NIM Services

NIM user service "nim:u"

Command Header	Description
0x00010000	Related to starting a sysupdate?
0x00020000	GetUpdateDownloadProgress
0x0003....	?
0x00040000	FinishTitlesInstall
0x00050000	This obtains an event handle. Home Menu will check whether a system update is available when this event is triggered.
0x0006....	?
0x0007....	?
0x0008....	?
0x00090000	CheckSysupdateAvailable
0x000A0000	GetState
0x000B0000	GetSystemTitleHash
0x000C0082	?
0x000E0080	?
0x000F0042	?
0x00110000	?
0x00130000	?
0x00140000	?
0x00150000	?
0x00170042	?
0x00180080	?
0x00250000	?
0x00260200	?
0x00270000	?
0x00280000	?
0x00290246	?
0x002A0000	?
0x002B0000	?
0x002C0000	?
0x002D00C0	?
0x00480002	?

NIM server service "nim:s"

Command Header	Description
0x00060080	The input at cmdreq[1-2] is an u64 titleID. This writes an u8 to cmdreply[2]. It's unknown what exactly the eShop application uses this for, it only uses this command for apps which are installed(checked via AM probably). In those cases, it seems the outval for this command(with result-code=0) is normally 0?
0x000A0000	CheckSysupdateAvailableSOAP
0x0016020A	ListTitles
0x0022....	AccountDeleteTitleETicketsSOAP. The SOAP request is sent only after the ticket for the specified titleID has been successfully deleted.
0x00290000	AccountCheckBalanceSOAP
0x002D0042	DownloadTickets
0x00420240	StartDownload

NIM server service "nim:aoc"

Command Header	Description
0x00030042	SetApplicationId
0x00040042	SetTin
0x000902D0	ListContentSetsEx
0x00180000	GetBalance
0x001D0000	GetCustomerSupportCode
0x00210000	Initialize
0x00240282	CalculateContentsRequiredSize
0x00250000	RefreshServerTime

kagiya server

The nim system module communicates with a server called kagiya (kagiya-ctr.cdn.nintendo.net or kagiya-dev-ctr.cdn.nintendo.net for development units). It provides the 9.6 crypto seed in binary form for any given title ID under (HTTPS) kagiya-ctr.cdn.nintendo.net/title/0x%16llx/ext_key?country=%s, where %16llx is the title ID and %s is a country code as used in the eShop.

New3DS

NIM module only uses CheckNew3DS for determining what heap sizes to use, in two functions. One is for the size of the 0x08000000 vmem heap, the other is probably for some buffer allocated on that heap. The New3DS version of these sizes are 0x1C000-bytes larger than the Old3DS sizes here.

HTTPS requests

Trusted RootCAs

During startup NIM-module creates two RootCertChains with HTTPC. Both of these only contain the same default cert with ID 0x3. The first RootCertChain is used with NetUpdateSOAP. Requests such as the "notifications.json" page don't use these RootCertChains(in this case just default certID 0xB is used).

SOAP

NetUpdateSOAP

There are exactly 3 types of network SOAP requests used with NetUpdateSOAP by NIM module, described below. This URL contained in NIM module itself is only used with GetSystemTitleHash. The other requests use an identical URL loaded from an ECommerceSOAP response instead.

See also here.

GetSystemUpdate

Returns the current sysupdate title-listing. This also contains the SystemTitleHash returned by GetSystemTitleHash.

GetSystemTitleHash

Returns the current SystemTitleHash for the current sysupdate title-listing.

GetSystemCommonETicket

Returns the Base64-encoded cetk for each specified TitleId entry.

This is only used when installing new titles. This means with CDN system-updates, tickets are never installed except when a title is being installed for the first time. For example, a system on the latest system-version that was only ever updated via CDN has the same NATIVE_FIRM ticket installed from the factory.

Sysupdate checking process

This section describes the process used when checking whether a sysupdate is required.

First the GetSystemTitleHash SOAP request is done. Then the SystemTitleHash in savedata hash.dat is compared with the received one. If they match and the SystemTitleHash flag is set to value 0x03, it will immediately return that no sysupdate is required. Otherwise it will start the GetSystemUpdate SOAP request handling.

The GetSystemUpdate SOAP request contains a titlelist of all NAND system-titles. For GetSystemUpdate response parsing, it compares each SOAP title_entry with the NAND system titlelist. If a SOAP titleID isn't found in the NAND titlelist, this means NAND is missing a new title and hence a sysupdate is required for installing that title. If a NAND title_entry-version is less than the SOAP title_entry-version, this means the title needs updated and hence a sysupdate is required.

At least one <TitleVersion> entry with valid data in the GetSystemUpdate response is required.

The titleIDs sent in the GetSystemUpdate SOAP request are decimal, while the titleIDs in the response are hex.

NIM System_SaveData

hash.dat

Offset	Size	Description
0x60	0x1	u8 flag used with the SystemTitleHash. 0x01 = latest sysupdate isn't installed as of last SOAP requests, 0x03 = latest sysupdate is installed as of last SOAP requests.
0x61	0x21	ASCII hex SystemTitleHash, including NUL-terminator. This is the latest SystemTitleHash which NIM module received from SOAP.

Types

InstallationMode

Value	Description
0	Initial installation
1	Unknown
2	Unknown
3	Reinstallation

DownloadState

Value	Description
0	Not initialized
1	Download initialized
2	Downloading, verifying and installing TMD
3	Initializing save data
4	Downloading and installing contents
5	Waiting before calling AM:CommitImportPrograms
6	Running AM:CommitImportPrograms
7	Title installation finished
8	Unknown error regarding title version
9	Creating the .ctx file (or error doing so)?
10	Irrecoverable error encountered

TitleConfig

Offset	Length	Description
0x0	0x8	Title ID
0x8	0x4	Title version
0xC	0x4	Unknown (always 0)
0x10	0x1	Age rating for the HOME Menu parental controls
0x11	0x1	Media Type
0x12	0x2	Padding
0x14	0x4	Unknown (always 0?)

TitleProgress

Offset	Length	Description
0x0	0x4	Download State
0x4	0x4	Last result code in NIM related to the installation
0x8	0x8	Amount of bytes that have been downloaded
0x10	0x8	Total bytes that need to be downloaded