YouTube

The YouTube application available from the eShop is a web-browser. Like the main browser this uses WebKit. All data is downloaded with plaintext HTTP.

User-Agent and Browser Versions

The user-agent format is almost identical to the main browser: "Mozilla/5.0 (Nintendo 3DS; U; ; Factory Media Production) Version/<version>.<region>". <lang> is "en", "fr", etc. <region> is "US", "EU", etc. See below for <version>.

Browser version	USA/EUR CDN Title-version	Release date	Notes
1.7498	v16 and v0		Initial app version.
1.7498	v1056 and v1040		First app update. This build uses the v7.0 NCCH encryption for the main CXI, this was the first retail title to use this.
1.7498	v2096 and v2080	October 15, 2015	This update fixed the vuln used for tubehax. This version was built with the latest CTRSDK, so NATIVE_FIRM 9.6.0-X is now required. Plaintext HTTP is still used. The RomFS is empty, and accessinfo is still 0x0. Strings related to RO are still in the codebin, but during application startup ldr:ro isn't used at all. The CROs are now built with the main codebin(included with the main .text etc), hence the much larger sections listed below. The codebin sections are much larger: "Code text size: 0x003A9CF0" -> "Code text size: 0x00A81470" "Code ro size: 0x000B9360" -> "Code ro size: 0x0014C848" "Code data size: 0x00203F08" -> "Code data size: 0x00207788" "Code bss size: 0x00095748" -> "Code bss size: 0x00094F48" The USA codebin contains the following user-agent strings: "Mozilla/5.0 (Nintendo 3DS; U; Factory Media Production; en) Version/1.7498.US" and "Mozilla/5.0 (Nintendo 3DS New3DS; U; Factory Media Production; en) Version/1.7499.US".

Updates for this application are forced, since the app itself checks for a newer version of the title(this is done before any actual HTTP requests by the actual application are done). This is done with Friend_Services: the application tries to authenticate itself with FRDU. When the installed version is outdated, it gets an error-code in the output buffer for FRDU:GetGameAuthenticationData(this error-code then gets passed to the error-display applet).

The friend HTTP requests which are involved with the above use HTTPS, so blocking it (probably) isn't an option(the usual POST request(s) to https://nasc.nintendowifi.net/ac).

RomFS

The RomFS only contains CROs("/cro/") and the CRR("/.crr/static.crr"), the following is the "/cro/" contents:

• JavaScriptCore_CTR.cro
• WebCore_CTR.cro
• WebkitMediaPlayer_CTR.cro
• WebKit_CTR.cro
• static.crs

Webkit

Looks like the YouTube application uses a newer version of Webkit than the Internet Browser applet. It has the ability to construct Blobs, of course the HTML5 video element, and possibly the Audio element (Visible, but untested). It also supports the localStorage API. Here a list of exposed apis: [1].

embedded.ctr

Inside the YouTube app, there is a pseudo-webserver running that links to a structure inside ExeFS. This structure provides a list of urls under the domain "http://embeded.ctr/".