EShop
The Nintendo 3DS eShop was added in the June 2011 update for JP/EUR/USA.
From here, you can download Virtual Console games, 3D Classics, DSiware software, view screenshots, and 3D trailers for upcoming 3DS titles.
While eShop is loading, eShop will use command NIMS:CheckSysupdateAvailableSOAP. If a system update is available where title installation for system titles still needs finalized (or when the updated titles were not downloaded at all), eShop will then display the "system update is available" message.
The eShop application uses command AMNet:FinishInstallToMedia to finalize the SD title install (if the whole title is downloaded while eShop is still running), however, before using that command the eShop application also uses AMNet:FinishInstallToMedia to finalize installing all system titles (from system updates).
eShop QR Codes
eShop QR Codes can be scanned with the camera, allowing one to quickly navigate to the desired eShop title with just two clicks. The QR Codes themselves is a simple text/url QR, started with "ESHOP://" string followed by a decimal eShop content link id(same IDs used internally by eShop for all content) and then some special data, delimited by a dot symbol, which can be ommited.
In order for the QR-code string data to be valid for eShop, it must begin with "ESHOP://5", with the first ID being all decimal.
QR Code source | Region | Title | Serial | Title ID |
---|---|---|---|---|
ESHOP://50010000000201.PEAALL000000 | EUR | Nintendogs & Cats Demo | ADA/B/C | 0004000200030c01 |
ESHOP://50010000007870.PEAALL000000 | EUR | Crush 3D | A??P | 00040002 |
ESHOP://50010000008009.PEAALL000000 | EUR | Resident Evil Revelations Demo | ABRE | 000400020005ee01 |
ESHOP://50010000008123.J00101Z00095 | JPN | Rhythm Thief And The Emperor's Treasure Demo | ARTJ | 00040002 |
ESHOP://50010000008404.PEAALL000000 | EUR | Mario And Sonic At The London 2012 Olympic Games Demo | ACMP [1] | 00040002 |
ESHOP://50010000008447.J00101Z00094 | JPN | Resident Evil Revelations Demo | ABRJ | 00040002 |
ESHOP://50010000008449.J00101Z00082 | JPN | Swapnote | JFRJ | ? |
ESHOP://50010000008561 | USA | Swapnote | JFRE | 0004000000051700 |
ESHOP://50010000008647.J00101Z00096 | JPN | Metal Gear Solid Snake Eater 3D Demo | AMGJ | 0004000200048101 |
ESHOP://50010000008648.J00101Z00097 | JPN | Theatrythm Final Fantasy | ATHJ | ? |
ESHOP://50010000008782.PEAALL000000 | EUR | Metal Gear Solid Snake Eater 3D Demo | AMGE | 0004000200082401 |
ESHOP://50010000008842.PEAALL000000 | EUR | Rhythm Thief And The Emperor's Treasure Demo | ARTP [2] | 00040002 |
ESHOP://50010000009084.J00101Z00121 | JPN | Hatsune Miku And Future Stars: Project Mirai Demo | AM9J | 00040002 |
ESHOP://50010000009102.J00101Z00106 | JPN | Denpa Ningen RPG | JD8J | ? |
ESHOP://50010000009161.J00101Z00118 | JPN | Dillon's Rolling Western | JAMJ | 00040000 |
ESHOP://50010000009261 | USA | Dillon's Rolling Western | JAME? | 00040000 |
ESHOP://50010000009401.J00101Z00120 | JPN | Kingdom Hearts 3D Video Download | JZ8J | ? |
ESHOP://50010000009403.J00101Z00119 | JPN | DQM 3D Video Download | JZ7J | ? |
ESHOP://50010000009575.PEAALL000000 | EUR | Kid Icarus: Of Myths And Monsters (Virtual Console) | ? | ? |
ESHOP://50010000009846 | USA | Ketzal's Corridors | ? | ? |
- New QR Code for Japanese "Photos with Super Mario" has a different code string: ESHOP://50010000013120.J00108Z00001.CD588EAE95A3A68D15C647DA2AC0945FD88F70AB8A31149E51C4B05FB927B0B8
- There is a link in the Japanese eShop [http://www.nintendo.co.jp/3ds/eshop/qrCode.html?####] where you can replace the #### with the Japanese eShop title's serial and you will get it's QR code. (i.e. http://www.nintendo.co.jp/3ds/eshop/qrCode.html?jcaj will get you the pushmo QR code)
- You could use Google's Chart API to create a QR code from the codes above: https://chart.googleapis.com/chart?chs=150x150&cht=qr&chl=ESHOP (replace the ESHOP text with the ESHOP:// link from one of the above)
NS eShop application parameters
This section describes the 0x1C-byte structure stored at the application parameters from APT:StartApplication, under the 0x300-byte buffer listed there.
Offset | Size | Description |
---|---|---|
0x0 | 0x4 | Unknown, usually 0x3? |
0x4 | 0x4 | Unknown, usually 0x0? |
0x8 | 0x8 | u64 binary eShop content ID, same ID from the first string in eShop QR-codes except in binary form. |
0x10 | 0x10 | This is the last string from the QR-code(if any), no NUL-termination. |
ExtData
The ExtData File System for eShop is as follows:
root ├── icon ├── boss │ └── TIGER100.tmp └── user
File | Details | Size | Firmware Introduced | Plain text |
---|---|---|---|---|
icon | Duplicate from application ExeFS. Always image 00000002 | 0x36C0 Bytes | 2.0.0-2 | Download_EUR |
TIGER100.tmp | Always image 00000003. | 0xCE47 bytes (varies?) | 2.0.0-2 |
Music
The eShop pulls its music from a static, region-specific link in a format similar to the following:
https:// a248.e.akamai.net/f/248/103046/10m/npdl.c.app.nintendowifi.net/p01/nsa/CtfKXACbUPl8s7lk/BGM1/US_BGM1 , where region is one of the primary system regions (JP, US, EU, KR, etc.) Support also exists for 'BGM2', but this seems to be unused. The music is held in a BOSS container.
The format consists of a brief XML header describing the audio (including the date it was set as the main eShop theme, loop times, size, etc) followed by a raw AAC stream. Tools such as FFmpeg can handle rebuilding this stream with ADTS headers for proper time info and such.
The Home Menu uses nearly the same format for the Theme Shop's background music.
URLs
eShop uses the following domains over HTTPS:
- cp3s-auth.c.shop.nintendowifi.net
- a248.e.akamai.net
- ninja.ctr.shop.nintendo.net
- samurai.ctr.shop.nintendo.net
- ccif.ctr.shop.nintendo.net
- eou.c.shop.nintendowifi.net
These domains are used by NIM:
- nus.c.shop.nintendowifi.net
- ecs.c.shop.nintendowifi.net
- cas.c.shop.nintendowifi.net
ninja.ctr.shop.nintendo.net and samurai.ctr.shop.nintendo.net contain the bulk of the eShop information.
Common Parameters to ninja and samurai
For every request to the ninja and samurai servers, three parameters are always sent, though are not necessarily required:
Parameter | Required | Description | Type | Normal value |
---|---|---|---|---|
shop_id | depends on the URL, usually no | Describes which eShop instance should be used. 1 indicates the 3DS eShop, 2 indicates the Wii U eShop. 3 seems to yield the same results as 2. Values greater than 3 or less than 1 are invalid. Defaults to 2 or 3 if not given. | unsigned integer | 1 |
lang | no | Describes the language. Seems to be an ISO 639-1 code in lower case. Every eShop region has a default language that is used if this parameter is not given. Some regions have multiple languages, such as CA (en and fr). | string (two characters) | depends on region and eShop settings; for US: en |
_type | no | Describes whether the client wants to receive JSON or XML. This parameter seems actually unused and the servers always return XML. | string | json |
samurai
samurai.ctr.shop.nintendo.net (samurai) provides metadata about titles. The samurai server provides the backend for the eShop title search.
Common parameters described above can always be sent.
Path | Description | Parameters |
---|---|---|
/samurai/ws/region/titles | Fetches the title list, containing the content id (not the 3DS title id), the product code and the localized title name | All of these are optional.
|
/samurai/ws/region/news | eShop news section | (none) |
/samurai/ws/region/telops | Scrolling news on the top screen | shop_id is required |
/samurai/ws/region/directory/(long long unsigned int) and /samurai/ws/region/directory/~(string) | Collections, like sales | (none) |
/samurai/ws/region/title/content id | Returns information about the title, more verbose than /titles. | (none) |
/samurai/ws/region/contents | Seems identical to /titles. | see /titles |
/samurai/ws/region/genres | Returns a list of human-readable genre names and their corresponding genre id. | (none) |
/samurai/ws/region/publishers | Returns a list of human-readable publisher names and their corresponding publisher id. | (none) |
/samurai/ws/region/platforms | Returns a list of human-readable platform names and their corresponding platform id. | (none) |
/samurai/ws/region/title/content id/aocs | Returns a list of add-on contents/downloadable content and prices in eShop region currency. | (none) |
ninja
ninja.ctr.shop.nintendo.net (ninja) contains the seeds for the new 9.6 crypto, pricing information and handles actions that require authentication, such as purchases. Authentication information seems to be obtained from the act:u sysmodule and works through OAuth2.
Path | Description | Parameters |
---|---|---|
/ninja/ws/region/title/content id/ec_info | Contains information about the title. Such as title id, content size, and if available, the 9.6 crypto seed | (none) |
/ninja/ws/titles/id_pair | Provides the content id for the given title id, or vice versa. | title_id[] or ns_uid[] is required. |
/ninja/ws/region/tax_locations | Provides the tax location ID | postal_code is required. |
/ninja/ws/service_hosts | Provides CCIF and Samurai servers | country and shop_id is required. |
/ninja/ws/country/region | Various eshop related information for a given region | (none) |
/ninja/ws/country/region/replenish_amounts | Provides the amounts of money you can replenish to your account. | (none) |
Trusted Root CAs
The eShop application itself uses a RootCertChain for all HTTPS requests, all of the trusted root CAs are the following default ones:
- CertID 0x3
- CertID 0x6
- CertID 0x7
- CertID 0x8
- CertID 0x9
- CertID 0xA
Server changes following the November 2, 2015, maintenance
Pre-v10.0 eShop used an URL like this: "%s/samurai/ws/%s/title/%llu/other_purchased?shop_id=1&lang=%s&_type=json". That URL was removed with v10.0. That URL was requested when trying to load eShop app-pages. Following the maintenance mentioned above, this page was removed from the server, which broke pre-v10.0 eShop app whenever it tried to access that page.
URL changes between 9.7.0-25 and 10.0.0-27 are (green = add, red = remove):
%s/ninja/ws/%s/titles/online_prices?title%%5B%%5D=%s&lang=%s&include_coupon=true&shop_id=1&_type=json
%s/ninja/ws/%s/coupon/!check?shop_id=1&_type=json
%s/ninja/ws/my/owned_coupons?ns_uid=%llu&shop_id=1&_type=json
%s/ninja/ws/my/owned_coupons?shop_id=1&_type=json
%s/ninja/ws/my/parental_control/!put?shop_id=1&_type=json
%s/ninja/ws/%s/title/%llu/prepurchase_info?%s=%s&shop_id=1&_type=json
%s/samurai/ws/%s/coupon/%llu/titles?lang=%s&limit=%u&offset=%u&shop_id=1&_type=json
%s/ninja/ws/my/auto_billing/plans?limit=%u&offset=%u&shop_id=1&_type=json
%s/ninja/ws/%s/titles/online_prices?title%%5B%%5D=%s&lang=%s&include_coupon=true&coupon_id=%llu&shop_id=1&_type=json
%s/ninja/ws/my/auto_billing/%014llu/!cancel?shop_id=1&_type=json
%s/samurai/ws/%s/title/%llu/other_purchased?shop_id=1&lang=%s&_type=json
%s/samurai/movie/%s/%s/%014llu/moflex
New3DS
CheckNew3DS is called in two functions. This is only used for disabling UI button(s) for downloading New3DS titles when running on Old3DS. For example, on a New3DS patching a CheckNew3DS func-call with <retval=0>, results in the download button on the app page being grayed-out for a New3DS-only title.
TitleID checks
There's titleID checks in the system eShop application code for "Pokémon Omega Ruby". This appears to be used with UI-related code, unknown why.