3dbrew - User contributions [en]

Talk:Title metadata

2016-01-10T08:15:35Z

Syphurith: ECDSA Signature

I wondered if it was wrong,too.But TMD size is sometimes diffrent.
[[User:Matyapiro31|Matyapiro31]]

Are there any known access rights?--[[User:Lazymarek9614|Lazymarek9614]] 17:42, 15 September 2011 (CEST)

As said there is 0x00010005 representing the ECDSA. However I haven't even encountered any TMD that using this type of signature. Even I've found two DER format certificates in Process9 NCCH/CXI which is contained in FIRM ARM9 section, and the two certs uses "id-ecPublicKey". May be not important at all, but i wonder if that is really used.--[[User:Syphurith|Syphurith]] ([[User talk:Syphurith|talk]]) 10:15, 10 January 2016 (CET)

Talk:Title list

2016-01-07T09:39:34Z

Syphurith: /* How to work out meaning of version? */ Answer+1

Obviously the 3DS Retail titles have TitleIDs as well and they share the same prefix as the eShop titles:

Should we put a new category or put eShop and retail titles togather? --[[User:Elisherer|Elisherer]] 19:15, 6 September 2011 (CEST)

0004000000037500 Tom Clancy's Ghost Recon: Shadow Wars - EUR
0004000000038900 Super Monkeyball 3D - EUR
0004000000038c00 Lego Star Wars III: The Clone Wars - EUR

IMO that extdata section would be more appropriate on the [[SD_Filesystem]] page, this Title list page isn't meant for savedata/extdata-related info.(Those "TitleID low/high" aren't correct either, 00000000 is just an extdata ID while the other ID is the titleID_low>>8.) --[[User:Yellows8|Yellows8]] 17:26, 16 November 2011 (CET)

Game trials have .ctx files...
Why?
--Matyapiro31 16:03, 13 December 2011 (CET)

I think 0004000200060201 is the Resident Evil Revelations Trial.
--11111.11106^2 21:37, 19 January 2012 (EST)

"Serial structure" The info described there is not a "serial", it's the TitleID. This is actual [[serials]]. --[[User:Yellows8|Yellows8]] 20:33, 1 March 2012 (CET)
:"A [http://en.wikipedia.org/wiki/Serial_number serial number] is a unique number assigned for identification which varies from its successor or predecessor by a fixed discrete integer value". I think it matches its definition...but you can change it if you like :) --[[User:Elisherer|Elisherer]] 23:03, 1 March 2012 (CET)

I think there is no merit to write all eshop titles information here,
how do you think about?
:Indeed. Really don't see the need for listing so many useless retail titleIDs which originated from warez either. --[[User:Yellows8|Yellows8]] 18:05, 29 March 2012 (CEST)

On developer 3DS' programs with the title type '0138' are recognised as firmware rather than an application and in DevMenu a special option appears which allows the user to update the system firmware when a '0138' .cia is selected.
:Guess you discovered that by modifying the titleID stored in a .cia? --[[User:Yellows8|Yellows8]] 22:43, 15 May 2012 (CEST)
::Yeah, have a look [http://n-dev.net/showthread.php?tid=1276 here], I put my finding there. Though I think it's not quite ready for the wiki yet.--[[User:3dsguy|3dsguy]] 02:13, 16 May 2012 (CEST)
:::I already saw that thread. --[[User:Yellows8|Yellows8]] 03:40, 16 May 2012 (CEST)

3dsguy, almost all of those system titles are from the system update SOAP response. 000400100002X600 wasn't listed because it was never listed in SOAP replies. --[[User:Yellows8|Yellows8]] 17:04, 8 May 2012 (CEST)

On my Developer 3DS, I can bring up the revision of the Home Menu, at the Home Menu, but it is different to the revision SYSMENU (0004003000009802). They can't be the same but on the title list page SYSMENU links to the Home Menu. So... is there something I'm missing here?--[[User:3dsguy|3dsguy]] 10:59, 15 May 2012 (CEST)
:Yes, SYSMENU is Homemenu. Either the dev "revision" is different from retail, or that's separate from the TMD title version. --[[User:Yellows8|Yellows8]] 17:43, 15 May 2012 (CEST)
::So they are the same. Well what ever the reason for revision inconsistency, some photos:[[File:homemenrev.JPG|200px]] [[File:Homemenrev2.JPG|200px]]--[[User:3dsguy|3dsguy]] 02:13, 16 May 2012 (CEST)
:::That's definitely not the TMD title version, that revision is way higher than any title version. AFAIK the REV field on that error screen is the SDK revision. The one displayed in homemenu might be SDK-revision related too. --[[User:Yellows8|Yellows8]] 03:40, 16 May 2012 (CEST)
::::When you say SDK revision, do you mean the SDK revision of the 3DS firmware or the SDK revision of the the SDK Lib used to build it.--[[User:3dsguy|3dsguy]] 11:01, 16 May 2012 (CEST)
:::::The error screen REV is the SDK-revision used when building the NCCH. Not sure what that homemenu revision is. --[[User:Yellows8|Yellows8]] 17:00, 16 May 2012 (CEST)

If Korea, China, Taiwan have region coding separate to JPN/USA/EUR, do you think that they will use different regions in the e-Shop for dsi titles, because Taiwan doesn't have a dsi region and in turn nor a dsiware region?--[[User:3dsguy|3dsguy]] 07:19, 24 May 2012 (CEST)
:AFAIK DSi CHN/KOR doesn't even have separate regions for DSiWare. --[[User:Yellows8|Yellows8]] 08:06, 24 May 2012 (CEST)
::For the DSi they did [http://dsibrew.org/wiki/Title_list#Region_Codes DSiBrew.org]--[[User:3dsguy|3dsguy]] 09:55, 24 May 2012 (CEST)
:::I mean they wouldn't have separate 3DS CHN/KOR DSiWare regions when DSi didn't even have those.(Yes, there's CHN/KOR DSi region-codes but DSiWare using those regions doesn't exist AFAIK.) Also, generally only region V is used for DSiWare on DSi for regions outside of USA/JPN. --[[User:Yellows8|Yellows8]] 17:14, 24 May 2012 (CEST)

My scripts which check for system updates are now publicly accessible [http://yls8.mtheall.com/reports.php here]. --[[User:Yellows8|Yellows8]] 23:49, 24 May 2012 (CEST)

"''System tickets are retrieved via a SOAP request to NUS, instead of directly downloading the cetk with HTTPS.''" Did you know that are tmd and cetk are also available via HTTP for 3ds titles?--[[User:3dsguy|3dsguy]] 15:56, 25 May 2012 (CEST)
:Of course, but this time the 3DS uses SOAP for common/system tickets instead of HTTP. Also, *every* region-specific CTR title also has the CHN/TWN/KOR regions, just haven't bothered to add those yet.(partly because some of them use separate title versions) The AUS region-specific titles are missing too, but trying to retrieve the CTR AUS titlelist from the twl SOAP server returns nothing. --[[User:Yellows8|Yellows8]] 18:10, 25 May 2012 (CEST)
::I don't think AUS has a separate CTR title list(I might be misunderstanding what your saying, but), Australian 3DSs are a part of the EUR 3DS region, and all of its downloads (including TWL) all are the EUR version. Also the title versions (for system applications at least) differ between regions, trying to request versions other than '0' listed on 3dbrew only work for the USA versions of the titles--[[User:3dsguy|3dsguy]] 03:34, 26 May 2012 (CEST)
:::Perhaps the AUS SOAP region is identical to EUR then. The titlelist I'm referring to is the one returned from SOAP, like [http://yls8.mtheall.com/titlelist.php?date=05-14-12_08-05-00&sys=ctr&reg=E&soap=1 this]. Some region-specific titles have the same versions for each region, not sure how many have separate versions though. --[[User:Yellows8|Yellows8]] 04:31, 26 May 2012 (CEST)

"For game patches update data, these are the same as the game's ''NCSD'', except these only contain the updated code and updated RomFS data." Yellows8, are you saying that the content downloaded for game patches are in CCI format not CXI format? Just asking as it would make more sense for the 3DS to download a patch CXI.--[[User:3dsguy|3dsguy]] 11:46, 20 June 2012 (CEST)
:Apps downloaded from eShop are NCSD, so I'm assuming game patch titles are NCSD too.(Retail NAND titles from CDN are NCCH however) --[[User:Yellows8|Yellows8]] 17:09, 20 June 2012 (CEST)
:: I highly doubt that eshop content is ever in NCSD form. If apps downloaded from the eShop are in NCSD format, why can the TMD of eShop downloads, specify more than one content(ie app and manual). The size of the content(s) specified in the TMD, is the same size as the content, downloaded from the eshop and the content on the SD card is the same size as well. And on development units, when a SD card app is installed(via CIA), the content installed on the SD card is the same size(s) as the CXI(s) extracted from the CIA which installed it, so the content on the SD card is NCCH form.--[[User:3dsguy|3dsguy]] 01:45, 21 June 2012 (CEST)
:::So is the dlp child NCCH stored in a separate content for eShop apps as well?(don't have any eShop app titleIDs for those) --[[User:Yellows8|Yellows8]] 02:10, 21 June 2012 (CEST)
::::I don't have a CIA which installs a dlp child NCCH, but I do have one with a manual. I'm thinking of preparing a better sample CIA, now that I understand better how the file formats work.(When I gave the sample cia to 3DBrew made by Jl12, I had no clue how the 3DS file formats worked)--[[User:3dsguy|3dsguy]] 07:30, 21 June 2012 (CEST)
:::::Scratch that, I've just found a cia which has a dlp child NCCH. I'll see what I can do--[[User:3dsguy|3dsguy]] 15:53, 21 June 2012 (CEST)
::::::I've put decrypted examples of a dlp child and manual NCCH on the [[CXI]] page if you want to have a look at the contents of one--[[User:3dsguy|3dsguy]] 12:33, 23 June 2012 (CEST)

@Yellows8 the title you've called "SAFE_MODE System Settings (mset)", (000400100002XF00), on my dev unit, this launches straight into 'System Update', you can't do anything else, it's not the whole system settings. Does it act different for you, as I wouldn't call the system updater standalone title "SAFE_MODE System Settings"?--[[User:3dsguy|3dsguy]] 09:34, 19 July 2012 (CEST)
:I don't have a dev 3DS so I can't launch that title myself. That title is *exactly* the same as the regular mset, except only system update is accessible from it. --[[User:Yellows8|Yellows8]] 17:32, 19 July 2012 (CEST)

3dsguy, why do you think PTM is "Battery"? That system module handles play history and pedometer stuff. --[[User:Yellows8|Yellows8]] 05:08, 21 July 2012 (CEST)
:It's because I have a compiled SDK Demo for PTM and it's a battery status reader it monitors the battery level, whether it is charging and if a charger is connected.--[[User:3dsguy|3dsguy]] 05:15, 21 July 2012 (CEST)

Would it be a good idea to list, some developer application titleIDs on this list?--[[User:3dsguy|3dsguy]] 05:53, 23 July 2012 (CEST)
:That's not really relevant here, TIDs for dev apps are rather useless unless one has a dev unit. However, NS can load system modules 00001902 and 00003602 which are presumably dev modules, go ahead and add those system modules to the title list if you know what those are. --[[User:Yellows8|Yellows8]] 06:11, 23 July 2012 (CEST)

"No, that title does exist for CHN, TWN, and KOR. AC uses this data archive, not the NZone app." The archive is used by AC to identify NZone Hotspots, but those regions don't have the NZone app according to the Title List, so why would AC use them. Granted they still download them(according to your logs), but why would they, if it's just used for NZone?--[[User:3dsguy|3dsguy]] 01:36, 25 July 2012 (CEST)
:"N/A" implies that the title doesn't exist for that region, but it does exist here. The AC module doesn't care what the region is, it loads the hotspot list regardless of region. --[[User:Yellows8|Yellows8]] 03:07, 25 July 2012 (CEST)

Why is it necessary to list practically every retail/eShop title here? This page is already way too long because of that retail/eShop list. --[[User:Yellows8|Yellows8]] 17:24, 30 August 2012 (CEST)
:Well it's only really practical to list all the system titles on this page. As IMO they are the important titles. Having SD card titles on this list, essentially keep the list complete. Perhaps moving SD card titles to another page would be better and leaving an excerpt list on this page linking to the full SD Card title list? Also I don't think the retail card Title ID list is necessary at all.--[[User:3dsguy|3dsguy]] 02:01, 31 August 2012 (CEST)
::The retail/eShop titles section is close to 5x the lines for system titles. The retail and demos section should be completely removed. The eShop section can stay, but most of the unknown/paid-for titles should be removed. --[[User:Yellows8|Yellows8]] 02:21, 31 August 2012 (CEST)

Well i found in TMDs there is some titles in this list with a higher title version. should i change that or just keep going? --[[User:Syphurith|Syphurith]] 10:40, 28 March 2013 (CET)
:Go ahead and fix any incorrect versions.(There's some CHN/TWN/KOR [http://yls8.mtheall.com/titlelist.php?sys=ctr titles/versions] still not listed on this page as well) --[[User:Yellows8|Yellows8]] 17:52, 28 March 2013 (CET)

For those who want to get many newest versions (value, of the titles) quickly, you can use this script ''with nodejs executable'' [https://skydrive.live.com/redir?resid=A6D0BCEF437037D4!277&authkey=!ANGBM3GKlfEkzGA]. It will help you check the titles, however ''it does not directly generates the wiki table''. You can modify, distribute, use freely (not Commercial yeh) ''If you've downloaded a r0 version please fetch the newest r2'' --[[User:Syphurith|Syphurith]] 05:29, 29 March 2013 (CET)

@[[User:Yellows8|Yellows8]]: well you said the package 0004001B00010702 is not used in NATIVE_FIRM. Well i do wonder if you can decrypt the CDN packages now (i mean manually call the API).. (You said there is CFA containing two files sized 96b and 64b -- the file on CDN is 0x4200Bytes). If that is correct maybe we can find some clues from the NATIVE_FIRM packages? Thx. --[[User:Syphurith|Syphurith]] 07:20, 10 April 2013 (CEST)
:That title is used by NS not NATIVE_FIRM. I'm not sure what that CFA is used for but it's probably not really interesting - the data stored in key.bin is not random either. "You said there is CFA containing two files sized 96b and 64b -- the file on CDN is 0x4200Bytes" "key.bin" is 12-bytes, "value.bin" is 8-bytes, and the total RomFS size is 0x4000-bytes. --[[User:Yellows8|Yellows8]] 07:44, 10 April 2013 (CEST)
::Thanks for reply. (So that is not a proper way.) Ok i think i should wait for your progress then. (In fact i do wonder if you can decrypt those packages.) --[[User:Syphurith|Syphurith]] 09:35, 10 April 2013 (CEST)

== How to work out meaning of version? ==

I don't understand the instructions. --[[User:Hiccup|Hiccup]] 12:45, 29 October 2015 (CET)
:Also; how do you convert a title id into the four letter code used on the front of cards etc and vice versa? --[[User:Hiccup|Hiccup]] ([[User talk:Hiccup|talk]]) 15:00, 6 January 2016 (CET)
::I'm quite sorry I don't find direct relationship between TitleID and Title ProductCode. Mainly the ProductCode of a title is the ProductCode of its first NCCH content, which is likely to be a CXI. And i don't know how to get that through memory or other ways, sorry. --[[User:Syphurith|Syphurith]] ([[User talk:Syphurith|talk]]) 11:36, 7 January 2016 (CET)

== Dlp Content ==

Just to note that after you unpack the Dlp Content using 3dstool, its romfs contains a CIA, which have the similar TitleID. For example 00040000000F8100 is Mario Party Tour Island, and the Dlp CIA contained is 00040001000F8100. However I can not unpack the content inside Dlp CIA.. --[[User:Syphurith|Syphurith]] 04:41, 13 November 2015 (CET)

Talk:Main Page

2016-01-07T09:38:59Z

Syphurith: /* Does anyone know how to tell an installed/braindumped title's version? */ Answer+1

So how about a [http://wiisixtyfour.webs.com/images/3dsbrew-bg4545.png logo]? --[[User:Bg4545|wiisixtyfour]] 06:59, 1 April 2011 (CEST)

Great one, let's put it as default logo ! --[[User:GeekShadow|GeekShadow]] 09:37, 1 April 2011 (CEST)

Here's one I made, which doesn't use any official artwork/photography: [http://dl.dropbox.com/u/1077900/Graphics/3dbrew.png PNG] [http://dl.dropbox.com/u/1077900/Graphics/3dbrew.svg SVG] --[[User:BHSPitMonkey|BHSPitMonkey]] 05:36, 7 April 2011 (CEST)

How about making the default skin [http://3dbrew.org/w/index.php?title=Main_Page&useskin=monobook MonoBook]?, I like the it better. --[[User:Elisherer|Elisherer]] 10:58, 6 October 2011 (CEST)

I want to dump RAM.What can I do now?How can I learn? --[[User:Matyapiro31|Matyapiro31]] 16:30, 20 November 2011 (CET)
:Sorry, this is not the correct page to talk about that. However, it's a good topic for our new forum! http://n-dev.net/index.php --[[User:Lazymarek9614|Lazymarek9614]] 17:43, 20 November 2011 (CET)

-Hello, I would like to translate this great wiki into French, how should I do ? Thanks :)
:I guess each page you want to translate you need to edit the page's link with a '/' (slash) after it and the language code (fr for french i think), for instance edit the page http://www.3dbrew.org/wiki/Main_Page/Fr and then put a link on the bottom next to Japanese.. --[[User:Elisherer|Elisherer]] 17:49, 21 December 2011 (CET)
::You should take a look [http://www.mediawiki.org/wiki/Template:Languages here]...Apperantly we don't have the needed template for it to work automaticaly maybe we need the admin to install some kind of extension to support this type of thing. --[[User:Elisherer|Elisherer]] 18:59, 21 December 2011 (CET)

-Yes, it would be more practical. For now, I'll continue translating like that, please tell me when the plugin is added.
---I added a language selection bar at the bottom of each main page.

I cannot have be accessing for a week.Why?--Matyapiro31 12:51, 19 April 2012 (CEST)
== SVG upload ==

Hey neimod, can you enable svg uploading? I want to upload graphics for the buttons [http://sherer.co.il/svg/ I made] (for future homebrew and stuff)--[[User:Elisherer|Elisherer]] 14:41, 9 February 2012 (CET)
: You can address this issue to [[User:Mha|Mha]] (mha on irc) --[[User:Neimod|Neimod]] 19:04, 9 February 2012 (CET)

Game Screenshots...

Hey guys how can i export the photos from DoA:D from 3DS to PC i have the right file but on mc if i change to .jpg or mpo it does not open...

== Does anyone know how to tell an installed/braindumped title's version? ==

I'm on 9.3 and have hax. I want to know this so I can contribute versions to to the title list. --[[User:Hiccup|Hiccup]] ([[User talk:Hiccup|talk]]) 14:57, 6 January 2016 (CET)
:1.If you have NAND Xorpad you can dump and decrypt to get the .[[TMD]] files and read the version from it. 2.Use [[AM]] service, and use "AM_ListTitles" from libctru, structure "AM_TitleEntry" includes the version. 3.Most versions of System Titles are fetched via System Update SOAP response, thanks to [[User:Yellows8|Yellows8]] for that.
:BTW I suggest you to ask questions on 4dsdev.org or IRC(EFNET.org#3dsdev) thus it may be dealt faster. --[[User:Syphurith|Syphurith]] ([[User talk:Syphurith|talk]]) 11:35, 7 January 2016 (CET)

Talk:Title list

2015-11-13T02:41:21Z

Syphurith: DLP Content Notes

Obviously the 3DS Retail titles have TitleIDs as well and they share the same prefix as the eShop titles:

Should we put a new category or put eShop and retail titles togather? --[[User:Elisherer|Elisherer]] 19:15, 6 September 2011 (CEST)

0004000000037500 Tom Clancy's Ghost Recon: Shadow Wars - EUR
0004000000038900 Super Monkeyball 3D - EUR
0004000000038c00 Lego Star Wars III: The Clone Wars - EUR

IMO that extdata section would be more appropriate on the [[SD_Filesystem]] page, this Title list page isn't meant for savedata/extdata-related info.(Those "TitleID low/high" aren't correct either, 00000000 is just an extdata ID while the other ID is the titleID_low>>8.) --[[User:Yellows8|Yellows8]] 17:26, 16 November 2011 (CET)

Game trials have .ctx files...
Why?
--Matyapiro31 16:03, 13 December 2011 (CET)

I think 0004000200060201 is the Resident Evil Revelations Trial.
--11111.11106^2 21:37, 19 January 2012 (EST)

"Serial structure" The info described there is not a "serial", it's the TitleID. This is actual [[serials]]. --[[User:Yellows8|Yellows8]] 20:33, 1 March 2012 (CET)
:"A [http://en.wikipedia.org/wiki/Serial_number serial number] is a unique number assigned for identification which varies from its successor or predecessor by a fixed discrete integer value". I think it matches its definition...but you can change it if you like :) --[[User:Elisherer|Elisherer]] 23:03, 1 March 2012 (CET)

I think there is no merit to write all eshop titles information here,
how do you think about?
:Indeed. Really don't see the need for listing so many useless retail titleIDs which originated from warez either. --[[User:Yellows8|Yellows8]] 18:05, 29 March 2012 (CEST)

On developer 3DS' programs with the title type '0138' are recognised as firmware rather than an application and in DevMenu a special option appears which allows the user to update the system firmware when a '0138' .cia is selected.
:Guess you discovered that by modifying the titleID stored in a .cia? --[[User:Yellows8|Yellows8]] 22:43, 15 May 2012 (CEST)
::Yeah, have a look [http://n-dev.net/showthread.php?tid=1276 here], I put my finding there. Though I think it's not quite ready for the wiki yet.--[[User:3dsguy|3dsguy]] 02:13, 16 May 2012 (CEST)
:::I already saw that thread. --[[User:Yellows8|Yellows8]] 03:40, 16 May 2012 (CEST)

3dsguy, almost all of those system titles are from the system update SOAP response. 000400100002X600 wasn't listed because it was never listed in SOAP replies. --[[User:Yellows8|Yellows8]] 17:04, 8 May 2012 (CEST)

On my Developer 3DS, I can bring up the revision of the Home Menu, at the Home Menu, but it is different to the revision SYSMENU (0004003000009802). They can't be the same but on the title list page SYSMENU links to the Home Menu. So... is there something I'm missing here?--[[User:3dsguy|3dsguy]] 10:59, 15 May 2012 (CEST)
:Yes, SYSMENU is Homemenu. Either the dev "revision" is different from retail, or that's separate from the TMD title version. --[[User:Yellows8|Yellows8]] 17:43, 15 May 2012 (CEST)
::So they are the same. Well what ever the reason for revision inconsistency, some photos:[[File:homemenrev.JPG|200px]] [[File:Homemenrev2.JPG|200px]]--[[User:3dsguy|3dsguy]] 02:13, 16 May 2012 (CEST)
:::That's definitely not the TMD title version, that revision is way higher than any title version. AFAIK the REV field on that error screen is the SDK revision. The one displayed in homemenu might be SDK-revision related too. --[[User:Yellows8|Yellows8]] 03:40, 16 May 2012 (CEST)
::::When you say SDK revision, do you mean the SDK revision of the 3DS firmware or the SDK revision of the the SDK Lib used to build it.--[[User:3dsguy|3dsguy]] 11:01, 16 May 2012 (CEST)
:::::The error screen REV is the SDK-revision used when building the NCCH. Not sure what that homemenu revision is. --[[User:Yellows8|Yellows8]] 17:00, 16 May 2012 (CEST)

If Korea, China, Taiwan have region coding separate to JPN/USA/EUR, do you think that they will use different regions in the e-Shop for dsi titles, because Taiwan doesn't have a dsi region and in turn nor a dsiware region?--[[User:3dsguy|3dsguy]] 07:19, 24 May 2012 (CEST)
:AFAIK DSi CHN/KOR doesn't even have separate regions for DSiWare. --[[User:Yellows8|Yellows8]] 08:06, 24 May 2012 (CEST)
::For the DSi they did [http://dsibrew.org/wiki/Title_list#Region_Codes DSiBrew.org]--[[User:3dsguy|3dsguy]] 09:55, 24 May 2012 (CEST)
:::I mean they wouldn't have separate 3DS CHN/KOR DSiWare regions when DSi didn't even have those.(Yes, there's CHN/KOR DSi region-codes but DSiWare using those regions doesn't exist AFAIK.) Also, generally only region V is used for DSiWare on DSi for regions outside of USA/JPN. --[[User:Yellows8|Yellows8]] 17:14, 24 May 2012 (CEST)

My scripts which check for system updates are now publicly accessible [http://yls8.mtheall.com/reports.php here]. --[[User:Yellows8|Yellows8]] 23:49, 24 May 2012 (CEST)

"''System tickets are retrieved via a SOAP request to NUS, instead of directly downloading the cetk with HTTPS.''" Did you know that are tmd and cetk are also available via HTTP for 3ds titles?--[[User:3dsguy|3dsguy]] 15:56, 25 May 2012 (CEST)
:Of course, but this time the 3DS uses SOAP for common/system tickets instead of HTTP. Also, *every* region-specific CTR title also has the CHN/TWN/KOR regions, just haven't bothered to add those yet.(partly because some of them use separate title versions) The AUS region-specific titles are missing too, but trying to retrieve the CTR AUS titlelist from the twl SOAP server returns nothing. --[[User:Yellows8|Yellows8]] 18:10, 25 May 2012 (CEST)
::I don't think AUS has a separate CTR title list(I might be misunderstanding what your saying, but), Australian 3DSs are a part of the EUR 3DS region, and all of its downloads (including TWL) all are the EUR version. Also the title versions (for system applications at least) differ between regions, trying to request versions other than '0' listed on 3dbrew only work for the USA versions of the titles--[[User:3dsguy|3dsguy]] 03:34, 26 May 2012 (CEST)
:::Perhaps the AUS SOAP region is identical to EUR then. The titlelist I'm referring to is the one returned from SOAP, like [http://yls8.mtheall.com/titlelist.php?date=05-14-12_08-05-00&sys=ctr&reg=E&soap=1 this]. Some region-specific titles have the same versions for each region, not sure how many have separate versions though. --[[User:Yellows8|Yellows8]] 04:31, 26 May 2012 (CEST)

"For game patches update data, these are the same as the game's ''NCSD'', except these only contain the updated code and updated RomFS data." Yellows8, are you saying that the content downloaded for game patches are in CCI format not CXI format? Just asking as it would make more sense for the 3DS to download a patch CXI.--[[User:3dsguy|3dsguy]] 11:46, 20 June 2012 (CEST)
:Apps downloaded from eShop are NCSD, so I'm assuming game patch titles are NCSD too.(Retail NAND titles from CDN are NCCH however) --[[User:Yellows8|Yellows8]] 17:09, 20 June 2012 (CEST)
:: I highly doubt that eshop content is ever in NCSD form. If apps downloaded from the eShop are in NCSD format, why can the TMD of eShop downloads, specify more than one content(ie app and manual). The size of the content(s) specified in the TMD, is the same size as the content, downloaded from the eshop and the content on the SD card is the same size as well. And on development units, when a SD card app is installed(via CIA), the content installed on the SD card is the same size(s) as the CXI(s) extracted from the CIA which installed it, so the content on the SD card is NCCH form.--[[User:3dsguy|3dsguy]] 01:45, 21 June 2012 (CEST)
:::So is the dlp child NCCH stored in a separate content for eShop apps as well?(don't have any eShop app titleIDs for those) --[[User:Yellows8|Yellows8]] 02:10, 21 June 2012 (CEST)
::::I don't have a CIA which installs a dlp child NCCH, but I do have one with a manual. I'm thinking of preparing a better sample CIA, now that I understand better how the file formats work.(When I gave the sample cia to 3DBrew made by Jl12, I had no clue how the 3DS file formats worked)--[[User:3dsguy|3dsguy]] 07:30, 21 June 2012 (CEST)
:::::Scratch that, I've just found a cia which has a dlp child NCCH. I'll see what I can do--[[User:3dsguy|3dsguy]] 15:53, 21 June 2012 (CEST)
::::::I've put decrypted examples of a dlp child and manual NCCH on the [[CXI]] page if you want to have a look at the contents of one--[[User:3dsguy|3dsguy]] 12:33, 23 June 2012 (CEST)

@Yellows8 the title you've called "SAFE_MODE System Settings (mset)", (000400100002XF00), on my dev unit, this launches straight into 'System Update', you can't do anything else, it's not the whole system settings. Does it act different for you, as I wouldn't call the system updater standalone title "SAFE_MODE System Settings"?--[[User:3dsguy|3dsguy]] 09:34, 19 July 2012 (CEST)
:I don't have a dev 3DS so I can't launch that title myself. That title is *exactly* the same as the regular mset, except only system update is accessible from it. --[[User:Yellows8|Yellows8]] 17:32, 19 July 2012 (CEST)

3dsguy, why do you think PTM is "Battery"? That system module handles play history and pedometer stuff. --[[User:Yellows8|Yellows8]] 05:08, 21 July 2012 (CEST)
:It's because I have a compiled SDK Demo for PTM and it's a battery status reader it monitors the battery level, whether it is charging and if a charger is connected.--[[User:3dsguy|3dsguy]] 05:15, 21 July 2012 (CEST)

Would it be a good idea to list, some developer application titleIDs on this list?--[[User:3dsguy|3dsguy]] 05:53, 23 July 2012 (CEST)
:That's not really relevant here, TIDs for dev apps are rather useless unless one has a dev unit. However, NS can load system modules 00001902 and 00003602 which are presumably dev modules, go ahead and add those system modules to the title list if you know what those are. --[[User:Yellows8|Yellows8]] 06:11, 23 July 2012 (CEST)

"No, that title does exist for CHN, TWN, and KOR. AC uses this data archive, not the NZone app." The archive is used by AC to identify NZone Hotspots, but those regions don't have the NZone app according to the Title List, so why would AC use them. Granted they still download them(according to your logs), but why would they, if it's just used for NZone?--[[User:3dsguy|3dsguy]] 01:36, 25 July 2012 (CEST)
:"N/A" implies that the title doesn't exist for that region, but it does exist here. The AC module doesn't care what the region is, it loads the hotspot list regardless of region. --[[User:Yellows8|Yellows8]] 03:07, 25 July 2012 (CEST)

Why is it necessary to list practically every retail/eShop title here? This page is already way too long because of that retail/eShop list. --[[User:Yellows8|Yellows8]] 17:24, 30 August 2012 (CEST)
:Well it's only really practical to list all the system titles on this page. As IMO they are the important titles. Having SD card titles on this list, essentially keep the list complete. Perhaps moving SD card titles to another page would be better and leaving an excerpt list on this page linking to the full SD Card title list? Also I don't think the retail card Title ID list is necessary at all.--[[User:3dsguy|3dsguy]] 02:01, 31 August 2012 (CEST)
::The retail/eShop titles section is close to 5x the lines for system titles. The retail and demos section should be completely removed. The eShop section can stay, but most of the unknown/paid-for titles should be removed. --[[User:Yellows8|Yellows8]] 02:21, 31 August 2012 (CEST)

Well i found in TMDs there is some titles in this list with a higher title version. should i change that or just keep going? --[[User:Syphurith|Syphurith]] 10:40, 28 March 2013 (CET)
:Go ahead and fix any incorrect versions.(There's some CHN/TWN/KOR [http://yls8.mtheall.com/titlelist.php?sys=ctr titles/versions] still not listed on this page as well) --[[User:Yellows8|Yellows8]] 17:52, 28 March 2013 (CET)

For those who want to get many newest versions (value, of the titles) quickly, you can use this script ''with nodejs executable'' [https://skydrive.live.com/redir?resid=A6D0BCEF437037D4!277&authkey=!ANGBM3GKlfEkzGA]. It will help you check the titles, however ''it does not directly generates the wiki table''. You can modify, distribute, use freely (not Commercial yeh) ''If you've downloaded a r0 version please fetch the newest r2'' --[[User:Syphurith|Syphurith]] 05:29, 29 March 2013 (CET)

@[[User:Yellows8|Yellows8]]: well you said the package 0004001B00010702 is not used in NATIVE_FIRM. Well i do wonder if you can decrypt the CDN packages now (i mean manually call the API).. (You said there is CFA containing two files sized 96b and 64b -- the file on CDN is 0x4200Bytes). If that is correct maybe we can find some clues from the NATIVE_FIRM packages? Thx. --[[User:Syphurith|Syphurith]] 07:20, 10 April 2013 (CEST)
:That title is used by NS not NATIVE_FIRM. I'm not sure what that CFA is used for but it's probably not really interesting - the data stored in key.bin is not random either. "You said there is CFA containing two files sized 96b and 64b -- the file on CDN is 0x4200Bytes" "key.bin" is 12-bytes, "value.bin" is 8-bytes, and the total RomFS size is 0x4000-bytes. --[[User:Yellows8|Yellows8]] 07:44, 10 April 2013 (CEST)
::Thanks for reply. (So that is not a proper way.) Ok i think i should wait for your progress then. (In fact i do wonder if you can decrypt those packages.) --[[User:Syphurith|Syphurith]] 09:35, 10 April 2013 (CEST)

== How to work out meaning of version? ==

I don't understand the instructions. --[[User:Hiccup|Hiccup]] 12:45, 29 October 2015 (CET)

== Dlp Content ==

Just to note that after you unpack the Dlp Content using 3dstool, its romfs contains a CIA, which have the similar TitleID. For example 00040000000F8100 is Mario Party Tour Island, and the Dlp CIA contained is 00040001000F8100. However I can not unpack the content inside Dlp CIA.. --[[User:Syphurith|Syphurith]] 04:41, 13 November 2015 (CET)

NAND Redirection

2015-11-05T07:50:31Z

Syphurith: Added missing brace to fix the link on this page.

NAND redirection is an umbrella term for methods used to redirect [[Flash_Filesystem|NAND]] reads and writes from the actual system storage (in this context called sysNAND) to the SD card (or technically, any other data source). Among other things, this allows for accessing more recent (in some cases fully updated) system versions (installed on the redirection source) while keeping access to full-control exploits (through the old system installed on sysNAND).

=== General Idea ===

The SD filesystem, being a FAT32 partition, can be shrinked and relocated easily. As such, it is easy to make room on the SD card for a full NAND image. By not listing the NAND image partition in the SD card's Master Boot Record (the first 512 bytes of data on the device which is responsible for providing information on the contained filesystems), the NAND image does not interfere with regular SD card access. The actual redirection needs to be done through use of a [[FIRM|firmware]] modification depending on the location of the NAND image on the SD card. Two common approaches for this are known as EmuNAND and RedNAND, albeit these terms are sometimes also used as synonyms for the concept of NAND redirection in general.

=== RedNAND ===

RedNAND places the full NAND image at byte offset 512 on the SD card. The modified firmware hence needs to offset all NAND reads and writes by 512 bytes.

=== EmuNAND ===

Calling the NAND image size N, EmuNAND places bytes [512:N-1] of the NAND image at byte offset 512 on the SD card, and bytes [0:511] at byte offset N. The modified firmware needs to make sure that NAND reads/writes to the first 512 bytes are redirected properly, but leaves all other accesses unmodified.

=== Restrictions on New 3DS ===

If the sysNAND of a New 3DS console is below system version 9.6, it is not currently publicly possible to have NAND redirection work with a redirected NAND of any system version since 9.6. This is because the [[AES|AES engine keyslots]] introduced for NCCH decryption with 9.6 are initialized by arm9loader using data generated from [[OTP Registers|OTP data]] upon boot. Since OTP access is blocked via [[CONFIG_Registers#CFG_SYSPROT9|CFG_SYSPROT9]] shortly after that, it's impossible to perform this keyslot initialization at any later time.

Title list

2015-10-30T15:51:15Z

Syphurith: Oh! The version values included modules inside firm are always v2, however file differs./* 00040130 - System Modules */

The Nintendo 3DS utilizes a similar title-based organization as seen in the Wii and DSi platforms. The update server is located [http://nus.cdn.c.shop.nintendowifi.net/ccs/download/ here]. When using SSL, the update/shop servers must be accessed via SSLv3.

The organization of Title IDs has not been documented fully yet. Region info isn't stored in title IDs however there does appear to be evidence that the regions are sequential, similar to how Wii System Menu Updates are ordered: JPN USA EUR KOR and CHN (introduced with the DSi). 3DS has one additional region: TWN.

Note: The terms 'Title ID', 'Partition ID' and 'Media ID' are interchangeable.

The 3DS retrieves system [[CommonETicket|tickets]] with SOAP request GetSystemCommonETicket, instead of directly downloading the cetk with HTTPS. The cetk is still accessible via HTTP, however 3DS doesn't use direct HTTP for this.

'''TitleID Structure''': 0xCCCCABCDLLLLLLRR

* CCCC defines the console '''Platform''' (5=WiiU, 4=3DS, 3=DSi, 1=[http://wiibrew.org/wiki/Title_database Wii])
* ABCD defines the '''Content Category''' of the title, Demo, DLPChild, etc.
* LLLLLL For CTR titles, this is the title's '''Unique ID'''. For TWL converted titles this is in two sections grouped as SSLLLL. SS is the old title identification used by the DSi and is made redundant by 'ABCD'. LLLL is the TWL title's 'Unique ID'. There are restrictions on the Unique ID, see below for more info.
* RR This is the Title ID '''Variation''', and has various uses.

'''Content Categories''':

This u16 is a collection bit mask flag. Each Category is a group of one or more bit masks.

Specific Bitmask Flags:
{| class="wikitable" border="1"
|-
! Category
! Bitmask
|-
| Normal
| 0x0
|-
| DlpChild
| 0x1
|-
| Demo
| 0x2
|-
| Contents
| 0x3
|-
| AddOnContents
| 0x4
|-
| Patch
| 0x6
|-
| CannotExecution
| 0x8
|-
| System
| 0x10
|-
| RequireBatchUpdate
| 0x20
|-
| NotRequireUserApproval
| 0x40
|-
| NotRequireRightForMount
| 0x80
|-
| CanSkipConvertJumpId
| 0x100
|-
| TWL
| 0x8000
|}

* TWL Category bit mask are carried over from original TWL category bitmasks (ignoring bit mask 0x8000), so TWL system titles have the bitmask of 0x8001.

* System titles (TWL and CTR) are eligible to be updated during a System Update.

* Bit Mask 0x4000 appears to be reserved, as it renders the ''TWL'' and ''System'' bit masks useless.

'''Unique ID Restrictions''':

For the CTR titles, there appears to be is a correlation between Unique IDs (UID) and 3DS 'title types'. For developer titles this is known(shown below), and retail titles *appear* to follow suite. It is unknown if this correlation is enforced on retail units, or if it is just for organisation purposes.

{| class="wikitable" border="1"
|-
! TITLE TYPE
! UNIQUE ID RANGE
|-
| System
| 0x0 - 0x2FF
|-
| Application
| 0x300 - 0xF7FFF
|-
| Evaluation
| 0xF8000 -0xFFFFF
|-
| Prototype*
| 0xFF000 - 0xFF3FF
|}
<nowiki>*</nowiki>On the home menu, titles with UIDs within the 'Prototype' range, appear on the home menu after install without the gift fanfare.

ProgramID/titleID low bitmask 0xF0000000(uniqueID bitmask 0xF00000) seems to be related to which hardware the title is allowed to run on. 3DS code tends to clear this bitmask when handling programIDs. This bitmask is normally zero. When this is 0x2, this indicates that the title only runs on [[New_3DS]](that is, programID-low 0x20000000 / uniqueID 0x200000).

'''TitleID Variation''':

This u8 allows enumeration of titles from the same category and unique ID. Common uses are explained below:

* CTR System Titles: The 3DS has two copies of most modules/applets/archives for usage with either the NATIVE_FIRM or SAFE_MODE_FIRM. This is allowed for, by changing the title ID variation of the title to match the core version set by the FIRM it is designed to be used with:
{| class="wikitable" border="1"
|-
! RR
! MEANING
|-
| 02
| System Title (Core version 0x2)
|-
| 03
| SAFE_MODE System Title (Core version 0x3)
|}
Normally on retail SAFE_MODE ARM11 [[NCCH#CXI|CXI]] titles can't be launched, since the [[Configuration_Memory|system]] core version doesn't match the CXI exheader core version.

* Only most non-Normal Applications are known to utilise Title ID variation, this is explained in their respective sections on this page.

* [[3DS Development Unit Software|Dev Menu]] installs CTR Applications with a TitleID variation of 0x02 to the CTR NAND.

* Title ID variation is ignored for TWL titles, this value is carried over from the original TWL title ID and is used for region lock:

=== Versions ===

v## = 0xHHHH = 0bBBBBBBBB...

* The version major,minor and micro can be extracted from the version number by converting the 16 bit number to binary
* 6 bits : Major
* 6 bits : Minor
* 4 bits : Micro ('Build' in some contexts)
* i.e. v2069 (Taken from 000400DB00017302) = 0b000010 000001 0101 means that the title version is v2.1.5. For reasons unknown, the CVer build, stored in the RomFS of the title, has always been zero (at time of writing), regardless of the CVer build in the TMD. So when predicting the firmware version, this should be taken into account.

NOTE: This Title list is a condensed version, only the System Titles lists are full lists. For a full list of titles on Nintendo's CDN, see [http://mtheall.com/~mtheall/tmdlist.php here]. The reports/title-lists from [http://yls8.mtheall.com/ninupdates/reports.php here] are automatically obtained from the system update SOAP.

== CTR System Titles ==
{| class="wikitable" border="1"
|-
! System Category
! Bit Mask(s)
! Category Bit Mask
|-
| Application (SYSTEM_APPLICATION)
| Normal<nowiki>|</nowiki>System
| 0x0010
|-
| System Data Archives (SYSTEM_CONTENT)
| Contents<nowiki>|</nowiki>CannotExecution<nowiki>|</nowiki>System
| 0x001B
|-
| Shared Data Archives (SHARED_CONTENT)
| Contents<nowiki>|</nowiki>CannotExecution<nowiki>|</nowiki>System<nowiki>|</nowiki>NotRequireRightForMount
| 0x009B
|-
| System Data Archives (AUTO_UPDATE_CONTENT)
| Contents<nowiki>|</nowiki>CannotExecution<nowiki>|</nowiki>System<nowiki>|</nowiki>NotRequireUserApproval<nowiki>|</nowiki>NotRequireRightForMount
| 0x00DB
|-
| Applet (APPLET)
| Normal<nowiki>|</nowiki>System<nowiki>|</nowiki>RequireBatchUpdate
| 0x0030
|-
| Module (BASE)
| Normal<nowiki>|</nowiki>System<nowiki>|</nowiki>RequireBatchUpdate<nowiki>|</nowiki>CanSkipConvertJumpId
| 0x0130
|-
| Firmware (FIRMWARE)
| Normal<nowiki>|</nowiki>CannotExecution<nowiki>|</nowiki>System<nowiki>|</nowiki>RequireBatchUpdate<nowiki>|</nowiki>CanSkipConvertJumpId
| 0x0138
|}

=== 00040010 - System Applications ===
The versions for CHN, KOR, and TWN are separate from the other regions.

{| class="wikitable" border="1"
|-
! JPN TIDLow
! USA TIDLow
! EUR TIDLow
! CHN TIDLow
! KOR TIDLow
! TWN TIDLow
! Description
! JPN Versions
! EUR Versions
! USA Versions
! CHN Versions
! KOR Versions
! TWN Versions
! Status
|-
| 00020000
| 00021000
| 00022000
| 00026000
| 00027000
| 00028000
| [[System Settings]] (mset)
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[3.0.0-5|v2060]], [[4.0.0-7|v3074]], [[5.0.0-11|v4097]], [[6.0.0-11|v5127]], [[7.0.0-13|v6157]], [[7.2.0-17|v7173]], [[8.1.0-0_New3DS|v8198]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v9224]], [[9.6.0-24|v10245]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[3.0.0-5|v2061]], [[4.0.0-7|v3075]], [[5.0.0-11|v4097]], [[6.0.0-11|v5127]], [[7.0.0-13|v6157]], [[7.2.0-17|v7174]], [[9.0.0-20|v8202]], [[9.6.0-24|v9220]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[3.0.0-5|v2062]], [[4.0.0-7|v3078]], [[5.0.0-11|v4098]], [[6.0.0-11|v5128]], [[7.0.0-13|v6157]], [[7.2.0-17|v7174]], [[9.0.0-20|v8203]], [[9.6.0-24|v9221]]
| [[4.0.0-7|v8]], [[4.4.0-10|v1024]](CHN-only sysupdate for just mset), [[5.0.0-11|v2049]], [[7.0.0-13|v3075]]
| [[4.0.0-7|v1026]], [[5.0.0-11|v2049]], [[7.0.0-13|v4098]]
| [[4.1.0-8|v8]], [[4.2.0-9|v1024]], [[5.0.0-11|v2050]], [[7.0.0-13|v3074]]
| Active
|-
| 00020100
| 00021100
| 00022100
| 00026100
| 00027100
| 00028100
| [[Download Play]] (dlplay)
| [[1.0.0-0|v0]], [[2.1.0-4|v1026]], [[4.0.0-7|v2051]], [[9.0.0-20|v3072]](Also for [[8.1.0-0_New3DS]])
| [[1.0.0-0|v0]], [[2.1.0-4|v1026]], [[4.0.0-7|v2051]], [[9.0.0-20|v3073]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1026]], [[4.0.0-7|v2051]], [[9.0.0-20|v3073]]
| [[4.0.0-7|v4]]
| [[4.0.0-7|v1027]]
| [[4.1.0-8|v4]]
| Active
|-
| 00020200
| 00021200
| 00022200
| 00026200
| 00027200
| 00028200
| [[Activity Log]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[3.0.0-5|v2051]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[3.0.0-5|v2054]], [[7.0.0-13|v2064]]
| Same as EUR
| [[4.0.0-7|v3]]
| [[4.0.0-7|v2]], [[7.0.0-13|v16]]
| [[4.1.0-8|v2]]
| Active
|-
| 00020300
| 00021300
| 00022300
| 00026300
| 00027300
| 00028300
| [[Health and Safety Information]]
| [[1.0.0-0|v0]], [[4.0.0-7|v1024]], [[6.0.0-11|v2050]]
| [[1.0.0-0|v0]], [[3.0.0-5|v1024]], [[4.0.0-7|v2050]], [[6.0.0-11|v3077]]
| [[1.0.0-0|v0]], [[4.0.0-7|v1026]], [[6.1.0-12U|v2051]]
| [[4.0.0-7|v5]]
| [[4.0.0-7|v2]]
| [[4.1.0-8|v5]]
| Active
|-
| 20020300
| 20021300
| 20022300
| N/A
| N/A
| N/A
| [[New_3DS]] [[Health and Safety Information]]
| [[8.1.0-0_New3DS|v2]], [[9.3.0-21|v17]]
| [[8.1.0-0_New3DS|v1]]
| Same as EUR.
| N/A
| N/A
| N/A
| Active
|-
| 00020400
| 00021400
| 00022400
| 00026400
| 00027400
| 00028400
| [[Nintendo 3DS Camera]] (CtrApp)
| [[1.0.0-0|v0]], [[2.1.0-4|v16]], [[3.0.0-5|v1038]], [[4.0.0-7|v2048]], [[6.0.0-11|v3073]], [[9.0.0-20|v4097]](Also for [[8.1.0-0_New3DS]])
| [[1.0.0-0|v0]], [[2.1.0-4|v16]], [[3.0.0-5|v1039]], [[4.0.0-7|v2048]], [[6.0.0-11|v3073]], [[7.0.0-13|v3088]], [[9.0.0-20|v4097]]
| [[1.0.0-0|v0]], [[2.1.0-4|v16]], [[3.0.0-5|v1039]], [[4.0.0-7|v2048]], [[6.1.0-12U|v3074]], [[7.0.0-13|v3088]], [[9.0.0-20|v4097]]
| [[4.0.0-7|v3]]
| [[4.0.0-7|v2]], [[7.0.0-13|v1040]]
| [[4.1.0-8|v3]]
| Active
|-
| 00020500
| 00021500
| 00022500
| 00026500
| 00027500
| 00028500
| [[Nintendo 3DS Sound]] (CtrApp)
| [[1.0.0-0|v0]], [[2.1.0-4|v1027]], [[3.0.0-5|v2049]], [[4.0.0-7|v3072]], [[7.0.0-13|v3089]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1027]], [[3.0.0-5|v2049]], [[4.0.0-7|v3072]], [[7.0.0-13|v3088]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1027]], [[3.0.0-5|v2049]], [[4.0.0-7|v3072]], [[7.0.0-13|v3088]]
| [[4.0.0-7|v2]]
| [[4.0.0-7|v2]], [[7.0.0-13|v16]]
| [[4.1.0-8|v3]]
| Active
|-
| 00020700
| 00021700
| 00022700
| 00026700
| 00027700
| 00028700
| [[Mii Maker]] (EDIT)
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[7.0.0-13|v2055]]
| Same as JPN
| Same as JPN
| [[4.0.0-7|v1]]
| [[4.0.0-7|v1]], [[7.0.0-13|v16]]
| [[4.1.0-8|v2]]
| Active
|-
| 00020800
| 00021800
| 00022800
| 00026800
| 00027800
| 00028800
| [[StreetPass Mii Plaza]] (MEET)
| [[1.0.0-0|v0]], v1027, [[2.1.0-4|v2048]], [[3.0.0-5|v3087]], [[3.0.0-6|v4096]], [[6.0.0-11|v5121]]
| [[1.0.0-0|v0]], v1027, [[2.1.0-4|v2048]], [[3.0.0-5|v3087]], [[3.0.0-6|v4096]], [[6.0.0-11|v5122]]
| [[1.0.0-0|v0]], v1027, [[2.1.0-4|v2048]], [[3.0.0-5|v3087]], [[3.0.0-6|v4096]], [[6.1.0-12U|v5124]], [[7.0.0-13|v5136]]
| [[4.0.0-7|v0]], [[4.4.0-10|v4096]]
| [[4.0.0-7|v1]], [[4.4.0-10|v4096]], [[7.0.0-13|v5120]]
| [[4.1.0-8|v1]], [[4.4.0-10|v4096]]
| Active
|-
| 00020900
| 00021900
| 00022900
| N/A
| 00027900
| 00028900
| [[eShop]] (tiger)
| [[2.0.0-2|v4]], [[2.1.0-3|v1026]], [[3.0.0-5|v2057]], [[4.0.0-7|v3081]], [[4.1.0-8|v4096]], [[4.2.0-9|v5123]], [[4.3.0-10|v6146]], [[5.0.0-11|v7169]], [[7.0.0-13|v8206]], [[7.1.0-14|v9231]], [[7.2.0-17|v10245]], [[8.0.0-18|v11265]], [[8.1.0-19|v12288]], [[9.0.0-20|v13320]], [[9.3.0-21|v15366]], [[9.5.0-22|v16384]], [[9.6.0-24|v17421]], [[9.7.0-25|v18432]], [[10.0.0-27|v19465]]
| [[2.0.0-2|v4]], [[2.1.0-3|v1026]], [[3.0.0-5|v2058]], [[4.0.0-7|v3081]], [[4.1.0-8|v4096]], [[4.2.0-9|v5123]], [[4.3.0-10|v6146]], [[5.0.0-11|v7171]], [[7.0.0-13|v8206]], [[7.1.0-14|v9231]], [[7.2.0-17|v10245]], [[8.0.0-18|v11265]], [[8.1.0-19|v12288]], [[9.0.0-20|v13320]], [[9.3.0-21|v15366]], [[9.5.0-22|v16384]], [[9.6.0-24|v17421]], [[9.7.0-25|v18432]], [[10.0.0-27|v19465]]
| [[2.0.0-2|v4]], [[2.1.0-3|v1026]], [[3.0.0-5|v2058]], [[4.0.0-7|v3081]], [[4.1.0-8|v4096]], [[4.2.0-9|v5123]], [[4.3.0-10|v6146]], [[5.0.0-11|v7170]], [[7.0.0-13|v8206]], [[7.1.0-14|v9231]], [[7.2.0-17|v10246]], [[8.0.0-18|v11265]], [[8.1.0-19|v12288]], [[9.0.0-20|v13321]], [[9.3.0-21|v15366]], [[9.5.0-22|v16384]], [[9.6.0-24|v17422]], [[9.7.0-25|v18432]], [[10.0.0-27|v19465]]
| N/A
| [[4.0.0-7|v3082]], [[4.1.0-8|v4096]], [[4.2.0-9|v5123]], [[4.3.0-10|v6146]], [[5.0.0-11|v7169]], [[7.0.0-13|v8205]], [[7.1.0-14|v9231]], [[8.1.0-19|v12288]], [[9.0.0-20|v13320]], [[9.3.0-21|v15366]], [[9.5.0-22|v16384]], [[9.6.0-24|v17420]], [[9.7.0-25|v18432]], [[10.0.0-27|v19465]]
| [[4.1.0-8|v4096]], [[4.2.0-9|v5123]], [[4.3.0-10|v6146]], [[5.0.0-11|v7170]], [[7.0.0-13|v8205]], [[7.1.0-14|v9231]], [[8.1.0-19|v12288]], [[9.3.0-21|v15366]], [[9.5.0-22|v16384]], [[9.6.0-24|v17421]], [[9.7.0-25|v18432]], [[10.0.0-27|v19465]]
| Active
|-
| 00020A00
| 00021A00
| 00022A00
| N/A
| 00027A00
| 00028A00
| [[System Transfer]] (CARDBOARD)
| [[2.0.0-2|v4]], [[3.0.0-5|v1035]], [[4.0.0-7|v2050]], [[5.0.0-11|v3074]], [[7.0.0-13|v4109]], [[9.0.0-20|v5130]], [[9.6.0-24|v6154]]
| [[2.0.0-2|v4]], [[3.0.0-5|v1035]], [[4.0.0-7|v2050]], [[5.0.0-11|v3073]], [[7.0.0-13|v4109]], [[9.0.0-20|v5131]], [[9.6.0-24|v6155]]
| [[2.0.0-2|v4]], [[3.0.0-5|v1035]], [[4.0.0-7|v2051]], [[5.0.0-11|v3073]], [[7.0.0-13|v4109]], [[9.0.0-20|v5131]], [[9.6.0-24|v6156]]
| N/A
| [[4.0.0-7|v2]], [[5.0.0-11|v1025]], [[7.0.0-13|v2061]], [[9.0.0-20|v3082]]
| [[4.1.0-8|v2]], [[5.0.0-11|v1025]], [[7.0.0-13|v2061]]
| Active
|-
| 00020B00
| 00021B00
| 00022B00
| N/A
| N/A
| N/A
| [[Nintendo Zone]] ("Nintendo")
| [[1.0.0-0|v0]], [[3.0.0-5|v1034]]
| Same as JPN
| Same as JPN
| N/A
| N/A
| N/A
| Active
|-
| 00020D00
| 00021D00
| 00022D00
| 00026D00
| 00027D00
| 00028D00
| [[Face Raiders]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1028]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1028]], [[7.0.0-13|v1040]]
| Same as EUR
| [[4.0.0-7|v0]]
| [[4.0.0-7|v0]]
| [[4.1.0-8|v2]]
| Active
|-
| 20020D00
| 20021D00
| 20022D00
| N/A
| N/A
| N/A
| [[New_3DS]] [[Face Raiders]]
| [[8.1.0-0_New3DS|v2050]]
| [[8.1.0-0_New3DS|v2049]]
| Same as EUR.
| N/A
| N/A
| N/A
| Active
|-
| 00020E00
| 00021E00
| 00022E00
| 00026E00
| 00027E00
| 00028E00
| [[AR Games]] (AR_ACT)
| [[1.0.0-0|v0]], [[2.1.0-4|v1026]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1026]], [[7.0.0-13|v1040]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1027]], [[7.0.0-13|v1040]]
| [[4.0.0-7|v0]]
| [[4.0.0-7|v0]], [[7.0.0-13|v16]]
| [[4.1.0-8|v1]]
| Active
|-
| 00020F00
| 00021F00
| 00022F00
| 00026F00
| 00027F00
| 00028F00
| SAFE_MODE [[System Settings#System Updater|System Updater]] (mset)
| [[1.0.0-0|v0]], [[3.0.0-5|v1024]], [[6.0.0-11|v2049]]
| [[1.0.0-0|v0]], [[3.0.0-5|v1024]], [[6.0.0-11|v2050]]
| Same as JPN
| [[4.0.0-7|v1]], [[6.0.0-11|v1026]]
| [[4.0.0-7|v1]]
| [[4.1.0-8|v1]]
| Active
|-
| 00023000
| 00024000
| 00025000
| N/A
| N/A
| N/A
| Promotional video
| [[1.1.0-1|v2]], [[2.0.0-2|v2048]]
| [[1.1.0-1|v<unknown>]], [[2.0.0-2|v2048]]
| [[1.1.0-1|v0]], [[2.0.0-2|v2048]]
| N/A
| N/A
| N/A
| Stubbed
|-
| 0002BF00
| 0002C000
| 0002C100
| N/A
| N/A
| N/A
| Nintendo Network ID Settings (act)
| [[7.0.0-13|v14]], [[7.2.0-17|v1029]], [[9.0.0-20|v2051]], [[9.3.0-21|v3072]]
| Same as JPN
| Same as JPN
| N/A
| N/A
| N/A
| Active
|-
| 20023100
| 20024100
| 20025100
| N/A
| N/A
| N/A
| [[microSD Management]] ('mcopy') ([[New_3DS]]-only)
| [[8.1.0-0_New3DS|v8]], [[9.0.0-20|v1024]]
| [[8.1.0-0_New3DS|v4]]
| [[8.1.0-0_New3DS|v5]]
| N/A
| N/A
| N/A
| Available
|-
| 2002C800
| 2002CF00
| 2002D000
| N/A
| 2002D700
| N/A
| [[New_3DS]]-only, currently stubbed. Placeholder exheader name is "menu".
| [[8.1.0-0_New3DS|v2]], [[9.0.0-20|v18]], [[9.3.0-21|v34]], [[9.6.0-24|v50]]
| [[8.1.0-0_New3DS|v1]], [[9.3.0-21|v17]], [[9.6.0-24|v34]]
| [[8.1.0-0_New3DS|v1]], [[9.3.0-21|v18]], [[9.6.0-24|v33]]
| N/A
| [[9.6.0-24|v2]]
| N/A
| Stubbed
|-
| 2002C900
| 2002D100
| 2002D200
| N/A
| 2002D800
| N/A
| [[New_3DS]]-only, currently stubbed. Placeholder exheader name is "friend".
| [[8.1.0-0_New3DS|v1]]
| Same as JPN.
| [[8.1.0-0_New3DS|v0]], [[9.3.0-21|v16]]
| N/A
| [[9.6.0-24|v2]]
| N/A
| Stubbed
|-
| 2002CA00
| 2002D300
| 2002D400
| N/A
| 2002D900
| N/A
| [[New_3DS]]-only, currently stubbed. Placeholder exheader name is "newslist".
| [[8.1.0-0_New3DS|v0]], v1([[Home_Menu|JPN-only]] Oct 2, 2014 "sysupdate", actually uploaded on 09-29-14. Identical to v0, same TMDs besides title-versions)
| [[8.1.0-0_New3DS|v2]]
| [[8.1.0-0_New3DS|v0]]
| N/A
| [[9.6.0-24|v2]]
| N/A
| Stubbed
|-
| 2002CB00
| 2002D500
| 2002D600
| N/A
| 2002DA00
| N/A
| [[New_3DS]]-only, currently stubbed. Placeholder exheader name is "cherry".
| [[8.1.0-0_New3DS|v0]], [[9.0.0-20|v1]]
| [[8.1.0-0_New3DS|v2]]
| Same as EUR.
| N/A
| [[9.6.0-24|v1]]
| N/A
| Stubbed
|}

The "act" application seems to use a web browser with webkit?

Regardless of version, the ExeFS:/.code for mset is the same for USA/EUR/JPN. The [[4.0.0-7]] version of mset([[4.1.0-8]] for TWN) has the same ExeFS:/.code for all regions(JPN, USA, EUR, CHN, KOR, TWN). The [[5.0.0-11]] mset ExeFS:/.code is the same for all regions as well, except for CHN. The [[7.0.0-13]] mset ExeFS:/.code is unique for the following regions: CHN, KOR, and TWN.

=== 0004001B - [[NCCH#CFA|System Data Archives]] ===
{| class="wikitable" border="1"
|-
! TitleID Low
! Description
! Versions
|-
| 00010002
| [[ClCertA]]
| [[1.0.0-0|v0]]
|-
| 00010702
| [[NS CFA]]
| [[3.0.0-5|v0]], [[6.0.0-11|v1028]], [[6.3.0-12|v2048]], [[7.0.0-13|v3073]], [[9.0.0-20|v4096]](also for [[8.1.0-0_New3DS]])
|-
| 00010802
| This CFA only contains a 1-byte "dummy.txt" in the RomFS, which contains '0'.
| [[6.3.0-12|v0]], [[9.5.0-23|v1024]]
|-
| 00018002
| Same contents as 00010802. Starting with [[7.1.0-15]], the "dummy.txt" file was removed from RomFS: this CFA RomFS now contains web-browser data(similar to 00018102) for NNID / networking, etc.
| [[7.0.0-13|v14]], [[7.1.0-15|v1025]], [[7.2.0-17|v2055]], [[9.0.0-20|v3078]], [[9.3.0-21|v4096]], [[9.6.0-24|v5120]]
|-
| 00018102
| This contains local web-browser data(html/js, gfx, etc) for the Miiverse Offline-mode.
| [[7.0.0-13|v11]], [[9.0.0-20|v1025]](also for [[8.1.0-0_New3DS]])
|-
| 00018202
| This contains the webkit/OSS [[CRO0|CROs]] used with the Miiverse applet and the "act" application.
| [[7.0.0-13|v7]], [[8.1.0-0_New3DS|v1026]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v2050]]
|-
| 00019002
| [[Fangate_updater]]
| [[9.3.0-21|v2]], [[9.6.0-24|v1026]]
|}

=== 00040030 - Applets===
{| class="wikitable" border="1"
|-
! JPN TitleIDLow
! USA TitleIDLow
! EUR TitleIDLow
! Description
! JPN Versions
! USA Versions
! EUR Versions
|-
| 00008102
| 00008102
| 00008102
| [[NS#Alternate menu|Alternate menu]]
| N/A
|-
| 00008202
| 00008F02
| 00009802
| [[Home Menu|Home Menu]] (menu)
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[2.1.0-3|v2049]], [[2.2.0-X|v3075]], [[3.0.0-5|v4111]], [[4.0.0-7|v5131]], [[4.2.0-9|v6146]], [[5.0.0-11|v7172]], [[6.0.0-11|v8198]], [[7.0.0-13|v9230]], [[8.1.0-0_New3DS|v10250]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v13313]], [[9.1.0-20J|v14336]], [[9.2.0-20|v15360]], [[9.3.0-21|v16402]], [[9.4.0-21|v17408]], [[9.5.0-22|v18432]], [[9.6.0-24|v19476]], [[9.7.0-25|v20487]], [[9.8.0-25|v22528]], [[10.1.0-27|v23552]], [[10.2.0-28|v24576]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[2.1.0-3|v2049]], [[2.2.0-X|v3075]], [[3.0.0-5|v4111]], [[4.0.0-7|v5131]], [[4.2.0-9|v6146]], [[5.0.0-11|v7172]], [[6.0.0-11|v8198]], [[7.0.0-13|v9230]], [[8.1.0-0_New3DS|v10250]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v11272]], [[9.2.0-20|v12288]], [[9.3.0-21|v13330]], [[9.4.0-21|v14336]], [[9.5.0-22|v15360]], [[9.6.0-24|v16404]], [[9.7.0-25|v17415]], [[9.8.0-25|v19456]], [[9.9.0-26|v20480]], [[10.1.0-27|v21504]], [[10.2.0-28|v22528]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[2.1.0-3|v2049]], [[2.2.0-X|v3075]], [[3.0.0-5|v4111]], [[4.0.0-7|v5131]], [[4.2.0-9|v6146]], [[5.0.0-11|v7172]], [[6.0.0-11|v8198]], [[7.0.0-13|v9230]], [[8.1.0-0_New3DS|v10250]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v11272]], [[9.2.0-20|v12288]], [[9.3.0-21|v13330]], [[9.4.0-21|v14336]], [[9.5.0-22|v15360]], [[9.6.0-24|v16404]], [[9.7.0-25|v17415]], [[9.8.0-25|v19456]], [[10.1.0-27|v20480]], [[10.2.0-28|v21504]]
|-
| 00008402
| 00009002
| 00009902
| Camera applet used by Home-menu (CtrApp)
| v0, v1036, [[9.0.0-20|v2049]](Also for [[8.1.0-0_New3DS]])
| Same as JPN
| Same as JPN
|-
| 00008502
| 00009102
| 00009A02
| Not available on CDN
| ?
|
|
|-
| 00008602
| 00009202
| 00009B02
| Instruction Manual, applet for displaying instruction manuals
| v0, v1026, v2048, v3072, [[5.0.0-11|v4097]], [[9.0.0-20|v5120]](Also for [[8.1.0-0_New3DS]])
| Same as JPN
|-
| 00008702
| 00009302
| 00009C02
| Game Notes (Cherry)
| v0, v1026, v2049, [[5.0.0-11|v3073]], [[9.0.0-20|v4096]](Also for [[8.1.0-0_New3DS]])
| Same as JPN
| Same as JPN
|-
| 00008802
| 00009402
| 00009D02
| [[Internet Browser]] (spider)
| [[2.0.0-2|v6]], [[2.1.0-4|v1024]], [[4.0.0-7|v2050]], [[5.0.0-11|v3074 (EUR)/v3075(USA,JAP)]], [[7.0.0-13|v3088]], [[7.1.0-16|v4096]], [[9.5.0-23|v5121]], [[9.9.0-26|v6149]], [[10.2.0-28|v7168]]
| Same as JPN
| Same as JPN
|-
| 20008802
| 20009402
| 20009D02
| [[New_3DS]] [[Internet Browser]] (SKATER)
| [[8.1.0-0_New3DS|v10]], [[9.3.0-21|v1027]], [[9.6.0-24|v2051]], [[9.9.0-26|v3077]], [[10.2.0-28|v4096]]
| Same as JPN
| Same as JPN
|-
| 00008A02
| 00008A02
| 00008A02
| [[ErrDisp]]
| v0, v1025, [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[5.0.0-11|v5121]], [[8.0.0-18|v6144]], [[9.0.0-20|v7168]](Also for [[8.1.0-0_New3DS]])
| Same as JPN
| Same as JPN
|-
| 00008A03
| 00008A03
| 00008A03
| SAFE_MODE [[ErrDisp]]
| v0
| Same as JPN
| Same as JPN
|-
| 20008A03
| 20008A03
| 20008A03
| [[New_3DS]] SAFE_MODE [[ErrDisp]]
| [[8.1.0-0_New3DS|v7169]]
| Same as JPN
| Same as JPN
|-
| 00008D02
| 00009602
| 00009F02
| Friend List (friend)
| v0, v1026, [[2.2.0-X|v2051]], v3082, v4099, [[7.0.0-13|v5120]], [[9.0.0-20|v6144]](Also for [[8.1.0-0_New3DS]]) (EUR v6, v1024, v3082, v4099, [[7.0.0-13|v5120]], [[9.0.0-20|v6144]])
| Same as JPN
| Same as JPN
|-
| 00008E02
| 00009702
| 0000A002
| Notifications (newslist)
| v0, v1029, v2054, v3075, [[9.0.0-20|v4097]] (EUR v6, v1024, v2054, v3075, [[9.0.0-20|v4097]]) (JPN: ..., [[8.1.0-0_New3DS|v4096]], [[9.0.0-20|v5121]])
| Same as JPN
| Same as JPN
|-
| 0000C002
| 0000C802
| 0000D002
| Software Keyboard (swkbd)
| v0, v1026, v2053, [[7.0.0-13|v3072]], [[9.0.0-20|v4096]](Also for [[8.1.0-0_New3DS]])
| Same as JPN
| Same as JPN
|-
| 0000C003
| 0000C803
| 0000D003
| SAFE_MODE Software Keyboard (swkbd)
| v0
| Same as JPN
| Same as JPN
|-
| 2000C003
| 2000C803
| 2000D003
| [[New_3DS]] SAFE_MODE Software Keyboard (swkbd)
| [[8.1.0-0_New3DS|v0]](for JPN this is v1024)
| Same as JPN
| Same as JPN
|-
| 0000C102
| 0000C902
| 0000D102
| appletEd
| v0, v1026, [[9.0.0-20|v2048]](Also for [[8.1.0-0_New3DS]]), [[9.3.0-21|v3077]]
| Same as JPN
| Same as JPN
|-
| 0000C302
| 0000CB02
| 0000D302
| PNOTE_AP (Photo file selector applet, for SD-card/etc?)
| v0, v1024, [[8.1.0-0_New3DS|v2049]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v3075]], [[9.3.0-21|v4096]]
| Same as JPN
| Same as JPN
|-
| 0000C402
| 0000CC02
| 0000D402
| SNOTE_AP (Sound file selector applet, for SD-card/etc?)
| v0, v3, [[8.0.0-18|v1026]], [[9.0.0-20|v2048]](Also for [[8.1.0-0_New3DS]])
| Same as JPN
| Same as JPN
|-
| 0000C502
| 0000C502
| 0000C502
| error (This applet displays networking errors, etc)
| v0, v1026, v2053, v3074, [[8.1.0-0_New3DS|v4096]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v5128]], [[9.6.0-24|v6145]]
| Same as JPN
| Same as JPN
|-
| 0000C503
| 0000C503
| 0000C503
| SAFE_MODE error applet
| v0
| Same as JPN
| Same as JPN
|-
| 2000C503
| 2000C503
| 2000C503
| [[New_3DS]] SAFE_MODE error applet
| [[8.1.0-0_New3DS|v1024]]
| Same as JPN
| Same as JPN
|-
| 0000CD02
| 0000CD02
| 0000CD02
| extrapad ([[Circle Pad Pro]] calibration applet)
| v1, v1026, [[8.1.0-0_New3DS|v2048]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v3073]]
| Same as JPN
| Same as JPN
|-
| 0000C602
| 0000CE02
| 0000D602
| mint. eShop applet, used by applications for accessing the eShop, for DLC/etc. Also used by the eShop application itself.
| v5, v1028, [[4.2.0-9|v2050]], [[5.0.0-11|v3072]], [[7.0.0-13|v4109]], [[7.2.0-17|v5125]](v5123 for JPN), [[8.0.0-18|v6145]], [[8.1.0-0_New3DS|v7168]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v8200]], [[9.3.0-21|v9224]], [[9.6.0-24|v10247]], [[9.8.0-25|v11264]], [[10.0.0-27|v12293]], [[10.1.0-27|v13312]]
| Same as JPN
| Same as JPN
|-
| 0000BC02
| 0000BD02
| 0000BE02
| olv (Miiverse applet)
| [[7.0.0-13|v14]], [[7.2.0-17|v1024]], [[9.0.0-20|v2048]](Also for [[8.1.0-0_New3DS]]), [[9.3.0-21|v3072]], [[9.6.0-24|v4096]]
| Same as JPN
| Same as JPN
|-
| 0000F602
| 0000F602
| 0000F602
| memolib (Uses Miiverse, likely the "system library" for Miiverse)
| [[7.0.0-13|v5]], [[8.1.0-0_New3DS|v1024]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v2050]], [[9.3.0-21|v3072]]
| Same as JPN
| Same as JPN
|-
| 00008302
| 00008B02
| 0000BA02
| solv3 (Miiverse-posting applet)
| [[9.0.0-20|v6]]
| Same as JPN
| Same as JPN
|-
| 00009502
| 00009E02
| 0000B902
| Cabinet ([[amiibo Settings]])
| [[9.3.0-21|v7]], [[9.6.0-24|v1031]]
| Same as JPN
| Same as JPN
|}

Most of these processes are applets, see [[NS_and_APT_Services|here]] for details.

All of the above processes use the "SYSTEM" [[SVC|memory-region]].

The ExeFS for Home Menu is exactly the same for USA/EUR/JPN.

The Miiverse applet seems to use a web browser with webkit.

=== 0004009B - [[NCCH#CFA|System Data Archives]] (Shared Archives) ===
{| class="wikitable" border="1"
|-
! JPN TitleIDLow
! USA TitleIDLow
! EUR TitleIDLow
! Description
! Versions
|-
| 00010202
| 00010202
| 00010202
| Probably Mii-related, contains "CFL_Res.dat" in the RomFS.
| v0
|-
| 00010302
| 00010302
| 00010302
| Doesn't exist on CDN?
| v0, v2052
|-
| 00010402
| 00010402
| 00010402
| Mounted as "area:", contains Country and Region names
| v0, v1024, v2050, v3072, [[7.0.0-13|v4098]], [[9.6.0-24|v5122]]
|-
| 00010502
| 00010502
| 00010502
| Doesn't exist on CDN?
| v0, v1024, v2048
|-
| 00010602
| 00010602
| 00010602
| Non-Nintendo TLS Root-CA Certificates (RomFS contains files with filename "CACERT_PUBLIC_CA_<val>.der", where <val> is 5..8)
| v2
|-
| 00011902
| ?
| ?
| ?
| v0
|-
| ?
| 00011402
| ?
| ?
| v0
|-
| ?
| 00011602
| ?
| ?
| v0
|-
| ?
| 00011D02
| ?
| ?
| v0
|-
| ?
| 00011E02
| ?
| ?
| v0
|-
| ?
| ?
| 00011202
| ?
| v0
|-
| ?
| ?
| 00011302
| ?
| v0
|-
| ?
| ?
| 00011502
| ?
| v0
|-
| ?
| ?
| 00011702
| ?
| v0
|-
| ?
| ?
| 00011802
| ?
| v0
|-
| 00011902
| ?
| ?
| ?
| v0
|-
| ?
| ?
| 00011B02
| ?
| v0
|-
| ?
| ?
| 00011C02
| ?
| v0
|-
| ?
| ?
| 00011D02
| ?
| v0
|-
| ?
| ?
| 00012102
| ?
| v0, v1026, v2051, v3074
|-
| 00012202
| 00012302
| 00012102
| ?contains a lists with error strings
| v1026, v2053, v3073, [[4.2.0-9|v4096]], [[5.0.0-11|v5120]], [[7.0.0-13|v6149]], [[7.2.0-17|v7168]], [[8.0.0-18|v8192]], [[9.0.0-20|v9218]], [[9.3.0-21|v10242]], [[9.6.0-24|v11269]], [[10.0.0-27|v12289]]
|-
| 00013202
| 00013302
| 00013102
| Mounted as "eula:"
| v0, v1024, v2049 USA: v1024, v2051, [[7.0.0-13|v3074]], [[7.2.0-17|v4100]](EUR-only), [[9.0.0-20|v4099]], [[9.9.0-26|v6144]]
|-
| 00014002
| 00014002
| 00014002
| JPN/EUR/USA [[System Font]] ("font:")
| v0
|-
| 00014102
| 00014102
| 00014102
| CHN [[System Font]] ("font:")
| v0, v1024
|-
| 00014202
| 00014202
| 00014202
| KOR [[System Font]] ("font:")
| v0, v1024
|-
| 00014302
| 00014302
| 00014302
| TWN [[System Font]] ("font:")
| v0, v1024
|-
| 00015202
| 00015302
| 00015102
| Mounted as "rate:"
| v0 (EUR: v0, v1024)
|-
| ?
| 00016302
| ?
| ?
| v80
|-
| ?
| 00017302
| ?
| ?
| v3088
|}

=== 000400DB - [[NCCH#CFA|System Data Archives]] ===
These [[NVer]] titleIDs can be found @ offset 0x320 in every [[CCI]].

{| class="wikitable" border="1"
|-
! EUR TitleIDLow
! JPN TitleIDLow
! USA TitleIDLow
! CHN TitleIDLow
! KOR TitleIDLow
! TWN TitleIDLow
! Description
! USA/EUR/JPN Versions
! CHN Versions
! TWN Versions
! KOR Versions
|-
| 00010302
| 00010302
| 00010302
| 00010302
| 00010302
| 00010302
| NGWord bad word list
| [[1.0.0-0|v0]], [[2.0.0-2|v1024]], [[3.0.0-5|v2052]], [[4.0.0-7|v3072]], [[4.3.0-10|v4096]], [[5.0.0-11|v5120]], [[9.0.0-20|v6144]], [[9.3.0-21|v7168]], [[9.6.0-24|v8192]]
| Same as USA
| Same as USA
| Same as USA
|-
| 00010502
| 00010502
| 00010502
| 00010502
| 00010502
| 00010502
| [[Nintendo Zone]] hotspot list
| [[1.0.0-0|v0]], [[2.0.0-2|v1024]], [[3.0.0-5|v2048]], [[4.0.0-7|v3073]], [[4.3.0-10|v4096]], [[4.4.0-10|v5120]], [[4.5.0-10|v6144]], [[5.0.0-11|v7169]], [[6.0.0-11|v8192]], [[6.2.0-12|v9216]], [[7.0.0-13|v10242]], [[7.2.0-17|v11267]], [[8.0.0-18|v12288]], [[9.0.0-20|v14336]], [[9.3.0-21|v15360]], [[9.6.0-24|v16386]], [[10.0.0-27|v17409]]
| Same as USA
| Same as USA
| Same as USA
|-
| 00016102
| 00016202
| 00016302
| 00016402
| 00016502
| 00016602
| [[NVer]]
| [[1.0.0-0|v0]], [[1.1.0-1|v16]], [[2.0.0-2|v32]], [[2.1.0-3|v48]], [[2.1.0-4|v64]], [[3.0.0-5|v80]], [[3.0.0-6|v96]], [[4.0.0-7|v112]], [[4.1.0-8|v128]], [[4.2.0-9|v144]], [[4.3.0-10|v160]], [[5.0.0-11|v176]], non-USA=[[6.0.0-11|v192]]/USA=[[6.1.0-12U|v192]], [[7.0.0-13|v208]], [[7.1.0-14|v224]], [[7.1.0-15|v240]], [[7.1.0-16|v256]], [[7.2.0-17|v272]], [[8.0.0-18|v288]], [[8.1.0-19|v304]], [[9.0.0-20|v320]], [[9.3.0-21|v336]], [[9.5.0-22|v352]], [[9.5.0-23|v368]], [[9.6.0-24|v384]], [[9.7.0-25|v400]], [[9.9.0-26|v416]], [[10.0.0-27|v432]], [[10.2.0-28|v448]]
| [[4.0.0-7|v113]], [[4.2.0-9|v128]], [[5.0.0-11|v129]], [[7.1.0-16|v130]], [[7.2.0-17|v272]], [[9.5.0-23|v131]], [[9.9.0-26|v132]]
| [[4.1.0-8|v114]], [[4.2.0-9|v133]], [[4.3.0-10|v134]], [[5.0.0-11|v136]], [[7.0.0-13|v144]], [[7.1.0-14|v160]] [[7.1.0-16|v192]], [[7.2.0-17|v272]], [[8.0.0-18|v208]], [[8.1.0-19|v224]], [[9.0.0-20|v240]], [[9.5.0-22|v272]], [[9.5.0-23|v288]], [[9.6.0-24|v304]], [[9.7.0-25|v320]], [[9.9.0-26|v336]], [[10.0.0-27|v352]], [[10.2.0-28|v368]]
| [[4.0.0-7|v113]], [[4.1.0-8|v114]], [[4.2.0-9|v133]], [[4.3.0-10|v134]], [[5.0.0-11|v136]], [[7.0.0-13|v160]], [[7.1.0-14|v176]], [[7.1.0-16|v176]], [[7.2.0-17|v272]], [[8.0.0-18|v224]], [[8.1.0-19|v240]], [[9.0.0-20|v256]], [[9.3.0-21|v272]], [[9.5.0-22|v288]], [[9.5.0-23|v304]], [[9.6.0-24|v320]], [[9.7.0-25|v336]], [[9.9.0-26|v352]], [[10.0.0-27|v368]], [[10.2.0-28|v384]]
|-
| 20016102
| 20016202
| 20016302
| N/A
| 20016502
| N/A
| [[New_3DS]] [[NVer]]
| [[8.1.0-0_New3DS|v0]], [[9.0.0-20|v320]], [[9.3.0-21|v336]], [[9.5.0-22|v352]], [[9.5.0-22|v352]], [[9.5.0-23|v368]], [[9.6.0-24|v384]], [[9.7.0-25|v400]], [[9.9.0-26|v416]], [[10.0.0-27|v432]], [[10.2.0-28|v448]]
| N/A
| N/A
| [[9.6.0-24|v320]], [[9.7.0-25|v336]], [[9.9.0-26|v352]], [[10.0.0-27|v368]], [[10.2.0-28|v384]]
|-
| 00017102
| 00017202
| 00017302
| 00017402
| 00017502
| 00017602
| [[CVer]]
| [[1.0.0-0|v1024]], [[1.1.0-1|v1045]], [[2.0.0-2|v2049]], [[2.1.0-3|v2069]], [[2.2.0-X|v2088]] [[3.0.0-5|v3088]], [[4.0.0-7|v4098]], [[4.1.0-8|v4113]], [[4.2.0-9|v4130]], [[4.3.0-10|v4145]], [[4.4.0-10|v4163]], [[4.5.0-10|v4176]], [[5.0.0-11|v5120]], [[5.1.0-11|v5136]], [[6.0.0-11|v6146]], [[6.1.0-11|v6160]], [[6.2.0-12|v6178]], [[6.3.0-12|v6192]], [[7.0.0-13|v7175]], [[7.1.0-14|v7187]], [[7.2.0-17|v7203]], [[8.0.0-18|v8196]], [[8.1.0-18|v8208]], [[8.1.0-0_New3DS|v8215]](8.1.0-0_New3DS), [[9.0.0-20|v9218]], [[9.1.0-20J|v9232]](JPN-only), [[9.2.0-20|v9248]], [[9.3.0-21|v9264]], [[9.4.0-21|v9280]], [[9.5.0-22|v9296]], [[9.6.0-24|v9319]], [[9.7.0-25|v9328]], [[9.8.0-25|v9344]], [[9.9.0-26|v9360]], [[10.0.0-27|v10240]], [[10.1.0-27|v10256]], [[10.2.0-28|v10272]]
| [[1.0.0-0|v1024]], [[1.1.0-1|v1045]], [[2.0.0-2|v2049]], [[2.1.0-3|v2069]], [[2.2.0-X|v2088]] [[3.0.0-5|v3088]], [[4.0.0-7|v4098]], [[4.1.0-8|v4113]], [[4.2.0-9|v4130]], [[4.3.0-10|v4145]], [[4.4.0-10|v4163]], [[4.5.0-10|v4176]], [[5.0.0-11|v5120]], [[5.1.0-11|v5136]], [[6.0.0-11|v6146]], [[6.1.0-11|v6160]], [[6.2.0-12|v6178]], [[6.3.0-12|v6192]], [[7.0.0-13|v7175]], [[7.1.0-14|v7187]], [[7.2.0-17|v7203]], [[8.0.0-18|v8196]], [[8.1.0-18|v8208]], [[9.0.0-20|v9217]], [[9.3.0-21|v9264]], [[9.5.0-22|v9296]], [[9.6.0-24|v9319]], [[9.7.0-25|v9328]], [[9.8.0-25|v9344]], [[9.9.0-26|v9360]], [[10.0.0-27|v10240]], [[10.2.0-28|v10272]]
| Same as CHN
| Same as CHN
|}

=== 00040130 - System [[Services API|Modules]] ===
{| class="wikitable" border="1"
|-
! TitleID Low
! Description
! Versions
|-
| 00001002
| [[Services|sm]] (Stored in [[FIRM|NATIVE_FIRM]])
| N/A
|-
| 00001003
| SAFE_MODE [[Services|sm]] (Stored in SAFE_MODE NATIVE_FIRM)
| N/A
|-
| 00001102
| [[Filesystem services‎|fs]] (Stored in [[FIRM|NATIVE_FIRM]])
| N/A
|-
| 00001103
| SAFE_MODE [[Filesystem services‎|fs]] (Stored in SAFE_MODE NATIVE_FIRM)
| N/A
|-
| 00001202
| [[Process Manager Services|pm]] (Stored in [[FIRM|NATIVE_FIRM]])
| N/A
|-
| 00001203
| SAFE_MODE [[Process Manager Services|pm]] (Stored in SAFE_MODE NATIVE_FIRM)
| N/A
|-
| 00001302
| [[Loader Services‎|loader]] (Stored in [[FIRM|NATIVE_FIRM]])
| N/A
|-
| 00001303
| SAFE_MODE [[Loader Services‎|loader]] (Stored in SAFE_MODE NATIVE_FIRM)
| N/A
|-
| 00001402
| [[PXI Services‎|pxi]] (Stored in [[FIRM|NATIVE_FIRM]])
| N/A
|-
| 00001403
| SAFE_MODE [[PXI Services‎|pxi]] (Stored in SAFE_MODE NATIVE_FIRM)
| N/A
|-
| 00001502
| [[Application Manager Services|AM]] ( Application Manager )
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[3.0.0-5|v2053]], [[4.0.0-7|v3072]], [[5.0.0-11|v4098]], [[6.0.0-11|v5120]], [[8.0.0-18|v6148]], [[8.1.0-0_New3DS|v7168]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v8192]], [[10.0.0-27|v9217]]
|-
| 00001503
| SAFE_MODE [[Application Manager Services|AM]]
| [[1.0.0-0|v0]]
|-
| 20001503
| [[New_3DS]] SAFE_MODE [[Application Manager Services|AM]]
| [[8.1.0-0_New3DS|v7169]]
|-
| 00001602
| [[Camera Services|Camera]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[3.0.0-5|v2048]], [[4.0.0-7|v3074]], [[5.0.0-11|v4098]], [[6.0.0-11|v5120]], [[7.1.0-14|v6146]], [[8.0.0-18|v7172]], [[9.0.0-20|v9216]], [[9.3.0-21|v10242]], [[10.0.0-27|v11265]]
|-
| 20001602
| [[New_3DS]] [[Camera Services|Camera]]
| [[8.1.0-0_New3DS|v8200]], [[9.0.0-20|v9218]], [[9.3.0-21|v10242]], [[10.0.0-27|v11265]]
|-
| 00001702
| [[Config Services|Config]] (cfg)
| [[1.0.0-0|v0]], [[2.0.0-2|v1024]], [[3.0.0-5|v2049]], v3072, [[4.0.0-7|v4096]], [[5.0.0-11|v5122]], [[6.0.0-11|v6145]], [[6.1.0-11|v7168]], [[7.0.0-13|v8196]], [[7.2.0-17|v9220]], [[8.0.0-18|v10243]], [[8.1.0-0_New3DS|v11265]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v12290]], [[9.3.0-21|v13315]], [[9.6.0-24|v14342]]
|-
| 00001703
| SAFE_MODE [[Config Services|Config]] (cfg)
| [[1.0.0-0|v0]]
|-
| 20001703
| [[New_3DS]] SAFE_MODE [[Config Services|Config]] (cfg)
| [[8.1.0-0_New3DS|v11265]]
|-
| 00001802
| [[Codec Services|Codec]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[5.0.0-11|v4098]], [[7.0.0-13|v5120]], [[8.0.0-18|v6144]], [[9.0.0-20|v7168]](Also for [[8.1.0-0_New3DS]])
|-
| 00001803
| SAFE_MODE [[Codec Services|Codec]]
| [[1.0.0-0|v0]]
|-
| 20001803
| [[New_3DS]] SAFE_MODE [[Codec Services|Codec]]
| [[8.1.0-0_New3DS|v7169]]
|-
| 00001902
| dmnt, debugger sysmodule. This use devunit-only HIO for devunit<>pc comms. This only exists for development units(launched by NS during startup depending on certain [[Configuration_Memory]] fields' values). This is installed at the [[Factory_Setup|factory]], then later deleted at the factory on retail units.
|
|-
| 00001A02
| [[DSP Services|DSP]]
| [[1.0.0-0|v0]], [[3.0.0-5|v1024]], [[4.0.0-7|v2048]], [[5.0.0-11|v3074]], [[6.0.0-11|v4096]], [[8.0.0-18|v5120]], [[9.7.0-25|v6145]]
|-
| 00001A03
| SAFE_MODE [[DSP Services|DSP]]
| [[1.0.0-0|v0]]
|-
| 20001A03
| [[New_3DS]] SAFE_MODE [[DSP Services|DSP]]
| [[8.1.0-0_New3DS|v6145]]
|-
| 00001B02
| [[GPIO Services|GPIO]]
| [[1.0.0-0|v0]], [[5.0.0-11|v1025]], [[8.0.0-18|v2048]], [[9.5.0-22|v3073]]
|-
| 00001B03
| SAFE_MODE [[GPIO Services|GPIO]]
| [[1.0.0-0|v0]]
|-
| 20001B03
| [[New_3DS]] SAFE_MODE [[GPIO Services|GPIO]]
| [[8.1.0-0_New3DS|v3073]]
|-
| 00001C02
| [[GSP Services|GSP]]
| [[1.0.0-0|v0]], [[1.1.0-1|v1040]], [[2.0.0-2|v2049]], [[3.0.0-5|v3075]], v4098, [[4.0.0-7|v5120]], [[5.0.0-11|v6145]], [[6.0.0-11|v7168]], [[8.0.0-18|v8196]], [[9.0.0-20|v10240]], [[9.3.0-21|v11264]], [[9.6.0-24|v12294]]
|-
| 20001C02
| [[New_3DS]] [[GSP Services|GSP]]
| [[8.1.0-0_New3DS|v10243]], [[9.3.0-21|v11267]], [[9.6.0-24|v12294]]
|-
| 00001C03
| SAFE_MODE [[GSP Services|GSP]]
| [[1.0.0-0|v0]]
|-
| 20001C03
| [[New_3DS]] SAFE_MODE [[GSP Services|GSP]]
| [[8.1.0-0_New3DS|v9217]]
|-
| 00001D02
| [[HID Services|HID]] (Human Interface Devices)
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[5.0.0-11|v5121]], [[7.2.0-17|v6148]], [[8.0.0-18|v7168]], [[8.1.0-0_New3DS|v8192]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v9216]], [[9.3.0-21|v10240]]
|-
| 00001D03
| SAFE_MODE [[HID Services|HID]]
| [[1.0.0-0|v0]]
|-
| 20001D03
| [[New_3DS]] SAFE_MODE [[HID Services|HID]]
| [[8.1.0-0_New3DS|v8193]]
|-
| 00001E02
| [[I2C Services|i2c]]
| [[1.0.0-0|v0]], [[3.0.0-5|v1024]], [[5.0.0-11|v2049]], [[8.0.0-18|v3076]], [[9.3.0-21|v5120]]
|-
| 20001E02
| [[New_3DS]] [[I2C Services|i2c]]
| [[8.1.0-0_New3DS|v4096]], [[9.3.0-21|v5121]]
|-
| 00001E03
| SAFE_MODE [[I2C Services|i2c]]
| [[1.0.0-0|v0]]
|-
| 20001E03
| [[New_3DS]] SAFE_MODE [[I2C Services|i2c]]
| [[8.1.0-0_New3DS|v4097]]
|-
| 00001F02
| [[MCU Services|MCU]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.1.0-3|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4102]], [[5.0.0-11|v5122]], [[6.0.0-11|v6145]], [[7.0.0-13|v7168]], [[8.0.0-18|v8192]]
|-
| 20001F02
| [[New_3DS]] [[MCU Services|MCU]]
| [[8.1.0-0_New3DS|v8192]]
|-
| 00001F03
| SAFE_MODE [[MCU Services|MCU]]
| [[1.0.0-0|v0]]
|-
| 20001F03
| [[New_3DS]] SAFE_MODE [[MCU Services|MCU]]
| [[8.1.0-0_New3DS|v9217]]
|-
| 00002002
| [[MIC Services|MIC]] (Microphone)
| [[1.0.0-0|v0]], [[5.0.0-11|v1025]], [[8.0.0-18|v2048]]
|-
| 00002102
| [[PDN Services|PDN]]
| [[1.0.0-0|v0]], [[5.0.0-11|v1025]], [[8.0.0-18|v2048]]
|-
| 00002103
| SAFE_MODE [[PDN Services|PDN]]
| [[1.0.0-0|v0]]
|-
| 20002103
| [[New_3DS]] SAFE_MODE [[PDN Services|PDN]]
| [[8.1.0-0_New3DS|v3073]]
|-
| 00002202
| [[PTM Services|PTM]] (Play time, pedometer, and battery manager)
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.2.0-X|v2048]], [[3.0.0-5|v3075]], v4096, [[4.0.0-7|v5120]], [[5.0.0-11|v6146]], [[6.0.0-11|v7168]], [[7.0.0-13|v8192]], [[8.0.0-18|v9219]], [[9.6.0-24|v11264]]
|-
| 20002202
| [[New_3DS]] [[PTM Services|PTM]] (Play time, pedometer, and battery manager)
| [[8.1.0-0_New3DS|v10240]], [[9.6.0-24|v11264]]
|-
| 00002203
| SAFE_MODE [[PTM Services|PTM]]
| [[1.0.0-0|v0]]
|-
| 20002203
| [[New_3DS]] SAFE_MODE [[PTM Services|PTM]]
| [[8.1.0-0_New3DS|v10241]]
|-
| 00002302
| [[SPI Services|spi]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[5.0.0-11|v2049]], [[8.0.0-18|v3072]]
|-
| 20002302
| [[New_3DS]] [[SPI Services|spi]]
| [[8.1.0-0_New3DS|v4096]]
|-
| 00002303
| SAFE_MODE [[SPI Services|spi]]
| [[1.0.0-0|v0]]
|-
| 20002303
| [[New_3DS]] SAFE_MODE [[SPI Services|spi]]
| [[8.1.0-0_New3DS|v4097]]
|-
| 00002402
| [[AC Services|AC]] (Network manager)
| [[1.0.0-0|v0]], [[1.1.0-1|v1024]], [[2.0.0-2|v2052]], [[2.1.0-3|v3072]], [[3.0.0-5|v4101]], [[5.0.0-11|v5122]], [[7.0.0-13|v6145]], [[8.0.0-18|v7172]], [[9.0.0-20|v8192]](Also for [[8.1.0-0_New3DS]]), [[9.3.0-21|v9216]]
|-
| 00002403
| SAFE_MODE [[AC Services|AC]]
| [[1.0.0-0|v0]]
|-
| 20002403
| [[New_3DS]] SAFE_MODE [[AC Services|AC]]
| [[8.1.0-0_New3DS|v8193]]
|-
| 00002602
| [[CECD Services|Cecd]] (StreetPass)
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.2.0-X|v2048]], [[3.0.0-5|v3073]], [[4.0.0-7|v4097]], [[5.0.0-11|v5122]], [[6.0.0-11|v6144]], [[6.2.0-12|v7170]], [[7.0.0-13|v8193]], [[8.0.0-18|v9216]], [[9.0.0-20|v10240]]
|-
| 00002702
| [[CSND Services|CSND]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[4.0.0-7|v2048]], [[5.0.0-11|v3073]], [[8.0.0-18|v4096]], [[9.0.0-20|v5120]]
|-
| 00002703
| SAFE_MODE [[CSND Services|CSND]]
| [[1.0.0-0|v0]]
|-
| 20002703
| [[New_3DS]] SAFE_MODE [[CSND Services|CSND]]
| [[8.1.0-0_New3DS|v5121]]
|-
| 00002802
| [[DLP Services|DLP]] ([[Download Play]])
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.2.0-X|v2048]], [[3.0.0-5|v3078]], [[5.0.0-11|v4099]], [[8.0.0-18|v5123]], [[9.0.0-20|v6145]](Also for [[8.1.0-0_New3DS]]), [[9.6.0-24|v7174]], [[10.0.0-27|v8192]]
|-
| 00002902
| [[HTTP Services|HTTP]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.1.0-3|v2049]], [[2.2.0-X|v3072]], [[3.0.0-5|v4099]], [[4.0.0-7|v5122]], [[5.0.0-11|v6145]], [[7.0.0-13|v7171]], [[7.1.0-14|v8192]], [[8.0.0-18|v9220]], [[8.1.0-18|v10245]], [[8.1.0-0_New3DS|v11264]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v12288]], [[9.6.0-24|v13318]]
|-
| 00002903
| SAFE_MODE [[HTTP Services|HTTP]]
| [[1.0.0-0|v0]]
|-
| 20002903
| [[New_3DS]] SAFE_MODE [[HTTP Services|HTTP]]
| [[8.1.0-0_New3DS|v10241]]
|-
| 00002A02
| [[MP Services|MP]]
| [[1.0.0-0|v0]], [[5.0.0-11|v1025]], [[8.0.0-18|v2048]]
|-
| 00002A03
| SAFE_MODE [[MP Services|MP]]
| [[1.0.0-0|v0]]
|-
| 00002B02
| [[NDM Services|NDM]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[3.0.0-5|v2049]], [[4.0.0-7|v3072]], [[5.0.0-11|v4098]], [[8.0.0-18|v5124]], [[8.1.0-0_New3DS|v6144]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v7169]]
|-
| 00002C02
| [[NIM Services|NIM]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1028]], [[3.0.0-5|v2055]], [[4.0.0-7|v3074]], [[5.0.0-11|v4100]], [[6.0.0-11|v5120]], [[7.0.0-13|v6148]], [[7.2.0-17|v7174]], [[8.0.0-18|v8195]], [[8.1.0-0_New3DS|v9217]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v10249]], [[9.3.0-21|v11267]], [[9.6.0-24|v12296]], [[10.0.0-27|v13313]]
|-
| 00002C03
| SAFE_MODE [[NIM Services|NIM]]
| [[1.0.0-0|v0]]
|-
| 20002C03
| [[New_3DS]] SAFE_MODE [[NIM Services|NIM]]
| [[8.1.0-0_New3DS|v9217]]
|-
| 00002D02
| [[NWM Services|NWM]] ( Low-level wifi manager )
| [[1.0.0-0|v0]], [[1.1.0-1|v1024]], [[2.0.0-2|v2052]], [[2.2.0-X|v3072]], [[3.0.0-5|v4101]], [[4.0.0-7|v5120]], [[5.0.0-11|v6148]], [[6.0.0-11|v7169]], [[7.2.0-17|v8196]], [[8.0.0-18|v9216]], [[9.0.0-20|v10240]]
|-
| 00002D03
| SAFE_MODE [[NWM Services|NWM]]
| [[1.0.0-0|v0]], [[6.0.0-11|v5120]]
|-
| 20002D03
| [[New_3DS]] SAFE_MODE [[NWM Services|NWM]]
| [[8.1.0-0_New3DS|v10241]]
|-
| 00002E02
| [[Socket Services|Sockets]]
| [[1.0.0-0|v0]], [[1.1.0-1|v1024]], [[2.0.0-2|v2053]], [[3.0.0-5|v3075]], [[4.0.0-7|v4096]], [[5.0.0-11|v5121]], [[8.0.0-18|v6144]], [[9.0.0-20|v7168]]
|-
| 00002E03
| SAFE_MODE [[Socket Services|Sockets]]
| [[1.0.0-0|v0]]
|-
| 20002E03
| [[New_3DS]] SAFE_MODE [[Socket Services|Sockets]]
| [[8.1.0-0_New3DS|v7169]]
|-
| 00002F02
| [[SSL Services|SSL]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1024]], [[2.1.0-3|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[5.0.0-11|v5122]], [[8.0.0-18|v6144]], [[9.0.0-20|v7168]], [[9.6.0-24|v8198]]
|-
| 00002F03
| SAFE_MODE [[SSL Services|SSL]]
| [[1.0.0-0|v0]]
|-
| 20002F03
| [[New_3DS]] SAFE_MODE [[SSL Services|SSL]]
| [[8.1.0-0_New3DS|v7169]]
|-
| 00003000
| [[FIRM|Process9]] (in SAFE_MODE and normal NATIVE_FIRM)
| N/A
|-
| 00003102
| [[Process Services‎|PS]] ( Process Manager )
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[5.0.0-11|v2049]], [[6.0.0-11|v3072]], [[8.0.0-18|v4096]], [[9.0.0-20|v5120]]
|-
| 00003103
| SAFE_MODE [[Process Services‎|PS]]
| [[1.0.0-0|v0]]
|-
| 20003103
| [[New_3DS]] SAFE_MODE [[Process Services‎|PS]]
| [[8.1.0-0_New3DS|v5121]]
|-
| 00003202
| [[Friend Services‎|friends]] (Friends list)
| [[1.0.0-0|v0]], [[2.0.0-2|v1028]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[5.0.0-11|v5122]], [[7.0.0-13|v6145]], [[8.0.0-18|v7172]], [[9.0.0-20|v8192]](Also for [[8.1.0-0_New3DS]])
|-
| 00003203
| SAFE_MODE [[Friend Services‎|friends]] (Friends list)
| [[1.0.0-0|v0]]
|-
| 20003203
| [[New_3DS]] SAFE_MODE [[Friend Services‎|friends]] (Friends list)
| [[8.1.0-0_New3DS|v8193]]
|-
| 00003302
| [[IR Services‎|IR]] (Infrared)
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[5.0.0-11|v5121]], [[8.0.0-18|v6148]], [[8.1.0-0_New3DS|v7170]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v8192]], [[9.3.0-21|v9216]], [[9.6.0-24|v10246]], [[10.0.0-27|v11265]]
|-
| 00003303
| SAFE_MODE [[IR Services‎|IR]]
| [[1.0.0-0|v0]]
|-
| 20003303
| [[New_3DS]] SAFE_MODE [[IR Services‎|IR]]
| [[8.1.0-0_New3DS|v7169]]
|-
| 00003402
| [[BOSS Services‎|BOSS]] (SpotPass)
| [[1.0.0-0|v0]], [[1.1.0-1|v1024]], [[2.0.0-2|v2053]], [[2.2.0-X|v3073]], [[3.0.0-5|v4101]], [[4.0.0-7|v5122]], [[5.0.0-11|v6146]], [[6.0.0-11|v7169]], [[6.2.0-12|v8193]], [[7.0.0-13|v9222]], [[8.0.0-18|v10240]], [[9.0.0-20|v11266]], [[10.0.0-27|v12289]]
|-
| 00003502
| [[News Services‎|News]] (Notifications)
| [[1.0.0-0|v0]], [[2.0.0-2|v1028]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[5.0.0-11|v4097]], [[8.0.0-18|v5120]], [[9.0.0-20|v6147]], [[9.7.0-25|v7168]]
|-
| 00003602
| This only exist for development units(launched by NS during startup depending on certain [[Configuration_Memory]] fields' values).
|
|-
| 00003702
| [[RO_Services|RO]]
| [[2.0.0-2|v0]], [[4.0.0-7|v1024]], [[5.0.0-11|v2049]], [[7.2.0-17|v3074]], [[8.0.0-18|v4096]], [[9.0.0-20|v5120]](Also for [[8.1.0-0_New3DS]]), [[9.3.0-21|v6148]]
|-
| 00003802
| [[ACT Services‎|act]] (handles Nintendo Network '''a'''c'''c'''oun'''t'''s)
| [[7.0.0-13|v1029]], [[7.1.0-14|v2050]], [[7.2.0-17|v3077]], [[8.0.0-18|v4099]], [[8.1.0-0_New3DS|v5120]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v6144]], [[9.3.0-21|v7168]], [[9.6.0-24|v8198]]
|-
| 00004002
| Old3DS [[NFC_Services|nfc]]
| [[9.3.0-21|v2053]], [[9.6.0-24|v4106]], [[9.7.0-25|v5121]], [[10.0.0-27|v6145]]
|-
| 20004002
| [[New_3DS]] [[NFC_Services|nfc]]
| [[8.1.0-0_New3DS|v0]], [[9.0.0-20|v1024]], [[9.3.0-21|v2053]], [[9.5.0-22|v3073]], [[9.6.0-24|v4102]], [[10.0.0-27|v6145]]
|-
| 20004102
| [[New_3DS]] [[MVD Services|mvd]]
| [[8.1.0-0_New3DS|v0]], [[9.0.0-20|v1024]]
|-
| 20004202
| [[New_3DS]] [[QTM Services|qtm]]
| [[8.1.0-0_New3DS|v8]], [[9.0.0-20|v1024]], [[9.3.0-21|v2052]]
|-
| 00008002
| [[NS]] (Memory-region: "SYSTEM")
| [[1.0.0-0|v0]], [[2.0.0-2|v1028]], [[2.2.0-X|v2048]], [[3.0.0-5|v3077]], v4096, [[4.0.0-7|v5121]], [[5.0.0-11|v6148]], [[5.1.0-11|v7168]], [[6.0.0-11|v8193]], [[6.1.0-11|v9216]], [[7.0.0-13|v10248]], [[7.2.0-17|v11268]], [[8.0.0-18|v12291]], [[8.1.0-0_New3DS|v13312]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v14336]], [[9.3.0-21|v15360]], [[9.6.0-24|v16390]], [[9.8.0-25|v17408]], [[10.0.0-27|v18433]]
|-
| 00008003
| SAFE_MODE [[NS]] (Memory-region: "SYSTEM")
| [[1.0.0-0|v0]]
|-
| 20008003
| [[New_3DS]] SAFE_MODE [[NS]] (Memory-region: "SYSTEM")
| [[8.1.0-0_New3DS|v13313]]
|}

Once Home Menu finishes loading, all of the above system modules are running, except for MP, RO, and act which are automatically [[Process_Manager_Services|loaded]] when a process requires them. When [[Process_Manager_Services|PM]]-module terminates processes, it will check whether the processes listed as dependencies for this process are listed as dependencies for other processes. Any processes which are no longer listed in any processes dependencies lists are then terminated. On [[New_3DS]], the only New3DS-specific system-module which automatically gets loaded during system boot is qtm.

All of the above system modules use the "BASE" [[SVC|memory-region]](specified in the exheader), except when listed otherwise for certain modules.

When handling the exheader dependency list starting with [[8.0.0-18]], Old3DS FIRM [[Process_Manager_Services|PM]]-module now skips handling titles in this list which have any bits in programID-low bitmask 0xF0000000 set(with [[8.0.0-18]] this is hard-coded). The exheader dependency list handling change is for the [[New 3DS]] system-module(s), which do not exist on Old3DS. When the New3DS pm-module is launching any title except [[NS]], it first attempts to launch the title with programID-low bitmask 0x20000000 set, then with that bitmask clear if launching fails.

=== 00040138 - [[FIRM|System Firmware]] ===
NATIVE_FIRM and SAFE_MODE_FIRM for the initial versions are exactly the same, besides [[Configuration_Memory|core-version]] fields. SAFE_MODE_FIRM is used for running SAFE_MODE titles, on retail SAFE_MODE_FIRM seems to be only used for running the [[System_Settings#System_Updater|System Updater]] application. When a GBA VC title is launched, AGB_FIRM is launched to handle running this title. GBA VC savegames stored under SD card /title/<TID>/data use a custom format, this is handled by AGB_FIRM.

{| class="wikitable" border="1"
|-
! TitleID Low
! Description
! USA/EUR/JPN Versions
! CHN Versions
! KOR Versions
! TWN Versions
|-
| 00000001
| Unknown, very similar to SAFE_MODE_FIRM. Exists only on dev units and seems to only be used by SystemUpdaters.
| v0
|
|
|
|-
| 00000002
| NATIVE_FIRM (Native Firmware)
| [[1.0.0-0|v432]], [[1.1.0-1|v1472]], [[2.0.0-2|v2516]], [[2.1.0-3|v3553]], [[2.2.0-X|v4595]], [[3.0.0-5|v5647]], [[4.0.0-7|v6677]], [[4.1.0-8|v7712]], [[5.0.0-11|v8758]], [[5.1.0-11|v9792]], [[6.0.0-11|v10833]], [[6.1.0-11|v11872]], [[7.0.0-13|v12916]], [[7.2.0-17|v13956]], v15043, [[8.0.0-18|v15047]], [[9.0.0-20|v17120]], [[9.3.0-21|v18182]], [[9.5.0-22|v19216]], [[9.6.0-24|v20262]], [[10.0.0-27|v21288]], [[10.2.0-28|v22313]]
| Same as USA/EUR/JPN starting with the USA/EUR/JPN [[4.0.0-7]] title-version
| Same as CHN.
| Same as CHN.
|-
| 20000002
| [[New_3DS]] NATIVE_FIRM (Native Firmware)
| [[8.1.0-0_New3DS|v16085]], [[9.0.0-20|v17120]], [[9.3.0-21|v18182]], [[9.5.0-22|v19218]], [[9.6.0-24|v20262]], [[10.0.0-27|v21288]], [[10.2.0-28|v22313]]
| N/A
| Same as CHN.
| Same as CHN.
|-
| 00000003
| SAFE_MODE_FIRM
| [[1.0.0-0|v432]], [[3.0.0-5|v5632]]
| Same as USA/EUR/JPN starting with the USA/EUR/JPN [[3.0.0-5]] title-version
| Same as CHN.
| Same as CHN.
|-
| 20000003
| [[New_3DS]] SAFE_MODE_FIRM
| [[8.1.0-0_New3DS|v16081]]
| N/A
| Same as CHN.
| Same as CHN.
|-
| 00000102
| TWL_FIRM ( DSi Firmware )
| [[1.0.0-0|v432]], [[2.0.0-2|v1489]], [[3.0.0-5|v2565]], v3601, [[4.0.0-7|v4625]], [[4.4.0-10|v5681]], [[4.5.0-10|v6704]], [[6.0.0-11|v7762]], [[6.2.0-12|v8817]]
| Same as USA/EUR/JPN starting with the USA/EUR/JPN [[4.0.0-7]] title-version
| Same as CHN.
| Same as CHN.
|-
| 20000102
| [[New_3DS]] TWL_FIRM ( DSi Firmware )
| [[8.1.0-0_New3DS|v9936]]
| N/A
| Same as CHN.
| Same as CHN.
|-
| 00000202
| AGB_FIRM ( GBA Firmware )
| [[3.0.0-5|v519]], v1553, [[4.0.0-7|v2576]], [[6.0.0-11|v3665]]
| [[4.0.0-7|v2576]]
| [[4.0.0-7|v2576]], [[6.0.0-11|v3665]]
| Same as CHN.
|-
| 20000202
| [[New_3DS]] AGB_FIRM ( GBA Firmware )
| [[8.1.0-0_New3DS|v4816]]
| N/A
| N/A
| N/A
|}

== TWL System Titles ==

{| class="wikitable" border="1"
|-
! Content Category
! Bit Mask(s)
! Category Bit Mask
|-
| System Application
| TWL<nowiki>|</nowiki>0x1<nowiki>|</nowiki>0x4
| 0x8005
|-
| System Archive
| TWL<nowiki>|</nowiki>0x1<nowiki>|</nowiki>0x2<nowiki>|</nowiki>0x4<nowiki>|</nowiki>0x8
| 0x800F
|}
Bitmask 0x1 for TWL titles determines whether the title will be updated during a System Update.

=== 00048005 - System Applications===
{| class="wikitable" border="1"
|-
! TitleID Low
! Region
! Description
! Versions
! Information
|-
| 42383841(B88A)
| ALL
| [[DS Internet]]
| v0, [[2.1.0-4|v1025]], [[3.0.0-5|v2048]]
| [[DS Internet]] is the DSi-mode application launched by [[System Settings]] for setting TWL wifi configuration.
|-
| 484E4441(HNDA)
| ALL
| [[Download Play]]
| v1024
| This [[Download Play]] application is the DS-mode Download Play client, launched by the 3DS-mode Download Play application.
|-
| 484E4443(HNDC)
| CHN
| [[Download Play]]
| v1024
| See Above Description.
|-
| 484E444B(HNDK)
| KOR
| [[Download Play]]
| v1024
| See Above Description.
|}

=== 0004800F - System Data Archives===
{| class="wikitable" border="1"
|-
! TitleID Low
! Description
! Versions
|-
| 484E4841(HNHA)
| [[Nintendo DS Cart Whitelist]]
| v0, [[2.0.0-2|v1026]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[4.2.0-9|v5120]], [[4.3.0-10|v6145]], [[4.4.0-10|v7168]], [[4.5.0-10|v8192]], [[5.0.0-11|v9216]], [[6.0.0-11|v10240]], [[7.0.0-13|v11264]]
|-
| 484E4C41(HNLA)
| [[Version Data]]
| v0
|}

New system updates only block DS flash-cards when the above whitelist was updated, or when TWL_FIRM was updated. The whitelist contains the data used for detecting flash-cards, this is used by TWL_FIRM.

== Application Titles ==
{| class="wikitable" border="1"
|-
! Content Category
! Bit Mask(s)
! Category Bit Mask
|-
| [[Title list/eShop Titles|Application]] (eShop Title)
| Normal
| 0x0000
|-
| DLP Child
| DlpChild
| 0x0001
|-
| [[EShop Demos|Demo]]
| Demo
| 0x0002
|-
| [[Title list/Patches|Patch]]
| CannotExecution<nowiki>|</nowiki>Patch
| 0x000E
|-
| [[Title list/DLC|Add-on Content]] (DLC)
| NotRequireRightForMount<nowiki>|</nowiki>CannotExecution<nowiki>|</nowiki>AddOnContents
| 0x008C
|}

=== 00040001 - [[Download Play]] Titles ===
This titleID-high/programID-high is used for the titles sent over [[Download Play]]. Only one 00040001 Download Play title is installed to NAND /title at a time. There can be a maximum of 255 Download Play child titles per Unique ID, indexed by Title ID Variation. The legal index range: 0x0 - 0xff.

== TWL Application Titles ==
{| class="wikitable" border="1"
|-
! Content Category
! Bit Mask(s)
! Category Bit Mask
|-
| Application (DSiWare)
| TWL<nowiki>|</nowiki>0x4
| 0x8004
|}

=== 00048004 - DSiWare ===
Although these have a titleID high separate from DSi and a titleID is stored in the SRLs, the content of these SRLs are identical to DSi.

{| class="wikitable" border="1"
|-
! TitleID Low
! Region
! Description
! Versions
|-
| 4B4B5456(KKTV)
| EUR
| Cut the Rope
| v0, v64
|-
| 4B4E5256(KNRV)
| EUR
| A Little Bit of... Brain Training™: Maths Edition
| v0
|-
| 4B5A4C56(KZLV)
| EUR
| Plants vs. Zombies™
| v0
|-
| 4B454256(KEBV)
| EUR
| ELECTROPLANKTON (Hanenbow)
| v0
|-
| 4B513956(KQ9V)
| EUR
| Zelda: Four Swords Anniversary Edition
| v16
|-
| 4B574256(KWBV)
| EUR
| Mario Calculator
| v0
|-
| 4B574656(KWFV)
| EUR
| Mario Clock
| v0
|}

Title list

2015-10-30T15:14:56Z

Syphurith: Process9 extracted from FIRM. /* 00040130 - System Modules */

The Nintendo 3DS utilizes a similar title-based organization as seen in the Wii and DSi platforms. The update server is located [http://nus.cdn.c.shop.nintendowifi.net/ccs/download/ here]. When using SSL, the update/shop servers must be accessed via SSLv3.

The organization of Title IDs has not been documented fully yet. Region info isn't stored in title IDs however there does appear to be evidence that the regions are sequential, similar to how Wii System Menu Updates are ordered: JPN USA EUR KOR and CHN (introduced with the DSi). 3DS has one additional region: TWN.

Note: The terms 'Title ID', 'Partition ID' and 'Media ID' are interchangeable.

The 3DS retrieves system [[CommonETicket|tickets]] with SOAP request GetSystemCommonETicket, instead of directly downloading the cetk with HTTPS. The cetk is still accessible via HTTP, however 3DS doesn't use direct HTTP for this.

'''TitleID Structure''': 0xCCCCABCDLLLLLLRR

* CCCC defines the console '''Platform''' (5=WiiU, 4=3DS, 3=DSi, 1=[http://wiibrew.org/wiki/Title_database Wii])
* ABCD defines the '''Content Category''' of the title, Demo, DLPChild, etc.
* LLLLLL For CTR titles, this is the title's '''Unique ID'''. For TWL converted titles this is in two sections grouped as SSLLLL. SS is the old title identification used by the DSi and is made redundant by 'ABCD'. LLLL is the TWL title's 'Unique ID'. There are restrictions on the Unique ID, see below for more info.
* RR This is the Title ID '''Variation''', and has various uses.

'''Content Categories''':

This u16 is a collection bit mask flag. Each Category is a group of one or more bit masks.

Specific Bitmask Flags:
{| class="wikitable" border="1"
|-
! Category
! Bitmask
|-
| Normal
| 0x0
|-
| DlpChild
| 0x1
|-
| Demo
| 0x2
|-
| Contents
| 0x3
|-
| AddOnContents
| 0x4
|-
| Patch
| 0x6
|-
| CannotExecution
| 0x8
|-
| System
| 0x10
|-
| RequireBatchUpdate
| 0x20
|-
| NotRequireUserApproval
| 0x40
|-
| NotRequireRightForMount
| 0x80
|-
| CanSkipConvertJumpId
| 0x100
|-
| TWL
| 0x8000
|}

* TWL Category bit mask are carried over from original TWL category bitmasks (ignoring bit mask 0x8000), so TWL system titles have the bitmask of 0x8001.

* System titles (TWL and CTR) are eligible to be updated during a System Update.

* Bit Mask 0x4000 appears to be reserved, as it renders the ''TWL'' and ''System'' bit masks useless.

'''Unique ID Restrictions''':

For the CTR titles, there appears to be is a correlation between Unique IDs (UID) and 3DS 'title types'. For developer titles this is known(shown below), and retail titles *appear* to follow suite. It is unknown if this correlation is enforced on retail units, or if it is just for organisation purposes.

{| class="wikitable" border="1"
|-
! TITLE TYPE
! UNIQUE ID RANGE
|-
| System
| 0x0 - 0x2FF
|-
| Application
| 0x300 - 0xF7FFF
|-
| Evaluation
| 0xF8000 -0xFFFFF
|-
| Prototype*
| 0xFF000 - 0xFF3FF
|}
<nowiki>*</nowiki>On the home menu, titles with UIDs within the 'Prototype' range, appear on the home menu after install without the gift fanfare.

ProgramID/titleID low bitmask 0xF0000000(uniqueID bitmask 0xF00000) seems to be related to which hardware the title is allowed to run on. 3DS code tends to clear this bitmask when handling programIDs. This bitmask is normally zero. When this is 0x2, this indicates that the title only runs on [[New_3DS]](that is, programID-low 0x20000000 / uniqueID 0x200000).

'''TitleID Variation''':

This u8 allows enumeration of titles from the same category and unique ID. Common uses are explained below:

* CTR System Titles: The 3DS has two copies of most modules/applets/archives for usage with either the NATIVE_FIRM or SAFE_MODE_FIRM. This is allowed for, by changing the title ID variation of the title to match the core version set by the FIRM it is designed to be used with:
{| class="wikitable" border="1"
|-
! RR
! MEANING
|-
| 02
| System Title (Core version 0x2)
|-
| 03
| SAFE_MODE System Title (Core version 0x3)
|}
Normally on retail SAFE_MODE ARM11 [[NCCH#CXI|CXI]] titles can't be launched, since the [[Configuration_Memory|system]] core version doesn't match the CXI exheader core version.

* Only most non-Normal Applications are known to utilise Title ID variation, this is explained in their respective sections on this page.

* [[3DS Development Unit Software|Dev Menu]] installs CTR Applications with a TitleID variation of 0x02 to the CTR NAND.

* Title ID variation is ignored for TWL titles, this value is carried over from the original TWL title ID and is used for region lock:

=== Versions ===

v## = 0xHHHH = 0bBBBBBBBB...

* The version major,minor and micro can be extracted from the version number by converting the 16 bit number to binary
* 6 bits : Major
* 6 bits : Minor
* 4 bits : Micro ('Build' in some contexts)
* i.e. v2069 (Taken from 000400DB00017302) = 0b000010 000001 0101 means that the title version is v2.1.5. For reasons unknown, the CVer build, stored in the RomFS of the title, has always been zero (at time of writing), regardless of the CVer build in the TMD. So when predicting the firmware version, this should be taken into account.

NOTE: This Title list is a condensed version, only the System Titles lists are full lists. For a full list of titles on Nintendo's CDN, see [http://mtheall.com/~mtheall/tmdlist.php here]. The reports/title-lists from [http://yls8.mtheall.com/ninupdates/reports.php here] are automatically obtained from the system update SOAP.

== CTR System Titles ==
{| class="wikitable" border="1"
|-
! System Category
! Bit Mask(s)
! Category Bit Mask
|-
| Application (SYSTEM_APPLICATION)
| Normal<nowiki>|</nowiki>System
| 0x0010
|-
| System Data Archives (SYSTEM_CONTENT)
| Contents<nowiki>|</nowiki>CannotExecution<nowiki>|</nowiki>System
| 0x001B
|-
| Shared Data Archives (SHARED_CONTENT)
| Contents<nowiki>|</nowiki>CannotExecution<nowiki>|</nowiki>System<nowiki>|</nowiki>NotRequireRightForMount
| 0x009B
|-
| System Data Archives (AUTO_UPDATE_CONTENT)
| Contents<nowiki>|</nowiki>CannotExecution<nowiki>|</nowiki>System<nowiki>|</nowiki>NotRequireUserApproval<nowiki>|</nowiki>NotRequireRightForMount
| 0x00DB
|-
| Applet (APPLET)
| Normal<nowiki>|</nowiki>System<nowiki>|</nowiki>RequireBatchUpdate
| 0x0030
|-
| Module (BASE)
| Normal<nowiki>|</nowiki>System<nowiki>|</nowiki>RequireBatchUpdate<nowiki>|</nowiki>CanSkipConvertJumpId
| 0x0130
|-
| Firmware (FIRMWARE)
| Normal<nowiki>|</nowiki>CannotExecution<nowiki>|</nowiki>System<nowiki>|</nowiki>RequireBatchUpdate<nowiki>|</nowiki>CanSkipConvertJumpId
| 0x0138
|}

=== 00040010 - System Applications ===
The versions for CHN, KOR, and TWN are separate from the other regions.

{| class="wikitable" border="1"
|-
! JPN TIDLow
! USA TIDLow
! EUR TIDLow
! CHN TIDLow
! KOR TIDLow
! TWN TIDLow
! Description
! JPN Versions
! EUR Versions
! USA Versions
! CHN Versions
! KOR Versions
! TWN Versions
! Status
|-
| 00020000
| 00021000
| 00022000
| 00026000
| 00027000
| 00028000
| [[System Settings]] (mset)
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[3.0.0-5|v2060]], [[4.0.0-7|v3074]], [[5.0.0-11|v4097]], [[6.0.0-11|v5127]], [[7.0.0-13|v6157]], [[7.2.0-17|v7173]], [[8.1.0-0_New3DS|v8198]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v9224]], [[9.6.0-24|v10245]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[3.0.0-5|v2061]], [[4.0.0-7|v3075]], [[5.0.0-11|v4097]], [[6.0.0-11|v5127]], [[7.0.0-13|v6157]], [[7.2.0-17|v7174]], [[9.0.0-20|v8202]], [[9.6.0-24|v9220]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[3.0.0-5|v2062]], [[4.0.0-7|v3078]], [[5.0.0-11|v4098]], [[6.0.0-11|v5128]], [[7.0.0-13|v6157]], [[7.2.0-17|v7174]], [[9.0.0-20|v8203]], [[9.6.0-24|v9221]]
| [[4.0.0-7|v8]], [[4.4.0-10|v1024]](CHN-only sysupdate for just mset), [[5.0.0-11|v2049]], [[7.0.0-13|v3075]]
| [[4.0.0-7|v1026]], [[5.0.0-11|v2049]], [[7.0.0-13|v4098]]
| [[4.1.0-8|v8]], [[4.2.0-9|v1024]], [[5.0.0-11|v2050]], [[7.0.0-13|v3074]]
| Active
|-
| 00020100
| 00021100
| 00022100
| 00026100
| 00027100
| 00028100
| [[Download Play]] (dlplay)
| [[1.0.0-0|v0]], [[2.1.0-4|v1026]], [[4.0.0-7|v2051]], [[9.0.0-20|v3072]](Also for [[8.1.0-0_New3DS]])
| [[1.0.0-0|v0]], [[2.1.0-4|v1026]], [[4.0.0-7|v2051]], [[9.0.0-20|v3073]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1026]], [[4.0.0-7|v2051]], [[9.0.0-20|v3073]]
| [[4.0.0-7|v4]]
| [[4.0.0-7|v1027]]
| [[4.1.0-8|v4]]
| Active
|-
| 00020200
| 00021200
| 00022200
| 00026200
| 00027200
| 00028200
| [[Activity Log]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[3.0.0-5|v2051]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[3.0.0-5|v2054]], [[7.0.0-13|v2064]]
| Same as EUR
| [[4.0.0-7|v3]]
| [[4.0.0-7|v2]], [[7.0.0-13|v16]]
| [[4.1.0-8|v2]]
| Active
|-
| 00020300
| 00021300
| 00022300
| 00026300
| 00027300
| 00028300
| [[Health and Safety Information]]
| [[1.0.0-0|v0]], [[4.0.0-7|v1024]], [[6.0.0-11|v2050]]
| [[1.0.0-0|v0]], [[3.0.0-5|v1024]], [[4.0.0-7|v2050]], [[6.0.0-11|v3077]]
| [[1.0.0-0|v0]], [[4.0.0-7|v1026]], [[6.1.0-12U|v2051]]
| [[4.0.0-7|v5]]
| [[4.0.0-7|v2]]
| [[4.1.0-8|v5]]
| Active
|-
| 20020300
| 20021300
| 20022300
| N/A
| N/A
| N/A
| [[New_3DS]] [[Health and Safety Information]]
| [[8.1.0-0_New3DS|v2]], [[9.3.0-21|v17]]
| [[8.1.0-0_New3DS|v1]]
| Same as EUR.
| N/A
| N/A
| N/A
| Active
|-
| 00020400
| 00021400
| 00022400
| 00026400
| 00027400
| 00028400
| [[Nintendo 3DS Camera]] (CtrApp)
| [[1.0.0-0|v0]], [[2.1.0-4|v16]], [[3.0.0-5|v1038]], [[4.0.0-7|v2048]], [[6.0.0-11|v3073]], [[9.0.0-20|v4097]](Also for [[8.1.0-0_New3DS]])
| [[1.0.0-0|v0]], [[2.1.0-4|v16]], [[3.0.0-5|v1039]], [[4.0.0-7|v2048]], [[6.0.0-11|v3073]], [[7.0.0-13|v3088]], [[9.0.0-20|v4097]]
| [[1.0.0-0|v0]], [[2.1.0-4|v16]], [[3.0.0-5|v1039]], [[4.0.0-7|v2048]], [[6.1.0-12U|v3074]], [[7.0.0-13|v3088]], [[9.0.0-20|v4097]]
| [[4.0.0-7|v3]]
| [[4.0.0-7|v2]], [[7.0.0-13|v1040]]
| [[4.1.0-8|v3]]
| Active
|-
| 00020500
| 00021500
| 00022500
| 00026500
| 00027500
| 00028500
| [[Nintendo 3DS Sound]] (CtrApp)
| [[1.0.0-0|v0]], [[2.1.0-4|v1027]], [[3.0.0-5|v2049]], [[4.0.0-7|v3072]], [[7.0.0-13|v3089]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1027]], [[3.0.0-5|v2049]], [[4.0.0-7|v3072]], [[7.0.0-13|v3088]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1027]], [[3.0.0-5|v2049]], [[4.0.0-7|v3072]], [[7.0.0-13|v3088]]
| [[4.0.0-7|v2]]
| [[4.0.0-7|v2]], [[7.0.0-13|v16]]
| [[4.1.0-8|v3]]
| Active
|-
| 00020700
| 00021700
| 00022700
| 00026700
| 00027700
| 00028700
| [[Mii Maker]] (EDIT)
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[7.0.0-13|v2055]]
| Same as JPN
| Same as JPN
| [[4.0.0-7|v1]]
| [[4.0.0-7|v1]], [[7.0.0-13|v16]]
| [[4.1.0-8|v2]]
| Active
|-
| 00020800
| 00021800
| 00022800
| 00026800
| 00027800
| 00028800
| [[StreetPass Mii Plaza]] (MEET)
| [[1.0.0-0|v0]], v1027, [[2.1.0-4|v2048]], [[3.0.0-5|v3087]], [[3.0.0-6|v4096]], [[6.0.0-11|v5121]]
| [[1.0.0-0|v0]], v1027, [[2.1.0-4|v2048]], [[3.0.0-5|v3087]], [[3.0.0-6|v4096]], [[6.0.0-11|v5122]]
| [[1.0.0-0|v0]], v1027, [[2.1.0-4|v2048]], [[3.0.0-5|v3087]], [[3.0.0-6|v4096]], [[6.1.0-12U|v5124]], [[7.0.0-13|v5136]]
| [[4.0.0-7|v0]], [[4.4.0-10|v4096]]
| [[4.0.0-7|v1]], [[4.4.0-10|v4096]], [[7.0.0-13|v5120]]
| [[4.1.0-8|v1]], [[4.4.0-10|v4096]]
| Active
|-
| 00020900
| 00021900
| 00022900
| N/A
| 00027900
| 00028900
| [[eShop]] (tiger)
| [[2.0.0-2|v4]], [[2.1.0-3|v1026]], [[3.0.0-5|v2057]], [[4.0.0-7|v3081]], [[4.1.0-8|v4096]], [[4.2.0-9|v5123]], [[4.3.0-10|v6146]], [[5.0.0-11|v7169]], [[7.0.0-13|v8206]], [[7.1.0-14|v9231]], [[7.2.0-17|v10245]], [[8.0.0-18|v11265]], [[8.1.0-19|v12288]], [[9.0.0-20|v13320]], [[9.3.0-21|v15366]], [[9.5.0-22|v16384]], [[9.6.0-24|v17421]], [[9.7.0-25|v18432]], [[10.0.0-27|v19465]]
| [[2.0.0-2|v4]], [[2.1.0-3|v1026]], [[3.0.0-5|v2058]], [[4.0.0-7|v3081]], [[4.1.0-8|v4096]], [[4.2.0-9|v5123]], [[4.3.0-10|v6146]], [[5.0.0-11|v7171]], [[7.0.0-13|v8206]], [[7.1.0-14|v9231]], [[7.2.0-17|v10245]], [[8.0.0-18|v11265]], [[8.1.0-19|v12288]], [[9.0.0-20|v13320]], [[9.3.0-21|v15366]], [[9.5.0-22|v16384]], [[9.6.0-24|v17421]], [[9.7.0-25|v18432]], [[10.0.0-27|v19465]]
| [[2.0.0-2|v4]], [[2.1.0-3|v1026]], [[3.0.0-5|v2058]], [[4.0.0-7|v3081]], [[4.1.0-8|v4096]], [[4.2.0-9|v5123]], [[4.3.0-10|v6146]], [[5.0.0-11|v7170]], [[7.0.0-13|v8206]], [[7.1.0-14|v9231]], [[7.2.0-17|v10246]], [[8.0.0-18|v11265]], [[8.1.0-19|v12288]], [[9.0.0-20|v13321]], [[9.3.0-21|v15366]], [[9.5.0-22|v16384]], [[9.6.0-24|v17422]], [[9.7.0-25|v18432]], [[10.0.0-27|v19465]]
| N/A
| [[4.0.0-7|v3082]], [[4.1.0-8|v4096]], [[4.2.0-9|v5123]], [[4.3.0-10|v6146]], [[5.0.0-11|v7169]], [[7.0.0-13|v8205]], [[7.1.0-14|v9231]], [[8.1.0-19|v12288]], [[9.0.0-20|v13320]], [[9.3.0-21|v15366]], [[9.5.0-22|v16384]], [[9.6.0-24|v17420]], [[9.7.0-25|v18432]], [[10.0.0-27|v19465]]
| [[4.1.0-8|v4096]], [[4.2.0-9|v5123]], [[4.3.0-10|v6146]], [[5.0.0-11|v7170]], [[7.0.0-13|v8205]], [[7.1.0-14|v9231]], [[8.1.0-19|v12288]], [[9.3.0-21|v15366]], [[9.5.0-22|v16384]], [[9.6.0-24|v17421]], [[9.7.0-25|v18432]], [[10.0.0-27|v19465]]
| Active
|-
| 00020A00
| 00021A00
| 00022A00
| N/A
| 00027A00
| 00028A00
| [[System Transfer]] (CARDBOARD)
| [[2.0.0-2|v4]], [[3.0.0-5|v1035]], [[4.0.0-7|v2050]], [[5.0.0-11|v3074]], [[7.0.0-13|v4109]], [[9.0.0-20|v5130]], [[9.6.0-24|v6154]]
| [[2.0.0-2|v4]], [[3.0.0-5|v1035]], [[4.0.0-7|v2050]], [[5.0.0-11|v3073]], [[7.0.0-13|v4109]], [[9.0.0-20|v5131]], [[9.6.0-24|v6155]]
| [[2.0.0-2|v4]], [[3.0.0-5|v1035]], [[4.0.0-7|v2051]], [[5.0.0-11|v3073]], [[7.0.0-13|v4109]], [[9.0.0-20|v5131]], [[9.6.0-24|v6156]]
| N/A
| [[4.0.0-7|v2]], [[5.0.0-11|v1025]], [[7.0.0-13|v2061]], [[9.0.0-20|v3082]]
| [[4.1.0-8|v2]], [[5.0.0-11|v1025]], [[7.0.0-13|v2061]]
| Active
|-
| 00020B00
| 00021B00
| 00022B00
| N/A
| N/A
| N/A
| [[Nintendo Zone]] ("Nintendo")
| [[1.0.0-0|v0]], [[3.0.0-5|v1034]]
| Same as JPN
| Same as JPN
| N/A
| N/A
| N/A
| Active
|-
| 00020D00
| 00021D00
| 00022D00
| 00026D00
| 00027D00
| 00028D00
| [[Face Raiders]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1028]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1028]], [[7.0.0-13|v1040]]
| Same as EUR
| [[4.0.0-7|v0]]
| [[4.0.0-7|v0]]
| [[4.1.0-8|v2]]
| Active
|-
| 20020D00
| 20021D00
| 20022D00
| N/A
| N/A
| N/A
| [[New_3DS]] [[Face Raiders]]
| [[8.1.0-0_New3DS|v2050]]
| [[8.1.0-0_New3DS|v2049]]
| Same as EUR.
| N/A
| N/A
| N/A
| Active
|-
| 00020E00
| 00021E00
| 00022E00
| 00026E00
| 00027E00
| 00028E00
| [[AR Games]] (AR_ACT)
| [[1.0.0-0|v0]], [[2.1.0-4|v1026]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1026]], [[7.0.0-13|v1040]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1027]], [[7.0.0-13|v1040]]
| [[4.0.0-7|v0]]
| [[4.0.0-7|v0]], [[7.0.0-13|v16]]
| [[4.1.0-8|v1]]
| Active
|-
| 00020F00
| 00021F00
| 00022F00
| 00026F00
| 00027F00
| 00028F00
| SAFE_MODE [[System Settings#System Updater|System Updater]] (mset)
| [[1.0.0-0|v0]], [[3.0.0-5|v1024]], [[6.0.0-11|v2049]]
| [[1.0.0-0|v0]], [[3.0.0-5|v1024]], [[6.0.0-11|v2050]]
| Same as JPN
| [[4.0.0-7|v1]], [[6.0.0-11|v1026]]
| [[4.0.0-7|v1]]
| [[4.1.0-8|v1]]
| Active
|-
| 00023000
| 00024000
| 00025000
| N/A
| N/A
| N/A
| Promotional video
| [[1.1.0-1|v2]], [[2.0.0-2|v2048]]
| [[1.1.0-1|v<unknown>]], [[2.0.0-2|v2048]]
| [[1.1.0-1|v0]], [[2.0.0-2|v2048]]
| N/A
| N/A
| N/A
| Stubbed
|-
| 0002BF00
| 0002C000
| 0002C100
| N/A
| N/A
| N/A
| Nintendo Network ID Settings (act)
| [[7.0.0-13|v14]], [[7.2.0-17|v1029]], [[9.0.0-20|v2051]], [[9.3.0-21|v3072]]
| Same as JPN
| Same as JPN
| N/A
| N/A
| N/A
| Active
|-
| 20023100
| 20024100
| 20025100
| N/A
| N/A
| N/A
| [[microSD Management]] ('mcopy') ([[New_3DS]]-only)
| [[8.1.0-0_New3DS|v8]], [[9.0.0-20|v1024]]
| [[8.1.0-0_New3DS|v4]]
| [[8.1.0-0_New3DS|v5]]
| N/A
| N/A
| N/A
| Available
|-
| 2002C800
| 2002CF00
| 2002D000
| N/A
| 2002D700
| N/A
| [[New_3DS]]-only, currently stubbed. Placeholder exheader name is "menu".
| [[8.1.0-0_New3DS|v2]], [[9.0.0-20|v18]], [[9.3.0-21|v34]], [[9.6.0-24|v50]]
| [[8.1.0-0_New3DS|v1]], [[9.3.0-21|v17]], [[9.6.0-24|v34]]
| [[8.1.0-0_New3DS|v1]], [[9.3.0-21|v18]], [[9.6.0-24|v33]]
| N/A
| [[9.6.0-24|v2]]
| N/A
| Stubbed
|-
| 2002C900
| 2002D100
| 2002D200
| N/A
| 2002D800
| N/A
| [[New_3DS]]-only, currently stubbed. Placeholder exheader name is "friend".
| [[8.1.0-0_New3DS|v1]]
| Same as JPN.
| [[8.1.0-0_New3DS|v0]], [[9.3.0-21|v16]]
| N/A
| [[9.6.0-24|v2]]
| N/A
| Stubbed
|-
| 2002CA00
| 2002D300
| 2002D400
| N/A
| 2002D900
| N/A
| [[New_3DS]]-only, currently stubbed. Placeholder exheader name is "newslist".
| [[8.1.0-0_New3DS|v0]], v1([[Home_Menu|JPN-only]] Oct 2, 2014 "sysupdate", actually uploaded on 09-29-14. Identical to v0, same TMDs besides title-versions)
| [[8.1.0-0_New3DS|v2]]
| [[8.1.0-0_New3DS|v0]]
| N/A
| [[9.6.0-24|v2]]
| N/A
| Stubbed
|-
| 2002CB00
| 2002D500
| 2002D600
| N/A
| 2002DA00
| N/A
| [[New_3DS]]-only, currently stubbed. Placeholder exheader name is "cherry".
| [[8.1.0-0_New3DS|v0]], [[9.0.0-20|v1]]
| [[8.1.0-0_New3DS|v2]]
| Same as EUR.
| N/A
| [[9.6.0-24|v1]]
| N/A
| Stubbed
|}

The "act" application seems to use a web browser with webkit?

Regardless of version, the ExeFS:/.code for mset is the same for USA/EUR/JPN. The [[4.0.0-7]] version of mset([[4.1.0-8]] for TWN) has the same ExeFS:/.code for all regions(JPN, USA, EUR, CHN, KOR, TWN). The [[5.0.0-11]] mset ExeFS:/.code is the same for all regions as well, except for CHN. The [[7.0.0-13]] mset ExeFS:/.code is unique for the following regions: CHN, KOR, and TWN.

=== 0004001B - [[NCCH#CFA|System Data Archives]] ===
{| class="wikitable" border="1"
|-
! TitleID Low
! Description
! Versions
|-
| 00010002
| [[ClCertA]]
| [[1.0.0-0|v0]]
|-
| 00010702
| [[NS CFA]]
| [[3.0.0-5|v0]], [[6.0.0-11|v1028]], [[6.3.0-12|v2048]], [[7.0.0-13|v3073]], [[9.0.0-20|v4096]](also for [[8.1.0-0_New3DS]])
|-
| 00010802
| This CFA only contains a 1-byte "dummy.txt" in the RomFS, which contains '0'.
| [[6.3.0-12|v0]], [[9.5.0-23|v1024]]
|-
| 00018002
| Same contents as 00010802. Starting with [[7.1.0-15]], the "dummy.txt" file was removed from RomFS: this CFA RomFS now contains web-browser data(similar to 00018102) for NNID / networking, etc.
| [[7.0.0-13|v14]], [[7.1.0-15|v1025]], [[7.2.0-17|v2055]], [[9.0.0-20|v3078]], [[9.3.0-21|v4096]], [[9.6.0-24|v5120]]
|-
| 00018102
| This contains local web-browser data(html/js, gfx, etc) for the Miiverse Offline-mode.
| [[7.0.0-13|v11]], [[9.0.0-20|v1025]](also for [[8.1.0-0_New3DS]])
|-
| 00018202
| This contains the webkit/OSS [[CRO0|CROs]] used with the Miiverse applet and the "act" application.
| [[7.0.0-13|v7]], [[8.1.0-0_New3DS|v1026]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v2050]]
|-
| 00019002
| [[Fangate_updater]]
| [[9.3.0-21|v2]], [[9.6.0-24|v1026]]
|}

=== 00040030 - Applets===
{| class="wikitable" border="1"
|-
! JPN TitleIDLow
! USA TitleIDLow
! EUR TitleIDLow
! Description
! JPN Versions
! USA Versions
! EUR Versions
|-
| 00008102
| 00008102
| 00008102
| [[NS#Alternate menu|Alternate menu]]
| N/A
|-
| 00008202
| 00008F02
| 00009802
| [[Home Menu|Home Menu]] (menu)
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[2.1.0-3|v2049]], [[2.2.0-X|v3075]], [[3.0.0-5|v4111]], [[4.0.0-7|v5131]], [[4.2.0-9|v6146]], [[5.0.0-11|v7172]], [[6.0.0-11|v8198]], [[7.0.0-13|v9230]], [[8.1.0-0_New3DS|v10250]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v13313]], [[9.1.0-20J|v14336]], [[9.2.0-20|v15360]], [[9.3.0-21|v16402]], [[9.4.0-21|v17408]], [[9.5.0-22|v18432]], [[9.6.0-24|v19476]], [[9.7.0-25|v20487]], [[9.8.0-25|v22528]], [[10.1.0-27|v23552]], [[10.2.0-28|v24576]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[2.1.0-3|v2049]], [[2.2.0-X|v3075]], [[3.0.0-5|v4111]], [[4.0.0-7|v5131]], [[4.2.0-9|v6146]], [[5.0.0-11|v7172]], [[6.0.0-11|v8198]], [[7.0.0-13|v9230]], [[8.1.0-0_New3DS|v10250]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v11272]], [[9.2.0-20|v12288]], [[9.3.0-21|v13330]], [[9.4.0-21|v14336]], [[9.5.0-22|v15360]], [[9.6.0-24|v16404]], [[9.7.0-25|v17415]], [[9.8.0-25|v19456]], [[9.9.0-26|v20480]], [[10.1.0-27|v21504]], [[10.2.0-28|v22528]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[2.1.0-3|v2049]], [[2.2.0-X|v3075]], [[3.0.0-5|v4111]], [[4.0.0-7|v5131]], [[4.2.0-9|v6146]], [[5.0.0-11|v7172]], [[6.0.0-11|v8198]], [[7.0.0-13|v9230]], [[8.1.0-0_New3DS|v10250]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v11272]], [[9.2.0-20|v12288]], [[9.3.0-21|v13330]], [[9.4.0-21|v14336]], [[9.5.0-22|v15360]], [[9.6.0-24|v16404]], [[9.7.0-25|v17415]], [[9.8.0-25|v19456]], [[10.1.0-27|v20480]], [[10.2.0-28|v21504]]
|-
| 00008402
| 00009002
| 00009902
| Camera applet used by Home-menu (CtrApp)
| v0, v1036, [[9.0.0-20|v2049]](Also for [[8.1.0-0_New3DS]])
| Same as JPN
| Same as JPN
|-
| 00008502
| 00009102
| 00009A02
| Not available on CDN
| ?
|
|
|-
| 00008602
| 00009202
| 00009B02
| Instruction Manual, applet for displaying instruction manuals
| v0, v1026, v2048, v3072, [[5.0.0-11|v4097]], [[9.0.0-20|v5120]](Also for [[8.1.0-0_New3DS]])
| Same as JPN
|-
| 00008702
| 00009302
| 00009C02
| Game Notes (Cherry)
| v0, v1026, v2049, [[5.0.0-11|v3073]], [[9.0.0-20|v4096]](Also for [[8.1.0-0_New3DS]])
| Same as JPN
| Same as JPN
|-
| 00008802
| 00009402
| 00009D02
| [[Internet Browser]] (spider)
| [[2.0.0-2|v6]], [[2.1.0-4|v1024]], [[4.0.0-7|v2050]], [[5.0.0-11|v3074 (EUR)/v3075(USA,JAP)]], [[7.0.0-13|v3088]], [[7.1.0-16|v4096]], [[9.5.0-23|v5121]], [[9.9.0-26|v6149]], [[10.2.0-28|v7168]]
| Same as JPN
| Same as JPN
|-
| 20008802
| 20009402
| 20009D02
| [[New_3DS]] [[Internet Browser]] (SKATER)
| [[8.1.0-0_New3DS|v10]], [[9.3.0-21|v1027]], [[9.6.0-24|v2051]], [[9.9.0-26|v3077]], [[10.2.0-28|v4096]]
| Same as JPN
| Same as JPN
|-
| 00008A02
| 00008A02
| 00008A02
| [[ErrDisp]]
| v0, v1025, [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[5.0.0-11|v5121]], [[8.0.0-18|v6144]], [[9.0.0-20|v7168]](Also for [[8.1.0-0_New3DS]])
| Same as JPN
| Same as JPN
|-
| 00008A03
| 00008A03
| 00008A03
| SAFE_MODE [[ErrDisp]]
| v0
| Same as JPN
| Same as JPN
|-
| 20008A03
| 20008A03
| 20008A03
| [[New_3DS]] SAFE_MODE [[ErrDisp]]
| [[8.1.0-0_New3DS|v7169]]
| Same as JPN
| Same as JPN
|-
| 00008D02
| 00009602
| 00009F02
| Friend List (friend)
| v0, v1026, [[2.2.0-X|v2051]], v3082, v4099, [[7.0.0-13|v5120]], [[9.0.0-20|v6144]](Also for [[8.1.0-0_New3DS]]) (EUR v6, v1024, v3082, v4099, [[7.0.0-13|v5120]], [[9.0.0-20|v6144]])
| Same as JPN
| Same as JPN
|-
| 00008E02
| 00009702
| 0000A002
| Notifications (newslist)
| v0, v1029, v2054, v3075, [[9.0.0-20|v4097]] (EUR v6, v1024, v2054, v3075, [[9.0.0-20|v4097]]) (JPN: ..., [[8.1.0-0_New3DS|v4096]], [[9.0.0-20|v5121]])
| Same as JPN
| Same as JPN
|-
| 0000C002
| 0000C802
| 0000D002
| Software Keyboard (swkbd)
| v0, v1026, v2053, [[7.0.0-13|v3072]], [[9.0.0-20|v4096]](Also for [[8.1.0-0_New3DS]])
| Same as JPN
| Same as JPN
|-
| 0000C003
| 0000C803
| 0000D003
| SAFE_MODE Software Keyboard (swkbd)
| v0
| Same as JPN
| Same as JPN
|-
| 2000C003
| 2000C803
| 2000D003
| [[New_3DS]] SAFE_MODE Software Keyboard (swkbd)
| [[8.1.0-0_New3DS|v0]](for JPN this is v1024)
| Same as JPN
| Same as JPN
|-
| 0000C102
| 0000C902
| 0000D102
| appletEd
| v0, v1026, [[9.0.0-20|v2048]](Also for [[8.1.0-0_New3DS]]), [[9.3.0-21|v3077]]
| Same as JPN
| Same as JPN
|-
| 0000C302
| 0000CB02
| 0000D302
| PNOTE_AP (Photo file selector applet, for SD-card/etc?)
| v0, v1024, [[8.1.0-0_New3DS|v2049]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v3075]], [[9.3.0-21|v4096]]
| Same as JPN
| Same as JPN
|-
| 0000C402
| 0000CC02
| 0000D402
| SNOTE_AP (Sound file selector applet, for SD-card/etc?)
| v0, v3, [[8.0.0-18|v1026]], [[9.0.0-20|v2048]](Also for [[8.1.0-0_New3DS]])
| Same as JPN
| Same as JPN
|-
| 0000C502
| 0000C502
| 0000C502
| error (This applet displays networking errors, etc)
| v0, v1026, v2053, v3074, [[8.1.0-0_New3DS|v4096]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v5128]], [[9.6.0-24|v6145]]
| Same as JPN
| Same as JPN
|-
| 0000C503
| 0000C503
| 0000C503
| SAFE_MODE error applet
| v0
| Same as JPN
| Same as JPN
|-
| 2000C503
| 2000C503
| 2000C503
| [[New_3DS]] SAFE_MODE error applet
| [[8.1.0-0_New3DS|v1024]]
| Same as JPN
| Same as JPN
|-
| 0000CD02
| 0000CD02
| 0000CD02
| extrapad ([[Circle Pad Pro]] calibration applet)
| v1, v1026, [[8.1.0-0_New3DS|v2048]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v3073]]
| Same as JPN
| Same as JPN
|-
| 0000C602
| 0000CE02
| 0000D602
| mint. eShop applet, used by applications for accessing the eShop, for DLC/etc. Also used by the eShop application itself.
| v5, v1028, [[4.2.0-9|v2050]], [[5.0.0-11|v3072]], [[7.0.0-13|v4109]], [[7.2.0-17|v5125]](v5123 for JPN), [[8.0.0-18|v6145]], [[8.1.0-0_New3DS|v7168]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v8200]], [[9.3.0-21|v9224]], [[9.6.0-24|v10247]], [[9.8.0-25|v11264]], [[10.0.0-27|v12293]], [[10.1.0-27|v13312]]
| Same as JPN
| Same as JPN
|-
| 0000BC02
| 0000BD02
| 0000BE02
| olv (Miiverse applet)
| [[7.0.0-13|v14]], [[7.2.0-17|v1024]], [[9.0.0-20|v2048]](Also for [[8.1.0-0_New3DS]]), [[9.3.0-21|v3072]], [[9.6.0-24|v4096]]
| Same as JPN
| Same as JPN
|-
| 0000F602
| 0000F602
| 0000F602
| memolib (Uses Miiverse, likely the "system library" for Miiverse)
| [[7.0.0-13|v5]], [[8.1.0-0_New3DS|v1024]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v2050]], [[9.3.0-21|v3072]]
| Same as JPN
| Same as JPN
|-
| 00008302
| 00008B02
| 0000BA02
| solv3 (Miiverse-posting applet)
| [[9.0.0-20|v6]]
| Same as JPN
| Same as JPN
|-
| 00009502
| 00009E02
| 0000B902
| Cabinet ([[amiibo Settings]])
| [[9.3.0-21|v7]], [[9.6.0-24|v1031]]
| Same as JPN
| Same as JPN
|}

Most of these processes are applets, see [[NS_and_APT_Services|here]] for details.

All of the above processes use the "SYSTEM" [[SVC|memory-region]].

The ExeFS for Home Menu is exactly the same for USA/EUR/JPN.

The Miiverse applet seems to use a web browser with webkit.

=== 0004009B - [[NCCH#CFA|System Data Archives]] (Shared Archives) ===
{| class="wikitable" border="1"
|-
! JPN TitleIDLow
! USA TitleIDLow
! EUR TitleIDLow
! Description
! Versions
|-
| 00010202
| 00010202
| 00010202
| Probably Mii-related, contains "CFL_Res.dat" in the RomFS.
| v0
|-
| 00010302
| 00010302
| 00010302
| Doesn't exist on CDN?
| v0, v2052
|-
| 00010402
| 00010402
| 00010402
| Mounted as "area:", contains Country and Region names
| v0, v1024, v2050, v3072, [[7.0.0-13|v4098]], [[9.6.0-24|v5122]]
|-
| 00010502
| 00010502
| 00010502
| Doesn't exist on CDN?
| v0, v1024, v2048
|-
| 00010602
| 00010602
| 00010602
| Non-Nintendo TLS Root-CA Certificates (RomFS contains files with filename "CACERT_PUBLIC_CA_<val>.der", where <val> is 5..8)
| v2
|-
| 00011902
| ?
| ?
| ?
| v0
|-
| ?
| 00011402
| ?
| ?
| v0
|-
| ?
| 00011602
| ?
| ?
| v0
|-
| ?
| 00011D02
| ?
| ?
| v0
|-
| ?
| 00011E02
| ?
| ?
| v0
|-
| ?
| ?
| 00011202
| ?
| v0
|-
| ?
| ?
| 00011302
| ?
| v0
|-
| ?
| ?
| 00011502
| ?
| v0
|-
| ?
| ?
| 00011702
| ?
| v0
|-
| ?
| ?
| 00011802
| ?
| v0
|-
| 00011902
| ?
| ?
| ?
| v0
|-
| ?
| ?
| 00011B02
| ?
| v0
|-
| ?
| ?
| 00011C02
| ?
| v0
|-
| ?
| ?
| 00011D02
| ?
| v0
|-
| ?
| ?
| 00012102
| ?
| v0, v1026, v2051, v3074
|-
| 00012202
| 00012302
| 00012102
| ?contains a lists with error strings
| v1026, v2053, v3073, [[4.2.0-9|v4096]], [[5.0.0-11|v5120]], [[7.0.0-13|v6149]], [[7.2.0-17|v7168]], [[8.0.0-18|v8192]], [[9.0.0-20|v9218]], [[9.3.0-21|v10242]], [[9.6.0-24|v11269]], [[10.0.0-27|v12289]]
|-
| 00013202
| 00013302
| 00013102
| Mounted as "eula:"
| v0, v1024, v2049 USA: v1024, v2051, [[7.0.0-13|v3074]], [[7.2.0-17|v4100]](EUR-only), [[9.0.0-20|v4099]], [[9.9.0-26|v6144]]
|-
| 00014002
| 00014002
| 00014002
| JPN/EUR/USA [[System Font]] ("font:")
| v0
|-
| 00014102
| 00014102
| 00014102
| CHN [[System Font]] ("font:")
| v0, v1024
|-
| 00014202
| 00014202
| 00014202
| KOR [[System Font]] ("font:")
| v0, v1024
|-
| 00014302
| 00014302
| 00014302
| TWN [[System Font]] ("font:")
| v0, v1024
|-
| 00015202
| 00015302
| 00015102
| Mounted as "rate:"
| v0 (EUR: v0, v1024)
|-
| ?
| 00016302
| ?
| ?
| v80
|-
| ?
| 00017302
| ?
| ?
| v3088
|}

=== 000400DB - [[NCCH#CFA|System Data Archives]] ===
These [[NVer]] titleIDs can be found @ offset 0x320 in every [[CCI]].

{| class="wikitable" border="1"
|-
! EUR TitleIDLow
! JPN TitleIDLow
! USA TitleIDLow
! CHN TitleIDLow
! KOR TitleIDLow
! TWN TitleIDLow
! Description
! USA/EUR/JPN Versions
! CHN Versions
! TWN Versions
! KOR Versions
|-
| 00010302
| 00010302
| 00010302
| 00010302
| 00010302
| 00010302
| NGWord bad word list
| [[1.0.0-0|v0]], [[2.0.0-2|v1024]], [[3.0.0-5|v2052]], [[4.0.0-7|v3072]], [[4.3.0-10|v4096]], [[5.0.0-11|v5120]], [[9.0.0-20|v6144]], [[9.3.0-21|v7168]], [[9.6.0-24|v8192]]
| Same as USA
| Same as USA
| Same as USA
|-
| 00010502
| 00010502
| 00010502
| 00010502
| 00010502
| 00010502
| [[Nintendo Zone]] hotspot list
| [[1.0.0-0|v0]], [[2.0.0-2|v1024]], [[3.0.0-5|v2048]], [[4.0.0-7|v3073]], [[4.3.0-10|v4096]], [[4.4.0-10|v5120]], [[4.5.0-10|v6144]], [[5.0.0-11|v7169]], [[6.0.0-11|v8192]], [[6.2.0-12|v9216]], [[7.0.0-13|v10242]], [[7.2.0-17|v11267]], [[8.0.0-18|v12288]], [[9.0.0-20|v14336]], [[9.3.0-21|v15360]], [[9.6.0-24|v16386]], [[10.0.0-27|v17409]]
| Same as USA
| Same as USA
| Same as USA
|-
| 00016102
| 00016202
| 00016302
| 00016402
| 00016502
| 00016602
| [[NVer]]
| [[1.0.0-0|v0]], [[1.1.0-1|v16]], [[2.0.0-2|v32]], [[2.1.0-3|v48]], [[2.1.0-4|v64]], [[3.0.0-5|v80]], [[3.0.0-6|v96]], [[4.0.0-7|v112]], [[4.1.0-8|v128]], [[4.2.0-9|v144]], [[4.3.0-10|v160]], [[5.0.0-11|v176]], non-USA=[[6.0.0-11|v192]]/USA=[[6.1.0-12U|v192]], [[7.0.0-13|v208]], [[7.1.0-14|v224]], [[7.1.0-15|v240]], [[7.1.0-16|v256]], [[7.2.0-17|v272]], [[8.0.0-18|v288]], [[8.1.0-19|v304]], [[9.0.0-20|v320]], [[9.3.0-21|v336]], [[9.5.0-22|v352]], [[9.5.0-23|v368]], [[9.6.0-24|v384]], [[9.7.0-25|v400]], [[9.9.0-26|v416]], [[10.0.0-27|v432]], [[10.2.0-28|v448]]
| [[4.0.0-7|v113]], [[4.2.0-9|v128]], [[5.0.0-11|v129]], [[7.1.0-16|v130]], [[7.2.0-17|v272]], [[9.5.0-23|v131]], [[9.9.0-26|v132]]
| [[4.1.0-8|v114]], [[4.2.0-9|v133]], [[4.3.0-10|v134]], [[5.0.0-11|v136]], [[7.0.0-13|v144]], [[7.1.0-14|v160]] [[7.1.0-16|v192]], [[7.2.0-17|v272]], [[8.0.0-18|v208]], [[8.1.0-19|v224]], [[9.0.0-20|v240]], [[9.5.0-22|v272]], [[9.5.0-23|v288]], [[9.6.0-24|v304]], [[9.7.0-25|v320]], [[9.9.0-26|v336]], [[10.0.0-27|v352]], [[10.2.0-28|v368]]
| [[4.0.0-7|v113]], [[4.1.0-8|v114]], [[4.2.0-9|v133]], [[4.3.0-10|v134]], [[5.0.0-11|v136]], [[7.0.0-13|v160]], [[7.1.0-14|v176]], [[7.1.0-16|v176]], [[7.2.0-17|v272]], [[8.0.0-18|v224]], [[8.1.0-19|v240]], [[9.0.0-20|v256]], [[9.3.0-21|v272]], [[9.5.0-22|v288]], [[9.5.0-23|v304]], [[9.6.0-24|v320]], [[9.7.0-25|v336]], [[9.9.0-26|v352]], [[10.0.0-27|v368]], [[10.2.0-28|v384]]
|-
| 20016102
| 20016202
| 20016302
| N/A
| 20016502
| N/A
| [[New_3DS]] [[NVer]]
| [[8.1.0-0_New3DS|v0]], [[9.0.0-20|v320]], [[9.3.0-21|v336]], [[9.5.0-22|v352]], [[9.5.0-22|v352]], [[9.5.0-23|v368]], [[9.6.0-24|v384]], [[9.7.0-25|v400]], [[9.9.0-26|v416]], [[10.0.0-27|v432]], [[10.2.0-28|v448]]
| N/A
| N/A
| [[9.6.0-24|v320]], [[9.7.0-25|v336]], [[9.9.0-26|v352]], [[10.0.0-27|v368]], [[10.2.0-28|v384]]
|-
| 00017102
| 00017202
| 00017302
| 00017402
| 00017502
| 00017602
| [[CVer]]
| [[1.0.0-0|v1024]], [[1.1.0-1|v1045]], [[2.0.0-2|v2049]], [[2.1.0-3|v2069]], [[2.2.0-X|v2088]] [[3.0.0-5|v3088]], [[4.0.0-7|v4098]], [[4.1.0-8|v4113]], [[4.2.0-9|v4130]], [[4.3.0-10|v4145]], [[4.4.0-10|v4163]], [[4.5.0-10|v4176]], [[5.0.0-11|v5120]], [[5.1.0-11|v5136]], [[6.0.0-11|v6146]], [[6.1.0-11|v6160]], [[6.2.0-12|v6178]], [[6.3.0-12|v6192]], [[7.0.0-13|v7175]], [[7.1.0-14|v7187]], [[7.2.0-17|v7203]], [[8.0.0-18|v8196]], [[8.1.0-18|v8208]], [[8.1.0-0_New3DS|v8215]](8.1.0-0_New3DS), [[9.0.0-20|v9218]], [[9.1.0-20J|v9232]](JPN-only), [[9.2.0-20|v9248]], [[9.3.0-21|v9264]], [[9.4.0-21|v9280]], [[9.5.0-22|v9296]], [[9.6.0-24|v9319]], [[9.7.0-25|v9328]], [[9.8.0-25|v9344]], [[9.9.0-26|v9360]], [[10.0.0-27|v10240]], [[10.1.0-27|v10256]], [[10.2.0-28|v10272]]
| [[1.0.0-0|v1024]], [[1.1.0-1|v1045]], [[2.0.0-2|v2049]], [[2.1.0-3|v2069]], [[2.2.0-X|v2088]] [[3.0.0-5|v3088]], [[4.0.0-7|v4098]], [[4.1.0-8|v4113]], [[4.2.0-9|v4130]], [[4.3.0-10|v4145]], [[4.4.0-10|v4163]], [[4.5.0-10|v4176]], [[5.0.0-11|v5120]], [[5.1.0-11|v5136]], [[6.0.0-11|v6146]], [[6.1.0-11|v6160]], [[6.2.0-12|v6178]], [[6.3.0-12|v6192]], [[7.0.0-13|v7175]], [[7.1.0-14|v7187]], [[7.2.0-17|v7203]], [[8.0.0-18|v8196]], [[8.1.0-18|v8208]], [[9.0.0-20|v9217]], [[9.3.0-21|v9264]], [[9.5.0-22|v9296]], [[9.6.0-24|v9319]], [[9.7.0-25|v9328]], [[9.8.0-25|v9344]], [[9.9.0-26|v9360]], [[10.0.0-27|v10240]], [[10.2.0-28|v10272]]
| Same as CHN
| Same as CHN
|}

=== 00040130 - System [[Services API|Modules]] ===
{| class="wikitable" border="1"
|-
! TitleID Low
! Description
! Versions
|-
| 00001002
| [[Services|sm]] (Stored in [[FIRM|NATIVE_FIRM]])
| v2
|-
| 00001003
| SAFE_MODE [[Services|sm]] (Stored in SAFE_MODE NATIVE_FIRM)
| v2
|-
| 00001102
| [[Filesystem services‎|fs]] (Stored in [[FIRM|NATIVE_FIRM]])
| v2
|-
| 00001103
| SAFE_MODE [[Filesystem services‎|fs]] (Stored in SAFE_MODE NATIVE_FIRM)
| v2
|-
| 00001202
| [[Process Manager Services|pm]] (Stored in [[FIRM|NATIVE_FIRM]])
| v2
|-
| 00001203
| SAFE_MODE [[Process Manager Services|pm]] (Stored in SAFE_MODE NATIVE_FIRM)
| v2
|-
| 00001302
| [[Loader Services‎|loader]] (Stored in [[FIRM|NATIVE_FIRM]])
| v2
|-
| 00001303
| SAFE_MODE [[Loader Services‎|loader]] (Stored in SAFE_MODE NATIVE_FIRM)
| v2
|-
| 00001402
| [[PXI Services‎|pxi]] (Stored in [[FIRM|NATIVE_FIRM]])
| v2
|-
| 00001403
| SAFE_MODE [[PXI Services‎|pxi]] (Stored in SAFE_MODE NATIVE_FIRM)
| v2
|-
| 00001502
| [[Application Manager Services|AM]] ( Application Manager )
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[3.0.0-5|v2053]], [[4.0.0-7|v3072]], [[5.0.0-11|v4098]], [[6.0.0-11|v5120]], [[8.0.0-18|v6148]], [[8.1.0-0_New3DS|v7168]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v8192]], [[10.0.0-27|v9217]]
|-
| 00001503
| SAFE_MODE [[Application Manager Services|AM]]
| [[1.0.0-0|v0]]
|-
| 20001503
| [[New_3DS]] SAFE_MODE [[Application Manager Services|AM]]
| [[8.1.0-0_New3DS|v7169]]
|-
| 00001602
| [[Camera Services|Camera]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[3.0.0-5|v2048]], [[4.0.0-7|v3074]], [[5.0.0-11|v4098]], [[6.0.0-11|v5120]], [[7.1.0-14|v6146]], [[8.0.0-18|v7172]], [[9.0.0-20|v9216]], [[9.3.0-21|v10242]], [[10.0.0-27|v11265]]
|-
| 20001602
| [[New_3DS]] [[Camera Services|Camera]]
| [[8.1.0-0_New3DS|v8200]], [[9.0.0-20|v9218]], [[9.3.0-21|v10242]], [[10.0.0-27|v11265]]
|-
| 00001702
| [[Config Services|Config]] (cfg)
| [[1.0.0-0|v0]], [[2.0.0-2|v1024]], [[3.0.0-5|v2049]], v3072, [[4.0.0-7|v4096]], [[5.0.0-11|v5122]], [[6.0.0-11|v6145]], [[6.1.0-11|v7168]], [[7.0.0-13|v8196]], [[7.2.0-17|v9220]], [[8.0.0-18|v10243]], [[8.1.0-0_New3DS|v11265]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v12290]], [[9.3.0-21|v13315]], [[9.6.0-24|v14342]]
|-
| 00001703
| SAFE_MODE [[Config Services|Config]] (cfg)
| [[1.0.0-0|v0]]
|-
| 20001703
| [[New_3DS]] SAFE_MODE [[Config Services|Config]] (cfg)
| [[8.1.0-0_New3DS|v11265]]
|-
| 00001802
| [[Codec Services|Codec]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[5.0.0-11|v4098]], [[7.0.0-13|v5120]], [[8.0.0-18|v6144]], [[9.0.0-20|v7168]](Also for [[8.1.0-0_New3DS]])
|-
| 00001803
| SAFE_MODE [[Codec Services|Codec]]
| [[1.0.0-0|v0]]
|-
| 20001803
| [[New_3DS]] SAFE_MODE [[Codec Services|Codec]]
| [[8.1.0-0_New3DS|v7169]]
|-
| 00001902
| dmnt, debugger sysmodule. This use devunit-only HIO for devunit<>pc comms. This only exists for development units(launched by NS during startup depending on certain [[Configuration_Memory]] fields' values). This is installed at the [[Factory_Setup|factory]], then later deleted at the factory on retail units.
|
|-
| 00001A02
| [[DSP Services|DSP]]
| [[1.0.0-0|v0]], [[3.0.0-5|v1024]], [[4.0.0-7|v2048]], [[5.0.0-11|v3074]], [[6.0.0-11|v4096]], [[8.0.0-18|v5120]], [[9.7.0-25|v6145]]
|-
| 00001A03
| SAFE_MODE [[DSP Services|DSP]]
| [[1.0.0-0|v0]]
|-
| 20001A03
| [[New_3DS]] SAFE_MODE [[DSP Services|DSP]]
| [[8.1.0-0_New3DS|v6145]]
|-
| 00001B02
| [[GPIO Services|GPIO]]
| [[1.0.0-0|v0]], [[5.0.0-11|v1025]], [[8.0.0-18|v2048]], [[9.5.0-22|v3073]]
|-
| 00001B03
| SAFE_MODE [[GPIO Services|GPIO]]
| [[1.0.0-0|v0]]
|-
| 20001B03
| [[New_3DS]] SAFE_MODE [[GPIO Services|GPIO]]
| [[8.1.0-0_New3DS|v3073]]
|-
| 00001C02
| [[GSP Services|GSP]]
| [[1.0.0-0|v0]], [[1.1.0-1|v1040]], [[2.0.0-2|v2049]], [[3.0.0-5|v3075]], v4098, [[4.0.0-7|v5120]], [[5.0.0-11|v6145]], [[6.0.0-11|v7168]], [[8.0.0-18|v8196]], [[9.0.0-20|v10240]], [[9.3.0-21|v11264]], [[9.6.0-24|v12294]]
|-
| 20001C02
| [[New_3DS]] [[GSP Services|GSP]]
| [[8.1.0-0_New3DS|v10243]], [[9.3.0-21|v11267]], [[9.6.0-24|v12294]]
|-
| 00001C03
| SAFE_MODE [[GSP Services|GSP]]
| [[1.0.0-0|v0]]
|-
| 20001C03
| [[New_3DS]] SAFE_MODE [[GSP Services|GSP]]
| [[8.1.0-0_New3DS|v9217]]
|-
| 00001D02
| [[HID Services|HID]] (Human Interface Devices)
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[5.0.0-11|v5121]], [[7.2.0-17|v6148]], [[8.0.0-18|v7168]], [[8.1.0-0_New3DS|v8192]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v9216]], [[9.3.0-21|v10240]]
|-
| 00001D03
| SAFE_MODE [[HID Services|HID]]
| [[1.0.0-0|v0]]
|-
| 20001D03
| [[New_3DS]] SAFE_MODE [[HID Services|HID]]
| [[8.1.0-0_New3DS|v8193]]
|-
| 00001E02
| [[I2C Services|i2c]]
| [[1.0.0-0|v0]], [[3.0.0-5|v1024]], [[5.0.0-11|v2049]], [[8.0.0-18|v3076]], [[9.3.0-21|v5120]]
|-
| 20001E02
| [[New_3DS]] [[I2C Services|i2c]]
| [[8.1.0-0_New3DS|v4096]], [[9.3.0-21|v5121]]
|-
| 00001E03
| SAFE_MODE [[I2C Services|i2c]]
| [[1.0.0-0|v0]]
|-
| 20001E03
| [[New_3DS]] SAFE_MODE [[I2C Services|i2c]]
| [[8.1.0-0_New3DS|v4097]]
|-
| 00001F02
| [[MCU Services|MCU]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.1.0-3|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4102]], [[5.0.0-11|v5122]], [[6.0.0-11|v6145]], [[7.0.0-13|v7168]], [[8.0.0-18|v8192]]
|-
| 20001F02
| [[New_3DS]] [[MCU Services|MCU]]
| [[8.1.0-0_New3DS|v8192]]
|-
| 00001F03
| SAFE_MODE [[MCU Services|MCU]]
| [[1.0.0-0|v0]]
|-
| 20001F03
| [[New_3DS]] SAFE_MODE [[MCU Services|MCU]]
| [[8.1.0-0_New3DS|v9217]]
|-
| 00002002
| [[MIC Services|MIC]] (Microphone)
| [[1.0.0-0|v0]], [[5.0.0-11|v1025]], [[8.0.0-18|v2048]]
|-
| 00002102
| [[PDN Services|PDN]]
| [[1.0.0-0|v0]], [[5.0.0-11|v1025]], [[8.0.0-18|v2048]]
|-
| 00002103
| SAFE_MODE [[PDN Services|PDN]]
| [[1.0.0-0|v0]]
|-
| 20002103
| [[New_3DS]] SAFE_MODE [[PDN Services|PDN]]
| [[8.1.0-0_New3DS|v3073]]
|-
| 00002202
| [[PTM Services|PTM]] (Play time, pedometer, and battery manager)
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.2.0-X|v2048]], [[3.0.0-5|v3075]], v4096, [[4.0.0-7|v5120]], [[5.0.0-11|v6146]], [[6.0.0-11|v7168]], [[7.0.0-13|v8192]], [[8.0.0-18|v9219]], [[9.6.0-24|v11264]]
|-
| 20002202
| [[New_3DS]] [[PTM Services|PTM]] (Play time, pedometer, and battery manager)
| [[8.1.0-0_New3DS|v10240]], [[9.6.0-24|v11264]]
|-
| 00002203
| SAFE_MODE [[PTM Services|PTM]]
| [[1.0.0-0|v0]]
|-
| 20002203
| [[New_3DS]] SAFE_MODE [[PTM Services|PTM]]
| [[8.1.0-0_New3DS|v10241]]
|-
| 00002302
| [[SPI Services|spi]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[5.0.0-11|v2049]], [[8.0.0-18|v3072]]
|-
| 20002302
| [[New_3DS]] [[SPI Services|spi]]
| [[8.1.0-0_New3DS|v4096]]
|-
| 00002303
| SAFE_MODE [[SPI Services|spi]]
| [[1.0.0-0|v0]]
|-
| 20002303
| [[New_3DS]] SAFE_MODE [[SPI Services|spi]]
| [[8.1.0-0_New3DS|v4097]]
|-
| 00002402
| [[AC Services|AC]] (Network manager)
| [[1.0.0-0|v0]], [[1.1.0-1|v1024]], [[2.0.0-2|v2052]], [[2.1.0-3|v3072]], [[3.0.0-5|v4101]], [[5.0.0-11|v5122]], [[7.0.0-13|v6145]], [[8.0.0-18|v7172]], [[9.0.0-20|v8192]](Also for [[8.1.0-0_New3DS]]), [[9.3.0-21|v9216]]
|-
| 00002403
| SAFE_MODE [[AC Services|AC]]
| [[1.0.0-0|v0]]
|-
| 20002403
| [[New_3DS]] SAFE_MODE [[AC Services|AC]]
| [[8.1.0-0_New3DS|v8193]]
|-
| 00002602
| [[CECD Services|Cecd]] (StreetPass)
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.2.0-X|v2048]], [[3.0.0-5|v3073]], [[4.0.0-7|v4097]], [[5.0.0-11|v5122]], [[6.0.0-11|v6144]], [[6.2.0-12|v7170]], [[7.0.0-13|v8193]], [[8.0.0-18|v9216]], [[9.0.0-20|v10240]]
|-
| 00002702
| [[CSND Services|CSND]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[4.0.0-7|v2048]], [[5.0.0-11|v3073]], [[8.0.0-18|v4096]], [[9.0.0-20|v5120]]
|-
| 00002703
| SAFE_MODE [[CSND Services|CSND]]
| [[1.0.0-0|v0]]
|-
| 20002703
| [[New_3DS]] SAFE_MODE [[CSND Services|CSND]]
| [[8.1.0-0_New3DS|v5121]]
|-
| 00002802
| [[DLP Services|DLP]] ([[Download Play]])
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.2.0-X|v2048]], [[3.0.0-5|v3078]], [[5.0.0-11|v4099]], [[8.0.0-18|v5123]], [[9.0.0-20|v6145]](Also for [[8.1.0-0_New3DS]]), [[9.6.0-24|v7174]], [[10.0.0-27|v8192]]
|-
| 00002902
| [[HTTP Services|HTTP]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.1.0-3|v2049]], [[2.2.0-X|v3072]], [[3.0.0-5|v4099]], [[4.0.0-7|v5122]], [[5.0.0-11|v6145]], [[7.0.0-13|v7171]], [[7.1.0-14|v8192]], [[8.0.0-18|v9220]], [[8.1.0-18|v10245]], [[8.1.0-0_New3DS|v11264]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v12288]], [[9.6.0-24|v13318]]
|-
| 00002903
| SAFE_MODE [[HTTP Services|HTTP]]
| [[1.0.0-0|v0]]
|-
| 20002903
| [[New_3DS]] SAFE_MODE [[HTTP Services|HTTP]]
| [[8.1.0-0_New3DS|v10241]]
|-
| 00002A02
| [[MP Services|MP]]
| [[1.0.0-0|v0]], [[5.0.0-11|v1025]], [[8.0.0-18|v2048]]
|-
| 00002A03
| SAFE_MODE [[MP Services|MP]]
| [[1.0.0-0|v0]]
|-
| 00002B02
| [[NDM Services|NDM]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[3.0.0-5|v2049]], [[4.0.0-7|v3072]], [[5.0.0-11|v4098]], [[8.0.0-18|v5124]], [[8.1.0-0_New3DS|v6144]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v7169]]
|-
| 00002C02
| [[NIM Services|NIM]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1028]], [[3.0.0-5|v2055]], [[4.0.0-7|v3074]], [[5.0.0-11|v4100]], [[6.0.0-11|v5120]], [[7.0.0-13|v6148]], [[7.2.0-17|v7174]], [[8.0.0-18|v8195]], [[8.1.0-0_New3DS|v9217]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v10249]], [[9.3.0-21|v11267]], [[9.6.0-24|v12296]], [[10.0.0-27|v13313]]
|-
| 00002C03
| SAFE_MODE [[NIM Services|NIM]]
| [[1.0.0-0|v0]]
|-
| 20002C03
| [[New_3DS]] SAFE_MODE [[NIM Services|NIM]]
| [[8.1.0-0_New3DS|v9217]]
|-
| 00002D02
| [[NWM Services|NWM]] ( Low-level wifi manager )
| [[1.0.0-0|v0]], [[1.1.0-1|v1024]], [[2.0.0-2|v2052]], [[2.2.0-X|v3072]], [[3.0.0-5|v4101]], [[4.0.0-7|v5120]], [[5.0.0-11|v6148]], [[6.0.0-11|v7169]], [[7.2.0-17|v8196]], [[8.0.0-18|v9216]], [[9.0.0-20|v10240]]
|-
| 00002D03
| SAFE_MODE [[NWM Services|NWM]]
| [[1.0.0-0|v0]], [[6.0.0-11|v5120]]
|-
| 20002D03
| [[New_3DS]] SAFE_MODE [[NWM Services|NWM]]
| [[8.1.0-0_New3DS|v10241]]
|-
| 00002E02
| [[Socket Services|Sockets]]
| [[1.0.0-0|v0]], [[1.1.0-1|v1024]], [[2.0.0-2|v2053]], [[3.0.0-5|v3075]], [[4.0.0-7|v4096]], [[5.0.0-11|v5121]], [[8.0.0-18|v6144]], [[9.0.0-20|v7168]]
|-
| 00002E03
| SAFE_MODE [[Socket Services|Sockets]]
| [[1.0.0-0|v0]]
|-
| 20002E03
| [[New_3DS]] SAFE_MODE [[Socket Services|Sockets]]
| [[8.1.0-0_New3DS|v7169]]
|-
| 00002F02
| [[SSL Services|SSL]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1024]], [[2.1.0-3|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[5.0.0-11|v5122]], [[8.0.0-18|v6144]], [[9.0.0-20|v7168]], [[9.6.0-24|v8198]]
|-
| 00002F03
| SAFE_MODE [[SSL Services|SSL]]
| [[1.0.0-0|v0]]
|-
| 20002F03
| [[New_3DS]] SAFE_MODE [[SSL Services|SSL]]
| [[8.1.0-0_New3DS|v7169]]
|-
| 00003000
| [[FIRM|Process9]] (in SAFE_MODE and normal NATIVE_FIRM)
| v2
|-
| 00003102
| [[Process Services‎|PS]] ( Process Manager )
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[5.0.0-11|v2049]], [[6.0.0-11|v3072]], [[8.0.0-18|v4096]], [[9.0.0-20|v5120]]
|-
| 00003103
| SAFE_MODE [[Process Services‎|PS]]
| [[1.0.0-0|v0]]
|-
| 20003103
| [[New_3DS]] SAFE_MODE [[Process Services‎|PS]]
| [[8.1.0-0_New3DS|v5121]]
|-
| 00003202
| [[Friend Services‎|friends]] (Friends list)
| [[1.0.0-0|v0]], [[2.0.0-2|v1028]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[5.0.0-11|v5122]], [[7.0.0-13|v6145]], [[8.0.0-18|v7172]], [[9.0.0-20|v8192]](Also for [[8.1.0-0_New3DS]])
|-
| 00003203
| SAFE_MODE [[Friend Services‎|friends]] (Friends list)
| [[1.0.0-0|v0]]
|-
| 20003203
| [[New_3DS]] SAFE_MODE [[Friend Services‎|friends]] (Friends list)
| [[8.1.0-0_New3DS|v8193]]
|-
| 00003302
| [[IR Services‎|IR]] (Infrared)
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[5.0.0-11|v5121]], [[8.0.0-18|v6148]], [[8.1.0-0_New3DS|v7170]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v8192]], [[9.3.0-21|v9216]], [[9.6.0-24|v10246]], [[10.0.0-27|v11265]]
|-
| 00003303
| SAFE_MODE [[IR Services‎|IR]]
| [[1.0.0-0|v0]]
|-
| 20003303
| [[New_3DS]] SAFE_MODE [[IR Services‎|IR]]
| [[8.1.0-0_New3DS|v7169]]
|-
| 00003402
| [[BOSS Services‎|BOSS]] (SpotPass)
| [[1.0.0-0|v0]], [[1.1.0-1|v1024]], [[2.0.0-2|v2053]], [[2.2.0-X|v3073]], [[3.0.0-5|v4101]], [[4.0.0-7|v5122]], [[5.0.0-11|v6146]], [[6.0.0-11|v7169]], [[6.2.0-12|v8193]], [[7.0.0-13|v9222]], [[8.0.0-18|v10240]], [[9.0.0-20|v11266]], [[10.0.0-27|v12289]]
|-
| 00003502
| [[News Services‎|News]] (Notifications)
| [[1.0.0-0|v0]], [[2.0.0-2|v1028]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[5.0.0-11|v4097]], [[8.0.0-18|v5120]], [[9.0.0-20|v6147]], [[9.7.0-25|v7168]]
|-
| 00003602
| This only exist for development units(launched by NS during startup depending on certain [[Configuration_Memory]] fields' values).
|
|-
| 00003702
| [[RO_Services|RO]]
| [[2.0.0-2|v0]], [[4.0.0-7|v1024]], [[5.0.0-11|v2049]], [[7.2.0-17|v3074]], [[8.0.0-18|v4096]], [[9.0.0-20|v5120]](Also for [[8.1.0-0_New3DS]]), [[9.3.0-21|v6148]]
|-
| 00003802
| [[ACT Services‎|act]] (handles Nintendo Network '''a'''c'''c'''oun'''t'''s)
| [[7.0.0-13|v1029]], [[7.1.0-14|v2050]], [[7.2.0-17|v3077]], [[8.0.0-18|v4099]], [[8.1.0-0_New3DS|v5120]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v6144]], [[9.3.0-21|v7168]], [[9.6.0-24|v8198]]
|-
| 00004002
| Old3DS [[NFC_Services|nfc]]
| [[9.3.0-21|v2053]], [[9.6.0-24|v4106]], [[9.7.0-25|v5121]], [[10.0.0-27|v6145]]
|-
| 20004002
| [[New_3DS]] [[NFC_Services|nfc]]
| [[8.1.0-0_New3DS|v0]], [[9.0.0-20|v1024]], [[9.3.0-21|v2053]], [[9.5.0-22|v3073]], [[9.6.0-24|v4102]], [[10.0.0-27|v6145]]
|-
| 20004102
| [[New_3DS]] [[MVD Services|mvd]]
| [[8.1.0-0_New3DS|v0]], [[9.0.0-20|v1024]]
|-
| 20004202
| [[New_3DS]] [[QTM Services|qtm]]
| [[8.1.0-0_New3DS|v8]], [[9.0.0-20|v1024]], [[9.3.0-21|v2052]]
|-
| 00008002
| [[NS]] (Memory-region: "SYSTEM")
| [[1.0.0-0|v0]], [[2.0.0-2|v1028]], [[2.2.0-X|v2048]], [[3.0.0-5|v3077]], v4096, [[4.0.0-7|v5121]], [[5.0.0-11|v6148]], [[5.1.0-11|v7168]], [[6.0.0-11|v8193]], [[6.1.0-11|v9216]], [[7.0.0-13|v10248]], [[7.2.0-17|v11268]], [[8.0.0-18|v12291]], [[8.1.0-0_New3DS|v13312]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v14336]], [[9.3.0-21|v15360]], [[9.6.0-24|v16390]], [[9.8.0-25|v17408]], [[10.0.0-27|v18433]]
|-
| 00008003
| SAFE_MODE [[NS]] (Memory-region: "SYSTEM")
| [[1.0.0-0|v0]]
|-
| 20008003
| [[New_3DS]] SAFE_MODE [[NS]] (Memory-region: "SYSTEM")
| [[8.1.0-0_New3DS|v13313]]
|}

Once Home Menu finishes loading, all of the above system modules are running, except for MP, RO, and act which are automatically [[Process_Manager_Services|loaded]] when a process requires them. When [[Process_Manager_Services|PM]]-module terminates processes, it will check whether the processes listed as dependencies for this process are listed as dependencies for other processes. Any processes which are no longer listed in any processes dependencies lists are then terminated. On [[New_3DS]], the only New3DS-specific system-module which automatically gets loaded during system boot is qtm.

All of the above system modules use the "BASE" [[SVC|memory-region]](specified in the exheader), except when listed otherwise for certain modules.

When handling the exheader dependency list starting with [[8.0.0-18]], Old3DS FIRM [[Process_Manager_Services|PM]]-module now skips handling titles in this list which have any bits in programID-low bitmask 0xF0000000 set(with [[8.0.0-18]] this is hard-coded). The exheader dependency list handling change is for the [[New 3DS]] system-module(s), which do not exist on Old3DS. When the New3DS pm-module is launching any title except [[NS]], it first attempts to launch the title with programID-low bitmask 0x20000000 set, then with that bitmask clear if launching fails.

=== 00040138 - [[FIRM|System Firmware]] ===
NATIVE_FIRM and SAFE_MODE_FIRM for the initial versions are exactly the same, besides [[Configuration_Memory|core-version]] fields. SAFE_MODE_FIRM is used for running SAFE_MODE titles, on retail SAFE_MODE_FIRM seems to be only used for running the [[System_Settings#System_Updater|System Updater]] application. When a GBA VC title is launched, AGB_FIRM is launched to handle running this title. GBA VC savegames stored under SD card /title/<TID>/data use a custom format, this is handled by AGB_FIRM.

{| class="wikitable" border="1"
|-
! TitleID Low
! Description
! USA/EUR/JPN Versions
! CHN Versions
! KOR Versions
! TWN Versions
|-
| 00000001
| Unknown, very similar to SAFE_MODE_FIRM. Exists only on dev units and seems to only be used by SystemUpdaters.
| v0
|
|
|
|-
| 00000002
| NATIVE_FIRM (Native Firmware)
| [[1.0.0-0|v432]], [[1.1.0-1|v1472]], [[2.0.0-2|v2516]], [[2.1.0-3|v3553]], [[2.2.0-X|v4595]], [[3.0.0-5|v5647]], [[4.0.0-7|v6677]], [[4.1.0-8|v7712]], [[5.0.0-11|v8758]], [[5.1.0-11|v9792]], [[6.0.0-11|v10833]], [[6.1.0-11|v11872]], [[7.0.0-13|v12916]], [[7.2.0-17|v13956]], v15043, [[8.0.0-18|v15047]], [[9.0.0-20|v17120]], [[9.3.0-21|v18182]], [[9.5.0-22|v19216]], [[9.6.0-24|v20262]], [[10.0.0-27|v21288]], [[10.2.0-28|v22313]]
| Same as USA/EUR/JPN starting with the USA/EUR/JPN [[4.0.0-7]] title-version
| Same as CHN.
| Same as CHN.
|-
| 20000002
| [[New_3DS]] NATIVE_FIRM (Native Firmware)
| [[8.1.0-0_New3DS|v16085]], [[9.0.0-20|v17120]], [[9.3.0-21|v18182]], [[9.5.0-22|v19218]], [[9.6.0-24|v20262]], [[10.0.0-27|v21288]], [[10.2.0-28|v22313]]
| N/A
| Same as CHN.
| Same as CHN.
|-
| 00000003
| SAFE_MODE_FIRM
| [[1.0.0-0|v432]], [[3.0.0-5|v5632]]
| Same as USA/EUR/JPN starting with the USA/EUR/JPN [[3.0.0-5]] title-version
| Same as CHN.
| Same as CHN.
|-
| 20000003
| [[New_3DS]] SAFE_MODE_FIRM
| [[8.1.0-0_New3DS|v16081]]
| N/A
| Same as CHN.
| Same as CHN.
|-
| 00000102
| TWL_FIRM ( DSi Firmware )
| [[1.0.0-0|v432]], [[2.0.0-2|v1489]], [[3.0.0-5|v2565]], v3601, [[4.0.0-7|v4625]], [[4.4.0-10|v5681]], [[4.5.0-10|v6704]], [[6.0.0-11|v7762]], [[6.2.0-12|v8817]]
| Same as USA/EUR/JPN starting with the USA/EUR/JPN [[4.0.0-7]] title-version
| Same as CHN.
| Same as CHN.
|-
| 20000102
| [[New_3DS]] TWL_FIRM ( DSi Firmware )
| [[8.1.0-0_New3DS|v9936]]
| N/A
| Same as CHN.
| Same as CHN.
|-
| 00000202
| AGB_FIRM ( GBA Firmware )
| [[3.0.0-5|v519]], v1553, [[4.0.0-7|v2576]], [[6.0.0-11|v3665]]
| [[4.0.0-7|v2576]]
| [[4.0.0-7|v2576]], [[6.0.0-11|v3665]]
| Same as CHN.
|-
| 20000202
| [[New_3DS]] AGB_FIRM ( GBA Firmware )
| [[8.1.0-0_New3DS|v4816]]
| N/A
| N/A
| N/A
|}

== TWL System Titles ==

{| class="wikitable" border="1"
|-
! Content Category
! Bit Mask(s)
! Category Bit Mask
|-
| System Application
| TWL<nowiki>|</nowiki>0x1<nowiki>|</nowiki>0x4
| 0x8005
|-
| System Archive
| TWL<nowiki>|</nowiki>0x1<nowiki>|</nowiki>0x2<nowiki>|</nowiki>0x4<nowiki>|</nowiki>0x8
| 0x800F
|}
Bitmask 0x1 for TWL titles determines whether the title will be updated during a System Update.

=== 00048005 - System Applications===
{| class="wikitable" border="1"
|-
! TitleID Low
! Region
! Description
! Versions
! Information
|-
| 42383841(B88A)
| ALL
| [[DS Internet]]
| v0, [[2.1.0-4|v1025]], [[3.0.0-5|v2048]]
| [[DS Internet]] is the DSi-mode application launched by [[System Settings]] for setting TWL wifi configuration.
|-
| 484E4441(HNDA)
| ALL
| [[Download Play]]
| v1024
| This [[Download Play]] application is the DS-mode Download Play client, launched by the 3DS-mode Download Play application.
|-
| 484E4443(HNDC)
| CHN
| [[Download Play]]
| v1024
| See Above Description.
|-
| 484E444B(HNDK)
| KOR
| [[Download Play]]
| v1024
| See Above Description.
|}

=== 0004800F - System Data Archives===
{| class="wikitable" border="1"
|-
! TitleID Low
! Description
! Versions
|-
| 484E4841(HNHA)
| [[Nintendo DS Cart Whitelist]]
| v0, [[2.0.0-2|v1026]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[4.2.0-9|v5120]], [[4.3.0-10|v6145]], [[4.4.0-10|v7168]], [[4.5.0-10|v8192]], [[5.0.0-11|v9216]], [[6.0.0-11|v10240]], [[7.0.0-13|v11264]]
|-
| 484E4C41(HNLA)
| [[Version Data]]
| v0
|}

New system updates only block DS flash-cards when the above whitelist was updated, or when TWL_FIRM was updated. The whitelist contains the data used for detecting flash-cards, this is used by TWL_FIRM.

== Application Titles ==
{| class="wikitable" border="1"
|-
! Content Category
! Bit Mask(s)
! Category Bit Mask
|-
| [[Title list/eShop Titles|Application]] (eShop Title)
| Normal
| 0x0000
|-
| DLP Child
| DlpChild
| 0x0001
|-
| [[EShop Demos|Demo]]
| Demo
| 0x0002
|-
| [[Title list/Patches|Patch]]
| CannotExecution<nowiki>|</nowiki>Patch
| 0x000E
|-
| [[Title list/DLC|Add-on Content]] (DLC)
| NotRequireRightForMount<nowiki>|</nowiki>CannotExecution<nowiki>|</nowiki>AddOnContents
| 0x008C
|}

=== 00040001 - [[Download Play]] Titles ===
This titleID-high/programID-high is used for the titles sent over [[Download Play]]. Only one 00040001 Download Play title is installed to NAND /title at a time. There can be a maximum of 255 Download Play child titles per Unique ID, indexed by Title ID Variation. The legal index range: 0x0 - 0xff.

== TWL Application Titles ==
{| class="wikitable" border="1"
|-
! Content Category
! Bit Mask(s)
! Category Bit Mask
|-
| Application (DSiWare)
| TWL<nowiki>|</nowiki>0x4
| 0x8004
|}

=== 00048004 - DSiWare ===
Although these have a titleID high separate from DSi and a titleID is stored in the SRLs, the content of these SRLs are identical to DSi.

{| class="wikitable" border="1"
|-
! TitleID Low
! Region
! Description
! Versions
|-
| 4B4B5456(KKTV)
| EUR
| Cut the Rope
| v0, v64
|-
| 4B4E5256(KNRV)
| EUR
| A Little Bit of... Brain Training™: Maths Edition
| v0
|-
| 4B5A4C56(KZLV)
| EUR
| Plants vs. Zombies™
| v0
|-
| 4B454256(KEBV)
| EUR
| ELECTROPLANKTON (Hanenbow)
| v0
|-
| 4B513956(KQ9V)
| EUR
| Zelda: Four Swords Anniversary Edition
| v16
|-
| 4B574256(KWBV)
| EUR
| Mario Calculator
| v0
|-
| 4B574656(KWFV)
| EUR
| Mario Clock
| v0
|}

Title list

2015-10-30T15:08:13Z

Syphurith: Found 5 modules after extracted them from decrypted and unpacked firm. /* 00040130 - System Modules */

The Nintendo 3DS utilizes a similar title-based organization as seen in the Wii and DSi platforms. The update server is located [http://nus.cdn.c.shop.nintendowifi.net/ccs/download/ here]. When using SSL, the update/shop servers must be accessed via SSLv3.

The organization of Title IDs has not been documented fully yet. Region info isn't stored in title IDs however there does appear to be evidence that the regions are sequential, similar to how Wii System Menu Updates are ordered: JPN USA EUR KOR and CHN (introduced with the DSi). 3DS has one additional region: TWN.

Note: The terms 'Title ID', 'Partition ID' and 'Media ID' are interchangeable.

The 3DS retrieves system [[CommonETicket|tickets]] with SOAP request GetSystemCommonETicket, instead of directly downloading the cetk with HTTPS. The cetk is still accessible via HTTP, however 3DS doesn't use direct HTTP for this.

'''TitleID Structure''': 0xCCCCABCDLLLLLLRR

* CCCC defines the console '''Platform''' (5=WiiU, 4=3DS, 3=DSi, 1=[http://wiibrew.org/wiki/Title_database Wii])
* ABCD defines the '''Content Category''' of the title, Demo, DLPChild, etc.
* LLLLLL For CTR titles, this is the title's '''Unique ID'''. For TWL converted titles this is in two sections grouped as SSLLLL. SS is the old title identification used by the DSi and is made redundant by 'ABCD'. LLLL is the TWL title's 'Unique ID'. There are restrictions on the Unique ID, see below for more info.
* RR This is the Title ID '''Variation''', and has various uses.

'''Content Categories''':

This u16 is a collection bit mask flag. Each Category is a group of one or more bit masks.

Specific Bitmask Flags:
{| class="wikitable" border="1"
|-
! Category
! Bitmask
|-
| Normal
| 0x0
|-
| DlpChild
| 0x1
|-
| Demo
| 0x2
|-
| Contents
| 0x3
|-
| AddOnContents
| 0x4
|-
| Patch
| 0x6
|-
| CannotExecution
| 0x8
|-
| System
| 0x10
|-
| RequireBatchUpdate
| 0x20
|-
| NotRequireUserApproval
| 0x40
|-
| NotRequireRightForMount
| 0x80
|-
| CanSkipConvertJumpId
| 0x100
|-
| TWL
| 0x8000
|}

* TWL Category bit mask are carried over from original TWL category bitmasks (ignoring bit mask 0x8000), so TWL system titles have the bitmask of 0x8001.

* System titles (TWL and CTR) are eligible to be updated during a System Update.

* Bit Mask 0x4000 appears to be reserved, as it renders the ''TWL'' and ''System'' bit masks useless.

'''Unique ID Restrictions''':

For the CTR titles, there appears to be is a correlation between Unique IDs (UID) and 3DS 'title types'. For developer titles this is known(shown below), and retail titles *appear* to follow suite. It is unknown if this correlation is enforced on retail units, or if it is just for organisation purposes.

{| class="wikitable" border="1"
|-
! TITLE TYPE
! UNIQUE ID RANGE
|-
| System
| 0x0 - 0x2FF
|-
| Application
| 0x300 - 0xF7FFF
|-
| Evaluation
| 0xF8000 -0xFFFFF
|-
| Prototype*
| 0xFF000 - 0xFF3FF
|}
<nowiki>*</nowiki>On the home menu, titles with UIDs within the 'Prototype' range, appear on the home menu after install without the gift fanfare.

ProgramID/titleID low bitmask 0xF0000000(uniqueID bitmask 0xF00000) seems to be related to which hardware the title is allowed to run on. 3DS code tends to clear this bitmask when handling programIDs. This bitmask is normally zero. When this is 0x2, this indicates that the title only runs on [[New_3DS]](that is, programID-low 0x20000000 / uniqueID 0x200000).

'''TitleID Variation''':

This u8 allows enumeration of titles from the same category and unique ID. Common uses are explained below:

* CTR System Titles: The 3DS has two copies of most modules/applets/archives for usage with either the NATIVE_FIRM or SAFE_MODE_FIRM. This is allowed for, by changing the title ID variation of the title to match the core version set by the FIRM it is designed to be used with:
{| class="wikitable" border="1"
|-
! RR
! MEANING
|-
| 02
| System Title (Core version 0x2)
|-
| 03
| SAFE_MODE System Title (Core version 0x3)
|}
Normally on retail SAFE_MODE ARM11 [[NCCH#CXI|CXI]] titles can't be launched, since the [[Configuration_Memory|system]] core version doesn't match the CXI exheader core version.

* Only most non-Normal Applications are known to utilise Title ID variation, this is explained in their respective sections on this page.

* [[3DS Development Unit Software|Dev Menu]] installs CTR Applications with a TitleID variation of 0x02 to the CTR NAND.

* Title ID variation is ignored for TWL titles, this value is carried over from the original TWL title ID and is used for region lock:

=== Versions ===

v## = 0xHHHH = 0bBBBBBBBB...

* The version major,minor and micro can be extracted from the version number by converting the 16 bit number to binary
* 6 bits : Major
* 6 bits : Minor
* 4 bits : Micro ('Build' in some contexts)
* i.e. v2069 (Taken from 000400DB00017302) = 0b000010 000001 0101 means that the title version is v2.1.5. For reasons unknown, the CVer build, stored in the RomFS of the title, has always been zero (at time of writing), regardless of the CVer build in the TMD. So when predicting the firmware version, this should be taken into account.

NOTE: This Title list is a condensed version, only the System Titles lists are full lists. For a full list of titles on Nintendo's CDN, see [http://mtheall.com/~mtheall/tmdlist.php here]. The reports/title-lists from [http://yls8.mtheall.com/ninupdates/reports.php here] are automatically obtained from the system update SOAP.

== CTR System Titles ==
{| class="wikitable" border="1"
|-
! System Category
! Bit Mask(s)
! Category Bit Mask
|-
| Application (SYSTEM_APPLICATION)
| Normal<nowiki>|</nowiki>System
| 0x0010
|-
| System Data Archives (SYSTEM_CONTENT)
| Contents<nowiki>|</nowiki>CannotExecution<nowiki>|</nowiki>System
| 0x001B
|-
| Shared Data Archives (SHARED_CONTENT)
| Contents<nowiki>|</nowiki>CannotExecution<nowiki>|</nowiki>System<nowiki>|</nowiki>NotRequireRightForMount
| 0x009B
|-
| System Data Archives (AUTO_UPDATE_CONTENT)
| Contents<nowiki>|</nowiki>CannotExecution<nowiki>|</nowiki>System<nowiki>|</nowiki>NotRequireUserApproval<nowiki>|</nowiki>NotRequireRightForMount
| 0x00DB
|-
| Applet (APPLET)
| Normal<nowiki>|</nowiki>System<nowiki>|</nowiki>RequireBatchUpdate
| 0x0030
|-
| Module (BASE)
| Normal<nowiki>|</nowiki>System<nowiki>|</nowiki>RequireBatchUpdate<nowiki>|</nowiki>CanSkipConvertJumpId
| 0x0130
|-
| Firmware (FIRMWARE)
| Normal<nowiki>|</nowiki>CannotExecution<nowiki>|</nowiki>System<nowiki>|</nowiki>RequireBatchUpdate<nowiki>|</nowiki>CanSkipConvertJumpId
| 0x0138
|}

=== 00040010 - System Applications ===
The versions for CHN, KOR, and TWN are separate from the other regions.

{| class="wikitable" border="1"
|-
! JPN TIDLow
! USA TIDLow
! EUR TIDLow
! CHN TIDLow
! KOR TIDLow
! TWN TIDLow
! Description
! JPN Versions
! EUR Versions
! USA Versions
! CHN Versions
! KOR Versions
! TWN Versions
! Status
|-
| 00020000
| 00021000
| 00022000
| 00026000
| 00027000
| 00028000
| [[System Settings]] (mset)
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[3.0.0-5|v2060]], [[4.0.0-7|v3074]], [[5.0.0-11|v4097]], [[6.0.0-11|v5127]], [[7.0.0-13|v6157]], [[7.2.0-17|v7173]], [[8.1.0-0_New3DS|v8198]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v9224]], [[9.6.0-24|v10245]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[3.0.0-5|v2061]], [[4.0.0-7|v3075]], [[5.0.0-11|v4097]], [[6.0.0-11|v5127]], [[7.0.0-13|v6157]], [[7.2.0-17|v7174]], [[9.0.0-20|v8202]], [[9.6.0-24|v9220]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[3.0.0-5|v2062]], [[4.0.0-7|v3078]], [[5.0.0-11|v4098]], [[6.0.0-11|v5128]], [[7.0.0-13|v6157]], [[7.2.0-17|v7174]], [[9.0.0-20|v8203]], [[9.6.0-24|v9221]]
| [[4.0.0-7|v8]], [[4.4.0-10|v1024]](CHN-only sysupdate for just mset), [[5.0.0-11|v2049]], [[7.0.0-13|v3075]]
| [[4.0.0-7|v1026]], [[5.0.0-11|v2049]], [[7.0.0-13|v4098]]
| [[4.1.0-8|v8]], [[4.2.0-9|v1024]], [[5.0.0-11|v2050]], [[7.0.0-13|v3074]]
| Active
|-
| 00020100
| 00021100
| 00022100
| 00026100
| 00027100
| 00028100
| [[Download Play]] (dlplay)
| [[1.0.0-0|v0]], [[2.1.0-4|v1026]], [[4.0.0-7|v2051]], [[9.0.0-20|v3072]](Also for [[8.1.0-0_New3DS]])
| [[1.0.0-0|v0]], [[2.1.0-4|v1026]], [[4.0.0-7|v2051]], [[9.0.0-20|v3073]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1026]], [[4.0.0-7|v2051]], [[9.0.0-20|v3073]]
| [[4.0.0-7|v4]]
| [[4.0.0-7|v1027]]
| [[4.1.0-8|v4]]
| Active
|-
| 00020200
| 00021200
| 00022200
| 00026200
| 00027200
| 00028200
| [[Activity Log]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[3.0.0-5|v2051]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[3.0.0-5|v2054]], [[7.0.0-13|v2064]]
| Same as EUR
| [[4.0.0-7|v3]]
| [[4.0.0-7|v2]], [[7.0.0-13|v16]]
| [[4.1.0-8|v2]]
| Active
|-
| 00020300
| 00021300
| 00022300
| 00026300
| 00027300
| 00028300
| [[Health and Safety Information]]
| [[1.0.0-0|v0]], [[4.0.0-7|v1024]], [[6.0.0-11|v2050]]
| [[1.0.0-0|v0]], [[3.0.0-5|v1024]], [[4.0.0-7|v2050]], [[6.0.0-11|v3077]]
| [[1.0.0-0|v0]], [[4.0.0-7|v1026]], [[6.1.0-12U|v2051]]
| [[4.0.0-7|v5]]
| [[4.0.0-7|v2]]
| [[4.1.0-8|v5]]
| Active
|-
| 20020300
| 20021300
| 20022300
| N/A
| N/A
| N/A
| [[New_3DS]] [[Health and Safety Information]]
| [[8.1.0-0_New3DS|v2]], [[9.3.0-21|v17]]
| [[8.1.0-0_New3DS|v1]]
| Same as EUR.
| N/A
| N/A
| N/A
| Active
|-
| 00020400
| 00021400
| 00022400
| 00026400
| 00027400
| 00028400
| [[Nintendo 3DS Camera]] (CtrApp)
| [[1.0.0-0|v0]], [[2.1.0-4|v16]], [[3.0.0-5|v1038]], [[4.0.0-7|v2048]], [[6.0.0-11|v3073]], [[9.0.0-20|v4097]](Also for [[8.1.0-0_New3DS]])
| [[1.0.0-0|v0]], [[2.1.0-4|v16]], [[3.0.0-5|v1039]], [[4.0.0-7|v2048]], [[6.0.0-11|v3073]], [[7.0.0-13|v3088]], [[9.0.0-20|v4097]]
| [[1.0.0-0|v0]], [[2.1.0-4|v16]], [[3.0.0-5|v1039]], [[4.0.0-7|v2048]], [[6.1.0-12U|v3074]], [[7.0.0-13|v3088]], [[9.0.0-20|v4097]]
| [[4.0.0-7|v3]]
| [[4.0.0-7|v2]], [[7.0.0-13|v1040]]
| [[4.1.0-8|v3]]
| Active
|-
| 00020500
| 00021500
| 00022500
| 00026500
| 00027500
| 00028500
| [[Nintendo 3DS Sound]] (CtrApp)
| [[1.0.0-0|v0]], [[2.1.0-4|v1027]], [[3.0.0-5|v2049]], [[4.0.0-7|v3072]], [[7.0.0-13|v3089]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1027]], [[3.0.0-5|v2049]], [[4.0.0-7|v3072]], [[7.0.0-13|v3088]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1027]], [[3.0.0-5|v2049]], [[4.0.0-7|v3072]], [[7.0.0-13|v3088]]
| [[4.0.0-7|v2]]
| [[4.0.0-7|v2]], [[7.0.0-13|v16]]
| [[4.1.0-8|v3]]
| Active
|-
| 00020700
| 00021700
| 00022700
| 00026700
| 00027700
| 00028700
| [[Mii Maker]] (EDIT)
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[7.0.0-13|v2055]]
| Same as JPN
| Same as JPN
| [[4.0.0-7|v1]]
| [[4.0.0-7|v1]], [[7.0.0-13|v16]]
| [[4.1.0-8|v2]]
| Active
|-
| 00020800
| 00021800
| 00022800
| 00026800
| 00027800
| 00028800
| [[StreetPass Mii Plaza]] (MEET)
| [[1.0.0-0|v0]], v1027, [[2.1.0-4|v2048]], [[3.0.0-5|v3087]], [[3.0.0-6|v4096]], [[6.0.0-11|v5121]]
| [[1.0.0-0|v0]], v1027, [[2.1.0-4|v2048]], [[3.0.0-5|v3087]], [[3.0.0-6|v4096]], [[6.0.0-11|v5122]]
| [[1.0.0-0|v0]], v1027, [[2.1.0-4|v2048]], [[3.0.0-5|v3087]], [[3.0.0-6|v4096]], [[6.1.0-12U|v5124]], [[7.0.0-13|v5136]]
| [[4.0.0-7|v0]], [[4.4.0-10|v4096]]
| [[4.0.0-7|v1]], [[4.4.0-10|v4096]], [[7.0.0-13|v5120]]
| [[4.1.0-8|v1]], [[4.4.0-10|v4096]]
| Active
|-
| 00020900
| 00021900
| 00022900
| N/A
| 00027900
| 00028900
| [[eShop]] (tiger)
| [[2.0.0-2|v4]], [[2.1.0-3|v1026]], [[3.0.0-5|v2057]], [[4.0.0-7|v3081]], [[4.1.0-8|v4096]], [[4.2.0-9|v5123]], [[4.3.0-10|v6146]], [[5.0.0-11|v7169]], [[7.0.0-13|v8206]], [[7.1.0-14|v9231]], [[7.2.0-17|v10245]], [[8.0.0-18|v11265]], [[8.1.0-19|v12288]], [[9.0.0-20|v13320]], [[9.3.0-21|v15366]], [[9.5.0-22|v16384]], [[9.6.0-24|v17421]], [[9.7.0-25|v18432]], [[10.0.0-27|v19465]]
| [[2.0.0-2|v4]], [[2.1.0-3|v1026]], [[3.0.0-5|v2058]], [[4.0.0-7|v3081]], [[4.1.0-8|v4096]], [[4.2.0-9|v5123]], [[4.3.0-10|v6146]], [[5.0.0-11|v7171]], [[7.0.0-13|v8206]], [[7.1.0-14|v9231]], [[7.2.0-17|v10245]], [[8.0.0-18|v11265]], [[8.1.0-19|v12288]], [[9.0.0-20|v13320]], [[9.3.0-21|v15366]], [[9.5.0-22|v16384]], [[9.6.0-24|v17421]], [[9.7.0-25|v18432]], [[10.0.0-27|v19465]]
| [[2.0.0-2|v4]], [[2.1.0-3|v1026]], [[3.0.0-5|v2058]], [[4.0.0-7|v3081]], [[4.1.0-8|v4096]], [[4.2.0-9|v5123]], [[4.3.0-10|v6146]], [[5.0.0-11|v7170]], [[7.0.0-13|v8206]], [[7.1.0-14|v9231]], [[7.2.0-17|v10246]], [[8.0.0-18|v11265]], [[8.1.0-19|v12288]], [[9.0.0-20|v13321]], [[9.3.0-21|v15366]], [[9.5.0-22|v16384]], [[9.6.0-24|v17422]], [[9.7.0-25|v18432]], [[10.0.0-27|v19465]]
| N/A
| [[4.0.0-7|v3082]], [[4.1.0-8|v4096]], [[4.2.0-9|v5123]], [[4.3.0-10|v6146]], [[5.0.0-11|v7169]], [[7.0.0-13|v8205]], [[7.1.0-14|v9231]], [[8.1.0-19|v12288]], [[9.0.0-20|v13320]], [[9.3.0-21|v15366]], [[9.5.0-22|v16384]], [[9.6.0-24|v17420]], [[9.7.0-25|v18432]], [[10.0.0-27|v19465]]
| [[4.1.0-8|v4096]], [[4.2.0-9|v5123]], [[4.3.0-10|v6146]], [[5.0.0-11|v7170]], [[7.0.0-13|v8205]], [[7.1.0-14|v9231]], [[8.1.0-19|v12288]], [[9.3.0-21|v15366]], [[9.5.0-22|v16384]], [[9.6.0-24|v17421]], [[9.7.0-25|v18432]], [[10.0.0-27|v19465]]
| Active
|-
| 00020A00
| 00021A00
| 00022A00
| N/A
| 00027A00
| 00028A00
| [[System Transfer]] (CARDBOARD)
| [[2.0.0-2|v4]], [[3.0.0-5|v1035]], [[4.0.0-7|v2050]], [[5.0.0-11|v3074]], [[7.0.0-13|v4109]], [[9.0.0-20|v5130]], [[9.6.0-24|v6154]]
| [[2.0.0-2|v4]], [[3.0.0-5|v1035]], [[4.0.0-7|v2050]], [[5.0.0-11|v3073]], [[7.0.0-13|v4109]], [[9.0.0-20|v5131]], [[9.6.0-24|v6155]]
| [[2.0.0-2|v4]], [[3.0.0-5|v1035]], [[4.0.0-7|v2051]], [[5.0.0-11|v3073]], [[7.0.0-13|v4109]], [[9.0.0-20|v5131]], [[9.6.0-24|v6156]]
| N/A
| [[4.0.0-7|v2]], [[5.0.0-11|v1025]], [[7.0.0-13|v2061]], [[9.0.0-20|v3082]]
| [[4.1.0-8|v2]], [[5.0.0-11|v1025]], [[7.0.0-13|v2061]]
| Active
|-
| 00020B00
| 00021B00
| 00022B00
| N/A
| N/A
| N/A
| [[Nintendo Zone]] ("Nintendo")
| [[1.0.0-0|v0]], [[3.0.0-5|v1034]]
| Same as JPN
| Same as JPN
| N/A
| N/A
| N/A
| Active
|-
| 00020D00
| 00021D00
| 00022D00
| 00026D00
| 00027D00
| 00028D00
| [[Face Raiders]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1028]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1028]], [[7.0.0-13|v1040]]
| Same as EUR
| [[4.0.0-7|v0]]
| [[4.0.0-7|v0]]
| [[4.1.0-8|v2]]
| Active
|-
| 20020D00
| 20021D00
| 20022D00
| N/A
| N/A
| N/A
| [[New_3DS]] [[Face Raiders]]
| [[8.1.0-0_New3DS|v2050]]
| [[8.1.0-0_New3DS|v2049]]
| Same as EUR.
| N/A
| N/A
| N/A
| Active
|-
| 00020E00
| 00021E00
| 00022E00
| 00026E00
| 00027E00
| 00028E00
| [[AR Games]] (AR_ACT)
| [[1.0.0-0|v0]], [[2.1.0-4|v1026]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1026]], [[7.0.0-13|v1040]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1027]], [[7.0.0-13|v1040]]
| [[4.0.0-7|v0]]
| [[4.0.0-7|v0]], [[7.0.0-13|v16]]
| [[4.1.0-8|v1]]
| Active
|-
| 00020F00
| 00021F00
| 00022F00
| 00026F00
| 00027F00
| 00028F00
| SAFE_MODE [[System Settings#System Updater|System Updater]] (mset)
| [[1.0.0-0|v0]], [[3.0.0-5|v1024]], [[6.0.0-11|v2049]]
| [[1.0.0-0|v0]], [[3.0.0-5|v1024]], [[6.0.0-11|v2050]]
| Same as JPN
| [[4.0.0-7|v1]], [[6.0.0-11|v1026]]
| [[4.0.0-7|v1]]
| [[4.1.0-8|v1]]
| Active
|-
| 00023000
| 00024000
| 00025000
| N/A
| N/A
| N/A
| Promotional video
| [[1.1.0-1|v2]], [[2.0.0-2|v2048]]
| [[1.1.0-1|v<unknown>]], [[2.0.0-2|v2048]]
| [[1.1.0-1|v0]], [[2.0.0-2|v2048]]
| N/A
| N/A
| N/A
| Stubbed
|-
| 0002BF00
| 0002C000
| 0002C100
| N/A
| N/A
| N/A
| Nintendo Network ID Settings (act)
| [[7.0.0-13|v14]], [[7.2.0-17|v1029]], [[9.0.0-20|v2051]], [[9.3.0-21|v3072]]
| Same as JPN
| Same as JPN
| N/A
| N/A
| N/A
| Active
|-
| 20023100
| 20024100
| 20025100
| N/A
| N/A
| N/A
| [[microSD Management]] ('mcopy') ([[New_3DS]]-only)
| [[8.1.0-0_New3DS|v8]], [[9.0.0-20|v1024]]
| [[8.1.0-0_New3DS|v4]]
| [[8.1.0-0_New3DS|v5]]
| N/A
| N/A
| N/A
| Available
|-
| 2002C800
| 2002CF00
| 2002D000
| N/A
| 2002D700
| N/A
| [[New_3DS]]-only, currently stubbed. Placeholder exheader name is "menu".
| [[8.1.0-0_New3DS|v2]], [[9.0.0-20|v18]], [[9.3.0-21|v34]], [[9.6.0-24|v50]]
| [[8.1.0-0_New3DS|v1]], [[9.3.0-21|v17]], [[9.6.0-24|v34]]
| [[8.1.0-0_New3DS|v1]], [[9.3.0-21|v18]], [[9.6.0-24|v33]]
| N/A
| [[9.6.0-24|v2]]
| N/A
| Stubbed
|-
| 2002C900
| 2002D100
| 2002D200
| N/A
| 2002D800
| N/A
| [[New_3DS]]-only, currently stubbed. Placeholder exheader name is "friend".
| [[8.1.0-0_New3DS|v1]]
| Same as JPN.
| [[8.1.0-0_New3DS|v0]], [[9.3.0-21|v16]]
| N/A
| [[9.6.0-24|v2]]
| N/A
| Stubbed
|-
| 2002CA00
| 2002D300
| 2002D400
| N/A
| 2002D900
| N/A
| [[New_3DS]]-only, currently stubbed. Placeholder exheader name is "newslist".
| [[8.1.0-0_New3DS|v0]], v1([[Home_Menu|JPN-only]] Oct 2, 2014 "sysupdate", actually uploaded on 09-29-14. Identical to v0, same TMDs besides title-versions)
| [[8.1.0-0_New3DS|v2]]
| [[8.1.0-0_New3DS|v0]]
| N/A
| [[9.6.0-24|v2]]
| N/A
| Stubbed
|-
| 2002CB00
| 2002D500
| 2002D600
| N/A
| 2002DA00
| N/A
| [[New_3DS]]-only, currently stubbed. Placeholder exheader name is "cherry".
| [[8.1.0-0_New3DS|v0]], [[9.0.0-20|v1]]
| [[8.1.0-0_New3DS|v2]]
| Same as EUR.
| N/A
| [[9.6.0-24|v1]]
| N/A
| Stubbed
|}

The "act" application seems to use a web browser with webkit?

Regardless of version, the ExeFS:/.code for mset is the same for USA/EUR/JPN. The [[4.0.0-7]] version of mset([[4.1.0-8]] for TWN) has the same ExeFS:/.code for all regions(JPN, USA, EUR, CHN, KOR, TWN). The [[5.0.0-11]] mset ExeFS:/.code is the same for all regions as well, except for CHN. The [[7.0.0-13]] mset ExeFS:/.code is unique for the following regions: CHN, KOR, and TWN.

=== 0004001B - [[NCCH#CFA|System Data Archives]] ===
{| class="wikitable" border="1"
|-
! TitleID Low
! Description
! Versions
|-
| 00010002
| [[ClCertA]]
| [[1.0.0-0|v0]]
|-
| 00010702
| [[NS CFA]]
| [[3.0.0-5|v0]], [[6.0.0-11|v1028]], [[6.3.0-12|v2048]], [[7.0.0-13|v3073]], [[9.0.0-20|v4096]](also for [[8.1.0-0_New3DS]])
|-
| 00010802
| This CFA only contains a 1-byte "dummy.txt" in the RomFS, which contains '0'.
| [[6.3.0-12|v0]], [[9.5.0-23|v1024]]
|-
| 00018002
| Same contents as 00010802. Starting with [[7.1.0-15]], the "dummy.txt" file was removed from RomFS: this CFA RomFS now contains web-browser data(similar to 00018102) for NNID / networking, etc.
| [[7.0.0-13|v14]], [[7.1.0-15|v1025]], [[7.2.0-17|v2055]], [[9.0.0-20|v3078]], [[9.3.0-21|v4096]], [[9.6.0-24|v5120]]
|-
| 00018102
| This contains local web-browser data(html/js, gfx, etc) for the Miiverse Offline-mode.
| [[7.0.0-13|v11]], [[9.0.0-20|v1025]](also for [[8.1.0-0_New3DS]])
|-
| 00018202
| This contains the webkit/OSS [[CRO0|CROs]] used with the Miiverse applet and the "act" application.
| [[7.0.0-13|v7]], [[8.1.0-0_New3DS|v1026]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v2050]]
|-
| 00019002
| [[Fangate_updater]]
| [[9.3.0-21|v2]], [[9.6.0-24|v1026]]
|}

=== 00040030 - Applets===
{| class="wikitable" border="1"
|-
! JPN TitleIDLow
! USA TitleIDLow
! EUR TitleIDLow
! Description
! JPN Versions
! USA Versions
! EUR Versions
|-
| 00008102
| 00008102
| 00008102
| [[NS#Alternate menu|Alternate menu]]
| N/A
|-
| 00008202
| 00008F02
| 00009802
| [[Home Menu|Home Menu]] (menu)
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[2.1.0-3|v2049]], [[2.2.0-X|v3075]], [[3.0.0-5|v4111]], [[4.0.0-7|v5131]], [[4.2.0-9|v6146]], [[5.0.0-11|v7172]], [[6.0.0-11|v8198]], [[7.0.0-13|v9230]], [[8.1.0-0_New3DS|v10250]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v13313]], [[9.1.0-20J|v14336]], [[9.2.0-20|v15360]], [[9.3.0-21|v16402]], [[9.4.0-21|v17408]], [[9.5.0-22|v18432]], [[9.6.0-24|v19476]], [[9.7.0-25|v20487]], [[9.8.0-25|v22528]], [[10.1.0-27|v23552]], [[10.2.0-28|v24576]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[2.1.0-3|v2049]], [[2.2.0-X|v3075]], [[3.0.0-5|v4111]], [[4.0.0-7|v5131]], [[4.2.0-9|v6146]], [[5.0.0-11|v7172]], [[6.0.0-11|v8198]], [[7.0.0-13|v9230]], [[8.1.0-0_New3DS|v10250]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v11272]], [[9.2.0-20|v12288]], [[9.3.0-21|v13330]], [[9.4.0-21|v14336]], [[9.5.0-22|v15360]], [[9.6.0-24|v16404]], [[9.7.0-25|v17415]], [[9.8.0-25|v19456]], [[9.9.0-26|v20480]], [[10.1.0-27|v21504]], [[10.2.0-28|v22528]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[2.1.0-3|v2049]], [[2.2.0-X|v3075]], [[3.0.0-5|v4111]], [[4.0.0-7|v5131]], [[4.2.0-9|v6146]], [[5.0.0-11|v7172]], [[6.0.0-11|v8198]], [[7.0.0-13|v9230]], [[8.1.0-0_New3DS|v10250]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v11272]], [[9.2.0-20|v12288]], [[9.3.0-21|v13330]], [[9.4.0-21|v14336]], [[9.5.0-22|v15360]], [[9.6.0-24|v16404]], [[9.7.0-25|v17415]], [[9.8.0-25|v19456]], [[10.1.0-27|v20480]], [[10.2.0-28|v21504]]
|-
| 00008402
| 00009002
| 00009902
| Camera applet used by Home-menu (CtrApp)
| v0, v1036, [[9.0.0-20|v2049]](Also for [[8.1.0-0_New3DS]])
| Same as JPN
| Same as JPN
|-
| 00008502
| 00009102
| 00009A02
| Not available on CDN
| ?
|
|
|-
| 00008602
| 00009202
| 00009B02
| Instruction Manual, applet for displaying instruction manuals
| v0, v1026, v2048, v3072, [[5.0.0-11|v4097]], [[9.0.0-20|v5120]](Also for [[8.1.0-0_New3DS]])
| Same as JPN
|-
| 00008702
| 00009302
| 00009C02
| Game Notes (Cherry)
| v0, v1026, v2049, [[5.0.0-11|v3073]], [[9.0.0-20|v4096]](Also for [[8.1.0-0_New3DS]])
| Same as JPN
| Same as JPN
|-
| 00008802
| 00009402
| 00009D02
| [[Internet Browser]] (spider)
| [[2.0.0-2|v6]], [[2.1.0-4|v1024]], [[4.0.0-7|v2050]], [[5.0.0-11|v3074 (EUR)/v3075(USA,JAP)]], [[7.0.0-13|v3088]], [[7.1.0-16|v4096]], [[9.5.0-23|v5121]], [[9.9.0-26|v6149]], [[10.2.0-28|v7168]]
| Same as JPN
| Same as JPN
|-
| 20008802
| 20009402
| 20009D02
| [[New_3DS]] [[Internet Browser]] (SKATER)
| [[8.1.0-0_New3DS|v10]], [[9.3.0-21|v1027]], [[9.6.0-24|v2051]], [[9.9.0-26|v3077]], [[10.2.0-28|v4096]]
| Same as JPN
| Same as JPN
|-
| 00008A02
| 00008A02
| 00008A02
| [[ErrDisp]]
| v0, v1025, [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[5.0.0-11|v5121]], [[8.0.0-18|v6144]], [[9.0.0-20|v7168]](Also for [[8.1.0-0_New3DS]])
| Same as JPN
| Same as JPN
|-
| 00008A03
| 00008A03
| 00008A03
| SAFE_MODE [[ErrDisp]]
| v0
| Same as JPN
| Same as JPN
|-
| 20008A03
| 20008A03
| 20008A03
| [[New_3DS]] SAFE_MODE [[ErrDisp]]
| [[8.1.0-0_New3DS|v7169]]
| Same as JPN
| Same as JPN
|-
| 00008D02
| 00009602
| 00009F02
| Friend List (friend)
| v0, v1026, [[2.2.0-X|v2051]], v3082, v4099, [[7.0.0-13|v5120]], [[9.0.0-20|v6144]](Also for [[8.1.0-0_New3DS]]) (EUR v6, v1024, v3082, v4099, [[7.0.0-13|v5120]], [[9.0.0-20|v6144]])
| Same as JPN
| Same as JPN
|-
| 00008E02
| 00009702
| 0000A002
| Notifications (newslist)
| v0, v1029, v2054, v3075, [[9.0.0-20|v4097]] (EUR v6, v1024, v2054, v3075, [[9.0.0-20|v4097]]) (JPN: ..., [[8.1.0-0_New3DS|v4096]], [[9.0.0-20|v5121]])
| Same as JPN
| Same as JPN
|-
| 0000C002
| 0000C802
| 0000D002
| Software Keyboard (swkbd)
| v0, v1026, v2053, [[7.0.0-13|v3072]], [[9.0.0-20|v4096]](Also for [[8.1.0-0_New3DS]])
| Same as JPN
| Same as JPN
|-
| 0000C003
| 0000C803
| 0000D003
| SAFE_MODE Software Keyboard (swkbd)
| v0
| Same as JPN
| Same as JPN
|-
| 2000C003
| 2000C803
| 2000D003
| [[New_3DS]] SAFE_MODE Software Keyboard (swkbd)
| [[8.1.0-0_New3DS|v0]](for JPN this is v1024)
| Same as JPN
| Same as JPN
|-
| 0000C102
| 0000C902
| 0000D102
| appletEd
| v0, v1026, [[9.0.0-20|v2048]](Also for [[8.1.0-0_New3DS]]), [[9.3.0-21|v3077]]
| Same as JPN
| Same as JPN
|-
| 0000C302
| 0000CB02
| 0000D302
| PNOTE_AP (Photo file selector applet, for SD-card/etc?)
| v0, v1024, [[8.1.0-0_New3DS|v2049]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v3075]], [[9.3.0-21|v4096]]
| Same as JPN
| Same as JPN
|-
| 0000C402
| 0000CC02
| 0000D402
| SNOTE_AP (Sound file selector applet, for SD-card/etc?)
| v0, v3, [[8.0.0-18|v1026]], [[9.0.0-20|v2048]](Also for [[8.1.0-0_New3DS]])
| Same as JPN
| Same as JPN
|-
| 0000C502
| 0000C502
| 0000C502
| error (This applet displays networking errors, etc)
| v0, v1026, v2053, v3074, [[8.1.0-0_New3DS|v4096]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v5128]], [[9.6.0-24|v6145]]
| Same as JPN
| Same as JPN
|-
| 0000C503
| 0000C503
| 0000C503
| SAFE_MODE error applet
| v0
| Same as JPN
| Same as JPN
|-
| 2000C503
| 2000C503
| 2000C503
| [[New_3DS]] SAFE_MODE error applet
| [[8.1.0-0_New3DS|v1024]]
| Same as JPN
| Same as JPN
|-
| 0000CD02
| 0000CD02
| 0000CD02
| extrapad ([[Circle Pad Pro]] calibration applet)
| v1, v1026, [[8.1.0-0_New3DS|v2048]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v3073]]
| Same as JPN
| Same as JPN
|-
| 0000C602
| 0000CE02
| 0000D602
| mint. eShop applet, used by applications for accessing the eShop, for DLC/etc. Also used by the eShop application itself.
| v5, v1028, [[4.2.0-9|v2050]], [[5.0.0-11|v3072]], [[7.0.0-13|v4109]], [[7.2.0-17|v5125]](v5123 for JPN), [[8.0.0-18|v6145]], [[8.1.0-0_New3DS|v7168]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v8200]], [[9.3.0-21|v9224]], [[9.6.0-24|v10247]], [[9.8.0-25|v11264]], [[10.0.0-27|v12293]], [[10.1.0-27|v13312]]
| Same as JPN
| Same as JPN
|-
| 0000BC02
| 0000BD02
| 0000BE02
| olv (Miiverse applet)
| [[7.0.0-13|v14]], [[7.2.0-17|v1024]], [[9.0.0-20|v2048]](Also for [[8.1.0-0_New3DS]]), [[9.3.0-21|v3072]], [[9.6.0-24|v4096]]
| Same as JPN
| Same as JPN
|-
| 0000F602
| 0000F602
| 0000F602
| memolib (Uses Miiverse, likely the "system library" for Miiverse)
| [[7.0.0-13|v5]], [[8.1.0-0_New3DS|v1024]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v2050]], [[9.3.0-21|v3072]]
| Same as JPN
| Same as JPN
|-
| 00008302
| 00008B02
| 0000BA02
| solv3 (Miiverse-posting applet)
| [[9.0.0-20|v6]]
| Same as JPN
| Same as JPN
|-
| 00009502
| 00009E02
| 0000B902
| Cabinet ([[amiibo Settings]])
| [[9.3.0-21|v7]], [[9.6.0-24|v1031]]
| Same as JPN
| Same as JPN
|}

Most of these processes are applets, see [[NS_and_APT_Services|here]] for details.

All of the above processes use the "SYSTEM" [[SVC|memory-region]].

The ExeFS for Home Menu is exactly the same for USA/EUR/JPN.

The Miiverse applet seems to use a web browser with webkit.

=== 0004009B - [[NCCH#CFA|System Data Archives]] (Shared Archives) ===
{| class="wikitable" border="1"
|-
! JPN TitleIDLow
! USA TitleIDLow
! EUR TitleIDLow
! Description
! Versions
|-
| 00010202
| 00010202
| 00010202
| Probably Mii-related, contains "CFL_Res.dat" in the RomFS.
| v0
|-
| 00010302
| 00010302
| 00010302
| Doesn't exist on CDN?
| v0, v2052
|-
| 00010402
| 00010402
| 00010402
| Mounted as "area:", contains Country and Region names
| v0, v1024, v2050, v3072, [[7.0.0-13|v4098]], [[9.6.0-24|v5122]]
|-
| 00010502
| 00010502
| 00010502
| Doesn't exist on CDN?
| v0, v1024, v2048
|-
| 00010602
| 00010602
| 00010602
| Non-Nintendo TLS Root-CA Certificates (RomFS contains files with filename "CACERT_PUBLIC_CA_<val>.der", where <val> is 5..8)
| v2
|-
| 00011902
| ?
| ?
| ?
| v0
|-
| ?
| 00011402
| ?
| ?
| v0
|-
| ?
| 00011602
| ?
| ?
| v0
|-
| ?
| 00011D02
| ?
| ?
| v0
|-
| ?
| 00011E02
| ?
| ?
| v0
|-
| ?
| ?
| 00011202
| ?
| v0
|-
| ?
| ?
| 00011302
| ?
| v0
|-
| ?
| ?
| 00011502
| ?
| v0
|-
| ?
| ?
| 00011702
| ?
| v0
|-
| ?
| ?
| 00011802
| ?
| v0
|-
| 00011902
| ?
| ?
| ?
| v0
|-
| ?
| ?
| 00011B02
| ?
| v0
|-
| ?
| ?
| 00011C02
| ?
| v0
|-
| ?
| ?
| 00011D02
| ?
| v0
|-
| ?
| ?
| 00012102
| ?
| v0, v1026, v2051, v3074
|-
| 00012202
| 00012302
| 00012102
| ?contains a lists with error strings
| v1026, v2053, v3073, [[4.2.0-9|v4096]], [[5.0.0-11|v5120]], [[7.0.0-13|v6149]], [[7.2.0-17|v7168]], [[8.0.0-18|v8192]], [[9.0.0-20|v9218]], [[9.3.0-21|v10242]], [[9.6.0-24|v11269]], [[10.0.0-27|v12289]]
|-
| 00013202
| 00013302
| 00013102
| Mounted as "eula:"
| v0, v1024, v2049 USA: v1024, v2051, [[7.0.0-13|v3074]], [[7.2.0-17|v4100]](EUR-only), [[9.0.0-20|v4099]], [[9.9.0-26|v6144]]
|-
| 00014002
| 00014002
| 00014002
| JPN/EUR/USA [[System Font]] ("font:")
| v0
|-
| 00014102
| 00014102
| 00014102
| CHN [[System Font]] ("font:")
| v0, v1024
|-
| 00014202
| 00014202
| 00014202
| KOR [[System Font]] ("font:")
| v0, v1024
|-
| 00014302
| 00014302
| 00014302
| TWN [[System Font]] ("font:")
| v0, v1024
|-
| 00015202
| 00015302
| 00015102
| Mounted as "rate:"
| v0 (EUR: v0, v1024)
|-
| ?
| 00016302
| ?
| ?
| v80
|-
| ?
| 00017302
| ?
| ?
| v3088
|}

=== 000400DB - [[NCCH#CFA|System Data Archives]] ===
These [[NVer]] titleIDs can be found @ offset 0x320 in every [[CCI]].

{| class="wikitable" border="1"
|-
! EUR TitleIDLow
! JPN TitleIDLow
! USA TitleIDLow
! CHN TitleIDLow
! KOR TitleIDLow
! TWN TitleIDLow
! Description
! USA/EUR/JPN Versions
! CHN Versions
! TWN Versions
! KOR Versions
|-
| 00010302
| 00010302
| 00010302
| 00010302
| 00010302
| 00010302
| NGWord bad word list
| [[1.0.0-0|v0]], [[2.0.0-2|v1024]], [[3.0.0-5|v2052]], [[4.0.0-7|v3072]], [[4.3.0-10|v4096]], [[5.0.0-11|v5120]], [[9.0.0-20|v6144]], [[9.3.0-21|v7168]], [[9.6.0-24|v8192]]
| Same as USA
| Same as USA
| Same as USA
|-
| 00010502
| 00010502
| 00010502
| 00010502
| 00010502
| 00010502
| [[Nintendo Zone]] hotspot list
| [[1.0.0-0|v0]], [[2.0.0-2|v1024]], [[3.0.0-5|v2048]], [[4.0.0-7|v3073]], [[4.3.0-10|v4096]], [[4.4.0-10|v5120]], [[4.5.0-10|v6144]], [[5.0.0-11|v7169]], [[6.0.0-11|v8192]], [[6.2.0-12|v9216]], [[7.0.0-13|v10242]], [[7.2.0-17|v11267]], [[8.0.0-18|v12288]], [[9.0.0-20|v14336]], [[9.3.0-21|v15360]], [[9.6.0-24|v16386]], [[10.0.0-27|v17409]]
| Same as USA
| Same as USA
| Same as USA
|-
| 00016102
| 00016202
| 00016302
| 00016402
| 00016502
| 00016602
| [[NVer]]
| [[1.0.0-0|v0]], [[1.1.0-1|v16]], [[2.0.0-2|v32]], [[2.1.0-3|v48]], [[2.1.0-4|v64]], [[3.0.0-5|v80]], [[3.0.0-6|v96]], [[4.0.0-7|v112]], [[4.1.0-8|v128]], [[4.2.0-9|v144]], [[4.3.0-10|v160]], [[5.0.0-11|v176]], non-USA=[[6.0.0-11|v192]]/USA=[[6.1.0-12U|v192]], [[7.0.0-13|v208]], [[7.1.0-14|v224]], [[7.1.0-15|v240]], [[7.1.0-16|v256]], [[7.2.0-17|v272]], [[8.0.0-18|v288]], [[8.1.0-19|v304]], [[9.0.0-20|v320]], [[9.3.0-21|v336]], [[9.5.0-22|v352]], [[9.5.0-23|v368]], [[9.6.0-24|v384]], [[9.7.0-25|v400]], [[9.9.0-26|v416]], [[10.0.0-27|v432]], [[10.2.0-28|v448]]
| [[4.0.0-7|v113]], [[4.2.0-9|v128]], [[5.0.0-11|v129]], [[7.1.0-16|v130]], [[7.2.0-17|v272]], [[9.5.0-23|v131]], [[9.9.0-26|v132]]
| [[4.1.0-8|v114]], [[4.2.0-9|v133]], [[4.3.0-10|v134]], [[5.0.0-11|v136]], [[7.0.0-13|v144]], [[7.1.0-14|v160]] [[7.1.0-16|v192]], [[7.2.0-17|v272]], [[8.0.0-18|v208]], [[8.1.0-19|v224]], [[9.0.0-20|v240]], [[9.5.0-22|v272]], [[9.5.0-23|v288]], [[9.6.0-24|v304]], [[9.7.0-25|v320]], [[9.9.0-26|v336]], [[10.0.0-27|v352]], [[10.2.0-28|v368]]
| [[4.0.0-7|v113]], [[4.1.0-8|v114]], [[4.2.0-9|v133]], [[4.3.0-10|v134]], [[5.0.0-11|v136]], [[7.0.0-13|v160]], [[7.1.0-14|v176]], [[7.1.0-16|v176]], [[7.2.0-17|v272]], [[8.0.0-18|v224]], [[8.1.0-19|v240]], [[9.0.0-20|v256]], [[9.3.0-21|v272]], [[9.5.0-22|v288]], [[9.5.0-23|v304]], [[9.6.0-24|v320]], [[9.7.0-25|v336]], [[9.9.0-26|v352]], [[10.0.0-27|v368]], [[10.2.0-28|v384]]
|-
| 20016102
| 20016202
| 20016302
| N/A
| 20016502
| N/A
| [[New_3DS]] [[NVer]]
| [[8.1.0-0_New3DS|v0]], [[9.0.0-20|v320]], [[9.3.0-21|v336]], [[9.5.0-22|v352]], [[9.5.0-22|v352]], [[9.5.0-23|v368]], [[9.6.0-24|v384]], [[9.7.0-25|v400]], [[9.9.0-26|v416]], [[10.0.0-27|v432]], [[10.2.0-28|v448]]
| N/A
| N/A
| [[9.6.0-24|v320]], [[9.7.0-25|v336]], [[9.9.0-26|v352]], [[10.0.0-27|v368]], [[10.2.0-28|v384]]
|-
| 00017102
| 00017202
| 00017302
| 00017402
| 00017502
| 00017602
| [[CVer]]
| [[1.0.0-0|v1024]], [[1.1.0-1|v1045]], [[2.0.0-2|v2049]], [[2.1.0-3|v2069]], [[2.2.0-X|v2088]] [[3.0.0-5|v3088]], [[4.0.0-7|v4098]], [[4.1.0-8|v4113]], [[4.2.0-9|v4130]], [[4.3.0-10|v4145]], [[4.4.0-10|v4163]], [[4.5.0-10|v4176]], [[5.0.0-11|v5120]], [[5.1.0-11|v5136]], [[6.0.0-11|v6146]], [[6.1.0-11|v6160]], [[6.2.0-12|v6178]], [[6.3.0-12|v6192]], [[7.0.0-13|v7175]], [[7.1.0-14|v7187]], [[7.2.0-17|v7203]], [[8.0.0-18|v8196]], [[8.1.0-18|v8208]], [[8.1.0-0_New3DS|v8215]](8.1.0-0_New3DS), [[9.0.0-20|v9218]], [[9.1.0-20J|v9232]](JPN-only), [[9.2.0-20|v9248]], [[9.3.0-21|v9264]], [[9.4.0-21|v9280]], [[9.5.0-22|v9296]], [[9.6.0-24|v9319]], [[9.7.0-25|v9328]], [[9.8.0-25|v9344]], [[9.9.0-26|v9360]], [[10.0.0-27|v10240]], [[10.1.0-27|v10256]], [[10.2.0-28|v10272]]
| [[1.0.0-0|v1024]], [[1.1.0-1|v1045]], [[2.0.0-2|v2049]], [[2.1.0-3|v2069]], [[2.2.0-X|v2088]] [[3.0.0-5|v3088]], [[4.0.0-7|v4098]], [[4.1.0-8|v4113]], [[4.2.0-9|v4130]], [[4.3.0-10|v4145]], [[4.4.0-10|v4163]], [[4.5.0-10|v4176]], [[5.0.0-11|v5120]], [[5.1.0-11|v5136]], [[6.0.0-11|v6146]], [[6.1.0-11|v6160]], [[6.2.0-12|v6178]], [[6.3.0-12|v6192]], [[7.0.0-13|v7175]], [[7.1.0-14|v7187]], [[7.2.0-17|v7203]], [[8.0.0-18|v8196]], [[8.1.0-18|v8208]], [[9.0.0-20|v9217]], [[9.3.0-21|v9264]], [[9.5.0-22|v9296]], [[9.6.0-24|v9319]], [[9.7.0-25|v9328]], [[9.8.0-25|v9344]], [[9.9.0-26|v9360]], [[10.0.0-27|v10240]], [[10.2.0-28|v10272]]
| Same as CHN
| Same as CHN
|}

=== 00040130 - System [[Services API|Modules]] ===
{| class="wikitable" border="1"
|-
! TitleID Low
! Description
! Versions
|-
| 00001002
| [[Services|sm]] (Stored in [[FIRM|NATIVE_FIRM]])
| v2
|-
| 00001003
| SAFE_MODE [[Services|sm]] (Stored in SAFE_MODE NATIVE_FIRM)
| v2
|-
| 00001102
| [[Filesystem services‎|fs]] (Stored in [[FIRM|NATIVE_FIRM]])
| v2
|-
| 00001103
| SAFE_MODE [[Filesystem services‎|fs]] (Stored in SAFE_MODE NATIVE_FIRM)
| v2
|-
| 00001202
| [[Process Manager Services|pm]] (Stored in [[FIRM|NATIVE_FIRM]])
| v2
|-
| 00001203
| SAFE_MODE [[Process Manager Services|pm]] (Stored in SAFE_MODE NATIVE_FIRM)
| v2
|-
| 00001302
| [[Loader Services‎|loader]] (Stored in [[FIRM|NATIVE_FIRM]])
| v2
|-
| 00001303
| SAFE_MODE [[Loader Services‎|loader]] (Stored in SAFE_MODE NATIVE_FIRM)
| v2
|-
| 00001402
| [[PXI Services‎|pxi]] (Stored in [[FIRM|NATIVE_FIRM]])
| v2
|-
| 00001403
| SAFE_MODE [[PXI Services‎|pxi]] (Stored in SAFE_MODE NATIVE_FIRM)
| v2
|-
| 00001502
| [[Application Manager Services|AM]] ( Application Manager )
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[3.0.0-5|v2053]], [[4.0.0-7|v3072]], [[5.0.0-11|v4098]], [[6.0.0-11|v5120]], [[8.0.0-18|v6148]], [[8.1.0-0_New3DS|v7168]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v8192]], [[10.0.0-27|v9217]]
|-
| 00001503
| SAFE_MODE [[Application Manager Services|AM]]
| [[1.0.0-0|v0]]
|-
| 20001503
| [[New_3DS]] SAFE_MODE [[Application Manager Services|AM]]
| [[8.1.0-0_New3DS|v7169]]
|-
| 00001602
| [[Camera Services|Camera]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[3.0.0-5|v2048]], [[4.0.0-7|v3074]], [[5.0.0-11|v4098]], [[6.0.0-11|v5120]], [[7.1.0-14|v6146]], [[8.0.0-18|v7172]], [[9.0.0-20|v9216]], [[9.3.0-21|v10242]], [[10.0.0-27|v11265]]
|-
| 20001602
| [[New_3DS]] [[Camera Services|Camera]]
| [[8.1.0-0_New3DS|v8200]], [[9.0.0-20|v9218]], [[9.3.0-21|v10242]], [[10.0.0-27|v11265]]
|-
| 00001702
| [[Config Services|Config]] (cfg)
| [[1.0.0-0|v0]], [[2.0.0-2|v1024]], [[3.0.0-5|v2049]], v3072, [[4.0.0-7|v4096]], [[5.0.0-11|v5122]], [[6.0.0-11|v6145]], [[6.1.0-11|v7168]], [[7.0.0-13|v8196]], [[7.2.0-17|v9220]], [[8.0.0-18|v10243]], [[8.1.0-0_New3DS|v11265]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v12290]], [[9.3.0-21|v13315]], [[9.6.0-24|v14342]]
|-
| 00001703
| SAFE_MODE [[Config Services|Config]] (cfg)
| [[1.0.0-0|v0]]
|-
| 20001703
| [[New_3DS]] SAFE_MODE [[Config Services|Config]] (cfg)
| [[8.1.0-0_New3DS|v11265]]
|-
| 00001802
| [[Codec Services|Codec]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[5.0.0-11|v4098]], [[7.0.0-13|v5120]], [[8.0.0-18|v6144]], [[9.0.0-20|v7168]](Also for [[8.1.0-0_New3DS]])
|-
| 00001803
| SAFE_MODE [[Codec Services|Codec]]
| [[1.0.0-0|v0]]
|-
| 20001803
| [[New_3DS]] SAFE_MODE [[Codec Services|Codec]]
| [[8.1.0-0_New3DS|v7169]]
|-
| 00001902
| dmnt, debugger sysmodule. This use devunit-only HIO for devunit<>pc comms. This only exists for development units(launched by NS during startup depending on certain [[Configuration_Memory]] fields' values). This is installed at the [[Factory_Setup|factory]], then later deleted at the factory on retail units.
|
|-
| 00001A02
| [[DSP Services|DSP]]
| [[1.0.0-0|v0]], [[3.0.0-5|v1024]], [[4.0.0-7|v2048]], [[5.0.0-11|v3074]], [[6.0.0-11|v4096]], [[8.0.0-18|v5120]], [[9.7.0-25|v6145]]
|-
| 00001A03
| SAFE_MODE [[DSP Services|DSP]]
| [[1.0.0-0|v0]]
|-
| 20001A03
| [[New_3DS]] SAFE_MODE [[DSP Services|DSP]]
| [[8.1.0-0_New3DS|v6145]]
|-
| 00001B02
| [[GPIO Services|GPIO]]
| [[1.0.0-0|v0]], [[5.0.0-11|v1025]], [[8.0.0-18|v2048]], [[9.5.0-22|v3073]]
|-
| 00001B03
| SAFE_MODE [[GPIO Services|GPIO]]
| [[1.0.0-0|v0]]
|-
| 20001B03
| [[New_3DS]] SAFE_MODE [[GPIO Services|GPIO]]
| [[8.1.0-0_New3DS|v3073]]
|-
| 00001C02
| [[GSP Services|GSP]]
| [[1.0.0-0|v0]], [[1.1.0-1|v1040]], [[2.0.0-2|v2049]], [[3.0.0-5|v3075]], v4098, [[4.0.0-7|v5120]], [[5.0.0-11|v6145]], [[6.0.0-11|v7168]], [[8.0.0-18|v8196]], [[9.0.0-20|v10240]], [[9.3.0-21|v11264]], [[9.6.0-24|v12294]]
|-
| 20001C02
| [[New_3DS]] [[GSP Services|GSP]]
| [[8.1.0-0_New3DS|v10243]], [[9.3.0-21|v11267]], [[9.6.0-24|v12294]]
|-
| 00001C03
| SAFE_MODE [[GSP Services|GSP]]
| [[1.0.0-0|v0]]
|-
| 20001C03
| [[New_3DS]] SAFE_MODE [[GSP Services|GSP]]
| [[8.1.0-0_New3DS|v9217]]
|-
| 00001D02
| [[HID Services|HID]] (Human Interface Devices)
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[5.0.0-11|v5121]], [[7.2.0-17|v6148]], [[8.0.0-18|v7168]], [[8.1.0-0_New3DS|v8192]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v9216]], [[9.3.0-21|v10240]]
|-
| 00001D03
| SAFE_MODE [[HID Services|HID]]
| [[1.0.0-0|v0]]
|-
| 20001D03
| [[New_3DS]] SAFE_MODE [[HID Services|HID]]
| [[8.1.0-0_New3DS|v8193]]
|-
| 00001E02
| [[I2C Services|i2c]]
| [[1.0.0-0|v0]], [[3.0.0-5|v1024]], [[5.0.0-11|v2049]], [[8.0.0-18|v3076]], [[9.3.0-21|v5120]]
|-
| 20001E02
| [[New_3DS]] [[I2C Services|i2c]]
| [[8.1.0-0_New3DS|v4096]], [[9.3.0-21|v5121]]
|-
| 00001E03
| SAFE_MODE [[I2C Services|i2c]]
| [[1.0.0-0|v0]]
|-
| 20001E03
| [[New_3DS]] SAFE_MODE [[I2C Services|i2c]]
| [[8.1.0-0_New3DS|v4097]]
|-
| 00001F02
| [[MCU Services|MCU]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.1.0-3|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4102]], [[5.0.0-11|v5122]], [[6.0.0-11|v6145]], [[7.0.0-13|v7168]], [[8.0.0-18|v8192]]
|-
| 20001F02
| [[New_3DS]] [[MCU Services|MCU]]
| [[8.1.0-0_New3DS|v8192]]
|-
| 00001F03
| SAFE_MODE [[MCU Services|MCU]]
| [[1.0.0-0|v0]]
|-
| 20001F03
| [[New_3DS]] SAFE_MODE [[MCU Services|MCU]]
| [[8.1.0-0_New3DS|v9217]]
|-
| 00002002
| [[MIC Services|MIC]] (Microphone)
| [[1.0.0-0|v0]], [[5.0.0-11|v1025]], [[8.0.0-18|v2048]]
|-
| 00002102
| [[PDN Services|PDN]]
| [[1.0.0-0|v0]], [[5.0.0-11|v1025]], [[8.0.0-18|v2048]]
|-
| 00002103
| SAFE_MODE [[PDN Services|PDN]]
| [[1.0.0-0|v0]]
|-
| 20002103
| [[New_3DS]] SAFE_MODE [[PDN Services|PDN]]
| [[8.1.0-0_New3DS|v3073]]
|-
| 00002202
| [[PTM Services|PTM]] (Play time, pedometer, and battery manager)
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.2.0-X|v2048]], [[3.0.0-5|v3075]], v4096, [[4.0.0-7|v5120]], [[5.0.0-11|v6146]], [[6.0.0-11|v7168]], [[7.0.0-13|v8192]], [[8.0.0-18|v9219]], [[9.6.0-24|v11264]]
|-
| 20002202
| [[New_3DS]] [[PTM Services|PTM]] (Play time, pedometer, and battery manager)
| [[8.1.0-0_New3DS|v10240]], [[9.6.0-24|v11264]]
|-
| 00002203
| SAFE_MODE [[PTM Services|PTM]]
| [[1.0.0-0|v0]]
|-
| 20002203
| [[New_3DS]] SAFE_MODE [[PTM Services|PTM]]
| [[8.1.0-0_New3DS|v10241]]
|-
| 00002302
| [[SPI Services|spi]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[5.0.0-11|v2049]], [[8.0.0-18|v3072]]
|-
| 20002302
| [[New_3DS]] [[SPI Services|spi]]
| [[8.1.0-0_New3DS|v4096]]
|-
| 00002303
| SAFE_MODE [[SPI Services|spi]]
| [[1.0.0-0|v0]]
|-
| 20002303
| [[New_3DS]] SAFE_MODE [[SPI Services|spi]]
| [[8.1.0-0_New3DS|v4097]]
|-
| 00002402
| [[AC Services|AC]] (Network manager)
| [[1.0.0-0|v0]], [[1.1.0-1|v1024]], [[2.0.0-2|v2052]], [[2.1.0-3|v3072]], [[3.0.0-5|v4101]], [[5.0.0-11|v5122]], [[7.0.0-13|v6145]], [[8.0.0-18|v7172]], [[9.0.0-20|v8192]](Also for [[8.1.0-0_New3DS]]), [[9.3.0-21|v9216]]
|-
| 00002403
| SAFE_MODE [[AC Services|AC]]
| [[1.0.0-0|v0]]
|-
| 20002403
| [[New_3DS]] SAFE_MODE [[AC Services|AC]]
| [[8.1.0-0_New3DS|v8193]]
|-
| 00002602
| [[CECD Services|Cecd]] (StreetPass)
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.2.0-X|v2048]], [[3.0.0-5|v3073]], [[4.0.0-7|v4097]], [[5.0.0-11|v5122]], [[6.0.0-11|v6144]], [[6.2.0-12|v7170]], [[7.0.0-13|v8193]], [[8.0.0-18|v9216]], [[9.0.0-20|v10240]]
|-
| 00002702
| [[CSND Services|CSND]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[4.0.0-7|v2048]], [[5.0.0-11|v3073]], [[8.0.0-18|v4096]], [[9.0.0-20|v5120]]
|-
| 00002703
| SAFE_MODE [[CSND Services|CSND]]
| [[1.0.0-0|v0]]
|-
| 20002703
| [[New_3DS]] SAFE_MODE [[CSND Services|CSND]]
| [[8.1.0-0_New3DS|v5121]]
|-
| 00002802
| [[DLP Services|DLP]] ([[Download Play]])
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.2.0-X|v2048]], [[3.0.0-5|v3078]], [[5.0.0-11|v4099]], [[8.0.0-18|v5123]], [[9.0.0-20|v6145]](Also for [[8.1.0-0_New3DS]]), [[9.6.0-24|v7174]], [[10.0.0-27|v8192]]
|-
| 00002902
| [[HTTP Services|HTTP]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.1.0-3|v2049]], [[2.2.0-X|v3072]], [[3.0.0-5|v4099]], [[4.0.0-7|v5122]], [[5.0.0-11|v6145]], [[7.0.0-13|v7171]], [[7.1.0-14|v8192]], [[8.0.0-18|v9220]], [[8.1.0-18|v10245]], [[8.1.0-0_New3DS|v11264]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v12288]], [[9.6.0-24|v13318]]
|-
| 00002903
| SAFE_MODE [[HTTP Services|HTTP]]
| [[1.0.0-0|v0]]
|-
| 20002903
| [[New_3DS]] SAFE_MODE [[HTTP Services|HTTP]]
| [[8.1.0-0_New3DS|v10241]]
|-
| 00002A02
| [[MP Services|MP]]
| [[1.0.0-0|v0]], [[5.0.0-11|v1025]], [[8.0.0-18|v2048]]
|-
| 00002A03
| SAFE_MODE [[MP Services|MP]]
| [[1.0.0-0|v0]]
|-
| 00002B02
| [[NDM Services|NDM]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[3.0.0-5|v2049]], [[4.0.0-7|v3072]], [[5.0.0-11|v4098]], [[8.0.0-18|v5124]], [[8.1.0-0_New3DS|v6144]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v7169]]
|-
| 00002C02
| [[NIM Services|NIM]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1028]], [[3.0.0-5|v2055]], [[4.0.0-7|v3074]], [[5.0.0-11|v4100]], [[6.0.0-11|v5120]], [[7.0.0-13|v6148]], [[7.2.0-17|v7174]], [[8.0.0-18|v8195]], [[8.1.0-0_New3DS|v9217]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v10249]], [[9.3.0-21|v11267]], [[9.6.0-24|v12296]], [[10.0.0-27|v13313]]
|-
| 00002C03
| SAFE_MODE [[NIM Services|NIM]]
| [[1.0.0-0|v0]]
|-
| 20002C03
| [[New_3DS]] SAFE_MODE [[NIM Services|NIM]]
| [[8.1.0-0_New3DS|v9217]]
|-
| 00002D02
| [[NWM Services|NWM]] ( Low-level wifi manager )
| [[1.0.0-0|v0]], [[1.1.0-1|v1024]], [[2.0.0-2|v2052]], [[2.2.0-X|v3072]], [[3.0.0-5|v4101]], [[4.0.0-7|v5120]], [[5.0.0-11|v6148]], [[6.0.0-11|v7169]], [[7.2.0-17|v8196]], [[8.0.0-18|v9216]], [[9.0.0-20|v10240]]
|-
| 00002D03
| SAFE_MODE [[NWM Services|NWM]]
| [[1.0.0-0|v0]], [[6.0.0-11|v5120]]
|-
| 20002D03
| [[New_3DS]] SAFE_MODE [[NWM Services|NWM]]
| [[8.1.0-0_New3DS|v10241]]
|-
| 00002E02
| [[Socket Services|Sockets]]
| [[1.0.0-0|v0]], [[1.1.0-1|v1024]], [[2.0.0-2|v2053]], [[3.0.0-5|v3075]], [[4.0.0-7|v4096]], [[5.0.0-11|v5121]], [[8.0.0-18|v6144]], [[9.0.0-20|v7168]]
|-
| 00002E03
| SAFE_MODE [[Socket Services|Sockets]]
| [[1.0.0-0|v0]]
|-
| 20002E03
| [[New_3DS]] SAFE_MODE [[Socket Services|Sockets]]
| [[8.1.0-0_New3DS|v7169]]
|-
| 00002F02
| [[SSL Services|SSL]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1024]], [[2.1.0-3|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[5.0.0-11|v5122]], [[8.0.0-18|v6144]], [[9.0.0-20|v7168]], [[9.6.0-24|v8198]]
|-
| 00002F03
| SAFE_MODE [[SSL Services|SSL]]
| [[1.0.0-0|v0]]
|-
| 20002F03
| [[New_3DS]] SAFE_MODE [[SSL Services|SSL]]
| [[8.1.0-0_New3DS|v7169]]
|-
| 00003102
| [[Process Services‎|PS]] ( Process Manager )
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[5.0.0-11|v2049]], [[6.0.0-11|v3072]], [[8.0.0-18|v4096]], [[9.0.0-20|v5120]]
|-
| 00003103
| SAFE_MODE [[Process Services‎|PS]]
| [[1.0.0-0|v0]]
|-
| 20003103
| [[New_3DS]] SAFE_MODE [[Process Services‎|PS]]
| [[8.1.0-0_New3DS|v5121]]
|-
| 00003202
| [[Friend Services‎|friends]] (Friends list)
| [[1.0.0-0|v0]], [[2.0.0-2|v1028]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[5.0.0-11|v5122]], [[7.0.0-13|v6145]], [[8.0.0-18|v7172]], [[9.0.0-20|v8192]](Also for [[8.1.0-0_New3DS]])
|-
| 00003203
| SAFE_MODE [[Friend Services‎|friends]] (Friends list)
| [[1.0.0-0|v0]]
|-
| 20003203
| [[New_3DS]] SAFE_MODE [[Friend Services‎|friends]] (Friends list)
| [[8.1.0-0_New3DS|v8193]]
|-
| 00003302
| [[IR Services‎|IR]] (Infrared)
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[5.0.0-11|v5121]], [[8.0.0-18|v6148]], [[8.1.0-0_New3DS|v7170]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v8192]], [[9.3.0-21|v9216]], [[9.6.0-24|v10246]], [[10.0.0-27|v11265]]
|-
| 00003303
| SAFE_MODE [[IR Services‎|IR]]
| [[1.0.0-0|v0]]
|-
| 20003303
| [[New_3DS]] SAFE_MODE [[IR Services‎|IR]]
| [[8.1.0-0_New3DS|v7169]]
|-
| 00003402
| [[BOSS Services‎|BOSS]] (SpotPass)
| [[1.0.0-0|v0]], [[1.1.0-1|v1024]], [[2.0.0-2|v2053]], [[2.2.0-X|v3073]], [[3.0.0-5|v4101]], [[4.0.0-7|v5122]], [[5.0.0-11|v6146]], [[6.0.0-11|v7169]], [[6.2.0-12|v8193]], [[7.0.0-13|v9222]], [[8.0.0-18|v10240]], [[9.0.0-20|v11266]], [[10.0.0-27|v12289]]
|-
| 00003502
| [[News Services‎|News]] (Notifications)
| [[1.0.0-0|v0]], [[2.0.0-2|v1028]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[5.0.0-11|v4097]], [[8.0.0-18|v5120]], [[9.0.0-20|v6147]], [[9.7.0-25|v7168]]
|-
| 00003602
| This only exist for development units(launched by NS during startup depending on certain [[Configuration_Memory]] fields' values).
|
|-
| 00003702
| [[RO_Services|RO]]
| [[2.0.0-2|v0]], [[4.0.0-7|v1024]], [[5.0.0-11|v2049]], [[7.2.0-17|v3074]], [[8.0.0-18|v4096]], [[9.0.0-20|v5120]](Also for [[8.1.0-0_New3DS]]), [[9.3.0-21|v6148]]
|-
| 00003802
| [[ACT Services‎|act]] (handles Nintendo Network '''a'''c'''c'''oun'''t'''s)
| [[7.0.0-13|v1029]], [[7.1.0-14|v2050]], [[7.2.0-17|v3077]], [[8.0.0-18|v4099]], [[8.1.0-0_New3DS|v5120]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v6144]], [[9.3.0-21|v7168]], [[9.6.0-24|v8198]]
|-
| 00004002
| Old3DS [[NFC_Services|nfc]]
| [[9.3.0-21|v2053]], [[9.6.0-24|v4106]], [[9.7.0-25|v5121]], [[10.0.0-27|v6145]]
|-
| 20004002
| [[New_3DS]] [[NFC_Services|nfc]]
| [[8.1.0-0_New3DS|v0]], [[9.0.0-20|v1024]], [[9.3.0-21|v2053]], [[9.5.0-22|v3073]], [[9.6.0-24|v4102]], [[10.0.0-27|v6145]]
|-
| 20004102
| [[New_3DS]] [[MVD Services|mvd]]
| [[8.1.0-0_New3DS|v0]], [[9.0.0-20|v1024]]
|-
| 20004202
| [[New_3DS]] [[QTM Services|qtm]]
| [[8.1.0-0_New3DS|v8]], [[9.0.0-20|v1024]], [[9.3.0-21|v2052]]
|-
| 00008002
| [[NS]] (Memory-region: "SYSTEM")
| [[1.0.0-0|v0]], [[2.0.0-2|v1028]], [[2.2.0-X|v2048]], [[3.0.0-5|v3077]], v4096, [[4.0.0-7|v5121]], [[5.0.0-11|v6148]], [[5.1.0-11|v7168]], [[6.0.0-11|v8193]], [[6.1.0-11|v9216]], [[7.0.0-13|v10248]], [[7.2.0-17|v11268]], [[8.0.0-18|v12291]], [[8.1.0-0_New3DS|v13312]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v14336]], [[9.3.0-21|v15360]], [[9.6.0-24|v16390]], [[9.8.0-25|v17408]], [[10.0.0-27|v18433]]
|-
| 00008003
| SAFE_MODE [[NS]] (Memory-region: "SYSTEM")
| [[1.0.0-0|v0]]
|-
| 20008003
| [[New_3DS]] SAFE_MODE [[NS]] (Memory-region: "SYSTEM")
| [[8.1.0-0_New3DS|v13313]]
|}

Once Home Menu finishes loading, all of the above system modules are running, except for MP, RO, and act which are automatically [[Process_Manager_Services|loaded]] when a process requires them. When [[Process_Manager_Services|PM]]-module terminates processes, it will check whether the processes listed as dependencies for this process are listed as dependencies for other processes. Any processes which are no longer listed in any processes dependencies lists are then terminated. On [[New_3DS]], the only New3DS-specific system-module which automatically gets loaded during system boot is qtm.

All of the above system modules use the "BASE" [[SVC|memory-region]](specified in the exheader), except when listed otherwise for certain modules.

When handling the exheader dependency list starting with [[8.0.0-18]], Old3DS FIRM [[Process_Manager_Services|PM]]-module now skips handling titles in this list which have any bits in programID-low bitmask 0xF0000000 set(with [[8.0.0-18]] this is hard-coded). The exheader dependency list handling change is for the [[New 3DS]] system-module(s), which do not exist on Old3DS. When the New3DS pm-module is launching any title except [[NS]], it first attempts to launch the title with programID-low bitmask 0x20000000 set, then with that bitmask clear if launching fails.

=== 00040138 - [[FIRM|System Firmware]] ===
NATIVE_FIRM and SAFE_MODE_FIRM for the initial versions are exactly the same, besides [[Configuration_Memory|core-version]] fields. SAFE_MODE_FIRM is used for running SAFE_MODE titles, on retail SAFE_MODE_FIRM seems to be only used for running the [[System_Settings#System_Updater|System Updater]] application. When a GBA VC title is launched, AGB_FIRM is launched to handle running this title. GBA VC savegames stored under SD card /title/<TID>/data use a custom format, this is handled by AGB_FIRM.

{| class="wikitable" border="1"
|-
! TitleID Low
! Description
! USA/EUR/JPN Versions
! CHN Versions
! KOR Versions
! TWN Versions
|-
| 00000001
| Unknown, very similar to SAFE_MODE_FIRM. Exists only on dev units and seems to only be used by SystemUpdaters.
| v0
|
|
|
|-
| 00000002
| NATIVE_FIRM (Native Firmware)
| [[1.0.0-0|v432]], [[1.1.0-1|v1472]], [[2.0.0-2|v2516]], [[2.1.0-3|v3553]], [[2.2.0-X|v4595]], [[3.0.0-5|v5647]], [[4.0.0-7|v6677]], [[4.1.0-8|v7712]], [[5.0.0-11|v8758]], [[5.1.0-11|v9792]], [[6.0.0-11|v10833]], [[6.1.0-11|v11872]], [[7.0.0-13|v12916]], [[7.2.0-17|v13956]], v15043, [[8.0.0-18|v15047]], [[9.0.0-20|v17120]], [[9.3.0-21|v18182]], [[9.5.0-22|v19216]], [[9.6.0-24|v20262]], [[10.0.0-27|v21288]], [[10.2.0-28|v22313]]
| Same as USA/EUR/JPN starting with the USA/EUR/JPN [[4.0.0-7]] title-version
| Same as CHN.
| Same as CHN.
|-
| 20000002
| [[New_3DS]] NATIVE_FIRM (Native Firmware)
| [[8.1.0-0_New3DS|v16085]], [[9.0.0-20|v17120]], [[9.3.0-21|v18182]], [[9.5.0-22|v19218]], [[9.6.0-24|v20262]], [[10.0.0-27|v21288]], [[10.2.0-28|v22313]]
| N/A
| Same as CHN.
| Same as CHN.
|-
| 00000003
| SAFE_MODE_FIRM
| [[1.0.0-0|v432]], [[3.0.0-5|v5632]]
| Same as USA/EUR/JPN starting with the USA/EUR/JPN [[3.0.0-5]] title-version
| Same as CHN.
| Same as CHN.
|-
| 20000003
| [[New_3DS]] SAFE_MODE_FIRM
| [[8.1.0-0_New3DS|v16081]]
| N/A
| Same as CHN.
| Same as CHN.
|-
| 00000102
| TWL_FIRM ( DSi Firmware )
| [[1.0.0-0|v432]], [[2.0.0-2|v1489]], [[3.0.0-5|v2565]], v3601, [[4.0.0-7|v4625]], [[4.4.0-10|v5681]], [[4.5.0-10|v6704]], [[6.0.0-11|v7762]], [[6.2.0-12|v8817]]
| Same as USA/EUR/JPN starting with the USA/EUR/JPN [[4.0.0-7]] title-version
| Same as CHN.
| Same as CHN.
|-
| 20000102
| [[New_3DS]] TWL_FIRM ( DSi Firmware )
| [[8.1.0-0_New3DS|v9936]]
| N/A
| Same as CHN.
| Same as CHN.
|-
| 00000202
| AGB_FIRM ( GBA Firmware )
| [[3.0.0-5|v519]], v1553, [[4.0.0-7|v2576]], [[6.0.0-11|v3665]]
| [[4.0.0-7|v2576]]
| [[4.0.0-7|v2576]], [[6.0.0-11|v3665]]
| Same as CHN.
|-
| 20000202
| [[New_3DS]] AGB_FIRM ( GBA Firmware )
| [[8.1.0-0_New3DS|v4816]]
| N/A
| N/A
| N/A
|}

== TWL System Titles ==

{| class="wikitable" border="1"
|-
! Content Category
! Bit Mask(s)
! Category Bit Mask
|-
| System Application
| TWL<nowiki>|</nowiki>0x1<nowiki>|</nowiki>0x4
| 0x8005
|-
| System Archive
| TWL<nowiki>|</nowiki>0x1<nowiki>|</nowiki>0x2<nowiki>|</nowiki>0x4<nowiki>|</nowiki>0x8
| 0x800F
|}
Bitmask 0x1 for TWL titles determines whether the title will be updated during a System Update.

=== 00048005 - System Applications===
{| class="wikitable" border="1"
|-
! TitleID Low
! Region
! Description
! Versions
! Information
|-
| 42383841(B88A)
| ALL
| [[DS Internet]]
| v0, [[2.1.0-4|v1025]], [[3.0.0-5|v2048]]
| [[DS Internet]] is the DSi-mode application launched by [[System Settings]] for setting TWL wifi configuration.
|-
| 484E4441(HNDA)
| ALL
| [[Download Play]]
| v1024
| This [[Download Play]] application is the DS-mode Download Play client, launched by the 3DS-mode Download Play application.
|-
| 484E4443(HNDC)
| CHN
| [[Download Play]]
| v1024
| See Above Description.
|-
| 484E444B(HNDK)
| KOR
| [[Download Play]]
| v1024
| See Above Description.
|}

=== 0004800F - System Data Archives===
{| class="wikitable" border="1"
|-
! TitleID Low
! Description
! Versions
|-
| 484E4841(HNHA)
| [[Nintendo DS Cart Whitelist]]
| v0, [[2.0.0-2|v1026]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[4.2.0-9|v5120]], [[4.3.0-10|v6145]], [[4.4.0-10|v7168]], [[4.5.0-10|v8192]], [[5.0.0-11|v9216]], [[6.0.0-11|v10240]], [[7.0.0-13|v11264]]
|-
| 484E4C41(HNLA)
| [[Version Data]]
| v0
|}

New system updates only block DS flash-cards when the above whitelist was updated, or when TWL_FIRM was updated. The whitelist contains the data used for detecting flash-cards, this is used by TWL_FIRM.

== Application Titles ==
{| class="wikitable" border="1"
|-
! Content Category
! Bit Mask(s)
! Category Bit Mask
|-
| [[Title list/eShop Titles|Application]] (eShop Title)
| Normal
| 0x0000
|-
| DLP Child
| DlpChild
| 0x0001
|-
| [[EShop Demos|Demo]]
| Demo
| 0x0002
|-
| [[Title list/Patches|Patch]]
| CannotExecution<nowiki>|</nowiki>Patch
| 0x000E
|-
| [[Title list/DLC|Add-on Content]] (DLC)
| NotRequireRightForMount<nowiki>|</nowiki>CannotExecution<nowiki>|</nowiki>AddOnContents
| 0x008C
|}

=== 00040001 - [[Download Play]] Titles ===
This titleID-high/programID-high is used for the titles sent over [[Download Play]]. Only one 00040001 Download Play title is installed to NAND /title at a time. There can be a maximum of 255 Download Play child titles per Unique ID, indexed by Title ID Variation. The legal index range: 0x0 - 0xff.

== TWL Application Titles ==
{| class="wikitable" border="1"
|-
! Content Category
! Bit Mask(s)
! Category Bit Mask
|-
| Application (DSiWare)
| TWL<nowiki>|</nowiki>0x4
| 0x8004
|}

=== 00048004 - DSiWare ===
Although these have a titleID high separate from DSi and a titleID is stored in the SRLs, the content of these SRLs are identical to DSi.

{| class="wikitable" border="1"
|-
! TitleID Low
! Region
! Description
! Versions
|-
| 4B4B5456(KKTV)
| EUR
| Cut the Rope
| v0, v64
|-
| 4B4E5256(KNRV)
| EUR
| A Little Bit of... Brain Training™: Maths Edition
| v0
|-
| 4B5A4C56(KZLV)
| EUR
| Plants vs. Zombies™
| v0
|-
| 4B454256(KEBV)
| EUR
| ELECTROPLANKTON (Hanenbow)
| v0
|-
| 4B513956(KQ9V)
| EUR
| Zelda: Four Swords Anniversary Edition
| v16
|-
| 4B574256(KWBV)
| EUR
| Mario Calculator
| v0
|-
| 4B574656(KWFV)
| EUR
| Mario Clock
| v0
|}

User:EdwardDer

2013-07-26T04:51:07Z

Syphurith: oh right, just use no words that may be specified automatically. yeah hey s*am

Talk:3DS System Flaws

2013-07-18T04:16:31Z

Syphurith: well ok but you may need to ask him yourself

I have a way to freeze the 3DS which might be exploitable - see [[Talk:Internet Browser]]. [[User:R4wrz0rz0r|R4wrz0rz0r]] 14:59, 20 June 2011 (CEST)
: That crash isn't exploitable unless you're extremely lucky. Don't waste your time. --[[User:Luigi2us|Luigi2us]] 20:44, 15 August 2011 (CEST)

It is not so bad to looking for buffer overflow.
But try to know about file system is more important.

And we do not know enough about CCI,... formats to write an exploit with a loader which loads an executable file!
Maybe we should try to make a savegame exploit...

Yeah, yeah, great hacking plans, kids. What are you going to do once you find a buffer overflow? Blindly write stuff to memory hoping to hit the PICA200 registers someday? Quit wasting your time with buffer overflows. Come back when more is known. --[[User:Luigi2us|Luigi2us]] 20:42, 15 August 2011 (CEST)

How would you write a 3DS Exploit, Luigi2us?

We should ask Neimod to use his RAM dumping setup to see where link's name is in OOT:3D. If it is not properly limited, and is near the regions the console executes next, we might be able to get a buffer overflow exploit. We should try to get a way to do a system exploit ASAP with this method
--[[User:Alex theman|Alex theman]] 16:00, 15 July 2013 (CEST)
:Dear iirc, neimod use RAM modfication not exploit, and yellow use exploit. --snip-- --[[User:Syphurith|Syphurith]] 06:29, 16 July 2013 (CEST)
I know that and we should see what would happen, '''if''' we could get this exploit running. And by the way you are really mentally handicapped and should not be posting on this wiki period. Third, [http://tvtropes.org/pmwiki/pmwiki.php/Main/CowboyBebopAtHisComputer your a cowboy bebop at his computer]. And I have been on the sega fourms and i know this BS like the back of my hand. Go on the Sega fourm now!. Before you get banned! For stupidity!
:Orz. All okey. If you are hurted, take my apologize. I'm not wanting to hurt anyone, so not knowing why you're getting angry. Also i would take no more interests in that gateway (at least before anyone confirmed that).
:*Buffer overflow is somewhat difficult for ARM executables since there is no-execution flags. So yellow's is ROP.
:*If you think you're very powerful to get new progress just contact him on IRC not here (he merely be here). Also that is your idea that a RAM dump may help so please ask him yourself.
:*Always be calm. This wiki is not a site for querrals - So if you think i'm wrong OK i'm wrong.
:>>Head back to continue MSIL hacking.. Have a good time here.--[[User:Syphurith|Syphurith]] 08:16, 18 July 2013 (CEST)

Talk:3DS System Flaws

2013-07-16T02:29:44Z

Syphurith: Oh dear you may learn ARM disassembly and Reverse Engineering first.

I have a way to freeze the 3DS which might be exploitable - see [[Talk:Internet Browser]]. [[User:R4wrz0rz0r|R4wrz0rz0r]] 14:59, 20 June 2011 (CEST)
: That crash isn't exploitable unless you're extremely lucky. Don't waste your time. --[[User:Luigi2us|Luigi2us]] 20:44, 15 August 2011 (CEST)

It is not so bad to looking for buffer overflow.
But try to know about file system is more important.

And we do not know enough about CCI,... formats to write an exploit with a loader which loads an executable file!
Maybe we should try to make a savegame exploit...

Yeah, yeah, great hacking plans, kids. What are you going to do once you find a buffer overflow? Blindly write stuff to memory hoping to hit the PICA200 registers someday? Quit wasting your time with buffer overflows. Come back when more is known. --[[User:Luigi2us|Luigi2us]] 20:42, 15 August 2011 (CEST)

How would you write a 3DS Exploit, Luigi2us?

We should ask Neimod to use his RAM dumping setup to see where link's name is in OOT:3D. If it is not properly limited, and is near the regions the console executes next, we might be able to get a system exploit. We should try to get a way to do a system exploit ASAP with this method
--[[User:Alex theman|Alex theman]] 16:00, 15 July 2013 (CEST)
:Dear iirc, neimod use RAM modfication not exploit, and yellow use exploit. You can never fully trust a person that you haven't seen (even you're all friends) so i think that would be impossible to ask one share one thing that makes him noble (yeah who you are is never so clear dear. BTW, Something is considered to be licensed and can not share with you legally -- yeah ie fundraiser's SEM image). I don't think neimod can give you such a thing. If not believed try contact him on IRC. Even i do consider if there is exploit that still accessible in Gateway-3ds (that is "we are exploits based" interested me).--[[User:Syphurith|Syphurith]] 06:29, 16 July 2013 (CEST)

User:Pistatimento

2013-07-16T02:22:46Z

Syphurith: Dear LoganA: use no Undo but Edit and with not special reason to disable the auto s**m detection

User:MelindaCh

2013-07-13T00:37:41Z

Syphurith: well i am a little bored of writing those summaries for cleaning *ot

User:EricaMays

2013-07-09T23:29:11Z

Syphurith: you should know why i marked this page.

User:Florentin

2013-07-08T22:36:47Z

Syphurith: well this is that - you know. or please check the history page

User talk:Yellows8

2013-07-04T22:38:39Z

Syphurith: append+

Thanks for clearing that up about the free space on the "TWL", what confused me about the name was how the dev unit handled ds games. You know how the 3ds's code name is CTR(we don't know what that stands for yet) and the ds's code name is NTR which mean Nitro. When a 3DS game is inserted, the dev menu says a "CTR CARD" is inserted, but when a DS game is inserted it says a "TWL CARD" is inserted instead of what I expected which would be "NTR CARD". I still do not understand this. - 3dsguy
:DS=NTR, DSLite=USG (japanese for thin..), DSi=TWL(Twelve), DSiXL=UTL, 3DS=CTR... DS (on the 3DS) is usually associated with DSi.. --[[User:Elisherer|Elisherer]] 02:32, 19 October 2011 (CEST)
::3dsguy, that game you inserted was released *long* before DSi right?(also, sign your comments with the signature button) --[[User:Yellows8|Yellows8]] 04:02, 19 October 2011 (CEST)
:Elisherer thanks for clearing that up :).--[[User:3dsguy|3dsguy]] 09:46, 19 October 2011 (CEST)
::Yellows8, no that game was not, but just now i tryed it with a game released in 2006 and it still said 'TWL CARD', but what Elisherer said explained this.--[[User:3dsguy|3dsguy]] 09:46, 19 October 2011 (CEST)

:DS = NTR/Nitro
:DSi = TWL/Twilight
:3DS = CTR/Horizon
:Wii = RVL/Revolution

:Yellows8 - if you have DS/Nitro code running on a DSi system, can you escalate to DSi/TWL mode or load a TWL/DSi binary or similar. [[User:Jl12|Jl12]]
::No, that's impossible. When DSi launcher/sysmenu switches to DS-mode, launcher clears the MSB of a DSi register disabling access to the registers controlling what hw is enabled and the clock rate etc. Once those regs are disabled, it's impossible to re-enable them again without resetting the system via I2C etc.(Also, by the time any exploited title is running homebrew code, those regs are already disabled too.) --[[User:Yellows8|Yellows8]] 19:53, 7 November 2011 (CET)
: Is the NAND encrypted as it is on 3DS? Also, does DSi use DLP [for TWL games] at all? [[User:Jl12|Jl12]]
::Yes, DSi NAND is encrypted with AES-CTR. DSiWare uses download-play but the WMB/dlp binaries are DS-mode only.--[[User:Yellows8|Yellows8]] 06:27, 14 November 2011 (CET)

@Yellows8 - I'm sorry for asking this so late, but what does NUS stand for in this context "redistributing copyrighted content, in this case NUS content, is *not* allowed here.". I do not understand why you deleted my page: [[Update Data|Update Data]]
:NUS = Nintendo Update Servers. Those archive(s) you linked to contained files you downloaded from NUS, all of which are copyrighted. Besides, mirroring NUS content without any decryption done at all is *completely* pointless. --[[User:Yellows8|Yellows8]] 16:41, 12 December 2011 (CET)
::So would it be better to provide update logs, so it can point people to which update data is from which version as on the NUS the individual update data for each title is not stored the same way for all titles, providing people with further reference, so they know what they are using. You may ask me what would they use them for, they are still not decrypted and therefore pointless. ATM knowing which version is which on the NUS *maybe* very important, but I can't tell you more until later.--[[User:3dsguy|3dsguy]] 01:19, 13 December 2011 (CET)
:::Yeah a list of titleIDs and versions would be fine. One could grab that info from [[Title_list]] diffs, but that's not the best way to handle this. I have lists of updated titles for each 3DS system update, but of course I never bothered to document which version was from what sysupdate beyond just adding them to the title list page.(obtained from their system update SOAP) --[[User:Yellows8|Yellows8]] 02:20, 13 December 2011 (CET)

@Yellows8 - Thanks for your progress everyday, really. i have questions.. If feeling uneasy please tell me politely (and i will remove these).
* Would you need a tool that can use specified patterns to mark the decrypted binary (certainly it can not be perfect) ? Or have you find a disassembler so powerful that you don't need that a tool any more? please tell me. if that is useful, let me and my friend make that.
:The tool would have such ability in resolving the configuration file. Comment, Include, CmdID (with no params), CmdID (with specified params), CmdID (with no specified params). such as 80001000:0103:4,0102:4,Any:4. (ie this can mark 800010000102 out as a second type).
* Just curious. It has been a long time since neimod's latest update. Have you got a board from him, or you are only using the exploit (not with the board). If the board is helpful, is there any access to get/purchase one? (if no i think i should learn how to diy one then)
it seems to be a long time for you to do all the documentations by yourself. (Orz i forgot my suggestion) --[[User:Syphurith|Syphurith]] 02:35, 15 April 2013 (CEST)
:I don't have any 3DS ramhaxx, I use software savegame haxx of course. "is there any access to get/purchase one? (if no i think i should learn how to diy one then)" You should be asking neimod about that instead, but [https://secure.flickr.com/photos/neimod/6238747088/in/photostream the] [https://secure.flickr.com/photos/neimod/6212627980/in/photostream soldering] for 3DS ramhaxx would be *really* difficult. I'm not sure what you mean regarding that tool either, are you referring to a tool which would locate the code for service commands in a binary? --[[User:Yellows8|Yellows8]] 03:10, 15 April 2013 (CEST)
::Thanks for reply. I will try to contact him for boards. About the tool --sniff--.
::* Cons: can not detect structures; may make mistake; need configuration file (can be made by writing the header code)
::* Pros: can visually color the matched patterns; can load unlimited size of file (result will be divided into segments of 1MB or other)
::It would not be too difficult to make. However may take one or two weeks. --[[User:Syphurith|Syphurith]] 03:49, 15 April 2013 (CEST)
:::I have no need for a tool which searches for service commandIDs, when I can just search for commandIDs etc in my text-editor for disassembled code. --[[User:Yellows8|Yellows8]] 04:04, 15 April 2013 (CEST)
::::Well thanks for reply. I removed the details above. I will left it undone. Have a good day.--[[User:Syphurith|Syphurith]] 04:21, 15 April 2013 (CEST)
I've seen there are users without contributions flew in. There are even some guys cheating (or just making jokes) with your names.. What's your opinion about that? PS3Brew is blocking those without edits (daily). --[[User:Syphurith|Syphurith]] 17:03, 17 April 2013 (CEST)
:I don't care much about either,(neither of those fake accounts were used to edit anything at least) I'm not an admin here though. --[[User:Yellows8|Yellows8]] 17:36, 17 April 2013 (CEST)

Hello Yellows8,
I have a question regarding the release of the hack. You guys said, that you won't release it, because it is very easy to patch. Now the new firmware was released and in fact the exploit was patched. So releasing it now wouldn't change anything, because Nintendo already patched it.

But if you release it now, people could start develloping homebrew and when you guys find a new exploit for the new firmware, we would already have a good base of homebrew applications.

So why still hiding it from the world?

Best regards and thank you for your work

elBirx
:"the exploit was patched" Only the code execution haxx was [[5.0.0-11|fixed]], the savegame haxx was not fixed. "But if you release it now, people could start develloping homebrew" No, currently it's '''only''' useful for reverse engineers. Almost everyone that wants that savegame haxx would have no use for it right now, since "it's '''only''' useful for reverse engineers". --[[User:Yellows8|Yellows8]] 18:46, 21 April 2013 (CEST)
::So i do think only one that want to do Reverse engineering and do have skills in ARM disassembly can ask you for such a thing. Yellows8, what would i need to learn if i want to analyse those (taken ARM references in consideration)? --[[User:Syphurith|Syphurith]] 03:07, 22 April 2013 (CEST)
:::What are you referring to by "those"? --[[User:Yellows8|Yellows8]] 04:26, 22 April 2013 (CEST)
::::I'm so sorry for my poor expression skill. If i want to analyse the ram or anything that you used as a material.. Exefs is ARM code so i think to check those (you can get using exploit/haxx) need arm knowledges. i mean, that is those service APIs. you did say you can check disassembled code. Even i don't know what is left to be done. --[[User:Syphurith|Syphurith]] 07:31, 22 April 2013 (CEST)
:::::"what would i need to learn..." You could learn to read/write ARM assembly, and learn reverse engineering. --[[User:Yellows8|Yellows8]] 07:38, 22 April 2013 (CEST)
::::::Thanks. Confirmed~ That's clear to me now. --[[User:Syphurith|Syphurith]] 11:53, 22 April 2013 (CEST)

Eh. Yellows8, i got some n00b questions about the ARM execution.

There is non-executable sections in the memory layout, but where did these "This can be executed" flags got initialized (I mean that is made of hardware circuits or bios or other software section)? If that is not changable, would all those ARM cores use the same non-execution flags settings(possibly no so we may change the core to keep that work?). Even more, can we sniffer the data app to core and change its execution length then inject.

Also, is there any method to let the core execute those commands (that you detected) and use that to produce something you interested in?
:The ARM11 kernel [[Memory_layout#ARM11_User-land_memory_regions|initializes]] the MMU tables. "Also, is there any method to let the core execute those commands (that you detected) and use that to produce something you interested in?" By running code on a 3DS of course. --[[User:Yellows8|Yellows8]] 17:27, 17 June 2013 (CEST)
::Thanks. But still feeling strange of that strategy. I think at least the Home Menu may be able to re-map or deactive this mark.
::-snip- Sorry for being noob (i would try learning arm soon). Hope you good work.--[[User:Syphurith|Syphurith]] 02:46, 19 June 2013 (CEST)

Home Menu starts application processes via [[NS]], terminating and "suspending" process execution(the process is still running with that, the application threads wait for a [[NS]] notification for resuming actual execution) is done via NS as well. The ARM11 kernel handles mapping the processes' virtual memory for .text, .rodata, and .data. The ARM11 kernel handles terminating processes as well of course. The only process which has access to [[SVC|svcControlProcessMemory]] for mapping memory or changing memory permissions, is [[RO_Services|RO]] module, and of course that module will only map R-X .text pages for the signed [[CRO0|CRO]] .text. --[[User:Yellows8|Yellows8]] 03:16, 19 June 2013 (CEST)
:I can still remember ns/ro is also a title in title list. (if manually start that may fails/cause failure) if you launch a title with those commands manually, would it be exposed (in ram?)(, if so we may dump the firmware/modules)? MPS let multiple processes can share the same resources (with home menu?). or have we to modify the real memory externally? There are just thoughts, if interesting please think for a while; if not just tell me "NONE".--[[User:Syphurith|Syphurith]] 05:17, 19 June 2013 (CEST)
:I saw you update the AES page recently. you can confirm some keyslots are with the same data, but how had you done that (by comparing the data, or just the same memory location)? Can you even fetch those keys to decrypt the CDN TMD key strings? if so that would be a potential way to go.. BTW you're disasm those in-memory content not the decrypted Romfs right?
:I do wonder if contents decrypted succussfully, shall we need any customed disassembler? --[[User:Syphurith|Syphurith]] 16:51, 26 June 2013 (CEST)
::"some keyslots are with the same data" I encrypted an all-zero block with each AES engine keyslot with CTR=0, and encrypted that data again with each keyslot with keyY=0. When the output block for the former is the same for multiple keyslots, those keyslots use the same keyX/keyY. When the latter output block is the same for multiple keyslots, those keyslots use the same keyX. "decrypt the CDN TMD key strings" TMDs have nothing to do with decrypting the ticket titlekey. [[RomFS]] does not contain code(besides [[CRO0]] for web browser), that's stored in [[ExeFS]]:/.code. There's no need to dump code from memory when one can just use the [[AES]] engine. --[[User:Yellows8|Yellows8]] 17:40, 26 June 2013 (CEST)
:::oh well. sorry for been n00b again. then have you ever found something that you can execute to decrypt those CDN data? i badly wanna try it.. ExeFS.. okey.. hope good work--[[User:Syphurith|Syphurith]] 08:04, 27 June 2013 (CEST)
:::-snip- --[[User:Syphurith|Syphurith]] 08:36, 27 June 2013 (CEST)
::::You do not "call" crypto functions here, this is a hardware [[AES]] engine with a hardware key-scrambler. "found something that you can execute to decrypt those CDN data" Not sure what you mean when we had system-version v4.5 total-control code exec haxx since December. --[[User:Yellows8|Yellows8]] 09:52, 27 June 2013 (CEST)
:::::I forgot that hours ago. sorry. I thought we would be able to feed those raw data we got from CDN, and let it decrypt and extract for us. then at least we may be able to find those differences in modules implemented between two nearby versions. Some just fix crash - stablility, and some would fix some vulnerables we may use, and some would indicates those internal logical process of the module's implementation. we can not always rely on those ROP or other black-box methods. when we get the opportunity to build a CFW or a special homebrew that would affect the original behaviours of the system, we may need to modify it right? also that should show us some interesting points if we have ones dedicated on analysing those. --[[User:Syphurith|Syphurith]] 14:51, 27 June 2013 (CEST)
::::::Total-control code exec haxx = access to the [[AES]] engine obviously. "build a 'CFW'" That's not possible because of [[NCCH|RSA]], the only way around that would be to exploit software while the system is booting or exploit Home Menu. And patching the NCCH signature checks(from like savegame haxx with a game) is rather pointless, because you would have to re-patch *every* time you boot your 3DS(there's no need to run a regular homebrew application via NCCH this way either tbh). --[[User:Yellows8|Yellows8]] 16:06, 27 June 2013 (CEST)
:::::Thx. That's exactly how cfw works. (sorry i only have psp and 3ds) procfw on psp, have ipl flashed (psp has one special section inside its battery) can auto-patch the cfw code into the system while booting. But have no news for how those men repair customer's device i definitely have no clubs about the existence of similiar mechism. Besides, patching is not that easy, well. i know you have full access to AES engine, and i just want to know have you ever tried or thought of using contents from CDN and decrypt them and disassemble to seek something interesting. --[[User:Syphurith|Syphurith]] 05:31, 28 June 2013 (CEST)
::::::Using the AES engine is basically the only way to obtain cleartext NCCH for updated titles, without finalizing the install for titles. That's obviously where stuff like the new [[6.0.0-11|savegame]] keyY info came from. --[[User:Yellows8|Yellows8]] 07:16, 28 June 2013 (CEST)
:::::Okey, good. you can take use of that (however still not related to exefs..) have a good day.
::There is ClCertA on CDN. Important keys are stored in hardware key-scrambler right? A.ClCertA's private key stored in hardware and there is api called with write access in the package. B.ClCertA's key stored in NAND or somewhere else so we can eventually grab that and setup a proxy to remote while replacing the original ninty ones to our own self-sign ones (Then we would be able to decode the data transfers between proxy to 3ds and proxy to remote). C.ClCertA.. The workers think their private key can never be leaked so no CRL and just stored in hardware with a package cheating their boss. Which one you think would be the best answer? BTW i do really think there is ones with R/W access to the hardware.. Hope you find new apis.--[[User:Syphurith|Syphurith]] 02:35, 4 July 2013 (CEST)
:::ClCertA contains the SSL client RSA cert/private-key, when one has that one can only access their servers(like with a PC) with that, *nothing* more. I'm not sure why they store that data in a CFA seperate from SSL module, those two files stored in the ClCertA RomFS use additional encryption to begin with. "BTW i do really think there is ones with R/W access to the hardware" I'm not sure what you mean by that. --[[User:Yellows8|Yellows8]] 03:24, 4 July 2013 (CEST)
::::-snip-
:::::I don't think you understand what "SSL client certificate authentication" is, you should google it etc. A fake server would require the SSL server private-key from the real server, which you can't obtain of course. The AES engine has *nothing* to do with this besides being used to decrypt those two files in that CFA RomFS. This CFA is a system title so it's obviously stored in NAND, but of course you can't change any NCCH data due to RSA signing of course(modifying ClCertA is pointless anyway). There's not much point changing the SSL client cert/private-key, each 3DS prior to that update would be using the old ClCertA, and system updates require that SSL client auth for SOAP(besides SOAP that stuff isn't really interesting tbh). SSL module is the only process which uses ClCertA. "... write/read which section of memory" I have no use for that. --[[User:Yellows8|Yellows8]] 17:30, 4 July 2013 (CEST)
::::::oh well thanks. So only SSL module then. Without the ability to modify the original data, even a tunnel proxy would not work properly..(what annoying the rsa signature is - maybe as me to you. i means, 3ds with replaced, child cert and key of a self-signed, connects to a proxy with self-signed cert and key; the proxy takes the original cert and key that of 3ds client, to connects to ninty CDN. the two connections are all connecting with proper key and cert, that client signed by server; but 3ds's original cert and key must be replaced by one signed by our proxy's server cert and key, as what ninty does with 3ds. cause inability to change the content, it is nothing now.)(maybe better quick head to learning disasm and someday to have a try) BTW haven't seen Jl12 for long, seeing someone impeach him for just taking $ away lol. (even i don't think about that before. oh no this is your page and i should not be short to you) --[[User:Syphurith|Syphurith]] 02:16, 5 July 2013 (CEST)
::::::So please let me say that. "Sorry". also hope you find something today.

===Spam attack===
I guess the simple captcha isn't enough, do you have an idea what to do? (i'm asking you because you are the most active admin here). 
I think we should adopt a method of registration and waiting for an admin to approve it. the recent changes page is spammed hard and a lot of google pages, I guess, are being created linking to those pages. --[[User:Elisherer|Elisherer]] 09:40, 31 May 2013 (CEST)
:Mha is the only one that can do anything about anti-spam, I can't do much about it myself. Mha said that he would work on this tomorrow. --[[User:Yellows8|Yellows8]] 22:19, 31 May 2013 (CEST)
::A. Stop registeration for several weeks (NOT GOOD).
::B. Ajax to load captcha (maybe reCAPTCHA?). Not well-made bots will have trouble loading the javascript code or lose the speed (there is ones with javascript but can not act so quickly)(MAYBE USEFUL). This method is widely used ''it may be not so useful'' (against latest tools).
::C. Use auto filter to auto check those suspicious content and block those users, given an access for those by accident closed guys to talk about their opinion. (I do wonder if the wiki admin backdoor provide you such a tool)(Hey Regex~)
::D.find their IP and block the IP section for a while.(Similiar as A)
::E. Use man-made Email to validate (I means, instead of the system writing mail to user to validate, let user write mails to admin or other trusted -- use SPAM filter)(NOT WELL PRATICAL, Haven't tested, SO..)
::F. Calls for someone can trust and give him only those block and delete power (DIFFICULT). Well just a little tries..
::G. Try to update your wiki version first, i mean the version of this website framework. (MAYBE USEFUL? DOUBT..)
::If you tried the actions of blocking and the spam still flow in you need to update or call wiki program's supporters (may be exploit..) But i do wonder why they tried to attack here, a (script) guy (with latest tool)?(if so he should try to improve his skill first).
::Oh well, Recent changes. Guys have a good day (International Children's Day).--[[User:Syphurith|Syphurith]] 09:39, 1 June 2013 (CEST)
:We are able to mark those pages as spam but however no effects in deed if no one comes to remove those spam accounts. Well.--[[User:Syphurith|Syphurith]] 10:17, 17 June 2013 (CEST)

===Fundraiser===
Hello Yellows8,
I know you're not the one that is responsible for the chip decapping fundraiser, but I didn't manage to contact Jl12 via E-Mail (He's not responding). So, have you guys noticed that the donations hit the 2000$ last week? Will the decapping start anytime soon or do you need some more money for buying the 3DS itself?
Best regards
:Jl12 has had a broken 3DS for decapping before the fundraiser even started. And of course we noticed that, however since Jl12 is usually very busy it might be a while before he sends his 3DS for decapping. --[[User:Yellows8|Yellows8]] 00:26, 5 June 2013 (CEST)
Hi again,
anything regarding the chip decapping happened in the past week? Will the images be released to the public?
Best regards
:We still haven't heard anything from Jl12. --[[User:Yellows8|Yellows8]] 19:34, 15 June 2013 (CEST)
So Still no news from Jl12? Seems not seeing him for long.--[[User:Syphurith|Syphurith]] 02:35, 4 July 2013 (CEST)

User talk:Yellows8

2013-07-04T22:16:16Z

Syphurith: inability to change content, Cert is nothing now. i should learn something or try a new way.

Thanks for clearing that up about the free space on the "TWL", what confused me about the name was how the dev unit handled ds games. You know how the 3ds's code name is CTR(we don't know what that stands for yet) and the ds's code name is NTR which mean Nitro. When a 3DS game is inserted, the dev menu says a "CTR CARD" is inserted, but when a DS game is inserted it says a "TWL CARD" is inserted instead of what I expected which would be "NTR CARD". I still do not understand this. - 3dsguy
:DS=NTR, DSLite=USG (japanese for thin..), DSi=TWL(Twelve), DSiXL=UTL, 3DS=CTR... DS (on the 3DS) is usually associated with DSi.. --[[User:Elisherer|Elisherer]] 02:32, 19 October 2011 (CEST)
::3dsguy, that game you inserted was released *long* before DSi right?(also, sign your comments with the signature button) --[[User:Yellows8|Yellows8]] 04:02, 19 October 2011 (CEST)
:Elisherer thanks for clearing that up :).--[[User:3dsguy|3dsguy]] 09:46, 19 October 2011 (CEST)
::Yellows8, no that game was not, but just now i tryed it with a game released in 2006 and it still said 'TWL CARD', but what Elisherer said explained this.--[[User:3dsguy|3dsguy]] 09:46, 19 October 2011 (CEST)

:DS = NTR/Nitro
:DSi = TWL/Twilight
:3DS = CTR/Horizon
:Wii = RVL/Revolution

:Yellows8 - if you have DS/Nitro code running on a DSi system, can you escalate to DSi/TWL mode or load a TWL/DSi binary or similar. [[User:Jl12|Jl12]]
::No, that's impossible. When DSi launcher/sysmenu switches to DS-mode, launcher clears the MSB of a DSi register disabling access to the registers controlling what hw is enabled and the clock rate etc. Once those regs are disabled, it's impossible to re-enable them again without resetting the system via I2C etc.(Also, by the time any exploited title is running homebrew code, those regs are already disabled too.) --[[User:Yellows8|Yellows8]] 19:53, 7 November 2011 (CET)
: Is the NAND encrypted as it is on 3DS? Also, does DSi use DLP [for TWL games] at all? [[User:Jl12|Jl12]]
::Yes, DSi NAND is encrypted with AES-CTR. DSiWare uses download-play but the WMB/dlp binaries are DS-mode only.--[[User:Yellows8|Yellows8]] 06:27, 14 November 2011 (CET)

@Yellows8 - I'm sorry for asking this so late, but what does NUS stand for in this context "redistributing copyrighted content, in this case NUS content, is *not* allowed here.". I do not understand why you deleted my page: [[Update Data|Update Data]]
:NUS = Nintendo Update Servers. Those archive(s) you linked to contained files you downloaded from NUS, all of which are copyrighted. Besides, mirroring NUS content without any decryption done at all is *completely* pointless. --[[User:Yellows8|Yellows8]] 16:41, 12 December 2011 (CET)
::So would it be better to provide update logs, so it can point people to which update data is from which version as on the NUS the individual update data for each title is not stored the same way for all titles, providing people with further reference, so they know what they are using. You may ask me what would they use them for, they are still not decrypted and therefore pointless. ATM knowing which version is which on the NUS *maybe* very important, but I can't tell you more until later.--[[User:3dsguy|3dsguy]] 01:19, 13 December 2011 (CET)
:::Yeah a list of titleIDs and versions would be fine. One could grab that info from [[Title_list]] diffs, but that's not the best way to handle this. I have lists of updated titles for each 3DS system update, but of course I never bothered to document which version was from what sysupdate beyond just adding them to the title list page.(obtained from their system update SOAP) --[[User:Yellows8|Yellows8]] 02:20, 13 December 2011 (CET)

@Yellows8 - Thanks for your progress everyday, really. i have questions.. If feeling uneasy please tell me politely (and i will remove these).
* Would you need a tool that can use specified patterns to mark the decrypted binary (certainly it can not be perfect) ? Or have you find a disassembler so powerful that you don't need that a tool any more? please tell me. if that is useful, let me and my friend make that.
:The tool would have such ability in resolving the configuration file. Comment, Include, CmdID (with no params), CmdID (with specified params), CmdID (with no specified params). such as 80001000:0103:4,0102:4,Any:4. (ie this can mark 800010000102 out as a second type).
* Just curious. It has been a long time since neimod's latest update. Have you got a board from him, or you are only using the exploit (not with the board). If the board is helpful, is there any access to get/purchase one? (if no i think i should learn how to diy one then)
it seems to be a long time for you to do all the documentations by yourself. (Orz i forgot my suggestion) --[[User:Syphurith|Syphurith]] 02:35, 15 April 2013 (CEST)
:I don't have any 3DS ramhaxx, I use software savegame haxx of course. "is there any access to get/purchase one? (if no i think i should learn how to diy one then)" You should be asking neimod about that instead, but [https://secure.flickr.com/photos/neimod/6238747088/in/photostream the] [https://secure.flickr.com/photos/neimod/6212627980/in/photostream soldering] for 3DS ramhaxx would be *really* difficult. I'm not sure what you mean regarding that tool either, are you referring to a tool which would locate the code for service commands in a binary? --[[User:Yellows8|Yellows8]] 03:10, 15 April 2013 (CEST)
::Thanks for reply. I will try to contact him for boards. About the tool --sniff--.
::* Cons: can not detect structures; may make mistake; need configuration file (can be made by writing the header code)
::* Pros: can visually color the matched patterns; can load unlimited size of file (result will be divided into segments of 1MB or other)
::It would not be too difficult to make. However may take one or two weeks. --[[User:Syphurith|Syphurith]] 03:49, 15 April 2013 (CEST)
:::I have no need for a tool which searches for service commandIDs, when I can just search for commandIDs etc in my text-editor for disassembled code. --[[User:Yellows8|Yellows8]] 04:04, 15 April 2013 (CEST)
::::Well thanks for reply. I removed the details above. I will left it undone. Have a good day.--[[User:Syphurith|Syphurith]] 04:21, 15 April 2013 (CEST)
I've seen there are users without contributions flew in. There are even some guys cheating (or just making jokes) with your names.. What's your opinion about that? PS3Brew is blocking those without edits (daily). --[[User:Syphurith|Syphurith]] 17:03, 17 April 2013 (CEST)
:I don't care much about either,(neither of those fake accounts were used to edit anything at least) I'm not an admin here though. --[[User:Yellows8|Yellows8]] 17:36, 17 April 2013 (CEST)

Hello Yellows8,
I have a question regarding the release of the hack. You guys said, that you won't release it, because it is very easy to patch. Now the new firmware was released and in fact the exploit was patched. So releasing it now wouldn't change anything, because Nintendo already patched it.

But if you release it now, people could start develloping homebrew and when you guys find a new exploit for the new firmware, we would already have a good base of homebrew applications.

So why still hiding it from the world?

Best regards and thank you for your work

elBirx
:"the exploit was patched" Only the code execution haxx was [[5.0.0-11|fixed]], the savegame haxx was not fixed. "But if you release it now, people could start develloping homebrew" No, currently it's '''only''' useful for reverse engineers. Almost everyone that wants that savegame haxx would have no use for it right now, since "it's '''only''' useful for reverse engineers". --[[User:Yellows8|Yellows8]] 18:46, 21 April 2013 (CEST)
::So i do think only one that want to do Reverse engineering and do have skills in ARM disassembly can ask you for such a thing. Yellows8, what would i need to learn if i want to analyse those (taken ARM references in consideration)? --[[User:Syphurith|Syphurith]] 03:07, 22 April 2013 (CEST)
:::What are you referring to by "those"? --[[User:Yellows8|Yellows8]] 04:26, 22 April 2013 (CEST)
::::I'm so sorry for my poor expression skill. If i want to analyse the ram or anything that you used as a material.. Exefs is ARM code so i think to check those (you can get using exploit/haxx) need arm knowledges. i mean, that is those service APIs. you did say you can check disassembled code. Even i don't know what is left to be done. --[[User:Syphurith|Syphurith]] 07:31, 22 April 2013 (CEST)
:::::"what would i need to learn..." You could learn to read/write ARM assembly, and learn reverse engineering. --[[User:Yellows8|Yellows8]] 07:38, 22 April 2013 (CEST)
::::::Thanks. Confirmed~ That's clear to me now. --[[User:Syphurith|Syphurith]] 11:53, 22 April 2013 (CEST)

Eh. Yellows8, i got some n00b questions about the ARM execution.

There is non-executable sections in the memory layout, but where did these "This can be executed" flags got initialized (I mean that is made of hardware circuits or bios or other software section)? If that is not changable, would all those ARM cores use the same non-execution flags settings(possibly no so we may change the core to keep that work?). Even more, can we sniffer the data app to core and change its execution length then inject.

Also, is there any method to let the core execute those commands (that you detected) and use that to produce something you interested in?
:The ARM11 kernel [[Memory_layout#ARM11_User-land_memory_regions|initializes]] the MMU tables. "Also, is there any method to let the core execute those commands (that you detected) and use that to produce something you interested in?" By running code on a 3DS of course. --[[User:Yellows8|Yellows8]] 17:27, 17 June 2013 (CEST)
::Thanks. But still feeling strange of that strategy. I think at least the Home Menu may be able to re-map or deactive this mark.
::-snip- Sorry for being noob (i would try learning arm soon). Hope you good work.--[[User:Syphurith|Syphurith]] 02:46, 19 June 2013 (CEST)

Home Menu starts application processes via [[NS]], terminating and "suspending" process execution(the process is still running with that, the application threads wait for a [[NS]] notification for resuming actual execution) is done via NS as well. The ARM11 kernel handles mapping the processes' virtual memory for .text, .rodata, and .data. The ARM11 kernel handles terminating processes as well of course. The only process which has access to [[SVC|svcControlProcessMemory]] for mapping memory or changing memory permissions, is [[RO_Services|RO]] module, and of course that module will only map R-X .text pages for the signed [[CRO0|CRO]] .text. --[[User:Yellows8|Yellows8]] 03:16, 19 June 2013 (CEST)
:I can still remember ns/ro is also a title in title list. (if manually start that may fails/cause failure) if you launch a title with those commands manually, would it be exposed (in ram?)(, if so we may dump the firmware/modules)? MPS let multiple processes can share the same resources (with home menu?). or have we to modify the real memory externally? There are just thoughts, if interesting please think for a while; if not just tell me "NONE".--[[User:Syphurith|Syphurith]] 05:17, 19 June 2013 (CEST)
:I saw you update the AES page recently. you can confirm some keyslots are with the same data, but how had you done that (by comparing the data, or just the same memory location)? Can you even fetch those keys to decrypt the CDN TMD key strings? if so that would be a potential way to go.. BTW you're disasm those in-memory content not the decrypted Romfs right?
:I do wonder if contents decrypted succussfully, shall we need any customed disassembler? --[[User:Syphurith|Syphurith]] 16:51, 26 June 2013 (CEST)
::"some keyslots are with the same data" I encrypted an all-zero block with each AES engine keyslot with CTR=0, and encrypted that data again with each keyslot with keyY=0. When the output block for the former is the same for multiple keyslots, those keyslots use the same keyX/keyY. When the latter output block is the same for multiple keyslots, those keyslots use the same keyX. "decrypt the CDN TMD key strings" TMDs have nothing to do with decrypting the ticket titlekey. [[RomFS]] does not contain code(besides [[CRO0]] for web browser), that's stored in [[ExeFS]]:/.code. There's no need to dump code from memory when one can just use the [[AES]] engine. --[[User:Yellows8|Yellows8]] 17:40, 26 June 2013 (CEST)
:::oh well. sorry for been n00b again. then have you ever found something that you can execute to decrypt those CDN data? i badly wanna try it.. ExeFS.. okey.. hope good work--[[User:Syphurith|Syphurith]] 08:04, 27 June 2013 (CEST)
:::-snip- --[[User:Syphurith|Syphurith]] 08:36, 27 June 2013 (CEST)
::::You do not "call" crypto functions here, this is a hardware [[AES]] engine with a hardware key-scrambler. "found something that you can execute to decrypt those CDN data" Not sure what you mean when we had system-version v4.5 total-control code exec haxx since December. --[[User:Yellows8|Yellows8]] 09:52, 27 June 2013 (CEST)
:::::I forgot that hours ago. sorry. I thought we would be able to feed those raw data we got from CDN, and let it decrypt and extract for us. then at least we may be able to find those differences in modules implemented between two nearby versions. Some just fix crash - stablility, and some would fix some vulnerables we may use, and some would indicates those internal logical process of the module's implementation. we can not always rely on those ROP or other black-box methods. when we get the opportunity to build a CFW or a special homebrew that would affect the original behaviours of the system, we may need to modify it right? also that should show us some interesting points if we have ones dedicated on analysing those. --[[User:Syphurith|Syphurith]] 14:51, 27 June 2013 (CEST)
::::::Total-control code exec haxx = access to the [[AES]] engine obviously. "build a 'CFW'" That's not possible because of [[NCCH|RSA]], the only way around that would be to exploit software while the system is booting or exploit Home Menu. And patching the NCCH signature checks(from like savegame haxx with a game) is rather pointless, because you would have to re-patch *every* time you boot your 3DS(there's no need to run a regular homebrew application via NCCH this way either tbh). --[[User:Yellows8|Yellows8]] 16:06, 27 June 2013 (CEST)
:::::Thx. That's exactly how cfw works. (sorry i only have psp and 3ds) procfw on psp, have ipl flashed (psp has one special section inside its battery) can auto-patch the cfw code into the system while booting. But have no news for how those men repair customer's device i definitely have no clubs about the existence of similiar mechism. Besides, patching is not that easy, well. i know you have full access to AES engine, and i just want to know have you ever tried or thought of using contents from CDN and decrypt them and disassemble to seek something interesting. --[[User:Syphurith|Syphurith]] 05:31, 28 June 2013 (CEST)
::::::Using the AES engine is basically the only way to obtain cleartext NCCH for updated titles, without finalizing the install for titles. That's obviously where stuff like the new [[6.0.0-11|savegame]] keyY info came from. --[[User:Yellows8|Yellows8]] 07:16, 28 June 2013 (CEST)
:::::Okey, good. you can take use of that (however still not related to exefs..) have a good day.
::There is ClCertA on CDN. Important keys are stored in hardware key-scrambler right? A.ClCertA's private key stored in hardware and there is api called with write access in the package. B.ClCertA's key stored in NAND or somewhere else so we can eventually grab that and setup a proxy to remote while replacing the original ninty ones to our own self-sign ones (Then we would be able to decode the data transfers between proxy to 3ds and proxy to remote). C.ClCertA.. The workers think their private key can never be leaked so no CRL and just stored in hardware with a package cheating their boss. Which one you think would be the best answer? BTW i do really think there is ones with R/W access to the hardware.. Hope you find new apis.--[[User:Syphurith|Syphurith]] 02:35, 4 July 2013 (CEST)
:::ClCertA contains the SSL client RSA cert/private-key, when one has that one can only access their servers(like with a PC) with that, *nothing* more. I'm not sure why they store that data in a CFA seperate from SSL module, those two files stored in the ClCertA RomFS use additional encryption to begin with. "BTW i do really think there is ones with R/W access to the hardware" I'm not sure what you mean by that. --[[User:Yellows8|Yellows8]] 03:24, 4 July 2013 (CEST)
::::-snip-
:::::I don't think you understand what "SSL client certificate authentication" is, you should google it etc. A fake server would require the SSL server private-key from the real server, which you can't obtain of course. The AES engine has *nothing* to do with this besides being used to decrypt those two files in that CFA RomFS. This CFA is a system title so it's obviously stored in NAND, but of course you can't change any NCCH data due to RSA signing of course(modifying ClCertA is pointless anyway). There's not much point changing the SSL client cert/private-key, each 3DS prior to that update would be using the old ClCertA, and system updates require that SSL client auth for SOAP(besides SOAP that stuff isn't really interesting tbh). SSL module is the only process which uses ClCertA. "... write/read which section of memory" I have no use for that. --[[User:Yellows8|Yellows8]] 17:30, 4 July 2013 (CEST)
::::::oh well thanks. So only SSL module then. Without the ability to modify the original data, even a tunnel proxy would not work properly..(what annoying the rsa signature is - maybe as me to you. i means, 3ds with replaced, child cert and key of a self-signed, connects to a proxy with self-signed cert and key; the proxy takes the original cert and key that of 3ds client, to connects to ninty CDN. the two connections are all connecting with proper key and cert, that client signed by server; but 3ds's original cert and key must be replaced by one signed by our proxy's server cert and key, as what ninty does with 3ds. cause inability to change the content, it is nothing now.)(maybe better quick head to learning disasm and someday to have a try) BTW haven't seen Jl12 for long, seeing someone impeach him for just taking $ away lol. (even i don't think about that before. oh no this is your page and i should not be short to you) --[[User:Syphurith|Syphurith]] 02:16, 5 July 2013 (CEST)

===Spam attack===
I guess the simple captcha isn't enough, do you have an idea what to do? (i'm asking you because you are the most active admin here). 
I think we should adopt a method of registration and waiting for an admin to approve it. the recent changes page is spammed hard and a lot of google pages, I guess, are being created linking to those pages. --[[User:Elisherer|Elisherer]] 09:40, 31 May 2013 (CEST)
:Mha is the only one that can do anything about anti-spam, I can't do much about it myself. Mha said that he would work on this tomorrow. --[[User:Yellows8|Yellows8]] 22:19, 31 May 2013 (CEST)
::A. Stop registeration for several weeks (NOT GOOD).
::B. Ajax to load captcha (maybe reCAPTCHA?). Not well-made bots will have trouble loading the javascript code or lose the speed (there is ones with javascript but can not act so quickly)(MAYBE USEFUL). This method is widely used ''it may be not so useful'' (against latest tools).
::C. Use auto filter to auto check those suspicious content and block those users, given an access for those by accident closed guys to talk about their opinion. (I do wonder if the wiki admin backdoor provide you such a tool)(Hey Regex~)
::D.find their IP and block the IP section for a while.(Similiar as A)
::E. Use man-made Email to validate (I means, instead of the system writing mail to user to validate, let user write mails to admin or other trusted -- use SPAM filter)(NOT WELL PRATICAL, Haven't tested, SO..)
::F. Calls for someone can trust and give him only those block and delete power (DIFFICULT). Well just a little tries..
::G. Try to update your wiki version first, i mean the version of this website framework. (MAYBE USEFUL? DOUBT..)
::If you tried the actions of blocking and the spam still flow in you need to update or call wiki program's supporters (may be exploit..) But i do wonder why they tried to attack here, a (script) guy (with latest tool)?(if so he should try to improve his skill first).
::Oh well, Recent changes. Guys have a good day (International Children's Day).--[[User:Syphurith|Syphurith]] 09:39, 1 June 2013 (CEST)
:We are able to mark those pages as spam but however no effects in deed if no one comes to remove those spam accounts. Well.--[[User:Syphurith|Syphurith]] 10:17, 17 June 2013 (CEST)

===Fundraiser===
Hello Yellows8,
I know you're not the one that is responsible for the chip decapping fundraiser, but I didn't manage to contact Jl12 via E-Mail (He's not responding). So, have you guys noticed that the donations hit the 2000$ last week? Will the decapping start anytime soon or do you need some more money for buying the 3DS itself?
Best regards
:Jl12 has had a broken 3DS for decapping before the fundraiser even started. And of course we noticed that, however since Jl12 is usually very busy it might be a while before he sends his 3DS for decapping. --[[User:Yellows8|Yellows8]] 00:26, 5 June 2013 (CEST)
Hi again,
anything regarding the chip decapping happened in the past week? Will the images be released to the public?
Best regards
:We still haven't heard anything from Jl12. --[[User:Yellows8|Yellows8]] 19:34, 15 June 2013 (CEST)
So Still no news from Jl12? Seems not seeing him for long.--[[User:Syphurith|Syphurith]] 02:35, 4 July 2013 (CEST)

User talk:Yellows8

2013-07-04T06:11:40Z

Syphurith: appendix

Thanks for clearing that up about the free space on the "TWL", what confused me about the name was how the dev unit handled ds games. You know how the 3ds's code name is CTR(we don't know what that stands for yet) and the ds's code name is NTR which mean Nitro. When a 3DS game is inserted, the dev menu says a "CTR CARD" is inserted, but when a DS game is inserted it says a "TWL CARD" is inserted instead of what I expected which would be "NTR CARD". I still do not understand this. - 3dsguy
:DS=NTR, DSLite=USG (japanese for thin..), DSi=TWL(Twelve), DSiXL=UTL, 3DS=CTR... DS (on the 3DS) is usually associated with DSi.. --[[User:Elisherer|Elisherer]] 02:32, 19 October 2011 (CEST)
::3dsguy, that game you inserted was released *long* before DSi right?(also, sign your comments with the signature button) --[[User:Yellows8|Yellows8]] 04:02, 19 October 2011 (CEST)
:Elisherer thanks for clearing that up :).--[[User:3dsguy|3dsguy]] 09:46, 19 October 2011 (CEST)
::Yellows8, no that game was not, but just now i tryed it with a game released in 2006 and it still said 'TWL CARD', but what Elisherer said explained this.--[[User:3dsguy|3dsguy]] 09:46, 19 October 2011 (CEST)

:DS = NTR/Nitro
:DSi = TWL/Twilight
:3DS = CTR/Horizon
:Wii = RVL/Revolution

:Yellows8 - if you have DS/Nitro code running on a DSi system, can you escalate to DSi/TWL mode or load a TWL/DSi binary or similar. [[User:Jl12|Jl12]]
::No, that's impossible. When DSi launcher/sysmenu switches to DS-mode, launcher clears the MSB of a DSi register disabling access to the registers controlling what hw is enabled and the clock rate etc. Once those regs are disabled, it's impossible to re-enable them again without resetting the system via I2C etc.(Also, by the time any exploited title is running homebrew code, those regs are already disabled too.) --[[User:Yellows8|Yellows8]] 19:53, 7 November 2011 (CET)
: Is the NAND encrypted as it is on 3DS? Also, does DSi use DLP [for TWL games] at all? [[User:Jl12|Jl12]]
::Yes, DSi NAND is encrypted with AES-CTR. DSiWare uses download-play but the WMB/dlp binaries are DS-mode only.--[[User:Yellows8|Yellows8]] 06:27, 14 November 2011 (CET)

@Yellows8 - I'm sorry for asking this so late, but what does NUS stand for in this context "redistributing copyrighted content, in this case NUS content, is *not* allowed here.". I do not understand why you deleted my page: [[Update Data|Update Data]]
:NUS = Nintendo Update Servers. Those archive(s) you linked to contained files you downloaded from NUS, all of which are copyrighted. Besides, mirroring NUS content without any decryption done at all is *completely* pointless. --[[User:Yellows8|Yellows8]] 16:41, 12 December 2011 (CET)
::So would it be better to provide update logs, so it can point people to which update data is from which version as on the NUS the individual update data for each title is not stored the same way for all titles, providing people with further reference, so they know what they are using. You may ask me what would they use them for, they are still not decrypted and therefore pointless. ATM knowing which version is which on the NUS *maybe* very important, but I can't tell you more until later.--[[User:3dsguy|3dsguy]] 01:19, 13 December 2011 (CET)
:::Yeah a list of titleIDs and versions would be fine. One could grab that info from [[Title_list]] diffs, but that's not the best way to handle this. I have lists of updated titles for each 3DS system update, but of course I never bothered to document which version was from what sysupdate beyond just adding them to the title list page.(obtained from their system update SOAP) --[[User:Yellows8|Yellows8]] 02:20, 13 December 2011 (CET)

@Yellows8 - Thanks for your progress everyday, really. i have questions.. If feeling uneasy please tell me politely (and i will remove these).
* Would you need a tool that can use specified patterns to mark the decrypted binary (certainly it can not be perfect) ? Or have you find a disassembler so powerful that you don't need that a tool any more? please tell me. if that is useful, let me and my friend make that.
:The tool would have such ability in resolving the configuration file. Comment, Include, CmdID (with no params), CmdID (with specified params), CmdID (with no specified params). such as 80001000:0103:4,0102:4,Any:4. (ie this can mark 800010000102 out as a second type).
* Just curious. It has been a long time since neimod's latest update. Have you got a board from him, or you are only using the exploit (not with the board). If the board is helpful, is there any access to get/purchase one? (if no i think i should learn how to diy one then)
it seems to be a long time for you to do all the documentations by yourself. (Orz i forgot my suggestion) --[[User:Syphurith|Syphurith]] 02:35, 15 April 2013 (CEST)
:I don't have any 3DS ramhaxx, I use software savegame haxx of course. "is there any access to get/purchase one? (if no i think i should learn how to diy one then)" You should be asking neimod about that instead, but [https://secure.flickr.com/photos/neimod/6238747088/in/photostream the] [https://secure.flickr.com/photos/neimod/6212627980/in/photostream soldering] for 3DS ramhaxx would be *really* difficult. I'm not sure what you mean regarding that tool either, are you referring to a tool which would locate the code for service commands in a binary? --[[User:Yellows8|Yellows8]] 03:10, 15 April 2013 (CEST)
::Thanks for reply. I will try to contact him for boards. About the tool --sniff--.
::* Cons: can not detect structures; may make mistake; need configuration file (can be made by writing the header code)
::* Pros: can visually color the matched patterns; can load unlimited size of file (result will be divided into segments of 1MB or other)
::It would not be too difficult to make. However may take one or two weeks. --[[User:Syphurith|Syphurith]] 03:49, 15 April 2013 (CEST)
:::I have no need for a tool which searches for service commandIDs, when I can just search for commandIDs etc in my text-editor for disassembled code. --[[User:Yellows8|Yellows8]] 04:04, 15 April 2013 (CEST)
::::Well thanks for reply. I removed the details above. I will left it undone. Have a good day.--[[User:Syphurith|Syphurith]] 04:21, 15 April 2013 (CEST)
I've seen there are users without contributions flew in. There are even some guys cheating (or just making jokes) with your names.. What's your opinion about that? PS3Brew is blocking those without edits (daily). --[[User:Syphurith|Syphurith]] 17:03, 17 April 2013 (CEST)
:I don't care much about either,(neither of those fake accounts were used to edit anything at least) I'm not an admin here though. --[[User:Yellows8|Yellows8]] 17:36, 17 April 2013 (CEST)

Hello Yellows8,
I have a question regarding the release of the hack. You guys said, that you won't release it, because it is very easy to patch. Now the new firmware was released and in fact the exploit was patched. So releasing it now wouldn't change anything, because Nintendo already patched it.

But if you release it now, people could start develloping homebrew and when you guys find a new exploit for the new firmware, we would already have a good base of homebrew applications.

So why still hiding it from the world?

Best regards and thank you for your work

elBirx
:"the exploit was patched" Only the code execution haxx was [[5.0.0-11|fixed]], the savegame haxx was not fixed. "But if you release it now, people could start develloping homebrew" No, currently it's '''only''' useful for reverse engineers. Almost everyone that wants that savegame haxx would have no use for it right now, since "it's '''only''' useful for reverse engineers". --[[User:Yellows8|Yellows8]] 18:46, 21 April 2013 (CEST)
::So i do think only one that want to do Reverse engineering and do have skills in ARM disassembly can ask you for such a thing. Yellows8, what would i need to learn if i want to analyse those (taken ARM references in consideration)? --[[User:Syphurith|Syphurith]] 03:07, 22 April 2013 (CEST)
:::What are you referring to by "those"? --[[User:Yellows8|Yellows8]] 04:26, 22 April 2013 (CEST)
::::I'm so sorry for my poor expression skill. If i want to analyse the ram or anything that you used as a material.. Exefs is ARM code so i think to check those (you can get using exploit/haxx) need arm knowledges. i mean, that is those service APIs. you did say you can check disassembled code. Even i don't know what is left to be done. --[[User:Syphurith|Syphurith]] 07:31, 22 April 2013 (CEST)
:::::"what would i need to learn..." You could learn to read/write ARM assembly, and learn reverse engineering. --[[User:Yellows8|Yellows8]] 07:38, 22 April 2013 (CEST)
::::::Thanks. Confirmed~ That's clear to me now. --[[User:Syphurith|Syphurith]] 11:53, 22 April 2013 (CEST)

Eh. Yellows8, i got some n00b questions about the ARM execution.

There is non-executable sections in the memory layout, but where did these "This can be executed" flags got initialized (I mean that is made of hardware circuits or bios or other software section)? If that is not changable, would all those ARM cores use the same non-execution flags settings(possibly no so we may change the core to keep that work?). Even more, can we sniffer the data app to core and change its execution length then inject.

Also, is there any method to let the core execute those commands (that you detected) and use that to produce something you interested in?
:The ARM11 kernel [[Memory_layout#ARM11_User-land_memory_regions|initializes]] the MMU tables. "Also, is there any method to let the core execute those commands (that you detected) and use that to produce something you interested in?" By running code on a 3DS of course. --[[User:Yellows8|Yellows8]] 17:27, 17 June 2013 (CEST)
::Thanks. But still feeling strange of that strategy. I think at least the Home Menu may be able to re-map or deactive this mark.
::-snip- Sorry for being noob (i would try learning arm soon). Hope you good work.--[[User:Syphurith|Syphurith]] 02:46, 19 June 2013 (CEST)

Home Menu starts application processes via [[NS]], terminating and "suspending" process execution(the process is still running with that, the application threads wait for a [[NS]] notification for resuming actual execution) is done via NS as well. The ARM11 kernel handles mapping the processes' virtual memory for .text, .rodata, and .data. The ARM11 kernel handles terminating processes as well of course. The only process which has access to [[SVC|svcControlProcessMemory]] for mapping memory or changing memory permissions, is [[RO_Services|RO]] module, and of course that module will only map R-X .text pages for the signed [[CRO0|CRO]] .text. --[[User:Yellows8|Yellows8]] 03:16, 19 June 2013 (CEST)
:I can still remember ns/ro is also a title in title list. (if manually start that may fails/cause failure) if you launch a title with those commands manually, would it be exposed (in ram?)(, if so we may dump the firmware/modules)? MPS let multiple processes can share the same resources (with home menu?). or have we to modify the real memory externally? There are just thoughts, if interesting please think for a while; if not just tell me "NONE".--[[User:Syphurith|Syphurith]] 05:17, 19 June 2013 (CEST)
:I saw you update the AES page recently. you can confirm some keyslots are with the same data, but how had you done that (by comparing the data, or just the same memory location)? Can you even fetch those keys to decrypt the CDN TMD key strings? if so that would be a potential way to go.. BTW you're disasm those in-memory content not the decrypted Romfs right?
:I do wonder if contents decrypted succussfully, shall we need any customed disassembler? --[[User:Syphurith|Syphurith]] 16:51, 26 June 2013 (CEST)
::"some keyslots are with the same data" I encrypted an all-zero block with each AES engine keyslot with CTR=0, and encrypted that data again with each keyslot with keyY=0. When the output block for the former is the same for multiple keyslots, those keyslots use the same keyX/keyY. When the latter output block is the same for multiple keyslots, those keyslots use the same keyX. "decrypt the CDN TMD key strings" TMDs have nothing to do with decrypting the ticket titlekey. [[RomFS]] does not contain code(besides [[CRO0]] for web browser), that's stored in [[ExeFS]]:/.code. There's no need to dump code from memory when one can just use the [[AES]] engine. --[[User:Yellows8|Yellows8]] 17:40, 26 June 2013 (CEST)
:::oh well. sorry for been n00b again. then have you ever found something that you can execute to decrypt those CDN data? i badly wanna try it.. ExeFS.. okey.. hope good work--[[User:Syphurith|Syphurith]] 08:04, 27 June 2013 (CEST)
:::-snip- --[[User:Syphurith|Syphurith]] 08:36, 27 June 2013 (CEST)
::::You do not "call" crypto functions here, this is a hardware [[AES]] engine with a hardware key-scrambler. "found something that you can execute to decrypt those CDN data" Not sure what you mean when we had system-version v4.5 total-control code exec haxx since December. --[[User:Yellows8|Yellows8]] 09:52, 27 June 2013 (CEST)
:::::I forgot that hours ago. sorry. I thought we would be able to feed those raw data we got from CDN, and let it decrypt and extract for us. then at least we may be able to find those differences in modules implemented between two nearby versions. Some just fix crash - stablility, and some would fix some vulnerables we may use, and some would indicates those internal logical process of the module's implementation. we can not always rely on those ROP or other black-box methods. when we get the opportunity to build a CFW or a special homebrew that would affect the original behaviours of the system, we may need to modify it right? also that should show us some interesting points if we have ones dedicated on analysing those. --[[User:Syphurith|Syphurith]] 14:51, 27 June 2013 (CEST)
::::::Total-control code exec haxx = access to the [[AES]] engine obviously. "build a 'CFW'" That's not possible because of [[NCCH|RSA]], the only way around that would be to exploit software while the system is booting or exploit Home Menu. And patching the NCCH signature checks(from like savegame haxx with a game) is rather pointless, because you would have to re-patch *every* time you boot your 3DS(there's no need to run a regular homebrew application via NCCH this way either tbh). --[[User:Yellows8|Yellows8]] 16:06, 27 June 2013 (CEST)
:::::Thx. That's exactly how cfw works. (sorry i only have psp and 3ds) procfw on psp, have ipl flashed (psp has one special section inside its battery) can auto-patch the cfw code into the system while booting. But have no news for how those men repair customer's device i definitely have no clubs about the existence of similiar mechism. Besides, patching is not that easy, well. i know you have full access to AES engine, and i just want to know have you ever tried or thought of using contents from CDN and decrypt them and disassemble to seek something interesting. --[[User:Syphurith|Syphurith]] 05:31, 28 June 2013 (CEST)
::::::Using the AES engine is basically the only way to obtain cleartext NCCH for updated titles, without finalizing the install for titles. That's obviously where stuff like the new [[6.0.0-11|savegame]] keyY info came from. --[[User:Yellows8|Yellows8]] 07:16, 28 June 2013 (CEST)
:::::Okey, good. you can take use of that (however still not related to exefs..) have a good day.
::There is ClCertA on CDN. Important keys are stored in hardware key-scrambler right? A.ClCertA's private key stored in hardware and there is api called with write access in the package. B.ClCertA's key stored in NAND or somewhere else so we can eventually grab that and setup a proxy to remote while replacing the original ninty ones to our own self-sign ones (Then we would be able to decode the data transfers between proxy to 3ds and proxy to remote). C.ClCertA.. The workers think their private key can never be leaked so no CRL and just stored in hardware with a package cheating their boss. Which one you think would be the best answer? BTW i do really think there is ones with R/W access to the hardware.. Hope you find new apis.--[[User:Syphurith|Syphurith]] 02:35, 4 July 2013 (CEST)
:::ClCertA contains the SSL client RSA cert/private-key, when one has that one can only access their servers(like with a PC) with that, *nothing* more. I'm not sure why they store that data in a CFA seperate from SSL module, those two files stored in the ClCertA RomFS use additional encryption to begin with. "BTW i do really think there is ones with R/W access to the hardware" I'm not sure what you mean by that. --[[User:Yellows8|Yellows8]] 03:24, 4 July 2013 (CEST)
::::So no other things inside that package (Only CFA? I'm unable to decrypt the CDN so i can not even get a close look). If that key is stored in NAND, building up a proxy and replacing the original key and cert is not too easy lol (Then 3ds to us using our key and we to ninty using ninty keys, emulated.. able to catch all data pass through proxy SSL-decrypted) - even i don't know how to do that accurately (however can not assure). I don't think that private key is stored in nand or even sd, just cause of that can be easily cheated (if there is write access found). Since there is CRL enabled in the cert, even there is no CRL(Certificate Revocation List) file on remote now - that means they've prepared for declarition of the cert being invalid. after it is invalid they should take action to put a new package including new cert and private key (sounds reasonable for why they get such a package on cdn right?) and flash that into 3ds during a new update. That is why i think there is somewhere with at least write-access to the storation of keys. you mentioned ssl module, have you decrypted the whole executable yet (or from CDN with extracting its material)?
::::Conclusion: I do think there is some access to the storation of such a ssl private key. but i don't know where it exactly exists (even i hope that is stored in that key-scrambler - would bring a possibility to discovery the key-scrambler). i can not tell that is nand or sd or somewhere inside soc or actually key-scrambler, so i use hardware to refer that instead.--[[User:Syphurith|Syphurith]] 09:58, 4 July 2013 (CEST)
::::Appendix:iirc, the resources in one title may be refered and used in another title. so if only a new cert and key should be provided they may not need to rewrite the modules to implement that replacement. if i make a key-updater, i do provide keys in daily updates, and a modules such as connector (so ssl?) to everytime check the keys on server before start the secure connection. If such a speculation is right, then the write access can be in another title not the keys package. BTW have you built a tool that can help you detect the internal actions done in memory (when and who write/read which section of memory. there is such pc tools already but not arm)? It may help your analysing. --[[User:Syphurith|Syphurith]] 10:11, 4 July 2013 (CEST)

===Spam attack===
I guess the simple captcha isn't enough, do you have an idea what to do? (i'm asking you because you are the most active admin here). 
I think we should adopt a method of registration and waiting for an admin to approve it. the recent changes page is spammed hard and a lot of google pages, I guess, are being created linking to those pages. --[[User:Elisherer|Elisherer]] 09:40, 31 May 2013 (CEST)
:Mha is the only one that can do anything about anti-spam, I can't do much about it myself. Mha said that he would work on this tomorrow. --[[User:Yellows8|Yellows8]] 22:19, 31 May 2013 (CEST)
::A. Stop registeration for several weeks (NOT GOOD).
::B. Ajax to load captcha (maybe reCAPTCHA?). Not well-made bots will have trouble loading the javascript code or lose the speed (there is ones with javascript but can not act so quickly)(MAYBE USEFUL). This method is widely used ''it may be not so useful'' (against latest tools).
::C. Use auto filter to auto check those suspicious content and block those users, given an access for those by accident closed guys to talk about their opinion. (I do wonder if the wiki admin backdoor provide you such a tool)(Hey Regex~)
::D.find their IP and block the IP section for a while.(Similiar as A)
::E. Use man-made Email to validate (I means, instead of the system writing mail to user to validate, let user write mails to admin or other trusted -- use SPAM filter)(NOT WELL PRATICAL, Haven't tested, SO..)
::F. Calls for someone can trust and give him only those block and delete power (DIFFICULT). Well just a little tries..
::G. Try to update your wiki version first, i mean the version of this website framework. (MAYBE USEFUL? DOUBT..)
::If you tried the actions of blocking and the spam still flow in you need to update or call wiki program's supporters (may be exploit..) But i do wonder why they tried to attack here, a (script) guy (with latest tool)?(if so he should try to improve his skill first).
::Oh well, Recent changes. Guys have a good day (International Children's Day).--[[User:Syphurith|Syphurith]] 09:39, 1 June 2013 (CEST)
:We are able to mark those pages as spam but however no effects in deed if no one comes to remove those spam accounts. Well.--[[User:Syphurith|Syphurith]] 10:17, 17 June 2013 (CEST)

===Fundraiser===
Hello Yellows8,
I know you're not the one that is responsible for the chip decapping fundraiser, but I didn't manage to contact Jl12 via E-Mail (He's not responding). So, have you guys noticed that the donations hit the 2000$ last week? Will the decapping start anytime soon or do you need some more money for buying the 3DS itself?
Best regards
:Jl12 has had a broken 3DS for decapping before the fundraiser even started. And of course we noticed that, however since Jl12 is usually very busy it might be a while before he sends his 3DS for decapping. --[[User:Yellows8|Yellows8]] 00:26, 5 June 2013 (CEST)
Hi again,
anything regarding the chip decapping happened in the past week? Will the images be released to the public?
Best regards
:We still haven't heard anything from Jl12. --[[User:Yellows8|Yellows8]] 19:34, 15 June 2013 (CEST)
So Still no news from Jl12? Seems not seeing him for long.--[[User:Syphurith|Syphurith]] 02:35, 4 July 2013 (CEST)

User talk:Yellows8

2013-07-04T05:58:16Z

Syphurith: about ClCertA and CRL

Thanks for clearing that up about the free space on the "TWL", what confused me about the name was how the dev unit handled ds games. You know how the 3ds's code name is CTR(we don't know what that stands for yet) and the ds's code name is NTR which mean Nitro. When a 3DS game is inserted, the dev menu says a "CTR CARD" is inserted, but when a DS game is inserted it says a "TWL CARD" is inserted instead of what I expected which would be "NTR CARD". I still do not understand this. - 3dsguy
:DS=NTR, DSLite=USG (japanese for thin..), DSi=TWL(Twelve), DSiXL=UTL, 3DS=CTR... DS (on the 3DS) is usually associated with DSi.. --[[User:Elisherer|Elisherer]] 02:32, 19 October 2011 (CEST)
::3dsguy, that game you inserted was released *long* before DSi right?(also, sign your comments with the signature button) --[[User:Yellows8|Yellows8]] 04:02, 19 October 2011 (CEST)
:Elisherer thanks for clearing that up :).--[[User:3dsguy|3dsguy]] 09:46, 19 October 2011 (CEST)
::Yellows8, no that game was not, but just now i tryed it with a game released in 2006 and it still said 'TWL CARD', but what Elisherer said explained this.--[[User:3dsguy|3dsguy]] 09:46, 19 October 2011 (CEST)

:DS = NTR/Nitro
:DSi = TWL/Twilight
:3DS = CTR/Horizon
:Wii = RVL/Revolution

:Yellows8 - if you have DS/Nitro code running on a DSi system, can you escalate to DSi/TWL mode or load a TWL/DSi binary or similar. [[User:Jl12|Jl12]]
::No, that's impossible. When DSi launcher/sysmenu switches to DS-mode, launcher clears the MSB of a DSi register disabling access to the registers controlling what hw is enabled and the clock rate etc. Once those regs are disabled, it's impossible to re-enable them again without resetting the system via I2C etc.(Also, by the time any exploited title is running homebrew code, those regs are already disabled too.) --[[User:Yellows8|Yellows8]] 19:53, 7 November 2011 (CET)
: Is the NAND encrypted as it is on 3DS? Also, does DSi use DLP [for TWL games] at all? [[User:Jl12|Jl12]]
::Yes, DSi NAND is encrypted with AES-CTR. DSiWare uses download-play but the WMB/dlp binaries are DS-mode only.--[[User:Yellows8|Yellows8]] 06:27, 14 November 2011 (CET)

@Yellows8 - I'm sorry for asking this so late, but what does NUS stand for in this context "redistributing copyrighted content, in this case NUS content, is *not* allowed here.". I do not understand why you deleted my page: [[Update Data|Update Data]]
:NUS = Nintendo Update Servers. Those archive(s) you linked to contained files you downloaded from NUS, all of which are copyrighted. Besides, mirroring NUS content without any decryption done at all is *completely* pointless. --[[User:Yellows8|Yellows8]] 16:41, 12 December 2011 (CET)
::So would it be better to provide update logs, so it can point people to which update data is from which version as on the NUS the individual update data for each title is not stored the same way for all titles, providing people with further reference, so they know what they are using. You may ask me what would they use them for, they are still not decrypted and therefore pointless. ATM knowing which version is which on the NUS *maybe* very important, but I can't tell you more until later.--[[User:3dsguy|3dsguy]] 01:19, 13 December 2011 (CET)
:::Yeah a list of titleIDs and versions would be fine. One could grab that info from [[Title_list]] diffs, but that's not the best way to handle this. I have lists of updated titles for each 3DS system update, but of course I never bothered to document which version was from what sysupdate beyond just adding them to the title list page.(obtained from their system update SOAP) --[[User:Yellows8|Yellows8]] 02:20, 13 December 2011 (CET)

@Yellows8 - Thanks for your progress everyday, really. i have questions.. If feeling uneasy please tell me politely (and i will remove these).
* Would you need a tool that can use specified patterns to mark the decrypted binary (certainly it can not be perfect) ? Or have you find a disassembler so powerful that you don't need that a tool any more? please tell me. if that is useful, let me and my friend make that.
:The tool would have such ability in resolving the configuration file. Comment, Include, CmdID (with no params), CmdID (with specified params), CmdID (with no specified params). such as 80001000:0103:4,0102:4,Any:4. (ie this can mark 800010000102 out as a second type).
* Just curious. It has been a long time since neimod's latest update. Have you got a board from him, or you are only using the exploit (not with the board). If the board is helpful, is there any access to get/purchase one? (if no i think i should learn how to diy one then)
it seems to be a long time for you to do all the documentations by yourself. (Orz i forgot my suggestion) --[[User:Syphurith|Syphurith]] 02:35, 15 April 2013 (CEST)
:I don't have any 3DS ramhaxx, I use software savegame haxx of course. "is there any access to get/purchase one? (if no i think i should learn how to diy one then)" You should be asking neimod about that instead, but [https://secure.flickr.com/photos/neimod/6238747088/in/photostream the] [https://secure.flickr.com/photos/neimod/6212627980/in/photostream soldering] for 3DS ramhaxx would be *really* difficult. I'm not sure what you mean regarding that tool either, are you referring to a tool which would locate the code for service commands in a binary? --[[User:Yellows8|Yellows8]] 03:10, 15 April 2013 (CEST)
::Thanks for reply. I will try to contact him for boards. About the tool --sniff--.
::* Cons: can not detect structures; may make mistake; need configuration file (can be made by writing the header code)
::* Pros: can visually color the matched patterns; can load unlimited size of file (result will be divided into segments of 1MB or other)
::It would not be too difficult to make. However may take one or two weeks. --[[User:Syphurith|Syphurith]] 03:49, 15 April 2013 (CEST)
:::I have no need for a tool which searches for service commandIDs, when I can just search for commandIDs etc in my text-editor for disassembled code. --[[User:Yellows8|Yellows8]] 04:04, 15 April 2013 (CEST)
::::Well thanks for reply. I removed the details above. I will left it undone. Have a good day.--[[User:Syphurith|Syphurith]] 04:21, 15 April 2013 (CEST)
I've seen there are users without contributions flew in. There are even some guys cheating (or just making jokes) with your names.. What's your opinion about that? PS3Brew is blocking those without edits (daily). --[[User:Syphurith|Syphurith]] 17:03, 17 April 2013 (CEST)
:I don't care much about either,(neither of those fake accounts were used to edit anything at least) I'm not an admin here though. --[[User:Yellows8|Yellows8]] 17:36, 17 April 2013 (CEST)

Hello Yellows8,
I have a question regarding the release of the hack. You guys said, that you won't release it, because it is very easy to patch. Now the new firmware was released and in fact the exploit was patched. So releasing it now wouldn't change anything, because Nintendo already patched it.

But if you release it now, people could start develloping homebrew and when you guys find a new exploit for the new firmware, we would already have a good base of homebrew applications.

So why still hiding it from the world?

Best regards and thank you for your work

elBirx
:"the exploit was patched" Only the code execution haxx was [[5.0.0-11|fixed]], the savegame haxx was not fixed. "But if you release it now, people could start develloping homebrew" No, currently it's '''only''' useful for reverse engineers. Almost everyone that wants that savegame haxx would have no use for it right now, since "it's '''only''' useful for reverse engineers". --[[User:Yellows8|Yellows8]] 18:46, 21 April 2013 (CEST)
::So i do think only one that want to do Reverse engineering and do have skills in ARM disassembly can ask you for such a thing. Yellows8, what would i need to learn if i want to analyse those (taken ARM references in consideration)? --[[User:Syphurith|Syphurith]] 03:07, 22 April 2013 (CEST)
:::What are you referring to by "those"? --[[User:Yellows8|Yellows8]] 04:26, 22 April 2013 (CEST)
::::I'm so sorry for my poor expression skill. If i want to analyse the ram or anything that you used as a material.. Exefs is ARM code so i think to check those (you can get using exploit/haxx) need arm knowledges. i mean, that is those service APIs. you did say you can check disassembled code. Even i don't know what is left to be done. --[[User:Syphurith|Syphurith]] 07:31, 22 April 2013 (CEST)
:::::"what would i need to learn..." You could learn to read/write ARM assembly, and learn reverse engineering. --[[User:Yellows8|Yellows8]] 07:38, 22 April 2013 (CEST)
::::::Thanks. Confirmed~ That's clear to me now. --[[User:Syphurith|Syphurith]] 11:53, 22 April 2013 (CEST)

Eh. Yellows8, i got some n00b questions about the ARM execution.

There is non-executable sections in the memory layout, but where did these "This can be executed" flags got initialized (I mean that is made of hardware circuits or bios or other software section)? If that is not changable, would all those ARM cores use the same non-execution flags settings(possibly no so we may change the core to keep that work?). Even more, can we sniffer the data app to core and change its execution length then inject.

Also, is there any method to let the core execute those commands (that you detected) and use that to produce something you interested in?
:The ARM11 kernel [[Memory_layout#ARM11_User-land_memory_regions|initializes]] the MMU tables. "Also, is there any method to let the core execute those commands (that you detected) and use that to produce something you interested in?" By running code on a 3DS of course. --[[User:Yellows8|Yellows8]] 17:27, 17 June 2013 (CEST)
::Thanks. But still feeling strange of that strategy. I think at least the Home Menu may be able to re-map or deactive this mark.
::-snip- Sorry for being noob (i would try learning arm soon). Hope you good work.--[[User:Syphurith|Syphurith]] 02:46, 19 June 2013 (CEST)

Home Menu starts application processes via [[NS]], terminating and "suspending" process execution(the process is still running with that, the application threads wait for a [[NS]] notification for resuming actual execution) is done via NS as well. The ARM11 kernel handles mapping the processes' virtual memory for .text, .rodata, and .data. The ARM11 kernel handles terminating processes as well of course. The only process which has access to [[SVC|svcControlProcessMemory]] for mapping memory or changing memory permissions, is [[RO_Services|RO]] module, and of course that module will only map R-X .text pages for the signed [[CRO0|CRO]] .text. --[[User:Yellows8|Yellows8]] 03:16, 19 June 2013 (CEST)
:I can still remember ns/ro is also a title in title list. (if manually start that may fails/cause failure) if you launch a title with those commands manually, would it be exposed (in ram?)(, if so we may dump the firmware/modules)? MPS let multiple processes can share the same resources (with home menu?). or have we to modify the real memory externally? There are just thoughts, if interesting please think for a while; if not just tell me "NONE".--[[User:Syphurith|Syphurith]] 05:17, 19 June 2013 (CEST)
:I saw you update the AES page recently. you can confirm some keyslots are with the same data, but how had you done that (by comparing the data, or just the same memory location)? Can you even fetch those keys to decrypt the CDN TMD key strings? if so that would be a potential way to go.. BTW you're disasm those in-memory content not the decrypted Romfs right?
:I do wonder if contents decrypted succussfully, shall we need any customed disassembler? --[[User:Syphurith|Syphurith]] 16:51, 26 June 2013 (CEST)
::"some keyslots are with the same data" I encrypted an all-zero block with each AES engine keyslot with CTR=0, and encrypted that data again with each keyslot with keyY=0. When the output block for the former is the same for multiple keyslots, those keyslots use the same keyX/keyY. When the latter output block is the same for multiple keyslots, those keyslots use the same keyX. "decrypt the CDN TMD key strings" TMDs have nothing to do with decrypting the ticket titlekey. [[RomFS]] does not contain code(besides [[CRO0]] for web browser), that's stored in [[ExeFS]]:/.code. There's no need to dump code from memory when one can just use the [[AES]] engine. --[[User:Yellows8|Yellows8]] 17:40, 26 June 2013 (CEST)
:::oh well. sorry for been n00b again. then have you ever found something that you can execute to decrypt those CDN data? i badly wanna try it.. ExeFS.. okey.. hope good work--[[User:Syphurith|Syphurith]] 08:04, 27 June 2013 (CEST)
:::-snip- --[[User:Syphurith|Syphurith]] 08:36, 27 June 2013 (CEST)
::::You do not "call" crypto functions here, this is a hardware [[AES]] engine with a hardware key-scrambler. "found something that you can execute to decrypt those CDN data" Not sure what you mean when we had system-version v4.5 total-control code exec haxx since December. --[[User:Yellows8|Yellows8]] 09:52, 27 June 2013 (CEST)
:::::I forgot that hours ago. sorry. I thought we would be able to feed those raw data we got from CDN, and let it decrypt and extract for us. then at least we may be able to find those differences in modules implemented between two nearby versions. Some just fix crash - stablility, and some would fix some vulnerables we may use, and some would indicates those internal logical process of the module's implementation. we can not always rely on those ROP or other black-box methods. when we get the opportunity to build a CFW or a special homebrew that would affect the original behaviours of the system, we may need to modify it right? also that should show us some interesting points if we have ones dedicated on analysing those. --[[User:Syphurith|Syphurith]] 14:51, 27 June 2013 (CEST)
::::::Total-control code exec haxx = access to the [[AES]] engine obviously. "build a 'CFW'" That's not possible because of [[NCCH|RSA]], the only way around that would be to exploit software while the system is booting or exploit Home Menu. And patching the NCCH signature checks(from like savegame haxx with a game) is rather pointless, because you would have to re-patch *every* time you boot your 3DS(there's no need to run a regular homebrew application via NCCH this way either tbh). --[[User:Yellows8|Yellows8]] 16:06, 27 June 2013 (CEST)
:::::Thx. That's exactly how cfw works. (sorry i only have psp and 3ds) procfw on psp, have ipl flashed (psp has one special section inside its battery) can auto-patch the cfw code into the system while booting. But have no news for how those men repair customer's device i definitely have no clubs about the existence of similiar mechism. Besides, patching is not that easy, well. i know you have full access to AES engine, and i just want to know have you ever tried or thought of using contents from CDN and decrypt them and disassemble to seek something interesting. --[[User:Syphurith|Syphurith]] 05:31, 28 June 2013 (CEST)
::::::Using the AES engine is basically the only way to obtain cleartext NCCH for updated titles, without finalizing the install for titles. That's obviously where stuff like the new [[6.0.0-11|savegame]] keyY info came from. --[[User:Yellows8|Yellows8]] 07:16, 28 June 2013 (CEST)
:::::Okey, good. you can take use of that (however still not related to exefs..) have a good day.
::There is ClCertA on CDN. Important keys are stored in hardware key-scrambler right? A.ClCertA's private key stored in hardware and there is api called with write access in the package. B.ClCertA's key stored in NAND or somewhere else so we can eventually grab that and setup a proxy to remote while replacing the original ninty ones to our own self-sign ones (Then we would be able to decode the data transfers between proxy to 3ds and proxy to remote). C.ClCertA.. The workers think their private key can never be leaked so no CRL and just stored in hardware with a package cheating their boss. Which one you think would be the best answer? BTW i do really think there is ones with R/W access to the hardware.. Hope you find new apis.--[[User:Syphurith|Syphurith]] 02:35, 4 July 2013 (CEST)
:::ClCertA contains the SSL client RSA cert/private-key, when one has that one can only access their servers(like with a PC) with that, *nothing* more. I'm not sure why they store that data in a CFA seperate from SSL module, those two files stored in the ClCertA RomFS use additional encryption to begin with. "BTW i do really think there is ones with R/W access to the hardware" I'm not sure what you mean by that. --[[User:Yellows8|Yellows8]] 03:24, 4 July 2013 (CEST)
::::So no other things inside that package (Only CFA? I'm unable to decrypt the CDN so i can not even get a close look). If that key is stored in NAND, building up a proxy and replacing the original key and cert is not too easy lol (Then 3ds to us using our key and we to ninty using ninty keys, emulated.. able to catch all data pass through proxy SSL-decrypted) - even i don't know how to do that accurately (however can not assure). I don't think that private key is stored in nand or even sd, just cause of that can be easily cheated (if there is write access found). Since there is CRL enabled in the cert, even there is no CRL(Certificate Revocation List) file on remote now - that means they've prepared for declarition of the cert being invalid. after it is invalid they should take action to put a new package including new cert and private key (sounds reasonable for why they get such a package on cdn right?) and flash that into 3ds during a new update. That is why i think there is somewhere with at least write-access to the storation of keys. you mentioned ssl module, have you decrypted the whole executable yet (or from CDN with extracting its material)?
::::Conclusion: I do think there is some access to the storation of such a ssl private key. but i don't know where it exactly exists (even i hope that is stored in that key-scrambler - would bring a possibility to discovery the key-scrambler). i can not tell that is nand or sd or somewhere inside soc or actually key-scrambler, so i use hardware to refer that instead.--[[User:Syphurith|Syphurith]] 09:58, 4 July 2013 (CEST)

===Spam attack===
I guess the simple captcha isn't enough, do you have an idea what to do? (i'm asking you because you are the most active admin here). 
I think we should adopt a method of registration and waiting for an admin to approve it. the recent changes page is spammed hard and a lot of google pages, I guess, are being created linking to those pages. --[[User:Elisherer|Elisherer]] 09:40, 31 May 2013 (CEST)
:Mha is the only one that can do anything about anti-spam, I can't do much about it myself. Mha said that he would work on this tomorrow. --[[User:Yellows8|Yellows8]] 22:19, 31 May 2013 (CEST)
::A. Stop registeration for several weeks (NOT GOOD).
::B. Ajax to load captcha (maybe reCAPTCHA?). Not well-made bots will have trouble loading the javascript code or lose the speed (there is ones with javascript but can not act so quickly)(MAYBE USEFUL). This method is widely used ''it may be not so useful'' (against latest tools).
::C. Use auto filter to auto check those suspicious content and block those users, given an access for those by accident closed guys to talk about their opinion. (I do wonder if the wiki admin backdoor provide you such a tool)(Hey Regex~)
::D.find their IP and block the IP section for a while.(Similiar as A)
::E. Use man-made Email to validate (I means, instead of the system writing mail to user to validate, let user write mails to admin or other trusted -- use SPAM filter)(NOT WELL PRATICAL, Haven't tested, SO..)
::F. Calls for someone can trust and give him only those block and delete power (DIFFICULT). Well just a little tries..
::G. Try to update your wiki version first, i mean the version of this website framework. (MAYBE USEFUL? DOUBT..)
::If you tried the actions of blocking and the spam still flow in you need to update or call wiki program's supporters (may be exploit..) But i do wonder why they tried to attack here, a (script) guy (with latest tool)?(if so he should try to improve his skill first).
::Oh well, Recent changes. Guys have a good day (International Children's Day).--[[User:Syphurith|Syphurith]] 09:39, 1 June 2013 (CEST)
:We are able to mark those pages as spam but however no effects in deed if no one comes to remove those spam accounts. Well.--[[User:Syphurith|Syphurith]] 10:17, 17 June 2013 (CEST)

===Fundraiser===
Hello Yellows8,
I know you're not the one that is responsible for the chip decapping fundraiser, but I didn't manage to contact Jl12 via E-Mail (He's not responding). So, have you guys noticed that the donations hit the 2000$ last week? Will the decapping start anytime soon or do you need some more money for buying the 3DS itself?
Best regards
:Jl12 has had a broken 3DS for decapping before the fundraiser even started. And of course we noticed that, however since Jl12 is usually very busy it might be a while before he sends his 3DS for decapping. --[[User:Yellows8|Yellows8]] 00:26, 5 June 2013 (CEST)
Hi again,
anything regarding the chip decapping happened in the past week? Will the images be released to the public?
Best regards
:We still haven't heard anything from Jl12. --[[User:Yellows8|Yellows8]] 19:34, 15 June 2013 (CEST)
So Still no news from Jl12? Seems not seeing him for long.--[[User:Syphurith|Syphurith]] 02:35, 4 July 2013 (CEST)

User talk:Yellows8

2013-07-03T22:35:25Z

Syphurith: questions~*2

Thanks for clearing that up about the free space on the "TWL", what confused me about the name was how the dev unit handled ds games. You know how the 3ds's code name is CTR(we don't know what that stands for yet) and the ds's code name is NTR which mean Nitro. When a 3DS game is inserted, the dev menu says a "CTR CARD" is inserted, but when a DS game is inserted it says a "TWL CARD" is inserted instead of what I expected which would be "NTR CARD". I still do not understand this. - 3dsguy
:DS=NTR, DSLite=USG (japanese for thin..), DSi=TWL(Twelve), DSiXL=UTL, 3DS=CTR... DS (on the 3DS) is usually associated with DSi.. --[[User:Elisherer|Elisherer]] 02:32, 19 October 2011 (CEST)
::3dsguy, that game you inserted was released *long* before DSi right?(also, sign your comments with the signature button) --[[User:Yellows8|Yellows8]] 04:02, 19 October 2011 (CEST)
:Elisherer thanks for clearing that up :).--[[User:3dsguy|3dsguy]] 09:46, 19 October 2011 (CEST)
::Yellows8, no that game was not, but just now i tryed it with a game released in 2006 and it still said 'TWL CARD', but what Elisherer said explained this.--[[User:3dsguy|3dsguy]] 09:46, 19 October 2011 (CEST)

:DS = NTR/Nitro
:DSi = TWL/Twilight
:3DS = CTR/Horizon
:Wii = RVL/Revolution

:Yellows8 - if you have DS/Nitro code running on a DSi system, can you escalate to DSi/TWL mode or load a TWL/DSi binary or similar. [[User:Jl12|Jl12]]
::No, that's impossible. When DSi launcher/sysmenu switches to DS-mode, launcher clears the MSB of a DSi register disabling access to the registers controlling what hw is enabled and the clock rate etc. Once those regs are disabled, it's impossible to re-enable them again without resetting the system via I2C etc.(Also, by the time any exploited title is running homebrew code, those regs are already disabled too.) --[[User:Yellows8|Yellows8]] 19:53, 7 November 2011 (CET)
: Is the NAND encrypted as it is on 3DS? Also, does DSi use DLP [for TWL games] at all? [[User:Jl12|Jl12]]
::Yes, DSi NAND is encrypted with AES-CTR. DSiWare uses download-play but the WMB/dlp binaries are DS-mode only.--[[User:Yellows8|Yellows8]] 06:27, 14 November 2011 (CET)

@Yellows8 - I'm sorry for asking this so late, but what does NUS stand for in this context "redistributing copyrighted content, in this case NUS content, is *not* allowed here.". I do not understand why you deleted my page: [[Update Data|Update Data]]
:NUS = Nintendo Update Servers. Those archive(s) you linked to contained files you downloaded from NUS, all of which are copyrighted. Besides, mirroring NUS content without any decryption done at all is *completely* pointless. --[[User:Yellows8|Yellows8]] 16:41, 12 December 2011 (CET)
::So would it be better to provide update logs, so it can point people to which update data is from which version as on the NUS the individual update data for each title is not stored the same way for all titles, providing people with further reference, so they know what they are using. You may ask me what would they use them for, they are still not decrypted and therefore pointless. ATM knowing which version is which on the NUS *maybe* very important, but I can't tell you more until later.--[[User:3dsguy|3dsguy]] 01:19, 13 December 2011 (CET)
:::Yeah a list of titleIDs and versions would be fine. One could grab that info from [[Title_list]] diffs, but that's not the best way to handle this. I have lists of updated titles for each 3DS system update, but of course I never bothered to document which version was from what sysupdate beyond just adding them to the title list page.(obtained from their system update SOAP) --[[User:Yellows8|Yellows8]] 02:20, 13 December 2011 (CET)

@Yellows8 - Thanks for your progress everyday, really. i have questions.. If feeling uneasy please tell me politely (and i will remove these).
* Would you need a tool that can use specified patterns to mark the decrypted binary (certainly it can not be perfect) ? Or have you find a disassembler so powerful that you don't need that a tool any more? please tell me. if that is useful, let me and my friend make that.
:The tool would have such ability in resolving the configuration file. Comment, Include, CmdID (with no params), CmdID (with specified params), CmdID (with no specified params). such as 80001000:0103:4,0102:4,Any:4. (ie this can mark 800010000102 out as a second type).
* Just curious. It has been a long time since neimod's latest update. Have you got a board from him, or you are only using the exploit (not with the board). If the board is helpful, is there any access to get/purchase one? (if no i think i should learn how to diy one then)
it seems to be a long time for you to do all the documentations by yourself. (Orz i forgot my suggestion) --[[User:Syphurith|Syphurith]] 02:35, 15 April 2013 (CEST)
:I don't have any 3DS ramhaxx, I use software savegame haxx of course. "is there any access to get/purchase one? (if no i think i should learn how to diy one then)" You should be asking neimod about that instead, but [https://secure.flickr.com/photos/neimod/6238747088/in/photostream the] [https://secure.flickr.com/photos/neimod/6212627980/in/photostream soldering] for 3DS ramhaxx would be *really* difficult. I'm not sure what you mean regarding that tool either, are you referring to a tool which would locate the code for service commands in a binary? --[[User:Yellows8|Yellows8]] 03:10, 15 April 2013 (CEST)
::Thanks for reply. I will try to contact him for boards. About the tool --sniff--.
::* Cons: can not detect structures; may make mistake; need configuration file (can be made by writing the header code)
::* Pros: can visually color the matched patterns; can load unlimited size of file (result will be divided into segments of 1MB or other)
::It would not be too difficult to make. However may take one or two weeks. --[[User:Syphurith|Syphurith]] 03:49, 15 April 2013 (CEST)
:::I have no need for a tool which searches for service commandIDs, when I can just search for commandIDs etc in my text-editor for disassembled code. --[[User:Yellows8|Yellows8]] 04:04, 15 April 2013 (CEST)
::::Well thanks for reply. I removed the details above. I will left it undone. Have a good day.--[[User:Syphurith|Syphurith]] 04:21, 15 April 2013 (CEST)
I've seen there are users without contributions flew in. There are even some guys cheating (or just making jokes) with your names.. What's your opinion about that? PS3Brew is blocking those without edits (daily). --[[User:Syphurith|Syphurith]] 17:03, 17 April 2013 (CEST)
:I don't care much about either,(neither of those fake accounts were used to edit anything at least) I'm not an admin here though. --[[User:Yellows8|Yellows8]] 17:36, 17 April 2013 (CEST)

Hello Yellows8,
I have a question regarding the release of the hack. You guys said, that you won't release it, because it is very easy to patch. Now the new firmware was released and in fact the exploit was patched. So releasing it now wouldn't change anything, because Nintendo already patched it.

But if you release it now, people could start develloping homebrew and when you guys find a new exploit for the new firmware, we would already have a good base of homebrew applications.

So why still hiding it from the world?

Best regards and thank you for your work

elBirx
:"the exploit was patched" Only the code execution haxx was [[5.0.0-11|fixed]], the savegame haxx was not fixed. "But if you release it now, people could start develloping homebrew" No, currently it's '''only''' useful for reverse engineers. Almost everyone that wants that savegame haxx would have no use for it right now, since "it's '''only''' useful for reverse engineers". --[[User:Yellows8|Yellows8]] 18:46, 21 April 2013 (CEST)
::So i do think only one that want to do Reverse engineering and do have skills in ARM disassembly can ask you for such a thing. Yellows8, what would i need to learn if i want to analyse those (taken ARM references in consideration)? --[[User:Syphurith|Syphurith]] 03:07, 22 April 2013 (CEST)
:::What are you referring to by "those"? --[[User:Yellows8|Yellows8]] 04:26, 22 April 2013 (CEST)
::::I'm so sorry for my poor expression skill. If i want to analyse the ram or anything that you used as a material.. Exefs is ARM code so i think to check those (you can get using exploit/haxx) need arm knowledges. i mean, that is those service APIs. you did say you can check disassembled code. Even i don't know what is left to be done. --[[User:Syphurith|Syphurith]] 07:31, 22 April 2013 (CEST)
:::::"what would i need to learn..." You could learn to read/write ARM assembly, and learn reverse engineering. --[[User:Yellows8|Yellows8]] 07:38, 22 April 2013 (CEST)
::::::Thanks. Confirmed~ That's clear to me now. --[[User:Syphurith|Syphurith]] 11:53, 22 April 2013 (CEST)

Eh. Yellows8, i got some n00b questions about the ARM execution.

There is non-executable sections in the memory layout, but where did these "This can be executed" flags got initialized (I mean that is made of hardware circuits or bios or other software section)? If that is not changable, would all those ARM cores use the same non-execution flags settings(possibly no so we may change the core to keep that work?). Even more, can we sniffer the data app to core and change its execution length then inject.

Also, is there any method to let the core execute those commands (that you detected) and use that to produce something you interested in?
:The ARM11 kernel [[Memory_layout#ARM11_User-land_memory_regions|initializes]] the MMU tables. "Also, is there any method to let the core execute those commands (that you detected) and use that to produce something you interested in?" By running code on a 3DS of course. --[[User:Yellows8|Yellows8]] 17:27, 17 June 2013 (CEST)
::Thanks. But still feeling strange of that strategy. I think at least the Home Menu may be able to re-map or deactive this mark.
::-snip- Sorry for being noob (i would try learning arm soon). Hope you good work.--[[User:Syphurith|Syphurith]] 02:46, 19 June 2013 (CEST)

Home Menu starts application processes via [[NS]], terminating and "suspending" process execution(the process is still running with that, the application threads wait for a [[NS]] notification for resuming actual execution) is done via NS as well. The ARM11 kernel handles mapping the processes' virtual memory for .text, .rodata, and .data. The ARM11 kernel handles terminating processes as well of course. The only process which has access to [[SVC|svcControlProcessMemory]] for mapping memory or changing memory permissions, is [[RO_Services|RO]] module, and of course that module will only map R-X .text pages for the signed [[CRO0|CRO]] .text. --[[User:Yellows8|Yellows8]] 03:16, 19 June 2013 (CEST)
:I can still remember ns/ro is also a title in title list. (if manually start that may fails/cause failure) if you launch a title with those commands manually, would it be exposed (in ram?)(, if so we may dump the firmware/modules)? MPS let multiple processes can share the same resources (with home menu?). or have we to modify the real memory externally? There are just thoughts, if interesting please think for a while; if not just tell me "NONE".--[[User:Syphurith|Syphurith]] 05:17, 19 June 2013 (CEST)
:I saw you update the AES page recently. you can confirm some keyslots are with the same data, but how had you done that (by comparing the data, or just the same memory location)? Can you even fetch those keys to decrypt the CDN TMD key strings? if so that would be a potential way to go.. BTW you're disasm those in-memory content not the decrypted Romfs right?
:I do wonder if contents decrypted succussfully, shall we need any customed disassembler? --[[User:Syphurith|Syphurith]] 16:51, 26 June 2013 (CEST)
::"some keyslots are with the same data" I encrypted an all-zero block with each AES engine keyslot with CTR=0, and encrypted that data again with each keyslot with keyY=0. When the output block for the former is the same for multiple keyslots, those keyslots use the same keyX/keyY. When the latter output block is the same for multiple keyslots, those keyslots use the same keyX. "decrypt the CDN TMD key strings" TMDs have nothing to do with decrypting the ticket titlekey. [[RomFS]] does not contain code(besides [[CRO0]] for web browser), that's stored in [[ExeFS]]:/.code. There's no need to dump code from memory when one can just use the [[AES]] engine. --[[User:Yellows8|Yellows8]] 17:40, 26 June 2013 (CEST)
:::oh well. sorry for been n00b again. then have you ever found something that you can execute to decrypt those CDN data? i badly wanna try it.. ExeFS.. okey.. hope good work--[[User:Syphurith|Syphurith]] 08:04, 27 June 2013 (CEST)
:::-snip- --[[User:Syphurith|Syphurith]] 08:36, 27 June 2013 (CEST)
::::You do not "call" crypto functions here, this is a hardware [[AES]] engine with a hardware key-scrambler. "found something that you can execute to decrypt those CDN data" Not sure what you mean when we had system-version v4.5 total-control code exec haxx since December. --[[User:Yellows8|Yellows8]] 09:52, 27 June 2013 (CEST)
:::::I forgot that hours ago. sorry. I thought we would be able to feed those raw data we got from CDN, and let it decrypt and extract for us. then at least we may be able to find those differences in modules implemented between two nearby versions. Some just fix crash - stablility, and some would fix some vulnerables we may use, and some would indicates those internal logical process of the module's implementation. we can not always rely on those ROP or other black-box methods. when we get the opportunity to build a CFW or a special homebrew that would affect the original behaviours of the system, we may need to modify it right? also that should show us some interesting points if we have ones dedicated on analysing those. --[[User:Syphurith|Syphurith]] 14:51, 27 June 2013 (CEST)
::::::Total-control code exec haxx = access to the [[AES]] engine obviously. "build a 'CFW'" That's not possible because of [[NCCH|RSA]], the only way around that would be to exploit software while the system is booting or exploit Home Menu. And patching the NCCH signature checks(from like savegame haxx with a game) is rather pointless, because you would have to re-patch *every* time you boot your 3DS(there's no need to run a regular homebrew application via NCCH this way either tbh). --[[User:Yellows8|Yellows8]] 16:06, 27 June 2013 (CEST)
:::::Thx. That's exactly how cfw works. (sorry i only have psp and 3ds) procfw on psp, have ipl flashed (psp has one special section inside its battery) can auto-patch the cfw code into the system while booting. But have no news for how those men repair customer's device i definitely have no clubs about the existence of similiar mechism. Besides, patching is not that easy, well. i know you have full access to AES engine, and i just want to know have you ever tried or thought of using contents from CDN and decrypt them and disassemble to seek something interesting. --[[User:Syphurith|Syphurith]] 05:31, 28 June 2013 (CEST)
::::::Using the AES engine is basically the only way to obtain cleartext NCCH for updated titles, without finalizing the install for titles. That's obviously where stuff like the new [[6.0.0-11|savegame]] keyY info came from. --[[User:Yellows8|Yellows8]] 07:16, 28 June 2013 (CEST)
:::::Okey, good. you can take use of that (however still not related to exefs..) have a good day.
::There is ClCertA on CDN. Important keys are stored in hardware key-scrambler right? A.ClCertA's private key stored in hardware and there is api called with write access in the package. B.ClCertA's key stored in NAND or somewhere else so we can eventually grab that and setup a proxy to remote while replacing the original ninty ones to our own self-sign ones (Then we would be able to decode the data transfers between proxy to 3ds and proxy to remote). C.ClCertA.. The workers think their private key can never be leaked so no CRL and just stored in hardware with a package cheating their boss. Which one you think would be the best answer? BTW i do really think there is ones with R/W access to the hardware.. Hope you find new apis.--[[User:Syphurith|Syphurith]] 02:35, 4 July 2013 (CEST)

===Spam attack===
I guess the simple captcha isn't enough, do you have an idea what to do? (i'm asking you because you are the most active admin here). 
I think we should adopt a method of registration and waiting for an admin to approve it. the recent changes page is spammed hard and a lot of google pages, I guess, are being created linking to those pages. --[[User:Elisherer|Elisherer]] 09:40, 31 May 2013 (CEST)
:Mha is the only one that can do anything about anti-spam, I can't do much about it myself. Mha said that he would work on this tomorrow. --[[User:Yellows8|Yellows8]] 22:19, 31 May 2013 (CEST)
::A. Stop registeration for several weeks (NOT GOOD).
::B. Ajax to load captcha (maybe reCAPTCHA?). Not well-made bots will have trouble loading the javascript code or lose the speed (there is ones with javascript but can not act so quickly)(MAYBE USEFUL). This method is widely used ''it may be not so useful'' (against latest tools).
::C. Use auto filter to auto check those suspicious content and block those users, given an access for those by accident closed guys to talk about their opinion. (I do wonder if the wiki admin backdoor provide you such a tool)(Hey Regex~)
::D.find their IP and block the IP section for a while.(Similiar as A)
::E. Use man-made Email to validate (I means, instead of the system writing mail to user to validate, let user write mails to admin or other trusted -- use SPAM filter)(NOT WELL PRATICAL, Haven't tested, SO..)
::F. Calls for someone can trust and give him only those block and delete power (DIFFICULT). Well just a little tries..
::G. Try to update your wiki version first, i mean the version of this website framework. (MAYBE USEFUL? DOUBT..)
::If you tried the actions of blocking and the spam still flow in you need to update or call wiki program's supporters (may be exploit..) But i do wonder why they tried to attack here, a (script) guy (with latest tool)?(if so he should try to improve his skill first).
::Oh well, Recent changes. Guys have a good day (International Children's Day).--[[User:Syphurith|Syphurith]] 09:39, 1 June 2013 (CEST)
:We are able to mark those pages as spam but however no effects in deed if no one comes to remove those spam accounts. Well.--[[User:Syphurith|Syphurith]] 10:17, 17 June 2013 (CEST)

===Fundraiser===
Hello Yellows8,
I know you're not the one that is responsible for the chip decapping fundraiser, but I didn't manage to contact Jl12 via E-Mail (He's not responding). So, have you guys noticed that the donations hit the 2000$ last week? Will the decapping start anytime soon or do you need some more money for buying the 3DS itself?
Best regards
:Jl12 has had a broken 3DS for decapping before the fundraiser even started. And of course we noticed that, however since Jl12 is usually very busy it might be a while before he sends his 3DS for decapping. --[[User:Yellows8|Yellows8]] 00:26, 5 June 2013 (CEST)
Hi again,
anything regarding the chip decapping happened in the past week? Will the images be released to the public?
Best regards
:We still haven't heard anything from Jl12. --[[User:Yellows8|Yellows8]] 19:34, 15 June 2013 (CEST)
So Still no news from Jl12? Seems not seeing him for long.--[[User:Syphurith|Syphurith]] 02:35, 4 July 2013 (CEST)

User:ShariHarg

2013-07-03T22:00:43Z

Syphurith: ok i think i would change another word to express s*am

User:AmparoReg

2013-07-03T21:58:35Z

Syphurith: you know what this is,right. set this to rubbish bin.

User:TeraHPU

2013-07-03T07:00:49Z

Syphurith: i would never surf one site with ads in wiki.

User:Franchesc

2013-07-03T06:59:32Z

Syphurith: i do wonder if that one responsible for blocking those users is back

User:WilfordCa

2013-06-30T07:20:52Z

Syphurith: yetanother sp**/**am

User:MaisieGir

2013-06-30T00:57:46Z

Syphurith: okey i do know all those *pam are *ds or ma**are site

3dbrew:Community portal

2013-06-29T01:31:36Z

Syphurith: ohhh installation. yellow yeah that seems a little far away.

== Theme ==

How about we change the default theme to 'Vector' to match the Wii and WiiU brew sites? --[[User:Elisherer|Elisherer]] 08:51, 11 December 2012 (CET)

==Translations==
To whoever translates this days..
* I recommend you wouldn't waste your time on translating pages which aren't finished (i.e. [[Savegames]])
* Do not translate database pages like [[Title list]] or [[Friend code]] these pages are updated regulary.
* This Wiki doesn't have a localization plug-in I would recommend waiting until it does..
--[[User:Elisherer|Elisherer]] 11:06, 15 March 2012 (CET)
: Okay, I see...--[[User:Wangxuan8331800|Wangxuan8331800]] 12:46, 16 March 2012 (CET)

Humm...

I think we create the other domains for those languages.--Matyapiro3118:24, 19 March 2012 (CET)

==Forum?==
A forum will be created when it becomes necessary, for e.g. actual discussion about homebrew development. Currently homebrew is not possible, so a forum is not needed yet. --[[User:Neimod|Neimod]] 01:05, 29 February 2012 (CET)

==weird communication==
Hello all, I found some weird UDP communication coming from the 3ds to the internet (japan). Connection is made towards IP 203.180.85.77, 202.232.239.25, and contains a string.
String starts with afa1, then the number 1,4 or 6, then comes either a short or long string (can contain 00) and it ends with a 2-byte counter (b3 in my case). It seems to be repeated, but I cant reproduce it as of now. It happened after I tried to update the 3ds, but it could be related to video/spotpass (suggestions?)

Example:
af a1 44 00 00 00 00 00 00 00 00 b3

Any suggestions/ideas what it could be? --[[User:Mr seeker|Mr seeker]] 20:26, 8 December 2011 (CET)

==3ds dev unit==
Hey,Xcution,don't you release helloworld.cia?--Matyapiro31 15:40, 1 December 2011 (CET)

==Homebrew install idea?==
Could it be installed in a way similar to Smash Bros. Brawl? Where you go to a webpage with a 3D image to download (like on 3ds.to) but when you load it in Camera/Swapnote it triggers? Or with the new Save Backup feature they just added? Sorry if this is the wrong place to suggest ideas... [[User:Jariesuicune|Jarieスイクン]] 18:22, 28 June 2013 (CEST)
:It is good place to post idea, that's all good as well. however since there is few that can reverse those ARM executables, we don't have ones alike yellow that can do such a job. even grabbed the power of 4.5.x we don't have people that can work on analysis on those app - we don't have enough ones to see into the implementation of system modules yet. So that is a pity we can only think and suggest, or go to learn reverse engineering and ARM disassembly first. BTW that site seems down (to me), also i don't think they would enable such a method. you can contact them on irc when you got something you think that is very interesting or would easily happen.--[[User:Syphurith|Syphurith]] 05:31, 29 June 2013 (CEST)

User:ElliottEd

2013-06-29T01:24:02Z

Syphurith: yet another s&*m

User talk:Yellows8

2013-06-28T07:17:14Z

Syphurith: question terminated.

Thanks for clearing that up about the free space on the "TWL", what confused me about the name was how the dev unit handled ds games. You know how the 3ds's code name is CTR(we don't know what that stands for yet) and the ds's code name is NTR which mean Nitro. When a 3DS game is inserted, the dev menu says a "CTR CARD" is inserted, but when a DS game is inserted it says a "TWL CARD" is inserted instead of what I expected which would be "NTR CARD". I still do not understand this. - 3dsguy
:DS=NTR, DSLite=USG (japanese for thin..), DSi=TWL(Twelve), DSiXL=UTL, 3DS=CTR... DS (on the 3DS) is usually associated with DSi.. --[[User:Elisherer|Elisherer]] 02:32, 19 October 2011 (CEST)
::3dsguy, that game you inserted was released *long* before DSi right?(also, sign your comments with the signature button) --[[User:Yellows8|Yellows8]] 04:02, 19 October 2011 (CEST)
:Elisherer thanks for clearing that up :).--[[User:3dsguy|3dsguy]] 09:46, 19 October 2011 (CEST)
::Yellows8, no that game was not, but just now i tryed it with a game released in 2006 and it still said 'TWL CARD', but what Elisherer said explained this.--[[User:3dsguy|3dsguy]] 09:46, 19 October 2011 (CEST)

:DS = NTR/Nitro
:DSi = TWL/Twilight
:3DS = CTR/Horizon
:Wii = RVL/Revolution

:Yellows8 - if you have DS/Nitro code running on a DSi system, can you escalate to DSi/TWL mode or load a TWL/DSi binary or similar. [[User:Jl12|Jl12]]
::No, that's impossible. When DSi launcher/sysmenu switches to DS-mode, launcher clears the MSB of a DSi register disabling access to the registers controlling what hw is enabled and the clock rate etc. Once those regs are disabled, it's impossible to re-enable them again without resetting the system via I2C etc.(Also, by the time any exploited title is running homebrew code, those regs are already disabled too.) --[[User:Yellows8|Yellows8]] 19:53, 7 November 2011 (CET)
: Is the NAND encrypted as it is on 3DS? Also, does DSi use DLP [for TWL games] at all? [[User:Jl12|Jl12]]
::Yes, DSi NAND is encrypted with AES-CTR. DSiWare uses download-play but the WMB/dlp binaries are DS-mode only.--[[User:Yellows8|Yellows8]] 06:27, 14 November 2011 (CET)

@Yellows8 - I'm sorry for asking this so late, but what does NUS stand for in this context "redistributing copyrighted content, in this case NUS content, is *not* allowed here.". I do not understand why you deleted my page: [[Update Data|Update Data]]
:NUS = Nintendo Update Servers. Those archive(s) you linked to contained files you downloaded from NUS, all of which are copyrighted. Besides, mirroring NUS content without any decryption done at all is *completely* pointless. --[[User:Yellows8|Yellows8]] 16:41, 12 December 2011 (CET)
::So would it be better to provide update logs, so it can point people to which update data is from which version as on the NUS the individual update data for each title is not stored the same way for all titles, providing people with further reference, so they know what they are using. You may ask me what would they use them for, they are still not decrypted and therefore pointless. ATM knowing which version is which on the NUS *maybe* very important, but I can't tell you more until later.--[[User:3dsguy|3dsguy]] 01:19, 13 December 2011 (CET)
:::Yeah a list of titleIDs and versions would be fine. One could grab that info from [[Title_list]] diffs, but that's not the best way to handle this. I have lists of updated titles for each 3DS system update, but of course I never bothered to document which version was from what sysupdate beyond just adding them to the title list page.(obtained from their system update SOAP) --[[User:Yellows8|Yellows8]] 02:20, 13 December 2011 (CET)

@Yellows8 - Thanks for your progress everyday, really. i have questions.. If feeling uneasy please tell me politely (and i will remove these).
* Would you need a tool that can use specified patterns to mark the decrypted binary (certainly it can not be perfect) ? Or have you find a disassembler so powerful that you don't need that a tool any more? please tell me. if that is useful, let me and my friend make that.
:The tool would have such ability in resolving the configuration file. Comment, Include, CmdID (with no params), CmdID (with specified params), CmdID (with no specified params). such as 80001000:0103:4,0102:4,Any:4. (ie this can mark 800010000102 out as a second type).
* Just curious. It has been a long time since neimod's latest update. Have you got a board from him, or you are only using the exploit (not with the board). If the board is helpful, is there any access to get/purchase one? (if no i think i should learn how to diy one then)
it seems to be a long time for you to do all the documentations by yourself. (Orz i forgot my suggestion) --[[User:Syphurith|Syphurith]] 02:35, 15 April 2013 (CEST)
:I don't have any 3DS ramhaxx, I use software savegame haxx of course. "is there any access to get/purchase one? (if no i think i should learn how to diy one then)" You should be asking neimod about that instead, but [https://secure.flickr.com/photos/neimod/6238747088/in/photostream the] [https://secure.flickr.com/photos/neimod/6212627980/in/photostream soldering] for 3DS ramhaxx would be *really* difficult. I'm not sure what you mean regarding that tool either, are you referring to a tool which would locate the code for service commands in a binary? --[[User:Yellows8|Yellows8]] 03:10, 15 April 2013 (CEST)
::Thanks for reply. I will try to contact him for boards. About the tool --sniff--.
::* Cons: can not detect structures; may make mistake; need configuration file (can be made by writing the header code)
::* Pros: can visually color the matched patterns; can load unlimited size of file (result will be divided into segments of 1MB or other)
::It would not be too difficult to make. However may take one or two weeks. --[[User:Syphurith|Syphurith]] 03:49, 15 April 2013 (CEST)
:::I have no need for a tool which searches for service commandIDs, when I can just search for commandIDs etc in my text-editor for disassembled code. --[[User:Yellows8|Yellows8]] 04:04, 15 April 2013 (CEST)
::::Well thanks for reply. I removed the details above. I will left it undone. Have a good day.--[[User:Syphurith|Syphurith]] 04:21, 15 April 2013 (CEST)
I've seen there are users without contributions flew in. There are even some guys cheating (or just making jokes) with your names.. What's your opinion about that? PS3Brew is blocking those without edits (daily). --[[User:Syphurith|Syphurith]] 17:03, 17 April 2013 (CEST)
:I don't care much about either,(neither of those fake accounts were used to edit anything at least) I'm not an admin here though. --[[User:Yellows8|Yellows8]] 17:36, 17 April 2013 (CEST)

Hello Yellows8,
I have a question regarding the release of the hack. You guys said, that you won't release it, because it is very easy to patch. Now the new firmware was released and in fact the exploit was patched. So releasing it now wouldn't change anything, because Nintendo already patched it.

But if you release it now, people could start develloping homebrew and when you guys find a new exploit for the new firmware, we would already have a good base of homebrew applications.

So why still hiding it from the world?

Best regards and thank you for your work

elBirx
:"the exploit was patched" Only the code execution haxx was [[5.0.0-11|fixed]], the savegame haxx was not fixed. "But if you release it now, people could start develloping homebrew" No, currently it's '''only''' useful for reverse engineers. Almost everyone that wants that savegame haxx would have no use for it right now, since "it's '''only''' useful for reverse engineers". --[[User:Yellows8|Yellows8]] 18:46, 21 April 2013 (CEST)
::So i do think only one that want to do Reverse engineering and do have skills in ARM disassembly can ask you for such a thing. Yellows8, what would i need to learn if i want to analyse those (taken ARM references in consideration)? --[[User:Syphurith|Syphurith]] 03:07, 22 April 2013 (CEST)
:::What are you referring to by "those"? --[[User:Yellows8|Yellows8]] 04:26, 22 April 2013 (CEST)
::::I'm so sorry for my poor expression skill. If i want to analyse the ram or anything that you used as a material.. Exefs is ARM code so i think to check those (you can get using exploit/haxx) need arm knowledges. i mean, that is those service APIs. you did say you can check disassembled code. Even i don't know what is left to be done. --[[User:Syphurith|Syphurith]] 07:31, 22 April 2013 (CEST)
:::::"what would i need to learn..." You could learn to read/write ARM assembly, and learn reverse engineering. --[[User:Yellows8|Yellows8]] 07:38, 22 April 2013 (CEST)
::::::Thanks. Confirmed~ That's clear to me now. --[[User:Syphurith|Syphurith]] 11:53, 22 April 2013 (CEST)

Eh. Yellows8, i got some n00b questions about the ARM execution.

There is non-executable sections in the memory layout, but where did these "This can be executed" flags got initialized (I mean that is made of hardware circuits or bios or other software section)? If that is not changable, would all those ARM cores use the same non-execution flags settings(possibly no so we may change the core to keep that work?). Even more, can we sniffer the data app to core and change its execution length then inject.

Also, is there any method to let the core execute those commands (that you detected) and use that to produce something you interested in?
:The ARM11 kernel [[Memory_layout#ARM11_User-land_memory_regions|initializes]] the MMU tables. "Also, is there any method to let the core execute those commands (that you detected) and use that to produce something you interested in?" By running code on a 3DS of course. --[[User:Yellows8|Yellows8]] 17:27, 17 June 2013 (CEST)
::Thanks. But still feeling strange of that strategy. I think at least the Home Menu may be able to re-map or deactive this mark.
::-snip- Sorry for being noob (i would try learning arm soon). Hope you good work.--[[User:Syphurith|Syphurith]] 02:46, 19 June 2013 (CEST)

Home Menu starts application processes via [[NS]], terminating and "suspending" process execution(the process is still running with that, the application threads wait for a [[NS]] notification for resuming actual execution) is done via NS as well. The ARM11 kernel handles mapping the processes' virtual memory for .text, .rodata, and .data. The ARM11 kernel handles terminating processes as well of course. The only process which has access to [[SVC|svcControlProcessMemory]] for mapping memory or changing memory permissions, is [[RO_Services|RO]] module, and of course that module will only map R-X .text pages for the signed [[CRO0|CRO]] .text. --[[User:Yellows8|Yellows8]] 03:16, 19 June 2013 (CEST)
:I can still remember ns/ro is also a title in title list. (if manually start that may fails/cause failure) if you launch a title with those commands manually, would it be exposed (in ram?)(, if so we may dump the firmware/modules)? MPS let multiple processes can share the same resources (with home menu?). or have we to modify the real memory externally? There are just thoughts, if interesting please think for a while; if not just tell me "NONE".--[[User:Syphurith|Syphurith]] 05:17, 19 June 2013 (CEST)
:I saw you update the AES page recently. you can confirm some keyslots are with the same data, but how had you done that (by comparing the data, or just the same memory location)? Can you even fetch those keys to decrypt the CDN TMD key strings? if so that would be a potential way to go.. BTW you're disasm those in-memory content not the decrypted Romfs right?
:I do wonder if contents decrypted succussfully, shall we need any customed disassembler? --[[User:Syphurith|Syphurith]] 16:51, 26 June 2013 (CEST)
::"some keyslots are with the same data" I encrypted an all-zero block with each AES engine keyslot with CTR=0, and encrypted that data again with each keyslot with keyY=0. When the output block for the former is the same for multiple keyslots, those keyslots use the same keyX/keyY. When the latter output block is the same for multiple keyslots, those keyslots use the same keyX. "decrypt the CDN TMD key strings" TMDs have nothing to do with decrypting the ticket titlekey. [[RomFS]] does not contain code(besides [[CRO0]] for web browser), that's stored in [[ExeFS]]:/.code. There's no need to dump code from memory when one can just use the [[AES]] engine. --[[User:Yellows8|Yellows8]] 17:40, 26 June 2013 (CEST)
:::oh well. sorry for been n00b again. then have you ever found something that you can execute to decrypt those CDN data? i badly wanna try it.. ExeFS.. okey.. hope good work--[[User:Syphurith|Syphurith]] 08:04, 27 June 2013 (CEST)
:::-snip- --[[User:Syphurith|Syphurith]] 08:36, 27 June 2013 (CEST)
::::You do not "call" crypto functions here, this is a hardware [[AES]] engine with a hardware key-scrambler. "found something that you can execute to decrypt those CDN data" Not sure what you mean when we had system-version v4.5 total-control code exec haxx since December. --[[User:Yellows8|Yellows8]] 09:52, 27 June 2013 (CEST)
:::::I forgot that hours ago. sorry. I thought we would be able to feed those raw data we got from CDN, and let it decrypt and extract for us. then at least we may be able to find those differences in modules implemented between two nearby versions. Some just fix crash - stablility, and some would fix some vulnerables we may use, and some would indicates those internal logical process of the module's implementation. we can not always rely on those ROP or other black-box methods. when we get the opportunity to build a CFW or a special homebrew that would affect the original behaviours of the system, we may need to modify it right? also that should show us some interesting points if we have ones dedicated on analysing those. --[[User:Syphurith|Syphurith]] 14:51, 27 June 2013 (CEST)
::::::Total-control code exec haxx = access to the [[AES]] engine obviously. "build a 'CFW'" That's not possible because of [[NCCH|RSA]], the only way around that would be to exploit software while the system is booting or exploit Home Menu. And patching the NCCH signature checks(from like savegame haxx with a game) is rather pointless, because you would have to re-patch *every* time you boot your 3DS(there's no need to run a regular homebrew application via NCCH this way either tbh). --[[User:Yellows8|Yellows8]] 16:06, 27 June 2013 (CEST)
:::::Thx. That's exactly how cfw works. (sorry i only have psp and 3ds) procfw on psp, have ipl flashed (psp has one special section inside its battery) can auto-patch the cfw code into the system while booting. But have no news for how those men repair customer's device i definitely have no clubs about the existence of similiar mechism. Besides, patching is not that easy, well. i know you have full access to AES engine, and i just want to know have you ever tried or thought of using contents from CDN and decrypt them and disassemble to seek something interesting. --[[User:Syphurith|Syphurith]] 05:31, 28 June 2013 (CEST)
::::::Using the AES engine is basically the only way to obtain cleartext NCCH for updated titles, without finalizing the install for titles. That's obviously where stuff like the new [[6.0.0-11|savegame]] keyY info came from. --[[User:Yellows8|Yellows8]] 07:16, 28 June 2013 (CEST)
:::::Okey, good. you can take use of that (however still not related to exefs..) have a good day.

===Spam attack===
I guess the simple captcha isn't enough, do you have an idea what to do? (i'm asking you because you are the most active admin here). 
I think we should adopt a method of registration and waiting for an admin to approve it. the recent changes page is spammed hard and a lot of google pages, I guess, are being created linking to those pages. --[[User:Elisherer|Elisherer]] 09:40, 31 May 2013 (CEST)
:Mha is the only one that can do anything about anti-spam, I can't do much about it myself. Mha said that he would work on this tomorrow. --[[User:Yellows8|Yellows8]] 22:19, 31 May 2013 (CEST)
::A. Stop registeration for several weeks (NOT GOOD).
::B. Ajax to load captcha (maybe reCAPTCHA?). Not well-made bots will have trouble loading the javascript code or lose the speed (there is ones with javascript but can not act so quickly)(MAYBE USEFUL). This method is widely used ''it may be not so useful'' (against latest tools).
::C. Use auto filter to auto check those suspicious content and block those users, given an access for those by accident closed guys to talk about their opinion. (I do wonder if the wiki admin backdoor provide you such a tool)(Hey Regex~)
::D.find their IP and block the IP section for a while.(Similiar as A)
::E. Use man-made Email to validate (I means, instead of the system writing mail to user to validate, let user write mails to admin or other trusted -- use SPAM filter)(NOT WELL PRATICAL, Haven't tested, SO..)
::F. Calls for someone can trust and give him only those block and delete power (DIFFICULT). Well just a little tries..
::G. Try to update your wiki version first, i mean the version of this website framework. (MAYBE USEFUL? DOUBT..)
::If you tried the actions of blocking and the spam still flow in you need to update or call wiki program's supporters (may be exploit..) But i do wonder why they tried to attack here, a (script) guy (with latest tool)?(if so he should try to improve his skill first).
::Oh well, Recent changes. Guys have a good day (International Children's Day).--[[User:Syphurith|Syphurith]] 09:39, 1 June 2013 (CEST)
:We are able to mark those pages as spam but however no effects in deed if no one comes to remove those spam accounts. Well.--[[User:Syphurith|Syphurith]] 10:17, 17 June 2013 (CEST)

===Fundraiser===
Hello Yellows8,
I know you're not the one that is responsible for the chip decapping fundraiser, but I didn't manage to contact Jl12 via E-Mail (He's not responding). So, have you guys noticed that the donations hit the 2000$ last week? Will the decapping start anytime soon or do you need some more money for buying the 3DS itself?
Best regards
:Jl12 has had a broken 3DS for decapping before the fundraiser even started. And of course we noticed that, however since Jl12 is usually very busy it might be a while before he sends his 3DS for decapping. --[[User:Yellows8|Yellows8]] 00:26, 5 June 2013 (CEST)
Hi again,
anything regarding the chip decapping happened in the past week? Will the images be released to the public?
Best regards
:We still haven't heard anything from Jl12. --[[User:Yellows8|Yellows8]] 19:34, 15 June 2013 (CEST)

User talk:Yellows8

2013-06-28T01:31:20Z

Syphurith: i know that but have you ever made a try?

Thanks for clearing that up about the free space on the "TWL", what confused me about the name was how the dev unit handled ds games. You know how the 3ds's code name is CTR(we don't know what that stands for yet) and the ds's code name is NTR which mean Nitro. When a 3DS game is inserted, the dev menu says a "CTR CARD" is inserted, but when a DS game is inserted it says a "TWL CARD" is inserted instead of what I expected which would be "NTR CARD". I still do not understand this. - 3dsguy
:DS=NTR, DSLite=USG (japanese for thin..), DSi=TWL(Twelve), DSiXL=UTL, 3DS=CTR... DS (on the 3DS) is usually associated with DSi.. --[[User:Elisherer|Elisherer]] 02:32, 19 October 2011 (CEST)
::3dsguy, that game you inserted was released *long* before DSi right?(also, sign your comments with the signature button) --[[User:Yellows8|Yellows8]] 04:02, 19 October 2011 (CEST)
:Elisherer thanks for clearing that up :).--[[User:3dsguy|3dsguy]] 09:46, 19 October 2011 (CEST)
::Yellows8, no that game was not, but just now i tryed it with a game released in 2006 and it still said 'TWL CARD', but what Elisherer said explained this.--[[User:3dsguy|3dsguy]] 09:46, 19 October 2011 (CEST)

:DS = NTR/Nitro
:DSi = TWL/Twilight
:3DS = CTR/Horizon
:Wii = RVL/Revolution

:Yellows8 - if you have DS/Nitro code running on a DSi system, can you escalate to DSi/TWL mode or load a TWL/DSi binary or similar. [[User:Jl12|Jl12]]
::No, that's impossible. When DSi launcher/sysmenu switches to DS-mode, launcher clears the MSB of a DSi register disabling access to the registers controlling what hw is enabled and the clock rate etc. Once those regs are disabled, it's impossible to re-enable them again without resetting the system via I2C etc.(Also, by the time any exploited title is running homebrew code, those regs are already disabled too.) --[[User:Yellows8|Yellows8]] 19:53, 7 November 2011 (CET)
: Is the NAND encrypted as it is on 3DS? Also, does DSi use DLP [for TWL games] at all? [[User:Jl12|Jl12]]
::Yes, DSi NAND is encrypted with AES-CTR. DSiWare uses download-play but the WMB/dlp binaries are DS-mode only.--[[User:Yellows8|Yellows8]] 06:27, 14 November 2011 (CET)

@Yellows8 - I'm sorry for asking this so late, but what does NUS stand for in this context "redistributing copyrighted content, in this case NUS content, is *not* allowed here.". I do not understand why you deleted my page: [[Update Data|Update Data]]
:NUS = Nintendo Update Servers. Those archive(s) you linked to contained files you downloaded from NUS, all of which are copyrighted. Besides, mirroring NUS content without any decryption done at all is *completely* pointless. --[[User:Yellows8|Yellows8]] 16:41, 12 December 2011 (CET)
::So would it be better to provide update logs, so it can point people to which update data is from which version as on the NUS the individual update data for each title is not stored the same way for all titles, providing people with further reference, so they know what they are using. You may ask me what would they use them for, they are still not decrypted and therefore pointless. ATM knowing which version is which on the NUS *maybe* very important, but I can't tell you more until later.--[[User:3dsguy|3dsguy]] 01:19, 13 December 2011 (CET)
:::Yeah a list of titleIDs and versions would be fine. One could grab that info from [[Title_list]] diffs, but that's not the best way to handle this. I have lists of updated titles for each 3DS system update, but of course I never bothered to document which version was from what sysupdate beyond just adding them to the title list page.(obtained from their system update SOAP) --[[User:Yellows8|Yellows8]] 02:20, 13 December 2011 (CET)

@Yellows8 - Thanks for your progress everyday, really. i have questions.. If feeling uneasy please tell me politely (and i will remove these).
* Would you need a tool that can use specified patterns to mark the decrypted binary (certainly it can not be perfect) ? Or have you find a disassembler so powerful that you don't need that a tool any more? please tell me. if that is useful, let me and my friend make that.
:The tool would have such ability in resolving the configuration file. Comment, Include, CmdID (with no params), CmdID (with specified params), CmdID (with no specified params). such as 80001000:0103:4,0102:4,Any:4. (ie this can mark 800010000102 out as a second type).
* Just curious. It has been a long time since neimod's latest update. Have you got a board from him, or you are only using the exploit (not with the board). If the board is helpful, is there any access to get/purchase one? (if no i think i should learn how to diy one then)
it seems to be a long time for you to do all the documentations by yourself. (Orz i forgot my suggestion) --[[User:Syphurith|Syphurith]] 02:35, 15 April 2013 (CEST)
:I don't have any 3DS ramhaxx, I use software savegame haxx of course. "is there any access to get/purchase one? (if no i think i should learn how to diy one then)" You should be asking neimod about that instead, but [https://secure.flickr.com/photos/neimod/6238747088/in/photostream the] [https://secure.flickr.com/photos/neimod/6212627980/in/photostream soldering] for 3DS ramhaxx would be *really* difficult. I'm not sure what you mean regarding that tool either, are you referring to a tool which would locate the code for service commands in a binary? --[[User:Yellows8|Yellows8]] 03:10, 15 April 2013 (CEST)
::Thanks for reply. I will try to contact him for boards. About the tool --sniff--.
::* Cons: can not detect structures; may make mistake; need configuration file (can be made by writing the header code)
::* Pros: can visually color the matched patterns; can load unlimited size of file (result will be divided into segments of 1MB or other)
::It would not be too difficult to make. However may take one or two weeks. --[[User:Syphurith|Syphurith]] 03:49, 15 April 2013 (CEST)
:::I have no need for a tool which searches for service commandIDs, when I can just search for commandIDs etc in my text-editor for disassembled code. --[[User:Yellows8|Yellows8]] 04:04, 15 April 2013 (CEST)
::::Well thanks for reply. I removed the details above. I will left it undone. Have a good day.--[[User:Syphurith|Syphurith]] 04:21, 15 April 2013 (CEST)
I've seen there are users without contributions flew in. There are even some guys cheating (or just making jokes) with your names.. What's your opinion about that? PS3Brew is blocking those without edits (daily). --[[User:Syphurith|Syphurith]] 17:03, 17 April 2013 (CEST)
:I don't care much about either,(neither of those fake accounts were used to edit anything at least) I'm not an admin here though. --[[User:Yellows8|Yellows8]] 17:36, 17 April 2013 (CEST)

Hello Yellows8,
I have a question regarding the release of the hack. You guys said, that you won't release it, because it is very easy to patch. Now the new firmware was released and in fact the exploit was patched. So releasing it now wouldn't change anything, because Nintendo already patched it.

But if you release it now, people could start develloping homebrew and when you guys find a new exploit for the new firmware, we would already have a good base of homebrew applications.

So why still hiding it from the world?

Best regards and thank you for your work

elBirx
:"the exploit was patched" Only the code execution haxx was [[5.0.0-11|fixed]], the savegame haxx was not fixed. "But if you release it now, people could start develloping homebrew" No, currently it's '''only''' useful for reverse engineers. Almost everyone that wants that savegame haxx would have no use for it right now, since "it's '''only''' useful for reverse engineers". --[[User:Yellows8|Yellows8]] 18:46, 21 April 2013 (CEST)
::So i do think only one that want to do Reverse engineering and do have skills in ARM disassembly can ask you for such a thing. Yellows8, what would i need to learn if i want to analyse those (taken ARM references in consideration)? --[[User:Syphurith|Syphurith]] 03:07, 22 April 2013 (CEST)
:::What are you referring to by "those"? --[[User:Yellows8|Yellows8]] 04:26, 22 April 2013 (CEST)
::::I'm so sorry for my poor expression skill. If i want to analyse the ram or anything that you used as a material.. Exefs is ARM code so i think to check those (you can get using exploit/haxx) need arm knowledges. i mean, that is those service APIs. you did say you can check disassembled code. Even i don't know what is left to be done. --[[User:Syphurith|Syphurith]] 07:31, 22 April 2013 (CEST)
:::::"what would i need to learn..." You could learn to read/write ARM assembly, and learn reverse engineering. --[[User:Yellows8|Yellows8]] 07:38, 22 April 2013 (CEST)
::::::Thanks. Confirmed~ That's clear to me now. --[[User:Syphurith|Syphurith]] 11:53, 22 April 2013 (CEST)

Eh. Yellows8, i got some n00b questions about the ARM execution.

There is non-executable sections in the memory layout, but where did these "This can be executed" flags got initialized (I mean that is made of hardware circuits or bios or other software section)? If that is not changable, would all those ARM cores use the same non-execution flags settings(possibly no so we may change the core to keep that work?). Even more, can we sniffer the data app to core and change its execution length then inject.

Also, is there any method to let the core execute those commands (that you detected) and use that to produce something you interested in?
:The ARM11 kernel [[Memory_layout#ARM11_User-land_memory_regions|initializes]] the MMU tables. "Also, is there any method to let the core execute those commands (that you detected) and use that to produce something you interested in?" By running code on a 3DS of course. --[[User:Yellows8|Yellows8]] 17:27, 17 June 2013 (CEST)
::Thanks. But still feeling strange of that strategy. I think at least the Home Menu may be able to re-map or deactive this mark.
::-snip- Sorry for being noob (i would try learning arm soon). Hope you good work.--[[User:Syphurith|Syphurith]] 02:46, 19 June 2013 (CEST)

Home Menu starts application processes via [[NS]], terminating and "suspending" process execution(the process is still running with that, the application threads wait for a [[NS]] notification for resuming actual execution) is done via NS as well. The ARM11 kernel handles mapping the processes' virtual memory for .text, .rodata, and .data. The ARM11 kernel handles terminating processes as well of course. The only process which has access to [[SVC|svcControlProcessMemory]] for mapping memory or changing memory permissions, is [[RO_Services|RO]] module, and of course that module will only map R-X .text pages for the signed [[CRO0|CRO]] .text. --[[User:Yellows8|Yellows8]] 03:16, 19 June 2013 (CEST)
:I can still remember ns/ro is also a title in title list. (if manually start that may fails/cause failure) if you launch a title with those commands manually, would it be exposed (in ram?)(, if so we may dump the firmware/modules)? MPS let multiple processes can share the same resources (with home menu?). or have we to modify the real memory externally? There are just thoughts, if interesting please think for a while; if not just tell me "NONE".--[[User:Syphurith|Syphurith]] 05:17, 19 June 2013 (CEST)
:I saw you update the AES page recently. you can confirm some keyslots are with the same data, but how had you done that (by comparing the data, or just the same memory location)? Can you even fetch those keys to decrypt the CDN TMD key strings? if so that would be a potential way to go.. BTW you're disasm those in-memory content not the decrypted Romfs right?
:I do wonder if contents decrypted succussfully, shall we need any customed disassembler? --[[User:Syphurith|Syphurith]] 16:51, 26 June 2013 (CEST)
::"some keyslots are with the same data" I encrypted an all-zero block with each AES engine keyslot with CTR=0, and encrypted that data again with each keyslot with keyY=0. When the output block for the former is the same for multiple keyslots, those keyslots use the same keyX/keyY. When the latter output block is the same for multiple keyslots, those keyslots use the same keyX. "decrypt the CDN TMD key strings" TMDs have nothing to do with decrypting the ticket titlekey. [[RomFS]] does not contain code(besides [[CRO0]] for web browser), that's stored in [[ExeFS]]:/.code. There's no need to dump code from memory when one can just use the [[AES]] engine. --[[User:Yellows8|Yellows8]] 17:40, 26 June 2013 (CEST)
:::oh well. sorry for been n00b again. then have you ever found something that you can execute to decrypt those CDN data? i badly wanna try it.. ExeFS.. okey.. hope good work--[[User:Syphurith|Syphurith]] 08:04, 27 June 2013 (CEST)
:::-snip- --[[User:Syphurith|Syphurith]] 08:36, 27 June 2013 (CEST)
::::You do not "call" crypto functions here, this is a hardware [[AES]] engine with a hardware key-scrambler. "found something that you can execute to decrypt those CDN data" Not sure what you mean when we had system-version v4.5 total-control code exec haxx since December. --[[User:Yellows8|Yellows8]] 09:52, 27 June 2013 (CEST)
:::::I forgot that hours ago. sorry. I thought we would be able to feed those raw data we got from CDN, and let it decrypt and extract for us. then at least we may be able to find those differences in modules implemented between two nearby versions. Some just fix crash - stablility, and some would fix some vulnerables we may use, and some would indicates those internal logical process of the module's implementation. we can not always rely on those ROP or other black-box methods. when we get the opportunity to build a CFW or a special homebrew that would affect the original behaviours of the system, we may need to modify it right? also that should show us some interesting points if we have ones dedicated on analysing those. --[[User:Syphurith|Syphurith]] 14:51, 27 June 2013 (CEST)
::::::Total-control code exec haxx = access to the [[AES]] engine obviously. "build a 'CFW'" That's not possible because of [[NCCH|RSA]], the only way around that would be to exploit software while the system is booting or exploit Home Menu. And patching the NCCH signature checks(from like savegame haxx with a game) is rather pointless, because you would have to re-patch *every* time you boot your 3DS(there's no need to run a regular homebrew application via NCCH this way either tbh). --[[User:Yellows8|Yellows8]] 16:06, 27 June 2013 (CEST)
:::::Thx. That's exactly how cfw works. (sorry i only have psp and 3ds) procfw on psp, have ipl flashed (psp has one special section inside its battery) can auto-patch the cfw code into the system while booting. But have no news for how those men repair customer's device i definitely have no clubs about the existence of similiar mechism. Besides, patching is not that easy, well. i know you have full access to AES engine, and i just want to know have you ever tried or thought of using contents from CDN and decrypt them and disassemble to seek something interesting. --[[User:Syphurith|Syphurith]] 05:31, 28 June 2013 (CEST)
===Spam attack===
I guess the simple captcha isn't enough, do you have an idea what to do? (i'm asking you because you are the most active admin here). 
I think we should adopt a method of registration and waiting for an admin to approve it. the recent changes page is spammed hard and a lot of google pages, I guess, are being created linking to those pages. --[[User:Elisherer|Elisherer]] 09:40, 31 May 2013 (CEST)
:Mha is the only one that can do anything about anti-spam, I can't do much about it myself. Mha said that he would work on this tomorrow. --[[User:Yellows8|Yellows8]] 22:19, 31 May 2013 (CEST)
::A. Stop registeration for several weeks (NOT GOOD).
::B. Ajax to load captcha (maybe reCAPTCHA?). Not well-made bots will have trouble loading the javascript code or lose the speed (there is ones with javascript but can not act so quickly)(MAYBE USEFUL). This method is widely used ''it may be not so useful'' (against latest tools).
::C. Use auto filter to auto check those suspicious content and block those users, given an access for those by accident closed guys to talk about their opinion. (I do wonder if the wiki admin backdoor provide you such a tool)(Hey Regex~)
::D.find their IP and block the IP section for a while.(Similiar as A)
::E. Use man-made Email to validate (I means, instead of the system writing mail to user to validate, let user write mails to admin or other trusted -- use SPAM filter)(NOT WELL PRATICAL, Haven't tested, SO..)
::F. Calls for someone can trust and give him only those block and delete power (DIFFICULT). Well just a little tries..
::G. Try to update your wiki version first, i mean the version of this website framework. (MAYBE USEFUL? DOUBT..)
::If you tried the actions of blocking and the spam still flow in you need to update or call wiki program's supporters (may be exploit..) But i do wonder why they tried to attack here, a (script) guy (with latest tool)?(if so he should try to improve his skill first).
::Oh well, Recent changes. Guys have a good day (International Children's Day).--[[User:Syphurith|Syphurith]] 09:39, 1 June 2013 (CEST)
:We are able to mark those pages as spam but however no effects in deed if no one comes to remove those spam accounts. Well.--[[User:Syphurith|Syphurith]] 10:17, 17 June 2013 (CEST)

===Fundraiser===
Hello Yellows8,
I know you're not the one that is responsible for the chip decapping fundraiser, but I didn't manage to contact Jl12 via E-Mail (He's not responding). So, have you guys noticed that the donations hit the 2000$ last week? Will the decapping start anytime soon or do you need some more money for buying the 3DS itself?
Best regards
:Jl12 has had a broken 3DS for decapping before the fundraiser even started. And of course we noticed that, however since Jl12 is usually very busy it might be a while before he sends his 3DS for decapping. --[[User:Yellows8|Yellows8]] 00:26, 5 June 2013 (CEST)
Hi again,
anything regarding the chip decapping happened in the past week? Will the images be released to the public?
Best regards
:We still haven't heard anything from Jl12. --[[User:Yellows8|Yellows8]] 19:34, 15 June 2013 (CEST)

User talk:Yellows8

2013-06-27T10:51:54Z

Syphurith: well...i mean decryption..

Thanks for clearing that up about the free space on the "TWL", what confused me about the name was how the dev unit handled ds games. You know how the 3ds's code name is CTR(we don't know what that stands for yet) and the ds's code name is NTR which mean Nitro. When a 3DS game is inserted, the dev menu says a "CTR CARD" is inserted, but when a DS game is inserted it says a "TWL CARD" is inserted instead of what I expected which would be "NTR CARD". I still do not understand this. - 3dsguy
:DS=NTR, DSLite=USG (japanese for thin..), DSi=TWL(Twelve), DSiXL=UTL, 3DS=CTR... DS (on the 3DS) is usually associated with DSi.. --[[User:Elisherer|Elisherer]] 02:32, 19 October 2011 (CEST)
::3dsguy, that game you inserted was released *long* before DSi right?(also, sign your comments with the signature button) --[[User:Yellows8|Yellows8]] 04:02, 19 October 2011 (CEST)
:Elisherer thanks for clearing that up :).--[[User:3dsguy|3dsguy]] 09:46, 19 October 2011 (CEST)
::Yellows8, no that game was not, but just now i tryed it with a game released in 2006 and it still said 'TWL CARD', but what Elisherer said explained this.--[[User:3dsguy|3dsguy]] 09:46, 19 October 2011 (CEST)

:DS = NTR/Nitro
:DSi = TWL/Twilight
:3DS = CTR/Horizon
:Wii = RVL/Revolution

:Yellows8 - if you have DS/Nitro code running on a DSi system, can you escalate to DSi/TWL mode or load a TWL/DSi binary or similar. [[User:Jl12|Jl12]]
::No, that's impossible. When DSi launcher/sysmenu switches to DS-mode, launcher clears the MSB of a DSi register disabling access to the registers controlling what hw is enabled and the clock rate etc. Once those regs are disabled, it's impossible to re-enable them again without resetting the system via I2C etc.(Also, by the time any exploited title is running homebrew code, those regs are already disabled too.) --[[User:Yellows8|Yellows8]] 19:53, 7 November 2011 (CET)
: Is the NAND encrypted as it is on 3DS? Also, does DSi use DLP [for TWL games] at all? [[User:Jl12|Jl12]]
::Yes, DSi NAND is encrypted with AES-CTR. DSiWare uses download-play but the WMB/dlp binaries are DS-mode only.--[[User:Yellows8|Yellows8]] 06:27, 14 November 2011 (CET)

@Yellows8 - I'm sorry for asking this so late, but what does NUS stand for in this context "redistributing copyrighted content, in this case NUS content, is *not* allowed here.". I do not understand why you deleted my page: [[Update Data|Update Data]]
:NUS = Nintendo Update Servers. Those archive(s) you linked to contained files you downloaded from NUS, all of which are copyrighted. Besides, mirroring NUS content without any decryption done at all is *completely* pointless. --[[User:Yellows8|Yellows8]] 16:41, 12 December 2011 (CET)
::So would it be better to provide update logs, so it can point people to which update data is from which version as on the NUS the individual update data for each title is not stored the same way for all titles, providing people with further reference, so they know what they are using. You may ask me what would they use them for, they are still not decrypted and therefore pointless. ATM knowing which version is which on the NUS *maybe* very important, but I can't tell you more until later.--[[User:3dsguy|3dsguy]] 01:19, 13 December 2011 (CET)
:::Yeah a list of titleIDs and versions would be fine. One could grab that info from [[Title_list]] diffs, but that's not the best way to handle this. I have lists of updated titles for each 3DS system update, but of course I never bothered to document which version was from what sysupdate beyond just adding them to the title list page.(obtained from their system update SOAP) --[[User:Yellows8|Yellows8]] 02:20, 13 December 2011 (CET)

@Yellows8 - Thanks for your progress everyday, really. i have questions.. If feeling uneasy please tell me politely (and i will remove these).
* Would you need a tool that can use specified patterns to mark the decrypted binary (certainly it can not be perfect) ? Or have you find a disassembler so powerful that you don't need that a tool any more? please tell me. if that is useful, let me and my friend make that.
:The tool would have such ability in resolving the configuration file. Comment, Include, CmdID (with no params), CmdID (with specified params), CmdID (with no specified params). such as 80001000:0103:4,0102:4,Any:4. (ie this can mark 800010000102 out as a second type).
* Just curious. It has been a long time since neimod's latest update. Have you got a board from him, or you are only using the exploit (not with the board). If the board is helpful, is there any access to get/purchase one? (if no i think i should learn how to diy one then)
it seems to be a long time for you to do all the documentations by yourself. (Orz i forgot my suggestion) --[[User:Syphurith|Syphurith]] 02:35, 15 April 2013 (CEST)
:I don't have any 3DS ramhaxx, I use software savegame haxx of course. "is there any access to get/purchase one? (if no i think i should learn how to diy one then)" You should be asking neimod about that instead, but [https://secure.flickr.com/photos/neimod/6238747088/in/photostream the] [https://secure.flickr.com/photos/neimod/6212627980/in/photostream soldering] for 3DS ramhaxx would be *really* difficult. I'm not sure what you mean regarding that tool either, are you referring to a tool which would locate the code for service commands in a binary? --[[User:Yellows8|Yellows8]] 03:10, 15 April 2013 (CEST)
::Thanks for reply. I will try to contact him for boards. About the tool --sniff--.
::* Cons: can not detect structures; may make mistake; need configuration file (can be made by writing the header code)
::* Pros: can visually color the matched patterns; can load unlimited size of file (result will be divided into segments of 1MB or other)
::It would not be too difficult to make. However may take one or two weeks. --[[User:Syphurith|Syphurith]] 03:49, 15 April 2013 (CEST)
:::I have no need for a tool which searches for service commandIDs, when I can just search for commandIDs etc in my text-editor for disassembled code. --[[User:Yellows8|Yellows8]] 04:04, 15 April 2013 (CEST)
::::Well thanks for reply. I removed the details above. I will left it undone. Have a good day.--[[User:Syphurith|Syphurith]] 04:21, 15 April 2013 (CEST)
I've seen there are users without contributions flew in. There are even some guys cheating (or just making jokes) with your names.. What's your opinion about that? PS3Brew is blocking those without edits (daily). --[[User:Syphurith|Syphurith]] 17:03, 17 April 2013 (CEST)
:I don't care much about either,(neither of those fake accounts were used to edit anything at least) I'm not an admin here though. --[[User:Yellows8|Yellows8]] 17:36, 17 April 2013 (CEST)

Hello Yellows8,
I have a question regarding the release of the hack. You guys said, that you won't release it, because it is very easy to patch. Now the new firmware was released and in fact the exploit was patched. So releasing it now wouldn't change anything, because Nintendo already patched it.

But if you release it now, people could start develloping homebrew and when you guys find a new exploit for the new firmware, we would already have a good base of homebrew applications.

So why still hiding it from the world?

Best regards and thank you for your work

elBirx
:"the exploit was patched" Only the code execution haxx was [[5.0.0-11|fixed]], the savegame haxx was not fixed. "But if you release it now, people could start develloping homebrew" No, currently it's '''only''' useful for reverse engineers. Almost everyone that wants that savegame haxx would have no use for it right now, since "it's '''only''' useful for reverse engineers". --[[User:Yellows8|Yellows8]] 18:46, 21 April 2013 (CEST)
::So i do think only one that want to do Reverse engineering and do have skills in ARM disassembly can ask you for such a thing. Yellows8, what would i need to learn if i want to analyse those (taken ARM references in consideration)? --[[User:Syphurith|Syphurith]] 03:07, 22 April 2013 (CEST)
:::What are you referring to by "those"? --[[User:Yellows8|Yellows8]] 04:26, 22 April 2013 (CEST)
::::I'm so sorry for my poor expression skill. If i want to analyse the ram or anything that you used as a material.. Exefs is ARM code so i think to check those (you can get using exploit/haxx) need arm knowledges. i mean, that is those service APIs. you did say you can check disassembled code. Even i don't know what is left to be done. --[[User:Syphurith|Syphurith]] 07:31, 22 April 2013 (CEST)
:::::"what would i need to learn..." You could learn to read/write ARM assembly, and learn reverse engineering. --[[User:Yellows8|Yellows8]] 07:38, 22 April 2013 (CEST)
::::::Thanks. Confirmed~ That's clear to me now. --[[User:Syphurith|Syphurith]] 11:53, 22 April 2013 (CEST)

Eh. Yellows8, i got some n00b questions about the ARM execution.

There is non-executable sections in the memory layout, but where did these "This can be executed" flags got initialized (I mean that is made of hardware circuits or bios or other software section)? If that is not changable, would all those ARM cores use the same non-execution flags settings(possibly no so we may change the core to keep that work?). Even more, can we sniffer the data app to core and change its execution length then inject.

Also, is there any method to let the core execute those commands (that you detected) and use that to produce something you interested in?
:The ARM11 kernel [[Memory_layout#ARM11_User-land_memory_regions|initializes]] the MMU tables. "Also, is there any method to let the core execute those commands (that you detected) and use that to produce something you interested in?" By running code on a 3DS of course. --[[User:Yellows8|Yellows8]] 17:27, 17 June 2013 (CEST)
::Thanks. But still feeling strange of that strategy. I think at least the Home Menu may be able to re-map or deactive this mark.
::-snip- Sorry for being noob (i would try learning arm soon). Hope you good work.--[[User:Syphurith|Syphurith]] 02:46, 19 June 2013 (CEST)

Home Menu starts application processes via [[NS]], terminating and "suspending" process execution(the process is still running with that, the application threads wait for a [[NS]] notification for resuming actual execution) is done via NS as well. The ARM11 kernel handles mapping the processes' virtual memory for .text, .rodata, and .data. The ARM11 kernel handles terminating processes as well of course. The only process which has access to [[SVC|svcControlProcessMemory]] for mapping memory or changing memory permissions, is [[RO_Services|RO]] module, and of course that module will only map R-X .text pages for the signed [[CRO0|CRO]] .text. --[[User:Yellows8|Yellows8]] 03:16, 19 June 2013 (CEST)
:I can still remember ns/ro is also a title in title list. (if manually start that may fails/cause failure) if you launch a title with those commands manually, would it be exposed (in ram?)(, if so we may dump the firmware/modules)? MPS let multiple processes can share the same resources (with home menu?). or have we to modify the real memory externally? There are just thoughts, if interesting please think for a while; if not just tell me "NONE".--[[User:Syphurith|Syphurith]] 05:17, 19 June 2013 (CEST)
:I saw you update the AES page recently. you can confirm some keyslots are with the same data, but how had you done that (by comparing the data, or just the same memory location)? Can you even fetch those keys to decrypt the CDN TMD key strings? if so that would be a potential way to go.. BTW you're disasm those in-memory content not the decrypted Romfs right?
:I do wonder if contents decrypted succussfully, shall we need any customed disassembler? --[[User:Syphurith|Syphurith]] 16:51, 26 June 2013 (CEST)
::"some keyslots are with the same data" I encrypted an all-zero block with each AES engine keyslot with CTR=0, and encrypted that data again with each keyslot with keyY=0. When the output block for the former is the same for multiple keyslots, those keyslots use the same keyX/keyY. When the latter output block is the same for multiple keyslots, those keyslots use the same keyX. "decrypt the CDN TMD key strings" TMDs have nothing to do with decrypting the ticket titlekey. [[RomFS]] does not contain code(besides [[CRO0]] for web browser), that's stored in [[ExeFS]]:/.code. There's no need to dump code from memory when one can just use the [[AES]] engine. --[[User:Yellows8|Yellows8]] 17:40, 26 June 2013 (CEST)
:::oh well. sorry for been n00b again. then have you ever found something that you can execute to decrypt those CDN data? i badly wanna try it.. ExeFS.. okey.. hope good work--[[User:Syphurith|Syphurith]] 08:04, 27 June 2013 (CEST)
:::-snip- --[[User:Syphurith|Syphurith]] 08:36, 27 June 2013 (CEST)
::::You do not "call" crypto functions here, this is a hardware [[AES]] engine with a hardware key-scrambler. "found something that you can execute to decrypt those CDN data" Not sure what you mean when we had system-version v4.5 total-control code exec haxx since December. --[[User:Yellows8|Yellows8]] 09:52, 27 June 2013 (CEST)
:::::I forgot that hours ago. sorry. I thought we would be able to feed those raw data we got from CDN, and let it decrypt and extract for us. then at least we may be able to find those differences in modules implemented between two nearby versions. Some just fix crash - stablility, and some would fix some vulnerables we may use, and some would indicates those internal logical process of the module's implementation. we can not always rely on those ROP or other black-box methods. when we get the opportunity to build a CFW or a special homebrew that would affect the original behaviours of the system, we may need to modify it right? also that should show us some interesting points if we have ones dedicated on analysing those. --[[User:Syphurith|Syphurith]] 14:51, 27 June 2013 (CEST)

===Spam attack===
I guess the simple captcha isn't enough, do you have an idea what to do? (i'm asking you because you are the most active admin here). 
I think we should adopt a method of registration and waiting for an admin to approve it. the recent changes page is spammed hard and a lot of google pages, I guess, are being created linking to those pages. --[[User:Elisherer|Elisherer]] 09:40, 31 May 2013 (CEST)
:Mha is the only one that can do anything about anti-spam, I can't do much about it myself. Mha said that he would work on this tomorrow. --[[User:Yellows8|Yellows8]] 22:19, 31 May 2013 (CEST)
::A. Stop registeration for several weeks (NOT GOOD).
::B. Ajax to load captcha (maybe reCAPTCHA?). Not well-made bots will have trouble loading the javascript code or lose the speed (there is ones with javascript but can not act so quickly)(MAYBE USEFUL). This method is widely used ''it may be not so useful'' (against latest tools).
::C. Use auto filter to auto check those suspicious content and block those users, given an access for those by accident closed guys to talk about their opinion. (I do wonder if the wiki admin backdoor provide you such a tool)(Hey Regex~)
::D.find their IP and block the IP section for a while.(Similiar as A)
::E. Use man-made Email to validate (I means, instead of the system writing mail to user to validate, let user write mails to admin or other trusted -- use SPAM filter)(NOT WELL PRATICAL, Haven't tested, SO..)
::F. Calls for someone can trust and give him only those block and delete power (DIFFICULT). Well just a little tries..
::G. Try to update your wiki version first, i mean the version of this website framework. (MAYBE USEFUL? DOUBT..)
::If you tried the actions of blocking and the spam still flow in you need to update or call wiki program's supporters (may be exploit..) But i do wonder why they tried to attack here, a (script) guy (with latest tool)?(if so he should try to improve his skill first).
::Oh well, Recent changes. Guys have a good day (International Children's Day).--[[User:Syphurith|Syphurith]] 09:39, 1 June 2013 (CEST)
:We are able to mark those pages as spam but however no effects in deed if no one comes to remove those spam accounts. Well.--[[User:Syphurith|Syphurith]] 10:17, 17 June 2013 (CEST)

===Fundraiser===
Hello Yellows8,
I know you're not the one that is responsible for the chip decapping fundraiser, but I didn't manage to contact Jl12 via E-Mail (He's not responding). So, have you guys noticed that the donations hit the 2000$ last week? Will the decapping start anytime soon or do you need some more money for buying the 3DS itself?
Best regards
:Jl12 has had a broken 3DS for decapping before the fundraiser even started. And of course we noticed that, however since Jl12 is usually very busy it might be a while before he sends his 3DS for decapping. --[[User:Yellows8|Yellows8]] 00:26, 5 June 2013 (CEST)
Hi again,
anything regarding the chip decapping happened in the past week? Will the images be released to the public?
Best regards
:We still haven't heard anything from Jl12. --[[User:Yellows8|Yellows8]] 19:34, 15 June 2013 (CEST)

User talk:Yellows8

2013-06-27T04:36:53Z

Syphurith: question+

Thanks for clearing that up about the free space on the "TWL", what confused me about the name was how the dev unit handled ds games. You know how the 3ds's code name is CTR(we don't know what that stands for yet) and the ds's code name is NTR which mean Nitro. When a 3DS game is inserted, the dev menu says a "CTR CARD" is inserted, but when a DS game is inserted it says a "TWL CARD" is inserted instead of what I expected which would be "NTR CARD". I still do not understand this. - 3dsguy
:DS=NTR, DSLite=USG (japanese for thin..), DSi=TWL(Twelve), DSiXL=UTL, 3DS=CTR... DS (on the 3DS) is usually associated with DSi.. --[[User:Elisherer|Elisherer]] 02:32, 19 October 2011 (CEST)
::3dsguy, that game you inserted was released *long* before DSi right?(also, sign your comments with the signature button) --[[User:Yellows8|Yellows8]] 04:02, 19 October 2011 (CEST)
:Elisherer thanks for clearing that up :).--[[User:3dsguy|3dsguy]] 09:46, 19 October 2011 (CEST)
::Yellows8, no that game was not, but just now i tryed it with a game released in 2006 and it still said 'TWL CARD', but what Elisherer said explained this.--[[User:3dsguy|3dsguy]] 09:46, 19 October 2011 (CEST)

:DS = NTR/Nitro
:DSi = TWL/Twilight
:3DS = CTR/Horizon
:Wii = RVL/Revolution

:Yellows8 - if you have DS/Nitro code running on a DSi system, can you escalate to DSi/TWL mode or load a TWL/DSi binary or similar. [[User:Jl12|Jl12]]
::No, that's impossible. When DSi launcher/sysmenu switches to DS-mode, launcher clears the MSB of a DSi register disabling access to the registers controlling what hw is enabled and the clock rate etc. Once those regs are disabled, it's impossible to re-enable them again without resetting the system via I2C etc.(Also, by the time any exploited title is running homebrew code, those regs are already disabled too.) --[[User:Yellows8|Yellows8]] 19:53, 7 November 2011 (CET)
: Is the NAND encrypted as it is on 3DS? Also, does DSi use DLP [for TWL games] at all? [[User:Jl12|Jl12]]
::Yes, DSi NAND is encrypted with AES-CTR. DSiWare uses download-play but the WMB/dlp binaries are DS-mode only.--[[User:Yellows8|Yellows8]] 06:27, 14 November 2011 (CET)

@Yellows8 - I'm sorry for asking this so late, but what does NUS stand for in this context "redistributing copyrighted content, in this case NUS content, is *not* allowed here.". I do not understand why you deleted my page: [[Update Data|Update Data]]
:NUS = Nintendo Update Servers. Those archive(s) you linked to contained files you downloaded from NUS, all of which are copyrighted. Besides, mirroring NUS content without any decryption done at all is *completely* pointless. --[[User:Yellows8|Yellows8]] 16:41, 12 December 2011 (CET)
::So would it be better to provide update logs, so it can point people to which update data is from which version as on the NUS the individual update data for each title is not stored the same way for all titles, providing people with further reference, so they know what they are using. You may ask me what would they use them for, they are still not decrypted and therefore pointless. ATM knowing which version is which on the NUS *maybe* very important, but I can't tell you more until later.--[[User:3dsguy|3dsguy]] 01:19, 13 December 2011 (CET)
:::Yeah a list of titleIDs and versions would be fine. One could grab that info from [[Title_list]] diffs, but that's not the best way to handle this. I have lists of updated titles for each 3DS system update, but of course I never bothered to document which version was from what sysupdate beyond just adding them to the title list page.(obtained from their system update SOAP) --[[User:Yellows8|Yellows8]] 02:20, 13 December 2011 (CET)

@Yellows8 - Thanks for your progress everyday, really. i have questions.. If feeling uneasy please tell me politely (and i will remove these).
* Would you need a tool that can use specified patterns to mark the decrypted binary (certainly it can not be perfect) ? Or have you find a disassembler so powerful that you don't need that a tool any more? please tell me. if that is useful, let me and my friend make that.
:The tool would have such ability in resolving the configuration file. Comment, Include, CmdID (with no params), CmdID (with specified params), CmdID (with no specified params). such as 80001000:0103:4,0102:4,Any:4. (ie this can mark 800010000102 out as a second type).
* Just curious. It has been a long time since neimod's latest update. Have you got a board from him, or you are only using the exploit (not with the board). If the board is helpful, is there any access to get/purchase one? (if no i think i should learn how to diy one then)
it seems to be a long time for you to do all the documentations by yourself. (Orz i forgot my suggestion) --[[User:Syphurith|Syphurith]] 02:35, 15 April 2013 (CEST)
:I don't have any 3DS ramhaxx, I use software savegame haxx of course. "is there any access to get/purchase one? (if no i think i should learn how to diy one then)" You should be asking neimod about that instead, but [https://secure.flickr.com/photos/neimod/6238747088/in/photostream the] [https://secure.flickr.com/photos/neimod/6212627980/in/photostream soldering] for 3DS ramhaxx would be *really* difficult. I'm not sure what you mean regarding that tool either, are you referring to a tool which would locate the code for service commands in a binary? --[[User:Yellows8|Yellows8]] 03:10, 15 April 2013 (CEST)
::Thanks for reply. I will try to contact him for boards. About the tool --sniff--.
::* Cons: can not detect structures; may make mistake; need configuration file (can be made by writing the header code)
::* Pros: can visually color the matched patterns; can load unlimited size of file (result will be divided into segments of 1MB or other)
::It would not be too difficult to make. However may take one or two weeks. --[[User:Syphurith|Syphurith]] 03:49, 15 April 2013 (CEST)
:::I have no need for a tool which searches for service commandIDs, when I can just search for commandIDs etc in my text-editor for disassembled code. --[[User:Yellows8|Yellows8]] 04:04, 15 April 2013 (CEST)
::::Well thanks for reply. I removed the details above. I will left it undone. Have a good day.--[[User:Syphurith|Syphurith]] 04:21, 15 April 2013 (CEST)
I've seen there are users without contributions flew in. There are even some guys cheating (or just making jokes) with your names.. What's your opinion about that? PS3Brew is blocking those without edits (daily). --[[User:Syphurith|Syphurith]] 17:03, 17 April 2013 (CEST)
:I don't care much about either,(neither of those fake accounts were used to edit anything at least) I'm not an admin here though. --[[User:Yellows8|Yellows8]] 17:36, 17 April 2013 (CEST)

Hello Yellows8,
I have a question regarding the release of the hack. You guys said, that you won't release it, because it is very easy to patch. Now the new firmware was released and in fact the exploit was patched. So releasing it now wouldn't change anything, because Nintendo already patched it.

But if you release it now, people could start develloping homebrew and when you guys find a new exploit for the new firmware, we would already have a good base of homebrew applications.

So why still hiding it from the world?

Best regards and thank you for your work

elBirx
:"the exploit was patched" Only the code execution haxx was [[5.0.0-11|fixed]], the savegame haxx was not fixed. "But if you release it now, people could start develloping homebrew" No, currently it's '''only''' useful for reverse engineers. Almost everyone that wants that savegame haxx would have no use for it right now, since "it's '''only''' useful for reverse engineers". --[[User:Yellows8|Yellows8]] 18:46, 21 April 2013 (CEST)
::So i do think only one that want to do Reverse engineering and do have skills in ARM disassembly can ask you for such a thing. Yellows8, what would i need to learn if i want to analyse those (taken ARM references in consideration)? --[[User:Syphurith|Syphurith]] 03:07, 22 April 2013 (CEST)
:::What are you referring to by "those"? --[[User:Yellows8|Yellows8]] 04:26, 22 April 2013 (CEST)
::::I'm so sorry for my poor expression skill. If i want to analyse the ram or anything that you used as a material.. Exefs is ARM code so i think to check those (you can get using exploit/haxx) need arm knowledges. i mean, that is those service APIs. you did say you can check disassembled code. Even i don't know what is left to be done. --[[User:Syphurith|Syphurith]] 07:31, 22 April 2013 (CEST)
:::::"what would i need to learn..." You could learn to read/write ARM assembly, and learn reverse engineering. --[[User:Yellows8|Yellows8]] 07:38, 22 April 2013 (CEST)
::::::Thanks. Confirmed~ That's clear to me now. --[[User:Syphurith|Syphurith]] 11:53, 22 April 2013 (CEST)

Eh. Yellows8, i got some n00b questions about the ARM execution.

There is non-executable sections in the memory layout, but where did these "This can be executed" flags got initialized (I mean that is made of hardware circuits or bios or other software section)? If that is not changable, would all those ARM cores use the same non-execution flags settings(possibly no so we may change the core to keep that work?). Even more, can we sniffer the data app to core and change its execution length then inject.

Also, is there any method to let the core execute those commands (that you detected) and use that to produce something you interested in?
:The ARM11 kernel [[Memory_layout#ARM11_User-land_memory_regions|initializes]] the MMU tables. "Also, is there any method to let the core execute those commands (that you detected) and use that to produce something you interested in?" By running code on a 3DS of course. --[[User:Yellows8|Yellows8]] 17:27, 17 June 2013 (CEST)
::Thanks. But still feeling strange of that strategy. I think at least the Home Menu may be able to re-map or deactive this mark.
::-snip- Sorry for being noob (i would try learning arm soon). Hope you good work.--[[User:Syphurith|Syphurith]] 02:46, 19 June 2013 (CEST)

Home Menu starts application processes via [[NS]], terminating and "suspending" process execution(the process is still running with that, the application threads wait for a [[NS]] notification for resuming actual execution) is done via NS as well. The ARM11 kernel handles mapping the processes' virtual memory for .text, .rodata, and .data. The ARM11 kernel handles terminating processes as well of course. The only process which has access to [[SVC|svcControlProcessMemory]] for mapping memory or changing memory permissions, is [[RO_Services|RO]] module, and of course that module will only map R-X .text pages for the signed [[CRO0|CRO]] .text. --[[User:Yellows8|Yellows8]] 03:16, 19 June 2013 (CEST)
:I can still remember ns/ro is also a title in title list. (if manually start that may fails/cause failure) if you launch a title with those commands manually, would it be exposed (in ram?)(, if so we may dump the firmware/modules)? MPS let multiple processes can share the same resources (with home menu?). or have we to modify the real memory externally? There are just thoughts, if interesting please think for a while; if not just tell me "NONE".--[[User:Syphurith|Syphurith]] 05:17, 19 June 2013 (CEST)
:I saw you update the AES page recently. you can confirm some keyslots are with the same data, but how had you done that (by comparing the data, or just the same memory location)? Can you even fetch those keys to decrypt the CDN TMD key strings? if so that would be a potential way to go.. BTW you're disasm those in-memory content not the decrypted Romfs right?
:I do wonder if contents decrypted succussfully, shall we need any customed disassembler? --[[User:Syphurith|Syphurith]] 16:51, 26 June 2013 (CEST)
::"some keyslots are with the same data" I encrypted an all-zero block with each AES engine keyslot with CTR=0, and encrypted that data again with each keyslot with keyY=0. When the output block for the former is the same for multiple keyslots, those keyslots use the same keyX/keyY. When the latter output block is the same for multiple keyslots, those keyslots use the same keyX. "decrypt the CDN TMD key strings" TMDs have nothing to do with decrypting the ticket titlekey. [[RomFS]] does not contain code(besides [[CRO0]] for web browser), that's stored in [[ExeFS]]:/.code. There's no need to dump code from memory when one can just use the [[AES]] engine. --[[User:Yellows8|Yellows8]] 17:40, 26 June 2013 (CEST)
:::oh well. sorry for been n00b again. then have you ever found something that you can execute to decrypt those CDN data? i badly wanna try it.. ExeFS.. okey.. hope good work--[[User:Syphurith|Syphurith]] 08:04, 27 June 2013 (CEST)
:::oh wait i nearly forgot one thing. where do you think those keys are been when you manually called those encrypt/decrypt functions? if that is purely hardware implemented decapping may help; if that is in memory you may eventually get it; if that is stored in somewhere inside SoC.. yeah? --[[User:Syphurith|Syphurith]] 08:36, 27 June 2013 (CEST)

===Spam attack===
I guess the simple captcha isn't enough, do you have an idea what to do? (i'm asking you because you are the most active admin here). 
I think we should adopt a method of registration and waiting for an admin to approve it. the recent changes page is spammed hard and a lot of google pages, I guess, are being created linking to those pages. --[[User:Elisherer|Elisherer]] 09:40, 31 May 2013 (CEST)
:Mha is the only one that can do anything about anti-spam, I can't do much about it myself. Mha said that he would work on this tomorrow. --[[User:Yellows8|Yellows8]] 22:19, 31 May 2013 (CEST)
::A. Stop registeration for several weeks (NOT GOOD).
::B. Ajax to load captcha (maybe reCAPTCHA?). Not well-made bots will have trouble loading the javascript code or lose the speed (there is ones with javascript but can not act so quickly)(MAYBE USEFUL). This method is widely used ''it may be not so useful'' (against latest tools).
::C. Use auto filter to auto check those suspicious content and block those users, given an access for those by accident closed guys to talk about their opinion. (I do wonder if the wiki admin backdoor provide you such a tool)(Hey Regex~)
::D.find their IP and block the IP section for a while.(Similiar as A)
::E. Use man-made Email to validate (I means, instead of the system writing mail to user to validate, let user write mails to admin or other trusted -- use SPAM filter)(NOT WELL PRATICAL, Haven't tested, SO..)
::F. Calls for someone can trust and give him only those block and delete power (DIFFICULT). Well just a little tries..
::G. Try to update your wiki version first, i mean the version of this website framework. (MAYBE USEFUL? DOUBT..)
::If you tried the actions of blocking and the spam still flow in you need to update or call wiki program's supporters (may be exploit..) But i do wonder why they tried to attack here, a (script) guy (with latest tool)?(if so he should try to improve his skill first).
::Oh well, Recent changes. Guys have a good day (International Children's Day).--[[User:Syphurith|Syphurith]] 09:39, 1 June 2013 (CEST)
:We are able to mark those pages as spam but however no effects in deed if no one comes to remove those spam accounts. Well.--[[User:Syphurith|Syphurith]] 10:17, 17 June 2013 (CEST)

===Fundraiser===
Hello Yellows8,
I know you're not the one that is responsible for the chip decapping fundraiser, but I didn't manage to contact Jl12 via E-Mail (He's not responding). So, have you guys noticed that the donations hit the 2000$ last week? Will the decapping start anytime soon or do you need some more money for buying the 3DS itself?
Best regards
:Jl12 has had a broken 3DS for decapping before the fundraiser even started. And of course we noticed that, however since Jl12 is usually very busy it might be a while before he sends his 3DS for decapping. --[[User:Yellows8|Yellows8]] 00:26, 5 June 2013 (CEST)
Hi again,
anything regarding the chip decapping happened in the past week? Will the images be released to the public?
Best regards
:We still haven't heard anything from Jl12. --[[User:Yellows8|Yellows8]] 19:34, 15 June 2013 (CEST)

User talk:Yellows8

2013-06-27T04:04:24Z

Syphurith: thx for definite answer you geniue

Thanks for clearing that up about the free space on the "TWL", what confused me about the name was how the dev unit handled ds games. You know how the 3ds's code name is CTR(we don't know what that stands for yet) and the ds's code name is NTR which mean Nitro. When a 3DS game is inserted, the dev menu says a "CTR CARD" is inserted, but when a DS game is inserted it says a "TWL CARD" is inserted instead of what I expected which would be "NTR CARD". I still do not understand this. - 3dsguy
:DS=NTR, DSLite=USG (japanese for thin..), DSi=TWL(Twelve), DSiXL=UTL, 3DS=CTR... DS (on the 3DS) is usually associated with DSi.. --[[User:Elisherer|Elisherer]] 02:32, 19 October 2011 (CEST)
::3dsguy, that game you inserted was released *long* before DSi right?(also, sign your comments with the signature button) --[[User:Yellows8|Yellows8]] 04:02, 19 October 2011 (CEST)
:Elisherer thanks for clearing that up :).--[[User:3dsguy|3dsguy]] 09:46, 19 October 2011 (CEST)
::Yellows8, no that game was not, but just now i tryed it with a game released in 2006 and it still said 'TWL CARD', but what Elisherer said explained this.--[[User:3dsguy|3dsguy]] 09:46, 19 October 2011 (CEST)

:DS = NTR/Nitro
:DSi = TWL/Twilight
:3DS = CTR/Horizon
:Wii = RVL/Revolution

:Yellows8 - if you have DS/Nitro code running on a DSi system, can you escalate to DSi/TWL mode or load a TWL/DSi binary or similar. [[User:Jl12|Jl12]]
::No, that's impossible. When DSi launcher/sysmenu switches to DS-mode, launcher clears the MSB of a DSi register disabling access to the registers controlling what hw is enabled and the clock rate etc. Once those regs are disabled, it's impossible to re-enable them again without resetting the system via I2C etc.(Also, by the time any exploited title is running homebrew code, those regs are already disabled too.) --[[User:Yellows8|Yellows8]] 19:53, 7 November 2011 (CET)
: Is the NAND encrypted as it is on 3DS? Also, does DSi use DLP [for TWL games] at all? [[User:Jl12|Jl12]]
::Yes, DSi NAND is encrypted with AES-CTR. DSiWare uses download-play but the WMB/dlp binaries are DS-mode only.--[[User:Yellows8|Yellows8]] 06:27, 14 November 2011 (CET)

@Yellows8 - I'm sorry for asking this so late, but what does NUS stand for in this context "redistributing copyrighted content, in this case NUS content, is *not* allowed here.". I do not understand why you deleted my page: [[Update Data|Update Data]]
:NUS = Nintendo Update Servers. Those archive(s) you linked to contained files you downloaded from NUS, all of which are copyrighted. Besides, mirroring NUS content without any decryption done at all is *completely* pointless. --[[User:Yellows8|Yellows8]] 16:41, 12 December 2011 (CET)
::So would it be better to provide update logs, so it can point people to which update data is from which version as on the NUS the individual update data for each title is not stored the same way for all titles, providing people with further reference, so they know what they are using. You may ask me what would they use them for, they are still not decrypted and therefore pointless. ATM knowing which version is which on the NUS *maybe* very important, but I can't tell you more until later.--[[User:3dsguy|3dsguy]] 01:19, 13 December 2011 (CET)
:::Yeah a list of titleIDs and versions would be fine. One could grab that info from [[Title_list]] diffs, but that's not the best way to handle this. I have lists of updated titles for each 3DS system update, but of course I never bothered to document which version was from what sysupdate beyond just adding them to the title list page.(obtained from their system update SOAP) --[[User:Yellows8|Yellows8]] 02:20, 13 December 2011 (CET)

@Yellows8 - Thanks for your progress everyday, really. i have questions.. If feeling uneasy please tell me politely (and i will remove these).
* Would you need a tool that can use specified patterns to mark the decrypted binary (certainly it can not be perfect) ? Or have you find a disassembler so powerful that you don't need that a tool any more? please tell me. if that is useful, let me and my friend make that.
:The tool would have such ability in resolving the configuration file. Comment, Include, CmdID (with no params), CmdID (with specified params), CmdID (with no specified params). such as 80001000:0103:4,0102:4,Any:4. (ie this can mark 800010000102 out as a second type).
* Just curious. It has been a long time since neimod's latest update. Have you got a board from him, or you are only using the exploit (not with the board). If the board is helpful, is there any access to get/purchase one? (if no i think i should learn how to diy one then)
it seems to be a long time for you to do all the documentations by yourself. (Orz i forgot my suggestion) --[[User:Syphurith|Syphurith]] 02:35, 15 April 2013 (CEST)
:I don't have any 3DS ramhaxx, I use software savegame haxx of course. "is there any access to get/purchase one? (if no i think i should learn how to diy one then)" You should be asking neimod about that instead, but [https://secure.flickr.com/photos/neimod/6238747088/in/photostream the] [https://secure.flickr.com/photos/neimod/6212627980/in/photostream soldering] for 3DS ramhaxx would be *really* difficult. I'm not sure what you mean regarding that tool either, are you referring to a tool which would locate the code for service commands in a binary? --[[User:Yellows8|Yellows8]] 03:10, 15 April 2013 (CEST)
::Thanks for reply. I will try to contact him for boards. About the tool --sniff--.
::* Cons: can not detect structures; may make mistake; need configuration file (can be made by writing the header code)
::* Pros: can visually color the matched patterns; can load unlimited size of file (result will be divided into segments of 1MB or other)
::It would not be too difficult to make. However may take one or two weeks. --[[User:Syphurith|Syphurith]] 03:49, 15 April 2013 (CEST)
:::I have no need for a tool which searches for service commandIDs, when I can just search for commandIDs etc in my text-editor for disassembled code. --[[User:Yellows8|Yellows8]] 04:04, 15 April 2013 (CEST)
::::Well thanks for reply. I removed the details above. I will left it undone. Have a good day.--[[User:Syphurith|Syphurith]] 04:21, 15 April 2013 (CEST)
I've seen there are users without contributions flew in. There are even some guys cheating (or just making jokes) with your names.. What's your opinion about that? PS3Brew is blocking those without edits (daily). --[[User:Syphurith|Syphurith]] 17:03, 17 April 2013 (CEST)
:I don't care much about either,(neither of those fake accounts were used to edit anything at least) I'm not an admin here though. --[[User:Yellows8|Yellows8]] 17:36, 17 April 2013 (CEST)

Hello Yellows8,
I have a question regarding the release of the hack. You guys said, that you won't release it, because it is very easy to patch. Now the new firmware was released and in fact the exploit was patched. So releasing it now wouldn't change anything, because Nintendo already patched it.

But if you release it now, people could start develloping homebrew and when you guys find a new exploit for the new firmware, we would already have a good base of homebrew applications.

So why still hiding it from the world?

Best regards and thank you for your work

elBirx
:"the exploit was patched" Only the code execution haxx was [[5.0.0-11|fixed]], the savegame haxx was not fixed. "But if you release it now, people could start develloping homebrew" No, currently it's '''only''' useful for reverse engineers. Almost everyone that wants that savegame haxx would have no use for it right now, since "it's '''only''' useful for reverse engineers". --[[User:Yellows8|Yellows8]] 18:46, 21 April 2013 (CEST)
::So i do think only one that want to do Reverse engineering and do have skills in ARM disassembly can ask you for such a thing. Yellows8, what would i need to learn if i want to analyse those (taken ARM references in consideration)? --[[User:Syphurith|Syphurith]] 03:07, 22 April 2013 (CEST)
:::What are you referring to by "those"? --[[User:Yellows8|Yellows8]] 04:26, 22 April 2013 (CEST)
::::I'm so sorry for my poor expression skill. If i want to analyse the ram or anything that you used as a material.. Exefs is ARM code so i think to check those (you can get using exploit/haxx) need arm knowledges. i mean, that is those service APIs. you did say you can check disassembled code. Even i don't know what is left to be done. --[[User:Syphurith|Syphurith]] 07:31, 22 April 2013 (CEST)
:::::"what would i need to learn..." You could learn to read/write ARM assembly, and learn reverse engineering. --[[User:Yellows8|Yellows8]] 07:38, 22 April 2013 (CEST)
::::::Thanks. Confirmed~ That's clear to me now. --[[User:Syphurith|Syphurith]] 11:53, 22 April 2013 (CEST)

Eh. Yellows8, i got some n00b questions about the ARM execution.

There is non-executable sections in the memory layout, but where did these "This can be executed" flags got initialized (I mean that is made of hardware circuits or bios or other software section)? If that is not changable, would all those ARM cores use the same non-execution flags settings(possibly no so we may change the core to keep that work?). Even more, can we sniffer the data app to core and change its execution length then inject.

Also, is there any method to let the core execute those commands (that you detected) and use that to produce something you interested in?
:The ARM11 kernel [[Memory_layout#ARM11_User-land_memory_regions|initializes]] the MMU tables. "Also, is there any method to let the core execute those commands (that you detected) and use that to produce something you interested in?" By running code on a 3DS of course. --[[User:Yellows8|Yellows8]] 17:27, 17 June 2013 (CEST)
::Thanks. But still feeling strange of that strategy. I think at least the Home Menu may be able to re-map or deactive this mark.
::-snip- Sorry for being noob (i would try learning arm soon). Hope you good work.--[[User:Syphurith|Syphurith]] 02:46, 19 June 2013 (CEST)

Home Menu starts application processes via [[NS]], terminating and "suspending" process execution(the process is still running with that, the application threads wait for a [[NS]] notification for resuming actual execution) is done via NS as well. The ARM11 kernel handles mapping the processes' virtual memory for .text, .rodata, and .data. The ARM11 kernel handles terminating processes as well of course. The only process which has access to [[SVC|svcControlProcessMemory]] for mapping memory or changing memory permissions, is [[RO_Services|RO]] module, and of course that module will only map R-X .text pages for the signed [[CRO0|CRO]] .text. --[[User:Yellows8|Yellows8]] 03:16, 19 June 2013 (CEST)
:I can still remember ns/ro is also a title in title list. (if manually start that may fails/cause failure) if you launch a title with those commands manually, would it be exposed (in ram?)(, if so we may dump the firmware/modules)? MPS let multiple processes can share the same resources (with home menu?). or have we to modify the real memory externally? There are just thoughts, if interesting please think for a while; if not just tell me "NONE".--[[User:Syphurith|Syphurith]] 05:17, 19 June 2013 (CEST)
:I saw you update the AES page recently. you can confirm some keyslots are with the same data, but how had you done that (by comparing the data, or just the same memory location)? Can you even fetch those keys to decrypt the CDN TMD key strings? if so that would be a potential way to go.. BTW you're disasm those in-memory content not the decrypted Romfs right?
:I do wonder if contents decrypted succussfully, shall we need any customed disassembler? --[[User:Syphurith|Syphurith]] 16:51, 26 June 2013 (CEST)
::"some keyslots are with the same data" I encrypted an all-zero block with each AES engine keyslot with CTR=0, and encrypted that data again with each keyslot with keyY=0. When the output block for the former is the same for multiple keyslots, those keyslots use the same keyX/keyY. When the latter output block is the same for multiple keyslots, those keyslots use the same keyX. "decrypt the CDN TMD key strings" TMDs have nothing to do with decrypting the ticket titlekey. [[RomFS]] does not contain code(besides [[CRO0]] for web browser), that's stored in [[ExeFS]]:/.code. There's no need to dump code from memory when one can just use the [[AES]] engine. --[[User:Yellows8|Yellows8]] 17:40, 26 June 2013 (CEST)
:::oh well. sorry for been n00b again. then have you ever found something that you can execute to decrypt those CDN data? i badly wanna try it.. ExeFS.. okey.. hope good work--[[User:Syphurith|Syphurith]] 08:04, 27 June 2013 (CEST)

===Spam attack===
I guess the simple captcha isn't enough, do you have an idea what to do? (i'm asking you because you are the most active admin here). 
I think we should adopt a method of registration and waiting for an admin to approve it. the recent changes page is spammed hard and a lot of google pages, I guess, are being created linking to those pages. --[[User:Elisherer|Elisherer]] 09:40, 31 May 2013 (CEST)
:Mha is the only one that can do anything about anti-spam, I can't do much about it myself. Mha said that he would work on this tomorrow. --[[User:Yellows8|Yellows8]] 22:19, 31 May 2013 (CEST)
::A. Stop registeration for several weeks (NOT GOOD).
::B. Ajax to load captcha (maybe reCAPTCHA?). Not well-made bots will have trouble loading the javascript code or lose the speed (there is ones with javascript but can not act so quickly)(MAYBE USEFUL). This method is widely used ''it may be not so useful'' (against latest tools).
::C. Use auto filter to auto check those suspicious content and block those users, given an access for those by accident closed guys to talk about their opinion. (I do wonder if the wiki admin backdoor provide you such a tool)(Hey Regex~)
::D.find their IP and block the IP section for a while.(Similiar as A)
::E. Use man-made Email to validate (I means, instead of the system writing mail to user to validate, let user write mails to admin or other trusted -- use SPAM filter)(NOT WELL PRATICAL, Haven't tested, SO..)
::F. Calls for someone can trust and give him only those block and delete power (DIFFICULT). Well just a little tries..
::G. Try to update your wiki version first, i mean the version of this website framework. (MAYBE USEFUL? DOUBT..)
::If you tried the actions of blocking and the spam still flow in you need to update or call wiki program's supporters (may be exploit..) But i do wonder why they tried to attack here, a (script) guy (with latest tool)?(if so he should try to improve his skill first).
::Oh well, Recent changes. Guys have a good day (International Children's Day).--[[User:Syphurith|Syphurith]] 09:39, 1 June 2013 (CEST)
:We are able to mark those pages as spam but however no effects in deed if no one comes to remove those spam accounts. Well.--[[User:Syphurith|Syphurith]] 10:17, 17 June 2013 (CEST)

===Fundraiser===
Hello Yellows8,
I know you're not the one that is responsible for the chip decapping fundraiser, but I didn't manage to contact Jl12 via E-Mail (He's not responding). So, have you guys noticed that the donations hit the 2000$ last week? Will the decapping start anytime soon or do you need some more money for buying the 3DS itself?
Best regards
:Jl12 has had a broken 3DS for decapping before the fundraiser even started. And of course we noticed that, however since Jl12 is usually very busy it might be a while before he sends his 3DS for decapping. --[[User:Yellows8|Yellows8]] 00:26, 5 June 2013 (CEST)
Hi again,
anything regarding the chip decapping happened in the past week? Will the images be released to the public?
Best regards
:We still haven't heard anything from Jl12. --[[User:Yellows8|Yellows8]] 19:34, 15 June 2013 (CEST)

User:MatthewSt

2013-06-27T04:01:00Z

Syphurith: well bored enough.. to see those s**m

{{delete|such 'review' has already been posted for times. hey s*a* why not try another text? i'm getting tired of that}}

User:Nathaniel

2013-06-27T03:59:15Z

Syphurith: think of those on ps3wiki oh gosh. *p*m

{{delete|it is pity that wiki can not block you too strict. s**m}}

User:PerryLyon

2013-06-27T03:58:07Z

Syphurith: just another **am you know

User talk:Yellows8

2013-06-26T12:51:03Z

Syphurith: about the keyslots?

User:JaimeStra

2013-06-26T12:30:54Z

Syphurith: =_=||| i doubt when would these come to deleted users

User:JaimeStra

2013-06-25T08:17:14Z

Syphurith: that is the older version of s**m bo*s isn't it

User:DelilaWea

2013-06-25T03:09:24Z

Syphurith: =_=|||well daily update....lol

{{delete|oh dear i would appreciate if you upload a How-to prevent been sp**ed}}

User:MatthewSt

2013-06-24T06:41:31Z

Syphurith: i do wonder how easy it may be to use that tool to generates those fu**ing s***s

User:PerryLyon

2013-06-24T06:40:27Z

Syphurith: YASB - yet another *pam bo*

User:RosieBoeh

2013-06-23T21:46:17Z

Syphurith: i do wander how many b*ts did that

User:Corina70E

2013-06-23T21:45:35Z

Syphurith: O i see more

User:Florentin

2013-06-22T12:02:15Z

Syphurith: use not sp*m mark to disable sp*m reaction checks

User:MelindaCh

2013-06-22T00:21:30Z

Syphurith: oh well undo. seriously

User:PerryLyon

2013-06-22T00:20:43Z

Syphurith: Undo revision 7385 by PerryLyon (talk)

User talk:Elisherer

2013-06-21T13:20:13Z

Syphurith: about your 3dsexplorer

This is a hacking site.
If it is not for hacking,you need not upload or edit files.
Or you did find any games which seems to be exploitable?

: I did not find any exploitable games.. I didn't think all the games on that table were exploitable... just games so I started adding the list of the games. Anyway it still got some mistakes according to what I know. But I don't want to change it because I don't know enough in that field of hacking.--[[User:Elisherer|Elisherer]] 05:51, 31 August 2011 (CEST)

:: Searching for exploits now is a waste of time. We don't know enough to make exploits useful. --[[User:Luigi2us|Luigi2us]] 15:38, 31 August 2011 (CEST)

[[File:HNI_0090_MPO.JPG|120px]] 3DS may be support this one. How do you think? --[[Matyapiro31]] 16:40, 16 October 2011 (CEST)
:I think Nintendo wouldn't use something that unconventional...It propbably has a JTAG of some kind on the board. (Matyapiro please use the sig button at the end of your comments...) --[[User:Elisherer|Elisherer]] 16:47, 16 October 2011 (CEST)

[http://www.ebay.com/itm/RARE-Nintendo-3DS-Panda-Development-Model-/170674509885#ht_500wt_1287 3DS dev model] --Matyapiro31 15:12, 18 October 2011 (CEST)
:That's nice but I don't see it helping us at the moment (comparing to a normal unit). --[[User:Elisherer|Elisherer]] 17:10, 18 October 2011 (CEST)
::Well, maybe we can get easy some information using a dev-model, because Nintendo made these models for developers.
::@[[User:Matyapiro31|Matyapiro31]]: What do you want to do with the adapter shown on the picture above?--[[User:Lazymarek9614|Lazymarek9614]] 17:45, 18 October 2011 (CEST)

elisherer,are you interested in capturing 3DS screen?

Some interesting result found in Japan.--Matyapiro31 16:18, 28 February 2012 (CET)
:Ofcourse...tell me, tell me...--[[User:Elisherer|Elisherer]] 18:14, 28 February 2012 (CET)

== added swedish translation ==

3DSExplorer/sw
=)

== about game saves ==
There is one product called "3ds Cyber Save Editor". Looked carefully through the list of what games it supports, i found some games (that taken its offical cartbarge release date as a reference) must have using firmwares higher than 2.0.0 (which imported a new method of save encryption) and even one just released less than a month ago (in fact that is another title sorry). (If you need proofs i can get the list and all their release dates uploaded to my skydrive). So what do you think of such a product? If that do handle other games outside its support list (that i mean i can backup my save of one game and let it decrypted and resigned to your 3ds) i highly doubt it holding something like a keyslot of 3ds, or it can dump your console key (hey not such less). Or even it has more. well i'm getting many hunters cheating their games.
:It doesn't need the key from the 3ds because games and their saves are encrypted with general keys (which happens to be on the 3ds as well). I think their dongle has a lot of logic in it (if it is what is says it is) and is very much illegal... more on that subject I can't really comment until they provide some proof.. --[[User:Elisherer|Elisherer]] 18:13, 6 June 2013 (CEST)
(BTW could you please tell me where to edit if i do want to add CHN translation of 3dsexplorer?)--[[User:Syphurith|Syphurith]] 16:10, 5 June 2013 (CEST)
:Sorry 3dsexplorer is not localizable.. --[[User:Elisherer|Elisherer]] 18:13, 6 June 2013 (CEST)
::Ok i know then. Tried to communicate on irc one or two days ago. There Normmatt and others tried to analyse it, however got a result that all those encrypt/decrypt things happened on their server and the save file uploaded to remote seems to be a full one (that no clues about the decryption of the saves). Yellow said the company should already have lots of decrypted ncch or other things related to decrypt the saves, may be even decapped the SoC (at least how could they get those commands?).
::Got that. if we need to analyse that firmware file we should get that product first (cause those binary/hex related to its core - STM32XXXX) so that is not a very good way to explore. So leave that waiting for chip decapping result. --[[User:Syphurith|Syphurith]] 07:58, 7 June 2013 (CEST)
:Sorry to disturb you again, but.. If i or my friends prepare those CHNiese text for you, is it possible to add into the program? - Even i can read English without much trouble, someone is finding that not easy to use lol. BTW, what is the key that used to extract exefs.bin and so on from CXI? I'm confused about that. Maybe the Retail key? --[[User:Syphurith|Syphurith]] 17:20, 21 June 2013 (CEST)

User talk:3dsguy

2013-06-21T13:15:11Z

Syphurith: about exefs

Thanks,3dsguy.
How did you get it? Matyapiro31

As much as I'd like to say, I can't tell you where i got it. But i'm trying to post info as much about Dev 3DS as possible

Does your development 3DS appear to be same hardware as ordinary one? --Matyapiro31 16:10, 18 October 2011 (CEST)

Yes, Matyapiro31, it seems to be that way, i was surprised when i got it, that it did not have parts of the case in red like a panda dev unit, but it had the sticker on the back saying it was a "Development Unit". Also the FCC id does not differ between my Development Unit and a Retail Unit. This probably explains why in the Config menu, the "System Mode" (which I believe is memory allowance) is stuck on "Prod". For some reason Prod mode is 64mb. Why do you ask?

Hi 3dsguy, maybe you have something like a kiosk "demo unit" used at stores (like GameStop, etc.).

* Do you have a retail 3DS unit? I'm curious if your test unit will communicate with a retail 3DS unit. ( downloadplay, street-pass, etc. )
* Does it connect to (production) nusd update servers for any updates?
* Do you have any other software or hardware with it? ( firmware updates? rewritable CTR cards? etc. )
* Can you get more of them however/wherever you received yours from?
* Would you be willing to run pre-compiled apps imported through your dev menu on your test unit? [and if so do you have an email to send them to]
* Would you be willing to lend or rent your unit out? I'm pretty sure you won't but it wouldn't hurt to ask.
- [[User:Jl12|Jl12]]

No problem, I don't have a dev unit or anything so at least I can help out a little this way, lol. [[User:Nathan|Nathan]] 17:19, 20 May 2012 (CEST)

== 3DS Development System Talk ==

Quick link to a page on .CIA files, with sample .cia!!

I do not know a way of creating .CIA files. its just that [[Jl12]] asked me as part of a set of questions on my talk page:
*"Would you be willing to run pre-compiled apps imported through your dev menu on your test unit? [and if so do you have an email to send them to]"
I said of course, and gave some details. Then, Jl12 responded to that emailing me 3 apps to test. Jl12 on the other hand does know how to compile apps in the .cia format and appears to have access to the DSi SDK from what i gathered from the email.--[[User:3dsguy|3dsguy]] 22:37, 1 November 2011 (CET)
:This is the problem many people seem to have with the test units. From what I can tell, the only way to actually run some unsigned application (not created by Nintendo) is by programming it on a development flashcard. --[[User:Neimod|Neimod]] 01:11, 2 November 2011 (CET)
:I'm not sure why you deleted your previous post, but I agree that there are '''supposed''' to be different kinds of media (development flashcard, and copying from SD card to internal NAND) that allow running applications on a test unit. However, of these methods, only so far the development flashcard has proven to work with '''unsigned''' code. The problem lies in the fact that the unsigned development CXI image uses a dummy RSA private key to create the RSA signature, while official Nintendo development CXI images use the real deal. So as it stands, no developer can create proper CXI images for CIA importing. --[[User:Neimod|Neimod]] 14:11, 2 November 2011 (CET)
* I sent him 3 pre-compiled apps at first. ( all by Nintendo ). The first two don't boot because they're not compiled with the libs/firmware running on his test-unit. The 3rd TWL NAND app, doesn't have any icon/banner/title to identify itself after being installed, and although it imports/installs succesfully, it can't be selected or launched from Dev Menu or the Home Menu. Later, I sent him a self-built application ( one not by Nint. ), it installs, boots and runs properly and it just displays some information on the screens; those are the files and images he's linked to here. [the "Hello Galaxy!!!" test-application.]
* They're not unsigned. Dev/test units use a different set of keys then the retail/production units do.
* ''So as it stands, no developer can create proper CXI images for CIA importing.'' - What. I've sent self-built apps to test to 3dsguy and somebody else who owns a test unit running on a different firmware. They work fine. ( Although it's difficult to line up firmware revisions. )
* The one that runs was made (compiled/built) using the SDK/firmware revision matching his test-unit.
* He probably removed the 1st link because I asked him not to post anything with ( even potentially ) copyrighted contents for the sake of not getting this wiki associated with it, the binaries contained code from an e3 demo and the TWL/DSi SDK, we're not doing ourselves any benefit by posting it. The app that runs ( 'Hello Galaxy' ) is a self-compiled application, so it's probably not going to be mistaken for a game or another commercial application. [thus probably safe for wiki.] [[User:Jl12|Jl12]]
::Interesting. That's the first I hear about running self compiled CIA's on a test unit. And yes, sorry I said unsigned application, but I meant signed with the development RSA private key provided by the SDK. The official Nintendo development CIA's do not use keys from the SDK, but rather, a private one that is not distributed. --[[User:Neimod|Neimod]] 02:17, 4 November 2011 (CET)

I had a look at your previous post, 3dsguy, where you have posted a download link for a CIA file. We don't know much about CIA files so it was interesting to see a file and look into it. The actual data for the app/tmd/cmd files seems to be encrypted (expected that) there's only some plain text like "Root"", "CA00000004" and "Root-CA00000004" to name a few (...) which obviously are paths on the NAND FS. However, I've found out that the name of the files/directories (eg name of the app file:"ad7e6744") which are saved on the SD card after installing the archieve seem to be in the CIA file: Not as plain text, they're actually hex values. I'm not really sure about that. It would be nice if you could post another CIA file, 3dsguy, that we can compare them and find out more about it. Shall we actually create a new page about CIA files?--[[User:Lazymarek9614|Lazymarek9614]] 21:48, 2 November 2011 (CET)
: They're certificates.
: It's mentioned partially under "[[Download Play]]", because it's another use of the same file format. [[User:Jl12|Jl12]]

Yes I think we should create another page made for .CIA file and move some of this page to its discussion page. But I've got another .cia file and and boots. see [[http://121.215.146.1/3ds/more_cia_stuff.rar]] for everything you may want to know about it and perhaps from this we can start a new page.--[[User:3dsguy|3dsguy]] 07:52, 3 November 2011 (CET)
: I think this is more about getting our own code running on the 3DS/CTR then it is about CIA. [[User:Jl12|Jl12]]

Lazymarek9614, those "paths" are from the cert chain and the ticket. CIA is based on WAD. --[[User:Yellows8|Yellows8]] 16:25, 3 November 2011 (CET)
: If you are right and the format is based on WAD, then it might be little endian (unlike WAD). First there's an unknown byte (0x20) and then 4 bytes (0x20000000), which looks a lot like the header size in WAD (which is 'always' 32, in BE). So if this is the same field, I'm pretty sure it's LE. --[[User:Lesderid|lesderid]] 19:45, 3 November 2011 (CET)

@3dsguy - if the situation changes about being able to get any other test-units please let me know, thanks. [[User:Jl12|Jl12]]

@[[User:Jl12|Jl12]]: Do you have the Nintendo SDK? If so, can you upload it (correct me if this is a crime)?
: If I did, I wouldn't be posting it here, see bullet #5 above. -[[User:Jl12|Jl12]]
::Oops, sorry. Maybe can you upload some more CIA files which differs in some cases only like the title name, icon etc.?--[[User:Lazymarek9614|Lazymarek9614]] 18:20, 5 November 2011 (CET)
@--[[User:Lesderid|lesderid]]: "So if this is the same field, I'm pretty sure it's LE." I think it's HE. Is the header size actually 0x20 large? There's always a 0x80 byte after 0x20 bytes...--[[User:Lazymarek9614|Lazymarek9614]] 22:09, 4 November 2011 (CET)

Who ever has the ip "151.26.190.77" living in Campobasso, Italy, stop probing the website where I've hosted the files. There are no SDKs on that website so stop trying find something that does not exist.--[[User:3dsguy|3dsguy]] 13:13, 5 November 2011 (CET)

Just a simple question, 3dsguy. In the CIA page you uploaded a CIA example. Can you upload also the binary format uncrypted,please?--[[User:Jocopoco|Jocopoco]] 07:42, 18 November 2011 (CET)

@[[User:Jocopoco|Jocopoco]] - you should ask [[User:Jl12|Jl12]] for it, it's his app after all. If he asks you which one it is it's this one "JlTestApp - test_02.cia"--[[User:3dsguy|3dsguy]] 17:39, 18 November 2011 (CET)
:[[User:Jocopoco|Jocopoco]], that CIA isn't encrypted at all, just use ctrtool to extract the CXI and ExeFS.(and anything else) --[[User:Yellows8|Yellows8]] 18:44, 18 November 2011 (CET)
Sure? In the content folder there is a file named [''id''?].app it's encrypted I cant find anything, arm opcodes, text plain --[[User:Jocopoco|Jocopoco]] 19:09, 18 November 2011 (CET)
:That .app CXI is encrypted the same way as titles downloaded via eShop stored on SD card for retail 3DS,(besides different keys) the sample.cia is cleartext. --[[User:Yellows8|Yellows8]] 20:37, 18 November 2011 (CET)

@[[User:3dsguy|3dsguy]]: About the [[SHBIN]] in [[RomFS|romfs.bin]]. Have you ever found there is .shbin inside it? Look at which you uploaded to dropbox (''today or yesterday, named "CIA"'') and find that one in folder "CIA\Extracted CIA Content\CXI extract" and check offset 0x10C0. There is [[SHBIN]] name "font_RectDrawerShader.shbin" just above the offset (with 00 padding, also with the length of name 0x3a). There is also some other clear text. you can extract the file in hex to check the shbin (maybe 0x3A0+0x8/0x18, of that file). if you think there is chance to check those shbin, you may have to fetch some different CIA that generated and decrypt and then extract its Romfs. i will be eager to see the ''extracted decrypted romfs''. If there is the proper source code of those files that may be even easier to check the function's ASM. (well best way is ''use dev unit to generate a series of versions of the title and extract all CIAs and decrypt to check those shbins'') --[[User:Syphurith|Syphurith]] 05:07, 28 March 2013 (CET)
:[[User:Syphurith|Syphurith]], I knew about the .shbin in the RomFS. I've updated the archive to include it. It's not a particularly special file, I've seen it in lots of CXIs. You know you can use ctrtool to extract and view everything in the .CIA file, as it is a debug CIA. If you want the application's executable code, then you should look in the code.bin inside the "exefs_extracted" directory.--[[User:3dsguy|3dsguy]] 07:07, 28 March 2013 (CET)
::@[[User:3dsguy|3dsguy]], thanks for the information. well is there any way to check the relations that between assembly and source code? well i found those in exefs is salted (ie 0x5A03, with 0x00 0x10 0x20 chars. so if there is some source code of that CIA, the analyse can be even easier)(Since it is salted we may find out the salt hex and can make a tool to filter them all out). BTW, please take a look at these below:
::* Generate CIA series with Dev Unit (i mentioned above) and decrypt and try to compare those generated to see the assembly.
::* Decap the chip and try to gain the ''Creator Power'' and we can take down Home Menu then (but there should be lots of work to do).
::* Check all the potential storage media to look for 3ds Common Key, and use that and cetk of firmware on CDN to decrypt the firmware and check if there is any exploits that patched so the devices with lower version would have a chance to break in.
::* Crack the storage chips and use something like a proxy to record all the data streams to a prepared storage (or to PC)
::* Or simply let us wait for some progress?
:::You need to read up on the 3DS file formats, and boot order. It's nowhere near as simple as that.--[[User:3dsguy|3dsguy]] 07:59, 2 April 2013 (CEST)
::::I know there is a page of how 3DS got boot up (haven't found one telling me how a title got launched). Well i think i should try to read those documents (especially those has 'boot' or those word) again. --[[User:Syphurith|Syphurith]] 09:33, 2 April 2013 (CEST)

::I hope you can get some inspiration and find a new way. Well i'm wondering about where could be a 'CTR Common Prod 1' key stored. (if that can be written somehow, we may be able to cheat the system (if we can get its private key from device and use that for decrypt, sorry) I check those "CTR Common Prod 1" of my Japanese 3ds and one Usa 3ds of my friend, and found there is nothing different in hex. if you need more detail about that, pm me.) is that still more important finding the way? --[[User:Syphurith|Syphurith]] 09:50, 28 March 2013 (CET)
::You won't find the 3DS common key by analysing 3DS communications. The common key(s) are stored in two parts, and scrambled, deep inside the 3DS.--[[User:3dsguy|3dsguy]] 07:59, 2 April 2013 (CEST)
:::That's right (yellows8 edited 'ClCertA' page and i knew that days ago); i've given up finding one without hardware help (now waiting and also learning some basis about hardware methods from Hackmii). Thanks. --[[User:Syphurith|Syphurith]] 09:33, 2 April 2013 (CEST)

:I tried to check the 'exefs.bin' in your archive uploaded, and found it not easy to analyse. There're many things seems to be timestamps (that WinHex told me).. and those text inside are merely readable (but you can get 'NULL' or something else like 'Mem' or 'display'). I tried hard to get some but found that not useful as a clue. Also the header and reserved in exefs are 0x180 length now. If you can get many decrypted exefs.bin please tell me (especially those on a same branch of source code), thx. Well hope you get progress everyday. --[[User:Syphurith|Syphurith]] 07:22, 2 April 2013 (CEST)
::That is the decrypted ExeFS, BTW the ExeFS format is already [[ExeFS|reversed]]. You will probably find it hard to make anything out of the code actual game code, as it is a dissected version of an ARM ELF.--[[User:3dsguy|3dsguy]] 07:59, 2 April 2013 (CEST)
:::Oh.. Thanks. I may try to find another way. (sorry for my being noob, that is really not easy) --[[User:Syphurith|Syphurith]] 09:33, 2 April 2013 (CEST)
:That ExeFs seems to need decoding before trying to get anything from it (via disassemblers). So no usage now indeed (regarding yellow reading those in memory..)? or maybe we will need a customed disassembler dealing these for us? --[[User:Syphurith|Syphurith]] 17:15, 21 June 2013 (CEST)

User:Florentin

2013-06-20T21:44:50Z

Syphurith: spam+