
| s32 result, u32 unknownA, u32 unknownB
|
|}

This is used by the [[amiibo Settings]] applet. This service has the above commands, in addition to the command-set listed below.

==NFC development service "nfc:dev"==
This service seems to be intended for use only on dev-units(or at least some of the command(s)).

Unlike the New3DS NFC-module, at least some of these commands are stubbed in the Old3DS NFC-module(only returns an error).

==NFC service "nfc:p"==
This service is used by the mint library-applet, starting with [[9.3.0-21]]. This service was added to the mint service-access-control list with [[9.0.0-20]].
The mint process is the only known eShop-related process using this service([[eShop]]-application and NIM-module don't use it). Presumably used for NFC card payments in JPN [[eShop]](the v16384 mint title is ''identical'' for USA/JPN besides programIDs in the NCCH header/exheader).

==NFC service "nfc:r"==
This service has no known use.

==NFC service "nfc:s"==
{| class="wikitable" border="1"
|-
! Command header
! Available since system-version
! Description
|-
| 0x00230000
|
| This writes the following command request data to [[I2C_Registers|I2C]], without reading any response: 10 20 00 01 01.
|-
| 0x00240000
|
| This writes the following command request data to [[I2C_Registers|I2C]], without reading any response: 10 40 00 03 00 0F 01.
|}

This service has no known use.

Unlike the New3DS NFC-module, at least some of these commands are stubbed in the Old3DS NFC-module(only returns an error).

="nfc:u" and "nfc:m" command set=
There are at least two different revisions of the NFC module. First version was introduced on New3DS only with firmware [[8.1.0-0_New3DS]]. Second version made its appearance with [[9.3.0-21|9.3.0-X]], on both Old3DS and New3DS.

These two versions are not interchangeable and not compatible, since the newer version uses a different command set and has no implemented commands from the older version. This does not introduce compatibility problems since no retail software used the NFC module, before the system titles added with [[9.3.0-21]] which use NFC.

==9.3.0-X==
{| class="wikitable" border="1"
|-
! Command Header
! Available since system-version
! Name
! Input
! Output
! Notes
|-
| 0x00010040
|
| [[NFC:Initialize|Initialize]]
| u8 inputval
| s32 result
|
|-
| 0x00020040
|
| [[NFC:Shutdown|Shutdown]]
| u8 inputval
| s32 result
|
|-
| 0x00030000
|
| [[NFC:StartCommunication|StartCommunication]]
| void
| s32 result
|
|-
| 0x00040000
|
| [[NFC:StopCommunication|StopCommunication]]
| void
| s32 result
|
|-
| 0x00050040
|
| [[NFC:StartTagScanning|StartTagScanning]]
| u16 inval
| s32 result
|
|-
| 0x00060000
|
| [[NFC:StopTagScanning|StopTagScanning]]
| void
| s32 result
|
|-
| 0x00070000
|
| [[NFC:LoadAmiiboData|LoadAmiiboData]]
|
|
|
|-
| 0x00080000
|
| [[NFC:ResetTagScanState|ResetTagScanState]]
|
|
|
|-
| 0x00090002
|
| [[NFC:UpdateStoredAmiiboData|UpdateStoredAmiiboData]]
|
|
|
|-
| 0x000A0000
|
| ???
| void
| s32 result
|
|-
| 0x000B0000
|
| ???
| void
| s32 result, u32 copy handle descriptor, Handle event
| amiibo applet ignores value 'descriptor'. It doesn't even read it from the command buffer.
|-
| 0x000C0000
|
| ???
| void
| s32 result, u32 copy handle descriptor, Handle event
| amiibo applet also ignores value 'descriptor' for this command.
|-
| 0x000D0000
|
| [[NFC:GetTagState|GetTagState]]
| void
| s32 result, u8 outval
|
|-
| 0x000F0000
|
| [[NFC:CommunicationGetStatus|CommunicationGetStatus]]
|
|
|
|-
| 0x00100000
|
| [[NFC:GetTagInfo2|GetTagInfo2]]
|
|
|
|-
| 0x00110000
|
| [[NFC:GetTagInfo|GetTagInfo]]
|
|
|
|-
| 0x00120000
|
| [[NFC:CommunicationGetResult|CommunicationGetResult]]
|
|
|
|-
| 0x00130040
|
| [[NFC:OpenAppData|OpenAppData]]
|
|
|
|-
| 0x00140384
|
| [[NFC:InitializeWriteAppData|InitializeWriteAppData]]
|
|
|
|-
| 0x00150040
|
| [[NFC:ReadAppData|ReadAppData]]
|
|
|
|-
| 0x00160242
|
| [[NFC:WriteAppData|WriteAppData]]
|
|
|
|-
| 0x00170000
|
| [[NFC:GetAmiiboSettings|GetAmiiboSettings]]
|
|
|
|-
| 0x00180000
|
| [[NFC:GetAmiiboConfig|GetAmiiboConfig]]
|
|
|
|-
| 0x00190000
|
| [[NFC:GetAppDataInitStruct|GetAppDataInitStruct]]
|
|
|
|-
| 0x001A0000
|
|
| None
| No additional output.
|
|-
| 0x001B0000
|
|
| None
| 0x36-byte output structure starting at cmdreply[2].
|
|-
| 0x001C0040
| [[9.6.0-24|9.6.0-X]]
|
| u8 inputval
| No additional output.
| ?
|-
| 0x001D0040
| [[9.6.0-24|9.6.0-X]]
|
| u32 inputval
| No additional output.
| ?
|-
| 0x001E0040
| [[9.6.0-24|9.6.0-X]]
|
| u8 inputval
| u8 outval at cmdreply[2].
| ?
|}

==Pre-9.3.0-X==
{| class="wikitable" border="1"
|-
! Pre-9.3.0-X command header
! Command header starting with 9.3.0-X
! Available since system-version
! Description
|-
| 0x00010000
| ?
| [[8.1.0-0_New3DS]]
| Initialize
|-
| 0x00020000
| ?
| [[8.1.0-0_New3DS]]
| Shutdown
|-
| 0x00030000
| ?
| [[8.1.0-0_New3DS]]
| GetNFCState. This writes an output u8 to cmdreply[2]: 0 = not initialized, 1 = just initialized, 5 = data transfer ready, ...
|-
| 0x00040000
| 0x000B0000
| [[8.1.0-0_New3DS]]
| This writes an output handle to cmdreply[3].
|-
| 0x00050000
| 0x000C0000
| [[8.1.0-0_New3DS]]
| This writes an output handle to cmdreply[3].
|-
| 0x00060040
| ?
| [[8.1.0-0_New3DS]]
| (u8 input)
|-
| 0x00070000
| ?
| [[8.1.0-0_New3DS]]
| The user process must setup the output-buffer hdr+ptr data @ TLS+0x180 when using this. cmdreply[2] = actual output data size?
|-
| 0x00080100
| ?
| [[8.1.0-0_New3DS]]
| (<0x10-bytes starting at cmdreq[1]>)
|-
| 0x00090000
| ?
| [[8.1.0-0_New3DS]]
|
|-
| 0x000A0000
| ?
| [[8.1.0-0_New3DS]]
| The user process must setup the output-buffer hdr+ptr data @ TLS+0x180 when using this.
|-
| 0x000B0042
| ?
| [[8.1.0-0_New3DS]]
| (u32 size, ((Size<<14) <nowiki>|</nowiki> 2), inbufptr)
|-
| 0x000C0044
| ?
| [[8.1.0-0_New3DS]]
| (u32 size, 0x20, <procid set by kernel>, ((Size<<14) <nowiki>|</nowiki> 0x402), inbufptr)
|-
| 0x000D0040
| ?
| [[8.1.0-0_New3DS]]
| (u16 in)
|-
| 0x000E0000
| ?
| [[8.1.0-0_New3DS]]
|
|-
| 0x000F00C2
| ?
| [[8.1.0-0_New3DS]]
| (u32 unk0, u32 unk1, u32 unk2, ((Size<<14) <nowiki>|</nowiki> 0x802), inbufptr)
|-
| 0x00100040
| ?
| [[8.1.0-0_New3DS]]
| (u32 in)
|-
| 0x00110040
| ?
| [[8.1.0-0_New3DS]]
| (u32 in)
|-
| 0x00120040
| ?
| [[8.1.0-0_New3DS]]
| (u32 in)
|-
| 0x00130000
| ?
| [[8.1.0-0_New3DS]]
| Writes an output u32 to cmdreply[2].
|-
| 0x00140000
| ?
| [[8.1.0-0_New3DS]]
| This writes an output 0x30-byte struct starting at cmdreply[2].
|-
| 0x00150000
| 0x00110000
| [[8.1.0-0_New3DS]]
| This writes an output 0x2C-byte struct starting at cmdreply[2].
|-
| 0x00160000
| ?
| [[8.1.0-0_New3DS]]
|
|-
| 0x00170000
| ?
| [[8.1.0-0_New3DS]]
|
|}

=NFC services error codes=
{| class="wikitable" border="1"
|-
! Error-code
! Description
|-
| 0xc8a17600
| The current NFC tag [[NFC:GetTagState|state]], or other NFC state, is invalid with the NFC command which was used.
|}

=NFC module savedata=
* "/nfp_backup.dat" This contains raw data from the [[Amiibo]] NFC data pages. The filesize is 0x001fbd20-bytes. Certain service cmds will trigger writing to this savedata. This entire file is read during [[amiibo Settings]] startup, it's unknown what command(s) actually triggers that. It seems the Amiibo data here is updated each time the Amiibo NFC data is updated, and read each time the Amiibo NFC data is read. Data is written into this savedata when the Amiibo was never scanned on this system before. The data here is probably also updated when the scanned Amiibo NFC data doesn't match the data stored here.

During NFC writing, the NFC data being written can become corrupted if the Amiibo figure is moved outside of range during writing. When this happens, this nfp_backup data can be used to restore a previous version of that data prior to the last failed write.

==nfp_backup.dat structure==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x20
| Header
|-
| 0x20
| 0x800
| Amiibo data table header
|-
| 0x7D20
| 0x21C
| The NFC data for the first stored Amiibo is located here. This is the entire raw data from all 0x87 NFC data pages.
|}

===Header structure===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| Unknown, normally the following data? "00 00 02 00 02 00 00 00" (as little-endian u32s: 0x20000, 0x2)
|-
| 0x8
| 0x14
| Unknown, normally all-zero?
|-
| 0x1C
| 0x4
| Unknown. CRC32 / checksum maybe?
|}

===Amiibo data table header===
This is an array with 0x40(?) entries, where the size of each entry is 0x20-bytes. Entry structure:
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| First 8-bytes from [[Amiibo]] NFC serial-number.
|-
| 0x8
| 0x3
| Unknown, normally zero?
|-
| 0xB
| 0x2
| u16 little-endian date value for when this Amiibo was initially written into this savedata, with the same format from [[Amiibo|here]].
|-
| 0xD
| 0xF
| Unknown, normally zero?
|-
| 0x1C
| 0x4
| Unknown. CRC32 / checksum maybe?
|}

=NFC module versions=
{| class="wikitable" border="1"
|-
! System version
! New3DS title-version
! Old3DS title-version
! Changes
|-
| [[9.6.0-24|9.6.0-X]]
| v4102
| v4106
| New3DS and Old3DS: the only changes regarding new commands is that new commands were added for the nfcu/nfcm command-set and new commands for an unknown cmd-handler were added. It's unknown if there's other changes.
|}

=Errors=
{| class="wikitable" border="1"
|-
! Error code
! Description
|-
| 0xC8A17600
| This is returned when the current state is invalid for this command.
|-
| 0xC8A17620
| This is returned by [[NFC:OpenAppData]] when the appdata is uninitialized since [[NFC:InitializeWriteAppData]] wasn't used previously.
|-
| 0xC8A17628
| This is returned by [[NFC:GetAmiiboSettings]] when the amiibo wasn't setup by the amiibo Settings applet.
|-
| 0xC8A17638
| This is returned by [[NFC:OpenAppData]] when the input AppID doesn't match the actual Amiibo AppID.
|-
| 0xC8C1760C
| Returned for HMAC-hash mismatch(data corruption), with HMAC-calculation input_buffer_size=0x34.
|-
| 0xC8A17618
| HMAC-hash mismatch with input_buffer_size=0x1DF(see [[Amiibo|here]]).
|}

NFC Services

2016-12-15T18:50:57Z

Mailwl: /* 9.3.0-X */

The New3DS NFC module was added with [[8.1.0-0_New3DS]]. The Old3DS NFC module was added with [[9.3.0-21|9.3.0-X]].

On New3DS NFC module uses the [[I2C_Registers|NFC]] hardware via the [[I2C_Services|i2c::NFC]] and [[GPIO_Services|gpio:NFC]] services. On Old3DS NFC module communicates with a NFC peripheral via IR with the IRUSER service.

A total of 6 sessions can be open simultaneously for all of these services combined.

=NFC services=
==NFC user service "nfc:u"==
This is the NFC service used by regular applications, for the NFP API.

This was first seen in the Super Smash Bros eShop demo (only in the exheader, the demo doesn't actually use it), but at that time no system-module was available for NFC on CDN. The first regular application to use this service was Super Smash Bros, with the v1.0.5 game-update, which used the new 9.3.0-X command set.

==NFC management service "nfc:m"==
{| class="wikitable" border="1"
|-
! Command Header
! Available since system-version
! Name
! Input
! Output
! Notes
|-
| 0x040100C2
| Unknown, <[[9.3.0-21|9.3.0-X]]
| ???
| u32 unknownA, u32 unknownB, u32 unknownC, u32 (sizeof(*buffer) << 14 <nowiki>|</nowiki> 0x402), void * buffer
| s32 result
|
|-
| 0x04020000
| [[9.3.0-21|9.3.0-X]]
| ???
| void
| s32 result, u32 unknownA[16]
| Output seems to be a struct
|-
| 0x04030000
| [[9.3.0-21|9.3.0-X]]
| ???
| void
| s32 result, u32 unknownA[41]
|
|-
| 0x04040A40
| [[9.3.0-21|9.3.0-X]]
| [[NFCM:SetAmiiboSettings|SetAmiiboSettings]]
|
|
|
|-
| 0x04060000
| [[9.3.0-21|9.3.0-X]]
| ???
| void
| s32 result
|
|-
| 0x04070000
| [[9.3.0-21|9.3.0-X]]
| ???
| void
| s32 result, u32 unknownA
|
|-
| 0x04080000
| [[9.3.0-21|9.3.0-X]]
| ???
| void
| s32 result, u32 unknownA
|
|-
| 0x040C0000
| [[9.3.0-21|9.3.0-X]]
| ?
| None
| s32 result
| Among other things, this will eventually call the savedata writing code referenced in the below savedata section.
|-
| 0x040D0000
| [[9.3.0-21|9.3.0-X]]
| ???
| void
| s32 result
|
|-
| 0x040E0000
| [[9.3.0-21|9.3.0-X]]
| ???
| void
| s32 result, u32 unknownA, u32 unknownB
| Again, amiibo applet ignores value unknownA.
|-
| 0x040F0000
| [[9.3.0-21|9.3.0-X]]
| ???
| void
| s32 result, u32 unknownA, u32 unknownB
|
|}

This is used by the [[amiibo Settings]] applet. This service has the above commands, in addition to the command-set listed below.

==NFC development service "nfc:dev"==
This service seems to be intended for use only on dev-units(or at least some of the command(s)).

Unlike the New3DS NFC-module, at least some of these commands are stubbed in the Old3DS NFC-module(only returns an error).

==NFC service "nfc:p"==
This service is used by the mint library-applet, starting with [[9.3.0-21]]. This service was added to the mint service-access-control list with [[9.0.0-20]].
The mint process is the only known eShop-related process using this service([[eShop]]-application and NIM-module don't use it). Presumably used for NFC card payments in JPN [[eShop]](the v16384 mint title is ''identical'' for USA/JPN besides programIDs in the NCCH header/exheader).

==NFC service "nfc:r"==
This service has no known use.

==NFC service "nfc:s"==
{| class="wikitable" border="1"
|-
! Command header
! Available since system-version
! Description
|-
| 0x00230000
|
| This writes the following command request data to [[I2C_Registers|I2C]], without reading any response: 10 20 00 01 01.
|-
| 0x00240000
|
| This writes the following command request data to [[I2C_Registers|I2C]], without reading any response: 10 40 00 03 00 0F 01.
|}

This service has no known use.

Unlike the New3DS NFC-module, at least some of these commands are stubbed in the Old3DS NFC-module(only returns an error).

="nfc:u" and "nfc:m" command set=
There are at least two different revisions of the NFC module. First version was introduced on New3DS only with firmware [[8.1.0-0_New3DS]]. Second version made its appearance with [[9.3.0-21|9.3.0-X]], on both Old3DS and New3DS.

These two versions are not interchangeable and not compatible, since the newer version uses a different command set and has no implemented commands from the older version. This does not introduce compatibility problems since no retail software used the NFC module, before the system titles added with [[9.3.0-21]] which use NFC.

==9.3.0-X==
{| class="wikitable" border="1"
|-
! Command Header
! Available since system-version
! Name
! Input
! Output
! Notes
|-
| 0x00010040
|
| [[NFC:Initialize|Initialize]]
| u8 inputval
| s32 result
|
|-
| 0x00020040
|
| [[NFC:Shutdown|Shutdown]]
| u8 inputval
| s32 result
|
|-
| 0x00030000
|
| [[NFC:StartCommunication|StartCommunication]]
| void
| s32 result
|
|-
| 0x00040000
|
| [[NFC:StopCommunication|StopCommunication]]
| void
| s32 result
|
|-
| 0x00050040
|
| [[NFC:StartTagScanning|StartTagScanning]]
| u16 inval
| s32 result
|
|-
| 0x00060000
|
| [[NFC:StopTagScanning|StopTagScanning]]
| void
| s32 result
|
|-
| 0x00070000
|
| [[NFC:LoadAmiiboData|LoadAmiiboData]]
|
|
|
|-
| 0x00080000
|
| [[NFC:ResetTagScanState|ResetTagScanState]]
|
|
|
|-
| 0x00090002
|
| [[NFC:UpdateStoredAmiiboData|UpdateStoredAmiiboData]]
|
|
|
|-
| 0x000A0000
|
| ???
| void
| s32 result
|
|-
| 0x000B0000
|
| ???
| void
| s32 result, u32 copy handle descriptor, Handle event
| amiibo applet ignores value 'descriptor'. It doesn't even read it from the command buffer.
|-
| 0x000C0000
|
| ???
| void
| s32 result, u32 unknownA, u32 unknownB
| amiibo applet also ignores value unknownA for this command.
|-
| 0x000D0000
|
| [[NFC:GetTagState|GetTagState]]
| void
| s32 result, u8 outval
|
|-
| 0x000F0000
|
| [[NFC:CommunicationGetStatus|CommunicationGetStatus]]
|
|
|
|-
| 0x00100000
|
| [[NFC:GetTagInfo2|GetTagInfo2]]
|
|
|
|-
| 0x00110000
|
| [[NFC:GetTagInfo|GetTagInfo]]
|
|
|
|-
| 0x00120000
|
| [[NFC:CommunicationGetResult|CommunicationGetResult]]
|
|
|
|-
| 0x00130040
|
| [[NFC:OpenAppData|OpenAppData]]
|
|
|
|-
| 0x00140384
|
| [[NFC:InitializeWriteAppData|InitializeWriteAppData]]
|
|
|
|-
| 0x00150040
|
| [[NFC:ReadAppData|ReadAppData]]
|
|
|
|-
| 0x00160242
|
| [[NFC:WriteAppData|WriteAppData]]
|
|
|
|-
| 0x00170000
|
| [[NFC:GetAmiiboSettings|GetAmiiboSettings]]
|
|
|
|-
| 0x00180000
|
| [[NFC:GetAmiiboConfig|GetAmiiboConfig]]
|
|
|
|-
| 0x00190000
|
| [[NFC:GetAppDataInitStruct|GetAppDataInitStruct]]
|
|
|
|-
| 0x001A0000
|
|
| None
| No additional output.
|
|-
| 0x001B0000
|
|
| None
| 0x36-byte output structure starting at cmdreply[2].
|
|-
| 0x001C0040
| [[9.6.0-24|9.6.0-X]]
|
| u8 inputval
| No additional output.
| ?
|-
| 0x001D0040
| [[9.6.0-24|9.6.0-X]]
|
| u32 inputval
| No additional output.
| ?
|-
| 0x001E0040
| [[9.6.0-24|9.6.0-X]]
|
| u8 inputval
| u8 outval at cmdreply[2].
| ?
|}

==Pre-9.3.0-X==
{| class="wikitable" border="1"
|-
! Pre-9.3.0-X command header
! Command header starting with 9.3.0-X
! Available since system-version
! Description
|-
| 0x00010000
| ?
| [[8.1.0-0_New3DS]]
| Initialize
|-
| 0x00020000
| ?
| [[8.1.0-0_New3DS]]
| Shutdown
|-
| 0x00030000
| ?
| [[8.1.0-0_New3DS]]
| GetNFCState. This writes an output u8 to cmdreply[2]: 0 = not initialized, 1 = just initialized, 5 = data transfer ready, ...
|-
| 0x00040000
| 0x000B0000
| [[8.1.0-0_New3DS]]
| This writes an output handle to cmdreply[3].
|-
| 0x00050000
| 0x000C0000
| [[8.1.0-0_New3DS]]
| This writes an output handle to cmdreply[3].
|-
| 0x00060040
| ?
| [[8.1.0-0_New3DS]]
| (u8 input)
|-
| 0x00070000
| ?
| [[8.1.0-0_New3DS]]
| The user process must setup the output-buffer hdr+ptr data @ TLS+0x180 when using this. cmdreply[2] = actual output data size?
|-
| 0x00080100
| ?
| [[8.1.0-0_New3DS]]
| (<0x10-bytes starting at cmdreq[1]>)
|-
| 0x00090000
| ?
| [[8.1.0-0_New3DS]]
|
|-
| 0x000A0000
| ?
| [[8.1.0-0_New3DS]]
| The user process must setup the output-buffer hdr+ptr data @ TLS+0x180 when using this.
|-
| 0x000B0042
| ?
| [[8.1.0-0_New3DS]]
| (u32 size, ((Size<<14) <nowiki>|</nowiki> 2), inbufptr)
|-
| 0x000C0044
| ?
| [[8.1.0-0_New3DS]]
| (u32 size, 0x20, <procid set by kernel>, ((Size<<14) <nowiki>|</nowiki> 0x402), inbufptr)
|-
| 0x000D0040
| ?
| [[8.1.0-0_New3DS]]
| (u16 in)
|-
| 0x000E0000
| ?
| [[8.1.0-0_New3DS]]
|
|-
| 0x000F00C2
| ?
| [[8.1.0-0_New3DS]]
| (u32 unk0, u32 unk1, u32 unk2, ((Size<<14) <nowiki>|</nowiki> 0x802), inbufptr)
|-
| 0x00100040
| ?
| [[8.1.0-0_New3DS]]
| (u32 in)
|-
| 0x00110040
| ?
| [[8.1.0-0_New3DS]]
| (u32 in)
|-
| 0x00120040
| ?
| [[8.1.0-0_New3DS]]
| (u32 in)
|-
| 0x00130000
| ?
| [[8.1.0-0_New3DS]]
| Writes an output u32 to cmdreply[2].
|-
| 0x00140000
| ?
| [[8.1.0-0_New3DS]]
| This writes an output 0x30-byte struct starting at cmdreply[2].
|-
| 0x00150000
| 0x00110000
| [[8.1.0-0_New3DS]]
| This writes an output 0x2C-byte struct starting at cmdreply[2].
|-
| 0x00160000
| ?
| [[8.1.0-0_New3DS]]
|
|-
| 0x00170000
| ?
| [[8.1.0-0_New3DS]]
|
|}

=NFC services error codes=
{| class="wikitable" border="1"
|-
! Error-code
! Description
|-
| 0xc8a17600
| The current NFC tag [[NFC:GetTagState|state]], or other NFC state, is invalid with the NFC command which was used.
|}

=NFC module savedata=
* "/nfp_backup.dat" This contains raw data from the [[Amiibo]] NFC data pages. The filesize is 0x001fbd20-bytes. Certain service cmds will trigger writing to this savedata. This entire file is read during [[amiibo Settings]] startup, it's unknown what command(s) actually triggers that. It seems the Amiibo data here is updated each time the Amiibo NFC data is updated, and read each time the Amiibo NFC data is read. Data is written into this savedata when the Amiibo was never scanned on this system before. The data here is probably also updated when the scanned Amiibo NFC data doesn't match the data stored here.

During NFC writing, the NFC data being written can become corrupted if the Amiibo figure is moved outside of range during writing. When this happens, this nfp_backup data can be used to restore a previous version of that data prior to the last failed write.

==nfp_backup.dat structure==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x20
| Header
|-
| 0x20
| 0x800
| Amiibo data table header
|-
| 0x7D20
| 0x21C
| The NFC data for the first stored Amiibo is located here. This is the entire raw data from all 0x87 NFC data pages.
|}

===Header structure===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| Unknown, normally the following data? "00 00 02 00 02 00 00 00" (as little-endian u32s: 0x20000, 0x2)
|-
| 0x8
| 0x14
| Unknown, normally all-zero?
|-
| 0x1C
| 0x4
| Unknown. CRC32 / checksum maybe?
|}

===Amiibo data table header===
This is an array with 0x40(?) entries, where the size of each entry is 0x20-bytes. Entry structure:
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| First 8-bytes from [[Amiibo]] NFC serial-number.
|-
| 0x8
| 0x3
| Unknown, normally zero?
|-
| 0xB
| 0x2
| u16 little-endian date value for when this Amiibo was initially written into this savedata, with the same format from [[Amiibo|here]].
|-
| 0xD
| 0xF
| Unknown, normally zero?
|-
| 0x1C
| 0x4
| Unknown. CRC32 / checksum maybe?
|}

=NFC module versions=
{| class="wikitable" border="1"
|-
! System version
! New3DS title-version
! Old3DS title-version
! Changes
|-
| [[9.6.0-24|9.6.0-X]]
| v4102
| v4106
| New3DS and Old3DS: the only changes regarding new commands is that new commands were added for the nfcu/nfcm command-set and new commands for an unknown cmd-handler were added. It's unknown if there's other changes.
|}

=Errors=
{| class="wikitable" border="1"
|-
! Error code
! Description
|-
| 0xC8A17600
| This is returned when the current state is invalid for this command.
|-
| 0xC8A17620
| This is returned by [[NFC:OpenAppData]] when the appdata is uninitialized since [[NFC:InitializeWriteAppData]] wasn't used previously.
|-
| 0xC8A17628
| This is returned by [[NFC:GetAmiiboSettings]] when the amiibo wasn't setup by the amiibo Settings applet.
|-
| 0xC8A17638
| This is returned by [[NFC:OpenAppData]] when the input AppID doesn't match the actual Amiibo AppID.
|-
| 0xC8C1760C
| Returned for HMAC-hash mismatch(data corruption), with HMAC-calculation input_buffer_size=0x34.
|-
| 0xC8A17618
| HMAC-hash mismatch with input_buffer_size=0x1DF(see [[Amiibo|here]]).
|}

MCU Services

2016-12-15T10:19:46Z

Mailwl: /* MCU GPU service "mcu::GPU" */

Only one session can be open per service at a time. If a session is already open for a service, MCU module will wait for the thread handling the session to terminate(triggered by the session being closed by the user process), then it accepts the new session. The commands for each service are handled by separate threads.

=MCU camera service "mcu::CAM"=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x0001....
| ?
|-
| 0x0002....
| ?
|}

=MCU GPU service "mcu::GPU"=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010000
| GetLcdPowerState. This writes the value of I2C-MCU register 0xf bit6 to u8 cmdreply[2], and the value of bit5 from that register to u8 cmdreply[3].
|-
| 0x00020080
| SetLcdPowerState. This writes the upper LCD bits of MCU register 0x22.
|-
| 0x00030000
| GetGpuLcdInterfaceState. This writes the value of I2C-MCU register 0xf bit7 to u8 cmdreply[2].
|-
| 0x00040040
| SetGpuLcdInterfaceState. This writes the lower two bits of MCU register 0x22.
|-
| 0x0005....
| ?
|-
| 0x0006....
| ?
|-
| 0x0007....
| ?
|-
| 0x0008....
| ?
|-
| 0x00090000
| GetMcuFwVerHigh. Called by GSP module
|-
| 0x000A0000
| GetMcuFwVerLow. Called by GSP module
|-
| 0x000B0040
| Set3dLedState
|-
| 0x000C....
| Get3dLedState
|-
| 0x000D0000
| GetMcuGpuEventHandle. Event handle written to TLS+0x8c. MCU notifications 24 to 29 signal this.
|-
| 0x000E0000
| GetMcuGpuEventReason. Writes some value to TLS+0x88. Called by GSP module
|}

=MCU HID service "mcu::HID"=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010040
| ?
|-
| 0x0002....
| ?
|-
| 0x0003....
| ?
|-
| 0x0004....
| ?
|-
| 0x0005....
| ?
|-
| 0x0006....
| ?
|-
| 0x00070000
| Get3dSliderState
|-
| 0x0008....
| ?
|-
| 0x00090000
| ?
|-
| 0x000A0000
| ?
|-
| 0x000B....
| ?
|-
| 0x000C0000
| GetMcuHidEventHandle. MCU notifications 11 and 12 signal this.
|-
| 0x000D0000
| GetMcuHidEventReason
|-
| 0x000E0000
| [[MCUHID:GetSoundVolume|GetSoundVolume]]
|-
| 0x000F0040
| SetAccelerometerState(int enable). 1 = enable, 0 = disable accelerometer
|}

=MCU service "mcu::RTC"=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x0001....
| SetSystemClock (RTC)
|-
| 0x0002....
| GetSystemClock (RTC)
|-
| 0x0003....
| ?
|-
| 0x0004....
| ?
|-
| 0x0005....
| ?
|-
| 0x0006....
| ?
|-
| 0x0007....
| ?
|-
| 0x0008....
| ?
|-
| 0x0009....
| ?
|-
| 0x000A....
| ?
|-
| 0x000B....
| ?
|-
| 0x000C....
| ?
|-
| 0x000D....
| ?
|-
| 0x000E....
| ?
|-
| 0x000F....
| ?
|-
| 0x0010....
| ?
|-
| 0x0011....
| ?
|-
| 0x0012....
| ?
|-
| 0x0013....
| ?
|-
| 0x0014....
| ?
|-
| 0x0015....
| ?
|-
| 0x0016....
| ?
|-
| 0x0017....
| ?
|-
| 0x0018....
| ?
|-
| 0x0019....
| ?
|-
| 0x001A....
| ?
|-
| 0x001B....
| ?
|-
| 0x001C....
| ?
|-
| 0x001D....
| ?
|-
| 0x001E....
| ?
|-
| 0x001F0040
| SetPedometerRecordingMode
|-
| 0x00200000
| GetPedometerState
|-
| 0x0021....
| ?
|-
| 0x0022....
| ?
|-
| 0x0023....
| ?
|-
| 0x0024....
| GetMcuRtcEventHandle. MCU notifications 1, 8, 9, 10, 13, 14 and 15 signal this.
|-
| 0x0025....
| GetMcuRtcEventReason
|-
| 0x0026....
| ?
|-
| 0x0027....
| ?
|-
| 0x0028....
| ?
|-
| 0x0029....
| ?
|-
| 0x002A0000
| GetShellState. This writes the value of I2C-MCU register 0xf bit1 to u8 cmdreply[2].
|-
| 0x002B0000
| GetAdapterState. This writes the value of I2C-MCU register 0xf bit3 to u8 cmdreply[2].
|-
| 0x002C0000
| GetBatteryChargeState. This writes the value of I2C-MCU register 0xf bit4 to u8 cmdreply[2].
|-
| 0x002D0000
| [[MCURTC:GetBatteryLevel|GetBatteryLevel]]
|-
| 0x002E....
| ?
|-
| 0x002F....
| ?
|-
| 0x0030....
| ?
|-
| 0x0031....
| ?
|-
| 0x0032....
| [[MCURTC:PowerOff|PowerOff]] (writes 0x1 to i2c MCU device, reg 0x20)
|-
| 0x0033....
| [[MCURTC:HardwareReboot|HardwareReboot]] (writes 0x4 to i2c MCU device, reg 0x20)
|-
| 0x0034....
| ?
|-
| 0x0035....
| Writes 0x10 to i2c MCU device, reg 0x20
|-
| 0x0036....
| SetWatchdogTimer
|-
| 0x0037....
| GetWatchdogTimer
|-
| 0x0038....
| ?
|-
| 0x0039....
| ?
|-
| 0x003A....
| ?
|-
| 0x003B0640
| [[MCURTC:SetInfoLEDPattern|SetInfoLEDPattern]]
|-
| 0x003C0040
| [[MCURTC:SetInfoLEDPatternHeader|SetInfoLEDPatternHeader]]
|-
| 0x003D0000
| [[MCURTC:GetInfoLEDStatus|GetInfoLEDStatus]]
|-
| 0x003E....
| ?
|-
| 0x003F....
| ?
|-
| 0x0040....
| ?
|-
| 0x0041....
| ?
|-
| 0x00420040
| [[MCURTC:SetBatteryEmptyLEDPattern|SetBatteryEmptyLEDPattern]]
|-
| 0x0043....
| ?
|-
| 0x0044....
| ?
|-
| 0x0045....
| ?
|-
| 0x0046....
| ?
|-
| 0x0047....
| ?
|-
| 0x0048....
| ?
|-
| 0x0049....
| ?
|-
| 0x004A....
| ?
|-
| 0x004B....
| ?
|-
| 0x004C....
| ?
|-
| 0x004D....
| [[MCURTC:ReadHidFlagRegister|ReadHidFlagRegister]] (reads i2c MCU device, reg 0x10)
|-
| 0x004E0040
| [[MCURTC:PublishNotifications|PublishNotifications]]
|-
| 0x004F....
| Sets some flag (otherwise set when uploading MCU firmware)
|-
| 0x0050....
| Returns the above flag
|-
| 0x00510040
| [[MCURTC:SetSoftwareClosedFlag|SetSoftwareClosedFlag]]
|-
| 0x00520000
| [[MCURTC:GetSoftwareClosedFlag|GetSoftwareClosedFlag]]
|-
| 0x0053....
| ?
|-
| 0x0054....
| ?
|-
| 0x0055....
| ?
|-
| 0x0056....
| ?
|-
| 0x0057....
| ?
|-
| 0x0058....
| ?
|-
| 0x00590040
| [[MCURTC:SetLegacyJumpProhibitedFlag|SetLegacyJumpProhibitedFlag]]
|-
| 0x005A0000
| [[MCURTC:GetLegacyJumpProhibitedFlag|GetLegacyJumpProhibitedFlag]]
|}

Note that using invalid input with these InfoLED/SetBatteryEmptyLEDPattern commands(especially SetInfoLEDPattern) can cause the system to be bricked(however the boot failure may not begin immediately after using the invalid parameters).

=MCU sound service "mcu::SND"=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x0001....
| GetSoundVolume
|-
| 0x0002....
| ?
|-
| 0x0003....
| ?
|}

=MCU wifi service "mcu::NWM"=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x0001....
| SetWirelessLedState
|-
| 0x0002....
| GetWirelessLedState
|-
| 0x0003....
| Sets GPIO 0x20 high/low?
|-
| 0x0004....
| Gets GPIO 0x20 high/low?
|-
| 0x0005....
| Sets GPIO 0x40000 high/low?
|-
| 0x0006....
| Gets GPIO 0x40000 high/low?
|-
| 0x0007....
| [[MCUNWM:SetWirelessDisabledFlag|SetWirelessDisabledFlag]]
|-
| 0x0008....
| [[MCUNWM:GetWirelessDisabledFlag|GetWirelessDisabledFlag]]
|}

=MCU service "mcu::HWC"=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010082
| [[MCUHWC:ReadRegister|ReadRegister]]
|-
| 0x00020082
| [[MCUHWC:WriteRegister|WriteRegister]]
|-
| 0x00030042
| [[MCUHWC:GetInfoRegisters|GetInfoRegisters]]
|-
| 0x00040000
| [[MCUHWC:GetBatteryVoltage|GetBatteryVoltage]]
|-
| 0x00050000
| [[MCUHWC:GetBatteryLevel|GetBatteryLevel]]
|-
| 0x00060040
| [[MCUHWC:SetPowerLEDPattern|SetPowerLEDPattern]]
|-
| 0x00070040
| [[MCUHWC:SetWifiLEDState|SetWifiLEDState]]
|-
| 0x00080040
| [[MCUHWC:SetCameraLEDPattern|SetCameraLEDPattern]]
|-
| 0x00090040
| [[MCUHWC:Set3DLEDState|Set3DLEDState]]
|-
| 0x000A0640
| This is the same as [[MCURTC:SetInfoLEDPattern]].
|-
| 0x000B0000
| [[MCUHWC:GetSoundVolume|GetSoundVolume]]
|-
| 0x000C....
| ?
|-
| 0x000D....
| ?
|-
| 0x000E....
| ?
|-
| 0x000F....
| GetRtcTime
|-
| 0x00100000
| GetMcuFwVerHigh
|-
| 0x00110000
| GetMcuFwVerLow
|}

=MCU service "mcu::PLS"=

RTC-related? Each of these seems to retrieve a second counter from a different RTC register.

{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x0001....
| ?
|-
| 0x0002....
| ?
|-
| 0x0003....
| ?
|-
| 0x0004....
| ?
|-
| 0x0005....
| ?
|-
| 0x0006....
| ?
|-
| 0x0007....
| ?
|-
| 0x0008....
| ?
|-
| 0x0009....
| ?
|}

=MCU codec service "mcu::CDC"=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010000
| ?
|}

=New3DS=
The Old3DS/New3DS MCU sysmodules are identical except that the MCU firmware binary written via I2C is different. The size of that binary is the same. The only different words in .text are for the version of that MCU fw binary.

=MCU firmware versions=

These reside in mcu-module .rodata, are uploaded to MCU register 0x05 and are usually size 0x4003 bytes. (0x4000 bytes with 3 byte magic "jhl"?)

There exists an alternate code path where uploading is done using register 0x3B (decided by making some nonsense conclusions about registers 0x0F and 0x10). This may be a "hack" around early versions of MCU? Register 0x3B is RTC-related on recent versions of MCU, and the "nonsense" condition is not met even on factory MCU firmware.

On dev-units, the user-facing representation of this firmware version is displayed by first subtracting 0x10 from the major field (raw register 0x00). It is these user-facing versions that are displayed in the table below. It is unknown what bit4 (0x10) actually represents, but it is seemingly always set.

{| class="wikitable" border="1"
|-
! Title version
! Firmware
|-
| New3DS v8192/safe v9217 (latest)
| 3.56
|-
| Old3DS v6145 to v8192 (latest)
| 2.37
|-
| Old3DS v5122
| 2.35
|-
| Old3DS v4102
| 2.30
|-
| Old3DS v3072
| 2.16
|-
| Old3DS v2048
| 1.52
|-
| Old3DS v1026
| 1.51
|-
| Old3DS v0/safe v0
| 1.20
|-
| Old3DS factory
| 1.07
|}

CECD Services

2016-12-15T05:36:21Z

Mailwl: /* CECD Service "cecd:ndm" */

[[Category:Services]]

Streetpass stuff.

= CECD Service "cecd:u" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x000100C2
| [[CECDU:OpenRawFile|OpenRawFile]]
|-
| 0x00020042
| [[CECDU:ReadRawFile|ReadRawFile]]
|-
| 0x00030104
| [[CECDU:ReadMessage|ReadMessage]]
|-
| 0x00040106
| [[CECDU:ReadMessageWithHMAC|ReadMessageWithHMAC]]
|-
| 0x00050042
| [[CECDU:WriteRawFile|WriteRawFile]]
|-
| 0x00060104
| [[CECDU:WriteMessage|WriteMessage]]
|-
| 0x00070106
| [[CECDU:WriteMessageWithHMAC|WriteMessageWithHMAC]]
|-
| 0x00080102
| [[CECDU:Delete|Delete]]
|-
| 0x000900C2
| ? (16*length+10 of CecMessageId buffer in cmdbuff[4] (always 16*8+10), CecMessageId* in cmdbuf[5])
|-
| 0x000A00C4
| [[CECDU:GetSystemInfo|GetSystemInfo]]
|-
| 0x000B0040
| RunCommand
|-
| 0x000C0040
| RunCommandAlt (seems to be the same as RunCommand besides some extra checks)
|-
| 0x000D0082
| ?
|-
| 0x000E0000
| GetCecStateAbbreviated (returns CecStateAbbreviated in cmdbuf[2])
|-
| 0x000F0000
| GetCecInfoEventHandle (returns event handle in cmdbuf[3])
|-
| 0x00100000
| GetChangeStateEventHandle (returns event handle in cmdbuf[3])
|-
| 0x00110104
| [[CECDU:OpenAndWrite|OpenAndWrite]]
|-
| 0x00120104
| [[CECDU:OpenAndRead|OpenAndRead]]
|-
| 0x001E0082
| ?
|-
| 0x001F....
| ?
|-
| 0x0020....
| ?
|-
| 0x0021....
| ?
|-
|}

=== CecDataPathType ===
{| class="wikitable" border="1"
! Name
! Value
! Notes
|-
| CEC_PATH_MBOX_LIST || 1
| data:/CEC/MBoxList____
|-
| CEC_PATH_MBOX_INFO || 2
| data:/CEC/<id>/MBoxInfo____
|-
| CEC_PATH_INBOX_INFO || 3
| data:/CEC/<id>/InBox___/BoxInfo_____
|-
| CEC_PATH_OUTBOX_INFO || 4
| data:/CEC/<id>/OutBox__/BoxInfo_____
|-
| CEC_PATH_OUTBOX_INDEX || 5
| data:/CEC/<id>/OutBox__/OBIndex_____
|-
| CEC_PATH_INBOX_MSG || 6
| data:/CEC/<id>/InBox___/_<message_id>
|-
| CEC_PATH_OUTBOX_MSG || 7
| data:/CEC/<id>/OutBox__/_<message_id>
|-
| CEC_PATH_ROOT_DIR || 10
| data:/CEC
|-
| CEC_PATH_MBOX_DIR || 11
| data:/CEC/<id>
|-
| CEC_PATH_INBOX_DIR || 12
| data:/CEC/<id>/InBox___
|-
| CEC_PATH_OUTBOX_DIR || 13
| data:/CEC/<id>/OutBox__
|-
| || 101 thru 199 (inclusive)
| data:/CEC/<id>/MBoxData.0<i-100>
|-
| CECMESSAGE_BOX_ICON || 101
| data:/CEC/<id>/MBoxData.001
|-
| CECMESSAGE_BOX_TITLE || 110
| data:/CEC/<id>/MBoxData.010
|}

=== CecCommand ===
{| class="wikitable" border="1"
! Name
! Value
! Notes
|-
| CEC_COMMAND_NONE
| 0
|
|-
| CEC_COMMAND_START
| 1
|
|-
| CEC_COMMAND_RESET_START
| 2
|
|-
| CEC_COMMAND_READYSCAN
| 3
|
|-
| CEC_COMMAND_READYSCANWAIT
| 4
|
|-
| CEC_COMMAND_STARTSCAN
| 5
|
|-
| CEC_COMMAND_RESCAN
| 6
|
|-
| CEC_COMMAND_NDM_RESUME
| 7
|
|-
| CEC_COMMAND_NDM_SUSPEND
| 8
|
|-
| CEC_COMMAND_NDM_SUSPEND_IMMEDIATE
| 9
|
|-
| CEC_COMMAND_STOPWAIT
| 0xA
|
|-
| CEC_COMMAND_STOP
| 0xB
|
|-
| CEC_COMMAND_STOP_FORCE
| 0xC
|
|-
| CEC_COMMAND_STOP_FORCE_WAIT
| 0xD
|
|-
| CEC_COMMAND_RESET_FILTER
| 0xE
|
|-
| CEC_COMMAND_DAEMON_STOP
| 0xF
|
|-
| CEC_COMMAND_DAEMON_START
| 0x10
|
|-
| CEC_COMMAND_EXIT
| 0x11
|
|-
| CEC_COMMAND_OVER_BOSS
| 0x12
|
|-
| CEC_COMMAND_OVER_BOSS_FORCE
| 0x13
|
|-
| CEC_COMMAND_OVER_BOSS_FORCE_WAIT
| 0x14
|
|-
| CEC_COMMAND_END
| 0x15
|
|-
|}

=== CecStateAbbreviated ===
{| class="wikitable" border="1"
! Name
! Value
! Notes
|-
| CEC_STATE_ABBREV_IDLE
| 1
| Corresponds to CEC_STATE_IDLE
|-
| CEC_STATE_ABBREV_INACTIVE
| 2
| Corresponds to CEC_STATEs *FINISH*, *POST, and OVER_BOSS
|-
| CEC_STATE_ABBREV_SCANNING
| 3
| Corresponds to CEC_STATE_SCANNING
|-
| CEC_STATE_ABBREV_WLREADY?
| 4
| Corresponds to CEC_STATE_WIRELESS_READY when some unknown bool is true
|-
| CEC_STATE_ABBREV_OTHER
| 5
| Corresponds to CEC_STATEs besides *FINISH*, *POST, and OVER_BOSS and those listed here
|}

=== CecMessageId ===
{| class="wikitable" border="1"
! Type
! Field
|-
| char[8]
| data
|-
|}

= CECD Service "cecd:s" =

This contains a similar (probably the same) command handler from 0x0001.... to 0x0021.... as them in cecd:u. In addition, it also contains
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x0401....
| ?
|-
| 0x04020002
| ?
|-
| 0x040A....
| ?
|-
| 0x040B....
| ?
|-
| 0x040C0042
| ?
|-
| 0x040D0082
| ?
|-
| 0x040E....
| ?
|-
| 0x040F....
| ?
|-
| 0x0410....
| ?
|-
| 0x04110042
| ?
|-
| 0x041200C2
| ?
|-
| 0x0413....
| ?
|-
| 0x0414....
| ?
|-
| 0x0415....
| ?
|-
| 0x04160002
| ?
|-
| 0x0417....
| ?
|-
|}

= CECD Service "cecd:ndm" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010000
| Initialize
|-
| 0x00020000
| Deinitialize
|-
| 0x00030000
| ResumeDaemon
|-
| 0x00040040
| SuspendDaemon(bool immediately)
|-
| 0x00050000
| ?
|-
| 0x00060042
| ?
|-
| 0x00070042
| ?
|-
| 0x00080042
| ?
|-
|}

AC Services

2016-12-12T10:13:53Z

Mailwl: /* AC service "ac:i" */

[[Category:Services]]
= AC service "ac:u" =

These commands are common to both ac:u and ac:i

{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010000
| CreateDefaultConfig
|-
| 0x00040006
| ConnectAsync
|-
| 0x00050002
| GetConnectResult
|-
| 0x00070002
| CancelConnectAsync
|-
| 0x00080004
| CloseAsync
|-
| 0x00090002
| GetCloseResult
|-
| 0x000A0000
| GetLastErrorCode
|-
| 0x000C0000
| ?
|-
| 0x000D0000
| [[ACU:GetWifiStatus|GetWifiStatus]]
|-
| 0x000E0042
| [[ACU:GetCurrentAPInfo|GetCurrentAPInfo]]
|-
| 0x000F0000
| ?
|-
| 0x00100042
| [[ACU:GetCurrentNZoneInfo|GetCurrentNZoneInfo]]
|-
| 0x00110042
| [[ACU:GetNZoneApNumService|GetNZoneApNumService]]
|-
| 0x00120042
| ?
|-
| 0x00190004
| ?
|-
| 0x001A0002
| ?
|-
| 0x001D0042
| [[AC:ScanAPs|ScanAPs]] System Settings uses this via ac:i, this is presumably accessible via ac:u too.
|-
| 0x00240042
| AddDenyApType
|-
| 0x00260042
| ?
|-
| 0x00270002
| GetInfraPriority
|-
| 0x00280042
| ?
|-
| 0x002C0042
| unknown..
|-
| 0x002D0082
| SetRequestEulaVersion
|-
| 0x002F0004
| ?
|-
| 0x00300004
| RegisterDisconnectEvent
|-
| 0x003C0042
| [[ACU:GetAPSSIDList|GetAPSSIDList]]
|-
| 0x003D0042
| ?
|-
| 0x003E0042
| IsConnected
|-
| 0x003F0040
| ?
|-
| 0x00400042
| SetClientVersion
|}

= AC service "ac:i" =

These commands are exclusive to ac:i

{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x04010040
| ?
|-
| 0x04060040
| ?
|-
| 0x04080040
| ?
|-
| 0x040A0040
| ?
|-
| 0x040C0040
| ?
|-
| 0x04100002
| ?
|-
| 0x04140040
| ?
|-
| 0x04160002
| ?
|-
| 0x04180002
| ?
|-
| 0x041A0040
| ?
|-
| 0x041C0040
| ?
|-
| 0x041E0040
| ?
|-
| 0x04200002
| ?
|-
| 0x04220040
| ?
|-
| 0x04240040
| ?
|-
| 0x04260002
| ?
|-
| 0x04280002
| ?
|-
| 0x042C0040
| ?
|-
| 0x042E0040
| ?
|-
| 0x04300002
| ?
|-
| 0x04360040
| ?
|-
| 0x04380040
| ?
|-
| 0x043A0040
| ?
|-
| 0x043C0002
| ?
|-
| 0x043E0002
| ?
|}

AC Services

2016-12-12T10:13:21Z

Mailwl: /* AC service "ac:u" */

[[Category:Services]]
= AC service "ac:u" =

These commands are common to both ac:u and ac:i

{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010000
| CreateDefaultConfig
|-
| 0x00040006
| ConnectAsync
|-
| 0x00050002
| GetConnectResult
|-
| 0x00070002
| CancelConnectAsync
|-
| 0x00080004
| CloseAsync
|-
| 0x00090002
| GetCloseResult
|-
| 0x000A0000
| GetLastErrorCode
|-
| 0x000C0000
| ?
|-
| 0x000D0000
| [[ACU:GetWifiStatus|GetWifiStatus]]
|-
| 0x000E0042
| [[ACU:GetCurrentAPInfo|GetCurrentAPInfo]]
|-
| 0x000F0000
| ?
|-
| 0x00100042
| [[ACU:GetCurrentNZoneInfo|GetCurrentNZoneInfo]]
|-
| 0x00110042
| [[ACU:GetNZoneApNumService|GetNZoneApNumService]]
|-
| 0x00120042
| ?
|-
| 0x00190004
| ?
|-
| 0x001A0002
| ?
|-
| 0x001D0042
| [[AC:ScanAPs|ScanAPs]] System Settings uses this via ac:i, this is presumably accessible via ac:u too.
|-
| 0x00240042
| AddDenyApType
|-
| 0x00260042
| ?
|-
| 0x00270002
| GetInfraPriority
|-
| 0x00280042
| ?
|-
| 0x002C0042
| unknown..
|-
| 0x002D0082
| SetRequestEulaVersion
|-
| 0x002F0004
| ?
|-
| 0x00300004
| RegisterDisconnectEvent
|-
| 0x003C0042
| [[ACU:GetAPSSIDList|GetAPSSIDList]]
|-
| 0x003D0042
| ?
|-
| 0x003E0042
| IsConnected
|-
| 0x003F0040
| ?
|-
| 0x00400042
| SetClientVersion
|}

= AC service "ac:i" =

"ac:i" service has same functions as "ac:u", and additional functions, related with connection setup:

{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x04010040
| ?
|-
| 0x04060040
| ?
|-
| 0x04080040
| ?
|-
| 0x040A0040
| ?
|-
| 0x040C0040
| ?
|-
| 0x04100002
| ?
|-
| 0x04140040
| ?
|-
| 0x04160002
| ?
|-
| 0x04180002
| ?
|-
| 0x041A0040
| ?
|-
| 0x041C0040
| ?
|-
| 0x041E0040
| ?
|-
| 0x04200002
| ?
|-
| 0x04220040
| ?
|-
| 0x04240040
| ?
|-
| 0x04260002
| ?
|-
| 0x04280002
| ?
|-
| 0x042C0040
| ?
|-
| 0x042E0040
| ?
|-
| 0x04300002
| ?
|-
| 0x04360040
| ?
|-
| 0x04380040
| ?
|-
| 0x043A0040
| ?
|-
| 0x043C0002
| ?
|-
| 0x043E0002
| ?
|}

AC Services

2016-12-12T08:38:28Z

Mailwl: /* AC service "ac:i" */

[[Category:Services]]
= AC service "ac:u" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010000
| CreateDefaultConfig
|-
| 0x00040006
| ConnectAsync
|-
| 0x00050002
| GetConnectResult
|-
| 0x00070002
| CancelConnectAsync
|-
| 0x00080004
| CloseAsync
|-
| 0x00090002
| GetCloseResult
|-
| 0x000A0000
| GetLastErrorCode
|-
| 0x000C0000
| ?
|-
| 0x000D0000
| [[ACU:GetWifiStatus|GetWifiStatus]]
|-
| 0x000E0042
| [[ACU:GetCurrentAPInfo|GetCurrentAPInfo]]
|-
| 0x000F0000
| ?
|-
| 0x00100042
| [[ACU:GetCurrentNZoneInfo|GetCurrentNZoneInfo]]
|-
| 0x00110042
| [[ACU:GetNZoneApNumService|GetNZoneApNumService]]
|-
| 0x00120042
| ?
|-
| 0x00190004
| ?
|-
| 0x001A0002
| ?
|-
| 0x001D0042
| [[AC:ScanAPs|ScanAPs]] System Settings uses this via ac:i, this is presumably accessible via ac:u too.
|-
| 0x00240042
| AddDenyApType
|-
| 0x00260042
| ?
|-
| 0x00270002
| GetInfraPriority
|-
| 0x00280042
| ?
|-
| 0x002C0042
| unknown..
|-
| 0x002D0082
| SetRequestEulaVersion
|-
| 0x002F0004
| ?
|-
| 0x00300004
| RegisterDisconnectEvent
|-
| 0x003C0042
| [[ACU:GetAPSSIDList|GetAPSSIDList]]
|-
| 0x003D0042
| ?
|-
| 0x003E0042
| IsConnected
|-
| 0x003F0040
| ?
|-
| 0x00400042
| SetClientVersion
|}

= AC service "ac:i" =

"ac:i" service has same functions as "ac:u", and additional functions, related with connection setup:

{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x04010040
| ?
|-
| 0x04060040
| ?
|-
| 0x04080040
| ?
|-
| 0x040A0040
| ?
|-
| 0x040C0040
| ?
|-
| 0x04100002
| ?
|-
| 0x04140040
| ?
|-
| 0x04160002
| ?
|-
| 0x04180002
| ?
|-
| 0x041A0040
| ?
|-
| 0x041C0040
| ?
|-
| 0x041E0040
| ?
|-
| 0x04200002
| ?
|-
| 0x04220040
| ?
|-
| 0x04240040
| ?
|-
| 0x04260002
| ?
|-
| 0x04280002
| ?
|-
| 0x042C0040
| ?
|-
| 0x042E0040
| ?
|-
| 0x04300002
| ?
|-
| 0x04360040
| ?
|-
| 0x04380040
| ?
|-
| 0x043A0040
| ?
|-
| 0x043C0002
| ?
|-
| 0x043E0002
| ?
|}

Services API

2016-11-11T08:29:47Z

Mailwl: add boss:P to BOSS Services

Nintendo provides application developers with an API, which communicate with certain services. Services, in this sense, are [[Title_list#00040130_-_System_Modules|system processes running in the background]] which wait for incoming requests. When a process wants to communicate with a service, it first needs to get a handle to the named service, and then it can communicate with the service via interprocess communication. Each service has a name up to 8 characters, for example "nim:u".

Handles for services are retrieved from the [[Services|service manager port]], "srv:". Services are an abstraction of ports, they operate the same way except regular ports can have their handles retrieved directly from a SVC.

For a description of how commands and arguments are passed to services, see [[IPC Command Structure]].

List of services (grouped by the process which provides them):
{| class="wikitable" border="1"
|-
! Old3ds
! Services
! Service names
! scope="col" width="200" | Notes
|-
| style="background: green" | Yes
| [[Filesystem services‎]]
| fs:USER, fs:LDR, fs:REG
|
|-
| style="background: green" | Yes
| [[Process Services‎]]
| ps:ps
|
|-
| style="background: green" | Yes
| [[PXI Services‎]]
| PxiFS0, PxiFS1, PxiFSB, PxiFSR, PxiPM, pxi:am9, pxi:dev, pxi:mc, pxi:ps9
|
|-
| style="background: green" | Yes
| [[Application Manager Services]]
| am:app, am:net, am:u, am:sys, am:pipe
|
|-
| style="background: green" | Yes
| [[Process Manager Services]]
| pm:app, pm:dbg
|
|-
| style="background: green" | Yes
| [[NIM Services]]
| nim:aoc, nim:ndm, nim:s, nim:u
|
|-
| style="background: green" | Yes
| [[Config Services]]
| cfg:u, cfg:s, cfg:i, cfg:nor
|
|-
| style="background: green" | Yes
| [[NS|NS and APT Services]]
| ns:s, ns:p, ns:c, APT:A, APT:S, APT:U
|
|-
| style="background: green" | Yes
| [[RO Services]]
| ldr:ro
|
|-
| style="background: green" | Yes
| [[NDM Services]]
| ndm:u
|
|-
| style="background: green" | Yes
| [[CSND Services]]
| csnd:SND
|
|-
| style="background: green" | Yes
| [[Camera Services]]
| cam:u, y2r:u, cam:s, cam:c, cam:q (New3DS only)
|
|-
| style="background: green" | Yes
| [[Codec Services]]
| cdc:HID, cdc:MIC, cdc:CSN, cdc:DSP, cdc:LGY, cdc:CHK
|
|-
| style="background: green" | Yes
| [[DLP Services]]
| dlp:CLNT, dlp:FKCL, dlp:SRVR
|
|-
| style="background: green" | Yes
| [[DSP Services]]
| dsp::DSP
|
|-
| style="background: green" | Yes
| [[GSP Services]]
| gsp::Lcd, gsp::Gpu
|
|-
| style="background: green" | Yes
| [[BOSS Services]]
| boss:U, boss:P
|
|-
| style="background: green" | Yes
| [[CECD Services]]
| cecd:u, cecd:s, cecd:ndm
|
|-
| style="background: green" | Yes
| [[IR Services]]
|
|
|-
| style="background: green" | Yes
| [[I2C Services]]
| i2c::MCU, i2c::CAM, i2c::LCD, i2c::DEB, i2c::HID, i2c::IR, i2c::EEP, i2c::NFC, i2c::QTM
|
|-
| style="background: green" | Yes
| [[GPIO Services]]
| gpio:CDC, gpio:MCU, gpio:HID, gpio:NWM, gpio:IR, gpio:NFC, gpio:QTM
|
|-
| style="background: green" | Yes
| [[HID Services]]
| hid:NFC, hid:QTM, hid:SPVR, hid:USER
|
|-
| style="background: green" | Yes
| [[PTM Services]]
| ptm:gets, ptm:play, ptm:s, ptm:sets, ptm:sysm, ptm:u
|
|-
| style="background: green" | Yes
| [[NWM Services]]
| nwm::UDS
|
|-
| style="background: green" | Yes
| [[HTTP Services]]
| http:C
|
|-
| style="background: green" | Yes
| [[SSL Services]]
| ssl:C
|
|-
| style="background: green" | Yes
| [[Socket Services]]
| soc:P, soc:U
|
|-
| style="background: green" | Yes
| [[AC Services]]
| ac:i, ac:u
|
|-
| style="background: green" | Yes
| [[Friend Services]]
| frd:a, frd:u, frd:n
|
|-
| style="background: green" | Yes
| [[News Services]]
|
|
|-
| style="background: green" | Yes
| [[PDN Services]]
| pdn:s, pdn:d, pdn:i, pdn:g, pdn:c
|
|-
| style="background: green" | Yes
| [[SPI Services]]
| SPI::NOR, SPI::CD2, SPI::CS2, SPI::CS3, SPI::DEF
|
|-
| style="background: green" | Yes
| [[Loader Services]]
| Loader
|
|-
| style="background: green" | Yes
| [[MCU Services]]
| mcu::CAM, mcu::GPU, mcu::HID, mcu::RTC, mcu::SND, mcu::NWM, mcu::HWC, mcu::PLS, mcu::CDC
|
|-
| style="background: green" | Yes
| [[MIC Services]]
| mic:u
|
|-
| style="background: green" | Yes
| [[ACT Services]]
| act:a, act:u
|
|-
| style="background: green" | Yes
| [[NFC Services]]
|
|
|-
| style="background: red" | No
| [[MVD Services]]
|
|
|-
| style="background: red" | No
| [[QTM Services]]
|
|
|}

List of PXI services:
* [[Filesystem services PXI]]
* [[Process Services PXI]]
* [[Application Manager Services PXI]]
* [[Process Manager Services PXI]]
* [[Development Services PXI]]
* [[Gamecard Services PXI]]
* [[Legacy FIRM PXI]] (TWL_FIRM/AGB_FIRM)

List of ports:
* [[ErrDisp]]
* [[Services]]

See [[Error codes]].

AC Services

2016-10-26T10:19:13Z

Mailwl: /* AC service "ac:u" */

BOSS Services

2016-08-13T12:17:21Z

Mailwl: /* BOSS Service "boss:U" */

==BOSS Service "boss:U"==
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010082
| InitializeSession
|-
| 0x00020100
| GetStorageInfo
|-
| 0x00030000
| UnregisterStorage
|-
| 0x00040000
| GetTaskStorageInfo
|-
| 0x00090040
| SetOptoutFlag
|-
| 0x000A0000
| GetOptoutFlag
|-
| 0x000B00C2
| RegisterTask
|-
| 0x000D0082
| ReconfigureTask
|-
| 0x000E0000
| GetTaskIdList
|-
| 0x000C0082
| UnregisterTask
|-
| 0x00100102
| GetNsDataIdList
|-
| 0x00140082
| SendProperty
|-
| 0x00150042
| SendPropertyHandle
|-
| 0x00160082
| ReceiveProperty
|-
| 0x00180082
| UpdateTaskCount
|-
| 0x001A0042
| GetTaskCount
|-
| 0x001B0042
| GetTaskServiceStatus
|-
| 0x001C0042
| StartTask
|-
| 0x001D0042
| StartTaskImmediate
|-
| 0x001E0042
| CancelTask
|-
| 0x001F0000
| GetTaskFinishHandle
|-
| 0x00200082
| GetTaskState
|-
| 0x00210042
| GetTaskResult
|-
| 0x002300C2
| GetTaskStatus
|-
| 0x00260040
| DeleteNsData
|-
| 0x002700C2
| GetNsDataHeaderInfo
|-
| 0x00280102
| ReadNsData
|-
| 0x002D0040
| unknown...
|-
| 0x002B0080
| SetNsDataNewFlag
|-
| 0x002C0040
| GetNsDataNewFlag
|-
| 0x002E0040
| GetErrorCode
|-
| 0x002F0140
| RegisterStorageEntry
|-
| 0x00300000
| unknown...
|-
| 0x00330042
| StartBgImmediate
|-
| 0x003500C2
| RegisterImmediateTask
|-
| 0x00360084
| unknown...
|}

==Privileged BOSS Service "boss:P"==
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x04040080
| unknown...
|-
| 0x040500C0
| unknown...
|-
| 0x040600C0
| unknown...
|-
| 0x04070080
| unknown...
|-
| 0x04090102
| unknown...
|-
| 0x040B0080
| unknown...
|-
| 0x040D0182
| unknown...
|-
| 0x041500C0
| DeleteNsDataPrivileged
|-
| 0x04160142
| unknown...
|-
| 0x04170182
| ReadNsDataPrivileged
|-
| 0x041A0100
| SetNsDataNewFlagPrivileged
|-
| 0x041B00C0
| GetNsDataNewFlagPrivileged
|-
| 0x041C00C0
| unknown...
|-
| 0x042E00C2
| unknown...
|-
| 0x042F00C2
| unknown...
|-
| 0x043000C2
| unknown...
|-
| 0x04490142
| unknown...
|-
| 0x044A0180
| unknown...
|-
| 0x044D0080
| unknown...
|-
| 0x04500102
| unknown...
|-
| 0x04540102
| unknown...
|-
| 0x045500C2
| unknown...
|}

boss:P also contains all of the commands from boss:U.

CECD Services

2016-05-29T18:16:49Z

Mailwl: /* CECD Service "cecd:u" */

[[Category:Services]]

Streetpass stuff.

= CECD Service "cecd:u" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x000100C2
| Open mail box
|-
| 0x00020042
| ?
|-
| 0x00030104
| ?
|-
| 0x00070106
| ? (16*length+10 of CecMessage buffer in cmdbuff[9] (always 16*8+10), CecMessage* in cmdbuf[10])
|-
| 0x00080102
| Delete mail box
|-
| 0x000900C2
| ? (16*length+10 of CecMessage buffer in cmdbuff[4] (always 16*8+10), CecMessage* in cmdbuf[5])
|-
| 0x000A00C4
| ?
|-
| 0x000B0040
| ?
|-
| 0x000C0040
| ?
|-
| 0x000D0082
| ?
|-
| 0x000E0000
| GetCecStateAbbreviated (returns CecStateAbbreviated in cmdbuf[2])
|-
| 0x000F0000
| GetCecInfoEventHandle (returns event handle in cmdbuf[3])
|-
| 0x00100000
| GetChangeStateEventHandle (returns event handle in cmdbuf[3])
|-
| 0x00110104
| OpenAndWrite (cmdbuf[3]: CecMessageType type, cmdbuf[5]: 0x20, cmdbuf[6]: u8* data_buf, cmdbuf[7]: u32 16*data_size+10)
|-
| 0x00120104
| [[CECDU:ReadSavedData|OpenAndRead]]
|-
|}

=== CecCommand ===
{| class="wikitable" border="1"
! Name
! Value
! Notes
|-
| CEC_COMMAND_NONE
| 0
|
|-
| CEC_COMMAND_START
| 1
|
|-
| CEC_COMMAND_RESET_START
| 2
|
|-
| CEC_COMMAND_READYSCAN
| 3
|
|-
| CEC_COMMAND_READYSCANWAIT
| 4
|
|-
| CEC_COMMAND_STARTSCAN
| 5
|
|-
| CEC_COMMAND_RESCAN
| 6
|
|-
| CEC_COMMAND_NDM_RESUME
| 7
|
|-
| CEC_COMMAND_NDM_SUSPEND
| 8
|
|-
| CEC_COMMAND_NDM_SUSPEND_IMMEDIATE
| 9
|
|-
| CEC_COMMAND_STOPWAIT
| 0xA
|
|-
| CEC_COMMAND_STOP
| 0xB
|
|-
| CEC_COMMAND_STOP_FORCE
| 0xC
|
|-
| CEC_COMMAND_STOP_FORCE_WAIT
| 0xD
|
|-
| CEC_COMMAND_RESET_FILTER
| 0xE
|
|-
| CEC_COMMAND_DAEMON_STOP
| 0xF
|
|-
| CEC_COMMAND_DAEMON_START
| 0x10
|
|-
| CEC_COMMAND_EXIT
| 0x11
|
|-
| CEC_COMMAND_OVER_BOSS
| 0x12
|
|-
| CEC_COMMAND_OVER_BOSS_FORCE
| 0x13
|
|-
| CEC_COMMAND_OVER_BOSS_FORCE_WAIT
| 0x14
|
|-
| CEC_COMMAND_END
| 0x15
|
|-
|}

=== CecStateAbbreviated ===
{| class="wikitable" border="1"
! Name
! Value
! Notes
|-
| CEC_STATE_ABBREV_IDLE
| 1
| Corresponds to CEC_STATE_IDLE
|-
| CEC_STATE_ABBREV_NOT_LOCAL?
| 2
| Corresponds to CEC_STATEs *FINISH*, *POST, and OVER_BOSS
|-
| CEC_STATE_ABBREV_SCANNING
| 3
| Corresponds to CEC_STATE_SCANNING
|-
| CEC_STATE_ABBREV_WLREADY?
| 4
| Corresponds to CEC_STATE_WIRELESS_READY when some unknown bool is true
|-
| CEC_STATE_ABBREV_OTHER
| 5
| Corresponds to CEC_STATEs besides *FINISH*, *POST, and OVER_BOSS and those listed here
|}

=== CecMessage ===
{| class="wikitable" border="1"
! Type
! Field
|-
| char[8]
| data
|-
|}

=== CecMessageType ===
{| class="wikitable" border="1"
! Name
! Value
! Notes
|-
| ?
| 0x2
| Corresponds to some 0x60-byte data
|-
| CECMESSAGE_BOX_ICON
| 0x65
| Corresponds to the StreetPass "box" icon
|-
| CECMESSAGE_BOX_TITLE
| 0x6E
| Corresponds to the StreetPass "box" title
|-
|}

= CECD Service "cecd:ndm" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x0001....
| Initialize
|-
| 0x0002....
| Deinitialize
|-
| 0x0003....
| ResumeDaemon
|-
| 0x0004....
| SuspendDaemon(bool immediately)
|-
|}

CECD Services

2016-05-29T10:57:32Z

Mailwl: change names of 2 function

[[Category:Services]]

Streetpass stuff.

= CECD Service "cecd:u" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x000100C2
| ?
|-
| 0x00020042
| ?
|-
| 0x00030104
| ?
|-
| 0x00070106
| ? (16*length+10 of CecMessage buffer in cmdbuff[9] (always 16*8+10), CecMessage* in cmdbuf[10])
|-
| 0x00080102
| ?
|-
| 0x000900C2
| ? (16*length+10 of CecMessage buffer in cmdbuff[4] (always 16*8+10), CecMessage* in cmdbuf[5])
|-
| 0x000A00C4
| ?
|-
| 0x000B0040
| ?
|-
| 0x000C0040
| ?
|-
| 0x000D0082
| ?
|-
| 0x000E0000
| GetCecStateAbbreviated (returns CecStateAbbreviated in cmdbuf[2])
|-
| 0x000F0000
| GetCecInfoEventHandle (returns event handle in cmdbuf[3])
|-
| 0x00100000
| GetChangeStateEventHandle (returns event handle in cmdbuf[3])
|-
| 0x00110104
| OpenAndWrite (cmdbuf[3]: CecMessageType type, cmdbuf[5]: 0x20, cmdbuf[6]: u8* data_buf, cmdbuf[7]: u32 16*data_size+10)
|-
| 0x00120104
| [[CECDU:ReadSavedData|OpenAndRead]]
|-
|}

=== CecCommand ===
{| class="wikitable" border="1"
! Name
! Value
! Notes
|-
| CEC_COMMAND_NONE
| 0
|
|-
| CEC_COMMAND_START
| 1
|
|-
| CEC_COMMAND_RESET_START
| 2
|
|-
| CEC_COMMAND_READYSCAN
| 3
|
|-
| CEC_COMMAND_READYSCANWAIT
| 4
|
|-
| CEC_COMMAND_STARTSCAN
| 5
|
|-
| CEC_COMMAND_RESCAN
| 6
|
|-
| CEC_COMMAND_NDM_RESUME
| 7
|
|-
| CEC_COMMAND_NDM_SUSPEND
| 8
|
|-
| CEC_COMMAND_NDM_SUSPEND_IMMEDIATE
| 9
|
|-
| CEC_COMMAND_STOPWAIT
| 0xA
|
|-
| CEC_COMMAND_STOP
| 0xB
|
|-
| CEC_COMMAND_STOP_FORCE
| 0xC
|
|-
| CEC_COMMAND_STOP_FORCE_WAIT
| 0xD
|
|-
| CEC_COMMAND_RESET_FILTER
| 0xE
|
|-
| CEC_COMMAND_DAEMON_STOP
| 0xF
|
|-
| CEC_COMMAND_DAEMON_START
| 0x10
|
|-
| CEC_COMMAND_EXIT
| 0x11
|
|-
| CEC_COMMAND_OVER_BOSS
| 0x12
|
|-
| CEC_COMMAND_OVER_BOSS_FORCE
| 0x13
|
|-
| CEC_COMMAND_OVER_BOSS_FORCE_WAIT
| 0x14
|
|-
| CEC_COMMAND_END
| 0x15
|
|-
|}

=== CecStateAbbreviated ===
{| class="wikitable" border="1"
! Name
! Value
! Notes
|-
| CEC_STATE_ABBREV_IDLE
| 1
| Corresponds to CEC_STATE_IDLE
|-
| CEC_STATE_ABBREV_NOT_LOCAL?
| 2
| Corresponds to CEC_STATEs *FINISH*, *POST, and OVER_BOSS
|-
| CEC_STATE_ABBREV_SCANNING
| 3
| Corresponds to CEC_STATE_SCANNING
|-
| CEC_STATE_ABBREV_WLREADY?
| 4
| Corresponds to CEC_STATE_WIRELESS_READY when some unknown bool is true
|-
| CEC_STATE_ABBREV_OTHER
| 5
| Corresponds to CEC_STATEs besides *FINISH*, *POST, and OVER_BOSS and those listed here
|}

=== CecMessage ===
{| class="wikitable" border="1"
! Type
! Field
|-
| char[8]
| data
|-
|}

=== CecMessageType ===
{| class="wikitable" border="1"
! Name
! Value
! Notes
|-
| ?
| 0x2
| Corresponds to some 0x60-byte data
|-
| CECMESSAGE_BOX_ICON
| 0x65
| Corresponds to the StreetPass "box" icon
|-
| CECMESSAGE_BOX_TITLE
| 0x6E
| Corresponds to the StreetPass "box" title
|-
|}

= CECD Service "cecd:ndm" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x0001....
| Initialize
|-
| 0x0002....
| Deinitialize
|-
| 0x0003....
| ResumeDaemon
|-
| 0x0004....
| SuspendDaemon(bool immediately)
|-
|}

CECD Services

2016-03-31T07:01:37Z

Mailwl: /* CECD Service "cecd:u" add name for 2 functions */

[[Category:Services]]

Streetpass stuff.

= CECD Service "cecd:u" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x000100C2
| ?
|-
| 0x00030104
| ?
|-
| 0x00070106
| ? (16*length+10 of CecMessage buffer in cmdbuff[9] (always 16*8+10), CecMessage* in cmdbuf[10])
|-
| 0x00080102
| ?
|-
| 0x000900C2
| ? (16*length+10 of CecMessage buffer in cmdbuff[4] (always 16*8+10), CecMessage* in cmdbuf[5])
|-
| 0x000A00C4
| ?
|-
| 0x000B0040
| ?
|-
| 0x000C0040
| ?
|-
| 0x000D0082
| ?
|-
| 0x000E0000
| GetCecStateAbbreviated (returns CecStateAbbreviated in cmdbuf[2])
|-
| 0x000F0000
| GetCecInfoEventHandle (returns event handle in cmdbuf[3])
|-
| 0x00100000
| GetChangeStateEventHandle (returns event handle in cmdbuf[3])
|-
| 0x00110104
| SetSendingData? (cmdbuf[3]: CecMessageType type, cmdbuf[5]: 0x20, cmdbuf[6]: u8* data_buf, cmdbuf[7]: u32 16*data_size+10)
|-
| 0x00120104
| [[CECDU:ReadSavedData|ReadSavedData]]
|-
|}

=== CecCommand ===
{| class="wikitable" border="1"
! Name
! Value
! Notes
|-
| CEC_COMMAND_NONE
| 0
|
|-
| CEC_COMMAND_START
| 1
|
|-
| CEC_COMMAND_RESET_START
| 2
|
|-
| CEC_COMMAND_READYSCAN
| 3
|
|-
| CEC_COMMAND_READYSCANWAIT
| 4
|
|-
| CEC_COMMAND_STARTSCAN
| 5
|
|-
| CEC_COMMAND_RESCAN
| 6
|
|-
| CEC_COMMAND_NDM_RESUME
| 7
|
|-
| CEC_COMMAND_NDM_SUSPEND
| 8
|
|-
| CEC_COMMAND_NDM_SUSPEND_IMMEDIATE
| 9
|
|-
| CEC_COMMAND_STOPWAIT
| 0xA
|
|-
| CEC_COMMAND_STOP
| 0xB
|
|-
| CEC_COMMAND_STOP_FORCE
| 0xC
|
|-
| CEC_COMMAND_STOP_FORCE_WAIT
| 0xD
|
|-
| CEC_COMMAND_RESET_FILTER
| 0xE
|
|-
| CEC_COMMAND_DAEMON_STOP
| 0xF
|
|-
| CEC_COMMAND_DAEMON_START
| 0x10
|
|-
| CEC_COMMAND_EXIT
| 0x11
|
|-
| CEC_COMMAND_OVER_BOSS
| 0x12
|
|-
| CEC_COMMAND_OVER_BOSS_FORCE
| 0x13
|
|-
| CEC_COMMAND_OVER_BOSS_FORCE_WAIT
| 0x14
|
|-
| CEC_COMMAND_END
| 0x15
|
|-
|}

=== CecStateAbbreviated ===
{| class="wikitable" border="1"
! Name
! Value
! Notes
|-
| CEC_STATE_ABBREV_IDLE
| 1
| Corresponds to CEC_STATE_IDLE
|-
| CEC_STATE_ABBREV_NOT_LOCAL?
| 2
| Corresponds to CEC_STATEs *FINISH*, *POST, and OVER_BOSS
|-
| CEC_STATE_ABBREV_SCANNING
| 3
| Corresponds to CEC_STATE_SCANNING
|-
| CEC_STATE_ABBREV_WLREADY?
| 4
| Corresponds to CEC_STATE_WIRELESS_READY when some unknown bool is true
|-
| CEC_STATE_ABBREV_OTHER
| 5
| Corresponds to CEC_STATEs besides *FINISH*, *POST, and OVER_BOSS and those listed here
|}

=== CecMessage ===
{| class="wikitable" border="1"
! Type
! Field
|-
| char[8]
| data
|-
|}

=== CecMessageType ===
{| class="wikitable" border="1"
! Name
! Value
! Notes
|-
| ?
| 0x2
| Corresponds to some 0x60-byte data
|-
| CECMESSAGE_BOX_ICON
| 0x65
| Corresponds to the StreetPass "box" icon
|-
| CECMESSAGE_BOX_TITLE
| 0x6E
| Corresponds to the StreetPass "box" title
|-
|}

= CECD Service "cecd:ndm" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x0001....
| Initialize
|-
| 0x0002....
| Deinitialize
|-
| 0x0003....
| ResumeDaemon
|-
| 0x0004....
| SuspendDaemon(bool immediately)
|-
|}

DLP Services

2016-03-30T04:37:31Z

Mailwl: /* Download Play Server Service "dlp:SRVR" all functions codes added*/

=Download Play Client Service "dlp:CLNT"=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|}

="dlp:FKCL"=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|}

=Download Play Server Service "dlp:SRVR"=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010183
| Initialize...
|-
| 0x00020000
| Finalize...
|-
| 0x00030000
| unknown...
|-
| 0x00040000
| unknown...
|-
| 0x00050080
| unknown...
|-
| 0x00060000
| unknown...
|-
| 0x00070000
| unknown...
|-
| 0x000800C0
| unknown...
|-
| 0x00090040
| unknown...
|-
| 0x000A0040
| unknown...
|-
| 0x000B0042
| unknown...
|-
| 0x000C0040
| unknown...
|-
| 0x000D0040
| unknown...
|-
| 0x000E0040
| unknown...
|-
| 0x000F0303
| unknown...
|-
| 0x00100000
| unknown...
|}

IR Services

2016-02-21T08:47:51Z

Mailwl: clarify some service codes

[[Category:Services]]
= IR Service "ir:u" =
{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Description
|-
| 0x00010000
| [[1.0.0-0]]
| [[IRU:Initialize|Initialize]]
|-
| 0x00020000
| [[1.0.0-0]]
| [[IRU:Shutdown|Shutdown]]
|-
| 0x00030042
| [[1.0.0-0]]
| [[IRU:StartSendTransfer|StartSendTransfer]]
|-
| 0x00040000
| [[1.0.0-0]]
| [[IRU:WaitSendTransfer|WaitSendTransfer]]
|-
| 0x000500C2
| [[1.0.0-0]]
| [[IRU:StartRecvTransfer|StartRecvTransfer]]
|-
| 0x00060000
| [[1.0.0-0]]
| [[IRU:WaitRecvTransfer|WaitRecvTransfer]]
|-
| 0x00070000
| [[1.0.0-0]]
| [[IRU:GetRecvTransferCount|GetRecvTransferCount]]
|-
| 0x00080000
| [[1.0.0-0]]
| [[IRU:GetSendState|GetSendState]]
|-
| 0x00090040
| [[1.0.0-0]]
| [[IRU:SetBitRate|SetBitRate]]
|-
| 0x000A0000
| [[1.0.0-0]]
| [[IRU:GetBitRate|GetBitRate]]
|-
| 0x000B0040
| [[1.0.0-0]]
| [[IRU:SetIRLEDState|SetIRLEDState]]
|-
| 0x000C0000
| [[1.0.0-0]]
| [[IRU:GetIRLEDRecvState|GetIRLEDRecvState]]
|-
| 0x000D0000
| [[1.0.0-0]]
| [[IRU:GetSendFinishedEvent|GetSendFinishedEvent]]
|-
| 0x000E0000
| [[1.0.0-0]]
| [[IRU:GetRecvFinishedEvent|GetRecvFinishedEvent]]
|-
| 0x000F0000
| [[1.0.0-0]]
| [[IRU:GetTransferState|GetTransferState]]
|-
| 0x00100000
| [[1.0.0-0]]
| GetErrorStatus
|-
| 0x00110040
| [[1.0.0-0]]
| [[IRU:SetSleepModeActive|SetSleepModeActive]]
|-
| 0x00120040
| [[1.0.0-0]]
| [[IRU:SetSleepModeState|SetSleepModeState]]
|}

= IR Service "ir:USER" =
{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Description
|-
| 0x00010182
| [[2.0.0-2]]
| InitializeIrnop(cmd[5]=[[IRU:SetBitRate|bitrate]] value, cmd[7]=0, cmd[8]=handle, the rest unknown)
|-
| 0x00020000
| [[2.0.0-2]]
| FinalizeIrnop
|-
| 0x00030000
| [[2.0.0-2]]
| ClearReceiveBuffer
|-
| 0x00040000
| [[2.0.0-2]]
| ClearSendBuffer
|-
| 0x000500C0
| [[2.0.0-2]]
| WaitConnection
|-
| 0x00060040
| [[2.0.0-2]]
| RequireConnection (u8 input)
|-
| 0x00070C20
| [[2.0.0-2]]
| AutoConnection
|-
| 0x00080000
| [[2.0.0-2]]
| AnyConnection
|-
| 0x00090000
| [[2.0.0-2]]
| Disconnect
|-
| 0x000A0000
| [[2.0.0-2]]
| GetReceiveEvent (writes event handle to cmdreply[3])
|-
| 0x000B0000
| [[2.0.0-2]]
| GetSendEvent (writes event handle to cmdreply[3])
|-
| 0x000C0000
| [[2.0.0-2]]
| GetConnectionStatusEvent (writes event handle to cmdreply[3])
|-
| 0x000D0042
| [[2.0.0-2]]
| SendIrnop (u32 size, ((Size<<14) <nowiki>|</nowiki> 2), inbufptr)
|-
| 0x000E0042
| [[2.0.0-2]]
| SendIrnopLarge (u32 size, ((Size<<8) <nowiki>|</nowiki> 10), inbufptr)
|-
| 0x000F0040
| [[2.0.0-2]]
| ReceiveIrnop
|-
| 0x00100042
| [[2.0.0-2]]
| ReceiveIrnopLarge
|-
| 0x0011....
| [[2.0.0-2]]
| GetLatestReceiveErrorResult
|-
| 0x0012....
| [[2.0.0-2]]
| GetLatestSendErrorResult
|-
| 0x0013....
| [[2.0.0-2]]
| GetConnectionStatus
|-
| 0x0014....
| [[2.0.0-2]]
| GetTryingToConnectStatus
|-
| 0x0015....
| [[2.0.0-2]]
| GetReceiveSizeFreeAndUsed
|-
| 0x0016....
| [[2.0.0-2]]
| GetSendSizeFreeAndUsed
|-
| 0x0017....
| [[2.2.0-X]]
| GetConnectionRole
|-
| 0x00180182
| [[2.2.0-X]]
| InitializeIrnopShared (u32, u32, u32, u32, u32, cmd[6] = u8 [[IRU:SetBitRate|bitrate]] value, 0, handle)
|-
| 0x00190040
| [[2.2.0-X]]
| ReleaseReceivedData (32bit_value input)
|-
| 0x001A0040
| [[2.2.0-X]]
| SetOwnMachineId (u8 input)
|}

This service was added with [[2.0.0-2]].

When sending data, SendIrnop is used when the size is <=0xFC, otherwise SendIrnopLarge is used.

= IR Service "ir:rst" =
{| class="wikitable" border="1"
|-
! Command Header
! Available since system-version
! Description
|-
| 0x00010000
| [[8.0.0-18]]
| [[IRRST:GetHandles|GetHandles]]
|-
| 0x00020080
| [[8.0.0-18]]
| [[IRRST:Initialize|Initialize]]
|-
| 0x00030000
| [[8.0.0-18]]
| [[IRRST:Shutdown|Shutdown]]
|-
| 0x00040000
| [[8.0.0-18]]
| This writes an unknown u8 to index-word cmdreply[2], from data loaded from an I2C device register.
|-
| 0x00050000
| [[8.0.0-18]]
| This writes an unknown u8 from IR-module state to index-word cmdreply[2].
|-
| 0x00060000
| [[8.0.0-18]]
| This writes two unknown u8 fields from IR-module state to index-word cmdreply[2] and cmdreply[3].
|-
| 0x00070080
| [[9.0.0-20]]
| (u8 unk0, u8 unk1) ?
|-
| 0x00080000
| [[9.0.0-20]]
| (u8 unk0, u8 unk1) ?
|-
| 0x00090000
| [[9.0.0-20]]
| This writes two unknown u8 fields to index-word cmdreply[2] and cmdreply[3].
|}

This service was added with [[8.0.0-18]]. Unlike the other IR services, this uses [[I2C]] deviceid 17(this deviceid isn't actually handled by the [[8.0.0-18]] I2C module). This is for the additional [[New 3DS]] HID hardware, this HID data is stored in [[IRRST_Shared_Memory|shared-memory]]. Even with [[9.0.0-20]] IR module still registers+handles this service on both Old3DS+New3DS.

=IR Services=
Only one session(two sessions starting with [[8.0.0-18]]) to any of these services can be open at a time, thus only one/two process(es) can use any of these services at once. These services interface with hardware services gpio::IR and i2c::IR. The i2c::IR service is used for sending/receiving data.

IRU is for regular IR comms. IRUSER uses a custom IR protocol(above the physical layer). Both of these services use IrDA-SIR. The IR hardware seems to only support IrDA-SIR, other physical protocols such as the one for TV-remotes are not supported(going by the datasheet linked [[Hardware|here]] for a different IC at least).

The protocol used with IRUSER involves encryption(?) implemented in software. IRUSER is used for the [[Circle Pad Pro]]. This same IRUSER service uses the New3DS HID hardware when running on New3DS(note that the main service for New3DS HID is ir:rst).

NS and APT Services

2015-09-28T04:36:35Z

Mailwl: right code for 0x00510080

[[Category:Services]]
The NS ('''N'''intendo User Interface '''S'''hell) system module is the first module launched from a CTR-NAND title after the [[FIRM]] processes are loaded. This module is launched by the pm process, with the titleID loaded from NS state(hard-coded TID initialized during applet TID-array initialization). NS first launches [[ErrDisp]], then the menu. On retail the menu TID is loaded from NS state, while on dev/debug the menu TID is loaded from [[Config_Savegame|config]]. On dev-units if the menu TID block doesn't exist in [[Config_Savegame|config]], NS will attempt to launch the alternate menu instead. The TID of the launched menu is then written to [[Configuration Memory|ACTIVEMENUTID]]. NS uses [[PMApp:LaunchTitle|pm:app]] to launch titles.

NS will not trigger the [[ErrDisp|fatal-error]] screen when launching the regular/alternate menu fails.

Like home menu NS is constantly running while the system is in 3DS-mode. When attempting to return to home-menu when the home-menu process isn't running(like when the process terminated/crashed), NS will trigger a [[ErrDisp|fatal]] error.

= Alternate menu =
When launching the regular menu fails, NS will then attempt to launch the alternate menu. This title could be used as a recovery process, however it's normally not used after the factory.

At the factory for all 3DS systems, [[3DS Development Unit GUI#Test Menu|Test Menu]] is installed with this TID. On retail this title is eventually deleted during [[Factory Setup]].

= Auto-boot =
After [[PMApp:GetFIRMLaunchParams|loading]] [[FIRM]] params and prior to launching [[ErrDisp]]/Home Menu, NS handles auto-booting titles. The same code called by [[APT:Reboot]] is used for launching FIRM here. When the [[Configuration_Memory|UPDATEFLAG]] is set, NS will launch SAFE_MODE_FIRM with the application titleID set to the [[System_Settings#System_Updater|System Updater]] titleID for this region. When the UPDATEFLAG is not set, NS can auto-boot the following titles as well if [[Configuration_Memory|0x1FF80016]] bit0 is set.

When bit1 and bit2 are value zero in [[Configuration_Memory|0x1FF80016]], NS will [[NSS:LaunchFIRM|launch]] the title specified by the [[FIRM]] parameters if the title-info is set. This FIRM launch is done after launching [[ErrDisp]] and Home Menu. Otherwise when [[Configuration_Memory|0x1FF80016]] is value 2 and the output u8 from [[PTM|PTMSYSM]] command 0x08140000 is value 0, NS will boot the title specified from the TWL TLNC block from FIRMparams+0x300. This is the same TLNC block which DSi titles wrote to RAM+0x300 for launching other titles via the launcher title. When handling the TLNC block, NS will boot the 3DS System Settings title when the TLNC titleID is the DSi System Settings titleID(the region field in the TLNC TID is not checked/used). When the TLNC titleID is not System Settings, NS will convert the input DSi titleID-high to the 3DS TWL titleID-high(tidhigh = (TLNCtidhigh & 0x7FFF) | 0x48000), then launch TWL_FIRM to run the title. NS does not support launching from gamecard via TLNC.

= NS Workaround =
A "ns_workaround" was [[5.1.0-11|added]] in NS to workaround the flaw added with [[5.0.0-11]]. When NS is loading before launching any ARM11 processes and certain [[Configuration Memory]] fields are set, NS will launch [[Application_Manager_Services|AM]] then use command [[AM:InstallNATIVEFIRM]]. NS will then execute the code called by [[APT:StartNewestHomeMenu]], the code related to APT:PrepareToStartNewestHomeMenu is not executed here.

NS will only execute this code-path when [[Configuration Memory|0x1FF80016]] is value zero, when KERNEL_VERSIONMAJOR is value 2, and when KERNEL_VERSIONMINOR is less than 35. Therefore, this code-path is only executed when the running NATIVE_FIRM version is prior to [[5.0.0-11]].

= NS Service "ns:s" =
{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Description
|-
| 0x000100C0
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:LaunchFIRM|LaunchFIRM]]
|-
| 0x000200C0
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:LaunchTitle|LaunchTitle]]
|-
| 0x0003....
| [[1.0.0-0]] - [[2.0.0-2]]
| Wrapper for [[Process_Manager_Services|PMApp]] command 0x00030080.
|-
| 0x0004....
| [[1.0.0-0]] - [[2.0.0-2]]
| Wrapper for [[Process_Manager_Services|PMApp]] command 0x000500C0.
|-
| 0x000500C0
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:LaunchApplicationFIRM|LaunchApplicationFIRM]]
|-
| 0x00060042
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:SetFIRMParams4A0|SetFIRMParams4A0]]
|-
| 0x00070042
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:CardUpdateInitialize|CardUpdateInitialize]]
|-
| 0x00080000
| [[1.0.0-0]] - [[2.0.0-2]]
| This shuts down the gamecard system update interface: the shared memory is unmapped, the CFA archive is closed, state is cleared, etc.
|-
| 0x0009....
| [[1.0.0-0]] - [[2.0.0-2]]
| Gamecard system update related.
|-
| 0x000A....
| [[1.0.0-0]] - [[2.0.0-2]]
| Gamecard system update related.
|-
| 0x000B....
| [[1.0.0-0]] - [[2.0.0-2]]
| Gamecard system update related.
|-
| 0x000C....
| [[1.0.0-0]] - [[2.0.0-2]]
| Gamecard system update related.
|-
| 0x000D0140
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:SetFIRMParams4B0|SetFIRMParams4B0]]
|-
| 0x000E....
| [[1.0.0-0]] - [[2.0.0-2]]
| Wrapper for "ptm:sysm" service command 0x040700C0.
|-
| 0x000F0000
| [[1.0.0-0]] - [[2.0.0-2]]
| This calls [[APT:AppletUtility]] with fixed input params.
|-
| 0x00100180
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:RebootSystem|RebootSystem]]
|-
| 0x0011....
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:TerminateProcessTID|TerminateProcessTID]]
|-
| 0x0012....
| ?
| Uses pm:app cmdA&B
|-
| 0x0013....
| ?
| ?
|-
| 0x0014....
| ?
| ?
|-
| 0x0015....
| ?
| ?
|-
| 0x00160000
| [[8.0.0-18]]
| This triggers a hw-reboot.
|}

The maximum sessions that can be used with this service is two, therefore only two processes can use this service at the same time.

=NS Service "ns:p"=
This was added with [[3.0.0-5]]. The PTM sysmodule connects to this service, and syncs whenever [[PTM|ptm:s GetShellState()]] changes.

=NS Service "ns:c"=
This was added with [[5.0.0-11]], it's unknown what this is used for.

=APT Services=
{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Accessible with APT:U
! Description
|-
| 0x00010040
|
| Yes
| GetLockHandle
|-
| 0x00020080
|
| See [[APTU:Initialize|here]].
| [[APTU:Initialize|Initialize]]
|-
| 0x00030040
|
| Yes
| Enable
|-
| 0x00040040
|
| Yes
| Finalize
|-
| 0x00050040
|
| Yes
| [[APT:GetAppletManInfo|GetAppletManInfo]]
|-
| 0x00060040
|
| Yes
| [[APT:GetAppletInfo|GetAppletInfo]]
|-
| 0x00070000
|
| Yes
| GetLastSignaledAppletId
|-
| 0x00080000
|
| Yes
| CountRegisteredApplet
|-
| 0x00090040
|
| Yes
| [[APT:IsRegistered|IsRegistered]]
|-
| 0x000A0040
|
| Yes
| GetAttribute
|-
| 0x000B0040
|
| Yes
| [[APTU:GetSignalType|InquireNotification]]
|-
| 0x000C0104
|
| Yes
| [[APT:SendParameter|SendParameter]]
|-
| 0x000D0080
|
| Yes
| [[APT:ReceiveParameter|ReceiveParameter]]
|-
| 0x000E0080
|
| Yes
| [[APT:GlanceParameter|GlanceParameter]]
|-
| 0x000F0100
|
| Yes
| [[APT:CancelParameter|CancelParameter]]
|-
| 0x001000C2
|
| Yes
| DebugFunc
|-
| 0x001100C0
|
| Yes
| [[APT:MapProgramIdForDebug|MapProgramIdForDebug]]
|-
| 0x00120040
|
| Yes
| SetHomeMenuAppletIdForDebug
|-
| 0x00130000
|
| Yes
| GetPreparationState
|-
| 0x00140040
|
| Yes
| SetPreparationState
|-
| 0x00150140
|
| No
| [[APT:PrepareToStartApplication|PrepareToStartApplication]]
|-
| 0x00160040
|
| Yes
| PreloadLibraryApplet
|-
| 0x00170040
|
| Yes
| FinishPreloadingLibraryApplet
|-
| 0x00180040
|
| Yes
| PrepareToStartLibraryApplet
|-
| 0x00190040
|
| Yes
| [[APT:PrepareToStartSystemApplet|PrepareToStartSystemApplet]]
|-
| 0x001A0000
|
| Yes
| PrepareToStartNewestHomeMenu
|-
| 0x001B00C4
|
| Yes
| [[APT:StartApplication|StartApplication]]
|-
| 0x001C0000
|
| Yes
| WakeupApplication
|-
| 0x001D0000
|
| Yes
| CancelApplication
|-
| 0x001E0084
|
| Yes
| StartLibraryApplet
|-
| 0x001F0084
|
| Yes
| [[APT:StartSystemApplet|StartSystemApplet]]
|-
| 0x00200044
|
| Yes
| [[APT:StartNewestHomeMenu|StartNewestHomeMenu]]
|-
| 0x00210000
|
| No
| OrderToCloseApplication
|-
| 0x00220040
|
| Yes
| PrepareToCloseApplication(bool isJumpToHome)
|-
| 0x00230040
|
| Yes
| PrepareToJumpToApplication
|-
| 0x00240044
|
| Yes
| JumpToApplication
|-
| 0x002500C0
|
| Yes
| PrepareToCloseLibraryApplet
|-
| 0x00260000
|
| Yes
| PrepareToCloseSystemApplet
|-
| 0x00270044
|
| Yes
| CloseApplication
|-
| 0x00280044
|
| Yes
| CloseLibraryApplet
|-
| 0x00290044
|
| Yes
| CloseSystemApplet
|-
| 0x002A0000
|
| Yes
| OrderToCloseSystemApplet
|-
| 0x002B0000
|
| Yes
| PrepareToJumpToHomeMenu
|-
| 0x002C0044
|
| Yes
| JumpToHomeMenu
|-
| 0x002D0000
|
| Yes
| PrepareToLeaveHomeMenu
|-
| 0x002E0044
|
| Yes
| LeaveHomeMenu
|-
| 0x002F0040
|
| Yes
| PrepareToLeaveResidentApplet This is stubbed: this just returns 0.
|-
| 0x00300044
|
| Yes
| LeaveResidentApplet This is stubbed: this just returns 0 after verifying the cmd/translate headers.
|-
| 0x00310100
|
| Yes
| [[APT:PrepareToDoApplicationJump|PrepareToDoApplicationJump]]
|-
| 0x00320084
|
| Yes
| [[APT:DoApplicationJump|DoApplicationJump]]
|-
| 0x00330000
|
| Yes
| GetProgramIdOnApplicationJump
|-
| 0x00340084
|
| Yes
| [[APT:SendDeliverArg|SendDeliverArg]]
|-
| 0x00350080
|
| Yes
| ReceiveDeliverArg
|-
| 0x00360040
|
| Yes
| [[APT:LoadSysMenuArg|LoadSysMenuArg]]
|-
| 0x00370042
|
| Yes
| [[APT:StoreSysMenuArg|StoreSysMenuArg]]
|-
| 0x00380040
|
| Yes
| PreloadResidentApplet This is stubbed: this just returns 0.
|-
| 0x00390040
|
| Yes
| PrepareToStartResidentApplet This is stubbed: this just returns 0.
|-
| 0x003A0044
|
| Yes
| StartResidentApplet This is stubbed: this just returns 0 after verifying the cmd/translate headers.
|-
| 0x003B0040
|
| Yes
| CancelLibraryApplet
|-
| 0x003C0042
|
| Yes
| SendDspSleep
|-
| 0x003D0042
|
| Yes
| SendDspWakeUp
|-
| 0x003E0080
|
| Yes
| ReplySleepQuery
|-
| 0x003F0040
|
| Yes
| ReplySleepNotificationComplete
|-
| 0x00400042
|
| Yes
| [[APT:SendCaptureBufferInfo|SendCaptureBufferInfo]]
|-
| 0x00410040
|
| Yes
| [[APT:ReceiveCaptureBufferInfo|ReceiveCaptureBufferInfo]]
|-
| 0x00420080
|
| Yes
| SleepSystem
|-
| 0x00430040
|
| Yes
| NotifyToWait
|-
| 0x00440000
|
| Yes
| GetSharedFont
|-
| 0x00450040
|
| Yes
| GetWirelessRebootInfo
|-
| 0x00460104
|
| Yes
| [[APT:Wrap|Wrap]]
|-
| 0x00470104
|
| Yes
| [[APT:Unwrap|Unwrap]]
|-
| 0x00480100
|
| No
| [[APT:GetProgramInfo|GetProgramInfo]]
|-
| 0x00490180
|
| No
| [[APT:Reboot|Reboot]]
|-
| 0x004A0040
|
| Yes
| [[APT:GetCaptureInfo|GetCaptureInfo]]
|-
| 0x004B00C2
|
| Yes
| [[APT:AppletUtility|AppletUtility]]
|-
| 0x004C0000
|
| Yes
| SetFatalErrDispMode
|-
| 0x004D0080
|
| Yes
| [[APT:GetAppletProgramInfo|GetAppletProgramInfo]]
|-
| 0x004E0000
|
| Yes
| HardwareResetAsync
|-
| 0x004F0080
| [[2.2.0-X]]
| Yes
| [[APT:SetApplicationCpuTimeLimit|SetApplicationCpuTimeLimit]]
|-
| 0x00500040
| [[2.2.0-X]]
| Yes
| [[APT:GetApplicationCpuTimeLimit|GetApplicationCpuTimeLimit]]
|-
| 0x00510080
| [[3.0.0-5]]
| ?
| Uses pm:app cmdB
|-
| 0x00520104
| [[4.0.0-7]]
| ?
| Wrap1
|-
| 0x00530104
| [[4.0.0-7]]
| ?
| Unwrap1
|-
| 0x00540040
| [[5.0.0-11]]
| ?
| ?
|-
| 0x00550040
| [[7.0.0-13]]
| Yes
| This writes the input u8 to a NS state field.
|-
| 0x00560000
| [[7.0.0-13]]
| Yes
| This returns an u8 NS state field(which can be set by cmd 0x00550040), at cmdreply+8.
|-
| 0x00570044
| [[7.0.0-13]]
| ?
| WakeupApplication2?
|-
| 0x00580002
| [[7.0.0-13]]
| Yes
| [[APT:GetProgramID]]
|-
| 0x01010000
| [[8.0.0-18]]
| Yes
| This writes an output u8 to cmdreply indexword[2]. This uses [[PTMSYSM:CheckNew3DS]]. When a certain NS state field is non-zero, the output value is zero, otherwise the output is from [[PTMSYSM:CheckNew3DS]]. Normally this NS state field is zero, however this state field is set to 1 when [[APT:PrepareToStartApplication]] is used with flags bit8 is set.
|-
| 0x01020000
| [[8.0.0-18]]
| Yes
| Wrapper for [[PTMSYSM:CheckNew3DS]].
|-
| 0x01030000
| [[8.0.0-18]]
| Yes
| ?
|-
| 0x01040000
| [[8.0.0-18]]
| ?
| ?
|}

These "APT:U" and "APT:S" NS services can handle launching titles/"applets", these services handle signaling for home/power button as well. Only one session for either APT service can be open at a time, normally processes close the service handle immediately once finished using the service. The commands for APT:U and APT:S are exactly the same, however certain commands are only accessible with APT:S(NS module will call [[SVC|svcBreak]] when the command isn't accessible).

Applets returning to home-menu first use commands APT:PrepareToJumpToHomeMenu and APT:JumpToHomeMenu, followed by these commands to launch home-menu: [[APT:PrepareToStartSystemApplet]] and [[APT:StartSystemApplet]]. [[APT:PrepareToStartSystemApplet]] and [[APT:StartSystemApplet]] are also used for launching the [[Internet Browser]], the camera applet, etc.

Processes launch applications via home-menu, not directly with [[APT:PrepareToStartApplication]] and [[APT:StartApplication]]. Regular applications can't directly launch applications since [[APT:StartApplication]] launches the process without terminating the currently running application.

APT:PrepareToDoApplicationJump and APT:DoApplicationJump are used by applications, for launching native/<non-NATIVE_FIRM> applications. These commands notify Home Menu that title launching needs done, Home Menu does the actual title launching via NS commands.

="APT:A" Service=
This was added with [[7.0.0-13|7.0.0-X]]. Official apps built with the CTRSDK for system-version >=[[7.0.0-13|7.0.0-X]] normally use the "APT:A" service instead of "APT:U". Those processes also have "APT:A" instead of "APT:U" in the service-access-control. It's unknown whether there's anything which is only accessible via "APT:A".

=Applets=
NS module does not verify that the input appID for the APT service cmds are correct for that type of command. For example, a process-launch of a SystemApplet via LibraryApplet commands works fine(minus the launched-process side of APT probably).

==System Applets==
On Old3DS there could only be one applet here(Home Menu, Internet Browser, Friend-List, etc) with programID-high 00040030 running at a time. On Old3DS when directly launching one of these 00040030 applets with Home Menu, the Home Menu process will terminate once the process is launched. On Old3DS when returning to Home Menu from that launched process, the Home Menu process is launched again.

On New3DS the Home Menu process is still running/in-memory, while another system-applet is running. On New3DS it appears that the Home Menu process is terminated+relaunched, when another system-applet terminated without exiting with APT properly.

==Library Applets==
Library applets can be launched by applications and regular applets. These library applets render to the screen(s) when running, etc. For example, this includes swkbd for text input. See the below appIDs in the 0x2XX range, the actual appID used is 0x4XX however.

Input data can be sent to the library applet via the NS [[APT:SendParameter|parameter]] buffer, and/or with shared-memory with a shared-mem handle sent to the library applet. Output data from the library applet can be received by [[APT:ReceiveParameter]], the library applet can also use the specified shared-mem for output too.

=AppIDs=
{| class="wikitable" border="1"
|-
! AppID
! Description
|-
| 0x101
| Home Menu (menu)
|-
| 0x103
| Alternate Menu
|-
| 0x110
| Camera applet (CtrApp)
|-
| 0x112
| Friends List applet (friend)
|-
| 0x113
| Game Notes applet (Cherry)
|-
| 0x114
| [[Internet Browser]] (spider/SKATER)
|-
| 0x115
| Instruction Manual applet
|-
| 0x116
| Notifications applet (newslist)
|-
| 0x117
| Miiverse applet (olv)
|-
| 0x118
| Miiverse posting applet (solv3)
|-
| 0x119
| Amiibo settings (cabinet)
|-
| 0x201
| Software Keyboard (swkbd) (?)
|-
| 0x202
| Mii Selector (appletEd) (?)
|-
| 0x204
| Photo Selector (PNOTE_AP) (?)
|-
| 0x205
| Sound Selector (SNOTE_AP) (?)
|-
| 0x206
| Error Display (error) (?)
|-
| 0x207
| eShop applet (mint) (?)
|-
| 0x208
| Circle Pad Pro Calibrator ([[Extrapad_Applet|extrapad]]) (?)
|-
| 0x209
| Notepad (memolib) (?)
|-
| 0x300
| Application
|-
| 0x301
| eShop (tiger)
|-
| 0x401
| Software Keyboard (swkbd)
|-
| 0x402
| Mii Selector (appletEd)
|-
| 0x404
| Photo Selector (PNOTE_AP)
|-
| 0x405
| Sound Selector (SNOTE_AP)
|-
| 0x406
| Error Display (error)
|-
| 0x407
| eShop applet (mint)
|-
| 0x408
| Circle Pad Pro Calibrator ([[Extrapad_Applet|extrapad]])
|-
| 0x409
| Notepad (memolib)
|-
| 0xF10
| ProgramID: 0004003000008900.
|-
| 0xF11
| ProgramID: 000400000FFFFD00.
|-
| 0xF12
| ProgramID: 000400000FFFFC00.
|-
| 0xF13
| ProgramID: 000400000FFFFB00.
|-
| 0xF14
| ProgramID: 000400000FFFF900.
|-
| 0xF15
| ProgramID: 000400000FFFF800.
|-
| 0xF16
| ProgramID: 000400000FFFF700.
|-
| 0xF17
| ProgramID: 000400000FFFF600.
|-
| 0xF18
| ProgramID: 000400000FFFF500.
|}

These AppIDs are all for NAND titles, except for 0x300. AppIDs in the 0x1XX range are applets(programID-high 00040030), and the AppIDs in the 0x2XX range are "system libraries"(programID-high 00040030). The 0xFXX AppID range is for development NAND applications, these are not available for retail.

Note that at some point the total AppID entry count was changed from 28 to 27.

FS:OpenArchive

2015-06-25T08:56:09Z

Mailwl: /* Archive idcodes */

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x080C00C2]
|-
| 1
| Archive idcode
|-
| 2
| [[FS:OpenFile|LowPath]].Type
|-
| 3
| LowPath.Size
|-
| 4
| (LowPath.Size<<14) <nowiki>|</nowiki> 2
|-
| 5
| LowPath.Data pointer
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code
|-
| 1
| Resultcode
|-
| 2
| Archive handle lower word
|-
| 3
| Archive handle upper word
|}

=Archive idcodes =
{| class="wikitable" border="1"
|-
! Idcode
! Description
! Accessible via [[Filesystem_services|FS]]
! Accessible via [[Filesystem_services_PXI|FSPXI]]
! Requires binary [[FS:OpenFile|Lowpath]]
|-
| 0x00000003
| Application RomFS
| Yes
| No
| No
|-
| 0x00000004
| SaveData (the saveID/mediatype for this is loaded from data originally from the user process' exheader)
| Yes
| No
| No
|-
| 0x00000006
| ExtSaveData
| Yes
| No
| Yes
|-
| 0x00000007
| Shared ExtSaveData
| Yes
| No
| Yes
|-
| 0x00000008
| SystemSaveData
| Yes
| No
| Yes
|-
| 0x00000009
| SDMC
| Yes
| Yes
| No
|-
| 0x0000000A
| SDMC Write-Only
| Yes
| No
| No
|-
| 0x12345678
| ExtSaveData for BOSS
| Yes
| No
| Yes
|-
| 0x12345679
| CARD SPI FS
| Yes
| Yes
| No
|-
| 0x1234567B
| ExtSaveData, and ExtSaveData for BOSS
| No
| Yes
| Yes
|-
| 0x1234567C
| SystemSaveData
| No
| Yes
| Yes
|-
| 0x1234567D
| NAND RW
| Yes
| Yes
| No
|-
| 0x1234567E
| NAND RO
| Yes
| Yes
| No
|-
| 0x1234567F
| NAND RO Write FS
| No
| Yes
| No
|-
| 0x2345678A
| User/GameCard SaveData (for check), and other uses (FS can only mount the latter) (lo hi mediatype reserved)
| Yes
| Yes
| Yes
|-
| 0x2345678B
| ?
| No
| No
| Yes
|-
| 0x2345678C
| ?
| No
| No
| Yes
|-
| 0x2345678D
| ?
| No
| No
| No
|-
| 0x2345678E
| SaveData, ExeFS, and RomFS (For [[Filesystem_services|fs:LDR]], only ExeFS)
| Yes
| Yes
| Yes
|-
| 0x567890AB
| NAND CTR FS
| No
| Yes
| No
|-
| 0x567890AC
| TWL PHOTO
| Yes
| Yes
| No
|-
| 0x567890AD
| ?
| No
| Yes
| No
|-
| 0x567890AE
| NAND TWL FS
| Yes
| Yes
| No
|-
| 0x567890AF
| NAND W FS
| Yes
| Yes
| No
|-
| 0x567890B0
| ?
| No
| Yes
| No
|-
| 0x567890B1
| Gamecard SaveData (for check). This is a wrapper for UserSaveDataForCheck: the OpenArchive code for that is called with archive-lowpath TID=0/mediatype=2(gamecard).
| Yes
| No
| No
|-
| 0x567890B2
| UserSaveData (for check). This is the same as the regular SaveData archive, except with this the savedata ID and mediatype is loaded from the input archive lowpath.
| Yes
| No
| Yes
|-
| 0x567890B4
| ? SaveData from Demo Version of Retail Game
| Yes
| No
| No
|}
Archives listed as not requiring a binary lowpath, use lowpath type [[FS:OpenFile|empty]].

Archives CTR NAND, NAND RO Write FS, TWL NAND, NAND W FS, and CARD SPI FS require the corresponding process exheader access control mount flag to be set, in the exheader for any of the currently running ARM11 processes, for [[Filesystem_services_PXI|FSPXI]]. The access rights checked by [[Filesystem services|FS]] module for archive mounting with fs:USER, are stored in the process' exheader accessinfo.

The CARDSPI archive allows access to the gamecard CARD1 raw savedata flash(aka "cardspi:/" in [[FIRM|Process9]]), the file lowpath must be WCHAR "/". The "NAND W FS" archive allows access to the raw NAND image(aka "wnand:/" in Process9), the file lowpath must be WCHAR "/".

Talk:DSP:RegisterInterruptEvents

2015-06-23T04:38:59Z

Mailwl:

DSP really changes header in answer? but why? applications never checks it, as far as i know
--[[User:Mailwl|Mailwl]] 13:47, 21 June 2015 (CEST)

Many do that in case of an error for example some errors in the GSP come back with 0x00000040
--[[User:ichfly]]

All services change the header, because it's used by the kernel to know how to send the parameters back to the calling process. [[User:Yuriks|Yuriks]] 00:49, 23 June 2015 (CEST)

Ah, this make sense
--[[User:Mailwl|Mailwl]] 08:38, 23 June 2015 (CEST)

Camera Services

2015-06-22T15:43:26Z

Mailwl: /* y2r:u */

==cam:c (PORT_REG) ==

==cam:s (PORT_CAL) ==

==cam:q (PORT_QTM) ==
This was added with New3DS.

==cam:u (PORT_USER)==

== y2r:u ==
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010040
| SetInputFormat(InputFormat)
|-
| 0x0002...
| GetInputFormat()
|-
| 0x00030040
| SetOutputFormat(OutputFormat)
|-
| 0x0004...
| GetOutputFormat()
|-
| 0x00050040
| SetRotation(Rotation)
|-
| 0x0006...
| GetRotation()
|-
| 0x00070040
| SetBlockAlignment(BlockAlignment)
|-
| 0x0008...
| GetBlockAlignment()
|-
| 0x0009...
| SetCntBit16(Value)
|-
| 0x000A...
| GetCntBit16()
|-
| 0x000B...
| SetCntBit17(Value)
|-
| 0x000C...
| GetCntBit17()
|-
| 0x000D0040
| SetTransferEndInterrupt(bool)
|-
| 0x000E...
| GetTransferEndInterrupt()
|-
| 0x000F0000
| GetTransferEndEvent(Handle*)
|-
| 0x00100102
| [[Y2R:SetSendingY|SetSendingY]]
|-
| 0x00110102
| [[Y2R:SetSendingU|SetSendingU]]
|-
| 0x00120102
| [[Y2R:SetSendingV|SetSendingV]]
|-
| 0x00130102
| [[Y2R:SetSendingYUYV|SetSendingYUYV]]
|-
| 0x00140000
| IsDoneSendingYUYV(bool* state)
|-
| 0x00150000
| IsDoneSendingY(bool* state)
|-
| 0x00160000
| IsDoneSendingU(bool* state)
|-
| 0x00170000
| IsDoneSendingV(bool* state)
|-
| 0x00180102
| SetReceiving(unsigned int pDst, unsigned int imageSize, short transferUnit, short transferStride, 0, Handle dstProcess).
|-
| 0x00190000
| IsDoneReceiving(bool* state)
|-
| 0x001A0040
| SetInputLineWidth(short)
|-
| 0x001B...
| GetInputLineWidth()
|-
| 0x001C0040
| SetInputLines(short)
|-
| 0x001D...
| GetInputLines()
|-
| 0x001E....
| SetCoefficient(0x10-byte CoefficientStruct)
|-
| 0x001F....
| GetCoefficient()
|-
| 0x00200040
| SetStandardCoefficient(StandardCoefficient)
This command is equivalent to SetCoefficient(GenerateStandardCoefficient(StandardCoefficient)).
|-
| 0x0021....
| GenerateStandardCoefficient(StandardCoefficient)
|-
| 0x00220040
| SetAlpha(short)
|-
| 0x0023....
| GetAlpha()
|-
| 0x0024....
| SetUnknownParams(0x20 bytes UnknownParamBlock)
|-
| 0x0025....
| GetUnknownParams
|-
| 0x00260000
| StartConversion
|-
| 0x00270000
| StopConversion
|-
| 0x00280000
| IsBusyConversion(bool * state)
|-
| 0x002901C0
| [[Y2R:SetConversionParams|SetConversionParams]]
|-
| 0x002A0000
| PingProcess(unsigned char * connectedNumber)
|-
| 0x002B0000
| DriverInitialize
|-
| 0x002C0000
| DriverFinalize
|-
| 0x002D....
| [[Y2R:GetConversionParams|GetConversionParams]]
|}

'''InputFormat'''
{| class="wikitable" border="1"
|-
! Enum
! Value
|-
| INPUT_YUV422_INDIV_8
| 0x0
|-
| INPUT_YUV420_INDIV_8
| 0x1
|-
| INPUT_YUV422_INDIV_16
| 0x2
|-
| INPUT_YUV420_INDIV_16
| 0x3
|-
| INPUT_YUV422_BATCH
| 0x4
|}

'''OutputFormat'''
{| class="wikitable" border="1"
|-
! Enum
! Value
|-
| OUTPUT_RGB_32
| 0x0
|-
| OUTPUT_RGB_24
| 0x1
|-
| OUTPUT_RGB_16_555
| 0x2
|-
| OUTPUT_RGB_16_565
| 0x3
|}

'''Rotation'''
{| class="wikitable" border="1"
|-
! Enum
! Value
|-
| ROTATION_NONE
| 0x0
|-
| ROTATION_CLOCKWISE_90
| 0x1
|-
| ROTATION_CLOCKWISE_180
| 0x2
|-
| ROTATION_CLOCKWISE_270
| 0x3
|}

'''BlockAlignment'''
{| class="wikitable" border="1"
|-
! Enum
! Value
! Description
|-
| BLOCK_LINE
| 0x0
| Output buffer's pixels are arranged linearly. Used when outputting to the framebuffer.
|-
| BLOCK_8_BY_8
| 0x1
| Output buffer's pixels are morton swizzled. Used when outputting to a GPU texture.
|}

'''StandardCoefficient'''
{| class="wikitable" border="1"
|-
! Enum
! Value
|-
| COEFFICIENT_ITU_R_BT_601
| 0x0
|-
| COEFFICIENT_ITU_R_BT_709
| 0x1
|-
| COEFFICIENT_ITU_R_BT_601_SCALING
| 0x2
|-
| COEFFICIENT_ITU_R_BT_709_SCALING
| 0x3
|-
| COEFFICIENT_MAX
| 0x4
|}

Talk:DSP:RegisterInterruptEvents

2015-06-21T09:47:04Z

Mailwl: Created page with "DSP really changes header in answer? but why? applications never checks it, as far as i know --~~~~"

DSP really changes header in answer? but why? applications never checks it, as far as i know
--[[User:Mailwl|Mailwl]] 13:47, 21 June 2015 (CEST)

Talk:DSP:LoadComponent

2015-06-18T23:42:54Z

Mailwl:

I would prefer if you didn't. Thanks.

- [[User:Plutooo|Plutooo]] 22:18, 18 June 2015 (CEST)
----
ok, i'll discard all changes, i made.
Oops, I don't know, how to do it. Just copy old version? How in history remain old version
--[[User:Mailwl|Mailwl]] 03:42, 19 June 2015 (CEST)

Talk:DSP:LoadComponent

2015-06-18T23:36:08Z

Mailwl:

I would prefer if you didn't. Thanks.

- [[User:Plutooo|Plutooo]] 22:18, 18 June 2015 (CEST)
----
ok, i discard all changes

Talk:DSP:LoadComponent

2015-06-18T14:04:28Z

Mailwl:

Is CTR SDK version of Component is signed too?
It differs from games version by size

----

Hi, please do not make wiki contributions based on the official CTR SDK.
This wiki is for people to share their reverse engineering notes; this is not a 3DS version of Wikileaks.
Anyway, the DSP firmware is signed and the DSP module has a separate RSA-key for devunits.

- [[User:Plutooo|Plutooo]] 17:12, 18 June 2015 (CEST)

----

Ok, I got it! BTW, I did reverse engineering of CTR to fill the table of name functions (they is not used directly, too low level).
It is allowed in this case? I think it may help in DSP emulation

--[[User:Mailwl|Mailwl]] 18:04, 18 June 2015 (CEST)

Talk:DSP:LoadComponent

2015-06-18T07:49:09Z

Mailwl: Created page with "Is CTR SDK version of Component is signed too? It differs from games version by size"

Is CTR SDK version of Component is signed too?
It differs from games version by size

DSP Services

2015-06-18T07:44:17Z

Mailwl: all functions described (still no parameters for all)

[[Category:Services]]
= DSP service "dsp::DSP" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010040
| RecvData(chan 0-3)
|-
| 0x00020040
| RecvDataIsReady(chan 0-3)
|-
| 0x00030080
| SendData(chan 0-3)
|-
| 0x00040040
| SendDataIsEmpty(chan 0-3)
|-
| 0x000500C2
| SendFifoEx(unsigned short, unsigned short const*, unsigned int, unsigned int)
|-
| 0x000600C0
| RecvFifoEx(unsigned short *, unsigned short, unsigned int, unsigned int)
|-
| 0x00070040
| [[DSP:WriteReg0x10|WriteReg0x10]] SetSemaphore
|-
| 0x00080000
| GetSemaphore(unsigned short * pMask)
|-
| 0x00090040
| ClearSemaphore(unsigned short mask)
|-
| 0x000A0040
| MaskSemaphore(unsigned short mask)
|-
| 0x000B0000
| CheckSemaphoreRequest(bool * pIsRequested )
|-
| 0x000C0040
| [[DSP:ConvertProcessAddressFromDspDram|ConvertProcessAddressFromDspDram]]
|-
| 0x000D0082
| [[DSP:WriteProcessPipe|WriteProcessPipe]]
|-
| 0x000E00C0
| ReadPipe(int, int, unsigned char *, unsigned short)
|-
| 0x000F0080
| GetPipeReadableSize(int, int, unsigned short *)
|-
| 0x001000C0
| [[DSP:ReadPipeIfPossible|ReadPipeIfPossible]]
|-
| 0x001100C2
| [[DSP:LoadComponent|LoadComponent]]. This requires RSA-signed DSP firmware specified via the input buffer for this command, the firmware data is eventually written to DSPmem+0(0x1FF00000).
|-
| 0x00120000
| UnloadComponent
|-
| 0x00130082
| FlushDataCache (The buffer must be located in the 0x14000000 region)
|-
| 0x00140082
| InvalidateDCache (The buffer must be located in either the 0x14000000 region, or the DSP memory region)
|-
| 0x00150082
| [[DSP:RegisterInterruptEvents|RegisterInterruptEvents(param0, param1, 0, eventhandle)]]
|-
| 0x00160000
| [[DSP:GetSemaphoreEventHandle|GetSemaphoreEventHandle]]
|-
| 0x00170040
| [[DSP:SetSemaphoreMask|SetSemaphoreMask]]
|-
| 0x00180040
| GetPhysicalAddress (0x14000000+ -> 0x20000000+, 0x1FF00000+ -> 0x1FF00000+, 0x08000000-0x0E000000 -> 0x00000000+, 0 otherwise)
|-
| 0x00190040
| GetVirtualAddress (0x20000000+ -> 0x14000000+, 0x1FF00000+ -> 0x1FF00000+, 0 otherwise)
|-
| 0x001A0042
| SetIirFilterI2S1. Wrapper for cdc:DSP cmd 1
|-
| 0x001B0042
| SetIirFilterI2S2. Wrapper for cdc:DSP cmd 2
|-
| 0x001C0082
| SetIirFilterEQ. Wrapper for cdc:DSP cmd 3
|-
| 0x001D00C0
| ReadMultiEx_SPI2(unsigned char, unsigned char, unsigned char *, unsigned char) (Wrapper for cdc:DSP cmd 4)
|-
| 0x001E00C2
| WriteMultiEx_SPI2(unsigned char, unsigned char, unsigned char const*, unsigned char) (Wrapper for cdc:DSP cmd 5)
|-
| 0x001F0000
| GetHeadphoneStatus(bool *isConnected). Wrapper for cdc:DSP cmd 6
|-
| 0x00200040
| ForceHeadphoneOut(bool forceout) (Wrapper for cdc:DSP cmd 8)
|-
| 0x00210000
| GetIsDspOccupied(bool *) returns a byte (can be 1 or 0) can be set to 1 in LoadComponent
|}

This is the main service for playing audio. The [[CSND_Services|CSND]] service can be used for playing audio as well, however most processes use this DSP service for playing audio. The DSP and CSND hardware can play audio simultaneously.

DSP Services

2015-06-18T07:37:51Z

Mailwl: /* DSP service "dsp::DSP" */

[[Category:Services]]
= DSP service "dsp::DSP" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010040
| RecvData(chan 0-3)
|-
| 0x00020040
| RecvDataIsReady(chan 0-3)
|-
| 0x00030080
| SendData(chan 0-3)
|-
| 0x00040040
| SendDataIsEmpty(chan 0-3)
|-
| 0x000500C2
| SendFifoEx(unsigned short, unsigned short const*, unsigned int, unsigned int)
|-
| 0x000600C0
| RecvFifoEx(unsigned short *, unsigned short, unsigned int, unsigned int)
|-
| 0x00070040
| [[DSP:WriteReg0x10|WriteReg0x10]] SetSemaphore
|-
| 0x00080000
| GetSemaphore(unsigned short * pMask)
|-
| 0x00090040
| ClearSemaphore(unsigned short mask)
|-
| 0x000A0040
| MaskSemaphore(unsigned short mask)
|-
| 0x000B0000
| CheckSemaphoreRequest(bool * pIsRequested )
|-
| 0x000C0040
| [[DSP:ConvertProcessAddressFromDspDram|ConvertProcessAddressFromDspDram]]
|-
| 0x000D0082
| [[DSP:WriteProcessPipe|WriteProcessPipe]]
|-
| 0x000E00C0
| ReadPipe(int, int, unsigned char *, unsigned short)
|-
| 0x000F0080
| GetPipeReadableSize(int, int, unsigned short *)
|-
| 0x001000C0
| [[DSP:ReadPipeIfPossible|ReadPipeIfPossible]]
|-
| 0x001100C2
| [[DSP:LoadComponent|LoadComponent]]. This requires RSA-signed DSP firmware specified via the input buffer for this command, the firmware data is eventually written to DSPmem+0(0x1FF00000).
|-
| 0x00120000
| UnloadComponent
|-
| 0x00130082
| FlushDataCache (The buffer must be located in the 0x14000000 region)
|
|-
| 0x00140082
| InvalidateDCache (The buffer must be located in either the 0x14000000 region, or the DSP memory region)
|-
| 0x00150082
| [[DSP:RegisterInterruptEvents|RegisterInterruptEvents(param0, param1, 0, eventhandle)]]
|-
| 0x00160000
| [[DSP:GetSemaphoreEventHandle|GetSemaphoreEventHandle]]
|-
| 0x00170040
| [[DSP:SetSemaphoreMask|SetSemaphoreMask]]
|-
| 0x00180040
| GetPhysicalAddress (0x14000000+ -> 0x20000000+, 0x1FF00000+ -> 0x1FF00000+, 0x08000000-0x0E000000 -> 0x00000000+, 0 otherwise)
|-
| 0x00190040
| GetVirtualAddress (0x20000000+ -> 0x14000000+, 0x1FF00000+ -> 0x1FF00000+, 0 otherwise)
|-
| 0x001A0042
| SetIirFilterI2S1. Wrapper for cdc:DSP cmd 1
|-
| 0x001B0042
| SetIirFilterI2S2. Wrapper for cdc:DSP cmd 2
|-
| 0x001C0082
| SetIirFilterEQ. Wrapper for cdc:DSP cmd 3
|-
| 0x001D....
| Wrapper for cdc:DSP cmd 4
|-
| 0x001E....
| Wrapper for cdc:DSP cmd 5
|-
| 0x001F0000
| GetHeadphoneStatus. Wrapper for cdc:DSP cmd 6
|-
| 0x0020....
| Wrapper for cdc:DSP cmd 8
|-
| 0x00210000
| GetIsDspOccupied returns a byte (can be 1 or 0) can be set to 1 in LoadComponent
|}

This is the main service for playing audio. The [[CSND_Services|CSND]] service can be used for playing audio as well, however most processes use this DSP service for playing audio. The DSP and CSND hardware can play audio simultaneously.

DSP Services

2015-06-18T07:36:59Z

Mailwl: add some requests

[[Category:Services]]
= DSP service "dsp::DSP" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010040
| RecvData(chan 0-3)
|-
| 0x00020040
| RecvDataIsReady(chan 0-3)
|-
| 0x00030080
| SendData(chan 0-3)
|-
| 0x00040040
| SendDataIsEmpty(chan 0-3)
|-
| 0x000500C2
| SendFifoEx(unsigned short, unsigned short const*, unsigned int, unsigned int)
|-
| 0x000600C0
| RecvFifoEx(unsigned short *, unsigned short, unsigned int, unsigned int)
|-
| 0x00070040
| [[DSP:WriteReg0x10|WriteReg0x10]] SetSemaphore
|-
| 0x00080000
| GetSemaphore(unsigned short * pMask)
|-
| 0x00090040
| ClearSemaphore(unsigned short mask)
|-
| 0x000A0040
| MaskSemaphore(unsigned short mask)
|-
| 0x000B0000
| CheckSemaphoreRequest(bool * pIsRequested )
|-
| 0x000C0040
| [[DSP:ConvertProcessAddressFromDspDram|ConvertProcessAddressFromDspDram]]
|-
| 0x000D0082
| [[DSP:WriteProcessPipe|WriteProcessPipe]]
|-
| 0x000E00C0
| ReadPipe(int, int, unsigned char *, unsigned short)
|-
| 0x000F0080
| GetPipeReadableSize(int, int, unsigned short *)
|-
| 0x001000C0
| [[DSP:ReadPipeIfPossible|ReadPipeIfPossible]]
|-
| 0x001100C2
| [[DSP:LoadComponent|LoadComponent]]. This requires RSA-signed DSP firmware specified via the input buffer for this command, the firmware data is eventually written to DSPmem+0(0x1FF00000).
|-
| 0x00120000
| UnloadComponent
|-
| 0x00130082
| FlushDataCache (The buffer must be located in the 0x14000000 region)
|
|-
| 0x00140082
| InvalidateDCache (The buffer must be located in either the 0x14000000 region, or the DSP memory region)
|-
| 0x00150082
| [[DSP:RegisterInterruptEvents|RegisterInterruptEvents(param0, param1, 0, eventhandle)]]
|-
| 0x00160000
| [[DSP:GetSemaphoreEventHandle|GetSemaphoreEventHandle]]
|-
| 0x00170040
| [[DSP:SetSemaphoreMask|SetSemaphoreMask]]
|-
| 0x00180040
| GetPhysicalAddress (0x14000000+ -> 0x20000000+, 0x1FF00000+ -> 0x1FF00000+, 0x08000000-0x0E000000 -> 0x00000000+, 0 otherwise)
|-
| 0x00190040
| GetVirtualAddress (0x20000000+ -> 0x14000000+, 0x1FF00000+ -> 0x1FF00000+, 0 otherwise)
|-
| 0x001A0042
| SetIirFilterI2S1. Wrapper for cdc:DSP cmd 1
|-
| 0x001B0042
| SetIirFilterI2S1. Wrapper for cdc:DSP cmd 2
|-
| 0x001C0082
| SetIirFilterEQ. Wrapper for cdc:DSP cmd 3
|-
| 0x001D....
| Wrapper for cdc:DSP cmd 4
|-
| 0x001E....
| Wrapper for cdc:DSP cmd 5
|-
| 0x001F0000
| GetHeadphoneStatus. Wrapper for cdc:DSP cmd 6
|-
| 0x0020....
| Wrapper for cdc:DSP cmd 8
|-
| 0x00210000
| GetIsDspOccupied returns a byte (can be 1 or 0) can be set to 1 in LoadComponent
|}

This is the main service for playing audio. The [[CSND_Services|CSND]] service can be used for playing audio as well, however most processes use this DSP service for playing audio. The DSP and CSND hardware can play audio simultaneously.