3dbrew - User contributions [en]

3DS Development Unit Software

2015-01-27T08:06:27Z

Vgturtle127: /* Added info about the Coin Setter */

The following is a description of the functions what is possible with the applications unique to 3DS Development Units.

Descriptions Derived from SDK 2.3.4 except where notified otherwise. For information on 3DS Development Hardware see [http://gbatemp.net/topic/327858-3ds-development-hardware/]
[[File:CTR_HMN_DEV.png|300px|thumb|right|Beautifully clear picture of the Dev Apps + Home Menu. Click to view in great quality. - Xcution]]

== Dev Menu ==
[[File:Devmenuicon.png]]

[[File:Devmenscnsht.jpg|250px|thumb|right|Dev Menu Screenshots]]
[[File:Old_Dev_Menu.png|200px|thumb|left|Old Dev Menu Screenshot]]
This application on the top screen displays the firmware and revision of the Dev Menu, the free space available on the [[Flash Filesystem#TWL partition|TWL(DSi) NAND partition]] and [[SD Filesystem|SD card]] if present. It also provides information on the current file or device selected, as well as navigation instructions for the bottom screen.The bottom screen has three different windows, which are:

*Programs- From this window, applications can be loaded from the [[Flash Filesystem|NAND]], the [[SD Filesystem|SD card]] and the slot 1 card (only a select scope of applications, see below for Dev Menu revisions and their corresponding scope of applications) . This is shown in the format of "Unique Id' '[[Serials#Product Code|Product Code]]'". Installed titles can be deleted from this menu.

*Import- From this window, titles compiled in the format of a .[[CIA]] file, can be installed from the SD card. In later revisions this was renamed to ''SDMC''.

*HIO- A tab available in later revisions of the Dev Menu. Used for installing CIAs stored on the host PC, this is supported by hio services, and hio daemon on the host PC.

*ExtData- From this window, the 3DS's [[Extdata|ExtData]](this includes all ExtData) can be deleted

(Note that retail 3ds games are not recognised by Developer 3DSs and the Dev Menu prints "Unknown Card" in the 'Programs' window and shows no details on top screen)

(Also note that if a 3ds executable cannot be launched from the Dev Menu due to restrictive flags in the executable, such as restrictive memory, the product ID will be coloured red as opposed to black)

{| class="wikitable" border="1"
|-
! SDK Version
! Titles Accessible
|-
| 0.9.2 - 0.13.2
| Applications(NAND), System Applications , TWL Titles
|-
| 0.14.0 - 1.1.0
| Dev NAND Applications, System Applications , TWL Titles
|-
| 1.2.0 - 2.0.0
| Dev NAND Applications, DSiWare
|-
| 2.1.0 - 2.4.0
| Applications(SD), Dev NAND Applications, DSiWare
|-
| 3.0.0 - 3.1.0
| Applications(SD), Dev NAND Applications, Demos, DSiWare
|-
| 3.2.0
| Applications(SD), Dev NAND Applications, Demos, DSiWare, WebBrowser
|-
| 3.3.0 - Recent
| Applications(SD), Dev NAND Applications, Demos, DSiWare, WebBrowser, TwlNandFiler
|}

== Config ==
[[File:Configicon.png]]

[[File:3DS_dev_configmenu.JPG|250px|thumb|right|Config Menu Screenshot]]
This application is a configuration menu for the 3DS, which has the following options:

*Reset Settings - Resets all settings to default.

*Hid Setting - (human interface device) Calibrates Touch-Pad and Analog stick.

*Rtc Setting - (real time clock) Sets system time.

*Lcd Setting - Sets display settings as found in the home menu as well as Flicker settings.

*User Info Setting - Allows username change and "NG NAME FLAG" to be set to true or false.

:In later versions of Config, "User Info Setting" also has :
::*CountryId - Changes 3DS between installed countries.
::*RegionId - Changes between the location in the selected country.

*Other Setting(branches off into other settings) -
:*Sound Mode - mono/stereo/surround

:*System Mode - Changes Memory Allowance.
::*Prod - 64MB Memory mode ([[Home Menu]] can usually only run in this mode and ''most'' retail-looking units cannot switch out of this mode)
::*Dev1 - 96MB Memory mode
::*Dev2 - 80MB Memory mode
::*Dev3 - 72MB Memory mode
::*Dev4 - 32MB Memory mode
::All CTR Debuggers/Prototype units can change memory allowance. For Developer Test Units, the ability to change Memory Allowance, appears to be dependent on an option when buying the Test Unit. (similar to having a choice to purchase IS_Nitro's Wireless/USG options when buying an IS_Nitro from Nintendo)
::On some Test Units, it's possible to run the [[Home Menu]] outside of Prod. However, software with limited memory (such as the web browser) cannot be launched from the home menu if the home menu is outside of Prod.

:*Exception handler - Selects whether to enable or disable the application's handling of exceptions that arise in the non-debug environment - enable/disable

:*Break Stop - (enable/disable) - Selects whether to enable or disable stopping the application when a break is encountered in the non-debug environment. If the application is not made to stop, it quits on a break.

:*Menu - (Home Menu/Test Menu) This function edits the [[Config_Savegame|configuration]] field containing the menu TID for dev units, allowing the user to choose between the [[Home Menu]] or the [[3DS Development Unit GUI#Test Menu|Test Menu]], as the menu loaded by the [[NS]] module.

:*Language - same options found in the Language section of [[System Settings]] but also has an "invalid" option

:*Dlp Force Child Import - (enable/disable) - normally the 3ds caches downloaded "Download Play (Dlp)" applications on the nand and only re-downloads, overwriting the cached copy if the version application being requested to downloaded is higher than what is currently present on the nand. Enabling this option forces the 3ds to download and overwrite the cached copy on the nand, regardless of the version of the application being downloaded. This is of course for testing purposes.

:*Debug Mode - (enable/disable) - Toggles Debug environment?

:In later versions of Config, "Other Setting" also has :
::*FS Latency Emulation - Filesystem Latency, in milliseconds (0ms-2550ms). Selection is in increments of 10. (ie 0ms->10ms->20ms...)
::*Coppacs Setting - Unknown (stuck on 'not restricted')

*Test Setting - Test calibration of touch pad and joystick

*Eula Setting - Allows user to change "Agree Version" namely:"ff.ff" the two symbol sets are interchangeable with combination variations from aa to 99 (default is 00.00 where the Eula is not accepted yet).

*Stereo Camera Cal for Check - Camera test (?) as options to "write strange data(excess Z-rot) and "reset to factory default".

*Gyro / Accel Cal for Check - Allows Gyro and Accelerometer to be calibrated.

*Ctr Info Setting - Changes settings to that found on the ctrsetting.txt on an SD .

== Downloadplay Client ==
[[File:Dlpcliscnsht.jpg|250px|thumb|right|Downloadplay Client Screenshots]]
[[File:Dlpcliicon.png]]

Even though a Developer 3DS has a "Download Play" application visually identical to the retail 3DS [[Download Play|application]], the "Downloadplay Client" application can be installed as an alternative to the regular Download Play application. (Note: a Developer 3DS' and Retail 3DS' cannot receive download play 'children' from each-other.) This Developer application is a stripped down version of 'Download Play' which has the following options and limitations:

*It can only download 3ds download play titles

*Scraps the GUI found in the normal Download Play application(see screenshot)

*Can select from a maximum of 16 Download play 'servers'

This application is clearly used for easy testing of download play 'child' apps, without the hassle of constantly re-navigating the normal Download Play interface

== Network Settings ==
[[File:Netsetscnsht.jpg|250px|thumb|right|Network Settings Screenshots]]
[[File:Netseticon.png]]

This Developer application allows the users to directly modify the following from any of the three possible network setting 'slots'

*Security Mode :(the wireless encryption the network is using) OPEN/WEP 40bit/WEP 104bit/128bit/WPA TKIP/WPA2 TKIP/WPA AES/WPA2 AES

*SSID :(self-explanitory) maximum 32 characters

*KEY :(the key for the encrytion is here in plain text) the maximum length depends on encryption type

*AutoDNS :(whether the 3DS obtains the DNS automatically or not) |True-3DS obtains the DNS automatically|False-3DS uses the DNS server address provided by the user(it is possible to edit this here)|

At the bottom of the setting options there are two choices:

*Write Setting & Connect Test To AP - Applies the settings above and performs a connection test(note any settings made in system settings for this connection, which are not present in the above settings will be nullified, for example any proxy server settings)

*Remove Setting - removes all settings for this 'slot'

== SaveDataFiler ==
[[File:Saveflscnsht.jpg|250px|thumb|right|SaveDataFiler Screenshots]]
[[File:Saveflicon.png]]

This 3DS Developer application allows save files and extdata to be exported and imported from an SD Card. The window has three tabs:

*User - This is where saves for 3DS applications and saves on 3DS Game Cards(not DS Game Cards) can be exported to the SD Card. Saves cannot be deleted here.

*ExtData - This is where application extdata can be deleted or exported to the SD Card for later use

*SD - This is where extdata and application saves on the SD Card can be imported to the 3DS or 3DS Game Card. Also extdata and application saves can be deleted from the SD Card

User save data is exported to sdmc:/filer/UserSaveData/YYYYMMDD(Hour)(Minute)(Second)

It creates a folder in that path and 3 files. The 2 files exported to the above path are <uniqueID>.dat and <uniqueID>_.dat while a folder named /<uniqueID>/ in that path contains <ExHeader Name>.dat

== CTR MenuSelector ==
[[File:MenuSelector.png|120px|thumb|right|Menu Selector Screenshot]]
[[File:Menuselectoricon.jpg]]

This application when loaded can change the current 'Active Menu'(being used at the moment) by editing the menu TID [[Config_Savegame|configuration]] field, allowing the user to choose between the [[Home Menu]] or the [[3DS Development Unit GUI#Test Menu|Test Menu]], as the menu loaded by the [[NS]] module.
With the release of SDK 1.1.0, this application was superseded by the introduction of the "Menu" choice in the [[3DS Development Unit Software#Config|Config Menu]] and consequently removed as a standard application.

== CecLotcheckTool ==
[[File:Ceclotscnsht.jpg|250px|thumb|right|CecLotcheckTool Screenshot]]
[[File:Cecloticon.png]]

This application is used to manage CECs (Chance Encounter Communications, AKA StreetPass hits) for any of the twelve possible applications used on the 3DS, if there are any. The application has twelve possible slots which can be filled by BOXes . The BOXes are individual applications which are permitted by the user to use CECs, such as StreetPass Mii Plaza or Nintendo 3DS Sound. And as such, the boxes in this application correspond to the applications in 'StreetPass Management', in 'System Settings' (StreetPass Management is accessible from retail 3DSs). The functions of this application:

*<Y> BOX Options - this opens up a sub menu with the following options(when hovering over Nintendo 3DS Sounds BOX - the only one I can test the app with):

*Box Info - Gives the Out-Box parameters [[File:Boxinf.jpg|250px|]]

*Message Info (OUT-BOX) - Gives the Message Parameters For the current BOX [[File:Mesinf.jpg|250px|]]

*Dummy Message Settings - Not quite sure what the options do here [[File:Dummesinf.jpg|250px|]]

*<A> Create Dummy BOXes - Creates dummy BOXes to fill any unused slots. (does not overwrite any present slots)

*<X> Delete BOXes - Deletes all of the BOXes from the slots.

*<START> CEC Filter Reset - I can only guess that it erases data collected by CEC enabled apps.

== BossLotCheckTool ==
[[File:Bosslcscnsht.png|100px|thumb|right|BossLotCheckTool Screenshot]]
[[File:Bosslcicon.png]]

This application is used to manage BOSS (SpotPass) tasks/data for 3DS titles which utilise BOSS communications. 'Pokedex' is an application which utilizes BOSS comunications. This application also displays the 3DS's friend code, although this code is not to be confused with the 3DS's Friend Card code found in 'Friends List'. The user can browse by unique ID the 3DS titles(excluding system titles) registered to use BOSS. For each title you can view details about the downloaded 'NsData' which accompanies BOSS downloads, view the BOSS task lists (implies applications can perform more than one BOSS task). You can also view various details about each BOSS task, including:

TaskStatus : DONE?
TaskExecCount : How many times the BOSS task has been executed
TaskExecInterval : Period of time (in seconds) in the task is to be executed, in intervals
TaskPriority : Is a number value
URL : The URL to the BOSS content
AP Info : NONE?
TaskResultCode : Success or not
HTTP_StatusCode : Self explanatory
DataSize : Size of Content (in bytes)
Last_Modified : Last time the BOSS content (on server) was modified
StartTime : when the BOSS task was registered
OptOut : Whether the user can/has opted out of BOSS communication for this task

It also possible to manually execute the BOSS task from here

== Stereo Camera Calibrator ==
[[File:Stecamscnsht.png|100px|thumb|right|Stereo Camera Calibrator Screenshot]]
[[File:Stecamicon.png]]

The Stereo Camera Calibrator (SCC), in a nutshell, allows the user to adjust the configuration of the outer cameras in relation to each other. It can be configured automatically by positioning the 3DS a set distance away from a special chart. It can also be configured manually, by setting the rotation of each camera image and the size of the right eye camera. The 3D effect can be perceived by superimposing the right eye camera image translucently with the left eye camera image or by viewing the 3D image directly by use of the parallax barrier in the 3DS Screen.

== Model Viewer ==
[[File:ModelViewer.png|100px|thumb|right|3DS Model Viewer Screenshot]]
[[File:ModelViewericon.png]]

As the name suggests this application allows the user to view models. It is supposed to be used with a CTR-Debugger, assumingly so models can be entered in the memory of the program. But the program can be used on Test Units, but the model is restricted to three coloured lines depicting the 3 dimensions (x,y,z). The model can be viewed from any angle or scale, the perspective is controlled by the circle pad and directional buttons. And of course the application utilises the 3D effect

== Friend Testing Partner ==
[[File:Ftestpscnsht.png|250px|thumb|right|Friend Testing Partner Screenshot]]
[[File:Ftestpicon.png]]

The Friend Testing Partner application is used to test/monitor the 3DS's Friend List function. It allows the user to test various functions of the 3DS's out-going Friend Card, by giving the following options:
*Master Control - (RUN/STOP) (STOP is the default setting) when ‘STOP’ is selected the 3DS Friend Card uses the user’s settings/data. When ‘RUN’ is selected the 3DS Friend Card uses the dummy settings/data chosen to test from the settings bellow.

*Login/Logout - (ON/OFF) (ON is the default setting) What effect this has on the Friend Card is not known

*Playing Title - (ON/OFF) (ON is the default setting) When ‘ON’ is selected the currently used title is ignored and a dummy applications are cycled through as the ‘Playing Title’ approximately every ten seconds in its place. The dummy applications used are the applications found in Firmware version 1.0.0-0 of a retail 3DS including the ‘Nintendo Zone viewer’ app. When ‘OFF’ is selected the currently used title (which is the Friend Testing Partner app) is used as the ‘Playing Title’

*Mode Description - (ON/OFF) (ON is the default setting) When ‘ON’ is selected the Software in Use(Playing Title) is accompanied by the Date and Time found on that user’s 3DS. The Mode Description is refreshed every ten or so seconds. When ‘OFF’ is selected the date and time on the user’s 3DS is not displayed.

*Message - (ON/OFF) (ON is the default setting) When ‘ON’ is selected the message made by the user is replaced(not overwritten as it reverts back to the user’s choice when this is ‘OFF’) by the current date and time in the format “YYYYMMDD HHMMSS”, this is refreshed every ten or so seconds.

*Mii - (ON/OFF) (ON is the default setting) When 'ON' the currently used Mii is replaced with one of 4 dummy Miis and cycles them through every ten seconds with a new dummy mii. This effect can only be seen from another 3DS not the host

*Favorite Title (ON/OFF) (ON is the default setting) When 'ON' is selected, the user’s favorite title is replaced with a dummy, which is replaced every 10 or so seconds.
Also this application allows the user to monitor the whether the 3DS is online or not and whether the 3DS’s Friend Presence is online or offline. Every time a dummy setting is refreshed it is displayed on the top screen with a time stamp.

== Game Coin Setter ==
[[File:Coinstscnsht.png|100px|thumb|right|Game Coin Setter Screenshot]]
[[File:Coinsticon.png]]

This application is used to set the Play Coin count on the 3DS. Obviously this was created so a developer can test parts of their game in which the player can exchange earned play coins for in-game content or similar. It has a very simple interface showing the current play coin count and the adjustable option, the target coin count. These are the controls with explanation of each:

*LEFT/RIGHT - using the D-pad only to adjust the 'Target Count' to a number between 0-300.

*A - Sets the 'Current Count' (amount of play coins the system has) to the user selected 'Target Count' (the user specified amount of play coins)

*L+R+X - "Preclude today's Increment" This is fairly complicated...This either removes all coins added today, or removes all coins added previously starting the day before. Then it allows you to add more (with the value you set). This is more of a theory, it is poorly translated and this option isn't very useful anyway. Do yourself a favor and just give yourself millions of coins so you can buy all the fun stuff. :)

== TWL Development Tools ==

These are DSi/DS mode development tools repackaged into a [[CIA]], for installing to the TWL NAND.

=== NINTENDO DS - WMtest ===
[[File:Wmtestscnsht.jpg|300px|thumb|right|WMtest Screenshot]]
[[File:Wmtesttool.png‎]]

This application is a TWL(DSi) application compiled for use on the 3DS. It is an wireless test tool with its uses explained below:

*Scan Test - Scans Wireless channels 1-13(can be focused on one specific channel) for broadcasting stations. It can detect two types of broadcasting stations:

Wifi Access Points - Giving the Mac Address, Broadcasting Channel, 'c', and the SSID

DS Stations such as DS Download stations and Pokemon distributors - Giving the Mac Address, Brodcasting Channel, TGID and GGID

*ScanEx Test - and has two Scan Types. Passive which lets you individually scan channels 1-13 (only one at at time) and the DS distribution channels (1,7,13 all at once). And Active which scans all 13 channels at once. when it finds a channel it prints on the bottom screen next to 'Found' 'bssDescCount='

*MeasureChannel Test - not quite sure what this does but it for a given channel it gives a ratio(in percentage form), which it finds in its allocated test time ranging from 10ms to 1000ms. And for every interval of time which is specified, it tests and gives a ratio.

*Noise Mode - Seeks wireless channels in which to make wireless noise (This is not made very clear on the app). You can specify the:

Channel where the scanner will seek to make noise

Noise Rate, ranging from 0% to 100%

Frequency, ranging from 10ms to 50ms

Seek Mode, ranging from 1000ms to 1500ms

When the settings are chosen the top screen has two counters which display 'Noise ON count' and 'Noise OFF count' the counters are affected by the noise rate. Starting at 0% the 'Noise ON count' does not change but as the Noise rate gets closer to 100% the count moves and gets faster as Noise rate reaches 100%. For 'Noise OFF count' it is the exact opposite to the ' Noise ON count' in regards to counting.

----
[[Category:3DS Development Unit Related Pages]]

AES Registers

2014-11-12T06:32:16Z

Vgturtle127: Fixes

== Registers ==
{| class="wikitable" border="1"
! NAME
! PHYSICAL ADDRESS
! WIDTH
! RW
|-
| REG_AESCNT
| 0x10009000
| 4
| RW
|-
| REG_AESBLKCNT
| 0x10009004
| 4
| W?
|-
| REG_AESWRFIFO
| 0x10009008
| 4
| W
|-
| REG_AESRDFIFO
| 0x1000900C
| 4
| R
|-
| REG_AESKEYSEL
| 0x10009010
| 1
| RW
|-
| REG_AESKEYCNT
| 0x10009011
| 1
| RW
|-
| REG_AESCTR
| 0x10009020
| 16
| W
|-
| REG_AESMAC
| 0x10009030
| 16
| W
|-
| REG_AESKEY0
| 0x10009040
| 48
| W
|-
| REG_AESKEY1
| 0x10009070
| 48
| W
|-
| REG_AESKEY2
| 0x100090A0
| 48
| W
|-
| REG_AESKEY3
| 0x100090D0
| 48
| W
|-
| REG_AESKEYFIFO
| 0x10009100
| 4
| W
|-
| REG_AESKEYXFIFO
| 0x10009104
| 4
| W
|-
| REG_AESKEYYFIFO
| 0x10009108
| 4
| W
|}

== REG_AESCNT ==
{| class="wikitable" border="1"
! Bit
! Description
|-
| 4-0
| Write FIFO count (0-16)
|-
| 9-5
| Read FIFO count (0-16)
|-
| 10
| Flush write FIFO (1=Clear write FIFO)
|-
| 11
| Flush read fifo (1=Clear read FIFO)
|-
| 18-16
| MAC size (encoding = (maclen-2)/2)
|-
| 19
|? (MAC related)
|-
| 20
| MAC input control (0 = read MAC from FIFO, 1 = read from MAC register)
|-
| 21
| MAC status (0 = invalid, 1 = verified)
|-
| 22
| Output endianness (1=Big endian, 0=Little endian)
|-
| 23
| Input endianness (1=Big endian, 0=Little endian)
|-
| 24
| Output word order (1=Normal order, 0=Reversed order)
|-
| 25
| Input word order (1=Normal order, 0=Reversed order)
|-
|-
| 26
| Update keyslot (set to 1 when the keyslot is changed)
|-
| 29-27
| Mode (0=CCM decrypt, 1=CCM encrypt, 2=CTR, 3=CTR, 4=CBC decrypt, 5=CBC encrypt, 6=ECB decrypt, 7=ECB encrypt)
|-
| 30
| Interrupt enable (1=enable, 0=disable)
|-
| 31
| Start (1=enable/busy, 0=idle)
|}

== REG_AESBLKCNT ==

{| class="wikitable" border="1"
! Bit
! Description
|-
| 16-31
| (Data length)>>4
|}

== REG_AESKEYCNT ==
{| class="wikitable" border="1"
! Bit
! Description
|-
| 5-0
| Keyslot
|-
| 6
| Hardware key-generator type: 0 = 3DS, 1 = DSi.
|-
| 7
| This normally has value 1 written here when updating keys, however that's not actually needed(keydata gets updated regardless of whether this bit is set).
|}

Bit6 is only used when keyslots >=4 are used, value1 has the same affect as doing key-init with the TWL keyslots. Bit6 is checked when a keyY was written, for when the final-normalkey needs updated via the key-generator.

== REG_AESCTR ==
This register specifies the counter (CTR mode), nonce (CCM mode) or the initialization vector (CBC mode) depending on the mode of operation.
For CBC and CTR mode this register takes up the full 16 bytes, but for CCM mode the nonce is only the first 12 bytes.

== REG_AESMAC ==
This register specifies the message authentication code (MAC) for use in CCM mode.

== Endianness and word order ==
When writing to the REG_AESCTR or REG_AESMAC register, the hardware will process the written data according to the current input endianness specified in AESCNT. However, the current specified input word order will not be honored for this register, and always defaults to reversed word order. Therefore, for normal word order, the reversal must be carried out manually if required.

== Keyslots ==
{| class="wikitable" border="1"
! Keyslot
! Description
|-
| 0x00-0x03
| These are the TWL keyslots, the key-data for these can be set via the REG_AESKEY0-REG_AESKEY3 registers. These keyslots are initialized by NATIVE_FIRM. The console-unique portion of two of these keyslots are only [[CONFIG|initialized]] by NATIVE_FIRM during initial hard-boot.
|-
| 0x0D
| See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]], this uses the hardware key-scrambler.
|-
| 0x11
| This is used for general normal-key crypto, where the normal-key is set by FIRM. This keyslot is also used by the New3DS [[FIRM]] arm9 binary loader.
|-
| 0x14
| Starting with [[5.0.0-11]], NATIVE_FIRM Process9 now sets the keyY for this to the same one it uses for initializing 3 of the keyslots' keyYs from [[PSPXI:EncryptDecryptAes|here]].
|-
| 0x20..0x23
| All of these keyslots(initialized by bootrom) are set to the same key-data. These seem to be set to a regular normal-key?
|-
| 0x25
| The keyX and keyY initialized by bootrom for this keyslot are console-unique. This keyslot is used for the [[7.0.0-13|v7.0]] [[NCCH]] encryption, the keyX is initialized during NATIVE_FIRM [[Savegames#6.0.0-11_Savegame_keyY|boot]]. The keyY/CTR used for this keyslot is the same as keyslot 0x2C.
|-
| 0x2C
| Used to decrypt [[NCCH|NCCH]], the keyY is set by Process9(see [[NCCH|here]] regarding the keyY). Keyslots 0x2C..0x2F all use the same keyX, set by bootrom.
|-
| 0x2D
| See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]], this uses the hardware key-scrambler.
|-
| 0x2E
| See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]]. This keyY is set by NATIVE_FIRM.
|-
| 0x2F
| Initially this keyslot has the same keyY as keyslot 0x2D, initialized by bootrom. This keyY is initialized during NATIVE_FIRM [[Savegames#6.0.0-11_Savegame_keyY|boot]]. This is the keyslot used for calculating v6.0 gamecard savegames' keyYs.
|-
| 0x31
| See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]], this uses the hardware key-scrambler. NATIVE_FIRM sets this keyY to the same one used for keyslot 0x2E.
|-
| 0x32
| See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]]. This keyslot keyX is the same keyX used for keyslot 0x31.
|-
| 0x34-0x37
| All four of these keyslots use the same keyX. Keyslots 0x35/0x36 use the same keyY, see [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]] for keyslot 0x36.
|-
| 0x38
| See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]], this uses the hardware key-scrambler.
|-
| 0x39
| See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]]. This keyslot keyX is the same keyX used for keyslot 0x38. NATIVE_FIRM sets this keyY to the same one used for keyslot 0x2E.
|-
| 0x3D
| This keyslot uses keyY. Used to decrypt title keys in [[Ticket]]. Used by Gateway.
|-
| 0x3E
| This keyslot uses an unique keyX/keyY.
|-
| 0x3F
| This keyslot uses an unique keyX/keyY.
|}

=== Hardware key generator ===
Unless noted otherwise, all keyslots on retail units use the hardware key-scrambler, where the final normal-key is generated in hardware using the input keyX and keyY. This normal-key is then written to the hardware keyslot by the AES engine, all of the AES engine key registers are write-only. The internal normal-key keyslot is only updated when the keyY is written to, the keyslot's normal-key is not immediately updated when writing to the keyX.

=== keyX ===
The ARM9 bootrom initializes the keyX for each 3DS keyslot, the ARM9 bootrom also initializes the keyY for the keyslots where NATIVE_FIRM doesn't set the keyY. In certain cases Process9 may also set the keyX.

=== Updating keydata ===
After writing to a keyslot when the keyslot is already selected, the keyslot must be re-selected for the updated keyslot key-data to be used.

Writing to the key FIFOs with byte writes results in the AES engine converting the byte to a word for setting the key word, with this: word = (byteval) | (byteval<<8) | (byteval<<16) | (byteval<<24). The result is the same regardless of which FIFO register byte was written to.

=== FIRM-launch key clearing ===
Starting with [[9.0.0-20]] the Process9 FIRM-launch code now "clears" the following AES keyslots, with certain keydata by writing the normal-key: 0x15 and 0x18-0x20. These are the keyslots used by the New3DS [[FIRM]] arm9bin loader(minus keyslot 0x11), so the New3DS Process9 presumably does this too.

Filesystem services

2014-11-12T06:09:35Z

Vgturtle127: Fixes and improvements, added a note about the table for accuracy purposes

[[Category:Services]]

= Filesystem service "fs:USER" =
You can at most have 32 FS archive handles.

{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Description
! scope="col" width="400" | Required [[NCCH/Extended_Header|exheader]] access info bitmask
|-
| 0x000100C6
|?
| Dummy1
| None
|-
| 0x040100C4
|?
| Control
| None
|-
| 0x08010002
|?
| [[FS:Initialize|Initialize]]
| None
|-
| 0x080201C2
|?
| [[FS:OpenFile|OpenFile]]
| None
|-
| 0x08030204
|?
| [[FS:OpenFileDirectly|OpenFileDirectly]]
| None
|-
| 0x08040142
|?
| [[FS:DeleteFile|DeleteFile]]
| None
|-
| 0x08050244
|?
| RenameFile
| None
|-
| 0x08060142
|?
| [[FS:DeleteDirectory|DeleteDirectory]]
| None
|-
| 0x08070142
|?
| DeleteDirectoryRecursively
| None
|-
| 0x08080202
|?
| CreateFile
| None
|-
| 0x08090182
|?
| [[FS:CreateDirectory|CreateDirectory]]
| None
|-
| 0x080A0244
|?
| RenameDirectory
| None
|-
| 0x080B0102
|?
| [[FS:OpenDirectory|OpenDirectory]]
| None
|-
| 0x080C00C2
|?
| [[FS:OpenArchive|OpenArchive]]
| Each archive ID code has separate access info bitmasks, if it has any
|-
| 0x080D0144
|?
| ControlArchive
| None
|-
| 0x080E0080
|?
| [[FS:CloseArchive|CloseArchive]]
| None
|-
| 0x080F0180
|?
| FormatThisUserSaveData
| None
|-
| 0x08100200
|?
| CreateSystemSaveData
| 0x4, for when the input saveID doesn't match the exheader saveID
|-
| 0x08110040
|?
| DeleteSystemSaveData
| 0x1004, for when the input saveID doesn't match the exheader saveID
|-
| 0x08120080
|?
| GetFreeBytes
| None
|-
| 0x08130000
|?
| GetCardType
| 0x1017
|-
| 0x08140000
|?
| [[FS:GetSdmcArchiveResource|GetSdmcArchiveResource]]
| None
|-
| 0x08150000
|?
| [[FS:GetNandArchiveResource|GetNandArchiveResource]]
| None
|-
| 0x08160000
|?
| GetSdmcFatfsError
| 0x2
|-
| 0x08170000
|?
| [[FS:IsSdmcDetected|IsSdmcDetected]]
| None
|-
| 0x08180000
|?
| [[FS:IsSdmcWritable|IsSdmcWritable]]
| None
|-
| 0x08190042
|?
| GetSdmcCid
| 0x2
|-
| 0x081A0042
|?
| GetNandCid
| 0x2
|-
| 0x081B0000
|?
| GetSdmcSpeedInfo
| 0x2
|-
| 0x081C0000
|?
| GetNandSpeedInfo
| 0x2
|-
| 0x081D0042
|?
| GetSdmcLog
| 0x2
|-
| 0x081E0042
|?
| GetNandLog
| 0x2
|-
| 0x081F0000
|?
| ClearSdmcLog
| 0x2
|-
| 0x08200000
|?
| ClearNandLog
| 0x2
|-
| 0x08210000
|?
| CardSlotIsInserted
| 0x1017
|-
| 0x08220000
|?
| CardSlotPowerOn
| 0x2
|-
| 0x08230000
|?
| CardSlotPowerOff
| 0x2
|-
| 0x08240000
|?
| CardSlotGetCardIFPowerStatus
| 0x2
|-
| 0x08250040
|?
| CardNorDirectCommand
| 0x2
|-
| 0x08260080
|?
| CardNorDirectCommandWithAddress
| 0x2
|-
| 0x08270082
|?
| CardNorDirectRead
| 0x2
|-
| 0x082800C2
|?
| CardNorDirectReadWithAddress
| 0x2
|-
| 0x08290082
|?
| CardNorDirectWrite
| 0x2
|-
| 0x082A00C2
|?
| CardNorDirectWriteWithAddress
| 0x2
|-
| 0x082B00C2
|?
| CardNorDirectRead_4xIO
| 0x2
|-
| 0x082C0082
|?
| CardNorDirectCpuWriteWithoutVerify
| 0x2
|-
| 0x082D0040
|?
| CardNorDirectSectorEraseWithoutVerify
| 0x2
|-
| 0x082E0040
|?
| [[FS:GetProductInfo|GetProductInfo]]
| 0x1005
|-
| 0x082F0040
|?
| [[FS:GetProgramLaunchInfo|GetProgramLaunchInfo]]
| 0x1005
|-
| 0x08300182
|?
| CreateExtSaveData
| 0xC, for when the input extdataID doesn't match the exheader extdataID
|-
| 0x08310180
|?
| CreateSharedExtSaveData
| 0x1005
|-
| 0x08320102
|?
| [[FS:ReadExtSaveDataIcon|ReadExtSaveDataIcon]]
| 0x100D, for when the input extdataID doesn't match the exheader extdataID
|-
| 0x08330082
|?
| EnumerateExtSaveData
| 0x1005
|-
| 0x08340082
|?
| EnumerateSharedExtSaveData
| 0x1005
|-
| 0x08350080
|?
| DeleteExtSaveData
| 0x100D, for when the input extdataID doesn't match the exheader extdataID
|-
| 0x08360080
|?
| DeleteSharedExtSaveData
| 0x1005
|-
| 0x08370040
|?
| SetCardSpiBaudRate
| 0x2
|-
| 0x08380040
|?
| SetCardSpiBusMode
| 0x2
|-
| 0x08390000
|?
| SendInitializeInfoTo9
| None
|-
| 0x083A0100
|?
| GetSpecialContentIndex
| 0x1005
|-
| 0x083B00C2
|?
| GetLegacyRomHeader
| 0x1015
|-
| 0x083C00C2
|?
| GetLegacyBannerData
| 0x1015
|-
| 0x083D0100
|?
| CheckAuthorityToAccessExtSaveData
| 0x44
|-
| 0x083E00C2
|?
| QueryTotalQuotaSize
| None
|-
| 0x083F00C0
|?
| GetExtDataBlockSize
| None
|-
| 0x08400040
|?
| AbnegateAccessRight
|?
|-
| 0x08410000
|?
| DeleteSdmcRoot
| 0x1005
|-
| 0x08420040
|?
| DeleteAllExtSaveDataOnNand
| 0x1005
|-
| 0x08430000
|?
| [[FS:InitializeCtrFileSystem|InitializeCtrFileSystem]]
| None
|-
| 0x08440000
|?
| CreateSeed
| 0x2
|-
| 0x084500C2
|?
| GetFormatInfo
|?
|-
| 0x08460102
|?
| GetLegacyRomHeader2
| 0x1015
|-
| 0x08470180
|?
| FormatCtrCardUserSaveData
| 0x6
|-
| 0x08480042
|?
| GetSdmcCtrRootPath
| 0x100D
|-
| 0x08490040
|?
| GetArchiveResource
|?
|-
| 0x084A0002
|?
| ExportIntegrityVerificationSeed
| 0x4000
|-
| 0x084B0002
|?
| ImportIntegrityVerificationSeed
| 0x4000
|-
| 0x084C0242
|?
| FormatSaveData
| 0x6, in some cases this write isn't needed however
|-
| 0x084D0102
|?
| GetLegacySubBannerData
| 0x1015
|-
| 0x084E0342
|?
| [[FS:UpdateSha256Context|UpdateSha256Context]]
| 0x5
|-
| 0x084F0102
|?
| ReadSpecialFile
| None
|-
| 0x08500040
|?
| GetSpecialFileSize
| None
|-
| 0x08510242
| [[3.0.0-5]]
| CreateExtSaveData
| Shared extdata: 0x101005. Regular extdata in certain cases: 0xC
|-
| 0x08520100
| [[3.0.0-5]]
| DeleteExtSaveData (u32 flags, u64 extdataID)
| Shared extdata: 0x101005. Regular extdata in certain cases: 0x10100D
|-
| 0x08530142
| [[3.0.0-5]]
| ReadExtSaveDataIcon
| 0x10100D (this doesn't apply in certain cases, however)
|-
| 0x085400C0
| [[3.0.0-5]]
| GetExtDataBlockSize?
| 0x10100D (this doesn't apply in certain cases, however)
|-
| 0x08550102
| [[3.0.0-5]]
| EnumerateExtSaveData
| 0x101005
|-
| 0x08560200
| [[3.0.0-5]]
| FsCreateSystemSaveData?
| 0x4 (this doesn't apply in certain cases, however)
|-
| 0x08570080
| [[3.0.0-5]]
| DeleteSystemSaveData
| 0x1004 (this doesn't apply in certain cases, however)
|-
| 0x08580000
| [[3.0.0-5]]
| [[FS:GetMovableSedHashedKeyYRandomData|GetMovableSedHashedKeyYRandomData]]
| 0x2004
|-
| 0x08590200
| [[3.0.0-5]]
| SetMovableSedHashedKeyYRandomData?
| 0x2004
|-
| 0x085A00C0
| [[3.0.0-5]]
| SetArchivePriority(u64 ID,u32 priority)
| None
|-
| 0x085B0080
| [[3.0.0-5]]
| GetArchivePriority(u64 ID,u32 *priority)
| None
|-
| 0x085C00C0
| [[3.0.0-5]]
| SetCtrCardLatencyParameter
| 0xE
|-
| 0x085D0180
| [[3.0.0-5]]
|?
| 0x100001
|-
| 0x085E0040
| [[3.0.0-5]]
| ResetCardCompatibilityParameter
| 0xE
|-
| 0x085F0040
| [[3.0.0-5]]
| SwitchCleanupInvalidSaveData
| 0x12004
|-
| 0x08600042
| [[3.0.0-5]]
| EnumerateSystemSaveData
| 0x2004
|-
| 0x08610042
| [[3.0.0-5]]
| InitializeWithSdkVersion
| None
|-
| 0x08620040
| [[3.0.0-5]]
| SetPriority
| None
|-
| 0x08630000
| [[3.0.0-5]]
| GetPriority
| None
|-
| 0x08640000
| [[3.0.0-5]]
| Obsoleted_4_0_GetNandInfo Stubbed, this returns an error
| None
|-
| 0x08650140
| [[4.0.0-7]]
| SetSaveDataSecureValue, this is used with [[Anti Savegame Restore]].
| 0x121004 (in certain cases this doesn't apply, however)
|-
| 0x086600C0
| [[4.0.0-7]]
| GetSaveDataSecureValue, this is used with [[Anti Savegame Restore]].
| 0x121004 (in certain cases this doesn't apply, however)
|-
| 0x086700C4
| [[4.0.0-7]]
| ControlSecureSave
| 0x121004
|-
| 0x08680000
| [[4.0.0-7]]
| GetMediaType, This loads the u8 mediatype for the current application from already initialized state, this u8 was originally loaded from the same data used by [[FS:GetProgramLaunchInfo|GetProgramLaunchInfo]]. This then writes the u8 to response-word[2]. This is used with [[Anti Savegame Restore]]
| None
|-
| 0x08690000
| [[4.0.0-7]]
| Obsoleted_4_0_GetNandEraseCount Stubbed, this returns an error.
| None
|-
| 0x086A0082
| [[4.0.0-7]]
| ReadNandReport This is a wrapper for [[Filesystem_services_PXI|FSPXI]] command 0x00550082.
| None
|-
| 0x086B00C2
|?
|?
| 00121004
|-
| 0x086C00C2
|?
|?
| 00121004
|-
| 0x086D0040
|?
|?
| 00020004
|-
| 0x086E00C0
|?
|?
|None?
|-
| 0x086F0040
|?
|?
| 0xE
|-
| 0x087000C2
|?
|?
|None?
|-
| 0x08710100
|?
|?
| 0xC
|-
| 0x087201C0
|?
|?
| 00080004
|-
| 0x087300C0
|?
|?
| 00080004
|-
| 0x08740000
|?
|?
| 00080004
|-
| 0x08750140
|?
|?
|None?
|-
| 0x087600C0
|?
|?
|None?
|-
| 0x08770100
|?
|?
|?
|-
| 0x087800C0
|?
|?
|?
|}

Note: The question marks from Dummy1 to GetSpecialFileSize on the "available since system version" field are mainly there because I think that most of these are necessary for the main system to function, so theoretically that would mean that since the creation of the 3DS these were available, or since launch if that makes more sense. But because of the peculiar nature of some of the functions, they will remain question marks until they can be confirmed 100%.

When access rights are required for a command, at least one of the bits in the process access info specified in the above table for the command must be set. Error 0xD9004676 is returned when a process attempts to use a command which it doesn't have access rights for the command. The exheader access info field is all zero's for most applications. Note that the permissions listed in the above table is for system-version v2.x, therefore permission bit(s) added with newer FIRM may be missing from this.

Each session for fs:USER has separate permissions, initially these are set to all zero's for new fs:USER sessions. The permissions/etc for fs:USER sessions are initialized via [[FS:Initialize]](loaded from the user process exheader).

=File service=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x000100C6
| Dummy1
|-
| 0x040100C4
| Control
|-
| 0x08010100
| OpenSubFile
|-
| 0x080200C2
| [[FSFile:Read|Read]]
|-
| 0x08030102
| [[FSFile:Write|Write]]
|-
| 0x08040000
| [[FSFile:GetSize|GetSize]]
|-
| 0x08050080
| [[FSFile:SetSize|SetSize]]
|-
| 0x08060000
| GetAttributes
|-
| 0x08070040
| SetAttributes
|-
| 0x08080000
| [[FSFile:Close|Close]]
|-
| 0x08090000
| Flush
|-
| 0x080A0040
| SetPriority
|-
| 0x080B0000
| GetPriority
|-
| 0x080C0000
| OpenLinkFile
|}

=Directory service=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x000100C6
| Dummy1
|-
| 0x040100C4
| Control
|-
| 0x08010042
| [[FSDir:Read|Read]]
|-
| 0x08020000
| [[FSDir:Close|Close]]
|}

= Filesystem service "fs:LDR" =
This service is identical to fs:USER, except [[FS:OpenArchive]] archive 0x2345678E can only be accessed with fs:LDR

= ProgramRegistry service "fs:REG" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x000100C6
| Dummy1
|-
| 0x040103C0
| Register
|-
| 0x04020040
| Unregister
|-
| 0x040300C0
| GetProgramInfo
|-
| 0x04040100
| LoadProgram
|-
| 0x04050080
| UnloadProgram
|-
| 0x04060080
| CheckHostLoadId
|}

=Errors=
See [[Filesystem_services_PXI]].

RSF Files

2014-11-12T03:57:46Z

Vgturtle127: Create RSF files page, put some basic info in

RSF files are files with descriptive data used when outputting a CCI/CXI file. Specifying options such as title, save type, and so on are available.

Makerom

2014-11-12T02:16:14Z

Vgturtle127: /* Issues */

{{Infobox homebrew
| title = makerom
| type = pc utility
| author = [[User:3dsguy|3dsguy]]
| download = https://anonfiles.com/file/2e954a4b954778e8bcd0c317f071c272
| source = https://github.com/3DSGuy/Project_CTR/tree/master/makerom
| version = 0.8
}}

makerom is a tool which can be used to create [[NCCH]], [[NCSD|CCI]], and [[CIA]] files.

== Using Makerom ==

=== Command line ===
Since CCI and CIA are NCCH containers, makerom was built so CXIs could be built stand alone or straight into a container format. It is also possible rebuild CXIs from an ELF file. As a result there are many combinations which can be used; for simplicity, specific functions will be explained by breaking them up into argument groups:

'''Creating CXIs from scratch:'''
-elf <elf path> -rsf <rsf path> [-icon <[[SMDH|icon]] path> -banner <banner path>]

'''Rebuilding CXIs:'''
-code <decompressed exefs .code> -exheader <exheader from original CXI> -rsf <rsf path> [-icon <[[SMDH|icon]] path> -banner <banner path> -romfs <cleartext romfs binary>]

'''Creating CFAs:'''
-f cfa -rsf <rsf path> [-icon <[[SMDH|icon]] path> -romfs <romfs binary>]

'''Creating CCIs:'''
-f cci [-content <path>:<index> ...]

'''Creating CIAs:'''
-f cia [-content <path>:<index>:<id> ...]

'''Using Desc presets:'''
-desc <app type>:<firm version>

* 'app type' can be SDApp / ECApp / Demo / DlpChild
* 'firm version' is the target kernel version minor for the intended 3DS system.

'''Examples:'''
Create a CCI, using a manual CFA, and a desc preset:
makerom -f cci -elf homebrew.elf -rsf app.rsf -desc sdapp:33 -icon homebrew.icn -banner homebrew.bnr -content manual.cfa:1 -o homebrew.cci

Create a CIA using an already built application CXI and manual CFA:
makerom -f cia -content homebrew.cxi:0:0 -content manual.cfa:1:1 -o homebrew.cia

Rebuild a CXI:
makerom -code code.bin -exheader exheader.bin -icon icon.bin -banner banner.bin -romfs romfs.bin -rsf app.rsf -desc sdapp:33 -o rebuild.cxi

=== Creating RSF files ===
Inspired by Nintendo's format for their makerom, a yaml configuration file is required for creating NCCH files. CIA/CCI can be created without using a RSF file, but default settings will be used.

For CXI, RSF files can be used to specify permissions, and access control settings. Makerom can use default settings by use of the "-desc" option, which removes the requirement for specifying them in the RSF file.

Sample RSF to be used with "-desc": [https://gist.githubusercontent.com/3DSGuy/83e12e0ae3dcccb9827f/raw/sample0.rsf download]

Sample RSF to be used without "-desc": [https://gist.githubusercontent.com/3DSGuy/83e12e0ae3dcccb9827f/raw/sample1.rsf download]

=== Creating ELF files ===
ELF files that are created using the official SDK can be used with makerom. ELF files created using [https://github.com/smealum/ctrulib ctrulib] can be used, provided they are linked with this linker script: [https://gist.github.com/yellows8/6da7984a80a825b10294 download]

== Compiling Source ==
For Windows use MinGW, 64bit versions of MinGW are supported also.

For Linux, gcc/g++/make must be installed.

All additional libraries used by makerom are included in the source, and are linked statically.

== Issues ==

* Proper ticket index generation isn't complete (CIA tickets are valid for only one content)
* RomFS hasn't been completely implemented (but valid pre-built RomFS can be used as substitute)

Main Page/Welcome

2014-11-12T02:07:28Z

Vgturtle127: Fix some things and be more specific. :)

{{Main page box|Welcome!|Main Page/Welcome}}
<div style="margin: -.3em -1em -1em -1em;">
{| width="100%" bgcolor="#fff" border="0" cellpadding="2px" cellspacing="2px" style="margin:auto;"
|- align="center" bgcolor="#e7eef6"
! width="50%" | '''What is Homebrew?'''
! width="50%"| '''Want to help?'''
|- valign="top" align="left" style="background: #F5FAFF;"
| [http://en.wikipedia.org/wiki/Homebrew_(video_games) Homebrew] is a popular term used for applications that are created and executed on a video game console by hackers, programmers, developers, and consumers.
| Homebrew is not yet possible without purchasing a flash card or using specific game exploits. However, you can help out by documenting as much as you can about the system, games, and accessories and putting all your findings on the Wiki!
|}
{| width="100%" bgcolor="#fff" border="0" cellpadding="2px" cellspacing="2px" style="margin:auto;"
|- align="center" bgcolor="#e7eef6"
! width="50%" | '''How do I develop homebrew?'''
! width="50%"| '''When can I run homebrew?'''
|- valign="top" align="left" style="background: #F5FAFF;"
| See [[Setting up Development Environment‎|this page]] for a guide on how to get started with homebrew development for the 3DS.
| In a few weeks. :) See the [[Homebrew Applications]] page for a list of homebrew applications/games in the meantime.
|}

</div>
{{box-footer-empty}}

3DSExplorer

2014-11-12T01:57:50Z

Vgturtle127: Fix some wording

{{Infobox homebrew
| title = 3DSExplorer
| image = [[Image:3DSCube_128px.png|128px]]
| type = pc utility
| author = [[User:Elisherer|elisherer]]
| download = http://3dsexplorer.googlecode.com/files/3dsexplorer_v1.5.3.zip
| source = http://code.google.com/p/3dsexplorer/
| version = 1.5.3
}}

3DSExplorer can explore various 3DS-related files and view the information as described on 3DBrew.

----

'''Please use the latest version of the software, older versions have bugs that are fixed in the latest version.'''

'''More over, refrain from uploading the application anywhere without my permission, just link to the Google code site.'''

----

== Usage ==

Needs '''.NET Framework 4.0''', you can get it [http://www.microsoft.com/download/en/details.aspx?id=17851 here].

Note: If you want to install this program for Mac, Linux, or FreeBSD, you should install the latest version of Wine with Wine Mono.

It runs well on Linux, but I haven't tested it on Mac OS X.

Opens:
* CTR Cartridge Image files ([[NCSD|CCI]]/[[NCSD|CSU]]) (NCSD)
* CTR eXecutable Image files ([[NCCH#CXI|CXI]]) (NCCH)
* CTR File Archives ([[NCCH#CFA|CFA]]) (NCCH)
* CTR Importable Archives ([[CIA]])
* CTR Icons ([[SMDH|ICN]]) (SMDH)
* CTR Banners (BNR) (CBMD + BCWAV)
* CTR Waves ([[BCWAV]])
* CTR Banner Model Data ([[CBMD]])
* CTR Graphics ([[CBMD|CGFX]]) (CBMD)
* [[DARC]] (file containers) / [[BCMA]] CTR-Manuals
* Save Flash binaries ([[Savegames|SAV]]) (decrypted or encrypted)
* Title meta data files ([[TMD]]),
* Multi-Picture Objects ([[MPO]]) , (3D Images)

Converts:
* Videos to 2D/3D MJPG AVI files for the 3DS (can download directly from YouTube)

Some of the file formats can be saved with replaced contents.

== Option for reading 3DS/CCI/CSU files from ZIP/7Z files ==

Just compress your 3DS/CCI/CSU file into a 7Z or ZIP (with any other file you want like NFO file)

Then you can open it from 3DSExplorer. '''But be aware that only the first CXI will be loaded and saving capabilities will not be available.'''

(3DSExplorer looks for the first file with the proper extension and reads the first 0x5000 bytes)

== Upcoming features ==

for v1.6
* Extracting binaries from CIA like ctrtool does.

== Change log ==

v1.5.3
*Revert supertrim from deleting the last partition record.

v1.5.2
* Added Trim, Un-Trim and SuperTrim for CCI by 3DSGuy (aka ps3hen)
+ (Open up a CCI file and a new menu "CCI" will appear.)

v1.5.1
* MPO: Added some info found by Thib
* Fixed: title.db update process.
* Parentool 3ds algorithm fixed (was wrong)
v1.5
* Added: QR Tool
* Added: Parental Control Unlocker (for 3DS as found by neimod, and for the DSi/Wii as on marcan's site)
v1.4
* Added: support for BCMA/DARC files/containers.
* Added: DSDecmp GUI for compression/decompression of LZ-10/11/Ovl & Huffman4/8.
* Updated: XOR Tool's file text boxes accept drag&drop (DSDecmp GUI's also).
v1.3 (3DSGuy)
* Added *.cfa as an openable file (associated with CXI module)
* Used more general terms for CXI/CFA and 3DS/CCI/CSU with NCCH and NCSD respectively, while the general terms are more broad, they are correct, as a CFA file is not a CXI file.
* Fixed the Number of NCCH from 13 to 8 in the CCI module
* Changed the NCSD header readings to match the current specs on 3DBrew, with the exception of the "ExHeader size/Exheader Hash", as they are always zero in every NCSD.
* Made the ExHeader an extractable file from NCCH files.
v1.2.1
* fixed opening of cia files (thanks 3dsguy)
* updated title.db up to release #183
v1.2
* Added: The product codes and maker codes are now in a file called title.db
* Added: 3ds/cci/csu can be opened from zip/7z files with limited information (cci,1st cxi & crc32)
v1.1.1
* fixed file tree activation bugs
* fixed some typos
* CCI: added an option to save cxi file (right click the CXI node in the file tree)
v1.1 - Happy Holidays
* New opens CXI files
* New opens CSU files (CTR System update - same as CCI)
* New opens ICN files (CTR Icons)
* Added QuickCRC32 tool to check for authenticity (also added CRC32 to hash tool)
* Generalized the explorer (the source code of the explorer is general, now it would be easier to add more file formats)
* 3D Video converter: Progress is working, fixed a lot, now works almost flawlessly.
* CCI: Added more information to the header.
* MPO: Added Nintendo's MakerNote structure.
v1.0
* Better late then ever...update to v1.0 so I can continue with the regular
version giving.
* Added MPO support (3D Images taken by the 3ds camera)
* 3D Video Conversion tool to convert youtube 3d videos to 3DS-3D MJPG videos...
* more bug fixes (as always)
v0.96
* Moved to .NET Framework 4.0 (because of OpenGL Support)
* Improved SRAM key search algorithm (fixes Starfox 3D)
* Added initial support for CWAV, CGFX
* New nifty about screen (3d logo)
* Preparations made for wav (CWAV) & 3d model (CMDL) decoding (WIP)
* Now the application needs 2 external DLLs for SharpGL
v0.9
* Now checks for update on startup (can be disabled)
* Added link to the Google-code site
* CIA: Can replace icons with any picture you want (Saving enabled)
* More bug fixes
v0.89
* CIA: Icons color mapping corrected (It's RGB565)
* ImageBox now has a zoom button.
* XOR Tool: New features: Xor byte arrays, AES-ctr sandbox.
* More bug fixes and mostly source code redesign
v0.83
* CIA: Fix: Correct Ticket
* CIA: Icon color mapping fixed (RGB -> GBR)
v0.82
* CIA: Added Banner icons viewing (Double click an icon to show it in the Banner's Metadata section)
v0.81
* Fix bug when opening TMD files
v0.8
* CIA support
* Changed GUI + Skin
* Fixed some bugs
v0.7
* More information on sav files
* Now all information is grouped
* Bug fixes for all contexts
* Hash tool supports HMAC
* Source code rewritten for optimization..
* [Experimental] Can now replace original files into sav image and save it to a new created sav file.
v0.62
* Bug fixes
* Rearranged the gui
* Now the exe file is a release and not a debug.
* Context menu for files in the filesystem list.
v0.61
* Fix for DATA partitions files save (wrong offsets)...
* Can now be associated with sav/bin/3ds/tmd files to open files from the explorer...
* Hashtool and XORtool can be opened while working with the explorer part of the program.
v0.6
* New GUI
* Improved algorithms (SAV files mainly)
* More information shown
* NEW and improved Hash Tool.
v0.55
* Works with most save files.
* More of the save structure understood
* Saving of files from the sav image fixed.
v0.53
* Fix for the tmd (now has certificates)
* TMD: Still not supporting SHA1 type
v0.52
* TMD now works
* Save opening was improved
* No question rather it's encrypted or not (autodetect)

v0.51
* fix for save files from save image
* feature: save image file from sav binary

v0.5
* new GUI now has file box
* fix for a few save files
* now can save files from save and 3ds (from 3ds still encrypted) by double clicking a file.
* when opening a crypted save you can save the key to a file
* now on google code using SVN (moved from github)

v0.3
* changed the name of the application
* initial work on opening save binary files
* already opens save binary files, decrypts them and shows some info

* I'll be happy to get some help from you guys on this...

v0.1
* opens 3DS files and creates a treeview with the information
* can't decrypt the ExeFS (as no key yet to be found)

== Screen shot ==

[[File:Screenshot 3dsexplorer.png]]

== Latest Build ==

You can download the latest build [http://3dsexplorer.googlecode.com/svn/trunk/3DSExplorer/bin/3DSExplorer.exe here].

Notice that this version may have unexpected output (broken files, corrupted data, broken dreams, etc.), as it is the latest development version available...

3DSExplorer

2014-11-12T01:54:47Z

Vgturtle127: Adjusted the wording and improved the look of some sentence structure and dictation

3DSExplorer

2014-11-12T01:51:11Z

Vgturtle127: Adjusted the wording and updated a few things. Fixed a few links

{{Infobox homebrew
| title = 3DSExplorer
| image = [[Image:3DSCube_128px.png|128px]]
| type = pc utility
| author = [[User:Elisherer|elisherer]]
| download = http://3dsexplorer.googlecode.com/files/3dsexplorer_v1.5.3.zip
| source = http://code.google.com/p/3dsexplorer/
| version = 1.5.3
}}

3DSExplorer can explore various 3DS-related files and view the information as described on 3DBrew.

----

'''Please use the latest version of the software, older versions have bugs that are fixed in the latest version.'''

'''More over, refrain from uploading the application anywhere without my permission, just link to the Google code site.'''

----

== Usage ==

Needs '''.NET Framework 4.0''', you can get it [http://www.microsoft.com/download/en/details.aspx?id=17851 here].

Note: If you want to install this program for Mac, Linux, or FreeBSD,you should install Wine beta version 15 or later with Wine Mono.

It completely works on Linux, but I haven't tested it on Mac OS X.

Opens:
* CTR Cartridge Image files ([[NCSD|CCI]]/[[NCSD|CSU]]) (NCSD)
* CTR eXecutable Image files ([[NCCH#CXI|CXI]]) (NCCH)
* CTR File Archives ([[NCCH#CFA|CFA]]) (NCCH)
* CTR Importable Archives ([[CIA]])
* CTR Icons ([[SMDH|ICN]]) (SMDH)
* CTR Banners (BNR) (CBMD + BCWAV)
* CTR Waves ([[BCWAV]])
* CTR Banner Model Data ([[CBMD]])
* CTR Graphics ([[CBMD|CGFX]]) (CBMD)
* [[DARC]] (file containers) / [[BCMA]] CTR-Manuals
* Save Flash binaries ([[Savegames|SAV]]) (decrypted or encrypted)
* Title meta data files ([[TMD]]),
* Multi-Picture Objects ([[MPO]]) , (3D Images)

Converts:
* Videos to 2D/3D MJPG AVI files for the 3DS (can download directly from YouTube)

Some of the file formats can be saved with replaced contents.

== Option for reading 3DS/CCI/CSU files from ZIP/7Z files ==

Just compress your 3DS/CCI/CSU file into a 7Z or ZIP (with any other file you want like NFO file)

Then you can open it from 3DSExplorer. '''But be aware that only the first CXI will be loaded and saving capabilities will not be available.'''

(3DSExplorer looks for the first file with the proper extension and reads the first 0x5000 bytes)

== Upcoming features ==

for v1.6
* Extracting binaries from CIA like ctrtool does.

== Change log ==

v1.5.3
*Revert supertrim from deleting the last partition record.

v1.5.2
* Added Trim, Un-Trim and SuperTrim for CCI by 3DSGuy (aka ps3hen)
+ (Open up a CCI file and a new menu "CCI" will appear.)

v1.5.1
* MPO: Added some info found by Thib
* Fixed: title.db update process.
* Parentool 3ds algorithm fixed (was wrong)
v1.5
* Added: QR Tool
* Added: Parental Control Unlocker (for 3DS as found by neimod, and for the DSi/Wii as on marcan's site)
v1.4
* Added: support for BCMA/DARC files/containers.
* Added: DSDecmp GUI for compression/decompression of LZ-10/11/Ovl & Huffman4/8.
* Updated: XOR Tool's file text boxes accept drag&drop (DSDecmp GUI's also).
v1.3 (3DSGuy)
* Added *.cfa as an openable file (associated with CXI module)
* Used more general terms for CXI/CFA and 3DS/CCI/CSU with NCCH and NCSD respectively, while the general terms are more broad, they are correct, as a CFA file is not a CXI file.
* Fixed the Number of NCCH from 13 to 8 in the CCI module
* Changed the NCSD header readings to match the current specs on 3DBrew, with the exception of the "ExHeader size/Exheader Hash", as they are always zero in every NCSD.
* Made the ExHeader an extractable file from NCCH files.
v1.2.1
* fixed opening of cia files (thanks 3dsguy)
* updated title.db up to release #183
v1.2
* Added: The product codes and maker codes are now in a file called title.db
* Added: 3ds/cci/csu can be opened from zip/7z files with limited information (cci,1st cxi & crc32)
v1.1.1
* fixed file tree activation bugs
* fixed some typos
* CCI: added an option to save cxi file (right click the CXI node in the file tree)
v1.1 - Happy Holidays
* New opens CXI files
* New opens CSU files (CTR System update - same as CCI)
* New opens ICN files (CTR Icons)
* Added QuickCRC32 tool to check for authenticity (also added CRC32 to hash tool)
* Generalized the explorer (the source code of the explorer is general, now it would be easier to add more file formats)
* 3D Video converter: Progress is working, fixed a lot, now works almost flawlessly.
* CCI: Added more information to the header.
* MPO: Added Nintendo's MakerNote structure.
v1.0
* Better late then ever...update to v1.0 so I can continue with the regular
version giving.
* Added MPO support (3D Images taken by the 3ds camera)
* 3D Video Conversion tool to convert youtube 3d videos to 3DS-3D MJPG videos...
* more bug fixes (as always)
v0.96
* Moved to .NET Framework 4.0 (because of OpenGL Support)
* Improved SRAM key search algorithm (fixes Starfox 3D)
* Added initial support for CWAV, CGFX
* New nifty about screen (3d logo)
* Preparations made for wav (CWAV) & 3d model (CMDL) decoding (WIP)
* Now the application needs 2 external DLLs for SharpGL
v0.9
* Now checks for update on startup (can be disabled)
* Added link to the Google-code site
* CIA: Can replace icons with any picture you want (Saving enabled)
* More bug fixes
v0.89
* CIA: Icons color mapping corrected (It's RGB565)
* ImageBox now has a zoom button.
* XOR Tool: New features: Xor byte arrays, AES-ctr sandbox.
* More bug fixes and mostly source code redesign
v0.83
* CIA: Fix: Correct Ticket
* CIA: Icon color mapping fixed (RGB -> GBR)
v0.82
* CIA: Added Banner icons viewing (Double click an icon to show it in the Banner's Metadata section)
v0.81
* Fix bug when opening TMD files
v0.8
* CIA support
* Changed GUI + Skin
* Fixed some bugs
v0.7
* More information on sav files
* Now all information is grouped
* Bug fixes for all contexts
* Hash tool supports HMAC
* Source code rewritten for optimization..
* [Experimental] Can now replace original files into sav image and save it to a new created sav file.
v0.62
* Bug fixes
* Rearranged the gui
* Now the exe file is a release and not a debug.
* Context menu for files in the filesystem list.
v0.61
* Fix for DATA partitions files save (wrong offsets)...
* Can now be associated with sav/bin/3ds/tmd files to open files from the explorer...
* Hashtool and XORtool can be opened while working with the explorer part of the program.
v0.6
* New GUI
* Improved algorithms (SAV files mainly)
* More information shown
* NEW and improved Hash Tool.
v0.55
* Works with most save files.
* More of the save structure understood
* Saving of files from the sav image fixed.
v0.53
* Fix for the tmd (now has certificates)
* TMD: Still not supporting SHA1 type
v0.52
* TMD now works
* Save opening was improved
* No question rather it's encrypted or not (autodetect)

v0.51
* fix for save files from save image
* feature: save image file from sav binary

v0.5
* new GUI now has file box
* fix for a few save files
* now can save files from save and 3ds (from 3ds still encrypted) by double clicking a file.
* when opening a crypted save you can save the key to a file
* now on google code using SVN (moved from github)

v0.3
* changed the name of the application
* initial work on opening save binary files
* already opens save binary files, decrypts them and shows some info

* I'll be happy to get some help from you guys on this...

v0.1
* opens 3DS files and creates a treeview with the information
* can't decrypt the ExeFS (as no key yet to be found)

== Screen shot ==

[[File:Screenshot 3dsexplorer.png]]

== Latest Build ==

You can download the latest build [http://3dsexplorer.googlecode.com/svn/trunk/3DSExplorer/bin/3DSExplorer.exe here].

Notice that this version may have unexpected output (broken files, corrupted data, broken dreams, etc.), as it is the latest version available...

News/Archive

2014-11-12T01:42:25Z

Vgturtle127: Update the international text to be more English, and less international. :D

*'''7 August 14''' Nintendo released system update [[8.1.0-19]].
*'''24 July 14''' Nintendo released system update [[8.1.0-18]].
*'''7 July 14''' Nintendo released system update [[8.0.0-18]].
*'''12 May 14''' Nintendo released system update [[7.2.0-17]].
*'''26 February 14''' Nintendo released system update [[7.1.0-16]].
*'''22 January 14''' Nintendo released system update [[7.1.0-15]].
*'''19 December 13''' Nintendo released system update [[7.1.0-14]].
*'''9 December 13''' Nintendo released system update [[7.0.0-13]].
*'''13 September 13''' Nintendo released system update [[6.3.0-12]].
*'''20 August 13''' [[3DSExplorer|3DSExplorer v1.5.3]] updated by [[User:Elisherer|Elisherer]] (Enable trimming NCSD)
*'''6 August 13''' Nintendo released system update [[6.2.0-12]].
*'''11 July 13''' Nintendo released system update [[6.1.0-12U]] for only USA.
*'''27 June 13''' Nintendo released system update [[6.1.0-11]] (6.1.0-12 for all regions except USA).
*'''17 June 13''' Nintendo released system update [[6.0.0-11]] (6.0.0-12 for all regions except USA).
*'''4 April 13''' Nintendo released system update [[5.1.0-11]].
*'''25 March 13''' Nintendo released system update [[5.0.0-11]].
*'''14 January 13''' [[3DSExplorer|3DSExplorer v1.5.1]] updated by [[User:Elisherer|Elisherer]]
*'''4 December 12''' Nintendo released system update [[4.5.0-10]].
*'''1 December 12''' [[3DSExplorer|3DSExplorer v1.4]] updated by [[User:Elisherer|Elisherer]]
*'''2 November 12''' Added page for [[Fundraiser|Chip decapping fundraiser]]
*'''8 January 13''' [[3DSExplorer|3DSExplorer v1.5]] updated by [[User:Elisherer|Elisherer]]
*'''23 September 12''' [[005tools|005tools v0.1b]] by [[User:McHaggis|McHaggis]]
*'''19 September 12''' Nintendo released system update [[4.4.0-10]].
*'''17 August 12''' Nintendo released New Super Mario Bros. 2, the first 3DS title released simultaneously in stores and as an [[eShop]] download.
*'''28 July 12''' [[3DSExplorer|3DSExplorer v1.3]] (modified by 3DSGuy) updated by [[User:Elisherer|Elisherer]]
*'''24 July 12''' Nintendo released system update [[4.3.0-10]].
*'''26 June 12''' Nintendo released system update [[4.2.0-9]].
*'''19 May 12''' [[3DSExplorer|3DSExplorer v1.2.1]] updated by [[User:Elisherer|Elisherer]]
*'''15 May 12''' Nintendo released its first implementation of 3DS '[[Title list#0004000E - Add-on Content|Add-on Content]]' with the Mario Kart 1.1 update.
*'''14 May 12''' Nintendo released system update [[4.1.0-8]].
*'''24 April 12''' Nintendo released system update [[4.0.0-7]].
*'''08 February 12''' [[CiTRUS|CiTRUS v0.2]] updated by [[User:Xcution|Xcution]]
*'''04 February 12''' [[CiTRUS|CiTRUS v0.1]] released by [[User:Xcution|Xcution]]
*'''02 February 12''' [[3DSExplorer|3DSExplorer v1.2]] updated by [[User:Elisherer|elisherer]]
*'''26 January 12''' [[Crappy Tiny Reader|CTR - Crappy Tiny Reader v0.07]] updated by [[User:PsyKopaT|PsyKo]]
*'''05 January 12''' [[Crappy Tiny Reader|CTR - Crappy Tiny Reader v0.06]] updated by [[User:PsyKopaT|PsyKo]]
*'''21 December 11''' Nintendo released system update [[3.0.0-6]]
*'''21 December 11''' [[3DSExplorer|3DSExplorer v1.1.1]] updated by [[User:Elisherer|elisherer]]
*'''7 December 11''' [[3DSExplorer|3DSExplorer v0.96]] updated by [[User:Elisherer|elisherer]]
*'''4 September 11''' [[3DSViewer|3DSViewer v0.1]] released by [[User:Elisherer|elisherer]]
*'''1 August 11''' [[3DS Save DeEncrypter3DS|Save DeEncrypter v1.0]] released by [[User:Blite|Blite]]
*'''25 July 11''' Nintendo released system update [[2.1.0-4]].
*'''15 June 11''' Nintendo released system update [[2.1.0-3]].
*'''6 June 11''' Nintendo released system update [[2.0.0-2]].
*'''6 April 11''' [[DSaveManager|DSaveManager v0.1]] released by [[User:Crediar|crediar]]
*'''4 April 11''' [[3DSaveTool|3DSaveTool v0.2b]] released by [[User:Crediar|crediar]]
*'''2 April 11''' [[3DSaveTool|3DSaveTool v0.1]] released by [[User:Crediar|crediar]]
*'''28 March 11''' Fixed 3DBrew wiki issues, now fully operational!
*'''18 March 11''' 3DBrew launched.

== 3DBrew International ==
Our community is an international community.

We have freedom, and we will express it in our language (but you have to write it in English before ;)!

DSP Binary

2014-11-10T22:11:11Z

Vgturtle127: Small fixes

[[Category:File formats]]

{| class="wikitable" border="1"
! Offset
! Size
! Description
|-
| 0x0
| 0x100
| RSA Signature over bytes 0x100-0x300
|-
| 0x100
| 4
| Magic ('DSP1')
|-
| 0x104
| 4
| DSP binary size
|-
| 0x108
| 2
| Memory layout (bits 0-7: Program ram, 8-15: Data ram). Each bit represents a memory region. The region is always 0x8000 bytes in size (the first region starts at 0x1FF00000; the next is a 0x1FF08000 and so on). The HW registers for DSP memory configuration are (u8*)(0x1EC40000 + bit position) (?).
|-
| 0x10C
| 1
|?
|-
| 0x10D
| 1
| Special segment memory type (0=1=0x1FF00000(Program ram)+,2=0x1FF40000(Data ram)+)
|-
| 0x10E
| 1
| Num segments (must be 1-10)
|-
| 0x10F
| 1
| Flags (bit0=?, bit1=load special segment)
|-
| 0x110
| 4
| Special segment Start address in 16-bit words
|-
| 0x114
| 4
| Special segment size in bytes
|-
| 0x118
| 8
| Zero
|-
| 0x120
| 0x30*10
| Segment records
|}

If "special segment" flag is set, 0x214 bytes are read from [[CfgS:GetConfigInfoBlk8]] block 0x70000, and then copied to the special segment given. If the reading fails, zeroes are written in its place. The purpose of this segment is currently unknown.

Each segment record:

{| class="wikitable" border="1"
! Offset
! Size
! Description
|-
| 0
| 4
| Offset data
|-
| 4
| 4
| Start address in 16-bit words (must be < 0x20000 for type 0, < 0x10000 for type 1,2)
|-
| 8
| 4
| Size in bytes
|-
| 15
| 1
| Memory type (0=1=0x1FF00000 (Program ram)+,2=0x1FF40000 (Data ram)+)
|-
| 16
| 32
| SHA256 hash of segment
|}

The normal ending of this files is *.cdc

DSP Binary

2014-11-10T22:10:17Z

Vgturtle127: Clean some things up

[[Category:File formats]]

{| class="wikitable" border="1"
! Offset
! Size
! Description
|-
| 0x0
| 0x100
| RSA Signature over bytes 0x100-0x300
|-
| 0x100
| 4
| Magic ('DSP1')
|-
| 0x104
| 4
| DSP binary size
|-
| 0x108
| 2
| Memory layout (bits 0-7: Program ram, 8-15: Data ram). Each bit represents a memory region. The region is always 0x8000 bytes in size (the first region starts at 0x1FF00000; the next is a 0x1FF08000 and so on). The HW registers for DSP memory configuration are (u8*)(0x1EC40000 + bit position) (?).
|-
| 0x10C
| 1
| ?
|-
| 0x10D
| 1
| Special segment memory type (0=1=0x1FF00000(Program ram)+,2=0x1FF40000(Dataram)+)
|-
| 0x10E
| 1
| Num segments (must be 1-10)
|-
| 0x10F
| 1
| Flags (bit0=?, bit1=load special segment)
|-
| 0x110
| 4
| Special segment Start address in 16-bit words
|-
| 0x114
| 4
| Special segment size in bytes
|-
| 0x118
| 8
| Zero
|-
| 0x120
| 0x30*10
| Segment records
|}

If "special segment" flag is set, 0x214 bytes are read from [[CfgS:GetConfigInfoBlk8]] block 0x70000, and then copied to the special segment given. If the reading fails, zeroes are written in its place. The purpose of this segment is currently unknown.

Each segment record:

{| class="wikitable" border="1"
! Offset
! Size
! Description
|-
| 0
| 4
| Offset data
|-
| 4
| 4
| Start address in 16-bit words (must be < 0x20000 for type 0, < 0x10000 for type 1,2)
|-
| 8
| 4
| Size in bytes
|-
| 15
| 1
| Memory type (0=1=0x1FF00000 (Program ram)+,2=0x1FF40000 (Data ram)+)
|-
| 16
| 32
| SHA256 hash of segment
|}

The normal ending of this files is *.cdc

EShop

2014-11-10T22:05:49Z

Vgturtle127: Fix up some stuff

The Nintendo 3DS eShop was added in the June 2011 update for JP/EUR/USA.

From here, you can download Virtual Console games, 3D Classics, DSiware software, view screenshots, and 3D trailers for upcoming 3DS titles.

eShop uses the following domains over HTTPS:

* cp3s-auth.c.shop.nintendowifi.net
* a248.e.akamai.net

These domains are used by [[NIM_Services|NIM]]:

* nus.c.shop.nintendowifi.net
* ecs.c.shop.nintendowifi.net
* cas.c.shop.nintendowifi.net

While eShop is loading, eShop will use command [[NIMS:CheckSysupdateAvailableSOAP]]. If a system update is available where title installation for system titles still needs finalized (or when the updated titles were not downloaded at all), eShop will then display the "system update is available" message.

The eShop application uses command [[AMNet:FinishInstallToMedia]] to finalize the SD title install (if the whole title is downloaded while eShop is still running), however, before using that command the eShop application also uses [[AMNet:FinishInstallToMedia]] to finalize installing all system titles (from system updates).

== eShop QR Codes ==
eShop QR Codes can be scanned with the camera, allowing one to quickly navigate to the desired eShop title with just two clicks. The QR Codes themselves is a simple text/url QR, started with "ESHOP://" string followed by an eShop title link id and then some special data, delimited by a dot symbol, which can be ommited.

{| class="wikitable"
|-
! QR Code source
! Region
! Title
! Serial
! Title ID
|-
| ESHOP://50010000000201.PEAALL000000 || EUR || Nintendogs & Cats Demo || ADA/B/C || 0004000200030c01
|-
| ESHOP://50010000007870.PEAALL000000 || EUR || Crush 3D || A??P || 00040002
|-
| ESHOP://50010000008009.PEAALL000000 || EUR || Resident Evil Revelations Demo || ABRE || 000400020005ee01
|-
| ESHOP://50010000008123.J00101Z00095 || JPN || Rhythm Thief And The Emperor's Treasure Demo || ARTJ || 00040002
|-
| ESHOP://50010000008404.PEAALL000000 || EUR || Mario And Sonic At The London 2012 Olympic Games Demo || ACMP [http://mediacontent.nintendo-europe.com/NOE/images/game_content/ACMP-MarioAndSonicAtTheLondon2012OlympicGames-QRCode-EA_ALL_000_001.bmp] || 00040002
|-
| ESHOP://50010000008447.J00101Z00094 || JPN || Resident Evil Revelations Demo || ABRJ || 00040002
|-
| ESHOP://50010000008449.J00101Z00082 || JPN || Swapnote || JFRJ ||?
|-
| ESHOP://50010000008561 || USA || Swapnote || JFRE || 0004000000051700
|-
| ESHOP://50010000008647.J00101Z00096 || JPN || Metal Gear Solid Snake Eater 3D Demo || AMGJ || 0004000200048101
|-
| ESHOP://50010000008648.J00101Z00097 || JPN || Theatrythm Final Fantasy || ATHJ ||?
|-
| ESHOP://50010000008782.PEAALL000000 || EUR || Metal Gear Solid Snake Eater 3D Demo || AMGE || 0004000200082401
|-
| ESHOP://50010000008842.PEAALL000000 || EUR || Rhythm Thief And The Emperor's Treasure Demo || ARTP [http://mediacontent.nintendo-europe.com/NOE/images/game_content/ARTP-RhythmThief_TheEmperorsTreasure-QRCode-EA_ALL_000_001.bmp] || 00040002
|-
| ESHOP://50010000009084.J00101Z00121 || JPN || Hatsune Miku And Future Stars: Project Mirai Demo || AM9J || 00040002
|-
| ESHOP://50010000009102.J00101Z00106 || JPN || Denpa Ningen RPG || JD8J ||?
|-
| ESHOP://50010000009161.J00101Z00118 || JPN || Dillon's Rolling Western || JAMJ || 00040000
|-
| ESHOP://50010000009261 || USA || Dillon's Rolling Western || JAME? || 00040000
|-
| ESHOP://50010000009401.J00101Z00120 || JPN || Kingdom Hearts 3D Video Download || JZ8J ||?
|-
| ESHOP://50010000009403.J00101Z00119 || JPN || DQM 3D Video Download || JZ7J ||?
|-
| ESHOP://50010000009575.PEAALL000000 || EUR || Kid Icarus: Of Myths And Monsters (Virtual Console) ||? ||?
|-
| ESHOP://50010000009846 || USA || Ketzal's Corridors ||? ||?
|}

* New QR Code for Japanese "Photos with Super Mario" has a different code string: ESHOP://50010000013120.J00108Z00001.CD588EAE95A3A68D15C647DA2AC0945FD88F70AB8A31149E51C4B05FB927B0B8

* There is a link in the Japanese eShop <nowiki>[http://www.nintendo.co.jp/3ds/eshop/qrCode.html?####]</nowiki> where you can replace the #### with the Japanese eShop title's serial and you will get it's QR code. (i.e. http://www.nintendo.co.jp/3ds/eshop/qrCode.html?jcaj will get you the pushmo QR code)

* You could use Google's Chart API to create a QR code from the codes above: https://chart.googleapis.com/chart?chs=150x150&cht=qr&chl=ESHOP (replace the ESHOP text with the ESHOP:// link from one of the above)

== ExtData ==
The ExtData [[Extdata#Filesystem|File System]] for eShop is as follows:

root
├── icon
├── boss
│ └── TIGER100.tmp
└── user

{| class="wikitable" border="1"
|-
! File
! Details
! Size
! Firmware Introduced
! Plain text
|-
| icon
| Duplicate from application ExeFS. Always image 00000002
| 0x36C0 Bytes
| [[2.0.0-2]]
| [https://dl.dropboxusercontent.com/u/60710927/CTR/Sample/eShopExtdata/icon Download_EUR]
|-
| TIGER100.tmp
| Always image 00000003.
| 0xCE47 bytes (varies?)
| [[2.0.0-2]]
|
|}

EShop

2014-11-10T21:55:52Z

Vgturtle127: Many fixes

The Nintendo 3DS eShop was added in the June 2011 update for JP/EUR/USA.

From here, you can download Virtual Console games, 3D Classics, DSiware software, view screenshots, and 3D trailers for upcoming 3DS titles.

eShop uses the following domains over HTTPS:

* cp3s-auth.c.shop.nintendowifi.net
* a248.e.akamai.net

These domains are used by [[NIM_Services|NIM]]:

* nus.c.shop.nintendowifi.net
* ecs.c.shop.nintendowifi.net
* cas.c.shop.nintendowifi.net

While eShop is loading, eShop will use command [[NIMS:CheckSysupdateAvailableSOAP]]. If a system update is available where title installation for system titles still needs finalized (or when the updated titles were not downloaded at all), eShop will then display the "system update is available" message.

The eShop application uses command [[AMNet:FinishInstallToMedia]] to finalize the SD title install (if the whole title is downloaded while eShop is still running), however, before using that command the eShop application also uses [[AMNet:FinishInstallToMedia]] to finalize installing all system titles (from system updates).

== eShop QR Codes ==
eShop QR Codes can be scanned with the camera, allowing one to quickly navigate to the desired eShop title with just two clicks. The QR Codes themselves is a simple text/url QR, started with "ESHOP://" string followed by an eShop title link id and then some special data, delimited by a dot symbol, which can be ommited.

{| class="wikitable"
|-
! QR Code source
! Region
! Title
! Serial
! Title ID
|-
| ESHOP://50010000000201.PEAALL000000 || EUR || Nintendogs & Cats Demo || ADA/B/C || 0004000200030c01
|-
| ESHOP://50010000007870.PEAALL000000 || EUR || Crush 3D || A??P || 00040002
|-
| ESHOP://50010000008009.PEAALL000000 || EUR || Resident Evil Revelations Demo || ABRE || 000400020005ee01
|-
| ESHOP://50010000008123.J00101Z00095 || JPN || Rhythm Thief And The Emperor's Treasure Demo || ARTJ || 00040002
|-
| ESHOP://50010000008404.PEAALL000000 || EUR || Mario And Sonic At The London 2012 Olympic Games Demo || ACMP [http://mediacontent.nintendo-europe.com/NOE/images/game_content/ACMP-MarioAndSonicAtTheLondon2012OlympicGames-QRCode-EA_ALL_000_001.bmp] || 00040002
|-
| ESHOP://50010000008447.J00101Z00094 || JPN || Resident Evil Revelations Demo || ABRJ || 00040002
|-
| ESHOP://50010000008449.J00101Z00082 || JPN || Swapnote || JFRJ ||?
|-
| ESHOP://50010000008561 || USA || Swapnote || JFRE || 0004000000051700
|-
| ESHOP://50010000008647.J00101Z00096 || JPN || Metal Gear Solid Snake Eater 3D Demo || AMGJ || 0004000200048101
|-
| ESHOP://50010000008648.J00101Z00097 || JPN || Theatrythm Final Fantasy || ATHJ ||?
|-
| ESHOP://50010000008782.PEAALL000000 || EUR || MGS Snake Eater 3D Demo || AMGE || 0004000200082401
|-
| ESHOP://50010000008842.PEAALL000000 || EUR || Rhythm Thief & the Emperor's Treasure Demo || ARTP [http://mediacontent.nintendo-europe.com/NOE/images/game_content/ARTP-RhythmThief_TheEmperorsTreasure-QRCode-EA_ALL_000_001.bmp] || 00040002
|-
| ESHOP://50010000009084.J00101Z00121 || JPN || Hatsune Miku and Future Stars: Project Mirai Demo || AM9J || 00040002
|-
| ESHOP://50010000009102.J00101Z00106 || JPN || Denpa Ningen RPG || JD8J ||?
|-
| ESHOP://50010000009161.J00101Z00118 || JPN || Dillon's Rolling Western || JAMJ || 00040000
|-
| ESHOP://50010000009261 || USA || Dillon's Rolling Western || JAME? || 00040000
|-
| ESHOP://50010000009401.J00101Z00120 || JPN || Kingdom Hearts 3D Video Download || JZ8J ||?
|-
| ESHOP://50010000009403.J00101Z00119 || JPN || DQM 3D Video Download || JZ7J ||?
|-
| ESHOP://50010000009575.PEAALL000000 || EUR || Kid Icarus: Of Myths And Monsters (Virtual Console) ||? ||
|-
| ESHOP://50010000009846 || USA || Ketzal's Corridors ||? ||
|}

* New QR Code for Japanese "Photos with Super Mario" has a different code string: ESHOP://50010000013120.J00108Z00001.CD588EAE95A3A68D15C647DA2AC0945FD88F70AB8A31149E51C4B05FB927B0B8

* There is a link in the Japanese eShop <nowiki>[http://www.nintendo.co.jp/3ds/eshop/qrCode.html?####]</nowiki> where you can replace the #### with the Japanese eShop title's serial and you will get it's QR code. (i.e. http://www.nintendo.co.jp/3ds/eshop/qrCode.html?jcaj will get you the pushmo QR code)

* You could use Google's Chart API to create a QR code from the codes above: https://chart.googleapis.com/chart?chs=150x150&cht=qr&chl=ESHOP (replace the ESHOP text with the ESHOP:// link from one of the above)

== ExtData ==
The ExtData [[Extdata#Filesystem|File System]] for eShop is as follows:

root
├── icon
├── boss
│ └── TIGER100.tmp
└── user

{| class="wikitable" border="1"
|-
! File
! Details
! Size
! FW Introduced
! Plaintext
|-
| icon
| Duplicate from Application ExeFS. Always image 00000002.
| 0x36c0 Bytes
| [[2.0.0-2]]
| [https://dl.dropboxusercontent.com/u/60710927/CTR/Sample/eShopExtdata/icon Download_EUR]
|-
| TIGER100.tmp
| Always image 00000003.
| 0xce47 Bytes (Varies?)
| [[2.0.0-2]]
|
|}

EShop

2014-11-10T21:51:43Z

Vgturtle127: Make it less crowded

The Nintendo 3DS eShop was added in the June 2011 update for JP/EUR/USA.

From here, you can download Virtual Console games, 3D Classics, DSiware software, view screenshots, and 3D trailers for upcoming 3DS titles.

eShop uses the following domains over HTTPS:

* cp3s-auth.c.shop.nintendowifi.net
* a248.e.akamai.net

These domains are used by [[NIM_Services|NIM]]:

* nus.c.shop.nintendowifi.net
* ecs.c.shop.nintendowifi.net
* cas.c.shop.nintendowifi.net

While eShop is loading, eShop will use command [[NIMS:CheckSysupdateAvailableSOAP]]. If a system update is available where title installation for system titles still needs finalized (or when the updated titles were not downloaded at all), eShop will then display the "system update is available" message.

The eShop application uses command [[AMNet:FinishInstallToMedia]] to finalize the SD title install (if the whole title is downloaded while eShop is still running), however, before using that command the eShop application also uses [[AMNet:FinishInstallToMedia]] to finalize installing all system titles (from system updates).

== eShop QR Codes ==
eShop QR Codes can be scanned with the camera, allowing one to quickly navigate to the desired eShop title with just two clicks. The QR Codes themselves is a simple text/url QR, started with "ESHOP://" string followed by an eShop title link id and then some special data, delimited by a dot symbol, which can be ommited.

{| class="wikitable"
|-
! QR Code source
! Region
! Title
! Serial
! Title Id
|-
| ESHOP://50010000000201.PEAALL000000 || EUR || Nintendogs & Cats Demo || ADA/B/C || 0004000200030c01
|-
| ESHOP://50010000007870.PEAALL000000 || EUR || Crush 3D || A??P || 00040002
|-
| ESHOP://50010000008009.PEAALL000000 || EUR || Resident Evil Revelations Demo || ABRE || 000400020005ee01
|-
| ESHOP://50010000008123.J00101Z00095 || JPN || Rhythm Thief & the Emperor's Treasure Demo || ARTJ || 00040002
|-
| ESHOP://50010000008404.PEAALL000000 || EUR || Mario & Sonic at the London 2012 Olympic Games Demo || ACMP [http://mediacontent.nintendo-europe.com/NOE/images/game_content/ACMP-MarioAndSonicAtTheLondon2012OlympicGames-QRCode-EA_ALL_000_001.bmp] || 00040002
|-
| ESHOP://50010000008447.J00101Z00094 || JPN || Resident Evil Revelations Demo || ABRJ || 00040002
|-
| ESHOP://50010000008449.J00101Z00082 || JPN || Swapnote || JFRJ ||
|-
| ESHOP://50010000008561 || USA || Swapnote || JFRE || 0004000000051700
|-
| ESHOP://50010000008647.J00101Z00096 || JPN || MGS Snake Eater 3D Demo || AMGJ || 0004000200048101
|-
| ESHOP://50010000008648.J00101Z00097 || JPN || Theatrythm Final Fantasy || ATHJ ||
|-
| ESHOP://50010000008782.PEAALL000000 || EUR || MGS Snake Eater 3D Demo || AMGE || 0004000200082401
|-
| ESHOP://50010000008842.PEAALL000000 || EUR || Rhythm Thief & the Emperor's Treasure Demo || ARTP [http://mediacontent.nintendo-europe.com/NOE/images/game_content/ARTP-RhythmThief_TheEmperorsTreasure-QRCode-EA_ALL_000_001.bmp] || 00040002
|-
| ESHOP://50010000009084.J00101Z00121 || JPN || Hatsune Miku and Future Stars: Project Mirai Demo || AM9J || 00040002
|-
| ESHOP://50010000009102.J00101Z00106 || JPN || Denpa Ningen RPG || JD8J ||
|-
| ESHOP://50010000009161.J00101Z00118 || JPN || Dillon's Rolling Western || JAMJ || 00040000
|-
| ESHOP://50010000009261 || USA || Dillon's Rolling Western || JAME? || 00040000
|-
| ESHOP://50010000009401.J00101Z00120 || JPN || Kingdom Hearts 3D Video Download || JZ8J ||
|-
| ESHOP://50010000009403.J00101Z00119 || JPN || DQM 3D Video Download || JZ7J ||
|-
| ESHOP://50010000009575.PEAALL000000 || EUR || Kid Icarus: Of Myths and Monsters (Virtual Console) || ? ||
|-
| ESHOP://50010000009846 || USA || Ketzal's Corridors || ? ||
|}

* New QR Code for Japanese "Photos with Super Mario" has a different code string: ESHOP://50010000013120.J00108Z00001.CD588EAE95A3A68D15C647DA2AC0945FD88F70AB8A31149E51C4B05FB927B0B8

* There is a link in the Japanese eshop <nowiki>[http://www.nintendo.co.jp/3ds/eshop/qrCode.html?####]</nowiki> where you can replace the #### with the Japanese eShop title's serial and you will get its qrcode. (i.e. http://www.nintendo.co.jp/3ds/eshop/qrCode.html?jcaj will get you the pushmo qr code)

* You could use Google's Chart API to create a qr code from the codes above: https://chart.googleapis.com/chart?chs=150x150&cht=qr&chl=ESHOP (replace the ESHOP text with the ESHOP:// link from one of the above..)

== ExtData ==
The ExtData [[Extdata#Filesystem|File System]] for eShop is as follows:

root
├── icon
├── boss
│ └── TIGER100.tmp
└── user

{| class="wikitable" border="1"
|-
! File
! Details
! Size
! FW Introduced
! Plaintext
|-
| icon
| Duplicate from Application ExeFS. Always image 00000002.
| 0x36c0 Bytes
| [[2.0.0-2]]
| [https://dl.dropboxusercontent.com/u/60710927/CTR/Sample/eShopExtdata/icon Download_EUR]
|-
| TIGER100.tmp
| Always image 00000003.
| 0xce47 Bytes (Varies?)
| [[2.0.0-2]]
|
|}

EShop

2014-11-10T21:50:48Z

Vgturtle127: Fix the fix that was fixed (don't judge me)

The Nintendo 3DS eShop was added in the June 2011 update for JP/EUR/USA.

From here, you can download Virtual Console games, 3D Classics, DSiware software, view screenshots, and 3D trailers for upcoming 3DS titles.

eShop uses the following domains over HTTPS:

* cp3s-auth.c.shop.nintendowifi.net
* a248.e.akamai.net

These domains are used by [[NIM_Services|NIM]]:

* nus.c.shop.nintendowifi.net
* ecs.c.shop.nintendowifi.net
* cas.c.shop.nintendowifi.net

While eShop is loading, eShop will use command [[NIMS:CheckSysupdateAvailableSOAP]]. If a system update is available where title installation for system titles still needs finalized (or when the updated titles were not downloaded at all), eShop will then display the "system update is available" message.

The eShop application uses command [[AMNet:FinishInstallToMedia]] to finalize the SD title install (if the whole title is downloaded while eShop is still running), however, before using that command the eShop application also uses [[AMNet:FinishInstallToMedia]] to finalize installing all system titles (from system updates).

== eShop QR Codes ==
eShop QR Codes can be scanned with the camera, allowing one to quickly navigate to the desired eShop title with just two clicks. The QR Codes themselves is a simple text/url QR, started with "ESHOP://" string followed by an eShop title link id and then some special data, delimited by a dot symbol, which can be ommited.

{| class="wikitable"
|-
! QR Code source
! Region
! Title
! Serial
! Title Id
|-
| ESHOP://50010000000201.PEAALL000000 || EUR || Nintendogs & Cats Demo || ADA/B/C || 0004000200030c01
|-
| ESHOP://50010000007870.PEAALL000000 || EUR || Crush 3D || A??P || 00040002
|-
| ESHOP://50010000008009.PEAALL000000 || EUR || Resident Evil Revelations Demo || ABRE || 000400020005ee01
|-
| ESHOP://50010000008123.J00101Z00095 || JPN || Rhythm Thief & the Emperor's Treasure Demo || ARTJ || 00040002
|-
| ESHOP://50010000008404.PEAALL000000 || EUR || Mario & Sonic at the London 2012 Olympic Games Demo || ACMP [http://mediacontent.nintendo-europe.com/NOE/images/game_content/ACMP-MarioAndSonicAtTheLondon2012OlympicGames-QRCode-EA_ALL_000_001.bmp] || 00040002
|-
| ESHOP://50010000008447.J00101Z00094 || JPN || Resident Evil Revelations Demo || ABRJ || 00040002
|-
| ESHOP://50010000008449.J00101Z00082 || JPN || Swapnote || JFRJ ||
|-
| ESHOP://50010000008561 || USA || Swapnote || JFRE || 0004000000051700
|-
| ESHOP://50010000008647.J00101Z00096 || JPN || MGS Snake Eater 3D Demo || AMGJ || 0004000200048101
|-
| ESHOP://50010000008648.J00101Z00097 || JPN || Theatrythm Final Fantasy || ATHJ ||
|-
| ESHOP://50010000008782.PEAALL000000 || EUR || MGS Snake Eater 3D Demo || AMGE || 0004000200082401
|-
| ESHOP://50010000008842.PEAALL000000 || EUR || Rhythm Thief & the Emperor's Treasure Demo || ARTP [http://mediacontent.nintendo-europe.com/NOE/images/game_content/ARTP-RhythmThief_TheEmperorsTreasure-QRCode-EA_ALL_000_001.bmp] || 00040002
|-
| ESHOP://50010000009084.J00101Z00121 || JPN || Hatsune Miku and Future Stars: Project Mirai Demo || AM9J || 00040002
|-
| ESHOP://50010000009102.J00101Z00106 || JPN || Denpa Ningen RPG || JD8J ||
|-
| ESHOP://50010000009161.J00101Z00118 || JPN || Dillon's Rolling Western || JAMJ || 00040000
|-
| ESHOP://50010000009261 || USA || Dillon's Rolling Western || JAME? || 00040000
|-
| ESHOP://50010000009401.J00101Z00120 || JPN || Kingdom Hearts 3D Video Download || JZ8J ||
|-
| ESHOP://50010000009403.J00101Z00119 || JPN || DQM 3D Video Download || JZ7J ||
|-
| ESHOP://50010000009575.PEAALL000000 || EUR || Kid Icarus: Of Myths and Monsters (Virtual Console) || ? ||
|-
| ESHOP://50010000009846 || USA || Ketzal's Corridors || ? ||
|}

* New QR Code for Japanese "Photos with Super Mario" has a different code string: ESHOP://50010000013120.J00108Z00001.CD588EAE95A3A68D15C647DA2AC0945FD88F70AB8A31149E51C4B05FB927B0B8

* There is a link in the Japanese eshop <nowiki>[http://www.nintendo.co.jp/3ds/eshop/qrCode.html?####]</nowiki> where you can replace the #### with the Japanese eShop title's serial and you will get its qrcode. (i.e. http://www.nintendo.co.jp/3ds/eshop/qrCode.html?jcaj will get you the pushmo qr code)

* You could use Google's Chart API to create a qr code from the codes above: https://chart.googleapis.com/chart?chs=150x150&cht=qr&chl=ESHOP (replace the ESHOP text with the ESHOP:// link from one of the above..)

== ExtData ==
The ExtData [[Extdata#Filesystem|File System]] for eShop is as follows:

root
├── icon
├── boss
│ └── TIGER100.tmp
└── user

{| class="wikitable" border="1"
|-
! File
! Details
! Size
! FW Introduced
! Plaintext
|-
| icon
| Duplicate from Application ExeFS. Always image 00000002.
| 0x36c0 Bytes
| [[2.0.0-2]]
| [https://dl.dropboxusercontent.com/u/60710927/CTR/Sample/eShopExtdata/icon Download_EUR]
|-
| TIGER100.tmp
| Always image 00000003.
| 0xce47 Bytes (Varies?)
| [[2.0.0-2]]
|
|}

EShop

2014-11-10T21:48:10Z

Vgturtle127: Fix the fix

The Nintendo 3DS eShop was added in the June 2011 update for JP/EUR/USA.

From here, you can download Virtual Console games, 3D Classics, DSiware software, view screenshots, and 3D trailers for upcoming 3DS titles.

<nowiki>eShop uses the following domains over HTTPS:

- cp3s-auth.c.shop.nintendowifi.net
- a248.e.akamai.net

These domains are used by [[NIM_Services|NIM]]:

- nus.c.shop.nintendowifi.net
- ecs.c.shop.nintendowifi.net
- cas.c.shop.nintendowifi.net</nowiki>

While eShop is loading, eShop will use command [[NIMS:CheckSysupdateAvailableSOAP]]. If a system update is available where title installation for system titles still needs finalized (or when the updated titles were not downloaded at all), eShop will then display the "system update is available" message.

The eShop application uses command [[AMNet:FinishInstallToMedia]] to finalize the SD title install (if the whole title is downloaded while eShop is still running), however, before using that command the eShop application also uses [[AMNet:FinishInstallToMedia]] to finalize installing all system titles (from system updates).

== eShop QR Codes ==
eShop QR Codes can be scanned with the camera, allowing one to quickly navigate to the desired eShop title with just two clicks. The QR Codes themselves is a simple text/url QR, started with "ESHOP://" string followed by an eShop title link id and then some special data, delimited by a dot symbol, which can be ommited.

{| class="wikitable"
|-
! QR Code source
! Region
! Title
! Serial
! Title Id
|-
| ESHOP://50010000000201.PEAALL000000 || EUR || Nintendogs & Cats Demo || ADA/B/C || 0004000200030c01
|-
| ESHOP://50010000007870.PEAALL000000 || EUR || Crush 3D || A??P || 00040002
|-
| ESHOP://50010000008009.PEAALL000000 || EUR || Resident Evil Revelations Demo || ABRE || 000400020005ee01
|-
| ESHOP://50010000008123.J00101Z00095 || JPN || Rhythm Thief & the Emperor's Treasure Demo || ARTJ || 00040002
|-
| ESHOP://50010000008404.PEAALL000000 || EUR || Mario & Sonic at the London 2012 Olympic Games Demo || ACMP [http://mediacontent.nintendo-europe.com/NOE/images/game_content/ACMP-MarioAndSonicAtTheLondon2012OlympicGames-QRCode-EA_ALL_000_001.bmp] || 00040002
|-
| ESHOP://50010000008447.J00101Z00094 || JPN || Resident Evil Revelations Demo || ABRJ || 00040002
|-
| ESHOP://50010000008449.J00101Z00082 || JPN || Swapnote || JFRJ ||
|-
| ESHOP://50010000008561 || USA || Swapnote || JFRE || 0004000000051700
|-
| ESHOP://50010000008647.J00101Z00096 || JPN || MGS Snake Eater 3D Demo || AMGJ || 0004000200048101
|-
| ESHOP://50010000008648.J00101Z00097 || JPN || Theatrythm Final Fantasy || ATHJ ||
|-
| ESHOP://50010000008782.PEAALL000000 || EUR || MGS Snake Eater 3D Demo || AMGE || 0004000200082401
|-
| ESHOP://50010000008842.PEAALL000000 || EUR || Rhythm Thief & the Emperor's Treasure Demo || ARTP [http://mediacontent.nintendo-europe.com/NOE/images/game_content/ARTP-RhythmThief_TheEmperorsTreasure-QRCode-EA_ALL_000_001.bmp] || 00040002
|-
| ESHOP://50010000009084.J00101Z00121 || JPN || Hatsune Miku and Future Stars: Project Mirai Demo || AM9J || 00040002
|-
| ESHOP://50010000009102.J00101Z00106 || JPN || Denpa Ningen RPG || JD8J ||
|-
| ESHOP://50010000009161.J00101Z00118 || JPN || Dillon's Rolling Western || JAMJ || 00040000
|-
| ESHOP://50010000009261 || USA || Dillon's Rolling Western || JAME? || 00040000
|-
| ESHOP://50010000009401.J00101Z00120 || JPN || Kingdom Hearts 3D Video Download || JZ8J ||
|-
| ESHOP://50010000009403.J00101Z00119 || JPN || DQM 3D Video Download || JZ7J ||
|-
| ESHOP://50010000009575.PEAALL000000 || EUR || Kid Icarus: Of Myths and Monsters (Virtual Console) || ? ||
|-
| ESHOP://50010000009846 || USA || Ketzal's Corridors || ? ||
|}

* New QR Code for Japanese "Photos with Super Mario" has a different code string: ESHOP://50010000013120.J00108Z00001.CD588EAE95A3A68D15C647DA2AC0945FD88F70AB8A31149E51C4B05FB927B0B8

* There is a link in the Japanese eshop <nowiki>[http://www.nintendo.co.jp/3ds/eshop/qrCode.html?####]</nowiki> where you can replace the #### with the Japanese eShop title's serial and you will get its qrcode. (i.e. http://www.nintendo.co.jp/3ds/eshop/qrCode.html?jcaj will get you the pushmo qr code)

* You could use Google's Chart API to create a qr code from the codes above: https://chart.googleapis.com/chart?chs=150x150&cht=qr&chl=ESHOP (replace the ESHOP text with the ESHOP:// link from one of the above..)

== ExtData ==
The ExtData [[Extdata#Filesystem|File System]] for eShop is as follows:

root
├── icon
├── boss
│ └── TIGER100.tmp
└── user

{| class="wikitable" border="1"
|-
! File
! Details
! Size
! FW Introduced
! Plaintext
|-
| icon
| Duplicate from Application ExeFS. Always image 00000002.
| 0x36c0 Bytes
| [[2.0.0-2]]
| [https://dl.dropboxusercontent.com/u/60710927/CTR/Sample/eShopExtdata/icon Download_EUR]
|-
| TIGER100.tmp
| Always image 00000003.
| 0xce47 Bytes (Varies?)
| [[2.0.0-2]]
|
|}

EShop

2014-11-10T21:46:14Z

Vgturtle127: Make everything look much better, and improve visibility

The Nintendo 3DS eShop was added in the June 2011 update for JP/EUR/USA.

From here, you can download Virtual Console games, 3D Classics, DSiware software, view screenshots, and 3D trailers for upcoming 3DS titles.

eShop uses the following domains over HTTPS:

- cp3s-auth.c.shop.nintendowifi.net
- a248.e.akamai.net

These domains are used by [[NIM_Services|NIM]]:

- nus.c.shop.nintendowifi.net
- ecs.c.shop.nintendowifi.net
- cas.c.shop.nintendowifi.net

While eShop is loading, eShop will use command [[NIMS:CheckSysupdateAvailableSOAP]]. If a system update is available where title installation for system titles still needs finalized (or when the updated titles were not downloaded at all), eShop will then display the "system update is available" message.

The eShop application uses command [[AMNet:FinishInstallToMedia]] to finalize the SD title install (if the whole title is downloaded while eShop is still running), however, before using that command the eShop application also uses [[AMNet:FinishInstallToMedia]] to finalize installing all system titles (from system updates).

== eShop QR Codes ==
eShop QR Codes can be scanned with the camera, allowing one to quickly navigate to the desired eShop title with just two clicks. The QR Codes themselves is a simple text/url QR, started with "ESHOP://" string followed by an eShop title link id and then some special data, delimited by a dot symbol, which can be ommited.

{| class="wikitable"
|-
! QR Code source
! Region
! Title
! Serial
! Title Id
|-
| ESHOP://50010000000201.PEAALL000000 || EUR || Nintendogs & Cats Demo || ADA/B/C || 0004000200030c01
|-
| ESHOP://50010000007870.PEAALL000000 || EUR || Crush 3D || A??P || 00040002
|-
| ESHOP://50010000008009.PEAALL000000 || EUR || Resident Evil Revelations Demo || ABRE || 000400020005ee01
|-
| ESHOP://50010000008123.J00101Z00095 || JPN || Rhythm Thief & the Emperor's Treasure Demo || ARTJ || 00040002
|-
| ESHOP://50010000008404.PEAALL000000 || EUR || Mario & Sonic at the London 2012 Olympic Games Demo || ACMP [http://mediacontent.nintendo-europe.com/NOE/images/game_content/ACMP-MarioAndSonicAtTheLondon2012OlympicGames-QRCode-EA_ALL_000_001.bmp] || 00040002
|-
| ESHOP://50010000008447.J00101Z00094 || JPN || Resident Evil Revelations Demo || ABRJ || 00040002
|-
| ESHOP://50010000008449.J00101Z00082 || JPN || Swapnote || JFRJ ||
|-
| ESHOP://50010000008561 || USA || Swapnote || JFRE || 0004000000051700
|-
| ESHOP://50010000008647.J00101Z00096 || JPN || MGS Snake Eater 3D Demo || AMGJ || 0004000200048101
|-
| ESHOP://50010000008648.J00101Z00097 || JPN || Theatrythm Final Fantasy || ATHJ ||
|-
| ESHOP://50010000008782.PEAALL000000 || EUR || MGS Snake Eater 3D Demo || AMGE || 0004000200082401
|-
| ESHOP://50010000008842.PEAALL000000 || EUR || Rhythm Thief & the Emperor's Treasure Demo || ARTP [http://mediacontent.nintendo-europe.com/NOE/images/game_content/ARTP-RhythmThief_TheEmperorsTreasure-QRCode-EA_ALL_000_001.bmp] || 00040002
|-
| ESHOP://50010000009084.J00101Z00121 || JPN || Hatsune Miku and Future Stars: Project Mirai Demo || AM9J || 00040002
|-
| ESHOP://50010000009102.J00101Z00106 || JPN || Denpa Ningen RPG || JD8J ||
|-
| ESHOP://50010000009161.J00101Z00118 || JPN || Dillon's Rolling Western || JAMJ || 00040000
|-
| ESHOP://50010000009261 || USA || Dillon's Rolling Western || JAME? || 00040000
|-
| ESHOP://50010000009401.J00101Z00120 || JPN || Kingdom Hearts 3D Video Download || JZ8J ||
|-
| ESHOP://50010000009403.J00101Z00119 || JPN || DQM 3D Video Download || JZ7J ||
|-
| ESHOP://50010000009575.PEAALL000000 || EUR || Kid Icarus: Of Myths and Monsters (Virtual Console) || ? ||
|-
| ESHOP://50010000009846 || USA || Ketzal's Corridors || ? ||
|}

* New QR Code for Japanese "Photos with Super Mario" has a different code string: ESHOP://50010000013120.J00108Z00001.CD588EAE95A3A68D15C647DA2AC0945FD88F70AB8A31149E51C4B05FB927B0B8

* There is a link in the Japanese eshop <nowiki>[http://www.nintendo.co.jp/3ds/eshop/qrCode.html?####]</nowiki> where you can replace the #### with the Japanese eShop title's serial and you will get its qrcode. (i.e. http://www.nintendo.co.jp/3ds/eshop/qrCode.html?jcaj will get you the pushmo qr code)

* You could use Google's Chart API to create a qr code from the codes above: https://chart.googleapis.com/chart?chs=150x150&cht=qr&chl=ESHOP (replace the ESHOP text with the ESHOP:// link from one of the above..)

== ExtData ==
The ExtData [[Extdata#Filesystem|File System]] for eShop is as follows:

root
├── icon
├── boss
│ └── TIGER100.tmp
└── user

{| class="wikitable" border="1"
|-
! File
! Details
! Size
! FW Introduced
! Plaintext
|-
| icon
| Duplicate from Application ExeFS. Always image 00000002.
| 0x36c0 Bytes
| [[2.0.0-2]]
| [https://dl.dropboxusercontent.com/u/60710927/CTR/Sample/eShopExtdata/icon Download_EUR]
|-
| TIGER100.tmp
| Always image 00000003.
| 0xce47 Bytes (Varies?)
| [[2.0.0-2]]
|
|}

Configuration Memory

2014-11-10T21:37:22Z

Vgturtle127: Firmware and 3DS naming updates

= ARM11 Kernel Configuration Memory =
{| class="wikitable" border="1"
! NAME
! PROCESS VIRTUAL ADDRESS
! WIDTH
|-
| KERNEL_?
| 0x1FF80000
| 1
|-
| KERNEL_VERSIONREVISION
| 0x1FF80001
| 1
|-
| KERNEL_VERSIONMINOR
| 0x1FF80002
| 1
|-
| KERNEL_VERSIONMAJOR
| 0x1FF80003
| 1
|-
| UPDATEFLAG
| 0x1FF80004
| 4
|-
| NSTID
| 0x1FF80008
| 8
|-
| SYSCOREVER
| 0x1FF80010
| 4
|-
| UNITINFO
| 0x1FF80014
| 1
|-
| BOOT_FIRM
| 0x1FF80015
| 1
|-
| PREV_FIRM
| 0x1FF80016
| 1
|-
| KERNEL_CTRSDKVERSION
| 0x1FF80018
| 4
|-
| APPMEMTYPE
| 0x1FF80030
| 4
|-
| APPMEMALLOC
| 0x1FF80040
| 4
|-
| SYSMEMALLOC
| 0x1FF80044
| 4
|-
| BASEMEMALLOC
| 0x1FF80048
| 4
|-
| FIRM_?
| 0x1FF80060
| 1
|-
| FIRM_VERSIONREVISION
| 0x1FF80061
| 1
|-
| FIRM_VERSIONMINOR
| 0x1FF80062
| 1
|-
| FIRM_VERSIONMAJOR
| 0x1FF80063
| 1
|-
| FIRM_SYSCOREVER
| 0x1FF80064
| 4
|-
| FIRM_CTRSDKVERSION
| 0x1FF80068
| 4
|}

This memory page is [[Memory_layout|read-only]] for ARM11 processes.

The FIRM_* fields are by default identical to the KERNEL_* fields. However, the FIRM_* fields can be overridden via FIRM-launch parameters, see [[FIRM|here]].

Besides mem-region related fields, the data written here by the old 3DS/new 3DS kernels is identical.

= Shared Memory Page For ARM11 Processes =
{| class="wikitable" border="1"
! NAME
! PROCESS VIRTUAL ADDRESS
! WIDTH
|-
| bit0 selects DATETIME_0 or DATETIME_1.
| 0x1FF81000
| 4
|-
| RUNNING_HW (1=product, 2=devboard, 3=debugger, 4=capture)
| 0x1FF81004
| 1
|-
| MCU_HW_INFO
| 0x1FF81005
| 1
|-
| DATETIME_0 {(u64)MillisecondsSinceFirstJan1900,(u64)SystemTickLastTimeThisWasUpdated,(u32)unk,(u32)unk,(u32)unk,(u32)unk}
| 0x1FF81020
| 32
|-
| DATETIME_1
| 0x1FF81040
| 32
|-
| WIFI_MACADDR
| 0x1FF81060
| 6
|-
| 3D_SLIDERSTATE
| 0x1FF81080
| 4
|-
| 3D_LEDSTATE
| 0x1FF81084
| 1
|-
| MENUTID
| 0x1FF810A0
| 8
|-
| ACTIVEMENUTID
| 0x1FF810A8
| 8
|-
| Signed? Headsets connected?
| 0x1FF810C0
| 1
|}

This memory page is normally read-only for ARM11 processes, write-access is [[Memory_layout|determined]] by the process exheader kernel "shared page writing" flag.

= ARM11 Kernel Config Fields =

== 0x1FF80000 / 0x1FF80060 ==
Unknown, this is normally value 0.

== KERNEL_VERSIONREVISION / FIRM_VERSIONREVISION ==
This is the version-revision for the currently running [[FIRM]].

== KERNEL_VERSIONMINOR ==
This is the version-minor from ((title-version & 0x3FF) >> 4), for the currently running [[FIRM]]. The values from KERNEL_VERSIONMINOR and KERNEL_VERSIONMAJOR can be stored in applications' [[NCCH#CXI|CXI]] exheader.

== FIRM_VERSIONMINOR ==
This is the same as KERNEL_VERSIONMINOR. After [[AM:InstallNATIVEFIRM]] checks FIRM_SYSCOREVER, [[AM:InstallNATIVEFIRM]] then compares FIRM_VERSIONMINOR with the NATIVE_FIRM ((title-version & 0x3FF) >> 4), when the latter is larger than FIRM_VERSIONMINOR [[AM:InstallNATIVEFIRM]] will trigger a [[FIRM]] install.

== KERNEL_VERSIONMAJOR / FIRM_VERSIONMAJOR ==
This is the version-major for the currently running [[FIRM]].

== UPDATEFLAG ==
Normally this flag is zero. When the ARM11 kernel is booting on non-factory FIRM it will set this flag to 1, when bit0 from the data which field 0x1FF80016 is loaded from is clear, if the following [[PAD]] buttons are pressed: L, R, A, Up. When this flag is set, [[NS]] will launch the [[System_Settings#System_Updater|System Updater]] title instead of [[Home Menu]].

== NSTID ==
This field contains the titleID of the first title to launch from CTR-NAND after the [[FIRM]] system processes are loaded. The [[Process_Manager_Services|PM]] module launches this title. If this field titleID is all-zero, the system will not attempt to launch the title. The regular ARM11 kernel sets this to the regular [[NS]] titleID, while the SAFE_MODE ARM11 kernel sets this to the SAFE_MODE NS titleID. The factory FIRM ARM11-kernel sets this to the NS TID from [[Factory_Setup|here]].

== SYSCOREVER ==
This field is initialized by the ARM11 kernel, this is the programID-low of the running FIRM. When launching [[NCCH#CXI|CXIs]], the value stored here must match the core version field stored in the CXI exheader. If they do not match, the [[Process_Manager_Services|PM]] module will refuse to launch the ARM11 process.

With [[Factory_Setup|factory]] NATIVE_FIRM, this is set to 0x0, even though the FIRM programID-low is 0x2. However, the factory system-titles have core-version set to 0x2. Hence, this config-mem SYSCOREVER field might not be used by factory system processes?

== FIRM_SYSCOREVER ==
Normally this is the same as SYSCOREVER. This used by [[AM:InstallNATIVEFIRM]] for comparing with the NATIVE_FIRM titleID-low. When the low u8 from the NATIVE_FIRM titleID-low is larger than FIRMSYSCOREVER, [[AM:InstallNATIVEFIRM]] will trigger FIRM installing. When that u8 is not larger than FIRM_SYSCOREVER, and these two values don't match, [[AM:InstallNATIVEFIRM]] will return an error.

== UNITINFO ==
{| class="wikitable" border="1"
! Bit
! Description
|-
| 0
| Clear for developer unit, set for retail.(See 0x1FF80015)
|-
| 1
| Set for debug units
|-
| 2-7
|?
|}

Bit1 in this field is set by the ARM11 kernel when ARM debug CP14 DSCR bit14 is set. [[NS]] loads the menu TID from MENUTID when bits 1-7 of this field are clear. [[ErrDisp]] will display development error info when bit0 is clear.

== 0x1FF80015 ==
When this field is zero, bit0 for UNITINFO is set for retail. When this field is non-zero, bit0 for UNITINFO is clear for dev/debug units, and an ARM11 kernel state flag which enables debugging is set. Bit1 means JTAG connected.

== 0x1FF80016 ==
This originates from the low 8-bits of register [[CONFIG|0x10010000]]. When bit0 is set, the ARM11 kernel will not set the UPDATEFLAG to value 1.

== KERNEL_CTRSDKVERSION / FIRM_CTRSDKVERSION ==
This is the CTR-SDK version which was used to build the currently running [[FIRM]].

== APPMEMTYPE ==
The value of this field determines the size for APPMEMALLOC. The retail type(value0) is used when the type is not values 2-5. See [[Memory_layout]] for the table of values for this and the mem-region sizes.

== APPMEMALLOC ==
This contains the total size of the memory that can be allocated with the APPLICATION [[SVC|memory-region]], see [[Memory_layout|here]].

== SYSMEMALLOC ==
Same as APPMEMALLOC except for the SYSTEM mem-region, see [[Memory_layout|here]].

== BASEMEMALLOC ==
Same as APPMEMALLOC except for the BASE mem-region, see [[Memory_layout|here]].

= Shared Memory Page Fields =

== WIFI_MACADDR ==
This is the WiFi MAC address for the 3DS. This is initialized by the [[NWM_Services|NWM]] module, it's unknown where the MAC address written here was originally loaded from.

== 3D_SLIDERSTATE ==
This float contains the state of the 3D slider. The range of this float is value 0.0f for "off", and 1.0f for max.

This is written/updated by [[HID_Services|HID]] module.

== 3D_LEDSTATE ==
When non-zero, the 3D LED is disabled. See [[GSPGPU:SetLedForceOff]].

== MENUTID ==
Unknown, contains the menu TID (used by [[NS]])

== ACTIVEMENUTID ==
This contains the titleID of the currently running menu launched by [[NS]].

= NATIVE_FIRM Versions =
{| class="wikitable" border="1"
! System version
! old 3DS title version
! old 3DS hex title contentID
! Kernel/FIRM version (old 3DS/new 3DS)
|-
| [[Factory_Setup|Factory]] FIRM (titleID 00040001-00000002)
| v0
| 00
| 2.3-0
|-
| [[1.0.0-0]]
| v432
| 00
| 2.27-0
|-
| [[1.1.0-1]]
| v1472
| 02
| 2.28-0
|-
| [[2.0.0-2]]
| v2516
| 09
| 2.29-7
|-
| [[2.1.0-3]]
| v3553
| 0B
| 2.30-18
|-
| [[2.2.0-X]]
| v4595
| 0F
| 2.31-40
|-
| [[3.0.0-5]]
| v5647
| 18
| 2.32-15
|-
| [[4.0.0-7]]
| v6677
| 1D
| 2.33-4
|-
| [[4.1.0-8]]
| v7712
| 1F
| 2.34-0
|-
| [[5.0.0-11]]
| v8758
| 25
| 2.35-6
|-
| [[5.1.0-11]]
| v9792
| 26
| 2.36-0
|-
| [[6.0.0-11]]
| v10833
| 29
| 2.37-0
|-
| [[6.1.0-11]]
| v11872
| 2A
| 2.38-0
|-
| [[7.0.0-13]]
| v12916
| 2E
| 2.39-4
|-
| [[7.2.0-17]]
| v13956
| 30
| 2.40-0
|-
| [[8.0.0-18]]
| v15047
| 37
| 2.44-6
|-
| [[8.1.0-0_New3DS]]
|N/A
|N/A
| 2.45-5
|-
| [[9.0.0-20]]
| v17120
| 38
| 2.46-0
|}

The above kernel/FIRM versions are in the format: <KERNEL_VERSIONMAJOR>.<KERNEL_VERSIONMINOR>-<KERNEL_VERSIONREVISION>.

Configuration Memory

2014-11-10T21:35:50Z

Vgturtle127: Fixes

= ARM11 Kernel Configuration Memory =
{| class="wikitable" border="1"
! NAME
! PROCESS VIRTUAL ADDRESS
! WIDTH
|-
| KERNEL_?
| 0x1FF80000
| 1
|-
| KERNEL_VERSIONREVISION
| 0x1FF80001
| 1
|-
| KERNEL_VERSIONMINOR
| 0x1FF80002
| 1
|-
| KERNEL_VERSIONMAJOR
| 0x1FF80003
| 1
|-
| UPDATEFLAG
| 0x1FF80004
| 4
|-
| NSTID
| 0x1FF80008
| 8
|-
| SYSCOREVER
| 0x1FF80010
| 4
|-
| UNITINFO
| 0x1FF80014
| 1
|-
| BOOT_FIRM
| 0x1FF80015
| 1
|-
| PREV_FIRM
| 0x1FF80016
| 1
|-
| KERNEL_CTRSDKVERSION
| 0x1FF80018
| 4
|-
| APPMEMTYPE
| 0x1FF80030
| 4
|-
| APPMEMALLOC
| 0x1FF80040
| 4
|-
| SYSMEMALLOC
| 0x1FF80044
| 4
|-
| BASEMEMALLOC
| 0x1FF80048
| 4
|-
| FIRM_?
| 0x1FF80060
| 1
|-
| FIRM_VERSIONREVISION
| 0x1FF80061
| 1
|-
| FIRM_VERSIONMINOR
| 0x1FF80062
| 1
|-
| FIRM_VERSIONMAJOR
| 0x1FF80063
| 1
|-
| FIRM_SYSCOREVER
| 0x1FF80064
| 4
|-
| FIRM_CTRSDKVERSION
| 0x1FF80068
| 4
|}

This memory page is [[Memory_layout|read-only]] for ARM11 processes.

The FIRM_* fields are by default identical to the KERNEL_* fields. However, the FIRM_* fields can be overridden via FIRM-launch parameters, see [[FIRM|here]].

Besides mem-region related fields, the data written here by the old 3DS/new 3DS kernels is identical.

= Shared Memory Page For ARM11 Processes =
{| class="wikitable" border="1"
! NAME
! PROCESS VIRTUAL ADDRESS
! WIDTH
|-
| bit0 selects DATETIME_0 or DATETIME_1.
| 0x1FF81000
| 4
|-
| RUNNING_HW (1=product, 2=devboard, 3=debugger, 4=capture)
| 0x1FF81004
| 1
|-
| MCU_HW_INFO
| 0x1FF81005
| 1
|-
| DATETIME_0 {(u64)MillisecondsSinceFirstJan1900,(u64)SystemTickLastTimeThisWasUpdated,(u32)unk,(u32)unk,(u32)unk,(u32)unk}
| 0x1FF81020
| 32
|-
| DATETIME_1
| 0x1FF81040
| 32
|-
| WIFI_MACADDR
| 0x1FF81060
| 6
|-
| 3D_SLIDERSTATE
| 0x1FF81080
| 4
|-
| 3D_LEDSTATE
| 0x1FF81084
| 1
|-
| MENUTID
| 0x1FF810A0
| 8
|-
| ACTIVEMENUTID
| 0x1FF810A8
| 8
|-
| Signed? Headsets connected?
| 0x1FF810C0
| 1
|}

This memory page is normally read-only for ARM11 processes, write-access is [[Memory_layout|determined]] by the process exheader kernel "shared page writing" flag.

= ARM11 Kernel Config Fields =

== 0x1FF80000 / 0x1FF80060 ==
Unknown, this is normally value 0.

== KERNEL_VERSIONREVISION / FIRM_VERSIONREVISION ==
This is the version-revision for the currently running [[FIRM]].

== KERNEL_VERSIONMINOR ==
This is the version-minor from ((title-version & 0x3FF) >> 4), for the currently running [[FIRM]]. The values from KERNEL_VERSIONMINOR and KERNEL_VERSIONMAJOR can be stored in applications' [[NCCH#CXI|CXI]] exheader.

== FIRM_VERSIONMINOR ==
This is the same as KERNEL_VERSIONMINOR. After [[AM:InstallNATIVEFIRM]] checks FIRM_SYSCOREVER, [[AM:InstallNATIVEFIRM]] then compares FIRM_VERSIONMINOR with the NATIVE_FIRM ((title-version & 0x3FF) >> 4), when the latter is larger than FIRM_VERSIONMINOR [[AM:InstallNATIVEFIRM]] will trigger a [[FIRM]] install.

== KERNEL_VERSIONMAJOR / FIRM_VERSIONMAJOR ==
This is the version-major for the currently running [[FIRM]].

== UPDATEFLAG ==
Normally this flag is zero. When the ARM11 kernel is booting on non-factory FIRM it will set this flag to 1, when bit0 from the data which field 0x1FF80016 is loaded from is clear, if the following [[PAD]] buttons are pressed: L, R, A, Up. When this flag is set, [[NS]] will launch the [[System_Settings#System_Updater|System Updater]] title instead of [[Home Menu]].

== NSTID ==
This field contains the titleID of the first title to launch from CTR-NAND after the [[FIRM]] system processes are loaded. The [[Process_Manager_Services|PM]] module launches this title. If this field titleID is all-zero, the system will not attempt to launch the title. The regular ARM11 kernel sets this to the regular [[NS]] titleID, while the SAFE_MODE ARM11 kernel sets this to the SAFE_MODE NS titleID. The factory FIRM ARM11-kernel sets this to the NS TID from [[Factory_Setup|here]].

== SYSCOREVER ==
This field is initialized by the ARM11 kernel, this is the programID-low of the running FIRM. When launching [[NCCH#CXI|CXIs]], the value stored here must match the core version field stored in the CXI exheader. If they do not match, the [[Process_Manager_Services|PM]] module will refuse to launch the ARM11 process.

With [[Factory_Setup|factory]] NATIVE_FIRM, this is set to 0x0, even though the FIRM programID-low is 0x2. However, the factory system-titles have core-version set to 0x2. Hence, this config-mem SYSCOREVER field might not be used by factory system processes?

== FIRM_SYSCOREVER ==
Normally this is the same as SYSCOREVER. This used by [[AM:InstallNATIVEFIRM]] for comparing with the NATIVE_FIRM titleID-low. When the low u8 from the NATIVE_FIRM titleID-low is larger than FIRMSYSCOREVER, [[AM:InstallNATIVEFIRM]] will trigger FIRM installing. When that u8 is not larger than FIRM_SYSCOREVER, and these two values don't match, [[AM:InstallNATIVEFIRM]] will return an error.

== UNITINFO ==
{| class="wikitable" border="1"
! Bit
! Description
|-
| 0
| Clear for developer unit, set for retail.(See 0x1FF80015)
|-
| 1
| Set for debug units
|-
| 2-7
|?
|}

Bit1 in this field is set by the ARM11 kernel when ARM debug CP14 DSCR bit14 is set. [[NS]] loads the menu TID from MENUTID when bits 1-7 of this field are clear. [[ErrDisp]] will display development error info when bit0 is clear.

== 0x1FF80015 ==
When this field is zero, bit0 for UNITINFO is set for retail. When this field is non-zero, bit0 for UNITINFO is clear for dev/debug units, and an ARM11 kernel state flag which enables debugging is set. Bit1 means JTAG connected.

== 0x1FF80016 ==
This originates from the low 8-bits of register [[CONFIG|0x10010000]]. When bit0 is set, the ARM11 kernel will not set the UPDATEFLAG to value 1.

== KERNEL_CTRSDKVERSION / FIRM_CTRSDKVERSION ==
This is the CTR-SDK version which was used to build the currently running [[FIRM]].

== APPMEMTYPE ==
The value of this field determines the size for APPMEMALLOC. The retail type(value0) is used when the type is not values 2-5. See [[Memory_layout]] for the table of values for this and the mem-region sizes.

== APPMEMALLOC ==
This contains the total size of the memory that can be allocated with the APPLICATION [[SVC|memory-region]], see [[Memory_layout|here]].

== SYSMEMALLOC ==
Same as APPMEMALLOC except for the SYSTEM mem-region, see [[Memory_layout|here]].

== BASEMEMALLOC ==
Same as APPMEMALLOC except for the BASE mem-region, see [[Memory_layout|here]].

= Shared Memory Page Fields =

== WIFI_MACADDR ==
This is the WiFi MAC address for the 3DS. This is initialized by the [[NWM_Services|NWM]] module, it's unknown where the MAC address written here was originally loaded from.

== 3D_SLIDERSTATE ==
This float contains the state of the 3D slider. The range of this float is value 0.0f for "off", and 1.0f for max.

This is written/updated by [[HID_Services|HID]] module.

== 3D_LEDSTATE ==
When non-zero, the 3D LED is disabled. See [[GSPGPU:SetLedForceOff]].

== MENUTID ==
Unknown, contains the menu TID (used by [[NS]])

== ACTIVEMENUTID ==
This contains the titleID of the currently running menu launched by [[NS]].

= NATIVE_FIRM Versions =
{| class="wikitable" border="1"
! System version
! Old3DS title-version
! Old3DS hex title contentID
! Kernel/FIRM version (Old3DS/New3DS)
|-
| [[Factory_Setup|Factory]] FIRM (titleID 00040001-00000002)
| v0
| 00
| 2.3-0
|-
| [[1.0.0-0]]
| v432
| 00
| 2.27-0
|-
| [[1.1.0-1]]
| v1472
| 02
| 2.28-0
|-
| [[2.0.0-2]]
| v2516
| 09
| 2.29-7
|-
| [[2.1.0-3]]
| v3553
| 0B
| 2.30-18
|-
| [[2.2.0-X]]
| v4595
| 0F
| 2.31-40
|-
| [[3.0.0-5]]
| v5647
| 18
| 2.32-15
|-
| [[4.0.0-7]]
| v6677
| 1D
| 2.33-4
|-
| [[4.1.0-8]]
| v7712
| 1F
| 2.34-0
|-
| [[5.0.0-11]]
| v8758
| 25
| 2.35-6
|-
| [[5.1.0-11]]
| v9792
| 26
| 2.36-0
|-
| [[6.0.0-11]]
| v10833
| 29
| 2.37-0
|-
| [[6.1.0-11]]
| v11872
| 2A
| 2.38-0
|-
| [[7.0.0-13]]
| v12916
| 2E
| 2.39-4
|-
| [[7.2.0-17]]
| v13956
| 30
| 2.40-0
|-
| [[8.0.0-18]]
| v15047
| 37
| 2.44-6
|-
| [[8.1.0-0_New3DS]]
|
|
| 2.45-5
|-
| [[9.0.0-20]]
| v17120
| 38
| 2.46-0
|}

The above kernel/FIRM versions are in the format: <KERNEL_VERSIONMAJOR>.<KERNEL_VERSIONMINOR>-<KERNEL_VERSIONREVISION>.

Configuration Memory

2014-11-10T21:35:12Z

Vgturtle127: Updates to the WiFi MAC address stuff

= ARM11 Kernel Configuration Memory =
{| class="wikitable" border="1"
! NAME
! PROCESS VIRTUAL ADDRESS
! WIDTH
|-
| KERNEL_?
| 0x1FF80000
| 1
|-
| KERNEL_VERSIONREVISION
| 0x1FF80001
| 1
|-
| KERNEL_VERSIONMINOR
| 0x1FF80002
| 1
|-
| KERNEL_VERSIONMAJOR
| 0x1FF80003
| 1
|-
| UPDATEFLAG
| 0x1FF80004
| 4
|-
| NSTID
| 0x1FF80008
| 8
|-
| SYSCOREVER
| 0x1FF80010
| 4
|-
| UNITINFO
| 0x1FF80014
| 1
|-
| BOOT_FIRM
| 0x1FF80015
| 1
|-
| PREV_FIRM
| 0x1FF80016
| 1
|-
| KERNEL_CTRSDKVERSION
| 0x1FF80018
| 4
|-
| APPMEMTYPE
| 0x1FF80030
| 4
|-
| APPMEMALLOC
| 0x1FF80040
| 4
|-
| SYSMEMALLOC
| 0x1FF80044
| 4
|-
| BASEMEMALLOC
| 0x1FF80048
| 4
|-
| FIRM_?
| 0x1FF80060
| 1
|-
| FIRM_VERSIONREVISION
| 0x1FF80061
| 1
|-
| FIRM_VERSIONMINOR
| 0x1FF80062
| 1
|-
| FIRM_VERSIONMAJOR
| 0x1FF80063
| 1
|-
| FIRM_SYSCOREVER
| 0x1FF80064
| 4
|-
| FIRM_CTRSDKVERSION
| 0x1FF80068
| 4
|}

This memory page is [[Memory_layout|read-only]] for ARM11 processes.

The FIRM_* fields are by default identical to the KERNEL_* fields. However, the FIRM_* fields can be overridden via FIRM-launch parameters, see [[FIRM|here]].

Besides mem-region related fields, the data written here by the old 3DS/new 3DS kernels is identical.

= Shared Memory Page For ARM11 Processes =
{| class="wikitable" border="1"
! NAME
! PROCESS VIRTUAL ADDRESS
! WIDTH
|-
| bit0 selects DATETIME_0 or DATETIME_1.
| 0x1FF81000
| 4
|-
| RUNNING_HW (1=product, 2=devboard, 3=debugger, 4=capture)
| 0x1FF81004
| 1
|-
| MCU_HW_INFO
| 0x1FF81005
| 1
|-
| DATETIME_0 {(u64)MillisecondsSinceFirstJan1900,(u64)SystemTickLastTimeThisWasUpdated,(u32)unk,(u32)unk,(u32)unk,(u32)unk}
| 0x1FF81020
| 32
|-
| DATETIME_1
| 0x1FF81040
| 32
|-
| WIFI_MACADDR
| 0x1FF81060
| 6
|-
| 3D_SLIDERSTATE
| 0x1FF81080
| 4
|-
| 3D_LEDSTATE
| 0x1FF81084
| 1
|-
| MENUTID
| 0x1FF810A0
| 8
|-
| ACTIVEMENUTID
| 0x1FF810A8
| 8
|-
| Signed? Headsets connected?
| 0x1FF810C0
| 1
|}

This memory page is normally read-only for ARM11 processes, write-access is [[Memory_layout|determined]] by the process exheader kernel "shared page writing" flag.

= ARM11 Kernel Config Fields =

== 0x1FF80000 / 0x1FF80060 ==
Unknown, this is normally value 0.

== KERNEL_VERSIONREVISION / FIRM_VERSIONREVISION ==
This is the version-revision for the currently running [[FIRM]].

== KERNEL_VERSIONMINOR ==
This is the version-minor from ((title-version & 0x3FF) >> 4), for the currently running [[FIRM]]. The values from KERNEL_VERSIONMINOR and KERNEL_VERSIONMAJOR can be stored in applications' [[NCCH#CXI|CXI]] exheader.

== FIRM_VERSIONMINOR ==
This is the same as KERNEL_VERSIONMINOR. After [[AM:InstallNATIVEFIRM]] checks FIRM_SYSCOREVER, [[AM:InstallNATIVEFIRM]] then compares FIRM_VERSIONMINOR with the NATIVE_FIRM ((title-version & 0x3FF) >> 4), when the latter is larger than FIRM_VERSIONMINOR [[AM:InstallNATIVEFIRM]] will trigger a [[FIRM]] install.

== KERNEL_VERSIONMAJOR / FIRM_VERSIONMAJOR ==
This is the version-major for the currently running [[FIRM]].

== UPDATEFLAG ==
Normally this flag is zero. When the ARM11 kernel is booting on non-factory FIRM it will set this flag to 1, when bit0 from the data which field 0x1FF80016 is loaded from is clear, if the following [[PAD]] buttons are pressed: L, R, A, Up. When this flag is set, [[NS]] will launch the [[System_Settings#System_Updater|System Updater]] title instead of [[Home Menu]].

== NSTID ==
This field contains the titleID of the first title to launch from CTR-NAND after the [[FIRM]] system processes are loaded. The [[Process_Manager_Services|PM]] module launches this title. If this field titleID is all-zero, the system will not attempt to launch the title. The regular ARM11 kernel sets this to the regular [[NS]] titleID, while the SAFE_MODE ARM11 kernel sets this to the SAFE_MODE NS titleID. The factory FIRM ARM11-kernel sets this to the NS TID from [[Factory_Setup|here]].

== SYSCOREVER ==
This field is initialized by the ARM11 kernel, this is the programID-low of the running FIRM. When launching [[NCCH#CXI|CXIs]], the value stored here must match the core version field stored in the CXI exheader. If they do not match, the [[Process_Manager_Services|PM]] module will refuse to launch the ARM11 process.

With [[Factory_Setup|factory]] NATIVE_FIRM, this is set to 0x0, even though the FIRM programID-low is 0x2. However, the factory system-titles have core-version set to 0x2. Hence, this config-mem SYSCOREVER field might not be used by factory system processes?

== FIRM_SYSCOREVER ==
Normally this is the same as SYSCOREVER. This used by [[AM:InstallNATIVEFIRM]] for comparing with the NATIVE_FIRM titleID-low. When the low u8 from the NATIVE_FIRM titleID-low is larger than FIRMSYSCOREVER, [[AM:InstallNATIVEFIRM]] will trigger FIRM installing. When that u8 is not larger than FIRM_SYSCOREVER, and these two values don't match, [[AM:InstallNATIVEFIRM]] will return an error.

== UNITINFO ==
{| class="wikitable" border="1"
! Bit
! Description
|-
| 0
| Clear for developer unit, set for retail.(See 0x1FF80015)
|-
| 1
| Set for debug units
|-
| 2-7
|?
|}

Bit1 in this field is set by the ARM11 kernel when ARM debug CP14 DSCR bit14 is set. [[NS]] loads the menu TID from MENUTID when bits 1-7 of this field are clear. [[ErrDisp]] will display development error info when bit0 is clear.

== 0x1FF80015 ==
When this field is zero, bit0 for UNITINFO is set for retail. When this field is non-zero, bit0 for UNITINFO is clear for dev/debug units, and an ARM11 kernel state flag which enables debugging is set. Bit1 means JTAG connected.

== 0x1FF80016 ==
This originates from the low 8-bits of register [[CONFIG|0x10010000]]. When bit0 is set, the ARM11 kernel will not set the UPDATEFLAG to value 1.

== KERNEL_CTRSDKVERSION / FIRM_CTRSDKVERSION ==
This is the CTR-SDK version which was used to build the currently running [[FIRM]].

== APPMEMTYPE ==
The value of this field determines the size for APPMEMALLOC. The retail type(value0) is used when the type is not values 2-5. See [[Memory_layout]] for the table of values for this and the mem-region sizes.

== APPMEMALLOC ==
This contains the total size of the memory that can be allocated with the APPLICATION [[SVC|memory-region]], see [[Memory_layout|here]].

== SYSMEMALLOC ==
Same as APPMEMALLOC except for the SYSTEM mem-region, see [[Memory_layout|here]].

== BASEMEMALLOC ==
Same as APPMEMALLOC except for the BASE mem-region, see [[Memory_layout|here]].

= Shared Memory Page Fields =

== WIFI_MACADDR ==
This is the WiFi MAC address for the 3DS. This is initialized by the [[NWM_Services|NWM]] module, it's unknown where the MAC address written here was originally loaded from.

== 3D_SLIDERSTATE ==
This float contains the state of the 3D slider. The range of this float is value 0.0f for "off", and 1.0f for max.

This is written/updated by [[HID_Services|HID]] module.

== 3D_LEDSTATE ==
When non-zero, the 3D LED is disabled. See [[GSPGPU:SetLedForceOff]].

== MENUTID ==
Unknown, contains the menu TID(used by [[NS]]).

== ACTIVEMENUTID ==
This contains the titleID of the currently running menu launched by [[NS]].

= NATIVE_FIRM Versions =
{| class="wikitable" border="1"
! System version
! Old3DS title-version
! Old3DS hex title contentID
! Kernel/FIRM version (Old3DS/New3DS)
|-
| [[Factory_Setup|Factory]] FIRM (titleID 00040001-00000002)
| v0
| 00
| 2.3-0
|-
| [[1.0.0-0]]
| v432
| 00
| 2.27-0
|-
| [[1.1.0-1]]
| v1472
| 02
| 2.28-0
|-
| [[2.0.0-2]]
| v2516
| 09
| 2.29-7
|-
| [[2.1.0-3]]
| v3553
| 0B
| 2.30-18
|-
| [[2.2.0-X]]
| v4595
| 0F
| 2.31-40
|-
| [[3.0.0-5]]
| v5647
| 18
| 2.32-15
|-
| [[4.0.0-7]]
| v6677
| 1D
| 2.33-4
|-
| [[4.1.0-8]]
| v7712
| 1F
| 2.34-0
|-
| [[5.0.0-11]]
| v8758
| 25
| 2.35-6
|-
| [[5.1.0-11]]
| v9792
| 26
| 2.36-0
|-
| [[6.0.0-11]]
| v10833
| 29
| 2.37-0
|-
| [[6.1.0-11]]
| v11872
| 2A
| 2.38-0
|-
| [[7.0.0-13]]
| v12916
| 2E
| 2.39-4
|-
| [[7.2.0-17]]
| v13956
| 30
| 2.40-0
|-
| [[8.0.0-18]]
| v15047
| 37
| 2.44-6
|-
| [[8.1.0-0_New3DS]]
|
|
| 2.45-5
|-
| [[9.0.0-20]]
| v17120
| 38
| 2.46-0
|}

The above kernel/FIRM versions are in the format: <KERNEL_VERSIONMAJOR>.<KERNEL_VERSIONMINOR>-<KERNEL_VERSIONREVISION>.

Configuration Memory

2014-11-10T21:33:17Z

Vgturtle127: Fix some spacing

= ARM11 Kernel Configuration Memory =
{| class="wikitable" border="1"
! NAME
! PROCESS VIRTUAL ADDRESS
! WIDTH
|-
| KERNEL_?
| 0x1FF80000
| 1
|-
| KERNEL_VERSIONREVISION
| 0x1FF80001
| 1
|-
| KERNEL_VERSIONMINOR
| 0x1FF80002
| 1
|-
| KERNEL_VERSIONMAJOR
| 0x1FF80003
| 1
|-
| UPDATEFLAG
| 0x1FF80004
| 4
|-
| NSTID
| 0x1FF80008
| 8
|-
| SYSCOREVER
| 0x1FF80010
| 4
|-
| UNITINFO
| 0x1FF80014
| 1
|-
| BOOT_FIRM
| 0x1FF80015
| 1
|-
| PREV_FIRM
| 0x1FF80016
| 1
|-
| KERNEL_CTRSDKVERSION
| 0x1FF80018
| 4
|-
| APPMEMTYPE
| 0x1FF80030
| 4
|-
| APPMEMALLOC
| 0x1FF80040
| 4
|-
| SYSMEMALLOC
| 0x1FF80044
| 4
|-
| BASEMEMALLOC
| 0x1FF80048
| 4
|-
| FIRM_?
| 0x1FF80060
| 1
|-
| FIRM_VERSIONREVISION
| 0x1FF80061
| 1
|-
| FIRM_VERSIONMINOR
| 0x1FF80062
| 1
|-
| FIRM_VERSIONMAJOR
| 0x1FF80063
| 1
|-
| FIRM_SYSCOREVER
| 0x1FF80064
| 4
|-
| FIRM_CTRSDKVERSION
| 0x1FF80068
| 4
|}

This memory page is [[Memory_layout|read-only]] for ARM11 processes.

The FIRM_* fields are by default identical to the KERNEL_* fields. However, the FIRM_* fields can be overridden via FIRM-launch parameters, see [[FIRM|here]].

Besides mem-region related fields, the data written here by the old 3DS/new 3DS kernels is identical.

= Shared Memory Page For ARM11 Processes =
{| class="wikitable" border="1"
! NAME
! PROCESS VIRTUAL ADDRESS
! WIDTH
|-
| bit0 selects DATETIME_0 or DATETIME_1.
| 0x1FF81000
| 4
|-
| RUNNING_HW (1=product, 2=devboard, 3=debugger, 4=capture)
| 0x1FF81004
| 1
|-
| MCU_HW_INFO
| 0x1FF81005
| 1
|-
| DATETIME_0 {(u64)MillisecondsSinceFirstJan1900,(u64)SystemTickLastTimeThisWasUpdated,(u32)unk,(u32)unk,(u32)unk,(u32)unk}
| 0x1FF81020
| 32
|-
| DATETIME_1
| 0x1FF81040
| 32
|-
| WIFI_MACADDR
| 0x1FF81060
| 6
|-
| 3D_SLIDERSTATE
| 0x1FF81080
| 4
|-
| 3D_LEDSTATE
| 0x1FF81084
| 1
|-
| MENUTID
| 0x1FF810A0
| 8
|-
| ACTIVEMENUTID
| 0x1FF810A8
| 8
|-
| Signed? Headsets connected?
| 0x1FF810C0
| 1
|}

This memory page is normally read-only for ARM11 processes, write-access is [[Memory_layout|determined]] by the process exheader kernel "shared page writing" flag.

= ARM11 Kernel Config Fields =

== 0x1FF80000 / 0x1FF80060 ==
Unknown, this is normally value 0.

== KERNEL_VERSIONREVISION / FIRM_VERSIONREVISION ==
This is the version-revision for the currently running [[FIRM]].

== KERNEL_VERSIONMINOR ==
This is the version-minor from ((title-version & 0x3FF) >> 4), for the currently running [[FIRM]]. The values from KERNEL_VERSIONMINOR and KERNEL_VERSIONMAJOR can be stored in applications' [[NCCH#CXI|CXI]] exheader.

== FIRM_VERSIONMINOR ==
This is the same as KERNEL_VERSIONMINOR. After [[AM:InstallNATIVEFIRM]] checks FIRM_SYSCOREVER, [[AM:InstallNATIVEFIRM]] then compares FIRM_VERSIONMINOR with the NATIVE_FIRM ((title-version & 0x3FF) >> 4), when the latter is larger than FIRM_VERSIONMINOR [[AM:InstallNATIVEFIRM]] will trigger a [[FIRM]] install.

== KERNEL_VERSIONMAJOR / FIRM_VERSIONMAJOR ==
This is the version-major for the currently running [[FIRM]].

== UPDATEFLAG ==
Normally this flag is zero. When the ARM11 kernel is booting on non-factory FIRM it will set this flag to 1, when bit0 from the data which field 0x1FF80016 is loaded from is clear, if the following [[PAD]] buttons are pressed: L, R, A, Up. When this flag is set, [[NS]] will launch the [[System_Settings#System_Updater|System Updater]] title instead of [[Home Menu]].

== NSTID ==
This field contains the titleID of the first title to launch from CTR-NAND after the [[FIRM]] system processes are loaded. The [[Process_Manager_Services|PM]] module launches this title. If this field titleID is all-zero, the system will not attempt to launch the title. The regular ARM11 kernel sets this to the regular [[NS]] titleID, while the SAFE_MODE ARM11 kernel sets this to the SAFE_MODE NS titleID. The factory FIRM ARM11-kernel sets this to the NS TID from [[Factory_Setup|here]].

== SYSCOREVER ==
This field is initialized by the ARM11 kernel, this is the programID-low of the running FIRM. When launching [[NCCH#CXI|CXIs]], the value stored here must match the core version field stored in the CXI exheader. If they do not match, the [[Process_Manager_Services|PM]] module will refuse to launch the ARM11 process.

With [[Factory_Setup|factory]] NATIVE_FIRM, this is set to 0x0, even though the FIRM programID-low is 0x2. However, the factory system-titles have core-version set to 0x2. Hence, this config-mem SYSCOREVER field might not be used by factory system processes?

== FIRM_SYSCOREVER ==
Normally this is the same as SYSCOREVER. This used by [[AM:InstallNATIVEFIRM]] for comparing with the NATIVE_FIRM titleID-low. When the low u8 from the NATIVE_FIRM titleID-low is larger than FIRMSYSCOREVER, [[AM:InstallNATIVEFIRM]] will trigger FIRM installing. When that u8 is not larger than FIRM_SYSCOREVER, and these two values don't match, [[AM:InstallNATIVEFIRM]] will return an error.

== UNITINFO ==
{| class="wikitable" border="1"
! Bit
! Description
|-
| 0
| Clear for developer unit, set for retail.(See 0x1FF80015)
|-
| 1
| Set for debug units
|-
| 2-7
|?
|}

Bit1 in this field is set by the ARM11 kernel when ARM debug CP14 DSCR bit14 is set. [[NS]] loads the menu TID from MENUTID when bits 1-7 of this field are clear. [[ErrDisp]] will display development error info when bit0 is clear.

== 0x1FF80015 ==
When this field is zero, bit0 for UNITINFO is set for retail. When this field is non-zero, bit0 for UNITINFO is clear for dev/debug units, and an ARM11 kernel state flag which enables debugging is set. Bit1 means JTAG connected.

== 0x1FF80016 ==
This originates from the low 8-bits of register [[CONFIG|0x10010000]]. When bit0 is set, the ARM11 kernel will not set the UPDATEFLAG to value 1.

== KERNEL_CTRSDKVERSION / FIRM_CTRSDKVERSION ==
This is the CTR-SDK version which was used to build the currently running [[FIRM]].

== APPMEMTYPE ==
The value of this field determines the size for APPMEMALLOC. The retail type(value0) is used when the type is not values 2-5. See [[Memory_layout]] for the table of values for this and the mem-region sizes.

== APPMEMALLOC ==
This contains the total size of the memory that can be allocated with the APPLICATION [[SVC|memory-region]], see [[Memory_layout|here]].

== SYSMEMALLOC ==
Same as APPMEMALLOC except for the SYSTEM mem-region, see [[Memory_layout|here]].

== BASEMEMALLOC ==
Same as APPMEMALLOC except for the BASE mem-region, see [[Memory_layout|here]].

= Shared Memory Page Fields =

== WIFI_MACADDR ==
This is the wifi MAC address for this 3DS. This is initialized by the [[NWM_Services|NWM]] module, it's unknown where the the MAC address written here was originally loaded from.

== 3D_SLIDERSTATE ==
This float contains the state of the 3D slider. The range of this float is value 0.0f for "off", and 1.0f for max.

This is written/updated by [[HID_Services|HID]] module.

== 3D_LEDSTATE ==
When non-zero, the 3D LED is disabled. See [[GSPGPU:SetLedForceOff]].

== MENUTID ==
Unknown, contains the menu TID(used by [[NS]]).

== ACTIVEMENUTID ==
This contains the titleID of the currently running menu launched by [[NS]].

= NATIVE_FIRM Versions =
{| class="wikitable" border="1"
! System version
! Old3DS title-version
! Old3DS hex title contentID
! Kernel/FIRM version (Old3DS/New3DS)
|-
| [[Factory_Setup|Factory]] FIRM (titleID 00040001-00000002)
| v0
| 00
| 2.3-0
|-
| [[1.0.0-0]]
| v432
| 00
| 2.27-0
|-
| [[1.1.0-1]]
| v1472
| 02
| 2.28-0
|-
| [[2.0.0-2]]
| v2516
| 09
| 2.29-7
|-
| [[2.1.0-3]]
| v3553
| 0B
| 2.30-18
|-
| [[2.2.0-X]]
| v4595
| 0F
| 2.31-40
|-
| [[3.0.0-5]]
| v5647
| 18
| 2.32-15
|-
| [[4.0.0-7]]
| v6677
| 1D
| 2.33-4
|-
| [[4.1.0-8]]
| v7712
| 1F
| 2.34-0
|-
| [[5.0.0-11]]
| v8758
| 25
| 2.35-6
|-
| [[5.1.0-11]]
| v9792
| 26
| 2.36-0
|-
| [[6.0.0-11]]
| v10833
| 29
| 2.37-0
|-
| [[6.1.0-11]]
| v11872
| 2A
| 2.38-0
|-
| [[7.0.0-13]]
| v12916
| 2E
| 2.39-4
|-
| [[7.2.0-17]]
| v13956
| 30
| 2.40-0
|-
| [[8.0.0-18]]
| v15047
| 37
| 2.44-6
|-
| [[8.1.0-0_New3DS]]
|
|
| 2.45-5
|-
| [[9.0.0-20]]
| v17120
| 38
| 2.46-0
|}

The above kernel/FIRM versions are in the format: <KERNEL_VERSIONMAJOR>.<KERNEL_VERSIONMINOR>-<KERNEL_VERSIONREVISION>.

Configuration Memory

2014-11-10T21:31:58Z

Vgturtle127: Fix some weird issues

= ARM11 Kernel Configuration Memory =
{| class="wikitable" border="1"
! NAME
! PROCESS VIRTUAL ADDRESS
! WIDTH
|-
| KERNEL_?
| 0x1FF80000
| 1
|-
| KERNEL_VERSIONREVISION
| 0x1FF80001
| 1
|-
| KERNEL_VERSIONMINOR
| 0x1FF80002
| 1
|-
| KERNEL_VERSIONMAJOR
| 0x1FF80003
| 1
|-
| UPDATEFLAG
| 0x1FF80004
| 4
|-
| NSTID
| 0x1FF80008
| 8
|-
| SYSCOREVER
| 0x1FF80010
| 4
|-
| UNITINFO
| 0x1FF80014
| 1
|-
| BOOT_FIRM
| 0x1FF80015
| 1
|-
| PREV_FIRM
| 0x1FF80016
| 1
|-
| KERNEL_CTRSDKVERSION
| 0x1FF80018
| 4
|-
| APPMEMTYPE
| 0x1FF80030
| 4
|-
| APPMEMALLOC
| 0x1FF80040
| 4
|-
| SYSMEMALLOC
| 0x1FF80044
| 4
|-
| BASEMEMALLOC
| 0x1FF80048
| 4
|-
| FIRM_?
| 0x1FF80060
| 1
|-
| FIRM_VERSIONREVISION
| 0x1FF80061
| 1
|-
| FIRM_VERSIONMINOR
| 0x1FF80062
| 1
|-
| FIRM_VERSIONMAJOR
| 0x1FF80063
| 1
|-
| FIRM_SYSCOREVER
| 0x1FF80064
| 4
|-
| FIRM_CTRSDKVERSION
| 0x1FF80068
| 4
|}

This memory page is [[Memory_layout|read-only]] for ARM11 processes.

The FIRM_* fields are by default identical to the KERNEL_* fields. However, the FIRM_* fields can be overridden via FIRM-launch parameters, see [[FIRM|here]].

Besides mem-region related fields, the data written here by the old 3DS/new 3DS kernels is identical.

= Shared Memory Page For ARM11 Processes =
{| class="wikitable" border="1"
! NAME
! PROCESS VIRTUAL ADDRESS
! WIDTH
|-
| bit0 selects DATETIME_0 or DATETIME_1.
| 0x1FF81000
| 4
|-
| RUNNING_HW (1=product, 2=devboard, 3=debugger, 4=capture)
| 0x1FF81004
| 1
|-
| MCU_HW_INFO
| 0x1FF81005
| 1
|-
| DATETIME_0 {(u64)MillisecondsSinceFirstJan1900,(u64)SystemTickLastTimeThisWasUpdated,(u32)unk,(u32)unk,(u32)unk,(u32)unk}
| 0x1FF81020
| 32
|-
| DATETIME_1
| 0x1FF81040
| 32
|-
| WIFI_MACADDR
| 0x1FF81060
| 6
|-
| 3D_SLIDERSTATE
| 0x1FF81080
| 4
|-
| 3D_LEDSTATE
| 0x1FF81084
| 1
|-
| MENUTID
| 0x1FF810A0
| 8
|-
| ACTIVEMENUTID
| 0x1FF810A8
| 8
|-
| Signed? Headsets connected?
| 0x1FF810C0
| 1
|}

This memory page is normally read-only for ARM11 processes, write-access is [[Memory_layout|determined]] by the process exheader kernel "shared page writing" flag.

= ARM11 Kernel Config Fields =

== 0x1FF80000 / 0x1FF80060 ==
Unknown, this is normally value 0.

== KERNEL_VERSIONREVISION / FIRM_VERSIONREVISION ==
This is the version-revision for the currently running [[FIRM]].

== KERNEL_VERSIONMINOR ==
This is the version-minor from ((title-version & 0x3FF) >> 4), for the currently running [[FIRM]]. The values from KERNEL_VERSIONMINOR and KERNEL_VERSIONMAJOR can be stored in applications' [[NCCH#CXI|CXI]] exheader.

== FIRM_VERSIONMINOR ==
This is the same as KERNEL_VERSIONMINOR. After [[AM:InstallNATIVEFIRM]] checks FIRM_SYSCOREVER, [[AM:InstallNATIVEFIRM]] then compares FIRM_VERSIONMINOR with the NATIVE_FIRM ((title-version & 0x3FF) >> 4), when the latter is larger than FIRM_VERSIONMINOR [[AM:InstallNATIVEFIRM]] will trigger a [[FIRM]] install.

== KERNEL_VERSIONMAJOR / FIRM_VERSIONMAJOR ==
This is the version-major for the currently running [[FIRM]].

== UPDATEFLAG ==
Normally this flag is zero. When the ARM11 kernel is booting on non-factory FIRM it will set this flag to 1, when bit0 from the data which field 0x1FF80016 is loaded from is clear, if the following [[PAD]] buttons are pressed: L, R, A, Up. When this flag is set, [[NS]] will launch the [[System_Settings#System_Updater|System Updater]] title instead of [[Home Menu]].

== NSTID ==
This field contains the titleID of the first title to launch from CTR-NAND after the [[FIRM]] system processes are loaded. The [[Process_Manager_Services|PM]] module launches this title. If this field titleID is all-zero, the system will not attempt to launch the title. The regular ARM11 kernel sets this to the regular [[NS]] titleID, while the SAFE_MODE ARM11 kernel sets this to the SAFE_MODE NS titleID. The factory FIRM ARM11-kernel sets this to the NS TID from [[Factory_Setup|here]].

== SYSCOREVER ==
This field is initialized by the ARM11 kernel, this is the programID-low of the running FIRM. When launching [[NCCH#CXI|CXIs]], the value stored here must match the core version field stored in the CXI exheader. If they do not match, the [[Process_Manager_Services|PM]] module will refuse to launch the ARM11 process.

With [[Factory_Setup|factory]] NATIVE_FIRM, this is set to 0x0, even though the FIRM programID-low is 0x2. However, the factory system-titles have core-version set to 0x2. Hence, this config-mem SYSCOREVER field might not be used by factory system processes?

== FIRM_SYSCOREVER ==
Normally this is the same as SYSCOREVER. This used by [[AM:InstallNATIVEFIRM]] for comparing with the NATIVE_FIRM titleID-low. When the low u8 from the NATIVE_FIRM titleID-low is larger than FIRMSYSCOREVER, [[AM:InstallNATIVEFIRM]] will trigger FIRM installing. When that u8 is not larger than FIRM_SYSCOREVER, and these two values don't match, [[AM:InstallNATIVEFIRM]] will return an error.

== UNITINFO ==
{| class="wikitable" border="1"
! Bit
! Description
|-
| 0
| Clear for dev unit, set for retail.(See 0x1FF80015)
|-
| 1
| Set for debug units
|-
| 2-7
| ?
|}

Bit1 in this field is set by the ARM11 kernel when ARM debug CP14 DSCR bit14 is set. [[NS]] loads the menu TID from MENUTID when bits 1-7 of this field are clear. [[ErrDisp]] will display development error info when bit0 is clear.

== 0x1FF80015 ==
When this field is zero, bit0 for UNITINFO is set for retail. When this field is non-zero, bit0 for UNITINFO is clear for dev/debug units, and an ARM11 kernel state flag which enables debugging is set. Bit1 means JTAG connected.

== 0x1FF80016 ==
This originates from the low 8-bits of register [[CONFIG|0x10010000]]. When bit0 is set, the ARM11 kernel will not set the UPDATEFLAG to value 1.

== KERNEL_CTRSDKVERSION / FIRM_CTRSDKVERSION ==
This is the CTR-SDK version which was used to build the currently running [[FIRM]].

== APPMEMTYPE ==
The value of this field determines the size for APPMEMALLOC. The retail type(value0) is used when the type is not values 2-5. See [[Memory_layout]] for the table of values for this and the mem-region sizes.

== APPMEMALLOC ==
This contains the total size of the memory that can be allocated with the APPLICATION [[SVC|memory-region]], see [[Memory_layout|here]].

== SYSMEMALLOC ==
Same as APPMEMALLOC except for the SYSTEM mem-region, see [[Memory_layout|here]].

== BASEMEMALLOC ==
Same as APPMEMALLOC except for the BASE mem-region, see [[Memory_layout|here]].

= Shared Memory Page Fields =

== WIFI_MACADDR ==
This is the wifi MAC address for this 3DS. This is initialized by the [[NWM_Services|NWM]] module, it's unknown where the the MAC address written here was originally loaded from.

== 3D_SLIDERSTATE ==
This float contains the state of the 3D slider. The range of this float is value 0.0f for "off", and 1.0f for max.

This is written/updated by [[HID_Services|HID]] module.

== 3D_LEDSTATE ==
When non-zero, the 3D LED is disabled. See [[GSPGPU:SetLedForceOff]].

== MENUTID ==
Unknown, contains the menu TID(used by [[NS]]).

== ACTIVEMENUTID ==
This contains the titleID of the currently running menu launched by [[NS]].

= NATIVE_FIRM Versions =
{| class="wikitable" border="1"
! System version
! Old3DS title-version
! Old3DS hex title contentID
! Kernel/FIRM version (Old3DS/New3DS)
|-
| [[Factory_Setup|Factory]] FIRM (titleID 00040001-00000002)
| v0
| 00
| 2.3-0
|-
| [[1.0.0-0]]
| v432
| 00
| 2.27-0
|-
| [[1.1.0-1]]
| v1472
| 02
| 2.28-0
|-
| [[2.0.0-2]]
| v2516
| 09
| 2.29-7
|-
| [[2.1.0-3]]
| v3553
| 0B
| 2.30-18
|-
| [[2.2.0-X]]
| v4595
| 0F
| 2.31-40
|-
| [[3.0.0-5]]
| v5647
| 18
| 2.32-15
|-
| [[4.0.0-7]]
| v6677
| 1D
| 2.33-4
|-
| [[4.1.0-8]]
| v7712
| 1F
| 2.34-0
|-
| [[5.0.0-11]]
| v8758
| 25
| 2.35-6
|-
| [[5.1.0-11]]
| v9792
| 26
| 2.36-0
|-
| [[6.0.0-11]]
| v10833
| 29
| 2.37-0
|-
| [[6.1.0-11]]
| v11872
| 2A
| 2.38-0
|-
| [[7.0.0-13]]
| v12916
| 2E
| 2.39-4
|-
| [[7.2.0-17]]
| v13956
| 30
| 2.40-0
|-
| [[8.0.0-18]]
| v15047
| 37
| 2.44-6
|-
| [[8.1.0-0_New3DS]]
|
|
| 2.45-5
|-
| [[9.0.0-20]]
| v17120
| 38
| 2.46-0
|}

The above kernel/FIRM versions are in the format: <KERNEL_VERSIONMAJOR>.<KERNEL_VERSIONMINOR>-<KERNEL_VERSIONREVISION>.

Configuration Memory

2014-11-10T21:30:41Z

Vgturtle127: Adjust the formatting of the old and new 3DS

= ARM11 Kernel Configuration Memory =
{| class="wikitable" border="1"
! NAME
! PROCESS VIRTUAL ADDRESS
! WIDTH
|-
| KERNEL_?
| 0x1FF80000
| 1
|-
| KERNEL_VERSIONREVISION
| 0x1FF80001
| 1
|-
| KERNEL_VERSIONMINOR
| 0x1FF80002
| 1
|-
| KERNEL_VERSIONMAJOR
| 0x1FF80003
| 1
|-
| UPDATEFLAG
| 0x1FF80004
| 4
|-
| NSTID
| 0x1FF80008
| 8
|-
| SYSCOREVER
| 0x1FF80010
| 4
|-
| UNITINFO
| 0x1FF80014
| 1
|-
| BOOT_FIRM
| 0x1FF80015
| 1
|-
| PREV_FIRM
| 0x1FF80016
| 1
|-
| KERNEL_CTRSDKVERSION
| 0x1FF80018
| 4
|-
| APPMEMTYPE
| 0x1FF80030
| 4
|-
| APPMEMALLOC
| 0x1FF80040
| 4
|-
| SYSMEMALLOC
| 0x1FF80044
| 4
|-
| BASEMEMALLOC
| 0x1FF80048
| 4
|-
| FIRM_?
| 0x1FF80060
| 1
|-
| FIRM_VERSIONREVISION
| 0x1FF80061
| 1
|-
| FIRM_VERSIONMINOR
| 0x1FF80062
| 1
|-
| FIRM_VERSIONMAJOR
| 0x1FF80063
| 1
|-
| FIRM_SYSCOREVER
| 0x1FF80064
| 4
|-
| FIRM_CTRSDKVERSION
| 0x1FF80068
| 4
|}

This memory page is [[Memory_layout|read-only]] for ARM11 processes.

The FIRM_* fields are by default identical to the KERNEL_* fields. However, the FIRM_* fields can be overridden via FIRM-launch parameters, see [[FIRM|here]].

Besides mem-region related fields, the data written here by the old 3DS/new 3DS kernels is identical.

= Shared Memory Page For ARM11 Processes =
{| class="wikitable" border="1"
! NAME
! PROCESS VIRTUAL ADDRESS
! WIDTH
|-
| bit0 selects DATETIME_0 or DATETIME_1.
| 0x1FF81000
| 4
|-
| RUNNING_HW (1=product, 2=devboard, 3=debugger, 4=capture)
| 0x1FF81004
| 1
|-
| MCU_HW_INFO
| 0x1FF81005
| 1
|-
| DATETIME_0 {(u64)MillisecondsSinceFirstJan1900,(u64)SystemTickLastTimeThisWasUpdated,(u32)unk,(u32)unk,(u32)unk,(u32)unk}
| 0x1FF81020
| 32
|-
| DATETIME_1
| 0x1FF81040
| 32
|-
| WIFI_MACADDR
| 0x1FF81060
| 6
|-
| 3D_SLIDERSTATE
| 0x1FF81080
| 4
|-
| 3D_LEDSTATE
| 0x1FF81084
| 1
|-
| MENUTID
| 0x1FF810A0
| 8
|-
| ACTIVEMENUTID
| 0x1FF810A8
| 8
|-
| signed ? HeadsetsConnected?
| 0x1FF810C0
| 1
|}

This memory page is normally read-only for ARM11 processes, write-access is [[Memory_layout|determined]] by the process exheader kernel "Shared page writing" flag.

= ARM11 Kernel Config Fields =

== 0x1FF80000 / 0x1FF80060 ==
Unknown, this is normally value 0.

== KERNEL_VERSIONREVISION / FIRM_VERSIONREVISION ==
This is the version-revision for the currently running [[FIRM]].

== KERNEL_VERSIONMINOR ==
This is the version-minor from ((title-version & 0x3FF) >> 4), for the currently running [[FIRM]]. The values from KERNEL_VERSIONMINOR and KERNEL_VERSIONMAJOR can be stored in applications' [[NCCH#CXI|CXI]] exheader.

== FIRM_VERSIONMINOR ==
This is the same as KERNEL_VERSIONMINOR. After [[AM:InstallNATIVEFIRM]] checks FIRM_SYSCOREVER, [[AM:InstallNATIVEFIRM]] then compares FIRM_VERSIONMINOR with the NATIVE_FIRM ((title-version & 0x3FF) >> 4), when the latter is larger than FIRM_VERSIONMINOR [[AM:InstallNATIVEFIRM]] will trigger a [[FIRM]] install.

== KERNEL_VERSIONMAJOR / FIRM_VERSIONMAJOR ==
This is the version-major for the currently running [[FIRM]].

== UPDATEFLAG ==
Normally this flag is zero. When the ARM11 kernel is booting on non-factory FIRM it will set this flag to 1, when bit0 from the data which field 0x1FF80016 is loaded from is clear, if the following [[PAD]] buttons are pressed: L, R, A, Up. When this flag is set, [[NS]] will launch the [[System_Settings#System_Updater|System Updater]] title instead of [[Home Menu]].

== NSTID ==
This field contains the titleID of the first title to launch from CTR-NAND after the [[FIRM]] system processes are loaded. The [[Process_Manager_Services|PM]] module launches this title. If this field titleID is all-zero, the system will not attempt to launch the title. The regular ARM11 kernel sets this to the regular [[NS]] titleID, while the SAFE_MODE ARM11 kernel sets this to the SAFE_MODE NS titleID. The factory FIRM ARM11-kernel sets this to the NS TID from [[Factory_Setup|here]].

== SYSCOREVER ==
This field is initialized by the ARM11 kernel, this is the programID-low of the running FIRM. When launching [[NCCH#CXI|CXIs]], the value stored here must match the core version field stored in the CXI exheader. If they do not match, the [[Process_Manager_Services|PM]] module will refuse to launch the ARM11 process.

With [[Factory_Setup|factory]] NATIVE_FIRM, this is set to 0x0, even though the FIRM programID-low is 0x2. However, the factory system-titles have core-version set to 0x2. Hence, this config-mem SYSCOREVER field might not be used by factory system processes?

== FIRM_SYSCOREVER ==
Normally this is the same as SYSCOREVER. This used by [[AM:InstallNATIVEFIRM]] for comparing with the NATIVE_FIRM titleID-low. When the low u8 from the NATIVE_FIRM titleID-low is larger than FIRMSYSCOREVER, [[AM:InstallNATIVEFIRM]] will trigger FIRM installing. When that u8 is not larger than FIRM_SYSCOREVER, and these two values don't match, [[AM:InstallNATIVEFIRM]] will return an error.

== UNITINFO ==
{| class="wikitable" border="1"
! Bit
! Description
|-
| 0
| Clear for dev unit, set for retail.(See 0x1FF80015)
|-
| 1
| Set for debug units
|-
| 2-7
| ?
|}

Bit1 in this field is set by the ARM11 kernel when ARM debug CP14 DSCR bit14 is set. [[NS]] loads the menu TID from MENUTID when bits 1-7 of this field are clear. [[ErrDisp]] will display development error info when bit0 is clear.

== 0x1FF80015 ==
When this field is zero, bit0 for UNITINFO is set for retail. When this field is non-zero, bit0 for UNITINFO is clear for dev/debug units, and an ARM11 kernel state flag which enables debugging is set. Bit1 means JTAG connected.

== 0x1FF80016 ==
This originates from the low 8-bits of register [[CONFIG|0x10010000]]. When bit0 is set, the ARM11 kernel will not set the UPDATEFLAG to value 1.

== KERNEL_CTRSDKVERSION / FIRM_CTRSDKVERSION ==
This is the CTR-SDK version which was used to build the currently running [[FIRM]].

== APPMEMTYPE ==
The value of this field determines the size for APPMEMALLOC. The retail type(value0) is used when the type is not values 2-5. See [[Memory_layout]] for the table of values for this and the mem-region sizes.

== APPMEMALLOC ==
This contains the total size of the memory that can be allocated with the APPLICATION [[SVC|memory-region]], see [[Memory_layout|here]].

== SYSMEMALLOC ==
Same as APPMEMALLOC except for the SYSTEM mem-region, see [[Memory_layout|here]].

== BASEMEMALLOC ==
Same as APPMEMALLOC except for the BASE mem-region, see [[Memory_layout|here]].

= Shared Memory Page Fields =

== WIFI_MACADDR ==
This is the wifi MAC address for this 3DS. This is initialized by the [[NWM_Services|NWM]] module, it's unknown where the the MAC address written here was originally loaded from.

== 3D_SLIDERSTATE ==
This float contains the state of the 3D slider. The range of this float is value 0.0f for "off", and 1.0f for max.

This is written/updated by [[HID_Services|HID]] module.

== 3D_LEDSTATE ==
When non-zero, the 3D LED is disabled. See [[GSPGPU:SetLedForceOff]].

== MENUTID ==
Unknown, contains the menu TID(used by [[NS]]).

== ACTIVEMENUTID ==
This contains the titleID of the currently running menu launched by [[NS]].

= NATIVE_FIRM Versions =
{| class="wikitable" border="1"
! System version
! Old3DS title-version
! Old3DS hex title contentID
! Kernel/FIRM version (Old3DS/New3DS)
|-
| [[Factory_Setup|Factory]] FIRM (titleID 00040001-00000002)
| v0
| 00
| 2.3-0
|-
| [[1.0.0-0]]
| v432
| 00
| 2.27-0
|-
| [[1.1.0-1]]
| v1472
| 02
| 2.28-0
|-
| [[2.0.0-2]]
| v2516
| 09
| 2.29-7
|-
| [[2.1.0-3]]
| v3553
| 0B
| 2.30-18
|-
| [[2.2.0-X]]
| v4595
| 0F
| 2.31-40
|-
| [[3.0.0-5]]
| v5647
| 18
| 2.32-15
|-
| [[4.0.0-7]]
| v6677
| 1D
| 2.33-4
|-
| [[4.1.0-8]]
| v7712
| 1F
| 2.34-0
|-
| [[5.0.0-11]]
| v8758
| 25
| 2.35-6
|-
| [[5.1.0-11]]
| v9792
| 26
| 2.36-0
|-
| [[6.0.0-11]]
| v10833
| 29
| 2.37-0
|-
| [[6.1.0-11]]
| v11872
| 2A
| 2.38-0
|-
| [[7.0.0-13]]
| v12916
| 2E
| 2.39-4
|-
| [[7.2.0-17]]
| v13956
| 30
| 2.40-0
|-
| [[8.0.0-18]]
| v15047
| 37
| 2.44-6
|-
| [[8.1.0-0_New3DS]]
|
|
| 2.45-5
|-
| [[9.0.0-20]]
| v17120
| 38
| 2.46-0
|}

The above kernel/FIRM versions are in the format: <KERNEL_VERSIONMAJOR>.<KERNEL_VERSIONMINOR>-<KERNEL_VERSIONREVISION>.

Config Savegame

2014-11-10T21:28:56Z

Vgturtle127: Small fix

This page describes the format of the [[Config_Services|Cfg]] [[System_SaveData|NAND]] savegame. These blocks can be accessed with the Cfg service commands.

==Structure of save-file "/config"==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x2
| Total entries
|-
| 0x2
| 0x2
| Data entries offset
|-
| 0x4
| 0x4558
| Block entries
|-
| 0x455C
|
| Data for the entries
|}

The filesize for this /config file is 0x8000-bytes.

==Configuration block entry ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| BlkID
|-
| 0x4
| 0x4
| Offset to the data for this block when size is >4, otherwise this word is the data for this block
|-
| 0x8
| 0x2
| Size
|-
| 0xA
| 0x2
| Flags
|}

==Configuration blocks==
{| class="wikitable" border="1"
|-
! BlkID
! Size
! Flags
! Description
|-
| 0x00050005
| 0x20
|?
| Stereo camera settings?
|-
| 0x00070001
| 0x1
|?
| Sound output mode?
|-
| 0x00080000
| 0xC00
| 0x2?
| WiFi configuration slot 0
|-
| 0x00080001
| 0xC00
| 0x2?
| WiFi configuration slot 1
|-
| 0x00080002
| 0xC00
| 0x2?
| WiFi configuration slot 2
|-
| 0x00090000
| 0x8
| 0x2?
| This contains a u64 ID, used by processes using [[NWMUDS:Initialize]]. The first word is the same as [[CfgS:GetLocalFriendCodeSeed|LocalFriendCodeSeed]], while the latter is a separate random word
|-
| 0x00090001
| 0x8
| 0xE
| This console-unique u64 used by [[Cfg:GenHashConsoleUnique|GenHashConsoleUnique]] is generated with the LocalFriendCodeSeed and with random data
|-
| 0x000A0000
| 0x1C
| 0xE
| Username
|-
| 0x000A0002
| 0x1
| 0xA
| Language
|-
| 0x000B0000
| 0x4
| 0x8
| CountryInfo
|-
| 0x000B0001
| 0x800
| 0x2?
| Country name in UTF-16, every 0x80-bytes is an entry for each language(not all entries are set)
|-
| 0x000B0002
| 0x800
| 0x2?
| State name in UTF-16, every 0x80-bytes is an entry for each language
|-
| 0x000C0000
| 0xC0
|?
| Restricted photo exchange data, and other info
|-
| 0x000C0001
| 0x14
|?
| Same as above?
|-
| 0x000D0000
| 0x4
|?
| u16 at offset 0x0: [[SMDH#EULA_Version|EULA Version]] which was agreed to.
|-
| 0x000F0000
| 0x10
| 0x8?
| Unknown, used by [[NS]] on dev-units for [[SVC|svcKernelSetState]], where Type is 6. During NS startup on debug-units, NS compares the u32 from +8 in this config-block with the [[Configuration_Memory#APPMEMTYPE|APPMEMTYPE]]. When those don't match NS starts a FIRM-launch (with the same FIRM titleID as the currently running one) to boot into a FIRM with the APPMEMTYPE value from this config-block
|-
| 0x000F0004
| 0x4
| 0x8?
| The first u8 is the System-Model [[Cfg:GetSystemModel|value]], the last 3-bytes are unknown
|-
| 0x00110000
| 0x4
|?
| The low u16 indicates whether the system setup is required, such as when the system is booted for the first time or after doing a [[System Settings|System Format]]: 0 = setup required, non-zero = no setup required
|-
| 0x00110001
| 0x8
| 0xA?
| TitleID of the menu to launch, used by [[NS]] on dev units (this block can be edited on dev units with [[3DS Development Unit Software#Config|Config]])
|-
| 0x00130000
| 0x4
|?
| If response is 0x100 then debug mode is enabled.
|-
| 0x00160000
| 0x4
| 0x8?
| Unknown, first byte is used by config service-cmd [[Config_Services|0x00070040]]. (Unknown whether the last 3-bytes are used)
|}

The developer unit TID block only exists on developer units.

===Languages===
{| class="wikitable" border="1"
|-
! ID
! Description
|-
| 0
| JP
|-
| 1
| EN
|-
| 2
| FR
|-
| 3
| DE
|-
| 4
| IT
|-
| 5
| ES
|-
| 6
| ZH
|-
| 7
| KO
|-
| 8
| NL
|-
| 9
| PT
|-
| 10
| RU
|}

===CountryInfo===
{| class="wikitable" border="1"
|-
! Byte
! Description
|-
| 0
|?
|-
| 1
|?
|-
| 2
|?
|-
| 3
| Country code, same as DSi/Wii country codes. Value 0xFF is invalid.
|}

===0x000A0000 Block===
{| class="wikitable" border="1"
|-
! Byte
! Description
|-
| 0x0-0x13
| UTF-16 username, with no NULL-terminator.
|-
| 0x14-17
| Usually zero?
|-
| 0x18-0x1B
| u32 NGWord version the username was last checked with. If this value is less than the u32 stored in the NGWord CFA "romfs:/version.dat", the system then checks the username string with the bad-word list CFA again, then updates this field with the value from the CFA
|}

Config Savegame

2014-11-10T21:26:35Z

Vgturtle127: Spell some stuff out for clarification

This page describes the format of the [[Config_Services|Cfg]] [[System_SaveData|NAND]] savegame. These blocks can be accessed with the Cfg service commands.

==Structure of save-file "/config"==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x2
| Total entries
|-
| 0x2
| 0x2
| Data entries offset
|-
| 0x4
| 0x4558
| Block entries
|-
| 0x455C
|
| Data for the entries
|}

The filesize for this /config file is 0x8000-bytes.

==Configuration block entry ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| BlkID
|-
| 0x4
| 0x4
| Offset to the data for this block when size is >4, otherwise this word is the data for this block
|-
| 0x8
| 0x2
| Size
|-
| 0xA
| 0x2
| Flags
|}

==Configuration blocks==
{| class="wikitable" border="1"
|-
! BlkID
! Size
! Flags
! Description
|-
| 0x00050005
| 0x20
|?
| Stereo camera settings?
|-
| 0x00070001
| 0x1
|?
| Sound output mode?
|-
| 0x00080000
| 0xC00
| 0x2?
| WiFi configuration slot 0
|-
| 0x00080001
| 0xC00
| 0x2?
| WiFi configuration slot 1
|-
| 0x00080002
| 0xC00
| 0x2?
| WiFi configuration slot 2
|-
| 0x00090000
| 0x8
| 0x2?
| This contains a u64 ID, used by processes using [[NWMUDS:Initialize]]. The first word is the same as [[CfgS:GetLocalFriendCodeSeed|LocalFriendCodeSeed]], while the latter is a separate random word
|-
| 0x00090001
| 0x8
| 0xE
| This console-unique u64 used by [[Cfg:GenHashConsoleUnique|GenHashConsoleUnique]] is generated with the LocalFriendCodeSeed and with random data
|-
| 0x000A0000
| 0x1C
| 0xE
| Username
|-
| 0x000A0002
| 0x1
| 0xA
| Language
|-
| 0x000B0000
| 0x4
| 0x8
| CountryInfo
|-
| 0x000B0001
| 0x800
| 0x2?
| Country name in UTF-16, every 0x80-bytes is an entry for each language(not all entries are set)
|-
| 0x000B0002
| 0x800
| 0x2?
| State name in UTF-16, every 0x80-bytes is an entry for each language
|-
| 0x000C0000
| 0xC0
|?
| Restricted photo exchange data, and other info
|-
| 0x000C0001
| 0x14
|?
| Same as above?
|-
| 0x000D0000
| 0x4
|?
| u16 at offset 0x0: [[SMDH#EULA_Version|EULA Version]] which was agreed to.
|-
| 0x000F0000
| 0x10
| 0x8?
| Unknown, used by [[NS]] on dev-units for [[SVC|svcKernelSetState]], where Type is 6. During NS startup on debug-units, NS compares the u32 from +8 in this config-block with the [[Configuration_Memory#APPMEMTYPE|APPMEMTYPE]]. When those don't match NS starts a FIRM-launch (with the same FIRM titleID as the currently running one) to boot into a FIRM with the APPMEMTYPE value from this config-block
|-
| 0x000F0004
| 0x4
| 0x8?
| The first u8 is the System-Model [[Cfg:GetSystemModel|value]], the last 3-bytes are unknown
|-
| 0x00110000
| 0x4
|?
| The low u16 indicates whether the system setup is required, such as when the system is booted for the first time or after doing a [[System Settings|System Format]]: 0 = setup required, non-zero = no setup required
|-
| 0x00110001
| 0x8
| 0xA?
| TitleID of the menu to launch, used by [[NS]] on dev units (this block can be edited on dev units with [[3DS Development Unit Software#Config|Config]])
|-
| 0x00130000
| 0x4
|?
| If response is 0x100 then debug mode is enabled.
|-
| 0x00160000
| 0x4
| 0x8?
| Unknown, first byte is used by config service-cmd [[Config_Services|0x00070040]]. (Unknown whether the last 3-bytes are used)
|}

The developer unit TID block only exists on developer units.

===Languages===
{| class="wikitable" border="1"
|-
! ID
! Description
|-
| 0
| JP
|-
| 1
| EN
|-
| 2
| FR
|-
| 3
| DE
|-
| 4
| IT
|-
| 5
| ES
|-
| 6
| ZH
|-
| 7
| KO
|-
| 8
| NL
|-
| 9
| PT
|-
| 10
| RU
|}

===CountryInfo===
{| class="wikitable" border="1"
|-
! Byte
! Description
|-
| 0
| ?
|-
| 1
|?
|-
| 2
|?
|-
| 3
| Country code, same as DSi/Wii country codes. Value 0xFF is invalid.
|}

===0x000A0000 Block===
{| class="wikitable" border="1"
|-
! Byte
! Description
|-
| 0x0-0x13
| UTF-16 username, with no NULL-terminator.
|-
| 0x14-17
| Usually zero?
|-
| 0x18-0x1B
| u32 NGWord version the username was last checked with. If this value is less than the u32 stored in the NGWord CFA "romfs:/version.dat", the system then checks the username string with the bad-word list CFA again, then updates this field with the value from the CFA
|}

Config Savegame

2014-11-10T21:25:48Z

Vgturtle127: Fixes and some adjustments to formatting

This page describes the format of the [[Config_Services|Cfg]] [[System_SaveData|NAND]] savegame. These blocks can be accessed with the Cfg service commands.

==Structure of save-file "/config"==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x2
| Total entries
|-
| 0x2
| 0x2
| Data entries offset
|-
| 0x4
| 0x4558
| Block entries
|-
| 0x455C
|
| Data for the entries
|}

The filesize for this /config file is 0x8000-bytes.

==Configuration block entry ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| BlkID
|-
| 0x4
| 0x4
| Offset to the data for this block when size is >4, otherwise this word is the data for this block
|-
| 0x8
| 0x2
| Size
|-
| 0xA
| 0x2
| Flags
|}

==Configuration blocks==
{| class="wikitable" border="1"
|-
! BlkID
! Size
! Flags
! Description
|-
| 0x00050005
| 0x20
|?
| Stereo camera settings?
|-
| 0x00070001
| 0x1
|?
| Sound output mode?
|-
| 0x00080000
| 0xC00
| 0x2?
| WiFi configuration slot 0
|-
| 0x00080001
| 0xC00
| 0x2?
| WiFi configuration slot 1
|-
| 0x00080002
| 0xC00
| 0x2?
| WiFi configuration slot 2
|-
| 0x00090000
| 0x8
| 0x2?
| This contains a u64 ID, used by processes using [[NWMUDS:Initialize]]. The first word is the same as [[CfgS:GetLocalFriendCodeSeed|LocalFriendCodeSeed]], while the latter is a separate random word
|-
| 0x00090001
| 0x8
| 0xE
| This console-unique u64 used by [[Cfg:GenHashConsoleUnique|GenHashConsoleUnique]] is generated with the LocalFriendCodeSeed and with random data
|-
| 0x000A0000
| 0x1C
| 0xE
| Username
|-
| 0x000A0002
| 0x1
| 0xA
| Language
|-
| 0x000B0000
| 0x4
| 0x8
| CountryInfo
|-
| 0x000B0001
| 0x800
| 0x2?
| Country name in UTF-16, every 0x80-bytes is an entry for each language(not all entries are set)
|-
| 0x000B0002
| 0x800
| 0x2?
| State name in UTF-16, every 0x80-bytes is an entry for each language
|-
| 0x000C0000
| 0xC0
|?
| Restricted photo exchange data, and other info
|-
| 0x000C0001
| 0x14
|?
| Same as above?
|-
| 0x000D0000
| 0x4
|?
| u16 at offset 0x0: [[SMDH#EULA_Version|EULA Version]] which was agreed to.
|-
| 0x000F0000
| 0x10
| 0x8?
| Unknown, used by [[NS]] on dev-units for [[SVC|svcKernelSetState]], where Type is 6. During NS startup on debug-units, NS compares the u32 from +8 in this config-block with the [[Configuration_Memory#APPMEMTYPE|APPMEMTYPE]]. When those don't match NS starts a FIRM-launch (with the same FIRM titleID as the currently running one) to boot into a FIRM with the APPMEMTYPE value from this config-block
|-
| 0x000F0004
| 0x4
| 0x8?
| The first u8 is the System-Model [[Cfg:GetSystemModel|value]], the last 3-bytes are unknown
|-
| 0x00110000
| 0x4
|?
| The low u16 indicates whether the system setup is required, such as when the system is booted for the first time or after doing a [[System Settings|System Format]]: 0 = setup required, non-zero = no setup required
|-
| 0x00110001
| 0x8
| 0xA?
| TitleID of the menu to launch, used by [[NS]] on dev units (this block can be edited on dev units with [[3DS Development Unit Software#Config|Config]])
|-
| 0x00130000
| 0x4
|?
| If response is 0x100 then debug mode is enabled.
|-
| 0x00160000
| 0x4
| 0x8?
| Unknown, first byte is used by config service-cmd [[Config_Services|0x00070040]]. (Unknown whether the last 3-bytes are used)
|}

The dev unit TID block only exists on dev units.

===Languages===
{| class="wikitable" border="1"
|-
! ID
! Description
|-
| 0
| JP
|-
| 1
| EN
|-
| 2
| FR
|-
| 3
| DE
|-
| 4
| IT
|-
| 5
| ES
|-
| 6
| ZH
|-
| 7
| KO
|-
| 8
| NL
|-
| 9
| PT
|-
| 10
| RU
|}

===CountryInfo===
{| class="wikitable" border="1"
|-
! Byte
! Description
|-
| 0
| ?
|-
| 1
|?
|-
| 2
|?
|-
| 3
| Country code, same as DSi/Wii country codes. Value 0xFF is invalid.
|}

===0x000A0000 Block===
{| class="wikitable" border="1"
|-
! Byte
! Description
|-
| 0x0-0x13
| UTF-16 username, with no NULL-terminator.
|-
| 0x14-17
| Usually zero?
|-
| 0x18-0x1B
| u32 NGWord version the username was last checked with. If this value is less than the u32 stored in the NGWord CFA "romfs:/version.dat", the system then checks the username string with the bad-word list CFA again, then updates this field with the value from the CFA
|}

Config Savegame

2014-11-10T21:20:49Z

Vgturtle127: Data fix

This page describes the format of the [[Config_Services|Cfg]] [[System_SaveData|NAND]] savegame. These blocks can be accessed with the Cfg service commands.

==Structure of save-file "/config"==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x2
| Total entries
|-
| 0x2
| 0x2
| Data entries offset
|-
| 0x4
| 0x4558
| Block entries
|-
| 0x455C
|
| Data for the entries
|}

The filesize for this /config file is 0x8000-bytes.

==Configuration block entry ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| BlkID
|-
| 0x4
| 0x4
| Offset to the data for this block when size is >4, otherwise this word is the data for this block
|-
| 0x8
| 0x2
| Size
|-
| 0xA
| 0x2
| Flags
|}

==Configuration blocks==
{| class="wikitable" border="1"
|-
! BlkID
! Size
! Flags
! Description
|-
| 0x00050005
| 0x20
| ?
| Stereo camera settings?
|-
| 0x00070001
| 0x1
| ?
| Sound output mode?
|-
| 0x00080000
| 0xC00
| 0x2?
| Wifi configuration slot0.
|-
| 0x00080001
| 0xC00
| 0x2?
| Wifi configuration slot1.
|-
| 0x00080002
| 0xC00
| 0x2?
| Wifi configuration slot2.
|-
| 0x00090000
| 0x8
| 0x2?
| This contains a u64 ID, used by processes using [[NWMUDS:Initialize]]. The first word is the same as [[CfgS:GetLocalFriendCodeSeed|LocalFriendCodeSeed]], while the latter is a separate random word.
|-
| 0x00090001
| 0x8
| 0xE
| This console-unique u64 used by [[Cfg:GenHashConsoleUnique|GenHashConsoleUnique]] is generated with the LocalFriendCodeSeed and with random data.
|-
| 0x000A0000
| 0x1C
| 0xE
| Username
|-
| 0x000A0002
| 0x1
| 0xA
| Language
|-
| 0x000B0000
| 0x4
| 0x8
| CountryInfo
|-
| 0x000B0001
| 0x800
| 0x2?
| Country name in UTF-16, every 0x80-bytes is an entry for each language(not all entries are set).
|-
| 0x000B0002
| 0x800
| 0x2?
| State name in UTF-16, every 0x80-bytes is an entry for each language.
|-
| 0x000C0000
| 0xC0
| ?
| Restricted photo exchange data, and other info.
|-
| 0x000C0001
| 0x14
| ?
| Same as above?
|-
| 0x000D0000
| 0x4
| ?
| u16 at offset 0x0: [[SMDH#EULA_Version|EULA Version]] which was agreed to.
|-
| 0x000F0000
| 0x10
| 0x8?
| Unknown, used by [[NS]] on dev-units for [[SVC|svcKernelSetState]], where Type is 6. During NS startup on debug-units, NS compares the u32 from +8 in this config-block with the [[Configuration_Memory#APPMEMTYPE|APPMEMTYPE]]. When those don't match NS starts a FIRM-launch(with the same FIRM titleID as the currently running one) to boot into a FIRM with the APPMEMTYPE value from this config-block.
|-
| 0x000F0004
| 0x4
| 0x8?
| The first u8 is the System-Model [[Cfg:GetSystemModel|value]], the last 3-bytes are unknown.
|-
| 0x00110000
| 0x4
| ?
| The low u16 indicates whether the system setup is required, such as when the system is booted for the first time or after doing a [[System Settings|System Format]]: 0 = setup required, non-zero = no setup required.
|-
| 0x00110001
| 0x8
| 0xA?
| TitleID of the menu to launch, used by [[NS]] on dev units. (This block can be edited on dev units with [[3DS Development Unit Software#Config|Config]])
|-
| 0x00130000
| 0x4
| ?
| If response is 0x100 then debug mode is enabled.
|-
| 0x00160000
| 0x4
| 0x8?
| Unknown, first byte is used by config service-cmd [[Config_Services|0x00070040]]. (Unknown whether the last 3-bytes are used)
|}

The dev unit TID block only exists on dev units.

===Languages===
{| class="wikitable" border="1"
|-
! ID
! Description
|-
| 0
| ja
|-
| 1
| en
|-
| 2
| fr
|-
| 3
| de
|-
| 4
| it
|-
| 5
| es
|-
| 6
| zh
|-
| 7
| ko
|-
| 8
| nl
|-
| 9
| pt
|-
| 10
| ru
|}

===CountryInfo===
{| class="wikitable" border="1"
|-
! Byte
! Description
|-
| 0
| ?
|-
| 1
| ?
|-
| 2
| ?
|-
| 3
| Country code, same as DSi/Wii country codes. Value 0xff is invalid.
|}

===0x000A0000 Block===
{| class="wikitable" border="1"
|-
! Byte
! Description
|-
| 0x0-0x13
| UTF-16 username, with no NULL-terminator.
|-
| 0x14-17
| Usually zero?
|-
| 0x18-0x1B
| u32 NGWord version the username was last checked with. If this value is less than the u32 stored in the NGWord CFA "romfs:/version.dat", the system then checks the username string with the bad-word list CFA again, then updates this field with the value from the CFA.
|}

Extended Banner

2014-11-10T21:19:29Z

Vgturtle127: Fix date format

== Overview ==

The Extended Banner format is very simple. The Extended Banner is used to add text (and optionally an extra texture) to a given banner. It can also (optionally) be used to set an expiration date for a banner.

== Format ==

Extension: .BIN

{| class="wikitable" border="1"
|-
! OFFSET
! SIZE
! DESCRIPTION
|-
| 0x000
| 0x002
| Texture width (if texture is used)
|-
| 0x002
| 0x002
| Texture height (if texture is used)
|-
| 0x004
| 0x002
| Texture colour format (if texture is used)
|-
| 0x008
| 0x004
| Year to expire
|-
| 0x00C
| 0x002
| Month to expire
|-
| 0x010
| 0x002
| Day to expire
|-
| 0x014
| 0x015
| Name of texture (if texture is used)
|-
| 0x024
| 0x200
| Plain text comment (255 character max) to be displayed in the banner on the HOME Menu
|-
| 0x2A4
|
| If used, this is where the extra texture is located, otherwise file ends.
|-
|}

The date used for never-expiring exbanners varies, on retail like with Mii Maker this is December 31, 2099, where year is 0x833, month is 0xC, and day is 0x1F.

== Texture Colour Formats ==

{| class="wikitable" border="1"
|-
! CODE
! ENCODING
|-
| 0x00
| RGBA8
|-
| 0x01
| RGB8
|-
| 0x02
| RGBA5551
|-
| 0x03
| RGBA565
|-
| 0x04
| RGBA4
|-
| 0x05
| LA8
|-
| 0x06
| HILO8
|-
| 0x07
| L8
|-
| 0x08
| A8
|-
| 0x09
| LA4
|-
| 0x0A
| L4
|-
| 0x0B
| A4
|-
| 0x0C
| ETC1
|-
| 0x0D
| ETC1A4
|-
|}

Extended Banner

2014-11-10T21:18:24Z

Vgturtle127: Small fixes

== Overview ==

The Extended Banner format is very simple. The Extended Banner is used to add text (and optionally an extra texture) to a given banner. It can also (optionally) be used to set an expiration date for a banner.

== Format ==

Extension: .BIN

{| class="wikitable" border="1"
|-
! OFFSET
! SIZE
! DESCRIPTION
|-
| 0x000
| 0x002
| Texture width (if texture is used)
|-
| 0x002
| 0x002
| Texture height (if texture is used)
|-
| 0x004
| 0x002
| Texture colour format (if texture is used)
|-
| 0x008
| 0x004
| Year to expire
|-
| 0x00C
| 0x002
| Month to expire
|-
| 0x010
| 0x002
| Day to expire
|-
| 0x014
| 0x015
| Name of texture (if texture is used)
|-
| 0x024
| 0x200
| Plain text comment (255 character max) to be displayed in the banner on the HOME Menu
|-
| 0x2A4
|
| If used, this is where the extra texture is located, otherwise file ends.
|-
|}

The date used for never-expiring exbanners varies, on retail like with Mii Maker this is December 31 2099, where year is 0x833, month is 0xC, and day is 0x1F.

== Texture Colour Formats ==

{| class="wikitable" border="1"
|-
! CODE
! ENCODING
|-
| 0x00
| RGBA8
|-
| 0x01
| RGB8
|-
| 0x02
| RGBA5551
|-
| 0x03
| RGBA565
|-
| 0x04
| RGBA4
|-
| 0x05
| LA8
|-
| 0x06
| HILO8
|-
| 0x07
| L8
|-
| 0x08
| A8
|-
| 0x09
| LA4
|-
| 0x0A
| L4
|-
| 0x0B
| A4
|-
| 0x0C
| ETC1
|-
| 0x0D
| ETC1A4
|-
|}

Nintendo Video

2014-11-10T21:15:01Z

Vgturtle127: Fix my wording

'''Nintendo Video''' is a service allowing owners of American, Japanese, and European 3DS's to download and watch various videos offered by Nintendo. Nintendo Video uses SpotPass to download videos, even when the Nintendo Video app itself is not running. Nintendo Video was discontinued March 31, 2014.

'''Eurosport''' is a service similar to '''Nintendo Video''' and allowing owners of European 3DS's to download and watch various videos offered by Eurosport. Eurosport was discontinued December 31, 2012.

== Internet connection ==

To identify your 3DS's region and country, different URLs are requested by 3DS's from different countries. A URL contains a subdomain that's specific for your region (EU/USA/JP), a country code that's specific to your country, and a language code. Here's a table containing country codes and subdomains known so far and their corresponding file names:

{| class="wikitable"
|-
! Country
! Region subdomain
! File name
|-
| EUR (Nintendo Video)
| pubeu-p
| ESP_MD
|-
| EUR (Eurosport)
| pubes-p
| EWP_MD
|-
| USA
| pubus-p
| ESE_MD
|-
| Japan
| pubjp-p
| ESJ_MD
|}

See http://www.wiibrew.org/wiki/Country_Codes for the country codes.

Language codes known so far:
{| class="wikitable"
|-
! Language
! Code
! Region
|-
| Japanese
| 0
| Japan
|-
| English
| 1
| EUR/USA
|-
| French
| 2
| EUR/USA
|-
| German
| 3
| EUR
|-
| Italian
| 4
| EUR
|-
| Spanish
| 5
| EUR/USA
|-
| Netherlands
| 8
| EUR
|-
| Portuguese
| 9
| EUR/USA
|-
| Russian
| 10
| EUR
|}

In all requests below, ''COUNTRYCODE'' should be replaced with your country's code, ''COUNTRYSUBDOMAIN'' should be replaced with your region's subdomain. ''FILENAME'' are also depends on the region and should be replaced correspondingly. ''LANGUAGECODE'' should be replaced by a desired language (by now most of the content are the same for all available languages, so one can use "1" as a most common).

Surprisingly, Nintendo Video uses plain unencrypted HTTP connection to transfer videos. When "connectivity check" button is pressed, Nintendo Video sends a following HTTP request to ''COUNTRYSUBDOMAIN''.est.c.app.nintendowifi.net:

<tt>GET /1/''COUNTRYCODE''/''LANGUAGECODE''/CHECK HTTP/1.1

Host: ''COUNTRYSUBDOMAIN''.est.c.app.nintendowifi.net</tt>

As you can see, no console-specific data is being sent. The server responds with either a 403 or 404 error code, where 403 means that user's region (determined by IP, I guess) doesn't match the region specified by ''COUNTRYCODE'' and ''COUNTRYSUBDOMAIN'' and 404 means that everything's OK.

If everything is OK with the region check, the 3DS proceeds to download videos. It seems that support for only four videos is hardcoded into Nintendo Video app, because it makes following requests (to the same server as the CHECK query):

<tt>GET /1/''COUNTRYCODE''/''LANGUAGECODE''/''FILENAME''1 HTTP/1.1

Host: ''COUNTRYSUBDOMAIN''.est.c.app.nintendowifi.net</tt>

<tt>GET /1/''COUNTRYCODE''/''LANGUAGECODE''/''FILENAME''2 HTTP/1.1

Host: ''COUNTRYSUBDOMAIN''.est.c.app.nintendowifi.net</tt>

<tt>GET /1/''COUNTRYCODE''/''LANGUAGECODE''/''FILENAME''3 HTTP/1.1

Host: ''COUNTRYSUBDOMAIN''.est.c.app.nintendowifi.net</tt>

<tt>GET /1/''COUNTRYCODE''/''LANGUAGECODE''/''FILENAME''4 HTTP/1.1

Host: ''COUNTRYSUBDOMAIN''.est.c.app.nintendowifi.net</tt>

''FILENAME'' seems to return a 403 error if the user's region doesn't match, 404 if the video doesn't exist and the video itself otherwise. As of July 18th, 2011, only 1st and 2nd videos are available from UK IP addresses.

For Japan region /1/1/0/ESJ_CNF must also present on a server in order to play video files.

These videos can easily be downloaded from any computer with IP address that matches country specified by ''COUNTRYCODE'', ''COUNTRYSUBDOMAIN'' and ''LANGUAGECODE'' using wget without any special settings. Videos are region-locked.

== SD storage ==
Downloaded videos are stored in the SD card [[Extdata]], from the decrypted [[SpotPass]] content payload. Country info is presumably stored in this metadata, region-lock is handled by the BOSS module via the programID in the [[SpotPass#Payload Content Header|payload header]]. At the end of the video file is a JPEG, which contains the video thumbnail, and various metadata in the EXIF including the URL associated with the video. The text shown on the web browser button is also stored in the EXIF.

All of these fields are big-endian?
Structure of this SD data:
{| class="wikitable"
|-
! Offset
! Length
! Notes
|-
| 0x0
| 4
| Unknown, value is 0x18
|-
| 0x4
| 0x14
|?
|-
| 0x18
| 8
| TitleID of Nintendo Video
|-
| 0x20
| 0x8
|?
|-
| 0x28
| 0x4
| Total filesize?
|-
| 0x2c
| 0x2c
| Unknown, some countries' videos have two extra words added here?
|-
| 0x58
| 0x20
| ASCII video ID? M<shortvidtitle>video ID
|-
| 0x68
| 0x20
|?
|-
| 0x88
| 0x78
| UTF-16 video title
|-
| 0x100
| 0xc
|?
|-
| 0x10c
| 0x190
| UTF-16 video description
|-
| 0x29c
| 0x20
| Another ASCII video ID? I<shortvidtitle>video ID
|-
| 0x2bc
| Video size
| Mobiclip .moflex video data (first word here is little-endian magic number 0xABAA324C)
|}

== File format ==

The SpotPass content downloaded for Nintendo Video uses the [[SpotPass]] content container format, see the SpotPass page for info on the container format. See the above SD storage section for info on the cleartext payload.

Region info is stored in the decrypted SpotPass crypto layer, see above SD section.

== Server spoofing ==

In case you want to try messing with Nintendo Video, here's a description of what I did:

# Set up a DNS server using bind9, which returned my IP as the IP for pubeu-p.est.c.app.nintendowifi.net [http://pastie.org/2230422 (bind config)].
## Don't forget to replace MY_IP in config with your IP address, but '''don't''' replace the IP of conntest.nintendowifi.net service
# Set up an HTTP server using nginx and put ESP_MD1, ESP_MD2 (which I have downloaded from Nintendo's servers earlier, see above) in my /var/www/1/110/1/ folder.
# Configured my 3DS to use my DNS server as both primary and secondary DNS server.
# ???
# PROFIT!

This can be done with any DNS server and HTTP server, as long as you spoof everything correctly. It is possible on Windows. I have not tried Mac OS X.

Unfortunately, this currently has little use since Nintendo shut the services down. However, they can still be spoofed if you have everything still on your 3DS. Spoofing your own videos could be possible, but you can already watch videos with the web browser and something like Universal Media Server.

== External links ==
* [http://www.youtube.com/watch?v=Tl8QYofL1tg A video showing Nintendo Video server being spoofed]

Nintendo Video

2014-11-10T21:13:35Z

Vgturtle127: Small fixes

'''Nintendo Video''' is a service allowing owners of American, Japanese, and European 3DS's to download and watch various videos offered by Nintendo. Nintendo Video uses SpotPass to download videos, even when the Nintendo Video app itself is not running. Nintendo Video was discontinued March 31, 2014.

'''Eurosport''' is a service similar to '''Nintendo Video''' and allowing owners of European 3DS's to download and watch various videos offered by Eurosport. Eurosport was discontinued December 31, 2012.

== Internet connection ==

To identify your 3DS's region and country, different URLs are requested by 3DS's from different countries. A URL contains a subdomain that's specific for your region (EU/USA/JP), a country code that's specific to your country, and a language code. Here's a table containing country codes and subdomains known so far and their corresponding file names:

{| class="wikitable"
|-
! Country
! Region subdomain
! File name
|-
| EUR (Nintendo Video)
| pubeu-p
| ESP_MD
|-
| EUR (Eurosport)
| pubes-p
| EWP_MD
|-
| USA
| pubus-p
| ESE_MD
|-
| Japan
| pubjp-p
| ESJ_MD
|}

See http://www.wiibrew.org/wiki/Country_Codes for the country codes.

Language codes known so far:
{| class="wikitable"
|-
! Language
! Code
! Region
|-
| Japanese
| 0
| Japan
|-
| English
| 1
| EUR/USA
|-
| French
| 2
| EUR/USA
|-
| German
| 3
| EUR
|-
| Italian
| 4
| EUR
|-
| Spanish
| 5
| EUR/USA
|-
| Netherlands
| 8
| EUR
|-
| Portuguese
| 9
| EUR/USA
|-
| Russian
| 10
| EUR
|}

In all requests below, ''COUNTRYCODE'' should be replaced with your country's code, ''COUNTRYSUBDOMAIN'' should be replaced with your region's subdomain. ''FILENAME'' are also depends on the region and should be replaced correspondingly. ''LANGUAGECODE'' should be replaced by a desired language (by now most of the content are the same for all available languages, so one can use "1" as a most common).

Surprisingly, Nintendo Video uses plain unencrypted HTTP connection to transfer videos. When "connectivity check" button is pressed, Nintendo Video sends a following HTTP request to ''COUNTRYSUBDOMAIN''.est.c.app.nintendowifi.net:

<tt>GET /1/''COUNTRYCODE''/''LANGUAGECODE''/CHECK HTTP/1.1

Host: ''COUNTRYSUBDOMAIN''.est.c.app.nintendowifi.net</tt>

As you can see, no console-specific data is being sent. The server responds with either a 403 or 404 error code, where 403 means that user's region (determined by IP, I guess) doesn't match the region specified by ''COUNTRYCODE'' and ''COUNTRYSUBDOMAIN'' and 404 means that everything's OK.

If everything is OK with the region check, the 3DS proceeds to download videos. It seems that support for only four videos is hardcoded into Nintendo Video app, because it makes following requests (to the same server as the CHECK query):

<tt>GET /1/''COUNTRYCODE''/''LANGUAGECODE''/''FILENAME''1 HTTP/1.1

Host: ''COUNTRYSUBDOMAIN''.est.c.app.nintendowifi.net</tt>

<tt>GET /1/''COUNTRYCODE''/''LANGUAGECODE''/''FILENAME''2 HTTP/1.1

Host: ''COUNTRYSUBDOMAIN''.est.c.app.nintendowifi.net</tt>

<tt>GET /1/''COUNTRYCODE''/''LANGUAGECODE''/''FILENAME''3 HTTP/1.1

Host: ''COUNTRYSUBDOMAIN''.est.c.app.nintendowifi.net</tt>

<tt>GET /1/''COUNTRYCODE''/''LANGUAGECODE''/''FILENAME''4 HTTP/1.1

Host: ''COUNTRYSUBDOMAIN''.est.c.app.nintendowifi.net</tt>

''FILENAME'' seems to return a 403 error if the user's region doesn't match, 404 if the video doesn't exist and the video itself otherwise. As of July 18th, 2011, only 1st and 2nd videos are available from UK IP addresses.

For Japan region /1/1/0/ESJ_CNF must also present on a server in order to play video files.

These videos can easily be downloaded from any computer with IP address that matches country specified by ''COUNTRYCODE'', ''COUNTRYSUBDOMAIN'' and ''LANGUAGECODE'' using wget without any special settings. Videos are region-locked.

== SD storage ==
Downloaded videos are stored in the SD card [[Extdata]], from the decrypted [[SpotPass]] content payload. Country info is presumably stored in this metadata, region-lock is handled by the BOSS module via the programID in the [[SpotPass#Payload Content Header|payload header]]. At the end of the video file is a JPEG, which contains the video thumbnail, and various metadata in the EXIF including the URL associated with the video. The text shown on the web browser button is also stored in the EXIF.

All of these fields are big-endian?
Structure of this SD data:
{| class="wikitable"
|-
! Offset
! Length
! Notes
|-
| 0x0
| 4
| Unknown, value is 0x18
|-
| 0x4
| 0x14
|?
|-
| 0x18
| 8
| TitleID of Nintendo Video
|-
| 0x20
| 0x8
|?
|-
| 0x28
| 0x4
| Total filesize?
|-
| 0x2c
| 0x2c
| Unknown, some countries' videos have two extra words added here?
|-
| 0x58
| 0x20
| ASCII video ID? M<shortvidtitle>video ID
|-
| 0x68
| 0x20
|?
|-
| 0x88
| 0x78
| UTF-16 video title
|-
| 0x100
| 0xc
|?
|-
| 0x10c
| 0x190
| UTF-16 video description
|-
| 0x29c
| 0x20
| Another ASCII video ID? I<shortvidtitle>video ID
|-
| 0x2bc
| Video size
| Mobiclip .moflex video data (first word here is little-endian magic number 0xABAA324C)
|}

== File format ==

The SpotPass content downloaded for Nintendo Video uses the [[SpotPass]] content container format, see the SpotPass page for info on the container format. See the above SD storage section for info on the cleartext payload.

Region info is stored in the decrypted SpotPass crypto layer, see above SD section.

== Server spoofing ==

In case you want to try messing with Nintendo Video, here's a description of what I did:

# Set up a DNS server using bind9, which returned my IP as the IP for pubeu-p.est.c.app.nintendowifi.net [http://pastie.org/2230422 (bind config)].
## Don't forget to replace MY_IP in config with your IP address, but '''don't''' replace the IP of conntest.nintendowifi.net service
# Set up an HTTP server using nginx and put ESP_MD1, ESP_MD2 (which I have downloaded from Nintendo's servers earlier, see above) in my /var/www/1/110/1/ folder.
# Configured my 3DS to use my DNS server as both primary and secondary DNS server.
# ???
# PROFIT!

This can be done with any DNS server and HTTP server, as long as you spoof everything correctly. It is possible on Windows. I have not tried Mac OS X.

Unfortunately, this currently has little use since Nintendo shut the services down. However, they can still be spoofed if you have everything still on your 3DS. Spoofing your own videos could be possible, but you can already do that with the web browser and something like Universal Media Server.

== External links ==
* [http://www.youtube.com/watch?v=Tl8QYofL1tg A video showing Nintendo Video server being spoofed]

Nintendo Video

2014-11-10T21:10:52Z

Vgturtle127: Fixes

'''Nintendo Video''' is a service allowing owners of American, Japanese, and European 3DS's to download and watch various videos offered by Nintendo. Nintendo Video uses SpotPass to download videos, even when the Nintendo Video app itself is not running. Nintendo Video was discontinued March 31, 2014.

'''Eurosport''' is a service similar to '''Nintendo Video''' and allowing owners of European 3DS's to download and watch various videos offered by Eurosport. Eurosport was discontinued December 31, 2012.

== Internet connection ==

To identify your 3DS's region and country, different URLs are requested by 3DS's from different countries. A URL contains a subdomain that's specific for your region (EU/USA/JP), a country code that's specific to your country, and a language code. Here's a table containing country codes and subdomains known so far and their corresponding file names:

{| class="wikitable"
|-
! Country
! Region subdomain
! File name
|-
| EUR (Nintendo Video)
| pubeu-p
| ESP_MD
|-
| EUR (Eurosport)
| pubes-p
| EWP_MD
|-
| USA
| pubus-p
| ESE_MD
|-
| Japan
| pubjp-p
| ESJ_MD
|}

See http://www.wiibrew.org/wiki/Country_Codes for the country codes.

Language codes known so far:
{| class="wikitable"
|-
! Language
! Code
! Region
|-
| Japanese
| 0
| Japan
|-
| English
| 1
| EUR/USA
|-
| French
| 2
| EUR/USA
|-
| German
| 3
| EUR
|-
| Italian
| 4
| EUR
|-
| Spanish
| 5
| EUR/USA
|-
| Netherlands
| 8
| EUR
|-
| Portuguese
| 9
| EUR/USA
|-
| Russian
| 10
| EUR
|}

In all requests below, ''COUNTRYCODE'' should be replaced with your country's code, ''COUNTRYSUBDOMAIN'' should be replaced with your region's subdomain. ''FILENAME'' are also depends on the region and should be replaced correspondingly. ''LANGUAGECODE'' should be replaced by a desired language (by now most of the content are the same for all available languages, so one can use "1" as a most common).

Surprisingly, Nintendo Video uses plain unencrypted HTTP connection to transfer videos. When "connectivity check" button is pressed, Nintendo Video sends a following HTTP request to ''COUNTRYSUBDOMAIN''.est.c.app.nintendowifi.net:

<tt>GET /1/''COUNTRYCODE''/''LANGUAGECODE''/CHECK HTTP/1.1

Host: ''COUNTRYSUBDOMAIN''.est.c.app.nintendowifi.net</tt>

As you can see, no console-specific data is being sent. The server responds with either a 403 or 404 error code, where 403 means that user's region (determined by IP, I guess) doesn't match the region specified by ''COUNTRYCODE'' and ''COUNTRYSUBDOMAIN'' and 404 means that everything's OK.

If everything is OK with the region check, the 3DS proceeds to download videos. It seems that support for only four videos is hardcoded into Nintendo Video app, because it makes following requests (to the same server as the CHECK query):

<tt>GET /1/''COUNTRYCODE''/''LANGUAGECODE''/''FILENAME''1 HTTP/1.1

Host: ''COUNTRYSUBDOMAIN''.est.c.app.nintendowifi.net</tt>

<tt>GET /1/''COUNTRYCODE''/''LANGUAGECODE''/''FILENAME''2 HTTP/1.1

Host: ''COUNTRYSUBDOMAIN''.est.c.app.nintendowifi.net</tt>

<tt>GET /1/''COUNTRYCODE''/''LANGUAGECODE''/''FILENAME''3 HTTP/1.1

Host: ''COUNTRYSUBDOMAIN''.est.c.app.nintendowifi.net</tt>

<tt>GET /1/''COUNTRYCODE''/''LANGUAGECODE''/''FILENAME''4 HTTP/1.1

Host: ''COUNTRYSUBDOMAIN''.est.c.app.nintendowifi.net</tt>

''FILENAME'' seems to return a 403 error if the user's region doesn't match, 404 if the video doesn't exist and the video itself otherwise. As of July 18th, 2011, only 1st and 2nd videos are available from UK IP addresses.

For Japan region /1/1/0/ESJ_CNF must also present on a server in order to play video files.

These videos can easily be downloaded from any computer with IP address that matches country specified by ''COUNTRYCODE'', ''COUNTRYSUBDOMAIN'' and ''LANGUAGECODE'' using wget without any special settings. Videos are region-locked.

== SD storage ==
Downloaded videos are stored in the SD card [[Extdata]], from the decrypted [[SpotPass]] content payload. Country info is presumably stored in this metadata, region-lock is handled by the BOSS module via the programID in the [[SpotPass#Payload Content Header|payload header]]. At the end of the video file is a JPEG, which contains the video thumbnail, and various metadata in the EXIF including the URL associated with the video. The text shown on the web browser button is also stored in the EXIF.

All of these fields are big-endian?
Structure of this SD data:
{| class="wikitable"
|-
! Offset
! Length
! Notes
|-
| 0x0
| 4
| Unknown, value is 0x18
|-
| 0x4
| 0x14
|?
|-
| 0x18
| 8
| TitleID of Nintendo Video
|-
| 0x20
| 0x8
|?
|-
| 0x28
| 0x4
| Total filesize?
|-
| 0x2c
| 0x2c
| Unknown, some countries' videos have two extra words added here?
|-
| 0x58
| 0x20
| ASCII Video ID? M<shortvidtitle>video ID
|-
| 0x68
| 0x20
|?
|-
| 0x88
| 0x78
| UTF-16 video title
|-
| 0x100
| 0xc
|?
|-
| 0x10c
| 0x190
| UTF-16 video description
|-
| 0x29c
| 0x20
| Another ASCII video ID? I<shortvidtitle>video ID
|-
| 0x2bc
| Video size
| Mobiclip .moflex video data (first word here is little-endian magic number 0xABAA324C)
|}

== File format ==

The SpotPass content downloaded for Nintendo Video uses the [[SpotPass]] content container format, see the SpotPass page for info on the container format. See the above SD storage section for info on the cleartext payload.

Region info is stored in the decrypted SpotPass crypto layer, see above SD section.

== Server spoofing ==

In case you want to try messing with Nintendo Video, here's a description of what I did:

# Set up a DNS server using bind9, which returned my IP as the IP for pubeu-p.est.c.app.nintendowifi.net [http://pastie.org/2230422 (bind config)].
## Don't forget to replace MY_IP in config with your IP address, but '''don't''' replace the IP of conntest.nintendowifi.net service
# Set up an HTTP server using nginx and put ESP_MD1, ESP_MD2 (which I have downloaded from Nintendo's servers earlier, see above) in my /var/www/1/110/1/ folder.
# Configured my 3DS to use my DNS server as both primary and secondary DNS server.
# ???
# PROFIT!

This can be done with any DNS server and HTTP server, as long as you spoof everything correctly. It is possible on Windows. I have not tried Mac OS X.

Unfortunately, this currently has little use since Nintendo shut the services down. However, they can still be spoofed if you have everything still on your 3DS. Spoofing your own videos could be possible, but you can already do that with the web browser and something like Universal Media Server.

== External links ==
* [http://www.youtube.com/watch?v=Tl8QYofL1tg A video showing Nintendo Video server being spoofed]

Nintendo Video

2014-11-10T21:09:45Z

Vgturtle127: Fix some stuff, add some notes about the service and some personal tests.

'''Nintendo Video''' is a service allowing owners of American, Japanese, and European 3DS's to download and watch various videos offered by Nintendo. Nintendo Video uses SpotPass to download videos, even when the Nintendo Video app itself is not running. Nintendo Video was discontinued March 31, 2014.

'''Eurosport''' is a service similar to '''Nintendo Video''' and allowing owners of European 3DS's to download and watch various videos offered by Eurosport. Eurosport was discontinued December 31, 2012.

== Internet connection ==

To identify your 3DS's region and country, different URLs are requested by 3DS's from different countries. A URL contains a subdomain that's specific for your region (EU/USA/JP), a country code that's specific to your country, and a language code. Here's a table containing country codes and subdomains known so far and their corresponding file names:

{| class="wikitable"
|-
! Country
! Region subdomain
! File name
|-
| EUR (Nintendo Video)
| pubeu-p
| ESP_MD
|-
| EUR (Eurosport)
| pubes-p
| EWP_MD
|-
| USA
| pubus-p
| ESE_MD
|-
| Japan
| pubjp-p
| ESJ_MD
|}

See http://www.wiibrew.org/wiki/Country_Codes for the country codes.

Language codes known so far:
{| class="wikitable"
|-
! Language
! Code
! Region
|-
| Japanese
| 0
| Japan
|-
| English
| 1
| EUR/USA
|-
| French
| 2
| EUR/USA
|-
| German
| 3
| EUR
|-
| Italian
| 4
| EUR
|-
| Spanish
| 5
| EUR/USA
|-
| Netherlands
| 8
| EUR
|-
| Portuguese
| 9
| EUR/USA
|-
| Russian
| 10
| EUR
|}

In all requests below, ''COUNTRYCODE'' should be replaced with your country's code, ''COUNTRYSUBDOMAIN'' should be replaced with your region's subdomain. ''FILENAME'' are also depends on the region and should be replaced correspondingly. ''LANGUAGECODE'' should be replaced by a desired language (by now most of the content are the same for all available languages, so one can use "1" as a most common).

Surprisingly, Nintendo Video uses plain unencrypted HTTP connection to transfer videos. When "connectivity check" button is pressed, Nintendo Video sends a following HTTP request to ''COUNTRYSUBDOMAIN''.est.c.app.nintendowifi.net:

<tt>GET /1/''COUNTRYCODE''/''LANGUAGECODE''/CHECK HTTP/1.1

Host: ''COUNTRYSUBDOMAIN''.est.c.app.nintendowifi.net</tt>

As you can see, no console-specific data is being sent. The server responds with either a 403 or 404 error code, where 403 means that user's region (determined by IP, I guess) doesn't match the region specified by ''COUNTRYCODE'' and ''COUNTRYSUBDOMAIN'' and 404 means that everything's OK.

If everything is OK with the region check, the 3DS proceeds to download videos. It seems that support for only four videos is hardcoded into Nintendo Video app, because it makes following requests (to the same server as the CHECK query):

<tt>GET /1/''COUNTRYCODE''/''LANGUAGECODE''/''FILENAME''1 HTTP/1.1

Host: ''COUNTRYSUBDOMAIN''.est.c.app.nintendowifi.net</tt>

<tt>GET /1/''COUNTRYCODE''/''LANGUAGECODE''/''FILENAME''2 HTTP/1.1

Host: ''COUNTRYSUBDOMAIN''.est.c.app.nintendowifi.net</tt>

<tt>GET /1/''COUNTRYCODE''/''LANGUAGECODE''/''FILENAME''3 HTTP/1.1

Host: ''COUNTRYSUBDOMAIN''.est.c.app.nintendowifi.net</tt>

<tt>GET /1/''COUNTRYCODE''/''LANGUAGECODE''/''FILENAME''4 HTTP/1.1

Host: ''COUNTRYSUBDOMAIN''.est.c.app.nintendowifi.net</tt>

''FILENAME'' seems to return a 403 error if the user's region doesn't match, 404 if the video doesn't exist and the video itself otherwise. As of July 18th, 2011, only 1st and 2nd videos are available from UK IP addresses.

For Japan region /1/1/0/ESJ_CNF must also present on a server in order to play video files.

These videos can easily be downloaded from any computer with IP address that matches country specified by ''COUNTRYCODE'', ''COUNTRYSUBDOMAIN'' and ''LANGUAGECODE'' using wget without any special settings. Videos are region-locked.

== SD storage ==
Downloaded videos are stored in the SD card [[Extdata]], from the decrypted [[SpotPass]] content payload. Country info is presumably stored in this metadata, region-lock is handled by the BOSS module via the programID in the [[SpotPass#Payload Content Header|payload header]]. At the end of the video file is a JPEG, which contains the video thumbnail, and various metadata in the EXIF including the URL associated with the video. The text shown on the web browser button is also stored in the EXIF.

All of these fields are big-endian?
Structure of this SD data:
{| class="wikitable"
|-
! Offset
! Length
! Notes
|-
| 0x0
| 4
| Unknown, value is 0x18
|-
| 0x4
| 0x14
|?
|-
| 0x18
| 8
| TitleID of Nintendo Video
|-
| 0x20
| 0x8
|?
|-
| 0x28
| 0x4
| Total filesize?
|-
| 0x2c
| 0x2c
| Unknown, some countries' videos have two extra words added here?
|-
| 0x58
| 0x20
| ASCII Video ID? M<shortvidtitle>video ID
|-
| 0x68
| 0x20
|?
|-
| 0x88
| 0x78
| UTF-16 video title
|-
| 0x100
| 0xc
|?
|-
| 0x10c
| 0x190
| UTF-16 video description
|-
| 0x29c
| 0x20
| Another ASCII video ID? I<shortvidtitle>someid
|-
| 0x2bc
| Video size
| Mobiclip .moflex video data (first word here is little-endian magic number 0xABAA324C)
|}

== File format ==

The SpotPass content downloaded for Nintendo Video uses the [[SpotPass]] content container format, see the SpotPass page for info on the container format. See the above SD storage section for info on the cleartext payload.

Region info is stored in the decrypted SpotPass crypto layer, see above SD section.

== Server spoofing ==

In case you want to try messing with Nintendo Video, here's a description of what I did:

# Set up a DNS server using bind9, which returned my IP as the IP for pubeu-p.est.c.app.nintendowifi.net [http://pastie.org/2230422 (bind config)].
## Don't forget to replace MY_IP in config with your IP address, but '''don't''' replace the IP of conntest.nintendowifi.net service
# Set up an HTTP server using nginx and put ESP_MD1, ESP_MD2 (which I have downloaded from Nintendo's servers earlier, see above) in my /var/www/1/110/1/ folder.
# Configured my 3DS to use my DNS server as both primary and secondary DNS server.
# ???
# PROFIT!

This can be done with any DNS server and HTTP server, as long as you spoof everything correctly. It is possible on Windows. I have not tried Mac OS X.

Unfortunately, this currently has little use since Nintendo shut the services down. However, they can still be spoofed if you have everything still on your 3DS. Spoofing your own videos could be possible, but you can already do that with the web browser and something like Universal Media Server.

== External links ==
* [http://www.youtube.com/watch?v=Tl8QYofL1tg A video showing Nintendo Video server being spoofed]

EShop Demos

2014-11-10T20:58:29Z

Vgturtle127: Minor fix

[[Title list|Go Back to Title list]]

== Overview ==
These titles have limited uses. For a given unique ID, there can be a maximum of 254 separate demos. Each demo is indexed by the Title ID variation. The legal demo index range: 0x1 - 0xFF.

The maximum play count is stored in the [[ticket]]. The current play count for demos is stored in the [[Application_Manager_Services|AM-module]] [[System_SaveData]].

== List ==
{| class="wikitable" border="1"
|-
! TitleID Low
! Region
! Description
! Versions
|-
| 00030B01
| JPN
| Nintendogs & Cats: Golden Retreiver Demo
| v0
|-
| 00030C01
| EUR
| Nintendogs & Cats: Golden Retreiver Demo
| v0
|-
| 00030D01
| USA
| Nintendogs & Cats: Golden Retreiver Demo
| v0
|-
| 00032001
|?
|?
| v16
|-
| 00032101
|?
|?
| v80
|-
| 00036F01
|?
|?
| v16
|-
| 00037101
| USA
| CRUSH3D Demo
| v0
|-
| 00038A01
| EUR
| DOA Dimensions Demo
| v0
|-
| 00039B01
|?
|?
| v0
|-
| 00040401
| EUR
| CRUSH3D Demo
| v0
|-
| 00043701
|?
|?
| v0
|-
| 00047E01
|?
|?
| v0
|-
| 00048001
|?
|?
| v0
|-
| 00048101
| JPN
| Monster Hunter Tri G Demo
| v0
|-
| 0004EE01
|?
|?
| v0
|-
| 00053B01
|?
|?
| v0
|-
| 00054801
| USA
| Mario & Sonic at the London 2012 Olympic Games Demo
| v0
|-
| 00054901
| EUR
| Mario & Sonic at the London 2012 Olympic Games Demo
| v0
|-
| 00056601
|?
|?
| v16
|-
| 00056A01
|?
|?
| v32
|-
| 00057601
|?
|?
| v16
|-
| 0005A201
| USA
| LEGO Batman 2 DC Super Heroes Demo
| v0
|-
| 0005A401
| EUR
| LEGO Batman 2 DC Super Heroes Demo
| v0
|-
| 0005A501
| EUR
| RAYMAN ORIGINS Demo
| v0
|-
| 0005DE01
|?
|?
| v16
|-
| 0005E301
|?
|?
| v16
|-
| 0005E901
|?
|?
| v16
|-
| 0005ED01
| EUR
| Cooking Mama 4 Demo
| v0
|-
| 0005EE01
| EUR
| Resident Evil Revelations Demo
| v0
|-
| 00060201
| USA
| Resident Evil Revelations Demo
| v0
|-
| 00060F01
| EUR
| Pyramids Demo
| v0
|-
| 00064701
|?
|?
| v0
|-
| 00065701
|?
|?
| v32
|-
| 00065A01
|?
|?
| v0
|-
| 00067601
| USA
| Rhythm Thief Demo
| v0
|-
| 00068201
| USA
| Pyramids Demo
| v0
|-
| 0006DA01
| EUR
| Rhythm Thief Demo
| v0
|-
| 00071F01
|?
|?
| v32
|-
| 00072A01
|?
|?
| v32
|-
| 00074001
| EUR
| Heroes of Ruin Demo
| v0
|-
| 00074701
|?
|?
| v0
|-
| 00075101
| USA
| Heroes of Ruin Demo
| v0
|-
| 00077E01
|?
|?
| v16
|-
| 00078101
|?
|?
| v0
|-
| 00078201
|?
|?
| v0
|-
| 0007A001
|?
|?
| v0
|-
| 00080101
|?
|?
| v16
|-
| 00081E01
| USA
| Metal Gear Solid Snake Eater 3D Demo
| v0
|-
| 00082401
| EUR
| Metal Gear Solid Snake Eater 3D Demo
| v0
|-
| 00086101
| EUR
| Farming Simulator 2012 3D Demo
| v0
|-
| 00086601
| USA
| Mutant Mudds 3d Demo
| v0
|-
| 00088901
| USA
| The Amazing Spider-Man
| v0
|-
| 0008C601
|?
|?
| v0
|-
| 0008D301
| USA
| Kingdom Hearts 3D Dream Drop Distance Demo
| v0
|-
| 00090B01
|?
|?
| v0
|-
| 00090D01
|?
|?
| v0
|-
| 00090F01
|?
|?
| v0
|-
| 00091601
| EUR
| THEATRHYTHM Final Fantasy Demo
| v0
|-
| 00092B01
|?
|?
| v0
|-
| 00095101
|?
|?
| v0
|-
| 00095501
| EUR
| Kingdom Hearts 3D Dream Drop Distance Demo
| v0
|-
| 00095B01
|?
|?
| v0
|-
| 0009D201
| USA
| Order Up! Demo
| v0
|-
| 000A4D01
|?
|?
| v0
|-
| 000A5401
| EUR
| Mutant Mudds Demo
| v0
|-
| 000AC801
|?
|?
| v0
|-
| 000ADE01
|?
|?
| v0
|}

EShop Demos

2014-11-10T20:56:49Z

Vgturtle127: Minor edits, some corrections

[[Title list|Go Back to Title list]]

== Overview ==
These titles have limited uses. For a given unique ID, there can be a maximum of 254 separate demos. Each demo is indexed by the Title ID variation. The legal demo index range: 0x1 - 0xFF.

The maximum play count is stored in the [[ticket]]. The current play count for demos is stored in the [[Application_Manager_Services|AM-module]] [[System_SaveData]].

== List ==
{| class="wikitable" border="1"
|-
! TitleID Low
! Region
! Description
! Versions
|-
| 00030B01
| JPN
| Nintendogs & Cats: Golden Retreiver Demo
| v0
|-
| 00030C01
| EUR
| Nintendogs & Cats: Golden Retreiver Demo
| v0
|-
| 00030D01
| USA
| Nintendogs & Cats: Golden Retreiver Demo
| v0
|-
| 00032001
|?
|?
| v16
|-
| 00032101
| ?
| ?
| v80
|-
| 00036F01
|?
|?
| v16
|-
| 00037101
| USA
| CRUSH3D Demo
| v0
|-
| 00038A01
| EUR
| DOA Dimensions Demo
| v0
|-
| 00039B01
|?
|?
| v0
|-
| 00040401
| EUR
| CRUSH3D Demo
| v0
|-
| 00043701
|?
|?
| v0
|-
| 00047E01
|?
|?
| v0
|-
| 00048001
|?
|?
| v0
|-
| 00048101
| JPN
| Monster Hunter Tri G Demo
| v0
|-
| 0004EE01
|?
|?
| v0
|-
| 00053B01
|?
|?
| v0
|-
| 00054801
| USA
| Mario & Sonic at the London 2012 Olympic Games Demo
| v0
|-
| 00054901
| EUR
| Mario & Sonic at the London 2012 Olympic Games Demo
| v0
|-
| 00056601
|?
|?
| v16
|-
| 00056A01
|?
|?
| v32
|-
| 00057601
|?
|?
| v16
|-
| 0005A201
| USA
| LEGO Batman 2 DC Super Heroes Demo
| v0
|-
| 0005A401
| EUR
| LEGO Batman 2 DC Super Heroes Demo
| v0
|-
| 0005A501
| EUR
| RAYMAN ORIGINS Demo
| v0
|-
| 0005DE01
|?
|?
| v16
|-
| 0005E301
|?
|?
| v16
|-
| 0005E901
|?
|?
| v16
|-
| 0005ED01
| EUR
| Cooking Mama 4 Demo
| v0
|-
| 0005EE01
| EUR
| Resident Evil Revelations Demo
| v0
|-
| 00060201
| USA
| Resident Evil Revelations Demo
| v0
|-
| 00060F01
| EUR
| Pyramids Demo
| v0
|-
| 00064701
|?
|?
| v0
|-
| 00065701
|?
|?
| v32
|-
| 00065A01
|?
|?
| v0
|-
| 00067601
| USA
| Rhythm Thief Demo
| v0
|-
| 00068201
| USA
| Pyramids Demo
| v0
|-
| 0006DA01
| EUR
| Rhythm Thief Demo
| v0
|-
| 00071F01
|?
|?
| v32
|-
| 00072A01
|?
|?
| v32
|-
| 00074001
| EUR
| Heroes of Ruin Demo
| v0
|-
| 00074701
|?
|?
| v0
|-
| 00075101
| USA
| Heroes of Ruin Demo
| v0
|-
| 00077E01
|?
|?
| v16
|-
| 00078101
|?
|?
| v0
|-
| 00078201
|?
|?
| v0
|-
| 0007A001
|?
|?
| v0
|-
| 00080101
|?
|?
| v16
|-
| 00081E01
| USA
| Metal Gear Solid Snake Eater 3D Demo
| v0
|-
| 00082401
| EUR
| Metal Gear Solid Snake Eater 3D Demo
| v0
|-
| 00086101
| EUR
| Farming Simulator 2012 3D Demo
| v0
|-
| 00086601
| USA
| Mutant Mudds 3d Demo
| v0
|-
| 00088901
| USA
| The Amazing Spider-Man
| v0
|-
| 0008C601
|?
|?
| v0
|-
| 0008D301
| USA
| Kingdom Hearts 3D Dream Drop Distance Demo
| v0
|-
| 00090B01
|?
|?
| v0
|-
| 00090D01
|?
|?
| v0
|-
| 00090F01
|?
|?
| v0
|-
| 00091601
| EUR
| THEATRHYTHM Final Fantasy Demo
| v0
|-
| 00092B01
|?
|?
| v0
|-
| 00095101
|?
|?
| v0
|-
| 00095501
| EUR
| Kingdom Hearts 3D Dream Drop Distance Demo
| v0
|-
| 00095B01
|?
|?
| v0
|-
| 0009D201
| USA
| Order Up! Demo
| v0
|-
| 000A4D01
|?
|?
| v0
|-
| 000A5401
| EUR
| Mutant Mudds Demo
| v0
|-
| 000AC801
|?
|?
| v0
|-
| 000ADE01
|?
|?
| v0
|}

Nintendo 3DS Sound

2014-11-10T06:53:19Z

Vgturtle127: Fixes and removed warning since one is included in the source

Nintendo 3DS Sound is the music playing and audio recording application that is included with all retail consoles.

It loads audio files from the SD card. It supports MP3 and AAC-encoded audio files and supports m3u playlists.

== Playlist file format==
The application allows for user created playlists. They are stored on the SD card.

{| class="wikitable" border="1"
! Offset
! Size
! Description
|-
| 0x00
| 0x04
| Magic bytes, 'O', 'V', 'A', 'F' or "FAVO" endian corrected.
|-
| 0x04
| 0x04
| Always integer with value 16
|-
| 0x08
| 0x04
| File size (0x26730)
|-
| 0x0C
| 0x04
| Zero Padding
|-
| 0x10
| 0x02
| checksum (songs?)
|-
| 0x12
| 0x02
| Icon ID (0-44) if id==-1 then loads custom icon from end of playlist?
|-
| 0x14
| 0x02
| Song file count
|-
| 0x16
| 0x02
| Number of possible songs (usually 0x12C/300)
|-
| 0x18
| 0x04
| Some kind of timestamp, for encryption (doesn't change when editing)
|-
| 0x1A
| 0x01
| Checksum (icon?, header?) (doesn't change when editing)
|-
| 0x1B
| 0x01
| Checksum (name?) (doesn't change when editing)
|-
| 0x1C
| 0x04
| Always(?) integer with value 6
|-
| 0x20
| 0x100 (avaiable 0x40)
| Playlist name stored in UTF-16
|-
| 0x120+(n*0x20C) => n<300
| 692 (0x20C per song)
| File name stored in UTF-16, repeats for the rest of the file
|-
| 0x2672F
| -
| End
|}

== Sample reader ==
This is a basic example of how to read a 3DS playlist.

<pre>/* This is free and unencumbered software released into the public domain.
/* Anyone is free to copy, modify, publish, use, compile, sell, or
/* distribute this software, either in source code form or as a compiled
/* binary, for any purpose, commercial or non-commercial, and by any
/* means.

/* In jurisdictions that recognize copyright laws, the author or authors
/* of this software dedicate any and all copyright interest in the
/* software to the public domain. We make this dedication for the benefit
/* of the public at large and to the detriment of our heirs and
/* successors. We intend this dedication to be an overt act of
/* relinquishment in perpetuity of all present and future rights to this
/* software under copyright law.
/*
/* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
/* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
/* MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
/* IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
/* OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
/* ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
/* OTHER DEALINGS IN THE SOFTWARE.
/*
/* For more information, please refer to <http://unlicense.org/> */

#include <stdio.h>
#include <stdint.h>

uint8_t buf[0x26730];
uint16_t checksum, icon, songCount;
uint32_t timestamp;
uint8_t playlistName[0x100];
uint8_t songName[0x20C][299];

void readUtf16AsAscii(uint8_t *input, uint8_t *output, uint16_t length, uint32_t offset) {
uint16_t j=0;
for (j=0; j<length; j++) {
output[j] = input[(j*2)+offset];
}
}

int main(int argc, char* argv[]) {
uint16_t t=0;
FILE *playlistFile;

if (argc != 2) {
printf("Usage: %s FILE\n", argv[0]);
exit(1);
}

if ((playlistFile = fopen(argv[1], "rb")) == NULL) {
printf("Could not open %s.\n", argv[1]);
exit(1);
}

if (fread(buf, 1, 0x26730, playlistFile) != 0x26730) {
printf("Could not 0x26730 bytes from %s.\n", argv[1]);
exit(1);
}

if (!((buf[0] = 'O') && (buf[1] = 'V') && (buf[2] = 'F') && (buf[3] = 'A'))) {
printf("%s is not a 3DS playlist file.\n", argv[1]);
exit(1);
}

checksum = (buf[0x11] << 8) | buf[0x10];
icon = (buf[0x13] << 8) | buf[0x12];
songCount = (buf[0x15] << 8) | buf[0x14];
timestamp = (buf[0x17] << 24) | (buf[0x16] << 16) | (buf[0x19] << 8) | buf[0x18];
readUtf16AsAscii(buf, playlistName, 0x100, 0x20);
for (t=0; t<songCount; t++) readUtf16AsAscii(buf, songName[t], 0x20C, (0x120+(t*0x20C)));

printf("Checksum:\t%04X\nIcon ID:\t%04X\nSong Count:\t%04X\nTimestamp:\t%08X\nPlaylist Name:\t\"%s\"\n",
checksum, icon, songCount, timestamp, playlistName);

for (t=0; t<songCount; t++) printf("Name of song %03i: %s\n", t, songName[t]);
}
</pre>

[[Category:File formats]]
[[Category:Nintendo Software]]

DSP:RegisterInterruptEvents

2014-11-10T06:22:25Z

Vgturtle127: Small fixes

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x00150082]
|-
| 1
| param0
|-
| 2
| param1
|-
| 3
| 0?
|-
| 4
| Event Handle
|}
=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code
|-
| 1
| Result code
|}

Application Manager Services PXI

2014-11-06T03:04:35Z

Vgturtle127: ixes and added info

{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Description
|-
| 0x00010040
| [[1.0.0-0]]
| [[AMPXI:GetTitleCount|GetTitleCount]]
|-
| 0x00020082
| [[1.0.0-0]]
| [[AMPXI:GetTitleList|GetTitleList]]
|-
| 0x00030084
| [[1.0.0-0]]
| [[AMPXI:GetTitleInfo|GetTitleInfo]]
|-
| 0x000400C0
| [[1.0.0-0]]
| [[AMPXI:DeleteTitle|DeleteTitle]]
|-
| 0x000500C0
| [[1.0.0-0]]
| [[AMPXI:GetTitleProductCode|GetTitleProductCode]]
|-
| 0x000600C0
| [[1.0.0-0]]
| (unknown_u8, unknown_u64)
|-
| 0x00070080
| [[1.0.0-0]]
| (unknown_u8, unknown_u32)
|-
| 0x00080080
| [[1.0.0-0]]
| [[AMPXI:InstallFIRM|InstallFIRM]]
|-
| 0x00090000
| [[1.0.0-0]]
| InstallTikBegin
|-
| 0x000A0042
| [[1.0.0-0]]
| InstallTikWrite (size, ptr, ptrsize)
|-
| 0x000B0000
| [[1.0.0-0]]
|?
|-
| 0x000C0000
| [[1.0.0-0]]
| InstallTikFinish
|-
| 0x000D0080
| [[1.0.0-0]]
| (unknown_u64)
|-
| 0x000E0000
| [[1.0.0-0]]
| GetTitleAllCount
|-
| 0x000F0082
| [[1.0.0-0]]
| GetTitleAllList
|-
| 0x00100100
| [[1.0.0-0]]
| InstallTitleBegin (?)
|-
| 0x00110000
| [[1.0.0-0]]
| InstallTitleAbort (?)
|-
| 0x00120100
| [[1.0.0-0]]
| InstallTitleResume (?)
|-
| 0x00130000
| [[1.0.0-0]]
| InstallTmdBegin (?)
|-
| 0x00140042
| [[1.0.0-0]]
| [[AMPXI:InstallTmdWrite|InstallTmdWrite]]
|-
| 0x00150000
| [[1.0.0-0]]
|?
|-
| 0x00160040
| [[1.0.0-0]]
| InstallTmdFinish (?)
|-
| 0x00170040
| [[1.0.0-0]]
| [[AMPXI:InstallContentBegin|InstallContentBegin]]
|-
| 0x00180042
| [[1.0.0-0]]
| [[AMPXI:InstallContentWrite|InstallContentWrite]]
|-
| 0x00190000
| [[1.0.0-0]]
| InstallContentAbort (?)
|-
| 0x001A0000
| [[1.0.0-0]]
|?
|-
| 0x001B0040
| [[1.0.0-0]]
| [[AMPXI:InstallContentResume|InstallContentResume]]
|-
| 0x001C0000
| [[1.0.0-0]]
| [[AMPXI:InstallContentFinish|InstallContentFinish]]
|-
| 0x001D0040
| [[1.0.0-0]]
| (unknown_u8, unknown_u32)
|-
| 0x001E00C2
| [[1.0.0-0]]
| (unknown_entrycount, unknown_u8, unknown_u32, ptr, ptrsize)
|-
| 0x001F0084
| [[1.0.0-0]]
| [[AMPXI:GetTitleTemporaryInfo|GetTitleTemporaryInfo]]
|-
| 0x002000C0
| [[1.0.0-0]]
| (unknown_u8, unknown_u64)
|-
| 0x002100C0
| [[1.0.0-0]]
| (unknown_u8, unknown_u64)
|-
| 0x00220102
| [[1.0.0-0]]
| (count, unknown_u8, unknown_u64, ptrsize_count_mul_2, ptr)
|-
| 0x00230104
| [[1.0.0-0]]
| (count, unknown_u8, unknown_u64, ptr1size_count_mul_2, ptr1, ptr2size_count_mul_24, ptr2)
|-
| 0x00240102
| [[1.0.0-0]]
| (count, unknown_u8, unknown_u64, ptrsize_count_mul2, ptr)
|-
| 0x00250000
| [[1.0.0-0]]
| GetContentCount (?)
|-
| 0x00260042
| [[1.0.0-0]]
| GetContentIds (?)
|-
| 0x00270044
| [[1.0.0-0]]
| GetContentInfoForIds (?)
|-
| 0x00280000
| [[1.0.0-0]]
|?
|-
| 0x00290000
| [[1.0.0-0]]
| InstallTitleFinish (?)
|-
| 0x002A00C2
| [[1.0.0-0]]
| (unknown_u8, count, unknown_u8, ptrsize_count_mul_8, ptr)
|-
| 0x002B....
| [[1.0.0-0]]
| ?
|-
| 0x002C....
| [[1.0.0-0]]
| ?
|-
| 0x002D....
| [[1.0.0-0]]
| ?
|-
| 0x002E....
| [[1.0.0-0]]
| ?
|-
| 0x002F....
| [[1.0.0-0]]
| ?
|-
| 0x0030....
| [[1.0.0-0]]
| ?
|-
| 0x0031....
| [[1.0.0-0]]
| ?
|-
| 0x0032....
| [[1.0.0-0]]
| ?
|-
| 0x0033....
| [[1.0.0-0]]
| ?
|-
| 0x0034....
| [[1.0.0-0]]
| ?
|-
| 0x0035....
| [[1.0.0-0]]
| ?
|-
| 0x0036....
| [[1.0.0-0]]
| ?
|-
| 0x0037....
| [[1.0.0-0]]
| ?
|-
| 0x0038....
| [[1.0.0-0]]
| ?
|-
| 0x00390146
| [[1.0.0-0]]
| (size2, size3, unknown_u64, size1, ptr1size_size1, ptr1, ptr2size_size2, ptr2, ptr3size_size3, ptr3)
|-
| 0x003A0146
| [[1.0.0-0]]
| (unknown_u64, size1, size2, size3, ptr1size_size1, ptr1, ptr2size_size2, ptr2, ptr3size_size3, ptr3)
|-
| 0x003B0042
| [[1.0.0-0]]
| (size, ptrsize, ptr)
|-
| 0x003C0000
| [[1.0.0-0]]
|?
|-
| 0x003D0108
| [[1.0.0-0]]
| (size1, size2, size3, size4, ptr1size, ptr1, ptr2size, ptr2, ptr3size, ptr3, ptr4size, ptr4)
|-
| 0x003E0042
| [[1.0.0-0]]
| (size, ptrsize, ptr)
|-
| 0x003F0040
| [[1.0.0-0]]
| (unknown_u8)
|-
| 0x00400040
| [[1.0.0-0]]
| FinishInstallToMedia (u8 mediatype)
|-
| 0x00410000
| [[1.0.0-0]]
|?
|-
| 0x00420142
| [[1.0.0-0]]
| InstallCommit
|-
| 0x004301C8
| [[2.0.0-2]]
| [[AMPXI:VerifyDSiWareFooter|VerifyDSiWareFooter]]
|-
| 0x004400C4
| [[2.0.0-2]]
|?
|-
| 0x00450108
| [[2.0.0-2]]
| (size1, size3, size2, unknown_u8, ptr1size, ptr1, ptr2size, ptr2, ptr3size, ptr3, ptr4size_size2, ptr4) (DecryptDSiWareData)
|-
| 0x00460182
| [[2.0.0-2]]
| [[AMPXI:WriteTWLSavedata|WriteTWLSavedata]]
|-
| 0x00470080
| [[2.0.0-2]]
| (unknown_u8, unknown_u8)
|-
| 0x00480040
| [[2.0.0-2]]
| [[AMPXI:ReloadDBS|ReloadDBS]]
|-
| 0x00490080
| [[2.0.0-2]]
| (unknown_u64)
|-
| 0x004A0102
| [[2.0.0-2]]
| (count, unknown_u64, unknown_u8, ptrsize_count_mul_8, ptr)
|-
| 0x004B0100
| [[2.0.0-2]]
| (unknown_u64, unknown_u64)
|-
| 0x004C0042
| [[2.0.0-2]]
| (count, ptrsize_count_mul_24, ptr)
|-
| 0x004D0144
| [[2.0.0-2]]
| [[AMPXI:ExportDSiWare|ExportDSiWare]]
|-
| 0x004E00C0
| [[2.0.0-2]]
| (unknown_u64, unknown_u8)
|-
| 0x004F00C0
| [[2.0.0-2]]
| [[AMPXI:GetDSiWareExportSize|GetDSiWareExportSize]]
|-
| 0x00500044
| [[2.0.0-2]]
| (count, ptr1size_count_mul_8, ptr1, ptr2size_count_mul_4, ptr2)
|-
| 0x00510000
| [[2.0.0-2]]
|?
|-
| 0x00520040
| [[2.0.0-2]]
| (unknown_u8)
|-
| 0x00530084
| [[2.0.0-2]]
| [[AMPXI:ValidateDSiWareMovableSedHash|ValidateDSiWareMovableSedHash]]
|-
| 0x00540000
| [[2.0.0-2]]
|?
|-
| 0x005500C4
| [[2.0.0-2]]
| [[AMPXI:ValidateDSiWareSectionMAC|ValidateDSiWareSectionMAC]]
|-
| 0x005600C0
| [[2.0.0-2]]
| (unknown_u64, unknown_u16)
|-
| 0x00570042
| [[4.0.0-7]]
| ?
|-
| 0x0058....
| [[4.0.0-7]]
| ?
|-
| 0x00590104
| [[4.0.0-7]]
| ?
|-
| 0x005A0142
| [[4.0.0-7]]
| ?
|-
| 0x005B....
| [[4.0.0-7]]
| ?
|-
| 0x005C0044
| [[4.0.0-7]]
| ?
|-
| 0x005D0082
| [[4.0.0-7]]
| ?
|-
| 0x005E0102
| [[4.0.0-7]]
| ?
|-
| 0x005F....
| [[4.0.0-7]]
| ?
|-
| 0x00600102
| [[4.0.0-7]]
| ?
|-
| 0x00610142
| [[4.0.0-7]]
| ?
|-
| 0x00620044
| [[4.0.0-7]]
| ?
|-
| 0x00630042
| [[4.0.0-7]]
| ?
|-
| 0x0064....
| [[4.0.0-7]]
| ?
|-
| 0x0065....
| [[4.0.0-7]]
| ?
|-
| 0x0066....
| [[4.0.0-7]]
| Stubbed starting with [[4.0.0-7]], this only returns zero for the command result-code.
|-
| 0x00670082
| [[4.0.0-7]]
| ?
|-
| 0x006801C2
| [[4.0.0-7]]
| ?
|-
| 0x0069....
| [[4.0.0-7]]
| ?
|-
| 0x006A....
| [[4.0.0-7]]
| ?
|-
| 0x006B0142
| [[4.0.0-7]]
| ?
|-
| 0x006C....
| [[5.0.0-11]]
| (u8 [[Mediatypes|Mediatype]], u64 programID)
|}

=Errors=
{| class="wikitable" border="1"
|-
! Error-code
! Description
|-
| 0xC8A0802B
| This indicates the the [[Title_Database|dbs]] image(.db) does not exist, or opening the .db file failed.
|-
| 0xC8E083FC
| This error indicates that the title is already installed, with the same title-version as the title being installed?
|-
| 0xD8E08027
| Invalid title-version, or the title-version of the title being installed is older than the currently installed title-version.
|-
| 0xD8A08004
| Invalid ticket title version.
|-
| 0xD8E08025
| Invalid NCCH. returned from InstallContentFinish
|-
| 0xD8A08029
| Error-type 1
|-
| 0xD8E08065
| Error-type -1
|-
| 0xD8E08065+1 / 0xD8E08066
| Error-type -2
|-
| 0xD8E08065+2 / 0xD8E08067
| Error-type -3
|-
| 0xD8E08065+3 / 0xD8E08068
| Error-type -4
|-
| 0xD8E08065+4 / 0xD8E08069
| Error-type -5
|-
| 0xD8E08065+5 / 0xD8E0806A
| Error-type -6. Returned when a function returns error -2011: signature check for cert(TMD/TIK/cert-chain, ...) failed.
|-
| 0xD8E08065+6 / 0xD8E0806B
| Error-type -7
|-
| 0xD8E08065+7 / 0xD8E0806C
| Error-type -8
|-
| 0xD8E08065+8 / 0xD8E0806D
| Error-type -9
|-
| 0xD8E08065+9 / 0xD8E0806E
| Error-type -10
|-
| 0xD8E08065+10 / 0xD8E0806F
| Error-type -11
|-
| 0xD8E08065+11 / 0xD8E08070
| Error-type -12
|-
| 0xD8E08065+12 / 0xD8E08071
| Error-type -13
|-
| 0xD8E08065+13 / 0xD8E08072
| Error-type -14
|-
| 0xD8A083FA
| Invalid titleID.
|-
| 0xE0E0802C
| AM module returns this error when the system-title bit is set for the input CTR/TWL titleID-high, for [[AM:DeleteApplicationTitle]].
|}

Filesystem services PXI

2014-11-06T02:53:50Z

Vgturtle127: Fixes, added things we need to know

{| class="wikitable" border="1"
|-
! Command Header, prior to [[3.0.0-5]]
! Command Header, starting with [[3.0.0-5]]
! Available since system version
! Description
|-
| 0x000101C2
|?
| [[1.0.0-0]]
| OpenFile
|-
| 0x00020142
|?
| [[1.0.0-0]]
| DeleteFile? (unknown_u32, archivehandlelo, archivehandlehi, pathtype, pathsize, pathptrsize, pathptr)
|-
| 0x00030244
|?
| [[1.0.0-0]]
| RenameFile? (unknown_u32, archivehandlelo, archivehandlehi, pathtype, pathsize, secondarchivehandlelo, secondarchivehandlehi, secondpathtype, secondpathsize, pathptrsize, pathptr, secondpathptrsize, secondpathptr)
|-
| 0x00040142
|?
| [[1.0.0-0]]
| DeleteDirectory? (unknown_u32, archivehandlelo, archivehandlehi, pathtype, pathsize, pathptrsize, pathptr)
|-
| 0x00050202
|?
| [[1.0.0-0]]
| CreateFile? (unknown_u32, archivehandlelo, archivehandlehi, pathtype, pathsize, unknown_u32, unknown_lo, unknown_hi, pathptrsize, pathptr)
|-
| 0x00060182
|?
| [[1.0.0-0]]
| CreateDirectory? (unknown_u32, archivehandlelo, archivehandlehi, pathtype, pathsize, unknown_u32, pathptrsize, pathptr)
|-
| 0x00070244
|?
| [[1.0.0-0]]
| RenameDirectory? (unknown_u32, archivehandlelo, archivehandlehi, pathtype, pathsize, secondarchivehandlelo, secondarchivehandlehi, secondpathtype, secondpathsize, pathptrsize, pathptr, secondpathptrsize, secondpathptr)
|-
| 0x00080102
|?
| [[1.0.0-0]]
| OpenDirectory (archivehandlelo, archivehandlehi, pathtype, pathsize, pathptrsize, pathptr)
|-
| 0x00090142
|?
| [[1.0.0-0]]
| ReadFile
|-
| 0x000A00C2
|?
| [[1.0.0-0]]
| CalculateFileHashSHA256
|-
| 0x000B0182
|?
| [[1.0.0-0]]
| WriteFile
|-
| 0x000C0104
|?
| [[1.0.0-0]]
| [[FSPXI:CalcSavegameMAC|CalcSavegameMAC]]
|-
| 0x000D0080
|?
| [[1.0.0-0]]
| GetFileSize
|-
| 0x000E0100
|?
| [[1.0.0-0]]
| SetFileSize (sizelo, sizehi, filehandlelo, filehandlehi)
|-
| 0x000F0080
|?
| [[1.0.0-0]]
| CloseFile (filehandlelo, filehandlehi)
|-
| 0x001000C2
|?
| [[1.0.0-0]]
| ReadDirectory (dirhandlelo, dirhandlehi, count, ptrsize, ptr)
|-
| 0x00110080
|?
| [[1.0.0-0]]
| CloseDirectory (dirhandlelo, dirhandlehi)
|-
| 0x001200C2
|?
| [[1.0.0-0]]
| [[FSPXI:OpenArchive|OpenArchive]]
|-
| 0x00130102
|?
| [[1.0.0-0]]
| CreateExtSaveData? (archivehandlelo, archivehandlehi, pathtype, pathsize, pathptrsize, pathptr)
|-
| 0x00140102
|?
| [[1.0.0-0]]
| (archivehandlelo, archivehandlehi, pathtype, pathsize, pathptrsize, pathptr)
|-
| 0x00150102
|?
| [[1.0.0-0]]
| (archivehandlelo, archivehandlehi, pathtype, pathsize, pathptrsize, pathptr)
|-
| 0x00160080
|?
| [[1.0.0-0]]
| CloseArchive (archivehandlelo, archivehandlehi)
|-
| 0x00170080
|?
| [[1.0.0-0]]
| ReopenArchive? (archivehandlelo, archivehandlehi)
|-
| 0x00180000
|?
| [[1.0.0-0]]
| GetCardType
|-
| 0x00190000
|?
| [[1.0.0-0]]
| [[FSPXI:GetSdmcArchiveResource|GetSdmcArchiveResource]]
|-
| 0x001A0000
|?
| [[1.0.0-0]]
| [[FSPXI:GetNandArchiveResource|GetNandArchiveResource]]
|-
| 0x001B0000
|?
| [[1.0.0-0]]
| GetSdmcFatFsError
|-
| 0x001C0000
|?
| [[1.0.0-0]]
| GetSdmcDetected
|-
| 0x001D0000
|?
| [[1.0.0-0]]
| GetSdmcWritable
|-
| 0x001E0042
|?
| [[1.0.0-0]]
| [[FSPXI:GetSdmcCid|GetSdmcCid]]
|-
| 0x001F0042
|?
| [[1.0.0-0]]
| [[FSPXI:GetNandCid|GetNandCid]]
|-
| 0x00200000
|?
| [[1.0.0-0]]
| GetSdmcSpeedInfo
|-
| 0x00210000
|?
| [[1.0.0-0]]
| GetNandSpeedInfo
|-
| 0x00220042
|?
| [[1.0.0-0]]
| GetSdmcLog
|-
| 0x00230042
|?
| [[1.0.0-0]]
| GetNandLog
|-
| 0x00240000
|?
| [[1.0.0-0]]
| ClearSdmcLog
|-
| 0x00250000
|?
| [[1.0.0-0]]
| ClearNandLog
|-
| 0x00260000
|?
| [[1.0.0-0]]
| GetCardSlotInserted
|-
| 0x00270000
|?
| [[1.0.0-0]]
| CardSlotPowerOn
|-
| 0x00280000
|?
| [[1.0.0-0]]
| CardSlotPowerOff
|-
| 0x00290000
|?
| [[1.0.0-0]]
| CardSlotGetIfPowerStatus
|-
| 0x002A0040
|?
| [[1.0.0-0]]
| [[FSPXI:CardNorDirectCommand|CardNorDirectCommand]] (These CardNor commands are used for accessing the raw gamecard flash savedata)
|-
| 0x002B0080
|?
| [[1.0.0-0]]
| [[FSPXI:CardNorDirectCommandWithAddress|CardNorDirectCommandWithAddress]]
|-
| 0x002C0082
|?
| [[1.0.0-0]]
| [[FSPXI:CardNorDirectRead|CardNorDirectRead]]
|-
| 0x002D00C2
|?
| [[1.0.0-0]]
| [[FSPXI:CardNorDirectReadWithAddress|CardNorDirectReadWithAddress]]
|-
| 0x002E0082
|?
| [[1.0.0-0]]
| [[FSPXI:CardNorDirectWrite|CardNorDirectWrite]]
|-
| 0x002F00C2
|?
| [[1.0.0-0]]
| [[FSPXI:CardNorDirectWriteWithAddress|CardNorDirectWriteWithAddress]]
|-
| 0x003000C2
|?
| [[1.0.0-0]]
| [[FSPXI:CardNorDirectRead4IO|CardNorDirectRead4IO]]
|-
| 0x00310082
|?
| [[1.0.0-0]]
| CardNorDirectCpuWriteWithoutVerify
|-
| 0x00320040
|?
| [[1.0.0-0]]
| [[FSPXI:CardNorDirectSectorEraseWithoutVerify|CardNorDirectSectorEraseWithoutVerify]]
|-
| 0x00330080
|?
| [[1.0.0-0]]
| GetProductInfo
|-
| 0x00340040
|?
| [[1.0.0-0]]
| SetCardSpiBaudrate
|-
| 0x00350040
|?
| [[1.0.0-0]]
| SetCardSpiBusMode
|-
| 0x00360040
|?
| [[1.0.0-0]]
| SendInitializeInfo
|-
| 0x00370140
|?
| [[1.0.0-0]]
| CreateExtSaveData
|-
| 0x003800C0
|?
| [[1.0.0-0]]
| DeleteExtSaveData
|-
| 0x00390082
|?
| [[1.0.0-0]]
| EnumerateExtSaveData
|-
| 0x003A0100
|?
| [[1.0.0-0]]
| GetSpecialContentIndex
|-
| 0x003B00C2
|?
| [[1.0.0-0]]
| GetLegacyRomHeader
|-
| 0x003C00C2
|?
| [[1.0.0-0]]
| GetLegacyBannerData
|-
| 0x003F0000
|?
| [[1.0.0-0]]
| [[FSPXI:DeleteSdmcRoot|DeleteSdmcRoot]]
|-
| 0x00400040
|?
| [[1.0.0-0]]
| DeleteAllExtSaveDataOnNand
|-
| 0x00410000
|?
| [[1.0.0-0]]
| [[FSPXI:InitializeCtrFilesystem|InitializeCtrFilesystem]]
|-
| 0x00420000
|?
| [[1.0.0-0]]
| CreateSeed
|-
| 0x00430042
|?
| [[2.0.0-2]]
| [[FSPXI:GetSdmcCtrRootPath|GetSdmcCtrRootPath]]
|-
| 0x00440040
|?
| [[2.0.0-2]]
| GetArchiveResource
|-
| 0x00450002
|?
| [[2.0.0-2]]
| [[FSPXI:ExportIntegrityVerificationSeed|ExportIntegrityVerificationSeed]]
|-
| 0x00460002
|?
| [[2.0.0-2]]
| [[FSPXI:ImportIntegrityVerificationSeed|ImportIntegrityVerificationSeed]]
|-
| 0x00470082
|?
| [[2.0.0-2]]
| EnumerateSharedExtSaveData
|-
| 0x00480102
|?
| [[2.0.0-2]]
| GetLegacySubBannerData
|-
| 0x00490042
|?
| [[2.0.0-2]]
| Initialize (?)
|-
| 0x004A00C2
|?
| [[2.0.0-2]]
| OpenSpecialFile? (archivehandlelo, archivehandlehi, size, ptrsize_mul2, ptr)
|-
| 0x004B0102
|?
| [[2.0.0-2]]
| ReadSpecialFile
|-
|?
| 0x004B0000
| [[3.0.0-5]]
| [[FSPXI:GetMovableSedHashedKeyYRandomData|GetMovableSedHashedKeyYRandomData]]
|-
| 0x004C0040
|?
| [[2.0.0-2]]
| GetSpecialFileSize
|-
|?
| 0x004D01C4
| [[3.0.0-5]]
| This is a wrapper for ReadFile. If the first ReadFile call fails, this calls ReadFile again then executes hash-related code.
|-
|?
| 0x004E0204
| [[3.0.0-5]]
| This is a wrapper for WriteFile, this is similar to command 0x004D01C4.
|-
|?
| 0x004F....
| [[3.0.0-5]]
| (unknown_u64)
|-
|?
| 0x00500000
| [[3.0.0-5]]
| Stubbed, this only returns value 0.
|-
|?
| 0x0051....
| [[3.0.0-5]]
| (unknown_u8)
|-
|?
| 0x00520042
| [[3.0.0-5]]
| (outbuffersize, outbufferptr)
|-
|?
| 0x00530000
| [[3.0.0-5]]
| Unknown, stubbed with [[4.0.0-7]].
|-
|?
| 0x0054....
| [[4.0.0-7]]
| Stubbed with [[4.0.0-7]].
|-
|?
| 0x00550082
| [[4.0.0-7]]
| ReadNandReport (outbuffersize, u8 mediatype, outbufferptr)
|}

=Errors=
{| class="wikitable" border="1"
|-
! Error-code
! Description
|-
| 0xC8804478
| Object doesn't exist / failed to open object(file). Or: The specified title does not exist in the [[Title_Database|database]].
|-
| 0xC880448D
| FSPXI: Gamecard not inserted when attempting to use the gamecard.
|-
| 0xC88044AB
| [[SDMC]]/NAND bus error, REG_SDSTATUS: TMIO_STAT_CMD_BUSY or TMIO_STAT_TXUNDERRUN
|-
| 0xC88044AC
| [[SDMC]]/NAND bus error, REG_SDSTATUS: TMIO_STAT_ILL_FUNC
|-
| 0xC92044E6
| Operation not allowed with the current file openflags (maybe other causes too?).
|-
| 0xC9204509
| [[SDMC]]/NAND bus error, REG_SDSTATUS: TMIO_STAT_CMDTIMEOUT
|-
| 0xC960454B
| [[SDMC]]/NAND bus error, when an error-bit in REG_SDSTATUS separate from the above errors is set. This can also indicate that the TWL partition table in the NAND sector0 is invalid, or that the sector signature for sector0 at offset 0x1FE is invalid?
|-
| 0xC960454C
| [[SDMC]]/NAND bus error, REG_SDSTATUS: TMIO_STAT_STOPBIT_ERR
|-
| 0xC960F401
| [[SDMC]]/NAND bus error, REG_SDSTATUS: Bit23 (0x00800000)
|-
| 0xD9004587
| FSPXI: Hash verification failure (only for NCCH region hashes?).
|-
| 0xD9004588
| FSPXI/FSUSER: Verification failure for RSA or hashes. FSUSER: Verification failed for [[Savegames|savegame]] AES-MAC.
|-
| 0xD900458B
| FSUSER: A corrupted [[RomFS]] block was read (hash check fail).
|-
| 0xD9004676
| FSUSER: The specified service-command / archive is not accessible, due to the currently used exheader accessinfo not having the required bit(s) set. (This error can also indicate that the required ARM9 access-control mount flag is not enabled, in the exheader for any of the running ARM11 processes)
|-
| 0xE0E046BE
| Invalid lowpath. This can also indicate that the specified archive-id does not exist, or that the specified archive-id is not accessible over FSPXI. In certain cases this can also be caused by attempting to open a FSUSER archive where none of the required bit(s) for the archive are set in the user-process exheader accessinfo.
|-
| 0xE0C046F9
| FSPXI: Specified read-size doesn't match the actual filesize, when accessing ExeFS.
|-
| 0xE160F402
| [[SDMC]]/NAND bus error, REG_SDSTATUS: TMIO_STAT_RXRDY
|-
| 0xE160F403
| [[SDMC]]/NAND bus error, REG_SDSTATUS: Bit28 (0x10000000)
|-
| 0xE160F404
| [[SDMC]]/NAND bus error, REG_SDSTATUS: Bit27 (0x08000000)
|}

Process Services PXI

2014-11-06T02:45:11Z

Vgturtle127: More fixes, yay?

{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Description
|-
| 0x000100C6
| [[1.0.0-0]]
| This crypts a raw message with RSA.
|-
| 0x00020284
| [[1.0.0-0]]
| SignRsaSha256
|-
| 0x00030284
| [[1.0.0-0]]
| VerifyRsaSha256
|-
| 0x000401C4
| [[1.0.0-0]]
| [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]]
|-
| 0x00050284
| [[1.0.0-0]]
| [[PSPXI:EncryptSignDecryptVerifyAesCcm|EncryptSignDecryptVerifyAesCcm]]
|-
| 0x00060000
| [[1.0.0-0]]
| GetRomId. This reads 0x40-bytes from [[Gamecards|gamecard]] command 0xC6 (gamecard-uniqueID), and returns the first 0x10-bytes from that since the rest of the command reply is all 0xFF-bytes.
|-
| 0x00070000
| [[1.0.0-0]]
| GetRomId2. The first u8 this returns is from GetRomMakerCode, the following 0x10-bytes are from [[AES|encrypting]] the 0x10-bytes which GetRomId also returns. This is encrypted with AES-CBC, the regular normal-key and IV set by [[FIRM|Process9]] for this are loaded from the Process9 .rodata section.
|-
| 0x00080000
| [[1.0.0-0]]
| GetCTRCardAutoStartupBit
|-
| 0x00090000
| [[1.0.0-0]]
| GetRomMakerCode
|-
| 0x000A0000
| [[1.0.0-0]]
| [[PSPXI:GetLocalFriendCodeSeed|GetLocalFriendCodeSeed]]
|-
| 0x000B0000
| [[1.0.0-0]]
| [[PSPXI:GetDeviceId|GetDeviceId]]
|-
| 0x000C0042
| [[1.0.0-0]]
| GatherEntropy
|-
| 0x000D0042
| [[1.0.0-0]]
| [[PSPXI:GenerateRandomBytes|GenerateRandomBytes]]
|-
| 0x000E0042
| [[1.0.0-0]], removed with [[2.0.0-2]]
| With [[2.0.0-2]] the system no longer handles this command at all. This was mostly the same as GenerateRandomBytes.
|}

These RSA commands are an interface for using the [[RSA]] engine. The system will hang when it attempts to use a >RSA-2048 RSA bit-size with the RSA engine, since the [[RSA]] engine does not support >RSA-2048.

Process Manager Services PXI

2014-11-06T02:43:20Z

Vgturtle127: Capitalization

{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Description
|-
| 0x00010082
| [[1.0.0-0]]
| ReadExtendedHeader
|-
| 0x00020100
| [[1.0.0-0]]
| OpenTitle
|-
| 0x00030080
| [[1.0.0-0]]
| CloseTitle (used after the process terminates)
|}

Mode Control Services PXI

2014-11-06T02:42:42Z

Vgturtle127: /* Make it nicer */

="pxi:mc" service=
{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Description
|-
| 0x00010000
| [[1.0.0-0]]
| This is sent to the ARM9 by the ARM11 PXI-module, when PXI-module is shutting down due to receiving [[Services|srv]] notification-ID 0x100.
|-
| 0x0002....
| [[1.0.0-0]]
| Stubbed, does nothing...
|-
| 0x0003....
| [[1.0.0-0]]
| Stubbed, does nothing...
|-
| 0x0004....
| [[1.0.0-0]]
| Stubbed, does nothing...
|-
| 0x0005....
| [[1.0.0-0]]
|?
|-
| 0x0006....
| [[1.0.0-0]]
| Stubbed, does nothing...
|-
| 0x00070000
| [[1.0.0-0]]
| Stubbed, writes uninitialized stack byte to (u8*)(cmdbuf+4).
|-
| 0x0008....
| [[1.0.0-0]]
| Stubbed, returns 0xE0C0EC03...
|-
| 0x0009....
| [[1.0.0-0]]
| Stubbed, returns 0xE0C0EC03...
|-
| 0x000A....
| [[1.0.0-0]]
|?
|-
| 0x000B....
| [[1.0.0-0]]
| Stubbed, does some unnecessary copying to stack...
|-
| 0x000C....
| [[1.0.0-0]]
| Stubbed, does some unnecessary copying to stack...
|}

Back to↓

[[Services API]]

IO Registers

2014-11-06T02:40:30Z

Vgturtle127: Another small fix

= Overview =

{| class="wikitable" border="1"
! Old3DS
! A9/A11
! Category
! Physaddr
! Used by
! Comments
|-
| style="background: green" | Yes
| A9
| [[CONFIG Registers]]
| 0x10000000
| Boot9, Process9
|
|-
| style="background: green" | Yes
| A9
| [[IRQ Registers]]
| 0x10001000
| Boot9, Process9, Kernel9
| ARM9 Interrupt Masking
|-
| style="background: green" | Yes
| A9
| [[NDMA Registers]]
| 0x10002000
| Boot9, Process9
| DMA Engine
|-
| style="background: green" | Yes
| A9
| [[TIMER Registers]]
| 0x10003000
| Boot9, Process9
|
|-
| style="background: green" | Yes
| A9
| [[CTRCARD Registers]]
| 0x10004000 / 0x10005000
| Process9
|
|-
| style="background: green" | Yes
| A9
| [[EMMC Registers]]
| 0x10006000 / 0x10007000
| Boot9, Process9
| 0x10007000 is apparently not used on retail
|-
| style="background: green" | Yes
| A9
| [[PXI Registers]]
| 0x10008000
| Boot9, Process9
|
|-
| style="background: green" | Yes
| A9
| [[AES Registers]]
| 0x10009000
| Boot9, Process9
|
|-
| style="background: green" | Yes
| A9
| [[SHA Registers]]
| 0x1000A000
| Boot9, Process9
|
|-
| style="background: green" | Yes
| A9
| [[RSA Registers]]
| 0x1000B000
| Boot9, Process9
|
|-
| style="background: green" | Yes
| A9
| [[XDMA Registers]]
| 0x1000C000
| Boot9, Kernel9
| [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0424d/index.html CoreLink™ DMA-330]
|-
| style="background: green" | Yes
| A9
| [[SPICARD Registers]]
| 0x1000D800
| Process9
|
|-style="border-top: double"
| style="background: green" | Yes
|?
| [[CONFIG Registers]]
| 0x10010000
| Process9
|
|-
| style="background: green" | Yes
|?
| [[CONFIG Registers]]
| 0x10011000
| Process9
|
|-
| style="background: green" | Yes
|?
|?
| 0x10012000
| Kernel9, NewKernel9Loader
| Top secret.
|-
| style="background: green" | Yes
|?
|?
| 0x10018000
| TwlProcess9
| Used to setup the ARM7 core for AGB/TWL
|-style="border-top: double"
| style="background: green" | Yes
|?
|?
| 0x10100000
|?
|?
|-
| style="background: green" | Yes
| A11/A9
| [[HASH Registers]]
| 0x10101000
| [[Filesystem services]]
|
|-
| style="background: green" | Yes
| A11/A9
| [[Camera Registers]]
| 0x10102000
| [[Camera Services]]
| y2r
|-
| style="background: green" | Yes
| A11/A9
| [[CSND Registers]] / DSP
| 0x10103000
| TwlBg, [[Codec Services]], [[CSND Services]], [[DSP Services]]
| Sound Hardware
|-style="border-top: double"
| style="background: green" | Yes
| A11/A9
|?
| 0x10110000
|?
|?
|-
| style="background: green" | Yes
| A11/A9
|?
| 0x10111000
| TwlBg
|
|-style="border-top: double"
| style="background: green" | Yes
| A11/A9
| [[Camera Registers]]
| 0x10120000
| [[Camera Services]]
|
|-
| style="background: green" | Yes
| A11/A9
| [[Camera Registers]]
| 0x10121000
| [[Camera Services]]
| Mirror of 0x10120000?
|-
| style="background: green" | Yes
| A11/A9
|?
| 0x10122000
| [[NWM Services]]
| WIFI?
|-
| style="background: green" | Yes
| A11/A9
|?
| 0x10123000
| [[NWM Services]]
| WIFI?
|-style="border-top: double"
| style="background: red" | No
| A11/A9
| [[MVD Registers]]
| 0x10130000
| [[MVD Services]]
|
|-
| style="background: red" | No
| A11/A9
| [[MVD Registers]]
| 0x10131000
| [[MVD Services]]
|
|-
| style="background: red" | No
| A11/A9
| [[MVD Registers]]
| 0x10132000
| [[MVD Services]]
|
|-style="border-top: double"
| style="background: green" | Yes
| A11/A9
|?
| 0x10140000
| Process9, Boot11, Kernel11, TwlBg, [[DSP Services]], [[NWM Services]], [[SPI Services]]
| Power management
|-
| style="background: green" | Yes
| A11/A9
| [[PDN Registers]] / [[CODEC Registers]]
| 0x10141000
| Process9, Boot11, Kernel11, TwlBg, [[Codec Services]], [[NWM Services]], [[SPI Services]], [[PDN Services]]
| Power management
|-
| style="background: green" | Yes
| A11/A9
| [[SPI Registers]]
| 0x10142000
| TwlBg, [[SPI Services]]
|
|-
| style="background: green" | Yes
| A11/A9
| [[SPI Registers]]
| 0x10143000
| TwlBg
| Only used under TWL_FIRM?
|-
| style="background: green" | Yes
| A11/A9
| [[I2C Registers]]
| 0x10144000
| Boot11, Kernel11, TwlBg, [[I2C Services]]
|
|-
| style="background: green" | Yes
| A11/A9
| [[CODEC Registers]]
| 0x10145000
| TwlBg, [[Codec Services]]
|
|-
| style="background: green" | Yes
| A11/A9
| [[HID Registers]]
| 0x10146000
| Boot11, Kernel11, TwlBg, [[HID Services]]
| See [[PAD]].
|-
| style="background: green" | Yes
| A11/A9
| [[GPIO Registers]]
| 0x10147000
| Boot11, TwlBg, [[GPIO Services]]
|
|-
| style="background: green" | Yes
| A11/A9
| [[I2C Registers]]
| 0x10148000
| TwlBg, [[I2C Services]]
|
|-style="border-top: double"
| style="background: green" | Yes
| A11/A9
| [[SPI Registers]]
| 0x10160000
| Boot9, TwlBg, [[SPI Services]]
|
|-
| style="background: green" | Yes
| A11/A9
| [[I2C Registers]]
| 0x10161000
| Boot11, TwlBg, [[I2C Services]]
|
|-
| style="background: green" | Yes
| A11/A9
| [[MIC Registers]]
| 0x10162000
| [[MIC Services]]
|
|-
| style="background: green" | Yes
| A11/A9
| [[PXI Registers]]
| 0x10163000
| Boot11, Kernel11, TwlBg, [[PXI Services]]
|
|-
| style="background: green" | Yes
| A11/A9
| [[NTRCARD Registers]]
| 0x10164000
| Boot9, Process9
|
|-
| style="background: green" | Yes
| A11/A9
| [[MP Registers]]
| 0x10165000
| [[MP Services]]
|
|-style="border-top: double"
| style="background: green" | Yes
| A11/A9
| [[MP Registers]]
| 0x10170000
| [[MP Services]]
| NTR WIFI Registers, see [http://problemkaputt.de/gbatek.htm#dswirelesscommunications GBATek].
|-
| style="background: green" | Yes
| A11/A9
| [[MP Registers]]
| 0x10171000
| [[MP Services]]
| NTR WIFI Registers (mirror)
|-
| style="background: green" | Yes
| A11/A9
|?
| 0x10172000
|?
| NTR WIFI Unused?
|-
| style="background: green" | Yes
| A11/A9
|?
| 0x10173000
|?
| NTR WIFI Unused?
|-
| style="background: green" | Yes
| A11/A9
| [[MP Registers]]
| 0x10174000
| [[MP Services]]
| NTR WIFI RAM
|-
| style="background: green" | Yes
| A11/A9
| [[MP Registers]]
| 0x10175000
|?
| NTR WIFI RAM
|-
| style="background: green" | Yes
| A11/A9
| [[MP Registers]]
| 0x10176000
|?
| NTR WIFI Registers (mirror)
|-
| style="background: green" | Yes
| A11/A9
| [[MP Registers]]
| 0x10177000
|?
| NTR WIFI Registers (mirror)
|-
| style="background: green" | Yes
| A11/A9
| [[MP Registers]]
| 0x10178000 - 0x10180000
| [[MP Services]]
| NTR WIFI WS1 Region
|-style="border-top: double"
| style="background: orange" |?
| A11
| CDMA
| 0x10200000
| Boot11, Kernel11
| On old 3DS this is [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0424d/index.html CoreLink™ DMA-330]. On the New 3DS it is unknown what this is.
|-
| style="background: green" | Yes
| A11
|?
| 0x10202000
| TwlBg, Kernel11, [[GSP Services]]
|
|-
| style="background: green" | Yes
| A11
| DSP
| 0x10203000
| [[DSP Services]]
|
|-
| style="background: orange" |?
| A11
| CDMA
| 0x10206000
| NewKernel11
| CDMA was moved here on New 3DS. [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0424d/index.html CoreLink™ DMA-330].
|-
| style="background: orange" |?
| A11
| [[MVD Registers]]
| 0x10207000
| [[MVD Services]]
| New 3DS only?
|-
| style="background: green" | Yes
| A11
| GPU?
| 0x1020F000
| TwlBg, [[GSP Services]]
|
|-style="border-top: double"
| style="background: green" | Yes
| A11
| MIRROR
| 0x10300000-0x10400000
|
| Mirror of 0x10100000-0x10200000 (faster bus?), CDMA wants these addresses
|-style="border-top: double"
| style="background: green" | Yes
| A11
| [[LCD Registers]]
| 0x10400000
| Boot11, Kernel11, [[GSP Services]]
|
|-
| style="background: green" | Yes
| A11
| [[LCD Registers]]
| 0x10420000
| [[GSP Services]]
|
|}

IO registers starting at physical address 0x10200000 are not accessible from the ARM9 (which includes all LCD/GPU registers).

ARM11 kernel virtual address mappings for these registers varies for different builds. For ARM11 user mode applications you have:
physaddr = virtaddr - 0x1EC00000 + 0x10100000

=0x10012000=
Keys seem to be stored here? Access to this region is disabled once the ARM9 writes 0x2 to [[CONFIG|REG_SYSPROT9]]. Before writing that bit, the ARM9 copies the low u32 for the TWL keydata to +0x100 (and high u32 keydata to +0x104 with the New 3DS). On development units ([[CONFIG|UNITINFO]]!=0) ARM9 uses the first 8-bytes from 0x10012000 for the TWL keydata.

Originally the above TWL keyinit + region disable was done by Kernel9. However, with the [[New_3DS]] FIRM ARM9 binary this is now done in the [[FIRM]] ARM9 binary loader, which also uses the 0x10012000 region for key generation.

IO Registers

2014-11-06T02:39:27Z

Vgturtle127: Small fix

= Overview =

{| class="wikitable" border="1"
! Old3DS
! A9/A11
! Category
! Physaddr
! Used by
! Comments
|-
| style="background: green" | Yes
| A9
| [[CONFIG Registers]]
| 0x10000000
| Boot9, Process9
|
|-
| style="background: green" | Yes
| A9
| [[IRQ Registers]]
| 0x10001000
| Boot9, Process9, Kernel9
| ARM9 Interrupt Masking
|-
| style="background: green" | Yes
| A9
| [[NDMA Registers]]
| 0x10002000
| Boot9, Process9
| DMA Engine
|-
| style="background: green" | Yes
| A9
| [[TIMER Registers]]
| 0x10003000
| Boot9, Process9
|
|-
| style="background: green" | Yes
| A9
| [[CTRCARD Registers]]
| 0x10004000 / 0x10005000
| Process9
|
|-
| style="background: green" | Yes
| A9
| [[EMMC Registers]]
| 0x10006000 / 0x10007000
| Boot9, Process9
| 0x10007000 is apparently not used on retail
|-
| style="background: green" | Yes
| A9
| [[PXI Registers]]
| 0x10008000
| Boot9, Process9
|
|-
| style="background: green" | Yes
| A9
| [[AES Registers]]
| 0x10009000
| Boot9, Process9
|
|-
| style="background: green" | Yes
| A9
| [[SHA Registers]]
| 0x1000A000
| Boot9, Process9
|
|-
| style="background: green" | Yes
| A9
| [[RSA Registers]]
| 0x1000B000
| Boot9, Process9
|
|-
| style="background: green" | Yes
| A9
| [[XDMA Registers]]
| 0x1000C000
| Boot9, Kernel9
| [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0424d/index.html CoreLink™ DMA-330]
|-
| style="background: green" | Yes
| A9
| [[SPICARD Registers]]
| 0x1000D800
| Process9
|
|-style="border-top: double"
| style="background: green" | Yes
|?
| [[CONFIG Registers]]
| 0x10010000
| Process9
|
|-
| style="background: green" | Yes
|?
| [[CONFIG Registers]]
| 0x10011000
| Process9
|
|-
| style="background: green" | Yes
|?
|?
| 0x10012000
| Kernel9, NewKernel9Loader
| Top secret.
|-
| style="background: green" | Yes
|?
|?
| 0x10018000
| TwlProcess9
| Used to setup the ARM7 core for AGB/TWL
|-style="border-top: double"
| style="background: green" | Yes
|?
|?
| 0x10100000
|?
|?
|-
| style="background: green" | Yes
| A11/A9
| [[HASH Registers]]
| 0x10101000
| [[Filesystem services]]
|
|-
| style="background: green" | Yes
| A11/A9
| [[Camera Registers]]
| 0x10102000
| [[Camera Services]]
| y2r
|-
| style="background: green" | Yes
| A11/A9
| [[CSND Registers]] / DSP
| 0x10103000
| TwlBg, [[Codec Services]], [[CSND Services]], [[DSP Services]]
| Sound Hardware
|-style="border-top: double"
| style="background: green" | Yes
| A11/A9
|?
| 0x10110000
|?
|?
|-
| style="background: green" | Yes
| A11/A9
|?
| 0x10111000
| TwlBg
|
|-style="border-top: double"
| style="background: green" | Yes
| A11/A9
| [[Camera Registers]]
| 0x10120000
| [[Camera Services]]
|
|-
| style="background: green" | Yes
| A11/A9
| [[Camera Registers]]
| 0x10121000
| [[Camera Services]]
| Mirror of 0x10120000?
|-
| style="background: green" | Yes
| A11/A9
|?
| 0x10122000
| [[NWM Services]]
| WIFI?
|-
| style="background: green" | Yes
| A11/A9
|?
| 0x10123000
| [[NWM Services]]
| WIFI?
|-style="border-top: double"
| style="background: red" | No
| A11/A9
| [[MVD Registers]]
| 0x10130000
| [[MVD Services]]
|
|-
| style="background: red" | No
| A11/A9
| [[MVD Registers]]
| 0x10131000
| [[MVD Services]]
|
|-
| style="background: red" | No
| A11/A9
| [[MVD Registers]]
| 0x10132000
| [[MVD Services]]
|
|-style="border-top: double"
| style="background: green" | Yes
| A11/A9
|?
| 0x10140000
| Process9, Boot11, Kernel11, TwlBg, [[DSP Services]], [[NWM Services]], [[SPI Services]]
| Power management
|-
| style="background: green" | Yes
| A11/A9
| [[PDN Registers]] / [[CODEC Registers]]
| 0x10141000
| Process9, Boot11, Kernel11, TwlBg, [[Codec Services]], [[NWM Services]], [[SPI Services]], [[PDN Services]]
| Power management
|-
| style="background: green" | Yes
| A11/A9
| [[SPI Registers]]
| 0x10142000
| TwlBg, [[SPI Services]]
|
|-
| style="background: green" | Yes
| A11/A9
| [[SPI Registers]]
| 0x10143000
| TwlBg
| Only used under TWL_FIRM?
|-
| style="background: green" | Yes
| A11/A9
| [[I2C Registers]]
| 0x10144000
| Boot11, Kernel11, TwlBg, [[I2C Services]]
|
|-
| style="background: green" | Yes
| A11/A9
| [[CODEC Registers]]
| 0x10145000
| TwlBg, [[Codec Services]]
|
|-
| style="background: green" | Yes
| A11/A9
| [[HID Registers]]
| 0x10146000
| Boot11, Kernel11, TwlBg, [[HID Services]]
| See [[PAD]].
|-
| style="background: green" | Yes
| A11/A9
| [[GPIO Registers]]
| 0x10147000
| Boot11, TwlBg, [[GPIO Services]]
|
|-
| style="background: green" | Yes
| A11/A9
| [[I2C Registers]]
| 0x10148000
| TwlBg, [[I2C Services]]
|
|-style="border-top: double"
| style="background: green" | Yes
| A11/A9
| [[SPI Registers]]
| 0x10160000
| Boot9, TwlBg, [[SPI Services]]
|
|-
| style="background: green" | Yes
| A11/A9
| [[I2C Registers]]
| 0x10161000
| Boot11, TwlBg, [[I2C Services]]
|
|-
| style="background: green" | Yes
| A11/A9
| [[MIC Registers]]
| 0x10162000
| [[MIC Services]]
|
|-
| style="background: green" | Yes
| A11/A9
| [[PXI Registers]]
| 0x10163000
| Boot11, Kernel11, TwlBg, [[PXI Services]]
|
|-
| style="background: green" | Yes
| A11/A9
| [[NTRCARD Registers]]
| 0x10164000
| Boot9, Process9
|
|-
| style="background: green" | Yes
| A11/A9
| [[MP Registers]]
| 0x10165000
| [[MP Services]]
|
|-style="border-top: double"
| style="background: green" | Yes
| A11/A9
| [[MP Registers]]
| 0x10170000
| [[MP Services]]
| NTR WIFI Registers, see [http://problemkaputt.de/gbatek.htm#dswirelesscommunications GBATek].
|-
| style="background: green" | Yes
| A11/A9
| [[MP Registers]]
| 0x10171000
| [[MP Services]]
| NTR WIFI Registers (mirror)
|-
| style="background: green" | Yes
| A11/A9
|?
| 0x10172000
|
| NTR WIFI Unused?
|-
| style="background: green" | Yes
| A11/A9
|?
| 0x10173000
|
| NTR WIFI Unused?
|-
| style="background: green" | Yes
| A11/A9
| [[MP Registers]]
| 0x10174000
| [[MP Services]]
| NTR WIFI RAM
|-
| style="background: green" | Yes
| A11/A9
| [[MP Registers]]
| 0x10175000
|?
| NTR WIFI RAM
|-
| style="background: green" | Yes
| A11/A9
| [[MP Registers]]
| 0x10176000
|?
| NTR WIFI Registers (mirror)
|-
| style="background: green" | Yes
| A11/A9
| [[MP Registers]]
| 0x10177000
|?
| NTR WIFI Registers (mirror)
|-
| style="background: green" | Yes
| A11/A9
| [[MP Registers]]
| 0x10178000 - 0x10180000
| [[MP Services]]
| NTR WIFI WS1 Region
|-style="border-top: double"
| style="background: orange" |?
| A11
| CDMA
| 0x10200000
| Boot11, Kernel11
| On old 3DS this is [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0424d/index.html CoreLink™ DMA-330]. On the New 3DS it is unknown what this is.
|-
| style="background: green" | Yes
| A11
|?
| 0x10202000
| TwlBg, Kernel11, [[GSP Services]]
|
|-
| style="background: green" | Yes
| A11
| DSP
| 0x10203000
| [[DSP Services]]
|
|-
| style="background: orange" |?
| A11
| CDMA
| 0x10206000
| NewKernel11
| CDMA was moved here on New 3DS. [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0424d/index.html CoreLink™ DMA-330].
|-
| style="background: orange" |?
| A11
| [[MVD Registers]]
| 0x10207000
| [[MVD Services]]
| New 3DS only?
|-
| style="background: green" | Yes
| A11
| GPU?
| 0x1020F000
| TwlBg, [[GSP Services]]
|
|-style="border-top: double"
| style="background: green" | Yes
| A11
| MIRROR
| 0x10300000-0x10400000
|
| Mirror of 0x10100000-0x10200000 (faster bus?), CDMA wants these addresses
|-style="border-top: double"
| style="background: green" | Yes
| A11
| [[LCD Registers]]
| 0x10400000
| Boot11, Kernel11, [[GSP Services]]
|
|-
| style="background: green" | Yes
| A11
| [[LCD Registers]]
| 0x10420000
| [[GSP Services]]
|
|}

IO registers starting at physical address 0x10200000 are not accessible from the ARM9 (which includes all LCD/GPU registers).

ARM11 kernel virtual address mappings for these registers varies for different builds. For ARM11 user mode applications you have:
physaddr = virtaddr - 0x1EC00000 + 0x10100000

=0x10012000=
Keys seem to be stored here? Access to this region is disabled once the ARM9 writes 0x2 to [[CONFIG|REG_SYSPROT9]]. Before writing that bit, the ARM9 copies the low u32 for the TWL keydata to +0x100 (and high u32 keydata to +0x104 with the New 3DS). On development units ([[CONFIG|UNITINFO]]!=0) ARM9 uses the first 8-bytes from 0x10012000 for the TWL keydata.

Originally the above TWL keyinit + region disable was done by Kernel9. However, with the [[New_3DS]] FIRM ARM9 binary this is now done in the [[FIRM]] ARM9 binary loader, which also uses the 0x10012000 region for key generation.

IO Registers

2014-11-06T02:38:18Z

Vgturtle127: Fixed some stuff and added things we need to know

= Overview =

{| class="wikitable" border="1"
! Old3DS
! A9/A11
! Category
! Physaddr
! Used by
! Comments
|-
| style="background: green" | Yes
| A9
| [[CONFIG Registers]]
| 0x10000000
| Boot9, Process9
|
|-
| style="background: green" | Yes
| A9
| [[IRQ Registers]]
| 0x10001000
| Boot9, Process9, Kernel9
| ARM9 Interrupt Masking
|-
| style="background: green" | Yes
| A9
| [[NDMA Registers]]
| 0x10002000
| Boot9, Process9
| DMA Engine
|-
| style="background: green" | Yes
| A9
| [[TIMER Registers]]
| 0x10003000
| Boot9, Process9
|
|-
| style="background: green" | Yes
| A9
| [[CTRCARD Registers]]
| 0x10004000 / 0x10005000
| Process9
|
|-
| style="background: green" | Yes
| A9
| [[EMMC Registers]]
| 0x10006000 / 0x10007000
| Boot9, Process9
| 0x10007000 is apparently not used on retail
|-
| style="background: green" | Yes
| A9
| [[PXI Registers]]
| 0x10008000
| Boot9, Process9
|
|-
| style="background: green" | Yes
| A9
| [[AES Registers]]
| 0x10009000
| Boot9, Process9
|
|-
| style="background: green" | Yes
| A9
| [[SHA Registers]]
| 0x1000A000
| Boot9, Process9
|
|-
| style="background: green" | Yes
| A9
| [[RSA Registers]]
| 0x1000B000
| Boot9, Process9
|
|-
| style="background: green" | Yes
| A9
| [[XDMA Registers]]
| 0x1000C000
| Boot9, Kernel9
| [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0424d/index.html CoreLink™ DMA-330]
|-
| style="background: green" | Yes
| A9
| [[SPICARD Registers]]
| 0x1000D800
| Process9
|
|-style="border-top: double"
| style="background: green" | Yes
|?
| [[CONFIG Registers]]
| 0x10010000
| Process9
|
|-
| style="background: green" | Yes
|?
| [[CONFIG Registers]]
| 0x10011000
| Process9
|
|-
| style="background: green" | Yes
|?
|?
| 0x10012000
| Kernel9, NewKernel9Loader
| Top secret.
|-
| style="background: green" | Yes
|?
|?
| 0x10018000
| TwlProcess9
| Used to setup the ARM7 core for AGB/TWL
|-style="border-top: double"
| style="background: green" | Yes
|?
|?
| 0x10100000
|?
|?
|-
| style="background: green" | Yes
| A11/A9
| [[HASH Registers]]
| 0x10101000
| [[Filesystem services]]
|
|-
| style="background: green" | Yes
| A11/A9
| [[Camera Registers]]
| 0x10102000
| [[Camera Services]]
| y2r
|-
| style="background: green" | Yes
| A11/A9
| [[CSND Registers]] / DSP
| 0x10103000
| TwlBg, [[Codec Services]], [[CSND Services]], [[DSP Services]]
| Sound Hardware
|-style="border-top: double"
| style="background: green" | Yes
| A11/A9
|?
| 0x10110000
|?
|?
|-
| style="background: green" | Yes
| A11/A9
|?
| 0x10111000
| TwlBg
|
|-style="border-top: double"
| style="background: green" | Yes
| A11/A9
| [[Camera Registers]]
| 0x10120000
| [[Camera Services]]
|
|-
| style="background: green" | Yes
| A11/A9
| [[Camera Registers]]
| 0x10121000
| [[Camera Services]]
| Mirror of 0x10120000?
|-
| style="background: green" | Yes
| A11/A9
|?
| 0x10122000
| [[NWM Services]]
| WIFI?
|-
| style="background: green" | Yes
| A11/A9
|?
| 0x10123000
| [[NWM Services]]
| WIFI?
|-style="border-top: double"
| style="background: red" | No
| A11/A9
| [[MVD Registers]]
| 0x10130000
| [[MVD Services]]
|
|-
| style="background: red" | No
| A11/A9
| [[MVD Registers]]
| 0x10131000
| [[MVD Services]]
|
|-
| style="background: red" | No
| A11/A9
| [[MVD Registers]]
| 0x10132000
| [[MVD Services]]
|
|-style="border-top: double"
| style="background: green" | Yes
| A11/A9
|
| 0x10140000
| Process9, Boot11, Kernel11, TwlBg, [[DSP Services]], [[NWM Services]], [[SPI Services]]
| Power management
|-
| style="background: green" | Yes
| A11/A9
| [[PDN Registers]] / [[CODEC Registers]]
| 0x10141000
| Process9, Boot11, Kernel11, TwlBg, [[Codec Services]], [[NWM Services]], [[SPI Services]], [[PDN Services]]
| Power management
|-
| style="background: green" | Yes
| A11/A9
| [[SPI Registers]]
| 0x10142000
| TwlBg, [[SPI Services]]
|
|-
| style="background: green" | Yes
| A11/A9
| [[SPI Registers]]
| 0x10143000
| TwlBg
| Only used under TWL_FIRM?
|-
| style="background: green" | Yes
| A11/A9
| [[I2C Registers]]
| 0x10144000
| Boot11, Kernel11, TwlBg, [[I2C Services]]
|
|-
| style="background: green" | Yes
| A11/A9
| [[CODEC Registers]]
| 0x10145000
| TwlBg, [[Codec Services]]
|
|-
| style="background: green" | Yes
| A11/A9
| [[HID Registers]]
| 0x10146000
| Boot11, Kernel11, TwlBg, [[HID Services]]
| See [[PAD]].
|-
| style="background: green" | Yes
| A11/A9
| [[GPIO Registers]]
| 0x10147000
| Boot11, TwlBg, [[GPIO Services]]
|
|-
| style="background: green" | Yes
| A11/A9
| [[I2C Registers]]
| 0x10148000
| TwlBg, [[I2C Services]]
|
|-style="border-top: double"
| style="background: green" | Yes
| A11/A9
| [[SPI Registers]]
| 0x10160000
| Boot9, TwlBg, [[SPI Services]]
|
|-
| style="background: green" | Yes
| A11/A9
| [[I2C Registers]]
| 0x10161000
| Boot11, TwlBg, [[I2C Services]]
|
|-
| style="background: green" | Yes
| A11/A9
| [[MIC Registers]]
| 0x10162000
| [[MIC Services]]
|
|-
| style="background: green" | Yes
| A11/A9
| [[PXI Registers]]
| 0x10163000
| Boot11, Kernel11, TwlBg, [[PXI Services]]
|
|-
| style="background: green" | Yes
| A11/A9
| [[NTRCARD Registers]]
| 0x10164000
| Boot9, Process9
|
|-
| style="background: green" | Yes
| A11/A9
| [[MP Registers]]
| 0x10165000
| [[MP Services]]
|
|-style="border-top: double"
| style="background: green" | Yes
| A11/A9
| [[MP Registers]]
| 0x10170000
| [[MP Services]]
| NTR WIFI Registers, see [http://problemkaputt.de/gbatek.htm#dswirelesscommunications GBATek].
|-
| style="background: green" | Yes
| A11/A9
| [[MP Registers]]
| 0x10171000
| [[MP Services]]
| NTR WIFI Registers (mirror)
|-
| style="background: green" | Yes
| A11/A9
|?
| 0x10172000
|
| NTR WIFI Unused?
|-
| style="background: green" | Yes
| A11/A9
|?
| 0x10173000
|
| NTR WIFI Unused?
|-
| style="background: green" | Yes
| A11/A9
| [[MP Registers]]
| 0x10174000
| [[MP Services]]
| NTR WIFI RAM
|-
| style="background: green" | Yes
| A11/A9
| [[MP Registers]]
| 0x10175000
|?
| NTR WIFI RAM
|-
| style="background: green" | Yes
| A11/A9
| [[MP Registers]]
| 0x10176000
|?
| NTR WIFI Registers (mirror)
|-
| style="background: green" | Yes
| A11/A9
| [[MP Registers]]
| 0x10177000
|?
| NTR WIFI Registers (mirror)
|-
| style="background: green" | Yes
| A11/A9
| [[MP Registers]]
| 0x10178000 - 0x10180000
| [[MP Services]]
| NTR WIFI WS1 Region
|-style="border-top: double"
| style="background: orange" |?
| A11
| CDMA
| 0x10200000
| Boot11, Kernel11
| On old 3DS this is [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0424d/index.html CoreLink™ DMA-330]. On the New 3DS it is unknown what this is.
|-
| style="background: green" | Yes
| A11
|?
| 0x10202000
| TwlBg, Kernel11, [[GSP Services]]
|
|-
| style="background: green" | Yes
| A11
| DSP
| 0x10203000
| [[DSP Services]]
|
|-
| style="background: orange" |?
| A11
| CDMA
| 0x10206000
| NewKernel11
| CDMA was moved here on New 3DS. [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0424d/index.html CoreLink™ DMA-330].
|-
| style="background: orange" |?
| A11
| [[MVD Registers]]
| 0x10207000
| [[MVD Services]]
| New 3DS only?
|-
| style="background: green" | Yes
| A11
| GPU?
| 0x1020F000
| TwlBg, [[GSP Services]]
|
|-style="border-top: double"
| style="background: green" | Yes
| A11
| MIRROR
| 0x10300000-0x10400000
|
| Mirror of 0x10100000-0x10200000 (faster bus?), CDMA wants these addresses
|-style="border-top: double"
| style="background: green" | Yes
| A11
| [[LCD Registers]]
| 0x10400000
| Boot11, Kernel11, [[GSP Services]]
|
|-
| style="background: green" | Yes
| A11
| [[LCD Registers]]
| 0x10420000
| [[GSP Services]]
|
|}

IO registers starting at physical address 0x10200000 are not accessible from the ARM9 (which includes all LCD/GPU registers).

ARM11 kernel virtual address mappings for these registers varies for different builds. For ARM11 user mode applications you have:
physaddr = virtaddr - 0x1EC00000 + 0x10100000

=0x10012000=
Keys seem to be stored here? Access to this region is disabled once the ARM9 writes 0x2 to [[CONFIG|REG_SYSPROT9]]. Before writing that bit, the ARM9 copies the low u32 for the TWL keydata to +0x100 (and high u32 keydata to +0x104 with the New 3DS). On development units ([[CONFIG|UNITINFO]]!=0) ARM9 uses the first 8-bytes from 0x10012000 for the TWL keydata.

Originally the above TWL keyinit + region disable was done by Kernel9. However, with the [[New_3DS]] FIRM ARM9 binary this is now done in the [[FIRM]] ARM9 binary loader, which also uses the 0x10012000 region for key generation.

Services

2014-11-06T00:42:00Z

Vgturtle127: Corrected some stuff

Handles for services are retrieved from the service manager port, "srv:". Services are an abstraction of ports, they operate the same way except regular ports can have their handles retrieved directly from a [[SVC]](svcConnectToPort).

Processes with PID less than or equal to the number of NATIVE_FIRM built-in modules (fs, sm, pm, pxi, ldr) have access to all services.

==Service Manager Port "srv:"==
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010002
| Initialize
|-
| 0x00020000
| GetProcSemaphore (the handle from this gets signaled when notifications for this process gets triggered)
|-
| 0x00030100
| RegisterService (8-byte servicename, u32 strlen, u32 flags?)
|-
| 0x000400C0
| UnregisterService (8-byte servicename, u32 strlen)
|-
| 0x00050100
| GetServiceHandle (8-byte servicename, u32 strlen, u32 flags?)
|-
| 0x000600c2
| RegisterHandle? (8-byte servicename, u32 strlen, Handle h)
|-
| 0x0007....
| UnregisterHandle? (8-byte servicename, u32 strlen)
|-
| 0x0008....
| ishandlepresent (8-byte servicename, u32 strlen,u32 flags) if flag is set it returns the handle?
|-
| 0x00090040
| IsRegistered This enables the specified notificationID for the current process.
|-
| 0x000A....
| This disables the specified notificationID for the current process (u32 ID)
|-
| 0x000B0000
| ReceiveNotification This returns the notificationID which was triggered, if any(see GetProcSemaphore).
|-
| 0x000C0080
| PublishToSubscriber(u32 ID,u32 flag) This can fire notificationID (Bit(0) only fire if not already fired, Bit(1) = return error if error happens, else it always returns 0)
|-
| 0x000D....
| This can fire notificationIDs and return the number of fired notificationID
|-
| 0x000E....
| returns 1 if the service is registered. 0 if not (8-byte servicename, u32 strlen)
|}

==Service Manager Process-Manager Port "srv:pm"==
{| class="wikitable" border="1"
|-
! Command Header, prior to [[7.0.0-13]]
! Description
|-
| 0x04030082
| RegisterProcess (u32 procid, u32 wordsz, <nowiki>((wordsz<<16) | 2)</nowiki>, serviceaccesscontrol*).
|-
| 0x04040040
| UnregisterProcess (u32 procid).
|}

The Register command registers a process with the service-manager, which includes registering the serviceaccesscontrol for the process which normally originates from the [[NCCH/Extended_Header|exheader]].

Prior to to [[7.0.0-13]], the commands listed for "srv:" were also accessible under this port with the same command-headers. Starting with [[7.0.0-13]], the "srv:pm" port was changed to a service. With this change, commandIDs for these commands were changed. "srv:pm" was originally vulnerable, this was fixed with [[7.0.0-13]], see [[3DS_exploits|here]]. Originally any process could use "srv:pm", however starting with [[7.0.0-13]] only the built-in NATIVE_FIRM sysmodules have access to it. The only system title which uses "srv:pm" is the [[Process_Manager_Services|Process Manager]].

==Notifications==
{| class="wikitable" border="1"
|-
! ID
! Description
|-
| 0x100
| This indicates that all processes must terminate: power-off, reboot, or [[FIRM]]-launch.
|-
| 0x204
| This indicates that the HOME button was pressed.
|}

ErrDisp

2014-11-05T23:56:41Z

Vgturtle127: Fixes

This system process handles displaying the error screens, such as "an error has occurred, the system needs shutdown". This can also display a register dump for exceptions, and info for fatal errors. (Normally the black-screen errors are displayed on retail, while the latter is displayed on development units.)

The register dump/fatal error info can also be written to [[nandrw/sys/native.log]]. On retail consoles, the system does not notify ErrDisp that any user-land exceptions occurred, ErrDisp is only notified for this on dev/debug units. Therefore, on retail consoles native.log only contains info from fatal errors. Starting with [[5.0.0-11]] ErrDisp no longer writes logs to native.log, except when the error-type is value 5 and when other checks with the errorinfo structure are successful (normally processes using this port never use error-type 5).

The bottom screen displays the error screen like "error has occurred", even with a development 3DS. The top screen can display the development error info, this is only displayed when [[Configuration_Memory|UNITINFO]] bit0 is clear, for a development 3DS.

ErrDisp handles "returning" to Home Menu via [[NSS:RebootSystem]], which triggers a hardware system reboot.

= ErrDisp error port "err:f" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010800
| ThrowFatalError(0x80-byte errorinfo)
|-
| 0x00020042
| (size, <nowiki>(size<<14) | 2</nowiki>, errorinfoptr) This is similar to cmd1, except with this the input buffer is copied to final output errorinfo+0x80 instead of +0x0, via the ARM11 kernel. Max size is 0x100. ErrDisp doesn't do anything in the cmd-handler for this command at all, besides checking the command header and buffer header.
|}

Legacy FIRM PXI

2014-11-05T23:52:37Z

Vgturtle127: Fix stuff AGAIN

This page describes the PXI commands for TWL_FIRM/AGB_FIRM.

{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Description
|-
| 0x0001....
| [[1.0.0-0]]
|?
|-
| 0x00020080
| [[1.0.0-0]]
| (u64 application_titleID) This launches the specified TWL title. Eventually this will wait for command 0x00040080 to be sent.
|-
| 0x00030080
| [[1.0.0-0]]
| (u64 application_titleID) This launches the specified GBA VC title.
|-
| 0x00040080
| [[1.0.0-0]]
|?
|-
| 0x0005....
| [[1.0.0-0]]
|?
|-
| 0x0006....
| [[1.0.0-0]]
|?
|-
| 0x0007....
| [[1.0.0-0]]
|?
|-
| 0x0008....
| [[1.0.0-0]]
|?
|-
| 0x0009....
| [[1.0.0-0]]
|?
|-
| 0x000A....
| [[1.0.0-0]]
|?
|-
| 0x000B0040
| [[1.0.0-0]]
| This is used for TWL initialization, prior to using command 0x00020080.
|-
| 0x000C0800
| [[1.0.0-0]]
| This writes the input 0x80-byte ASCII data to [[Flash_Filesystem|nand:/rw/sys/lgy.log]].
|}

Services API

2014-11-05T23:42:39Z

Vgturtle127: Fixing some wording

Nintendo provides application developers with an API, which communicate with certain services. Services, in this sense, are system processes running in the background which wait for incoming requests. When a process wants to communicate with a service, it first needs to get a handle to the named service, and then it can communicate with the service via interprocess communication. Each service has a name up to 8 characters, for example "nim:u".

Handles for services are retrieved from the service manager port, "srv:". Services are an abstraction of ports, they operate the same way except regular ports can have their handles retrieved directly from a SVC.

For a description of how commands and arguments are passed to services, see [[IPC Command Structure]].

List of services:
{| class="wikitable" border="1"
|-
! Old3ds
! Services
! Service names
! scope="col" width="200" | Notes
|-
| style="background: green" | Yes
| [[Filesystem services‎]]
| fs:USER, fs:LDR, fs:REG
|
|-
| style="background: green" | Yes
| [[Process Services‎]]
|
|
|-
| style="background: green" | Yes
| [[PXI Services‎]]
| PxiFS0, PxiFS1, PxiFSB, PxiFSR, PxiPM, pxi:am9, pxi:dev, pxi:mc, pxi:ps9
|
|-
| style="background: green" | Yes
| [[Application Manager Services]]
| am:net, am:u, am:sys, am:pipe
|
|-
| style="background: green" | Yes
| [[Process Manager Services]]
| pm:app, pm:dbg
|
|-
| style="background: green" | Yes
| [[NIM Services]]
|
|
|-
| style="background: green" | Yes
| [[Config Services]]
|
|
|-
| style="background: green" | Yes
| [[NS|NS and APT Services]]
|
|
|-
| style="background: green" | Yes
| [[RO Services]]
|
|
|-
| style="background: green" | Yes
| [[NDM Services]]
|
|
|-
| style="background: green" | Yes
| [[CSND Services]]
|
|
|-
| style="background: green" | Yes
| [[DSP Services]]
|
|
|-
| style="background: green" | Yes
| [[GSP Services]]
|
|
|-
| style="background: green" | Yes
| [[IR Services]]
|
|
|-
| style="background: green" | Yes
| [[I2C Services]]
|
|
|-
| style="background: green" | Yes
| [[GPIO Services]]
|
|
|-
| style="background: green" | Yes
| [[HID Services]]
|
|
|-
| style="background: green" | Yes
| [[PTM Services]]
|
|
|-
| style="background: green" | Yes
| [[NWM Services]]
|
|
|-
| style="background: green" | Yes
| [[HTTP Services]]
|
|
|-
| style="background: green" | Yes
| [[SSL Services]]
|
|
|-
| style="background: green" | Yes
| [[Socket Services]]
|
|
|-
| style="background: green" | Yes
| [[AC Services]]
|
|
|-
| style="background: green" | Yes
| [[Friend Services]]
|
|
|-
| style="background: green" | Yes
| [[PDN Services]]
|
|
|-
| style="background: green" | Yes
| [[SPI Services]]
|
|
|-
| style="background: green" | Yes
| [[Loader Services]]
|
|
|-
| style="background: green" | Yes
| [[MCU Services]]
|
|
|-
| style="background: green" | Yes
| [[MIC Services]]
|
|
|-
| style="background: red" | No
| [[NFC Services]]
|
|
|-
| style="background: red" | No
| [[MVD Services]]
|
|
|-
| style="background: red" | No
| [[QTM Services]]
|
|
|}

List of PXI services:
* [[Filesystem services PXI]]
* [[Process Services PXI]]
* [[Application Manager Services PXI]]
* [[Process Manager Services PXI]]
* [[Development Services PXI]]
* [[Gamecard Services PXI]]
* [[Legacy FIRM PXI]] (TWL_FIRM/AGB_FIRM)

List of ports:
* [[ErrDisp]]
* [[Services]]

See [[Error codes]].