https://www.3dbrew.org/w/api.php?action=feedcontributions&feedformat=atom&user=Socram8888
3dbrew - User contributions [en]
2026-04-14T16:50:56Z
User contributions
MediaWiki 1.43.1
https://www.3dbrew.org/w/index.php?title=Homebrew_Libraries_and_Tools&diff=13279
Homebrew Libraries and Tools
2015-09-14T06:17:09Z
<p>Socram8888: /* Tools */</p>
<hr />
<div>This is a list of libraries and tools that can be used to develop 3DS Homebrew.<br />
<br />
==List==<br />
<br />
===Libraries===<br />
{| class="wikitable" border="1" width="100%"<br />
! width="20%" | Name<br />
! width="50%" | Description<br />
! width="10%" | Author<br />
! width="10%" | Download<br />
! width="10%" | Open-Source<br />
|-<br />
| [https://github.com/smealum/ctrulib ctrulib]<br />
| C library for writing user mode ARM11 code for the 3DS (CTR) <br />
| [https://twitter.com/smealum smea] et al.<br />
| [[Setting_up_Development_Environment|See here]]<br />
| Yes<br />
|-<br />
| [https://github.com/xerpi/sf2dlib sf2dlib]<br />
| Simple and Fast 2D library for the Nintendo 3DS (using ctrulib)<br />
| [https://github.com/xerpi xerpi]<br />
| [https://github.com/xerpi/sf2dlib/archive/master.zip Here]<br />
| Yes<br />
|-<br />
| [https://github.com/cpp3ds/gl3ds gl3ds]<br />
| OpenGL implementation for Nintendo 3DS using ctrulib<br />
| [https://github.com/Cruel Cruel] et al.<br />
| [https://github.com/cpp3ds/gl3ds/archive/master.zip Here]<br />
| Yes<br />
|-<br />
| [https://github.com/machinamentum/Caelina Caelina]<br />
| An OpenGL implementation for (N)3DS<br />
| [https://github.com/machinamentum machinamentum]<br />
| [https://github.com/machinamentum/Caelina/archive/master.zip Here]<br />
| Yes<br />
|-<br />
| [https://github.com/Myriachan/libkhax libkhax]<br />
| Library for modifying kernel memory on a certain handheld game console.<br />
| [https://github.com/Myriachan Myria] et al.<br />
| [https://github.com/Myriachan/libkhax/archive/master.zip Here]<br />
| Yes<br />
|}<br />
<br />
===Tools===<br />
{| class="wikitable" border="1" width="100%"<br />
! width="20%" | Name<br />
! width="50%" | Description<br />
! width="10%" | Author<br />
! width="10%" | Download<br />
! width="10%" | Open-Source<br />
|-<br />
| [http://devkitpro.org/ devkitARM]<br />
| GCC-based toolchain tuned for homebrew development for ARM-based consoles.<br />
| [https://github.com/WinterMute WinterMute] et al.<br />
| [[Setting_up_Development_Environment|See here]]<br />
| [https://github.com/devkitPro Yes]<br />
|-<br />
| [https://github.com/smealum/aemstro aemstro]<br />
| Set of tools used to disassemble and assemble shader code for DMP's MAESTRO shader extension used in the 3DS's PICA200 GPU<br />
| [https://twitter.com/smealum smea]<br />
| [https://github.com/smealum/aemstro/archive/master.zip Here]<br />
| Yes<br />
|-<br />
| [https://github.com/fincs/picasso picasso]<br />
| Homebrew PICA200 shader assembler<br />
| [https://github.com/fincs fincs]<br />
| [https://github.com/fincs/picasso/releases Here]<br />
| Yes<br />
|-<br />
| [http://4dsdev.org/thread.php?id=14 nihstro]<br />
| 3DS shader assembler and disassembler <br />
| [https://github.com/neobrain neobrain]<br />
| [http://4dsdev.org/thread.php?id=14 Here]<br />
| [https://github.com/neobrain/nihstro Yes]<br />
|-<br />
| [https://github.com/Lectem/3ds-cmake 3ds-cmake]<br />
| CMake files for devkitARM and 3DS homebrew development<br />
| [https://github.com/Lectem Lectem]<br />
| [https://github.com/Lectem/3ds-cmake/archive/master.zip Here]<br />
| Yes<br />
|-<br />
| [https://github.com/profi200/Project_CTR/archive/master.zip makerom]<br />
| Tool which can be used to create NCCH, CCI, and CIA files. <br />
| [http://3dbrew.org/wiki/User:3dsguy 3dsguy] maintained by [https://github.com/profi200 profi200]<br />
| [https://github.com/profi200/Project_CTR/archive/master.zip Here]<br />
| Yes<br />
|-<br />
| [https://github.com/Steveice10/bannertool bannertool]<br />
| Tool to create NCCH banners<br />
| [https://github.com/Steveice10 Steveice10]<br />
| [https://github.com/Steveice10/bannertool/archive/master.zip Here]<br />
| Yes<br />
|-<br />
| [https://github.com/socram8888/amiitool amiitool]<br />
| Tool to decrypt, encrypt and sign amiibo dumps<br />
| [https://github.com/socram8888 socram8888]<br />
| [https://github.com/socram8888/amiitool/archive/master.zip Here]<br />
| Yes<br />
|}</div>
Socram8888
https://www.3dbrew.org/w/index.php?title=Homebrew_Libraries_and_Tools&diff=13278
Homebrew Libraries and Tools
2015-09-14T06:16:28Z
<p>Socram8888: /* Tools */</p>
<hr />
<div>This is a list of libraries and tools that can be used to develop 3DS Homebrew.<br />
<br />
==List==<br />
<br />
===Libraries===<br />
{| class="wikitable" border="1" width="100%"<br />
! width="20%" | Name<br />
! width="50%" | Description<br />
! width="10%" | Author<br />
! width="10%" | Download<br />
! width="10%" | Open-Source<br />
|-<br />
| [https://github.com/smealum/ctrulib ctrulib]<br />
| C library for writing user mode ARM11 code for the 3DS (CTR) <br />
| [https://twitter.com/smealum smea] et al.<br />
| [[Setting_up_Development_Environment|See here]]<br />
| Yes<br />
|-<br />
| [https://github.com/xerpi/sf2dlib sf2dlib]<br />
| Simple and Fast 2D library for the Nintendo 3DS (using ctrulib)<br />
| [https://github.com/xerpi xerpi]<br />
| [https://github.com/xerpi/sf2dlib/archive/master.zip Here]<br />
| Yes<br />
|-<br />
| [https://github.com/cpp3ds/gl3ds gl3ds]<br />
| OpenGL implementation for Nintendo 3DS using ctrulib<br />
| [https://github.com/Cruel Cruel] et al.<br />
| [https://github.com/cpp3ds/gl3ds/archive/master.zip Here]<br />
| Yes<br />
|-<br />
| [https://github.com/machinamentum/Caelina Caelina]<br />
| An OpenGL implementation for (N)3DS<br />
| [https://github.com/machinamentum machinamentum]<br />
| [https://github.com/machinamentum/Caelina/archive/master.zip Here]<br />
| Yes<br />
|-<br />
| [https://github.com/Myriachan/libkhax libkhax]<br />
| Library for modifying kernel memory on a certain handheld game console.<br />
| [https://github.com/Myriachan Myria] et al.<br />
| [https://github.com/Myriachan/libkhax/archive/master.zip Here]<br />
| Yes<br />
|}<br />
<br />
===Tools===<br />
{| class="wikitable" border="1" width="100%"<br />
! width="20%" | Name<br />
! width="50%" | Description<br />
! width="10%" | Author<br />
! width="10%" | Download<br />
! width="10%" | Open-Source<br />
|-<br />
| [http://devkitpro.org/ devkitARM]<br />
| GCC-based toolchain tuned for homebrew development for ARM-based consoles.<br />
| [https://github.com/WinterMute WinterMute] et al.<br />
| [[Setting_up_Development_Environment|See here]]<br />
| [https://github.com/devkitPro Yes]<br />
|-<br />
| [https://github.com/smealum/aemstro aemstro]<br />
| Set of tools used to disassemble and assemble shader code for DMP's MAESTRO shader extension used in the 3DS's PICA200 GPU<br />
| [https://twitter.com/smealum smea]<br />
| [https://github.com/smealum/aemstro/archive/master.zip Here]<br />
| Yes<br />
|-<br />
| [https://github.com/fincs/picasso picasso]<br />
| Homebrew PICA200 shader assembler<br />
| [https://github.com/fincs fincs]<br />
| [https://github.com/fincs/picasso/releases Here]<br />
| Yes<br />
|-<br />
| [http://4dsdev.org/thread.php?id=14 nihstro]<br />
| 3DS shader assembler and disassembler <br />
| [https://github.com/neobrain neobrain]<br />
| [http://4dsdev.org/thread.php?id=14 Here]<br />
| [https://github.com/neobrain/nihstro Yes]<br />
|-<br />
| [https://github.com/Lectem/3ds-cmake 3ds-cmake]<br />
| CMake files for devkitARM and 3DS homebrew development<br />
| [https://github.com/Lectem Lectem]<br />
| [https://github.com/Lectem/3ds-cmake/archive/master.zip Here]<br />
| Yes<br />
|-<br />
| [https://github.com/profi200/Project_CTR/archive/master.zip makerom]<br />
| Tool which can be used to create NCCH, CCI, and CIA files. <br />
| [http://3dbrew.org/wiki/User:3dsguy 3dsguy] maintained by [https://github.com/profi200 profi200]<br />
| [https://github.com/profi200/Project_CTR/archive/master.zip Here]<br />
| Yes<br />
|-<br />
| [https://github.com/Steveice10/bannertool bannertool]<br />
| Tool to create NCCH banners<br />
| [https://github.com/Steveice10 Steveice10]<br />
| [https://github.com/Steveice10/bannertool/archive/master.zip Here]<br />
| Yes<br />
|-<br />
| [https://github.com/Steveice10/bannertool bannertool]<br />
| Tool to decrypt, encrypt and sign amiibo dumps<br />
| [https://github.com/socram8888 socram8888]<br />
| [https://github.com/socram8888/amiitool/archive/master.zip Here]<br />
| Yes<br />
|}</div>
Socram8888
https://www.3dbrew.org/w/index.php?title=NFC_adapter&diff=12550
NFC adapter
2015-05-04T11:28:16Z
<p>Socram8888: Edited with easier to read code</p>
<hr />
<div>The Nintendo NFC adapter is an upcoming external device which adds NFC capabilities for [[amiibo]]s to old Nintendo 3DS and Nintendo 2DS consoles, using the infrared port on the back of the console.<br />
<br />
[[File:150217nfcreader-640x360.jpg|thumb|right|250px|Media preview, as released by Nintendo]]<br />
<br />
<br />
= Technical details =<br />
Based on analysis of the [[fangate_updater.bin]] file, which is part of the old Nintendo 3DS operating system since [[9.3.0-21]] and contains the firmware running on the external adapter; and analysis of the [[NFC Services]] running on old 3DS.<br />
<br />
* SOC inside the adapter: Broadcom BCM20791B1<br />
* CPU: ARM Cortex M0<br />
* Communications: infrared, with [[ir:USER]] running on the console. Uses obfuscated payloads. Baud rate is 115200 bps.<br />
<br />
Memory map:<br />
{| class="wikitable"<br />
|-<br />
! Address<br />
! Size<br />
! Description<br />
|-<br />
| 0x08008000<br />
| 256KB?<br />
| Firmware ([[fangate_updater.bin]])<br />
|-<br />
| 0x20000000<br />
| 128KB?<br />
| RAM<br />
|-<br />
| 0x40023C00<br />
| 0x1C<br />
| FLASH ROM control<br />
|-<br />
| 0xE000ED00<br />
| 0x104<br />
| [http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0439b/BABCIIIA.html ARM Cortex system control block]<br />
|}<br />
<br />
= IR communications =<br />
Packets are sent using IrDA-SIR (using [[ir:USER]]), with a 8N1 encoding (eight data bits, one stop bit, without parity). Each one is formed by a 2-byte header, a varint with the payload size, an obfuscated payload, and trailing error detection byte.<br />
<br />
== Layer 1 - framing format ==<br />
Frames are encoded using two different yet very simmilar formats, depending on how large the payload to be transmitted is:<br />
* For payloads with less than 64 bytes, the third byte represents the payload size.<br />
* For packets with up to 16383 bytes, the size is split in two bytes, with the third byte being the upper 6 bits of the payload size, OR'd with 0x40, and the fourth being the lower eight bits of the payload size<br />
<br />
{| class="wikitable" style="margin: 0 auto; text-align: center;"<br />
|+IR framing format - short frame<br />
|-<br />
! style="border-top: none" | Byte<br />
! style="width:10%;"| 7<br />
! style="width:10%;"| 6<br />
! style="width:10%;"| 5<br />
! style="width:10%;"| 4<br />
! style="width:10%;"| 3<br />
! style="width:10%;"| 2<br />
! style="width:10%;"| 1<br />
! style="width:10%;"| 0<br />
|-<br />
! 0x00<br />
| colspan="8"|Synchronization byte (<code>0xA5</code>)<br />
|-<br />
! 0x01<br />
| colspan="8"|Reserved for future use (<code>0x00</code>)<br />
|-<br />
! 0x02<br />
| RFU (<code>0</code>)<br />
| Short frame (<code>0</code>)<br />
| colspan="6"|Payload size<br />
|-<br />
! 0x03<br />
| colspan="8"|Payload byte 0<br />
|-<br />
| colspan="9"|...<br />
|-<br />
! 0x03+n-1<br />
| colspan="8"|Payload byte n-1<br />
|-<br />
! 0x03+n<br />
| colspan="8"|[[CRC-8-CCITT]] computer over whole packet<br />
|}<br />
<br />
<br />
{| class="wikitable" style="margin: 0 auto; text-align: center;"<br />
|+IR framing format - long frame<br />
|-<br />
! style="border-top: none" | Byte<br />
! style="width:10%;"| 7<br />
! style="width:10%;"| 6<br />
! style="width:10%;"| 5<br />
! style="width:10%;"| 4<br />
! style="width:10%;"| 3<br />
! style="width:10%;"| 2<br />
! style="width:10%;"| 1<br />
! style="width:10%;"| 0<br />
|-<br />
! 0x00<br />
| colspan="8"|Synchronization byte: <code>0xA5</code><br />
|-<br />
! 0x01<br />
| colspan="8"|Reserved for future use<br />
|-<br />
! 0x02<br />
| RFU (<code>0</code>)<br />
| Long frame (<code>1</code>)<br />
| colspan="6"|Payload size (upper 6 bits)<br />
|-<br />
! 0x03<br />
| colspan="8"|Payload size (lower 8 bits)<br />
|-<br />
! 0x04<br />
| colspan="8"|Payload byte 0<br />
|-<br />
| colspan="9"|...<br />
|-<br />
! 0x04+n-1<br />
| colspan="8"|Payload byte n-1<br />
|-<br />
! 0x04+n<br />
| colspan="8"|[[CRC-8-CCITT]] computer over whole packet<br />
|}<br />
<br />
=== Header ===<br />
The packet header is fixed and consists in a synchronization byte (0xA5), followed by a unused (possibly RFU) zero byte. After these two hardcoded bytes, there's a varint representing the payload size, which may use one byte or two, depending on the how big the payload is.<br />
<br />
In C:<br />
<nowiki>uint8_t * setPacketHeader(uint8_t * buffer, size_t payloadSize) {<br />
assert(payloadSize < 16384);<br />
<br />
buffer[0] = 0xA5;<br />
buffer[1] = 0x00;<br />
<br />
if (payloadSize < 64) {<br />
buffer[2] = payloadSize;<br />
buffer += 3;<br />
} else {<br />
buffer[2] = 0x40 | (payloadSize >> 8);<br />
buffer[3] = payloadSize;<br />
buffer += 4;<br />
}<br />
<br />
return buffer;<br />
}</nowiki><br />
<br />
=== Payload ===<br />
The payload is obfuscated using a XOR-based encryption. In C:<br />
<nowiki>void payloadObfuscate(const void * voidplain, void * voidcipher, size_t size) {<br />
uint16_t * plain = (uint16_t *) voidplain;<br />
uint16_t * cipher = (uint16_t *) voidcipher;<br />
size_t halfCount = size >> 1; // Divide by 2 rounding towards zero<br />
<br />
uint16_t xorval = htobe16(0xE963);<br />
size_t i;<br />
<br />
for (i = 0; i < halfCount; i++) {<br />
xorval ^= plain[i];<br />
cipher[i] = xorval;<br />
}<br />
}<br />
<br />
void payloadDeobfuscate(const void * voidcipher, void * voidplain, size_t size) {<br />
uint16_t * cipher = (uint16_t *) voidcipher;<br />
uint16_t * plain = (uint16_t *) voidplain;<br />
size_t halfCount = size >> 1; // Divide by 2 rounding towards zero<br />
<br />
uint16_t xorval = htobe16(0xE963);<br />
size_t i;<br />
<br />
for (i = 0; i < halfCount; i++) {<br />
uint16_t word = plain[i];<br />
cipher[i] = xorval ^ word;<br />
xorval = word;<br />
}<br />
}</nowiki><br />
<br />
=== Error detection ===<br />
The trailing error detection byte is calculated using [[CRC-8-CCITT]] <b>over the whole packet</b> (both the header and the payload)<br />
<br />
== Layer 2 - "ircom" ==<br />
ircom is a simple stateful point-to-point master-slave communication protocol built on top of IR layer 1.<br />
<br />
{| class="wikitable" style="margin: 0 auto; text-align: center;"<br />
! style="border-top: none" | Byte<br />
! style="width:10%;"| 7<br />
! style="width:10%;"| 6<br />
! style="width:10%;"| 5<br />
! style="width:10%;"| 4<br />
! style="width:10%;"| 3<br />
! style="width:10%;"| 2<br />
! style="width:10%;"| 1<br />
! style="width:10%;"| 0<br />
|-<br />
! 0x00<br />
| colspan="8"|Random value in range <code>0x01</code>~<code>0xFE</code><br />
|-<br />
! 0x01<br />
| colspan="8"|Random value in range <code>0x01</code>~<code>0xFE</code><br />
|-<br />
! 0x02<br />
| colspan="8"|Random value in range <code>0x01</code>~<code>0xFE</code><br />
|-<br />
! 0x03<br />
| colspan="8"|Random value in range <code>0x01</code>~<code>0xFE</code><br />
|-<br />
! 0x04<br />
| colspan="4"|RFU?<br />
| colspan="4"|Protocol version: <code>0x1</code><br />
|-<br />
! 0x05<br />
| colspan="8"|Connection identifier<br />
|-<br />
! 0x06<br />
| colspan="8"|Reserved for future use?<br />
|-<br />
! 0x07<br />
| colspan="4"|???<br />
| colspan="4"|Operation code<br />
|-<br />
! 0x08+<br />
| colspan="8" style="background:#ffd0d0;"|Payload (if any)<br />
|}<br />
<br />
* Random values are generated using a Mersenne Twister whose seed is based off the NFC adapter system tick counter. It is therefore random, and the 3DS won't attempt to validate them by any means. Its purpose is unknown.<br />
* NFC adapter will ignore packets whose protocol version is not 1. It will not even reply.<br />
* Connection identifier is a random byte the 3DS assigns to identify the connection should be several connections in range at once. Slave devices must save this value from the initial handshake packet and use it for replies. It must also ignore packets whose connection ID does not match.<br />
<br />
=== Operation codes ===<br />
{| class="wikitable"<br />
! Code<br />
! Name<br />
! Has payload<br />
! Direction<br />
|-<br />
! 0x0<br />
| Layer 3 command?<br />
| style="background: green" | Yes<br />
| Master to slave<br />
|-<br />
! 0x1<br />
| ???<br />
| ???<br />
|-<br />
! 0x2<br />
| ???<br />
| ???<br />
|-<br />
! 0x3<br />
| ???<br />
| ???<br />
|-<br />
! 0x4<br />
| ???<br />
| ???<br />
|-<br />
! 0x5<br />
| ???<br />
| ???<br />
|-<br />
! 0x6<br />
| ???<br />
| ???<br />
|-<br />
! 0x7<br />
| ???<br />
| ???<br />
|-<br />
! 0x8<br />
| ???<br />
| ???<br />
|-<br />
! 0x9<br />
| ???<br />
| ???<br />
|-<br />
! 0xA<br />
| Disconnect request<br />
| style="background: red" | No<br />
| Master to slave<br />
|-<br />
! 0xB<br />
| Disconnection acknowledgment<br />
| style="background: red" | No<br />
| Slave to master<br />
|-<br />
! 0xC<br />
| Handshake<br />
| style="background: red" | No<br />
| Master to slave<br />
|-<br />
! 0xD<br />
| Handshake acknowledgement<br />
| style="background: red" | No<br />
| Slave to master<br />
|-<br />
! 0xE<br />
| ???<br />
| ???<br />
|-<br />
! 0xF<br />
| ???<br />
| ???<br />
|}<br />
<br />
== Samples ==<br />
<br />
NFC handshake beacons:<br />
{| class="wikitable"<br />
|-<br />
! Layer 1 packet<br />
! Layer 2 packet<br />
! Layer 3 packet<br />
|-<br />
| <code>A5 00 08 73 FE A5 C4 A4 2C A4 20 F5</code><br />
| <code>9A 9D D6 3A 01 E8 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 D1 3E B7 7B B6 91 B6 9D 87</code><br />
| <code>38 5D 66 45 01 EA 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 09 58 23 36 22 DA 22 D6 AE</code><br />
| <code>E0 3B 2A 6E 01 EC 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 5E DD A4 A0 A5 4E A5 42 A8</code><br />
| <code>B7 BE FA 7D 01 EE 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 BC 19 C6 37 C7 C7 C7 CB 8B</code><br />
| <code>55 7A 7A 2E 01 F0 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 C9 15 F6 63 F7 91 F7 9D B2</code><br />
| <code>20 76 3F 76 01 F2 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 6E 48 47 1A 46 EE 46 E2 C7</code><br />
| <code>87 2B 29 52 01 F4 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 A2 8C E5 C3 E4 35 E4 39 74</code><br />
| <code>4B EF 47 4F 01 F6 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 26 1C 07 10 06 E8 06 E4 64</code><br />
| <code>CF 7F 21 0C 01 F8 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 7E 73 A2 3F A3 C5 A3 C9 FD</code><br />
| <code>97 10 DC 4C 01 FA 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 75 00 F3 B8 F2 44 F2 48 63</code><br />
| <code>9C 63 86 B8 01 FC 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 8D AC 0F D5 0E 2B 0E 27 72</code><br />
| <code>64 CF 82 79 01 FE 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 A3 55 7C 53 7D 52 7D 5E B2</code><br />
| <code>4A 36 DF 06 01 01 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 15 06 43 C0 42 C3 42 CF 85</code><br />
| <code>FC 65 56 C6 01 03 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 66 E0 9A 17 9B 12 9B 1E A0</code><br />
| <code>8F 83 FC F7 01 05 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 A4 35 09 97 08 90 08 9C 25</code><br />
| <code>4D 56 AD A2 01 07 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 73 E2 BD AF BC A6 BC AA 60</code><br />
| <code>9A 81 CE 4D 01 09 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 02 57 D7 B0 D6 BB D6 B7 28</code><br />
| <code>EB 34 D5 E7 01 0B 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 0D 79 01 AA 00 A7 00 AB 22</code><br />
| <code>E4 1A 0C D3 01 0D 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 14 91 04 B9 05 B6 05 BA B2</code><br />
| <code>FD F2 10 28 01 0F 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 2C 86 B1 49 B0 58 B0 54 C0</code><br />
| <code>C5 E5 9D CF 01 11 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 D5 1D DE DB DF C8 DF C4 F9</code><br />
| <code>3C 7E 0B C6 01 13 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 AF 75 DE 5C DF 49 DF 45 9C</code><br />
| <code>46 16 71 29 01 15 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 C8 E2 5B C6 5A D1 5A DD B5</code><br />
| <code>21 81 93 24 01 17 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 9B 51 68 2D 69 34 69 38 41</code><br />
| <code>72 32 F3 7C 01 19 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 13 7B 9F EF 9E F4 9E F8 32</code><br />
| <code>FA 18 8C 94 01 1B 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 A7 62 02 9C 03 81 03 8D BD</code><br />
| <code>4E 01 A5 FE 01 1D 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 39 06 94 36 95 29 95 25 09</code><br />
| <code>D0 65 AD 30 01 1F 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 32 4C D7 C0 D6 E1 D6 ED 92</code><br />
| <code>DB 2F E5 8C 01 21 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 83 BE F2 8F F3 AC F3 A0 B1</code><br />
| <code>6A DD 71 31 01 23 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 83 5E A0 57 A1 72 A1 7E F0</code><br />
| <code>6A 3D 23 09 01 25 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 6E C8 AD 69 AC 4E AC 42 D1</code><br />
| <code>87 AB C3 A1 01 27 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 C7 33 A1 2C A0 05 A0 09 FC</code><br />
| <code>2E 50 66 1F 01 29 00 0C</code><br />
| ␀<br />
|}<br />
<br />
= External links =<br />
* [https://www.broadcom.com/products/NFC/NFC-Solutions/BCM2079x-Family BCM2079x brief on Broadcom's website]</div>
Socram8888
https://www.3dbrew.org/w/index.php?title=NFC_adapter&diff=12481
NFC adapter
2015-04-20T12:34:53Z
<p>Socram8888: </p>
<hr />
<div>The Nintendo NFC adapter is an upcoming external device which adds NFC capabilities for [[amiibo]]s to old Nintendo 3DS and Nintendo 2DS consoles, using the infrared port on the back of the console.<br />
<br />
[[File:150217nfcreader-640x360.jpg|thumb|right|250px|Media preview, as released by Nintendo]]<br />
<br />
<br />
= Technical details =<br />
Based on analysis of the [[fangate_updater.bin]] file, which is part of the old Nintendo 3DS operating system since [[9.3.0-21]] and contains the firmware running on the external adapter; and analysis of the [[NFC Services]] running on old 3DS.<br />
<br />
* SOC inside the adapter: Broadcom BCM20791B1<br />
* CPU: ARM Cortex M0<br />
* Communications: infrared, with [[ir:USER]] running on the console. Uses obfuscated payloads. Baud rate is 115200 bps.<br />
<br />
Memory map:<br />
{| class="wikitable"<br />
|-<br />
! Address<br />
! Size<br />
! Description<br />
|-<br />
| 0x08008000<br />
| 256KB?<br />
| Firmware ([[fangate_updater.bin]])<br />
|-<br />
| 0x20000000<br />
| 128KB?<br />
| RAM<br />
|-<br />
| 0x40023C00<br />
| 0x1C<br />
| FLASH ROM control<br />
|-<br />
| 0xE000ED00<br />
| 0x104<br />
| [http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0439b/BABCIIIA.html ARM Cortex system control block]<br />
|}<br />
<br />
= IR communications =<br />
Packets are sent using IrDA-SIR (using [[ir:USER]]), with a 8N1 encoding (eight data bits, one stop bit, without parity). Each one is formed by a 2-byte header, a varint with the payload size, an obfuscated payload, and trailing error detection byte.<br />
<br />
== Layer 1 - framing format ==<br />
Frames are encoded using two different yet very simmilar formats, depending on how large the payload to be transmitted is:<br />
* For payloads with less than 64 bytes, the third byte represents the payload size.<br />
* For packets with up to 16383 bytes, the size is split in two bytes, with the third byte being the upper 6 bits of the payload size, OR'd with 0x40, and the fourth being the lower eight bits of the payload size<br />
<br />
{| class="wikitable" style="margin: 0 auto; text-align: center;"<br />
|+IR framing format - short frame<br />
|-<br />
! style="border-top: none" | Byte<br />
! style="width:10%;"| 7<br />
! style="width:10%;"| 6<br />
! style="width:10%;"| 5<br />
! style="width:10%;"| 4<br />
! style="width:10%;"| 3<br />
! style="width:10%;"| 2<br />
! style="width:10%;"| 1<br />
! style="width:10%;"| 0<br />
|-<br />
! 0x00<br />
| colspan="8"|Synchronization byte (<code>0xA5</code>)<br />
|-<br />
! 0x01<br />
| colspan="8"|Reserved for future use (<code>0x00</code>)<br />
|-<br />
! 0x02<br />
| RFU (<code>0</code>)<br />
| Short frame (<code>0</code>)<br />
| colspan="6"|Payload size<br />
|-<br />
! 0x03<br />
| colspan="8"|Payload byte 0<br />
|-<br />
| colspan="9"|...<br />
|-<br />
! 0x03+n-1<br />
| colspan="8"|Payload byte n-1<br />
|-<br />
! 0x03+n<br />
| colspan="8"|[[CRC-8-CCITT]] computer over whole packet<br />
|}<br />
<br />
<br />
{| class="wikitable" style="margin: 0 auto; text-align: center;"<br />
|+IR framing format - long frame<br />
|-<br />
! style="border-top: none" | Byte<br />
! style="width:10%;"| 7<br />
! style="width:10%;"| 6<br />
! style="width:10%;"| 5<br />
! style="width:10%;"| 4<br />
! style="width:10%;"| 3<br />
! style="width:10%;"| 2<br />
! style="width:10%;"| 1<br />
! style="width:10%;"| 0<br />
|-<br />
! 0x00<br />
| colspan="8"|Synchronization byte: <code>0xA5</code><br />
|-<br />
! 0x01<br />
| colspan="8"|Reserved for future use<br />
|-<br />
! 0x02<br />
| RFU (<code>0</code>)<br />
| Long frame (<code>1</code>)<br />
| colspan="6"|Payload size (upper 6 bits)<br />
|-<br />
! 0x03<br />
| colspan="8"|Payload size (lower 8 bits)<br />
|-<br />
! 0x04<br />
| colspan="8"|Payload byte 0<br />
|-<br />
| colspan="9"|...<br />
|-<br />
! 0x04+n-1<br />
| colspan="8"|Payload byte n-1<br />
|-<br />
! 0x04+n<br />
| colspan="8"|[[CRC-8-CCITT]] computer over whole packet<br />
|}<br />
<br />
=== Header ===<br />
The packet header is fixed and consists in a synchronization byte (0xA5), followed by a unused (possibly RFU) zero byte. After these two hardcoded bytes, there's a varint representing the payload size, which may use one byte or two, depending on the how big the payload is.<br />
<br />
In C:<br />
<nowiki>uint8_t * setPacketHeader(uint8_t * buffer, size_t payloadSize) {<br />
assert(payloadSize < 16384);<br />
<br />
buffer[0] = 0xA5;<br />
buffer[1] = 0x00;<br />
<br />
if (payloadSize < 64) {<br />
buffer[2] = payloadSize;<br />
buffer += 3;<br />
} else {<br />
buffer[2] = 0x40 | (payloadSize >> 8);<br />
buffer[3] = payloadSize;<br />
buffer += 4;<br />
}<br />
<br />
return buffer;<br />
}</nowiki><br />
<br />
=== Payload ===<br />
The payload is obfuscated using a XOR-based encryption. In C:<br />
<nowiki>void payloadObfuscate(const void * voidplain, void * voidcipher, size_t size) {<br />
uint16_t * plain = (uint16_t *) voidplain;<br />
uint16_t * cipher = (uint16_t *) voidcipher;<br />
size_t halfCount = size / sizeof(uint16_t);<br />
<br />
uint16_t xorval = htobe16(0xE963);<br />
size_t i;<br />
<br />
for (i = 0; i < halfCount; i++) {<br />
xorval ^= plain[i];<br />
cipher[i] = xorval;<br />
}<br />
}<br />
<br />
void payloadDeobfuscate(const void * voidcipher, void * voidplain, size_t size) {<br />
uint16_t * cipher = (uint16_t *) voidcipher;<br />
uint16_t * plain = (uint16_t *) voidplain;<br />
size_t halfCount = size / sizeof(uint16_t);<br />
<br />
if (halfCount) {<br />
size_t i;<br />
for (i = halfCount - 1; i > 0; i--) {<br />
plain[i] = cipher[i] ^ cipher[i - 1];<br />
}<br />
<br />
plain[0] = cipher[0] ^ htobe16(0xE963);<br />
}<br />
}</nowiki><br />
<br />
=== Error detection ===<br />
The trailing error detection byte is calculated using [[CRC-8-CCITT]] <b>over the whole packet</b> (both the header and the payload)<br />
<br />
== Layer 2 - "ircom" ==<br />
ircom is a simple stateful point-to-point master-slave communication protocol built on top of IR layer 1.<br />
<br />
{| class="wikitable" style="margin: 0 auto; text-align: center;"<br />
! style="border-top: none" | Byte<br />
! style="width:10%;"| 7<br />
! style="width:10%;"| 6<br />
! style="width:10%;"| 5<br />
! style="width:10%;"| 4<br />
! style="width:10%;"| 3<br />
! style="width:10%;"| 2<br />
! style="width:10%;"| 1<br />
! style="width:10%;"| 0<br />
|-<br />
! 0x00<br />
| colspan="8"|Random value in range <code>0x01</code>~<code>0xFE</code><br />
|-<br />
! 0x01<br />
| colspan="8"|Random value in range <code>0x01</code>~<code>0xFE</code><br />
|-<br />
! 0x02<br />
| colspan="8"|Random value in range <code>0x01</code>~<code>0xFE</code><br />
|-<br />
! 0x03<br />
| colspan="8"|Random value in range <code>0x01</code>~<code>0xFE</code><br />
|-<br />
! 0x04<br />
| colspan="4"|RFU?<br />
| colspan="4"|Protocol version: <code>0x1</code><br />
|-<br />
! 0x05<br />
| colspan="8"|Connection identifier<br />
|-<br />
! 0x06<br />
| colspan="8"|Reserved for future use?<br />
|-<br />
! 0x07<br />
| colspan="4"|???<br />
| colspan="4"|Operation code<br />
|-<br />
! 0x08+<br />
| colspan="8" style="background:#ffd0d0;"|Payload (if any)<br />
|}<br />
<br />
* Random values are generated using a Mersenne Twister whose seed is based off the NFC adapter system tick counter. It is therefore random, and the 3DS won't attempt to validate them by any means. Its purpose is unknown.<br />
* NFC adapter will ignore packets whose protocol version is not 1. It will not even reply.<br />
* Connection identifier is a random byte the 3DS assigns to identify the connection should be several connections in range at once. Slave devices must save this value from the initial handshake packet and use it for replies. It must also ignore packets whose connection ID does not match.<br />
<br />
=== Operation codes ===<br />
{| class="wikitable"<br />
! Code<br />
! Name<br />
! Has payload<br />
! Direction<br />
|-<br />
! 0x0<br />
| Layer 3 command?<br />
| style="background: green" | Yes<br />
| Master to slave<br />
|-<br />
! 0x1<br />
| ???<br />
| ???<br />
|-<br />
! 0x2<br />
| ???<br />
| ???<br />
|-<br />
! 0x3<br />
| ???<br />
| ???<br />
|-<br />
! 0x4<br />
| ???<br />
| ???<br />
|-<br />
! 0x5<br />
| ???<br />
| ???<br />
|-<br />
! 0x6<br />
| ???<br />
| ???<br />
|-<br />
! 0x7<br />
| ???<br />
| ???<br />
|-<br />
! 0x8<br />
| ???<br />
| ???<br />
|-<br />
! 0x9<br />
| ???<br />
| ???<br />
|-<br />
! 0xA<br />
| Disconnect request<br />
| style="background: red" | No<br />
| Master to slave<br />
|-<br />
! 0xB<br />
| Disconnection acknowledgment<br />
| style="background: red" | No<br />
| Slave to master<br />
|-<br />
! 0xC<br />
| Handshake<br />
| style="background: red" | No<br />
| Master to slave<br />
|-<br />
! 0xD<br />
| Handshake acknowledgement<br />
| style="background: red" | No<br />
| Slave to master<br />
|-<br />
! 0xE<br />
| ???<br />
| ???<br />
|-<br />
! 0xF<br />
| ???<br />
| ???<br />
|}<br />
<br />
== Samples ==<br />
<br />
NFC handshake beacons:<br />
{| class="wikitable"<br />
|-<br />
! Layer 1 packet<br />
! Layer 2 packet<br />
! Layer 3 packet<br />
|-<br />
| <code>A5 00 08 73 FE A5 C4 A4 2C A4 20 F5</code><br />
| <code>9A 9D D6 3A 01 E8 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 D1 3E B7 7B B6 91 B6 9D 87</code><br />
| <code>38 5D 66 45 01 EA 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 09 58 23 36 22 DA 22 D6 AE</code><br />
| <code>E0 3B 2A 6E 01 EC 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 5E DD A4 A0 A5 4E A5 42 A8</code><br />
| <code>B7 BE FA 7D 01 EE 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 BC 19 C6 37 C7 C7 C7 CB 8B</code><br />
| <code>55 7A 7A 2E 01 F0 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 C9 15 F6 63 F7 91 F7 9D B2</code><br />
| <code>20 76 3F 76 01 F2 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 6E 48 47 1A 46 EE 46 E2 C7</code><br />
| <code>87 2B 29 52 01 F4 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 A2 8C E5 C3 E4 35 E4 39 74</code><br />
| <code>4B EF 47 4F 01 F6 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 26 1C 07 10 06 E8 06 E4 64</code><br />
| <code>CF 7F 21 0C 01 F8 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 7E 73 A2 3F A3 C5 A3 C9 FD</code><br />
| <code>97 10 DC 4C 01 FA 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 75 00 F3 B8 F2 44 F2 48 63</code><br />
| <code>9C 63 86 B8 01 FC 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 8D AC 0F D5 0E 2B 0E 27 72</code><br />
| <code>64 CF 82 79 01 FE 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 A3 55 7C 53 7D 52 7D 5E B2</code><br />
| <code>4A 36 DF 06 01 01 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 15 06 43 C0 42 C3 42 CF 85</code><br />
| <code>FC 65 56 C6 01 03 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 66 E0 9A 17 9B 12 9B 1E A0</code><br />
| <code>8F 83 FC F7 01 05 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 A4 35 09 97 08 90 08 9C 25</code><br />
| <code>4D 56 AD A2 01 07 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 73 E2 BD AF BC A6 BC AA 60</code><br />
| <code>9A 81 CE 4D 01 09 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 02 57 D7 B0 D6 BB D6 B7 28</code><br />
| <code>EB 34 D5 E7 01 0B 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 0D 79 01 AA 00 A7 00 AB 22</code><br />
| <code>E4 1A 0C D3 01 0D 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 14 91 04 B9 05 B6 05 BA B2</code><br />
| <code>FD F2 10 28 01 0F 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 2C 86 B1 49 B0 58 B0 54 C0</code><br />
| <code>C5 E5 9D CF 01 11 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 D5 1D DE DB DF C8 DF C4 F9</code><br />
| <code>3C 7E 0B C6 01 13 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 AF 75 DE 5C DF 49 DF 45 9C</code><br />
| <code>46 16 71 29 01 15 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 C8 E2 5B C6 5A D1 5A DD B5</code><br />
| <code>21 81 93 24 01 17 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 9B 51 68 2D 69 34 69 38 41</code><br />
| <code>72 32 F3 7C 01 19 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 13 7B 9F EF 9E F4 9E F8 32</code><br />
| <code>FA 18 8C 94 01 1B 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 A7 62 02 9C 03 81 03 8D BD</code><br />
| <code>4E 01 A5 FE 01 1D 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 39 06 94 36 95 29 95 25 09</code><br />
| <code>D0 65 AD 30 01 1F 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 32 4C D7 C0 D6 E1 D6 ED 92</code><br />
| <code>DB 2F E5 8C 01 21 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 83 BE F2 8F F3 AC F3 A0 B1</code><br />
| <code>6A DD 71 31 01 23 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 83 5E A0 57 A1 72 A1 7E F0</code><br />
| <code>6A 3D 23 09 01 25 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 6E C8 AD 69 AC 4E AC 42 D1</code><br />
| <code>87 AB C3 A1 01 27 00 0C</code><br />
| ␀<br />
|-<br />
| <code>A5 00 08 C7 33 A1 2C A0 05 A0 09 FC</code><br />
| <code>2E 50 66 1F 01 29 00 0C</code><br />
| ␀<br />
|}<br />
<br />
= External links =<br />
* [https://www.broadcom.com/products/NFC/NFC-Solutions/BCM2079x-Family BCM2079x brief on Broadcom's website]</div>
Socram8888
https://www.3dbrew.org/w/index.php?title=NFC_adapter&diff=12480
NFC adapter
2015-04-20T12:23:42Z
<p>Socram8888: /* Samples */</p>
<hr />
<div>The Nintendo NFC adapter is an upcoming external device which adds NFC capabilities for [[amiibo]]s to old Nintendo 3DS and Nintendo 2DS consoles, using the infrared port on the back of the console.<br />
<br />
[[File:150217nfcreader-640x360.jpg|thumb|right|250px|Media preview, as released by Nintendo]]<br />
<br />
<br />
= Technical details =<br />
Based on analysis of the [[fangate_updater.bin]] file, which is part of the old Nintendo 3DS operating system since [[9.3.0-21]] and contains the firmware running on the external adapter; and analysis of the [[NFC Services]] running on old 3DS.<br />
<br />
* SOC inside the adapter: Broadcom BCM20791B1<br />
* CPU: ARM Cortex M0<br />
* Communications: infrared, with [[ir:USER]] running on the console. Uses obfuscated payloads. Baud rate is 115200 bps.<br />
<br />
Memory map:<br />
{| class="wikitable"<br />
|-<br />
! Address<br />
! Size<br />
! Description<br />
|-<br />
| 0x08008000<br />
| 256KB?<br />
| Firmware ([[fangate_updater.bin]])<br />
|-<br />
| 0x20000000<br />
| 128KB?<br />
| RAM<br />
|-<br />
| 0x40023C00<br />
| 0x1C<br />
| FLASH ROM control<br />
|-<br />
| 0xE000ED00<br />
| 0x104<br />
| [http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0439b/BABCIIIA.html ARM Cortex system control block]<br />
|}<br />
<br />
= IR communications =<br />
Packets are sent using IrDA-SIR (using [[ir:USER]]), with a 8N1 encoding (eight data bits, one stop bit, without parity). Each one is formed by a 2-byte header, a varint with the payload size, an obfuscated payload, and trailing error detection byte.<br />
<br />
== Layer 1 - framing format ==<br />
Frames are encoded using two different yet very simmilar formats, depending on how large the payload to be transmitted is:<br />
* For payloads with less than 64 bytes, the third byte represents the payload size.<br />
* For packets with up to 16383 bytes, the size is split in two bytes, with the third byte being the upper 6 bits of the payload size, OR'd with 0x40, and the fourth being the lower eight bits of the payload size<br />
<br />
{| class="wikitable" style="margin: 0 auto; text-align: center;"<br />
|+IR framing format - short frame<br />
|-<br />
! style="border-top: none" | Byte<br />
! style="width:10%;"| 7<br />
! style="width:10%;"| 6<br />
! style="width:10%;"| 5<br />
! style="width:10%;"| 4<br />
! style="width:10%;"| 3<br />
! style="width:10%;"| 2<br />
! style="width:10%;"| 1<br />
! style="width:10%;"| 0<br />
|-<br />
! 0x00<br />
| colspan="8"|Synchronization byte (<code>0xA5</code>)<br />
|-<br />
! 0x01<br />
| colspan="8"|Reserved for future use (<code>0x00</code>)<br />
|-<br />
! 0x02<br />
| RFU (<code>0</code>)<br />
| Short frame (<code>0</code>)<br />
| colspan="6"|Payload size<br />
|-<br />
! 0x03<br />
| colspan="8"|Payload byte 0<br />
|-<br />
| colspan="9"|...<br />
|-<br />
! 0x03+n-1<br />
| colspan="8"|Payload byte n-1<br />
|-<br />
! 0x03+n<br />
| colspan="8"|[[CRC-8-CCITT]] computer over whole packet<br />
|}<br />
<br />
<br />
{| class="wikitable" style="margin: 0 auto; text-align: center;"<br />
|+IR framing format - long frame<br />
|-<br />
! style="border-top: none" | Byte<br />
! style="width:10%;"| 7<br />
! style="width:10%;"| 6<br />
! style="width:10%;"| 5<br />
! style="width:10%;"| 4<br />
! style="width:10%;"| 3<br />
! style="width:10%;"| 2<br />
! style="width:10%;"| 1<br />
! style="width:10%;"| 0<br />
|-<br />
! 0x00<br />
| colspan="8"|Synchronization byte: <code>0xA5</code><br />
|-<br />
! 0x01<br />
| colspan="8"|Reserved for future use<br />
|-<br />
! 0x02<br />
| RFU (<code>0</code>)<br />
| Long frame (<code>1</code>)<br />
| colspan="6"|Payload size (upper 6 bits)<br />
|-<br />
! 0x03<br />
| colspan="8"|Payload size (lower 8 bits)<br />
|-<br />
! 0x04<br />
| colspan="8"|Payload byte 0<br />
|-<br />
| colspan="9"|...<br />
|-<br />
! 0x04+n-1<br />
| colspan="8"|Payload byte n-1<br />
|-<br />
! 0x04+n<br />
| colspan="8"|[[CRC-8-CCITT]] computer over whole packet<br />
|}<br />
<br />
=== Header ===<br />
The packet header is fixed and consists in a synchronization byte (0xA5), followed by a unused (possibly RFU) zero byte. After these two hardcoded bytes, there's a varint representing the payload size, which may use one byte or two, depending on the how big the payload is.<br />
<br />
In C:<br />
<nowiki>uint8_t * setPacketHeader(uint8_t * buffer, size_t payloadSize) {<br />
assert(payloadSize < 16384);<br />
<br />
buffer[0] = 0xA5;<br />
buffer[1] = 0x00;<br />
<br />
if (payloadSize < 64) {<br />
buffer[2] = payloadSize;<br />
buffer += 3;<br />
} else {<br />
buffer[2] = 0x40 | (payloadSize >> 8);<br />
buffer[3] = payloadSize;<br />
buffer += 4;<br />
}<br />
<br />
return buffer;<br />
}</nowiki><br />
<br />
=== Payload ===<br />
The payload is obfuscated using a XOR-based encryption. In C:<br />
<nowiki>void payloadObfuscate(const void * voidplain, void * voidcipher, size_t size) {<br />
uint16_t * plain = (uint16_t *) voidplain;<br />
uint16_t * cipher = (uint16_t *) voidcipher;<br />
size_t halfCount = size / sizeof(uint16_t);<br />
<br />
uint16_t xorval = htobe16(0xE963);<br />
size_t i;<br />
<br />
for (i = 0; i < halfCount; i++) {<br />
xorval ^= plain[i];<br />
cipher[i] = xorval;<br />
}<br />
}<br />
<br />
void payloadDeobfuscate(const void * voidcipher, void * voidplain, size_t size) {<br />
uint16_t * cipher = (uint16_t *) voidcipher;<br />
uint16_t * plain = (uint16_t *) voidplain;<br />
size_t halfCount = size / sizeof(uint16_t);<br />
<br />
if (halfCount) {<br />
size_t i;<br />
for (i = halfCount - 1; i > 0; i--) {<br />
plain[i] = cipher[i] ^ cipher[i - 1];<br />
}<br />
<br />
plain[0] = cipher[0] ^ htobe16(0xE963);<br />
}<br />
}</nowiki><br />
<br />
=== Error detection ===<br />
The trailing error detection byte is calculated using [[CRC-8-CCITT]] <b>over the whole packet</b> (both the header and the payload)<br />
<br />
== Layer 2 - "ircom" ==<br />
ircom is a simple stateful point-to-point master-slave communication protocol built on top of IR layer 1.<br />
<br />
{| class="wikitable" style="margin: 0 auto; text-align: center;"<br />
! style="border-top: none" | Byte<br />
! style="width:10%;"| 7<br />
! style="width:10%;"| 6<br />
! style="width:10%;"| 5<br />
! style="width:10%;"| 4<br />
! style="width:10%;"| 3<br />
! style="width:10%;"| 2<br />
! style="width:10%;"| 1<br />
! style="width:10%;"| 0<br />
|-<br />
! 0x00<br />
| colspan="8"|Random value in range <code>0x01</code>~<code>0xFE</code><br />
|-<br />
! 0x01<br />
| colspan="8"|Random value in range <code>0x01</code>~<code>0xFE</code><br />
|-<br />
! 0x02<br />
| colspan="8"|Random value in range <code>0x01</code>~<code>0xFE</code><br />
|-<br />
! 0x03<br />
| colspan="8"|Random value in range <code>0x01</code>~<code>0xFE</code><br />
|-<br />
! 0x04<br />
| colspan="4"|RFU?<br />
| colspan="4"|Protocol version: <code>0x1</code><br />
|-<br />
! 0x05<br />
| colspan="8"|Connection identifier<br />
|-<br />
! 0x06<br />
| colspan="8"|Reserved for future use?<br />
|-<br />
! 0x07<br />
| colspan="4"|???<br />
| colspan="4"|Operation code<br />
|-<br />
! 0x08+<br />
| colspan="8" style="background:#ffd0d0;"|Payload (if any)<br />
|}<br />
<br />
* Random values are generated using a Mersenne Twister whose seed is based off the NFC adapter system tick counter. It is therefore random, and the 3DS won't attempt to validate them by any means. Its purpose is unknown.<br />
* NFC adapter will ignore packets whose protocol version is not 1. It will not even reply.<br />
* Connection identifier is a random byte the 3DS assigns to identify the connection should be several connections in range at once. Slave devices must save this value from the initial handshake packet and use it for replies. It must also ignore packets whose connection ID does not match.<br />
<br />
=== Operation codes ===<br />
{| class="wikitable"<br />
|+IR framing format - long frame<br />
|-<br />
! Code<br />
! Name<br />
! Direction<br />
|-<br />
! 0x0<br />
| Layer 3 command?<br />
| 3DS to NFC<br />
|-<br />
! 0x1<br />
| ???<br />
| ???<br />
|-<br />
! 0x2<br />
| ???<br />
| ???<br />
|-<br />
! 0x3<br />
| ???<br />
| ???<br />
|-<br />
! 0x4<br />
| ???<br />
| ???<br />
|-<br />
! 0x5<br />
| ???<br />
| ???<br />
|-<br />
! 0x6<br />
| ???<br />
| ???<br />
|-<br />
! 0x7<br />
| ???<br />
| ???<br />
|-<br />
! 0x8<br />
| ???<br />
| ???<br />
|-<br />
! 0x9<br />
| ???<br />
| ???<br />
|-<br />
! 0xA<br />
| Disconnect request<br />
| 3DS to NFC<br />
|-<br />
! 0xB<br />
| Disconnection acknowledgment<br />
| NFC to 3DS<br />
|-<br />
! 0xC<br />
| Handshake<br />
| 3DS to NFC<br />
|-<br />
! 0xD<br />
| Handshake acknowledgement<br />
| NFC to 3DS<br />
|-<br />
! 0xE<br />
| ???<br />
| ???<br />
|-<br />
! 0xF<br />
| ???<br />
| ???<br />
|}<br />
<br />
== Samples ==<br />
<br />
NFC handshake beacons:<br />
{| class="wikitable"<br />
|-<br />
! Layer 1 packet<br />
! Layer 2 packet<br />
|-<br />
| <code>A5 00 08 73 FE A5 C4 A4 2C A4 20 F5</code><br />
| <code>9A 9D D6 3A 01 E8 00 0C</code><br />
|-<br />
| <code>A5 00 08 D1 3E B7 7B B6 91 B6 9D 87</code><br />
| <code>38 5D 66 45 01 EA 00 0C</code><br />
|-<br />
| <code>A5 00 08 09 58 23 36 22 DA 22 D6 AE</code><br />
| <code>E0 3B 2A 6E 01 EC 00 0C</code><br />
|-<br />
| <code>A5 00 08 5E DD A4 A0 A5 4E A5 42 A8</code><br />
| <code>B7 BE FA 7D 01 EE 00 0C</code><br />
|-<br />
| <code>A5 00 08 BC 19 C6 37 C7 C7 C7 CB 8B</code><br />
| <code>55 7A 7A 2E 01 F0 00 0C</code><br />
|-<br />
| <code>A5 00 08 C9 15 F6 63 F7 91 F7 9D B2</code><br />
| <code>20 76 3F 76 01 F2 00 0C</code><br />
|-<br />
| <code>A5 00 08 6E 48 47 1A 46 EE 46 E2 C7</code><br />
| <code>87 2B 29 52 01 F4 00 0C</code><br />
|-<br />
| <code>A5 00 08 A2 8C E5 C3 E4 35 E4 39 74</code><br />
| <code>4B EF 47 4F 01 F6 00 0C</code><br />
|-<br />
| <code>A5 00 08 26 1C 07 10 06 E8 06 E4 64</code><br />
| <code>CF 7F 21 0C 01 F8 00 0C</code><br />
|-<br />
| <code>A5 00 08 7E 73 A2 3F A3 C5 A3 C9 FD</code><br />
| <code>97 10 DC 4C 01 FA 00 0C</code><br />
|-<br />
| <code>A5 00 08 75 00 F3 B8 F2 44 F2 48 63</code><br />
| <code>9C 63 86 B8 01 FC 00 0C</code><br />
|-<br />
| <code>A5 00 08 8D AC 0F D5 0E 2B 0E 27 72</code><br />
| <code>64 CF 82 79 01 FE 00 0C</code><br />
|-<br />
| <code>A5 00 08 A3 55 7C 53 7D 52 7D 5E B2</code><br />
| <code>4A 36 DF 06 01 01 00 0C</code><br />
|-<br />
| <code>A5 00 08 15 06 43 C0 42 C3 42 CF 85</code><br />
| <code>FC 65 56 C6 01 03 00 0C</code><br />
|-<br />
| <code>A5 00 08 66 E0 9A 17 9B 12 9B 1E A0</code><br />
| <code>8F 83 FC F7 01 05 00 0C</code><br />
|-<br />
| <code>A5 00 08 A4 35 09 97 08 90 08 9C 25</code><br />
| <code>4D 56 AD A2 01 07 00 0C</code><br />
|-<br />
| <code>A5 00 08 73 E2 BD AF BC A6 BC AA 60</code><br />
| <code>9A 81 CE 4D 01 09 00 0C</code><br />
|-<br />
| <code>A5 00 08 02 57 D7 B0 D6 BB D6 B7 28</code><br />
| <code>EB 34 D5 E7 01 0B 00 0C</code><br />
|-<br />
| <code>A5 00 08 0D 79 01 AA 00 A7 00 AB 22</code><br />
| <code>E4 1A 0C D3 01 0D 00 0C</code><br />
|-<br />
| <code>A5 00 08 14 91 04 B9 05 B6 05 BA B2</code><br />
| <code>FD F2 10 28 01 0F 00 0C</code><br />
|-<br />
| <code>A5 00 08 2C 86 B1 49 B0 58 B0 54 C0</code><br />
| <code>C5 E5 9D CF 01 11 00 0C</code><br />
|-<br />
| <code>A5 00 08 D5 1D DE DB DF C8 DF C4 F9</code><br />
| <code>3C 7E 0B C6 01 13 00 0C</code><br />
|-<br />
| <code>A5 00 08 AF 75 DE 5C DF 49 DF 45 9C</code><br />
| <code>46 16 71 29 01 15 00 0C</code><br />
|-<br />
| <code>A5 00 08 C8 E2 5B C6 5A D1 5A DD B5</code><br />
| <code>21 81 93 24 01 17 00 0C</code><br />
|-<br />
| <code>A5 00 08 9B 51 68 2D 69 34 69 38 41</code><br />
| <code>72 32 F3 7C 01 19 00 0C</code><br />
|-<br />
| <code>A5 00 08 13 7B 9F EF 9E F4 9E F8 32</code><br />
| <code>FA 18 8C 94 01 1B 00 0C</code><br />
|-<br />
| <code>A5 00 08 A7 62 02 9C 03 81 03 8D BD</code><br />
| <code>4E 01 A5 FE 01 1D 00 0C</code><br />
|-<br />
| <code>A5 00 08 39 06 94 36 95 29 95 25 09</code><br />
| <code>D0 65 AD 30 01 1F 00 0C</code><br />
|-<br />
| <code>A5 00 08 32 4C D7 C0 D6 E1 D6 ED 92</code><br />
| <code>DB 2F E5 8C 01 21 00 0C</code><br />
|-<br />
| <code>A5 00 08 83 BE F2 8F F3 AC F3 A0 B1</code><br />
| <code>6A DD 71 31 01 23 00 0C</code><br />
|-<br />
| <code>A5 00 08 83 5E A0 57 A1 72 A1 7E F0</code><br />
| <code>6A 3D 23 09 01 25 00 0C</code><br />
|-<br />
| <code>A5 00 08 6E C8 AD 69 AC 4E AC 42 D1</code><br />
| <code>87 AB C3 A1 01 27 00 0C</code><br />
|-<br />
| <code>A5 00 08 C7 33 A1 2C A0 05 A0 09 FC</code><br />
| <code>2E 50 66 1F 01 29 00 0C</code><br />
|}<br />
<br />
= External links =<br />
* [https://www.broadcom.com/products/NFC/NFC-Solutions/BCM2079x-Family BCM2079x brief on Broadcom's website]</div>
Socram8888
https://www.3dbrew.org/w/index.php?title=NFC_adapter&diff=12479
NFC adapter
2015-04-20T12:23:11Z
<p>Socram8888: /* Samples */</p>
<hr />
<div>The Nintendo NFC adapter is an upcoming external device which adds NFC capabilities for [[amiibo]]s to old Nintendo 3DS and Nintendo 2DS consoles, using the infrared port on the back of the console.<br />
<br />
[[File:150217nfcreader-640x360.jpg|thumb|right|250px|Media preview, as released by Nintendo]]<br />
<br />
<br />
= Technical details =<br />
Based on analysis of the [[fangate_updater.bin]] file, which is part of the old Nintendo 3DS operating system since [[9.3.0-21]] and contains the firmware running on the external adapter; and analysis of the [[NFC Services]] running on old 3DS.<br />
<br />
* SOC inside the adapter: Broadcom BCM20791B1<br />
* CPU: ARM Cortex M0<br />
* Communications: infrared, with [[ir:USER]] running on the console. Uses obfuscated payloads. Baud rate is 115200 bps.<br />
<br />
Memory map:<br />
{| class="wikitable"<br />
|-<br />
! Address<br />
! Size<br />
! Description<br />
|-<br />
| 0x08008000<br />
| 256KB?<br />
| Firmware ([[fangate_updater.bin]])<br />
|-<br />
| 0x20000000<br />
| 128KB?<br />
| RAM<br />
|-<br />
| 0x40023C00<br />
| 0x1C<br />
| FLASH ROM control<br />
|-<br />
| 0xE000ED00<br />
| 0x104<br />
| [http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0439b/BABCIIIA.html ARM Cortex system control block]<br />
|}<br />
<br />
= IR communications =<br />
Packets are sent using IrDA-SIR (using [[ir:USER]]), with a 8N1 encoding (eight data bits, one stop bit, without parity). Each one is formed by a 2-byte header, a varint with the payload size, an obfuscated payload, and trailing error detection byte.<br />
<br />
== Layer 1 - framing format ==<br />
Frames are encoded using two different yet very simmilar formats, depending on how large the payload to be transmitted is:<br />
* For payloads with less than 64 bytes, the third byte represents the payload size.<br />
* For packets with up to 16383 bytes, the size is split in two bytes, with the third byte being the upper 6 bits of the payload size, OR'd with 0x40, and the fourth being the lower eight bits of the payload size<br />
<br />
{| class="wikitable" style="margin: 0 auto; text-align: center;"<br />
|+IR framing format - short frame<br />
|-<br />
! style="border-top: none" | Byte<br />
! style="width:10%;"| 7<br />
! style="width:10%;"| 6<br />
! style="width:10%;"| 5<br />
! style="width:10%;"| 4<br />
! style="width:10%;"| 3<br />
! style="width:10%;"| 2<br />
! style="width:10%;"| 1<br />
! style="width:10%;"| 0<br />
|-<br />
! 0x00<br />
| colspan="8"|Synchronization byte (<code>0xA5</code>)<br />
|-<br />
! 0x01<br />
| colspan="8"|Reserved for future use (<code>0x00</code>)<br />
|-<br />
! 0x02<br />
| RFU (<code>0</code>)<br />
| Short frame (<code>0</code>)<br />
| colspan="6"|Payload size<br />
|-<br />
! 0x03<br />
| colspan="8"|Payload byte 0<br />
|-<br />
| colspan="9"|...<br />
|-<br />
! 0x03+n-1<br />
| colspan="8"|Payload byte n-1<br />
|-<br />
! 0x03+n<br />
| colspan="8"|[[CRC-8-CCITT]] computer over whole packet<br />
|}<br />
<br />
<br />
{| class="wikitable" style="margin: 0 auto; text-align: center;"<br />
|+IR framing format - long frame<br />
|-<br />
! style="border-top: none" | Byte<br />
! style="width:10%;"| 7<br />
! style="width:10%;"| 6<br />
! style="width:10%;"| 5<br />
! style="width:10%;"| 4<br />
! style="width:10%;"| 3<br />
! style="width:10%;"| 2<br />
! style="width:10%;"| 1<br />
! style="width:10%;"| 0<br />
|-<br />
! 0x00<br />
| colspan="8"|Synchronization byte: <code>0xA5</code><br />
|-<br />
! 0x01<br />
| colspan="8"|Reserved for future use<br />
|-<br />
! 0x02<br />
| RFU (<code>0</code>)<br />
| Long frame (<code>1</code>)<br />
| colspan="6"|Payload size (upper 6 bits)<br />
|-<br />
! 0x03<br />
| colspan="8"|Payload size (lower 8 bits)<br />
|-<br />
! 0x04<br />
| colspan="8"|Payload byte 0<br />
|-<br />
| colspan="9"|...<br />
|-<br />
! 0x04+n-1<br />
| colspan="8"|Payload byte n-1<br />
|-<br />
! 0x04+n<br />
| colspan="8"|[[CRC-8-CCITT]] computer over whole packet<br />
|}<br />
<br />
=== Header ===<br />
The packet header is fixed and consists in a synchronization byte (0xA5), followed by a unused (possibly RFU) zero byte. After these two hardcoded bytes, there's a varint representing the payload size, which may use one byte or two, depending on the how big the payload is.<br />
<br />
In C:<br />
<nowiki>uint8_t * setPacketHeader(uint8_t * buffer, size_t payloadSize) {<br />
assert(payloadSize < 16384);<br />
<br />
buffer[0] = 0xA5;<br />
buffer[1] = 0x00;<br />
<br />
if (payloadSize < 64) {<br />
buffer[2] = payloadSize;<br />
buffer += 3;<br />
} else {<br />
buffer[2] = 0x40 | (payloadSize >> 8);<br />
buffer[3] = payloadSize;<br />
buffer += 4;<br />
}<br />
<br />
return buffer;<br />
}</nowiki><br />
<br />
=== Payload ===<br />
The payload is obfuscated using a XOR-based encryption. In C:<br />
<nowiki>void payloadObfuscate(const void * voidplain, void * voidcipher, size_t size) {<br />
uint16_t * plain = (uint16_t *) voidplain;<br />
uint16_t * cipher = (uint16_t *) voidcipher;<br />
size_t halfCount = size / sizeof(uint16_t);<br />
<br />
uint16_t xorval = htobe16(0xE963);<br />
size_t i;<br />
<br />
for (i = 0; i < halfCount; i++) {<br />
xorval ^= plain[i];<br />
cipher[i] = xorval;<br />
}<br />
}<br />
<br />
void payloadDeobfuscate(const void * voidcipher, void * voidplain, size_t size) {<br />
uint16_t * cipher = (uint16_t *) voidcipher;<br />
uint16_t * plain = (uint16_t *) voidplain;<br />
size_t halfCount = size / sizeof(uint16_t);<br />
<br />
if (halfCount) {<br />
size_t i;<br />
for (i = halfCount - 1; i > 0; i--) {<br />
plain[i] = cipher[i] ^ cipher[i - 1];<br />
}<br />
<br />
plain[0] = cipher[0] ^ htobe16(0xE963);<br />
}<br />
}</nowiki><br />
<br />
=== Error detection ===<br />
The trailing error detection byte is calculated using [[CRC-8-CCITT]] <b>over the whole packet</b> (both the header and the payload)<br />
<br />
== Layer 2 - "ircom" ==<br />
ircom is a simple stateful point-to-point master-slave communication protocol built on top of IR layer 1.<br />
<br />
{| class="wikitable" style="margin: 0 auto; text-align: center;"<br />
! style="border-top: none" | Byte<br />
! style="width:10%;"| 7<br />
! style="width:10%;"| 6<br />
! style="width:10%;"| 5<br />
! style="width:10%;"| 4<br />
! style="width:10%;"| 3<br />
! style="width:10%;"| 2<br />
! style="width:10%;"| 1<br />
! style="width:10%;"| 0<br />
|-<br />
! 0x00<br />
| colspan="8"|Random value in range <code>0x01</code>~<code>0xFE</code><br />
|-<br />
! 0x01<br />
| colspan="8"|Random value in range <code>0x01</code>~<code>0xFE</code><br />
|-<br />
! 0x02<br />
| colspan="8"|Random value in range <code>0x01</code>~<code>0xFE</code><br />
|-<br />
! 0x03<br />
| colspan="8"|Random value in range <code>0x01</code>~<code>0xFE</code><br />
|-<br />
! 0x04<br />
| colspan="4"|RFU?<br />
| colspan="4"|Protocol version: <code>0x1</code><br />
|-<br />
! 0x05<br />
| colspan="8"|Connection identifier<br />
|-<br />
! 0x06<br />
| colspan="8"|Reserved for future use?<br />
|-<br />
! 0x07<br />
| colspan="4"|???<br />
| colspan="4"|Operation code<br />
|-<br />
! 0x08+<br />
| colspan="8" style="background:#ffd0d0;"|Payload (if any)<br />
|}<br />
<br />
* Random values are generated using a Mersenne Twister whose seed is based off the NFC adapter system tick counter. It is therefore random, and the 3DS won't attempt to validate them by any means. Its purpose is unknown.<br />
* NFC adapter will ignore packets whose protocol version is not 1. It will not even reply.<br />
* Connection identifier is a random byte the 3DS assigns to identify the connection should be several connections in range at once. Slave devices must save this value from the initial handshake packet and use it for replies. It must also ignore packets whose connection ID does not match.<br />
<br />
=== Operation codes ===<br />
{| class="wikitable"<br />
|+IR framing format - long frame<br />
|-<br />
! Code<br />
! Name<br />
! Direction<br />
|-<br />
! 0x0<br />
| Layer 3 command?<br />
| 3DS to NFC<br />
|-<br />
! 0x1<br />
| ???<br />
| ???<br />
|-<br />
! 0x2<br />
| ???<br />
| ???<br />
|-<br />
! 0x3<br />
| ???<br />
| ???<br />
|-<br />
! 0x4<br />
| ???<br />
| ???<br />
|-<br />
! 0x5<br />
| ???<br />
| ???<br />
|-<br />
! 0x6<br />
| ???<br />
| ???<br />
|-<br />
! 0x7<br />
| ???<br />
| ???<br />
|-<br />
! 0x8<br />
| ???<br />
| ???<br />
|-<br />
! 0x9<br />
| ???<br />
| ???<br />
|-<br />
! 0xA<br />
| Disconnect request<br />
| 3DS to NFC<br />
|-<br />
! 0xB<br />
| Disconnection acknowledgment<br />
| NFC to 3DS<br />
|-<br />
! 0xC<br />
| Handshake<br />
| 3DS to NFC<br />
|-<br />
! 0xD<br />
| Handshake acknowledgement<br />
| NFC to 3DS<br />
|-<br />
! 0xE<br />
| ???<br />
| ???<br />
|-<br />
! 0xF<br />
| ???<br />
| ???<br />
|}<br />
<br />
== Samples ==<br />
<br />
NFC handshake beacons:<br />
{| class="wikitable"<br />
|-<br />
! Raw<br />
! Deobfuscated<br />
|-<br />
| <code>A5 00 08 73 FE A5 C4 A4 2C A4 20 F5</code><br />
| <code>9A 9D D6 3A 01 E8 00 0C</code><br />
|-<br />
| <code>A5 00 08 D1 3E B7 7B B6 91 B6 9D 87</code><br />
| <code>38 5D 66 45 01 EA 00 0C</code><br />
|-<br />
| <code>A5 00 08 09 58 23 36 22 DA 22 D6 AE</code><br />
| <code>E0 3B 2A 6E 01 EC 00 0C</code><br />
|-<br />
| <code>A5 00 08 5E DD A4 A0 A5 4E A5 42 A8</code><br />
| <code>B7 BE FA 7D 01 EE 00 0C</code><br />
|-<br />
| <code>A5 00 08 BC 19 C6 37 C7 C7 C7 CB 8B</code><br />
| <code>55 7A 7A 2E 01 F0 00 0C</code><br />
|-<br />
| <code>A5 00 08 C9 15 F6 63 F7 91 F7 9D B2</code><br />
| <code>20 76 3F 76 01 F2 00 0C</code><br />
|-<br />
| <code>A5 00 08 6E 48 47 1A 46 EE 46 E2 C7</code><br />
| <code>87 2B 29 52 01 F4 00 0C</code><br />
|-<br />
| <code>A5 00 08 A2 8C E5 C3 E4 35 E4 39 74</code><br />
| <code>4B EF 47 4F 01 F6 00 0C</code><br />
|-<br />
| <code>A5 00 08 26 1C 07 10 06 E8 06 E4 64</code><br />
| <code>CF 7F 21 0C 01 F8 00 0C</code><br />
|-<br />
| <code>A5 00 08 7E 73 A2 3F A3 C5 A3 C9 FD</code><br />
| <code>97 10 DC 4C 01 FA 00 0C</code><br />
|-<br />
| <code>A5 00 08 75 00 F3 B8 F2 44 F2 48 63</code><br />
| <code>9C 63 86 B8 01 FC 00 0C</code><br />
|-<br />
| <code>A5 00 08 8D AC 0F D5 0E 2B 0E 27 72</code><br />
| <code>64 CF 82 79 01 FE 00 0C</code><br />
|-<br />
| <code>A5 00 08 A3 55 7C 53 7D 52 7D 5E B2</code><br />
| <code>4A 36 DF 06 01 01 00 0C</code><br />
|-<br />
| <code>A5 00 08 15 06 43 C0 42 C3 42 CF 85</code><br />
| <code>FC 65 56 C6 01 03 00 0C</code><br />
|-<br />
| <code>A5 00 08 66 E0 9A 17 9B 12 9B 1E A0</code><br />
| <code>8F 83 FC F7 01 05 00 0C</code><br />
|-<br />
| <code>A5 00 08 A4 35 09 97 08 90 08 9C 25</code><br />
| <code>4D 56 AD A2 01 07 00 0C</code><br />
|-<br />
| <code>A5 00 08 73 E2 BD AF BC A6 BC AA 60</code><br />
| <code>9A 81 CE 4D 01 09 00 0C</code><br />
|-<br />
| <code>A5 00 08 02 57 D7 B0 D6 BB D6 B7 28</code><br />
| <code>EB 34 D5 E7 01 0B 00 0C</code><br />
|-<br />
| <code>A5 00 08 0D 79 01 AA 00 A7 00 AB 22</code><br />
| <code>E4 1A 0C D3 01 0D 00 0C</code><br />
|-<br />
| <code>A5 00 08 14 91 04 B9 05 B6 05 BA B2</code><br />
| <code>FD F2 10 28 01 0F 00 0C</code><br />
|-<br />
| <code>A5 00 08 2C 86 B1 49 B0 58 B0 54 C0</code><br />
| <code>C5 E5 9D CF 01 11 00 0C</code><br />
|-<br />
| <code>A5 00 08 D5 1D DE DB DF C8 DF C4 F9</code><br />
| <code>3C 7E 0B C6 01 13 00 0C</code><br />
|-<br />
| <code>A5 00 08 AF 75 DE 5C DF 49 DF 45 9C</code><br />
| <code>46 16 71 29 01 15 00 0C</code><br />
|-<br />
| <code>A5 00 08 C8 E2 5B C6 5A D1 5A DD B5</code><br />
| <code>21 81 93 24 01 17 00 0C</code><br />
|-<br />
| <code>A5 00 08 9B 51 68 2D 69 34 69 38 41</code><br />
| <code>72 32 F3 7C 01 19 00 0C</code><br />
|-<br />
| <code>A5 00 08 13 7B 9F EF 9E F4 9E F8 32</code><br />
| <code>FA 18 8C 94 01 1B 00 0C</code><br />
|-<br />
| <code>A5 00 08 A7 62 02 9C 03 81 03 8D BD</code><br />
| <code>4E 01 A5 FE 01 1D 00 0C</code><br />
|-<br />
| <code>A5 00 08 39 06 94 36 95 29 95 25 09</code><br />
| <code>D0 65 AD 30 01 1F 00 0C</code><br />
|-<br />
| <code>A5 00 08 32 4C D7 C0 D6 E1 D6 ED 92</code><br />
| <code>DB 2F E5 8C 01 21 00 0C</code><br />
|-<br />
| <code>A5 00 08 83 BE F2 8F F3 AC F3 A0 B1</code><br />
| <code>6A DD 71 31 01 23 00 0C</code><br />
|-<br />
| <code>A5 00 08 83 5E A0 57 A1 72 A1 7E F0</code><br />
| <code>6A 3D 23 09 01 25 00 0C</code><br />
|-<br />
| <code>A5 00 08 6E C8 AD 69 AC 4E AC 42 D1</code><br />
| <code>87 AB C3 A1 01 27 00 0C</code><br />
|-<br />
| <code>A5 00 08 C7 33 A1 2C A0 05 A0 09 FC</code><br />
| <code>2E 50 66 1F 01 29 00 0C</code><br />
|}<br />
<br />
= External links =<br />
* [https://www.broadcom.com/products/NFC/NFC-Solutions/BCM2079x-Family BCM2079x brief on Broadcom's website]</div>
Socram8888
https://www.3dbrew.org/w/index.php?title=NFC_adapter&diff=12478
NFC adapter
2015-04-20T12:17:21Z
<p>Socram8888: /* Operation codes */</p>
<hr />
<div>The Nintendo NFC adapter is an upcoming external device which adds NFC capabilities for [[amiibo]]s to old Nintendo 3DS and Nintendo 2DS consoles, using the infrared port on the back of the console.<br />
<br />
[[File:150217nfcreader-640x360.jpg|thumb|right|250px|Media preview, as released by Nintendo]]<br />
<br />
<br />
= Technical details =<br />
Based on analysis of the [[fangate_updater.bin]] file, which is part of the old Nintendo 3DS operating system since [[9.3.0-21]] and contains the firmware running on the external adapter; and analysis of the [[NFC Services]] running on old 3DS.<br />
<br />
* SOC inside the adapter: Broadcom BCM20791B1<br />
* CPU: ARM Cortex M0<br />
* Communications: infrared, with [[ir:USER]] running on the console. Uses obfuscated payloads. Baud rate is 115200 bps.<br />
<br />
Memory map:<br />
{| class="wikitable"<br />
|-<br />
! Address<br />
! Size<br />
! Description<br />
|-<br />
| 0x08008000<br />
| 256KB?<br />
| Firmware ([[fangate_updater.bin]])<br />
|-<br />
| 0x20000000<br />
| 128KB?<br />
| RAM<br />
|-<br />
| 0x40023C00<br />
| 0x1C<br />
| FLASH ROM control<br />
|-<br />
| 0xE000ED00<br />
| 0x104<br />
| [http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0439b/BABCIIIA.html ARM Cortex system control block]<br />
|}<br />
<br />
= IR communications =<br />
Packets are sent using IrDA-SIR (using [[ir:USER]]), with a 8N1 encoding (eight data bits, one stop bit, without parity). Each one is formed by a 2-byte header, a varint with the payload size, an obfuscated payload, and trailing error detection byte.<br />
<br />
== Layer 1 - framing format ==<br />
Frames are encoded using two different yet very simmilar formats, depending on how large the payload to be transmitted is:<br />
* For payloads with less than 64 bytes, the third byte represents the payload size.<br />
* For packets with up to 16383 bytes, the size is split in two bytes, with the third byte being the upper 6 bits of the payload size, OR'd with 0x40, and the fourth being the lower eight bits of the payload size<br />
<br />
{| class="wikitable" style="margin: 0 auto; text-align: center;"<br />
|+IR framing format - short frame<br />
|-<br />
! style="border-top: none" | Byte<br />
! style="width:10%;"| 7<br />
! style="width:10%;"| 6<br />
! style="width:10%;"| 5<br />
! style="width:10%;"| 4<br />
! style="width:10%;"| 3<br />
! style="width:10%;"| 2<br />
! style="width:10%;"| 1<br />
! style="width:10%;"| 0<br />
|-<br />
! 0x00<br />
| colspan="8"|Synchronization byte (<code>0xA5</code>)<br />
|-<br />
! 0x01<br />
| colspan="8"|Reserved for future use (<code>0x00</code>)<br />
|-<br />
! 0x02<br />
| RFU (<code>0</code>)<br />
| Short frame (<code>0</code>)<br />
| colspan="6"|Payload size<br />
|-<br />
! 0x03<br />
| colspan="8"|Payload byte 0<br />
|-<br />
| colspan="9"|...<br />
|-<br />
! 0x03+n-1<br />
| colspan="8"|Payload byte n-1<br />
|-<br />
! 0x03+n<br />
| colspan="8"|[[CRC-8-CCITT]] computer over whole packet<br />
|}<br />
<br />
<br />
{| class="wikitable" style="margin: 0 auto; text-align: center;"<br />
|+IR framing format - long frame<br />
|-<br />
! style="border-top: none" | Byte<br />
! style="width:10%;"| 7<br />
! style="width:10%;"| 6<br />
! style="width:10%;"| 5<br />
! style="width:10%;"| 4<br />
! style="width:10%;"| 3<br />
! style="width:10%;"| 2<br />
! style="width:10%;"| 1<br />
! style="width:10%;"| 0<br />
|-<br />
! 0x00<br />
| colspan="8"|Synchronization byte: <code>0xA5</code><br />
|-<br />
! 0x01<br />
| colspan="8"|Reserved for future use<br />
|-<br />
! 0x02<br />
| RFU (<code>0</code>)<br />
| Long frame (<code>1</code>)<br />
| colspan="6"|Payload size (upper 6 bits)<br />
|-<br />
! 0x03<br />
| colspan="8"|Payload size (lower 8 bits)<br />
|-<br />
! 0x04<br />
| colspan="8"|Payload byte 0<br />
|-<br />
| colspan="9"|...<br />
|-<br />
! 0x04+n-1<br />
| colspan="8"|Payload byte n-1<br />
|-<br />
! 0x04+n<br />
| colspan="8"|[[CRC-8-CCITT]] computer over whole packet<br />
|}<br />
<br />
=== Header ===<br />
The packet header is fixed and consists in a synchronization byte (0xA5), followed by a unused (possibly RFU) zero byte. After these two hardcoded bytes, there's a varint representing the payload size, which may use one byte or two, depending on the how big the payload is.<br />
<br />
In C:<br />
<nowiki>uint8_t * setPacketHeader(uint8_t * buffer, size_t payloadSize) {<br />
assert(payloadSize < 16384);<br />
<br />
buffer[0] = 0xA5;<br />
buffer[1] = 0x00;<br />
<br />
if (payloadSize < 64) {<br />
buffer[2] = payloadSize;<br />
buffer += 3;<br />
} else {<br />
buffer[2] = 0x40 | (payloadSize >> 8);<br />
buffer[3] = payloadSize;<br />
buffer += 4;<br />
}<br />
<br />
return buffer;<br />
}</nowiki><br />
<br />
=== Payload ===<br />
The payload is obfuscated using a XOR-based encryption. In C:<br />
<nowiki>void payloadObfuscate(const void * voidplain, void * voidcipher, size_t size) {<br />
uint16_t * plain = (uint16_t *) voidplain;<br />
uint16_t * cipher = (uint16_t *) voidcipher;<br />
size_t halfCount = size / sizeof(uint16_t);<br />
<br />
uint16_t xorval = htobe16(0xE963);<br />
size_t i;<br />
<br />
for (i = 0; i < halfCount; i++) {<br />
xorval ^= plain[i];<br />
cipher[i] = xorval;<br />
}<br />
}<br />
<br />
void payloadDeobfuscate(const void * voidcipher, void * voidplain, size_t size) {<br />
uint16_t * cipher = (uint16_t *) voidcipher;<br />
uint16_t * plain = (uint16_t *) voidplain;<br />
size_t halfCount = size / sizeof(uint16_t);<br />
<br />
if (halfCount) {<br />
size_t i;<br />
for (i = halfCount - 1; i > 0; i--) {<br />
plain[i] = cipher[i] ^ cipher[i - 1];<br />
}<br />
<br />
plain[0] = cipher[0] ^ htobe16(0xE963);<br />
}<br />
}</nowiki><br />
<br />
=== Error detection ===<br />
The trailing error detection byte is calculated using [[CRC-8-CCITT]] <b>over the whole packet</b> (both the header and the payload)<br />
<br />
== Layer 2 - "ircom" ==<br />
ircom is a simple stateful point-to-point master-slave communication protocol built on top of IR layer 1.<br />
<br />
{| class="wikitable" style="margin: 0 auto; text-align: center;"<br />
! style="border-top: none" | Byte<br />
! style="width:10%;"| 7<br />
! style="width:10%;"| 6<br />
! style="width:10%;"| 5<br />
! style="width:10%;"| 4<br />
! style="width:10%;"| 3<br />
! style="width:10%;"| 2<br />
! style="width:10%;"| 1<br />
! style="width:10%;"| 0<br />
|-<br />
! 0x00<br />
| colspan="8"|Random value in range <code>0x01</code>~<code>0xFE</code><br />
|-<br />
! 0x01<br />
| colspan="8"|Random value in range <code>0x01</code>~<code>0xFE</code><br />
|-<br />
! 0x02<br />
| colspan="8"|Random value in range <code>0x01</code>~<code>0xFE</code><br />
|-<br />
! 0x03<br />
| colspan="8"|Random value in range <code>0x01</code>~<code>0xFE</code><br />
|-<br />
! 0x04<br />
| colspan="4"|RFU?<br />
| colspan="4"|Protocol version: <code>0x1</code><br />
|-<br />
! 0x05<br />
| colspan="8"|Connection identifier<br />
|-<br />
! 0x06<br />
| colspan="8"|Reserved for future use?<br />
|-<br />
! 0x07<br />
| colspan="4"|???<br />
| colspan="4"|Operation code<br />
|-<br />
! 0x08+<br />
| colspan="8" style="background:#ffd0d0;"|Payload (if any)<br />
|}<br />
<br />
* Random values are generated using a Mersenne Twister whose seed is based off the NFC adapter system tick counter. It is therefore random, and the 3DS won't attempt to validate them by any means. Its purpose is unknown.<br />
* NFC adapter will ignore packets whose protocol version is not 1. It will not even reply.<br />
* Connection identifier is a random byte the 3DS assigns to identify the connection should be several connections in range at once. Slave devices must save this value from the initial handshake packet and use it for replies. It must also ignore packets whose connection ID does not match.<br />
<br />
=== Operation codes ===<br />
{| class="wikitable"<br />
|+IR framing format - long frame<br />
|-<br />
! Code<br />
! Name<br />
! Direction<br />
|-<br />
! 0x0<br />
| Layer 3 command?<br />
| 3DS to NFC<br />
|-<br />
! 0x1<br />
| ???<br />
| ???<br />
|-<br />
! 0x2<br />
| ???<br />
| ???<br />
|-<br />
! 0x3<br />
| ???<br />
| ???<br />
|-<br />
! 0x4<br />
| ???<br />
| ???<br />
|-<br />
! 0x5<br />
| ???<br />
| ???<br />
|-<br />
! 0x6<br />
| ???<br />
| ???<br />
|-<br />
! 0x7<br />
| ???<br />
| ???<br />
|-<br />
! 0x8<br />
| ???<br />
| ???<br />
|-<br />
! 0x9<br />
| ???<br />
| ???<br />
|-<br />
! 0xA<br />
| Disconnect request<br />
| 3DS to NFC<br />
|-<br />
! 0xB<br />
| Disconnection acknowledgment<br />
| NFC to 3DS<br />
|-<br />
! 0xC<br />
| Handshake<br />
| 3DS to NFC<br />
|-<br />
! 0xD<br />
| Handshake acknowledgement<br />
| NFC to 3DS<br />
|-<br />
! 0xE<br />
| ???<br />
| ???<br />
|-<br />
! 0xF<br />
| ???<br />
| ???<br />
|}<br />
<br />
== Samples ==<br />
<br />
NFC adapter update beacon, as sent by the console:<br />
{| class="wikitable"<br />
|-<br />
! Raw<br />
! Deobfuscated<br />
|-<br />
| <code>A5 00 08 73 FE A5 C4 A4 2C A4 20 F5</code><br />
| <code>9A 9D D6 3A 01 E8 00 0C</code><br />
|-<br />
| <code>A5 00 08 D1 3E B7 7B B6 91 B6 9D 87</code><br />
| <code>38 5D 66 45 01 EA 00 0C</code><br />
|-<br />
| <code>A5 00 08 09 58 23 36 22 DA 22 D6 AE</code><br />
| <code>E0 3B 2A 6E 01 EC 00 0C</code><br />
|-<br />
| <code>A5 00 08 5E DD A4 A0 A5 4E A5 42 A8</code><br />
| <code>B7 BE FA 7D 01 EE 00 0C</code><br />
|-<br />
| <code>A5 00 08 BC 19 C6 37 C7 C7 C7 CB 8B</code><br />
| <code>55 7A 7A 2E 01 F0 00 0C</code><br />
|-<br />
| <code>A5 00 08 C9 15 F6 63 F7 91 F7 9D B2</code><br />
| <code>20 76 3F 76 01 F2 00 0C</code><br />
|-<br />
| <code>A5 00 08 6E 48 47 1A 46 EE 46 E2 C7</code><br />
| <code>87 2B 29 52 01 F4 00 0C</code><br />
|-<br />
| <code>A5 00 08 A2 8C E5 C3 E4 35 E4 39 74</code><br />
| <code>4B EF 47 4F 01 F6 00 0C</code><br />
|-<br />
| <code>A5 00 08 26 1C 07 10 06 E8 06 E4 64</code><br />
| <code>CF 7F 21 0C 01 F8 00 0C</code><br />
|-<br />
| <code>A5 00 08 7E 73 A2 3F A3 C5 A3 C9 FD</code><br />
| <code>97 10 DC 4C 01 FA 00 0C</code><br />
|-<br />
| <code>A5 00 08 75 00 F3 B8 F2 44 F2 48 63</code><br />
| <code>9C 63 86 B8 01 FC 00 0C</code><br />
|-<br />
| <code>A5 00 08 8D AC 0F D5 0E 2B 0E 27 72</code><br />
| <code>64 CF 82 79 01 FE 00 0C</code><br />
|-<br />
| <code>A5 00 08 A3 55 7C 53 7D 52 7D 5E B2</code><br />
| <code>4A 36 DF 06 01 01 00 0C</code><br />
|-<br />
| <code>A5 00 08 15 06 43 C0 42 C3 42 CF 85</code><br />
| <code>FC 65 56 C6 01 03 00 0C</code><br />
|-<br />
| <code>A5 00 08 66 E0 9A 17 9B 12 9B 1E A0</code><br />
| <code>8F 83 FC F7 01 05 00 0C</code><br />
|-<br />
| <code>A5 00 08 A4 35 09 97 08 90 08 9C 25</code><br />
| <code>4D 56 AD A2 01 07 00 0C</code><br />
|-<br />
| <code>A5 00 08 73 E2 BD AF BC A6 BC AA 60</code><br />
| <code>9A 81 CE 4D 01 09 00 0C</code><br />
|-<br />
| <code>A5 00 08 02 57 D7 B0 D6 BB D6 B7 28</code><br />
| <code>EB 34 D5 E7 01 0B 00 0C</code><br />
|-<br />
| <code>A5 00 08 0D 79 01 AA 00 A7 00 AB 22</code><br />
| <code>E4 1A 0C D3 01 0D 00 0C</code><br />
|-<br />
| <code>A5 00 08 14 91 04 B9 05 B6 05 BA B2</code><br />
| <code>FD F2 10 28 01 0F 00 0C</code><br />
|-<br />
| <code>A5 00 08 2C 86 B1 49 B0 58 B0 54 C0</code><br />
| <code>C5 E5 9D CF 01 11 00 0C</code><br />
|-<br />
| <code>A5 00 08 D5 1D DE DB DF C8 DF C4 F9</code><br />
| <code>3C 7E 0B C6 01 13 00 0C</code><br />
|-<br />
| <code>A5 00 08 AF 75 DE 5C DF 49 DF 45 9C</code><br />
| <code>46 16 71 29 01 15 00 0C</code><br />
|-<br />
| <code>A5 00 08 C8 E2 5B C6 5A D1 5A DD B5</code><br />
| <code>21 81 93 24 01 17 00 0C</code><br />
|-<br />
| <code>A5 00 08 9B 51 68 2D 69 34 69 38 41</code><br />
| <code>72 32 F3 7C 01 19 00 0C</code><br />
|-<br />
| <code>A5 00 08 13 7B 9F EF 9E F4 9E F8 32</code><br />
| <code>FA 18 8C 94 01 1B 00 0C</code><br />
|-<br />
| <code>A5 00 08 A7 62 02 9C 03 81 03 8D BD</code><br />
| <code>4E 01 A5 FE 01 1D 00 0C</code><br />
|-<br />
| <code>A5 00 08 39 06 94 36 95 29 95 25 09</code><br />
| <code>D0 65 AD 30 01 1F 00 0C</code><br />
|-<br />
| <code>A5 00 08 32 4C D7 C0 D6 E1 D6 ED 92</code><br />
| <code>DB 2F E5 8C 01 21 00 0C</code><br />
|-<br />
| <code>A5 00 08 83 BE F2 8F F3 AC F3 A0 B1</code><br />
| <code>6A DD 71 31 01 23 00 0C</code><br />
|-<br />
| <code>A5 00 08 83 5E A0 57 A1 72 A1 7E F0</code><br />
| <code>6A 3D 23 09 01 25 00 0C</code><br />
|-<br />
| <code>A5 00 08 6E C8 AD 69 AC 4E AC 42 D1</code><br />
| <code>87 AB C3 A1 01 27 00 0C</code><br />
|-<br />
| <code>A5 00 08 C7 33 A1 2C A0 05 A0 09 FC</code><br />
| <code>2E 50 66 1F 01 29 00 0C</code><br />
|}<br />
<br />
= External links =<br />
* [https://www.broadcom.com/products/NFC/NFC-Solutions/BCM2079x-Family BCM2079x brief on Broadcom's website]</div>
Socram8888
https://www.3dbrew.org/w/index.php?title=NFC_adapter&diff=12477
NFC adapter
2015-04-20T12:16:54Z
<p>Socram8888: /* Layer 2 - "ircom" */</p>
<hr />
<div>The Nintendo NFC adapter is an upcoming external device which adds NFC capabilities for [[amiibo]]s to old Nintendo 3DS and Nintendo 2DS consoles, using the infrared port on the back of the console.<br />
<br />
[[File:150217nfcreader-640x360.jpg|thumb|right|250px|Media preview, as released by Nintendo]]<br />
<br />
<br />
= Technical details =<br />
Based on analysis of the [[fangate_updater.bin]] file, which is part of the old Nintendo 3DS operating system since [[9.3.0-21]] and contains the firmware running on the external adapter; and analysis of the [[NFC Services]] running on old 3DS.<br />
<br />
* SOC inside the adapter: Broadcom BCM20791B1<br />
* CPU: ARM Cortex M0<br />
* Communications: infrared, with [[ir:USER]] running on the console. Uses obfuscated payloads. Baud rate is 115200 bps.<br />
<br />
Memory map:<br />
{| class="wikitable"<br />
|-<br />
! Address<br />
! Size<br />
! Description<br />
|-<br />
| 0x08008000<br />
| 256KB?<br />
| Firmware ([[fangate_updater.bin]])<br />
|-<br />
| 0x20000000<br />
| 128KB?<br />
| RAM<br />
|-<br />
| 0x40023C00<br />
| 0x1C<br />
| FLASH ROM control<br />
|-<br />
| 0xE000ED00<br />
| 0x104<br />
| [http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0439b/BABCIIIA.html ARM Cortex system control block]<br />
|}<br />
<br />
= IR communications =<br />
Packets are sent using IrDA-SIR (using [[ir:USER]]), with a 8N1 encoding (eight data bits, one stop bit, without parity). Each one is formed by a 2-byte header, a varint with the payload size, an obfuscated payload, and trailing error detection byte.<br />
<br />
== Layer 1 - framing format ==<br />
Frames are encoded using two different yet very simmilar formats, depending on how large the payload to be transmitted is:<br />
* For payloads with less than 64 bytes, the third byte represents the payload size.<br />
* For packets with up to 16383 bytes, the size is split in two bytes, with the third byte being the upper 6 bits of the payload size, OR'd with 0x40, and the fourth being the lower eight bits of the payload size<br />
<br />
{| class="wikitable" style="margin: 0 auto; text-align: center;"<br />
|+IR framing format - short frame<br />
|-<br />
! style="border-top: none" | Byte<br />
! style="width:10%;"| 7<br />
! style="width:10%;"| 6<br />
! style="width:10%;"| 5<br />
! style="width:10%;"| 4<br />
! style="width:10%;"| 3<br />
! style="width:10%;"| 2<br />
! style="width:10%;"| 1<br />
! style="width:10%;"| 0<br />
|-<br />
! 0x00<br />
| colspan="8"|Synchronization byte (<code>0xA5</code>)<br />
|-<br />
! 0x01<br />
| colspan="8"|Reserved for future use (<code>0x00</code>)<br />
|-<br />
! 0x02<br />
| RFU (<code>0</code>)<br />
| Short frame (<code>0</code>)<br />
| colspan="6"|Payload size<br />
|-<br />
! 0x03<br />
| colspan="8"|Payload byte 0<br />
|-<br />
| colspan="9"|...<br />
|-<br />
! 0x03+n-1<br />
| colspan="8"|Payload byte n-1<br />
|-<br />
! 0x03+n<br />
| colspan="8"|[[CRC-8-CCITT]] computer over whole packet<br />
|}<br />
<br />
<br />
{| class="wikitable" style="margin: 0 auto; text-align: center;"<br />
|+IR framing format - long frame<br />
|-<br />
! style="border-top: none" | Byte<br />
! style="width:10%;"| 7<br />
! style="width:10%;"| 6<br />
! style="width:10%;"| 5<br />
! style="width:10%;"| 4<br />
! style="width:10%;"| 3<br />
! style="width:10%;"| 2<br />
! style="width:10%;"| 1<br />
! style="width:10%;"| 0<br />
|-<br />
! 0x00<br />
| colspan="8"|Synchronization byte: <code>0xA5</code><br />
|-<br />
! 0x01<br />
| colspan="8"|Reserved for future use<br />
|-<br />
! 0x02<br />
| RFU (<code>0</code>)<br />
| Long frame (<code>1</code>)<br />
| colspan="6"|Payload size (upper 6 bits)<br />
|-<br />
! 0x03<br />
| colspan="8"|Payload size (lower 8 bits)<br />
|-<br />
! 0x04<br />
| colspan="8"|Payload byte 0<br />
|-<br />
| colspan="9"|...<br />
|-<br />
! 0x04+n-1<br />
| colspan="8"|Payload byte n-1<br />
|-<br />
! 0x04+n<br />
| colspan="8"|[[CRC-8-CCITT]] computer over whole packet<br />
|}<br />
<br />
=== Header ===<br />
The packet header is fixed and consists in a synchronization byte (0xA5), followed by a unused (possibly RFU) zero byte. After these two hardcoded bytes, there's a varint representing the payload size, which may use one byte or two, depending on the how big the payload is.<br />
<br />
In C:<br />
<nowiki>uint8_t * setPacketHeader(uint8_t * buffer, size_t payloadSize) {<br />
assert(payloadSize < 16384);<br />
<br />
buffer[0] = 0xA5;<br />
buffer[1] = 0x00;<br />
<br />
if (payloadSize < 64) {<br />
buffer[2] = payloadSize;<br />
buffer += 3;<br />
} else {<br />
buffer[2] = 0x40 | (payloadSize >> 8);<br />
buffer[3] = payloadSize;<br />
buffer += 4;<br />
}<br />
<br />
return buffer;<br />
}</nowiki><br />
<br />
=== Payload ===<br />
The payload is obfuscated using a XOR-based encryption. In C:<br />
<nowiki>void payloadObfuscate(const void * voidplain, void * voidcipher, size_t size) {<br />
uint16_t * plain = (uint16_t *) voidplain;<br />
uint16_t * cipher = (uint16_t *) voidcipher;<br />
size_t halfCount = size / sizeof(uint16_t);<br />
<br />
uint16_t xorval = htobe16(0xE963);<br />
size_t i;<br />
<br />
for (i = 0; i < halfCount; i++) {<br />
xorval ^= plain[i];<br />
cipher[i] = xorval;<br />
}<br />
}<br />
<br />
void payloadDeobfuscate(const void * voidcipher, void * voidplain, size_t size) {<br />
uint16_t * cipher = (uint16_t *) voidcipher;<br />
uint16_t * plain = (uint16_t *) voidplain;<br />
size_t halfCount = size / sizeof(uint16_t);<br />
<br />
if (halfCount) {<br />
size_t i;<br />
for (i = halfCount - 1; i > 0; i--) {<br />
plain[i] = cipher[i] ^ cipher[i - 1];<br />
}<br />
<br />
plain[0] = cipher[0] ^ htobe16(0xE963);<br />
}<br />
}</nowiki><br />
<br />
=== Error detection ===<br />
The trailing error detection byte is calculated using [[CRC-8-CCITT]] <b>over the whole packet</b> (both the header and the payload)<br />
<br />
== Layer 2 - "ircom" ==<br />
ircom is a simple stateful point-to-point master-slave communication protocol built on top of IR layer 1.<br />
<br />
{| class="wikitable" style="margin: 0 auto; text-align: center;"<br />
! style="border-top: none" | Byte<br />
! style="width:10%;"| 7<br />
! style="width:10%;"| 6<br />
! style="width:10%;"| 5<br />
! style="width:10%;"| 4<br />
! style="width:10%;"| 3<br />
! style="width:10%;"| 2<br />
! style="width:10%;"| 1<br />
! style="width:10%;"| 0<br />
|-<br />
! 0x00<br />
| colspan="8"|Random value in range <code>0x01</code>~<code>0xFE</code><br />
|-<br />
! 0x01<br />
| colspan="8"|Random value in range <code>0x01</code>~<code>0xFE</code><br />
|-<br />
! 0x02<br />
| colspan="8"|Random value in range <code>0x01</code>~<code>0xFE</code><br />
|-<br />
! 0x03<br />
| colspan="8"|Random value in range <code>0x01</code>~<code>0xFE</code><br />
|-<br />
! 0x04<br />
| colspan="4"|RFU?<br />
| colspan="4"|Protocol version: <code>0x1</code><br />
|-<br />
! 0x05<br />
| colspan="8"|Connection identifier<br />
|-<br />
! 0x06<br />
| colspan="8"|Reserved for future use?<br />
|-<br />
! 0x07<br />
| colspan="4"|???<br />
| colspan="4"|Operation code<br />
|-<br />
! 0x08+<br />
| colspan="8" style="background:#ffd0d0;"|Payload (if any)<br />
|}<br />
<br />
* Random values are generated using a Mersenne Twister whose seed is based off the NFC adapter system tick counter. It is therefore random, and the 3DS won't attempt to validate them by any means. Its purpose is unknown.<br />
* NFC adapter will ignore packets whose protocol version is not 1. It will not even reply.<br />
* Connection identifier is a random byte the 3DS assigns to identify the connection should be several connections in range at once. Slave devices must save this value from the initial handshake packet and use it for replies. It must also ignore packets whose connection ID does not match.<br />
<br />
=== Operation codes ===<br />
{| class="wikitable" style="margin: 0 auto; text-align: center;"<br />
|+IR framing format - long frame<br />
|-<br />
! Code<br />
! Name<br />
! Direction<br />
|-<br />
! 0x0<br />
| Layer 3 command?<br />
| 3DS to NFC<br />
|-<br />
! 0x1<br />
| ???<br />
| ???<br />
|-<br />
! 0x2<br />
| ???<br />
| ???<br />
|-<br />
! 0x3<br />
| ???<br />
| ???<br />
|-<br />
! 0x4<br />
| ???<br />
| ???<br />
|-<br />
! 0x5<br />
| ???<br />
| ???<br />
|-<br />
! 0x6<br />
| ???<br />
| ???<br />
|-<br />
! 0x7<br />
| ???<br />
| ???<br />
|-<br />
! 0x8<br />
| ???<br />
| ???<br />
|-<br />
! 0x9<br />
| ???<br />
| ???<br />
|-<br />
! 0xA<br />
| Disconnect request<br />
| 3DS to NFC<br />
|-<br />
! 0xB<br />
| Disconnection acknowledgment<br />
| NFC to 3DS<br />
|-<br />
! 0xC<br />
| Handshake<br />
| 3DS to NFC<br />
|-<br />
! 0xD<br />
| Handshake acknowledgement<br />
| NFC to 3DS<br />
|-<br />
! 0xE<br />
| ???<br />
| ???<br />
|-<br />
! 0xF<br />
| ???<br />
| ???<br />
|}<br />
<br />
== Samples ==<br />
<br />
NFC adapter update beacon, as sent by the console:<br />
{| class="wikitable"<br />
|-<br />
! Raw<br />
! Deobfuscated<br />
|-<br />
| <code>A5 00 08 73 FE A5 C4 A4 2C A4 20 F5</code><br />
| <code>9A 9D D6 3A 01 E8 00 0C</code><br />
|-<br />
| <code>A5 00 08 D1 3E B7 7B B6 91 B6 9D 87</code><br />
| <code>38 5D 66 45 01 EA 00 0C</code><br />
|-<br />
| <code>A5 00 08 09 58 23 36 22 DA 22 D6 AE</code><br />
| <code>E0 3B 2A 6E 01 EC 00 0C</code><br />
|-<br />
| <code>A5 00 08 5E DD A4 A0 A5 4E A5 42 A8</code><br />
| <code>B7 BE FA 7D 01 EE 00 0C</code><br />
|-<br />
| <code>A5 00 08 BC 19 C6 37 C7 C7 C7 CB 8B</code><br />
| <code>55 7A 7A 2E 01 F0 00 0C</code><br />
|-<br />
| <code>A5 00 08 C9 15 F6 63 F7 91 F7 9D B2</code><br />
| <code>20 76 3F 76 01 F2 00 0C</code><br />
|-<br />
| <code>A5 00 08 6E 48 47 1A 46 EE 46 E2 C7</code><br />
| <code>87 2B 29 52 01 F4 00 0C</code><br />
|-<br />
| <code>A5 00 08 A2 8C E5 C3 E4 35 E4 39 74</code><br />
| <code>4B EF 47 4F 01 F6 00 0C</code><br />
|-<br />
| <code>A5 00 08 26 1C 07 10 06 E8 06 E4 64</code><br />
| <code>CF 7F 21 0C 01 F8 00 0C</code><br />
|-<br />
| <code>A5 00 08 7E 73 A2 3F A3 C5 A3 C9 FD</code><br />
| <code>97 10 DC 4C 01 FA 00 0C</code><br />
|-<br />
| <code>A5 00 08 75 00 F3 B8 F2 44 F2 48 63</code><br />
| <code>9C 63 86 B8 01 FC 00 0C</code><br />
|-<br />
| <code>A5 00 08 8D AC 0F D5 0E 2B 0E 27 72</code><br />
| <code>64 CF 82 79 01 FE 00 0C</code><br />
|-<br />
| <code>A5 00 08 A3 55 7C 53 7D 52 7D 5E B2</code><br />
| <code>4A 36 DF 06 01 01 00 0C</code><br />
|-<br />
| <code>A5 00 08 15 06 43 C0 42 C3 42 CF 85</code><br />
| <code>FC 65 56 C6 01 03 00 0C</code><br />
|-<br />
| <code>A5 00 08 66 E0 9A 17 9B 12 9B 1E A0</code><br />
| <code>8F 83 FC F7 01 05 00 0C</code><br />
|-<br />
| <code>A5 00 08 A4 35 09 97 08 90 08 9C 25</code><br />
| <code>4D 56 AD A2 01 07 00 0C</code><br />
|-<br />
| <code>A5 00 08 73 E2 BD AF BC A6 BC AA 60</code><br />
| <code>9A 81 CE 4D 01 09 00 0C</code><br />
|-<br />
| <code>A5 00 08 02 57 D7 B0 D6 BB D6 B7 28</code><br />
| <code>EB 34 D5 E7 01 0B 00 0C</code><br />
|-<br />
| <code>A5 00 08 0D 79 01 AA 00 A7 00 AB 22</code><br />
| <code>E4 1A 0C D3 01 0D 00 0C</code><br />
|-<br />
| <code>A5 00 08 14 91 04 B9 05 B6 05 BA B2</code><br />
| <code>FD F2 10 28 01 0F 00 0C</code><br />
|-<br />
| <code>A5 00 08 2C 86 B1 49 B0 58 B0 54 C0</code><br />
| <code>C5 E5 9D CF 01 11 00 0C</code><br />
|-<br />
| <code>A5 00 08 D5 1D DE DB DF C8 DF C4 F9</code><br />
| <code>3C 7E 0B C6 01 13 00 0C</code><br />
|-<br />
| <code>A5 00 08 AF 75 DE 5C DF 49 DF 45 9C</code><br />
| <code>46 16 71 29 01 15 00 0C</code><br />
|-<br />
| <code>A5 00 08 C8 E2 5B C6 5A D1 5A DD B5</code><br />
| <code>21 81 93 24 01 17 00 0C</code><br />
|-<br />
| <code>A5 00 08 9B 51 68 2D 69 34 69 38 41</code><br />
| <code>72 32 F3 7C 01 19 00 0C</code><br />
|-<br />
| <code>A5 00 08 13 7B 9F EF 9E F4 9E F8 32</code><br />
| <code>FA 18 8C 94 01 1B 00 0C</code><br />
|-<br />
| <code>A5 00 08 A7 62 02 9C 03 81 03 8D BD</code><br />
| <code>4E 01 A5 FE 01 1D 00 0C</code><br />
|-<br />
| <code>A5 00 08 39 06 94 36 95 29 95 25 09</code><br />
| <code>D0 65 AD 30 01 1F 00 0C</code><br />
|-<br />
| <code>A5 00 08 32 4C D7 C0 D6 E1 D6 ED 92</code><br />
| <code>DB 2F E5 8C 01 21 00 0C</code><br />
|-<br />
| <code>A5 00 08 83 BE F2 8F F3 AC F3 A0 B1</code><br />
| <code>6A DD 71 31 01 23 00 0C</code><br />
|-<br />
| <code>A5 00 08 83 5E A0 57 A1 72 A1 7E F0</code><br />
| <code>6A 3D 23 09 01 25 00 0C</code><br />
|-<br />
| <code>A5 00 08 6E C8 AD 69 AC 4E AC 42 D1</code><br />
| <code>87 AB C3 A1 01 27 00 0C</code><br />
|-<br />
| <code>A5 00 08 C7 33 A1 2C A0 05 A0 09 FC</code><br />
| <code>2E 50 66 1F 01 29 00 0C</code><br />
|}<br />
<br />
= External links =<br />
* [https://www.broadcom.com/products/NFC/NFC-Solutions/BCM2079x-Family BCM2079x brief on Broadcom's website]</div>
Socram8888
https://www.3dbrew.org/w/index.php?title=NFC_adapter&diff=12476
NFC adapter
2015-04-20T12:11:24Z
<p>Socram8888: /* Layer 2 - "ircom" */</p>
<hr />
<div>The Nintendo NFC adapter is an upcoming external device which adds NFC capabilities for [[amiibo]]s to old Nintendo 3DS and Nintendo 2DS consoles, using the infrared port on the back of the console.<br />
<br />
[[File:150217nfcreader-640x360.jpg|thumb|right|250px|Media preview, as released by Nintendo]]<br />
<br />
<br />
= Technical details =<br />
Based on analysis of the [[fangate_updater.bin]] file, which is part of the old Nintendo 3DS operating system since [[9.3.0-21]] and contains the firmware running on the external adapter; and analysis of the [[NFC Services]] running on old 3DS.<br />
<br />
* SOC inside the adapter: Broadcom BCM20791B1<br />
* CPU: ARM Cortex M0<br />
* Communications: infrared, with [[ir:USER]] running on the console. Uses obfuscated payloads. Baud rate is 115200 bps.<br />
<br />
Memory map:<br />
{| class="wikitable"<br />
|-<br />
! Address<br />
! Size<br />
! Description<br />
|-<br />
| 0x08008000<br />
| 256KB?<br />
| Firmware ([[fangate_updater.bin]])<br />
|-<br />
| 0x20000000<br />
| 128KB?<br />
| RAM<br />
|-<br />
| 0x40023C00<br />
| 0x1C<br />
| FLASH ROM control<br />
|-<br />
| 0xE000ED00<br />
| 0x104<br />
| [http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0439b/BABCIIIA.html ARM Cortex system control block]<br />
|}<br />
<br />
= IR communications =<br />
Packets are sent using IrDA-SIR (using [[ir:USER]]), with a 8N1 encoding (eight data bits, one stop bit, without parity). Each one is formed by a 2-byte header, a varint with the payload size, an obfuscated payload, and trailing error detection byte.<br />
<br />
== Layer 1 - framing format ==<br />
Frames are encoded using two different yet very simmilar formats, depending on how large the payload to be transmitted is:<br />
* For payloads with less than 64 bytes, the third byte represents the payload size.<br />
* For packets with up to 16383 bytes, the size is split in two bytes, with the third byte being the upper 6 bits of the payload size, OR'd with 0x40, and the fourth being the lower eight bits of the payload size<br />
<br />
{| class="wikitable" style="margin: 0 auto; text-align: center;"<br />
|+IR framing format - short frame<br />
|-<br />
! style="border-top: none" | Byte<br />
! style="width:10%;"| 7<br />
! style="width:10%;"| 6<br />
! style="width:10%;"| 5<br />
! style="width:10%;"| 4<br />
! style="width:10%;"| 3<br />
! style="width:10%;"| 2<br />
! style="width:10%;"| 1<br />
! style="width:10%;"| 0<br />
|-<br />
! 0x00<br />
| colspan="8"|Synchronization byte (<code>0xA5</code>)<br />
|-<br />
! 0x01<br />
| colspan="8"|Reserved for future use (<code>0x00</code>)<br />
|-<br />
! 0x02<br />
| RFU (<code>0</code>)<br />
| Short frame (<code>0</code>)<br />
| colspan="6"|Payload size<br />
|-<br />
! 0x03<br />
| colspan="8"|Payload byte 0<br />
|-<br />
| colspan="9"|...<br />
|-<br />
! 0x03+n-1<br />
| colspan="8"|Payload byte n-1<br />
|-<br />
! 0x03+n<br />
| colspan="8"|[[CRC-8-CCITT]] computer over whole packet<br />
|}<br />
<br />
<br />
{| class="wikitable" style="margin: 0 auto; text-align: center;"<br />
|+IR framing format - long frame<br />
|-<br />
! style="border-top: none" | Byte<br />
! style="width:10%;"| 7<br />
! style="width:10%;"| 6<br />
! style="width:10%;"| 5<br />
! style="width:10%;"| 4<br />
! style="width:10%;"| 3<br />
! style="width:10%;"| 2<br />
! style="width:10%;"| 1<br />
! style="width:10%;"| 0<br />
|-<br />
! 0x00<br />
| colspan="8"|Synchronization byte: <code>0xA5</code><br />
|-<br />
! 0x01<br />
| colspan="8"|Reserved for future use<br />
|-<br />
! 0x02<br />
| RFU (<code>0</code>)<br />
| Long frame (<code>1</code>)<br />
| colspan="6"|Payload size (upper 6 bits)<br />
|-<br />
! 0x03<br />
| colspan="8"|Payload size (lower 8 bits)<br />
|-<br />
! 0x04<br />
| colspan="8"|Payload byte 0<br />
|-<br />
| colspan="9"|...<br />
|-<br />
! 0x04+n-1<br />
| colspan="8"|Payload byte n-1<br />
|-<br />
! 0x04+n<br />
| colspan="8"|[[CRC-8-CCITT]] computer over whole packet<br />
|}<br />
<br />
=== Header ===<br />
The packet header is fixed and consists in a synchronization byte (0xA5), followed by a unused (possibly RFU) zero byte. After these two hardcoded bytes, there's a varint representing the payload size, which may use one byte or two, depending on the how big the payload is.<br />
<br />
In C:<br />
<nowiki>uint8_t * setPacketHeader(uint8_t * buffer, size_t payloadSize) {<br />
assert(payloadSize < 16384);<br />
<br />
buffer[0] = 0xA5;<br />
buffer[1] = 0x00;<br />
<br />
if (payloadSize < 64) {<br />
buffer[2] = payloadSize;<br />
buffer += 3;<br />
} else {<br />
buffer[2] = 0x40 | (payloadSize >> 8);<br />
buffer[3] = payloadSize;<br />
buffer += 4;<br />
}<br />
<br />
return buffer;<br />
}</nowiki><br />
<br />
=== Payload ===<br />
The payload is obfuscated using a XOR-based encryption. In C:<br />
<nowiki>void payloadObfuscate(const void * voidplain, void * voidcipher, size_t size) {<br />
uint16_t * plain = (uint16_t *) voidplain;<br />
uint16_t * cipher = (uint16_t *) voidcipher;<br />
size_t halfCount = size / sizeof(uint16_t);<br />
<br />
uint16_t xorval = htobe16(0xE963);<br />
size_t i;<br />
<br />
for (i = 0; i < halfCount; i++) {<br />
xorval ^= plain[i];<br />
cipher[i] = xorval;<br />
}<br />
}<br />
<br />
void payloadDeobfuscate(const void * voidcipher, void * voidplain, size_t size) {<br />
uint16_t * cipher = (uint16_t *) voidcipher;<br />
uint16_t * plain = (uint16_t *) voidplain;<br />
size_t halfCount = size / sizeof(uint16_t);<br />
<br />
if (halfCount) {<br />
size_t i;<br />
for (i = halfCount - 1; i > 0; i--) {<br />
plain[i] = cipher[i] ^ cipher[i - 1];<br />
}<br />
<br />
plain[0] = cipher[0] ^ htobe16(0xE963);<br />
}<br />
}</nowiki><br />
<br />
=== Error detection ===<br />
The trailing error detection byte is calculated using [[CRC-8-CCITT]] <b>over the whole packet</b> (both the header and the payload)<br />
<br />
== Layer 2 - "ircom" ==<br />
ircom is a simple stateful point-to-point master-slave communication protocol built on top of IR layer 1.<br />
<br />
{| class="wikitable" style="margin: 0 auto; text-align: center;"<br />
! style="border-top: none" | Byte<br />
! style="width:10%;"| 7<br />
! style="width:10%;"| 6<br />
! style="width:10%;"| 5<br />
! style="width:10%;"| 4<br />
! style="width:10%;"| 3<br />
! style="width:10%;"| 2<br />
! style="width:10%;"| 1<br />
! style="width:10%;"| 0<br />
|-<br />
! 0x00<br />
| colspan="8"|Random value in range <code>0x01</code>~<code>0xFE</code><br />
|-<br />
! 0x01<br />
| colspan="8"|Random value in range <code>0x01</code>~<code>0xFE</code><br />
|-<br />
! 0x02<br />
| colspan="8"|Random value in range <code>0x01</code>~<code>0xFE</code><br />
|-<br />
! 0x03<br />
| colspan="8"|Random value in range <code>0x01</code>~<code>0xFE</code><br />
|-<br />
! 0x04<br />
| colspan="4"|RFU?<br />
| colspan="4"|Protocol version: <code>0x1</code><br />
|-<br />
! 0x05<br />
| colspan="8"|Connection identifier<br />
|-<br />
! 0x06<br />
| colspan="8"|Reserved for future use?<br />
|-<br />
! 0x07<br />
| colspan="4"|???<br />
| colspan="4"|Operation code<br />
|-<br />
! 0x08+<br />
| colspan="8" style="background:#ffd0d0;"|Payload (if any)<br />
|}<br />
<br />
* Random values are generated using a Mersenne Twister whose seed is based off the NFC adapter system tick counter. It is therefore random, and the 3DS won't attempt to validate them by any means. Its purpose is unknown.<br />
* NFC adapter will ignore packets whose protocol version is not 1. It will not even reply.<br />
* Connection identifier is a random byte the 3DS assigns to identify the connection should be several connections in range at once. Slave devices must save this value from the initial handshake packet and use it for replies. It must also ignore packets whose connection ID does not match.<br />
<br />
== Samples ==<br />
<br />
NFC adapter update beacon, as sent by the console:<br />
{| class="wikitable"<br />
|-<br />
! Raw<br />
! Deobfuscated<br />
|-<br />
| <code>A5 00 08 73 FE A5 C4 A4 2C A4 20 F5</code><br />
| <code>9A 9D D6 3A 01 E8 00 0C</code><br />
|-<br />
| <code>A5 00 08 D1 3E B7 7B B6 91 B6 9D 87</code><br />
| <code>38 5D 66 45 01 EA 00 0C</code><br />
|-<br />
| <code>A5 00 08 09 58 23 36 22 DA 22 D6 AE</code><br />
| <code>E0 3B 2A 6E 01 EC 00 0C</code><br />
|-<br />
| <code>A5 00 08 5E DD A4 A0 A5 4E A5 42 A8</code><br />
| <code>B7 BE FA 7D 01 EE 00 0C</code><br />
|-<br />
| <code>A5 00 08 BC 19 C6 37 C7 C7 C7 CB 8B</code><br />
| <code>55 7A 7A 2E 01 F0 00 0C</code><br />
|-<br />
| <code>A5 00 08 C9 15 F6 63 F7 91 F7 9D B2</code><br />
| <code>20 76 3F 76 01 F2 00 0C</code><br />
|-<br />
| <code>A5 00 08 6E 48 47 1A 46 EE 46 E2 C7</code><br />
| <code>87 2B 29 52 01 F4 00 0C</code><br />
|-<br />
| <code>A5 00 08 A2 8C E5 C3 E4 35 E4 39 74</code><br />
| <code>4B EF 47 4F 01 F6 00 0C</code><br />
|-<br />
| <code>A5 00 08 26 1C 07 10 06 E8 06 E4 64</code><br />
| <code>CF 7F 21 0C 01 F8 00 0C</code><br />
|-<br />
| <code>A5 00 08 7E 73 A2 3F A3 C5 A3 C9 FD</code><br />
| <code>97 10 DC 4C 01 FA 00 0C</code><br />
|-<br />
| <code>A5 00 08 75 00 F3 B8 F2 44 F2 48 63</code><br />
| <code>9C 63 86 B8 01 FC 00 0C</code><br />
|-<br />
| <code>A5 00 08 8D AC 0F D5 0E 2B 0E 27 72</code><br />
| <code>64 CF 82 79 01 FE 00 0C</code><br />
|-<br />
| <code>A5 00 08 A3 55 7C 53 7D 52 7D 5E B2</code><br />
| <code>4A 36 DF 06 01 01 00 0C</code><br />
|-<br />
| <code>A5 00 08 15 06 43 C0 42 C3 42 CF 85</code><br />
| <code>FC 65 56 C6 01 03 00 0C</code><br />
|-<br />
| <code>A5 00 08 66 E0 9A 17 9B 12 9B 1E A0</code><br />
| <code>8F 83 FC F7 01 05 00 0C</code><br />
|-<br />
| <code>A5 00 08 A4 35 09 97 08 90 08 9C 25</code><br />
| <code>4D 56 AD A2 01 07 00 0C</code><br />
|-<br />
| <code>A5 00 08 73 E2 BD AF BC A6 BC AA 60</code><br />
| <code>9A 81 CE 4D 01 09 00 0C</code><br />
|-<br />
| <code>A5 00 08 02 57 D7 B0 D6 BB D6 B7 28</code><br />
| <code>EB 34 D5 E7 01 0B 00 0C</code><br />
|-<br />
| <code>A5 00 08 0D 79 01 AA 00 A7 00 AB 22</code><br />
| <code>E4 1A 0C D3 01 0D 00 0C</code><br />
|-<br />
| <code>A5 00 08 14 91 04 B9 05 B6 05 BA B2</code><br />
| <code>FD F2 10 28 01 0F 00 0C</code><br />
|-<br />
| <code>A5 00 08 2C 86 B1 49 B0 58 B0 54 C0</code><br />
| <code>C5 E5 9D CF 01 11 00 0C</code><br />
|-<br />
| <code>A5 00 08 D5 1D DE DB DF C8 DF C4 F9</code><br />
| <code>3C 7E 0B C6 01 13 00 0C</code><br />
|-<br />
| <code>A5 00 08 AF 75 DE 5C DF 49 DF 45 9C</code><br />
| <code>46 16 71 29 01 15 00 0C</code><br />
|-<br />
| <code>A5 00 08 C8 E2 5B C6 5A D1 5A DD B5</code><br />
| <code>21 81 93 24 01 17 00 0C</code><br />
|-<br />
| <code>A5 00 08 9B 51 68 2D 69 34 69 38 41</code><br />
| <code>72 32 F3 7C 01 19 00 0C</code><br />
|-<br />
| <code>A5 00 08 13 7B 9F EF 9E F4 9E F8 32</code><br />
| <code>FA 18 8C 94 01 1B 00 0C</code><br />
|-<br />
| <code>A5 00 08 A7 62 02 9C 03 81 03 8D BD</code><br />
| <code>4E 01 A5 FE 01 1D 00 0C</code><br />
|-<br />
| <code>A5 00 08 39 06 94 36 95 29 95 25 09</code><br />
| <code>D0 65 AD 30 01 1F 00 0C</code><br />
|-<br />
| <code>A5 00 08 32 4C D7 C0 D6 E1 D6 ED 92</code><br />
| <code>DB 2F E5 8C 01 21 00 0C</code><br />
|-<br />
| <code>A5 00 08 83 BE F2 8F F3 AC F3 A0 B1</code><br />
| <code>6A DD 71 31 01 23 00 0C</code><br />
|-<br />
| <code>A5 00 08 83 5E A0 57 A1 72 A1 7E F0</code><br />
| <code>6A 3D 23 09 01 25 00 0C</code><br />
|-<br />
| <code>A5 00 08 6E C8 AD 69 AC 4E AC 42 D1</code><br />
| <code>87 AB C3 A1 01 27 00 0C</code><br />
|-<br />
| <code>A5 00 08 C7 33 A1 2C A0 05 A0 09 FC</code><br />
| <code>2E 50 66 1F 01 29 00 0C</code><br />
|}<br />
<br />
= External links =<br />
* [https://www.broadcom.com/products/NFC/NFC-Solutions/BCM2079x-Family BCM2079x brief on Broadcom's website]</div>
Socram8888
https://www.3dbrew.org/w/index.php?title=NFC_adapter&diff=12460
NFC adapter
2015-04-19T18:21:44Z
<p>Socram8888: </p>
<hr />
<div>The Nintendo NFC adapter is an upcoming external device which adds NFC capabilities for [[amiibo]]s to old Nintendo 3DS and Nintendo 2DS consoles, using the infrared port on the back of the console.<br />
<br />
[[File:150217nfcreader-640x360.jpg|thumb|right|250px|Media preview, as released by Nintendo]]<br />
<br />
<br />
= Technical details =<br />
Based on analysis of the [[fangate_updater.bin]] file, which is part of the old Nintendo 3DS operating system since [[9.3.0-21]] and contains the firmware running on the external adapter; and analysis of the [[NFC Services]] running on old 3DS.<br />
<br />
* SOC inside the adapter: Broadcom BCM20791B1<br />
* CPU: ARM Cortex M0<br />
* Communications: infrared, with [[ir:USER]] running on the console. Uses obfuscated payloads. Baud rate is 115200 bps.<br />
<br />
Memory map:<br />
{| class="wikitable"<br />
|-<br />
! Address<br />
! Size<br />
! Description<br />
|-<br />
| 0x08008000<br />
| 256KB?<br />
| Firmware ([[fangate_updater.bin]])<br />
|-<br />
| 0x20000000<br />
| 128KB?<br />
| RAM<br />
|-<br />
| 0x40023C00<br />
| 0x1C<br />
| FLASH ROM control<br />
|-<br />
| 0xE000ED00<br />
| 0x104<br />
| [http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0439b/BABCIIIA.html ARM Cortex system control block]<br />
|}<br />
<br />
= IR communications =<br />
Packets are sent using IrDA-SIR (using [[ir:USER]]), with a 8N1 encoding (eight data bits, one stop bit, without parity). Each one is formed by a 2-byte header, a varint with the payload size, an obfuscated payload, and trailing error detection byte.<br />
<br />
== Layer 1 - framing format ==<br />
Frames are encoded using two different yet very simmilar formats, depending on how large the payload to be transmitted is:<br />
* For payloads with less than 64 bytes, the third byte represents the payload size.<br />
* For packets with up to 16383 bytes, the size is split in two bytes, with the third byte being the upper 6 bits of the payload size, OR'd with 0x40, and the fourth being the lower eight bits of the payload size<br />
<br />
{| class="wikitable" style="margin: 0 auto; text-align: center;"<br />
|+IR framing format - short frame<br />
|-<br />
! style="border-top: none" | Byte<br />
! style="width:10%;"| 7<br />
! style="width:10%;"| 6<br />
! style="width:10%;"| 5<br />
! style="width:10%;"| 4<br />
! style="width:10%;"| 3<br />
! style="width:10%;"| 2<br />
! style="width:10%;"| 1<br />
! style="width:10%;"| 0<br />
|-<br />
! 0x00<br />
| colspan="8"|Synchronization byte (<code>0xA5</code>)<br />
|-<br />
! 0x01<br />
| colspan="8"|Reserved for future use (<code>0x00</code>)<br />
|-<br />
! 0x02<br />
| RFU (<code>0</code>)<br />
| Short frame (<code>0</code>)<br />
| colspan="6"|Payload size<br />
|-<br />
! 0x03<br />
| colspan="8"|Payload byte 0<br />
|-<br />
| colspan="9"|...<br />
|-<br />
! 0x03+n-1<br />
| colspan="8"|Payload byte n-1<br />
|-<br />
! 0x03+n<br />
| colspan="8"|[[CRC-8-CCITT]] computer over whole packet<br />
|}<br />
<br />
<br />
{| class="wikitable" style="margin: 0 auto; text-align: center;"<br />
|+IR framing format - long frame<br />
|-<br />
! style="border-top: none" | Byte<br />
! style="width:10%;"| 7<br />
! style="width:10%;"| 6<br />
! style="width:10%;"| 5<br />
! style="width:10%;"| 4<br />
! style="width:10%;"| 3<br />
! style="width:10%;"| 2<br />
! style="width:10%;"| 1<br />
! style="width:10%;"| 0<br />
|-<br />
! 0x00<br />
| colspan="8"|Synchronization byte: <code>0xA5</code><br />
|-<br />
! 0x01<br />
| colspan="8"|Reserved for future use<br />
|-<br />
! 0x02<br />
| RFU (<code>0</code>)<br />
| Long frame (<code>1</code>)<br />
| colspan="6"|Payload size (upper 6 bits)<br />
|-<br />
! 0x03<br />
| colspan="8"|Payload size (lower 8 bits)<br />
|-<br />
! 0x04<br />
| colspan="8"|Payload byte 0<br />
|-<br />
| colspan="9"|...<br />
|-<br />
! 0x04+n-1<br />
| colspan="8"|Payload byte n-1<br />
|-<br />
! 0x04+n<br />
| colspan="8"|[[CRC-8-CCITT]] computer over whole packet<br />
|}<br />
<br />
=== Header ===<br />
The packet header is fixed and consists in a synchronization byte (0xA5), followed by a unused (possibly RFU) zero byte. After these two hardcoded bytes, there's a varint representing the payload size, which may use one byte or two, depending on the how big the payload is.<br />
<br />
In C:<br />
<nowiki>uint8_t * setPacketHeader(uint8_t * buffer, size_t payloadSize) {<br />
assert(payloadSize < 16384);<br />
<br />
buffer[0] = 0xA5;<br />
buffer[1] = 0x00;<br />
<br />
if (payloadSize < 64) {<br />
buffer[2] = payloadSize;<br />
buffer += 3;<br />
} else {<br />
buffer[2] = 0x40 | (payloadSize >> 8);<br />
buffer[3] = payloadSize;<br />
buffer += 4;<br />
}<br />
<br />
return buffer;<br />
}</nowiki><br />
<br />
=== Payload ===<br />
The payload is obfuscated using a XOR-based encryption. In C:<br />
<nowiki>void payloadObfuscate(const void * voidplain, void * voidcipher, size_t size) {<br />
uint16_t * plain = (uint16_t *) voidplain;<br />
uint16_t * cipher = (uint16_t *) voidcipher;<br />
size_t halfCount = size / sizeof(uint16_t);<br />
<br />
uint16_t xorval = htobe16(0xE963);<br />
size_t i;<br />
<br />
for (i = 0; i < halfCount; i++) {<br />
xorval ^= plain[i];<br />
cipher[i] = xorval;<br />
}<br />
}<br />
<br />
void payloadDeobfuscate(const void * voidcipher, void * voidplain, size_t size) {<br />
uint16_t * cipher = (uint16_t *) voidcipher;<br />
uint16_t * plain = (uint16_t *) voidplain;<br />
size_t halfCount = size / sizeof(uint16_t);<br />
<br />
if (halfCount) {<br />
size_t i;<br />
for (i = halfCount - 1; i > 0; i--) {<br />
plain[i] = cipher[i] ^ cipher[i - 1];<br />
}<br />
<br />
plain[0] = cipher[0] ^ htobe16(0xE963);<br />
}<br />
}</nowiki><br />
<br />
=== Error detection ===<br />
The trailing error detection byte is calculated using [[CRC-8-CCITT]] <b>over the whole packet</b> (both the header and the payload)<br />
<br />
== Layer 2 - "ircom" ==<br />
ircom is a simple stateful point-to-point master-slave communication protocol built on top of IR layer 1.<br />
<br />
{| class="wikitable" style="margin: 0 auto; text-align: center;"<br />
|+IR framing format - long frame<br />
|-<br />
! style="border-top: none" | Byte<br />
! style="width:10%;"| 7<br />
! style="width:10%;"| 6<br />
! style="width:10%;"| 5<br />
! style="width:10%;"| 4<br />
! style="width:10%;"| 3<br />
! style="width:10%;"| 2<br />
! style="width:10%;"| 1<br />
! style="width:10%;"| 0<br />
|-<br />
! 0x00<br />
| colspan="8"|Random value in range <code>0x01</code>~<code>0xFE</code><br />
|-<br />
! 0x01<br />
| colspan="8"|Random value in range <code>0x01</code>~<code>0xFE</code><br />
|-<br />
! 0x02<br />
| colspan="8"|Random value in range <code>0x01</code>~<code>0xFE</code><br />
|-<br />
! 0x03<br />
| colspan="8"|Random value in range <code>0x01</code>~<code>0xFE</code><br />
|-<br />
! 0x04<br />
| colspan="4"|RFU?<br />
| colspan="4"|Protocol version: <code>0x1</code><br />
|-<br />
! 0x05<br />
| colspan="8"|Connection identificator<br />
|-<br />
! 0x06<br />
| colspan="8"|Reserved for future use?<br />
|-<br />
! 0x07<br />
| colspan="4"|???<br />
| colspan="4"|Operation code<br />
|-<br />
! 0x08+<br />
| colspan="8" style="background:#ffd0d0;"|Payload (if any)<br />
|}<br />
<br />
* Random values are generated using a Mersenne Twister whose seed is based off the NFC adapter system tick counter. It is therefore random, and the 3DS won't attempt to validate them by any means. Its purpose is unknown.<br />
* NFC adapter will ignore packets whose protocol version is not 1. It will not even reply.<br />
* Connection identifier is a random byte the 3DS assigns to identify the connection should be several connections in range at once. Slave devices must save this value from the initial handshake packet and use it for replies. It must also ignore packets whose connection ID does not match.<br />
<br />
== Samples ==<br />
<br />
NFC adapter update beacon, as sent by the console:<br />
{| class="wikitable"<br />
|-<br />
! Raw<br />
! Deobfuscated<br />
|-<br />
| <code>A5 00 08 73 FE A5 C4 A4 2C A4 20 F5</code><br />
| <code>9A 9D D6 3A 01 E8 00 0C</code><br />
|-<br />
| <code>A5 00 08 D1 3E B7 7B B6 91 B6 9D 87</code><br />
| <code>38 5D 66 45 01 EA 00 0C</code><br />
|-<br />
| <code>A5 00 08 09 58 23 36 22 DA 22 D6 AE</code><br />
| <code>E0 3B 2A 6E 01 EC 00 0C</code><br />
|-<br />
| <code>A5 00 08 5E DD A4 A0 A5 4E A5 42 A8</code><br />
| <code>B7 BE FA 7D 01 EE 00 0C</code><br />
|-<br />
| <code>A5 00 08 BC 19 C6 37 C7 C7 C7 CB 8B</code><br />
| <code>55 7A 7A 2E 01 F0 00 0C</code><br />
|-<br />
| <code>A5 00 08 C9 15 F6 63 F7 91 F7 9D B2</code><br />
| <code>20 76 3F 76 01 F2 00 0C</code><br />
|-<br />
| <code>A5 00 08 6E 48 47 1A 46 EE 46 E2 C7</code><br />
| <code>87 2B 29 52 01 F4 00 0C</code><br />
|-<br />
| <code>A5 00 08 A2 8C E5 C3 E4 35 E4 39 74</code><br />
| <code>4B EF 47 4F 01 F6 00 0C</code><br />
|-<br />
| <code>A5 00 08 26 1C 07 10 06 E8 06 E4 64</code><br />
| <code>CF 7F 21 0C 01 F8 00 0C</code><br />
|-<br />
| <code>A5 00 08 7E 73 A2 3F A3 C5 A3 C9 FD</code><br />
| <code>97 10 DC 4C 01 FA 00 0C</code><br />
|-<br />
| <code>A5 00 08 75 00 F3 B8 F2 44 F2 48 63</code><br />
| <code>9C 63 86 B8 01 FC 00 0C</code><br />
|-<br />
| <code>A5 00 08 8D AC 0F D5 0E 2B 0E 27 72</code><br />
| <code>64 CF 82 79 01 FE 00 0C</code><br />
|-<br />
| <code>A5 00 08 A3 55 7C 53 7D 52 7D 5E B2</code><br />
| <code>4A 36 DF 06 01 01 00 0C</code><br />
|-<br />
| <code>A5 00 08 15 06 43 C0 42 C3 42 CF 85</code><br />
| <code>FC 65 56 C6 01 03 00 0C</code><br />
|-<br />
| <code>A5 00 08 66 E0 9A 17 9B 12 9B 1E A0</code><br />
| <code>8F 83 FC F7 01 05 00 0C</code><br />
|-<br />
| <code>A5 00 08 A4 35 09 97 08 90 08 9C 25</code><br />
| <code>4D 56 AD A2 01 07 00 0C</code><br />
|-<br />
| <code>A5 00 08 73 E2 BD AF BC A6 BC AA 60</code><br />
| <code>9A 81 CE 4D 01 09 00 0C</code><br />
|-<br />
| <code>A5 00 08 02 57 D7 B0 D6 BB D6 B7 28</code><br />
| <code>EB 34 D5 E7 01 0B 00 0C</code><br />
|-<br />
| <code>A5 00 08 0D 79 01 AA 00 A7 00 AB 22</code><br />
| <code>E4 1A 0C D3 01 0D 00 0C</code><br />
|-<br />
| <code>A5 00 08 14 91 04 B9 05 B6 05 BA B2</code><br />
| <code>FD F2 10 28 01 0F 00 0C</code><br />
|-<br />
| <code>A5 00 08 2C 86 B1 49 B0 58 B0 54 C0</code><br />
| <code>C5 E5 9D CF 01 11 00 0C</code><br />
|-<br />
| <code>A5 00 08 D5 1D DE DB DF C8 DF C4 F9</code><br />
| <code>3C 7E 0B C6 01 13 00 0C</code><br />
|-<br />
| <code>A5 00 08 AF 75 DE 5C DF 49 DF 45 9C</code><br />
| <code>46 16 71 29 01 15 00 0C</code><br />
|-<br />
| <code>A5 00 08 C8 E2 5B C6 5A D1 5A DD B5</code><br />
| <code>21 81 93 24 01 17 00 0C</code><br />
|-<br />
| <code>A5 00 08 9B 51 68 2D 69 34 69 38 41</code><br />
| <code>72 32 F3 7C 01 19 00 0C</code><br />
|-<br />
| <code>A5 00 08 13 7B 9F EF 9E F4 9E F8 32</code><br />
| <code>FA 18 8C 94 01 1B 00 0C</code><br />
|-<br />
| <code>A5 00 08 A7 62 02 9C 03 81 03 8D BD</code><br />
| <code>4E 01 A5 FE 01 1D 00 0C</code><br />
|-<br />
| <code>A5 00 08 39 06 94 36 95 29 95 25 09</code><br />
| <code>D0 65 AD 30 01 1F 00 0C</code><br />
|-<br />
| <code>A5 00 08 32 4C D7 C0 D6 E1 D6 ED 92</code><br />
| <code>DB 2F E5 8C 01 21 00 0C</code><br />
|-<br />
| <code>A5 00 08 83 BE F2 8F F3 AC F3 A0 B1</code><br />
| <code>6A DD 71 31 01 23 00 0C</code><br />
|-<br />
| <code>A5 00 08 83 5E A0 57 A1 72 A1 7E F0</code><br />
| <code>6A 3D 23 09 01 25 00 0C</code><br />
|-<br />
| <code>A5 00 08 6E C8 AD 69 AC 4E AC 42 D1</code><br />
| <code>87 AB C3 A1 01 27 00 0C</code><br />
|-<br />
| <code>A5 00 08 C7 33 A1 2C A0 05 A0 09 FC</code><br />
| <code>2E 50 66 1F 01 29 00 0C</code><br />
|}<br />
<br />
= External links =<br />
* [https://www.broadcom.com/products/NFC/NFC-Solutions/BCM2079x-Family BCM2079x brief on Broadcom's website]</div>
Socram8888
https://www.3dbrew.org/w/index.php?title=NFC_adapter&diff=12459
NFC adapter
2015-04-19T17:57:32Z
<p>Socram8888: </p>
<hr />
<div>The Nintendo NFC adapter is an upcoming external device which adds NFC capabilities for [[amiibo]]s to old Nintendo 3DS and Nintendo 2DS consoles, using the infrared port on the back of the console.<br />
<br />
[[File:150217nfcreader-640x360.jpg|thumb|right|250px|Media preview, as released by Nintendo]]<br />
<br />
<br />
= Technical details =<br />
Based on analysis of the [[fangate_updater.bin]] file, which is part of the old Nintendo 3DS operating system since [[9.3.0-21]] and contains the firmware running on the external adapter; and analysis of the [[NFC Services]] running on old 3DS.<br />
<br />
* SOC inside the adapter: Broadcom BCM20791B1<br />
* CPU: ARM Cortex M0<br />
* Communications: infrared, with [[ir:USER]] running on the console. Uses obfuscated payloads. Baud rate is 115200 bps.<br />
<br />
Memory map:<br />
{| class="wikitable"<br />
|-<br />
! Address<br />
! Size<br />
! Description<br />
|-<br />
| 0x08008000<br />
| 256KB?<br />
| Firmware ([[fangate_updater.bin]])<br />
|-<br />
| 0x20000000<br />
| 128KB?<br />
| RAM<br />
|-<br />
| 0x40023C00<br />
| 0x1C<br />
| FLASH ROM control<br />
|-<br />
| 0xE000ED00<br />
| 0x104<br />
| [http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0439b/BABCIIIA.html ARM Cortex system control block]<br />
|}<br />
<br />
= IR communications =<br />
Packets are sent using IrDA-SIR (using [[ir:USER]]), with a 8N1 encoding (eight data bits, one stop bit, without parity). Each one is formed by a 2-byte header, a varint with the payload size, an obfuscated payload, and trailing error detection byte.<br />
<br />
== Layer 1 - framing format ==<br />
Frames are encoded using two different yet very simmilar formats, depending on how large the payload to be transmitted is:<br />
* For payloads with less than 64 bytes, the third byte represents the payload size.<br />
* For packets with up to 16383 bytes, the size is split in two bytes, with the third byte being the upper 6 bits of the payload size, OR'd with 0x40, and the fourth being the lower eight bits of the payload size<br />
<br />
{| class="wikitable" style="margin: 0 auto; text-align: center;"<br />
|+IR framing format - short frame<br />
|-<br />
! style="border-top: none" | Byte<br />
! style="width:10%;"| 7<br />
! style="width:10%;"| 6<br />
! style="width:10%;"| 5<br />
! style="width:10%;"| 4<br />
! style="width:10%;"| 3<br />
! style="width:10%;"| 2<br />
! style="width:10%;"| 1<br />
! style="width:10%;"| 0<br />
|-<br />
! 0x00<br />
| colspan="8"|Synchronization byte (<code>0xA5</code>)<br />
|-<br />
! 0x01<br />
| colspan="8"|Reserved for future use (<code>0x00</code>)<br />
|-<br />
! 0x02<br />
| RFU (<code>0</code>)<br />
| Short frame (<code>0</code>)<br />
| colspan="6"|Payload size<br />
|-<br />
! 0x03<br />
| colspan="8"|Payload byte 0<br />
|-<br />
| colspan="9"|...<br />
|-<br />
! 0x03+n-1<br />
| colspan="8"|Payload byte n-1<br />
|-<br />
! 0x03+n<br />
| colspan="8"|[[CRC-8-CCITT]] computer over whole packet<br />
|}<br />
<br />
<br />
{| class="wikitable" style="margin: 0 auto; text-align: center;"<br />
|+IR framing format - long frame<br />
|-<br />
! style="border-top: none" | Byte<br />
! style="width:10%;"| 7<br />
! style="width:10%;"| 6<br />
! style="width:10%;"| 5<br />
! style="width:10%;"| 4<br />
! style="width:10%;"| 3<br />
! style="width:10%;"| 2<br />
! style="width:10%;"| 1<br />
! style="width:10%;"| 0<br />
|-<br />
! 0x00<br />
| colspan="8"|Synchronization byte (<code>0xA5</code>)<br />
|-<br />
! 0x01<br />
| colspan="8"|Reserved for future use (<code>0x00</code>)<br />
|-<br />
! 0x02<br />
| RFU (<code>0</code>)<br />
| Long frame (<code>1</code>)<br />
| colspan="6"|Payload size (upper 6 bits)<br />
|-<br />
! 0x03<br />
| colspan="8"|Payload size (lower 8 bits)<br />
|-<br />
! 0x04<br />
| colspan="8"|Payload byte 0<br />
|-<br />
| colspan="9"|...<br />
|-<br />
! 0x04+n-1<br />
| colspan="8"|Payload byte n-1<br />
|-<br />
! 0x04+n<br />
| colspan="8"|[[CRC-8-CCITT]] computer over whole packet<br />
|}<br />
<br />
=== Header ===<br />
The packet header is fixed and consists in a synchronization byte (0xA5), followed by a unused (possibly RFU) zero byte. After these two hardcoded bytes, there's a varint representing the payload size, which may use one byte or two, depending on the how big the payload is.<br />
<br />
In C:<br />
<nowiki>uint8_t * setPacketHeader(uint8_t * buffer, size_t payloadSize) {<br />
assert(payloadSize < 16384);<br />
<br />
buffer[0] = 0xA5;<br />
buffer[1] = 0x00;<br />
<br />
if (payloadSize < 64) {<br />
buffer[2] = payloadSize;<br />
buffer += 3;<br />
} else {<br />
buffer[2] = 0x40 | (payloadSize >> 8);<br />
buffer[3] = payloadSize;<br />
buffer += 4;<br />
}<br />
<br />
return buffer;<br />
}</nowiki><br />
<br />
=== Payload ===<br />
The payload is obfuscated using a XOR-based encryption. In C:<br />
<nowiki>void payloadObfuscate(const void * voidplain, void * voidcipher, size_t size) {<br />
uint16_t * plain = (uint16_t *) voidplain;<br />
uint16_t * cipher = (uint16_t *) voidcipher;<br />
size_t halfCount = size / sizeof(uint16_t);<br />
<br />
uint16_t xorval = htobe16(0xE963);<br />
size_t i;<br />
<br />
for (i = 0; i < halfCount; i++) {<br />
xorval ^= plain[i];<br />
cipher[i] = xorval;<br />
}<br />
}<br />
<br />
void payloadDeobfuscate(const void * voidcipher, void * voidplain, size_t size) {<br />
uint16_t * cipher = (uint16_t *) voidcipher;<br />
uint16_t * plain = (uint16_t *) voidplain;<br />
size_t halfCount = size / sizeof(uint16_t);<br />
<br />
if (halfCount) {<br />
size_t i;<br />
for (i = halfCount - 1; i > 0; i--) {<br />
plain[i] = cipher[i] ^ cipher[i - 1];<br />
}<br />
<br />
plain[0] = cipher[0] ^ htobe16(0xE963);<br />
}<br />
}</nowiki><br />
<br />
=== Error detection ===<br />
The trailing error detection byte is calculated using [[CRC-8-CCITT]] <b>over the whole packet</b> (both the header and the payload)<br />
<br />
== Samples ==<br />
<br />
NFC adapter update beacon, as sent by the console:<br />
{| class="wikitable"<br />
|-<br />
! Raw<br />
! Deobfuscated<br />
|-<br />
| <code>A5 00 08 73 FE A5 C4 A4 2C A4 20 F5</code><br />
| <code>9A 9D D6 3A 01 E8 00 0C</code><br />
|-<br />
| <code>A5 00 08 D1 3E B7 7B B6 91 B6 9D 87</code><br />
| <code>38 5D 66 45 01 EA 00 0C</code><br />
|-<br />
| <code>A5 00 08 09 58 23 36 22 DA 22 D6 AE</code><br />
| <code>E0 3B 2A 6E 01 EC 00 0C</code><br />
|-<br />
| <code>A5 00 08 5E DD A4 A0 A5 4E A5 42 A8</code><br />
| <code>B7 BE FA 7D 01 EE 00 0C</code><br />
|-<br />
| <code>A5 00 08 BC 19 C6 37 C7 C7 C7 CB 8B</code><br />
| <code>55 7A 7A 2E 01 F0 00 0C</code><br />
|-<br />
| <code>A5 00 08 C9 15 F6 63 F7 91 F7 9D B2</code><br />
| <code>20 76 3F 76 01 F2 00 0C</code><br />
|-<br />
| <code>A5 00 08 6E 48 47 1A 46 EE 46 E2 C7</code><br />
| <code>87 2B 29 52 01 F4 00 0C</code><br />
|-<br />
| <code>A5 00 08 A2 8C E5 C3 E4 35 E4 39 74</code><br />
| <code>4B EF 47 4F 01 F6 00 0C</code><br />
|-<br />
| <code>A5 00 08 26 1C 07 10 06 E8 06 E4 64</code><br />
| <code>CF 7F 21 0C 01 F8 00 0C</code><br />
|-<br />
| <code>A5 00 08 7E 73 A2 3F A3 C5 A3 C9 FD</code><br />
| <code>97 10 DC 4C 01 FA 00 0C</code><br />
|-<br />
| <code>A5 00 08 75 00 F3 B8 F2 44 F2 48 63</code><br />
| <code>9C 63 86 B8 01 FC 00 0C</code><br />
|-<br />
| <code>A5 00 08 8D AC 0F D5 0E 2B 0E 27 72</code><br />
| <code>64 CF 82 79 01 FE 00 0C</code><br />
|-<br />
| <code>A5 00 08 A3 55 7C 53 7D 52 7D 5E B2</code><br />
| <code>4A 36 DF 06 01 01 00 0C</code><br />
|-<br />
| <code>A5 00 08 15 06 43 C0 42 C3 42 CF 85</code><br />
| <code>FC 65 56 C6 01 03 00 0C</code><br />
|-<br />
| <code>A5 00 08 66 E0 9A 17 9B 12 9B 1E A0</code><br />
| <code>8F 83 FC F7 01 05 00 0C</code><br />
|-<br />
| <code>A5 00 08 A4 35 09 97 08 90 08 9C 25</code><br />
| <code>4D 56 AD A2 01 07 00 0C</code><br />
|-<br />
| <code>A5 00 08 73 E2 BD AF BC A6 BC AA 60</code><br />
| <code>9A 81 CE 4D 01 09 00 0C</code><br />
|-<br />
| <code>A5 00 08 02 57 D7 B0 D6 BB D6 B7 28</code><br />
| <code>EB 34 D5 E7 01 0B 00 0C</code><br />
|-<br />
| <code>A5 00 08 0D 79 01 AA 00 A7 00 AB 22</code><br />
| <code>E4 1A 0C D3 01 0D 00 0C</code><br />
|-<br />
| <code>A5 00 08 14 91 04 B9 05 B6 05 BA B2</code><br />
| <code>FD F2 10 28 01 0F 00 0C</code><br />
|-<br />
| <code>A5 00 08 2C 86 B1 49 B0 58 B0 54 C0</code><br />
| <code>C5 E5 9D CF 01 11 00 0C</code><br />
|-<br />
| <code>A5 00 08 D5 1D DE DB DF C8 DF C4 F9</code><br />
| <code>3C 7E 0B C6 01 13 00 0C</code><br />
|-<br />
| <code>A5 00 08 AF 75 DE 5C DF 49 DF 45 9C</code><br />
| <code>46 16 71 29 01 15 00 0C</code><br />
|-<br />
| <code>A5 00 08 C8 E2 5B C6 5A D1 5A DD B5</code><br />
| <code>21 81 93 24 01 17 00 0C</code><br />
|-<br />
| <code>A5 00 08 9B 51 68 2D 69 34 69 38 41</code><br />
| <code>72 32 F3 7C 01 19 00 0C</code><br />
|-<br />
| <code>A5 00 08 13 7B 9F EF 9E F4 9E F8 32</code><br />
| <code>FA 18 8C 94 01 1B 00 0C</code><br />
|-<br />
| <code>A5 00 08 A7 62 02 9C 03 81 03 8D BD</code><br />
| <code>4E 01 A5 FE 01 1D 00 0C</code><br />
|-<br />
| <code>A5 00 08 39 06 94 36 95 29 95 25 09</code><br />
| <code>D0 65 AD 30 01 1F 00 0C</code><br />
|-<br />
| <code>A5 00 08 32 4C D7 C0 D6 E1 D6 ED 92</code><br />
| <code>DB 2F E5 8C 01 21 00 0C</code><br />
|-<br />
| <code>A5 00 08 83 BE F2 8F F3 AC F3 A0 B1</code><br />
| <code>6A DD 71 31 01 23 00 0C</code><br />
|-<br />
| <code>A5 00 08 83 5E A0 57 A1 72 A1 7E F0</code><br />
| <code>6A 3D 23 09 01 25 00 0C</code><br />
|-<br />
| <code>A5 00 08 6E C8 AD 69 AC 4E AC 42 D1</code><br />
| <code>87 AB C3 A1 01 27 00 0C</code><br />
|-<br />
| <code>A5 00 08 C7 33 A1 2C A0 05 A0 09 FC</code><br />
| <code>2E 50 66 1F 01 29 00 0C</code><br />
|}<br />
<br />
= External links =<br />
* [https://www.broadcom.com/products/NFC/NFC-Solutions/BCM2079x-Family BCM2079x brief on Broadcom's website]</div>
Socram8888
https://www.3dbrew.org/w/index.php?title=NFC_adapter&diff=12447
NFC adapter
2015-04-18T15:36:47Z
<p>Socram8888: /* Technical details */</p>
<hr />
<div>The Nintendo NFC adapter is an upcoming external device which adds NFC capabilities for [[amiibo]]s to old Nintendo 3DS and Nintendo 2DS consoles, using the infrared port on the back of the console.<br />
<br />
[[File:150217nfcreader-640x360.jpg|thumb|right|250px|Media preview, as released by Nintendo]]<br />
<br />
<br />
= Technical details =<br />
Based on analysis of the [[fangate_updater.bin]] file, which is part of the old Nintendo 3DS operating system since [[9.3.0-21]] and contains the firmware running on the external adapter; and analysis of the [[NFC Services]] running on old 3DS.<br />
<br />
* SOC inside the adapter: Broadcom BCM20791B1<br />
* CPU: ARM Cortex M0<br />
* Communications: infrared, with [[ir:USER]] running on the console. Uses obfuscated payloads. Baud rate is 115200 bps.<br />
<br />
Memory map:<br />
{| class="wikitable"<br />
|-<br />
! Address<br />
! Size<br />
! Description<br />
|-<br />
| 0x08008000<br />
| 256KB?<br />
| Firmware ([[fangate_updater.bin]])<br />
|-<br />
| 0x20000000<br />
| 128KB?<br />
| RAM<br />
|-<br />
| 0x40023C00<br />
| 0x1C<br />
| FLASH ROM control<br />
|-<br />
| 0xE000ED00<br />
| 0x104<br />
| [http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0439b/BABCIIIA.html ARM Cortex system control block]<br />
|}<br />
<br />
= IR communications =<br />
Packets are sent using IrDA-SIR (using [[ir:USER]]), with a 8N1 encoding (eight data bits, one stop bit, without parity). Each one is formed by a 2-byte header, a varint with the payload size, an obfuscated payload, and trailing error detection byte.<br />
<br />
== Packet header ==<br />
The packet header is fixed and consists in a synchronization byte (0xA5), followed by a unused (possibly RFU) zero byte. After these two hardcoded bytes, there's a varint representing the payload size, which may use one byte or two, depending on the how big the payload is.<br />
<br />
* For payloads with less than 64 bytes, the third byte represents the payload size.<br />
* For packets with up to 16383 bytes, the size is split in two bytes, with the third byte being the upper 6 bits of the payload size, OR'd with 0x40, and the fourth being the lower eight bits of the payload size<br />
<br />
For packets with less than 64 bytes:<br />
{| class="wikitable" border="1"<br />
! Sync<br />
! RFU<br />
! Size<br />
|-<br />
| 0xA5<br />
| 0x00<br />
| size<br />
|}<br />
<br />
For packets with up to 16383 bytes:<br />
{| class="wikitable" border="1"<br />
! Sync<br />
! RFU<br />
! Size (1)<br />
! Size (2)<br />
|-<br />
| 0xA5<br />
| 0x00<br />
| (size >> 8) <nowiki>|</nowiki> 0x40<br />
| size & 0xFF<br />
|}<br />
<br />
In C:<br />
<nowiki>uint8_t * setPacketHeader(uint8_t * buffer, size_t payloadSize) {<br />
assert(payloadSize < 16384);<br />
<br />
buffer[0] = 0xA5;<br />
buffer[1] = 0x00;<br />
<br />
if (payloadSize < 64) {<br />
buffer[2] = payloadSize;<br />
buffer += 3;<br />
} else {<br />
buffer[2] = 0x40 | (payloadSize >> 8);<br />
buffer[3] = payloadSize;<br />
buffer += 4;<br />
}<br />
<br />
return buffer;<br />
}</nowiki><br />
<br />
== Payload ==<br />
The payload is obfuscated using a XOR-based encryption. In C:<br />
<nowiki>void payloadObfuscate(const void * voidplain, void * voidcipher, size_t size) {<br />
uint16_t * plain = (uint16_t *) voidplain;<br />
uint16_t * cipher = (uint16_t *) voidcipher;<br />
size_t halfCount = size / sizeof(uint16_t);<br />
<br />
uint16_t xorval = htobe16(0xE963);<br />
size_t i;<br />
<br />
for (i = 0; i < halfCount; i++) {<br />
xorval ^= plain[i];<br />
cipher[i] = xorval;<br />
}<br />
}<br />
<br />
void payloadDeobfuscate(const void * voidcipher, void * voidplain, size_t size) {<br />
uint16_t * cipher = (uint16_t *) voidcipher;<br />
uint16_t * plain = (uint16_t *) voidplain;<br />
size_t halfCount = size / sizeof(uint16_t);<br />
<br />
if (halfCount) {<br />
size_t i;<br />
for (i = halfCount - 1; i > 0; i--) {<br />
plain[i] = cipher[i] ^ cipher[i - 1];<br />
}<br />
<br />
plain[0] = cipher[0] ^ htobe16(0xE963);<br />
}<br />
}</nowiki><br />
<br />
== Error detection ==<br />
The trailing error detection byte is calculated using [[CRC-8-CCITT]] <b>over the whole packet</b> (both the header and the payload)<br />
<br />
== Samples ==<br />
<br />
NFC adapter update beacon, as sent by the console:<br />
{| class="wikitable"<br />
|-<br />
! Raw<br />
! Deobfuscated<br />
|-<br />
| <code>A5 00 08 73 FE A5 C4 A4 2C A4 20 F5</code><br />
| <code>9A 9D D6 3A 01 E8 00 0C</code><br />
|-<br />
| <code>A5 00 08 D1 3E B7 7B B6 91 B6 9D 87</code><br />
| <code>38 5D 66 45 01 EA 00 0C</code><br />
|-<br />
| <code>A5 00 08 09 58 23 36 22 DA 22 D6 AE</code><br />
| <code>E0 3B 2A 6E 01 EC 00 0C</code><br />
|-<br />
| <code>A5 00 08 5E DD A4 A0 A5 4E A5 42 A8</code><br />
| <code>B7 BE FA 7D 01 EE 00 0C</code><br />
|-<br />
| <code>A5 00 08 BC 19 C6 37 C7 C7 C7 CB 8B</code><br />
| <code>55 7A 7A 2E 01 F0 00 0C</code><br />
|-<br />
| <code>A5 00 08 C9 15 F6 63 F7 91 F7 9D B2</code><br />
| <code>20 76 3F 76 01 F2 00 0C</code><br />
|-<br />
| <code>A5 00 08 6E 48 47 1A 46 EE 46 E2 C7</code><br />
| <code>87 2B 29 52 01 F4 00 0C</code><br />
|-<br />
| <code>A5 00 08 A2 8C E5 C3 E4 35 E4 39 74</code><br />
| <code>4B EF 47 4F 01 F6 00 0C</code><br />
|-<br />
| <code>A5 00 08 26 1C 07 10 06 E8 06 E4 64</code><br />
| <code>CF 7F 21 0C 01 F8 00 0C</code><br />
|-<br />
| <code>A5 00 08 7E 73 A2 3F A3 C5 A3 C9 FD</code><br />
| <code>97 10 DC 4C 01 FA 00 0C</code><br />
|-<br />
| <code>A5 00 08 75 00 F3 B8 F2 44 F2 48 63</code><br />
| <code>9C 63 86 B8 01 FC 00 0C</code><br />
|-<br />
| <code>A5 00 08 8D AC 0F D5 0E 2B 0E 27 72</code><br />
| <code>64 CF 82 79 01 FE 00 0C</code><br />
|-<br />
| <code>A5 00 08 A3 55 7C 53 7D 52 7D 5E B2</code><br />
| <code>4A 36 DF 06 01 01 00 0C</code><br />
|-<br />
| <code>A5 00 08 15 06 43 C0 42 C3 42 CF 85</code><br />
| <code>FC 65 56 C6 01 03 00 0C</code><br />
|-<br />
| <code>A5 00 08 66 E0 9A 17 9B 12 9B 1E A0</code><br />
| <code>8F 83 FC F7 01 05 00 0C</code><br />
|-<br />
| <code>A5 00 08 A4 35 09 97 08 90 08 9C 25</code><br />
| <code>4D 56 AD A2 01 07 00 0C</code><br />
|-<br />
| <code>A5 00 08 73 E2 BD AF BC A6 BC AA 60</code><br />
| <code>9A 81 CE 4D 01 09 00 0C</code><br />
|-<br />
| <code>A5 00 08 02 57 D7 B0 D6 BB D6 B7 28</code><br />
| <code>EB 34 D5 E7 01 0B 00 0C</code><br />
|-<br />
| <code>A5 00 08 0D 79 01 AA 00 A7 00 AB 22</code><br />
| <code>E4 1A 0C D3 01 0D 00 0C</code><br />
|-<br />
| <code>A5 00 08 14 91 04 B9 05 B6 05 BA B2</code><br />
| <code>FD F2 10 28 01 0F 00 0C</code><br />
|-<br />
| <code>A5 00 08 2C 86 B1 49 B0 58 B0 54 C0</code><br />
| <code>C5 E5 9D CF 01 11 00 0C</code><br />
|-<br />
| <code>A5 00 08 D5 1D DE DB DF C8 DF C4 F9</code><br />
| <code>3C 7E 0B C6 01 13 00 0C</code><br />
|-<br />
| <code>A5 00 08 AF 75 DE 5C DF 49 DF 45 9C</code><br />
| <code>46 16 71 29 01 15 00 0C</code><br />
|-<br />
| <code>A5 00 08 C8 E2 5B C6 5A D1 5A DD B5</code><br />
| <code>21 81 93 24 01 17 00 0C</code><br />
|-<br />
| <code>A5 00 08 9B 51 68 2D 69 34 69 38 41</code><br />
| <code>72 32 F3 7C 01 19 00 0C</code><br />
|-<br />
| <code>A5 00 08 13 7B 9F EF 9E F4 9E F8 32</code><br />
| <code>FA 18 8C 94 01 1B 00 0C</code><br />
|-<br />
| <code>A5 00 08 A7 62 02 9C 03 81 03 8D BD</code><br />
| <code>4E 01 A5 FE 01 1D 00 0C</code><br />
|-<br />
| <code>A5 00 08 39 06 94 36 95 29 95 25 09</code><br />
| <code>D0 65 AD 30 01 1F 00 0C</code><br />
|-<br />
| <code>A5 00 08 32 4C D7 C0 D6 E1 D6 ED 92</code><br />
| <code>DB 2F E5 8C 01 21 00 0C</code><br />
|-<br />
| <code>A5 00 08 83 BE F2 8F F3 AC F3 A0 B1</code><br />
| <code>6A DD 71 31 01 23 00 0C</code><br />
|-<br />
| <code>A5 00 08 83 5E A0 57 A1 72 A1 7E F0</code><br />
| <code>6A 3D 23 09 01 25 00 0C</code><br />
|-<br />
| <code>A5 00 08 6E C8 AD 69 AC 4E AC 42 D1</code><br />
| <code>87 AB C3 A1 01 27 00 0C</code><br />
|-<br />
| <code>A5 00 08 C7 33 A1 2C A0 05 A0 09 FC</code><br />
| <code>2E 50 66 1F 01 29 00 0C</code><br />
|}<br />
<br />
= External links =<br />
* [https://www.broadcom.com/products/NFC/NFC-Solutions/BCM2079x-Family BCM2079x brief on Broadcom's website]</div>
Socram8888
https://www.3dbrew.org/w/index.php?title=Amiibo&diff=12437
Amiibo
2015-04-17T21:08:15Z
<p>Socram8888: </p>
<hr />
<div>'''Amiibo''' are [[NFC_Services|NFC]] figures made by Nintendo, used in games in different forms (different in each game). It can be used with the New3DS and the Old3DS with an [[IR_Services|IR]] [[NFC_adapter|peripheral]].<br />
<br />
= Tag information =<br />
* Model: [http://www.nxp.com/products/identification_and_security/smart_label_and_tag_ics/ntag/series/NTAG213_215_216.html NTAG215]<br />
* Manufacturer: NXP Semiconductor<br />
* Page size: 4 bytes<br />
* Page count: 135 pages (540 bytes)<br />
* Data pages: 126 pages (504 bytes)<br />
<br />
= Page layout =<br />
Excluiding the configuration pages at the end, the structure of the NFC pages is as following:<br />
<br />
{| class="wikitable" border="1"<br />
|-<br />
! NFC page<br />
! Total pages<br />
! Raw byte offset in EEPROM<br />
! Total byte size<br />
! Writable<br />
! Description<br />
|-<br />
| 0x0<br />
| 0x4<br />
| 0x10<br />
| 0x10<br />
| style="background: red" | No<br />
| Same as standard NTAG215: 9-byte serial-number, "internal" u8 value, two lock bytes then the "Capability Container (CC)" page.<br />
|-<br />
| 0x4<br />
| 0x1<br />
| 0x10<br />
| 0x4<br />
| style="background: green" | Yes<br />
| Last 3-bytes here are used with the following HMAC where the size is 0x1DF-bytes. The u16 starting at byte1 is used for the first two bytes in the 0x40-byte input buffer for Amiibo [[Process_Services_PXI|crypto]] init. The first byte is normally 0xA5. The remaining bytes are initially(before the Amiibo is written to) all-zero. Byte[2](maybe big-endian u16 starting at byte1?) here is incremented each time the Amiibo is written to.<br />
|-<br />
| 0x5<br />
| 0x8<br />
| 0x14<br />
| 0x20<br />
| style="background: green" | Yes<br />
| The system crypts 0x1A0-bytes with some data from here, see below.<br />
|-<br />
| 0xD<br />
| 0x8<br />
| 0x34<br />
| 0x20<br />
| style="background: red" | No<br />
| SHA256-(HMAC?) hash. The first 0x18-bytes of this hash is section3 in the encrypted buffer.<br />
|-<br />
| 0x15<br />
| 0xB<br />
| 0x54<br />
| 0x2C<br />
| style="background: red" | No<br />
| This is plaintext data, see below.<br />
|-<br />
| 0x20<br />
| 0x8<br />
| 0x80<br />
| 0x20<br />
| style="background: green" | Yes<br />
| SHA256-(HMAC?) hash over 0x1DF-bytes: first 3-bytes are from the last 3-bytes of page[4], the rest is over the first 0x1DC-bytes of the plaintext data.<br />
|-<br />
| 0x28<br />
| 0x45<br />
| 0xA0<br />
| 0x114<br />
| style="background: green" | Yes<br />
| This is section1 in the encrypted buffer.<br />
|-<br />
| 0x6D<br />
| 0x15<br />
| 0x1B4<br />
| 0x54<br />
| style="background: green" | Yes<br />
| This is section2 in the encrypted buffer.<br />
|}<br />
<br />
Specifications can be found on this image, which is a compilation of screenshots made by scanning a Samus amiibo with the Android App "NFC TagInfo":<br />
[[File:Amiibonfctaginfo.png|500px]]<br />
<br />
See here regarding the Amiibo [[Process_Services_PXI|encryption]].<br />
<br />
= Data structures =<br />
<br />
== Structure of the data starting at page 0x15 ==<br />
{| class="wikitable" border="1"<br />
|-<br />
! Offset<br />
! Size<br />
! Description<br />
|-<br />
| 0x0<br />
| 0xC<br />
| ?<br />
|-<br />
| 0xC<br />
| 0x20<br />
| Probably a SHA256-HMAC hash.<br />
|}<br />
<br />
== Encrypted data buffer structure ==<br />
{| class="wikitable" border="1"<br />
|-<br />
! Encrypted buffer offset<br />
! Raw byte offset in NFC EEPROM<br />
! NFC page<br />
! Byte size<br />
! Notes<br />
|-<br />
| 0x0<br />
| 0x14<br />
| 0x5<br />
| 0x20<br />
| <br />
|-<br />
| 0x20<br />
| 0xA0<br />
| 0x28<br />
| 0x114<br />
| <br />
|-<br />
| 0x134<br />
| 0x1B4<br />
| 0x6D<br />
| 0x54<br />
| <br />
|-<br />
| 0x188<br />
| 0x34<br />
| 0xD<br />
| 0x18<br />
| This data is included in the crypto buffer, even though this data isn't actually encrypted(this is part of a hash).<br />
|}<br />
<br />
== Structure of the plaintext data ==<br />
{| class="wikitable" border="1"<br />
|-<br />
! Offset<br />
! Size<br />
! Description<br />
|-<br />
| 0x0<br />
| 0xB0<br />
| Amiibo settings are stored within here.<br />
|-<br />
| 0xB0<br />
| 0xD8<br />
| AppData, for the user-application specified in the above Amiibo settings. The data stored here is application-specific.<br />
|-<br />
| 0x188<br />
| 0x18<br />
| Not used in "decrypted" form, since this isn't encrypted to begin with.<br />
|}<br />
<br />
== Structure of Amiibo settings ==<br />
{| class="wikitable" border="1"<br />
|-<br />
! Offset<br />
! Size<br />
! Description<br />
|-<br />
| 0x0<br />
| 0x1<br />
| Flags. The low 4-bits here are copied to the struct used with [[NFC:GetAmiiboSettings]]. The below setup date is only loaded when bit4 and/or bit5 here are set, otherwise value 0 is used instead for the date. Bit4=1 indicates that the Amiibo was setup with [[amiibo Settings]]: [[NFC:GetAmiiboSettings]] will return an all-zero struct when this is not set.<br />
Bit5=1 indicates that the AppData was [[NFC:InitializeWriteAppData|initialized]]. [[NFC:InitializeWriteAppData]] will return an error if this is value 1, when successful that command will then set this bit to value 1.<br />
|-<br />
| 0x1<br />
| 0x1<br />
| Unknown. The low 4-bits here are copied to the struct used with [[NFC:GetAmiiboSettings]].<br />
|-<br />
| 0x2<br />
| 0x2<br />
| This big-endian u16 counter is incremented each time that the CRC32 at offset 0x8 gets updated by [[NFC:InitializeWriteAppData]], due to that value not matching the calculated one. When this value is already 0xFFFF, this counter won't be updated anymore.<br />
|-<br />
| 0x4<br />
| 0x2<br />
| u16 big-endian date value, see below. This is the date for when the Amiibo was initially setup in [[amiibo Settings]]. This is also written by [[NFC:InitializeWriteAppData]].<br />
|-<br />
| 0x6<br />
| 0x2<br />
| u16 big-endian date value, see below. This is the date for when the Amiibo was last written to.<br />
|-<br />
| 0x8<br />
| 0x4<br />
| Big-endian CRC32 value with initialval=~0, with the 8-byte output from [[Cfg:GenHashConsoleUnique]]. This is written by [[NFC:InitializeWriteAppData]], when the current value doesn't match the calculated one.<br />
|-<br />
| 0xC<br />
| 0x14(10*2)<br />
| UTF-16BE Amiibo nickname. <br />
|-<br />
| 0x20<br />
| 0x60<br />
| Owner [[Mii_Maker|Mii]].<br />
|-<br />
| 0x80<br />
| 0x8<br />
| Big-endian application programID/titleID from the application which [[NFC:InitializeWriteAppData|initialized]] the AppData, zero otherwise. This is only written, not compared with the user application titleID: doing the latter would break games' cross-platform compatibility with 3DS<>Wii U(Super Smash Bros 3DS/Wii U for example).<br />
|-<br />
| 0x88<br />
| 0x2<br />
| u16 big-endian. This value is incremented each time the Amiibo is written to. When this value is already 0xFFFF, this counter won't be updated anymore.<br />
|-<br />
| 0x8A<br />
| 0x4<br />
| Big-endian u32 Amiibo AppID.<br />
|-<br />
| 0x8E<br />
| 0x2<br />
| ?<br />
|-<br />
| 0x90<br />
| 0x20<br />
| Probably a SHA256-HMAC hash.<br />
|}<br />
<br />
Format of the big-endian date values:<br />
{| class="wikitable" border="1"<br />
|-<br />
! Bit<br />
! Description<br />
|-<br />
| 0-4<br />
| Day<br />
|-<br />
| 5-8<br />
| Month<br />
|-<br />
| 9-15<br />
| Year, relative to 2000.<br />
|}<br />
<br />
= 3DS read/write procedure =<br />
Note this is the procedure used by the console, but isn't the only way of reading them.<br />
<br />
== Read procedure ==<br />
* GET_VERSION<br />
* READ, startpage=0x03. The read page data for page[0x3] must match little-endian 0xEEFF10F1.<br />
* PWD_AUTH. Key is based on UID.<br />
* FAST_READ: startpage=0x00, endpage=0x3B<br />
* FAST_READ: startpage=0x3C, endpage=0x77<br />
* FAST_READ: startpage=0x78, endpage=0x86<br />
<br />
Therefore, *all* pages from the Amiibo NFC tag are read, including the configuration pages at the end.<br />
<br />
== Write procedure ==<br />
* GET_VERSION<br />
* READ, startpage=0x03. The read page data for page[0x3] must match little-endian 0xEEFF10F1.<br />
* PWD_AUTH. Key is based on UID.<br />
* Multiple WRITE commands for writing to pages 0x04..0x0C. The first byte for page[4] is zero here.<br />
* Multiple WRITE commands for writing to pages 0x20..0x81.<br />
* Use the last 3 commands from the above reading section.<br />
* WRITE: page=0x04, same data as before except first byte is 0xA5 this time.<br />
* FAST_READ: startpage=0x04, endpage=0x04<br />
<br />
= External links =<br />
* [http://wiiubrew.org/wiki/Wii_U_GamePad Wii U Gamepad and Amiibo information on WiiUBrew].</div>
Socram8888
https://www.3dbrew.org/w/index.php?title=NFC_adapter&diff=12426
NFC adapter
2015-04-17T12:22:24Z
<p>Socram8888: </p>
<hr />
<div>The Nintendo NFC adapter is an upcoming external device which adds NFC capabilities for [[amiibo]]s to old Nintendo 3DS and Nintendo 2DS consoles, using the infrared port on the back of the console.<br />
<br />
[[File:150217nfcreader-640x360.jpg|thumb|right|250px|Media preview, as released by Nintendo]]<br />
<br />
<br />
= Technical details =<br />
Based on analysis of the [[fangate_updater.bin]] file, which is part of the old Nintendo 3DS operating system since [[9.3.0-21]] and contains the firmware running on the external adapter; and analysis of the [[NFC Services]] running on old 3DS.<br />
<br />
* SOC inside the adapter: Broadcom BCM20791B1<br />
* CPU: ARM Cortex M0<br />
* Communications: infrared, with [[ir:USER]] running on the console. Uses obfuscated payloads. Baud rate is 115200 bps.<br />
<br />
Memory map:<br />
{| class="wikitable"<br />
|-<br />
! Address<br />
! Size<br />
! Description<br />
|-<br />
| 0x08008000<br />
| 256KB?<br />
| Firmware ([[fangate_updater.bin]])<br />
|-<br />
| 0x20000000<br />
| 128KB?<br />
| RAM<br />
|-<br />
| 0x40023C00<br />
| 0x0000001C<br />
| FLASH ROM control<br />
|-<br />
| 0xE000ED00<br />
| ?<br />
| System control block <br />
|}<br />
<br />
= IR communications =<br />
Packets are sent using IrDA-SIR (using [[ir:USER]]), with a 8N1 encoding (eight data bits, one stop bit, without parity). Each one is formed by a 2-byte header, a varint with the payload size, an obfuscated payload, and trailing error detection byte.<br />
<br />
== Packet header ==<br />
The packet header is fixed and consists in a synchronization byte (0xA5), followed by a unused (possibly RFU) zero byte. After these two hardcoded bytes, there's a varint representing the payload size, which may use one byte or two, depending on the how big the payload is.<br />
<br />
* For payloads with less than 64 bytes, the third byte represents the payload size.<br />
* For packets with up to 16383 bytes, the size is split in two bytes, with the third byte being the upper 6 bits of the payload size, OR'd with 0x40, and the fourth being the lower eight bits of the payload size<br />
<br />
For packets with less than 64 bytes:<br />
{| class="wikitable" border="1"<br />
! Sync<br />
! RFU<br />
! Size<br />
|-<br />
| 0xA5<br />
| 0x00<br />
| size<br />
|}<br />
<br />
For packets with up to 16383 bytes:<br />
{| class="wikitable" border="1"<br />
! Sync<br />
! RFU<br />
! Size (1)<br />
! Size (2)<br />
|-<br />
| 0xA5<br />
| 0x00<br />
| (size >> 8) <nowiki>|</nowiki> 0x40<br />
| size & 0xFF<br />
|}<br />
<br />
In C:<br />
<nowiki>uint8_t * setPacketHeader(uint8_t * buffer, size_t payloadSize) {<br />
assert(payloadSize < 16384);<br />
<br />
buffer[0] = 0xA5;<br />
buffer[1] = 0x00;<br />
<br />
if (payloadSize < 64) {<br />
buffer[2] = payloadSize;<br />
buffer += 3;<br />
} else {<br />
buffer[2] = 0x40 | (payloadSize >> 8);<br />
buffer[3] = payloadSize;<br />
buffer += 4;<br />
}<br />
<br />
return buffer;<br />
}</nowiki><br />
<br />
== Payload ==<br />
The payload is obfuscated using a XOR-based encryption. In C:<br />
<nowiki>void payloadObfuscate(const void * voidplain, void * voidcipher, size_t size) {<br />
uint16_t * plain = (uint16_t *) voidplain;<br />
uint16_t * cipher = (uint16_t *) voidcipher;<br />
size_t halfCount = size / sizeof(uint16_t);<br />
<br />
uint16_t xorval = htobe16(0xE963);<br />
size_t i;<br />
<br />
for (i = 0; i < halfCount; i++) {<br />
xorval ^= plain[i];<br />
cipher[i] = xorval;<br />
}<br />
}<br />
<br />
void payloadDeobfuscate(const void * voidcipher, void * voidplain, size_t size) {<br />
uint16_t * cipher = (uint16_t *) voidcipher;<br />
uint16_t * plain = (uint16_t *) voidplain;<br />
size_t halfCount = size / sizeof(uint16_t);<br />
<br />
if (halfCount) {<br />
size_t i;<br />
for (i = halfCount - 1; i > 0; i--) {<br />
plain[i] = cipher[i] ^ cipher[i - 1];<br />
}<br />
<br />
plain[0] = cipher[0] ^ htobe16(0xE963);<br />
}<br />
}</nowiki><br />
<br />
== Error detection ==<br />
The trailing error detection byte is calculated using [[CRC-8-CCITT]] <b>over the whole packet</b> (both the header and the payload)<br />
<br />
== Samples ==<br />
<br />
NFC adapter update beacon, as sent by the console:<br />
{| class="wikitable"<br />
|-<br />
! Raw<br />
! Deobfuscated<br />
|-<br />
| <code>A5 00 08 73 FE A5 C4 A4 2C A4 20 F5</code><br />
| <code>9A 9D D6 3A 01 E8 00 0C</code><br />
|-<br />
| <code>A5 00 08 D1 3E B7 7B B6 91 B6 9D 87</code><br />
| <code>38 5D 66 45 01 EA 00 0C</code><br />
|-<br />
| <code>A5 00 08 09 58 23 36 22 DA 22 D6 AE</code><br />
| <code>E0 3B 2A 6E 01 EC 00 0C</code><br />
|-<br />
| <code>A5 00 08 5E DD A4 A0 A5 4E A5 42 A8</code><br />
| <code>B7 BE FA 7D 01 EE 00 0C</code><br />
|-<br />
| <code>A5 00 08 BC 19 C6 37 C7 C7 C7 CB 8B</code><br />
| <code>55 7A 7A 2E 01 F0 00 0C</code><br />
|-<br />
| <code>A5 00 08 C9 15 F6 63 F7 91 F7 9D B2</code><br />
| <code>20 76 3F 76 01 F2 00 0C</code><br />
|-<br />
| <code>A5 00 08 6E 48 47 1A 46 EE 46 E2 C7</code><br />
| <code>87 2B 29 52 01 F4 00 0C</code><br />
|-<br />
| <code>A5 00 08 A2 8C E5 C3 E4 35 E4 39 74</code><br />
| <code>4B EF 47 4F 01 F6 00 0C</code><br />
|-<br />
| <code>A5 00 08 26 1C 07 10 06 E8 06 E4 64</code><br />
| <code>CF 7F 21 0C 01 F8 00 0C</code><br />
|-<br />
| <code>A5 00 08 7E 73 A2 3F A3 C5 A3 C9 FD</code><br />
| <code>97 10 DC 4C 01 FA 00 0C</code><br />
|-<br />
| <code>A5 00 08 75 00 F3 B8 F2 44 F2 48 63</code><br />
| <code>9C 63 86 B8 01 FC 00 0C</code><br />
|-<br />
| <code>A5 00 08 8D AC 0F D5 0E 2B 0E 27 72</code><br />
| <code>64 CF 82 79 01 FE 00 0C</code><br />
|-<br />
| <code>A5 00 08 A3 55 7C 53 7D 52 7D 5E B2</code><br />
| <code>4A 36 DF 06 01 01 00 0C</code><br />
|-<br />
| <code>A5 00 08 15 06 43 C0 42 C3 42 CF 85</code><br />
| <code>FC 65 56 C6 01 03 00 0C</code><br />
|-<br />
| <code>A5 00 08 66 E0 9A 17 9B 12 9B 1E A0</code><br />
| <code>8F 83 FC F7 01 05 00 0C</code><br />
|-<br />
| <code>A5 00 08 A4 35 09 97 08 90 08 9C 25</code><br />
| <code>4D 56 AD A2 01 07 00 0C</code><br />
|-<br />
| <code>A5 00 08 73 E2 BD AF BC A6 BC AA 60</code><br />
| <code>9A 81 CE 4D 01 09 00 0C</code><br />
|-<br />
| <code>A5 00 08 02 57 D7 B0 D6 BB D6 B7 28</code><br />
| <code>EB 34 D5 E7 01 0B 00 0C</code><br />
|-<br />
| <code>A5 00 08 0D 79 01 AA 00 A7 00 AB 22</code><br />
| <code>E4 1A 0C D3 01 0D 00 0C</code><br />
|-<br />
| <code>A5 00 08 14 91 04 B9 05 B6 05 BA B2</code><br />
| <code>FD F2 10 28 01 0F 00 0C</code><br />
|-<br />
| <code>A5 00 08 2C 86 B1 49 B0 58 B0 54 C0</code><br />
| <code>C5 E5 9D CF 01 11 00 0C</code><br />
|-<br />
| <code>A5 00 08 D5 1D DE DB DF C8 DF C4 F9</code><br />
| <code>3C 7E 0B C6 01 13 00 0C</code><br />
|-<br />
| <code>A5 00 08 AF 75 DE 5C DF 49 DF 45 9C</code><br />
| <code>46 16 71 29 01 15 00 0C</code><br />
|-<br />
| <code>A5 00 08 C8 E2 5B C6 5A D1 5A DD B5</code><br />
| <code>21 81 93 24 01 17 00 0C</code><br />
|-<br />
| <code>A5 00 08 9B 51 68 2D 69 34 69 38 41</code><br />
| <code>72 32 F3 7C 01 19 00 0C</code><br />
|-<br />
| <code>A5 00 08 13 7B 9F EF 9E F4 9E F8 32</code><br />
| <code>FA 18 8C 94 01 1B 00 0C</code><br />
|-<br />
| <code>A5 00 08 A7 62 02 9C 03 81 03 8D BD</code><br />
| <code>4E 01 A5 FE 01 1D 00 0C</code><br />
|-<br />
| <code>A5 00 08 39 06 94 36 95 29 95 25 09</code><br />
| <code>D0 65 AD 30 01 1F 00 0C</code><br />
|-<br />
| <code>A5 00 08 32 4C D7 C0 D6 E1 D6 ED 92</code><br />
| <code>DB 2F E5 8C 01 21 00 0C</code><br />
|-<br />
| <code>A5 00 08 83 BE F2 8F F3 AC F3 A0 B1</code><br />
| <code>6A DD 71 31 01 23 00 0C</code><br />
|-<br />
| <code>A5 00 08 83 5E A0 57 A1 72 A1 7E F0</code><br />
| <code>6A 3D 23 09 01 25 00 0C</code><br />
|-<br />
| <code>A5 00 08 6E C8 AD 69 AC 4E AC 42 D1</code><br />
| <code>87 AB C3 A1 01 27 00 0C</code><br />
|-<br />
| <code>A5 00 08 C7 33 A1 2C A0 05 A0 09 FC</code><br />
| <code>2E 50 66 1F 01 29 00 0C</code><br />
|}<br />
<br />
= External links =<br />
* [https://www.broadcom.com/products/NFC/NFC-Solutions/BCM2079x-Family BCM2079x brief on Broadcom's website]</div>
Socram8888
https://www.3dbrew.org/w/index.php?title=IR_Services&diff=12425
IR Services
2015-04-17T12:21:45Z
<p>Socram8888: Undo revision 12392 by Socram8888 (talk)</p>
<hr />
<div>[[Category:Services]]<br />
= IR Service "ir:u" =<br />
{| class="wikitable" border="1"<br />
|-<br />
! Command Header<br />
! Available since system version<br />
! Description<br />
|-<br />
| 0x00010000<br />
| [[1.0.0-0]]<br />
| [[IRU:Initialize|Initialize]]<br />
|-<br />
| 0x00020000<br />
| [[1.0.0-0]]<br />
| [[IRU:Shutdown|Shutdown]]<br />
|-<br />
| 0x00030042<br />
| [[1.0.0-0]]<br />
| [[IRU:StartSendTransfer|StartSendTransfer]]<br />
|-<br />
| 0x00040000<br />
| [[1.0.0-0]]<br />
| [[IRU:WaitSendTransfer|WaitSendTransfer]]<br />
|-<br />
| 0x000500C2<br />
| [[1.0.0-0]]<br />
| [[IRU:StartRecvTransfer|StartRecvTransfer]]<br />
|-<br />
| 0x00060000<br />
| [[1.0.0-0]]<br />
| [[IRU:WaitRecvTransfer|WaitRecvTransfer]]<br />
|-<br />
| 0x00070000<br />
| [[1.0.0-0]]<br />
| [[IRU:GetRecvTransferCount|GetRecvTransferCount]]<br />
|-<br />
| 0x00080000<br />
| [[1.0.0-0]]<br />
| [[IRU:GetSendState|GetSendState]]<br />
|-<br />
| 0x00090040<br />
| [[1.0.0-0]]<br />
| [[IRU:SetBitRate|SetBitRate]]<br />
|-<br />
| 0x000A0000<br />
| [[1.0.0-0]]<br />
| [[IRU:GetBitRate|GetBitRate]]<br />
|-<br />
| 0x000B0040<br />
| [[1.0.0-0]]<br />
| [[IRU:SetIRLEDState|SetIRLEDState]]<br />
|-<br />
| 0x000C0000<br />
| [[1.0.0-0]]<br />
| [[IRU:GetIRLEDRecvState|GetIRLEDRecvState]]<br />
|-<br />
| 0x000D0000<br />
| [[1.0.0-0]]<br />
| [[IRU:GetSendFinishedEvent|GetSendFinishedEvent]]<br />
|-<br />
| 0x000E0000<br />
| [[1.0.0-0]]<br />
| [[IRU:GetRecvFinishedEvent|GetRecvFinishedEvent]]<br />
|-<br />
| 0x000F0000<br />
| [[1.0.0-0]]<br />
| [[IRU:GetTransferState|GetTransferState]]<br />
|-<br />
| 0x00100000<br />
| [[1.0.0-0]]<br />
| GetErrorStatus<br />
|-<br />
| 0x00110040<br />
| [[1.0.0-0]]<br />
| [[IRU:SetSleepModeActive|SetSleepModeActive]]<br />
|-<br />
| 0x00120040<br />
| [[1.0.0-0]]<br />
| [[IRU:SetSleepModeState|SetSleepModeState]]<br />
|}<br />
<br />
= IR Service "ir:USER" =<br />
{| class="wikitable" border="1"<br />
|-<br />
! Command Header<br />
! Available since system version<br />
! Description<br />
|-<br />
| 0x00010182<br />
| [[2.0.0-2]]<br />
| InitializeIrnop<br />
|-<br />
| 0x00020000<br />
| [[2.0.0-2]]<br />
| FinalizeIrnop<br />
|-<br />
| 0x00030000<br />
| [[2.0.0-2]]<br />
| ClearReceiveBuffer<br />
|-<br />
| 0x00040000<br />
| [[2.0.0-2]]<br />
| ClearSendBuffer<br />
|-<br />
| 0x0005....<br />
| [[2.0.0-2]]<br />
| WaitConnection<br />
|-<br />
| 0x00060040<br />
| [[2.0.0-2]]<br />
| RequireConnection (u8 input)<br />
|-<br />
| 0x0007....<br />
| [[2.0.0-2]]<br />
| AutoConnection<br />
|-<br />
| 0x0008....<br />
| [[2.0.0-2]]<br />
| AnyConnection<br />
|-<br />
| 0x00090000<br />
| [[2.0.0-2]]<br />
| Disconnect<br />
|-<br />
| 0x000A0000<br />
| [[2.0.0-2]]<br />
| GetReceiveEvent (writes event handle to cmdreply[3])<br />
|-<br />
| 0x000B0000<br />
| [[2.0.0-2]]<br />
| GetSendEvent (writes event handle to cmdreply[3])<br />
|-<br />
| 0x000C0000<br />
| [[2.0.0-2]]<br />
| GetConnectionStatusEvent (writes event handle to cmdreply[3])<br />
|-<br />
| 0x000D0042<br />
| [[2.0.0-2]]<br />
| SendIrnop (u32 size, ((Size<<14) <nowiki>|</nowiki> 2), inbufptr)<br />
|-<br />
| 0x000E0042<br />
| [[2.0.0-2]]<br />
| SendIrnopLarge (u32 size, ((Size<<8) <nowiki>|</nowiki> 10), inbufptr)<br />
|-<br />
| 0x000F....<br />
| [[2.0.0-2]]<br />
| ReceiveIrnop<br />
|-<br />
| 0x0010....<br />
| [[2.0.0-2]]<br />
| ReceiveIrnopLarge<br />
|-<br />
| 0x0011....<br />
| [[2.0.0-2]]<br />
| GetLatestReceiveErrorResult<br />
|-<br />
| 0x0012....<br />
| [[2.0.0-2]]<br />
| GetLatestSendErrorResult<br />
|-<br />
| 0x0013....<br />
| [[2.0.0-2]]<br />
| GetConnectionStatus<br />
|-<br />
| 0x0014....<br />
| [[2.0.0-2]]<br />
| GetTryingToConnectStatus<br />
|-<br />
| 0x0015....<br />
| [[2.0.0-2]]<br />
| GetReceiveSizeFreeAndUsed<br />
|-<br />
| 0x0016....<br />
| [[2.0.0-2]]<br />
| GetSendSizeFreeAndUsed<br />
|-<br />
| 0x0017....<br />
| [[2.2.0-X]]<br />
| GetConnectionRole<br />
|-<br />
| 0x00180182<br />
| [[2.2.0-X]]<br />
| InitializeIrnopShared (u32, u32, u32, u32, u32, u8, 0, handle)<br />
|-<br />
| 0x00190040<br />
| [[2.2.0-X]]<br />
| ReleaseReceivedData (32bit_value input)<br />
|-<br />
| 0x001A0040<br />
| [[2.2.0-X]]<br />
| SetOwnMachineId (u8 input)<br />
|}<br />
<br />
This service was added with [[2.0.0-2]].<br />
<br />
When sending data, SendIrnop is used when the size is <=0xFC, otherwise SendIrnopLarge is used.<br />
<br />
= IR Service "ir:rst" =<br />
{| class="wikitable" border="1"<br />
|-<br />
! Command Header<br />
! Available since system-version<br />
! Description<br />
|-<br />
| 0x00010000<br />
| [[8.0.0-18]]<br />
| [[IRRST:GetHandles|GetHandles]]<br />
|-<br />
| 0x00020080<br />
| [[8.0.0-18]]<br />
| [[IRRST:Initialize|Initialize]]<br />
|-<br />
| 0x00030000<br />
| [[8.0.0-18]]<br />
| [[IRRST:Shutdown|Shutdown]]<br />
|-<br />
| 0x00040000<br />
| [[8.0.0-18]]<br />
| This writes an unknown u8 to index-word cmdreply[2], from data loaded from an I2C device register.<br />
|-<br />
| 0x00050000<br />
| [[8.0.0-18]]<br />
| This writes an unknown u8 from IR-module state to index-word cmdreply[2].<br />
|-<br />
| 0x00060000<br />
| [[8.0.0-18]]<br />
| This writes two unknown u8 fields from IR-module state to index-word cmdreply[2] and cmdreply[3].<br />
|-<br />
| 0x00070080<br />
| [[9.0.0-20]]<br />
| (u8 unk0, u8 unk1) ?<br />
|-<br />
| 0x00080000<br />
| [[9.0.0-20]]<br />
| (u8 unk0, u8 unk1) ?<br />
|-<br />
| 0x00090000<br />
| [[9.0.0-20]]<br />
| This writes two unknown u8 fields to index-word cmdreply[2] and cmdreply[3].<br />
|}<br />
<br />
This service was added with [[8.0.0-18]]. Unlike the other IR services, this uses [[I2C]] deviceid 17(this deviceid isn't actually handled by the [[8.0.0-18]] I2C module). This is for the additional [[New 3DS]] HID hardware, this HID data is stored in [[IRRST_Shared_Memory|shared-memory]]. Even with [[9.0.0-20]] IR module still registers+handles this service on both Old3DS+New3DS.<br />
<br />
=IR Services=<br />
Only one session(two sessions starting with [[8.0.0-18]]) to any of these services can be open at a time, thus only one/two process(es) can use any of these services at once. These services interface with hardware services gpio::IR and i2c::IR. The i2c::IR service is used for sending/receiving data.<br />
<br />
IRU is for regular IR comms. IRUSER uses a custom IR protocol(above the physical layer). Both of these services use IrDA-SIR. The IR hardware seems to only support IrDA-SIR, other physical protocols such as the one for TV-remotes are not supported(going by the datasheet linked [[Hardware|here]] for a different IC at least).<br />
<br />
The protocol used with IRUSER involves encryption(?) implemented in software. IRUSER is used for the [[Circle Pad Pro]]. This same IRUSER service uses the New3DS HID hardware when running on New3DS(note that the main service for New3DS HID is ir:rst).</div>
Socram8888
https://www.3dbrew.org/w/index.php?title=Ir:USER&diff=12424
Ir:USER
2015-04-17T12:21:24Z
<p>Socram8888: Undo revision 12391 by Socram8888 (talk)</p>
<hr />
<div>#REDIRECT [[IR Services#IR Service "ir:USER"]]</div>
Socram8888
https://www.3dbrew.org/w/index.php?title=NFC_adapter&diff=12395
NFC adapter
2015-04-16T09:05:25Z
<p>Socram8888: </p>
<hr />
<div>The Nintendo NFC adapter is an upcoming external device which adds NFC capabilities for [[amiibo]]s to old Nintendo 3DS and Nintendo 2DS consoles, using the infrared port on the back of the console.<br />
<br />
[[File:150217nfcreader-640x360.jpg|thumb|right|250px|Media preview, as released by Nintendo]]<br />
<br />
<br />
= Technical details =<br />
Based on analysis of the [[fangate_updater.bin]] file, which is part of the old Nintendo 3DS operating system since [[9.3.0-21]] and contains the firmware running on the external adapter; and analysis of the [[NFC Services]] running on old 3DS.<br />
<br />
* SOC inside the adapter: Broadcom BCM20791B1<br />
* CPU: ARM Cortex M0<br />
* Communications: infrared, with [[ir:USER]] running on the console. Uses obfuscated payloads. Baud rate is 115200 bps.<br />
<br />
Memory map:<br />
{| class="wikitable"<br />
|-<br />
! Address<br />
! Size<br />
! Description<br />
|-<br />
| 0x08008000<br />
| 256KB?<br />
| Firmware ([[fangate_updater.bin]])<br />
|-<br />
| 0x20000000<br />
| 128KB?<br />
| RAM<br />
|-<br />
| 0x40023C00<br />
| 0x0000001C<br />
| FLASH ROM control<br />
|-<br />
| 0xE000ED00<br />
| ?<br />
| System control block <br />
|}<br />
<br />
= IR communications =<br />
== Samples ==<br />
<br />
NFC adapter update beacon, as sent by the console:<br />
{| class="wikitable"<br />
|-<br />
! Raw<br />
! Deobfuscated<br />
|-<br />
| <code>A5 00 08 73 FE A5 C4 A4 2C A4 20 F5</code><br />
| <code>9A 9D D6 3A 01 E8 00 0C</code><br />
|-<br />
| <code>A5 00 08 D1 3E B7 7B B6 91 B6 9D 87</code><br />
| <code>38 5D 66 45 01 EA 00 0C</code><br />
|-<br />
| <code>A5 00 08 09 58 23 36 22 DA 22 D6 AE</code><br />
| <code>E0 3B 2A 6E 01 EC 00 0C</code><br />
|-<br />
| <code>A5 00 08 5E DD A4 A0 A5 4E A5 42 A8</code><br />
| <code>B7 BE FA 7D 01 EE 00 0C</code><br />
|-<br />
| <code>A5 00 08 BC 19 C6 37 C7 C7 C7 CB 8B</code><br />
| <code>55 7A 7A 2E 01 F0 00 0C</code><br />
|-<br />
| <code>A5 00 08 C9 15 F6 63 F7 91 F7 9D B2</code><br />
| <code>20 76 3F 76 01 F2 00 0C</code><br />
|-<br />
| <code>A5 00 08 6E 48 47 1A 46 EE 46 E2 C7</code><br />
| <code>87 2B 29 52 01 F4 00 0C</code><br />
|-<br />
| <code>A5 00 08 A2 8C E5 C3 E4 35 E4 39 74</code><br />
| <code>4B EF 47 4F 01 F6 00 0C</code><br />
|-<br />
| <code>A5 00 08 26 1C 07 10 06 E8 06 E4 64</code><br />
| <code>CF 7F 21 0C 01 F8 00 0C</code><br />
|-<br />
| <code>A5 00 08 7E 73 A2 3F A3 C5 A3 C9 FD</code><br />
| <code>97 10 DC 4C 01 FA 00 0C</code><br />
|-<br />
| <code>A5 00 08 75 00 F3 B8 F2 44 F2 48 63</code><br />
| <code>9C 63 86 B8 01 FC 00 0C</code><br />
|-<br />
| <code>A5 00 08 8D AC 0F D5 0E 2B 0E 27 72</code><br />
| <code>64 CF 82 79 01 FE 00 0C</code><br />
|-<br />
| <code>A5 00 08 A3 55 7C 53 7D 52 7D 5E B2</code><br />
| <code>4A 36 DF 06 01 01 00 0C</code><br />
|-<br />
| <code>A5 00 08 15 06 43 C0 42 C3 42 CF 85</code><br />
| <code>FC 65 56 C6 01 03 00 0C</code><br />
|-<br />
| <code>A5 00 08 66 E0 9A 17 9B 12 9B 1E A0</code><br />
| <code>8F 83 FC F7 01 05 00 0C</code><br />
|-<br />
| <code>A5 00 08 A4 35 09 97 08 90 08 9C 25</code><br />
| <code>4D 56 AD A2 01 07 00 0C</code><br />
|-<br />
| <code>A5 00 08 73 E2 BD AF BC A6 BC AA 60</code><br />
| <code>9A 81 CE 4D 01 09 00 0C</code><br />
|-<br />
| <code>A5 00 08 02 57 D7 B0 D6 BB D6 B7 28</code><br />
| <code>EB 34 D5 E7 01 0B 00 0C</code><br />
|-<br />
| <code>A5 00 08 0D 79 01 AA 00 A7 00 AB 22</code><br />
| <code>E4 1A 0C D3 01 0D 00 0C</code><br />
|-<br />
| <code>A5 00 08 14 91 04 B9 05 B6 05 BA B2</code><br />
| <code>FD F2 10 28 01 0F 00 0C</code><br />
|-<br />
| <code>A5 00 08 2C 86 B1 49 B0 58 B0 54 C0</code><br />
| <code>C5 E5 9D CF 01 11 00 0C</code><br />
|-<br />
| <code>A5 00 08 D5 1D DE DB DF C8 DF C4 F9</code><br />
| <code>3C 7E 0B C6 01 13 00 0C</code><br />
|-<br />
| <code>A5 00 08 AF 75 DE 5C DF 49 DF 45 9C</code><br />
| <code>46 16 71 29 01 15 00 0C</code><br />
|-<br />
| <code>A5 00 08 C8 E2 5B C6 5A D1 5A DD B5</code><br />
| <code>21 81 93 24 01 17 00 0C</code><br />
|-<br />
| <code>A5 00 08 9B 51 68 2D 69 34 69 38 41</code><br />
| <code>72 32 F3 7C 01 19 00 0C</code><br />
|-<br />
| <code>A5 00 08 13 7B 9F EF 9E F4 9E F8 32</code><br />
| <code>FA 18 8C 94 01 1B 00 0C</code><br />
|-<br />
| <code>A5 00 08 A7 62 02 9C 03 81 03 8D BD</code><br />
| <code>4E 01 A5 FE 01 1D 00 0C</code><br />
|-<br />
| <code>A5 00 08 39 06 94 36 95 29 95 25 09</code><br />
| <code>D0 65 AD 30 01 1F 00 0C</code><br />
|-<br />
| <code>A5 00 08 32 4C D7 C0 D6 E1 D6 ED 92</code><br />
| <code>DB 2F E5 8C 01 21 00 0C</code><br />
|-<br />
| <code>A5 00 08 83 BE F2 8F F3 AC F3 A0 B1</code><br />
| <code>6A DD 71 31 01 23 00 0C</code><br />
|-<br />
| <code>A5 00 08 83 5E A0 57 A1 72 A1 7E F0</code><br />
| <code>6A 3D 23 09 01 25 00 0C</code><br />
|-<br />
| <code>A5 00 08 6E C8 AD 69 AC 4E AC 42 D1</code><br />
| <code>87 AB C3 A1 01 27 00 0C</code><br />
|-<br />
| <code>A5 00 08 C7 33 A1 2C A0 05 A0 09 FC</code><br />
| <code>2E 50 66 1F 01 29 00 0C</code><br />
|}<br />
<br />
= External links =<br />
* [https://www.broadcom.com/products/NFC/NFC-Solutions/BCM2079x-Family BCM2079x brief on Broadcom's website]</div>
Socram8888
https://www.3dbrew.org/w/index.php?title=IR_Services&diff=12392
IR Services
2015-04-16T07:52:10Z
<p>Socram8888: </p>
<hr />
<div>[[Category:Services]]<br />
= IR Service "ir:u" =<br />
{| class="wikitable" border="1"<br />
|-<br />
! Command Header<br />
! Available since system version<br />
! Description<br />
|-<br />
| 0x00010000<br />
| [[1.0.0-0]]<br />
| [[IRU:Initialize|Initialize]]<br />
|-<br />
| 0x00020000<br />
| [[1.0.0-0]]<br />
| [[IRU:Shutdown|Shutdown]]<br />
|-<br />
| 0x00030042<br />
| [[1.0.0-0]]<br />
| [[IRU:StartSendTransfer|StartSendTransfer]]<br />
|-<br />
| 0x00040000<br />
| [[1.0.0-0]]<br />
| [[IRU:WaitSendTransfer|WaitSendTransfer]]<br />
|-<br />
| 0x000500C2<br />
| [[1.0.0-0]]<br />
| [[IRU:StartRecvTransfer|StartRecvTransfer]]<br />
|-<br />
| 0x00060000<br />
| [[1.0.0-0]]<br />
| [[IRU:WaitRecvTransfer|WaitRecvTransfer]]<br />
|-<br />
| 0x00070000<br />
| [[1.0.0-0]]<br />
| [[IRU:GetRecvTransferCount|GetRecvTransferCount]]<br />
|-<br />
| 0x00080000<br />
| [[1.0.0-0]]<br />
| [[IRU:GetSendState|GetSendState]]<br />
|-<br />
| 0x00090040<br />
| [[1.0.0-0]]<br />
| [[IRU:SetBitRate|SetBitRate]]<br />
|-<br />
| 0x000A0000<br />
| [[1.0.0-0]]<br />
| [[IRU:GetBitRate|GetBitRate]]<br />
|-<br />
| 0x000B0040<br />
| [[1.0.0-0]]<br />
| [[IRU:SetIRLEDState|SetIRLEDState]]<br />
|-<br />
| 0x000C0000<br />
| [[1.0.0-0]]<br />
| [[IRU:GetIRLEDRecvState|GetIRLEDRecvState]]<br />
|-<br />
| 0x000D0000<br />
| [[1.0.0-0]]<br />
| [[IRU:GetSendFinishedEvent|GetSendFinishedEvent]]<br />
|-<br />
| 0x000E0000<br />
| [[1.0.0-0]]<br />
| [[IRU:GetRecvFinishedEvent|GetRecvFinishedEvent]]<br />
|-<br />
| 0x000F0000<br />
| [[1.0.0-0]]<br />
| [[IRU:GetTransferState|GetTransferState]]<br />
|-<br />
| 0x00100000<br />
| [[1.0.0-0]]<br />
| GetErrorStatus<br />
|-<br />
| 0x00110040<br />
| [[1.0.0-0]]<br />
| [[IRU:SetSleepModeActive|SetSleepModeActive]]<br />
|-<br />
| 0x00120040<br />
| [[1.0.0-0]]<br />
| [[IRU:SetSleepModeState|SetSleepModeState]]<br />
|}<br />
<br />
= IR Service "ir:USER" =<br />
See [[ir:USER]]<br />
<br />
= IR Service "ir:rst" =<br />
{| class="wikitable" border="1"<br />
|-<br />
! Command Header<br />
! Available since system-version<br />
! Description<br />
|-<br />
| 0x00010000<br />
| [[8.0.0-18]]<br />
| [[IRRST:GetHandles|GetHandles]]<br />
|-<br />
| 0x00020080<br />
| [[8.0.0-18]]<br />
| [[IRRST:Initialize|Initialize]]<br />
|-<br />
| 0x00030000<br />
| [[8.0.0-18]]<br />
| [[IRRST:Shutdown|Shutdown]]<br />
|-<br />
| 0x00040000<br />
| [[8.0.0-18]]<br />
| This writes an unknown u8 to index-word cmdreply[2], from data loaded from an I2C device register.<br />
|-<br />
| 0x00050000<br />
| [[8.0.0-18]]<br />
| This writes an unknown u8 from IR-module state to index-word cmdreply[2].<br />
|-<br />
| 0x00060000<br />
| [[8.0.0-18]]<br />
| This writes two unknown u8 fields from IR-module state to index-word cmdreply[2] and cmdreply[3].<br />
|-<br />
| 0x00070080<br />
| [[9.0.0-20]]<br />
| (u8 unk0, u8 unk1) ?<br />
|-<br />
| 0x00080000<br />
| [[9.0.0-20]]<br />
| (u8 unk0, u8 unk1) ?<br />
|-<br />
| 0x00090000<br />
| [[9.0.0-20]]<br />
| This writes two unknown u8 fields to index-word cmdreply[2] and cmdreply[3].<br />
|}<br />
<br />
This service was added with [[8.0.0-18]]. Unlike the other IR services, this uses [[I2C]] deviceid 17(this deviceid isn't actually handled by the [[8.0.0-18]] I2C module). This is for the additional [[New 3DS]] HID hardware, this HID data is stored in [[IRRST_Shared_Memory|shared-memory]]. Even with [[9.0.0-20]] IR module still registers+handles this service on both Old3DS+New3DS.<br />
<br />
=IR Services=<br />
Only one session(two sessions starting with [[8.0.0-18]]) to any of these services can be open at a time, thus only one/two process(es) can use any of these services at once. These services interface with hardware services gpio::IR and i2c::IR. The i2c::IR service is used for sending/receiving data.<br />
<br />
IRU is for regular IR comms. IRUSER uses a custom IR protocol(above the physical layer). Both of these services use IrDA-SIR. The IR hardware seems to only support IrDA-SIR, other physical protocols such as the one for TV-remotes are not supported(going by the datasheet linked [[Hardware|here]] for a different IC at least).<br />
<br />
The protocol used with IRUSER involves encryption(?) implemented in software. IRUSER is used for the [[Circle Pad Pro]]. This same IRUSER service uses the New3DS HID hardware when running on New3DS(note that the main service for New3DS HID is ir:rst).</div>
Socram8888
https://www.3dbrew.org/w/index.php?title=Ir:USER&diff=12391
Ir:USER
2015-04-16T07:48:33Z
<p>Socram8888: </p>
<hr />
<div>This service was added with [[2.0.0-2]]. It employs a custom packet format with obfuscation and error detection.<br />
<br />
= Command set =<br />
When sending data, SendIrnop is used when the size is <=0xFC, otherwise SendIrnopLarge is used.<br />
<br />
{| class="wikitable" border="1"<br />
|-<br />
! Command Header<br />
! Available since system version<br />
! Description<br />
|-<br />
| 0x00010182<br />
| [[2.0.0-2]]<br />
| InitializeIrnop<br />
|-<br />
| 0x00020000<br />
| [[2.0.0-2]]<br />
| FinalizeIrnop<br />
|-<br />
| 0x00030000<br />
| [[2.0.0-2]]<br />
| ClearReceiveBuffer<br />
|-<br />
| 0x00040000<br />
| [[2.0.0-2]]<br />
| ClearSendBuffer<br />
|-<br />
| 0x0005....<br />
| [[2.0.0-2]]<br />
| WaitConnection<br />
|-<br />
| 0x00060040<br />
| [[2.0.0-2]]<br />
| RequireConnection (u8 input)<br />
|-<br />
| 0x0007....<br />
| [[2.0.0-2]]<br />
| AutoConnection<br />
|-<br />
| 0x0008....<br />
| [[2.0.0-2]]<br />
| AnyConnection<br />
|-<br />
| 0x00090000<br />
| [[2.0.0-2]]<br />
| Disconnect<br />
|-<br />
| 0x000A0000<br />
| [[2.0.0-2]]<br />
| GetReceiveEvent (writes event handle to cmdreply[3])<br />
|-<br />
| 0x000B0000<br />
| [[2.0.0-2]]<br />
| GetSendEvent (writes event handle to cmdreply[3])<br />
|-<br />
| 0x000C0000<br />
| [[2.0.0-2]]<br />
| GetConnectionStatusEvent (writes event handle to cmdreply[3])<br />
|-<br />
| 0x000D0042<br />
| [[2.0.0-2]]<br />
| SendIrnop (u32 size, ((Size<<14) <nowiki>|</nowiki> 2), inbufptr)<br />
|-<br />
| 0x000E0042<br />
| [[2.0.0-2]]<br />
| SendIrnopLarge (u32 size, ((Size<<8) <nowiki>|</nowiki> 10), inbufptr)<br />
|-<br />
| 0x000F....<br />
| [[2.0.0-2]]<br />
| ReceiveIrnop<br />
|-<br />
| 0x0010....<br />
| [[2.0.0-2]]<br />
| ReceiveIrnopLarge<br />
|-<br />
| 0x0011....<br />
| [[2.0.0-2]]<br />
| GetLatestReceiveErrorResult<br />
|-<br />
| 0x0012....<br />
| [[2.0.0-2]]<br />
| GetLatestSendErrorResult<br />
|-<br />
| 0x0013....<br />
| [[2.0.0-2]]<br />
| GetConnectionStatus<br />
|-<br />
| 0x0014....<br />
| [[2.0.0-2]]<br />
| GetTryingToConnectStatus<br />
|-<br />
| 0x0015....<br />
| [[2.0.0-2]]<br />
| GetReceiveSizeFreeAndUsed<br />
|-<br />
| 0x0016....<br />
| [[2.0.0-2]]<br />
| GetSendSizeFreeAndUsed<br />
|-<br />
| 0x0017....<br />
| [[2.2.0-X]]<br />
| GetConnectionRole<br />
|-<br />
| 0x00180182<br />
| [[2.2.0-X]]<br />
| InitializeIrnopShared (u32, u32, u32, u32, u32, u8, 0, handle)<br />
|-<br />
| 0x00190040<br />
| [[2.2.0-X]]<br />
| ReleaseReceivedData (32bit_value input)<br />
|-<br />
| 0x001A0040<br />
| [[2.2.0-X]]<br />
| SetOwnMachineId (u8 input)<br />
|}<br />
<br />
= Protocol description =<br />
Packets are sent using IrDA-SIR, with a 8N1 encoding (eight data bits, one stop bit, without parity). Each one is formed by a 2-byte header, a varint with the payload size, an obfuscated payload, and trailing error detection byte.<br />
<br />
== Packet header ==<br />
The packet header is fixed and consists in a synchronization byte (0xA5), followed by a unused (possibly RFU) zero byte. After these two hardcoded bytes, there's a varint representing the payload size, which may use one byte or two, depending on the how big the payload is.<br />
<br />
* For payloads with less than 64 bytes, the third byte represents the payload size.<br />
* For packets with up to 16383 bytes, the size is split in two bytes, with the third byte being the upper 6 bits of the payload size, OR'd with 0x40, and the fourth being the lower eight bits of the payload size<br />
<br />
For packets with less than 64 bytes:<br />
{| class="wikitable" border="1"<br />
! Sync<br />
! RFU<br />
! Size<br />
|-<br />
| 0xA5<br />
| 0x00<br />
| size<br />
|}<br />
<br />
For packets with up to 16383 bytes:<br />
{| class="wikitable" border="1"<br />
! Sync<br />
! RFU<br />
! Size (1)<br />
! Size (2)<br />
|-<br />
| 0xA5<br />
| 0x00<br />
| (size >> 8) <nowiki>|</nowiki> 0x40<br />
| size & 0xFF<br />
|}<br />
<br />
In C:<br />
<nowiki>uint8_t * setPacketHeader(uint8_t * buffer, size_t payloadSize) {<br />
assert(payloadSize < 16384);<br />
<br />
buffer[0] = 0xA5;<br />
buffer[1] = 0x00;<br />
<br />
if (payloadSize < 64) {<br />
buffer[2] = payloadSize;<br />
buffer += 3;<br />
} else {<br />
buffer[2] = 0x40 | (payloadSize >> 8);<br />
buffer[3] = payloadSize;<br />
buffer += 4;<br />
}<br />
<br />
return buffer;<br />
}</nowiki><br />
<br />
== Payload ==<br />
The payload is obfuscated using a XOR-based encryption. In C:<br />
<nowiki>void payloadObfuscate(const void * voidplain, void * voidcipher, size_t size) {<br />
uint16_t * plain = (uint16_t *) voidplain;<br />
uint16_t * cipher = (uint16_t *) voidcipher;<br />
size_t halfCount = size / sizeof(uint16_t);<br />
<br />
uint16_t xorval = htobe16(0xE963);<br />
size_t i;<br />
<br />
for (i = 0; i < halfCount; i++) {<br />
xorval ^= plain[i];<br />
cipher[i] = xorval;<br />
}<br />
}<br />
<br />
void payloadDeobfuscate(const void * voidcipher, void * voidplain, size_t size) {<br />
uint16_t * cipher = (uint16_t *) voidcipher;<br />
uint16_t * plain = (uint16_t *) voidplain;<br />
size_t halfCount = size / sizeof(uint16_t);<br />
<br />
if (halfCount) {<br />
size_t i;<br />
for (i = halfCount - 1; i > 0; i--) {<br />
plain[i] = cipher[i] ^ cipher[i - 1];<br />
}<br />
<br />
plain[0] = cipher[0] ^ htobe16(0xE963);<br />
}<br />
}</nowiki><br />
<br />
== Error detection ==<br />
The trailing error detection byte is calculated using [[CRC-8-CCITT]] <b>over the whole packet</b> (both the header and the payload)</div>
Socram8888
https://www.3dbrew.org/w/index.php?title=NFC_adapter&diff=12388
NFC adapter
2015-04-16T07:09:27Z
<p>Socram8888: </p>
<hr />
<div>The Nintendo NFC adapter is an upcoming external device which adds NFC capabilities for [[amiibo]]s to old Nintendo 3DS and Nintendo 2DS consoles, using the infrared port on the back of the console.<br />
<br />
[[File:150217nfcreader-640x360.jpg|thumb|right|250px|Media preview, as released by Nintendo]]<br />
<br />
<br />
== Technical details ==<br />
Based on analysis of the [[fangate_updater.bin]] file, which is part of the old Nintendo 3DS operating system since [[9.3.0-21]] and contains the firmware running on the external adapter; and analysis of the [[NFC Services]] running on old 3DS.<br />
<br />
* SOC inside the adapter: Broadcom BCM20791B1<br />
* CPU: ARM Cortex M0<br />
* Communications: infrared, with [[ir:USER]] running on the console. Uses obfuscated payloads. Baud rate is 115200 bps.<br />
<br />
Memory map:<br />
{| class="wikitable"<br />
|-<br />
! Address<br />
! Size<br />
! Description<br />
|-<br />
| 0x08008000<br />
| 256KB?<br />
| Firmware ([[fangate_updater.bin]])<br />
|-<br />
| 0x20000000<br />
| 128KB?<br />
| RAM<br />
|-<br />
| 0x40023C00<br />
| 0x0000001C<br />
| FLASH ROM control<br />
|-<br />
| 0xE000ED00<br />
| ?<br />
| System control block <br />
|}<br />
<br />
== External links ==<br />
* [https://www.broadcom.com/products/NFC/NFC-Solutions/BCM2079x-Family BCM2079x brief on Broadcom's website]</div>
Socram8888
https://www.3dbrew.org/w/index.php?title=NFC_adapter&diff=12380
NFC adapter
2015-04-15T21:58:34Z
<p>Socram8888: </p>
<hr />
<div>The Nintendo NFC adapter is an upcoming external device which adds NFC capabilities for [[amiibo]]s to old Nintendo 3DS and Nintendo 2DS consoles, using the infrared port on the back of the console.<br />
<br />
[[File:150217nfcreader-640x360.jpg|thumb|right|250px|Media preview, as released by Nintendo]]<br />
<br />
<br />
== Technical details ==<br />
Based on analysis of the [[fangate_updater.bin]] file, which is part of the old Nintendo 3DS operating system since [[9.3.0-21]] and contains the firmware running on the external adapter; and analysis of the [[NFC Services]] running on old 3DS.<br />
<br />
* SOC inside the adapter: Broadcom BCM20791B1<br />
* CPU: ARM Cortex M0<br />
* Communications: infrared, with [[ir:USER]] running on the console. Uses encrypted payloads. Baud rate is 115200 bps.<br />
<br />
Memory map:<br />
{| class="wikitable"<br />
|-<br />
! Address<br />
! Size<br />
! Description<br />
|-<br />
| 0x08008000<br />
| 256KB?<br />
| Firmware ([[fangate_updater.bin]])<br />
|-<br />
| 0x20000000<br />
| 128KB?<br />
| RAM<br />
|-<br />
| 0x40023C00<br />
| 0x0000001C<br />
| FLASH ROM control<br />
|-<br />
| 0xE000ED00<br />
| ?<br />
| System control block <br />
|}<br />
<br />
== External links ==<br />
* [https://www.broadcom.com/products/NFC/NFC-Solutions/BCM2079x-Family BCM2079x brief on Broadcom's website]</div>
Socram8888
https://www.3dbrew.org/w/index.php?title=CRC-8-CCITT&diff=12379
CRC-8-CCITT
2015-04-15T21:55:19Z
<p>Socram8888: Created page with "CRC-8-CCITT is a fast error detection algorithm. It's a standard CRC-8, with polynomial x⁸+x²+x+1. See the [http://en.wikipedia.org/wiki/Cyclic_redundancy_check Wikipedia arti..."</p>
<hr />
<div>CRC-8-CCITT is a fast error detection algorithm. It's a standard CRC-8, with polynomial x⁸+x²+x+1. See the [http://en.wikipedia.org/wiki/Cyclic_redundancy_check Wikipedia article on CRC] for more information.<br />
<br />
== Usage on the 3DS ==<br />
On the 3DS operating system, the CRC-8-CCITT is used for:<br />
* Error detection on [[ir:USER]] communications<br />
<br />
== Implementation ==<br />
Now follows a public domain implementation of CRC-8-CCITT, as used by the 3DS:<br />
<br />
<nowiki><br />
// crc8.h<br />
<br />
#include <stdint.h><br />
#include <string.h><br />
<br />
uint8_t crc8ccitt(const void * data, size_t size);</nowiki><br />
<br />
<nowiki>// crc8.c<br />
<br />
#include "crc8.h"<br />
<br />
static const uint8_t CRC_TABLE[256] = {<br />
0x00, 0x07, 0x0E, 0x09, 0x1C, 0x1B, 0x12, 0x15,<br />
0x38, 0x3F, 0x36, 0x31, 0x24, 0x23, 0x2A, 0x2D,<br />
0x70, 0x77, 0x7E, 0x79, 0x6C, 0x6B, 0x62, 0x65,<br />
0x48, 0x4F, 0x46, 0x41, 0x54, 0x53, 0x5A, 0x5D,<br />
0xE0, 0xE7, 0xEE, 0xE9, 0xFC, 0xFB, 0xF2, 0xF5,<br />
0xD8, 0xDF, 0xD6, 0xD1, 0xC4, 0xC3, 0xCA, 0xCD,<br />
0x90, 0x97, 0x9E, 0x99, 0x8C, 0x8B, 0x82, 0x85,<br />
0xA8, 0xAF, 0xA6, 0xA1, 0xB4, 0xB3, 0xBA, 0xBD,<br />
0xC7, 0xC0, 0xC9, 0xCE, 0xDB, 0xDC, 0xD5, 0xD2,<br />
0xFF, 0xF8, 0xF1, 0xF6, 0xE3, 0xE4, 0xED, 0xEA,<br />
0xB7, 0xB0, 0xB9, 0xBE, 0xAB, 0xAC, 0xA5, 0xA2,<br />
0x8F, 0x88, 0x81, 0x86, 0x93, 0x94, 0x9D, 0x9A,<br />
0x27, 0x20, 0x29, 0x2E, 0x3B, 0x3C, 0x35, 0x32,<br />
0x1F, 0x18, 0x11, 0x16, 0x03, 0x04, 0x0D, 0x0A,<br />
0x57, 0x50, 0x59, 0x5E, 0x4B, 0x4C, 0x45, 0x42,<br />
0x6F, 0x68, 0x61, 0x66, 0x73, 0x74, 0x7D, 0x7A,<br />
0x89, 0x8E, 0x87, 0x80, 0x95, 0x92, 0x9B, 0x9C,<br />
0xB1, 0xB6, 0xBF, 0xB8, 0xAD, 0xAA, 0xA3, 0xA4,<br />
0xF9, 0xFE, 0xF7, 0xF0, 0xE5, 0xE2, 0xEB, 0xEC,<br />
0xC1, 0xC6, 0xCF, 0xC8, 0xDD, 0xDA, 0xD3, 0xD4,<br />
0x69, 0x6E, 0x67, 0x60, 0x75, 0x72, 0x7B, 0x7C,<br />
0x51, 0x56, 0x5F, 0x58, 0x4D, 0x4A, 0x43, 0x44,<br />
0x19, 0x1E, 0x17, 0x10, 0x05, 0x02, 0x0B, 0x0C,<br />
0x21, 0x26, 0x2F, 0x28, 0x3D, 0x3A, 0x33, 0x34,<br />
0x4E, 0x49, 0x40, 0x47, 0x52, 0x55, 0x5C, 0x5B,<br />
0x76, 0x71, 0x78, 0x7F, 0x6A, 0x6D, 0x64, 0x63,<br />
0x3E, 0x39, 0x30, 0x37, 0x22, 0x25, 0x2C, 0x2B,<br />
0x06, 0x01, 0x08, 0x0F, 0x1A, 0x1D, 0x14, 0x13,<br />
0xAE, 0xA9, 0xA0, 0xA7, 0xB2, 0xB5, 0xBC, 0xBB,<br />
0x96, 0x91, 0x98, 0x9F, 0x8A, 0x8D, 0x84, 0x83,<br />
0xDE, 0xD9, 0xD0, 0xD7, 0xC2, 0xC5, 0xCC, 0xCB,<br />
0xE6, 0xE1, 0xE8, 0xEF, 0xFA, 0xFD, 0xF4, 0xF3<br />
};<br />
<br />
uint8_t crc8ccitt(const void * data, size_t size) {<br />
uint8_t val = 0;<br />
<br />
uint8_t * pos = (uint8_t *) data;<br />
uint8_t * end = pos + size;<br />
<br />
while (pos < end) {<br />
val = CRC_TABLE[val ^ *pos];<br />
pos++;<br />
}<br />
<br />
return val;<br />
}</nowiki></div>
Socram8888
https://www.3dbrew.org/w/index.php?title=NFC_adapter&diff=12307
NFC adapter
2015-04-13T16:25:57Z
<p>Socram8888: </p>
<hr />
<div>The Nintendo NFC adapter is an upcoming external device which adds NFC capabilities for [[amiibo]]s to old Nintendo 3DS and Nintendo 2DS consoles, using the infrared port on the back of the console.<br />
<br />
[[File:150217nfcreader-640x360.jpg|thumb|right|250px|Media preview, as released by Nintendo]]<br />
<br />
<br />
== Technical details ==<br />
Based on analysis of the [[fangate_updater.bin]] file, which is part of the old Nintendo 3DS operating system since [[9.3.0-21]] and contains the firmware running on the external adapter; and analysis of the [[NFC Services]] running on old 3DS.<br />
<br />
* SOC inside the adapter: Broadcom BCM20791B1<br />
* CPU: ARM Cortex M0<br />
* Communications: infrared, with [[ir:USER]] running on the console. Uses encrypted payloads.<br />
<br />
Memory map:<br />
{| class="wikitable"<br />
|-<br />
! Address<br />
! Size<br />
! Description<br />
|-<br />
| 0x08008000<br />
| 256KB?<br />
| Firmware ([[fangate_updater.bin]])<br />
|-<br />
| 0x20000000<br />
| 128KB?<br />
| RAM<br />
|-<br />
| 0x40023C00<br />
| 0x0000001C<br />
| FLASH ROM control<br />
|}<br />
<br />
== External links ==<br />
* [https://www.broadcom.com/products/NFC/NFC-Solutions/BCM2079x-Family BCM2079x brief on Broadcom's website]</div>
Socram8888
https://www.3dbrew.org/w/index.php?title=Peripherals&diff=12306
Peripherals
2015-04-13T16:05:31Z
<p>Socram8888: </p>
<hr />
<div>== Overview ==<br />
A list of 3DS system and accessory model numbers.<br />
<br />
{| class="wikitable" border="1"<br />
|-<br />
! Code<br />
! Peripheral<br />
|-<br />
| CTR-001 (region code)<br />
| Retail 3DS unit (EUR/JPN/USA/KOR/CHN/TWN)<br />
|- <br />
| CTR-001(-01) (region code)<br />
| Debug 3DS test unit (EUR/USA/JPN/AUS)<br />
|- <br />
| CTR-001(-04) (region code)<br />
| Kiosk 3DS unit (only 'EUR' has been spotted)<br />
|- <br />
| CTR-001(-06)<br />
| Louvre 'Audio Guide' 3DS unit (these units are 'special' debug units)<br />
|- <br />
| CTR-002<br />
| AR cards pack<br />
|- <br />
| CTR-003<br />
| Battery pack<br />
|- <br />
| CTR-004<br />
| 3DS stylus<br />
|- <br />
| CTR-005<br />
| [[Gamecards|Retail game card]]<br />
|- <br />
| CTR-005(-01)<br />
| Developer flash card (same shape as a regular CTR-005)<br />
|- <br />
| CTR-006<br />
| Game box<br />
|- <br />
| CTR-006 (EUR)<br />
| European game box (slightly thicker than a regular CTR-006)<br />
|- <br />
| CTR-007<br />
| Charging cradle<br />
|- <br />
| CTR-008<br />
| Developer flash card (is large and clunky and has replaceable save flash)<br />
|- <br />
| CTR-009<br />
| [[Circle Pad Pro]]<br />
|- <br />
| CTR-010<br />
| 3DS stand (bundled with [http://en.wikipedia.org/wiki/Kid_Icarus:_Uprising Kid Icarus: Uprising])<br />
|-<br />
| CTR-???<br />
| [[NFC adapter]]<br />
|- <br />
| SPR-001 (region code)<br />
| Retail 3DS XL unit (EUR/JPN/USA/KOR/CHN/TWN)<br />
|- <br />
| SPR-001(-01)<br />
| Debug 3DS XL test unit<br />
|- <br />
| SPR-004<br />
| 3DS XL stylus<br />
|- <br />
| SPR-009<br />
| [[Circle Pad Pro]] LL/XL<br />
|- <br />
| WAP-002<br />
| 3DS (XL) AC adapter<br />
|}</div>
Socram8888
https://www.3dbrew.org/w/index.php?title=Peripherals&diff=12305
Peripherals
2015-04-13T16:04:49Z
<p>Socram8888: /* Overview */</p>
<hr />
<div>== Overview ==<br />
A list of 3DS system and accessory model numbers.<br />
<br />
{| class="wikitable" border="1"<br />
|-<br />
! Code<br />
! Peripheral<br />
|-<br />
| CTR-001 (region code)<br />
| Retail 3DS unit (EUR/JPN/USA/KOR/CHN/TWN)<br />
|- <br />
| CTR-001(-01) (region code)<br />
| Debug 3DS test unit (EUR/USA/JPN/AUS)<br />
|- <br />
| CTR-001(-04) (region code)<br />
| Kiosk 3DS unit (only 'EUR' has been spotted)<br />
|- <br />
| CTR-001(-06)<br />
| Louvre 'Audio Guide' 3DS unit (these units are 'special' debug units)<br />
|- <br />
| CTR-002<br />
| AR cards pack<br />
|- <br />
| CTR-003<br />
| Battery pack<br />
|- <br />
| CTR-004<br />
| 3DS stylus<br />
|- <br />
| CTR-005<br />
| [[Gamecards|Retail game card]]<br />
|- <br />
| CTR-005(-01)<br />
| Developer flash card (same shape as a regular CTR-005)<br />
|- <br />
| CTR-006<br />
| Game box<br />
|- <br />
| CTR-006 (EUR)<br />
| European game box (slightly thicker than a regular CTR-006)<br />
|- <br />
| CTR-007<br />
| Charging cradle<br />
|- <br />
| CTR-008<br />
| Developer flash card (is large and clunky and has replaceable save flash)<br />
|- <br />
| CTR-009<br />
| [[Circle Pad Pro]]<br />
|- <br />
| CTR-010<br />
| 3DS stand (bundled with [http://en.wikipedia.org/wiki/Kid_Icarus:_Uprising Kid Icarus: Uprising])<br />
|- <br />
| SPR-001 (region code)<br />
| Retail 3DS XL unit (EUR/JPN/USA/KOR/CHN/TWN)<br />
|- <br />
| SPR-001(-01)<br />
| Debug 3DS XL test unit<br />
|- <br />
| SPR-004<br />
| 3DS XL stylus<br />
|- <br />
| SPR-009<br />
| [[Circle Pad Pro]] LL/XL<br />
|- <br />
| WAP-002<br />
| 3DS (XL) AC adapter<br />
|-<br />
| CTR-???<br />
| [[NFC adapter]]<br />
|}</div>
Socram8888
https://www.3dbrew.org/w/index.php?title=NFC_adapter&diff=12304
NFC adapter
2015-04-13T15:55:55Z
<p>Socram8888: </p>
<hr />
<div>The Nintendo NFC adapter is an upcoming external device which adds NFC capabilities for [[amiibo]]s to old Nintendo 3DS and Nintendo 2DS consoles, using the infrared port on the back of the console.<br />
<br />
[[File:150217nfcreader-640x360.jpg|thumb|right|250px|Media preview, as released by Nintendo]]<br />
<br />
<br />
== Technical details ==<br />
Based on analysis of the [[fangate_updater.bin]] file, which is part of the old Nintendo 3DS operating system since [[9.3.0-21]] and contains the firmware running on the external adapter; and analysis of the [[NFC Services]] running on old 3DS.<br />
<br />
* SOC inside the adapter: Broadcom BCM20791B1<br />
* CPU: ARM Cortex M0<br />
* Communications: infrared, with [[ir:USER]] running on the console. Uses encrypted payloads.<br />
<br />
Memory map:<br />
{| class="wikitable"<br />
|-<br />
! Address<br />
! Size<br />
! Description<br />
|-<br />
| 0x08008000<br />
| 256KB?<br />
| Firmware ([[fangate_updater.bin]])<br />
|-<br />
| 0x20000000<br />
| 128KB?<br />
| RAM<br />
|}<br />
<br />
== External links ==<br />
* [https://www.broadcom.com/products/NFC/NFC-Solutions/BCM2079x-Family BCM2079x brief on Broadcom's website]</div>
Socram8888
https://www.3dbrew.org/w/index.php?title=NFC_adapter&diff=12303
NFC adapter
2015-04-13T15:39:19Z
<p>Socram8888: </p>
<hr />
<div>The Nintendo NFC adapter is an upcoming external device which adds NFC capabilities for [[amiibo]]s to old Nintendo 3DS and Nintendo 2DS consoles, using the infrared port on the back of the console.<br />
<br />
[[File:150217nfcreader-640x360.jpg|thumb|right|250px|Media preview, as released by Nintendo]]<br />
<br />
<br />
== Technical details ==<br />
Based on analysis of the [[fangate_updater.bin]] file, which is part of the old Nintendo 3DS operating system since [[9.3.0-21]] and contains the firmware running on the external adapter; and analysis of the [[NFC Services]] running on old 3DS.<br />
<br />
* SOC inside the adapter: Broadcom BCM20791B1<br />
* CPU: ARM Cortex M0<br />
* Communications: infrared, with [[ir:USER]] running on the console. Uses encrypted payloads.<br />
<br />
Memory map:<br />
{| class="wikitable"<br />
|-<br />
! Address<br />
! Size<br />
! Description<br />
|-<br />
| 0x08008000<br />
| 256KB?<br />
| Firmware ([[fangate_updater.bin]])<br />
|-<br />
| 0x20000000<br />
| 32KB?<br />
| RAM<br />
|}<br />
<br />
== External links ==<br />
* [https://www.broadcom.com/products/NFC/NFC-Solutions/BCM2079x-Family BCM2079x brief on Broadcom's website]</div>
Socram8888
https://www.3dbrew.org/w/index.php?title=NFC_adapter&diff=12302
NFC adapter
2015-04-13T15:38:36Z
<p>Socram8888: Created page with "The Nintendo NFC adapter is an upcoming external device which adds NFC capabilities for amiibos to old Nintendo 3DS and Nintendo 2DS consoles, using the infrared port on the ..."</p>
<hr />
<div>The Nintendo NFC adapter is an upcoming external device which adds NFC capabilities for [[amiibo]]s to old Nintendo 3DS and Nintendo 2DS consoles, using the infrared port on the back of the console.<br />
<br />
[[File:150217nfcreader-640x360.jpg|thumb|right|250px|Media preview, as released by Nintendo]]<br />
<br />
<br />
== Technical details ==<br />
Based on analysis of the [[fangate_updater.bin]] file, which is part of the old Nintendo 3DS operating system since [[9.3.0-21]] and contains the firmware running on the external adapter; and analysis of the [[NFC Services]] running on old 3DS.<br />
<br />
* SOC inside the adapter: Broadcom BCM20791B1<br />
* CPU: ARM Cortex M0<br />
* Communications: infrared, with [[ir:USER]] running on the console. Uses encrypted payloads.<br />
<br />
Memory map:<br />
{| class="wikitable"<br />
|-<br />
! Address<br />
! Size<br />
! Description<br />
|-<br />
| 0x08008000<br />
| 256KB?<br />
| Firmware<br />
|-<br />
| 0x20000000<br />
| 32KB?<br />
| RAM<br />
|}<br />
<br />
== External links ==<br />
* [https://www.broadcom.com/products/NFC/NFC-Solutions/BCM2079x-Family BCM2079x brief on Broadcom's website]</div>
Socram8888
https://www.3dbrew.org/w/index.php?title=Memory_map&diff=12301
Memory map
2015-04-13T15:32:10Z
<p>Socram8888: Redirected page to Memory layout</p>
<hr />
<div>#REDIRECT [[Memory layout]]</div>
Socram8888
https://www.3dbrew.org/w/index.php?title=Ir:USER&diff=12300
Ir:USER
2015-04-13T15:30:54Z
<p>Socram8888: Redirected page to IR Services#IR Service "ir:USER"</p>
<hr />
<div>#REDIRECT [[IR Services#IR Service "ir:USER"]]</div>
Socram8888
https://www.3dbrew.org/w/index.php?title=Fangate_updater.bin&diff=12299
Fangate updater.bin
2015-04-13T15:23:43Z
<p>Socram8888: Redirected page to Fangate updater#fangate updater.bin</p>
<hr />
<div>#REDIRECT [[Fangate updater#fangate_updater.bin]]</div>
Socram8888
https://www.3dbrew.org/w/index.php?title=File:150217nfcreader-640x360.jpg&diff=12298
File:150217nfcreader-640x360.jpg
2015-04-13T15:16:16Z
<p>Socram8888: </p>
<hr />
<div></div>
Socram8888
https://www.3dbrew.org/w/index.php?title=Title_list&diff=12175
Title list
2015-03-30T13:16:32Z
<p>Socram8888: </p>
<hr />
<div>The Nintendo 3DS utilizes a similar title-based organization as seen in the Wii and DSi platforms. The update server is located [http://nus.cdn.c.shop.nintendowifi.net/ccs/download/ here]. When using SSL, the update/shop servers must be accessed via SSLv3.<br />
<br />
The organization of Title IDs has not been documented fully yet. Region info isn't stored in title IDs however there does appear to be evidence that the regions are sequential, similar to how Wii System Menu Updates are ordered: JPN USA EUR KOR and CHN (introduced with the DSi). 3DS has one additional region: TWN.<br />
<br />
Note: The terms 'Title ID', 'Partition ID' and 'Media ID' are interchangeable.<br />
<br />
The 3DS retrieves system [[CommonETicket|tickets]] with SOAP request GetSystemCommonETicket, instead of directly downloading the cetk with HTTPS. The cetk is still accessible via HTTP, however 3DS doesn't use direct HTTP for this.<br />
<br />
<br />
'''TitleID Structure''': 0xCCCCABCDLLLLLLRR<br />
<br />
* CCCC defines the console '''Platform''' (5=WiiU, 4=3DS, 3=DSi, 1=[http://wiibrew.org/wiki/Title_database Wii])<br />
* ABCD defines the '''Content Category''' of the title, Demo, DLPChild, etc.<br />
* LLLLLL For CTR titles, this is the title's '''Unique ID'''. For TWL converted titles this is in two sections grouped as SSLLLL. SS is the old title identification used by the DSi and is made redundant by 'ABCD'. LLLL is the TWL title's 'Unique ID'. There are restrictions on the Unique ID, see below for more info.<br />
* RR This is the Title ID '''Variation''', and has various uses.<br />
<br />
<br />
'''Content Categories''':<br />
<br />
This u16 is a collection bit mask flag. Each Category is a group of one or more bit masks.<br />
<br />
Specific Bitmask Flags:<br />
{| class="wikitable" border="1"<br />
|-<br />
! Category<br />
! Bitmask<br />
|-<br />
| Normal<br />
| 0x0<br />
|-<br />
| DlpChild<br />
| 0x1<br />
|-<br />
| Demo<br />
| 0x2<br />
|-<br />
| Contents<br />
| 0x3<br />
|-<br />
| AddOnContents<br />
| 0x4<br />
|-<br />
| Patch<br />
| 0x6<br />
|-<br />
| CannotExecution<br />
| 0x8<br />
|-<br />
| System<br />
| 0x10<br />
|-<br />
| RequireBatchUpdate<br />
| 0x20<br />
|-<br />
| NotRequireUserApproval<br />
| 0x40<br />
|-<br />
| NotRequireRightForMount<br />
| 0x80<br />
|-<br />
| CanSkipConvertJumpId<br />
| 0x100<br />
|-<br />
| TWL<br />
| 0x8000<br />
|}<br />
<br />
* TWL Category bit mask are carried over from original TWL category bitmasks (ignoring bit mask 0x8000), so TWL system titles have the bitmask of 0x8001.<br />
<br />
* System titles (TWL and CTR) are eligible to be updated during a System Update.<br />
<br />
* Bit Mask 0x4000 appears to be reserved, as it renders the ''TWL'' and ''System'' bit masks useless.<br />
<br />
'''Unique ID Restrictions''':<br />
<br />
For the CTR titles, there appears to be is a correlation between Unique IDs (UID) and 3DS 'title types'. For developer titles this is known(shown below), and retail titles *appear* to follow suite. It is unknown if this correlation is enforced on retail units, or if it is just for organisation purposes. <br />
<br />
{| class="wikitable" border="1"<br />
|-<br />
! TITLE TYPE<br />
! UNIQUE ID RANGE<br />
|-<br />
| System<br />
| 0x0 - 0x2FF<br />
|- <br />
| Application<br />
| 0x300 - 0xF7FFF<br />
|- <br />
| Evaluation<br />
| 0xF8000 -0xFFFFF<br />
|- <br />
| Prototype*<br />
| 0xFF000 - 0xFF3FF<br />
|}<br />
<nowiki>*</nowiki>On the home menu, titles with UIDs within the 'Prototype' range, appear on the home menu after install without the gift fanfare.<br />
<br />
ProgramID/titleID low bitmask 0xF0000000(uniqueID bitmask 0xF00000) seems to be related to which hardware the title is allowed to run on. 3DS code tends to clear this bitmask when handling programIDs. This bitmask is normally zero. When this is 0x2, this indicates that the title only runs on [[New_3DS]](that is, programID-low 0x20000000 / uniqueID 0x200000).<br />
<br />
'''TitleID Variation''':<br />
<br />
This u8 allows enumeration of titles from the same category and unique ID. Common uses are explained below:<br />
<br />
* CTR System Titles: The 3DS has two copies of most modules/applets/archives for usage with either the NATIVE_FIRM or SAFE_MODE_FIRM. This is allowed for, by changing the title ID variation of the title to match the core version set by the FIRM it is designed to be used with:<br />
{| class="wikitable" border="1"<br />
|-<br />
! RR<br />
! MEANING<br />
|- <br />
| 02<br />
| System Title (Core version 0x2)<br />
|-<br />
| 03<br />
| SAFE_MODE System Title (Core version 0x3)<br />
|}<br />
Normally on retail SAFE_MODE ARM11 [[NCCH#CXI|CXI]] titles can't be launched, since the [[Configuration_Memory|system]] core version doesn't match the CXI exheader core version.<br />
<br />
* Only most non-Normal Applications are known to utilise Title ID variation, this is explained in their respective sections on this page.<br />
<br />
* [[3DS Development Unit Software|Dev Menu]] installs CTR Applications with a TitleID variation of 0x02 to the CTR NAND.<br />
<br />
* Title ID variation is ignored for TWL titles, this value is carried over from the original TWL title ID and is used for region lock:<br />
<br />
=== Versions ===<br />
<br />
v## = 0xHHHH = 0bBBBBBBBB...<br />
<br />
* The version major,minor and micro can be extracted from the version number by converting the 16 bit number to binary<br />
* 6 bits : Major<br />
* 6 bits : Minor<br />
* 4 bits : Micro ('Build' in some contexts)<br />
* i.e. v2069 (Taken from 000400DB00017302) = 0b000010 000001 0101 means that the title version is v2.1.5. For reasons unknown, the CVer build, stored in the RomFS of the title, has always been zero (at time of writing), regardless of the CVer build in the TMD. So when predicting the firmware version, this should be taken into account.<br />
<br />
NOTE: This Title list is a condensed version, only the System Titles lists are full lists. For a full list of titles on Nintendo's CDN, see [http://mtheall.com/~mtheall/tmdlist.php here]. The reports/title-lists from [http://yls8.mtheall.com/ninupdates/reports.php here] are automatically obtained from the system update SOAP.<br />
<br />
== CTR System Titles ==<br />
{| class="wikitable" border="1"<br />
|-<br />
! System Category<br />
! Bit Mask(s)<br />
! Category Bit Mask<br />
|-<br />
| Application (SYSTEM_APPLICATION)<br />
| Normal<nowiki>|</nowiki>System<br />
| 0x0010<br />
|-<br />
| System Data Archives (SYSTEM_CONTENT)<br />
| Contents<nowiki>|</nowiki>CannotExecution<nowiki>|</nowiki>System<br />
| 0x001B<br />
|-<br />
| Shared Data Archives (SHARED_CONTENT)<br />
| Contents<nowiki>|</nowiki>CannotExecution<nowiki>|</nowiki>System<nowiki>|</nowiki>NotRequireRightForMount<br />
| 0x009B<br />
|-<br />
| System Data Archives (AUTO_UPDATE_CONTENT)<br />
| Contents<nowiki>|</nowiki>CannotExecution<nowiki>|</nowiki>System<nowiki>|</nowiki>NotRequireUserApproval<nowiki>|</nowiki>NotRequireRightForMount<br />
| 0x00DB<br />
|-<br />
| Applet (APPLET)<br />
| Normal<nowiki>|</nowiki>System<nowiki>|</nowiki>RequireBatchUpdate<br />
| 0x0030<br />
|-<br />
| Module (BASE)<br />
| Normal<nowiki>|</nowiki>System<nowiki>|</nowiki>RequireBatchUpdate<nowiki>|</nowiki>CanSkipConvertJumpId<br />
| 0x0130<br />
|-<br />
| Firmware (FIRMWARE)<br />
| Normal<nowiki>|</nowiki>CannotExecution<nowiki>|</nowiki>System<nowiki>|</nowiki>RequireBatchUpdate<nowiki>|</nowiki>CanSkipConvertJumpId<br />
| 0x0138<br />
|}<br />
<br />
=== 00040010 - System Applications ===<br />
The versions for CHN, KOR, and TWN are separate from the other regions.<br />
<br />
{| class="wikitable" border="1"<br />
|-<br />
! JPN TIDLow<br />
! USA TIDLow<br />
! EUR TIDLow<br />
! CHN TIDLow<br />
! KOR TIDLow<br />
! TWN TIDLow<br />
! Description<br />
! JPN Versions<br />
! EUR Versions<br />
! USA Versions<br />
! CHN Versions<br />
! KOR Versions<br />
! TWN Versions<br />
! Status<br />
|-<br />
| 00020000<br />
| 00021000<br />
| 00022000<br />
| 00026000<br />
| 00027000<br />
| 00028000<br />
| [[System Settings]] (mset)<br />
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[3.0.0-5|v2060]], [[4.0.0-7|v3074]], [[5.0.0-11|v4097]], [[6.0.0-11|v5127]], [[7.0.0-13|v6157]], [[7.2.0-17|v7173]], [[8.1.0-0_New3DS|v8198]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v9224]]<br />
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[3.0.0-5|v2061]], [[4.0.0-7|v3075]], [[5.0.0-11|v4097]], [[6.0.0-11|v5127]], [[7.0.0-13|v6157]], [[7.2.0-17|v7174]], [[9.0.0-20|v8202]]<br />
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[3.0.0-5|v2062]], [[4.0.0-7|v3078]], [[5.0.0-11|v4098]], [[6.0.0-11|v5128]], [[7.0.0-13|v6157]], [[7.2.0-17|v7174]], [[9.0.0-20|v8203]]<br />
| [[4.0.0-7|v8]], [[4.4.0-10|v1024]](CHN-only sysupdate for just mset), [[5.0.0-11|v2049]], [[7.0.0-13|v3075]]<br />
| [[4.0.0-7|v1026]], [[5.0.0-11|v2049]], [[7.0.0-13|v4098]]<br />
| [[4.1.0-8|v8]], [[4.2.0-9|v1024]], [[5.0.0-11|v2050]], [[7.0.0-13|v3074]]<br />
| Active<br />
|-<br />
| 00020100<br />
| 00021100<br />
| 00022100<br />
| 00026100<br />
| 00027100<br />
| 00028100<br />
| [[Download Play]] (dlplay)<br />
| [[1.0.0-0|v0]], [[2.1.0-4|v1026]], [[4.0.0-7|v2051]], [[9.0.0-20|v3072]](Also for [[8.1.0-0_New3DS]])<br />
| [[1.0.0-0|v0]], [[2.1.0-4|v1026]], [[4.0.0-7|v2051]], [[9.0.0-20|v3073]]<br />
| [[1.0.0-0|v0]], [[2.1.0-4|v1026]], [[4.0.0-7|v2051]], [[9.0.0-20|v3073]]<br />
| [[4.0.0-7|v4]]<br />
| [[4.0.0-7|v1027]]<br />
| [[4.1.0-8|v4]]<br />
| Active<br />
|-<br />
| 00020200<br />
| 00021200<br />
| 00022200<br />
| 00026200<br />
| 00027200<br />
| 00028200<br />
| [[Activity Log]]<br />
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[3.0.0-5|v2051]]<br />
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[3.0.0-5|v2054]], [[7.0.0-13|v2064]]<br />
| Same as EUR<br />
| [[4.0.0-7|v3]]<br />
| [[4.0.0-7|v2]], [[7.0.0-13|v16]]<br />
| [[4.1.0-8|v2]]<br />
| Active<br />
|-<br />
| 00020300<br />
| 00021300<br />
| 00022300<br />
| 00026300<br />
| 00027300<br />
| 00028300<br />
| [[Health and Safety Information]]<br />
| [[1.0.0-0|v0]], [[4.0.0-7|v1024]], [[6.0.0-11|v2050]]<br />
| [[1.0.0-0|v0]], [[3.0.0-5|v1024]], [[4.0.0-7|v2050]], [[6.0.0-11|v3077]]<br />
| [[1.0.0-0|v0]], [[4.0.0-7|v1026]], [[6.1.0-12U|v2051]]<br />
| [[4.0.0-7|v5]]<br />
| [[4.0.0-7|v2]]<br />
| [[4.1.0-8|v5]]<br />
| Active<br />
|-<br />
| 20020300<br />
| 20021300<br />
| 20022300<br />
| N/A<br />
| N/A<br />
| N/A<br />
| [[New_3DS]] [[Health and Safety Information]]<br />
| [[8.1.0-0_New3DS|v2]], [[9.3.0-21|v17]]<br />
| [[8.1.0-0_New3DS|v1]]<br />
| Same as EUR.<br />
| N/A<br />
| N/A<br />
| N/A<br />
| Active<br />
|-<br />
| 00020400<br />
| 00021400<br />
| 00022400<br />
| 00026400<br />
| 00027400<br />
| 00028400<br />
| [[Nintendo 3DS Camera]] (CtrApp)<br />
| [[1.0.0-0|v0]], [[2.1.0-4|v16]], [[3.0.0-5|v1038]], [[4.0.0-7|v2048]], [[6.0.0-11|v3073]], [[9.0.0-20|v4097]](Also for [[8.1.0-0_New3DS]])<br />
| [[1.0.0-0|v0]], [[2.1.0-4|v16]], [[3.0.0-5|v1039]], [[4.0.0-7|v2048]], [[6.0.0-11|v3073]], [[7.0.0-13|v3088]], [[9.0.0-20|v4097]]<br />
| [[1.0.0-0|v0]], [[2.1.0-4|v16]], [[3.0.0-5|v1039]], [[4.0.0-7|v2048]], [[6.1.0-12U|v3074]], [[7.0.0-13|v3088]], [[9.0.0-20|v4097]]<br />
| [[4.0.0-7|v3]]<br />
| [[4.0.0-7|v2]], [[7.0.0-13|v1040]]<br />
| [[4.1.0-8|v3]]<br />
| Active<br />
|-<br />
| 00020500<br />
| 00021500<br />
| 00022500<br />
| 00026500<br />
| 00027500<br />
| 00028500<br />
| [[Nintendo 3DS Sound]] (CtrApp)<br />
| [[1.0.0-0|v0]], [[2.1.0-4|v1027]], [[3.0.0-5|v2049]], [[4.0.0-7|v3072]], [[7.0.0-13|v3089]]<br />
| [[1.0.0-0|v0]], [[2.1.0-4|v1027]], [[3.0.0-5|v2049]], [[4.0.0-7|v3072]], [[7.0.0-13|v3088]]<br />
| [[1.0.0-0|v0]], [[2.1.0-4|v1027]], [[3.0.0-5|v2049]], [[4.0.0-7|v3072]], [[7.0.0-13|v3088]]<br />
| [[4.0.0-7|v2]]<br />
| [[4.0.0-7|v2]], [[7.0.0-13|v16]]<br />
| [[4.1.0-8|v3]]<br />
| Active<br />
|-<br />
| 00020700<br />
| 00021700<br />
| 00022700<br />
| 00026700<br />
| 00027700<br />
| 00028700<br />
| [[Mii Maker]] (EDIT)<br />
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[7.0.0-13|v2055]]<br />
| Same as JPN<br />
| Same as JPN<br />
| [[4.0.0-7|v1]]<br />
| [[4.0.0-7|v1]], [[7.0.0-13|v16]]<br />
| [[4.1.0-8|v2]]<br />
| Active<br />
|-<br />
| 00020800<br />
| 00021800<br />
| 00022800<br />
| 00026800<br />
| 00027800<br />
| 00028800<br />
| [[StreetPass Mii Plaza]] (MEET)<br />
| [[1.0.0-0|v0]], v1027, [[2.1.0-4|v2048]], [[3.0.0-5|v3087]], [[3.0.0-6|v4096]], [[6.0.0-11|v5121]]<br />
| [[1.0.0-0|v0]], v1027, [[2.1.0-4|v2048]], [[3.0.0-5|v3087]], [[3.0.0-6|v4096]], [[6.0.0-11|v5122]]<br />
| [[1.0.0-0|v0]], v1027, [[2.1.0-4|v2048]], [[3.0.0-5|v3087]], [[3.0.0-6|v4096]], [[6.1.0-12U|v5124]], [[7.0.0-13|v5136]]<br />
| [[4.0.0-7|v0]], [[4.4.0-10|v4096]]<br />
| [[4.0.0-7|v1]], [[4.4.0-10|v4096]], [[7.0.0-13|v5120]]<br />
| [[4.1.0-8|v1]], [[4.4.0-10|v4096]]<br />
| Active<br />
|-<br />
| 00020900<br />
| 00021900<br />
| 00022900<br />
| N/A<br />
| 00027900<br />
| 00028900<br />
| [[eShop]] (tiger)<br />
| [[2.0.0-2|v4]], [[2.1.0-3|v1026]], [[3.0.0-5|v2057]], [[4.0.0-7|v3081]], [[4.1.0-8|v4096]], [[4.2.0-9|v5123]], [[4.3.0-10|v6146]], [[5.0.0-11|v7169]], [[7.0.0-13|v8206]], [[7.1.0-14|v9231]], [[7.2.0-17|v10245]], [[8.0.0-18|v11265]], [[8.1.0-19|v12288]], [[9.0.0-20|v13320]], [[9.3.0-21|v15366]], [[9.5.0-22|v16384]]<br />
| [[2.0.0-2|v4]], [[2.1.0-3|v1026]], [[3.0.0-5|v2058]], [[4.0.0-7|v3081]], [[4.1.0-8|v4096]], [[4.2.0-9|v5123]], [[4.3.0-10|v6146]], [[5.0.0-11|v7171]], [[7.0.0-13|v8206]], [[7.1.0-14|v9231]], [[7.2.0-17|v10245]], [[8.0.0-18|v11265]], [[8.1.0-19|v12288]], [[9.0.0-20|v13321]], [[9.3.0-21|v15366]], [[9.5.0-22|v16384]]<br />
| [[2.0.0-2|v4]], [[2.1.0-3|v1026]], [[3.0.0-5|v2058]], [[4.0.0-7|v3081]], [[4.1.0-8|v4096]], [[4.2.0-9|v5123]], [[4.3.0-10|v6146]], [[5.0.0-11|v7170]], [[7.0.0-13|v8206]], [[7.1.0-14|v9231]], [[7.2.0-17|v10246]], [[8.0.0-18|v11265]], [[8.1.0-19|v12288]], [[9.0.0-20|v13320]], [[9.3.0-21|v15366]], [[9.5.0-22|v16384]]<br />
| N/A<br />
| [[4.0.0-7|v3082]], [[4.1.0-8|v4096]], [[4.2.0-9|v5123]], [[4.3.0-10|v6146]], [[5.0.0-11|v7169]], [[7.0.0-13|v8205]], [[7.1.0-14|v9231]], [[8.1.0-19|v12288]], [[9.0.0-20|v13320]], [[9.3.0-21|v15366]], [[9.5.0-22|v16384]]<br />
| [[4.1.0-8|v4096]], [[4.2.0-9|v5123]], [[4.3.0-10|v6146]], [[5.0.0-11|v7170]], [[7.0.0-13|v8205]], [[7.1.0-14|v9231]], [[8.1.0-19|v12288]], [[9.3.0-21|v15366]], [[9.5.0-22|v16384]]<br />
| Active<br />
|-<br />
| 00020A00<br />
| 00021A00<br />
| 00022A00<br />
| N/A<br />
| 00027A00<br />
| 00028A00<br />
| [[System Transfer]] (CARDBOARD)<br />
| [[2.0.0-2|v4]], [[3.0.0-5|v1035]], [[4.0.0-7|v2050]], [[5.0.0-11|v3074]], [[7.0.0-13|v4109]], [[9.0.0-20|v5130]]<br />
| [[2.0.0-2|v4]], [[3.0.0-5|v1035]], [[4.0.0-7|v2050]], [[5.0.0-11|v3073]], [[7.0.0-13|v4109]], [[9.0.0-20|v5131]]<br />
| [[2.0.0-2|v4]], [[3.0.0-5|v1035]], [[4.0.0-7|v2051]], [[5.0.0-11|v3073]], [[7.0.0-13|v4109]], [[9.0.0-20|v5131]]<br />
| N/A<br />
| [[4.0.0-7|v2]], [[5.0.0-11|v1025]], [[7.0.0-13|v2061]], [[9.0.0-20|v3082]]<br />
| [[4.1.0-8|v2]], [[5.0.0-11|v1025]], [[7.0.0-13|v2061]]<br />
| Active<br />
|-<br />
| 00020B00<br />
| 00021B00<br />
| 00022B00<br />
| N/A<br />
| N/A<br />
| N/A<br />
| [[Nintendo Zone]] ("Nintendo")<br />
| [[1.0.0-0|v0]], [[3.0.0-5|v1034]]<br />
| Same as JPN<br />
| Same as JPN<br />
| N/A<br />
| N/A<br />
| N/A<br />
| Active<br />
|-<br />
| 00020D00<br />
| 00021D00<br />
| 00022D00<br />
| 00026D00<br />
| 00027D00<br />
| 00028D00<br />
| [[Face Raiders]]<br />
| [[1.0.0-0|v0]], [[2.1.0-4|v1028]]<br />
| [[1.0.0-0|v0]], [[2.1.0-4|v1028]], [[7.0.0-13|v1040]]<br />
| Same as EUR<br />
| [[4.0.0-7|v0]]<br />
| [[4.0.0-7|v0]]<br />
| [[4.1.0-8|v2]]<br />
| Active<br />
|-<br />
| 20020D00<br />
| 20021D00<br />
| 20022D00<br />
| N/A<br />
| N/A<br />
| N/A<br />
| [[New_3DS]] [[Face Raiders]]<br />
| [[8.1.0-0_New3DS|v2050]]<br />
| [[8.1.0-0_New3DS|v2049]]<br />
| Same as EUR.<br />
| N/A<br />
| N/A<br />
| N/A<br />
| Active<br />
|-<br />
| 00020E00<br />
| 00021E00<br />
| 00022E00<br />
| 00026E00<br />
| 00027E00<br />
| 00028E00<br />
| [[AR Games]] (AR_ACT)<br />
| [[1.0.0-0|v0]], [[2.1.0-4|v1026]]<br />
| [[1.0.0-0|v0]], [[2.1.0-4|v1026]], [[7.0.0-13|v1040]]<br />
| [[1.0.0-0|v0]], [[2.1.0-4|v1027]], [[7.0.0-13|v1040]]<br />
| [[4.0.0-7|v0]]<br />
| [[4.0.0-7|v0]], [[7.0.0-13|v16]]<br />
| [[4.1.0-8|v1]]<br />
| Active<br />
|-<br />
| 00020F00<br />
| 00021F00<br />
| 00022F00<br />
| 00026F00<br />
| 00027F00<br />
| 00028F00<br />
| SAFE_MODE [[System Settings#System Updater|System Updater]] (mset)<br />
| [[1.0.0-0|v0]], [[3.0.0-5|v1024]], [[6.0.0-11|v2049]]<br />
| [[1.0.0-0|v0]], [[3.0.0-5|v1024]], [[6.0.0-11|v2050]]<br />
| Same as JPN<br />
| [[4.0.0-7|v1]], [[6.0.0-11|v1026]]<br />
| [[4.0.0-7|v1]]<br />
| [[4.1.0-8|v1]]<br />
| Active<br />
|-<br />
| 00023000<br />
| 00024000<br />
| 00025000<br />
| N/A<br />
| N/A<br />
| N/A<br />
| Promotional video<br />
| [[1.1.0-1|v2]], [[2.0.0-2|v2048]]<br />
| [[1.1.0-1|v<unknown>]], [[2.0.0-2|v2048]]<br />
| [[1.1.0-1|v0]], [[2.0.0-2|v2048]]<br />
| N/A<br />
| N/A<br />
| N/A<br />
| Stubbed<br />
|-<br />
| 0002BF00<br />
| 0002C000<br />
| 0002C100<br />
| N/A<br />
| N/A<br />
| N/A<br />
| Nintendo Network ID Settings (act)<br />
| [[7.0.0-13|v14]], [[7.2.0-17|v1029]], [[9.0.0-20|v2051]], [[9.3.0-21|v3072]]<br />
| Same as JPN<br />
| Same as JPN<br />
| N/A<br />
| N/A<br />
| N/A<br />
| Active<br />
|-<br />
| 20023100<br />
| 20024100<br />
| 20025100<br />
| N/A<br />
| N/A<br />
| N/A<br />
| [[microSD Management]] ('mcopy') ([[New_3DS]]-only)<br />
| [[8.1.0-0_New3DS|v8]], [[9.0.0-20|v1024]]<br />
| [[8.1.0-0_New3DS|v4]]<br />
| [[8.1.0-0_New3DS|v5]]<br />
| N/A<br />
| N/A<br />
| N/A<br />
| Available<br />
|-<br />
| 2002C800<br />
| 2002CF00<br />
| 2002D000<br />
| N/A<br />
| N/A<br />
| N/A<br />
| [[New_3DS]]-only, currently stubbed. Placeholder exheader name is "menu".<br />
| [[8.1.0-0_New3DS|v2]], [[9.0.0-20|v18]], [[9.3.0-21|v34]]<br />
| [[8.1.0-0_New3DS|v1]], [[9.3.0-21|v17]]<br />
| [[8.1.0-0_New3DS|v1]], [[9.3.0-21|v18]]<br />
| N/A<br />
| N/A<br />
| N/A<br />
| Stubbed<br />
|-<br />
| 2002C900<br />
| 2002D100<br />
| 2002D200<br />
| N/A<br />
| N/A<br />
| N/A<br />
| [[New_3DS]]-only, currently stubbed. Placeholder exheader name is "friend".<br />
| [[8.1.0-0_New3DS|v1]]<br />
| Same as JPN.<br />
| [[8.1.0-0_New3DS|v0]], [[9.3.0-21|v16]]<br />
| N/A<br />
| N/A<br />
| N/A<br />
| Stubbed<br />
|-<br />
| 2002CA00<br />
| 2002D300<br />
| 2002D400<br />
| N/A<br />
| N/A<br />
| N/A<br />
| [[New_3DS]]-only, currently stubbed. Placeholder exheader name is "newslist".<br />
| [[8.1.0-0_New3DS|v0]], v1([[Home_Menu|JPN-only]] Oct 2, 2014 "sysupdate", actually uploaded on 09-29-14. Identical to v0, same TMDs besides title-versions)<br />
| [[8.1.0-0_New3DS|v2]]<br />
| [[8.1.0-0_New3DS|v0]]<br />
| N/A<br />
| N/A<br />
| N/A<br />
| Stubbed<br />
|-<br />
| 2002CB00<br />
| 2002D500<br />
| 2002D600<br />
| N/A<br />
| N/A<br />
| N/A<br />
| [[New_3DS]]-only, currently stubbed. Placeholder exheader name is "cherry".<br />
| [[8.1.0-0_New3DS|v0]], [[9.0.0-20|v1]]<br />
| [[8.1.0-0_New3DS|v2]]<br />
| Same as EUR.<br />
| N/A<br />
| N/A<br />
| N/A<br />
| Stubbed<br />
|}<br />
<br />
The "act" application seems to use a web browser with webkit?<br />
<br />
Regardless of version, the ExeFS:/.code for mset is the same for USA/EUR/JPN. The [[4.0.0-7]] version of mset([[4.1.0-8]] for TWN) has the same ExeFS:/.code for all regions(JPN, USA, EUR, CHN, KOR, TWN). The [[5.0.0-11]] mset ExeFS:/.code is the same for all regions as well, except for CHN. The [[7.0.0-13]] mset ExeFS:/.code is unique for the following regions: CHN, KOR, and TWN.<br />
<br />
=== 0004001B - [[NCCH#CFA|System Data Archives]] ===<br />
{| class="wikitable" border="1"<br />
|-<br />
! TitleID Low<br />
! Description<br />
! Versions<br />
|-<br />
| 00010002<br />
| [[ClCertA]]<br />
| [[1.0.0-0|v0]]<br />
|-<br />
| 00010702<br />
| [[NS CFA]]<br />
| [[3.0.0-5|v0]], [[6.0.0-11|v1028]], [[6.3.0-12|v2048]], [[7.0.0-13|v3073]], [[9.0.0-20|v4096]](also for [[8.1.0-0_New3DS]])<br />
|-<br />
| 00010802<br />
| This CFA only contains a 1-byte "dummy.txt" in the RomFS, which contains '0'.<br />
| [[6.3.0-12|v0]], [[9.5.0-23|v1024]]<br />
|-<br />
| 00018002<br />
| Same contents as 00010802. Starting with [[7.1.0-15]], the "dummy.txt" file was removed from RomFS: this CFA RomFS now contains web-browser data(similar to 00018102) for NNID / networking, etc.<br />
| [[7.0.0-13|v14]], [[7.1.0-15|v1025]], [[7.2.0-17|v2055]], [[9.0.0-20|v3078]], [[9.3.0-21|v4096]]<br />
|-<br />
| 00018102<br />
| This contains local web-browser data(html/js, gfx, etc) for the Miiverse Offline-mode.<br />
| [[7.0.0-13|v11]], [[9.0.0-20|v1025]](also for [[8.1.0-0_New3DS]])<br />
|-<br />
| 00018202<br />
| This contains the webkit/OSS [[CRO0|CROs]] used with the Miiverse applet and the "act" application.<br />
| [[7.0.0-13|v7]], [[8.1.0-0_New3DS|v1026]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v2050]]<br />
|-<br />
| 00019002<br />
| [[Fangate_updater]]<br />
| [[9.3.0-21|v2]]<br />
|}<br />
<br />
=== 00040030 - Applets===<br />
{| class="wikitable" border="1"<br />
|-<br />
! JPN TitleIDLow<br />
! USA TitleIDLow<br />
! EUR TitleIDLow<br />
! Description<br />
! JPN Versions<br />
! USA Versions<br />
! EUR Versions<br />
|-<br />
| 00008102<br />
| 00008102<br />
| 00008102<br />
| [[NS#Alternate menu|Alternate menu]]<br />
| N/A<br />
|-<br />
| 00008202<br />
| 00008F02<br />
| 00009802<br />
| [[Home Menu|SYSMENU]] (menu)<br />
| v0, v1029, v2049, [[2.2.0-X|v3075]], v4111, v5131, [[4.2.0-9|v6146]], [[5.0.0-11|v7172]], [[6.0.0-11|v8198]], [[7.0.0-13|v9230]], [[8.1.0-0_New3DS|v10250]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v13313]], [[9.1.0-20J|v14336]], [[9.2.0-20|v15360]], [[9.3.0-21|v16402]], [[9.4.0-21|v17408]], [[9.5.0-22|v18432]]<br />
| v0, v1029, v2049, [[2.2.0-X|v3075]], v4111, v5131, [[4.2.0-9|v6146]], [[5.0.0-11|v7172]], [[6.0.0-11|v8198]], [[7.0.0-13|v9230]], [[8.1.0-0_New3DS|v10250]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v11272]], [[9.2.0-20|v12288]], [[9.3.0-21|v13330]], [[9.4.0-21|v14336]], [[9.5.0-22|v15360]]<br />
| v0, v1029, v2049, [[2.2.0-X|v3075]], v4111, v5131, [[4.2.0-9|v6146]], [[5.0.0-11|v7172]], [[6.0.0-11|v8198]], [[7.0.0-13|v9230]], [[8.1.0-0_New3DS|v10250]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v11272]], [[9.2.0-20|v12288]], [[9.3.0-21|v13330]], [[9.4.0-21|v14336]], [[9.5.0-22|v15360]]<br />
|-<br />
| 00008402<br />
| 00009002<br />
| 00009902<br />
| Camera applet used by Home-menu (CtrApp)<br />
| v0, v1036, [[9.0.0-20|v2049]](Also for [[8.1.0-0_New3DS]])<br />
| Same as JPN<br />
| Same as JPN<br />
|-<br />
| 00008502<br />
| 00009102<br />
| 00009A02<br />
| Not available on CDN<br />
| ?<br />
| <br />
| <br />
|-<br />
| 00008602<br />
| 00009202<br />
| 00009B02<br />
| Instruction Manual, applet for displaying instruction manuals<br />
| v0, v1026, v2048, v3072, [[5.0.0-11|v4097]], [[9.0.0-20|v5120]](Also for [[8.1.0-0_New3DS]])<br />
| Same as JPN<br />
|-<br />
| 00008702<br />
| 00009302<br />
| 00009C02<br />
| Game Notes (Cherry)<br />
| v0, v1026, v2049, [[5.0.0-11|v3073]], [[9.0.0-20|v4096]](Also for [[8.1.0-0_New3DS]])<br />
| Same as JPN<br />
| Same as JPN<br />
|-<br />
| 00008802<br />
| 00009402<br />
| 00009D02<br />
| [[Internet Browser]] (spider)<br />
| [[2.0.0-2|v6]], [[2.1.0-4|v1024]], [[4.0.0-7|v2050]], [[5.0.0-11|v3074 (EUR)/v3075(USA,JAP)]], [[7.0.0-13|v3088]], [[7.1.0-16|v4096]], [[9.5.0-23|v5121]]<br />
| Same as JPN<br />
| Same as JPN<br />
|-<br />
| 20008802<br />
| 20009402<br />
| 20009D02<br />
| [[New_3DS]] [[Internet Browser]] (SKATER)<br />
| [[8.1.0-0_New3DS|v10]], [[9.3.0-21|v1027]]<br />
| Same as JPN<br />
| Same as JPN<br />
|-<br />
| 00008A02<br />
| 00008A02<br />
| 00008A02<br />
| [[ErrDisp]]<br />
| v0, v1025, [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[5.0.0-11|v5121]], [[8.0.0-18|v6144]], [[9.0.0-20|v7168]](Also for [[8.1.0-0_New3DS]])<br />
| Same as JPN<br />
| Same as JPN<br />
|-<br />
| 00008A03<br />
| 00008A03<br />
| 00008A03<br />
| SAFE_MODE [[ErrDisp]]<br />
| v0<br />
| Same as JPN<br />
| Same as JPN<br />
|-<br />
| 20008A03<br />
| 20008A03<br />
| 20008A03<br />
| [[New_3DS]] SAFE_MODE [[ErrDisp]]<br />
| [[8.1.0-0_New3DS|v7169]]<br />
| Same as JPN<br />
| Same as JPN<br />
|-<br />
| 00008D02<br />
| 00009602<br />
| 00009F02<br />
| Friend List (friend)<br />
| v0, v1026, [[2.2.0-X|v2051]], v3082, v4099, [[7.0.0-13|v5120]], [[9.0.0-20|v6144]](Also for [[8.1.0-0_New3DS]]) (EUR v6, v1024, v3082, v4099, [[7.0.0-13|v5120]], [[9.0.0-20|v6144]])<br />
| Same as JPN<br />
| Same as JPN<br />
|-<br />
| 00008E02<br />
| 00009702<br />
| 0000A002<br />
| Notifications (newslist)<br />
| v0, v1029, v2054, v3075, [[9.0.0-20|v4097]] (EUR v6, v1024, v2054, v3075, [[9.0.0-20|v4097]]) (JPN: ..., [[8.1.0-0_New3DS|v4096]], [[9.0.0-20|v5121]])<br />
| Same as JPN<br />
| Same as JPN<br />
|-<br />
| 0000C002<br />
| 0000C802<br />
| 0000D002<br />
| Software Keyboard (swkbd)<br />
| v0, v1026, v2053, [[7.0.0-13|v3072]], [[9.0.0-20|v4096]](Also for [[8.1.0-0_New3DS]])<br />
| Same as JPN<br />
| Same as JPN<br />
|-<br />
| 0000C003<br />
| 0000C803<br />
| 0000D003<br />
| SAFE_MODE Software Keyboard (swkbd)<br />
| v0<br />
| Same as JPN<br />
| Same as JPN<br />
|-<br />
| 2000C003<br />
| 2000C803<br />
| 2000D003<br />
| [[New_3DS]] SAFE_MODE Software Keyboard (swkbd)<br />
| [[8.1.0-0_New3DS|v0]](for JPN this is v1024)<br />
| Same as JPN<br />
| Same as JPN<br />
|-<br />
| 0000C102<br />
| 0000C902<br />
| 0000D102<br />
| appletEd<br />
| v0, v1026, [[9.0.0-20|v2048]](Also for [[8.1.0-0_New3DS]]), [[9.3.0-21|v3077]]<br />
| Same as JPN<br />
| Same as JPN<br />
|-<br />
| 0000C302<br />
| 0000CB02<br />
| 0000D302<br />
| PNOTE_AP (Photo file selector applet, for SD-card/etc?)<br />
| v0, v1024, [[8.1.0-0_New3DS|v2049]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v3075]], [[9.3.0-21|v4096]]<br />
| Same as JPN<br />
| Same as JPN<br />
|-<br />
| 0000C402<br />
| 0000CC02<br />
| 0000D402<br />
| SNOTE_AP (Sound file selector applet, for SD-card/etc?)<br />
| v0, v3, [[8.0.0-18|v1026]], [[9.0.0-20|v2048]](Also for [[8.1.0-0_New3DS]])<br />
| Same as JPN<br />
| Same as JPN<br />
|-<br />
| 0000C502<br />
| 0000C502<br />
| 0000C502<br />
| error (This applet displays networking errors, etc)<br />
| v0, v1026, v2053, v3074, [[8.1.0-0_New3DS|v4096]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v5128]]<br />
| Same as JPN<br />
| Same as JPN<br />
|-<br />
| 0000C503<br />
| 0000C503<br />
| 0000C503<br />
| SAFE_MODE error applet<br />
| v0<br />
| Same as JPN<br />
| Same as JPN<br />
|-<br />
| 2000C503<br />
| 2000C503<br />
| 2000C503<br />
| [[New_3DS]] SAFE_MODE error applet<br />
| [[8.1.0-0_New3DS|v1024]]<br />
| Same as JPN<br />
| Same as JPN<br />
|-<br />
| 0000CD02<br />
| 0000CD02<br />
| 0000CD02<br />
| extrapad ([[Circle Pad Pro]] calibration applet)<br />
| v1, v1026, [[8.1.0-0_New3DS|v2048]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v3073]]<br />
| Same as JPN<br />
| Same as JPN<br />
|-<br />
| 0000C602<br />
| 0000CE02<br />
| 0000D602<br />
| mint. eShop applet, used by applications for accessing the eShop, for DLC/etc. Also used by the eShop application itself.<br />
| v5, v1028, [[4.2.0-9|v2050]], [[5.0.0-11|v3072]], [[7.0.0-13|v4109]], [[7.2.0-17|v5125]](v5123 for JPN), [[8.0.0-18|v6145]], [[8.1.0-0_New3DS|v7168]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v8200]], [[9.3.0-21|v9224]]<br />
| Same as JPN<br />
| Same as JPN<br />
|-<br />
| 0000BC02<br />
| 0000BD02<br />
| 0000BE02<br />
| olv (Miiverse applet)<br />
| [[7.0.0-13|v14]], [[7.2.0-17|v1024]], [[9.0.0-20|v2048]](Also for [[8.1.0-0_New3DS]]), [[9.3.0-21|v3072]]<br />
| Same as JPN<br />
| Same as JPN<br />
|-<br />
| 0000F602<br />
| 0000F602<br />
| 0000F602<br />
| memolib (Uses Miiverse, likely the "system library" for Miiverse)<br />
| [[7.0.0-13|v5]], [[8.1.0-0_New3DS|v1024]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v2050]], [[9.3.0-21|v3072]]<br />
| Same as JPN<br />
| Same as JPN<br />
|-<br />
| 00008302<br />
| 00008B02<br />
| 0000BA02<br />
| solv3 (Miiverse-posting applet)<br />
| [[9.0.0-20|v6]]<br />
| Same as JPN<br />
| Same as JPN<br />
|-<br />
| 00009502<br />
| 00009E02<br />
| 0000B902<br />
| Cabinet ([[amiibo Settings]])<br />
| [[9.3.0-21|v7]], [[9.6.0-24|v1031]]<br />
| Same as JPN<br />
| Same as JPN<br />
|}<br />
<br />
Most of these processes are applets. There can only be one application here(Home Menu, Internet Browser, Friend-List, etc) with programID-high 00040030 running at a time. When directly launching one of these 00040030 applications with Home Menu, the Home Menu process will terminate once the process is launched. When returning to Home Menu from that launched process, the Home Menu process is launched again.<br />
<br />
All of the above processes use the "SYSTEM" [[SVC|memory-region]].<br />
<br />
The ExeFS for Home Menu is exactly the same for USA/EUR/JPN.<br />
<br />
The Miiverse applet seems to use a web browser with webkit.<br />
<br />
=== 0004009B - [[NCCH#CFA|System Data Archives]] (Shared Archives) ===<br />
{| class="wikitable" border="1"<br />
|-<br />
! JPN TitleIDLow<br />
! USA TitleIDLow<br />
! EUR TitleIDLow<br />
! Description<br />
! Versions<br />
|-<br />
| 00010202<br />
| 00010202<br />
| 00010202<br />
| Probably Mii-related, contains "CFL_Res.dat" in the RomFS.<br />
| v0<br />
|-<br />
| 00010302<br />
| 00010302<br />
| 00010302<br />
| Doesn't exist on CDN?<br />
| v0, v2052<br />
|-<br />
| 00010402<br />
| 00010402<br />
| 00010402<br />
| Mounted as "area:", contains Country and Region names<br />
| v0, v1024, v2050, v3072, [[7.0.0-13|v4098]]<br />
|-<br />
| 00010502<br />
| 00010502<br />
| 00010502<br />
| Doesn't exist on CDN?<br />
| v0, v1024, v2048<br />
|-<br />
| 00010602<br />
| 00010602<br />
| 00010602<br />
| Non-Nintendo TLS Root-CA Certificates (RomFS contains files with filename "CACERT_PUBLIC_CA_<val>.der", where <val> is 5..8)<br />
| v2<br />
|-<br />
| 00011902<br />
| ?<br />
| ?<br />
| ?<br />
| v0<br />
|-<br />
| ?<br />
| 00011402<br />
| ?<br />
| ?<br />
| v0<br />
|-<br />
| ?<br />
| 00011602<br />
| ?<br />
| ?<br />
| v0<br />
|-<br />
| ?<br />
| 00011D02<br />
| ?<br />
| ?<br />
| v0<br />
|-<br />
| ?<br />
| 00011E02<br />
| ?<br />
| ?<br />
| v0<br />
|-<br />
| ?<br />
| ?<br />
| 00011202<br />
| ?<br />
| v0<br />
|-<br />
| ?<br />
| ?<br />
| 00011302<br />
| ?<br />
| v0<br />
|-<br />
| ?<br />
| ?<br />
| 00011502<br />
| ?<br />
| v0<br />
|-<br />
| ?<br />
| ?<br />
| 00011702<br />
| ?<br />
| v0<br />
|-<br />
| ?<br />
| ?<br />
| 00011802<br />
| ?<br />
| v0<br />
|-<br />
| 00011902<br />
| ?<br />
| ?<br />
| ?<br />
| v0<br />
|-<br />
| ?<br />
| ?<br />
| 00011B02<br />
| ?<br />
| v0<br />
|-<br />
| ?<br />
| ?<br />
| 00011C02<br />
| ?<br />
| v0<br />
|-<br />
| ?<br />
| ?<br />
| 00011D02<br />
| ?<br />
| v0<br />
|-<br />
| ?<br />
| ?<br />
| 00012102<br />
| ?<br />
| v0, v1026, v2051, v3074<br />
|-<br />
| 00012202<br />
| 00012302<br />
| 00012102<br />
| ?contains a lists with error strings<br />
| v1026, v2053, v3073, [[4.2.0-9|v4096]], [[5.0.0-11|v5120]], [[7.0.0-13|v6149]], [[7.2.0-17|v7168]], [[8.0.0-18|v8192]], [[9.0.0-20|v9218]], [[9.3.0-21|v10242]]<br />
|-<br />
| 00013202<br />
| 00013302<br />
| 00013102<br />
| Mounted as "eula:"<br />
| v0, v1024, v2049 USA: v1024, v2051, [[7.0.0-13|v3074]], [[7.2.0-17|v4100]](EUR-only), [[9.0.0-20|v4099]]<br />
|-<br />
| 00014002<br />
| 00014002<br />
| 00014002<br />
| JPN/EUR/USA System Font ("font:")<br />
| v0<br />
|-<br />
| 00014102<br />
| 00014102<br />
| 00014102<br />
| CHN System Font ("font:")<br />
| v0, v1024<br />
|-<br />
| 00014202<br />
| 00014202<br />
| 00014202<br />
| KOR System Font ("font:")<br />
| v0, v1024<br />
|-<br />
| 00014302<br />
| 00014302<br />
| 00014302<br />
| TWN System Font ("font:")<br />
| v0, v1024<br />
|-<br />
| 00015202<br />
| 00015302<br />
| 00015102<br />
| Mounted as "rate:"<br />
| v0 (EUR: v0, v1024)<br />
|-<br />
| ?<br />
| 00016302<br />
| ?<br />
| ?<br />
| v80<br />
|-<br />
| ?<br />
| 00017302<br />
| ?<br />
| ?<br />
| v3088<br />
|}<br />
<br />
=== 000400DB - [[NCCH#CFA|System Data Archives]] ===<br />
These [[NVer]] titleIDs can be found @ offset 0x320 in every [[CCI]].<br />
<br />
{| class="wikitable" border="1"<br />
|-<br />
! EUR TitleIDLow<br />
! JPN TitleIDLow<br />
! USA TitleIDLow<br />
! CHN TitleIDLow<br />
! KOR TitleIDLow<br />
! TWN TitleIDLow<br />
! Description<br />
! USA/EUR/JPN Versions<br />
! CHN Versions<br />
! TWN Versions<br />
! KOR Versions<br />
|-<br />
| 00010302<br />
| 00010302<br />
| 00010302<br />
| 00010302<br />
| 00010302<br />
| 00010302<br />
| NGWord bad word list<br />
| [[1.0.0-0|v0]], [[2.0.0-2|v1024]], [[3.0.0-5|v2052]], [[4.0.0-7|v3072]], [[4.3.0-10|v4096]], [[5.0.0-11|v5120]], [[9.0.0-20|v6144]], [[9.3.0-21|v7168]]<br />
| Same as USA<br />
| Same as USA<br />
| Same as USA<br />
|-<br />
| 00010502<br />
| 00010502<br />
| 00010502<br />
| 00010502<br />
| 00010502<br />
| 00010502<br />
| [[Nintendo Zone]] hotspot list<br />
| [[1.0.0-0|v0]], [[2.0.0-2|v1024]], [[3.0.0-5|v2048]], [[4.0.0-7|v3073]], [[4.3.0-10|v4096]], [[4.4.0-10|v5120]], [[4.5.0-10|v6144]], [[5.0.0-11|v7169]], [[6.0.0-11|v8192]], [[6.2.0-12|v9216]], [[7.0.0-13|v10242]], [[7.2.0-17|v11267]], [[8.0.0-18|v12288]], [[9.0.0-20|v14336]], [[9.3.0-21|v15360]]<br />
| Same as USA<br />
| Same as USA<br />
| Same as USA<br />
|-<br />
| 00016102<br />
| 00016202<br />
| 00016302<br />
| 00016402<br />
| 00016502<br />
| 00016602<br />
| [[NVer]]<br />
| [[1.0.0-0|v0]], [[1.1.0-1|v16]], [[2.0.0-2|v32]], [[2.1.0-3|v48]], [[2.1.0-4|v64]], [[3.0.0-5|v80]], [[3.0.0-6|v96]], [[4.0.0-7|v112]], [[4.1.0-8|v128]], [[4.2.0-9|v144]], [[4.3.0-10|v160]], [[5.0.0-11|v176]], non-USA=[[6.0.0-11|v192]]/USA=[[6.1.0-12U|v192]], [[7.0.0-13|v208]], [[7.1.0-14|v224]], [[7.1.0-15|v240]], [[7.1.0-16|v256]], [[7.2.0-17|v272]], [[8.0.0-18|v288]], [[8.1.0-19|v304]], [[9.0.0-20|v320]], [[9.3.0-21|v336]], [[9.5.0-22|v352]], [[9.5.0-23|v368]]<br />
| [[4.0.0-7|v113]], [[4.2.0-9|v128]], [[5.0.0-11|v129]], [[7.1.0-16|v130]], [[7.2.0-17|v272]], [[9.5.0-23|v131]]<br />
| [[4.1.0-8|v114]], [[4.2.0-9|v133]], [[4.3.0-10|v134]], [[5.0.0-11|v136]], [[7.0.0-13|v144]], [[7.1.0-14|v160]] [[7.1.0-16|v192]], [[7.2.0-17|v272]], [[8.0.0-18|v208]], [[8.1.0-19|v224]], [[9.0.0-20|v240]], [[9.5.0-22|v272]], [[9.5.0-23|v288]]<br />
| [[4.0.0-7|v113]], [[4.1.0-8|v114]], [[4.2.0-9|v133]], [[4.3.0-10|v134]], [[5.0.0-11|v136]], [[7.0.0-13|v160]], [[7.1.0-14|v176]], [[7.1.0-16|v176]], [[7.2.0-17|v272]], [[8.0.0-18|v224]], [[8.1.0-19|v240]], [[9.0.0-20|v256]], [[9.3.0-21|v272]], [[9.5.0-22|v288]], [[9.5.0-23|v304]]<br />
|-<br />
| 20016102<br />
| 20016202<br />
| 20016302<br />
| N/A<br />
| N/A<br />
| N/A<br />
| [[New_3DS]] [[NVer]]<br />
| [[8.1.0-0_New3DS|v0]], [[9.0.0-20|v320]], [[9.3.0-21|v336]], [[9.5.0-22|v352]], [[9.5.0-22|v352]], [[9.5.0-23|v368]]<br />
| N/A<br />
| N/A<br />
| N/A<br />
|-<br />
| 00017102<br />
| 00017202<br />
| 00017302<br />
| 00017402<br />
| 00017502<br />
| 00017602<br />
| [[CVer]]<br />
| [[1.0.0-0|v1024]], [[1.1.0-1|v1045]], [[2.0.0-2|v2049]], [[2.1.0-3|v2069]], [[2.2.0-X|v2088]] [[3.0.0-5|v3088]], [[4.0.0-7|v4098]], [[4.1.0-8|v4113]], [[4.2.0-9|v4130]], [[4.3.0-10|v4145]], [[4.4.0-10|v4163]], [[4.5.0-10|v4176]], [[5.0.0-11|v5120]], [[5.1.0-11|v5136]], [[6.0.0-11|v6146]], [[6.1.0-11|v6160]], [[6.2.0-12|v6178]], [[6.3.0-12|v6192]], [[7.0.0-13|v7175]], [[7.1.0-14|v7187]], [[7.2.0-17|v7203]], [[8.0.0-18|v8196]], [[8.1.0-18|v8208]], [[8.1.0-0_New3DS|v8215]](8.1.0-0_New3DS), [[9.0.0-20|v9218]], [[9.1.0-20J|v9232]](JPN-only), [[9.2.0-20|v9248]], [[9.3.0-21|v9264]], [[9.4.0-21|v9280]], [[9.5.0-22|v9296]]<br />
| [[1.0.0-0|v1024]], [[1.1.0-1|v1045]], [[2.0.0-2|v2049]], [[2.1.0-3|v2069]], [[2.2.0-X|v2088]] [[3.0.0-5|v3088]], [[4.0.0-7|v4098]], [[4.1.0-8|v4113]], [[4.2.0-9|v4130]], [[4.3.0-10|v4145]], [[4.4.0-10|v4163]], [[4.5.0-10|v4176]], [[5.0.0-11|v5120]], [[5.1.0-11|v5136]], [[6.0.0-11|v6146]], [[6.1.0-11|v6160]], [[6.2.0-12|v6178]], [[6.3.0-12|v6192]], [[7.0.0-13|v7175]], [[7.1.0-14|v7187]], [[7.2.0-17|v7203]], [[8.0.0-18|v8196]], [[8.1.0-18|v8208]], [[9.0.0-20|v9217]], [[9.3.0-21|v9264]], [[9.5.0-22|v9296]]<br />
| Same as CHN<br />
| Same as CHN<br />
|}<br />
<br />
=== 00040130 - System [[Services API|Modules]] ===<br />
{| class="wikitable" border="1"<br />
|-<br />
! TitleID Low<br />
! Description<br />
! Versions<br />
|-<br />
| 00001002<br />
| sm (Stored in [[FIRM|NATIVE_FIRM]])<br />
| N/A<br />
|-<br />
| 00001102<br />
| [[Filesystem services|fs]] (Stored in [[FIRM|NATIVE_FIRM]])<br />
| N/A<br />
|-<br />
| 00001202<br />
| [[Process Manager Services|pm]] (Stored in [[FIRM|NATIVE_FIRM]])<br />
| N/A<br />
|-<br />
| 00001302<br />
| loader (Stored in [[FIRM|NATIVE_FIRM]])<br />
| N/A<br />
|-<br />
| 00001402<br />
| pxi (Stored in [[FIRM|NATIVE_FIRM]])<br />
| N/A<br />
|-<br />
| 00001502<br />
| [[Application Manager Services|AM]] ( Application Manager )<br />
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[3.0.0-5|v2053]], [[4.0.0-7|v3072]], [[5.0.0-11|v4098]], [[6.0.0-11|v5120]], [[8.0.0-18|v6148]], [[8.1.0-0_New3DS|v7168]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v8192]]<br />
|-<br />
| 00001503<br />
| SAFE_MODE AM<br />
| [[1.0.0-0|v0]]<br />
|-<br />
| 20001503<br />
| [[New_3DS]] SAFE_MODE AM<br />
| [[8.1.0-0_New3DS|v7169]]<br />
|-<br />
| 00001602<br />
| Camera<br />
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[3.0.0-5|v2048]], [[4.0.0-7|v3074]], [[5.0.0-11|v4098]], [[6.0.0-11|v5120]], [[7.1.0-14|v6146]], [[8.0.0-18|v7172]], [[9.0.0-20|v9216]], [[9.3.0-21|v10242]]<br />
|-<br />
| 20001602<br />
| [[New_3DS]] Camera<br />
| [[8.1.0-0_New3DS|v8200]], [[9.0.0-20|v9218]], [[9.3.0-21|v10242]]<br />
|-<br />
| 00001702<br />
| [[Config Services|Config]] (cfg)<br />
| [[1.0.0-0|v0]], [[2.0.0-2|v1024]], [[3.0.0-5|v2049]], v3072, [[4.0.0-7|v4096]], [[5.0.0-11|v5122]], [[6.0.0-11|v6145]], [[6.1.0-11|v7168]], [[7.0.0-13|v8196]], [[7.2.0-17|v9220]], [[8.0.0-18|v10243]], [[8.1.0-0_New3DS|v11265]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v12290]], [[9.3.0-21|v13315]]<br />
|-<br />
| 00001703<br />
| SAFE_MODE Config (cfg)<br />
| [[1.0.0-0|v0]]<br />
|-<br />
| 20001703<br />
| [[New_3DS]] SAFE_MODE Config (cfg)<br />
| [[8.1.0-0_New3DS|v11265]]<br />
|-<br />
| 00001802<br />
| Codec<br />
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[5.0.0-11|v4098]], [[7.0.0-13|v5120]], [[8.0.0-18|v6144]], [[9.0.0-20|v7168]](Also for [[8.1.0-0_New3DS]])<br />
|-<br />
| 00001803<br />
| SAFE_MODE Codec<br />
| [[1.0.0-0|v0]]<br />
|-<br />
| 20001803<br />
| [[New_3DS]] SAFE_MODE Codec<br />
| [[8.1.0-0_New3DS|v7169]]<br />
|-<br />
| 00001902<br />
| dmnt, debugger sysmodule. This use devunit-only HIO for devunit<>pc comms. This only exists for development units(launched by NS during startup depending on certain [[Configuration_Memory]] fields' values). This is installed at the [[Factory_Setup|factory]], then later deleted at the factory on retail units.<br />
| <br />
|-<br />
| 00001A02<br />
| DSP<br />
| [[1.0.0-0|v0]], [[3.0.0-5|v1024]], [[4.0.0-7|v2048]], [[5.0.0-11|v3074]], [[6.0.0-11|v4096]], [[8.0.0-18|v5120]]<br />
|-<br />
| 00001A03<br />
| SAFE_MODE DSP<br />
| [[1.0.0-0|v0]]<br />
|-<br />
| 20001A03<br />
| [[New_3DS]] SAFE_MODE DSP<br />
| [[8.1.0-0_New3DS|v6145]]<br />
|-<br />
| 00001B02<br />
| GPIO<br />
| [[1.0.0-0|v0]], [[5.0.0-11|v1025]], [[8.0.0-18|v2048]], [[9.5.0-22|v3073]]<br />
|-<br />
| 00001B03<br />
| SAFE_MODE GPIO<br />
| [[1.0.0-0|v0]]<br />
|-<br />
| 20001B03<br />
| [[New_3DS]] SAFE_MODE GPIO<br />
| [[8.1.0-0_New3DS|v3073]]<br />
|-<br />
| 00001C02<br />
| GSP<br />
| [[1.0.0-0|v0]], [[1.1.0-1|v1040]], [[2.0.0-2|v2049]], [[3.0.0-5|v3075]], v4098, [[4.0.0-7|v5120]], [[5.0.0-11|v6145]], [[6.0.0-11|v7168]], [[8.0.0-18|v8196]], [[9.0.0-20|v10240]], [[9.3.0-21|v11264]]<br />
|-<br />
| 20001C02<br />
| [[New_3DS]] GSP<br />
| [[8.1.0-0_New3DS|v10243]], [[9.3.0-21|v11267]]<br />
|-<br />
| 00001C03<br />
| SAFE_MODE GSP<br />
| [[1.0.0-0|v0]]<br />
|-<br />
| 20001C03<br />
| [[New_3DS]] SAFE_MODE GSP<br />
| [[8.1.0-0_New3DS|v9217]]<br />
|-<br />
| 00001D02<br />
| HID (Human Interface Devices) <br />
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[5.0.0-11|v5121]], [[7.2.0-17|v6148]], [[8.0.0-18|v7168]], [[8.1.0-0_New3DS|v8192]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v9216]], [[9.3.0-21|v10240]]<br />
|-<br />
| 00001D03<br />
| SAFE_MODE HID<br />
| [[1.0.0-0|v0]]<br />
|-<br />
| 20001D03<br />
| [[New_3DS]] SAFE_MODE HID<br />
| [[8.1.0-0_New3DS|v8193]]<br />
|-<br />
| 00001E02<br />
| i2c<br />
| [[1.0.0-0|v0]], [[3.0.0-5|v1024]], [[5.0.0-11|v2049]], [[8.0.0-18|v3076]], [[9.3.0-21|v5120]]<br />
|-<br />
| 20001E02<br />
| [[New_3DS]] i2c<br />
| [[8.1.0-0_New3DS|v4096]], [[9.3.0-21|v5121]]<br />
|- <br />
| 00001E03<br />
| SAFE_MODE i2c<br />
| [[1.0.0-0|v0]]<br />
|- <br />
| 20001E03<br />
| [[New_3DS]] SAFE_MODE i2c<br />
| [[8.1.0-0_New3DS|v4097]]<br />
|-<br />
| 00001F02<br />
| MCU<br />
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.1.0-3|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4102]], [[5.0.0-11|v5122]], [[6.0.0-11|v6145]], [[7.0.0-13|v7168]], [[8.0.0-18|v8192]]<br />
|-<br />
| 20001F02<br />
| [[New_3DS]] MCU<br />
| [[8.1.0-0_New3DS|v8192]]<br />
|-<br />
| 00001F03<br />
| SAFE_MODE MCU<br />
| [[1.0.0-0|v0]]<br />
|-<br />
| 20001F03<br />
| [[New_3DS]] SAFE_MODE MCU<br />
| [[8.1.0-0_New3DS|v9217]]<br />
|-<br />
| 00002002<br />
| Microphone (mic)<br />
| [[1.0.0-0|v0]], [[5.0.0-11|v1025]], [[8.0.0-18|v2048]]<br />
|-<br />
| 00002102<br />
| PDN<br />
| [[1.0.0-0|v0]], [[5.0.0-11|v1025]], [[8.0.0-18|v2048]]<br />
|-<br />
| 00002103<br />
| SAFE_MODE PDN<br />
| [[1.0.0-0|v0]]<br />
|-<br />
| 20002103<br />
| [[New_3DS]] SAFE_MODE PDN<br />
| [[8.1.0-0_New3DS|v3073]]<br />
|-<br />
| 00002202<br />
| PTM (Play time, pedometer, and battery manager)<br />
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.2.0-X|v2048]], [[3.0.0-5|v3075]], v4096, [[4.0.0-7|v5120]], [[5.0.0-11|v6146]], [[6.0.0-11|v7168]], [[7.0.0-13|v8192]], [[8.0.0-18|v9219]]<br />
|-<br />
| 20002202<br />
| [[New_3DS]] PTM (Play time, pedometer, and battery manager)<br />
| [[8.1.0-0_New3DS|v10240]]<br />
|-<br />
| 00002203<br />
| SAFE_MODE PTM<br />
| [[1.0.0-0|v0]]<br />
|-<br />
| 20002203<br />
| [[New_3DS]] SAFE_MODE PTM<br />
| [[8.1.0-0_New3DS|v10241]]<br />
|-<br />
| 00002302<br />
| spi<br />
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[5.0.0-11|v2049]], [[8.0.0-18|v3072]]<br />
|-<br />
| 20002302<br />
| [[New_3DS]] spi<br />
| [[8.1.0-0_New3DS|v4096]]<br />
|-<br />
| 00002303<br />
| SAFE_MODE spi<br />
| [[1.0.0-0|v0]]<br />
|-<br />
| 20002303<br />
| [[New_3DS]] SAFE_MODE spi<br />
| [[8.1.0-0_New3DS|v4097]]<br />
|-<br />
| 00002402<br />
| Network manager (AC)<br />
| [[1.0.0-0|v0]], [[1.1.0-1|v1024]], [[2.0.0-2|v2052]], [[2.1.0-3|v3072]], [[3.0.0-5|v4101]], [[5.0.0-11|v5122]], [[7.0.0-13|v6145]], [[8.0.0-18|v7172]], [[9.0.0-20|v8192]](Also for [[8.1.0-0_New3DS]]), [[9.3.0-21|v9216]]<br />
|-<br />
| 00002403<br />
| SAFE_MODE AC<br />
| [[1.0.0-0|v0]]<br />
|-<br />
| 20002403<br />
| [[New_3DS]] SAFE_MODE AC<br />
| [[8.1.0-0_New3DS|v8193]]<br />
|-<br />
| 00002602<br />
| Cecd (StreetPass)<br />
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.2.0-X|v2048]], [[3.0.0-5|v3073]], [[4.0.0-7|v4097]], [[5.0.0-11|v5122]], [[6.0.0-11|v6144]], [[6.2.0-12|v7170]], [[7.0.0-13|v8193]], [[8.0.0-18|v9216]], [[9.0.0-20|v10240]]<br />
|-<br />
| 00002702<br />
| CSND<br />
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[4.0.0-7|v2048]], [[5.0.0-11|v3073]], [[8.0.0-18|v4096]], [[9.0.0-20|v5120]]<br />
|-<br />
| 00002703<br />
| SAFE_MODE CSND<br />
| [[1.0.0-0|v0]]<br />
|-<br />
| 20002703<br />
| [[New_3DS]] SAFE_MODE CSND<br />
| [[8.1.0-0_New3DS|v5121]]<br />
|-<br />
| 00002802<br />
| dlp ([[Download Play]])<br />
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.2.0-X|v2048]], [[3.0.0-5|v3078]], [[5.0.0-11|v4099]], [[8.0.0-18|v5123]], [[9.0.0-20|v6145]](Also for [[8.1.0-0_New3DS]])<br />
|-<br />
| 00002902<br />
| http<br />
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.1.0-3|v2049]], [[2.2.0-X|v3072]], [[3.0.0-5|v4099]], [[4.0.0-7|v5122]], [[5.0.0-11|v6145]], [[7.0.0-13|v7171]], [[7.1.0-14|v8192]], [[8.0.0-18|v9220]], [[8.1.0-18|v10245]], [[8.1.0-0_New3DS|v11264]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v12288]]<br />
|-<br />
| 00002903<br />
| SAFE_MODE http<br />
| [[1.0.0-0|v0]]<br />
|-<br />
| 20002903<br />
| [[New_3DS]] SAFE_MODE http<br />
| [[8.1.0-0_New3DS|v10241]]<br />
|-<br />
| 00002A02<br />
| MP<br />
| [[1.0.0-0|v0]], [[5.0.0-11|v1025]], [[8.0.0-18|v2048]]<br />
|-<br />
| 00002A03<br />
| SAFE_MODE MP<br />
| [[1.0.0-0|v0]]<br />
|-<br />
| 00002B02<br />
| NDM<br />
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[3.0.0-5|v2049]], [[4.0.0-7|v3072]], [[5.0.0-11|v4098]], [[8.0.0-18|v5124]], [[8.1.0-0_New3DS|v6144]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v7169]]<br />
|-<br />
| 00002C02<br />
| [[NIM Services|NIM]]<br />
| [[1.0.0-0|v0]], [[2.0.0-2|v1028]], [[3.0.0-5|v2055]], [[4.0.0-7|v3074]], [[5.0.0-11|v4100]], [[6.0.0-11|v5120]], [[7.0.0-13|v6148]], [[7.2.0-17|v7174]], [[8.0.0-18|v8195]], [[8.1.0-0_New3DS|v9217]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v10249]], [[9.3.0-21|v11267]]<br />
|-<br />
| 00002C03<br />
| SAFE_MODE NIM<br />
| [[1.0.0-0|v0]]<br />
|-<br />
| 20002C03<br />
| [[New_3DS]] SAFE_MODE NIM<br />
| [[8.1.0-0_New3DS|v9217]]<br />
|-<br />
| 00002D02<br />
| NWM ( Low-level wifi manager )<br />
| [[1.0.0-0|v0]], [[1.1.0-1|v1024]], [[2.0.0-2|v2052]], [[2.2.0-X|v3072]], [[3.0.0-5|v4101]], [[4.0.0-7|v5120]], [[5.0.0-11|v6148]], [[6.0.0-11|v7169]], [[7.2.0-17|v8196]], [[8.0.0-18|v9216]], [[9.0.0-20|v10240]]<br />
|-<br />
| 00002D03<br />
| SAFE_MODE NWM<br />
| [[1.0.0-0|v0]], [[6.0.0-11|v5120]]<br />
|-<br />
| 20002D03<br />
| [[New_3DS]] SAFE_MODE NWM<br />
| [[8.1.0-0_New3DS|v10241]]<br />
|-<br />
| 00002E02<br />
| Sockets<br />
| [[1.0.0-0|v0]], [[1.1.0-1|v1024]], [[2.0.0-2|v2053]], [[3.0.0-5|v3075]], [[4.0.0-7|v4096]], [[5.0.0-11|v5121]], [[8.0.0-18|v6144]], [[9.0.0-20|v7168]]<br />
|-<br />
| 00002E03<br />
| SAFE_MODE Sockets<br />
| [[1.0.0-0|v0]]<br />
|-<br />
| 20002E03<br />
| [[New_3DS]] SAFE_MODE Sockets<br />
| [[8.1.0-0_New3DS|v7169]]<br />
|-<br />
| 00002F02<br />
| SSL<br />
| [[1.0.0-0|v0]], [[2.0.0-2|v1024]], [[2.1.0-3|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[5.0.0-11|v5122]], [[8.0.0-18|v6144]], [[9.0.0-20|v7168]]<br />
|-<br />
| 00002F03<br />
| SAFE_MODE SSL<br />
| [[1.0.0-0|v0]]<br />
|-<br />
| 20002F03<br />
| [[New_3DS]] SAFE_MODE SSL<br />
| [[8.1.0-0_New3DS|v7169]]<br />
|-<br />
| 00003102<br />
| [[Process Services|PS]] ( Process Manager )<br />
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[5.0.0-11|v2049]], [[6.0.0-11|v3072]], [[8.0.0-18|v4096]], [[9.0.0-20|v5120]]<br />
|-<br />
| 00003103<br />
| SAFE_MODE PS<br />
| [[1.0.0-0|v0]]<br />
|-<br />
| 20003103<br />
| [[New_3DS]] SAFE_MODE PS<br />
| [[8.1.0-0_New3DS|v5121]]<br />
|-<br />
| 00003202<br />
| FriendsList (friends)<br />
| [[1.0.0-0|v0]], [[2.0.0-2|v1028]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[5.0.0-11|v5122]], [[7.0.0-13|v6145]], [[8.0.0-18|v7172]], [[9.0.0-20|v8192]](Also for [[8.1.0-0_New3DS]])<br />
|-<br />
| 00003203<br />
| SAFE_MODE FriendsList (friends)<br />
| [[1.0.0-0|v0]]<br />
|-<br />
| 20003203<br />
| [[New_3DS]] SAFE_MODE FriendsList (friends)<br />
| [[8.1.0-0_New3DS|v8193]]<br />
|-<br />
| 00003302<br />
| IR (Infrared)<br />
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[5.0.0-11|v5121]], [[8.0.0-18|v6148]], [[8.1.0-0_New3DS|v7170]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v8192]], [[9.3.0-21|v9216]]<br />
|-<br />
| 00003303<br />
| SAFE_MODE IR<br />
| [[1.0.0-0|v0]]<br />
|-<br />
| 20003303<br />
| [[New_3DS]] SAFE_MODE IR<br />
| [[8.1.0-0_New3DS|v7169]]<br />
|- <br />
| 00003402<br />
| BOSS (SpotPass)<br />
| [[1.0.0-0|v0]], [[1.1.0-1|v1024]], [[2.0.0-2|v2053]], [[2.2.0-X|v3073]], [[3.0.0-5|v4101]], [[4.0.0-7|v5122]], [[5.0.0-11|v6146]], [[6.0.0-11|v7169]], [[6.2.0-12|v8193]], [[7.0.0-13|v9222]], [[8.0.0-18|v10240]], [[9.0.0-20|v11266]]<br />
|-<br />
| 00003502<br />
| News (Notifications)<br />
| [[1.0.0-0|v0]], [[2.0.0-2|v1028]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[5.0.0-11|v4097]], [[8.0.0-18|v5120]], [[9.0.0-20|v6147]]<br />
|-<br />
| 00003602<br />
| This only exist for development units(launched by NS during startup depending on certain [[Configuration_Memory]] fields' values).<br />
| <br />
|-<br />
| 00003702<br />
| [[RO_Services|RO]]<br />
| [[2.0.0-2|v0]], [[4.0.0-7|v1024]], [[5.0.0-11|v2049]], [[7.2.0-17|v3074]], [[8.0.0-18|v4096]], [[9.0.0-20|v5120]](Also for [[8.1.0-0_New3DS]]), [[9.3.0-21|v6148]]<br />
|-<br />
| 00003802<br />
| act (handles Nintendo Network '''a'''c'''c'''oun'''t'''s)<br />
| [[7.0.0-13|v1029]], [[7.1.0-14|v2050]], [[7.2.0-17|v3077]], [[8.0.0-18|v4099]], [[8.1.0-0_New3DS|v5120]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v6144]], [[9.3.0-21|v7168]]<br />
|-<br />
| 00004002<br />
| Old3DS [[NFC_Services|nfc]]<br />
| [[9.3.0-21|v2053]], [[9.6.0-24|v4106]]<br />
|-<br />
| 20004002<br />
| [[New_3DS]] [[NFC_Services|nfc]]<br />
| [[8.1.0-0_New3DS|v0]], [[9.0.0-20|v1024]], [[9.3.0-21|v2053]], [[9.5.0-22|v3073]]<br />
|-<br />
| 20004102<br />
| [[New_3DS]] mvd<br />
| [[8.1.0-0_New3DS|v0]], [[9.0.0-20|v1024]]<br />
|-<br />
| 20004202<br />
| [[New_3DS]] [[QTM Services|qtm]]<br />
| [[8.1.0-0_New3DS|v8]], [[9.0.0-20|v1024]], [[9.3.0-21|v2052]]<br />
|-<br />
| 00008002<br />
| [[NS]] (Memory-region: "SYSTEM")<br />
| [[1.0.0-0|v0]], [[2.0.0-2|v1028]], [[2.2.0-X|v2048]], [[3.0.0-5|v3077]], v4096, [[4.0.0-7|v5121]], [[5.0.0-11|v6148]], [[5.1.0-11|v7168]], [[6.0.0-11|v8193]], [[6.1.0-11|v9216]], [[7.0.0-13|v10248]], [[7.2.0-17|v11268]], [[8.0.0-18|v12291]], [[8.1.0-0_New3DS|v13312]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v14336]], [[9.3.0-21|v15360]]<br />
|-<br />
| 00008003<br />
| SAFE_MODE NS (Memory-region: "SYSTEM")<br />
| [[1.0.0-0|v0]]<br />
|-<br />
| 20008003<br />
| [[New_3DS]] SAFE_MODE NS (Memory-region: "SYSTEM")<br />
| [[8.1.0-0_New3DS|v13313]]<br />
|}<br />
<br />
Once Home Menu finishes loading, all of the above system modules are running, except for MP, RO, and act which are automatically [[Process_Manager_Services|loaded]] when a process requires them. When [[Process_Manager_Services|PM]]-module terminates processes, it will check whether the processes listed as dependencies for this process are listed as dependencies for other processes. Any processes which are no longer listed in any processes dependencies lists are then terminated. On [[New_3DS]], the only New3DS-specific system-module which automatically gets loaded during system boot is qtm.<br />
<br />
All of the above system modules use the "BASE" [[SVC|memory-region]](specified in the exheader), except when listed otherwise for certain modules.<br />
<br />
When handling the exheader dependency list starting with [[8.0.0-18]], Old3DS FIRM [[Process_Manager_Services|PM]]-module now skips handling titles in this list which have any bits in programID-low bitmask 0xF0000000 set(with [[8.0.0-18]] this is hard-coded). The exheader dependency list handling change is for the [[New 3DS]] system-module(s), which do not exist on Old3DS. When the New3DS pm-module is launching any title except [[NS]], it first attempts to launch the title with programID-low bitmask 0x20000000 set, then with that bitmask clear if launching fails.<br />
<br />
=== 00040138 - [[FIRM|System Firmware]] ===<br />
NATIVE_FIRM and SAFE_MODE_FIRM for the initial versions are exactly the same, besides [[Configuration_Memory|core-version]] fields. SAFE_MODE_FIRM is used for running SAFE_MODE titles, on retail SAFE_MODE_FIRM seems to be only used for running the [[System_Settings#System_Updater|System Updater]] application. When a GBA VC title is launched, AGB_FIRM is launched to handle running this title. GBA VC savegames stored under SD card /title/<TID>/data use a custom format, this is handled by AGB_FIRM.<br />
<br />
{| class="wikitable" border="1"<br />
|-<br />
! TitleID Low<br />
! Description<br />
! USA/EUR/JPN Versions<br />
! CHN Versions<br />
! KOR Versions<br />
! TWN Versions<br />
|-<br />
| 00000001<br />
| Unknown, very similar to SAFE_MODE_FIRM. Exists only on dev units and seems to only be used by SystemUpdaters.<br />
| v0<br />
| <br />
| <br />
| <br />
|-<br />
| 00000002<br />
| NATIVE_FIRM (Native Firmware)<br />
| [[1.0.0-0|v432]], [[1.1.0-1|v1472]], [[2.0.0-2|v2516]], [[2.1.0-3|v3553]], [[2.2.0-X|v4595]], [[3.0.0-5|v5647]], [[4.0.0-7|v6677]], [[4.1.0-8|v7712]], [[5.0.0-11|v8758]], [[5.1.0-11|v9792]], [[6.0.0-11|v10833]], [[6.1.0-11|v11872]], [[7.0.0-13|v12916]], [[7.2.0-17|v13956]], v15043, [[8.0.0-18|v15047]], [[9.0.0-20|v17120]], [[9.3.0-21|v18182]], [[9.5.0-22|v19216]]<br />
| Same as USA/EUR/JPN starting with the USA/EUR/JPN [[4.0.0-7]] title-version<br />
| Same as CHN.<br />
| Same as CHN.<br />
|-<br />
| 20000002<br />
| [[New_3DS]] NATIVE_FIRM (Native Firmware)<br />
| [[8.1.0-0_New3DS|v16085]], [[9.0.0-20|v17120]], [[9.3.0-21|v18182]], [[9.5.0-22|v19218]]<br />
| N/A<br />
| Same as CHN.<br />
| Same as CHN.<br />
|-<br />
| 00000003<br />
| SAFE_MODE_FIRM <br />
| [[1.0.0-0|v432]], [[3.0.0-5|v5632]]<br />
| Same as USA/EUR/JPN starting with the USA/EUR/JPN [[3.0.0-5]] title-version<br />
| Same as CHN.<br />
| Same as CHN.<br />
|-<br />
| 20000003<br />
| [[New_3DS]] SAFE_MODE_FIRM <br />
| [[8.1.0-0_New3DS|v16081]]<br />
| N/A<br />
| Same as CHN.<br />
| Same as CHN.<br />
|-<br />
| 00000102 <br />
| TWL_FIRM ( DSi Firmware )<br />
| [[1.0.0-0|v432]], [[2.0.0-2|v1489]], [[3.0.0-5|v2565]], v3601, [[4.0.0-7|v4625]], [[4.4.0-10|v5681]], [[4.5.0-10|v6704]], [[6.0.0-11|v7762]], [[6.2.0-12|v8817]]<br />
| Same as USA/EUR/JPN starting with the USA/EUR/JPN [[4.0.0-7]] title-version<br />
| Same as CHN.<br />
| Same as CHN.<br />
|-<br />
| 20000102 <br />
| [[New_3DS]] TWL_FIRM ( DSi Firmware )<br />
| [[8.1.0-0_New3DS|v9936]]<br />
| N/A<br />
| Same as CHN.<br />
| Same as CHN.<br />
|- <br />
| 00000202<br />
| AGB_FIRM ( GBA Firmware )<br />
| [[3.0.0-5|v519]], v1553, [[4.0.0-7|v2576]], [[6.0.0-11|v3665]]<br />
| [[4.0.0-7|v2576]]<br />
| [[4.0.0-7|v2576]], [[6.0.0-11|v3665]]<br />
| Same as CHN.<br />
|- <br />
| 20000202<br />
| [[New_3DS]] AGB_FIRM ( GBA Firmware )<br />
| [[8.1.0-0_New3DS|v4816]]<br />
| N/A<br />
| N/A<br />
| N/A<br />
|}<br />
<br />
== TWL System Titles ==<br />
<br />
{| class="wikitable" border="1"<br />
|-<br />
! Content Category<br />
! Bit Mask(s)<br />
! Category Bit Mask<br />
|-<br />
| System Application<br />
| TWL<nowiki>|</nowiki>0x1<nowiki>|</nowiki>0x4<br />
| 0x8005<br />
|-<br />
| System Archive<br />
| TWL<nowiki>|</nowiki>0x1<nowiki>|</nowiki>0x2<nowiki>|</nowiki>0x4<nowiki>|</nowiki>0x8<br />
| 0x800F<br />
|}<br />
Bitmask 0x1 for TWL titles determines whether the title will be updated during a System Update.<br />
<br />
=== 00048005 - System Applications===<br />
{| class="wikitable" border="1"<br />
|-<br />
! TitleID Low<br />
! Region<br />
! Description<br />
! Versions<br />
! Information<br />
|-<br />
| 42383841(B88A)<br />
| ALL<br />
| [[DS Internet]]<br />
| v0, [[2.1.0-4|v1025]], [[3.0.0-5|v2048]]<br />
| [[DS Internet]] is the DSi-mode application launched by [[System Settings]] for setting TWL wifi configuration. <br />
|-<br />
| 484E4441(HNDA)<br />
| ALL<br />
| [[Download Play]]<br />
| v1024<br />
| This [[Download Play]] application is the DS-mode Download Play client, launched by the 3DS-mode Download Play application.<br />
|-<br />
| 484E4443(HNDC)<br />
| CHN<br />
| [[Download Play]]<br />
| v1024<br />
| See Above Description.<br />
|-<br />
| 484E444B(HNDK)<br />
| KOR<br />
| [[Download Play]]<br />
| v1024<br />
| See Above Description.<br />
|}<br />
<br />
=== 0004800F - System Data Archives===<br />
{| class="wikitable" border="1"<br />
|-<br />
! TitleID Low<br />
! Description<br />
! Versions<br />
|-<br />
| 484E4841(HNHA)<br />
| [[Nintendo DS Cart Whitelist]]<br />
| v0, [[2.0.0-2|v1026]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[4.2.0-9|v5120]], [[4.3.0-10|v6145]], [[4.4.0-10|v7168]], [[4.5.0-10|v8192]], [[5.0.0-11|v9216]], [[6.0.0-11|v10240]], [[7.0.0-13|v11264]]<br />
|-<br />
| 484E4C41(HNLA)<br />
| [[Version Data]]<br />
| v0<br />
|}<br />
<br />
New system updates only block DS flash-cards when the above whitelist was updated, or when TWL_FIRM was updated. The whitelist contains the data used for detecting flash-cards, this is used by TWL_FIRM.<br />
<br />
== Application Titles ==<br />
{| class="wikitable" border="1"<br />
|-<br />
! Content Category<br />
! Bit Mask(s)<br />
! Category Bit Mask<br />
|-<br />
| [[Title list/eShop Titles|Application]] (eShop Title)<br />
| Normal<br />
| 0x0000<br />
|-<br />
| DLP Child<br />
| DlpChild<br />
| 0x0001<br />
|-<br />
| [[EShop Demos|Demo]]<br />
| Demo<br />
| 0x0002<br />
|-<br />
| [[Title list/Patches|Patch]]<br />
| CannotExecution<nowiki>|</nowiki>Patch<br />
| 0x000E<br />
|-<br />
| [[Title list/DLC|Add-on Content]] (DLC)<br />
| NotRequireRightForMount<nowiki>|</nowiki>CannotExecution<nowiki>|</nowiki>AddOnContents<br />
| 0x008C<br />
|}<br />
<br />
=== 00040001 - [[Download Play]] Titles ===<br />
This titleID-high/programID-high is used for the titles sent over [[Download Play]]. Only one 00040001 Download Play title is installed to NAND /title at a time. There can be a maximum of 255 Download Play child titles per Unique ID, indexed by Title ID Variation. The legal index range: 0x0 - 0xff.<br />
<br />
== TWL Application Titles ==<br />
{| class="wikitable" border="1"<br />
|-<br />
! Content Category<br />
! Bit Mask(s)<br />
! Category Bit Mask<br />
|-<br />
| Application (DSiWare)<br />
| TWL<nowiki>|</nowiki>0x4<br />
| 0x8004<br />
|}<br />
<br />
=== 00048004 - DSiWare ===<br />
Although these have a titleID high separate from DSi and a titleID is stored in the SRLs, the content of these SRLs are identical to DSi.<br />
<br />
{| class="wikitable" border="1"<br />
|-<br />
! TitleID Low<br />
! Region<br />
! Description<br />
! Versions<br />
|-<br />
| 4B4B5456(KKTV)<br />
| EUR<br />
| Cut the Rope<br />
| v0, v64<br />
|-<br />
| 4B4E5256(KNRV)<br />
| EUR<br />
| A Little Bit of... Brain Training™: Maths Edition <br />
| v0<br />
|-<br />
| 4B5A4C56(KZLV)<br />
| EUR<br />
| Plants vs. Zombies™<br />
| v0<br />
|-<br />
| 4B454256(KEBV)<br />
| EUR<br />
| ELECTROPLANKTON (Hanenbow)<br />
| v0<br />
|-<br />
| 4B513956(KQ9V)<br />
| EUR<br />
| Zelda: Four Swords Anniversary Edition<br />
| v16<br />
|-<br />
| 4B574256(KWBV)<br />
| EUR<br />
| Mario Calculator <br />
| v0<br />
|-<br />
| 4B574656(KWFV)<br />
| EUR<br />
| Mario Clock <br />
| v0<br />
|}</div>
Socram8888
https://www.3dbrew.org/w/index.php?title=NFC_Services&diff=11809
NFC Services
2015-03-02T22:05:50Z
<p>Socram8888: /* Post-9.3.0-21 */</p>
<hr />
<div>The New3DS NFC module was added with [[8.1.0-0_New3DS]]. The Old3DS NFC module was added with [[9.3.0-21|9.3.0-X]].<br />
<br />
On New3DS NFC module uses the NFC hardware via the [[I2C_Services|i2c::NFC]] and [[GPIO_Services|gpio:NFC]] services. On Old3DS NFC module communicates with a NFC peripheral via IR with the IRUSER service.<br />
<br />
A total of 6 sessions can be open simultaneously for all of these services combined.<br />
<br />
=NFC services=<br />
==NFC user service "nfc:u"==<br />
This is the NFC service used by regular applications.<br />
<br />
This was first seen in the Super Smash Bros eShop demo (only in the exheader, the demo doesn't actually use it), but at that time no system-module was available for NFC on CDN. The first regular application to use this service was Super Smash Bros, with the v1.0.5 game-update, which used the new 9.3.0-21 command set.<br />
<br />
==NFC management service "nfc:m"==<br />
This is used by the [[amiibo Settings]] applet.<br />
<br />
==NFC development service "nfc:dev"==<br />
This service seems to be intended for use only on dev-units(or at least some of the command(s)).<br />
<br />
==NFC service "nfc:p"==<br />
This service is used by the mint library-applet, starting with [[9.3.0-21]]. This service was added to the mint service-access-control list with [[9.0.0-20]].<br />
<br />
==NFC service "nfc:r"==<br />
This service has no known use.<br />
<br />
==NFC service "nfc:s"==<br />
This service has no known use.<br />
<br />
="nfc:u" and "nfc:m" command set=<br />
There are two different revisions of the NFC module. First version was introduced on New3DS only with firmware 8.1.0-0_New3DS. Second version made its appearance with 9.3.0-X, on both Old3DS and New3DS.<br />
<br />
These two versions are not interchangeable and not compatible, since the newer version uses a different command set and has no implemented commands from the older version. This does not introduce compatibility problems since no retail software used the NFC module before the Super Smash Bros for 3DS, whose NFC update required 9.3.0-21.<br />
<br />
==Post-9.3.0-21==<br />
Commands for post-9.3.0-21 have been extracted by analyzing the amiibo Settings applet. Therefore this table may be missing commands. Note that the function name is actually a nickname for easeness of reading, as original function names have been stripped off the binaries.<br />
<br />
See [[IPC Command Structure]] for an explanation on how IPC communication works and how to use these functions.<br />
{| class="wikitable" border="1"<br />
|-<br />
! Command Header<br />
! Name<br />
! Input<br />
! Output<br />
! Notes<br />
|-<br />
| 0x00010040<br />
| nfcInit<br />
| u8 unknownA<br />
| s32 result<br />
|<br />
|-<br />
| 0x00020040<br />
| nfcStop<br />
| u8 unknownA<br />
| s32 result<br />
|<br />
|-<br />
| 0x00030000<br />
| ???<br />
| void<br />
| s32 result<br />
|<br />
|-<br />
| 0x00040000<br />
| ???<br />
| void<br />
| s32 result<br />
|<br />
|-<br />
| 0x00050040<br />
| ???<br />
| u16 unknownA<br />
| s32 result<br />
|<br />
|-<br />
| 0x00060000<br />
| ???<br />
| void<br />
| s32 result<br />
|<br />
|-<br />
| 0x00070000<br />
| ???<br />
| void<br />
| s32 result<br />
|<br />
|-<br />
| 0x00080000<br />
| ???<br />
| void<br />
| s32 result<br />
|<br />
|-<br />
| 0x00090002<br />
| ???<br />
| u32 pid, u32 pidPlaceholder<br />
| s32 result<br />
|<br />
|-<br />
| 0x000A0000<br />
| ???<br />
| void<br />
| s32 result<br />
|<br />
|-<br />
| 0x000B0000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA, u32 unknownB<br />
| amiibo applet ignores value unknownA. It doesn't even read it from the command buffer.<br />
|-<br />
| 0x000C0000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA, u32 unknownB<br />
| amiibo applet also ignores value unknownA for this command.<br />
|-<br />
| 0x000D0000<br />
| ???<br />
| void<br />
| s32 result, u8 unknownA<br />
|<br />
|-<br />
| 0x000F0000<br />
| ???<br />
| void<br />
| u32 result, u32 unknownA<br />
|<br />
|-<br />
| 0x00100000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA[24]<br />
|<br />
|-<br />
| 0x00110000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA[8], u32 unknownB[2], u32 unknownC<br />
|<br />
|-<br />
| 0x00120000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA<br />
|<br />
|-<br />
| 0x00130040<br />
| ???<br />
| u32 unknownA<br />
| s32 result<br />
|<br />
|-<br />
| 0x00140384<br />
| ???<br />
| u32 unknownA, u32 unknownB, u8 unknownB[48], u32 pid, u32 pidPlaceholder, u32 (buffer_size << 14) <nowiki>|</nowiki> 0x00000002, void * buffer<br />
| s32 result<br />
| See [[IPC_Command_Structure|IPC parameter type 1]] for explanation on buffer<br />
|-<br />
| 0x00150040<br />
| ???<br />
| u32 unknownA<br />
| s32 result<br />
| Uses something at TLS+0x180<br />
|-<br />
| 0x00160242<br />
| ???<br />
| u32 unknownA, u8 unknownB[32], u32 (buffer_size << 14) <nowiki>|</nowiki> 0x00000002, void * buffer<br />
| s32 result<br />
|<br />
|-<br />
| 0x00170000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA[42]<br />
|<br />
|-<br />
| 0x00180000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA[16]<br />
|<br />
|-<br />
| 0x00190000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA[8], u32 unknownB[4], u64 unknownC, u32 unknownD<br />
| Apparently output is a struct<br />
|-<br />
| 0x040100C2<br />
| ???<br />
| u32 unknownA, u32 unknownB, u32 unknownC, u32 (sizeof(*buffer) << 14 <nowiki>|</nowiki> 0x402), void * buffer<br />
| s32 result<br />
|<br />
|-<br />
| 0x04020000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA[16]<br />
| Output seems to be a struct<br />
|-<br />
| 0x04030000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA[41]<br />
|<br />
|-<br />
| 0x04040A40<br />
| ???<br />
| u32 unknownA[41]<br />
| s32 result<br />
|<br />
|-<br />
| 0x04060000<br />
| ???<br />
| void<br />
| s32 result<br />
|<br />
|-<br />
| 0x04070000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA<br />
|<br />
|-<br />
| 0x04080000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA<br />
|<br />
|-<br />
| 0x040D0000<br />
| ???<br />
| void<br />
| s32 result<br />
|<br />
|-<br />
| 0x040E0000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA, u32 unknownB<br />
| Again, amiibo applet ignores value unknownA.<br />
|-<br />
| 0x040F0000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA, u32 unknownB<br />
|<br />
|}<br />
<br />
==Pre-9.3.0-21==<br />
{| class="wikitable" border="1"<br />
|-<br />
! Command Header<br />
! Description<br />
|-<br />
| 0x00010000<br />
| Initialize<br />
|-<br />
| 0x00020000<br />
| Shutdown<br />
|-<br />
| 0x00030000<br />
| GetNFCState. This writes an output u8 to cmdreply[2]: 0 = not initialized, 1 = just initialized, 5 = data transfer ready, ...<br />
|-<br />
| 0x00040000<br />
| This writes an output handle to cmdreply[3].<br />
|-<br />
| 0x00050000<br />
| This writes an output handle to cmdreply[3].<br />
|-<br />
| 0x00060040<br />
| (u8 input)<br />
|-<br />
| 0x00070000<br />
| The user process must setup the output-buffer hdr+ptr data @ TLS+0x180 when using this. cmdreply[2] = actual output data size?<br />
|-<br />
| 0x00080100<br />
| (<0x10-bytes starting at cmdreq[1]>)<br />
|-<br />
| 0x00090000<br />
| <br />
|-<br />
| 0x000A0000<br />
| The user process must setup the output-buffer hdr+ptr data @ TLS+0x180 when using this.<br />
|-<br />
| 0x000B0042<br />
| (u32 size, ((Size<<14) <nowiki>|</nowiki> 2), inbufptr)<br />
|-<br />
| 0x000C0044<br />
| (u32 size, 0x20, <procid set by kernel>, ((Size<<14) <nowiki>|</nowiki> 0x402), inbufptr)<br />
|-<br />
| 0x000D0040<br />
| (u16 in)<br />
|-<br />
| 0x000E0000<br />
| <br />
|-<br />
| 0x000F00C2<br />
| (u32 unk0, u32 unk1, u32 unk2, ((Size<<14) <nowiki>|</nowiki> 0x802), inbufptr)<br />
|-<br />
| 0x00100040<br />
| (u32 in)<br />
|-<br />
| 0x00110040<br />
| (u32 in)<br />
|-<br />
| 0x00120040<br />
| (u32 in)<br />
|-<br />
| 0x00130000<br />
| Writes an output u32 to cmdreply[2].<br />
|-<br />
| 0x00140000<br />
| This writes an output 0x30-byte struct starting at cmdreply[2].<br />
|-<br />
| 0x00150000<br />
| This writes an output 0x2C-byte struct starting at cmdreply[2].<br />
|-<br />
| 0x00160000<br />
| <br />
|-<br />
| 0x00170000<br />
| <br />
|}<br />
<br />
=NFC module savedata=<br />
* "/nfp_backup.dat" Going by the filename this seems to contain data backed up from amiibo.</div>
Socram8888
https://www.3dbrew.org/w/index.php?title=NFC_Services&diff=11807
NFC Services
2015-03-02T21:45:34Z
<p>Socram8888: </p>
<hr />
<div>The New3DS NFC module was added with [[8.1.0-0_New3DS]]. The Old3DS NFC module was added with [[9.3.0-21|9.3.0-X]].<br />
<br />
On New3DS NFC module uses the NFC hardware via the [[I2C_Services|i2c::NFC]] and [[GPIO_Services|gpio:NFC]] services. On Old3DS NFC module communicates with a NFC peripheral via IR with the IRUSER service.<br />
<br />
A total of 6 sessions can be open simultaneously for all of these services combined.<br />
<br />
=NFC services=<br />
==NFC user service "nfc:u"==<br />
This is the NFC service used by regular applications.<br />
<br />
This was first seen in the Super Smash Bros eShop demo (only in the exheader, the demo doesn't actually use it), but at that time no system-module was available for NFC on CDN. The first regular application to use this service was Super Smash Bros, with the v1.0.5 game-update, which used the new 9.3.0-21 command set.<br />
<br />
==NFC management service "nfc:m"==<br />
This is used by the [[amiibo Settings]] applet.<br />
<br />
==NFC development service "nfc:dev"==<br />
This service seems to be intended for use only on dev-units(or at least some of the command(s)).<br />
<br />
==NFC service "nfc:p"==<br />
This service is used by the mint library-applet, starting with [[9.3.0-21]]. This service was added to the mint service-access-control list with [[9.0.0-20]].<br />
<br />
==NFC service "nfc:r"==<br />
This service has no known use.<br />
<br />
==NFC service "nfc:s"==<br />
This service has no known use.<br />
<br />
="nfc:u" and "nfc:m" command set=<br />
There are two different revisions of the NFC module. First version was introduced on New3DS only with firmware 8.1.0-0_New3DS. Second version made its appearance with 9.3.0-X, on both Old3DS and New3DS.<br />
<br />
These two versions are not interchangeable and not compatible, since the newer version uses a different command set and has no implemented commands from the older version. This does not introduce compatibility problems since no retail software used the NFC module before the Super Smash Bros for 3DS, whose NFC update required 9.3.0-21.<br />
<br />
==Post-9.3.0-21==<br />
Commands for post-9.3.0-21 have been extracted by analyzing the amiibo Settings applet. Therefore this table may be missing commands. Note that the function name is actually a nickname for easeness of reading, as original function names have been stripped off the binaries.<br />
<br />
See [[IPC Command Structure]] for an explanation on how IPC communication works and how to use these functions.<br />
{| class="wikitable" border="1"<br />
|-<br />
! Command Header<br />
! Name<br />
! Input<br />
! Output<br />
! Notes<br />
|-<br />
| 0x00010040<br />
| nfcInit<br />
| u8 unknownA<br />
| s32 result<br />
|<br />
|-<br />
| 0x00020040<br />
| nfcStop<br />
| u8 unknownA<br />
| s32 result<br />
|<br />
|-<br />
| 0x00030000<br />
| ???<br />
| void<br />
| s32 result<br />
|<br />
|-<br />
| 0x00040000<br />
| ???<br />
| void<br />
| s32 result<br />
|<br />
|-<br />
| 0x00050040<br />
| ???<br />
| u16 unknownA<br />
| s32 result<br />
|<br />
|-<br />
| 0x00060000<br />
| ???<br />
|<br />
| s32 result<br />
|<br />
|-<br />
| 0x00070000<br />
| ???<br />
| void<br />
| s32 result<br />
|<br />
|-<br />
| 0x00080000<br />
| ???<br />
| void<br />
| s32 result<br />
|<br />
|-<br />
| 0x00090002<br />
| ???<br />
| u32 pid, u32 pidPlaceholder<br />
| s32 result<br />
|<br />
|-<br />
| 0x000A0000<br />
| ???<br />
| void<br />
| s32 result<br />
|<br />
|-<br />
| 0x000B0000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA, u32 unknownB<br />
| amiibo applet ignores value unknownA. It doesn't even read it from the command buffer.<br />
|-<br />
| 0x000C0000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA, u32 unknownB<br />
| amiibo applet also ignores value unknownA for this command.<br />
|-<br />
| 0x000D0000<br />
| ???<br />
| void<br />
| s32 result, u8 unknownA<br />
|<br />
|-<br />
| 0x000F0000<br />
| ???<br />
| void<br />
| u32 result, u32 unknownA<br />
|<br />
|-<br />
| 0x00100000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA[24]<br />
|<br />
|-<br />
| 0x00110000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA[8], u32 unknownB[2], u32 unknownC<br />
|<br />
|-<br />
| 0x00120000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA<br />
|<br />
|-<br />
| 0x00130040<br />
| ???<br />
| u32 unknownA<br />
| s32 result<br />
|<br />
|-<br />
| 0x00140384<br />
| ???<br />
| u32 unknownA, u32 unknownB, u8 unknownB[48], u32 pid, u32 pidPlaceholder, u32 (buffer_size << 14) <nowiki>|</nowiki> 0x00000002, void * buffer<br />
| s32 result<br />
| See [[IPC_Command_Structure|IPC parameter type 1]] for explanation on buffer<br />
|-<br />
| 0x00150040<br />
| ???<br />
| u32 unknownA<br />
| s32 result<br />
| Uses something at TLS+0x180<br />
|-<br />
| 0x00160242<br />
| ???<br />
| u32 unknownA, u8 unknownB[32], u32 (buffer_size << 14) <nowiki>|</nowiki> 0x00000002, void * buffer<br />
| s32 result<br />
|<br />
|-<br />
| 0x00170000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA[42]<br />
|<br />
|-<br />
| 0x00180000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA[16]<br />
|<br />
|-<br />
| 0x00190000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA[8], u32 unknownB[4], u64 unknownC, u32 unknownD<br />
| Apparently output is a struct<br />
|-<br />
| 0x040100C2<br />
| ???<br />
| u32 unknownA, u32 unknownB, u32 unknownC, u32 (sizeof(*buffer) << 14 <nowiki>|</nowiki> 0x402), void * buffer<br />
| s32 result<br />
|<br />
|-<br />
| 0x04020000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA[16]<br />
| Output seems to be a struct<br />
|-<br />
| 0x04030000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA[41]<br />
|<br />
|-<br />
| 0x04040A40<br />
| ???<br />
| u32 unknownA[41]<br />
| s32 result<br />
|<br />
|-<br />
| 0x04060000<br />
| ???<br />
| void<br />
| s32 result<br />
|<br />
|-<br />
| 0x04070000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA<br />
|<br />
|-<br />
| 0x04080000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA<br />
|<br />
|-<br />
| 0x040D0000<br />
| ???<br />
| void<br />
| s32 result<br />
|<br />
|-<br />
| 0x040E0000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA, u32 unknownB<br />
| Again, amiibo applet ignores value unknownA.<br />
|-<br />
| 0x040F0000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA, u32 unknownB<br />
|<br />
|}<br />
<br />
==Pre-9.3.0-21==<br />
{| class="wikitable" border="1"<br />
|-<br />
! Command Header<br />
! Description<br />
|-<br />
| 0x00010000<br />
| Initialize<br />
|-<br />
| 0x00020000<br />
| Shutdown<br />
|-<br />
| 0x00030000<br />
| GetNFCState. This writes an output u8 to cmdreply[2]: 0 = not initialized, 1 = just initialized, 5 = data transfer ready, ...<br />
|-<br />
| 0x00040000<br />
| This writes an output handle to cmdreply[3].<br />
|-<br />
| 0x00050000<br />
| This writes an output handle to cmdreply[3].<br />
|-<br />
| 0x00060040<br />
| (u8 input)<br />
|-<br />
| 0x00070000<br />
| The user process must setup the output-buffer hdr+ptr data @ TLS+0x180 when using this. cmdreply[2] = actual output data size?<br />
|-<br />
| 0x00080100<br />
| (<0x10-bytes starting at cmdreq[1]>)<br />
|-<br />
| 0x00090000<br />
| <br />
|-<br />
| 0x000A0000<br />
| The user process must setup the output-buffer hdr+ptr data @ TLS+0x180 when using this.<br />
|-<br />
| 0x000B0042<br />
| (u32 size, ((Size<<14) <nowiki>|</nowiki> 2), inbufptr)<br />
|-<br />
| 0x000C0044<br />
| (u32 size, 0x20, <procid set by kernel>, ((Size<<14) <nowiki>|</nowiki> 0x402), inbufptr)<br />
|-<br />
| 0x000D0040<br />
| (u16 in)<br />
|-<br />
| 0x000E0000<br />
| <br />
|-<br />
| 0x000F00C2<br />
| (u32 unk0, u32 unk1, u32 unk2, ((Size<<14) <nowiki>|</nowiki> 0x802), inbufptr)<br />
|-<br />
| 0x00100040<br />
| (u32 in)<br />
|-<br />
| 0x00110040<br />
| (u32 in)<br />
|-<br />
| 0x00120040<br />
| (u32 in)<br />
|-<br />
| 0x00130000<br />
| Writes an output u32 to cmdreply[2].<br />
|-<br />
| 0x00140000<br />
| This writes an output 0x30-byte struct starting at cmdreply[2].<br />
|-<br />
| 0x00150000<br />
| This writes an output 0x2C-byte struct starting at cmdreply[2].<br />
|-<br />
| 0x00160000<br />
| <br />
|-<br />
| 0x00170000<br />
| <br />
|}<br />
<br />
=NFC module savedata=<br />
* "/nfp_backup.dat" Going by the filename this seems to contain data backed up from amiibo.</div>
Socram8888
https://www.3dbrew.org/w/index.php?title=NFC_Services&diff=11806
NFC Services
2015-03-02T21:44:42Z
<p>Socram8888: </p>
<hr />
<div>The New3DS NFC module was added with [[8.1.0-0_New3DS]]. The Old3DS NFC module was added with [[9.3.0-21|9.3.0-X]].<br />
<br />
On New3DS NFC module uses the NFC hardware via the [[I2C_Services|i2c::NFC]] and [[GPIO_Services|gpio:NFC]] services. On Old3DS NFC module communicates with a NFC peripheral via IR with the IRUSER service.<br />
<br />
A total of 6 sessions can be open simultaneously for all of these services combined.<br />
<br />
=NFC services=<br />
==NFC user service "nfc:u"==<br />
This is the NFC service used by regular applications.<br />
<br />
This was first seen in the Super Smash Bros eShop demo (only in the exheader, the demo doesn't actually use it), but at that time no system-module was available for NFC on CDN. The first regular application to use this service was Super Smash Bros, with the v1.0.5 game-update, which used the new 9.3.0-21 command set.<br />
<br />
==NFC management service "nfc:m"==<br />
This is used by the [[amiibo Settings]] applet.<br />
<br />
==NFC development service "nfc:dev"==<br />
This service seems to be intended for use only on dev-units(or at least some of the command(s)).<br />
<br />
==NFC service "nfc:p"==<br />
This service is used by the mint library-applet, starting with [[9.3.0-21]]. This service was added to the mint service-access-control list with [[9.0.0-20]].<br />
<br />
==NFC service "nfc:r"==<br />
This service has no known use.<br />
<br />
==NFC service "nfc:s"==<br />
This service has no known use.<br />
<br />
="nfc:u" and "nfc:m" command set=<br />
There are two different revisions of the NFC module. First version was introduced on New3DS only with firmware 8.1.0-0_New3DS. Second version made its appearance with 9.3.0-X, on both Old3DS and New3DS.<br />
<br />
These two versions are not interchangeable and not compatible, since the newer version uses a different command set and has no implemented commands from the older version. This does not introduce compatibility problems since no retail software used the NFC module before the Super Smash Bros for 3DS, whose NFC update required 9.3.0-21.<br />
<br />
==Post-9.3.0-21==<br />
Commands for post-9.3.0-21 have been extracted by analyzing the amiibo Settings applet. Therefore this table may be missing commands. Note that the function name is actually a nickname for easeness of reading, as original function names have been stripped off the binaries.<br />
<br />
See [[IPC Command Structure]] for an explanation on how IPC communication works and how to use these functions.<br />
{| class="wikitable" border="1"<br />
|-<br />
! Command Header<br />
! Name<br />
! Input<br />
! Output<br />
! Notes<br />
|-<br />
| 0x00010040<br />
| nfcInit<br />
| u8 unknownA<br />
| s32 result<br />
|<br />
|-<br />
| 0x00020040<br />
| nfcStop<br />
| u8 unknownA<br />
| s32 result<br />
|<br />
|-<br />
| 0x00030000<br />
| ???<br />
| void<br />
| s32 result<br />
|<br />
|-<br />
| 0x00040000<br />
| ???<br />
| void<br />
| s32 result<br />
|<br />
|-<br />
| 0x00050040<br />
| ???<br />
| u16 unknownA<br />
| s32 result<br />
|<br />
|-<br />
| 0x00060000<br />
| ???<br />
|<br />
| s32 result<br />
|<br />
|-<br />
| 0x00070000<br />
| ???<br />
| void<br />
| s32 result<br />
|<br />
|-<br />
| 0x00080000<br />
| ???<br />
| void<br />
| s32 result<br />
|<br />
|-<br />
| 0x00090002<br />
| ???<br />
| u32 pid, u32 pidPlaceholder<br />
| s32 result<br />
|<br />
|-<br />
| 0x000A0000<br />
| ???<br />
| void<br />
| s32 result<br />
|<br />
|-<br />
| 0x000B0000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA, u32 unknownB<br />
| amiibo applet ignores value unknownA. It doesn't even read it from the command buffer.<br />
|-<br />
| 0x000C0000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA, u32 unknownB<br />
| amiibo applet also ignores value unknownA for this command.<br />
|-<br />
| 0x000D0000<br />
| ???<br />
| void<br />
| s32 result, u8 unknownA<br />
|<br />
|-<br />
| 0x000F0000<br />
| ???<br />
| void<br />
| u32 result, u32 unknownA<br />
|<br />
|-<br />
| 0x00100000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA[24]<br />
|<br />
|-<br />
| 0x00110000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA[8], u32 unknownB[2], u32 unknownC<br />
|<br />
|-<br />
| 0x00120000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA<br />
|<br />
|-<br />
| 0x00130040<br />
| ???<br />
| u32 unknownA<br />
| s32 result<br />
|<br />
|-<br />
| 0x00140384<br />
| ???<br />
| u32 unknownA, u32 unknownB, u8 unknownB[48], u32 pid, u32 pidPlaceholder, u32 (buffer_size << 14) <nowiki>|</nowiki> 0x00000002, void * buffer<br />
| s32 result<br />
| See [[IPC_Command_Structure|IPC parameter type 1]] for explanation on buffer<br />
|-<br />
| 0x00150040<br />
| ???<br />
| u32 unknownA<br />
| s32 result<br />
| Uses something at TLS+0x180<br />
|-<br />
| 0x00160242<br />
| ???<br />
| u32 unknownA, u8 unknownB[32], u32 (buffer_size << 14) <nowiki>|</nowiki> 0x00000002, void * buffer<br />
| s32 result<br />
|<br />
|-<br />
| 0x00170000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA[42]<br />
|<br />
|-<br />
| 0x00180000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA[16]<br />
|<br />
|-<br />
| 0x00190000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA[8], u32 unknownB[4], u64 unknownC, u32 unknownD<br />
| Apparently output is a struct<br />
|-<br />
| 0x040100C2<br />
| ???<br />
| u32 unknownA, u32 unknownB, u32 unknownC, u32 (sizeof(*buffer) << 14 | 0x402), void * buffer<br />
| s32 result<br />
|<br />
|-<br />
| 0x04020000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA[16]<br />
| Output seems to be a struct<br />
|-<br />
| 0x04030000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA[41]<br />
|<br />
|-<br />
| 0x04040A40<br />
| ???<br />
| u32 unknownA[41]<br />
| s32 result<br />
|<br />
|-<br />
| 0x04060000<br />
| ???<br />
| void<br />
| s32 result<br />
|<br />
|-<br />
| 0x04070000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA<br />
|<br />
|-<br />
| 0x04080000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA<br />
|<br />
|-<br />
| 0x040D0000<br />
| ???<br />
| void<br />
| s32 result<br />
|<br />
|-<br />
| 0x040E0000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA, u32 unknownB<br />
| Again, amiibo applet ignores value unknownA.<br />
|-<br />
| 0x040F0000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA, u32 unknownB<br />
|<br />
|}<br />
<br />
==Pre-9.3.0-21==<br />
{| class="wikitable" border="1"<br />
|-<br />
! Command Header<br />
! Description<br />
|-<br />
| 0x00010000<br />
| Initialize<br />
|-<br />
| 0x00020000<br />
| Shutdown<br />
|-<br />
| 0x00030000<br />
| GetNFCState. This writes an output u8 to cmdreply[2]: 0 = not initialized, 1 = just initialized, 5 = data transfer ready, ...<br />
|-<br />
| 0x00040000<br />
| This writes an output handle to cmdreply[3].<br />
|-<br />
| 0x00050000<br />
| This writes an output handle to cmdreply[3].<br />
|-<br />
| 0x00060040<br />
| (u8 input)<br />
|-<br />
| 0x00070000<br />
| The user process must setup the output-buffer hdr+ptr data @ TLS+0x180 when using this. cmdreply[2] = actual output data size?<br />
|-<br />
| 0x00080100<br />
| (<0x10-bytes starting at cmdreq[1]>)<br />
|-<br />
| 0x00090000<br />
| <br />
|-<br />
| 0x000A0000<br />
| The user process must setup the output-buffer hdr+ptr data @ TLS+0x180 when using this.<br />
|-<br />
| 0x000B0042<br />
| (u32 size, ((Size<<14) <nowiki>|</nowiki> 2), inbufptr)<br />
|-<br />
| 0x000C0044<br />
| (u32 size, 0x20, <procid set by kernel>, ((Size<<14) <nowiki>|</nowiki> 0x402), inbufptr)<br />
|-<br />
| 0x000D0040<br />
| (u16 in)<br />
|-<br />
| 0x000E0000<br />
| <br />
|-<br />
| 0x000F00C2<br />
| (u32 unk0, u32 unk1, u32 unk2, ((Size<<14) <nowiki>|</nowiki> 0x802), inbufptr)<br />
|-<br />
| 0x00100040<br />
| (u32 in)<br />
|-<br />
| 0x00110040<br />
| (u32 in)<br />
|-<br />
| 0x00120040<br />
| (u32 in)<br />
|-<br />
| 0x00130000<br />
| Writes an output u32 to cmdreply[2].<br />
|-<br />
| 0x00140000<br />
| This writes an output 0x30-byte struct starting at cmdreply[2].<br />
|-<br />
| 0x00150000<br />
| This writes an output 0x2C-byte struct starting at cmdreply[2].<br />
|-<br />
| 0x00160000<br />
| <br />
|-<br />
| 0x00170000<br />
| <br />
|}<br />
<br />
=NFC module savedata=<br />
* "/nfp_backup.dat" Going by the filename this seems to contain data backed up from amiibo.</div>
Socram8888
https://www.3dbrew.org/w/index.php?title=IPC&diff=11802
IPC
2015-03-02T15:57:20Z
<p>Socram8888: </p>
<hr />
<div>The IPC commands are written to the Thread Local Storage, at offset 0x80. Every IPC command sent to services starts with a u32 header code, and parameters, if any, are written after this header. If the kernel was able to dispatch the request, the server replies with an error code at TLS+0x84, and after this code there is the response data, if any.<br />
<br />
The command header is a 32-bit integer that can be decompossed in the following parts:<br />
{| class="wikitable" border="1"<br />
|-<br />
! Bits<br />
! Description<br />
|-<br />
| 0-5<br />
| Number of translate parameters (=y)<br />
|-<br />
| 6-11<br />
| Number of normal parameters (=x)<br />
|-<br />
| 12-15<br />
| Unused<br />
|-<br />
| 16-31<br />
| Command ID<br />
|}<br />
<br />
The entire command has the following structure:<br />
{| class="wikitable" border="1"<br />
|-<br />
! Word<br />
! Size<br />
! Description<br />
|-<br />
| 0<br />
| 1<br />
| Header code<br />
|-<br />
| 1<br />
| x<br />
| Normal parameters<br />
|-<br />
| x<br />
| y<br />
| Translate parameters<br />
|}<br />
<br />
Translate parameters are modified/translated transparently by the kernel. They are used to transfer handles/buffers between the different processes.<br />
<br />
The type of parameter is described by the bits 1-3 in the translation descriptor. Parameter types accepted for sending by the kernel are: 0, 1, 2, 5, 6, 7. <br />
Type 0 is used to send handles across processes:<br />
if desc & 0x30 == 0x20:<br />
write process id to value<br />
else:<br />
translate handle<br />
if desc & 0x30 == 0x10:<br />
close handle for caller<br />
<br />
For replies, only 0, 1, 5, 6, 7 are allowed. In other words any type 2 fields must be zeroed before calling svcReplyAndReceive on the server-side. For replies type 0, 1, 2 are ignored. Types 5, 6, 7 do something with the mem pointer upon reply. The type 0 descriptor can be used to ignore parameters. The number of parameters covered by a type-0 descriptor is (desc >> 26) + 1.<br />
<br />
{| class="wikitable" border="1"<br />
|-<br />
! Type<br />
! scope="col" width="150" | Usual form<br />
! Description<br />
|-<br />
| 0<br />
| 0x00000000<br />
<handle><br />
| The corresponding value is a KHandle, that should be closed in calling process. Or zero otherwise.<br />
|-<br />
| 0<br />
| 0x00000010<br />
<handle><br />
| The corresponding value is a KHandle, that will be duplicated. Or zero otherwise.<br />
|-<br />
| 0<br />
| 0x00000020<br />
<placeholder><br />
| Let kernel set value to calling process ProcessID.<br />
|-<br />
| 1<br />
| 0x00000002 <nowiki>|</nowiki> (size<<14) <nowiki>|</nowiki> (static_buffer_id<<10)<br />
<ptr><br />
| The corresponding value contains a ptr to a buffer of said size, that should be copied to an already set-up buffer in destination process at [[Thread Local Storage]] offset 0x180 + static_buffer_id*8. The static_buffer_id is only 4 bits, making it possible for at most up to 16 buffers in total per thread.<br />
|-<br />
| 2<br />
| 0x00000004 <nowiki>|</nowiki> (size<<4)<br />
| This is used for PXI commands input/output buffers. The address written to the destination cmd-buf is a phys-addr for a table located in the BASE memregion. This table contains the phys-addrs for the actual data, the array entries have the following format: {u32 *datachunk_physaddr, u32 datachunk_bytesize}.<br />
|-<br />
| 3<br />
| 0x00000006<br />
| Does nothing?<br />
|-<br />
| 4<br />
| 0x00000008<br />
| This command will cause a kernelpanic.<br />
|-<br />
| 5<br />
| <nowiki>0x0000000A | (size<<4)</nowiki><br />
<ptr><br />
| The corresponding value contains a ptr to a buffer of said size. It is mapped R- in the destination process??<br />
|-<br />
| 6<br />
| 0x0000000C <nowiki>|</nowiki> (size<<4)<br />
<ptr><br />
| The corresponding value contains a ptr to a buffer of said size. It is mapped -W in the destination process??<br />
|-<br />
| 7<br />
| 0x0000000E <nowiki>|</nowiki> (size<<4)<br />
<ptr><br />
| The corresponding value contains a ptr to a buffer of said size. It is mapped RW in the destination process??<br />
|}<br />
<br />
Buffers from commands 5,6,7 will get mapped at virtual address 0x04000000+ in destination process.</div>
Socram8888
https://www.3dbrew.org/w/index.php?title=NFC_Services&diff=11800
NFC Services
2015-03-02T15:27:38Z
<p>Socram8888: /* Post-9.3.0-21 */</p>
<hr />
<div>The New3DS NFC module was added with [[8.1.0-0_New3DS]]. The Old3DS NFC module was added with [[9.3.0-21|9.3.0-X]].<br />
<br />
On New3DS NFC module uses the NFC hardware via the [[I2C_Services|i2c::NFC]] and [[GPIO_Services|gpio:NFC]] services. On Old3DS NFC module communicates with a NFC peripheral via IR with the IRUSER service.<br />
<br />
A total of 6 sessions can be open simultaneously for all of these services combined.<br />
<br />
=NFC services=<br />
==NFC user service "nfc:u"==<br />
This is the NFC service used by regular applications.<br />
<br />
This was first seen in the Super Smash Bros eShop demo (only in the exheader, the demo doesn't actually use it), but at that time no system-module was available for NFC on CDN. The first regular application to use this service was Super Smash Bros, with the v1.0.5 game-update, which used the new 9.3.0-21 command set.<br />
<br />
==NFC management service "nfc:m"==<br />
This is used by the [[amiibo Settings]] applet.<br />
<br />
==NFC development service "nfc:dev"==<br />
This service seems to be intended for use only on dev-units(or at least some of the command(s)).<br />
<br />
==NFC service "nfc:p"==<br />
This service is used by the mint library-applet, starting with [[9.3.0-21]]. This service was added to the mint service-access-control list with [[9.0.0-20]].<br />
<br />
==NFC service "nfc:r"==<br />
This service has no known use.<br />
<br />
==NFC service "nfc:s"==<br />
This service has no known use.<br />
<br />
="nfc:u" and "nfc:m" command set=<br />
There are two different revisions of the NFC module. First version was introduced on New3DS only with firmware 8.1.0-0_New3DS. Second version made its appearance with 9.3.0-X, on both Old3DS and New3DS.<br />
<br />
These two versions are not interchangeable and not compatible, since the newer version uses a different command set and has no implemented commands from the older version. This does not introduce compatibility problems since no retail software used the NFC module before the Super Smash Bros for 3DS, whose NFC update required 9.3.0-21.<br />
<br />
==Post-9.3.0-21==<br />
Commands for post-9.3.0-21 have been extracted by analyzing the amiibo Settings applet. Therefore this table may be missing commands.<br />
<br />
Command header is stored at [[Thread Local Storage|TLS]]+0x80. Input and output parameters, if any, are set at TLS+0x84 onwards. If the command specifies has a parameter named "pid", this value has to be set to 0x20, as the kernel will replace the next word ("pidPlaceholder" - which can be left uninitialized) with the process' real PID (see [[IPC_Command_Structure]]).<br />
<br />
Note that the function name is actually a nickname for easeness of reading, as original function names have been stripped off the binaries.<br />
{| class="wikitable" border="1"<br />
|-<br />
! Command Header<br />
! Name<br />
! Input<br />
! Output<br />
! Notes<br />
|-<br />
| 0x00010040<br />
| nfcInit<br />
| u8 unknownA<br />
| s32 result<br />
|<br />
|-<br />
| 0x00020040<br />
| nfcStop<br />
| u8 unknownA<br />
| s32 result<br />
|<br />
|-<br />
| 0x00050040<br />
| ???<br />
| u16 unknownA<br />
| s32 result<br />
|<br />
|-<br />
| 0x00060000<br />
| ???<br />
|<br />
| s32 result<br />
|<br />
|-<br />
| 0x00070000<br />
| ???<br />
| void<br />
| s32 result<br />
|<br />
|-<br />
| 0x00080000<br />
| ???<br />
| void<br />
| s32 result<br />
|<br />
|-<br />
| 0x00090002<br />
| ???<br />
| u32 pid, u32 pidPlaceholder<br />
| s32 result<br />
|<br />
|-<br />
| 0x000A0000<br />
| ???<br />
| void<br />
| s32 result<br />
|<br />
|-<br />
| 0x000D0000<br />
| ???<br />
| void<br />
| s32 result, u8 unknownA<br />
|<br />
|-<br />
| 0x000F0000<br />
| ???<br />
| void<br />
| u32 result, u32 unknownA<br />
|<br />
|-<br />
| 0x00100000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA[24]<br />
|<br />
|-<br />
| 0x00110000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA[8], u32 unknownB[2], u32 unknownC<br />
|<br />
|-<br />
| 0x00120000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA<br />
|<br />
|-<br />
| 0x00130040<br />
| ???<br />
| u32 unknownA<br />
| s32 result<br />
|<br />
|-<br />
| 0x00140384<br />
| ???<br />
| u32 unknownA, u32 unknownB, u8 unknownB[48], u32 pid, u32 pidPlaceholder, u32 (buffer_size << 14) <nowiki>|</nowiki> 0x00000002, void * buffer<br />
| s32 result<br />
| See [[IPC_Command_Structure|IPC parameter type 1]] for explanation on buffer<br />
|-<br />
| 0x00150040<br />
| ???<br />
| u32 unknownA<br />
| s32 result<br />
| Uses something at TLS+0x180<br />
|-<br />
| 0x00170000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA[42]<br />
|<br />
|-<br />
| 0x00180000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA[16]<br />
|<br />
|-<br />
| 0x00190000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA[8], u32 unknownB[4], u64 unknownC, u32 unknownD<br />
| Apparently output is a struct<br />
|-<br />
| 0x04060000<br />
| ???<br />
| void<br />
| s32 result<br />
|<br />
|}<br />
<br />
==Pre-9.3.0-21==<br />
{| class="wikitable" border="1"<br />
|-<br />
! Command Header<br />
! Description<br />
|-<br />
| 0x00010000<br />
| Initialize<br />
|-<br />
| 0x00020000<br />
| Shutdown<br />
|-<br />
| 0x00030000<br />
| GetNFCState. This writes an output u8 to cmdreply[2]: 0 = not initialized, 1 = just initialized, 5 = data transfer ready, ...<br />
|-<br />
| 0x00040000<br />
| This writes an output handle to cmdreply[3].<br />
|-<br />
| 0x00050000<br />
| This writes an output handle to cmdreply[3].<br />
|-<br />
| 0x00060040<br />
| (u8 input)<br />
|-<br />
| 0x00070000<br />
| The user process must setup the output-buffer hdr+ptr data @ TLS+0x180 when using this. cmdreply[2] = actual output data size?<br />
|-<br />
| 0x00080100<br />
| (<0x10-bytes starting at cmdreq[1]>)<br />
|-<br />
| 0x00090000<br />
| <br />
|-<br />
| 0x000A0000<br />
| The user process must setup the output-buffer hdr+ptr data @ TLS+0x180 when using this.<br />
|-<br />
| 0x000B0042<br />
| (u32 size, ((Size<<14) <nowiki>|</nowiki> 2), inbufptr)<br />
|-<br />
| 0x000C0044<br />
| (u32 size, 0x20, <procid set by kernel>, ((Size<<14) <nowiki>|</nowiki> 0x402), inbufptr)<br />
|-<br />
| 0x000D0040<br />
| (u16 in)<br />
|-<br />
| 0x000E0000<br />
| <br />
|-<br />
| 0x000F00C2<br />
| (u32 unk0, u32 unk1, u32 unk2, ((Size<<14) <nowiki>|</nowiki> 0x802), inbufptr)<br />
|-<br />
| 0x00100040<br />
| (u32 in)<br />
|-<br />
| 0x00110040<br />
| (u32 in)<br />
|-<br />
| 0x00120040<br />
| (u32 in)<br />
|-<br />
| 0x00130000<br />
| Writes an output u32 to cmdreply[2].<br />
|-<br />
| 0x00140000<br />
| This writes an output 0x30-byte struct starting at cmdreply[2].<br />
|-<br />
| 0x00150000<br />
| This writes an output 0x2C-byte struct starting at cmdreply[2].<br />
|-<br />
| 0x00160000<br />
| <br />
|-<br />
| 0x00170000<br />
| <br />
|}<br />
<br />
=NFC module savedata=<br />
* "/nfp_backup.dat" Going by the filename this seems to contain data backed up from amiibo.</div>
Socram8888
https://www.3dbrew.org/w/index.php?title=NFC_Services&diff=11799
NFC Services
2015-03-02T15:21:21Z
<p>Socram8888: /* Post-9.3.0-21 */</p>
<hr />
<div>The New3DS NFC module was added with [[8.1.0-0_New3DS]]. The Old3DS NFC module was added with [[9.3.0-21|9.3.0-X]].<br />
<br />
On New3DS NFC module uses the NFC hardware via the [[I2C_Services|i2c::NFC]] and [[GPIO_Services|gpio:NFC]] services. On Old3DS NFC module communicates with a NFC peripheral via IR with the IRUSER service.<br />
<br />
A total of 6 sessions can be open simultaneously for all of these services combined.<br />
<br />
=NFC services=<br />
==NFC user service "nfc:u"==<br />
This is the NFC service used by regular applications.<br />
<br />
This was first seen in the Super Smash Bros eShop demo (only in the exheader, the demo doesn't actually use it), but at that time no system-module was available for NFC on CDN. The first regular application to use this service was Super Smash Bros, with the v1.0.5 game-update, which used the new 9.3.0-21 command set.<br />
<br />
==NFC management service "nfc:m"==<br />
This is used by the [[amiibo Settings]] applet.<br />
<br />
==NFC development service "nfc:dev"==<br />
This service seems to be intended for use only on dev-units(or at least some of the command(s)).<br />
<br />
==NFC service "nfc:p"==<br />
This service is used by the mint library-applet, starting with [[9.3.0-21]]. This service was added to the mint service-access-control list with [[9.0.0-20]].<br />
<br />
==NFC service "nfc:r"==<br />
This service has no known use.<br />
<br />
==NFC service "nfc:s"==<br />
This service has no known use.<br />
<br />
="nfc:u" and "nfc:m" command set=<br />
There are two different revisions of the NFC module. First version was introduced on New3DS only with firmware 8.1.0-0_New3DS. Second version made its appearance with 9.3.0-X, on both Old3DS and New3DS.<br />
<br />
These two versions are not interchangeable and not compatible, since the newer version uses a different command set and has no implemented commands from the older version. This does not introduce compatibility problems since no retail software used the NFC module before the Super Smash Bros for 3DS, whose NFC update required 9.3.0-21.<br />
<br />
==Post-9.3.0-21==<br />
Commands for post-9.3.0-21 have been extracted by analyzing the amiibo Settings applet. Therefore this table may be missing commands.<br />
<br />
Command header is stored at [[Thread Local Storage|TLS]]+0x80. Input and output parameters, if any, are set at TLS+0x84 onwards. If the command specifies has a parameter named "pid", this value has to be set to 0x20, as the kernel will replace the next word ("pidPlaceholder" - which can be left uninitialized) with the process' real PID (see [[IPC_Command_Structure]]).<br />
<br />
Note that the function name is actually a nickname for easeness of reading, as original function names have been stripped off the binaries.<br />
{| class="wikitable" border="1"<br />
|-<br />
! Command Header<br />
! Name<br />
! Input<br />
! Output<br />
! Notes<br />
|-<br />
| 0x00010040<br />
| nfcInit<br />
| u8 unknownA<br />
| s32 result<br />
|<br />
|-<br />
| 0x00020040<br />
| nfcStop<br />
| u8 unknownA<br />
| s32 result<br />
|<br />
|-<br />
| 0x00050040<br />
| ???<br />
| u16 unknownA<br />
| s32 result<br />
|<br />
|-<br />
| 0x00060000<br />
| ???<br />
|<br />
| s32 result<br />
|<br />
|-<br />
| 0x00080000<br />
| ???<br />
| void<br />
| s32 result<br />
|<br />
|-<br />
| 0x00090002<br />
| ???<br />
| u32 pid, u32 pidPlaceholder<br />
| s32 result<br />
|<br />
|-<br />
| 0x000A0000<br />
| ???<br />
| void<br />
| s32 result<br />
|<br />
|-<br />
| 0x000D0000<br />
| ???<br />
| void<br />
| s32 result, u8 unknownA<br />
|<br />
|-<br />
| 0x000F0000<br />
| ???<br />
| void<br />
| u32 result, u32 unknownA<br />
|<br />
|-<br />
| 0x00100000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA[24]<br />
|<br />
|-<br />
| 0x00110000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA[8], u32 unknownB[2], u32 unknownC<br />
|<br />
|-<br />
| 0x00120000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA<br />
|<br />
|-<br />
| 0x00130040<br />
| ???<br />
| u32 unknownA<br />
| s32 result<br />
|<br />
|-<br />
| 0x00140384<br />
| ???<br />
| u32 unknownA, u32 unknownB, u8 unknownB[48], u32 pid, u32 pidPlaceholder, u32 (buffer_size << 14) <nowiki>|</nowiki> 0x00000002, void * buffer<br />
| s32 result<br />
| See [[IPC_Command_Structure|IPC parameter type 1]] for explanation on buffer<br />
|-<br />
| 0x00150040<br />
| ???<br />
| u32 unknownA<br />
| s32 result<br />
|<br />
|-<br />
| 0x00170000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA[42]<br />
|<br />
|-<br />
| 0x00180000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA[16]<br />
|<br />
|-<br />
| 0x00190000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA[8], u32 unknownB[4], u64 unknownC, u32 unknownD<br />
| Apparently output is a struct<br />
|-<br />
| 0x04060000<br />
| ???<br />
| void<br />
| s32 result<br />
|<br />
|}<br />
<br />
==Pre-9.3.0-21==<br />
{| class="wikitable" border="1"<br />
|-<br />
! Command Header<br />
! Description<br />
|-<br />
| 0x00010000<br />
| Initialize<br />
|-<br />
| 0x00020000<br />
| Shutdown<br />
|-<br />
| 0x00030000<br />
| GetNFCState. This writes an output u8 to cmdreply[2]: 0 = not initialized, 1 = just initialized, 5 = data transfer ready, ...<br />
|-<br />
| 0x00040000<br />
| This writes an output handle to cmdreply[3].<br />
|-<br />
| 0x00050000<br />
| This writes an output handle to cmdreply[3].<br />
|-<br />
| 0x00060040<br />
| (u8 input)<br />
|-<br />
| 0x00070000<br />
| The user process must setup the output-buffer hdr+ptr data @ TLS+0x180 when using this. cmdreply[2] = actual output data size?<br />
|-<br />
| 0x00080100<br />
| (<0x10-bytes starting at cmdreq[1]>)<br />
|-<br />
| 0x00090000<br />
| <br />
|-<br />
| 0x000A0000<br />
| The user process must setup the output-buffer hdr+ptr data @ TLS+0x180 when using this.<br />
|-<br />
| 0x000B0042<br />
| (u32 size, ((Size<<14) <nowiki>|</nowiki> 2), inbufptr)<br />
|-<br />
| 0x000C0044<br />
| (u32 size, 0x20, <procid set by kernel>, ((Size<<14) <nowiki>|</nowiki> 0x402), inbufptr)<br />
|-<br />
| 0x000D0040<br />
| (u16 in)<br />
|-<br />
| 0x000E0000<br />
| <br />
|-<br />
| 0x000F00C2<br />
| (u32 unk0, u32 unk1, u32 unk2, ((Size<<14) <nowiki>|</nowiki> 0x802), inbufptr)<br />
|-<br />
| 0x00100040<br />
| (u32 in)<br />
|-<br />
| 0x00110040<br />
| (u32 in)<br />
|-<br />
| 0x00120040<br />
| (u32 in)<br />
|-<br />
| 0x00130000<br />
| Writes an output u32 to cmdreply[2].<br />
|-<br />
| 0x00140000<br />
| This writes an output 0x30-byte struct starting at cmdreply[2].<br />
|-<br />
| 0x00150000<br />
| This writes an output 0x2C-byte struct starting at cmdreply[2].<br />
|-<br />
| 0x00160000<br />
| <br />
|-<br />
| 0x00170000<br />
| <br />
|}<br />
<br />
=NFC module savedata=<br />
* "/nfp_backup.dat" Going by the filename this seems to contain data backed up from amiibo.</div>
Socram8888
https://www.3dbrew.org/w/index.php?title=NFC_Services&diff=11798
NFC Services
2015-03-02T15:13:05Z
<p>Socram8888: /* Post-9.3.0-21 */</p>
<hr />
<div>The New3DS NFC module was added with [[8.1.0-0_New3DS]]. The Old3DS NFC module was added with [[9.3.0-21|9.3.0-X]].<br />
<br />
On New3DS NFC module uses the NFC hardware via the [[I2C_Services|i2c::NFC]] and [[GPIO_Services|gpio:NFC]] services. On Old3DS NFC module communicates with a NFC peripheral via IR with the IRUSER service.<br />
<br />
A total of 6 sessions can be open simultaneously for all of these services combined.<br />
<br />
=NFC services=<br />
==NFC user service "nfc:u"==<br />
This is the NFC service used by regular applications.<br />
<br />
This was first seen in the Super Smash Bros eShop demo (only in the exheader, the demo doesn't actually use it), but at that time no system-module was available for NFC on CDN. The first regular application to use this service was Super Smash Bros, with the v1.0.5 game-update, which used the new 9.3.0-21 command set.<br />
<br />
==NFC management service "nfc:m"==<br />
This is used by the [[amiibo Settings]] applet.<br />
<br />
==NFC development service "nfc:dev"==<br />
This service seems to be intended for use only on dev-units(or at least some of the command(s)).<br />
<br />
==NFC service "nfc:p"==<br />
This service is used by the mint library-applet, starting with [[9.3.0-21]]. This service was added to the mint service-access-control list with [[9.0.0-20]].<br />
<br />
==NFC service "nfc:r"==<br />
This service has no known use.<br />
<br />
==NFC service "nfc:s"==<br />
This service has no known use.<br />
<br />
="nfc:u" and "nfc:m" command set=<br />
There are two different revisions of the NFC module. First version was introduced on New3DS only with firmware 8.1.0-0_New3DS. Second version made its appearance with 9.3.0-X, on both Old3DS and New3DS.<br />
<br />
These two versions are not interchangeable and not compatible, since the newer version uses a different command set and has no implemented commands from the older version. This does not introduce compatibility problems since no retail software used the NFC module before the Super Smash Bros for 3DS, whose NFC update required 9.3.0-21.<br />
<br />
==Post-9.3.0-21==<br />
Commands for post-9.3.0-21 have been extracted by analyzing the amiibo Settings applet. Therefore this table may be missing commands.<br />
<br />
Command header is stored at [[Thread Local Storage|TLS]]+0x80. Input and output parameters, if any, are set at TLS+0x84 onwards. If the command specifies has a parameter named "pid", this value has to be set to 0x20, as the kernel will replace the next word ("pidPlaceholder" - which can be left uninitialized) with the process' real PID (see [[IPC_Command_Structure]]).<br />
<br />
Note that the function name is actually a nickname for easeness of reading, as original function names have been stripped off the binaries.<br />
{| class="wikitable" border="1"<br />
|-<br />
! Command Header<br />
! Name<br />
! Input<br />
! Output<br />
! Notes<br />
|-<br />
| 0x00010040<br />
| nfcInit<br />
| u8 unknownA<br />
| s32 result<br />
|<br />
|-<br />
| 0x00020040<br />
| nfcStop<br />
| u8 unknownA<br />
| s32 result<br />
|<br />
|-<br />
| 0x00050040<br />
| ???<br />
| u16 unknownA<br />
| s32 result<br />
|<br />
|-<br />
| 0x00060000<br />
| ???<br />
|<br />
| s32 result<br />
|<br />
|-<br />
| 0x00080000<br />
| ???<br />
| void<br />
| s32 result<br />
|<br />
|-<br />
| 0x00090002<br />
| ???<br />
| u32 pid, u32 pidPlaceholder<br />
| s32 result<br />
|<br />
|-<br />
| 0x000A0000<br />
| ???<br />
| void<br />
| s32 result<br />
|<br />
|-<br />
| 0x000D0000<br />
| ???<br />
| void<br />
| s32 result, u8 unknownA<br />
|<br />
|-<br />
| 0x000F0000<br />
| ???<br />
| void<br />
| u32 result, u32 unknownA<br />
|<br />
|-<br />
| 0x00100000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA[24]<br />
|<br />
|-<br />
| 0x00110000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA[8], u32 unknownB[2], u32 unknownC<br />
|<br />
|-<br />
| 0x00120000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA<br />
|<br />
|-<br />
| 0x00130040<br />
| ???<br />
| u32 unknownA<br />
| s32 result<br />
|<br />
|-<br />
| 0x00140384<br />
| ???<br />
| u32 unknownA, u32 unknownB, u8 unknownB[48], u32 pid, u32 pidPlaceholder, u32 (buffer_size << 14) <nowiki>|</nowiki> 0x00000002, void * buffer<br />
| s32 result<br />
| See [[IPC_Command_Structure|IPC parameter type 1]] for explanation on buffer<br />
|-<br />
| 0x00150040<br />
| ???<br />
| u32 unknownA<br />
| s32 result<br />
|<br />
|-<br />
| 0x00170000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA[42]<br />
|<br />
|-<br />
| 0x00180000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA[16]<br />
|<br />
|-<br />
| 0x04060000<br />
| ???<br />
| void<br />
| s32 result<br />
|<br />
|}<br />
<br />
==Pre-9.3.0-21==<br />
{| class="wikitable" border="1"<br />
|-<br />
! Command Header<br />
! Description<br />
|-<br />
| 0x00010000<br />
| Initialize<br />
|-<br />
| 0x00020000<br />
| Shutdown<br />
|-<br />
| 0x00030000<br />
| GetNFCState. This writes an output u8 to cmdreply[2]: 0 = not initialized, 1 = just initialized, 5 = data transfer ready, ...<br />
|-<br />
| 0x00040000<br />
| This writes an output handle to cmdreply[3].<br />
|-<br />
| 0x00050000<br />
| This writes an output handle to cmdreply[3].<br />
|-<br />
| 0x00060040<br />
| (u8 input)<br />
|-<br />
| 0x00070000<br />
| The user process must setup the output-buffer hdr+ptr data @ TLS+0x180 when using this. cmdreply[2] = actual output data size?<br />
|-<br />
| 0x00080100<br />
| (<0x10-bytes starting at cmdreq[1]>)<br />
|-<br />
| 0x00090000<br />
| <br />
|-<br />
| 0x000A0000<br />
| The user process must setup the output-buffer hdr+ptr data @ TLS+0x180 when using this.<br />
|-<br />
| 0x000B0042<br />
| (u32 size, ((Size<<14) <nowiki>|</nowiki> 2), inbufptr)<br />
|-<br />
| 0x000C0044<br />
| (u32 size, 0x20, <procid set by kernel>, ((Size<<14) <nowiki>|</nowiki> 0x402), inbufptr)<br />
|-<br />
| 0x000D0040<br />
| (u16 in)<br />
|-<br />
| 0x000E0000<br />
| <br />
|-<br />
| 0x000F00C2<br />
| (u32 unk0, u32 unk1, u32 unk2, ((Size<<14) <nowiki>|</nowiki> 0x802), inbufptr)<br />
|-<br />
| 0x00100040<br />
| (u32 in)<br />
|-<br />
| 0x00110040<br />
| (u32 in)<br />
|-<br />
| 0x00120040<br />
| (u32 in)<br />
|-<br />
| 0x00130000<br />
| Writes an output u32 to cmdreply[2].<br />
|-<br />
| 0x00140000<br />
| This writes an output 0x30-byte struct starting at cmdreply[2].<br />
|-<br />
| 0x00150000<br />
| This writes an output 0x2C-byte struct starting at cmdreply[2].<br />
|-<br />
| 0x00160000<br />
| <br />
|-<br />
| 0x00170000<br />
| <br />
|}<br />
<br />
=NFC module savedata=<br />
* "/nfp_backup.dat" Going by the filename this seems to contain data backed up from amiibo.</div>
Socram8888
https://www.3dbrew.org/w/index.php?title=NFC_Services&diff=11797
NFC Services
2015-03-02T15:12:01Z
<p>Socram8888: </p>
<hr />
<div>The New3DS NFC module was added with [[8.1.0-0_New3DS]]. The Old3DS NFC module was added with [[9.3.0-21|9.3.0-X]].<br />
<br />
On New3DS NFC module uses the NFC hardware via the [[I2C_Services|i2c::NFC]] and [[GPIO_Services|gpio:NFC]] services. On Old3DS NFC module communicates with a NFC peripheral via IR with the IRUSER service.<br />
<br />
A total of 6 sessions can be open simultaneously for all of these services combined.<br />
<br />
=NFC services=<br />
==NFC user service "nfc:u"==<br />
This is the NFC service used by regular applications.<br />
<br />
This was first seen in the Super Smash Bros eShop demo (only in the exheader, the demo doesn't actually use it), but at that time no system-module was available for NFC on CDN. The first regular application to use this service was Super Smash Bros, with the v1.0.5 game-update, which used the new 9.3.0-21 command set.<br />
<br />
==NFC management service "nfc:m"==<br />
This is used by the [[amiibo Settings]] applet.<br />
<br />
==NFC development service "nfc:dev"==<br />
This service seems to be intended for use only on dev-units(or at least some of the command(s)).<br />
<br />
==NFC service "nfc:p"==<br />
This service is used by the mint library-applet, starting with [[9.3.0-21]]. This service was added to the mint service-access-control list with [[9.0.0-20]].<br />
<br />
==NFC service "nfc:r"==<br />
This service has no known use.<br />
<br />
==NFC service "nfc:s"==<br />
This service has no known use.<br />
<br />
="nfc:u" and "nfc:m" command set=<br />
There are two different revisions of the NFC module. First version was introduced on New3DS only with firmware 8.1.0-0_New3DS. Second version made its appearance with 9.3.0-X, on both Old3DS and New3DS.<br />
<br />
These two versions are not interchangeable and not compatible, since the newer version uses a different command set and has no implemented commands from the older version. This does not introduce compatibility problems since no retail software used the NFC module before the Super Smash Bros for 3DS, whose NFC update required 9.3.0-21.<br />
<br />
==Post-9.3.0-21==<br />
Commands for post-9.3.0-21 have been extracted by analyzing the amiibo Settings applet. Therefore this table may be missing commands.<br />
<br />
Command header is stored at [[Thread Local Storage|TLS]]+0x80. Input and output parameters, if any, are set at TLS+0x84 onwards. If the command specifies has a parameter named "pid", this value has to be set to 0x20, as the kernel will replace the next word ("pidPlaceholder") with the process' real PID (see [[IPC_Command_Structure]]).<br />
<br />
Note that the function name is actually a nickname for easeness of reading, as original function names have been stripped off the binaries.<br />
{| class="wikitable" border="1"<br />
|-<br />
! Command Header<br />
! Name<br />
! Input<br />
! Output<br />
! Notes<br />
|-<br />
| 0x00010040<br />
| nfcInit<br />
| u8 unknownA<br />
| s32 result<br />
|<br />
|-<br />
| 0x00020040<br />
| nfcStop<br />
| u8 unknownA<br />
| s32 result<br />
|<br />
|-<br />
| 0x00050040<br />
| ???<br />
| u16 unknownA<br />
| s32 result<br />
|<br />
|-<br />
| 0x00060000<br />
| ???<br />
|<br />
| s32 result<br />
|<br />
|-<br />
| 0x00080000<br />
| ???<br />
| void<br />
| s32 result<br />
|<br />
|-<br />
| 0x00090002<br />
| ???<br />
| u32 pid, u32 pidPlaceholder<br />
| s32 result<br />
|<br />
|-<br />
| 0x000A0000<br />
| ???<br />
| void<br />
| s32 result<br />
|<br />
|-<br />
| 0x000D0000<br />
| ???<br />
| void<br />
| s32 result, u8 unknownA<br />
|<br />
|-<br />
| 0x000F0000<br />
| ???<br />
| void<br />
| u32 result, u32 unknownA<br />
|<br />
|-<br />
| 0x00100000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA[24]<br />
|<br />
|-<br />
| 0x00110000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA[8], u32 unknownB[2], u32 unknownC<br />
|<br />
|-<br />
| 0x00120000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA<br />
|<br />
|-<br />
| 0x00130040<br />
| ???<br />
| u32 unknownA<br />
| s32 result<br />
|<br />
|-<br />
| 0x00140384<br />
| ???<br />
| u32 unknownA, u32 unknownB, u8 unknownB[48], u32 pid, u32 pidPlaceholder, u32 (buffer_size << 14) <nowiki>|</nowiki> 0x00000002, void * buffer<br />
| s32 result<br />
| See [[IPC_Command_Structure|IPC parameter type 1]] for explanation on buffer<br />
|-<br />
| 0x00150040<br />
| ???<br />
| u32 unknownA<br />
| s32 result<br />
|<br />
|-<br />
| 0x00170000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA[42]<br />
|<br />
|-<br />
| 0x00180000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA[16]<br />
|<br />
|-<br />
| 0x04060000<br />
| ???<br />
| void<br />
| s32 result<br />
|<br />
|}<br />
<br />
==Pre-9.3.0-21==<br />
{| class="wikitable" border="1"<br />
|-<br />
! Command Header<br />
! Description<br />
|-<br />
| 0x00010000<br />
| Initialize<br />
|-<br />
| 0x00020000<br />
| Shutdown<br />
|-<br />
| 0x00030000<br />
| GetNFCState. This writes an output u8 to cmdreply[2]: 0 = not initialized, 1 = just initialized, 5 = data transfer ready, ...<br />
|-<br />
| 0x00040000<br />
| This writes an output handle to cmdreply[3].<br />
|-<br />
| 0x00050000<br />
| This writes an output handle to cmdreply[3].<br />
|-<br />
| 0x00060040<br />
| (u8 input)<br />
|-<br />
| 0x00070000<br />
| The user process must setup the output-buffer hdr+ptr data @ TLS+0x180 when using this. cmdreply[2] = actual output data size?<br />
|-<br />
| 0x00080100<br />
| (<0x10-bytes starting at cmdreq[1]>)<br />
|-<br />
| 0x00090000<br />
| <br />
|-<br />
| 0x000A0000<br />
| The user process must setup the output-buffer hdr+ptr data @ TLS+0x180 when using this.<br />
|-<br />
| 0x000B0042<br />
| (u32 size, ((Size<<14) <nowiki>|</nowiki> 2), inbufptr)<br />
|-<br />
| 0x000C0044<br />
| (u32 size, 0x20, <procid set by kernel>, ((Size<<14) <nowiki>|</nowiki> 0x402), inbufptr)<br />
|-<br />
| 0x000D0040<br />
| (u16 in)<br />
|-<br />
| 0x000E0000<br />
| <br />
|-<br />
| 0x000F00C2<br />
| (u32 unk0, u32 unk1, u32 unk2, ((Size<<14) <nowiki>|</nowiki> 0x802), inbufptr)<br />
|-<br />
| 0x00100040<br />
| (u32 in)<br />
|-<br />
| 0x00110040<br />
| (u32 in)<br />
|-<br />
| 0x00120040<br />
| (u32 in)<br />
|-<br />
| 0x00130000<br />
| Writes an output u32 to cmdreply[2].<br />
|-<br />
| 0x00140000<br />
| This writes an output 0x30-byte struct starting at cmdreply[2].<br />
|-<br />
| 0x00150000<br />
| This writes an output 0x2C-byte struct starting at cmdreply[2].<br />
|-<br />
| 0x00160000<br />
| <br />
|-<br />
| 0x00170000<br />
| <br />
|}<br />
<br />
=NFC module savedata=<br />
* "/nfp_backup.dat" Going by the filename this seems to contain data backed up from amiibo.</div>
Socram8888
https://www.3dbrew.org/w/index.php?title=NFC_Services&diff=11795
NFC Services
2015-03-02T11:29:53Z
<p>Socram8888: </p>
<hr />
<div>The New3DS NFC module was added with [[8.1.0-0_New3DS]]. The Old3DS NFC module was added with [[9.3.0-21|9.3.0-X]].<br />
<br />
On New3DS NFC module uses the NFC hardware via the [[I2C_Services|i2c::NFC]] and [[GPIO_Services|gpio:NFC]] services. On Old3DS NFC module communicates with a NFC peripheral via IR with the IRUSER service.<br />
<br />
A total of 6 sessions can be open simultaneously for all of these services combined.<br />
<br />
=NFC services=<br />
==NFC user service "nfc:u"==<br />
This is the NFC service used by regular applications.<br />
<br />
This was first seen in the Super Smash Bros eShop demo (only in the exheader, the demo doesn't actually use it), but at that time no system-module was available for NFC on CDN. The first regular application to use this service was Super Smash Bros, with the v1.0.5 game-update, which used the new 9.3.0-21 command set.<br />
<br />
==NFC management service "nfc:m"==<br />
This is used by the [[amiibo Settings]] applet.<br />
<br />
==NFC development service "nfc:dev"==<br />
This service seems to be intended for use only on dev-units(or at least some of the command(s)).<br />
<br />
==NFC service "nfc:p"==<br />
This service is used by the mint library-applet, starting with [[9.3.0-21]]. This service was added to the mint service-access-control list with [[9.0.0-20]].<br />
<br />
==NFC service "nfc:r"==<br />
This service has no known use.<br />
<br />
==NFC service "nfc:s"==<br />
This service has no known use.<br />
<br />
="nfc:u" and "nfc:m" command set=<br />
There are two different revisions of the NFC module. First version was introduced on New3DS only with firmware 8.1.0-0_New3DS. Second version made its appearance with 9.3.0-X, on both Old3DS and New3DS.<br />
<br />
These two versions are not interchangeable and not compatible, since the newer version uses a different command set and has no implemented commands from the older version. This does not introduce compatibility problems since no retail software used the NFC module before the Super Smash Bros for 3DS, whose NFC update required 9.3.0-21.<br />
<br />
==Post-9.3.0-21==<br />
Commands for post-9.3.0-21 have been extracted by analyzing the amiibo Settings applet. Therefore this table may be missing commands.<br />
<br />
Command header is stored at [[Thread Local Storage|TLS]]+0x80. Input and output parameters, if any, are set at TLS+0x84 onwards. If the command specifies has a parameter named "pid", this value has to be set to 0x20, as the kernel will replace the next word ("pidPlaceholder") with the process' real PID (see [[IPC_Command_Structure]]).<br />
<br />
Note that the function name is actually a nickname for easeness of reading, as original function names have been stripped off the binaries.<br />
{| class="wikitable" border="1"<br />
|-<br />
! Command Header<br />
! Name<br />
! Input<br />
! Output<br />
! Notes<br />
|-<br />
| 0x00010040<br />
| nfcInit<br />
| u8 unknownA<br />
| s32 result<br />
|<br />
|-<br />
| 0x00020040<br />
| nfcStop<br />
| u8 unknownA<br />
| s32 result<br />
|<br />
|-<br />
| 0x00050040<br />
| ???<br />
| u16 unknownA<br />
| s32 result<br />
|<br />
|-<br />
| 0x00080000<br />
| ???<br />
| void<br />
| s32 result<br />
|<br />
|-<br />
| 0x00090002<br />
| ???<br />
| u32 pid, u32 pidPlaceholder<br />
| s32 result<br />
|<br />
|-<br />
| 0x000A0000<br />
| ???<br />
| void<br />
| s32 result<br />
|<br />
|-<br />
| 0x000F0000<br />
| ???<br />
| void<br />
| u32 result, u32 unknownA<br />
|<br />
|-<br />
| 0x00100000<br />
| ???<br />
| void<br />
| s32 result, u8 unknownA[0x60]<br />
|<br />
|-<br />
| 0x00110000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA[8], u32 unknownB[2], u32 unknownC<br />
|<br />
|-<br />
| 0x00120000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA<br />
|<br />
|-<br />
| 0x00130040<br />
| ???<br />
| u32 unknownA<br />
| s32 result<br />
|<br />
|-<br />
| 0x00140384<br />
| ???<br />
| u32 unknownA, u32 unknownB, u8 unknownB[0x30], u32 pid, u32 pidPlaceholder, u32 (buffer_size << 14) <nowiki>|</nowiki> 0x00000002, u32 * buffer<br />
| s32 result<br />
| See [[IPC_Command_Structure|IPC parameter type 1]] for explanation on buffer<br />
|-<br />
| 0x00150040<br />
| ???<br />
| u32 unknownA<br />
| s32 result<br />
|<br />
|-<br />
| 0x00170000<br />
| ???<br />
| void<br />
| s32 result, u8 unknownA[0xA8]<br />
|<br />
|-<br />
| 0x04060000<br />
| ???<br />
| void<br />
| s32 result<br />
|<br />
|}<br />
<br />
==Pre-9.3.0-21==<br />
{| class="wikitable" border="1"<br />
|-<br />
! Command Header<br />
! Description<br />
|-<br />
| 0x00010000<br />
| Initialize<br />
|-<br />
| 0x00020000<br />
| Shutdown<br />
|-<br />
| 0x00030000<br />
| GetNFCState. This writes an output u8 to cmdreply[2]: 0 = not initialized, 1 = just initialized, 5 = data transfer ready, ...<br />
|-<br />
| 0x00040000<br />
| This writes an output handle to cmdreply[3].<br />
|-<br />
| 0x00050000<br />
| This writes an output handle to cmdreply[3].<br />
|-<br />
| 0x00060040<br />
| (u8 input)<br />
|-<br />
| 0x00070000<br />
| The user process must setup the output-buffer hdr+ptr data @ TLS+0x180 when using this. cmdreply[2] = actual output data size?<br />
|-<br />
| 0x00080100<br />
| (<0x10-bytes starting at cmdreq[1]>)<br />
|-<br />
| 0x00090000<br />
| <br />
|-<br />
| 0x000A0000<br />
| The user process must setup the output-buffer hdr+ptr data @ TLS+0x180 when using this.<br />
|-<br />
| 0x000B0042<br />
| (u32 size, ((Size<<14) <nowiki>|</nowiki> 2), inbufptr)<br />
|-<br />
| 0x000C0044<br />
| (u32 size, 0x20, <procid set by kernel>, ((Size<<14) <nowiki>|</nowiki> 0x402), inbufptr)<br />
|-<br />
| 0x000D0040<br />
| (u16 in)<br />
|-<br />
| 0x000E0000<br />
| <br />
|-<br />
| 0x000F00C2<br />
| (u32 unk0, u32 unk1, u32 unk2, ((Size<<14) <nowiki>|</nowiki> 0x802), inbufptr)<br />
|-<br />
| 0x00100040<br />
| (u32 in)<br />
|-<br />
| 0x00110040<br />
| (u32 in)<br />
|-<br />
| 0x00120040<br />
| (u32 in)<br />
|-<br />
| 0x00130000<br />
| Writes an output u32 to cmdreply[2].<br />
|-<br />
| 0x00140000<br />
| This writes an output 0x30-byte struct starting at cmdreply[2].<br />
|-<br />
| 0x00150000<br />
| This writes an output 0x2C-byte struct starting at cmdreply[2].<br />
|-<br />
| 0x00160000<br />
| <br />
|-<br />
| 0x00170000<br />
| <br />
|}<br />
<br />
=NFC module savedata=<br />
* "/nfp_backup.dat" Going by the filename this seems to contain data backed up from amiibo.</div>
Socram8888
https://www.3dbrew.org/w/index.php?title=NFC_Services&diff=11794
NFC Services
2015-03-02T10:24:26Z
<p>Socram8888: </p>
<hr />
<div>The New3DS NFC module was added with [[8.1.0-0_New3DS]]. The Old3DS NFC module was added with [[9.3.0-21|9.3.0-X]].<br />
<br />
On New3DS NFC module uses the NFC hardware via the [[I2C_Services|i2c::NFC]] and [[GPIO_Services|gpio:NFC]] services. On Old3DS NFC module communicates with a NFC peripheral via IR with the IRUSER service.<br />
<br />
A total of 6 sessions can be open simultaneously for all of these services combined.<br />
<br />
=NFC services=<br />
==NFC user service "nfc:u"==<br />
This is the NFC service used by regular applications.<br />
<br />
This was first seen in the Super Smash Bros eShop demo (only in the exheader, the demo doesn't actually use it), but at that time no system-module was available for NFC on CDN. The first regular application to use this service was Super Smash Bros, with the v1.0.5 game-update, which used the new 9.3.0-21 command set.<br />
<br />
==NFC management service "nfc:m"==<br />
This is used by the [[amiibo Settings]] applet.<br />
<br />
==NFC development service "nfc:dev"==<br />
This service seems to be intended for use only on dev-units(or at least some of the command(s)).<br />
<br />
==NFC service "nfc:p"==<br />
This service is used by the mint library-applet, starting with [[9.3.0-21]]. This service was added to the mint service-access-control list with [[9.0.0-20]].<br />
<br />
==NFC service "nfc:r"==<br />
This service has no known use.<br />
<br />
==NFC service "nfc:s"==<br />
This service has no known use.<br />
<br />
="nfc:u" and "nfc:m" command set=<br />
There are two different revisions of the NFC module. First version was introduced on New3DS only with firmware 8.1.0-0_New3DS. Second version made its appearance with 9.3.0-X, on both Old3DS and New3DS.<br />
<br />
These two versions are not interchangeable and not compatible, since the newer version uses a different command set and has no implemented commands from the older version. This does not introduce compatibility problems since no retail software used the NFC module before the Super Smash Bros for 3DS, whose NFC update required 9.3.0-21.<br />
<br />
==Post-9.3.0-21==<br />
Commands for post-9.3.0-21 have been extracted by analyzing the amiibo Settings applet. Therefore this table may be missing commands.<br />
<br />
Command header is stored at TLS+0x80. Input and output parameters, if any, are set at TLS+0x84 onwards. If the command specifies has a parameter named "pid", this value has to be set to 0x20, as the kernel will replace this magic value with the process' real PID.<br />
<br />
Note that the function name is actually a nickname for easeness of reading, as original function names have been stripped off the binaries.<br />
{| class="wikitable" border="1"<br />
|-<br />
! Command Header<br />
! Name<br />
! Input<br />
! Output<br />
! Notes<br />
|-<br />
| 0x00010040<br />
| nfcInit<br />
| u8 unknownA<br />
| s32 result<br />
|<br />
|-<br />
| 0x00020040<br />
| nfcStop<br />
| u8 unknownA<br />
| s32 result<br />
|<br />
|-<br />
| 0x00050040<br />
| ???<br />
| u16 unknownA<br />
| s32 result<br />
|<br />
|-<br />
| 0x00080000<br />
| ???<br />
| void<br />
| s32 result<br />
|<br />
|-<br />
| 0x00090002<br />
| ???<br />
| u32 pid<br />
| s32 result<br />
|<br />
|-<br />
| 0x000A0000<br />
| ???<br />
| void<br />
| s32 result<br />
|<br />
|-<br />
| 0x000F0000<br />
| ???<br />
| void<br />
| u32 result, u32 unknownA<br />
|<br />
|-<br />
| 0x00100000<br />
| ???<br />
| void<br />
| s32 result, u8 unknownA[0x60]<br />
|<br />
|-<br />
| 0x00110000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA[8], u32 unknownB[2], u32 unknownC<br />
|<br />
|-<br />
| 0x00130040<br />
| ???<br />
| u32 unknownA<br />
| s32 result<br />
|<br />
|-<br />
| 0x00150040<br />
| ???<br />
| u32 unknownA<br />
| s32 result<br />
|<br />
|-<br />
| 0x00170000<br />
| ???<br />
| void<br />
| s32 result, u8 unknownA[0xA8]<br />
|<br />
|-<br />
| 0x04060000<br />
| ???<br />
| void<br />
| s32 result<br />
|<br />
|}<br />
<br />
==Pre-9.3.0-21==<br />
{| class="wikitable" border="1"<br />
|-<br />
! Command Header<br />
! Description<br />
|-<br />
| 0x00010000<br />
| Initialize<br />
|-<br />
| 0x00020000<br />
| Shutdown<br />
|-<br />
| 0x00030000<br />
| GetNFCState. This writes an output u8 to cmdreply[2]: 0 = not initialized, 1 = just initialized, 5 = data transfer ready, ...<br />
|-<br />
| 0x00040000<br />
| This writes an output handle to cmdreply[3].<br />
|-<br />
| 0x00050000<br />
| This writes an output handle to cmdreply[3].<br />
|-<br />
| 0x00060040<br />
| (u8 input)<br />
|-<br />
| 0x00070000<br />
| The user process must setup the output-buffer hdr+ptr data @ TLS+0x180 when using this. cmdreply[2] = actual output data size?<br />
|-<br />
| 0x00080100<br />
| (<0x10-bytes starting at cmdreq[1]>)<br />
|-<br />
| 0x00090000<br />
| <br />
|-<br />
| 0x000A0000<br />
| The user process must setup the output-buffer hdr+ptr data @ TLS+0x180 when using this.<br />
|-<br />
| 0x000B0042<br />
| (u32 size, ((Size<<14) <nowiki>|</nowiki> 2), inbufptr)<br />
|-<br />
| 0x000C0044<br />
| (u32 size, 0x20, <procid set by kernel>, ((Size<<14) <nowiki>|</nowiki> 0x402), inbufptr)<br />
|-<br />
| 0x000D0040<br />
| (u16 in)<br />
|-<br />
| 0x000E0000<br />
| <br />
|-<br />
| 0x000F00C2<br />
| (u32 unk0, u32 unk1, u32 unk2, ((Size<<14) <nowiki>|</nowiki> 0x802), inbufptr)<br />
|-<br />
| 0x00100040<br />
| (u32 in)<br />
|-<br />
| 0x00110040<br />
| (u32 in)<br />
|-<br />
| 0x00120040<br />
| (u32 in)<br />
|-<br />
| 0x00130000<br />
| Writes an output u32 to cmdreply[2].<br />
|-<br />
| 0x00140000<br />
| This writes an output 0x30-byte struct starting at cmdreply[2].<br />
|-<br />
| 0x00150000<br />
| This writes an output 0x2C-byte struct starting at cmdreply[2].<br />
|-<br />
| 0x00160000<br />
| <br />
|-<br />
| 0x00170000<br />
| <br />
|}<br />
<br />
=NFC module savedata=<br />
* "/nfp_backup.dat" Going by the filename this seems to contain data backed up from amiibo.</div>
Socram8888
https://www.3dbrew.org/w/index.php?title=NFC_Services&diff=11793
NFC Services
2015-03-01T22:13:06Z
<p>Socram8888: </p>
<hr />
<div>The New3DS NFC module was added with [[8.1.0-0_New3DS]]. The Old3DS NFC module was added with [[9.3.0-21|9.3.0-X]].<br />
<br />
On New3DS NFC module uses the NFC hardware via the [[I2C_Services|i2c::NFC]] and [[GPIO_Services|gpio:NFC]] services. On Old3DS NFC module communicates with a NFC peripheral via IR with the IRUSER service.<br />
<br />
A total of 6 sessions can be open simultaneously for all of these services combined.<br />
<br />
=NFC services=<br />
==NFC user service "nfc:u"==<br />
This is the NFC service used by regular applications.<br />
<br />
This was first seen in the Super Smash Bros eShop demo (only in the exheader, the demo doesn't actually use it), but at that time no system-module was available for NFC on CDN. The first regular application to use this service was Super Smash Bros, with the v1.0.5 game-update, which used the new 9.3.0-21 command set.<br />
<br />
==NFC management service "nfc:m"==<br />
This is used by the [[amiibo Settings]] applet.<br />
<br />
==NFC development service "nfc:dev"==<br />
This service seems to be intended for use only on dev-units(or at least some of the command(s)).<br />
<br />
==NFC service "nfc:p"==<br />
This service is used by the mint library-applet, starting with [[9.3.0-21]]. This service was added to the mint service-access-control list with [[9.0.0-20]].<br />
<br />
==NFC service "nfc:r"==<br />
This service has no known use.<br />
<br />
==NFC service "nfc:s"==<br />
This service has no known use.<br />
<br />
="nfc:u" and "nfc:m" command set=<br />
There are two different revisions of the NFC module. First version was introduced on New3DS only with firmware 8.1.0-0_New3DS. Second version made its appearance with 9.3.0-X, on both Old3DS and New3DS.<br />
<br />
These two versions are not interchangeable and not compatible, since the newer version uses a different command set and has no implemented commands from the older version. This does not introduce compatibility problems since no retail software used the NFC module before the Super Smash Bros for 3DS, whose NFC update required 9.3.0-21.<br />
<br />
==Post-9.3.0-21==<br />
Commands for post-9.3.0-21 have been extracted by analyzing the amiibo Settings applet. Therefore this table may be missing commands.<br />
{| class="wikitable" border="1"<br />
|-<br />
! Command Header<br />
! Name<br />
! Input<br />
! Output<br />
! Notes<br />
|-<br />
| 0x00010040<br />
| nfcInit<br />
| u8 unknownA<br />
| s32 result<br />
|<br />
|-<br />
| 0x00020040<br />
| nfcStop<br />
| u8 unknownA<br />
| s32 result<br />
|<br />
|-<br />
| 0x00050040<br />
| ???<br />
| u16 unknownA<br />
| s32 result<br />
|<br />
|-<br />
| 0x00080000<br />
| ???<br />
| void<br />
| s32 result<br />
|<br />
|-<br />
| 0x00090002<br />
| ???<br />
| u32 pid<br />
| s32 result<br />
| "pid" must be set to 0x20<br />
|-<br />
| 0x000A0000<br />
| ???<br />
| void<br />
| s32 result<br />
|<br />
|-<br />
| 0x000F0000<br />
| ???<br />
| void<br />
| u32 result, u32 unknownA<br />
|<br />
|-<br />
| 0x00110000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA[8], u32 unknownB[2], u32 unknownC<br />
|<br />
|-<br />
| 0x00130040<br />
| ???<br />
| u32 unknownA<br />
| s32 result<br />
|<br />
|-<br />
| 0x00150040<br />
| ???<br />
| u32 unknownA<br />
| s32 result<br />
|<br />
|-<br />
| 0x04060000<br />
| ???<br />
| void<br />
| s32 result<br />
|<br />
|}<br />
<br />
==Pre-9.3.0-21==<br />
{| class="wikitable" border="1"<br />
|-<br />
! Command Header<br />
! Description<br />
|-<br />
| 0x00010000<br />
| Initialize<br />
|-<br />
| 0x00020000<br />
| Shutdown<br />
|-<br />
| 0x00030000<br />
| GetNFCState. This writes an output u8 to cmdreply[2]: 0 = not initialized, 1 = just initialized, 5 = data transfer ready, ...<br />
|-<br />
| 0x00040000<br />
| This writes an output handle to cmdreply[3].<br />
|-<br />
| 0x00050000<br />
| This writes an output handle to cmdreply[3].<br />
|-<br />
| 0x00060040<br />
| (u8 input)<br />
|-<br />
| 0x00070000<br />
| The user process must setup the output-buffer hdr+ptr data @ TLS+0x180 when using this. cmdreply[2] = actual output data size?<br />
|-<br />
| 0x00080100<br />
| (<0x10-bytes starting at cmdreq[1]>)<br />
|-<br />
| 0x00090000<br />
| <br />
|-<br />
| 0x000A0000<br />
| The user process must setup the output-buffer hdr+ptr data @ TLS+0x180 when using this.<br />
|-<br />
| 0x000B0042<br />
| (u32 size, ((Size<<14) <nowiki>|</nowiki> 2), inbufptr)<br />
|-<br />
| 0x000C0044<br />
| (u32 size, 0x20, <procid set by kernel>, ((Size<<14) <nowiki>|</nowiki> 0x402), inbufptr)<br />
|-<br />
| 0x000D0040<br />
| (u16 in)<br />
|-<br />
| 0x000E0000<br />
| <br />
|-<br />
| 0x000F00C2<br />
| (u32 unk0, u32 unk1, u32 unk2, ((Size<<14) <nowiki>|</nowiki> 0x802), inbufptr)<br />
|-<br />
| 0x00100040<br />
| (u32 in)<br />
|-<br />
| 0x00110040<br />
| (u32 in)<br />
|-<br />
| 0x00120040<br />
| (u32 in)<br />
|-<br />
| 0x00130000<br />
| Writes an output u32 to cmdreply[2].<br />
|-<br />
| 0x00140000<br />
| This writes an output 0x30-byte struct starting at cmdreply[2].<br />
|-<br />
| 0x00150000<br />
| This writes an output 0x2C-byte struct starting at cmdreply[2].<br />
|-<br />
| 0x00160000<br />
| <br />
|-<br />
| 0x00170000<br />
| <br />
|}<br />
<br />
=NFC module savedata=<br />
* "/nfp_backup.dat" Going by the filename this seems to contain data backed up from amiibo.</div>
Socram8888
https://www.3dbrew.org/w/index.php?title=NFC_Services&diff=11792
NFC Services
2015-03-01T22:04:42Z
<p>Socram8888: </p>
<hr />
<div>The New3DS NFC module was added with [[8.1.0-0_New3DS]]. The Old3DS NFC module was added with [[9.3.0-21|9.3.0-X]].<br />
<br />
On New3DS NFC module uses the NFC hardware via the [[I2C_Services|i2c::NFC]] and [[GPIO_Services|gpio:NFC]] services. On Old3DS NFC module communicates with a NFC peripheral via IR with the IRUSER service.<br />
<br />
A total of 6 sessions can be open simultaneously for all of these services combined.<br />
<br />
=NFC services=<br />
==NFC user service "nfc:u"==<br />
This is the NFC service used by regular applications.<br />
<br />
This was first seen in the Super Smash Bros eShop demo (only in the exheader, the demo doesn't actually use it), but at that time no system-module was available for NFC on CDN. The first regular application to use this service was Super Smash Bros, with the v1.0.5 game-update, which used the new 9.3.0-21 command set.<br />
<br />
==NFC management service "nfc:m"==<br />
This is used by the [[amiibo Settings]] applet.<br />
<br />
==NFC development service "nfc:dev"==<br />
This service seems to be intended for use only on dev-units(or at least some of the command(s)).<br />
<br />
==NFC service "nfc:p"==<br />
This service is used by the mint library-applet, starting with [[9.3.0-21]]. This service was added to the mint service-access-control list with [[9.0.0-20]].<br />
<br />
==NFC service "nfc:r"==<br />
This service has no known use.<br />
<br />
==NFC service "nfc:s"==<br />
This service has no known use.<br />
<br />
="nfc:u" and "nfc:m" command set=<br />
There are two different revisions of the NFC module. First version was introduced on New3DS only with firmware 8.1.0-0_New3DS. Second version made its appearance with 9.3.0-X, on both Old3DS and New3DS.<br />
<br />
These two versions are not interchangeable and not compatible, since the newer version uses a different command set and has no implemented commands from the older version. This does not introduce compatibility problems since no retail software used the NFC module before the Super Smash Bros for 3DS, whose NFC update required 9.3.0-21.<br />
<br />
==Post-9.3.0-21==<br />
Commands for post-9.3.0-21 have been extracted by analyzing the amiibo Settings applet. Therefore this table may be missing commands.<br />
{| class="wikitable" border="1"<br />
|-<br />
! Command Header<br />
! Name<br />
! Input<br />
! Output<br />
|-<br />
| 0x00010040<br />
| nfcInit<br />
| u8 unknownA<br />
| s32 result<br />
|-<br />
| 0x00020040<br />
| nfcStop<br />
| u8 unknownA<br />
| s32 result<br />
|-<br />
| 0x00050040<br />
| ???<br />
| u16 unknownA<br />
| s32 result<br />
|-<br />
| 0x00080000<br />
| ???<br />
| void<br />
| s32 result<br />
|-<br />
| 0x000A0000<br />
| ???<br />
| void<br />
| s32 result<br />
|-<br />
| 0x000F0000<br />
| ???<br />
| void<br />
| u32 result, u32 unknownA<br />
|-<br />
| 0x00110000<br />
| ???<br />
| void<br />
| s32 result, u32 unknownA[8], u32 unknownB[2], u32 unknownC<br />
|-<br />
| 0x00130040<br />
| ???<br />
| u32 unknownA<br />
| s32 result<br />
|-<br />
| 0x00150040<br />
| ???<br />
| u32 unknownA<br />
| s32 result<br />
|-<br />
| 0x04060000<br />
| ???<br />
| void<br />
| s32 result<br />
|}<br />
<br />
==Pre-9.3.0-21==<br />
{| class="wikitable" border="1"<br />
|-<br />
! Command Header<br />
! Description<br />
|-<br />
| 0x00010000<br />
| Initialize<br />
|-<br />
| 0x00020000<br />
| Shutdown<br />
|-<br />
| 0x00030000<br />
| GetNFCState. This writes an output u8 to cmdreply[2]: 0 = not initialized, 1 = just initialized, 5 = data transfer ready, ...<br />
|-<br />
| 0x00040000<br />
| This writes an output handle to cmdreply[3].<br />
|-<br />
| 0x00050000<br />
| This writes an output handle to cmdreply[3].<br />
|-<br />
| 0x00060040<br />
| (u8 input)<br />
|-<br />
| 0x00070000<br />
| The user process must setup the output-buffer hdr+ptr data @ TLS+0x180 when using this. cmdreply[2] = actual output data size?<br />
|-<br />
| 0x00080100<br />
| (<0x10-bytes starting at cmdreq[1]>)<br />
|-<br />
| 0x00090000<br />
| <br />
|-<br />
| 0x000A0000<br />
| The user process must setup the output-buffer hdr+ptr data @ TLS+0x180 when using this.<br />
|-<br />
| 0x000B0042<br />
| (u32 size, ((Size<<14) <nowiki>|</nowiki> 2), inbufptr)<br />
|-<br />
| 0x000C0044<br />
| (u32 size, 0x20, <procid set by kernel>, ((Size<<14) <nowiki>|</nowiki> 0x402), inbufptr)<br />
|-<br />
| 0x000D0040<br />
| (u16 in)<br />
|-<br />
| 0x000E0000<br />
| <br />
|-<br />
| 0x000F00C2<br />
| (u32 unk0, u32 unk1, u32 unk2, ((Size<<14) <nowiki>|</nowiki> 0x802), inbufptr)<br />
|-<br />
| 0x00100040<br />
| (u32 in)<br />
|-<br />
| 0x00110040<br />
| (u32 in)<br />
|-<br />
| 0x00120040<br />
| (u32 in)<br />
|-<br />
| 0x00130000<br />
| Writes an output u32 to cmdreply[2].<br />
|-<br />
| 0x00140000<br />
| This writes an output 0x30-byte struct starting at cmdreply[2].<br />
|-<br />
| 0x00150000<br />
| This writes an output 0x2C-byte struct starting at cmdreply[2].<br />
|-<br />
| 0x00160000<br />
| <br />
|-<br />
| 0x00170000<br />
| <br />
|}<br />
<br />
=NFC module savedata=<br />
* "/nfp_backup.dat" Going by the filename this seems to contain data backed up from amiibo.</div>
Socram8888
https://www.3dbrew.org/w/index.php?title=NFC_Services&diff=11791
NFC Services
2015-03-01T20:57:05Z
<p>Socram8888: </p>
<hr />
<div>The New3DS NFC module was added with [[8.1.0-0_New3DS]]. The Old3DS NFC module was added with [[9.3.0-21|9.3.0-X]].<br />
<br />
On New3DS NFC module uses the NFC hardware via the [[I2C_Services|i2c::NFC]] and [[GPIO_Services|gpio:NFC]] services. On Old3DS NFC module communicates with a NFC peripheral via IR with the IRUSER service.<br />
<br />
A total of 6 sessions can be open simultaneously for all of these services combined.<br />
<br />
=NFC services=<br />
==NFC user service "nfc:u"==<br />
This is the NFC service used by regular applications.<br />
<br />
This was first seen in the Super Smash Bros eShop demo (only in the exheader, the demo doesn't actually use it), but at that time no system-module was available for NFC on CDN. The first regular application to use this service was Super Smash Bros, with the v1.0.5 game-update, which used the new 9.3.0-21 command set.<br />
<br />
==NFC management service "nfc:m"==<br />
This is used by the [[amiibo Settings]] applet.<br />
<br />
==NFC development service "nfc:dev"==<br />
This service seems to be intended for use only on dev-units(or at least some of the command(s)).<br />
<br />
==NFC service "nfc:p"==<br />
This service is used by the mint library-applet, starting with [[9.3.0-21]]. This service was added to the mint service-access-control list with [[9.0.0-20]].<br />
<br />
==NFC service "nfc:r"==<br />
This service has no known use.<br />
<br />
==NFC service "nfc:s"==<br />
This service has no known use.<br />
<br />
="nfc:u" and "nfc:m" command set=<br />
There are two different revisions of the NFC module. First version was introduced on New3DS only with firmware 8.1.0-0_New3DS. Second version made its appearance with 9.3.0-X, on both Old3DS and New3DS.<br />
<br />
These two versions are not interchangeable and not compatible, since the newer version uses a different command set and has no implemented commands from the older version. This does not introduce compatibility problems since no retail software used the NFC module before the Super Smash Bros for 3DS, whose NFC update required 9.3.0-21.<br />
<br />
==Post-9.3.0-21==<br />
Commands for post-9.3.0-21 have been extracted by analyzing the amiibo Settings applet. Therefore this table may be missing commands.<br />
{| class="wikitable" border="1"<br />
|-<br />
! Command Header<br />
! Name<br />
! Input<br />
! Output<br />
|-<br />
| 0x00010040<br />
| nfcInit<br />
| u8 ???<br />
| u32 result<br />
|-<br />
| 0x00020040<br />
| nfcStop<br />
| u8 ???<br />
| u32 result<br />
|-<br />
| 0x00050040<br />
| ???<br />
| u16 ???<br />
| u32 result<br />
|-<br />
| 0x00080000<br />
| ???<br />
| void<br />
| u32 result<br />
|-<br />
| 0x000A0000<br />
| ???<br />
| void<br />
| u32 result<br />
|-<br />
| 0x00130040<br />
| ???<br />
| u32 ???<br />
| u32 result<br />
|-<br />
| 0x04060000<br />
| ???<br />
| void<br />
| u32 result<br />
|}<br />
<br />
==Pre-9.3.0-21==<br />
{| class="wikitable" border="1"<br />
|-<br />
! Command Header<br />
! Description<br />
|-<br />
| 0x00010000<br />
| Initialize<br />
|-<br />
| 0x00020000<br />
| Shutdown<br />
|-<br />
| 0x00030000<br />
| GetNFCState. This writes an output u8 to cmdreply[2]: 0 = not initialized, 1 = just initialized, 5 = data transfer ready, ...<br />
|-<br />
| 0x00040000<br />
| This writes an output handle to cmdreply[3].<br />
|-<br />
| 0x00050000<br />
| This writes an output handle to cmdreply[3].<br />
|-<br />
| 0x00060040<br />
| (u8 input)<br />
|-<br />
| 0x00070000<br />
| The user process must setup the output-buffer hdr+ptr data @ TLS+0x180 when using this. cmdreply[2] = actual output data size?<br />
|-<br />
| 0x00080100<br />
| (<0x10-bytes starting at cmdreq[1]>)<br />
|-<br />
| 0x00090000<br />
| <br />
|-<br />
| 0x000A0000<br />
| The user process must setup the output-buffer hdr+ptr data @ TLS+0x180 when using this.<br />
|-<br />
| 0x000B0042<br />
| (u32 size, ((Size<<14) <nowiki>|</nowiki> 2), inbufptr)<br />
|-<br />
| 0x000C0044<br />
| (u32 size, 0x20, <procid set by kernel>, ((Size<<14) <nowiki>|</nowiki> 0x402), inbufptr)<br />
|-<br />
| 0x000D0040<br />
| (u16 in)<br />
|-<br />
| 0x000E0000<br />
| <br />
|-<br />
| 0x000F00C2<br />
| (u32 unk0, u32 unk1, u32 unk2, ((Size<<14) <nowiki>|</nowiki> 0x802), inbufptr)<br />
|-<br />
| 0x00100040<br />
| (u32 in)<br />
|-<br />
| 0x00110040<br />
| (u32 in)<br />
|-<br />
| 0x00120040<br />
| (u32 in)<br />
|-<br />
| 0x00130000<br />
| Writes an output u32 to cmdreply[2].<br />
|-<br />
| 0x00140000<br />
| This writes an output 0x30-byte struct starting at cmdreply[2].<br />
|-<br />
| 0x00150000<br />
| This writes an output 0x2C-byte struct starting at cmdreply[2].<br />
|-<br />
| 0x00160000<br />
| <br />
|-<br />
| 0x00170000<br />
| <br />
|}<br />
<br />
=NFC module savedata=<br />
* "/nfp_backup.dat" Going by the filename this seems to contain data backed up from amiibo.</div>
Socram8888
https://www.3dbrew.org/w/index.php?title=NFC_Services&diff=11790
NFC Services
2015-03-01T20:34:11Z
<p>Socram8888: /* Post-9.3.0-21 */</p>
<hr />
<div>The New3DS NFC module was added with [[8.1.0-0_New3DS]]. The Old3DS NFC module was added with [[9.3.0-21|9.3.0-X]].<br />
<br />
On New3DS NFC module uses the NFC hardware via the [[I2C_Services|i2c::NFC]] and [[GPIO_Services|gpio:NFC]] services. On Old3DS NFC module communicates with a NFC peripheral via IR with the IRUSER service.<br />
<br />
A total of 6 sessions can be open simultaneously for all of these services combined.<br />
<br />
=NFC services=<br />
==NFC user service "nfc:u"==<br />
This is the NFC service used by regular applications.<br />
<br />
This was first seen in the Super Smash Bros eShop demo (only in the exheader, the demo doesn't actually use it), but at that time no system-module was available for NFC on CDN. The first regular application to use this service was Super Smash Bros, with the v1.0.5 game-update, which used the new 9.3.0-21 command set.<br />
<br />
==NFC management service "nfc:m"==<br />
This is used by the [[amiibo Settings]] applet.<br />
<br />
==NFC development service "nfc:dev"==<br />
This service seems to be intended for use only on dev-units(or at least some of the command(s)).<br />
<br />
==NFC service "nfc:p"==<br />
This service is used by the mint library-applet, starting with [[9.3.0-21]]. This service was added to the mint service-access-control list with [[9.0.0-20]].<br />
<br />
==NFC service "nfc:r"==<br />
This service has no known use.<br />
<br />
==NFC service "nfc:s"==<br />
This service has no known use.<br />
<br />
="nfc:u" and "nfc:m" command set=<br />
There are two different revisions of the NFC module. First version was introduced on New3DS only with firmware 8.1.0-0_New3DS. Second version made its appearance with 9.3.0-X, on both Old3DS and New3DS.<br />
<br />
These two versions are not interchangeable and not compatible, since the newer version uses a different command set and has no implemented commands from the older version. This does not introduce compatibility problems since no retail software used the NFC module before the Super Smash Bros for 3DS, whose NFC update required 9.3.0-21.<br />
<br />
==Post-9.3.0-21==<br />
Commands for post-9.3.0-21 have been extracted by analyzing the amiibo Settings applet. Therefore this table may be missing commands.<br />
{| class="wikitable" border="1"<br />
|-<br />
! Command Header<br />
! Description<br />
! Notes<br />
|-<br />
| 0x00010040<br />
| nfcInit(void)<br />
|<br />
|-<br />
| 0x00020040<br />
| nfcStop(void)<br />
|<br />
|-<br />
| 0x04060000<br />
| ???(void)<br />
|<br />
|}<br />
<br />
==Pre-9.3.0-21==<br />
{| class="wikitable" border="1"<br />
|-<br />
! Command Header<br />
! Description<br />
|-<br />
| 0x00010000<br />
| Initialize<br />
|-<br />
| 0x00020000<br />
| Shutdown<br />
|-<br />
| 0x00030000<br />
| GetNFCState. This writes an output u8 to cmdreply[2]: 0 = not initialized, 1 = just initialized, 5 = data transfer ready, ...<br />
|-<br />
| 0x00040000<br />
| This writes an output handle to cmdreply[3].<br />
|-<br />
| 0x00050000<br />
| This writes an output handle to cmdreply[3].<br />
|-<br />
| 0x00060040<br />
| (u8 input)<br />
|-<br />
| 0x00070000<br />
| The user process must setup the output-buffer hdr+ptr data @ TLS+0x180 when using this. cmdreply[2] = actual output data size?<br />
|-<br />
| 0x00080100<br />
| (<0x10-bytes starting at cmdreq[1]>)<br />
|-<br />
| 0x00090000<br />
| <br />
|-<br />
| 0x000A0000<br />
| The user process must setup the output-buffer hdr+ptr data @ TLS+0x180 when using this.<br />
|-<br />
| 0x000B0042<br />
| (u32 size, ((Size<<14) <nowiki>|</nowiki> 2), inbufptr)<br />
|-<br />
| 0x000C0044<br />
| (u32 size, 0x20, <procid set by kernel>, ((Size<<14) <nowiki>|</nowiki> 0x402), inbufptr)<br />
|-<br />
| 0x000D0040<br />
| (u16 in)<br />
|-<br />
| 0x000E0000<br />
| <br />
|-<br />
| 0x000F00C2<br />
| (u32 unk0, u32 unk1, u32 unk2, ((Size<<14) <nowiki>|</nowiki> 0x802), inbufptr)<br />
|-<br />
| 0x00100040<br />
| (u32 in)<br />
|-<br />
| 0x00110040<br />
| (u32 in)<br />
|-<br />
| 0x00120040<br />
| (u32 in)<br />
|-<br />
| 0x00130000<br />
| Writes an output u32 to cmdreply[2].<br />
|-<br />
| 0x00140000<br />
| This writes an output 0x30-byte struct starting at cmdreply[2].<br />
|-<br />
| 0x00150000<br />
| This writes an output 0x2C-byte struct starting at cmdreply[2].<br />
|-<br />
| 0x00160000<br />
| <br />
|-<br />
| 0x00170000<br />
| <br />
|}<br />
<br />
=NFC module savedata=<br />
* "/nfp_backup.dat" Going by the filename this seems to contain data backed up from amiibo.</div>
Socram8888
https://www.3dbrew.org/w/index.php?title=NFC_Services&diff=11788
NFC Services
2015-03-01T20:31:43Z
<p>Socram8888: </p>
<hr />
<div>The New3DS NFC module was added with [[8.1.0-0_New3DS]]. The Old3DS NFC module was added with [[9.3.0-21|9.3.0-X]].<br />
<br />
On New3DS NFC module uses the NFC hardware via the [[I2C_Services|i2c::NFC]] and [[GPIO_Services|gpio:NFC]] services. On Old3DS NFC module communicates with a NFC peripheral via IR with the IRUSER service.<br />
<br />
A total of 6 sessions can be open simultaneously for all of these services combined.<br />
<br />
=NFC services=<br />
==NFC user service "nfc:u"==<br />
This is the NFC service used by regular applications.<br />
<br />
This was first seen in the Super Smash Bros eShop demo (only in the exheader, the demo doesn't actually use it), but at that time no system-module was available for NFC on CDN. The first regular application to use this service was Super Smash Bros, with the v1.0.5 game-update, which used the new 9.3.0-21 command set.<br />
<br />
==NFC management service "nfc:m"==<br />
This is used by the [[amiibo Settings]] applet.<br />
<br />
==NFC development service "nfc:dev"==<br />
This service seems to be intended for use only on dev-units(or at least some of the command(s)).<br />
<br />
==NFC service "nfc:p"==<br />
This service is used by the mint library-applet, starting with [[9.3.0-21]]. This service was added to the mint service-access-control list with [[9.0.0-20]].<br />
<br />
==NFC service "nfc:r"==<br />
This service has no known use.<br />
<br />
==NFC service "nfc:s"==<br />
This service has no known use.<br />
<br />
="nfc:u" and "nfc:m" command set=<br />
There are two different revisions of the NFC module. First version was introduced on New3DS only with firmware 8.1.0-0_New3DS. Second version made its appearance with 9.3.0-X, on both Old3DS and New3DS.<br />
<br />
These two versions are not interchangeable and not compatible, since the newer version uses a different command set and has no implemented commands from the older version. This does not introduce compatibility problems since no retail software used the NFC module before the Super Smash Bros for 3DS, whose NFC update required 9.3.0-21.<br />
<br />
==Post-9.3.0-21==<br />
Commands for post-9.3.0-21 have been extracted by analyzing the amiibo Settings applet. Therefore this table may be missing commands.<br />
{| class="wikitable" border="1"<br />
|-<br />
! Command Header<br />
! Command<br />
! Description<br />
|-<br />
| 0x00010040<br />
| nfcInit(void)<br />
| Initializes the NFC service.<br />
|-<br />
| 0x00020040<br />
| nfcStop(void)<br />
| Deinitializes the NFC service.<br />
|-<br />
| 0x04060000<br />
| ???(void)<br />
| ???<br />
|}<br />
<br />
==Pre-9.3.0-21==<br />
{| class="wikitable" border="1"<br />
|-<br />
! Command Header<br />
! Description<br />
|-<br />
| 0x00010000<br />
| Initialize<br />
|-<br />
| 0x00020000<br />
| Shutdown<br />
|-<br />
| 0x00030000<br />
| GetNFCState. This writes an output u8 to cmdreply[2]: 0 = not initialized, 1 = just initialized, 5 = data transfer ready, ...<br />
|-<br />
| 0x00040000<br />
| This writes an output handle to cmdreply[3].<br />
|-<br />
| 0x00050000<br />
| This writes an output handle to cmdreply[3].<br />
|-<br />
| 0x00060040<br />
| (u8 input)<br />
|-<br />
| 0x00070000<br />
| The user process must setup the output-buffer hdr+ptr data @ TLS+0x180 when using this. cmdreply[2] = actual output data size?<br />
|-<br />
| 0x00080100<br />
| (<0x10-bytes starting at cmdreq[1]>)<br />
|-<br />
| 0x00090000<br />
| <br />
|-<br />
| 0x000A0000<br />
| The user process must setup the output-buffer hdr+ptr data @ TLS+0x180 when using this.<br />
|-<br />
| 0x000B0042<br />
| (u32 size, ((Size<<14) <nowiki>|</nowiki> 2), inbufptr)<br />
|-<br />
| 0x000C0044<br />
| (u32 size, 0x20, <procid set by kernel>, ((Size<<14) <nowiki>|</nowiki> 0x402), inbufptr)<br />
|-<br />
| 0x000D0040<br />
| (u16 in)<br />
|-<br />
| 0x000E0000<br />
| <br />
|-<br />
| 0x000F00C2<br />
| (u32 unk0, u32 unk1, u32 unk2, ((Size<<14) <nowiki>|</nowiki> 0x802), inbufptr)<br />
|-<br />
| 0x00100040<br />
| (u32 in)<br />
|-<br />
| 0x00110040<br />
| (u32 in)<br />
|-<br />
| 0x00120040<br />
| (u32 in)<br />
|-<br />
| 0x00130000<br />
| Writes an output u32 to cmdreply[2].<br />
|-<br />
| 0x00140000<br />
| This writes an output 0x30-byte struct starting at cmdreply[2].<br />
|-<br />
| 0x00150000<br />
| This writes an output 0x2C-byte struct starting at cmdreply[2].<br />
|-<br />
| 0x00160000<br />
| <br />
|-<br />
| 0x00170000<br />
| <br />
|}<br />
<br />
=NFC module savedata=<br />
* "/nfp_backup.dat" Going by the filename this seems to contain data backed up from amiibo.</div>
Socram8888