3dbrew - User contributions [en]

Homebrew Exploits

2016-12-26T19:38:48Z

Dazzozo:

==Payload==
{| class="wikitable" border="1"
|-
! Works on latest fw
! Name
! Description
! Supported firmwares
|-
| style="background: lightgreen" | Yes
| [https://smealum.github.io/3ds/ *hax payload]
| Booted by all of the below non-sysmodule exploits.
| From '''9.0.0-7''' up to and including '''11.2.0-35'''.
|}

For the rest of this page, "Supported firmwares" refers to the exploit ''itself'', not whether *hax payload supports it.

==Standalone Homebrew Launcher Exploits==
The following homebrew exploits can be executed on a previously un-exploited system. ''Please'' see the above Payload section regarding what "Supported firmwares" indicates ''exactly''.

{| class="wikitable" border="1"
|-
! Works on latest fw
! Name
! Supported firmwares
! Requirements
! Author
! Install
|-
| style="background: salmon" | No
| [[ninjhax|Ninjhax 1.1b]]
| From '''4.0.0-7''' up to and including '''9.2.0-20'''.
| A cartridge or eShop version (JPN-only) of "Cubic Ninja".
| smea
| [http://smealum.net/ninjhax/ Install]
|-
| style="background: lightgreen" | Yes
| [[ninjhax|Ninjhax 2.x]]
| From '''9.0.0-7''' up to and including '''11.2.0-35'''.
| A cartridge or eShop version (JPN-only, not available anymore for purchase) of "Cubic Ninja".
| smea
| [https://smealum.github.io/ninjhax2/ Install]
|-
| style="background: lightgreen" | Yes
| [http://plutooo.github.io/freakyhax/ freakyhax]
| From '''9.0.0-7''' up to and including '''11.2.0-35'''.
| A cartridge or eShop version (USA/EUR/JAP, not available anymore for purchase) of "Freakyform Deluxe".
| plutoo
| [http://plutooo.github.io/freakyhax/ Install]
|-
| style="background: salmon" | No
| [http://plutooo.github.io/smilehax/ smilehax]
| From '''9.0.0-7''' up to and including '''11.0.0-33'''
| SmileBASIC (JPN all versions up to 3.32 excluded, USA 3.31 only)
| plutoo
| [http://plutooo.github.io/smilehax/ Install]
|-
| style="background: salmon" | No
| [http://mrnbayoh.github.io/basicsploit/ BASICSploit]
| From '''9.0.0-7''' up to and including '''11.0.0-33'''
| SmileBASIC (USA all versions)
| MrNbaYoh
| [http://mrnbayoh.github.io/basicsploit/ Install]
|-
| style="background: lightgreen" | Yes
| [[smashbroshax|smashbroshax]] (beaconhax)
| (New 3DS only) From '''9.0.0-X''' up to and including '''11.2.0-35'''.
| Super Smash Bros 3DS (full-game) and a way to broadcast raw wifi beacons. The demo (prior to the updated November 2015 [https://github.com/yellows8/3ds_smashbroshax version]) isn't usable with the *hax payloads. Game-version v1.1.3 fixed the vuln used with this, see the repo for a workaround for that.
| [[User:Yellows8|Yellows8]]
| [https://github.com/yellows8/3ds_smashbroshax Install]
|-
| style="background: salmon" | No
| [[browserhax]]
| From '''9.0.0-2''' to '''11.0.0-33'''
Note that the browser-version-check bypass is only usable prior to [[10.7.0-32]].
| A USA, EUR, JPN, or KOR system.
| [[User:Yellows8|Yellows8]]
| [http://yls8.mtheall.com/3dsbrowserhax.php Install]
|-
| style="background: lightgreen" | Yes
| [https://github.com/svanheulen/genhax genhax]
| (New 3DS only) From '''9.9.0-X''' up to and including '''11.2.0-X'''.
| A gamecard or eShop-install of Monster Hunter X (JPN only), and the DLC encryption key (see installer instructions).
| svanheulen
| [https://github.com/svanheulen/genhax_installer Install]
|}

Note that ninjhax 1.x is still not obsolete. Even though ninjhax 2.x can be run on 9.3+, this was made possible (amongst other things) by sacrificing the memory remapping exploit used in ninjhax 1.x (rohax). Therefore, things like JIT engines for emulators can only be supported on ninjhax 1.x. Furthermore, ninjhax 2.x does not run on system versions below 9.0.0-X, while ninjhax 1.x does.

==Secondary Exploits==
Installation of these exploits requires a previously exploited system to install. After installation, they can be used on their own. ''Please'' see the above Payload section regarding what "Supported firmwares" indicates ''exactly''.

{| class="wikitable" border="1"
! Works on latest fw
! Name
! Supported firmwares
! Requirements
! Author
! Install
|-
| style="background: salmon" | No
| [[ironhax]]
| From '''9.5.0-X''' up to and including '''10.3.0-X''', for '''X''' up to and including 28.
| A copy of "Ironfall: Invasion" downloaded from eShop before August 11th, 2015. Note the updated version that was released on October 13th, 2015 is not supported.
| smea
| [http://smealum.github.io/3ds/ Install]
|-
| style="background: salmon" | No, exploit update required.
| [http://vegaroxas.github.io/ steelhax]
| From '''9.0.0-X''' up to and including '''11.1.0-X''', for '''X''' up to and including 34.
| A copy of Steel Diver: Sub wars
| Vegaroxas
| [https://github.com/VegaRoXas/vegaroxas.github.io/raw/master/files/steelhax-installer.zip Install]
|-
| style="background: lightgreen" | Yes
| [https://github.com/yellows8/oot3dhax oot3dhax]
| From '''9.0.0-X''' up to and including '''11.2.0-X''', for '''X''' up to and including 35.
| A gamecard or eShop-install of Legend of Zelda: Ocarina of Time 3D. Besides using the installer app, writing raw saveimages with a save dongle for example is another option. Before compression was introduced in the 2016-7-18 release, the size of the *hax payload meant the exploit can't coexist with regular saves on a physical version of the game.
| Yellows8 / smea et al.
| See [https://smealum.github.io/3ds/ here].
|-
| style="background: salmon" | No
| [[menuhax]]
| JPN/USA/EUR: From '''9.0.0-X''' up to and including '''11.0.0-X'''.
KOR: From '''9.6.0-X''' up to and including '''11.0.0-X'''.
| JPN/USA/EUR: Having created [[Home_Menu#Home_Menu_Theme_SD_ExtData|theme extdata]] through opening the official theme selector at least once.
| [[User:Yellows8|Yellows8]]
| [https://github.com/yellows8/3ds_homemenuhax/releases Download]
|-
| style="background: lightgreen" | Yes
| [https://github.com/shinyquagsire23/supermysterychunkhax supermysterychunkhax]
| From '''9.9.0-X''' (USA/JPN) / '''10.2.0-X''' (EUR) up to and including '''11.1.0-X''', for '''X''' up to and including 34.
| A gamecard or eShop-install of Pokémon Super Mystery Dungeon.
| Shiny Quagsire / SALT team
| [https://smd.salthax.org/ Install].
|-
| style="background: salmon" | No
| [https://github.com/shinyquagsire23/v_hax (v*)hax]
| From '''9.0.0-X''' up to and including '''11.0.0-X''', for '''X''' up to and including 33.
Note that '''9.0.0-X''' is only required for the Homebrew Launcher - the game itself only requires '''2.1.0-X''' for primitive userland code execution.
| A copy of VVVVVV downloaded after March 2012 (v1). v1.1 patches out the overflow vulnerability used by (v*)hax.
| Shiny Quagsire / SALT team
| [https://vvvvvv.salthax.org/ Install].
|-
| style="background: lightgreen" | Yes
| [https://github.com/Dazzozo/humblehax humblehax]
| From '''9.0.0-X''' (USA/EUR) up to and including '''11.2.0-X''', for '''X''' up to and including 35.
| An eShop-install of Citizens of Earth (either v1 or v2), featured in the Humble "Friends of Nintendo" Bundle.
| Dazzozo / SALT team
| [https://citizens.salthax.org/ Install].
|-
| style="background: salmon" | No
| [http://mrnbayoh.github.io/basehaxx/ basehaxx]
| From '''9.0.0-X''' up to and including '''11.1.0-X''', for '''X''' up to and including 34.
| A gamecard or eShop-install of Pokémon Omega Ruby / Alpha Sapphire.
| MrNbaYoh
| [http://mrnbayoh.github.io/basehaxx/ install]
|-
| style="background: lightgreen" | Yes
| [https://github.com/yellows8/stickerhax stickerhax]
| From '''9.0.0-X''' up to and including '''11.2.0-X'''(not including installation).
| A gamecard or eShop-install of Paper Mario: Sticker Star.
| [[User:Yellows8|Yellows8]]
| [https://github.com/yellows8/stickerhax Here]
|-
| style="background: lightgreen" | Yes
| [https://github.com/svanheulen/genhax genhax]
| (New 3DS only) From '''9.9.0-X'''(JPN) or '''10.3.0-X'''(EUR/USA) up to and including '''11.2.0-X'''.
| A gamecard or eShop-install of Monster Hunter Generations, and an internet connection during installation.
| svanheulen
| [https://github.com/svanheulen/genhax_installer Install]
|}

==Exploits without Homebrew Launcher (Not recommended)==

'''Warning:''' The following exploits can run code, but are missing a 3DSX launcher. They cannot launch any homebrew in the 3DSX format.

{| class="wikitable" border="1"
|-
! Works on latest fw
! Name
! Supported firmwares
! Requirements
! Author
! Install
|-
| style="background: salmon" | No
| [[browserhax]] (Without the loader in the 3ds_browserhax_common repo)
| (Old3DS) From '''5.0.0-2''' to '''11.0.0-33''' (Pre-v5.0 is supported for some versions if you manually modify the source)

(New3DS) From '''9.0.0-20''' to '''11.0.0-33'''

Note that the browser-version-check bypass is only usable prior to [[10.7.0-32]].
| An USA, EUR, or JPN system.
| [[User:Yellows8|Yellows8]]
| [[browserhax|Install]]
|-
| style="background: salmon" | No
| Ninjhax (with specialized payloads)
| Up to '''9.2.0-20'''?
|
| smea + independent developers
| N/A
|}

==Previous Exploits==
'''Warning:''' These exploits '''do not work'''. They are exploits which no longer function at all, regardless of software or firmware revision.
{| class="wikitable" border="1"
! Works on latest fw
! Name
! Supported firmwares
! Requirements
! Author
! Install
|-
| style="background: salmon" | No
| [[tubehax|Tubehax]]
| None. '''Was''': From '''9.0.0-X''' up to and including '''10.1.0-X''', for '''X''' up to and including 27.
| The YouTube application and an Internet connection. As of October 15, 2015, this is no longer usable due to an update being released which fixes the vuln used by tubehax + app update being forced (see [[YouTube|here]]).
| smea
| [http://smealum.github.io/3ds/ Install]
|}

==Other Homebrew Loaders==
The [https://github.com/yellows8/hblauncher_loader hblauncher_loader] title can be used when running under modded-FIRM which allows running unsigned titles, to boot the *hax payloads.

==Sysmodule Exploits==
This section is for system-module exploits, which can be run from the *hax payloads.

{| class="wikitable" border="1"
! Works on latest fw
! Name
! Supported firmwares
! Requirements
! Author
|-
| style="background: lightgreen" | Yes, that's not the intended default use however.
| [https://github.com/yellows8/ctr-httpwn/releases ctr-httpwn]
| From '''9.6.0-X''' up to and including '''11.2.0-X'''.
| None
| [[User:Yellows8|Yellows8]]
|}

==WebKit vuln testing==
See [https://github.com/yellows8/3ds_browserhax_common/issues/28 here].

News/Archive

2016-12-26T19:37:53Z

Dazzozo:

*'''4 October 2016''' An update for EUR version of VVVVVV was finally released (title was re-added to the eShop versionlist). Likewise for the USA version on the October 11th (this title was already listed in the versionlist however).
*'''22 September 2016''' [[User:shinyquagsire23|Shiny Quagsire]] released an update to [https://smd.salthax.org/ supermysterychunkhax] with [[11.1.0-34]] support.
*'''20 September 16''' [[User:Smea|Smea]] released an update to [http://smealum.github.io/ninjhax2/ Ninjhax 2] with [[11.1.0-34]] support.
*'''16 September 16''' [[User:Plutooo|plutoo]] released an update to [https://plutooo.github.io/freakyhax/ freakyhax] with [[11.1.0-34]] support.
*'''15 September 16''' [[User:Yellows8|Yellows8]] released updated oot3dhax [https://github.com/yellows8/oot3dhax/releases/tag/09-15-16 saveimages] for latest *hax payloads + [[11.1.0-34]] support.
*'''13 September 16''' Nintendo released system update [[11.1.0-34]].
*'''20 August 16''' [[User:Yellows8|Yellows8]] released hblauncher_loader [https://github.com/yellows8/hblauncher_loader/releases/tag/v1.2 v1.2], menuhax [https://github.com/yellows8/3ds_homemenuhax/releases/tag/v3.1 v3.1], and updated the starter-kit. The sploit_installer build from the starter-kit now supports all regions for stickerhax except CHNTWN. This also sends the Home Menu title-version for the initial *hax payload network request, unless the user changed the system-info(like the latest menuhax_manager and hblauncher_loader).
*'''9 August 16''' An updated version of USA SmileBASIC is now available(the updated JPN version was released exactly 2 weeks ago).
*'''29 July 16''' [[User:Yellows8|Yellows8]] released [https://github.com/yellows8/stickerhax stickerhax], which supports <=[[11.0.0-33]].
*'''27 July 16''' [[User:Yellows8|Yellows8]] released new browserhax(see changelog [[browserhax|here]]) and menuhax [https://github.com/yellows8/3ds_homemenuhax/releases v3.0], all of these now support [[11.0.0-33]].
*'''26 July 16''' Various JPN-only eShop app updates were released. This includes JPN SmileBASIC: the update-title was removed from versionlist, and the main-title was updated. Updating an already installed version of the game will currently update to 3.3.1. Uninstalling and redownloading will give you 3.3.2. [https://plutooo.github.io/smilehax/ smilehax] was fixed in [http://smilebasic.com/debug/ 3.3.2].
*'''22 July 16''' [[User:Dazzozo|Dazzozo]] released [https://citizens.salthax.org/ humblehax v2], supporting the Citizens of Earth update released on the eShop 3 days ago.
*'''20 July 16''' [[User:Plutooo|plutoo]] (with help from [[User:Yellows8|Yellows8]]) released [https://plutooo.github.io/smilehax/ smilehax].
*'''19 July 16''' An updated version of the EUR "Citizens of Earth" regular-title is now available on the EUR-eShop, ~2 months after being originally removed. Likewise for USA on the 21st.
*'''18 July 16''' [[User:Smea|Smea]] updated the hosted *hax payload builds(only otherapp for non-KOR) and this [https://smealum.github.io/3ds/ page]. KOR is now supported thanks to d3m3vilurr(system-version >=v9.6). All otherapp payloads were rebuilt+updated, hence these now include a commit for compression(committed by [[User:Yellows8|Yellows8]] with compression code by mtheall). Due to this, oot3dhax+payload can now be installed with multiple other normal save-files, without any issues(via sploit_installer from the starter-kit). [[User:Yellows8|Yellows8]] also updated the [https://smealum.github.io/3ds/ hosted] boot.3dsx to hbmenu 1.1.1.
*'''10 July 16''' MrNbaYoh released [https://mrnbayoh.github.io/basicsploit/ BASICSploit] for version 3.2.1 of SmileBASIC. Currently only the US version is supported. On July 11th the main-app title was removed from USA/JPN eShop: it's no longer listed on the former, while on the latter it can't be purchased.
*'''26 June 16''' [[User:Yellows8|Yellows8]] released oot3dhax builds for supporting [[11.0.0-33]], via updated sploit_installer in the [https://smealum.github.io/3ds/ starter-kit] and raw [https://github.com/yellows8/oot3dhax/releases/tag/06-26-16 saveimages]. Note that attempting to run sploit_installer on a 11.0.0-33 system with *hax payload <=v2.7 is equivalent to [[11.0.0-33|trying]] to use the older oot3dhax on that version.
*'''3 June 16''' [[User:Plutooo|plutoo]] released [https://plutooo.github.io/freakyhax/ freakyhax]. The USA game was removed from the eShop <=3-hours later("... currently unavailable" message).
*'''9 May 16''' Nintendo released system update [[11.0.0-33]].
*'''24 March 16''' Nintendo updated the pages stored on the server used for browser-version-check. Due to almost all of the Old3DS/New3DS pages for non-latest-browser being updated(content is now "99999"), browser versions prior to [[10.7.0-32]] are not usable anymore without using the browser-version-check bypass(fixed with [[10.7.0-32]]). The only exception is New3DS v10.2, it was "updated" but the content is still "0"(this is due to browser-version-check being [[Internet_Browser|broken]] with New3DS v10.2).
*'''22 March 16''' [[User:Yellows8|Yellows8]] released [https://github.com/yellows8/ctr-httpwn/releases ctr-httpwn]. v1.0.1 was released on the 25th for a RootCA cert update.
*'''14 March 16''' Nintendo released system update [[10.7.0-32]].
*'''24-25 February 16''' On the 24th the Old3DS [[Internet_Browser|browser-version-check]] pages were updated so that browser version >=v10.6 is now required. The New3DS pages for this were not changed. About 5 hours later, [[User:Yellows8|Yellows8]] disclosed a bypass for the browser-version-check. User instructions are available [http://yls8.mtheall.com/3dsbrowserhax.php here], details [[3DS_Userland_Flaws|here]].
*'''22 February 16''' Nintendo released system update [[10.6.0-31]].
*'''1 February 16''' As of this date (time zones notwithstanding) following server maintenance Nintendo now checks server-side that users are on current firmware before allowing access to online functionality in games. See [[10.5.0-30|here]] for details.
*'''25 January 16''' Nintendo released system update [[10.5.0-30]].
*'''25 January 16''' [[User:Yellows8|Yellows8]] updated [http://yls8.mtheall.com/3dsbrowserhax.php browserhax], [https://github.com/yellows8/3ds_homemenuhax/releases menuhax], and the oot3dhax [https://github.com/yellows8/oot3dhax/releases saveimages] for v10.4.
*'''18 January 16''' Nintendo released system update [[10.4.0-29]].
*'''7 January 16''' (roughly, not automatically detected) Ironfall v1.0 is no longer downloadable due to the main-CXI content files on CDN being removed (TMD wasn't removed).
*'''27 December 15''' A 3DS console hacking [https://events.ccc.de/congress/2015/Fahrplan/events/7240.html talk] was at 32C3. A recording can be found [https://www.youtube.com/watch?v=UutYOidFx3c here]. Around the end of the talk, [[User:Yellows8|Yellows8]] released [[browserhax]] and [[menuhax]] compatible with the latest system-version at the time of release ([[10.3.0-28]]). The homebrew [https://smealum.github.io/3ds/ starter-kit] was updated for latest menuhax, and for an option for downloading the old vulnerable version of Ironfall from eShop.
*'''15 December 15''' Nintendo released Smash Bros update v1.1.3 which fixed [[smashbroshax]], see [https://github.com/yellows8/3ds_smashbroshax here] for details. However, [[smashbroshax]] is still possible on latest firmware: simply remove the update from SD card before attempting the exploit.
*'''13 December 15''' WinterMute released [http://devkitpro.org/viewtopic.php?f=13&t=8542 devkitARM release 45].
*'''25 November 15''' [[User:Yellows8|Yellows8]] released [https://github.com/yellows8/hblauncher_loader/releases hblauncher_loader].
*'''17-20 November 15''' Nintendo released an update for the normal (non-invite-code) Super Smash Bros demos in USA, EUR and JPN, fixing [[smashbroshax]]. Only the demos were updated, the cartridge and eShop version of the full game are still vulnerable.
*'''12 November 15''' [[User:Yellows8|Yellows8]] released [https://github.com/yellows8/oot3dhax/releases oot3dhax] raw savedata images for gamecards with the latest *hax payloads. The official [https://github.com/smealum/sploit_installer installer] is now [https://smealum.github.io/3ds/ included] in the homebrew starter kit.
*'''9 November 15''' Nintendo released system update [[10.3.0-28]].
*'''2 November 15''' Following an eShop servers maintenance, changes to the [[eShop]] system application require an update of the Homebrew starter kit for eShop access on system versions older than [[10.0.0-27]]. See [[EShop|here]] for details.
*'''30 October 15''' [[User:Yellows8|Yellows8]] released [https://github.com/yellows8/3ds_homemenuhax/releases menuhax] v2.0.
*'''29 October 15''' [[User:Yellows8|Yellows8]] released [https://github.com/yellows8/3ds_smashbroshax/releases 3ds_smashbroshax] v1.2.
*'''26 October 15''' A [[Internet_Browser#v9.9_dummy_web-browser|dummy web browser]] is now being included in CUPs (cart updates) on Old3DS/New3DS likely starting with games shipping [[9.9.0-26|9.9.0-X]]. NVer is not updated by this.
*'''26 October 15''' The system web-browser on Old3DS/New3DS now displays a "sysupdate required" message on systems with [[9.9.0-26]] or above installed, if the installed browser(?) is not the latest version. See [[Internet_Browser#Forced_system-update|here]] for details.
*'''25 October 15''' [[User:Smea|smea]] released *hax 2.5 payloads, which fixes a number of bugs and adds new features such as screenshot-taking, romhacking and eshop access.
*'''20 October 15''' Nintendo released system update [[10.2.0-28]]. The publicly available versions of [[menuhax]] and [[browserhax]] at the time of sysupdate release, were blocked.
*'''15 October 15''' The [[YouTube]] application was updated with a fix for [[tubehax]]. This update is forced: the app itself checks whether a newer version of the title is available.
*'''13 October 15''' "Ironfall: Invasion" was made available on the eShop again (originally pulled on August 11th). The updated version blocks [[ironhax]].
*'''25 September 15''' [[User:Yellows8|Yellows8]] released [[browserhax]] and [[menuhax]]. On the 26th menuhax v1.2 was [https://github.com/yellows8/3ds_homemenuhax/releases released].
*'''14 September 15''' Nintendo released system update [[10.1.0-27]].
*'''11 September 15'''(11:30 EDT) [[User:Yellows8|Yellows8]] released [[smashbroshax]]. On the 30th v1.1 was [https://github.com/yellows8/3ds_smashbroshax/releases released] for supporting Super Smash Bros v1.1.1.
*'''8 September 15''' Nintendo released system update [[10.0.0-27]].
*'''18 July 15''' smea released [[ninjhax]] 2 beta [http://smealum.github.io/ninjhax2/], enabling ARM11 homebrew execution on Old/New 3DS up to firmware 9.9.0-26.
*'''13 July 15''' Nintendo released system update [[9.9.0-26]].
*'''1 June 15''' Nintendo released system update [[9.8.0-25]].
*'''03 May 15''' smea released regionFOUR [https://github.com/smealum/regionFOUR/blob/master/README.md], enabling region free gaming on latest firmware. (again)
*'''20 April 15''' Nintendo released system update [[9.7.0-25]].
*'''23 March 15''' Nintendo released system update [[9.6.0-24]].
*'''2 March 15''' Nintendo released system update [[9.5.0-23]].
*'''15 February 15''' WinterMute released [http://devkitpro.org/viewtopic.php?f=13&t=8409 devkitARM release 44].
*'''2 February 15''' Nintendo released system update [[9.5.0-22]], which fixes [[3DS System Flaws|firmlaunch-hax]].
*'''16 January 15''' smea released regionthree [https://github.com/smealum/regionthree/blob/master/README.md], enabling region free gaming on latest firmware.
*'''24 December 14''' smea released [[Ninjhax]] 1.1 ('''NOT''' a fix for firmware [[9.3.0-21]] or [[9.4.0-21]]).
*'''11 December 14''' Nintendo released system update [[9.4.0-21]].
*'''8 December 14''' Nintendo released system update [[9.3.0-21]], which fixes [[3DS System Flaws|rohax]].
*'''20 November 14''' smea released [[Ninjhax]], the first public [[Homebrew Exploits|homebrew exploit]] compatible with system-versions [[4.0.0-7]]-[[9.2.0-20]].
*'''29 October 14''' Nintendo released system update [[9.2.0-20]].
*'''10 October 14''' Nintendo released system update [[9.1.0-20J]].
*'''6 October 14''' Nintendo released system update [[9.0.0-20]].
*'''29 August 14''' Nintendo announced [[New 3DS]].
*'''7 August 14''' Nintendo released system update [[8.1.0-19]].
*'''24 July 14''' Nintendo released system update [[8.1.0-18]].
*'''7 July 14''' Nintendo released system update [[8.0.0-18]].
*'''12 May 14''' Nintendo released system update [[7.2.0-17]].
*'''26 February 14''' Nintendo released system update [[7.1.0-16]].
*'''22 January 14''' Nintendo released system update [[7.1.0-15]].
*'''19 December 13''' Nintendo released system update [[7.1.0-14]].
*'''9 December 13''' Nintendo released system update [[7.0.0-13]].
*'''13 September 13''' Nintendo released system update [[6.3.0-12]].
*'''20 August 13''' [[3DSExplorer|3DSExplorer v1.5.3]] updated by [[User:Elisherer|Elisherer]] (Enable trimming NCSD)
*'''6 August 13''' Nintendo released system update [[6.2.0-12]].
*'''11 July 13''' Nintendo released system update [[6.1.0-12U]] for only USA.
*'''27 June 13''' Nintendo released system update [[6.1.0-11]] (6.1.0-12 for all regions except USA).
*'''17 June 13''' Nintendo released system update [[6.0.0-11]] (6.0.0-12 for all regions except USA).
*'''4 April 13''' Nintendo released system update [[5.1.0-11]].
*'''25 March 13''' Nintendo released system update [[5.0.0-11]].
*'''14 January 13''' [[3DSExplorer|3DSExplorer v1.5.1]] updated by [[User:Elisherer|Elisherer]]
*'''4 December 12''' Nintendo released system update [[4.5.0-10]].
*'''1 December 12''' [[3DSExplorer|3DSExplorer v1.4]] updated by [[User:Elisherer|Elisherer]]
*'''2 November 12''' Added page for [[Fundraiser|Chip decapping fundraiser]]
*'''8 January 13''' [[3DSExplorer|3DSExplorer v1.5]] updated by [[User:Elisherer|Elisherer]]
*'''23 September 12''' [[005tools|005tools v0.1b]] by [[User:McHaggis|McHaggis]]
*'''19 September 12''' Nintendo released system update [[4.4.0-10]].
*'''17 August 12''' Nintendo released New Super Mario Bros. 2, the first 3DS title released simultaneously in stores and as an [[eShop]] download.
*'''28 July 12''' [[3DSExplorer|3DSExplorer v1.3]] (modified by 3DSGuy) updated by [[User:Elisherer|Elisherer]]
*'''24 July 12''' Nintendo released system update [[4.3.0-10]].
*'''26 June 12''' Nintendo released system update [[4.2.0-9]].
*'''19 May 12''' [[3DSExplorer|3DSExplorer v1.2.1]] updated by [[User:Elisherer|Elisherer]]
*'''15 May 12''' Nintendo released its first implementation of 3DS '[[Title list#0004000E - Add-on Content|Add-on Content]]' with the Mario Kart 1.1 update.
*'''14 May 12''' Nintendo released system update [[4.1.0-8]].
*'''24 April 12''' Nintendo released system update [[4.0.0-7]].
*'''08 February 12''' [[CiTRUS|CiTRUS v0.2]] updated by [[User:Xcution|Xcution]]
*'''04 February 12''' [[CiTRUS|CiTRUS v0.1]] released by [[User:Xcution|Xcution]]
*'''02 February 12''' [[3DSExplorer|3DSExplorer v1.2]] updated by [[User:Elisherer|elisherer]]
*'''26 January 12''' [[Crappy Tiny Reader|CTR - Crappy Tiny Reader v0.07]] updated by [[User:PsyKopaT|PsyKo]]
*'''05 January 12''' [[Crappy Tiny Reader|CTR - Crappy Tiny Reader v0.06]] updated by [[User:PsyKopaT|PsyKo]]
*'''21 December 11''' Nintendo released system update [[3.0.0-6]]
*'''21 December 11''' [[3DSExplorer|3DSExplorer v1.1.1]] updated by [[User:Elisherer|elisherer]]
*'''7 December 11''' [[3DSExplorer|3DSExplorer v0.96]] updated by [[User:Elisherer|elisherer]]
*'''4 September 11''' [[3DSViewer|3DSViewer v0.1]] released by [[User:Elisherer|elisherer]]
*'''1 August 11''' [[3DS Save DeEncrypter3DS|Save DeEncrypter v1.0]] released by [[User:Blite|Blite]]
*'''25 July 11''' Nintendo released system update [[2.1.0-4]].
*'''15 June 11''' Nintendo released system update [[2.1.0-3]].
*'''6 June 11''' Nintendo released system update [[2.0.0-2]].
*'''6 April 11''' [[DSaveManager|DSaveManager v0.1]] released by [[User:Crediar|crediar]]
*'''4 April 11''' [[3DSaveTool|3DSaveTool v0.2b]] released by [[User:Crediar|crediar]]
*'''2 April 11''' [[3DSaveTool|3DSaveTool v0.1]] released by [[User:Crediar|crediar]]
*'''28 March 11''' Fixed 3DBrew wiki issues, now fully operational!
*'''18 March 11''' 3DBrew launched.

== 3DBrew International ==
Our community is an international community.

We have freedom, and we will express it in our language (but you have to write it in English before ;)!

News

2016-12-26T19:37:31Z

Dazzozo:

Mysteries

2016-12-09T12:41:42Z

Dazzozo:

The following is a list of mysteries.

== General ==
* What is the CTR abbreviation?
: C may stand for Chiheisen ("horizon" in Japanese, the O3DS's codename being "Project Horizon").
:: Not true, Horizon refers to the OS.

== Hardware ==
=== Why are there two CTRCARD controllers? ===
'''Background:''' Also [http://problemkaputt.de/twl-core.jpg DSi SoC pinout] shows evidence of dual NTRCARD controllers on the final DSi SoC. (This was a [http://i.imgur.com/0kJlbEw.png planned feature] of the DSi before being axed later in development)

=== Why are there two EMMC controllers? ===
'''Theory:''' At some point during 3DS hardware development there was an idea to split up CTR and TWL nand into two different chips.
=== Is there a JTAG? ===
=== Is there more than one revision of the bootrom? ===
'''Background:''' Bootrom visible portion has been dumped on 3DS, 3DSXL, 2DS, New3DS. All matching exactly.
=== What is the EMMC controller @ 0x10100000 doing? ===
'''Background:''' There's dead code in NWM referencing it.
=== Why did they put NTRCARD accessible from ARM11? ===
'''Theory:''' At some point during 3DS hardware development there was a concept where ARM11 ran a menu with DS(i) icons while ARM9 was in TWL mode.

=== Is there a secret message embedded in the 3DS keyscrambler constant? ===
'''Background:''' TWL keyscrambler constant was Nintendo in Japanese, utf-8 encoded.

=== What is the PDN abbreviation? ===
: Power distribution network

== Software ==
=== What was the problem in "initial program loader" that was mentioned in an FCC filing by Nintendo for 2DS? ===
'''Background:''' http://www.neogaf.com/forum/showthread.php?t=814624&page=1
=== What did SVC 0x74 in the ARM11 kernel do before it got stubbed? ===
=== What is the PTM abbreviation? ===
=== Why is the DTCM not used anywhere except bootrom? ===
'''Background:''' Bootrom is known to use part of DTCM as state, memsetting it to 0 when it's done. After that, it is never used again.

GPIO:BindInterrupt

2016-09-25T12:19:45Z

Dazzozo: did you even look at the exheader?

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x00090082]
|-
| 1
| u32, interrupt bitmask
|-
| 2
| s32, priority
|-
| 3
| Must be value [[IPC#Message_Structure|0x00000000]], otherwise error 0xD9001830
|-
| 4
| Handle syncObject
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code
|-
| 1
| Result code
|}

=Description=
This binds an interrupt in gpio-module's [[NCCH/Extended Header#ARM11_Kernel_Capabilities|interrupt ACL]] to the specified syncObject (using [[SVC|svcBindInterrupt]]).

=Supported values=
{| class="wikitable" border="1"
|-
! Bitmask
! Interrupt
|-
| 0x2
| 0x63
|-
| 0x4
| 0x60
|-
| 0x8
| 0x64
|-
| 0x10
| 0x66
|-
| 0x40
| 0x68
|-
| 0x80
| 0x69
|-
| 0x100
| 0x6A
|-
| 0x200
| 0x6B
|-
| 0x400
| 0x6C
|-
| 0x800
| 0x6D
|-
| 0x1000
| 0x6E
|-
| 0x2000
| 0x6F
|-
| 0x4000
| 0x70
|-
| 0x8000
| 0x71
|-
| 0x10000
| 0x72
|-
| 0x20000
| 0x73
|}

See also [[ARM11 Interrupts]].

=Interrupts bound by modules=
{| class="wikitable" border="1"
|-
! Module
! Bound interrupts (bitmask)
|-
| [[Codec_Services|codec]]
| 0x8
|-
| [[HID_Services|hid]]
| 0x100
|-
| [[IR_Services|ir]]
| 0x40
|-
| [[MCU_Services|mcu]]
| 0x8000
|}

See [[GPIO:BindInterrupt#Supported_values]] for the bitmask <-> IRQ number correspondence table.

GPIO:BindInterrupt

2016-09-25T12:14:10Z

Dazzozo: unfuck

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x00090082]
|-
| 1
| u32, interrupt bitmask
|-
| 2
| s32, priority
|-
| 3
| Must be value [[IPC#Message_Structure|0x00000000]], otherwise error 0xD9001830
|-
| 4
| Handle syncObject
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code
|-
| 1
| Result code
|}

=Description=
This binds an interrupt in gpio-module's [[NCCH/Extended Header#ARM11_Kernel_Capabilities|interrupt ACL]] to the specified syncObject (using [[SVC|svcBindInterrupt]]).

=Supported values=
{| class="wikitable" border="1"
|-
! Bitmask
! Interrupt
|-
| 0x2
| 0x63
|-
| 0x4
| 0x60
|-
| 0x8
| 0x64
|-
| 0x10
| 0x66
|-
| 0x40
| 0x68
|-
| 0x80
| 0x69
|-
| 0x100
| 0x6A
|-
| 0x200
| 0x6B
|-
| 0x400
| 0x6C
|-
| 0x800
| 0x6D
|-
| 0x1000
| 0x6E
|-
| 0x2000
| 0x6F
|-
| 0x4000
| 0x70
|-
| 0x8000
| 0x71
|-
| 0x10000
| 0x72
|-
| 0x20000
| 0x73
|}

See also [[ARM11 Interrupts]].

=Interrupts bound by modules=
{| class="wikitable" border="1"
|-
! Module
! Bound interrupts (bitmask)
|-
| [[Codec_Services|cdc]]
| 0x8
|-
| [[HID_Services|hid]]
| 0x100
|-
| [[IR_Services|ir]]
| 0x40
|-
| [[MCU_Services|mcu]]
| 0x8000
|}

See [[GPIO:BindInterrupt#Supported_values]] for the bitmask <-> IRQ number correspondence table.

IO Registers

2016-09-25T12:13:17Z

Dazzozo: Undo revision 18281 by Neobrain (talk)

= Overview =

{| class="wikitable" border="1"
! Old3DS
! A9/A11
! Category
! Physaddr
! Used by
! Comments
|-
| style="background: green" | Yes
| A9
| [[CONFIG Registers]]
| 0x10000000
| Boot9, Process9
|
|-
| style="background: green" | Yes
| A9
| [[IRQ Registers]]
| 0x10001000
| Boot9, Process9, Kernel9
| ARM9 Interrupt Masking
|-
| style="background: green" | Yes
| A9
| [[NDMA Registers]]
| 0x10002000
| Boot9, Process9
| DMA Engine
|-
| style="background: green" | Yes
| A9
| [[TIMER Registers]]
| 0x10003000
| Boot9, Process9
|
|-
| style="background: green" | Yes
| A9
| [[CTRCARD Registers]]
| 0x10004000 / 0x10005000
| Process9
|
|-
| style="background: green" | Yes
| A9
| [[EMMC Registers]]
| 0x10006000 / 0x10007000
| Boot9, Process9
| 0x10007000 is normally not enabled on retail, all-zeros when read.
|-
| style="background: green" | Yes
| A9
| [[PXI Registers]]
| 0x10008000
| Boot9, Process9
|
|-
| style="background: green" | Yes
| A9
| [[AES Registers]]
| 0x10009000
| Boot9, Process9
|
|-
| style="background: green" | Yes
| A9
| [[SHA Registers]]
| 0x1000A000
| Boot9, Process9
|
|-
| style="background: green" | Yes
| A9
| [[RSA Registers]]
| 0x1000B000
| Boot9, Process9
|
|-
| style="background: green" | Yes
| A9
| [[Corelink DMA Engines|XDMA Registers]]
| 0x1000C000
| Boot9, Kernel9
| [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0424d/index.html CoreLink™ DMA-330] (single-channel).
|-
| style="background: green" | Yes
| A9
| [[SPICARD Registers]]
| 0x1000D800
| Process9
|
|-style="border-top: double"
| style="background: green" | Yes
| A9
| [[CONFIG Registers]]
| 0x10010000
| Process9
|
|-
| style="background: green" | Yes
| A9
| PRNG Registers
| 0x10011000
| Process9
| Used as entropy-source for seeding random number generators.
|-
| style="background: green" | Yes
| A9
| [[OTP Registers]]
| 0x10012000
| Kernel9, NewKernel9Loader
| Top secret.
|-
| style="background: green" | Yes
| A9
| [[ARM7|ARM7 Registers]]
| 0x10018000
| TwlProcess9
| Used to setup the ARM7 core for AGB/TWL
|-style="border-top: double"
| style="background: green" | Yes
| A11/A9
| Debug WIFI SDIO Registers?
| 0x10100000
|
| An SDIO controller is mapped here, NWM references this controller but doesn't have access to it.
|-
| style="background: green" | Yes
| A11/A9
| [[HASH Registers]]
| 0x10101000
| [[Filesystem services]]
|
|-
| style="background: green" | Yes
| A11/A9
| [[Camera Registers]]
| 0x10102000
| [[Camera Services]]
| y2r
|-
| style="background: green" | Yes
| A11/A9
| [[CSND Registers]] / [[DSP Registers]]
| 0x10103000
| TwlBg, [[Codec Services]], [[CSND Services]], [[DSP Services]]
| Sound hardware. For DSP regs, see the "DSi XpertTeak" section in [http://problemkaputt.de/gba.htm no$gba] help.
|-style="border-top: double"
| style="background: green" | Yes
| A11/A9
| LGYFB0
| 0x10110000
| TwlBg
| IO registers used to access legacy output framebuffer, as well as configure the upscaling filter.
|-
| style="background: green" | Yes
| A11/A9
| LGYFB1
| 0x10111000
| TwlBg
| IO registers used to access legacy output framebuffer, as well as configure the upscaling filter.
|-style="border-top: double"
| style="background: green" | Yes
| A11/A9
| [[Camera Registers]]
| 0x10120000
| [[Camera Services]]
|
|-
| style="background: green" | Yes
| A11/A9
| [[Camera Registers]]
| 0x10121000
| [[Camera Services]]
| Mirror of 0x10120000?
|-
| style="background: green" | Yes
| A11/A9
| [[WIFI Registers]]
| 0x10122000
| [[NWM Services]]
| WIFI SDIO bus registers
|-
| style="background: green" | Yes
| A11/A9
| ?
| 0x10123000
| [[NWM Services]]
| WIFI?
|-style="border-top: double"
| style="background: red" | No
| A11/A9
| [[MVD Registers]]
| 0x10130000
| [[MVD Services]]
|
|-
| style="background: red" | No
| A11/A9
| [[MVD Registers]]
| 0x10131000
| [[MVD Services]]
|
|-
| style="background: red" | No
| A11/A9
| [[MVD Registers]]
| 0x10132000
| [[MVD Services]]
|
|-style="border-top: double"
| style="background: green" | Yes
| A11/A9
| [[PDN Registers]]
| 0x10140000
| Process9, Boot11, Kernel11, TwlBg, [[DSP Services]], [[NWM Services]], [[SPI Services]]
| Power management.
|-
| style="background: green" | Yes
| A11/A9
| [[PDN Registers]]
| 0x10141000
| Process9, Boot11, Kernel11, TwlBg, [[Codec Services]], [[NWM Services]], [[SPI Services]], [[PDN Services]]
| Power management
|-
| style="background: green" | Yes
| A11/A9
| [[SPI Registers]]
| 0x10142000
| TwlBg, [[SPI Services]]
|
|-
| style="background: green" | Yes
| A11/A9
| [[SPI Registers]]
| 0x10143000
| TwlBg, dmnt Module
| Debugger related?
|-
| style="background: green" | Yes
| A11/A9
| [[I2C Registers]]
| 0x10144000
| Boot11, Kernel11, TwlBg, [[I2C Services]]
|
|-
| style="background: green" | Yes
| A11/A9
| [[CODEC Registers]]
| 0x10145000
| TwlBg, [[Codec Services]]
|
|-
| style="background: green" | Yes
| A11/A9
| [[HID Registers]]
| 0x10146000
| Boot11, Kernel11, TwlBg, [[HID Services]], dlp Services
| See [[PAD]].
|-
| style="background: green" | Yes
| A11/A9
| [[GPIO Registers]]
| 0x10147000
| Boot11, TwlBg, [[GPIO Services]], [[DSP Services]](v0)
|
|-
| style="background: green" | Yes
| A11/A9
| [[I2C Registers]]
| 0x10148000
| TwlBg, [[I2C Services]]
|
|-style="border-top: double"
| style="background: green" | Yes
| A11/A9
| [[SPI Registers]]
| 0x10160000
| Boot9, TwlBg, [[SPI Services]]
|
|-
| style="background: green" | Yes
| A11/A9
| [[I2C Registers]]
| 0x10161000
| Boot11, TwlBg, [[I2C Services]]
| See [http://problemkaputt.de/gba.htm no$gba] help for some clues maybe.
|-
| style="background: green" | Yes
| A11/A9
| [[MIC Registers]]
| 0x10162000
| [[MIC Services]]
|
|-
| style="background: green" | Yes
| A11/A9
| [[PXI Registers]]
| 0x10163000
| Boot11, Kernel11, TwlBg, [[PXI Services]]
|
|-
| style="background: green" | Yes
| A11/A9
| [[NTRCARD Registers]]
| 0x10164000
| Boot9, Process9
|
|-
| style="background: green" | Yes
| A11/A9
| [[MP Registers]]
| 0x10165000
| [[MP Services]]
|
|-style="border-top: double"
| style="background: green" | Yes
| A11/A9
| [[MP Registers]]
| 0x10170000
| [[MP Services]]
| NTR WIFI Registers, see [http://problemkaputt.de/gbatek.htm#dswirelesscommunications GBATek].
|-
| style="background: green" | Yes
| A11/A9
| [[MP Registers]]
| 0x10171000
| [[MP Services]]
| NTR WIFI Registers (mirror)
|-
| style="background: green" | Yes
| A11/A9
|?
| 0x10172000
|?
| NTR WIFI Unused?
|-
| style="background: green" | Yes
| A11/A9
|?
| 0x10173000
|?
| NTR WIFI Unused?
|-
| style="background: green" | Yes
| A11/A9
| [[MP Registers]]
| 0x10174000
| [[MP Services]]
| NTR WIFI RAM
|-
| style="background: green" | Yes
| A11/A9
| [[MP Registers]]
| 0x10175000
|?
| NTR WIFI RAM
|-
| style="background: green" | Yes
| A11/A9
| [[MP Registers]]
| 0x10176000
|?
| NTR WIFI Registers (mirror)
|-
| style="background: green" | Yes
| A11/A9
| [[MP Registers]]
| 0x10177000
|?
| NTR WIFI Registers (mirror)
|-
| style="background: green" | Yes
| A11/A9
| [[MP Registers]]
| 0x10178000 - 0x10180000
| [[MP Services]]
| NTR WIFI WS1 Region
|-style="border-top: double"
| style="background: green" | Yes
| A11
| [[Corelink DMA Engines|CDMA]]
| 0x10200000
| Boot11, Kernel11
| [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0424d/index.html CoreLink™ DMA-330]. Only used by bootrom on New3DS.
|-
| style="background: green" | Yes
| A11
| ?
| 0x10201000
| TwlBg
|
|-
| style="background: green" | Yes
| A11
| [[LCD Registers]]
| 0x10202000
| TwlBg, Kernel11, [[GSP Services]]
|
|-
| style="background: green" | Yes
| A11
| [[DSP Registers]]
| 0x10203000
| [[DSP Services]]
|
|-
| style="background: green" | Yes
| A11
| ?
| 0x10204000
|
|
|-style="border-top: double"
| style="background: red" | No
| A11
| [[Corelink DMA Engines|CDMA]]
| 0x10206000
| NewKernel11
| CDMA was moved (mirrored?) here on New 3DS. [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0424d/index.html CoreLink™ DMA-330].
|-
| style="background: red" | No
| A11
| [[MVD Registers]]
| 0x10207000
| [[MVD Services]]
| New 3DS only?
|-style="border-top: double"
| style="background: green" | Yes
| A11
| AXI
| 0x1020F000
| TwlBg, [[GSP Services]]
| [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0422a/CHDGHIID.html CoreLink™ NIC-301 r1p0].
|-style="border-top: double"
| style="background: green" | Yes
| A11
| DMA region
| 0x10300000-0x10400000
|
| CDMA wants these addresses. Each page in this region corresponds to the same page in the 0x10100000-0x10200000 region. It is unknown if this is just a separate bus and/or if there are any differences in the registers.
|-style="border-top: double"
| style="background: green" | Yes
| A11
| [[GPU/External_Registers|GPU Registers]]
| 0x10400000
| Boot11, Kernel11, [[GSP Services]]
||
|}

IO registers starting at physical address 0x10200000 are not accessible from the ARM9 (which includes all LCD/GPU registers). It seems IO registers below physical address 0x10100000 are not accessible from the ARM11 bus.

ARM11 kernel virtual address mappings for these registers varies for different builds. For ARM11 user mode applications you have:
physaddr = virtaddr - 0x1EC00000 + 0x10100000

Title list

2016-09-25T12:13:03Z

Dazzozo: Undo revision 18280 by Neobrain (talk)

NOTE: This Title list is a condensed version, only the System Titles lists are full lists. For a full list of titles on Nintendo's CDN, see [http://mtheall.com/~mtheall/tmdlist.php here]. The reports/title-lists from [https://yls8.mtheall.com/ninupdates/reports.php here] are automatically obtained from the system update SOAP.

== CTR System Titles ==
{| class="wikitable" border="1"
|-
! System Category
! Bit Mask(s)
! Category Bit Mask
|-
| Application (SYSTEM_APPLICATION)
| Normal<nowiki>|</nowiki>System
| 0x0010
|-
| System Data Archives (SYSTEM_CONTENT)
| Contents<nowiki>|</nowiki>CannotExecution<nowiki>|</nowiki>System
| 0x001B
|-
| Shared Data Archives (SHARED_CONTENT)
| Contents<nowiki>|</nowiki>CannotExecution<nowiki>|</nowiki>System<nowiki>|</nowiki>NotRequireRightForMount
| 0x009B
|-
| System Data Archives (AUTO_UPDATE_CONTENT)
| Contents<nowiki>|</nowiki>CannotExecution<nowiki>|</nowiki>System<nowiki>|</nowiki>NotRequireUserApproval<nowiki>|</nowiki>NotRequireRightForMount
| 0x00DB
|-
| Applet (APPLET)
| Normal<nowiki>|</nowiki>System<nowiki>|</nowiki>RequireBatchUpdate
| 0x0030
|-
| Module (BASE)
| Normal<nowiki>|</nowiki>System<nowiki>|</nowiki>RequireBatchUpdate<nowiki>|</nowiki>CanSkipConvertJumpId
| 0x0130
|-
| Firmware (FIRMWARE)
| Normal<nowiki>|</nowiki>CannotExecution<nowiki>|</nowiki>System<nowiki>|</nowiki>RequireBatchUpdate<nowiki>|</nowiki>CanSkipConvertJumpId
| 0x0138
|}

=== 00040010 - System Applications ===
The versions for CHN, KOR, and TWN are separate from the other regions.

{| class="wikitable" border="1"
|-
! JPN TIDLow
! USA TIDLow
! EUR TIDLow
! CHN TIDLow
! KOR TIDLow
! TWN TIDLow
! [[Product code]]
! Description
! JPN Versions
! EUR Versions
! USA Versions
! CHN Versions
! KOR Versions
! TWN Versions
! Status
|-
| 00020000
| 00021000
| 00022000
| 00026000
| 00027000
| 00028000
| CTR-N-HAS?
| [[System Settings]] (mset)
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[3.0.0-5|v2060]], [[4.0.0-7|v3074]], [[5.0.0-11|v4097]], [[6.0.0-11|v5127]], [[7.0.0-13|v6157]], [[7.2.0-17|v7173]], [[8.1.0-0_New3DS|v8198]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v9224]], [[9.6.0-24|v10245]], [[10.6.0-31|v10256]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[3.0.0-5|v2061]], [[4.0.0-7|v3075]], [[5.0.0-11|v4097]], [[6.0.0-11|v5127]], [[7.0.0-13|v6157]], [[7.2.0-17|v7174]], [[9.0.0-20|v8202]], [[9.6.0-24|v9220]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[3.0.0-5|v2062]], [[4.0.0-7|v3078]], [[5.0.0-11|v4098]], [[6.0.0-11|v5128]], [[7.0.0-13|v6157]], [[7.2.0-17|v7174]], [[9.0.0-20|v8203]], [[9.6.0-24|v9221]]
| [[4.0.0-7|v8]], [[4.4.0-10|v1024]](CHN-only sysupdate for just mset), [[5.0.0-11|v2049]], [[7.0.0-13|v3075]]
| [[4.0.0-7|v1026]], [[5.0.0-11|v2049]], [[7.0.0-13|v4098]]
| [[4.1.0-8|v8]], [[4.2.0-9|v1024]], [[5.0.0-11|v2050]], [[7.0.0-13|v3074]]
| Active
|-
| 00020100
| 00021100
| 00022100
| 00026100
| 00027100
| 00028100
| CTR-N-HDL?
| [[Download Play]] (dlplay)
| [[1.0.0-0|v0]], [[2.1.0-4|v1026]], [[4.0.0-7|v2051]], [[9.0.0-20|v3072]](Also for [[8.1.0-0_New3DS]])
| [[1.0.0-0|v0]], [[2.1.0-4|v1026]], [[4.0.0-7|v2051]], [[9.0.0-20|v3073]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1026]], [[4.0.0-7|v2051]], [[9.0.0-20|v3073]]
| [[4.0.0-7|v4]]
| [[4.0.0-7|v1027]]
| [[4.1.0-8|v4]]
| Active
|-
| 00020200
| 00021200
| 00022200
| 00026200
| 00027200
| 00028200
| CTR-N-HMK?
| [[Activity Log]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[3.0.0-5|v2051]], [[10.6.0-31|v2080]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[3.0.0-5|v2054]], [[7.0.0-13|v2064]]
| Same as EUR
| [[4.0.0-7|v3]]
| [[4.0.0-7|v2]], [[7.0.0-13|v16]]
| [[4.1.0-8|v2]]
| Active
|-
| 00020300
| 00021300
| 00022300
| 00026300
| 00027300
| 00028300
| ?
| [[Health and Safety Information]] (safe)
| [[1.0.0-0|v0]], [[4.0.0-7|v1024]], [[6.0.0-11|v2050]]
| [[1.0.0-0|v0]], [[3.0.0-5|v1024]], [[4.0.0-7|v2050]], [[6.0.0-11|v3077]]
| [[1.0.0-0|v0]], [[4.0.0-7|v1026]], [[6.1.0-12U|v2051]]
| [[4.0.0-7|v5]]
| [[4.0.0-7|v2]]
| [[4.1.0-8|v5]]
| Active
|-
| 20020300
| 20021300
| 20022300
| N/A
| 20027300
| N/A
| CTR-N-HAC?
| [[New_3DS]] [[Health and Safety Information]]
| [[8.1.0-0_New3DS|v2]], [[9.3.0-21|v17]]
| [[8.1.0-0_New3DS|v1]]
| Same as EUR.
| N/A
| [[9.6.0-24|v2]]
| N/A
| Active
|-
| 00020400
| 00021400
| 00022400
| 00026400
| 00027400
| 00028400
| CTR-N-HEP?
| [[Nintendo 3DS Camera]] (CtrApp)
| [[1.0.0-0|v0]], [[2.1.0-4|v16]], [[3.0.0-5|v1038]], [[4.0.0-7|v2048]], [[6.0.0-11|v3073]], [[9.0.0-20|v4097]](Also for [[8.1.0-0_New3DS]]), [[10.6.0-31|v4112]]
| [[1.0.0-0|v0]], [[2.1.0-4|v16]], [[3.0.0-5|v1039]], [[4.0.0-7|v2048]], [[6.0.0-11|v3073]], [[7.0.0-13|v3088]], [[9.0.0-20|v4097]]
| [[1.0.0-0|v0]], [[2.1.0-4|v16]], [[3.0.0-5|v1039]], [[4.0.0-7|v2048]], [[6.1.0-12U|v3074]], [[7.0.0-13|v3088]], [[9.0.0-20|v4097]]
| [[4.0.0-7|v3]]
| [[4.0.0-7|v2]], [[7.0.0-13|v1040]]
| [[4.1.0-8|v3]]
| Active
|-
| 00020500
| 00021500
| 00022500
| 00026500
| 00027500
| 00028500
| CTR-N-HES?
| [[Nintendo 3DS Sound]] (CtrApp)
| [[1.0.0-0|v0]], [[2.1.0-4|v1027]], [[3.0.0-5|v2049]], [[4.0.0-7|v3072]], [[7.0.0-13|v3089]], [[10.6.0-31|3104]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1027]], [[3.0.0-5|v2049]], [[4.0.0-7|v3072]], [[7.0.0-13|v3088]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1027]], [[3.0.0-5|v2049]], [[4.0.0-7|v3072]], [[7.0.0-13|v3088]]
| [[4.0.0-7|v2]]
| [[4.0.0-7|v2]], [[7.0.0-13|v16]]
| [[4.1.0-8|v3]]
| Active
|-
| 00020700
| 00021700
| 00022700
| 00026700
| 00027700
| 00028700
| CTR-N-HED?
| [[Mii Maker]] (EDIT)
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[7.0.0-13|v2055]], [[10.6.0-31|v2064]]
| Same as JPN
| Same as JPN
| [[4.0.0-7|v1]]
| [[4.0.0-7|v1]], [[7.0.0-13|v16]]
| [[4.1.0-8|v2]]
| Active
|-
| 00020800
| 00021800
| 00022800
| 00026800
| 00027800
| 00028800
| CTR-N-HME?
| [[StreetPass Mii Plaza]] (MEET)
| [[1.0.0-0|v0]], v1027, [[2.1.0-4|v2048]], [[3.0.0-5|v3087]], [[3.0.0-6|v4096]], [[6.0.0-11|v5121]]
| [[1.0.0-0|v0]], v1027, [[2.1.0-4|v2048]], [[3.0.0-5|v3087]], [[3.0.0-6|v4096]], [[6.0.0-11|v5122]]
| [[1.0.0-0|v0]], v1027, [[2.1.0-4|v2048]], [[3.0.0-5|v3087]], [[3.0.0-6|v4096]], [[6.1.0-12U|v5124]], [[7.0.0-13|v5136]]
| [[4.0.0-7|v0]], [[4.4.0-10|v4096]]
| [[4.0.0-7|v1]], [[4.4.0-10|v4096]], [[7.0.0-13|v5120]]
| [[4.1.0-8|v1]], [[4.4.0-10|v4096]]
| Active
|-
| 00020900
| 00021900
| 00022900
| N/A
| 00027900
| 00028900
| CTR-N-HGR?
| [[eShop]] (tiger)
| [[2.0.0-2|v4]], [[2.1.0-3|v1026]], [[3.0.0-5|v2057]], [[4.0.0-7|v3081]], [[4.1.0-8|v4096]], [[4.2.0-9|v5123]], [[4.3.0-10|v6146]], [[5.0.0-11|v7169]], [[7.0.0-13|v8206]], [[7.1.0-14|v9231]], [[7.2.0-17|v10245]], [[8.0.0-18|v11265]], [[8.1.0-19|v12288]], [[9.0.0-20|v13320]], [[9.3.0-21|v15366]], [[9.5.0-22|v16384]], [[9.6.0-24|v17421]], [[9.7.0-25|v18432]], [[10.0.0-27|v19465]], [[10.4.0-29|v20483]], [[10.7.0-32|v21504]]
| [[2.0.0-2|v4]], [[2.1.0-3|v1026]], [[3.0.0-5|v2058]], [[4.0.0-7|v3081]], [[4.1.0-8|v4096]], [[4.2.0-9|v5123]], [[4.3.0-10|v6146]], [[5.0.0-11|v7171]], [[7.0.0-13|v8206]], [[7.1.0-14|v9231]], [[7.2.0-17|v10245]], [[8.0.0-18|v11265]], [[8.1.0-19|v12288]], [[9.0.0-20|v13320]], [[9.3.0-21|v15366]], [[9.5.0-22|v16384]], [[9.6.0-24|v17421]], [[9.7.0-25|v18432]], [[10.0.0-27|v19465]], [[10.4.0-29|v20482]], [[10.7.0-32|v21505]]
| [[2.0.0-2|v4]], [[2.1.0-3|v1026]], [[3.0.0-5|v2058]], [[4.0.0-7|v3081]], [[4.1.0-8|v4096]], [[4.2.0-9|v5123]], [[4.3.0-10|v6146]], [[5.0.0-11|v7170]], [[7.0.0-13|v8206]], [[7.1.0-14|v9231]], [[7.2.0-17|v10246]], [[8.0.0-18|v11265]], [[8.1.0-19|v12288]], [[9.0.0-20|v13321]], [[9.3.0-21|v15366]], [[9.5.0-22|v16384]], [[9.6.0-24|v17422]], [[9.7.0-25|v18432]], [[10.0.0-27|v19465]], [[10.4.0-29|v20482]], [[10.7.0-32|v21506]]
| N/A
| [[4.0.0-7|v3082]], [[4.1.0-8|v4096]], [[4.2.0-9|v5123]], [[4.3.0-10|v6146]], [[5.0.0-11|v7169]], [[7.0.0-13|v8205]], [[7.1.0-14|v9231]], [[8.1.0-19|v12288]], [[9.0.0-20|v13320]], [[9.3.0-21|v15366]], [[9.5.0-22|v16384]], [[9.6.0-24|v17420]], [[9.7.0-25|v18432]], [[10.0.0-27|v19465]], [[10.4.0-29|v20482]]
| [[4.1.0-8|v4096]], [[4.2.0-9|v5123]], [[4.3.0-10|v6146]], [[5.0.0-11|v7170]], [[7.0.0-13|v8205]], [[7.1.0-14|v9231]], [[8.1.0-19|v12288]], [[9.3.0-21|v15366]], [[9.5.0-22|v16384]], [[9.6.0-24|v17421]], [[9.7.0-25|v18432]], [[10.0.0-27|v19465]]
| Active
|-
| 00020A00
| 00021A00
| 00022A00
| N/A
| 00027A00
| 00028A00
| CTR-N-HCB?
| [[System Transfer]] (CARDBOARD)
| [[2.0.0-2|v4]], [[3.0.0-5|v1035]], [[4.0.0-7|v2050]], [[5.0.0-11|v3074]], [[7.0.0-13|v4109]], [[9.0.0-20|v5130]], [[9.6.0-24|v6154]]
| [[2.0.0-2|v4]], [[3.0.0-5|v1035]], [[4.0.0-7|v2050]], [[5.0.0-11|v3073]], [[7.0.0-13|v4109]], [[9.0.0-20|v5131]], [[9.6.0-24|v6155]]
| [[2.0.0-2|v4]], [[3.0.0-5|v1035]], [[4.0.0-7|v2051]], [[5.0.0-11|v3073]], [[7.0.0-13|v4109]], [[9.0.0-20|v5131]], [[9.6.0-24|v6156]]
| N/A
| [[4.0.0-7|v2]], [[5.0.0-11|v1025]], [[7.0.0-13|v2061]], [[9.0.0-20|v3082]]
| [[4.1.0-8|v2]], [[5.0.0-11|v1025]], [[7.0.0-13|v2061]]
| Active
|-
| 00020B00
| 00021B00
| 00022B00
| N/A
| N/A
| N/A
| CTR-N-HMA?
| [[Nintendo Zone]] ("Nintendo")
| [[1.0.0-0|v0]], [[3.0.0-5|v1034]]
| Same as JPN
| Same as JPN
| N/A
| N/A
| N/A
| Active
|-
| 00020D00
| 00021D00
| 00022D00
| 00026D00
| 00027D00
| 00028D00
| CTR-N-HCH?
| [[Face Raiders]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1028]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1028]], [[7.0.0-13|v1040]]
| Same as EUR
| [[4.0.0-7|v0]]
| [[4.0.0-7|v0]]
| [[4.1.0-8|v2]]
| Active
|-
| 20020D00
| 20021D00
| 20022D00
| N/A
| 20027D00
| N/A
| ?
| [[New_3DS]] [[Face Raiders]]
| [[8.1.0-0_New3DS|v2050]]
| [[8.1.0-0_New3DS|v2049]]
| Same as EUR.
| N/A
| [[9.6.0-24|v2049]]
| N/A
| Active
|-
| 00020E00
| 00021E00
| 00022E00
| 00026E00
| 00027E00
| 00028E00
| CTR-N-HAR?
| [[AR Games]] (AR_ACT)
| [[1.0.0-0|v0]], [[2.1.0-4|v1026]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1026]], [[7.0.0-13|v1040]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1027]], [[7.0.0-13|v1040]]
| [[4.0.0-7|v0]]
| [[4.0.0-7|v0]], [[7.0.0-13|v16]]
| [[4.1.0-8|v1]]
| Active
|-
| 00020F00
| 00021F00
| 00022F00
| 00026F00
| 00027F00
| 00028F00
| CTR-N-HSH?
| SAFE_MODE [[System Settings#System Updater|System Updater]] (mset)
| [[1.0.0-0|v0]], [[3.0.0-5|v1024]], [[6.0.0-11|v2049]]
| [[1.0.0-0|v0]], [[3.0.0-5|v1024]], [[6.0.0-11|v2050]]
| Same as JPN
| [[4.0.0-7|v1]], [[6.0.0-11|v1026]]
| [[4.0.0-7|v1]]
| [[4.1.0-8|v1]]
| Active
|-
| 00023000
| 00024000
| 00025000
| N/A
| N/A
| N/A
| (Variable?)
| Promotional video
| [[1.1.0-1|v2]], [[2.0.0-2|v2048]]
| [[1.1.0-1|v<unknown>]], [[2.0.0-2|v2048]]
| [[1.1.0-1|v0]], [[2.0.0-2|v2048]]
| N/A
| N/A
| N/A
| Stubbed
|-
| 0002BF00
| 0002C000
| 0002C100
| N/A
| N/A
| N/A
| CTR-N-HAF?
| Nintendo Network ID Settings (act)
| [[7.0.0-13|v14]], [[7.2.0-17|v1029]], [[9.0.0-20|v2051]], [[9.3.0-21|v3072]]
| Same as JPN
| Same as JPN
| N/A
| N/A
| N/A
| Active
|-
| 20023100
| 20024100
| 20025100
| N/A
| N/A
| N/A
| CTR-N-HAJ?
| [[microSD Management]] ('mcopy') ([[New_3DS]]-only)
| [[8.1.0-0_New3DS|v8]], [[9.0.0-20|v1024]]
| [[8.1.0-0_New3DS|v4]]
| [[8.1.0-0_New3DS|v5]]
| N/A
| N/A
| N/A
| Available
|-
| 2002C800
| 2002CF00
| 2002D000
| N/A
| 2002D700
| N/A
| CTR-P-CTAP
| [[New_3DS]]-only, currently stubbed. "HOME menu/menu".
| [[8.1.0-0_New3DS|v2]], [[9.0.0-20|v18]], [[9.3.0-21|v34]], [[9.6.0-24|v50]]
| [[8.1.0-0_New3DS|v1]], [[9.3.0-21|v17]], [[9.6.0-24|v34]]
| [[8.1.0-0_New3DS|v1]], [[9.3.0-21|v18]], [[9.6.0-24|v33]]
| N/A
| [[9.6.0-24|v2]]
| N/A
| Stubbed
|-
| 2002C900
| 2002D100
| 2002D200
| N/A
| 2002D800
| N/A
| CTR-P-CTAP
| [[New_3DS]]-only, currently stubbed. "Friends list/friend".
| [[8.1.0-0_New3DS|v1]]
| Same as JPN.
| [[8.1.0-0_New3DS|v0]], [[9.3.0-21|v16]]
| N/A
| [[9.6.0-24|v2]]
| N/A
| Stubbed
|-
| 2002CA00
| 2002D300
| 2002D400
| N/A
| 2002D900
| N/A
| CTR-P-CTAP
| [[New_3DS]]-only, currently stubbed. "Notifications/newslist".
| [[8.1.0-0_New3DS|v0]], v1([[Home_Menu|JPN-only]] Oct 2, 2014 "sysupdate", actually uploaded on 09-29-14. Identical to v0, same TMDs besides title-versions)
| [[8.1.0-0_New3DS|v2]]
| [[8.1.0-0_New3DS|v0]]
| N/A
| [[9.6.0-24|v2]]
| N/A
| Stubbed
|-
| 2002CB00
| 2002D500
| 2002D600
| N/A
| 2002DA00
| N/A
| CTR-P-CTAP
| [[New_3DS]]-only, currently stubbed. "Game notes/cherry".
| [[8.1.0-0_New3DS|v0]], [[9.0.0-20|v1]]
| [[8.1.0-0_New3DS|v2]]
| Same as EUR.
| N/A
| [[9.6.0-24|v1]]
| N/A
| Stubbed
|}

The "act" application seems to use a web browser with webkit?

Regardless of version, the ExeFS:/.code for mset is the same for USA/EUR/JPN. The [[4.0.0-7]] version of mset([[4.1.0-8]] for TWN) has the same ExeFS:/.code for all regions(JPN, USA, EUR, CHN, KOR, TWN). The [[5.0.0-11]] mset ExeFS:/.code is the same for all regions as well, except for CHN. The [[7.0.0-13]] mset ExeFS:/.code is unique for the following regions: CHN, KOR, and TWN.

=== 0004001B - [[NCCH#CFA|System Data Archives]] ===
{| class="wikitable" border="1"
|-
! TitleID Low
! Description
! Versions
|-
| 00010002
| [[ClCertA]]
| [[1.0.0-0|v0]]
|-
| 00010702
| [[NS CFA]]
| [[3.0.0-5|v0]], [[6.0.0-11|v1028]], [[6.3.0-12|v2048]], [[7.0.0-13|v3073]], [[9.0.0-20|v4096]](also for [[8.1.0-0_New3DS]])
|-
| 00010802
| This CFA only contains a 1-byte "dummy.txt" in the RomFS, which contains '0'.
| [[6.3.0-12|v0]], [[9.5.0-23|v1024]], [[10.5.0-30|v2048]], [[11.0.0-33|v3072]]
|-
| 00018002
| Same contents as 00010802. Starting with [[7.1.0-15]], the "dummy.txt" file was removed from RomFS: this CFA RomFS now contains web-browser data(similar to 00018102) for NNID / networking, etc.
| [[7.0.0-13|v14]], [[7.1.0-15|v1025]], [[7.2.0-17|v2055]], [[9.0.0-20|v3078]], [[9.3.0-21|v4096]], [[9.6.0-24|v5120]]
|-
| 00018102
| This contains local web-browser data(html/js, gfx, etc) for the Miiverse Offline-mode.
| [[7.0.0-13|v11]], [[9.0.0-20|v1025]](also for [[8.1.0-0_New3DS]])
|-
| 00018202
| This contains the webkit/OSS [[CRO0|CROs]] used with the Miiverse applet and the "act" application.
| [[7.0.0-13|v7]], [[8.1.0-0_New3DS|v1026]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v2050]]
|-
| 00019002
| [[Fangate_updater]]
| [[9.3.0-21|v2]], [[9.6.0-24|v1026]]
|}

=== 00040030 - Applets===
{| class="wikitable" border="1"
|-
! JPN TitleIDLow
! USA TitleIDLow
! EUR TitleIDLow
! CHN TitleIDLow
! KOR TitleIDLow
! TWN TitleIDLow
! [[Product code]]
! Description
! JPN Versions
! USA Versions
! EUR Versions
|-
|colspan=6| 00008102
| CTR-P-CTAP
| [[NS#Alternate menu|Test Menu]] (Demo1)
|colspan=3| ..., v64, ..., v27648
|-
| 00008202
| 00008F02
| 00009802
| 0000A102
| 0000A902
| 0000B102
| CTR-P-HMM?
| [[Home Menu]] (menu)
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[2.1.0-3|v2049]], [[2.2.0-X|v3075]], [[3.0.0-5|v4111]], [[4.0.0-7|v5131]], [[4.2.0-9|v6146]], [[5.0.0-11|v7172]], [[6.0.0-11|v8198]], [[7.0.0-13|v9230]], [[8.1.0-0_New3DS|v10250]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v13313]], [[9.1.0-20J|v14336]], [[9.2.0-20|v15360]], [[9.3.0-21|v16402]], [[9.4.0-21|v17408]], [[9.5.0-22|v18432]], [[9.6.0-24|v19476]], [[9.7.0-25|v20487]], [[9.8.0-25|v22528]], [[10.1.0-27|v23552]], [[10.2.0-28|v24576]], [[10.3.0-28|v25600]], [[10.4.0-29|v26626]], [[10.6.0-31|v27648]], [[11.1.0-34|v28672]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[2.1.0-3|v2049]], [[2.2.0-X|v3075]], [[3.0.0-5|v4111]], [[4.0.0-7|v5131]], [[4.2.0-9|v6146]], [[5.0.0-11|v7172]], [[6.0.0-11|v8198]], [[7.0.0-13|v9230]], [[9.0.0-20|v11272]], [[9.2.0-20|v12288]], [[9.3.0-21|v13330]], [[9.4.0-21|v14336]], [[9.5.0-22|v15360]], [[9.6.0-24|v16404]], [[9.7.0-25|v17415]], [[9.8.0-25|v19456]], [[9.9.0-26|v20480]], [[10.1.0-27|v21504]], [[10.2.0-28|v22528]], [[10.3.0-28|v23552]], [[10.4.0-29|v24578]], [[10.6.0-31|v25600]], [[11.1.0-34|v26624]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[2.1.0-3|v2049]], [[2.2.0-X|v3075]], [[3.0.0-5|v4111]], [[4.0.0-7|v5131]], [[4.2.0-9|v6146]], [[5.0.0-11|v7172]], [[6.0.0-11|v8198]], [[7.0.0-13|v9230]], [[9.0.0-20|v11272]], [[9.2.0-20|v12288]], [[9.3.0-21|v13330]], [[9.4.0-21|v14336]], [[9.5.0-22|v15360]], [[9.6.0-24|v16404]], [[9.7.0-25|v17415]], [[9.8.0-25|v19456]], [[10.1.0-27|v20480]], [[10.2.0-28|v21504]], [[10.3.0-28|v22528]], [[10.4.0-29|v23554]], [[10.6.0-31|v24576]], [[11.1.0-34|v25600]]
|-
| 00008402
| 00009002
| 00009902
| 0000A202
| 0000AA02
| 0000B202
| CTR-N-HCS?
| Camera applet used by Home-menu (CtrApp)
|colspan=3| v0, v1036, [[9.0.0-20|v2049]](Also for [[8.1.0-0_New3DS]])
|-
| 00008502
| 00009102
| 00009A02
| ?
| ?
| ?
| ?
| Not available on CDN
| ?
| ?
| ?
|-
| 00008602
| 00009202
| 00009B02
| 0000A402
| 0000AC02
| 0000B402
|
| Instruction Manual, applet for displaying instruction manuals
|colspan=3| v0, v1026, v2048, v3072, [[5.0.0-11|v4097]], [[9.0.0-20|v5120]](Also for [[8.1.0-0_New3DS]])
|-
| 00008702
| 00009302
| 00009C02
| 0000A502
| 0000AD02
| 0000B502
| CTR-N-HGM?
| Game Notes (Cherry)
|colspan=3| v0, v1026, v2049, [[5.0.0-11|v3073]], [[9.0.0-20|v4096]](Also for [[8.1.0-0_New3DS]])
|-
| 00008802
| 00009402
| 00009D02
| 0000A602
| 0000AE02
| 0000B602
|
| [[Internet Browser]] (spider)
|colspan=3| [[2.0.0-2|v6]], [[2.1.0-4|v1024]], [[4.0.0-7|v2050]], [[5.0.0-11|v3074 (EUR)/v3075(USA,JAP)]], [[7.0.0-13|v3088]], [[7.1.0-16|v4096]], [[9.5.0-23|v5121]], [[9.9.0-26|v6149]], [[10.2.0-28|v7168]], [[10.6.0-31|v8192]], [[10.7.0-32|v9232]], [[11.1.0-34|v10240]]
|-
| 20008802
| 20009402
| 20009D02
| ?
| 2000AE02
| N/A
| CTR-N-HBR?
| [[New 3DS]] [[Internet Browser]] (SKATER)
|colspan=3| [[8.1.0-0_New3DS|v10]], [[9.3.0-21|v1027]], [[9.6.0-24|v2051]], [[9.9.0-26|v3077]], [[10.2.0-28|v4096]], [[10.4.0-29|v5121]], [[10.6.0-31|v6144]], [[10.7.0-32|v7184]], [[11.1.0-34|v8192]]
|-
|colspan=6| 00008A02
|
| Fatal error viewer ([[ErrDisp]])
|colspan=3| v0, v1025, [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[5.0.0-11|v5121]], [[8.0.0-18|v6144]], [[9.0.0-20|v7168]](Also for [[8.1.0-0_New3DS]])
|-
|colspan=6| 00008A03
|
| SAFE_MODE [[ErrDisp]]
|colspan=3| v0
|-
| 20008A03
| 20008A03
| 20008A03
| ?
| 20008A03
| N/A
|
| [[New_3DS]] SAFE_MODE [[ErrDisp]]
|colspan=3| [[8.1.0-0_New3DS|v7169]]
|-
| 00008D02
| 00009602
| 00009F02
| 0000A702
| 0000AF02
| 0000B702
| CTR-N-HFR?
| Friend List (friend)
|colspan=3| v0, v1026, [[2.2.0-X|v2051]], v3082, v4099, [[7.0.0-13|v5120]], [[9.0.0-20|v6144]](Also for [[8.1.0-0_New3DS]]) (EUR v6, v1024, v3082, v4099, [[7.0.0-13|v5120]], [[9.0.0-20|v6144]])
|-
| 00008E02
| 00009702
| 0000A002
| 0000A802
| 0000B002
| 0000B802
| CTR-N-HCR?
| Notifications (newslist)
|colspan=3| v0, v1029, v2054, v3075, [[9.0.0-20|v4097]] (EUR v6, v1024, v2054, v3075, [[9.0.0-20|v4097]]) (JPN: ..., [[8.1.0-0_New3DS|v4096]], [[9.0.0-20|v5121]])
|-
| 0000C002
| 0000C802
| 0000D002
| 0000D802
| 0000DE02
| 0000E402
| CTR-N-HKY?
| Software Keyboard (swkbd)
|colspan=3| v0, v1026, v2053, [[7.0.0-13|v3072]], [[9.0.0-20|v4096]](Also for [[8.1.0-0_New3DS]])
|-
| 0000C003
| 0000C803
| 0000D003
| 0000D803
| 0000DE03
| 0000E403
|
| SAFE_MODE Software Keyboard (swkbd)
|colspan=3| v0
|-
| 2000C003
| 2000C803
| 2000D003
| ?
| 2000DE03
| N/A
|
| [[New 3DS]] SAFE_MODE Software Keyboard (swkbd)
| [[8.1.0-0_New3DS|v1024]]
|colspan=2|[[9.0.0-20|v0]]
|-
| 0000C102
| 0000C902
| 0000D102
| 0000D902
| 0000DF02
| 0000E502
|
| Mii picker (appletEd)
|colspan=3| v0, v1026, [[9.0.0-20|v2048]](Also for [[8.1.0-0_New3DS]]), [[9.3.0-21|v3077]]
|-
| 0000C302
| 0000CB02
| 0000D302
| 0000DB02
| 0000E102
| 0000E702
|
| Picture picker (PNOTE_AP)
|colspan=3| v0, v1024, [[8.1.0-0_New3DS|v2049]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v3075]], [[9.3.0-21|v4096]]
|-
| 0000C402
| 0000CC02
| 0000D402
| 0000DC02
| 0000E202
| 0000E802
|
| [[Nintendo 3DS Sound|Voice memo]] picker (SNOTE_AP)
|colspan=3| v0, v3, [[8.0.0-18|v1026]], [[9.0.0-20|v2048]](Also for [[8.1.0-0_New3DS]])
|-
|colspan=3| 0000C502
|colspan=3| 0000CF02
|
| Non-critical (online, etc) error display (error)
|colspan=3| v0, v1026, v2053, v3074, [[8.1.0-0_New3DS|v4096]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v5128]], [[9.6.0-24|v6145]]
|-
|colspan=3| 0000C503
|colspan=3| 0000CF03
|
| SAFE_MODE error applet
|colspan=3| v0
|-
| 2000C503
| 2000C503
| 2000C503
| ?
| 2000CF03
| N/A
|
| [[New 3DS]] SAFE_MODE error applet
|colspan=3| [[8.1.0-0_New3DS|v1024]]
|-
|colspan=3| 0000CD02
|colspan=3| 0000D502
|
| [[Circle Pad Pro]] test/calibration applet (extrapad)
|colspan=3| v1, v1026, [[8.1.0-0_New3DS|v2048]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v3073]]
|-
| 0000C602
| 0000CE02
| 0000D602
| N/A
| 0000E302
| 0000E902
| CTR-N-HAA?
| eShop applet, used by applications for accessing the eShop, for DLC/etc. Also used by the eShop application itself. (mint)
|colspan=3| v5, v1028, [[4.2.0-9|v2050]], [[5.0.0-11|v3072]], [[7.0.0-13|v4109]], [[7.2.0-17|v5125]](v5123 for JPN), [[8.0.0-18|v6145]], [[8.1.0-0_New3DS|v7168]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v8200]], [[9.3.0-21|v9224]], [[9.6.0-24|v10247]], [[9.8.0-25|v11264]], [[10.0.0-27|v12293]], [[10.1.0-27|v13312]], [[10.3.0-28|v14337]], [[10.4.0-29|v15360]], [[10.7.0-32|v16384]]
|-
| 0000BC02
| 0000BD02
| 0000BE02
| ?
| ?
| ?
| CTR-N-HAE?
| Miiverse (olv)
|colspan=3| [[7.0.0-13|v14]], [[7.2.0-17|v1024]], [[9.0.0-20|v2048]](Also for [[8.1.0-0_New3DS]]), [[9.3.0-21|v3072]], [[9.6.0-24|v4096]]
|-
| 0000F602
| 0000F602
| 0000F602
| ?
| ?
| ?
|
| Likely the "system library" for Miiverse (memolib)
|colspan=3| [[7.0.0-13|v5]], [[8.1.0-0_New3DS|v1024]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v2050]], [[9.3.0-21|v3072]]
|-
| 00008302
| 00008B02
| 0000BA02
| ?
| ?
| ?
| CTR-N-HAH?
| In-app Miiverse-posting applet (solv3)
|colspan=3| [[9.0.0-20|v6]]
|-
| 00009502
| 00009E02
| 0000B902
| ?
| 00008C02
| ?
| CTR-N-HA3?
| Cabinet ([[amiibo Settings]])
|colspan=3| [[9.3.0-21|v7]], [[9.6.0-24|v1031]]
|}

Most of these processes are applets, see [[NS_and_APT_Services|here]] for details.

All of the above processes use the "SYSTEM" [[SVC|memory-region]].

The ExeFS for Home Menu is exactly the same for USA/EUR/JPN.

The Miiverse applet seems to use a web browser with webkit.

=== 0004009B - [[NCCH#CFA|System Data Archives]] (Shared Archives) ===
{| class="wikitable" border="1"
|-
! JPN TitleIDLow
! USA TitleIDLow
! EUR TitleIDLow
! KOR TitleIDLow
! Description
! Versions
|-
| 00010202
| 00010202
| 00010202
| 00010202
| Probably Mii-related, contains "CFL_Res.dat" in the RomFS.
| v0
|-
| 00010302
| 00010302
| 00010302
|
| Only exists for dev-units.
| v0, v2052
|-
| 00010402
| 00010402
| 00010402
| 00010402
| Mounted as "area:", contains Country and Region names
| v0, v1024, v2050, v3072, [[7.0.0-13|v4098]], [[9.6.0-24|v5122]]
|-
| 00010502
| 00010502
| 00010502
|
| Only exists for dev-units.
| v0, v1024, v2048
|-
| 00010602
| 00010602
| 00010602
| 00010602
| Non-Nintendo TLS Root-CA Certificates (RomFS contains files with filename "CACERT_PUBLIC_CA_<val>.der", where <val> is 5..8)
| v2, [[10.5.0-30|v1024]]
|-
|
|
| 00011202
|
| "NL/NL" dictionary.
| v0
|-
|
|
| 00011302
|
| "EN/GB" dictionary.
| v0
|-
|
| 00011402
|
|
| "EN/US" dictionary.
| v0
|-
|
|
| 00011502
|
| "FR/FR/regular" dictionary.
| v0
|-
|
| 00011602
|
|
| "FR/CA/regular" dictionary.
| v0
|-
|
|
| 00011702
|
| "DE/regular" dictionary.
| v0
|-
|
|
| 00011802
|
| "IT/IT" dictionary.
| v0
|-
| 00011902
|
|
|
| "JA_small/32" dictionary.
| v0
|-
|
|
|
| 00011A02
| ?
| v1
|-
|
|
| 00011B02
|
| "PT/PT/regular" dictionary.
| v0
|-
|
|
| 00011C02
|
| "RU/regular" dictionary.
| v0
|-
|
| 00011D02
| 00011D02
|
| "ES/ES" dictionary.
| v0
|-
|
| 00011E02
|
|
| "PT/BR/regular" dictionary.
| v0
|-
| 00012202
| 00012302
| 00012102
| 00012502
| ?contains a lists with error strings
| v1026, v2053, v3073, [[4.2.0-9|v4096]], [[5.0.0-11|v5120]], [[7.0.0-13|v6149]], [[7.2.0-17|v7168]], [[8.0.0-18|v8192]], [[9.0.0-20|v9218]], [[9.3.0-21|v10242]], [[9.6.0-24|v11269]], [[10.0.0-27|v12289]], [[10.4.0-29|v13312]], [[10.7.0-32|v13313]] (JPN: [[11.1.0-34|v14336]]) (KOR: [[9.6.0-24|v6148]], [[10.0.0-27|v7169]], [[10.3.0-28|v8193]], [[10.4.0-29|v9216]], [[11.1.0-34|v10240]])
|-
| 00013202
| 00013302
| 00013102
| 00013502
| Mounted as "eula:"
| v0, v1024, v2049 USA: v1024, v2051, [[7.0.0-13|v3074]], [[7.2.0-17|v4100]](EUR-only), [[9.0.0-20|v4099]], [[9.9.0-26|v6144]], [[10.4.0-29|v7168]] (KOR: [[9.7.0-25|v1025]])
|-
| 00014002
| 00014002
| 00014002
| 00014002
| JPN/EUR/USA [[System Font]] ("font:")
| v0
|-
| 00014102
| 00014102
| 00014102
| 00014102
| CHN [[System Font]] ("font:")
| v0, v1024
|-
| 00014202
| 00014202
| 00014202
| 00014202
| KOR [[System Font]] ("font:")
| v0, v1024
|-
| 00014302
| 00014302
| 00014302
| 00014302
| TWN [[System Font]] ("font:")
| v0, v1024
|-
| 00015202
| 00015302
| 00015102
| 00015502
| Mounted as "rate:"
| v0 (EUR: v0, v1024) (KOR: v1024)
|}

=== 000400DB - [[NCCH#CFA|System Data Archives]] ===
These [[NVer]] titleIDs can be found @ offset 0x320 in every [[CCI]].

{| class="wikitable" border="1"
|-
! EUR TitleIDLow
! JPN TitleIDLow
! USA TitleIDLow
! CHN TitleIDLow
! KOR TitleIDLow
! TWN TitleIDLow
! Description
! USA/EUR/JPN Versions
! CHN Versions
! TWN Versions
! KOR Versions
|-
| 00010302
| 00010302
| 00010302
| 00010302
| 00010302
| 00010302
| NGWord bad word list
| [[1.0.0-0|v0]], [[2.0.0-2|v1024]], [[3.0.0-5|v2052]], [[4.0.0-7|v3072]], [[4.3.0-10|v4096]], [[5.0.0-11|v5120]], [[9.0.0-20|v6144]], [[9.3.0-21|v7168]], [[9.6.0-24|v8192]], [[11.1.0-34|v9217]]
| Same as USA
| Same as USA
| Same as USA
|-
| 00010502
| 00010502
| 00010502
| 00010502
| 00010502
| 00010502
| [[Nintendo Zone]] hotspot list
| [[1.0.0-0|v0]], [[2.0.0-2|v1024]], [[3.0.0-5|v2048]], [[4.0.0-7|v3073]], [[4.3.0-10|v4096]], [[4.4.0-10|v5120]], [[4.5.0-10|v6144]], [[5.0.0-11|v7169]], [[6.0.0-11|v8192]], [[6.2.0-12|v9216]], [[7.0.0-13|v10242]], [[7.2.0-17|v11267]], [[8.0.0-18|v12288]], [[9.0.0-20|v14336]], [[9.3.0-21|v15360]], [[9.6.0-24|v16386]], [[10.0.0-27|v17409]], [[10.4.0-29|v18432]], [[11.1.0-34|v19457]]
| Same as USA
| Same as USA
| Same as USA
|-
| 00016102
| 00016202
| 00016302
| 00016402
| 00016502
| 00016602
| [[NVer]]
| [[1.0.0-0|v0]], [[1.1.0-1|v16]], [[2.0.0-2|v32]], [[2.1.0-3|v48]], [[2.1.0-4|v64]], [[3.0.0-5|v80]], [[3.0.0-6|v96]], [[4.0.0-7|v112]], [[4.1.0-8|v128]], [[4.2.0-9|v144]], [[4.3.0-10|v160]], [[5.0.0-11|v176]], non-USA=[[6.0.0-11|v192]]/USA=[[6.1.0-12U|v192]], [[7.0.0-13|v208]], [[7.1.0-14|v224]], [[7.1.0-15|v240]], [[7.1.0-16|v256]], [[7.2.0-17|v272]], [[8.0.0-18|v288]], [[8.1.0-19|v304]], [[9.0.0-20|v320]], [[9.3.0-21|v336]], [[9.5.0-22|v352]], [[9.5.0-23|v368]], [[9.6.0-24|v384]], [[9.7.0-25|v400]], [[9.9.0-26|v416]], [[10.0.0-27|v432]], [[10.2.0-28|v448]], [[10.4.0-29|v464]], [[10.5.0-30|v480]], [[10.6.0-31|v496]], [[10.7.0-32|v512]], [[11.0.0-33|v528]], [[11.1.0-34|v544]]
| [[4.0.0-7|v113]], [[4.2.0-9|v128]], [[5.0.0-11|v129]], [[7.1.0-16|v130]], [[7.2.0-17|v272]], [[9.5.0-23|v131]], [[9.9.0-26|v132]]
| [[4.1.0-8|v114]], [[4.2.0-9|v133]], [[4.3.0-10|v134]], [[5.0.0-11|v136]], [[7.0.0-13|v144]], [[7.1.0-14|v160]] [[7.1.0-16|v192]], [[7.2.0-17|v272]], [[8.0.0-18|v208]], [[8.1.0-19|v224]], [[9.0.0-20|v240]], [[9.5.0-22|v272]], [[9.5.0-23|v288]], [[9.6.0-24|v304]], [[9.7.0-25|v320]], [[9.9.0-26|v336]], [[10.0.0-27|v352]], [[10.2.0-28|v368]], [[10.4.0-29|v384]], [[10.5.0-30|v400]], [[10.6.0-31|v416]], [[10.7.0-32|v432]], [[11.0.0-33|v448]], [[11.1.0-34|v464]]
| [[4.0.0-7|v113]], [[4.1.0-8|v114]], [[4.2.0-9|v133]], [[4.3.0-10|v134]], [[5.0.0-11|v136]], [[7.0.0-13|v160]], [[7.1.0-14|v176]], [[7.1.0-16|v176]], [[7.2.0-17|v272]], [[8.0.0-18|v224]], [[8.1.0-19|v240]], [[9.0.0-20|v256]], [[9.3.0-21|v272]], [[9.5.0-22|v288]], [[9.5.0-23|v304]], [[9.6.0-24|v320]], [[9.7.0-25|v336]], [[9.9.0-26|v352]], [[10.0.0-27|v368]], [[10.2.0-28|v384]], [[10.4.0-29|v400]], [[10.5.0-30|v416]], [[10.6.0-31|v432]], [[10.7.0-32|v448]], [[11.0.0-33|v464]], [[11.1.0-34|v480]]
|-
| 20016102
| 20016202
| 20016302
| N/A
| 20016502
| N/A
| [[New_3DS]] [[NVer]]
| [[8.1.0-0_New3DS|v0]], [[9.0.0-20|v320]], [[9.3.0-21|v336]], [[9.5.0-22|v352]], [[9.5.0-22|v352]], [[9.5.0-23|v368]], [[9.6.0-24|v384]], [[9.7.0-25|v400]], [[9.9.0-26|v416]], [[10.0.0-27|v432]], [[10.2.0-28|v448]], [[10.4.0-29|v464]], [[10.5.0-30|v480]], [[10.6.0-31|v496]], [[10.7.0-32|v512]], [[11.0.0-33|v528]], [[11.1.0-34|v544]]
| N/A
| N/A
| [[9.6.0-24|v320]], [[9.7.0-25|v336]], [[9.9.0-26|v352]], [[10.0.0-27|v368]], [[10.2.0-28|v384]], [[10.4.0-29|v400]], [[10.5.0-30|v416]], [[10.6.0-31|v432]], [[10.7.0-32|v448]], [[11.0.0-33|v464]]
|-
| 00017102
| 00017202
| 00017302
| 00017402
| 00017502
| 00017602
| [[CVer]]
| [[1.0.0-0|v1024]], [[1.1.0-1|v1045]], [[2.0.0-2|v2049]], [[2.1.0-3|v2069]], [[2.2.0-X|v2088]] [[3.0.0-5|v3088]], [[4.0.0-7|v4098]], [[4.1.0-8|v4113]], [[4.2.0-9|v4130]], [[4.3.0-10|v4145]], [[4.4.0-10|v4163]], [[4.5.0-10|v4176]], [[5.0.0-11|v5120]], [[5.1.0-11|v5136]], [[6.0.0-11|v6146]], [[6.1.0-11|v6160]], [[6.2.0-12|v6178]], [[6.3.0-12|v6192]], [[7.0.0-13|v7175]], [[7.1.0-14|v7187]], [[7.2.0-17|v7203]], [[8.0.0-18|v8196]], [[8.1.0-18|v8208]], [[8.1.0-0_New3DS|v8215]](8.1.0-0_New3DS), [[9.0.0-20|v9218]], [[9.1.0-20J|v9232]](JPN-only), [[9.2.0-20|v9248]], [[9.3.0-21|v9264]], [[9.4.0-21|v9280]], [[9.5.0-22|v9296]], [[9.6.0-24|v9319]], [[9.7.0-25|v9328]], [[9.8.0-25|v9344]], [[9.9.0-26|v9360]], [[10.0.0-27|v10240]], [[10.1.0-27|v10256]], [[10.2.0-28|v10272]], [[10.3.0-28|v10288]], [[10.4.0-29|v10304]], [[10.5.0-30|v10320]], [[10.6.0-31|v10336]], [[10.7.0-32|v10352]], [[11.0.0-33|v11264]], [[11.1.0-34|v11280]]
| [[1.0.0-0|v1024]], [[1.1.0-1|v1045]], [[2.0.0-2|v2049]], [[2.1.0-3|v2069]], [[2.2.0-X|v2088]] [[3.0.0-5|v3088]], [[4.0.0-7|v4098]], [[4.1.0-8|v4113]], [[4.2.0-9|v4130]], [[4.3.0-10|v4145]], [[4.4.0-10|v4163]], [[4.5.0-10|v4176]], [[5.0.0-11|v5120]], [[5.1.0-11|v5136]], [[6.0.0-11|v6146]], [[6.1.0-11|v6160]], [[6.2.0-12|v6178]], [[6.3.0-12|v6192]], [[7.0.0-13|v7175]], [[7.1.0-14|v7187]], [[7.2.0-17|v7203]], [[8.0.0-18|v8196]], [[8.1.0-18|v8208]], [[9.0.0-20|v9217]], [[9.3.0-21|v9264]], [[9.5.0-22|v9296]], [[9.6.0-24|v9319]], [[9.7.0-25|v9328]], [[9.8.0-25|v9344]], [[9.9.0-26|v9360]], [[10.0.0-27|v10240]], [[10.2.0-28|v10272]], [[10.4.0-29|v10304]], [[10.5.0-30|v10320]], [[10.6.0-31|v10336]], [[10.7.0-32|v10352]]
| Same as CHN
| Same as CHN, [[11.1.0-34|v11280]]
|}

=== 00040130 - System [[Services API|Modules]] ===
{| class="wikitable" border="1"
|-
! TitleID Low
! Description
! Versions
|-
| 00001002
| [[Services|sm]] (Stored in [[FIRM|NATIVE_FIRM]])
| N/A
|-
| 00001003
| SAFE_MODE [[Services|sm]] (Stored in SAFE_MODE NATIVE_FIRM)
| N/A
|-
| 00001102
| [[Filesystem services‎|fs]] (Stored in [[FIRM|NATIVE_FIRM]])
| N/A
|-
| 00001103
| SAFE_MODE [[Filesystem services‎|fs]] (Stored in SAFE_MODE NATIVE_FIRM)
| N/A
|-
| 00001202
| [[Process Manager Services|pm]] (Stored in [[FIRM|NATIVE_FIRM]])
| N/A
|-
| 00001203
| SAFE_MODE [[Process Manager Services|pm]] (Stored in SAFE_MODE NATIVE_FIRM)
| N/A
|-
| 00001302
| [[Loader Services‎|loader]] (Stored in [[FIRM|NATIVE_FIRM]])
| N/A
|-
| 00001303
| SAFE_MODE [[Loader Services‎|loader]] (Stored in SAFE_MODE NATIVE_FIRM)
| N/A
|-
| 00001402
| [[PXI Services‎|pxi]] (Stored in [[FIRM|NATIVE_FIRM]])
| N/A
|-
| 00001403
| SAFE_MODE [[PXI Services‎|pxi]] (Stored in SAFE_MODE NATIVE_FIRM)
| N/A
|-
| 00001502
| [[Application Manager Services|AM]] ( Application Manager )
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[3.0.0-5|v2053]], [[4.0.0-7|v3072]], [[5.0.0-11|v4098]], [[6.0.0-11|v5120]], [[8.0.0-18|v6148]], [[8.1.0-0_New3DS|v7168]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v8192]], [[10.0.0-27|v9217]]
|-
| 00001503
| SAFE_MODE [[Application Manager Services|AM]]
| [[1.0.0-0|v0]]
|-
| 20001503
| [[New_3DS]] SAFE_MODE [[Application Manager Services|AM]]
| [[8.1.0-0_New3DS|v7169]]
|-
| 00001602
| [[Camera Services|Camera]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[3.0.0-5|v2048]], [[4.0.0-7|v3074]], [[5.0.0-11|v4098]], [[6.0.0-11|v5120]], [[7.1.0-14|v6146]], [[8.0.0-18|v7172]], [[9.0.0-20|v9216]], [[9.3.0-21|v10242]], [[10.0.0-27|v11265]]
|-
| 20001602
| [[New_3DS]] [[Camera Services|Camera]]
| [[8.1.0-0_New3DS|v8200]], [[9.0.0-20|v9218]], [[9.3.0-21|v10242]], [[10.0.0-27|v11265]]
|-
| 00001702
| [[Config Services|Config]] (cfg)
| [[1.0.0-0|v0]], [[2.0.0-2|v1024]], [[3.0.0-5|v2049]], v3072, [[4.0.0-7|v4096]], [[5.0.0-11|v5122]], [[6.0.0-11|v6145]], [[6.1.0-11|v7168]], [[7.0.0-13|v8196]], [[7.2.0-17|v9220]], [[8.0.0-18|v10243]], [[8.1.0-0_New3DS|v11265]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v12290]], [[9.3.0-21|v13315]], [[9.6.0-24|v14342]]
|-
| 00001703
| SAFE_MODE [[Config Services|Config]] (cfg)
| [[1.0.0-0|v0]]
|-
| 20001703
| [[New_3DS]] SAFE_MODE [[Config Services|Config]] (cfg)
| [[8.1.0-0_New3DS|v11265]]
|-
| 00001802
| [[Codec Services|Codec]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[5.0.0-11|v4098]], [[7.0.0-13|v5120]], [[8.0.0-18|v6144]], [[9.0.0-20|v7168]](Also for [[8.1.0-0_New3DS]])
|-
| 00001803
| SAFE_MODE [[Codec Services|Codec]]
| [[1.0.0-0|v0]]
|-
| 20001803
| [[New_3DS]] SAFE_MODE [[Codec Services|Codec]]
| [[8.1.0-0_New3DS|v7169]]
|-
| 00001902
| dmnt, debugger sysmodule. This use devunit-only HIO for devunit<>pc comms. This only exists for development units(launched by NS during startup depending on certain [[Configuration_Memory]] fields' values). This is installed at the [[Factory_Setup|factory]], then later deleted at the factory on retail units.
|
|-
| 00001A02
| [[DSP Services|DSP]]
| [[1.0.0-0|v0]], [[3.0.0-5|v1024]], [[4.0.0-7|v2048]], [[5.0.0-11|v3074]], [[6.0.0-11|v4096]], [[8.0.0-18|v5120]], [[9.7.0-25|v6145]], [[11.1.0-34|v7169]]
|-
| 00001A03
| SAFE_MODE [[DSP Services|DSP]]
| [[1.0.0-0|v0]]
|-
| 20001A03
| [[New_3DS]] SAFE_MODE [[DSP Services|DSP]]
| [[8.1.0-0_New3DS|v6145]]
|-
| 00001B02
| [[GPIO Services|GPIO]]
| [[1.0.0-0|v0]], [[5.0.0-11|v1025]], [[8.0.0-18|v2048]], [[9.5.0-22|v3073]]
|-
| 00001B03
| SAFE_MODE [[GPIO Services|GPIO]]
| [[1.0.0-0|v0]]
|-
| 20001B03
| [[New_3DS]] SAFE_MODE [[GPIO Services|GPIO]]
| [[8.1.0-0_New3DS|v3073]]
|-
| 00001C02
| [[GSP Services|GSP]]
| [[1.0.0-0|v0]], [[1.1.0-1|v1040]], [[2.0.0-2|v2049]], [[3.0.0-5|v3075]], v4098, [[4.0.0-7|v5120]], [[5.0.0-11|v6145]], [[6.0.0-11|v7168]], [[8.0.0-18|v8196]], [[9.0.0-20|v10240]], [[9.3.0-21|v11264]], [[9.6.0-24|v12294]]
|-
| 20001C02
| [[New_3DS]] [[GSP Services|GSP]]
| [[8.1.0-0_New3DS|v10243]], [[9.3.0-21|v11267]], [[9.6.0-24|v12294]]
|-
| 00001C03
| SAFE_MODE [[GSP Services|GSP]]
| [[1.0.0-0|v0]]
|-
| 20001C03
| [[New_3DS]] SAFE_MODE [[GSP Services|GSP]]
| [[8.1.0-0_New3DS|v9217]]
|-
| 00001D02
| [[HID Services|HID]] (Human Interface Devices)
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[5.0.0-11|v5121]], [[7.2.0-17|v6148]], [[8.0.0-18|v7168]], [[8.1.0-0_New3DS|v8192]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v9216]], [[9.3.0-21|v10240]]
|-
| 00001D03
| SAFE_MODE [[HID Services|HID]]
| [[1.0.0-0|v0]]
|-
| 20001D03
| [[New_3DS]] SAFE_MODE [[HID Services|HID]]
| [[8.1.0-0_New3DS|v8193]]
|-
| 00001E02
| [[I2C Services|i2c]]
| [[1.0.0-0|v0]], [[3.0.0-5|v1024]], [[5.0.0-11|v2049]], [[8.0.0-18|v3076]], [[9.3.0-21|v5120]]
|-
| 20001E02
| [[New_3DS]] [[I2C Services|i2c]]
| [[8.1.0-0_New3DS|v4096]], [[9.3.0-21|v5121]]
|-
| 00001E03
| SAFE_MODE [[I2C Services|i2c]]
| [[1.0.0-0|v0]]
|-
| 20001E03
| [[New_3DS]] SAFE_MODE [[I2C Services|i2c]]
| [[8.1.0-0_New3DS|v4097]]
|-
| 00001F02
| [[MCU Services|MCU]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.1.0-3|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4102]], [[5.0.0-11|v5122]], [[6.0.0-11|v6145]], [[7.0.0-13|v7168]], [[8.0.0-18|v8192]]
|-
| 20001F02
| [[New_3DS]] [[MCU Services|MCU]]
| [[8.1.0-0_New3DS|v8192]]
|-
| 00001F03
| SAFE_MODE [[MCU Services|MCU]]
| [[1.0.0-0|v0]]
|-
| 20001F03
| [[New_3DS]] SAFE_MODE [[MCU Services|MCU]]
| [[8.1.0-0_New3DS|v9217]]
|-
| 00002002
| [[MIC Services|MIC]] (Microphone)
| [[1.0.0-0|v0]], [[5.0.0-11|v1025]], [[8.0.0-18|v2048]]
|-
| 00002102
| [[PDN Services|PDN]]
| [[1.0.0-0|v0]], [[5.0.0-11|v1025]], [[8.0.0-18|v2048]]
|-
| 00002103
| SAFE_MODE [[PDN Services|PDN]]
| [[1.0.0-0|v0]]
|-
| 20002103
| [[New_3DS]] SAFE_MODE [[PDN Services|PDN]]
| [[8.1.0-0_New3DS|v3073]]
|-
| 00002202
| [[PTM Services|PTM]] (Play time, pedometer, and battery manager)
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.2.0-X|v2048]], [[3.0.0-5|v3075]], v4096, [[4.0.0-7|v5120]], [[5.0.0-11|v6146]], [[6.0.0-11|v7168]], [[7.0.0-13|v8192]], [[8.0.0-18|v9219]], [[9.6.0-24|v11264]]
|-
| 20002202
| [[New_3DS]] [[PTM Services|PTM]] (Play time, pedometer, and battery manager)
| [[8.1.0-0_New3DS|v10240]], [[9.6.0-24|v11264]]
|-
| 00002203
| SAFE_MODE [[PTM Services|PTM]]
| [[1.0.0-0|v0]]
|-
| 20002203
| [[New_3DS]] SAFE_MODE [[PTM Services|PTM]]
| [[8.1.0-0_New3DS|v10241]]
|-
| 00002302
| [[SPI Services|spi]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[5.0.0-11|v2049]], [[8.0.0-18|v3072]]
|-
| 20002302
| [[New_3DS]] [[SPI Services|spi]]
| [[8.1.0-0_New3DS|v4096]]
|-
| 00002303
| SAFE_MODE [[SPI Services|spi]]
| [[1.0.0-0|v0]]
|-
| 20002303
| [[New_3DS]] SAFE_MODE [[SPI Services|spi]]
| [[8.1.0-0_New3DS|v4097]]
|-
| 00002402
| [[AC Services|AC]] (Network manager)
| [[1.0.0-0|v0]], [[1.1.0-1|v1024]], [[2.0.0-2|v2052]], [[2.1.0-3|v3072]], [[3.0.0-5|v4101]], [[5.0.0-11|v5122]], [[7.0.0-13|v6145]], [[8.0.0-18|v7172]], [[9.0.0-20|v8192]](Also for [[8.1.0-0_New3DS]]), [[9.3.0-21|v9216]]
|-
| 00002403
| SAFE_MODE [[AC Services|AC]]
| [[1.0.0-0|v0]]
|-
| 20002403
| [[New_3DS]] SAFE_MODE [[AC Services|AC]]
| [[8.1.0-0_New3DS|v8193]]
|-
| 00002602
| [[CECD Services|Cecd]] (StreetPass)
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.2.0-X|v2048]], [[3.0.0-5|v3073]], [[4.0.0-7|v4097]], [[5.0.0-11|v5122]], [[6.0.0-11|v6144]], [[6.2.0-12|v7170]], [[7.0.0-13|v8193]], [[8.0.0-18|v9216]], [[9.0.0-20|v10240]]
|-
| 00002702
| [[CSND Services|CSND]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[4.0.0-7|v2048]], [[5.0.0-11|v3073]], [[8.0.0-18|v4096]], [[9.0.0-20|v5120]]
|-
| 00002703
| SAFE_MODE [[CSND Services|CSND]]
| [[1.0.0-0|v0]]
|-
| 20002703
| [[New_3DS]] SAFE_MODE [[CSND Services|CSND]]
| [[8.1.0-0_New3DS|v5121]]
|-
| 00002802
| [[DLP Services|DLP]] ([[Download Play]])
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.2.0-X|v2048]], [[3.0.0-5|v3078]], [[5.0.0-11|v4099]], [[8.0.0-18|v5123]], [[9.0.0-20|v6145]](Also for [[8.1.0-0_New3DS]]), [[9.6.0-24|v7174]], [[10.0.0-27|v8192]]
|-
| 00002902
| [[HTTP Services|HTTP]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.1.0-3|v2049]], [[2.2.0-X|v3072]], [[3.0.0-5|v4099]], [[4.0.0-7|v5122]], [[5.0.0-11|v6145]], [[7.0.0-13|v7171]], [[7.1.0-14|v8192]], [[8.0.0-18|v9220]], [[8.1.0-18|v10245]], [[8.1.0-0_New3DS|v11264]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v12288]], [[9.6.0-24|v13318]]
|-
| 00002903
| SAFE_MODE [[HTTP Services|HTTP]]
| [[1.0.0-0|v0]]
|-
| 20002903
| [[New_3DS]] SAFE_MODE [[HTTP Services|HTTP]]
| [[8.1.0-0_New3DS|v10241]]
|-
| 00002A02
| [[MP Services|MP]]
| [[1.0.0-0|v0]], [[5.0.0-11|v1025]], [[8.0.0-18|v2048]]
|-
| 00002A03
| SAFE_MODE [[MP Services|MP]]
| [[1.0.0-0|v0]]
|-
| 00002B02
| [[NDM Services|NDM]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[3.0.0-5|v2049]], [[4.0.0-7|v3072]], [[5.0.0-11|v4098]], [[8.0.0-18|v5124]], [[8.1.0-0_New3DS|v6144]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v7169]]
|-
| 00002C02
| [[NIM Services|NIM]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1028]], [[3.0.0-5|v2055]], [[4.0.0-7|v3074]], [[5.0.0-11|v4100]], [[6.0.0-11|v5120]], [[7.0.0-13|v6148]], [[7.2.0-17|v7174]], [[8.0.0-18|v8195]], [[8.1.0-0_New3DS|v9217]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v10249]], [[9.3.0-21|v11267]], [[9.6.0-24|v12296]], [[10.0.0-27|v13313]]
|-
| 00002C03
| SAFE_MODE [[NIM Services|NIM]]
| [[1.0.0-0|v0]]
|-
| 20002C03
| [[New_3DS]] SAFE_MODE [[NIM Services|NIM]]
| [[8.1.0-0_New3DS|v9217]]
|-
| 00002D02
| [[NWM Services|NWM]] ( Low-level wifi manager )
| [[1.0.0-0|v0]], [[1.1.0-1|v1024]], [[2.0.0-2|v2052]], [[2.2.0-X|v3072]], [[3.0.0-5|v4101]], [[4.0.0-7|v5120]], [[5.0.0-11|v6148]], [[6.0.0-11|v7169]], [[7.2.0-17|v8196]], [[8.0.0-18|v9216]], [[9.0.0-20|v10240]]
|-
| 00002D03
| SAFE_MODE [[NWM Services|NWM]]
| [[1.0.0-0|v0]], [[6.0.0-11|v5120]]
|-
| 20002D03
| [[New_3DS]] SAFE_MODE [[NWM Services|NWM]]
| [[8.1.0-0_New3DS|v10241]]
|-
| 00002E02
| [[Socket Services|Sockets]]
| [[1.0.0-0|v0]], [[1.1.0-1|v1024]], [[2.0.0-2|v2053]], [[3.0.0-5|v3075]], [[4.0.0-7|v4096]], [[5.0.0-11|v5121]], [[8.0.0-18|v6144]], [[9.0.0-20|v7168]], [[10.6.0-31|v8192]]
|-
| 00002E03
| SAFE_MODE [[Socket Services|Sockets]]
| [[1.0.0-0|v0]]
|-
| 20002E03
| [[New_3DS]] SAFE_MODE [[Socket Services|Sockets]]
| [[8.1.0-0_New3DS|v7169]]
|-
| 00002F02
| [[SSL Services|SSL]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1024]], [[2.1.0-3|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[5.0.0-11|v5122]], [[8.0.0-18|v6144]], [[9.0.0-20|v7168]], [[9.6.0-24|v8198]]
|-
| 00002F03
| SAFE_MODE [[SSL Services|SSL]]
| [[1.0.0-0|v0]]
|-
| 20002F03
| [[New_3DS]] SAFE_MODE [[SSL Services|SSL]]
| [[8.1.0-0_New3DS|v7169]]
|-
| 00003000
| [[FIRM|Process9]] (in SAFE_MODE and normal NATIVE_FIRM)
| N/A
|-
| 00003102
| [[Process Services‎|PS]] ( Process Manager )
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[5.0.0-11|v2049]], [[6.0.0-11|v3072]], [[8.0.0-18|v4096]], [[9.0.0-20|v5120]]
|-
| 00003103
| SAFE_MODE [[Process Services‎|PS]]
| [[1.0.0-0|v0]]
|-
| 20003103
| [[New_3DS]] SAFE_MODE [[Process Services‎|PS]]
| [[8.1.0-0_New3DS|v5121]]
|-
| 00003202
| [[Friend Services‎|friends]] (Friends list)
| [[1.0.0-0|v0]], [[2.0.0-2|v1028]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[5.0.0-11|v5122]], [[7.0.0-13|v6145]], [[8.0.0-18|v7172]], [[9.0.0-20|v8192]](Also for [[8.1.0-0_New3DS]]), [[10.5.0-30|v9216]], [[10.7.0-32|v10240]], [[11.0.0-33|v11264]], [[11.1.0-34|v12288]]
|-
| 00003203
| SAFE_MODE [[Friend Services‎|friends]] (Friends list)
| [[1.0.0-0|v0]]
|-
| 20003203
| [[New_3DS]] SAFE_MODE [[Friend Services‎|friends]] (Friends list)
| [[8.1.0-0_New3DS|v8193]]
|-
| 00003302
| [[IR Services‎|IR]] (Infrared)
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[5.0.0-11|v5121]], [[8.0.0-18|v6148]], [[8.1.0-0_New3DS|v7170]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v8192]], [[9.3.0-21|v9216]], [[9.6.0-24|v10246]], [[10.0.0-27|v11265]], [[10.6.0-31|v12289]]
|-
| 00003303
| SAFE_MODE [[IR Services‎|IR]]
| [[1.0.0-0|v0]]
|-
| 20003303
| [[New_3DS]] SAFE_MODE [[IR Services‎|IR]]
| [[8.1.0-0_New3DS|v7169]]
|-
| 00003402
| [[BOSS Services‎|BOSS]] (SpotPass)
| [[1.0.0-0|v0]], [[1.1.0-1|v1024]], [[2.0.0-2|v2053]], [[2.2.0-X|v3073]], [[3.0.0-5|v4101]], [[4.0.0-7|v5122]], [[5.0.0-11|v6146]], [[6.0.0-11|v7169]], [[6.2.0-12|v8193]], [[7.0.0-13|v9222]], [[8.0.0-18|v10240]], [[9.0.0-20|v11266]], [[10.0.0-27|v12289]], [[10.4.0-29|v13314]]
|-
| 00003502
| [[News Services‎|News]] (Notifications)
| [[1.0.0-0|v0]], [[2.0.0-2|v1028]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[5.0.0-11|v4097]], [[8.0.0-18|v5120]], [[9.0.0-20|v6147]], [[9.7.0-25|v7168]]
|-
| 00003602
| "debugger". This only exist for development units(launched by NS during startup depending on certain [[Configuration_Memory]] fields' values).
|
|-
| 00003702
| [[RO_Services|RO]]
| [[2.0.0-2|v0]], [[4.0.0-7|v1024]], [[5.0.0-11|v2049]], [[7.2.0-17|v3074]], [[8.0.0-18|v4096]], [[9.0.0-20|v5120]](Also for [[8.1.0-0_New3DS]]), [[9.3.0-21|v6148]]
|-
| 00003802
| [[ACT Services‎|act]] (handles Nintendo Network '''a'''c'''c'''oun'''t'''s)
| [[7.0.0-13|v1029]], [[7.1.0-14|v2050]], [[7.2.0-17|v3077]], [[8.0.0-18|v4099]], [[8.1.0-0_New3DS|v5120]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v6144]], [[9.3.0-21|v7168]], [[9.6.0-24|v8198]]
|-
| 00004002
| Old3DS [[NFC_Services|nfc]]
| [[9.3.0-21|v2053]], [[9.6.0-24|v4106]], [[9.7.0-25|v5121]], [[10.0.0-27|v6145]], [[10.6.0-31|v7168]], [[10.7.0-32|v8192]]
|-
| 20004002
| [[New_3DS]] [[NFC_Services|nfc]]
| [[8.1.0-0_New3DS|v0]], [[9.0.0-20|v1024]], [[9.3.0-21|v2053]], [[9.5.0-22|v3073]], [[9.6.0-24|v4102]], [[10.0.0-27|v6145]], [[10.6.0-31|v7168]]
|-
| 20004102
| [[New_3DS]] [[MVD Services|mvd]]
| [[8.1.0-0_New3DS|v0]], [[9.0.0-20|v1024]]
|-
| 20004202
| [[New_3DS]] [[QTM Services|qtm]]
| [[8.1.0-0_New3DS|v8]], [[9.0.0-20|v1024]], [[9.3.0-21|v2052]]
|-
| 00008002
| [[NS]] (Memory-region: "SYSTEM")
| [[1.0.0-0|v0]], [[2.0.0-2|v1028]], [[2.2.0-X|v2048]], [[3.0.0-5|v3077]], v4096, [[4.0.0-7|v5121]], [[5.0.0-11|v6148]], [[5.1.0-11|v7168]], [[6.0.0-11|v8193]], [[6.1.0-11|v9216]], [[7.0.0-13|v10248]], [[7.2.0-17|v11268]], [[8.0.0-18|v12291]], [[8.1.0-0_New3DS|v13312]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v14336]], [[9.3.0-21|v15360]], [[9.6.0-24|v16390]], [[9.8.0-25|v17408]], [[10.0.0-27|v18433]], [[10.4.0-29|v19458]], [[11.1.0-34|v20482]]
|-
| 00008003
| SAFE_MODE [[NS]] (Memory-region: "SYSTEM")
| [[1.0.0-0|v0]]
|-
| 20008003
| [[New_3DS]] SAFE_MODE [[NS]] (Memory-region: "SYSTEM")
| [[8.1.0-0_New3DS|v13313]]
|}

Once Home Menu finishes loading, all of the above system modules are running, except for MP, RO, and act which are automatically [[Process_Manager_Services|loaded]] when a process requires them. When [[Process_Manager_Services|PM]]-module terminates processes, it will check whether the processes listed as dependencies for this process are listed as dependencies for other processes. Any processes which are no longer listed in any processes dependencies lists are then terminated. On [[New_3DS]], the only New3DS-specific system-module which automatically gets loaded during system boot is qtm.

All of the above system modules use the "BASE" [[SVC|memory-region]](specified in the exheader), except when listed otherwise for certain modules.

When handling the exheader dependency list starting with [[8.0.0-18]], Old3DS FIRM [[Process_Manager_Services|PM]]-module now skips handling titles in this list which have any bits in programID-low bitmask 0xF0000000 set(with [[8.0.0-18]] this is hard-coded). The exheader dependency list handling change is for the [[New 3DS]] system-module(s), which do not exist on Old3DS. When the New3DS pm-module is launching any title except [[NS]], it first attempts to launch the title with programID-low bitmask 0x20000000 set, then with that bitmask clear if launching fails.

=== 00040138 - [[FIRM|System Firmware]] ===
NATIVE_FIRM and SAFE_MODE_FIRM for the initial versions are exactly the same, besides [[Configuration_Memory|core-version]] fields. SAFE_MODE_FIRM is used for running SAFE_MODE titles, on retail SAFE_MODE_FIRM seems to be only used for running the [[System_Settings#System_Updater|System Updater]] application. When a GBA VC title is launched, AGB_FIRM is launched to handle running this title. GBA VC savegames stored under SD card /title/<TID>/data use a custom format, this is handled by AGB_FIRM.

{| class="wikitable" border="1"
|-
! TitleID Low
! Description
! USA/EUR/JPN Versions
! CHN Versions
! KOR Versions
! TWN Versions
|-
| 00000001
| Unknown, very similar to SAFE_MODE_FIRM. Exists only on dev units and seems to only be used by SystemUpdaters.
| v0
|
|
|
|-
| 00000002
| NATIVE_FIRM (Native Firmware)
| [[1.0.0-0|v432]], [[1.1.0-1|v1472]], [[2.0.0-2|v2516]], [[2.1.0-3|v3553]], [[2.2.0-X|v4595]], [[3.0.0-5|v5647]], [[4.0.0-7|v6677]], [[4.1.0-8|v7712]], [[5.0.0-11|v8758]], [[5.1.0-11|v9792]], [[6.0.0-11|v10833]], [[6.1.0-11|v11872]], [[7.0.0-13|v12916]], [[7.2.0-17|v13956]], v15043, [[8.0.0-18|v15047]], [[9.0.0-20|v17120]], [[9.3.0-21|v18182]], [[9.5.0-22|v19216]], [[9.6.0-24|v20262]], [[10.0.0-27|v21288]], [[10.2.0-28|v22313]], [[10.4.0-29|v23341]], [[11.0.0-33|v24368]], [[11.1.0-34|v25396]]
| Same as USA/EUR/JPN starting with the USA/EUR/JPN [[4.0.0-7]] title-version
| Same as CHN.
| Same as CHN.
|-
| 20000002
| [[New_3DS]] NATIVE_FIRM (Native Firmware)
| [[8.1.0-0_New3DS|v16085]], [[9.0.0-20|v17120]], [[9.3.0-21|v18182]], [[9.5.0-22|v19218]], [[9.6.0-24|v20262]], [[10.0.0-27|v21288]], [[10.2.0-28|v22313]], [[10.4.0-29|v23341]], [[11.0.0-33|v24368]], [[11.1.0-34|v25396]]
| N/A
| Same as CHN.
| Same as CHN.
|-
| 00000003
| SAFE_MODE_FIRM
| [[1.0.0-0|v432]], [[3.0.0-5|v5632]]
| Same as USA/EUR/JPN starting with the USA/EUR/JPN [[3.0.0-5]] title-version
| Same as CHN.
| Same as CHN.
|-
| 20000003
| [[New_3DS]] SAFE_MODE_FIRM
| [[8.1.0-0_New3DS|v16081]]
| N/A
| Same as CHN.
| Same as CHN.
|-
| 00000102
| TWL_FIRM ( DSi Firmware )
| [[1.0.0-0|v432]], [[2.0.0-2|v1489]], [[3.0.0-5|v2565]], v3601, [[4.0.0-7|v4625]], [[4.4.0-10|v5681]], [[4.5.0-10|v6704]], [[6.0.0-11|v7762]], [[6.2.0-12|v8817]]
| Same as USA/EUR/JPN starting with the USA/EUR/JPN [[4.0.0-7]] title-version
| Same as CHN.
| Same as CHN.
|-
| 20000102
| [[New_3DS]] TWL_FIRM ( DSi Firmware )
| [[8.1.0-0_New3DS|v9936]]
| N/A
| Same as CHN.
| Same as CHN.
|-
| 00000202
| AGB_FIRM ( GBA Firmware )
| [[3.0.0-5|v519]], v1553, [[4.0.0-7|v2576]], [[6.0.0-11|v3665]]
| [[4.0.0-7|v2576]]
| [[4.0.0-7|v2576]], [[6.0.0-11|v3665]]
| Same as CHN.
|-
| 20000202
| [[New_3DS]] AGB_FIRM ( GBA Firmware )
| [[8.1.0-0_New3DS|v4816]]
| N/A
| N/A
| N/A
|}

== Application Titles ==
{| class="wikitable" border="1"
|-
! Content Category
! Bit Mask(s)
! Category Bit Mask
|-
| [[Title list/eShop Titles|Application]] (eShop Title)
| Normal
| 0x0000
|-
| DLP Child
| DlpChild
| 0x0001
|-
| [[EShop Demos|Demo]]
| Demo
| 0x0002
|-
| [[Title list/Patches|Patch]]
| CannotExecution<nowiki>|</nowiki>Patch
| 0x000E
|-
| [[Title list/DLC|Add-on Content]] (DLC)
| NotRequireRightForMount<nowiki>|</nowiki>CannotExecution<nowiki>|</nowiki>AddOnContents
| 0x008C
|}

=== 00040001 - [[Download Play]] Titles ===
This titleID-high/programID-high is used for the titles sent over [[Download Play]]. Only one 00040001 Download Play title is installed to NAND /title at a time. There can be a maximum of 255 Download Play child titles per Unique ID, indexed by Title ID Variation. The legal index range: 0x0 - 0xff.

== TWL (DSi) Titles ==

{| class="wikitable" border="1"
|-
! Content Category
! Bit Mask(s)
! Category Bit Mask
|-
| Application (DSiWare)
| TWL<nowiki>|</nowiki>0x4
| 0x8004
|-
| System Application
| TWL<nowiki>|</nowiki>0x1<nowiki>|</nowiki>0x4
| 0x8005
|-
| System Archive
| TWL<nowiki>|</nowiki>0x1<nowiki>|</nowiki>0x2<nowiki>|</nowiki>0x4<nowiki>|</nowiki>0x8
| 0x800F
|-
| Developer Tool
| TWL<nowiki>|</nowiki>0x1<nowiki>|</nowiki>0x4<nowiki>|</nowiki>0x10
| 0x8015
|}

Bitmask 0x1 for TWL titles denotes a system title (determining whether the title will be updated during a System Update). It appears to be sufficient, but not necessary, to make the title invisible on the [[Home Menu]].

Bitmask 0x2 for TWL titles may indicate no-execute.

Bitmask 0x4 for TWL titles indicates internal storage.

Bitmask 0x10 for TWL titles is found on developer tools.

=== 00048005 - System Applications===
{| class="wikitable" border="1"
|-
! TitleID Low
! Region
! Description
! Versions
! Information
|-
| 42383841(B88A)
| ALL
| [[DS Internet]]
| v0, [[2.1.0-4|v1025]], [[3.0.0-5|v2048]]
| [[DS Internet]] is the DS-mode application, (also integrated in every online-enabled DS game) and now accessible through [[System Settings]] for configuring network settings for DS software.
|-
| 484E4441(HNDA)
| ALL
| [[Download Play]]
| v1024
| This [[Download Play]] application is the DS-mode Download Play client, launched by the 3DS-mode Download Play application.
|-
| 484E4443(HNDC)
| CHN
| [[Download Play]]
| v1024
| See Above Description.
|-
| 484E444B(HNDK)
| KOR
| [[Download Play]]
| v1024
| See Above Description.
|}

=== 0004800F - System Data Archives===
{| class="wikitable" border="1"
|-
! TitleID Low
! Description
! Versions
|-
| 484E4841(HNHA)
| [[Nintendo DS Cart Whitelist]]
| v0, [[2.0.0-2|v1026]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[4.2.0-9|v5120]], [[4.3.0-10|v6145]], [[4.4.0-10|v7168]], [[4.5.0-10|v8192]], [[5.0.0-11|v9216]], [[6.0.0-11|v10240]], [[7.0.0-13|v11264]]
|-
| 484E4C41(HNLA)
| [[Version Data]]
| v0
|}

New system updates only block DS flash-cards when the above whitelist was updated, or when TWL_FIRM was updated. The whitelist contains the data used for detecting flash-cards, this is used by TWL_FIRM.

=== 00048004 - DSiWare ===
Although these have a titleID high separate from DSi and a titleID is stored in the SRLs, the content of these SRLs are identical to DSi.

{| class="wikitable" border="1"
|-
! TitleID Low
! Region
! Description
! Versions
|-
| 4B4B5456(KKTV)
| EUR
| Cut the Rope
| v0, v64
|-
| 4B4E5256(KNRV)
| EUR
| A Little Bit of... Brain Training™: Maths Edition
| v0
|-
| 4B5A4C56(KZLV)
| EUR
| Plants vs. Zombies™
| v0
|-
| 4B454256(KEBV)
| EUR
| ELECTROPLANKTON (Hanenbow)
| v0
|-
| 4B513956(KQ9V)
| EUR
| Zelda: Four Swords Anniversary Edition
| v16
|-
| 4B574256(KWBV)
| EUR
| Mario Calculator
| v0
|-
| 4B574656(KWFV)
| EUR
| Mario Clock
| v0
|}

SPI Services

2016-09-25T12:12:54Z

Dazzozo: Undo revision 18279 by Neobrain (talk)

[[Category:Services]]
= SPI Service Names =
* "SPI::NOR" (used by cfg:NOR)
* "SPI::CD2" (used by [[Codec Services]])
* "SPI::CS2"
* "SPI::CS3"
* "SPI::DEF"

= SPI Service Commands =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x0001....
| SetDeviceState(u8 deviceid, u8 state)
|-
| 0x0002....
| Stubbed, only returns zero.
|-
| 0x0003....
| ReadWriteDevice(u8 deviceid, ...)
|-
| 0x0004....
| ReadWriteDevice2(u8 deviceid, ...)
|-
| 0x0005....
| WriteDevice(u8 deviceid, ...)
|-
| 0x00060102
| ReadWriteDeviceArray(u8 deviceid, ...)
|-
| 0x00070102
| ReadWriteDevice2Array(u8 deviceid, ...)
|-
| 0x000800C0
| EnableSpiBus(u8 deviceid, bool onoff, u8 state)
|-
| 0x00090040
| EnableTwlSpiBus?(bool onoff)
|}

0,1,2: 0x1EC60800
3,4,5: 0x1EC42800
6: 0x1EC43800

Services API

2016-09-25T12:12:46Z

Dazzozo: Undo revision 18278 by Neobrain (talk)

Nintendo provides application developers with an API, which communicate with certain services. Services, in this sense, are [[Title_list#00040130_-_System_Modules|system processes running in the background]] which wait for incoming requests. When a process wants to communicate with a service, it first needs to get a handle to the named service, and then it can communicate with the service via interprocess communication. Each service has a name up to 8 characters, for example "nim:u".

Handles for services are retrieved from the [[Services|service manager port]], "srv:". Services are an abstraction of ports, they operate the same way except regular ports can have their handles retrieved directly from a SVC.

For a description of how commands and arguments are passed to services, see [[IPC Command Structure]].

List of services (grouped by the process which provides them):
{| class="wikitable" border="1"
|-
! Old3ds
! Services
! Service names
! scope="col" width="200" | Notes
|-
| style="background: green" | Yes
| [[Filesystem services‎]]
| fs:USER, fs:LDR, fs:REG
|
|-
| style="background: green" | Yes
| [[Process Services‎]]
| ps:ps
|
|-
| style="background: green" | Yes
| [[PXI Services‎]]
| PxiFS0, PxiFS1, PxiFSB, PxiFSR, PxiPM, pxi:am9, pxi:dev, pxi:mc, pxi:ps9
|
|-
| style="background: green" | Yes
| [[Application Manager Services]]
| am:app, am:net, am:u, am:sys, am:pipe
|
|-
| style="background: green" | Yes
| [[Process Manager Services]]
| pm:app, pm:dbg
|
|-
| style="background: green" | Yes
| [[NIM Services]]
| nim:aoc, nim:ndm, nim:s, nim:u
|
|-
| style="background: green" | Yes
| [[Config Services]]
| cfg:u, cfg:s, cfg:i, cfg:nor
|
|-
| style="background: green" | Yes
| [[NS|NS and APT Services]]
| ns:s, ns:p, ns:c, APT:A, APT:S, APT:U
|
|-
| style="background: green" | Yes
| [[RO Services]]
| ldr:ro
|
|-
| style="background: green" | Yes
| [[NDM Services]]
| ndm:u
|
|-
| style="background: green" | Yes
| [[CSND Services]]
| csnd:SND
|
|-
| style="background: green" | Yes
| [[Camera Services]]
| cam:u, y2r:u, cam:s, cam:c, cam:q (New3DS only)
|
|-
| style="background: green" | Yes
| [[Codec Services]]
| cdc:HID, cdc:MIC, cdc:CSN, cdc:DSP, cdc:LGY, cdc:CHK
|
|-
| style="background: green" | Yes
| [[DLP Services]]
| dlp:CLNT, dlp:FKCL, dlp:SRVR
|
|-
| style="background: green" | Yes
| [[DSP Services]]
| dsp::DSP
|
|-
| style="background: green" | Yes
| [[GSP Services]]
| gsp::Lcd, gsp::Gpu
|
|-
| style="background: green" | Yes
| [[BOSS Services]]
| boss:U
|
|-
| style="background: green" | Yes
| [[CECD Services]]
| cecd:u, cecd:s, cecd:ndm
|
|-
| style="background: green" | Yes
| [[IR Services]]
|
|
|-
| style="background: green" | Yes
| [[I2C Services]]
| i2c::MCU, i2c::CAM, i2c::LCD, i2c::DEB, i2c::HID, i2c::IR, i2c::EEP, i2c::NFC, i2c::QTM
|
|-
| style="background: green" | Yes
| [[GPIO Services]]
| gpio:CDC, gpio:MCU, gpio:HID, gpio:NWM, gpio:IR, gpio:NFC, gpio:QTM
|
|-
| style="background: green" | Yes
| [[HID Services]]
| hid:NFC, hid:QTM, hid:SPVR, hid:USER
|
|-
| style="background: green" | Yes
| [[PTM Services]]
| ptm:gets, ptm:play, ptm:s, ptm:sets, ptm:sysm, ptm:u
|
|-
| style="background: green" | Yes
| [[NWM Services]]
| nwm::UDS
|
|-
| style="background: green" | Yes
| [[HTTP Services]]
| http:C
|
|-
| style="background: green" | Yes
| [[SSL Services]]
| ssl:C
|
|-
| style="background: green" | Yes
| [[Socket Services]]
| soc:P, soc:U
|
|-
| style="background: green" | Yes
| [[AC Services]]
| ac:i, ac:u
|
|-
| style="background: green" | Yes
| [[Friend Services]]
| frd:a, frd:u, frd:n
|
|-
| style="background: green" | Yes
| [[News Services]]
|
|
|-
| style="background: green" | Yes
| [[PDN Services]]
| pdn:s, pdn:d, pdn:i, pdn:g, pdn:c
|
|-
| style="background: green" | Yes
| [[SPI Services]]
| SPI::NOR, SPI::CD2, SPI::CS2, SPI::CS3, SPI::DEF
|
|-
| style="background: green" | Yes
| [[Loader Services]]
| Loader
|
|-
| style="background: green" | Yes
| [[MCU Services]]
| mcu::CAM, mcu::GPU, mcu::HID, mcu::RTC, mcu::SND, mcu::NWM, mcu::HWC, mcu::PLS, mcu::CDC
|
|-
| style="background: green" | Yes
| [[MIC Services]]
| mic:u
|
|-
| style="background: green" | Yes
| [[ACT Services]]
| act:a, act:u
|
|-
| style="background: green" | Yes
| [[NFC Services]]
|
|
|-
| style="background: red" | No
| [[MVD Services]]
|
|
|-
| style="background: red" | No
| [[QTM Services]]
|
|
|}

List of PXI services:
* [[Filesystem services PXI]]
* [[Process Services PXI]]
* [[Application Manager Services PXI]]
* [[Process Manager Services PXI]]
* [[Development Services PXI]]
* [[Gamecard Services PXI]]
* [[Legacy FIRM PXI]] (TWL_FIRM/AGB_FIRM)

List of ports:
* [[ErrDisp]]
* [[Services]]

See [[Error codes]].

CDC Services

2016-09-25T12:12:33Z

Dazzozo: Dazzozo moved page CDC Services to Codec Services over redirect: maybe actually look at it first before you make that judgement

#REDIRECT [[Codec Services]]

Codec Services

2016-09-25T12:12:33Z

Dazzozo: Dazzozo moved page CDC Services to Codec Services over redirect: maybe actually look at it first before you make that judgement

=HID Codec "cdc:HID"=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010000
| [[Cdc:HID:GetData|GetData]]
|-
| 0x00020000
| Initialize
|-
| 0x00030000
| Finalize
|}

== Touchscreen ==
The touchscreen is the SPI [[SPI_Registers#SPI_NEW_CNT|device number 3]], so it uses the [[SPI_Services|0x10142XXX]] SPI registers. It is initialized by issuing the following SPI commands:
spi_select_reg(3, 0x67);
spi_offset_mask(3, 0x26, 0x80, 0x80);
spi_select_reg(3, 0x67);
spi_offset_mask(3, 0x24, 0, 0x80);
spi_select_reg(3, 0x67);
spi_offset_mask(3, 0x25, 0x10, 0x3C);

Once the touchscreen is initialized, you can start polling touch data:
u8 raw_touchdata[0x40];
spi_select_reg(3, 0x67);
spi_read_offset(3, 0x26); //The return value of this is checked against "& 2"
spi_select_reg(3, 0xFB);
spi_read_offset_array(3, 1, raw_touchdata, 0x34);

This is the format of the touchdata report:
{| class="wikitable" border="1"
|-
! Offset
! Width
! Description
|-
| 0x00
| 2*5
| Five Touchscreen X Coordinates (big-endian MSB,LSB each. 12 bits number)
|-
| 0x0A
| 2*5
| Five Touchscreen Y Coordinates (big-endian MSB,LSB each. 12 bits number)
|-
| 0x20
| ??
| ??
|}

When the touchscreen is not touched, all the coordinates report 0xFFFF, and since touch coordinates have only 12 bits, you can check if the touchscreen is pressed by checking the 4th bit of the MSB. For example: pendown = !(raw_touchdata[0] & BIT(4))

=MIC Codec "cdc:MIC"=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|}

=CSN Codec "cdc:CSN"=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|}

=DSP Codec "cdc:DSP"=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|}

=Legacy Codec "cdc:LGY"=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|}

=CHK Codec "cdc:CHK"=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|}

CVer

2016-09-08T14:23:26Z

Dazzozo: /* masterkey.bin */

This [[NCCH#CFA|CFA]] contains the files listed below in the RomFS.

=== cup_list ===
{| class="wikitable" border="1"
! Offset
! Size
! Description
|-
| 0x0
| 0x800
| TitleID list of system titles
|}
Unused TitleID entries are all-zero, therefore the total number of entries can be determined by finding the first all-zero entry. This list does not contain *all* system titles, though most are contained in this list.

This file was removed from the CDN CVer RomFS, starting with [[8.0.0-18]].

=== version.bin ===
This 8-byte file contains most of the data used for displaying the system version in [[System Settings]]. Format of the system version: "<major>.<minor>.<build>-[[NVer|<revision><region>]]".

{| class="wikitable" border="1"
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| Build version number
|-
| 0x1
| 0x1
| Minor version number
|-
| 0x2
| 0x1
| Major version number
|-
| 0x3
| 0x1
| Reserved
|-
| 0x4
| 0x1
| ASCII character for the system version region
|-
| 0x5
| 0x3
| Reserved
|}

=== masterkey.bin ===
This 0x40-byte file was added with [[7.2.0-17]]. This is used by [[System Settings#Parental Controls Reset|System Settings]].

{| class="wikitable" border="1"
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| First u8 is region, next u8 is version, the rest is all-zero. v7.2 USA = 0xa01, v8.0 USA = 0xb01, v8.0 EUR = 0xb02.
|-
| 0x4
| 0xC
| All-zero
|-
| 0x10
| 0x10
| AES counter value
|-
| 0x20
| 0x20
| Encrypted HMAC key, decrypted using AES-128-CTR using a key from mset .rodata and the above counter value.
|}

=== titleversion.txt ===
Added with [[9.6.0-24|9.6.0-X]]. With [[9.6.0-24|9.6.0-X]], this is a 5-byte file containing the following: "9.6.7". This is the parsed version of the CVer TMD title-version. After USA [[9.6.0-24|9.6.0-X]] for <=v11.0, this matches the version from CVer version.bin.

System Settings

2016-09-08T14:19:42Z

Dazzozo: Master key v1 and v2, see also https://github.com/Dazzozo/mkey

'''System Settings''' allows you to manage various settings, use [[System Transfer]], and use Data Management.

All applications(CTR/TWL) launched by System Settings are launched via [[NS|APT:PrepareToDoApplicationJump/APT:DoApplicationJump]], such as DS INTERNET and [[System Transfer]].

== Accessible services ==

{| class="wikitable" border="1"
|-
! Service
! Last seen on version
|-
| [[Filesystem_services#Filesystem_service_.22fs:USER.22|fs:USER]]
| [[9.0.0-20|v8202]]
|-
| [[GSP_Services|gsp:Gpu]]
| [[9.0.0-20|v8202]]
|-
| [[NDM_Services|ndm:u]]
| [[9.0.0-20|v8202]]
|-
| [[NS#.22APT:A.22_Service|APT:A]]
| [[9.0.0-20|v8202]]
|-
| [[AC_Services|ac:i]]
| [[9.0.0-20|v8202]]
|-
| [[ACT_Services|act:a]]
| [[9.0.0-20|v8202]]
|-
| [[Application_Manager_Services#Application_Manager_services|am:sys]]
| [[9.0.0-20|v8202]]
|-
| [[BOSS_Services|boss:P]]
| [[9.0.0-20|v8202]]
|-
| [[Camera_Services#cam:s_.28PORT_CAL.29|cam:s]]
| [[9.0.0-20|v8202]]
|-
| [[CECD_Services|cecd:s]]
| [[9.0.0-20|v8202]]
|-
| [[Config_Services#Config_NVRAM_service_.22cfg:nor.22|cfg:nor]]
| [[9.0.0-20|v8202]]
|-
| [[DSP_Services|dsp::DSP]]
| [[9.0.0-20|v8202]]
|-
| [[Friend_Services|frd:a]]
| [[9.0.0-20|v8202]]
|-
| [[GSP_Services|gsp::Lcd]]
| [[9.0.0-20|v8202]]
|-
| [[HTTP_Services|http:C]]
| [[9.0.0-20|v8202]]
|-
| [[MIC_Services|mic:u]]
| [[9.0.0-20|v8202]]
|-
| [[News_Services#News_service_.22news:s.22|news:s]]
| [[9.0.0-20|v8202]]
|-
| [[NIM_Services#NIM_user_service_.22nim:u.22|nim:u]]
| [[9.0.0-20|v8202]]
|-
| [[NS#NS_Service_.22ns:s.22|ns:s]]
| [[9.0.0-20|v8202]]
|-
| [[NWM_Services#NWM_service_.22nwm::EXT.22|nwm::EXT]]
| [[9.0.0-20|v8202]]
|-
| [[NWM_Services#NWM_infrastructure_service_.22nwm::INF.22|nwm::INF]]
| [[9.0.0-20|v8202]]
|-
| [[NWM_Services#NWM_socket_service_.22nwm::SOC.22|nwm::SOC]]
| [[9.0.0-20|v8202]]
|-
| [[PTM_Services#GetSystemTime_PTM_Service_.22ptm:gets.22|ptm:gets]]
| [[9.0.0-20|v8202]]
|-
| [[PTM_Services#SysMenu_PTM_Service_.22ptm:sysm.22|ptm:sysm]]
| [[9.0.0-20|v8202]]
|-
| [[Socket_Services#Socket_privileged_service_.22soc:P.22|soc:P]]
| [[9.0.0-20|v8202]]
|-
| [[Socket_Services#Socket_user_service_.22soc:U.22|soc:U]]
| [[9.0.0-20|v8202]]
|-
| [[SSL_Services|ssl:C]]
| [[9.0.0-20|v8202]]
|-
| [[Camera_Services#y2r:u|y2r:u]]
| [[9.0.0-20|v8202]]
|-
| [[QTM_Services#QTM_system_service_.22qtm:s.22|qtm:s]]
| [[9.0.0-20|v8202]]
|-
| [[Config_Services#Config_service_.22cfg:i.22|cfg:i]]
| [[9.0.0-20|v8202]]
|-
| [[HID_Services#HID_service_.22hid:SPVR.22|hid:SPVR]]
| [[9.0.0-20|v8202]]
|}

== Data Management ==

=== 3DS ===

Here you can manage 3DS extra data, and 3DSWare/"Software".

When managing 3DS Software installed to the SD Card, the [[Title Database|title.db]] is read by the core receiving [[Application Manager Services PXI|AM]] commands. From the title.db file, AM gets a list of installed titles, title sizes and the name of the ".cmd" file for each title, which is used to check the authenticity of the title data(product code, title version, and if an electronic manaual is used, is also kept for each title, in the title.db, but won't be used by the Data Management Utility). For each title listed, it checks if the title is authentic(via the .cmd file). If the title passes authentication, Data Management decrypts/reads the ICN data from the executable NCCH([[CXI]]) and displays it along with the archived title size. If a title doesn't pass authentication, a placeholder icon(light grey with a '?' in the center), name ('????????') and a size of zero are used. Deleting titles removes the title data from the title.db and import.db, and deletes the directory of the content.

=== DSiWare ===

See [[DSiWare Exports]].

== System Format ==
Most of the System Format is done with [[FS:InitializeCtrFileSystem]]. This command updates the high u64 of the keyY stored in [[Nand/private/movable.sed|movable.sed]]. Since this keyY was updated, the data stored on [[SD_Filesystem|SD]] card(sdmc/Nintendo 3DS/<ID0>/<ID1>) and the data under [[Flash_Filesystem|nand/data/<ID0>]] is rendered useless, since that data used the old keyY. Since that data is no longer usable, the system then deletes the two above SD/NAND directories.

When you first enter the System Format menu, it will check if a NNID is linked. If there's a linked-NNID, it will then display: "Are you ready to connect to the Internet to check whether data can be formatted"? Continuing will only result in connecting to wifi for checking in with Nintendo's servers, which may fail if the console is banned. Once that's done it will continue with the usual system-format messages; proceeding will result in the NNID cookie, potentially still present on NAND backups or multiboot scenarios, being invalidated until the next sign-in (at which point even old sessions will be valid again).

== System Updater ==
The system updater title is identical to the regular system settings, except only system update is accessible with this. On dev units, this title can only be launched under certain conditions.

On retail units, this title is accessible in scenarios where you have to update via the Internet to use certain 3DS software other than the home menu. i.e. using the eShop, on a system version less than the current one. When one selects "Cancel" from here on retail, the system will shutdown. [[NS]] launches SAFE_MODE_FIRM for running this title, when the [[Configuration_Memory|UPDATEFLAG]] is set during system boot.

==Exiting System Settings==
Upon exit, the system reboots instead of simply returning to home menu.

== Parental Controls Reset ==
The following refers to the functionality which generates the Parental Controls "Master Key".

{| class="wikitable" border="1"
|-
! System version, for the mset title
! Parental controls reset functionality version
! Inquiry number length
! Notes
|-
| [[1.0.0-0|1.0.0-X]] - [[6.3.0-12|6.3.0-X]]
| v0
| 8
| Mostly inherited from the Wii/DSi algorithm which used CRC-32 (0xEDB88320) with custom XOR-out (0xAAAA). 0x14C1 was added to produce the final result.

For the 3DS algorithm, only constants were changed: the polynomial was changed to 0xEDBA6320 and the addition constant became 0x1657.

The input to either function is an ASCII string of the format "%02u%02u%04u" where the parameters are month, day, and low 4 digits of the inquiry number. The low 5 decimal digits from the output u32 are then used for the master key.

Because of the date being used in the algorithm, this results in the master key only being valid on a particular day, though this is trivially defeated by setting the system time to the correct date that the key was generated on.

This had a minor refactor in [[6.0.0-11|6.0.0-X]] but is functionally identical.
|-
| [[7.0.0-13|7.0.0-X]] - [[7.1.0-16|7.1.0-X]]
| v1
| 10
| Introduced a new scheme using HMAC-SHA-256. The HMAC key is loaded from mset .rodata, and differs between regions.

The inquiry number was bumped from 8 digits to 10 digits, but the same function is used to generate the digits as in v0 (derived from MAC address).

All digits of the inquiry number are now actually used in the master key derivation function, as the string format is now "%02u%02u%010u" (month, day, inquiry number). This buffer is hashed (as above), and a little-endian word is read from the start of the output hash. The low 5 decimal digits of this word are used as the master key.
|-
| [[7.2.0-17|7.2.0-X]] - current
| v2
| 10
| Extension of v1 featuring a number of changes which serve to obscure the HMAC key used.

The HMAC key is now stored in a separate file stored in the CVer RomFS, called [[CVer#masterkey.bin|masterkey.bin]]. This is used to update the key independently of the mset title. In order to make this possible, a scheme was devised to encode the required key within the inquiry number - the first digit denotes region, and the next two digits represent the key version. These values match up with values stored in the masterkey.bin header. For compatibility with v1 (as inquiry number length did not change), the version values begin at 10 - when parsing an inquiry number, a "version" of less than 10 should be handled as algorithm v1.

The HMAC key is now also encrypted in masterkey.bin. This uses AES-128-CTR using a (normal) key in mset .rodata (which differs between regions), with the initial counter value also stored in masterkey.bin.

At some point, Nintendo chose to "abandon" the original JPN region ID (0), and moved to region ID 9 instead (which usually doesn't exist). It is unknown why they made this change, as the AES key used for both of these IDs is the same.
|}

== ExtData ==
The ExtData [[Extdata#Filesystem|File System]] for System Settings is as follows:

root
├── icon
├── boss
└── user
├── Backup.dat
└── MsetExt.dat

{| class="wikitable" border="1"
|-
! File
! Details
! Size
! FW Introduced
! Plaintext
|-
| icon
| Stubbed. Always image 00000002.
| 0x4 Bytes
| n/a
|
|-
| MsetExt.dat
| [[DSiWare Exports]] Management
| 0x960 Bytes
| [[2.0.0-2]]
| [https://dl.dropboxusercontent.com/u/60710927/CTR/Sample/SystemSettingsExtdata/MsetExt.dat Download]
|-
| Backup.dat
| [[SD Savedata Backups]] Management
| 0xf5a0 Bytes
| [[6.0.0-11]]
| [https://dl.dropboxusercontent.com/u/60710927/CTR/Sample/SystemSettingsExtdata/Backup.dat Download]
|}

=== MsetExt.dat ===
This keeps a record for the DSiWare Exports for a maximum of 300 exports. Each record is in the format:
{| class="wikitable" border="1"
|-
! OFFSET
! SIZE
! DESCRIPTION
|-
| 0
| 4
| Game Code in Little Endian
|-
| 0x4
| 4
| Reserved
|}

All unused entries are filled with "0xff".

=== Backup.dat ===
This keeps a record for the 30 save data backup slots for [[SD Savedata Backups]]. Each entry corresponds to an individual backup slot.

Entry:
{| class="wikitable" border="1"
|-
! OFFSET
! SIZE
! DESCRIPTION
|-
| 0x000
| 8
| Reserved
|-
| 0x8
| 0x800 (0x80*16)
| 16 UTF-16 Title Strings
|-
| 0x808
| 8
| Title ID
|-
| 0x810
| 8
| Unknown
|-
| 0x818
| 8
| Total Save Data Size
|-
| 0x820
| 0x10
| Reserved
|}

PXI Services

2016-08-18T15:31:51Z

Dazzozo: forgot to put this up, oops

= PXI Services =
The 'pxi' sysmodule contains the following services:
*[[Filesystem services PXI|PxiFS0]]
*[[Filesystem services PXI|PxiFS1]]
*[[Filesystem services PXI|PxiFSB]]
*[[Filesystem services PXI|PxiFSR]]
*[[Process Manager Services PXI|PxiPM]]
*[[Application Manager Services PXI|pxi:am9]]
*[[Gamecard Services PXI|pxi:dev]]
*[[Development Services PXI|pxi:mc]]
*[[Process Services PXI|pxi:ps9]]

Each of these services has up to 4 static IPC buffers of size 0x1000. When any of these service ports are sync:d, the IPC cmdbuf (TLS+0x80+) is sent over [[PXI_Registers|PXI]] to the ARM9.

Each PXI service can only have one session open for it at a time.

= Protocol =
The communication protocol for normal PXI commands is documented below. The size of cmd_buf is calculated from the cmd_hdr. With newer FIRM the total size for command header + buffer must be at most 0x40 words, otherwise Process9 will panic.

The PXI protocol is bidirectional - both processors can host a PXI service for a given pxi_id. In practice, Process9 hosts all but one of the services (pxi_11 is hosted by pxi-module instead). Each pxi_id corresponds to a PXI command-handler(called from threads) which handles the actual command processing. With newer FIRM the pxi_id must be in a certain range.

There's a dedicated Process9 thread for receiving data from PXI(in newer FIRM this is the main-thread), once it finishes receiving a request it copies the cmd_buf into a buffer for the corresponding pxi_id then signals an event so that the cmd-handler thread can process it. Once a cmd-handler thread finishes processing a command, the thread itself then sends the response over PXI. This means that multiple commands for different pxiIDs can be be handled at the same time, even when one cmd-handler completely hangs/etc for example.

Process9 will execute [[SVC|svcBreak]] when it receives a PXI command with a pxi_id where another command with that same pxi_id is still being processed by the command-handler(this won't happen with commands sent by the ARM11 PXI-module, since it waits for the command reply before sending another command request for that same pxi_id).

=PXI service "pxi_11"=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010040
| PublishToSubscriber - this exposes [[Services|"srv:" notifications]] to the Process9-side, to allow sending card-insert notifications etc. directly to ARM11.
|}

==Request==
A11->A9 (u32) pxi_id
A11->A9 (u32) cmd_hdr
A11->A9 (u32[]) cmd_buf

==Response==
A9->A11 (u32) pxi_id
A9->A11 (u32) cmd_hdr
A9->A11 (u32[]) cmd_buf

==pxi_id==
0 = pxi_mc
1 = pxi_fs
2 = pxi_fs
3 = pxi_fs
4 = pxi_fs
5 = pxi_pm
6 = pxi_dev
7 = pxi_am
8 = pxi_ps
9 = pxi_11

News/Archive

2016-07-22T22:10:45Z

Dazzozo:

*'''10 July 16''' MrNbaYoh released [https://mrnbayoh.github.io/basicsploit/ BASICSploit] for version 3.2.1 of SmileBASIC. Currently only the US version is supported. On July 11th the main-app title was removed from USA/JPN eShop: it's no longer listed on the former, while on the latter it can't be purchased.
*'''26 June 16''' [[User:Yellows8|Yellows8]] released oot3dhax builds for supporting [[11.0.0-33]], via updated sploit_installer in the [https://smealum.github.io/3ds/ starter-kit] and raw [https://github.com/yellows8/oot3dhax/releases/tag/06-26-16 saveimages]. Note that attempting to run sploit_installer on a 11.0.0-33 system with *hax payload <=v2.7 is equivalent to [[11.0.0-33|trying]] to use the older oot3dhax on that version.
*'''3 June 16''' [[User:Plutooo|plutoo]] released [https://plutooo.github.io/freakyhax/ freakyhax]. The USA game was removed from the eShop <=3-hours later("... currently unavailable" message).
*'''9 May 16''' Nintendo released system update [[11.0.0-33]].
*'''24 March 16''' Nintendo updated the pages stored on the server used for browser-version-check. Due to almost all of the Old3DS/New3DS pages for non-latest-browser being updated(content is now "99999"), browser versions prior to [[10.7.0-32]] are not usable anymore without using the browser-version-check bypass(fixed with [[10.7.0-32]]). The only exception is New3DS v10.2, it was "updated" but the content is still "0"(this is due to browser-version-check being [[Internet_Browser|broken]] with New3DS v10.2).
*'''22 March 16''' [[User:Yellows8|Yellows8]] released [https://github.com/yellows8/ctr-httpwn/releases ctr-httpwn]. v1.0.1 was released on the 25th for a RootCA cert update.
*'''14 March 16''' Nintendo released system update [[10.7.0-32]].
*'''24-25 February 16''' On the 24th the Old3DS [[Internet_Browser|browser-version-check]] pages were updated so that browser version >=v10.6 is now required. The New3DS pages for this were not changed. About 5 hours later, [[User:Yellows8|Yellows8]] disclosed a bypass for the browser-version-check. User instructions are available [http://yls8.mtheall.com/3dsbrowserhax.php here], details [[3DS_Userland_Flaws|here]].
*'''22 February 16''' Nintendo released system update [[10.6.0-31]].
*'''1 February 16''' As of this date (time zones notwithstanding) following server maintenance Nintendo now checks server-side that users are on current firmware before allowing access to online functionality in games. See [[10.5.0-30|here]] for details.
*'''25 January 16''' Nintendo released system update [[10.5.0-30]].
*'''25 January 16''' [[User:Yellows8|Yellows8]] updated [http://yls8.mtheall.com/3dsbrowserhax.php browserhax], [https://github.com/yellows8/3ds_homemenuhax/releases menuhax], and the oot3dhax [https://github.com/yellows8/oot3dhax/releases saveimages] for v10.4.
*'''18 January 16''' Nintendo released system update [[10.4.0-29]].
*'''7 January 16''' (roughly, not automatically detected) Ironfall v1.0 is no longer downloadable due to the main-CXI content files on CDN being removed (TMD wasn't removed).
*'''27 December 15''' A 3DS console hacking [https://events.ccc.de/congress/2015/Fahrplan/events/7240.html talk] was at 32C3. A recording can be found [https://www.youtube.com/watch?v=UutYOidFx3c here]. Around the end of the talk, [[User:Yellows8|Yellows8]] released [[browserhax]] and [[menuhax]] compatible with the latest system-version at the time of release ([[10.3.0-28]]). The homebrew [https://smealum.github.io/3ds/ starter-kit] was updated for latest menuhax, and for an option for downloading the old vulnerable version of Ironfall from eShop.
*'''15 December 15''' Nintendo released Smash Bros update v1.1.3 which fixed [[smashbroshax]], see [https://github.com/yellows8/3ds_smashbroshax here] for details. However, [[smashbroshax]] is still possible on latest firmware: simply remove the update from SD card before attempting the exploit.
*'''13 December 15''' WinterMute released [http://devkitpro.org/viewtopic.php?f=13&t=8542 devkitARM release 45].
*'''25 November 15''' [[User:Yellows8|Yellows8]] released [https://github.com/yellows8/hblauncher_loader/releases hblauncher_loader].
*'''17-20 November 15''' Nintendo released an update for the normal (non-invite-code) Super Smash Bros demos in USA, EUR and JPN, fixing [[smashbroshax]]. Only the demos were updated, the cartridge and eShop version of the full game are still vulnerable.
*'''12 November 15''' [[User:Yellows8|Yellows8]] released [https://github.com/yellows8/oot3dhax/releases oot3dhax] raw savedata images for gamecards with the latest *hax payloads. The official [https://github.com/smealum/sploit_installer installer] is now [https://smealum.github.io/3ds/ included] in the homebrew starter kit.
*'''9 November 15''' Nintendo released system update [[10.3.0-28]].
*'''2 November 15''' Following an eShop servers maintenance, changes to the [[eShop]] system application require an update of the Homebrew starter kit for eShop access on system versions older than [[10.0.0-27]]. See [[EShop|here]] for details.
*'''30 October 15''' [[User:Yellows8|Yellows8]] released [https://github.com/yellows8/3ds_homemenuhax/releases menuhax] v2.0.
*'''29 October 15''' [[User:Yellows8|Yellows8]] released [https://github.com/yellows8/3ds_smashbroshax/releases 3ds_smashbroshax] v1.2.
*'''26 October 15''' A [[Internet_Browser#v9.9_dummy_web-browser|dummy web browser]] is now being included in CUPs (cart updates) on Old3DS/New3DS likely starting with games shipping [[9.9.0-26|9.9.0-X]]. NVer is not updated by this.
*'''26 October 15''' The system web-browser on Old3DS/New3DS now displays a "sysupdate required" message on systems with [[9.9.0-26]] or above installed, if the installed browser(?) is not the latest version. See [[Internet_Browser#Forced_system-update|here]] for details.
*'''25 October 15''' [[User:Smea|smea]] released *hax 2.5 payloads, which fixes a number of bugs and adds new features such as screenshot-taking, romhacking and eshop access.
*'''20 October 15''' Nintendo released system update [[10.2.0-28]]. The publicly available versions of [[menuhax]] and [[browserhax]] at the time of sysupdate release, were blocked.
*'''15 October 15''' The [[YouTube]] application was updated with a fix for [[tubehax]]. This update is forced: the app itself checks whether a newer version of the title is available.
*'''13 October 15''' "Ironfall: Invasion" was made available on the eShop again (originally pulled on August 11th). The updated version blocks [[ironhax]].
*'''25 September 15''' [[User:Yellows8|Yellows8]] released [[browserhax]] and [[menuhax]]. On the 26th menuhax v1.2 was [https://github.com/yellows8/3ds_homemenuhax/releases released].
*'''14 September 15''' Nintendo released system update [[10.1.0-27]].
*'''11 September 15'''(11:30 EDT) [[User:Yellows8|Yellows8]] released [[smashbroshax]]. On the 30th v1.1 was [https://github.com/yellows8/3ds_smashbroshax/releases released] for supporting Super Smash Bros v1.1.1.
*'''8 September 15''' Nintendo released system update [[10.0.0-27]].
*'''18 July 15''' smea released [[ninjhax]] 2 beta [http://smealum.github.io/ninjhax2/], enabling ARM11 homebrew execution on Old/New 3DS up to firmware 9.9.0-26.
*'''13 July 15''' Nintendo released system update [[9.9.0-26]].
*'''1 June 15''' Nintendo released system update [[9.8.0-25]].
*'''03 May 15''' smea released regionFOUR [https://github.com/smealum/regionFOUR/blob/master/README.md], enabling region free gaming on latest firmware. (again)
*'''20 April 15''' Nintendo released system update [[9.7.0-25]].
*'''23 March 15''' Nintendo released system update [[9.6.0-24]].
*'''2 March 15''' Nintendo released system update [[9.5.0-23]].
*'''15 February 15''' WinterMute released [http://devkitpro.org/viewtopic.php?f=13&t=8409 devkitARM release 44].
*'''2 February 15''' Nintendo released system update [[9.5.0-22]], which fixes [[3DS System Flaws|firmlaunch-hax]].
*'''16 January 15''' smea released regionthree [https://github.com/smealum/regionthree/blob/master/README.md], enabling region free gaming on latest firmware.
*'''24 December 14''' smea released [[Ninjhax]] 1.1 ('''NOT''' a fix for firmware [[9.3.0-21]] or [[9.4.0-21]]).
*'''11 December 14''' Nintendo released system update [[9.4.0-21]].
*'''8 December 14''' Nintendo released system update [[9.3.0-21]], which fixes [[3DS System Flaws|rohax]].
*'''20 November 14''' smea released [[Ninjhax]], the first public [[Homebrew Exploits|homebrew exploit]] compatible with system-versions [[4.0.0-7]]-[[9.2.0-20]].
*'''29 October 14''' Nintendo released system update [[9.2.0-20]].
*'''10 October 14''' Nintendo released system update [[9.1.0-20J]].
*'''6 October 14''' Nintendo released system update [[9.0.0-20]].
*'''29 August 14''' Nintendo announced [[New 3DS]].
*'''7 August 14''' Nintendo released system update [[8.1.0-19]].
*'''24 July 14''' Nintendo released system update [[8.1.0-18]].
*'''7 July 14''' Nintendo released system update [[8.0.0-18]].
*'''12 May 14''' Nintendo released system update [[7.2.0-17]].
*'''26 February 14''' Nintendo released system update [[7.1.0-16]].
*'''22 January 14''' Nintendo released system update [[7.1.0-15]].
*'''19 December 13''' Nintendo released system update [[7.1.0-14]].
*'''9 December 13''' Nintendo released system update [[7.0.0-13]].
*'''13 September 13''' Nintendo released system update [[6.3.0-12]].
*'''20 August 13''' [[3DSExplorer|3DSExplorer v1.5.3]] updated by [[User:Elisherer|Elisherer]] (Enable trimming NCSD)
*'''6 August 13''' Nintendo released system update [[6.2.0-12]].
*'''11 July 13''' Nintendo released system update [[6.1.0-12U]] for only USA.
*'''27 June 13''' Nintendo released system update [[6.1.0-11]] (6.1.0-12 for all regions except USA).
*'''17 June 13''' Nintendo released system update [[6.0.0-11]] (6.0.0-12 for all regions except USA).
*'''4 April 13''' Nintendo released system update [[5.1.0-11]].
*'''25 March 13''' Nintendo released system update [[5.0.0-11]].
*'''14 January 13''' [[3DSExplorer|3DSExplorer v1.5.1]] updated by [[User:Elisherer|Elisherer]]
*'''4 December 12''' Nintendo released system update [[4.5.0-10]].
*'''1 December 12''' [[3DSExplorer|3DSExplorer v1.4]] updated by [[User:Elisherer|Elisherer]]
*'''2 November 12''' Added page for [[Fundraiser|Chip decapping fundraiser]]
*'''8 January 13''' [[3DSExplorer|3DSExplorer v1.5]] updated by [[User:Elisherer|Elisherer]]
*'''23 September 12''' [[005tools|005tools v0.1b]] by [[User:McHaggis|McHaggis]]
*'''19 September 12''' Nintendo released system update [[4.4.0-10]].
*'''17 August 12''' Nintendo released New Super Mario Bros. 2, the first 3DS title released simultaneously in stores and as an [[eShop]] download.
*'''28 July 12''' [[3DSExplorer|3DSExplorer v1.3]] (modified by 3DSGuy) updated by [[User:Elisherer|Elisherer]]
*'''24 July 12''' Nintendo released system update [[4.3.0-10]].
*'''26 June 12''' Nintendo released system update [[4.2.0-9]].
*'''19 May 12''' [[3DSExplorer|3DSExplorer v1.2.1]] updated by [[User:Elisherer|Elisherer]]
*'''15 May 12''' Nintendo released its first implementation of 3DS '[[Title list#0004000E - Add-on Content|Add-on Content]]' with the Mario Kart 1.1 update.
*'''14 May 12''' Nintendo released system update [[4.1.0-8]].
*'''24 April 12''' Nintendo released system update [[4.0.0-7]].
*'''08 February 12''' [[CiTRUS|CiTRUS v0.2]] updated by [[User:Xcution|Xcution]]
*'''04 February 12''' [[CiTRUS|CiTRUS v0.1]] released by [[User:Xcution|Xcution]]
*'''02 February 12''' [[3DSExplorer|3DSExplorer v1.2]] updated by [[User:Elisherer|elisherer]]
*'''26 January 12''' [[Crappy Tiny Reader|CTR - Crappy Tiny Reader v0.07]] updated by [[User:PsyKopaT|PsyKo]]
*'''05 January 12''' [[Crappy Tiny Reader|CTR - Crappy Tiny Reader v0.06]] updated by [[User:PsyKopaT|PsyKo]]
*'''21 December 11''' Nintendo released system update [[3.0.0-6]]
*'''21 December 11''' [[3DSExplorer|3DSExplorer v1.1.1]] updated by [[User:Elisherer|elisherer]]
*'''7 December 11''' [[3DSExplorer|3DSExplorer v0.96]] updated by [[User:Elisherer|elisherer]]
*'''4 September 11''' [[3DSViewer|3DSViewer v0.1]] released by [[User:Elisherer|elisherer]]
*'''1 August 11''' [[3DS Save DeEncrypter3DS|Save DeEncrypter v1.0]] released by [[User:Blite|Blite]]
*'''25 July 11''' Nintendo released system update [[2.1.0-4]].
*'''15 June 11''' Nintendo released system update [[2.1.0-3]].
*'''6 June 11''' Nintendo released system update [[2.0.0-2]].
*'''6 April 11''' [[DSaveManager|DSaveManager v0.1]] released by [[User:Crediar|crediar]]
*'''4 April 11''' [[3DSaveTool|3DSaveTool v0.2b]] released by [[User:Crediar|crediar]]
*'''2 April 11''' [[3DSaveTool|3DSaveTool v0.1]] released by [[User:Crediar|crediar]]
*'''28 March 11''' Fixed 3DBrew wiki issues, now fully operational!
*'''18 March 11''' 3DBrew launched.

== 3DBrew International ==
Our community is an international community.

We have freedom, and we will express it in our language (but you have to write it in English before ;)!

News

2016-07-22T22:10:39Z

Dazzozo:

<noinclude>
==Adding an item==
* Log in to the wiki. Editing is disabled if you don't have an account.
* Add the news event to the top of the list, using this format for the date: <tt><nowiki>'''</nowiki>{{#time: d F y}}<nowiki>''' </nowiki></tt>. Please include the application's creator, version number, and a link to a page on 3DBrew about the application. No external links please.
* '''Move the last entry to the [[:News/Archive|news archive]]. There should be no more than 4 entrees in the list.'''

==Archives==
For older news, see the [[:News/Archive|news archive]].

=== News ===
</noinclude>
*'''22 July 16''' [[User:Dazzozo|Dazzozo]] released [https://citizens.salthax.org/ humblehax v2], supporting the Citizens of Earth update released on the eShop 3 days ago.
*'''20 July 16''' [[User:Plutooo|plutoo]] (with help from [[User:Yellows8|Yellows8]]) released [https://plutooo.github.io/smilehax/ smilehax].
*'''19 July 16''' An updated version of the EUR "Citizens of Earth" regular-title is now available on the EUR-eShop, ~2 months after being originally removed. Likewise for USA on the 21st.
*'''18 July 16''' [[User:Smea|Smea]] updated the hosted *hax payload builds(only otherapp for non-KOR) and this [https://smealum.github.io/3ds/ page]. KOR is now supported thanks to d3m3vilurr(system-version >=v9.6). All otherapp payloads were rebuilt+updated, hence these now include a commit for compression(committed by [[User:Yellows8|Yellows8]] with compression code by mtheall). Due to this, oot3dhax+payload can now be installed with multiple other normal save-files, without any issues(via sploit_installer from the starter-kit). [[User:Yellows8|Yellows8]] also updated the [https://smealum.github.io/3ds/ hosted] boot.3dsx to hbmenu 1.1.1.

Homebrew Exploits

2016-07-22T21:50:14Z

Dazzozo:

==Standalone Homebrew Launcher Exploits==
The following homebrew exploits can be executed on a previously un-exploited system.

{| class="wikitable" border="1"
|-
! Works on latest fw
! Name
! Supported firmwares
! Requirements
! Author
! Install
|-
| style="background: salmon" | No
| [[ninjhax|Ninjhax 1.1b]]
| From '''4.0.0-7''' up to and including '''9.2.0-20'''.
| A cartridge or eShop version (JPN-only) of "Cubic Ninja".
| smea
| [http://smealum.net/ninjhax/ Install]
|-
| style="background: orange" | No; needs update.
| [[ninjhax|Ninjhax 2.x]]
| From '''9.0.0-7''' up to and including '''10.7.0-32'''.
| A cartridge or eShop version (JPN-only, not available anymore for purchase) of "Cubic Ninja". (note that this can be used on 11.0.0-33, but the savegame cannot be installed via the QR scanner, due to httpc access being revoked)
| smea
| [https://smealum.github.io/ninjhax2/ Install]
|-
| style="background: lightgreen" | Yes
| [http://plutooo.github.io/freakyhax/ freakyhax]
| From '''9.0.0-7''' up to and including '''11.0.0-33'''.
| A cartridge or eShop version (USA/EUR/JAP, not available anymore for purchase) of "Freakyform Deluxe".
| plutoo
| [http://plutooo.github.io/freakyhax/ Install]
|-
| style="background: lightgreen" | Yes
| [http://plutooo.github.io/smilehax/ smilehax]
| From '''9.0.0-7''' up to and including '''11.0.0-33'''
| SmileBASIC (JPN all versions, USA 3.31 only)
| plutoo
| [http://plutooo.github.io/smilehax/ Install]
|-
| style="background: lightgreen" | Yes
| [http://mrnbayoh.github.io/basicsploit/ BASICSploit]
| From '''9.0.0-7''' up to and including '''11.0.0-33'''
| SmileBASIC (USA all versions)
| MrNbaYoh
| [http://mrnbayoh.github.io/basicsploit/ Install]
|-
| style="background: lightgreen" | Yes
| [[smashbroshax|smashbroshax]] (beaconhax)
| (New 3DS only) From '''9.0.0-X''' up to and including '''11.0.0-33'''.
| Super Smash Bros 3DS (full-game) and a way to broadcast raw wifi beacons. The demo (prior to the updated November 2015 [https://github.com/yellows8/3ds_smashbroshax version]) isn't usable with the *hax payloads. Game-version v1.1.3 fixed the vuln used with this, see the repo for a workaround for that.
| [[User:Yellows8|Yellows8]]
| [https://github.com/yellows8/3ds_smashbroshax Install]
|-
| style="background: salmon" | No
| [[browserhax]]
| (Old 3DS) From '''9.0.0-16''' to '''9.5.0-22''', '''9.5.0-23''' to '''9.8.0-25''', '''9.9.0-26''' to '''10.1.0-27''', '''10.2.0-28''' to '''10.5.0-30'''

(New 3DS) From '''9.0.0-20''' to '''9.2.0-20''', '''9.3.0-21''' to '''9.5.0-23''', '''9.6.0-24''' to '''9.8.0-25''', '''9.9.0-26''' to '''10.1.0-27''', '''10.2.0-28''' to '''10.5.0-30'''

Note that the browser-version-check bypass is only usable prior to [[10.7.0-32]].
| An USA, EUR, or JPN system.
| [[User:Yellows8|Yellows8]]
| [http://yls8.mtheall.com/3dsbrowserhax.php Install]
|}

Note that ninjhax 1.x is still not obsolete. Even though ninjhax 2.x can be run on 9.3+, this was made possible (amongst other things) by sacrificing the memory remapping exploit used in ninjhax 1.x (rohax). Therefore, things like JIT engines for emulators can only be supported on ninjhax 1.x. Furthermore, ninjhax 2.x does not run on system versions below 9.0.0-X, while ninjhax 1.x does.

==Secondary Exploits==
Installation of these exploits requires a previously exploited system to install. After installation, they can be used on their own.

{| class="wikitable" border="1"
! Works on latest fw
! Name
! Supported firmwares
! Requirements
! Author
! Install
|-
| style="background: salmon" | No
| [[ironhax]]
| From '''9.5.0-X''' up to and including '''10.3.0-X''', for '''X''' up to and including 28.
| A copy of "Ironfall: Invasion" downloaded from eShop before August 11th, 2015. Note the updated version that was released on October 13th, 2015 is not supported.
| smea
| [http://smealum.github.io/3ds/ Install]
|-
| style="background: lightgreen" | Yes
| [https://github.com/yellows8/oot3dhax oot3dhax]
| From '''9.0.0-X''' up to and including '''11.0.0-X''', for '''X''' up to and including 33.
| A gamecard or eShop-install of Legend of Zelda: Ocarina of Time 3D. Besides using the installer app, writing raw saveimages with a save dongle for example is another option. Before compression was introduced in the 2016-7-18 release, the size of the *hax payload meant the exploit can't coexist with regular saves on a physical version of the game.
| Yellows8 / smea et al.
| See [https://smealum.github.io/3ds/ here].
|-
| style="background: salmon" | No
| [[menuhax]]
| From '''9.0.0-X''' up to and including '''10.5.0-X''', for '''X''' up to and including 30.
| Having created [[Home_Menu#Home_Menu_Theme_SD_ExtData|theme extdata]] through opening the official theme selector at least once.
| [[User:Yellows8|Yellows8]]
| [https://github.com/yellows8/3ds_homemenuhax/releases Download]
|-
| style="background: lightgreen" | Yes
| [https://github.com/shinyquagsire23/supermysterychunkhax supermysterychunkhax]
| From '''9.9.0-X''' (USA/JPN) / '''10.2.0-X''' (EUR) up to and including '''11.0.0-X''', for '''X''' up to and including 33.
| A gamecard or eShop-install of Pokémon Super Mystery Dungeon.
| Shiny Quagsire / SALT team
| [https://smd.salthax.org/ Install].
|-
| style="background: lightgreen" | Yes
| [https://github.com/shinyquagsire23/v_hax (v*)hax]
| From '''9.0.0-X''' up to and including '''11.0.0-X''', for '''X''' up to and including 33.
Note that '''9.0.0-X''' is only required for the Homebrew Launcher - the game itself only requires '''2.1.0-X''' for primitive userland code execution.
| A copy of VVVVVV downloaded after March 2012 (v1). The game is not available anymore for purchase.
| Shiny Quagsire / SALT team
| [https://vvvvvv.salthax.org/ Install].
|-
| style="background: lightgreen" | Yes
| [https://github.com/Dazzozo/humblehax humblehax]
| From '''9.0.0-X''' (USA/EUR) up to and including '''11.0.0-X''', for '''X''' up to and including 33.
| An eShop-install of Citizens of Earth (either v1 or v2), featured in the Humble "Friends of Nintendo" Bundle.
| Dazzozo / SALT team
| [https://citizens.salthax.org/ Install].
|-
| style="background: lightgreen" | Yes
| [http://mrnbayoh.github.io/basehaxx/ basehaxx]
| From '''9.0.0-X''' up to and including '''11.0.0-X''', for '''X''' up to and including 33.
| A gamecard or eShop-install of Pokémon Omega Ruby / Alpha Sapphire.
| MrNbaYoh
| [http://mrnbayoh.github.io/basehaxx/ install]
|}

==Exploits without Homebrew Launcher (Not recommended)==

'''Warning:''' The following exploits can run code, but are missing a 3DSX launcher. They cannot launch any homebrew in the 3DSX format.

{| class="wikitable" border="1"
|-
! Works on latest fw
! Name
! Supported firmwares
! Requirements
! Author
! Install
|-
| style="background: salmon" | No
| [[browserhax]] (Without the loader in the 3ds_browserhax_common repo)
| (Old3DS) From '''2.1.0-4''' to '''3.0.0-6''', '''4.0.0-7''' to '''4.5.0-10''', '''5.0.0-11''' to '''7.0.0-13''', '''7.1.0-16''' to '''9.5.0-22''', '''9.5.0-23''' to '''9.8.0-25''', '''9.9.0-26''' to '''10.1.0-27''', '''10.2.0-28''' to '''10.5.0-30'''

(New3DS) From '''9.0.0-20''' to '''9.2.0-20''', '''9.3.0-21''' to '''9.5.0-23''', '''9.6.0-24''' to '''9.8.0-25''', '''9.9.0-26''' to '''10.1.0-27''', '''10.2.0-28''' to '''10.5.0-30'''

Note that the browser-version-check bypass is only usable prior to [[10.7.0-32]].
| An USA, EUR, or JPN system.
| [[User:Yellows8|Yellows8]]
| [[browserhax|Install]]
|-
| style="background: salmon" | No
| Ninjhax (with specialized payloads)
| Up to '''9.2.0-20'''?
|
| smea + independent developers
| N/A
|}

==Previous Exploits==
'''Warning:''' These exploits '''do not work'''. They are exploits which no longer function at all, regardless of software or firmware revision.
{| class="wikitable" border="1"
! Works on latest fw
! Name
! Supported firmwares
! Requirements
! Author
! Install
|-
| style="background: salmon" | No
| [[tubehax|Tubehax]]
| None. '''Was''': From '''9.0.0-X''' up to and including '''10.1.0-X''', for '''X''' up to and including 27.
| The YouTube application and an Internet connection. As of October 15, 2015, this is no longer usable due to an update being released which fixes the vuln used by tubehax + app update being forced (see [[YouTube|here]]).
| smea
| [http://smealum.github.io/3ds/ Install]
|}

==Other Homebrew Loaders==
The [https://github.com/yellows8/hblauncher_loader hblauncher_loader] title can be used when running under modded-FIRM which allows running unsigned titles, to boot the *hax payloads.

==Sysmodule Exploits==
This section is for system-module exploits, which can be run from the *hax payloads.

{| class="wikitable" border="1"
! Works on latest fw
! Name
! Supported firmwares
! Requirements
! Author
|-
| Yes, that's not the intended default use however.
| [https://github.com/yellows8/ctr-httpwn/releases ctr-httpwn]
| From '''9.6.0-X''' up to and including '''11.0.0-X'''.
| None
| [[User:Yellows8|Yellows8]]
|}

==WebKit vuln testing==
See [https://github.com/yellows8/3ds_browserhax_common/issues/28 here].

AES Registers

2016-07-18T04:50:57Z

Dazzozo: The first 64 get processed, and the last 64 are waiting. Try harder.

== Registers ==
{| class="wikitable" border="1"
! Old3DS
! Name
! Address
! Width
! RW
|-
| style="background: green" | Yes
| [[#AES_CNT|AES_CNT]]
| 0x10009000
| 4
| RW
|-
| style="background: green" | Yes
| [[#AES_BLKCNT|AES_BLKCNT]]
| 0x10009004
| 4
| W
|-
| style="background: green" | Yes
| [[#AES_WRFIFO/AES_RDFIFO|AES_WRFIFO]]
| 0x10009008
| 4
| W
|-
| style="background: green" | Yes
| [[#AES_WRFIFO/AES_RDFIFO|AES_RDFIFO]]
| 0x1000900C
| 4
| R
|-
| style="background: green" | Yes
| AES_KEYSEL
| 0x10009010
| 1
| RW
|-
| style="background: green" | Yes
| [[#AES_KEYCNT|AES_KEYCNT]]
| 0x10009011
| 1
| RW
|-
| style="background: green" | Yes
| [[#AES_CTR|AES_CTR]]
| 0x10009020
| 16
| W
|-
| style="background: green" | Yes
| [[#AES_MAC|AES_MAC]]
| 0x10009030
| 16
| W
|-
| style="background: green" | Yes
| AES_KEY0
| 0x10009040
| 48
| W
|-
| style="background: green" | Yes
| AES_KEY1
| 0x10009070
| 48
| W
|-
| style="background: green" | Yes
| AES_KEY2
| 0x100090A0
| 48
| W
|-
| style="background: green" | Yes
| AES_KEY3
| 0x100090D0
| 48
| W
|-
| style="background: green" | Yes
| AES_KEYFIFO
| 0x10009100
| 4
| W
|-
| style="background: green" | Yes
| AES_KEYXFIFO
| 0x10009104
| 4
| W
|-
| style="background: green" | Yes
| AES_KEYYFIFO
| 0x10009108
| 4
| W
|}

== AES_CNT ==
{| class="wikitable" border="1"
! Bit
! Description
|-
| 4-0
| Write FIFO count (0-16)
|-
| 9-5
| Read FIFO count (0-16)
|-
| 10
| Flush write FIFO (1=Clear write FIFO)
|-
| 11
| Flush read fifo (1=Clear read FIFO)
|-
| 12-13
| Write FIFO DMA size (0=16, 1=12, 2=8, 3=4 words)
|-
| 14-15
| Read FIFO DMA size (0=4, 1=8, 2=12, 3=16 words)
|-
| 18-16
| MAC size (encoding = (maclen-2)/2)
|-
| 19
|? (MAC related)
|-
| 20
| MAC input control (0 = read MAC from FIFO, 1 = read from MAC register)
|-
| 21
| MAC status (0 = invalid, 1 = verified)
|-
| 22
| Output endianness (1=Big endian, 0=Little endian)
|-
| 23
| Input endianness (1=Big endian, 0=Little endian)
|-
| 24
| Output word order (1=Normal order, 0=Reversed order)
|-
| 25
| Input word order (1=Normal order, 0=Reversed order)
|-
| 26
| Update keyslot (selects the keyslot specified by AES_KEYSEL when this bit is set)
|-
| 29-27
| Mode (0=CCM decrypt, 1=CCM encrypt, 2=CTR, 3=CTR, 4=CBC decrypt, 5=CBC encrypt, 6=ECB decrypt, 7=ECB encrypt)
|-
| 30
| Interrupt enable (1=enable, 0=disable)
|-
| 31
| Start (1=enable/busy, 0=idle)
|}

When bit31 is set, this register essentially becomes locked and doesn't change when written to. However if bit26 is "set", keyslot-selection is cued to be handled when bit31 is cleared.

Clearing bit31 while the AES engine is doing crypto will result in the AES engine stopping crypto, once it finishes processing the current block.

Read/Write FIFO counts and the MAC status can never be set by writing to AES_CNT, they are read-only.

Changing the input word order triggers the key/keyX/keyY FIFOs to be flushed.

== AES_BLKCNT ==

{| class="wikitable" border="1"
! Bit
! Description
|-
| 16-31
| (Data length)>>4 (i.e. the number of blocks to process)
|}

== AES_WRFIFO/AES_RDFIFO ==
The AES engine can accept up to 64 bytes of input data (16 32-bit words) and can hold up to 64 bytes of output data at a time (for a total of 128 bytes of buffered data). Bits 12-13 and 14-15 in AES_CNT configure the DMA request for the relevant FIFO (see above).

The input data for the AES crypto operation is written to AES_WRFIFO, the output data is read from AES_RDFIFO.

Reading from AES_RDFIFO when there's no data available in the RDFIFO will result in reading the last word that was in the RDFIFO.

When triggering either RDFIFO or WRFIFO to be flushed, the AES Engine does not clear either buffer.

Word order and endianness can be changed between each read/write to these FIFOs. However changing the word order when writing to WRFIFO can cause the word to be written outside the current block, leaving uninitialized data in its place. Attempts to change endianness or word order are not honored when reading from RDFIFO when no more data is available.

== AES_KEYCNT ==
{| class="wikitable" border="1"
! Bit
! Description
|-
| 5-0
| Keyslot
|-
| 6
| Hardware key-generator type: 0 = 3DS, 1 = DSi.
|-
| 7
| This normally has value 1 written here when updating keys. 0 = disable key FIFO flush, 1 = enable key FIFO flush.
|}

Bit6 is only used when keyslots >=4 are used, value1 has the same affect as doing key-init with the TWL keyslots. Bit6 is only checked when a keyY was completely written, for when the final-normalkey needs updated via the key-generator. Changing bit6 has no affect on the generated normalkey when writing to this bit immediately after writing the last keyY word.

== AES_CTR ==
This register specifies the counter (CTR mode), nonce (CCM mode) or the initialization vector (CBC mode) depending on the mode of operation.
For CBC and CTR mode this register takes up the full 16 bytes, but for CCM mode the nonce is only the first 12 bytes.
The AES engine will automatically increment the counter up to the maximum BLKCNT, after which point it must be manually incremented and set again.

== AES_MAC ==
This register specifies the message authentication code (MAC) for use in CCM mode.

== AES_KEY0/1/2/3 ==
{| class="wikitable" border="1"
! Byte
! Description
|-
| 0-15
| Normalkey
|-
| 16-31
| KeyX
|-
| 32-47
| KeyY
|-}

These registers are the same as they were on TWL, and are likely preserved for compatibility reasons. The keyslot is updated immediately after *any* data(u8/u32/...) is written here, which was used on DSi to [[3DS_System_Flaws|break]] the key-generator.

== Endianness and word order ==
When writing to the AES_CTR, AES_MAC or AES_KEY0/1/2/3 register, the hardware will process the written data according to the current input endianness specified in AES_CNT. However, the current specified input word order will not be honored for this register, and always defaults to reversed word order. Therefore, for normal word order, the reversal must be carried out manually if required.

== Keyslot ranges ==
This is approximately a table of what is set by bootrom before booting into FIRM. Often it appears that keyslots in groups of 4 have the same keyX, and sometimes also same keyY set.

{| class="wikitable" border="1"
! Keyslot
! Name
! KeyX
! KeyY/Normal-key
! Console unique.
|-
| 0x00-0x03
| TWL keys.
| Probably unset.
| Probably unset.
| -
|-
| 0x04-0x07
| NAND partition keys.
| Same for all.
| Different for all.
| style="background: green" | Yes
|-
| 0x08-0x0B
| See below.
| Same for all.
| Different for all.
| style="background: green" | Yes
|-
| 0x0C-0x0F
| SSL cert key.
| Same for all.
| Same for all.
| style="background: red" | No
|-
| 0x10-0x17
| -
| Not set.
| Not set.
| -
|-
| 0x18-0x1B
| Never used.
| Same for all.
| Same for all.
| style="background: green" | Yes
|-
| 0x1C-0x1F
| Never used.
| Same for all.
| Same for all.
| style="background: green" | Yes
|-
| 0x20-0x23
| Never used.
| Same for all.
| Same for all.
| style="background: orange" | Normalkey is not. keyX is. keyY unknown.
|-
| 0x24
| Never used.
| Individually set.
| Individually set.
| style="background: orange" | Normalkey is not. keyX is. keyY unknown.
|-
| 0x25-0x27
| -
| Not set.
| Not set.
| -
|-
| 0x28-0x2B
| Never used.
| Individually set.
| Individually set.
| style="background: orange" | Normalkey is not. keyX is. keyY unknown.
|-
| 0x2C-0x2F
| Various uniques.
| Same for all.
| Same for all, probably.
| style="background: red" | No
|-
| 0x30-0x33
| Various uniques.
| Same for all.
| Same for all, probably.
| style="background: red" | No
|-
| 0x34-0x37
| Various uniques.
| Same for all.
| Same for all, probably.
| style="background: red" | No
|-
| 0x38-0x3B
| Various uniques.
| Same for all.
| Different for all.
| style="background: red" | No
|-
| 0x3C-0x3F
| Various uniques.
| Individually set.
| Individually set.
| style="background: red" | No
|}

Keyslot pairs (0x24, 0x28) and (0x38, 0x3C) shares the same normal-key, while at the same time having different keyX's. This suggests they were set to same normal-key by bootrom.

== Keyslots ==
There are 0x40 keyslots, each of which stores three keys called keyX, keyY and normalkey. All keys can be set explicitly, but the normalkey can optionally be generated using a hardware key generator instead (see [[#Hardware_key_generator|below]]). There is no way to read the contents of a keyslot.

{| class="wikitable" border="1"
! Keyslot
! Description
! KeyX set by
! KeyY set by
! Normal-key
! Old3DS
|-
| 0x00-0x03
| TWL keys.
| NATIVE_FIRM hard-boot.
| NATIVE_FIRM hard-boot.
| -
| Yes
|-
| 0x04..0x07
| [[Flash_Filesystem|NAND]] partition keys.

Keyslot is determined by [[NCSD]] partition FS type and encryption type.
The New3DS Process9 sets the keyY for keyslot 0x05 (New3DS CTRNAND) to a key from .(ro)data. Its keyX is console-unique and set by the bootloader.
| Bootrom.
| Bootrom.
| -
| Yes
|-
| 0x0A
| DSiWare export key.

Used for encrypting the all-zero 0x10-byte block in the [[DSiWare_Exports|DSiWare_Exports]] header. Console-unique.
| See above keyslot info.
| See above keyslot info.
| -
| Yes
|-
| 0x0B
| This is console-unique. This keyslot is used for the NAND [[Title_Database|dbs]] images AES-CMACs, and the [[Nand/private/movable.sed]] AES-CMAC(when used).
| See above keyslot info.
| See above keyslot info.
| -
| Yes
|-
| 0x0D
| SSL-certificate key.

See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].
| -
| -
| Bootrom.
| Yes
|-
| 0x11
| Temporary keyslot.

Used by FIRM for general normal-key crypto. Also used by the New3DS [[FIRM]] arm9 binary loader.
| Arm9Loader.
| Arm9Loader.
| NATIVE_FIRM.
| Yes
|-
| 0x14
| Starting with [[5.0.0-11]], NATIVE_FIRM Process9 now sets the keyY for this to the same one it uses for initializing 3 of the keyslots' keyYs from [[PSPXI:EncryptDecryptAes|here]].
| Bootrom.
| NATIVE_FIRM boot.
| -
| Yes
|-
| 0x15
| Used/initialized by the New3DS arm9 binary loader, see [[FIRM|here]].
| Arm9Loader.
| Arm9Loader.
| See previous info for this keyslot.
| No
|-
| 0x16
| Used/initialized by the New3DS arm9 binary loader starting with [[9.5.0-22|9.5.0-X]], see [[FIRM|here]].
| Arm9Loader.
| Arm9Loader.
| See previous info for this keyslot.
| No
|-
| 0x18..0x1F
| These are the New3DS keyslots, where the keyX is generated with keyslot 0x11 by the New3DS arm9 binary [[FIRM|loader]]. As of [[FIRM]] [[9.6.0-24|9.6.0-X]] keyslots 0x1C..0x1F are not yet used by Process9.
| Arm9Loader.
| NATIVE_FIRM / see previous info for these keyslots.
| See previous info for these keyslots.
| No
|-
| 0x18
| New3DS [[9.3.0-21|9.3.0-X]] [[NCCH]] key, when ncchflag[3] is 0x0A.
| Arm9Loader.
| NATIVE_FIRM
| -
| No
|-
| 0x19
| New3DS gamecard [[Savegames|savedata]] AES-CMAC key.

Equivalent of keyslot 0x33, used when a [[NCSD]] flag is set to a certain value (implemented with [[9.3.0-21|9.3.0-X]]).
| Arm9Loader.
| NATIVE_FIRM
| -
| No
|-
| 0x1A
| New3DS gamecard [[Savegames|savedata]] actual key.

Equivalent of keyslot 0x37, used when a [[NCSD]] flag is set to a certain value (implemented with [[9.3.0-21|9.3.0-X]]).
| Arm9Loader.
| NATIVE_FIRM
| -
| No
|-
| 0x1B
| New3DS [[9.6.0-24|9.6.0-X]] [[NCCH]] key, when ncchflag[3] is 0x0B.
| Arm9Loader.
| NATIVE_FIRM
| -
| No
|-
| 0x24
| AGB_FIRM savegame AES-CMAC key.
| Bootrom.
| AGB/NATIVE_FIRM.
| -
| Yes
|-
| 0x25
| [[7.0.0-13|v7.0]] [[NCCH]] key, when ncchflag[3] is 0x01.
| NATIVE_FIRM [[Savegames#6.0.0-11_Savegame_keyY|boot]].
| NATIVE_FIRM.
| -
| Yes
|-
| 0x2C
| Original [[NCCH|NCCH]] key, when ncchflag[3] is 0x00 and always for certain NCCH sections.
| Bootrom.
| Process9.
| -
| Yes
|-
| 0x2D
| UDS local-WLAN CCMP key.

See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].
| Bootrom.
| Bootrom.
| -
| Yes
|-
| 0x2E
| Streetpass key.

See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x2F
| [[Savegames#6.0.0-11_Savegame_keyY|v6.0]] save key.
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x30
| SD/NAND AES-CMAC key.

This keyY is initialized via [[Nand/private/movable.sed|movable.sed]]. This is used for calculating the AES-CMACs under SD [[SD_Filesystem|/Nintendo 3DS/<ID0>/<ID1>/]] (except [[DSiWare_Exports]]) and [[Flash_Filesystem|NAND]] /data/.
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x31
| APT wrap key.

See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]]. NATIVE_FIRM sets this keyY to the same one used for keyslot 0x2E.
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x32
| Unknown.

See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].
| Bootrom.
| Bootrom.
| -
| Yes
|-
| 0x33
| Gamecard [[Savegames|savedata]] AES-CMAC.
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x34
| SD key.

This keyY is initialized via [[Nand/private/movable.sed|movable.sed]]. This is used for encrypting *all* SD card data under [[SD_Filesystem|/Nintendo 3DS/<ID0>/<ID1>/]].
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x35
| Movable.sed key.

This is the keyslot used for movable.sed encryption + AES-CBC MAC with the import/export [[FSPXI:ImportIntegrityVerificationSeed|commands]].
| Bootrom.
| Bootrom.
| -
| Yes
|-
| 0x36
| Unknown. Used by friends module.

See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].
| Bootrom.
| Bootrom.
| -
| Yes
|-
| 0x37
| Gamecard [[Savegames|savedata]] actual key.
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x38
| BOSS key.

See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].
| Bootrom.
| Bootrom.
| -
| Yes
|-
| 0x39
| Download Play key, and the actual NFC key for generating retail [[Amiibo]] keys.

This keyslot is used for two different keys. Both are available via [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]]. NATIVE_FIRM sets this keyY to the same one used for keyslot 0x2E.
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x3A
| DSiWare export key.

This keyY is initialized via [[Nand/private/movable.sed|movable.sed]]. This is used for calculating the AES-CMACs for SD [[DSiWare_Exports]].
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x3B
| [[CTRCARD_Registers#CTRCARD_SECSEED|CTR-CARD hardware-crypto seed]] decryption key.

AES-CCM is used, the keyY, nonce and MAC are stored in the [[NCSD#Card_Info_Header|Card Info Header]].
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x3D
| Common key.

Used to decrypt title keys in [[Ticket]].
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|}

=== Updating keydata ===
The contents of the keyslot specified in AES_KEYCNT can be updated by consecutively writing four words to AES_KEYXFIFO (keyX), AES_KEYYFIFO(keyY), or AES_KEYFIFO (normalkey).

After writing to a keyslot, the keyslot must be selected again(write AES_KEYSEL + set AES_CNT bit26), even when writing to the same keyslot. Writing the last word to a key FIFO immediately after selecting a keyslot will not affect the keyslot keydata that gets used at that time, the new keydata will not get used until the keyslot gets selected again.

Writing to the key FIFOs with byte writes results in the AES engine converting the byte to a word for setting the key word, with this: word = (byteval) | (byteval<<8) | (byteval<<16) | (byteval<<24). The result is the same regardless of which FIFO register byte was written to.

The TWL keyslots 0x00-0x03 can be set directly by writing to the AES_KEY0-AES_KEY3 registers.

The key FIFOs can be written simultaneously. For example, executing the following will result in the keyX and keyY being set to all-zero(unknown for normalkey): memset(0x10009100, 0, 0x100);

Each key FIFO has a 0x10-byte tmp-buffer for storing the words written to that FIFO. Once the last word is written to a key FIFO, the filled tmp-buffer is then written to the key-data for the keyslot selected by AES_KEYCNT at the time the last word was written.

=== Hardware key generator ===
A dedicated hardware key generator can be used to generate a keyslot's normal-key from its keyX and keyY. The hardware key generator is triggered by writing the keyY, which is the only way to trigger it with the 3DS keyslots.

The algorithm for generating the normal-key from keyX and keyY is as follows, in big-endian 128-bit unsigned wraparound arithmetic:

{| class="wikitable" border="1"
! Mode
! Formula
|-
| 3DS
| NormalKey = (((KeyX ROL 2) XOR KeyY) + C1) ROR 41
|-
| DSi
| NormalKey = ((KeyX XOR KeyY) + C2) ROL 42
|}

Unless noted otherwise, all keyslots on retail units use the hardware key generator.

=== FIRM-launch key clearing ===
Starting with [[9.0.0-20]] the Process9 FIRM-launch code now "clears" the following AES keyslots, with certain keydata by writing the normal-key: 0x15 and 0x18-0x20. These are the keyslots used by the New3DS [[FIRM]] arm9bin loader(minus keyslot 0x11), the New3DS Process9 does this too.

AES Registers

2016-07-17T13:59:47Z

Dazzozo: pathetic

== Registers ==
{| class="wikitable" border="1"
! Old3DS
! Name
! Address
! Width
! RW
|-
| style="background: green" | Yes
| [[#AES_CNT|AES_CNT]]
| 0x10009000
| 4
| RW
|-
| style="background: green" | Yes
| [[#AES_BLKCNT|AES_BLKCNT]]
| 0x10009004
| 4
| W
|-
| style="background: green" | Yes
| [[#AES_WRFIFO/AES_RDFIFO|AES_WRFIFO]]
| 0x10009008
| 4
| W
|-
| style="background: green" | Yes
| [[#AES_WRFIFO/AES_RDFIFO|AES_RDFIFO]]
| 0x1000900C
| 4
| R
|-
| style="background: green" | Yes
| AES_KEYSEL
| 0x10009010
| 1
| RW
|-
| style="background: green" | Yes
| [[#AES_KEYCNT|AES_KEYCNT]]
| 0x10009011
| 1
| RW
|-
| style="background: green" | Yes
| [[#AES_CTR|AES_CTR]]
| 0x10009020
| 16
| W
|-
| style="background: green" | Yes
| [[#AES_MAC|AES_MAC]]
| 0x10009030
| 16
| W
|-
| style="background: green" | Yes
| AES_KEY0
| 0x10009040
| 48
| W
|-
| style="background: green" | Yes
| AES_KEY1
| 0x10009070
| 48
| W
|-
| style="background: green" | Yes
| AES_KEY2
| 0x100090A0
| 48
| W
|-
| style="background: green" | Yes
| AES_KEY3
| 0x100090D0
| 48
| W
|-
| style="background: green" | Yes
| AES_KEYFIFO
| 0x10009100
| 4
| W
|-
| style="background: green" | Yes
| AES_KEYXFIFO
| 0x10009104
| 4
| W
|-
| style="background: green" | Yes
| AES_KEYYFIFO
| 0x10009108
| 4
| W
|}

== AES_CNT ==
{| class="wikitable" border="1"
! Bit
! Description
|-
| 4-0
| Write FIFO count (0-16)
|-
| 9-5
| Read FIFO count (0-16)
|-
| 10
| Flush write FIFO (1=Clear write FIFO)
|-
| 11
| Flush read fifo (1=Clear read FIFO)
|-
| 12-13
| Write FIFO DMA size (0=16, 1=12, 2=8, 3=4 words)
|-
| 14-15
| Read FIFO DMA size (0=4, 1=8, 2=12, 3=16 words)
|-
| 18-16
| MAC size (encoding = (maclen-2)/2)
|-
| 19
|? (MAC related)
|-
| 20
| MAC input control (0 = read MAC from FIFO, 1 = read from MAC register)
|-
| 21
| MAC status (0 = invalid, 1 = verified)
|-
| 22
| Output endianness (1=Big endian, 0=Little endian)
|-
| 23
| Input endianness (1=Big endian, 0=Little endian)
|-
| 24
| Output word order (1=Normal order, 0=Reversed order)
|-
| 25
| Input word order (1=Normal order, 0=Reversed order)
|-
| 26
| Update keyslot (selects the keyslot specified by AES_KEYSEL when this bit is set)
|-
| 29-27
| Mode (0=CCM decrypt, 1=CCM encrypt, 2=CTR, 3=CTR, 4=CBC decrypt, 5=CBC encrypt, 6=ECB decrypt, 7=ECB encrypt)
|-
| 30
| Interrupt enable (1=enable, 0=disable)
|-
| 31
| Start (1=enable/busy, 0=idle)
|}

When bit31 is set, this register essentially becomes locked and doesn't change when written to. However if bit26 is "set", keyslot-selection is cued to be handled when bit31 is cleared.

Clearing bit31 while the AES engine is doing crypto will result in the AES engine stopping crypto, once it finishes processing the current block.

Read/Write FIFO counts and the MAC status can never be set by writing to AES_CNT, they are read-only.

Changing the input word order triggers the key/keyX/keyY FIFOs to be flushed.

== AES_BLKCNT ==

{| class="wikitable" border="1"
! Bit
! Description
|-
| 16-31
| (Data length)>>4 (i.e. the number of blocks to process)
|}

== AES_WRFIFO/AES_RDFIFO ==
The AES engine can accept up to 64 bytes of input data (16 32-bit words) and can hold up to 64 bytes of output data at a time (for a total of 128 bytes of buffered data). Bits 12-13 and 14-15 in AES_CNT configure the DMA request for the relevant FIFO (see above).

The input data for the AES crypto operation is written to AES_WRFIFO, the output data is read from AES_RDFIFO.

Reading from AES_RDFIFO when there's no data available in the RDFIFO will result in reading the last word that was in the RDFIFO.

When triggering either RDFIFO or WRFIFO to be flushed, the AES Engine does not clear either buffer.

Word order and endianness can be changed between each read/write to these FIFOs. However changing the word order when writing to WRFIFO can cause the word to be written outside the current block, leaving uninitialized data in its place. Attempts to change endianness or word order are not honored when reading from RDFIFO when no more data is available.

== AES_KEYCNT ==
{| class="wikitable" border="1"
! Bit
! Description
|-
| 5-0
| Keyslot
|-
| 6
| Hardware key-generator type: 0 = 3DS, 1 = DSi.
|-
| 7
| This normally has value 1 written here when updating keys. 0 = disable key FIFO flush, 1 = enable key FIFO flush.
|}

Bit6 is only used when keyslots >=4 are used, value1 has the same affect as doing key-init with the TWL keyslots. Bit6 is only checked when a keyY was completely written, for when the final-normalkey needs updated via the key-generator. Changing bit6 has no affect on the generated normalkey when writing to this bit immediately after writing the last keyY word.

== AES_CTR ==
This register specifies the counter (CTR mode), nonce (CCM mode) or the initialization vector (CBC mode) depending on the mode of operation.
For CBC and CTR mode this register takes up the full 16 bytes, but for CCM mode the nonce is only the first 12 bytes.
The AES engine will automatically increment the counter up to the maximum BLKCNT, after which point it must be manually incremented and set again.

== AES_MAC ==
This register specifies the message authentication code (MAC) for use in CCM mode.

== AES_KEY0/1/2/3 ==
{| class="wikitable" border="1"
! Byte
! Description
|-
| 0-15
| Normalkey
|-
| 16-31
| KeyX
|-
| 32-47
| KeyY
|-}

These registers are the same as they were on TWL, and are likely preserved for compatibility reasons. The keyslot is updated immediately after *any* data(u8/u32/...) is written here, which was used on DSi to [[3DS_System_Flaws|break]] the key-generator.

== Endianness and word order ==
When writing to the AES_CTR, AES_MAC or AES_KEY0/1/2/3 register, the hardware will process the written data according to the current input endianness specified in AES_CNT. However, the current specified input word order will not be honored for this register, and always defaults to reversed word order. Therefore, for normal word order, the reversal must be carried out manually if required.

== Keyslot ranges ==
This is approximately a table of what is set by bootrom before booting into FIRM. Often it appears that keyslots in groups of 4 have the same keyX, and sometimes also same keyY set.

{| class="wikitable" border="1"
! Keyslot
! Name
! KeyX
! KeyY/Normal-key
! Console unique.
|-
| 0x00-0x03
| TWL keys.
| Probably unset.
| Probably unset.
| -
|-
| 0x04-0x07
| NAND partition keys.
| Same for all.
| Different for all.
| style="background: green" | Yes
|-
| 0x08-0x0B
| See below.
| Same for all.
| Different for all.
| style="background: green" | Yes
|-
| 0x0C-0x0F
| SSL cert key.
| Same for all.
| Same for all.
| style="background: red" | No
|-
| 0x10-0x17
| -
| Not set.
| Not set.
| -
|-
| 0x18-0x1B
| Never used.
| Same for all.
| Same for all.
| style="background: green" | Yes
|-
| 0x1C-0x1F
| Never used.
| Same for all.
| Same for all.
| style="background: green" | Yes
|-
| 0x20-0x23
| Never used.
| Same for all.
| Same for all.
| style="background: orange" | Normalkey is not. keyX is. keyY unknown.
|-
| 0x24
| Never used.
| Individually set.
| Individually set.
| style="background: orange" | Normalkey is not. keyX is. keyY unknown.
|-
| 0x25-0x27
| -
| Not set.
| Not set.
| -
|-
| 0x28-0x2B
| Never used.
| Individually set.
| Individually set.
| style="background: orange" | Normalkey is not. keyX is. keyY unknown.
|-
| 0x2C-0x2F
| Various uniques.
| Same for all.
| Same for all, probably.
| style="background: red" | No
|-
| 0x30-0x33
| Various uniques.
| Same for all.
| Same for all, probably.
| style="background: red" | No
|-
| 0x34-0x37
| Various uniques.
| Same for all.
| Same for all, probably.
| style="background: red" | No
|-
| 0x38-0x3B
| Various uniques.
| Same for all.
| Different for all.
| style="background: red" | No
|-
| 0x3C-0x3F
| Various uniques.
| Individually set.
| Individually set.
| style="background: red" | No
|}

Keyslot pairs (0x24, 0x28) and (0x38, 0x3C) shares the same normal-key, while at the same time having different keyX's. This suggests they were set to same normal-key by bootrom.

== Keyslots ==
There are 0x40 keyslots, each of which stores three keys called keyX, keyY and normalkey. All keys can be set explicitly, but the normalkey can optionally be generated using a hardware key generator instead (see [[#Hardware_key_generator|below]]). There is no way to read the contents of a keyslot.

{| class="wikitable" border="1"
! Keyslot
! Description
! KeyX set by
! KeyY set by
! Normal-key
! Old3DS
|-
| 0x00-0x03
| TWL keys.
| NATIVE_FIRM hard-boot.
| NATIVE_FIRM hard-boot.
| -
| Yes
|-
| 0x04..0x07
| [[Flash_Filesystem|NAND]] partition keys.

Keyslot is determined by [[NCSD]] partition FS type and encryption type.
The New3DS Process9 sets the keyY for keyslot 0x05 (New3DS CTRNAND) to a key from .(ro)data. Its keyX is console-unique and set by the bootloader.
| Bootrom.
| Bootrom.
| -
| Yes
|-
| 0x0A
| DSiWare export key.

Used for encrypting the all-zero 0x10-byte block in the [[DSiWare_Exports|DSiWare_Exports]] header. Console-unique.
| See above keyslot info.
| See above keyslot info.
| -
| Yes
|-
| 0x0B
| This is console-unique. This keyslot is used for the NAND [[Title_Database|dbs]] images AESMACs, and the [[Nand/private/movable.sed]] AESMAC(when used).
| See above keyslot info.
| See above keyslot info.
| -
| Yes
|-
| 0x0D
| SSL-certificate key.

See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].
| -
| -
| Bootrom.
| Yes
|-
| 0x11
| Temporary keyslot.

Used by FIRM for general normal-key crypto. Also used by the New3DS [[FIRM]] arm9 binary loader.
| Arm9Loader.
| Arm9Loader.
| NATIVE_FIRM.
| Yes
|-
| 0x14
| Starting with [[5.0.0-11]], NATIVE_FIRM Process9 now sets the keyY for this to the same one it uses for initializing 3 of the keyslots' keyYs from [[PSPXI:EncryptDecryptAes|here]].
| Bootrom.
| NATIVE_FIRM boot.
| -
| Yes
|-
| 0x15
| Used/initialized by the New3DS arm9 binary loader, see [[FIRM|here]].
| Arm9Loader.
| Arm9Loader.
| See previous info for this keyslot.
| No
|-
| 0x16
| Used/initialized by the New3DS arm9 binary loader starting with [[9.5.0-22|9.5.0-X]], see [[FIRM|here]].
| Arm9Loader.
| Arm9Loader.
| See previous info for this keyslot.
| No
|-
| 0x18..0x1F
| These are the New3DS keyslots, where the keyX is generated with keyslot 0x11 by the New3DS arm9 binary [[FIRM|loader]]. As of [[FIRM]] [[9.6.0-24|9.6.0-X]] keyslots 0x1C..0x1F are not yet used by Process9.
| Arm9Loader.
| NATIVE_FIRM / see previous info for these keyslots.
| See previous info for these keyslots.
| No
|-
| 0x18
| New3DS [[9.3.0-21|9.3.0-X]] [[NCCH]] key, when ncchflag[3] is 0x0A.
| Arm9Loader.
| NATIVE_FIRM
| -
| No
|-
| 0x19
| New3DS gamecard [[Savegames|savedata]] AES-MAC key.

Equivalent of keyslot 0x33, used when a [[NCSD]] flag is set to a certain value (implemented with [[9.3.0-21|9.3.0-X]]).
| Arm9Loader.
| NATIVE_FIRM
| -
| No
|-
| 0x1A
| New3DS gamecard [[Savegames|savedata]] actual key.

Equivalent of keyslot 0x37, used when a [[NCSD]] flag is set to a certain value (implemented with [[9.3.0-21|9.3.0-X]]).
| Arm9Loader.
| NATIVE_FIRM
| -
| No
|-
| 0x1B
| New3DS [[9.6.0-24|9.6.0-X]] [[NCCH]] key, when ncchflag[3] is 0x0B.
| Arm9Loader.
| NATIVE_FIRM
| -
| No
|-
| 0x24
| AGB_FIRM savegame AES-MAC key.
| Bootrom.
| AGB/NATIVE_FIRM.
| -
| Yes
|-
| 0x25
| [[7.0.0-13|v7.0]] [[NCCH]] key, when ncchflag[3] is 0x01.
| NATIVE_FIRM [[Savegames#6.0.0-11_Savegame_keyY|boot]].
| NATIVE_FIRM.
| -
| Yes
|-
| 0x2C
| Original [[NCCH|NCCH]] key, when ncchflag[3] is 0x00 and always for certain NCCH sections.
| Bootrom.
| Process9.
| -
| Yes
|-
| 0x2D
| UDS local-WLAN CCMP key.

See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].
| Bootrom.
| Bootrom.
| -
| Yes
|-
| 0x2E
| Streetpass key.

See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x2F
| [[Savegames#6.0.0-11_Savegame_keyY|v6.0]] save key.
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x30
| SD/NAND AES-MAC key.

This keyY is initialized via [[Nand/private/movable.sed|movable.sed]]. This is used for calculating the AESMACs under SD [[SD_Filesystem|/Nintendo 3DS/<ID0>/<ID1>/]] (except [[DSiWare_Exports]]) and [[Flash_Filesystem|NAND]] /data/.
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x31
| APT wrap key.

See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]]. NATIVE_FIRM sets this keyY to the same one used for keyslot 0x2E.
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x32
| Unknown.

See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].
| Bootrom.
| Bootrom.
| -
| Yes
|-
| 0x33
| Gamecard [[Savegames|savedata]] AES-MAC.
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x34
| SD key.

This keyY is initialized via [[Nand/private/movable.sed|movable.sed]]. This is used for encrypting *all* SD card data under [[SD_Filesystem|/Nintendo 3DS/<ID0>/<ID1>/]].
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x35
| Movable.sed key.

This is the keyslot used for movable.sed encryption + AES-MAC with the import/export [[FSPXI:ImportIntegrityVerificationSeed|commands]].
| Bootrom.
| Bootrom.
| -
| Yes
|-
| 0x36
| Unknown. Used by friends module.

See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].
| Bootrom.
| Bootrom.
| -
| Yes
|-
| 0x37
| Gamecard [[Savegames|savedata]] actual key.
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x38
| BOSS key.

See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].
| Bootrom.
| Bootrom.
| -
| Yes
|-
| 0x39
| Download Play key, and the actual NFC key for generating retail [[Amiibo]] keys.

This keyslot is used for two different keys. Both are available via [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]]. NATIVE_FIRM sets this keyY to the same one used for keyslot 0x2E.
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x3A
| DSiWare export key.

This keyY is initialized via [[Nand/private/movable.sed|movable.sed]]. This is used for calculating the AESMACs for SD [[DSiWare_Exports]].
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x3B
| [[CTRCARD_Registers#CTRCARD_SECSEED|CTR-CARD hardware-crypto seed]] decryption key.

AES-CCM is used, the keyY, nonce and MAC are stored in the [[NCSD#Card_Info_Header|Card Info Header]].
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x3D
| Common key.

Used to decrypt title keys in [[Ticket]].
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|}

=== Updating keydata ===
The contents of the keyslot specified in AES_KEYCNT can be updated by consecutively writing four words to AES_KEYXFIFO (keyX), AES_KEYYFIFO(keyY), or AES_KEYFIFO (normalkey).

After writing to a keyslot, the keyslot must be selected again(write AES_KEYSEL + set AES_CNT bit26), even when writing to the same keyslot. Writing the last word to a key FIFO immediately after selecting a keyslot will not affect the keyslot keydata that gets used at that time, the new keydata will not get used until the keyslot gets selected again.

Writing to the key FIFOs with byte writes results in the AES engine converting the byte to a word for setting the key word, with this: word = (byteval) | (byteval<<8) | (byteval<<16) | (byteval<<24). The result is the same regardless of which FIFO register byte was written to.

The TWL keyslots 0x00-0x03 can be set directly by writing to the AES_KEY0-AES_KEY3 registers.

The key FIFOs can be written simultaneously. For example, executing the following will result in the keyX and keyY being set to all-zero(unknown for normalkey): memset(0x10009100, 0, 0x100);

Each key FIFO has a 0x10-byte tmp-buffer for storing the words written to that FIFO. Once the last word is written to a key FIFO, the filled tmp-buffer is then written to the key-data for the keyslot selected by AES_KEYCNT at the time the last word was written.

=== Hardware key generator ===
A dedicated hardware key generator can be used to generate a keyslot's normal-key from its keyX and keyY. The hardware key generator is triggered by writing the keyY, which is the only way to trigger it with the 3DS keyslots.

The algorithm for generating the normal-key from keyX and keyY is as follows, in big-endian 128-bit unsigned wraparound arithmetic:

{| class="wikitable" border="1"
! Mode
! Formula
|-
| 3DS
| NormalKey = (((KeyX ROL 2) XOR KeyY) + C1) ROR 41
|-
| DSi
| NormalKey = ((KeyX XOR KeyY) + C2) ROL 42
|}

Unless noted otherwise, all keyslots on retail units use the hardware key generator.

=== FIRM-launch key clearing ===
Starting with [[9.0.0-20]] the Process9 FIRM-launch code now "clears" the following AES keyslots, with certain keydata by writing the normal-key: 0x15 and 0x18-0x20. These are the keyslots used by the New3DS [[FIRM]] arm9bin loader(minus keyslot 0x11), the New3DS Process9 does this too.

Cdc:HID:GetData

2016-07-16T11:27:19Z

Dazzozo:

{{DISPLAYTITLE:cdc:HID:GetData}}
=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x00010000]
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x000100C0]
|-
| 1
| Result code [0xD8603BEF if no data available]
|-
| 2
| Touchscreen data
|-
| 3
| Circle pad data
|}

Cdc:HID:GetData

2016-07-16T11:20:45Z

Dazzozo:

{{DISPLAYTITLE:cdc:HID:GetData}}
=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x00010000]
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x0001????]
|-
| 1
| Result code
|-
| 2
| ??
|-
| 3
| ??
|}

Cdc:HID:GetTouchData

2016-07-16T11:20:34Z

Dazzozo: Dazzozo moved page Cdc:HID:GetTouchData to Cdc:HID:GetData

#REDIRECT [[Cdc:HID:GetData]]

Cdc:HID:GetData

2016-07-16T11:20:34Z

Dazzozo: Dazzozo moved page Cdc:HID:GetTouchData to Cdc:HID:GetData

{{DISPLAYTITLE:cdc:HID:GetTouchData}}
=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x00010000]
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x0001????]
|-
| 1
| Result code
|-
| 2
| ??
|-
| 3
| ??
|}

Codec Services

2016-07-16T11:19:47Z

Dazzozo: almost

Ticket

2016-07-09T22:28:06Z

Dazzozo:

[[Category:File formats]]
Tickets are a format used to store an encrypted titlekey (using 128-Bit AES-CBC). With 3DS, the Ticket format was updated (now v1) from Wii/DSi format (v0).

== Structure ==

All of the data in the file is represented in Big Endian.

{| class="wikitable"
| align="center" style="background:#f0f0f0;"|'''Offset'''
| align="center" style="background:#f0f0f0;"|'''Size'''
| align="center" style="background:#f0f0f0;"|'''Description'''
|-
| 0x000||Y||Signature Data
|-
| Y||0x210||Ticket Data
|}

Y denotes the total size of the "Signature Data" section and depends on the signature type.

=== Signature Data ===
The signature is of the ticket header.
{| class="wikitable"
| align="center" style="background:#f0f0f0;"|'''Offset'''
| align="center" style="background:#f0f0f0;"|'''Size'''
| align="center" style="background:#f0f0f0;"|'''Description'''
|-
| 0x0||0x4||Signature Type
|-
| 0x4 ||X||Signature
|-
| 0x4 + X|| ||Padding to align the signature data to 0x40 bytes
|}

==== Signature Type ====
{{Signature Types}}

The hash for the signature is calculated over the Ticket Data.

=== Ticket Data ===
{| class="wikitable"
| align="center" style="background:#f0f0f0;"|'''Offset'''
| align="center" style="background:#f0f0f0;"|'''Size'''
| align="center" style="background:#f0f0f0;"|'''Description'''
|-
| 0x0||0x40||Issuer
|-
| 0x40||0x3C||ECC PublicKey
|-
| 0x7C||0x1||Version (For 3DS this is always 1)
|-
| 0x7D||0x1||CaCrlVersion
|-
| 0x7E||0x1||SignerCrlVersion
|-
| 0x7F||0x10||TitleKey (normal-key encrypted using one of the common keyYs; see below)
|-
| 0x8F||0x1||Reserved
|-
| 0x90||0x8||TicketID
|-
| 0x98||0x4||ConsoleID
|-
| 0x9C||0x8||TitleID
|-
| 0xA4||0x2||Reserved
|-
| 0xA6||0x2||Ticket title version
|-
| 0xA8||0x8||Reserved
|-
| 0xB0||0x1||License Type
|-
| 0xB1||0x1||Index to the common [[AES|keyY]] used for this ticket, usually 0x1 for retail system titles; see below.
|-
| 0xB2||0x2A||Reserved
|-
| 0xDC||0x4||eShop Account ID?
|-
| 0xE0||0x1||Reserved
|-
| 0xE1||0x1||Audit
|-
| 0xE2||0x42||Reserved
|-
| 0x124||0x40||Limits
|-
| 0x164||0xAC||Content Index
|}

* For v0 of the format, see [[Talk:Ticket#Ticket_Format_0|here]]

* The Ticket Title Version is generally the same as the title version stored in the [[TMD|Title Metadata]]. Although it doesn't have to match the TMD version to be valid.

* The titlekey is decrypted by using the [[AES]] engine with the ticket common-key keyslot. The keyY is selected through an index (ticket offset 0xB1) into a plaintext array of 6 keys ("common keyYs") stored in the data section of Process9. AES-CBC mode is used where the IV is the big-endian titleID. Note that on a retail unit index0 is a retail keyY, while on a dev-unit index0 is the dev common-key which is a normal-key. (On retail for these keyYs, the hardware key-scrambler is used)

* The titlekey is used to decrypt content downloaded from the CDN using 128-bit AES-CBC with the content index (as big endian u16, padded with trailing zeroes) as the IV.

* In demos, the first u32 in the "Limits" section is 0x4, then the second u32 is the max-playcount.

== Certificate Chain ==
Tickets retrieved from CDN/SOAP have a [[Certificates|certificate]] chain appended at the end of the file. There are two certificates in this chain:

{| class="wikitable" border="1"
|-
! CERTIFICATE
! SIGNATURE TYPE
! RETAIL CERT NAME
! DEBUG CERT NAME
! DESCRIPTION
|-
| Ticket
| RSA-2048
| XS0000000c
| XS00000009
| Used to verify the Ticket signature
|-
| CA
| RSA-4096
| CA00000003
| CA00000004
| Used to verify the Ticket Certificate
|}

The CA certificate is issued by 'Root', the public key for which is stored in NATIVE_FIRM.

== Some facts==
* '''CommonETicket''' (for short, '''cetk''') is the name given to tickets for titles which are not available on the [[EShop|eShop]], like [[Title list#CTR System Titles|system titles]]. As the name suggests, they are not unique tickets, the same ticket is common to each 3ds which has installed that title. This is in contrast to tickets for eShop content, which are generated prior to initial download, and are unique to 3ds it was generated for.

* '''CETK''' can be fetched through HTTP using the link to default update server, using the title's [[TMD]] URL where "cetk" is used instead of "tmd" for the URL. The 3DS NIM module retrieves system tickets via SOAP request ''GetSystemCommonETicket'' instead of directly downloading the cetks with HTTPS. The cetks are also accessible via HTTP (even though the 3DS never accesses them like that).

Ticket

2016-07-09T22:26:15Z

Dazzozo: index not ID

[[Category:File formats]]
Tickets are a format used to store an encrypted titlekey (using 128-Bit AES-CBC). With 3DS, the Ticket format was updated (now v1) from Wii/DSi format (v0).

== Structure ==

All of the data in the file is represented in Big Endian.

{| class="wikitable"
| align="center" style="background:#f0f0f0;"|'''Offset'''
| align="center" style="background:#f0f0f0;"|'''Size'''
| align="center" style="background:#f0f0f0;"|'''Description'''
|-
| 0x000||Y||Signature Data
|-
| Y||0x210||Ticket Data
|}

Y denotes the total size of the "Signature Data" section and depends on the signature type.

=== Signature Data ===
The signature is of the ticket header.
{| class="wikitable"
| align="center" style="background:#f0f0f0;"|'''Offset'''
| align="center" style="background:#f0f0f0;"|'''Size'''
| align="center" style="background:#f0f0f0;"|'''Description'''
|-
| 0x0||0x4||Signature Type
|-
| 0x4 ||X||Signature
|-
| 0x4 + X|| ||Padding to align the signature data to 0x40 bytes
|}

==== Signature Type ====
{{Signature Types}}

The hash for the signature is calculated over the Ticket Data.

=== Ticket Data ===
{| class="wikitable"
| align="center" style="background:#f0f0f0;"|'''Offset'''
| align="center" style="background:#f0f0f0;"|'''Size'''
| align="center" style="background:#f0f0f0;"|'''Description'''
|-
| 0x0||0x40||Issuer
|-
| 0x40||0x3C||ECC PublicKey
|-
| 0x7C||0x1||Version (For 3DS this is always 1)
|-
| 0x7D||0x1||CaCrlVersion
|-
| 0x7E||0x1||SignerCrlVersion
|-
| 0x7F||0x10||TitleKey (normal-key encrypted using one of the common keyYs; see below)
|-
| 0x8F||0x1||Reserved
|-
| 0x90||0x8||TicketID
|-
| 0x98||0x4||ConsoleID
|-
| 0x9C||0x8||TitleID
|-
| 0xA4||0x2||Reserved
|-
| 0xA6||0x2||Ticket title version
|-
| 0xA8||0x8||Reserved
|-
| 0xB0||0x1||License Type
|-
| 0xB1||0x1||Index to the common [[AES|keyY]] used for this ticket, usually 0x1 for retail system titles; see below.
|-
| 0xB2||0x2A||Reserved
|-
| 0xDC||0x4||eShop Account ID?
|-
| 0xE0||0x1||Reserved
|-
| 0xE1||0x1||Audit
|-
| 0xE2||0x42||Reserved
|-
| 0x124||0x40||Limits
|-
| 0x164||0xAC||Content Index
|}

* For v0 of the format, see [[Talk:Ticket#Ticket_Format_0|here]]

* The Ticket Title Version is generally the same as the title version stored in the [[TMD|Title Metadata]]. Although it doesn't have to match the TMD version to be valid.

* The titlekey is decrypted by using the [[AES]] engine with the ticket common-key keyslot. The keyY is selected through an index (ticket offset 0xB1) into a plaintext array of 6 keys ("common keyYs") stored in the data section of Process9. AES-CBC mode is used where the IV is the big-endian titleID. Note that on a retail unit index0 is a retail keyY, while on a dev-unit index0 is the dev common-key which is a normal-key. (On retail for these keyYs, the hardware key-scrambler is used)

* The titlekey is used to decrypt content downloaded from the CDN using 128-bit AES-CBC with the content index (padded with trailing zeroes) as the IV.

* In demos, the first u32 in the "Limits" section is 0x4, then the second u32 is the max-playcount.

== Certificate Chain ==
Tickets retrieved from CDN/SOAP have a [[Certificates|certificate]] chain appended at the end of the file. There are two certificates in this chain:

{| class="wikitable" border="1"
|-
! CERTIFICATE
! SIGNATURE TYPE
! RETAIL CERT NAME
! DEBUG CERT NAME
! DESCRIPTION
|-
| Ticket
| RSA-2048
| XS0000000c
| XS00000009
| Used to verify the Ticket signature
|-
| CA
| RSA-4096
| CA00000003
| CA00000004
| Used to verify the Ticket Certificate
|}

The CA certificate is issued by 'Root', the public key for which is stored in NATIVE_FIRM.

== Some facts==
* '''CommonETicket''' (for short, '''cetk''') is the name given to tickets for titles which are not available on the [[EShop|eShop]], like [[Title list#CTR System Titles|system titles]]. As the name suggests, they are not unique tickets, the same ticket is common to each 3ds which has installed that title. This is in contrast to tickets for eShop content, which are generated prior to initial download, and are unique to 3ds it was generated for.

* '''CETK''' can be fetched through HTTP using the link to default update server, using the title's [[TMD]] URL where "cetk" is used instead of "tmd" for the URL. The 3DS NIM module retrieves system tickets via SOAP request ''GetSystemCommonETicket'' instead of directly downloading the cetks with HTTPS. The cetks are also accessible via HTTP (even though the 3DS never accesses them like that).

PXI Registers

2016-07-02T18:33:52Z

Dazzozo: clear up notes on sync cc profi200

= Registers =
{| class="wikitable" border="1"
! Old3DS
! Name
! Address
! Width
! Used by
|-
| style="background: green" | Yes
| [[#PXI_SYNC|PXI_SYNC]]9
| 0x10008000
| 4
|
|-
| style="background: green" | Yes
| [[#PXI_CNT|PXI_CNT]]9
| 0x10008004
| 4
|
|-
| style="background: green" | Yes
| PXI_SEND9
| 0x10008008
| 4
|
|-
| style="background: green" | Yes
| PXI_RECV9
| 0x1000800C
| 4
|
|-style="border-top: double"
| style="background: green" | Yes
| [[#PXI_SYNC|PXI_SYNC]]11
| 0x10163000
| 4
|
|-
| style="background: green" | Yes
| [[#PXI_CNT|PXI_CNT]]11
| 0x10163004
| 4
|
|-
| style="background: green" | Yes
| PXI_SEND11
| 0x10163008
| 4
|
|-
| style="background: green" | Yes
| PXI_RECV11
| 0x1016300C
| 4
|
|}

The PXI registers are similar to those on DS.

== PXI_SYNC ==
{| class="wikitable" border="1"
! Bit
! RW
! Description
|-
| 0-7
| R
| Data received from remote bits 8-15 (unrelated to SEND/RECV FIFOs)
|-
| 8-15
| R/W
| Data sent to remote bits 0-7
|-
| 23
| ?
| ?
|-
| 29
| W?
| Trigger PXI_SYNC11 IRQ (if enabled)
|-
| 30
| W?
| Trigger PXI_SYNC9 IRQ (if enabled)
|-
| 31
| RW
| PXI_SYNC IRQ enable (for local processor)
|}

This can also be accessed as 4 u8 registers.

== PXI_CNT ==
{| class="wikitable" border="1"
! Bit
! RW
! Description
|-
| 0
| R
| Send Fifo Empty Status (0=Not Empty, 1=Empty)
|-
| 1
| R
| Send Fifo Full Status (0=Not Full, 1=Full)
|-
| 2
| R/W
| Send Fifo Empty IRQ (0=Disable, 1=Enable)
|-
| 3
| W
| Send Fifo Clear (0=Nothing, 1=Flush Send Fifo)
|-
| 8
| R
| Receive Fifo Empty (0=Not Empty, 1=Empty)
|-
| 9
| R
| Receive Fifo Full (0=Not Full, 1=Full)
|-
| 10
| R/W
| Receive Fifo Not Empty IRQ (0=Disable, 1=Enable)
|-
| 14
| R/W
| Error, Read Empty/Send Full (0=No Error, 1=Error/Acknowledge)
|-
| 15
| R/W
| Enable Send/Receive Fifo (0=Disable, 1=Enable)
|}

HID Shared Memory

2016-07-02T14:12:24Z

Dazzozo:

This page describes the format of the [[HID_Services|HID]] shared memory.

The data for each of the below entries(PAD state, circle-pad, touch-screen, etc) is originally written by the HID module at different times per frame.

size: 0x2b0 (System-version v4.4 - [[9.0.0-20]])

=Offset 0x0=
{| class="wikitable" border="1"
|-
! Relative offset
! Size
! Description
|-
| 0x0
| 0x8
| [[SVC|svcGetSystemTick]] tick-count output, for when HID module updates entry index0 in the below array.
|-
| 0x8
| 0x8
| Before the above tick-count field is updated, that value is copied into this field. Therefore, this contains the tick-count for the previous time that entry index0 in the below array was updated by HID module.
|-
| 0x10
| 0x4
| Index in the following array which was last updated by HID module.
|-
| 0x1C
| 0x4
| Current [[PAD]] state.
|-
| 0x20
| 0x4
| Raw circle-pad info.
|-
| 0x28
| 0x80
| Array of 8 entries, where each entry(see below) is 0x10-bytes.
|}

HID module first updates index0, then index1, and so on. When updating the array when the index is already 7, the index is reset to 0.

==PAD State==
{| class="wikitable" border="1"
|-
! Bit
! Description
|-
| 0
| A
|-
| 1
| B
|-
| 2
| Select
|-
| 3
| Start
|-
| 4
| Right
|-
| 5
| Left
|-
| 6
| Up
|-
| 7
| Down
|-
| 8
| R
|-
| 9
| L
|-
| 10
| X
|-
| 11
| Y
|-
| 12
| ?
|-
| 13
| ?
|-
| 28
| Circle pad right (X >= 41)
|-
| 29
| Circle pad left (X <= -41)
|-
| 30
| Circle pad up (Y >= 41)
|-
| 31
| Circle pad down (Y <= -41)
|}

Bit set = button pressed, bit clear = button not pressed. Bit28-31 only apply to the PAD fields in the array entries. Bit28-31 are set by HID module depending on data from a codec command, these are not included with the [[PAD]] register itself. Likewise for Bit12-13, except these are set depending on data from a GPIO command, and are likely used with the sharedmem PAD-state field too(this was originally implemented in an old HID module version / initial module version).

==Entry format==
{| class="wikitable" border="1"
|-
! Relative offset
! Size
! Description
|-
| 0x0
| 0x4
| Current PAD state.
|-
| 0x4
| 0x4
| PAD state for buttons which were pressed(bitmasks which changed from value 0 to value 1) since the last HID update.
|-
| 0x8
| 0x4
| PAD state for buttons which were released(bitmasks which changed from value 1 to value 0) since the last HID update.
|-
| 0xC
| 0x4
| This stores circle-pad info: the low s16 is the X coordinate, the high s16 is the Y coordinate. The circle-pad center is approximately 0 for these fields. The range for these fields is approximately: -0x9C(bottom/left) - 0x9C(top/right).
|}

=Offset 0xA8=
{| class="wikitable" border="1"
|-
! Relative offset
! Size
! Description
|-
| 0x0
| 0x8
| [[SVC|svcGetSystemTick]] tick-count output, for when HID module updates entry index0 in the below array.
|-
| 0x8
| 0x8
| Before the above tick-count field is updated, that value is copied into this field. Therefore, this contains the tick-count for the previous time that entry index0 in the below array was updated by HID module.
|-
| 0x10
| 0x4
| Index in the following array which was last updated by HID module.
|-
| 0x18
| 0x8
| Touch-screen entry, which contains the raw coordinate data prior to being converted to pixel coordinates.
|-
| 0x20
| 0x40
| 8 Touch-screen entries, containing pixel coordinates.
|}

This 0x60-byte region stores state for touch-screen related info. Each touch-screen entry is all-zero when the touch-screen is not being touched.

HID module first updates index0, then index1, and so on. When updating the array when the index is already 7, the index is reset to 0.

==Entry format==
{| class="wikitable" border="1"
|-
! Relative offset
! Size
! Description
|-
| 0x0
| 0x2
| X coordinate.
|-
|-
| 0x2
| 0x2
| Y coordinate.
|-
|-
| 0x4
| 0x4
| The u8 at +0 here is 0x0 when this entry doesn't contain any actual data, value 0x1 indicates that this entry contains actual data.
|}

=Offset 0x108=
{| class="wikitable" border="1"
|-
! Relative offset
! Size
! Description
|-
| 0x0
| 0x8
| [[SVC|svcGetSystemTick]] tick-count output, for when HID module updates entry index0 in the below array.
|-
| 0x8
| 0x8
| Before the above tick-count field is updated, that value is copied into this field. Therefore, this contains the tick-count for the previous time that entry index0 in the below array was updated by HID module.
|-
| 0x10
| 0x4
| Index in the following array which was last updated by HID module.
|-
| 0x18
| 0x6
| Current accelerometer state entry, contains the raw accelerometer output data.
|-
| 0x20
| 0x30
| Array containing 8 accelerometer entries. Each entry when updated contains accelerometer data converted from the above entry.
|}

The size of this region is 0x50-bytes. This contains the accelerometer state. The data stored under these entries is loaded from [[MCU|MCUHID]] service commands.

HID module first updates index0, then index1, and so on. When updating the array when the index is already 7, the index is reset to 0.

==Entry format==
{| class="wikitable" border="1"
|-
! Relative offset
! Size
! Description
|-
| 0x0
| 0x2
| s16. X?
|-
| 0x2
| 0x2
| s16. Y?
|-
|-
| 0x4
| 0x2
| s16. Z?
|}

=Offset 0x158=
{| class="wikitable" border="1"
|-
! Relative offset
! Size
! Description
|-
| 0x0
| 0x8
| [[SVC|svcGetSystemTick]] tick-count output, for when HID module updates entry index0 in the below array.
|-
| 0x8
| 0x8
| Before the above tick-count field is updated, that value is copied into this field. Therefore, this contains the tick-count for the previous time that entry index0 in the below array was updated by HID module.
|-
| 0x10
| 0x4
| Index in the following array which was last updated by HID module.
|-
| 0x18
| 0x6
| Current gyroscope state entry.
|-
| 0x20
| 0xC0
| Array containing 32 gyroscrope entries.
|}

The size of this region is 0xE0-bytes. Initially this contains 0xFF/0x00 bytes. This contains the gyroscope state. The [[I2C]] gyroscope device is used for this.

HID module first updates index0, then index1, and so on. When updating the array when the index is already 31, the index is reset to 0.

==Entry format==
{| class="wikitable" border="1"
|-
! Relative offset
! Size
! Description
|-
| 0x0
| 0x2
| s16 X/roll(This the raw byte-swapped data from I2C, for the entry at +0x18 and the array entries).
|-
| 0x2
| 0x2
| Entry at +0x18: s16 Y/pitch. Array entries: s16 Z/yaw.
|-
|-
| 0x4
| 0x2
| Entry at +0x18: s16 Z/yaw. Array entries: s16 Y/pitch, from the raw byte-swapped I2C data.
|}

=Offset 0x238=
{| class="wikitable" border="1"
|-
! Relative offset
! Size
! Description
|-
| 0x0
| 0x8
| [[SVC|svcGetSystemTick]] tick-count output, for when HID module updates entry index0 in the below array.
|-
| 0x8
| 0x8
| Before the above tick-count field is updated, that value is copied into this field. Therefore, this contains the tick-count for the previous time that entry index0 in the below array was updated by HID module.
|-
| 0x10
| 0x4
| Index in the following array which was last updated by HID module.
|-
| 0x18
| 0x60
| Array containing 8 entries, see below.
|}

The size of this region is 0x78-bytes. Initially this contains 0xFF/0x00 bytes. The data stored under these entries is for the DebugPad. [[I2C]] deviceid 12 is used for this.

This doesn't have any HID service commands for enabling/disabling this. HID module only updates this state when reading the DebugPad state from hardware via the service command was successful. Since the DebugPad hardware is not available on retail units, this sharedmem section is not updated by HID module on retail units.

HID module first updates index0, then index1, and so on. When updating the array when the index is already 7, the index is reset to 0.

==Entry format==
{| class="wikitable" border="1"
|-
! Relative offset
! Size
! Description
|-
| 0x0
| 0x2
| ?
|-
| 0x2
| 0x2
| ?
|-
| 0x4
| 0x2
| ?
|-
| 0x6
| 0x1
| ?
|-
| 0x7
| 0x1
| ?
|-
| 0x8
| 0x1
| ?
|-
| 0x9
| 0x1
| ?
|-
| 0xA
| 0x2
| Padding, not written by HID module.
|}

ARM11 Interrupts

2016-06-30T12:39:12Z

Dazzozo:

== Interrupts ==

Interrupt priority is 0-0xF

= Private Interrupts =

Each CPU core has 32 software interrupts that are private and belong to that core. These interrupts are numbers 0-0x1F for each core. The hardware interrupts are not core-specific and start at interrupt ID 0x20.

{| class="wikitable" border="1"
! IRQ
! Listener
! Description
|-
| 0-0x5
|
| MPCore software-interrupt.
|-
| 0x6
| Kernel
| MPCore software-interrupt.
|-
| 0x7
|
| MPCore software-interrupt.
|-
| 0x8
| Kernel
| MPCore software-interrupt. Used for scheduling.
|-
| 0x9-0xE
|
| MPCore software-interrupt.
|-
| 0xF
| dmnt/debugger
| MPCore software-interrupt. Used to abstract FIQ (debug).
|-
| 0x1D
| Kernel
| MPCore timer.
|-
| 0x1E
| Kernel
| MPCore watchdog.
|}

= Hardware Interrupts =

There are 0x60 hardware interrupts starting at 0x20 and continuing up to 0x7F. These are not private and are accessible from any core.

{| class="wikitable" border="1"
! IRQ
! Listener
! Description
|-
| 0x28
| gsp, TwlBg
| PSC0?
|-
| 0x29
| gsp, TwlBg
| PSC1?
|-
| 0x2A
| gsp, TwlBg
| PDC0?
|-
| 0x2B
| gsp, TwlBg
| PDC1?
|-
| 0x2C
| gsp, TwlBg
| PPF?
|-
| 0x2D
| gsp, TwlBg
| ?
|-
| 0x30
| Kernel
| ?
|-
| 0x39
| Kernel
| DMA
|-
| 0x3A
| Kernel
| DMA
|-
| 0x3B
| Kernel
| DMA
|-
| 0x40
| nwm
| WIFI SDIO Controller @ 0x10122000
|-
| 0x41
| nwm
| ?
|-
| 0x42
| nwm_dev?
| WIFI SDIO Controller @ 0x10100000
|-
| 0x45
| mvd (New3DS)
| ?
|-
| 0x46
| mvd (New3DS)
| ?
|-
| 0x48
| camera
| ?
|-
| 0x49
| camera
| ?
|-
| 0x4A
| dsp
| ?
|-
| 0x4B
| camera
| Y2R Conversion Finished
|-
| 0x4C
| TwlBg
| ?
|-
| 0x4D
| TwlBg
| ?
|-
| 0x4E
| mvd (New3DS)
| ?
|-
| 0x4F
| mvd (New3DS)
| ?
|-
| 0x50
| pxi, TwlBg
| Sync
|-
| 0x51
| pxi, TwlBg
| ?
|-
| 0x52
| pxi, TwlBg
| Send Fifo Empty
|-
| 0x53
| pxi, TwlBg
| Receive Fifo Not Empty
|-
| 0x54
| i2c, TwlBg
| ?
|-
| 0x55
| i2c, TwlBg
| ?
|-
| 0x56
| spi, TwlBg
| ?
|-
| 0x57
| spi, TwlBg
| ?
|-
| 0x58
| Kernel
| PDN
|-
| 0x59
| TwlBg
| ?
|-
| 0x5A
| mic
| ?
|-
| 0x5C
| i2c, TwlBg
| ?
|-
| 0x60
| gpio, TwlBg
| Asserted when shell is opened?
|-
| 0x62
| gpio, TwlBg
| Asserted when shell is closed?
|-
| 0x63
| gpio, TwlBg
| Touchscreen
|-
| 0x64
| gpio, TwlBg
| Headphone jack plugged in/out
|-
| 0x66
| gpio, TwlBg
| ?
|-
| 0x68
| gpio, TwlBg
| IR?
|-
| 0x69
| gpio, TwlBg
| ?
|-
| 0x6A
| gpio, TwlBg
| ?
|-
| 0x6B
| gpio, TwlBg
| ?
|-
| 0x6C
| gpio, TwlBg
| ?
|-
| 0x6D
| gpio, TwlBg
| ?
|-
| 0x6E
| gpio, TwlBg
| ?
|-
| 0x6F
| gpio, TwlBg
| ?
|-
| 0x70
| gpio, TwlBg
| ?
|-
| 0x71
| gpio, TwlBg
| MCU
|-
| 0x72
| gpio, TwlBg
| ?
|-
| 0x73
| TwlBg
| ?
|-
| 0x74
| ?
| Gamecard related
|-
| 0x75
| ?
| Gamecard inserted
|}

There are 2 tables in the ARM11 kernel: the first has 32 * 2(or 32 * 4) 8-byte entries. This table is for the private interrupts that belong to each core. The data for each interrupt can be found by doing table_base + (core_num * 0x100) + (intr_num * 8). The second table is for public hardware interrupts and the data for each interrupt can be retrieved by doing table_base + (intr_num * 8).

= InterruptData =
{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x0
| u32
| Pointer to interrupt data object for interrupt number
|-
| 0x4
| u8
| Interrupt is pending
|-
| 0x5
| u8
| Interrupt is enabled, about to execute
|-
| 0x6
| u8
| Interrupt priority
|-
| 0x7
| u8
| Unused, alignment
|}

The interrupt data pointer is a pointer to the object that handles that interrupt. The first first word in the object is a pointer to the object's vtable and the first function in the vtable is the interrupt handler for that interrupt number. When an interrupt runs, the function is passed its object in r0 and the interrupt number in r1.

= Interrupt Table (New3DS) =
(0xFFF318F4 in 10.3)

{| class="wikitable" border="1"
! Offset
! Type
! Description
|-
| 0x0
| InterruptEvent[224]
| Table of interrupt event objects for all hardware and software interrupts
|-
| 0x700
| KThread*
| Thread currently acting on the interrupt table
|-
| 0x704
| s16
| Error tracker for thread above
|-
| 0x706
| u16
| Alignment
|}

= InterruptEvent =
{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x0
| u32
| Pointer to interrupt event object
|-
| 0x4
| u32
| Interrupt flags
|}

SPI Registers

2016-06-27T16:39:46Z

Dazzozo:

= Registers =
{| class="wikitable" border="1"
! Old3DS
! Name
! Address
! Width
! Used by
|-
| style="background: green" | Yes
| [[#SPI_CNT|SPI_CNT]]0
| 0x10142000
| 2
|
|-
| style="background: green" | Yes
| SPI_DATA0
| 0x10142002
| 1
|
|-
| style="background: green" | Yes
| [[#SPI_NEW_CNT|SPI_NEW_CNT]]0
| 0x10142800
| 4
|
|-
| style="background: green" | Yes
| [[#SPI_NEW_DONE|SPI_NEW_DONE]]0
| 0x10142804
| 4
|
|-
| style="background: green" | Yes
| [[#SPI_NEW_BLKLEN|SPI_NEW_BLKLEN]]0
| 0x10142808
| 4
|
|-
| style="background: green" | Yes
| [[#SPI_NEW_FIFO|SPI_NEW_FIFO]]0
| 0x1014280C
| 4
|
|-
| style="background: green" | Yes
| [[#SPI_NEW_STATUS|SPI_NEW_STATUS]]0
| 0x10142810
| 4
|
|-style="border-top: double"
| style="background: green" | Yes
| [[#SPI_CNT|SPI_CNT]]1
| 0x10143000
| 2
|
|-
| style="background: green" | Yes
| SPI_DATA1
| 0x10143002
| 1
|
|-
| style="background: green" | Yes
| [[#SPI_NEW_CNT|SPI_NEW_CNT]]1
| 0x10143800
| 4
|
|-
| style="background: green" | Yes
| [[#SPI_NEW_DONE|SPI_NEW_DONE]]1
| 0x10143804
| 4
|
|-
| style="background: green" | Yes
| [[#SPI_NEW_BLKLEN|SPI_NEW_BLKLEN]]1
| 0x10143808
| 4
|
|-
| style="background: green" | Yes
| [[#SPI_NEW_FIFO|SPI_NEW_FIFO]]1
| 0x1014380C
| 4
|
|-
| style="background: green" | Yes
| [[#SPI_NEW_STATUS|SPI_NEW_STATUS]]1
| 0x10143810
| 4
|
|-style="border-top: double"
| style="background: green" | Yes
| [[#SPI_CNT|SPI_CNT]]2
| 0x10160000
| 2
|
|-
| style="background: green" | Yes
| SPI_DATA2
| 0x10160002
| 1
|
|-
| style="background: green" | Yes
| [[#SPI_NEW_CNT|SPI_NEW_CNT]]2
| 0x10160800
| 4
|
|-
| style="background: green" | Yes
| [[#SPI_NEW_DONE|SPI_NEW_DONE]]2
| 0x10160804
| 4
|
|-
| style="background: green" | Yes
| [[#SPI_NEW_BLKLEN|SPI_NEW_BLKLEN]]2
| 0x10160808
| 4
|
|-
| style="background: green" | Yes
| [[#SPI_NEW_FIFO|SPI_NEW_FIFO]]2
| 0x1016080C
| 4
|
|-
| style="background: green" | Yes
| [[#SPI_NEW_STATUS|SPI_NEW_STATUS]]2
| 0x10160810
| 4
|
|}

== SPI_CNT ==
This is the old NDS/DSi SPI interface.

{| class="wikitable" border="1"
! Bits
! Name
|-
| 0-1
| Baudrate (0=4MHz, 1=2MHz, 2=1MHz, 3=512KHz)
|-
| 2-6
| Not used (Zero)
|-
| 7
| Busy Flag (0=Ready, 1=Busy) (presumably Read-only)
|-
| 8-9
| Device Select (0=Powerman., 1=Firmware, 2=Touchscreen)
|-
| 10
| Transfer Size (0=8bit/Normal, 1=16bit/Bugged)
|-
| 11
| Chipselect Hold (0=Deselect after transfer, 1=Keep selected)
|-
| 12-13
| Not used (Zero)
|-
| 14
| Interrupt Request (0=Disable, 1=Enable)
|-
| 15
| SPI Bus Enable (0=Disable, 1=Enable)
|}

== SPI_NEW_CNT ==
This is an alternative faster interface introduced with the 3DS.

{| class="wikitable" border="1"
! Bits
! Name
|-
| 0-5
| Baudrate?
|-
| 6-7
| Device Select
|-
| 13
| Transfer Direction? (0=Incoming, 1=Outgoing)
|-
| 15
| Busy/enable
|}

{| class="wikitable" border="1"
! Device id
! Device select bits
|-
| 0, 3, >=6
| 0
|-
| 1, 4
| 1
|-
| 2, 5
| 2
|}

{| class="wikitable" border="1"
! Device id
! Used baudrate
|-
| 3
| 5
|-
| 0
| 2
|}

== SPI_NEW_DONE ==
When the transfer is finished, a 0 has to be written to this register.

==SPI_NEW_BLKLEN==
The number of bytes to be sent/read is written to this register.

==SPI_NEW_FIFO==
32-bit FIFO for reading/writing the SPI payload.

==SPI_NEW_STATUS==
Bit0: FIFO busy.

Config Savegame

2016-06-15T09:34:56Z

Dazzozo: *fart noise*

This page describes the format of the [[Config_Services|Cfg]] [[System_SaveData|NAND]] savegame. These blocks can be accessed with the Cfg service commands.

==Structure of save-file "/config"==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x2
| Total entries
|-
| 0x2
| 0x2
| Data entries offset
|-
| 0x4
| 0x4558
| Block entries
|-
| 0x455C
|
| Data for the entries
|}

The filesize for this /config file is 0x8000-bytes.

==Configuration block entry ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| BlkID
|-
| 0x4
| 0x4
| Offset to the data for this block when size is >4, otherwise this word is the data for this block
|-
| 0x8
| 0x2
| Size
|-
| 0xA
| 0x2
| Flags
|}

==Configuration blocks==
{| class="wikitable" border="1"
|-
! BlkID
! Size
! Flags
! Description
|-
| 0x00000000
| 0x2
| ?
| Config savegame version?
|-
| 0x00030001
| 0x8
| 0xE
| User time offset (read by CECD)
|-
| 0x00040000
| 0x10
| 0x8
| ? (read by HID)
|-
| 0x00040001
| 0x1C
| 0x8
| ? (read by HID)
|-
| 0x00040002
| 0x12
| 0x8
| ? (read by HID)
|-
| 0x00040003
| 0xC
| 0x8
| ? (read by HID)
|-
| 0x00050001
| 0x2
| 0x8
| ? (read by GSP)
|-
| 0x00050002
| 0x38
| 0x8
| ? (read by GSP)
|-
| 0x00050003
| 0x20
| 0x8
| ? (read by GSP)
|-
| 0x00050005
| 0x20
|?
| Stereo camera settings?
|-
| 0x00050006
| 0x2
| 0x8
| ?
|-
| 0x00070001
| 0x1
|?
| Sound output mode (mono/stereo/surround)?
|-
| 0x00080000
| 0xC00
| 0x2?
| WiFi configuration slot 0
|-
| 0x00080001
| 0xC00
| 0x2?
| WiFi configuration slot 1
|-
| 0x00080002
| 0xC00
| 0x2?
| WiFi configuration slot 2
|-
| 0x00090000
| 0x8
| 0x2?
| This contains a u64 ID, used by processes using [[NWMUDS:InitializeWithVersion]]. The first word is the same as [[CfgS:GetLocalFriendCodeSeed|LocalFriendCodeSeed]], while the latter is a separate word.
|-
| 0x00090001
| 0x8
| 0xE
| This console-unique u64 used by [[Cfg:GenHashConsoleUnique|GenHashConsoleUnique]] is generated with the LocalFriendCodeSeed and with random data
|-
| 0x000A0000
| 0x1C
| 0xE
| Username
|-
| 0x000A0001
| 0x2
| 0xE
| Birthday (u8 month, u8 day)
|-
| 0x000A0002
| 0x1
| 0xA
| Language

|-
| 0x000B0000
| 0x4
| 0x8
| CountryInfo
|-
| 0x000B0001
| 0x800
| 0x2?
| Country name in UTF-16, every 0x80-bytes is an entry for each language, in the order of the Language table below (not all entries are set)
|-
| 0x000B0002
| 0x800
| 0x2?
| State name in UTF-16, every 0x80-bytes is an entry for each language
|-
| 0x000B0003
| 0x4
| 0xE
| Pair of 16-bit values, meaning unknown but related to address (ZIP code?)

|-
| 0x000C0000
| 0xC0
| 0x8
| Restricted photo exchange data, and other info
|-
| 0x000C0001
| 0x14
|?
| Same as above?
|-
| 0x000D0000
| 0x4
| 0x2
| u16 at offset 0x0: [[SMDH#EULA_Version|EULA Version]] which was agreed to.
|-
| 0x000F0000
| 0x10
| 0x8?
| Unknown, used by [[NS]] on dev-units for [[SVC|svcKernelSetState]], where Type is 6. During NS startup on debug-units, NS compares the u32 from +8 in this config-block with the [[Configuration_Memory#APPMEMTYPE|APPMEMTYPE]]. When those don't match NS starts a FIRM-launch (with the same FIRM titleID as the currently running one) to boot into a FIRM with the APPMEMTYPE value from this config-block
|-
| 0x000F0004
| 0x4
| 0x8?
| The first u8 is the System-Model [[Cfg:GetSystemModel|value]], the last 3-bytes are unknown
|-
| 0x00110000
| 0x4
|?
| The low u16 indicates whether the system setup is required, such as when the system is booted for the first time or after doing a [[System Settings|System Format]]: 0 = setup required, non-zero = no setup required
|-
| 0x00110001
| 0x8
| 0xA?
| TitleID of the menu to launch, used by [[NS]] on dev units (this block can be edited on dev units with [[3DS Development Unit Software#Config|Config]])
|-
| 0x00120000
| 0x8
| 0x8
| ? (read by HID)
|-
| 0x00130000
| 0x4
|?
| If response is 0x100 then debug mode is enabled.
|-
| 0x00160000
| 0x4
| 0x8?
| Unknown, first byte is used by config service-cmd [[Config_Services|0x00070040]]. (Unknown whether the last 3-bytes are used)
|-
| 0x00190000
| 0x1
| 0x8?
| Unknown. NFC-module checks for value1/non-value1.
|}

The developer unit TID block only exists on developer units.

===Languages===
{| class="wikitable" border="1"
|-
! ID
! Description
|-
| 0
| JP
|-
| 1
| EN
|-
| 2
| FR
|-
| 3
| DE
|-
| 4
| IT
|-
| 5
| ES
|-
| 6
| ZH
|-
| 7
| KO
|-
| 8
| NL
|-
| 9
| PT
|-
| 10
| RU
|-
| 11
| TW
|}

===CountryInfo===
{| class="wikitable" border="1"
|-
! Byte
! Description
|-
| 0
|?
|-
| 1
|?
|-
| 2
|?
|-
| 3
| Country code, same as DSi/Wii country codes. Value 0xFF is invalid.
|}

===0x000A0000 Block===
{| class="wikitable" border="1"
|-
! Byte
! Description
|-
| 0x0-0x13
| UTF-16 username, with no NULL-terminator.
|-
| 0x14-17
| Usually zero?
|-
| 0x18-0x1B
| u32 NGWord version the username was last checked with. If this value is less than the u32 stored in the NGWord CFA "romfs:/version.dat", the system then checks the username string with the bad-word list CFA again, then updates this field with the value from the CFA
|}

===LCD display config===
There seems to be some sort of LCD display configuration stored in this cfg. When using the cfg-save from an Old3DS on a New3DS without formatting the cfg first, the bottom-screen display is somewhat off(which is fixed by formatting the cfg-save).

PXI Services

2016-05-20T03:36:54Z

Dazzozo:

= PXI Services =
The 'pxi' sysmodule contains the following services:
*[[Filesystem services PXI|PxiFS0]]
*[[Filesystem services PXI|PxiFS1]]
*[[Filesystem services PXI|PxiFSB]]
*[[Filesystem services PXI|PxiFSR]]
*[[Process Manager Services PXI|PxiPM]]
*[[Application Manager Services PXI|pxi:am9]]
*[[Gamecard Services PXI|pxi:dev]]
*[[Development Services PXI|pxi:mc]]
*[[Process Services PXI|pxi:ps9]]

Each of these services has up to 4 static IPC buffers of size 0x1000. When any of these service ports are sync:d, the IPC cmdbuf (TLS+0x80+) is sent over [[PXI_Registers|PXI]] to the ARM9.

Each PXI service can only have one session open for it at a time.

= Protocol =
The communication protocol for normal PXI commands is documented below. The size of cmd_buf is calculated from the cmd_hdr. With newer FIRM the total size for command header + buffer must be at most 0x40 words, otherwise Process9 will panic.

Each pxi_id corresponds to a Process9 PXI command-handler(called from threads) which handles the actual command processing. With newer FIRM the pxi_id must be in a certain range.

There's a dedicated Process9 thread for receiving data from PXI(in newer FIRM this is the main-thread), once it finishes receiving a request it copies the cmd_buf into a buffer for the corresponding pxi_id then signals an event so that the cmd-handler thread can process it. Once a cmd-handler thread finishes processing a command, the thread itself then sends the response over PXI. This means that multiple commands for different pxiIDs can be be handled at the same time, even when one cmd-handler completely hangs/etc for example.

Process9 will execute [[SVC|svcBreak]] when it receives a PXI command with a pxi_id where another command with that same pxi_id is still being processed by the command-handler(this won't happen with commands sent by the ARM11 PXI-module, since it waits for the command reply before sending another command request for that same pxi_id).

==Request==
A11->A9 (u32) pxi_id
A11->A9 (u32) cmd_hdr
A11->A9 (u32[]) cmd_buf

==Response==
A9->A11 (u32) pxi_id
A9->A11 (u32) cmd_hdr
A9->A11 (u32[]) cmd_buf

==pxi_id==
0 = pxi_mc
1 = pxi_fs
2 = pxi_fs
3 = pxi_fs
4 = pxi_fs
5 = pxi_pm
6 = pxi_dev
7 = pxi_am
8 = pxi_ps
9 = pxi_11

System Settings

2016-05-19T00:09:59Z

Dazzozo: /* Parental Controls Reset */

'''System Settings''' allows you to manage various settings, use [[System Transfer]], and use Data Management.

All applications(CTR/TWL) launched by System Settings are launched via [[NS|APT:PrepareToDoApplicationJump/APT:DoApplicationJump]], such as DS INTERNET and [[System Transfer]].

== Accessible services ==

{| class="wikitable" border="1"
|-
! Service
! Last seen on version
|-
| [[Filesystem_services#Filesystem_service_.22fs:USER.22|fs:USER]]
| [[9.0.0-20|v8202]]
|-
| [[GSP_Services|gsp:Gpu]]
| [[9.0.0-20|v8202]]
|-
| [[NDM_Services|ndm:u]]
| [[9.0.0-20|v8202]]
|-
| [[NS#.22APT:A.22_Service|APT:A]]
| [[9.0.0-20|v8202]]
|-
| [[AC_Services|ac:i]]
| [[9.0.0-20|v8202]]
|-
| [[ACT_Services|act:a]]
| [[9.0.0-20|v8202]]
|-
| [[Application_Manager_Services#Application_Manager_services|am:sys]]
| [[9.0.0-20|v8202]]
|-
| [[BOSS_Services|boss:P]]
| [[9.0.0-20|v8202]]
|-
| [[Camera_Services#cam:s_.28PORT_CAL.29|cam:s]]
| [[9.0.0-20|v8202]]
|-
| [[CECD_Services|cecd:s]]
| [[9.0.0-20|v8202]]
|-
| [[Config_Services#Config_NVRAM_service_.22cfg:nor.22|cfg:nor]]
| [[9.0.0-20|v8202]]
|-
| [[DSP_Services|dsp::DSP]]
| [[9.0.0-20|v8202]]
|-
| [[Friend_Services|frd:a]]
| [[9.0.0-20|v8202]]
|-
| [[GSP_Services|gsp::Lcd]]
| [[9.0.0-20|v8202]]
|-
| [[HTTP_Services|http:C]]
| [[9.0.0-20|v8202]]
|-
| [[MIC_Services|mic:u]]
| [[9.0.0-20|v8202]]
|-
| [[News_Services#News_service_.22news:s.22|news:s]]
| [[9.0.0-20|v8202]]
|-
| [[NIM_Services#NIM_user_service_.22nim:u.22|nim:u]]
| [[9.0.0-20|v8202]]
|-
| [[NS#NS_Service_.22ns:s.22|ns:s]]
| [[9.0.0-20|v8202]]
|-
| [[NWM_Services#NWM_service_.22nwm::EXT.22|nwm::EXT]]
| [[9.0.0-20|v8202]]
|-
| [[NWM_Services#NWM_infrastructure_service_.22nwm::INF.22|nwm::INF]]
| [[9.0.0-20|v8202]]
|-
| [[NWM_Services#NWM_socket_service_.22nwm::SOC.22|nwm::SOC]]
| [[9.0.0-20|v8202]]
|-
| [[PTM_Services#GetSystemTime_PTM_Service_.22ptm:gets.22|ptm:gets]]
| [[9.0.0-20|v8202]]
|-
| [[PTM_Services#SysMenu_PTM_Service_.22ptm:sysm.22|ptm:sysm]]
| [[9.0.0-20|v8202]]
|-
| [[Socket_Services#Socket_privileged_service_.22soc:P.22|soc:P]]
| [[9.0.0-20|v8202]]
|-
| [[Socket_Services#Socket_user_service_.22soc:U.22|soc:U]]
| [[9.0.0-20|v8202]]
|-
| [[SSL_Services|ssl:C]]
| [[9.0.0-20|v8202]]
|-
| [[Camera_Services#y2r:u|y2r:u]]
| [[9.0.0-20|v8202]]
|-
| [[QTM_Services#QTM_system_service_.22qtm:s.22|qtm:s]]
| [[9.0.0-20|v8202]]
|-
| [[Config_Services#Config_service_.22cfg:i.22|cfg:i]]
| [[9.0.0-20|v8202]]
|-
| [[HID_Services#HID_service_.22hid:SPVR.22|hid:SPVR]]
| [[9.0.0-20|v8202]]
|}

== Data Management ==

=== 3DS ===

Here you can manage 3DS extra data, and 3DSWare/"Software".

When managing 3DS Software installed to the SD Card, the [[Title Database|title.db]] is read by the core receiving [[Application Manager Services PXI|AM]] commands. From the title.db file, AM gets a list of installed titles, title sizes and the name of the ".cmd" file for each title, which is used to check the authenticity of the title data(product code, title version, and if an electronic manaual is used, is also kept for each title, in the title.db, but won't be used by the Data Management Utility). For each title listed, it checks if the title is authentic(via the .cmd file). If the title passes authentication, Data Management decrypts/reads the ICN data from the executable NCCH([[CXI]]) and displays it along with the archived title size. If a title doesn't pass authentication, a placeholder icon(light grey with a '?' in the center), name ('????????') and a size of zero are used. Deleting titles removes the title data from the title.db and import.db, and deletes the directory of the content.

=== DSiWare ===

See [[DSiWare Exports]].

== System Format ==
Most of the System Format is done with [[FS:InitializeCtrFileSystem]]. This command updates the high u64 of the keyY stored in [[Nand/private/movable.sed|movable.sed]]. Since this keyY was updated, the data stored on [[SD_Filesystem|SD]] card(sdmc/Nintendo 3DS/<ID0>/<ID1>) and the data under [[Flash_Filesystem|nand/data/<ID0>]] is rendered useless, since that data used the old keyY. Since that data is no longer usable, the system then deletes the two above SD/NAND directories.

When you first enter the System Format menu, it will check if a NNID is linked. If there's a linked-NNID, it will then display: "Are you ready to connect to the Internet to check whether data can be formatted"? Continuing will only result in connecting to wifi for checking in with Nintendo's servers, which may fail if the console is banned. Once that's done it will continue with the usual system-format messages; proceeding will result in the NNID cookie, potentially still present on NAND backups or multiboot scenarios, being invalidated until the next sign-in (at which point even old sessions will be valid again).

== System Updater ==
The system updater title is identical to the regular system settings, except only system update is accessible with this. On dev units, this title can only be launched under certain conditions.

On retail units, this title is accessible in scenarios where you have to update via the Internet to use certain 3DS software other than the home menu. i.e. using the eShop, on a system version less than the current one. When one selects "Cancel" from here on retail, the system will shutdown. [[NS]] launches SAFE_MODE_FIRM for running this title, when the [[Configuration_Memory|UPDATEFLAG]] is set during system boot.

==Exiting System Settings==
Upon exit, the system reboots instead of simply returning to home menu.

== Parental Controls Reset ==
The following refers to the functionality which generates the Parental Controls "Master Key".

{| class="wikitable" border="1"
|-
! System version, for the mset title
! Parental controls reset functionality version
! Inquiry number length
! Notes
|-
| [[1.0.0-0|1.0.0-X]] - [[6.3.0-12|6.3.0-X]]
| v0
| 8
| Mostly inherited from the Wii/DSi algorithm which used CRC-32 (0xEDB88320) with custom XOR-out (0xAAAA). 0x14C1 was added to produce the final result.

For the 3DS algorithm, only constants were changed: the polynomial was changed to 0xEDBA6320 and the addition constant became 0x1657.

The input to either function is an ASCII string of the format "%02u%02u%04u" where the parameters are month, day, and low 4 digits of the inquiry number. The low 5 decimal digits from the output u32 are then used for the master key.

Because of the date being used in the algorithm, this results in the master key only being valid on a particular day, though this is trivially defeated by setting the system time to the correct date that the key was generated on.

This had a minor refactor in [[6.0.0-11|6.0.0-X]] but is functionally identical.
|-
| [[7.0.0-13|7.0.0-X]] - [[7.1.0-16|7.1.0-X]]
| v1
| 10
|
|-
| [[7.2.0-17|7.2.0-X]] - current
| v2
| 10
| The master key is indirectly a function of the current date, and of the [[CVer#masterkey.bin|system version and region]].
|}

== ExtData ==
The ExtData [[Extdata#Filesystem|File System]] for System Settings is as follows:

root
├── icon
├── boss
└── user
├── Backup.dat
└── MsetExt.dat

{| class="wikitable" border="1"
|-
! File
! Details
! Size
! FW Introduced
! Plaintext
|-
| icon
| Stubbed. Always image 00000002.
| 0x4 Bytes
| n/a
|
|-
| MsetExt.dat
| [[DSiWare Exports]] Management
| 0x960 Bytes
| [[2.0.0-2]]
| [https://dl.dropboxusercontent.com/u/60710927/CTR/Sample/SystemSettingsExtdata/MsetExt.dat Download]
|-
| Backup.dat
| [[SD Savedata Backups]] Management
| 0xf5a0 Bytes
| [[6.0.0-11]]
| [https://dl.dropboxusercontent.com/u/60710927/CTR/Sample/SystemSettingsExtdata/Backup.dat Download]
|}

=== MsetExt.dat ===
This keeps a record for the DSiWare Exports for a maximum of 300 exports. Each record is in the format:
{| class="wikitable" border="1"
|-
! OFFSET
! SIZE
! DESCRIPTION
|-
| 0
| 4
| Game Code in Little Endian
|-
| 0x4
| 4
| Reserved
|}

All unused entries are filled with "0xff".

=== Backup.dat ===
This keeps a record for the 30 save data backup slots for [[SD Savedata Backups]]. Each entry corresponds to an individual backup slot.

Entry:
{| class="wikitable" border="1"
|-
! OFFSET
! SIZE
! DESCRIPTION
|-
| 0x000
| 8
| Reserved
|-
| 0x8
| 0x800 (0x80*16)
| 16 UTF-16 Title Strings
|-
| 0x808
| 8
| Title ID
|-
| 0x810
| 8
| Unknown
|-
| 0x818
| 8
| Total Save Data Size
|-
| 0x820
| 0x10
| Reserved
|}

System Settings

2016-05-19T00:09:18Z

Dazzozo:

'''System Settings''' allows you to manage various settings, use [[System Transfer]], and use Data Management.

All applications(CTR/TWL) launched by System Settings are launched via [[NS|APT:PrepareToDoApplicationJump/APT:DoApplicationJump]], such as DS INTERNET and [[System Transfer]].

== Accessible services ==

{| class="wikitable" border="1"
|-
! Service
! Last seen on version
|-
| [[Filesystem_services#Filesystem_service_.22fs:USER.22|fs:USER]]
| [[9.0.0-20|v8202]]
|-
| [[GSP_Services|gsp:Gpu]]
| [[9.0.0-20|v8202]]
|-
| [[NDM_Services|ndm:u]]
| [[9.0.0-20|v8202]]
|-
| [[NS#.22APT:A.22_Service|APT:A]]
| [[9.0.0-20|v8202]]
|-
| [[AC_Services|ac:i]]
| [[9.0.0-20|v8202]]
|-
| [[ACT_Services|act:a]]
| [[9.0.0-20|v8202]]
|-
| [[Application_Manager_Services#Application_Manager_services|am:sys]]
| [[9.0.0-20|v8202]]
|-
| [[BOSS_Services|boss:P]]
| [[9.0.0-20|v8202]]
|-
| [[Camera_Services#cam:s_.28PORT_CAL.29|cam:s]]
| [[9.0.0-20|v8202]]
|-
| [[CECD_Services|cecd:s]]
| [[9.0.0-20|v8202]]
|-
| [[Config_Services#Config_NVRAM_service_.22cfg:nor.22|cfg:nor]]
| [[9.0.0-20|v8202]]
|-
| [[DSP_Services|dsp::DSP]]
| [[9.0.0-20|v8202]]
|-
| [[Friend_Services|frd:a]]
| [[9.0.0-20|v8202]]
|-
| [[GSP_Services|gsp::Lcd]]
| [[9.0.0-20|v8202]]
|-
| [[HTTP_Services|http:C]]
| [[9.0.0-20|v8202]]
|-
| [[MIC_Services|mic:u]]
| [[9.0.0-20|v8202]]
|-
| [[News_Services#News_service_.22news:s.22|news:s]]
| [[9.0.0-20|v8202]]
|-
| [[NIM_Services#NIM_user_service_.22nim:u.22|nim:u]]
| [[9.0.0-20|v8202]]
|-
| [[NS#NS_Service_.22ns:s.22|ns:s]]
| [[9.0.0-20|v8202]]
|-
| [[NWM_Services#NWM_service_.22nwm::EXT.22|nwm::EXT]]
| [[9.0.0-20|v8202]]
|-
| [[NWM_Services#NWM_infrastructure_service_.22nwm::INF.22|nwm::INF]]
| [[9.0.0-20|v8202]]
|-
| [[NWM_Services#NWM_socket_service_.22nwm::SOC.22|nwm::SOC]]
| [[9.0.0-20|v8202]]
|-
| [[PTM_Services#GetSystemTime_PTM_Service_.22ptm:gets.22|ptm:gets]]
| [[9.0.0-20|v8202]]
|-
| [[PTM_Services#SysMenu_PTM_Service_.22ptm:sysm.22|ptm:sysm]]
| [[9.0.0-20|v8202]]
|-
| [[Socket_Services#Socket_privileged_service_.22soc:P.22|soc:P]]
| [[9.0.0-20|v8202]]
|-
| [[Socket_Services#Socket_user_service_.22soc:U.22|soc:U]]
| [[9.0.0-20|v8202]]
|-
| [[SSL_Services|ssl:C]]
| [[9.0.0-20|v8202]]
|-
| [[Camera_Services#y2r:u|y2r:u]]
| [[9.0.0-20|v8202]]
|-
| [[QTM_Services#QTM_system_service_.22qtm:s.22|qtm:s]]
| [[9.0.0-20|v8202]]
|-
| [[Config_Services#Config_service_.22cfg:i.22|cfg:i]]
| [[9.0.0-20|v8202]]
|-
| [[HID_Services#HID_service_.22hid:SPVR.22|hid:SPVR]]
| [[9.0.0-20|v8202]]
|}

== Data Management ==

=== 3DS ===

Here you can manage 3DS extra data, and 3DSWare/"Software".

When managing 3DS Software installed to the SD Card, the [[Title Database|title.db]] is read by the core receiving [[Application Manager Services PXI|AM]] commands. From the title.db file, AM gets a list of installed titles, title sizes and the name of the ".cmd" file for each title, which is used to check the authenticity of the title data(product code, title version, and if an electronic manaual is used, is also kept for each title, in the title.db, but won't be used by the Data Management Utility). For each title listed, it checks if the title is authentic(via the .cmd file). If the title passes authentication, Data Management decrypts/reads the ICN data from the executable NCCH([[CXI]]) and displays it along with the archived title size. If a title doesn't pass authentication, a placeholder icon(light grey with a '?' in the center), name ('????????') and a size of zero are used. Deleting titles removes the title data from the title.db and import.db, and deletes the directory of the content.

=== DSiWare ===

See [[DSiWare Exports]].

== System Format ==
Most of the System Format is done with [[FS:InitializeCtrFileSystem]]. This command updates the high u64 of the keyY stored in [[Nand/private/movable.sed|movable.sed]]. Since this keyY was updated, the data stored on [[SD_Filesystem|SD]] card(sdmc/Nintendo 3DS/<ID0>/<ID1>) and the data under [[Flash_Filesystem|nand/data/<ID0>]] is rendered useless, since that data used the old keyY. Since that data is no longer usable, the system then deletes the two above SD/NAND directories.

When you first enter the System Format menu, it will check if a NNID is linked. If there's a linked-NNID, it will then display: "Are you ready to connect to the Internet to check whether data can be formatted"? Continuing will only result in connecting to wifi for checking in with Nintendo's servers, which may fail if the console is banned. Once that's done it will continue with the usual system-format messages; proceeding will result in the NNID cookie, potentially still present on NAND backups or multiboot scenarios, being invalidated until the next sign-in (at which point even old sessions will be valid again).

== System Updater ==
The system updater title is identical to the regular system settings, except only system update is accessible with this. On dev units, this title can only be launched under certain conditions.

On retail units, this title is accessible in scenarios where you have to update via the Internet to use certain 3DS software other than the home menu. i.e. using the eShop, on a system version less than the current one. When one selects "Cancel" from here on retail, the system will shutdown. [[NS]] launches SAFE_MODE_FIRM for running this title, when the [[Configuration_Memory|UPDATEFLAG]] is set during system boot.

==Exiting System Settings==
Upon exit, the system reboots instead of simply returning to home menu.

== Parental Controls Reset ==
The following refers to the functionality which generates the Parental Controls "Master Key".

{| class="wikitable" border="1"
|-
! System Version, for the mset title
! Parental controls reset functionality version
! Enquiry Number length
! Notes
|-
| [[1.0.0-0|1.0.0-X]] - [[6.3.0-12|6.3.0-X]]
| v0
| 8
| Mostly inherited from the Wii/DSi algorithm which used CRC-32 (0xEDB88320) with custom XOR-out (0xAAAA). 0x14C1 was added to produce the final result.

For the 3DS algorithm, only constants were changed: the polynomial was changed to 0xEDBA6320 and the addition constant became 0x1657.

The input to either function is an ASCII string of the format "%02u%02u%04u" where the parameters are month, day, and low 4 digits of the inquiry number. The low 5 decimal digits from the output u32 are then used for the master key.

Because of the date being used in the algorithm, this results in the master key only being valid on a particular day, though this is trivially defeated by setting the system time to the correct date that the key was generated on.

This had a minor refactor in [[6.0.0-11|6.0.0-X]] but is functionally identical.
|-
| [[7.0.0-13|7.0.0-X]] - [[7.1.0-16|7.1.0-X]]
| v1
| 10
|
|-
| [[7.2.0-17|7.2.0-X]] - current
| v2
| 10
| The master key is indirectly a function of the current date, and of the [[CVer#masterkey.bin|system version and region]].
|}

== ExtData ==
The ExtData [[Extdata#Filesystem|File System]] for System Settings is as follows:

root
├── icon
├── boss
└── user
├── Backup.dat
└── MsetExt.dat

{| class="wikitable" border="1"
|-
! File
! Details
! Size
! FW Introduced
! Plaintext
|-
| icon
| Stubbed. Always image 00000002.
| 0x4 Bytes
| n/a
|
|-
| MsetExt.dat
| [[DSiWare Exports]] Management
| 0x960 Bytes
| [[2.0.0-2]]
| [https://dl.dropboxusercontent.com/u/60710927/CTR/Sample/SystemSettingsExtdata/MsetExt.dat Download]
|-
| Backup.dat
| [[SD Savedata Backups]] Management
| 0xf5a0 Bytes
| [[6.0.0-11]]
| [https://dl.dropboxusercontent.com/u/60710927/CTR/Sample/SystemSettingsExtdata/Backup.dat Download]
|}

=== MsetExt.dat ===
This keeps a record for the DSiWare Exports for a maximum of 300 exports. Each record is in the format:
{| class="wikitable" border="1"
|-
! OFFSET
! SIZE
! DESCRIPTION
|-
| 0
| 4
| Game Code in Little Endian
|-
| 0x4
| 4
| Reserved
|}

All unused entries are filled with "0xff".

=== Backup.dat ===
This keeps a record for the 30 save data backup slots for [[SD Savedata Backups]]. Each entry corresponds to an individual backup slot.

Entry:
{| class="wikitable" border="1"
|-
! OFFSET
! SIZE
! DESCRIPTION
|-
| 0x000
| 8
| Reserved
|-
| 0x8
| 0x800 (0x80*16)
| 16 UTF-16 Title Strings
|-
| 0x808
| 8
| Title ID
|-
| 0x810
| 8
| Unknown
|-
| 0x818
| 8
| Total Save Data Size
|-
| 0x820
| 0x10
| Reserved
|}

Home Menu

2016-05-17T03:51:47Z

Dazzozo: /* Home Menu startup */

The '''Home Menu''' is the heart of the Nintendo 3DS. From there one can start games, applications, and access various processes including the friends list. It is launched by [[NS]], and is always running in the background in 3DS-mode except when other programID-high 00040030 applications like Internet Browser, Friend-List, etc are running. Home Menu is still running while [[System Settings]] is running, however the System Settings application does not allow directly returning to home-menu. The system will normally re-launch Home Menu when the Home Menu process crashes/terminates. When this re-launch occurs while Home Menu is active, Home Menu displays an error message which says to manually reboot the system.

== System Versions ==
Nintendo devised a system, whereby updates would be delivered via two channels:
*Card Updates (CUP) - The Nintendo 3DS is updated with data from an [[System Update CFA|update partition]] on retail gamecard title.
*Network Updates (NUP) - The Nintendo 3DS is updated by downloading data from Nintendo's [[Title list|CDN]].

CUPs will only deliver updates to core features, such as the Home Menu, [[Nintendo 3DS Camera]] etc. CUPs will not deliver updates to Network features, such as [[System Transfer]], [[Internet Browser]], [[StreetPass Mii Plaza]] or [[EShop|eShop]].

NUPs can deliver updates to core features as well as (updated) Network Features.

As a result of deciding to make a distinction between what content could be updated and how, Nintendo split the system version displayed by [[System Settings]] into two parts: [[CVer]] (Console Version) and [[NVer]] (Network Update Version). Represented as:
<CVer Major>.<CVer Minor>.<CVer Micro>-<NUP Version><NUP Region>

The Console Version represents the version of the collectively installed core features. And the NUP Version represents the version of the collectively installed network features.

So if a 3DS' System Firmware read '''2.1.0-2U''', it would indicate a console version of '''2.1.0''' and a NUP version of '''2U'''.

NOTES:
* CUPs can only update core content, so [[NVer]] is never updated with CUPs.
* NUPs will not update [[NVer]] if network features are not updated. (Best seen with the USA vs JPN/EUR 6.0.0 NUP)

CUPs are implemented by adding a [[System Update CFA]] to retail NCSD gamecard images. Nintendo generally creates CUPs after NUPs are released.

When updating the system from 4.5.0-6 to 4.5.0-10, the following titles are updated(in the order of title download+install): [[Health and Safety Information]], [[Nintendo 3DS Camera]], [[eShop]], [[System Transfer]], [[Internet Browser]], [[Title_list|0004009B00014102]], [[Title_list|0004009B00014202]], [[Title_list|0004009B00014302]], [[NVer]], and [[FIRM|AGB_FIRM]].

=== System Versions List ===
{| class="wikitable"
|-
! System version
! Home Menu title version
! Release date
! Changelog
! System security [[3DS_System_Flaws|flaws]] fixed*
! Userland security [[3DS_Userland_Flaws|flaws]] fixed*
! 3DS-mode homebrew affected*
! CUP Released
! CDN Availability
! CDN Post Date
|-
| [[1.0.0-0|1.0.0-0]]
| 0
| February 26, 2011
| Shipped with 3DS on launch
|
|
|
| Yes
| Available
| February 18, 2011
|-
| [[1.1.0-1|1.1.0-1]]
| 0
| February ?, 2011
| General bug fixes
Added 3D Video title to menu. ("For a Limited Time Only")
|
|
|
| Yes
| Available
| March 1, 2011
|-
| [[2.0.0-2|2.0.0-2]]
| 1029
| June 6/7, 2011
| [[eShop]] added, web browser available, [[System Transfer]] added. Full DSiWare data management available. [[Automatic_System_Update_Download|Automatic]] downloading for system updates added.
|
|
|
| No
| Available
| June 6, 2011
|-
| [[2.1.0-3|2.1.0-3]]
| 2049
| June 15, 2011
| Fixes the Ridge Racer freeze.
|
|
|
| Yes
| Available
| June 15, 2011
|-
| [[2.1.0-4|2.1.0-4]]
| Not updated
| July 25, 2011
| System stability improvements and other adjustments.
|
|
|
| No
| Available
| July 25, 2011
|-
| [[2.2.0-X|2.2.0]]
| ?
| November 6, 2011
| CUP Only Release. Improved the arrangement of [[Friend List]]. Update from some game cards such as Super Mario 3D Land.
|
|
|
| Yes
| Unavailable
| ?
|-
| [[3.0.0-5|3.0.0-5]]
| 4111
| December 7, 2011
| Added 3D video recording to the camera title, updated Mii Streetpass Plaza, [[System Transfer]] between 3DS systems available, improved eShop, home menu QR code scanning with QR codes containing URLs. [[Nintendo Zone]] is now always accessible, 3D video streaming support was added to NZone. This added support for running GBA VC titles via AGB_FIRM as well, support for GBA VC titles was also added to NATIVE_FIRM.
|
|
|
| Yes
| Available
| December 7, 2011
|-
| [[3.0.0-6|3.0.0-6]]
| Not updated
| December 21, 2011
| Only StreetPass Mii Plaza and the [[NVer]] title were updated. From Nintendo's release notes: "System stability improvements and other adjustments".
|
|
|
| No
| Available
| December 21, 2011
|-
| [[4.0.0-7|4.0.0-7]]
| 5131
| April 24, 2012
| Add folders to Home Menu, game patching added, buy more expensive games than 1000 yen in JPN. System titles for CHN, TWN, and KOR became available.
| Yes
|
|
| Yes
| Available
| April 24, 2012
|-
| [[4.1.0-8|4.1.0-8]]
| Not updated
| May 14, 2012
| From changelog: "improvements to overall system stability and other minor adjustments". Once updated to [[4.1.0-8]], the parental-controls PIN is no longer required for future system updates.
| Yes
|
|
| Yes
| Available
| May 14, 2012
|-
| [[4.2.0-9|4.2.0-9]]
| 6146
| June 26, 2012
| Improved eShop safety for entering credit-card info, and behind the scenes improvements. Stored CC info will be deleted by this updated eShop, and can be re-entered again.
|
|
|
| Yes
| Available
| June 26, 2012
|-
| [[4.3.0-10|4.3.0-10]]
| Not updated
| July 24, 2012
| Updated eShop, bad word list and NZone hotspot list updated.
|
|
|
| Yes
| Available
| July 24, 2012
|-
| [[4.4.0-10|4.4.0-10]]
| Not updated
| September 19, 2012
| NZone hotspot list updated and TWL_FIRM updated for blocking flash cards.
|
|
|
| Yes
| Available
| September 19, 2012
|-
| [[4.4.0-10|4.4.0-10C]]
| Not updated
| October 17, 2012
| China-only, the *only* updated title was [[System Settings]]. This title was updated to a version already available in TWN/KOR.
|
|
|
| ?
| Available
| October 17, 2012
|-
| [[4.5.0-10|4.5.0-10]]
| Not updated
| December 4, 2012
| Flash-card block via updated TWL_FIRM and whitelist. NZone hotspot list updated as well.
|
|
|
| Yes
| Available
| December 4, 2012
|-
| [[5.0.0-11|5.0.0-11]]
| 7172
| March 25, 2013
| Many system titles including NATIVE_FIRM were updated, multiple vulnerabilities were fixed as well.
| Yes
|
| Yes
| No
| Available
| March 25, 2013
|-
| [[5.1.0-11|5.1.0-11]]
| Not updated
| April 4, 2013
| NATIVE_FIRM and NS were updated. According to the official change-log: "Resolves an issue that may prevent access to the System Settings or other features."
| No
|
| No
| Yes
| Available
| April 4, 2013
|-
| [[6.0.0-11|6.0.0-12 (-11U)]]
| 8198
| June 17, 2013
| Official change-log: "Users can now back up save data for downloadable versions of Nintendo 3DS software and most Virtual Console games". For EUR/JPN, the [[StreetPass Mii Plaza]] application and the [[Nintendo 3DS Camera]] application were updated. Other titles for all regions were updated as well.
| Yes
|
|
| No
| Available
| June 17, 2013
|-
| [[6.1.0-11|6.1.0-12 (-11U)]]
| Not updated
| June 27, 2013
| Official change-log: "Further improvements to overall system stability and other minor adjustments have been made to enhance the user experience."
|
|
|
| Yes
| Available
| June 27, 2013
|-
| [[6.1.0-12U]]
| Not updated
| July 11, 2013
| This USA-only update added the updated network features applications which were first released in JPN/EUR with the [[6.0.0-11|6.0.0-12 NUP]] update.
|
|
|
| No
| Available
| July 11, 2013
|-
| [[6.2.0-12]]
| Not updated
| August 6, 2013
| This update added support for the StreetPass relay feature, updated TWL_FIRM, and updated the Nintendo Zone hotspots list.
|
|
|
| Yes
| Available
| August 6, 2013
|-
| [[6.3.0-12]]
| Not updated
| September 13, 2013
| See [[6.3.0-12|this]].
| No
|
| No
| No
| Available
| September 13, 2013
|-
| [[6.4.0-12]]
| ?
| November 11, 2013
| See [[6.4.0-12|this]](Only for the KOR and TWN regions).
|
|
|
| No
| Available
| November 11, 2013
|-
| [[7.0.0-13]]
| 9230
| December 9, 2013
| See [[7.0.0-13|this]].
| Yes
| Yes
|
| No
| Available
| December 9, 2013
|-
| [[7.1.0-14]]
| Not updated
| December 19, 2013
| See [[7.1.0-14|this]].
| No
|
|
| Yes
| Available
| December 19, 2013
|-
| [[7.1.0-15]]
| Not updated
| January 22, 2014
| See [[7.1.0-15|this]].
| No
|
| No
| No
| Available
| January 22, 2014
|-
| [[7.1.0-16]]
| Not updated
| February 26, 2014
| See [[7.1.0-16|this]].
| No
|
| No
| No
| Available
| February 26, 2014
|-
| [[7.2.0-17]]
| Not updated
| May 12, 2014
| See [[7.2.0-17|this]].
|
|
| No
| Yes
| Available
| May 12, 2014
|-
| [[8.0.0-18]]
| Not updated
| July 7, 2014
| See [[8.0.0-18|this]].
| No
|
| No
| Yes
| Available
| July 7, 2014
|-
| [[8.1.0-18]]
| Not updated
| July 24, 2014
| See [[8.1.0-18|this]].
| No
|
| No
| Yes
| Available
| July 24, 2014
|-
| [[8.1.0-19]]
| Not updated
| August 7, 2014
| See [[8.1.0-19|this]].
| No
|
| No
| No
| Available
| August 7, 2014
|-
| [[8.1.0-0 New3DS]]
| Not updated
| September 26, 2014
| See [[8.1.0-0 New3DS|this]].
|
|
| No
| No
| Available
| September 26, 2014
|-
| 8.1.0-19
| Not updated
| October 2, 2014
| Japan-only "update", see [http://yls8.mtheall.com/ninupdates/reports.php?date=10-02-14_02-05-03&sys=ctr here]. The only change was that a new title([[New_3DS]]-only system application) was added, CVer/NVer titles were not even updated. The initial version of this [[Title_list|title]] is a stub.
| No
|
| No
| No
| Available
| October 2, 2014
|-
| [[9.0.0-20]]
| v11272
| October 6, 2014
| See [[9.0.0-20|this]].
|
|
| No
| No
| Available
| October 6, 2014
|-
| [[9.1.0-20J]]
| v14336(JPN-region title)
| October 10, 2014
| Japan-only, see [[9.1.0-20J|this]].
| No
|
| No
| No
| Available
| October 10, 2014
|-
| [[9.2.0-20]]
|
| October 29, 2014
| See [[9.2.0-20|this]].
| No
|
| No
| No
| Available
| October 29, 2014
|-
| [[9.3.0-21]]
|
| December 8, 2014
| See [[9.3.0-21|this]].
| Yes
|
| Yes
| No
| Available
| December 8, 2014
|-
| [[9.4.0-21]]
|
| December 11, 2014
| See [[9.4.0-21|this]].
| No
|
| No
| No
| Available
| December 11, 2014
|-
| [[9.5.0-22]]
|
| February 2, 2015
| See [[9.5.0-22|this]].
| Yes
|
|
| No
| Available
| February 2, 2015
|-
| [[9.5.0-23]]
|
| March 2, 2015
| See [[9.5.0-22|this]].
| No
| Yes
|
| No
| Available
| March 2, 2015
|-
| [[9.6.0-24]]
|
| March 23, 2015
| See [[9.6.0-24|this]].
| See [[9.6.0-24|here]].
|
|
| No
| Available
| March 23, 2015
|-
| [[9.7.0-25]]
|
| April 20, 2015
| See [[9.7.0-25|this]].
| Probably none?
|
| No
| No
| Available
| April 20, 2015
|-
| [[9.8.0-25]]
|
| June 1, 2015
| See [[9.8.0-25|this]].
| No
| No
| No
| No
| Available
| June 1, 2015
|-
| [[9.9.0-26|9.9.0-26]]
|
| July 13, 2015
| See [[9.9.0-26|this]].
|
|
|
| No
| Available
| July 13, 2015
|-
| [[10.0.0-27|10.0.0-27]]
|
| September 8, 2015
| See [[10.0.0-27|this]].
| Yes
| No
| No
| No
| Available
| September 8, 2015
|-
| [[10.1.0-27|10.1.0-27]]
|
| September 14, 2015
| See [[10.1.0-27|this]].
| No
| No
| No
| No
| Available
| September 14, 2015
|-
| [[10.2.0-28|10.2.0-28]]
|
| October 19, 2015
| See [[10.2.0-28|this]].
|
|
|
| No
| Available
| October 19, 2015
|-
| [[10.3.0-28|10.3.0-28]]
|
| November 9, 2015
| See [[10.3.0-28|this]].
|
|
|
| No
| Available
| November 9, 2015
|-
| [[10.4.0-29|10.4.0-29]]
|
| January 18, 2016
| See [[10.4.0-29|this]].
| Yes
| Launching old Ironfall was blocked.
| Yes
| No
| Available
| January 18, 2016
|-
| [[10.5.0-30|10.5.0-30]]
|
| January 25, 2016
| See [[10.5.0-30|this]].
|
|
|
| No
| Available
| January 25, 2016
|-
| [[10.6.0-31|10.6.0-31]]
|
| February 22, 2016
| See [[10.6.0-31|this]].
| Yes
| Yes
| Yes
| No
| Available
| February 22, 2016
|-
| [[10.7.0-32|10.7.0-32]]
|
| March 14, 2016
| See [[10.7.0-32|this]].
| No
| Yes
| Yes
| No
| Available
| March 14, 2016
|-
| [[11.0.0-33|11.0.0-33]]
|
| May 9, 2016
| See [[11.0.0-33|this]].
| Yes
| No
| Yes
| No
| Available
| May 9, 2016
|}

"[[3DS_System_Flaws|System]]/[[3DS_Userland_Flaws|Userland]] security flaws fixed*": This includes known flaws, and any fixed flaws discovered via code bin-diff.

"[[3DS_System_Flaws|System]]/[[3DS_Userland_Flaws|Userland]] security flaws fixed*" and "3DS-mode homebrew affected" only apply to the changes done with that specific system-update("affected" does not include hax codebases breaking *just* due to updated codebins).

[[Category:Nintendo Software]]

== Auto-Boot Function ==
When the Home Menu is initially loaded by [[NS]], it checks the gamecard ExeFS:/[[SMDH|icon]] for the auto-boot flag. If the auto-boot flag is set, it will load the application on the cartridge and the home menu will not remain running in the background, or at least not in an operational state. Using software cues to return to the home menu, or sleep menu while in this state, causes a shutdown.

Notable features of demo titles:
*Auto-boot demos generally disable the functionality of the home button.
*The ''New Super Mario Bros 2'' demo, retained the functionality of the home button, and had an timer which triggered the demo to quit after a period of inactivity.

Auto-boot cartridges, can bypass some of the functions of the Home Menu. Auto Booted software:
* Doesn't show usage history in the [[Activity Log]]
* Bypasses Parental controls
* Bypasses Forced Game Card Updates
* Bypasses Initial 3DS Setup
* The console does not have a friends list presence.
* Is still subject to region lock(see below).

Region lock is still active, so the home menu will refuse to launch demos with incorrect region lock will not load, displaying "An Error has Occurred". However, game card update partition checks are not done, which allows launching demos that have region free encoding, but have an alternate(or even invalid) region update partition.

The following auto-boot paths can be used by Home Menu, checked in the same order listed below(the above gamecard auto-boot is checked before this):
{| class="wikitable"
! Key-combo / requirements for this path
! Description
|-
| R, L, and X
| This launches [[System Settings]] for touchscreen calibration.
|-
| R, L, and Y
| This launches [[System Settings]] for circlepad calibration.
|}

The following is only checked when the low u16 from [[Config_Savegame|config]] block 0x00110000 is value zero(normally this is non-zero). Thus, the below is only handled when a system setup is required.
{| class="wikitable"
! Key-combo / requirements for this path
! Description
|-
| R, X, Y, A, and B, a 3DS gamecard must be inserted as well.
| This launches the gamecard application. Note that pressing the HOME button in the gamecard application launched this way will only result in the system shutting down.
|-
| This is used when the above path isn't used.
| This launches System Settings for the system setup.
|}

== Region Lockout ==

One of the Home Menu's functions, is to regulate region lockout. The region lockout data for any given title is held in the [[SMDH#BNR Region|ICN data]]. There are 6 regions of which have their own region lockout, Japan, USA, Europe(including Nintendo Australia), China, Taiwan and Korea. There is also a value which makes a title exempt from region lockout, and consequently accessible from any region of 3DS.

The region-field stored in the [[SMDH|ICN-data]] is only checked when Home Menu itself launches a title, not when other titles use NS to have Home Menu launch titles. This isn't actually useful for gamecard region-free however, due to the gamecard system-updates, see below.

Also note that while some gamecard games are mostly region-free(main CXI is identical for all regions of the gamecard), those gamecards can't actually be launched with all 3DS regions due to the gamecard system-update, see below. Note that the main CXI being identical for all regions of a gamecard also means the savedata keyY is identical for all regions of that gamecard too(except for old system-version <v2.2 games, in some cases, due to different cardIDs).

=== Effects of Region Lockout ===
Every 3DS title regardless of location (NAND/SD Card/Game Card) is subject to region lockout scrutiny by the Home Menu. And the home menu treats 'out-of-region' titles by simply refusing to show them on the home menu. No messages are shown on the home menu to notify the user, the title is simply ignored. However out-of-region SD Card titles, will appear and quickly disappear, while all the SD Titles are being processed. In cases where access to the home menu GUI is not needed to launch the title (like in the case of kiosk demos), the home menu states an error has occurred, and launching of the title is stopped.

=== Game Card Updates ===
Either intentionally a region lock mechanism or not, the function which checks the game card update partition returns an error when it is detected the update is for a region other than the 3DS's region (Most likely triggered by the absence of the correct CVer title). And errors returned from checking the update partition, will result in the home menu displaying "This Game Card cannnot be used", when the user attempts to launch the title.

== Home-menu [[SpotPass]] usage ==

Home-menu originally used two domains with HTTPS for SpotPass. SpotPass stores this content in Home-menu's NAND shared extdata.

* The system notifications are downloaded from: https://a248.e.akamai.net/f/248/103046/10m/npdl.c.app.nintendowifi.net/p01/nsa/<regionID>/<filename>/<langcode>/<filename> Where langcode is the two-character language codes from [[Config Savegame#Languages|config]], and regionID is from the below table. <filename> is bashoX/sysmsgX where X is 0-3.
* https://pls.c.shop.nintendowifi.net/pl/upload This URL is used for uploading data from the home menu NAND shared extdata, it's unknown what this is used for. This data is uploaded every 24 hours.
* https://npul.c.app.nintendowifi.net/p01/recv/<regionID>/<filename> This is used for uploading unknown data from extdata. <filename> can be "phu", "tiu", "splu", or "sendmgn".

{| class="wikitable"
|-
! Region
! ID
|-
| JPN
| gWr4JXxb2mKTG3lq
|-
| NA
| uuI82221UKkqmtbp
|-
| EUR / Others
| UrXSeurnxhPrq7AS
|}

The SpotPass content payload for notifications begin with a header, followed by an [[SMDH|icon]] and the UTF-16 text, and various metadata.

=== VersionList ===
During startup, Home Menu loads "/versionList.dat" from NAND extdata 0xf000000e. This is downloaded via SpotPass, the file-data downloaded via HTTPS here is raw (no SpotPass container):
* Retail: [https://tagaya-ctr.cdn.nintendo.net/tagaya/versionlist]
* Dev-unit: [https://tagaya-dev-ctr.cdn.nintendo.net/tagaya/versionlist] The titles listed in this are not available on the [[Title list|normal]] CDN.

This is a list of title-updates available on the eShop, for regular app titles and update-titles. This is what Home Menu checks to determine whether the currently selected application needs to be updated or not. When an Internet connection is not available or wifi is disabled, Home Menu will skip VersionList handling/messages when you launch applications.

File structure:
{| class="wikitable"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x10
| The first u32 is normally 0x1, the rest is normally all-zero.
|-
| 0x10
| <Filesize-0x10>
| Title entries, 0x10-bytes each.
|}

Title entry structure:
{| class="wikitable"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| u64 TitleID
|-
| 0x8
| 0x4
| u32 titleversion
|-
| 0xC
| 0x4
| Unknown u32, usually zero?
|}

== Automatic System Update Download ==
See [[Automatic System Update Download]].

== Home Menu Error Messages ==
{| class="wikitable"
|-
! Dialog Text
! Description
|-
| "An error has occured. Please save your data ... then restart the system"
| This dialog is displayed when a system applet(including Home Menu) crashes/terminates. This dialog is also displayed for system errors as well.
|}

== Home Menu Themes ==
See [[Home_Menu/Themes|here]].

== Home Menu [[System_SaveData|NAND]] savedata ==
=== Launcher.dat ===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| Launcher.dat format version.
|-
| 0x1
| 0x1
| Padding?
|-
| 0x2
| 0x2
| Unknown, normally 0x1.
|-
| 0x4
| 0x4
| Unknown, normally 0x0.
|-
| 0x8
| 0xB40
| 360 u64s, list of titleIDs. For an unused entry, the u64 value is ~0(in that case, the corresponding entries at 0xD9A/0x106A for this titleID are not used either). This is used for the icons displayed on the main Home Menu screen.
|-
| 0xD9A
| 0x2D0
| Array of 360 s16 fields, each one corresponds to the titleIDs at the array located at offset 0x8. This is used for icon position, 0x0 for the very first icon, 0x1 for the next one and so on. This is completely linear, no X/Y coordinates.
|-
| 0x106A
| 0x168
| Array of 360 s8 fields, each one corresponds to the titleIDs at the array located at offset 0x8. This is used for icon position. When an s8 here is -1(which is the normal value), the icon is located with the first chunk of icons(outbuf+0), otherwise the base address is outbuf+0xB40+<s8val*0x1E0>(which is equivalent to 60 icons * s8val).
|}

== SD ExtData ==
The SD ExtData [[Extdata#Filesystem|File System]] for Home Menu is as follows:

root
├── icon
├── boss
└── user
├── SaveData.dat
├── Cache.dat
└── CacheD.dat

{| class="wikitable" border="1"
|-
! File
! Details
! Size
! FW Introduced
! Plaintext
|-
| icon
| Stubbed. Always image 00000002.
| 0x4 Bytes
| n/a
|
|-
| SaveData.dat
| Always image 00000003.
| 0x2cb0 Bytes (0x2da0 starting with [[4.0.0-7]])
| [[2.0.0-2]]
| [https://dl.dropboxusercontent.com/u/60710927/CTR/Sample/HomeMenuExtdata/SaveData.dat Download]
|-
| Cache.dat
| Indexes and records details for the cached icon data. Always image 00000004.
| 0x1688 Bytes
| [[2.0.0-2]]
| [https://dl.dropboxusercontent.com/u/60710927/CTR/Sample/HomeMenuExtdata/Cache.dat Download]
|-
| CacheD.dat
| Cached icon data for Home Menu. Always image 00000005.
| 0x4cfe00 Bytes
| [[2.0.0-2]]
| [https://dl.dropboxusercontent.com/u/60710927/CTR/Sample/HomeMenuExtdata/CacheD.dat Download]
|}

=== Cache.dat & CacheD.dat ===
These two files work in tandem to allow the home menu to cache icon data for applications which are presented on the Home Menu. The size of both files suggests a maximum cache size of 360 icons. Cache.dat stores details about the cache icon data, and CacheD.dat stores the icon data. The icon cache stores icon data for *all* applications shown on the Home Menu, this includes DSi NAND Titles, and DS(i) cartridges. The format of cached DS(i) icon data is not understood, but they are the same size as 3DS icon data (0x36c0).

In Cache.dat the first 8 bytes are reserved, then follows each icon slots's entry in the format:
{| class="wikitable" border="1"
|-
! OFFSET
! SIZE
! DESCRIPTION
|-
| 0x0
| 8
| Title ID in Little Endian
|-
| 0x8
| 4
| Unknown
|-
| 0xc
| 4
| Unknown
|}

All unused entries have the Title IDs filled with "0xff".

In CacheD.dat, the icon data is concatenated together, with the first icon at offset 0x0.

=== SaveData.dat ===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| SaveData.dat format version.
|-
| 0x13b8
| 0x8
| Theme entry structure for the regular theme.
|-
| 0x13c0
| 0x8*10(0x50)
| Array of theme entry structures for theme [[9.3.0-21|shuffling]].
|-
| 0x141b
| 0x1
| 0 = one regular theme, 1 = multiple themes for theme [[9.3.0-21|shuffle]].
|}

When the theme cache is enabled via the above fields, Home Menu loads the cache at startup(if the used theme structure is valid).

Theme entry structure:
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Theme index: for DLC this is the content-index, for built-in themes this is an index for an array selecting the built-in theme.
|-
| 0x4
| 0x1
| Normally zero. This is the low 8-bits in the DLC titleID that this theme was originally loaded from.
|-
| 0x5
| 0x1
| Theme type, the valid range is 0..5. 0 = none, 1 = built-in theme from Home Menu RomFS, 2 = theme data loaded from SD cache / content archive. 3 = ?, 4 = ?, 5 = ?
|-
| 0x6
| 0x1
| Normally zero?
|-
| 0x7
| 0x1
| Normally zero?
|}

When the theme-type is value1 the themeindex must be <9. When the theme-type is value2 the themeindex has to be non-zero, and the u8 at offset 0x4 must not be >=10.

The theme-loader code (besides the AM <is-current-themeindex-DLC-installed> code) handles all theme-types >=2 the same way. However, it seems all DLC AM code involving checking the currently-used theme DLC only gets executed when the theme-type is value2. The code in the theme-loader for that also checks that a certain Home Menu state flag is non-zero, before running the AM DLC code(it's unknown where this flag value comes from).

== Home Menu [[Home_Menu/Themes|Theme]] SD [[Extdata|ExtData]] ==
The filesystem for this extdata is as follows:

root
├── icon
├── boss
└── user
├── ThemeManage.bin
├── BodyCache.bin
├── BgmCache.bin
└── nsalist

{| class="wikitable" border="1"
|-
! File
! Details
! Size
! Extdata image ID
! FW Introduced
! Plaintext
|-
| ThemeManage.bin
| Theme management info. The filesize must match 0x800, otherwise the Home Menu code returns an error.
| 0x800
| 00000003
| [[9.0.0-20]]
|-
| BodyCache.bin
| Contains cached data from the last loaded [[Home_Menu/Themes|theme]] RomFS body_LZ.bin file. The filesize must match 0x150000, otherwise the Home Menu code returns an error.
| 0x150000
| 00000004
| [[9.0.0-20]]
|
|-
| BgmCache.bin
| Contains cached data from the last loaded [[Home_Menu/Themes|theme]] RomFS bgm.bcstm file. The filesize must match 0x337000, otherwise the Home Menu code returns an error.
| 0x337000
| 00000005
| [[9.0.0-20]]
|-
| nsalist
| Contains the list of DLC themes(IDs+prices), downloaded via [[SpotPass]].
|
| 00000007
| [[9.0.0-20]]
|}

BodyCache.bin and BgmCache.bin contain cached theme data for the currently used DLC theme. ThemeManage.bin is loaded by Home Menu during startup. The cached theme data is loaded at startup when a DLC theme is selected. This also contains theme-shop [[SpotPass]] data.

BodyCache.bin and BgmCache.bin are all-zero when no theme is selected.

Starting with [[9.3.0-21|9.3.0-X]] Home Menu can use more files in this extdata, for theme shuffling. "theme:/ThemeManage.bin" "theme:/BgmCache_%02d.bin" "theme:/BodyCache_rd.bin"

=== ThemeManage.bin ===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Unknown, normally value 0x1?
|-
| 0x4
| 0x4
| Unknown, normally zero?
|-
| 0x8
| 0x4
| Actual size of the cached body_LZ.bin data.
|-
| 0xC
| 0x4
| Actual size of the cached bgm.bcstm data.
|-
| 0x10
| 0x4
| Unknown
|-
| 0x14
| 0x4
| Unknown
|-
| 0x18
| 0x4
| When a DLC theme is selected, this is the content-index of the DLC theme.
|-
| 0x1C
| 0x4
| Unknown, usually value 0x200 when the data in theme-cache is actually used?
|}

The total filesize is 0x800-bytes, normally the data starting at offset 0x1C is all-zero.

When no theme is actually used, the only non-zero fields are the following: the u32 stored at offset 0x0 in ThemeManage.bin is value 0x1, with offset 0x10 u32 set to value 0x1.

== Home Menu badge SD [[Extdata|ExtData]] ==
The filesystem for this extdata(when it actually exists) is as follows:

root
├── icon
├── boss
└── user
├── BadgeData.dat
└── BadgeMngFile.dat

{| class="wikitable" border="1"
|-
! File
! Details
! Size
! Extdata image ID
! FW Introduced
|-
| BadgeData.dat
| [[Home_Menu#BadgeData.dat|See below.]]
| 0xF4DF80
|
| [[9.0.0-20]]
|-
| BadgeMngFile.dat
| [[Home_Menu#BadgeMngFile.dat|See below.]]
| 0xD4A8
|
| [[9.0.0-20]]
|}

=== BadgeData.dat ===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 100 * 16 * 0x8A
| UTF-16 Badge Set Titles (16 per set for different languages)
|-
| 0x35E80
| 1000 * 16 * 0x8A
| UTF-16 Badge Titles (16 per set for different languages)
|-
| 0x250F80
| 100 * 0x2000
| [http://en.wikipedia.org/wiki/Z-order_curve Tiled] RGB565 64x64 Badge Set Icons
|-
| 0x318F80
| 1000 * 0x2800
| [http://en.wikipedia.org/wiki/Z-order_curve Tiled] RGB565 64x64 + Tiled A4 64x64 Badge Icons
|-
| 0xCDCF80
| 1000 * 0xA00
| [http://en.wikipedia.org/wiki/Z-order_curve Tiled] RGB565 32x32 + Tiled A4 32x32 Badge Icons
|}

=== BadgeMngFile.dat ===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| u32, Must Be Zero
|-
| 0x4
| 0x4
| u32, Number of Badge Sets
|-
| 0x8
| 0x4
| u32, Number of Unique Badges
|-
| 0xC
| 0x4
| u32, Number of Placed Badges
|-
| 0x10
| 0x4
| u32, Selected Badge Set in Home Menu (0xFFFFFFFF = All Badges)
|-
| 0x14
| 0x4
| u32, Selected Badge Column in All Badges
|-
| 0x18
| 0x4
| u32, Number of Total Badges
|-
| 0x1C
| 0x4
| u32, Nintendo Network ID Number
|-
| 0x20
| 0x338
| Unknown (always zeros? unused?)
|-
| 0x358
| 0x80
| Used Badge Slots (each bit = 1 slot)
|-
| 0x3D8
| 0x10
| Used Badge Set Slots (each bit = 1 slot)
|-
| 0x3E8
| 1000 * 0x28
| [[Home_Menu#BadgeInfo|BadgeInfo]] Entries
|-
| 0xA028
| 100 * 0x30
| [[Home_Menu#BadgeSetInfo|BadgeSetInfo]] Entries
|-
| 0xB2E8
| 360 * 0x18
| [[Home_Menu#BadgeLayoutSlot|BadgeLayoutSlot]] Entries
|}

==== BadgeIdentifier ====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| u32, Unknown
|-
| 0x4
| 0x4
| u32, Badge ID
|-
| 0x8
| 0x4
| u32, Badge Set ID
|-
| 0xC
| 0x2
| u16, Badge Index
|-
| 0xE
| 0x2
| u16, Badge Sub ID (used for multi-part badges)
|}

==== BadgeSetIdentifier ====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| u32, Unknown (Usually 0xFFFFFFFF)
|-
| 0x4
| 0x4
| u32, Unknown (Usually 0xFFFFFFFF)
|-
| 0x8
| 0x4
| u32, Unknown (Usually 0x0)
|-
| 0xC
| 0x4
| u32, Unknown (Usually 0x2710)
|-
| 0x10
| 0x4
| u32, Badge Set ID
|-
| 0x14
| 0x4
| u32, Badge Set Index
|}

==== BadgeInfo ====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x10
| [[Home_Menu#BadgeIdentifier|BadgeIdentifier]]
|-
| 0x10
| 0x2
| u16, Number Placed
|-
| 0x12
| 0x2
| u16, Quantity
|-
| 0x14
| 0x4
| u32, Unknown (packed data?)
|-
| 0x18
| 0x10
| u64[2], Shortcut Title ID (twice, once per u64)
|}

==== BadgeSetInfo ====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x18
| [[Home_Menu#BadgeSetIdentifier|BadgeSetIdentifier]]
|-
| 0x18
| 0x4
| u32, Unknown (usually 0xFFFFFFFF)
|-
| 0x1C
| 0x4
| u32, Number of Unique Badges
|-
| 0x20
| 0x4
| u32, Number of Total Badges
|-
| 0x24
| 0x4
| u32, Start Badge Index
|-
| 0x28
| 0x4
| u32, Unknown (usually 0x0)
|-
| 0x2C
| 0x4
| u32, Unknown (usually 0x0)
|}

==== BadgeLayoutSlot ====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x10
| [[Home_Menu#BadgeIdentifier|BadgeIdentifier]]
|-
| 0x10
| 0x4
| u32, Position
|-
| 0x14
| 0x4
| u32, Folder (0xF0FF = Icon of a folder, 0xFFFFFFFF = No folder)
|}

The file size must match 0xD4A8, otherwise the Home Menu code returns an error.

== Home Menu theme layout SD [[Extdata|ExtData]] ==
The filesystem for this extdata(when it actually exists) is as follows:

root
├── icon
├── boss
└── user
└── MngFile.dat

{| class="wikitable" border="1"
|-
! File
! Details
! Size
! Extdata image ID
! FW Introduced
! Plaintext
|-
| MngFile.dat
| See below.
| 0x004D1280
| 00000003
| [[9.6.0-24]]
|}

=== MngFile.dat ===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| u32, must be zero.
|-
| 0x4
| 0x4
| u32, total number of stored layouts.
|-
| 0x8
| 0x4
| ?
|-
| 0xC
| ?
| Start of the layout entries.
|}

Layout entries structure:
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x2558
| Exact copy of the entire Home Menu [[System_SaveData]] Launcher.dat, this is the actual layout data.
|-
| 0x2558
| ?
| Layout preview screenshot gfx data, displayed by the Home Menu layout settings menu.
|}

The filesize must match 0x004D1280, otherwise the Home Menu code returns an error. The saved Home Menu layouts are stored here.

When saving a layout, the total layout field is increased, then a new layout entry is created with the contents of the current Home Menu [[System_SaveData]](NAND savedata) Launcher.dat + a screenshot of the main Home Menu screen is written. When loading a layout, Launcher.dat in savedata is written with the current Launcher.dat data already stored in memory(unknown if any data gets changed for it here), then data from the layout entry is copied into the Home Menu [[System_SaveData]] Launcher.dat.

Home Menu *only* accesses this file with the Home Menu layout-settings menu / when entering that menu.

== Home Menu startup ==
The following is what Home Menu does at startup(converted from cmd-logs), from [[9.4.0-21]], in the same order Home Menu does it.

Originally Home Menu mounted sdmc in main(), starting(?) with [[6.0.0-11]] Home Menu only has sdmc mounted while handling [[SD_Savedata_Backups]].

{| class="wikitable" border="1"
|-
! Archive
! Filename
! Read size
! Notes
|-
|
|
|
| srv_init(), then srv_GetServiceHandle is used to initialize the service handles for the following services: [[NS_and_APT_Services|ns:s]], [[PTM_Services|ptm:sysm]], and [[Config_Services|cfg:s]].
|-
|
|
|
| [[CfgS:SecureInfoGetByte101]] and [[CfgS:GetLocalFriendCodeSeed]] are used, the output data from these are not used. If either of these return an error, Home Menu uses [[ERR:Throw]].
|-
|
|
|
| [[Cfg:GetSystemModel]] is then used to initialize a Home Menu state field.
|-
|
|
|
| Home Menu then loads the system language via [[CfgS:GetConfigInfoBlk2]], and uses [[Cfg:SecureInfoGetRegion]], to initialize Home Menu region/language state. Home Menu then uses [[Cfg:SecureInfoGetRegion]] again, then loads the [[Config_Savegame|CountryInfo]] via [[CfgS:GetConfigInfoBlk2]].
|-
|
|
|
| Home Menu initializes [[Filesystem_services|fs:USER]] here. Home Menu then mounts the Home Menu CXI RomFS. Then Home Menu uses [[Filesystem_services|FSUSER:GetPriority]].
|-
|
|
|
| Home Menu starts APT initialization / using APT service commands here. Eventually Home Menu then [[NSS:LaunchTitle|launches]] various system-modules.
|-
|
|
|
| Here Home Menu attempts to open NAND shared-[[extdata]] 0xe0000000, which will normally fail since it doesn't exist.
|-
|
|
|
| Here Home Menu uses [[Application_Manager_Services|AM]] command 0x00130040, with input u8 = value 0x0. Home Menu continues using APT commands after this.
|-
|
|
|
| [[HID_Services|hid:SPVR]] service initialization is done here.
|-
|
|
|
| [[PTM_Services|PTMSYSM:GetShellStatus]] is used here.
|-
|
|
|
| [[Filesystem_services|FSUSER:GetCardType]] is used here. AM commands are then used to get the inserted gamecard programID, when successful the gamecard ExeFS:/icon is then read to check the auto-boot flag(see the auto-boot section on this page). The system-setup-required flag is then read here if needed, as mentioned under the auto-boot section of this page.
|-
|
|
|
| Home Menu then uses cfg commands to load system language, region, and CountryInfo.
|-
| Home Menu CXI RomFS
| "/message/<Region>_<Language>/menu_msbt_LZ.bin"
| Presumably loaded from the filesize.
|
|-
| Home Menu CXI RomFS
| "/message/<Region>_<Language>/RI_mstl_LZ.bin"
| Presumably loaded from the filesize.
|
|-
| Home Menu CXI RomFS
| "/message_hud/<Region>_<Language>/hud_msbt_LZ.bin"
| Presumably loaded from the filesize.
|
|-
| Home Menu CXI RomFS
| "/message_hud/<Region>_<Language>/RI_mstl_LZ.bin"
| Presumably loaded from the filesize.
|
|-
|
|
|
| [[NS_and_APT_Services|APT:GetSharedFont]] is used here.
|-
| Home Menu CXI RomFS
| "/font/Hud_JP.bcfnt"
|
|
|-
|
|
|
| Here Home Menu loads the [[Config_Savegame|cfg]] state for blkID 0x50005.
|-
|
|
|
| Here Home Menu loads the GPU shaders from RomFS.
|-
|
|
|
| Here Home Menu does DSP initialization then starts using DSP commands etc + loads sound data from RomFS.
|-
|
|
|
| Here Home Menu does GSP initialization.
|-
|
|
|
| [[APT:GetCaptureInfo]] is used here.
|-
| Home Menu CXI RomFS
|
|
|
|-
|
|
|
| Here Home Menu uses [[PTM_Services|PTMSYSM:GetShellStatus]], [[PTMSYSM:GetSoftwareClosedFlag]], and [[PTMSYSM:ClearSoftwareClosedFlag]]. Home Menu then uses [[PTM_Services|PTMSYSM:GetShellStatus]] 3 times in a row. Starting from here, Home Menu uses [[PTM_Services|PTMSYSM:GetShellStatus]] frequently(presumably from a separate thread).
|-
|
|
|
| Home Menu opens the archive for the Home Menu [[System_SaveData]] here. Then Home Menu attempts to open "/Launcher.dat" for reading, when successful Home Menu just closes the file.
|-
| Home Menu [[System_SaveData]]
| "/Launcher.dat"
| 0x2490
| Prior to doing the read, Home Menu uses [[FSFile:GetSize]].
|-
| System CFA, titleID for USA: 0004009B00013302
| "/country.bin"
|
|
|-
| [[NS CFA]]
| "/ctr_backup_black_list"
|
| Home Menu first reads 0x10-bytes from offset 0x0, then after that it reads the rest of the file.
|-
| Home Menu CXI RomFS
|
|
| Home Menu reads various RomFS files here.
|-
|
|
|
| Home Menu [[NSS:LaunchTitle|launches]] the camera system-module here.
|-
| Home Menu CXI RomFS
|
|
| Home Menu reads various RomFS files here.
|-
| NGWord bad word list CFA
| "/version.dat"
| 0x4
| Home Menu mounts the ngword archive here, then reads version.dat. Home Menu then loads the [[Config_Savegame|cfg]] data for blkID 0x000A0000.
|-
|
|
|
| Home Menu [[NSS:LaunchTitle|launches]] various system-modules here(from a separate thread?).
|-
|
|
|
| Home Menu opens the following NAND shared extdata archives here: 0xf0000001, 0xf0000002, 0xf0000009, 0xf000000b, 0xf000000c, 0xf000000d, and 0xf000000b again.
|-
| NAND [[extdata]] 0xf000000b
| "/ubll.lst"
| 0x2ee0
| Prior to doing the read, Home Menu uses [[FSFile:GetSize]].
|-
|
|
|
| Home Menu opens NAND shared extdata archive 0xf000000b again.
|-
| NAND extdata 0xf000000b
| "/CFL_DB.dat"
| 0xe4c0
| Home Menu only does one read with size 0xe4c0 for this, even though the value it loads from [[FSFile:GetSize]] is larger than that.
|-
| NAND extdata 0xf000000b
| "/CFL_OldDB.dat"
|
| Home Menu just closes this file immediately after opening it, when opening it was successful at least.
|-
|
|
|
| Home Menu loads the [[Config_Savegame|cfg]] data for blkID 0x000C0000 here.
|-
|
|
|
| Home Menu opens NAND shared extdata archive 0xf000000b again.
|-
| NAND extdata 0xf000000b
| [[Extdata|"/gamecoin.dat"]]
| 0x14
| Home Menu first tries to use [[FS:CreateFile]] with this, which will fail when the file already exists. This file is then opened with openflags=RW. After reading this file, Home Menu then uses [[PTM:GetTotalStepCount]], then uses [[FSFile:GetSize]]. Then the service handle for [[NDM_Services|"ndm:u"]] is initialized with srv_GetServiceHandle(done from a separate thread perhaps?). Then Home Menu writes to the already opened gamecoin.dat file.
|-
|
|
|
| [[Filesystem_services|FSUSER:CardSlotIsInserted]] and [[Filesystem_services|FSUSER:GetCardType]] is used here. AM commands are then used to get the inserted gamecard programID, when successful the gamecard ExeFS:/icon is then read.
|-
|
|
|
| [[BOSS_Services|"boss:P"]] service handle initialization with srv_GetServiceHandle is done here. Then [[Services|srv_Subscribe]] is used with various noticationIDs. Home Menu then uses [[FS:IsSdmcDetected]] and [[FS:IsSdmcWritable]]. Home Menu then loads the [[Config_Savegame|cfg]] data for blkID 0x000D0000. Home Menu uses boss:P command 0x4010082, then uses srv_GetServiceHandle for initializing service handles with the following services: [[News_Services|"news:s"]] and "cecd:s".
|-
|
|
|
| srv_GetServiceHandle is used to initialize the service handle for service [[Friend_Services|"frd:a"]], then various service commands are used for that.
|-
| NAND [[extdata]] 0xf000000c
|
|
| Home Menu first attempts to use [[FS:CreateFile]] with "/bashotorya.dat", which normally fails since that file already exists. Home Menu then repeats this with "/bashotorya2.dat".
|-
|
|
|
| Here, Home Menu opens the following SD extdata archives: Home Menu badge SD extdata, Home Menu SD extdata, and the theme-cache SD extdata.
|-
| Home Menu SD extdata
| "/SaveData.dat"
| 0x2da0
| Prior to doing the read, Home Menu uses [[FSFile:GetSize]].
|-
| Home Menu SD extdata
| "/Cache.dat"
| 0x1688
| Prior to doing the read, Home Menu uses [[FSFile:GetSize]].
|-
| Home Menu SD extdata
| "/CacheD.dat"
| 0x36c0
| This is used to read the cached icon data for the currently inserted gamecard, if any. Prior to doing the read, Home Menu uses [[FSFile:GetSize]]. After opening the file and before [[FSFile:GetSize]] is used, Home Menu uses AM commands 0x10070102(for theme DLC) and 0x30084(gamecard "title-listing").
|-
|
|
|
| Home Menu uses the following AM commands for theme DLC here: 0x10050084 and 0x10020104.
|-
| Home Menu Theme SD extdata
| "/BodyCache.bin"
| 0x150000
| Before opening the file, Home Menu firsts opens this archive under a new archive-handle again, then closes it. Prior to doing the read, Home Menu uses [[FSFile:GetSize]].
|-
| Home Menu Theme SD extdata
| "/ThemeManage.bin"
| 0x8
| Prior to doing the read, Home Menu uses [[FSFile:GetSize]](the result is filesize 0x800).
|-
| Home Menu Theme SD extdata
| "/BgmCache.bin"
|
| The data is read from here as needed. After opening the file, Home Menu uses [[FSFile:GetSize]].
|-
|
|
|
| boss:P commands 0x00040000 and 0x04040080 are used here. Home Menu opens NAND shared-extdata 0xf000000e, then closes it when the archive was opened successfully. Then Home Menu uses boss:P command 0x04500102 with the theme extdata, with string "thmtop".
|-
|
|
|
| boss:P command 0x04040080 is used, with the input programID set to the gamecard one. Then boss:P commands 0x000E0000 and 0x00160082 are used.
|-
|
|
|
| [[AMNet:GetTitleIDList|AM:GetTitleIDList]] is used with mediatype=SD and maxTIDs = 0x1c00.
|-
|
|
|
| boss:P command 0x00160082 is used.
|-
|
|
|
| [[PTM_Services|PTM:GetStepHistory]] is used.
|-
|
|
|
| srv_GetServiceHandle is used to initialize the service handle for [[AC_Services|"ac:u"]], then [[AC_Services|ACU:SetClientVersion]] is used. [[Services|srv_Subscribe]] is used, then ACU command 0x002F0004 is used.
|-
|
|
|
| [[AMNet:GetTitleIDList|AM:GetTitleIDList]] is used with mediatype=NAND and maxTIDs = 0x1c00.
|-
| NAND extdata 0xf000000b
| "/gamecoin.dat"
| 0x14
| Home Menu first tries to use FS:CreateFile with this, which will fail when the file already exists. This file is then opened with openflags=RW. After reading this file, Home Menu then uses [[PTM_Services|PTM:GetTotalStepCount]], then uses FSFile:GetSize. Then Home Menu writes to the already opened gamecoin.dat file.

At the same time as doing the above, Home Menu also uses(probably from a different thread) [[AMNet:GetTitleIDList3|AM:GetTitleIDList3]] with mediatype=NAND and maxTIDs=0x2000. Then Home Menu uses [[AMNet:ListTitles|AM:ListTitles]] with the NAND promotional-video titleID. Then Home Menu attempts to open the ExeFS:/icon in the NAND promotional-video title.
|-
| Home Menu [[System_SaveData]]
| "/Launcher.dat"
|
| Prior to doing the write, Home Menu uses [[FSFile:GetSize]]. Home Menu writes 0x2490-bytes to the file here. From a separate thread(?) at the same time, Home Menu also uses [[AM:ReloadDBS]] and AM command 0x00130040 with input=0x1.
|-
|
|
|
| Home Menu loads the u8 value from [[Config_Savegame|cfg]] blkID 0x000E0000 here.
|-
|
|
|
| [[AM:ReloadDBS]], AM command 0x10070102(for theme DLC), AM command 0x00130040, and AM command 0x10050084(for theme DLC) are used here.
At the same time(from a different thread?), the "act:u" service handle is initialized with srv_GetServiceHandle. Then ACTU commands 0x00010084 and 0x000600C2 are used.
|-
|
|
|
| The [[NIM_Services|"nim:u"]] service handle is initialized with srv_GetServiceHandle. Then NIMU commands 0x000F0042, 0x00170042, 0x00150000, and 0x00050000 are used.
|-
|
|
|
| AM command 0x10020104(theme DLC) is used here. Then Home Menu CXI RomFS data is read.
|-
|
|
|
| Home Menu CXI RomFS data is read. [[Filesystem_services|FS:GetSpecialContentIndex]] for the gamecard is used, then MICU initialization is done here(separate thread maybe?).
|-
|
|
|
| [[ACU:GetWifiStatus]] is used, the NAND shared-extdata 0xf000000b archive is then opened here.
|-
| NAND extdata 0xf000000b
| "/idb.dat"
| 0x2008
| This first opens the file for writing, then uses [[FSFile:GetSize]](output filesize is 0x6d4000). Then it writes to the file using size 0, then closes the file. Then [[PTM_Services|PTM:GetStepHistory]] is used. Then Home Menu opens "/idbt.dat", then reads 0x2008-bytes.
|-
|
|
|
| Home Menu starts using [[News_Services|"news:s"]] commands here. While Home Menu is doing this, it also uses(from another thread?) [[NS_and_APT_Services|APT:PrepareToStartNewestHomeMenu]], [[NIM_Services|NIMU:GetState]], and [[NDM_Services|NDMU:OverrideDefaultDaemons]] with input value 0xF.
Later with that news-command code still running, Home Menu also uses the following commands: [[ACU:GetWifiStatus]], [[NDM_Services|NDMU:QueryExclusiveMode]], and CECDS command 0x000E0000. Then [[Config_Savegame|cfg]] blkID 0x000D0000 is loaded.
|-
| NAND extdata 0xf000000b
| "/idbt.dat"
|
| Home Menu writes 0x2008-bytes to this file.
|-
| NAND extdata 0xf000000e
| "/versionList.dat"
| Loaded from the filesize.
|
|-
|
|
|
| boss:P command 0x00200082 is used with string "mmVerDl".
|-
|
|
|
| ...
|-
| Home Menu [[System_SaveData]]
| "/Launcher.dat"
|
| When Home Menu is terminating(?), Home Menu writes 0x2490-bytes to the file here. After doing this, Home Menu opens, writes, and closes the file again.
|}

== Returning to Home Menu from a crashed application ==
When returning to Home Menu from an application that didn't properly shutdown(like with an exception), PTM module writes data to the PTM system savedata. Then the system terminates Home Menu, and starts Home Menu again.

== See Also ==
* http://www.nintendo.com/consumer/systems/3ds/en_na/menu_update.jsp
* http://www.nintendo.co.jp/netinfo/3ds/JPN/ja.html
* http://yls8.mtheall.com/ninupdates/reports.php

PTMSYSM:ClearSoftwareClosedFlag

2016-05-17T03:50:58Z

Dazzozo: Created page with "=Request= {| class="wikitable" border="1" |- ! Index Word ! Description |- | 0 | Header code [0x08100000] |} =Response= {| class="wikitable" border="1" |- ! Index Word !..."

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x08100000]
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code
|-
| 1
| Result code
|}

=Description=
This is an abstraction for [[MCURTC:SetSoftwareClosedFlag]], used by Home Menu after the "Software closed" dialog has been displayed to clear the flag.

See also [[PTMSYSM:GetSoftwareClosedFlag]].

System Settings

2016-05-17T00:12:06Z

Dazzozo: /* Parental Controls Reset */

'''System Settings''' allows you to manage various settings, use [[System Transfer]], and use Data Management.

All applications(CTR/TWL) launched by System Settings are launched via [[NS|APT:PrepareToDoApplicationJump/APT:DoApplicationJump]], such as DS INTERNET and [[System Transfer]].

== Accessible services ==

{| class="wikitable" border="1"
|-
! Service
! Last seen on version
|-
| [[Filesystem_services#Filesystem_service_.22fs:USER.22|fs:USER]]
| [[9.0.0-20|v8202]]
|-
| [[GSP_Services|gsp:Gpu]]
| [[9.0.0-20|v8202]]
|-
| [[NDM_Services|ndm:u]]
| [[9.0.0-20|v8202]]
|-
| [[NS#.22APT:A.22_Service|APT:A]]
| [[9.0.0-20|v8202]]
|-
| [[AC_Services|ac:i]]
| [[9.0.0-20|v8202]]
|-
| [[ACT_Services|act:a]]
| [[9.0.0-20|v8202]]
|-
| [[Application_Manager_Services#Application_Manager_services|am:sys]]
| [[9.0.0-20|v8202]]
|-
| [[BOSS_Services|boss:P]]
| [[9.0.0-20|v8202]]
|-
| [[Camera_Services#cam:s_.28PORT_CAL.29|cam:s]]
| [[9.0.0-20|v8202]]
|-
| [[CECD_Services|cecd:s]]
| [[9.0.0-20|v8202]]
|-
| [[Config_Services#Config_NVRAM_service_.22cfg:nor.22|cfg:nor]]
| [[9.0.0-20|v8202]]
|-
| [[DSP_Services|dsp::DSP]]
| [[9.0.0-20|v8202]]
|-
| [[Friend_Services|frd:a]]
| [[9.0.0-20|v8202]]
|-
| [[GSP_Services|gsp::Lcd]]
| [[9.0.0-20|v8202]]
|-
| [[HTTP_Services|http:C]]
| [[9.0.0-20|v8202]]
|-
| [[MIC_Services|mic:u]]
| [[9.0.0-20|v8202]]
|-
| [[News_Services#News_service_.22news:s.22|news:s]]
| [[9.0.0-20|v8202]]
|-
| [[NIM_Services#NIM_user_service_.22nim:u.22|nim:u]]
| [[9.0.0-20|v8202]]
|-
| [[NS#NS_Service_.22ns:s.22|ns:s]]
| [[9.0.0-20|v8202]]
|-
| [[NWM_Services#NWM_service_.22nwm::EXT.22|nwm::EXT]]
| [[9.0.0-20|v8202]]
|-
| [[NWM_Services#NWM_infrastructure_service_.22nwm::INF.22|nwm::INF]]
| [[9.0.0-20|v8202]]
|-
| [[NWM_Services#NWM_socket_service_.22nwm::SOC.22|nwm::SOC]]
| [[9.0.0-20|v8202]]
|-
| [[PTM_Services#GetSystemTime_PTM_Service_.22ptm:gets.22|ptm:gets]]
| [[9.0.0-20|v8202]]
|-
| [[PTM_Services#SysMenu_PTM_Service_.22ptm:sysm.22|ptm:sysm]]
| [[9.0.0-20|v8202]]
|-
| [[Socket_Services#Socket_privileged_service_.22soc:P.22|soc:P]]
| [[9.0.0-20|v8202]]
|-
| [[Socket_Services#Socket_user_service_.22soc:U.22|soc:U]]
| [[9.0.0-20|v8202]]
|-
| [[SSL_Services|ssl:C]]
| [[9.0.0-20|v8202]]
|-
| [[Camera_Services#y2r:u|y2r:u]]
| [[9.0.0-20|v8202]]
|-
| [[QTM_Services#QTM_system_service_.22qtm:s.22|qtm:s]]
| [[9.0.0-20|v8202]]
|-
| [[Config_Services#Config_service_.22cfg:i.22|cfg:i]]
| [[9.0.0-20|v8202]]
|-
| [[HID_Services#HID_service_.22hid:SPVR.22|hid:SPVR]]
| [[9.0.0-20|v8202]]
|}

== Data Management ==

=== 3DS ===

Here you can manage 3DS extra data, and 3DSWare/"Software".

When managing 3DS Software installed to the SD Card, the [[Title Database|title.db]] is read by the core receiving [[Application Manager Services PXI|AM]] commands. From the title.db file, AM gets a list of installed titles, title sizes and the name of the ".cmd" file for each title, which is used to check the authenticity of the title data(product code, title version, and if an electronic manaual is used, is also kept for each title, in the title.db, but won't be used by the Data Management Utility). For each title listed, it checks if the title is authentic(via the .cmd file). If the title passes authentication, Data Management decrypts/reads the ICN data from the executable NCCH([[CXI]]) and displays it along with the archived title size. If a title doesn't pass authentication, a placeholder icon(light grey with a '?' in the center), name ('????????') and a size of zero are used. Deleting titles removes the title data from the title.db and import.db, and deletes the directory of the content.

=== DSiWare ===

See [[DSiWare Exports]].

== System Format ==
Most of the System Format is done with [[FS:InitializeCtrFileSystem]]. This command updates the high u64 of the keyY stored in [[Nand/private/movable.sed|movable.sed]]. Since this keyY was updated, the data stored on [[SD_Filesystem|SD]] card(sdmc/Nintendo 3DS/<ID0>/<ID1>) and the data under [[Flash_Filesystem|nand/data/<ID0>]] is rendered useless, since that data used the old keyY. Since that data is no longer usable, the system then deletes the two above SD/NAND directories.

When you first enter the System Format menu, it will check if a NNID is linked. If there's a linked-NNID, it will then display: "Are you ready to connect to the Internet to check whether data can be formatted"? Continuing will only result in connecting to wifi for checking in with Nintendo's servers, which may fail if the console is banned. Once that's done it will continue with the usual system-format messages; proceeding will result in the NNID cookie, potentially still present on NAND backups or multiboot scenarios, being invalidated until the next sign-in (at which point even old sessions will be valid again).

== System Updater ==
The system updater title is identical to the regular system settings, except only system update is accessible with this. On dev units, this title can only be launched under certain conditions.

On retail units, this title is accessible in scenarios where you have to update via the Internet to use certain 3DS software other than the home menu. i.e. using the eShop, on a system version less than the current one. When one selects "Cancel" from here on retail, the system will shutdown. [[NS]] launches SAFE_MODE_FIRM for running this title, when the [[Configuration_Memory|UPDATEFLAG]] is set during system boot.

==Exiting System Settings==
Upon exit, the system reboots instead of simply returning to home menu.

== Parental Controls Reset ==
The following refers to the functionality which generates the Parental Controls "Master Key".

{| class="wikitable" border="1"
|-
! System Version, for the mset title
! Parental controls reset functionality version
! Notes
|-
| [[1.0.0-0|1.0.0-X]] - [[6.3.0-12|6.3.0-X]]
| v0
| Mostly inherited from the Wii/DSi algorithm which used CRC-32 (0xEDB88320) with custom XOR-out (0xAAAA). 0x14C1 was added to produce the final result.

For the 3DS algorithm, only constants were changed: the polynomial was changed to 0xEDBA6320 and the addition constant became 0x1657.

The input to either function is an ASCII string of the format "%02u%02u%04u" where the parameters are month, day, and low 4 digits of the inquiry number. The low 5 decimal digits from the output u32 are then used for the master key.

Because of the date being used in the algorithm, this results in the master key only being valid on a particular day, though this is trivially defeated by setting the system time to the correct date that the key was generated on.

This had a minor refactor in [[6.0.0-11|6.0.0-X]] but is functionally identical.
|-
| [[7.0.0-13|7.0.0-X]] - [[7.1.0-16|7.1.0-X]]
| v1
|
|-
| [[7.2.0-17|7.2.0-X]] - current
| v2
|
|}

== ExtData ==
The ExtData [[Extdata#Filesystem|File System]] for System Settings is as follows:

root
├── icon
├── boss
└── user
├── Backup.dat
└── MsetExt.dat

{| class="wikitable" border="1"
|-
! File
! Details
! Size
! FW Introduced
! Plaintext
|-
| icon
| Stubbed. Always image 00000002.
| 0x4 Bytes
| n/a
|
|-
| MsetExt.dat
| [[DSiWare Exports]] Management
| 0x960 Bytes
| [[2.0.0-2]]
| [https://dl.dropboxusercontent.com/u/60710927/CTR/Sample/SystemSettingsExtdata/MsetExt.dat Download]
|-
| Backup.dat
| [[SD Savedata Backups]] Management
| 0xf5a0 Bytes
| [[6.0.0-11]]
| [https://dl.dropboxusercontent.com/u/60710927/CTR/Sample/SystemSettingsExtdata/Backup.dat Download]
|}

=== MsetExt.dat ===
This keeps a record for the DSiWare Exports for a maximum of 300 exports. Each record is in the format:
{| class="wikitable" border="1"
|-
! OFFSET
! SIZE
! DESCRIPTION
|-
| 0
| 4
| Game Code in Little Endian
|-
| 0x4
| 4
| Reserved
|}

All unused entries are filled with "0xff".

=== Backup.dat ===
This keeps a record for the 30 save data backup slots for [[SD Savedata Backups]]. Each entry corresponds to an individual backup slot.

Entry:
{| class="wikitable" border="1"
|-
! OFFSET
! SIZE
! DESCRIPTION
|-
| 0x000
| 8
| Reserved
|-
| 0x8
| 0x800 (0x80*16)
| 16 UTF-16 Title Strings
|-
| 0x808
| 8
| Title ID
|-
| 0x810
| 8
| Unknown
|-
| 0x818
| 8
| Total Save Data Size
|-
| 0x820
| 0x10
| Reserved
|}

System Settings

2016-05-17T00:01:32Z

Dazzozo: /* Parental Controls Reset */

'''System Settings''' allows you to manage various settings, use [[System Transfer]], and use Data Management.

All applications(CTR/TWL) launched by System Settings are launched via [[NS|APT:PrepareToDoApplicationJump/APT:DoApplicationJump]], such as DS INTERNET and [[System Transfer]].

== Accessible services ==

{| class="wikitable" border="1"
|-
! Service
! Last seen on version
|-
| [[Filesystem_services#Filesystem_service_.22fs:USER.22|fs:USER]]
| [[9.0.0-20|v8202]]
|-
| [[GSP_Services|gsp:Gpu]]
| [[9.0.0-20|v8202]]
|-
| [[NDM_Services|ndm:u]]
| [[9.0.0-20|v8202]]
|-
| [[NS#.22APT:A.22_Service|APT:A]]
| [[9.0.0-20|v8202]]
|-
| [[AC_Services|ac:i]]
| [[9.0.0-20|v8202]]
|-
| [[ACT_Services|act:a]]
| [[9.0.0-20|v8202]]
|-
| [[Application_Manager_Services#Application_Manager_services|am:sys]]
| [[9.0.0-20|v8202]]
|-
| [[BOSS_Services|boss:P]]
| [[9.0.0-20|v8202]]
|-
| [[Camera_Services#cam:s_.28PORT_CAL.29|cam:s]]
| [[9.0.0-20|v8202]]
|-
| [[CECD_Services|cecd:s]]
| [[9.0.0-20|v8202]]
|-
| [[Config_Services#Config_NVRAM_service_.22cfg:nor.22|cfg:nor]]
| [[9.0.0-20|v8202]]
|-
| [[DSP_Services|dsp::DSP]]
| [[9.0.0-20|v8202]]
|-
| [[Friend_Services|frd:a]]
| [[9.0.0-20|v8202]]
|-
| [[GSP_Services|gsp::Lcd]]
| [[9.0.0-20|v8202]]
|-
| [[HTTP_Services|http:C]]
| [[9.0.0-20|v8202]]
|-
| [[MIC_Services|mic:u]]
| [[9.0.0-20|v8202]]
|-
| [[News_Services#News_service_.22news:s.22|news:s]]
| [[9.0.0-20|v8202]]
|-
| [[NIM_Services#NIM_user_service_.22nim:u.22|nim:u]]
| [[9.0.0-20|v8202]]
|-
| [[NS#NS_Service_.22ns:s.22|ns:s]]
| [[9.0.0-20|v8202]]
|-
| [[NWM_Services#NWM_service_.22nwm::EXT.22|nwm::EXT]]
| [[9.0.0-20|v8202]]
|-
| [[NWM_Services#NWM_infrastructure_service_.22nwm::INF.22|nwm::INF]]
| [[9.0.0-20|v8202]]
|-
| [[NWM_Services#NWM_socket_service_.22nwm::SOC.22|nwm::SOC]]
| [[9.0.0-20|v8202]]
|-
| [[PTM_Services#GetSystemTime_PTM_Service_.22ptm:gets.22|ptm:gets]]
| [[9.0.0-20|v8202]]
|-
| [[PTM_Services#SysMenu_PTM_Service_.22ptm:sysm.22|ptm:sysm]]
| [[9.0.0-20|v8202]]
|-
| [[Socket_Services#Socket_privileged_service_.22soc:P.22|soc:P]]
| [[9.0.0-20|v8202]]
|-
| [[Socket_Services#Socket_user_service_.22soc:U.22|soc:U]]
| [[9.0.0-20|v8202]]
|-
| [[SSL_Services|ssl:C]]
| [[9.0.0-20|v8202]]
|-
| [[Camera_Services#y2r:u|y2r:u]]
| [[9.0.0-20|v8202]]
|-
| [[QTM_Services#QTM_system_service_.22qtm:s.22|qtm:s]]
| [[9.0.0-20|v8202]]
|-
| [[Config_Services#Config_service_.22cfg:i.22|cfg:i]]
| [[9.0.0-20|v8202]]
|-
| [[HID_Services#HID_service_.22hid:SPVR.22|hid:SPVR]]
| [[9.0.0-20|v8202]]
|}

== Data Management ==

=== 3DS ===

Here you can manage 3DS extra data, and 3DSWare/"Software".

When managing 3DS Software installed to the SD Card, the [[Title Database|title.db]] is read by the core receiving [[Application Manager Services PXI|AM]] commands. From the title.db file, AM gets a list of installed titles, title sizes and the name of the ".cmd" file for each title, which is used to check the authenticity of the title data(product code, title version, and if an electronic manaual is used, is also kept for each title, in the title.db, but won't be used by the Data Management Utility). For each title listed, it checks if the title is authentic(via the .cmd file). If the title passes authentication, Data Management decrypts/reads the ICN data from the executable NCCH([[CXI]]) and displays it along with the archived title size. If a title doesn't pass authentication, a placeholder icon(light grey with a '?' in the center), name ('????????') and a size of zero are used. Deleting titles removes the title data from the title.db and import.db, and deletes the directory of the content.

=== DSiWare ===

See [[DSiWare Exports]].

== System Format ==
Most of the System Format is done with [[FS:InitializeCtrFileSystem]]. This command updates the high u64 of the keyY stored in [[Nand/private/movable.sed|movable.sed]]. Since this keyY was updated, the data stored on [[SD_Filesystem|SD]] card(sdmc/Nintendo 3DS/<ID0>/<ID1>) and the data under [[Flash_Filesystem|nand/data/<ID0>]] is rendered useless, since that data used the old keyY. Since that data is no longer usable, the system then deletes the two above SD/NAND directories.

When you first enter the System Format menu, it will check if a NNID is linked. If there's a linked-NNID, it will then display: "Are you ready to connect to the Internet to check whether data can be formatted"? Continuing will only result in connecting to wifi for checking in with Nintendo's servers, which may fail if the console is banned. Once that's done it will continue with the usual system-format messages; proceeding will result in the NNID cookie, potentially still present on NAND backups or multiboot scenarios, being invalidated until the next sign-in (at which point even old sessions will be valid again).

== System Updater ==
The system updater title is identical to the regular system settings, except only system update is accessible with this. On dev units, this title can only be launched under certain conditions.

On retail units, this title is accessible in scenarios where you have to update via the Internet to use certain 3DS software other than the home menu. i.e. using the eShop, on a system version less than the current one. When one selects "Cancel" from here on retail, the system will shutdown. [[NS]] launches SAFE_MODE_FIRM for running this title, when the [[Configuration_Memory|UPDATEFLAG]] is set during system boot.

==Exiting System Settings==
Upon exit, the system reboots instead of simply returning to home menu.

== Parental Controls Reset ==
The following refers to the functionality which generates the Parental Controls "Master Key".

{| class="wikitable" border="1"
|-
! System Version, for the mset title
! Parental controls reset functionality version
! Notes
|-
| [[1.0.0-0|1.0.0-X]] - [[6.3.0-12|6.3.0-X]]
| v0
| This had a minor refactor in [[6.0.0-11|6.0.0-X]] but is functionally identical.
|-
| [[7.0.0-13|7.0.0-X]] - [[7.1.0-16|7.1.0-X]]
| v1
|
|-
| [[7.2.0-17|7.2.0-X]] - current
| v2
|
|}

== ExtData ==
The ExtData [[Extdata#Filesystem|File System]] for System Settings is as follows:

root
├── icon
├── boss
└── user
├── Backup.dat
└── MsetExt.dat

{| class="wikitable" border="1"
|-
! File
! Details
! Size
! FW Introduced
! Plaintext
|-
| icon
| Stubbed. Always image 00000002.
| 0x4 Bytes
| n/a
|
|-
| MsetExt.dat
| [[DSiWare Exports]] Management
| 0x960 Bytes
| [[2.0.0-2]]
| [https://dl.dropboxusercontent.com/u/60710927/CTR/Sample/SystemSettingsExtdata/MsetExt.dat Download]
|-
| Backup.dat
| [[SD Savedata Backups]] Management
| 0xf5a0 Bytes
| [[6.0.0-11]]
| [https://dl.dropboxusercontent.com/u/60710927/CTR/Sample/SystemSettingsExtdata/Backup.dat Download]
|}

=== MsetExt.dat ===
This keeps a record for the DSiWare Exports for a maximum of 300 exports. Each record is in the format:
{| class="wikitable" border="1"
|-
! OFFSET
! SIZE
! DESCRIPTION
|-
| 0
| 4
| Game Code in Little Endian
|-
| 0x4
| 4
| Reserved
|}

All unused entries are filled with "0xff".

=== Backup.dat ===
This keeps a record for the 30 save data backup slots for [[SD Savedata Backups]]. Each entry corresponds to an individual backup slot.

Entry:
{| class="wikitable" border="1"
|-
! OFFSET
! SIZE
! DESCRIPTION
|-
| 0x000
| 8
| Reserved
|-
| 0x8
| 0x800 (0x80*16)
| 16 UTF-16 Title Strings
|-
| 0x808
| 8
| Title ID
|-
| 0x810
| 8
| Unknown
|-
| 0x818
| 8
| Total Save Data Size
|-
| 0x820
| 0x10
| Reserved
|}

System Settings

2016-05-16T23:19:30Z

Dazzozo:

'''System Settings''' allows you to manage various settings, use [[System Transfer]], and use Data Management.

All applications(CTR/TWL) launched by System Settings are launched via [[NS|APT:PrepareToDoApplicationJump/APT:DoApplicationJump]], such as DS INTERNET and [[System Transfer]].

== Accessible services ==

{| class="wikitable" border="1"
|-
! Service
! Last seen on version
|-
| [[Filesystem_services#Filesystem_service_.22fs:USER.22|fs:USER]]
| [[9.0.0-20|v8202]]
|-
| [[GSP_Services|gsp:Gpu]]
| [[9.0.0-20|v8202]]
|-
| [[NDM_Services|ndm:u]]
| [[9.0.0-20|v8202]]
|-
| [[NS#.22APT:A.22_Service|APT:A]]
| [[9.0.0-20|v8202]]
|-
| [[AC_Services|ac:i]]
| [[9.0.0-20|v8202]]
|-
| [[ACT_Services|act:a]]
| [[9.0.0-20|v8202]]
|-
| [[Application_Manager_Services#Application_Manager_services|am:sys]]
| [[9.0.0-20|v8202]]
|-
| [[BOSS_Services|boss:P]]
| [[9.0.0-20|v8202]]
|-
| [[Camera_Services#cam:s_.28PORT_CAL.29|cam:s]]
| [[9.0.0-20|v8202]]
|-
| [[CECD_Services|cecd:s]]
| [[9.0.0-20|v8202]]
|-
| [[Config_Services#Config_NVRAM_service_.22cfg:nor.22|cfg:nor]]
| [[9.0.0-20|v8202]]
|-
| [[DSP_Services|dsp::DSP]]
| [[9.0.0-20|v8202]]
|-
| [[Friend_Services|frd:a]]
| [[9.0.0-20|v8202]]
|-
| [[GSP_Services|gsp::Lcd]]
| [[9.0.0-20|v8202]]
|-
| [[HTTP_Services|http:C]]
| [[9.0.0-20|v8202]]
|-
| [[MIC_Services|mic:u]]
| [[9.0.0-20|v8202]]
|-
| [[News_Services#News_service_.22news:s.22|news:s]]
| [[9.0.0-20|v8202]]
|-
| [[NIM_Services#NIM_user_service_.22nim:u.22|nim:u]]
| [[9.0.0-20|v8202]]
|-
| [[NS#NS_Service_.22ns:s.22|ns:s]]
| [[9.0.0-20|v8202]]
|-
| [[NWM_Services#NWM_service_.22nwm::EXT.22|nwm::EXT]]
| [[9.0.0-20|v8202]]
|-
| [[NWM_Services#NWM_infrastructure_service_.22nwm::INF.22|nwm::INF]]
| [[9.0.0-20|v8202]]
|-
| [[NWM_Services#NWM_socket_service_.22nwm::SOC.22|nwm::SOC]]
| [[9.0.0-20|v8202]]
|-
| [[PTM_Services#GetSystemTime_PTM_Service_.22ptm:gets.22|ptm:gets]]
| [[9.0.0-20|v8202]]
|-
| [[PTM_Services#SysMenu_PTM_Service_.22ptm:sysm.22|ptm:sysm]]
| [[9.0.0-20|v8202]]
|-
| [[Socket_Services#Socket_privileged_service_.22soc:P.22|soc:P]]
| [[9.0.0-20|v8202]]
|-
| [[Socket_Services#Socket_user_service_.22soc:U.22|soc:U]]
| [[9.0.0-20|v8202]]
|-
| [[SSL_Services|ssl:C]]
| [[9.0.0-20|v8202]]
|-
| [[Camera_Services#y2r:u|y2r:u]]
| [[9.0.0-20|v8202]]
|-
| [[QTM_Services#QTM_system_service_.22qtm:s.22|qtm:s]]
| [[9.0.0-20|v8202]]
|-
| [[Config_Services#Config_service_.22cfg:i.22|cfg:i]]
| [[9.0.0-20|v8202]]
|-
| [[HID_Services#HID_service_.22hid:SPVR.22|hid:SPVR]]
| [[9.0.0-20|v8202]]
|}

== Data Management ==

=== 3DS ===

Here you can manage 3DS extra data, and 3DSWare/"Software".

When managing 3DS Software installed to the SD Card, the [[Title Database|title.db]] is read by the core receiving [[Application Manager Services PXI|AM]] commands. From the title.db file, AM gets a list of installed titles, title sizes and the name of the ".cmd" file for each title, which is used to check the authenticity of the title data(product code, title version, and if an electronic manaual is used, is also kept for each title, in the title.db, but won't be used by the Data Management Utility). For each title listed, it checks if the title is authentic(via the .cmd file). If the title passes authentication, Data Management decrypts/reads the ICN data from the executable NCCH([[CXI]]) and displays it along with the archived title size. If a title doesn't pass authentication, a placeholder icon(light grey with a '?' in the center), name ('????????') and a size of zero are used. Deleting titles removes the title data from the title.db and import.db, and deletes the directory of the content.

=== DSiWare ===

See [[DSiWare Exports]].

== System Format ==
Most of the System Format is done with [[FS:InitializeCtrFileSystem]]. This command updates the high u64 of the keyY stored in [[Nand/private/movable.sed|movable.sed]]. Since this keyY was updated, the data stored on [[SD_Filesystem|SD]] card(sdmc/Nintendo 3DS/<ID0>/<ID1>) and the data under [[Flash_Filesystem|nand/data/<ID0>]] is rendered useless, since that data used the old keyY. Since that data is no longer usable, the system then deletes the two above SD/NAND directories.

When you first enter the System Format menu, it will check if a NNID is linked. If there's a linked-NNID, it will then display: "Are you ready to connect to the Internet to check whether data can be formatted"? Continuing will only result in connecting to wifi for checking in with Nintendo's servers, which may fail if the console is banned. Once that's done it will continue with the usual system-format messages; proceeding will result in the NNID cookie, potentially still present on NAND backups or multiboot scenarios, being invalidated until the next sign-in (at which point even old sessions will be valid again).

== System Updater ==
The system updater title is identical to the regular system settings, except only system update is accessible with this. On dev units, this title can only be launched under certain conditions.

On retail units, this title is accessible in scenarios where you have to update via the Internet to use certain 3DS software other than the home menu. i.e. using the eShop, on a system version less than the current one. When one selects "Cancel" from here on retail, the system will shutdown. [[NS]] launches SAFE_MODE_FIRM for running this title, when the [[Configuration_Memory|UPDATEFLAG]] is set during system boot.

==Exiting System Settings==
Upon exit, the system reboots instead of simply returning to home menu.

== Parental Controls Reset ==
The following refers to the functionality which generates the Parental Controls "Master Key".

{| class="wikitable" border="1"
|-
! System Version, for the mset title
! Parental controls reset functionality version
! Notes
|-
| [[1.0.0-0|1.0.0-X]] - [[6.3.0-12|6.3.0-X]]
| v0
|
|-
| [[7.0.0-13|7.0.0-X]] - [[7.1.0-16|7.1.0-X]]
| v1
|
|-
| [[7.2.0-17|7.2.0-X]] - current
| v2
|
|}

== ExtData ==
The ExtData [[Extdata#Filesystem|File System]] for System Settings is as follows:

root
├── icon
├── boss
└── user
├── Backup.dat
└── MsetExt.dat

{| class="wikitable" border="1"
|-
! File
! Details
! Size
! FW Introduced
! Plaintext
|-
| icon
| Stubbed. Always image 00000002.
| 0x4 Bytes
| n/a
|
|-
| MsetExt.dat
| [[DSiWare Exports]] Management
| 0x960 Bytes
| [[2.0.0-2]]
| [https://dl.dropboxusercontent.com/u/60710927/CTR/Sample/SystemSettingsExtdata/MsetExt.dat Download]
|-
| Backup.dat
| [[SD Savedata Backups]] Management
| 0xf5a0 Bytes
| [[6.0.0-11]]
| [https://dl.dropboxusercontent.com/u/60710927/CTR/Sample/SystemSettingsExtdata/Backup.dat Download]
|}

=== MsetExt.dat ===
This keeps a record for the DSiWare Exports for a maximum of 300 exports. Each record is in the format:
{| class="wikitable" border="1"
|-
! OFFSET
! SIZE
! DESCRIPTION
|-
| 0
| 4
| Game Code in Little Endian
|-
| 0x4
| 4
| Reserved
|}

All unused entries are filled with "0xff".

=== Backup.dat ===
This keeps a record for the 30 save data backup slots for [[SD Savedata Backups]]. Each entry corresponds to an individual backup slot.

Entry:
{| class="wikitable" border="1"
|-
! OFFSET
! SIZE
! DESCRIPTION
|-
| 0x000
| 8
| Reserved
|-
| 0x8
| 0x800 (0x80*16)
| 16 UTF-16 Title Strings
|-
| 0x808
| 8
| Title ID
|-
| 0x810
| 8
| Unknown
|-
| 0x818
| 8
| Total Save Data Size
|-
| 0x820
| 0x10
| Reserved
|}

Homebrew Exploits

2016-05-10T00:39:56Z

Dazzozo: remove aids

==Standalone Homebrew Launcher Exploits==
The following homebrew exploits can be executed on a previously un-exploited system.

{| class="wikitable" border="1"
|-
! Works on latest fw
! Name
! Supported firmwares
! Requirements
! Author
! Install
|-
| style="background: salmon" | No
| [[ninjhax|Ninjhax 1.1b]]
| From '''4.0.0-7''' up to and including '''9.2.0-20'''.
| A cartridge or eShop version (JPN-only) of "Cubic Ninja".
| smea
| [http://smealum.net/ninjhax/ Install]
|-
| style="background: salmon" | No
| [[ninjhax|Ninjhax 2.5]]
| From '''9.0.0-7''' up to and including '''10.7.0-32'''.
| A cartridge or eShop version (JPN-only) of "Cubic Ninja".
| smea
| [https://smealum.github.io/ninjhax2/ Install]
|-
| style="background: lightgreen" | Yes
| [[smashbroshax|smashbroshax]] (beaconhax)
| (New 3DS only) From '''9.0.0-X''' up to and including '''11.0.0-33'''.
| Super Smash Bros 3DS (full-game) and a way to broadcast raw wifi beacons. The demo(prior to the updated November 2015 [https://github.com/yellows8/3ds_smashbroshax version]) isn't usable with the *hax payloads. Game-version v1.1.3 fixed the vuln used with this, see the repo for a workaround for that.
| [[User:Yellows8|Yellows8]]
| [https://github.com/yellows8/3ds_smashbroshax Install]
|-
| style="background: salmon" | No
| [[browserhax]]
| (Old 3DS) From '''9.0.0-16''' to '''9.5.0-22''', '''9.5.0-23''' to '''9.8.0-25''', '''9.9.0-26''' to '''10.1.0-27''', '''10.2.0-28''' to '''10.5.0-30'''

(New 3DS) From '''9.0.0-20''' to '''9.2.0-20''', '''9.3.0-21''' to '''9.5.0-23''', '''9.6.0-24''' to '''9.8.0-25''', '''9.9.0-26''' to '''10.1.0-27''', '''10.2.0-28''' to '''10.5.0-30'''

Note that the browser-version-check bypass is only usable prior to [[10.7.0-32]].
| An USA, EUR, or JPN system.
| [[User:Yellows8|Yellows8]]
| [http://yls8.mtheall.com/3dsbrowserhax.php Install]
|}

Note that ninjhax 1.x is still not obsolete. Even though ninjhax 2.x can be run on 9.3+, this was made possible (amongst other things) by sacrificing the memory remapping exploit used in ninjhax 1.x (rohax). Therefore, things like JIT engines for emulators can only be supported on ninjhax 1.x. Furthermore, ninjhax 2.x does not run on system versions below 9.0.0-X, while ninjhax 1.x does.

==Secondary Exploits==
Installation of these exploits requires a previously exploited system to install. After installation, they can be used on their own.

{| class="wikitable" border="1"
! Works on latest fw
! Name
! Supported firmwares
! Requirements
! Author
! Install
|-
| style="background: salmon" | No
| [[ironhax]]
| From '''9.5.0-X''' up to and including '''10.3.0-X''', for '''X''' up to and including 28.
| A copy of "Ironfall: Invasion" downloaded from eShop before August 11th, 2015. Note the updated version that was released on October 13th, 2015 is not supported.
| smea
| [http://smealum.github.io/3ds/ Install]
|-
| style="background: salmon" | No
| [https://github.com/yellows8/oot3dhax oot3dhax]
| From '''9.0.0-X''' up to and including '''10.7.0-X''', for '''X''' up to and including 32.
| A gamecard or eShop-install of Legend of Zelda: Ocarina of Time 3D. Besides using the installer app, writing raw saveimages with a save dongle for example is another option. Due to lack of free space with the size of the *hax payload, the only save-slot that can exist in the *gamecard* savedata is the oot3dhax save-slot.
| Yellows8 / smea et al.
| See [https://smealum.github.io/3ds/ here].
|-
| style="background: salmon" | No
| [[menuhax]]
| From '''9.0.0-X''' up to and including '''10.5.0-X''', for '''X''' up to and including 30.
|
| [[User:Yellows8|Yellows8]]
| [https://github.com/yellows8/3ds_homemenuhax/releases Download]
|-
| style="background: lightgreen" | Yes
| [https://github.com/shinyquagsire23/supermysterychunkhax supermysterychunkhax]
| From '''9.9.0-X''' (USA/JPN) / '''11.0.0-X''' (EUR) up to and including '''10.7.0-X''', for '''X''' up to and including 33.
| A gamecard or eShop-install of Pokémon Super Mystery Dungeon.
| Shiny Quagsire / SALT team
| [https://smd.salthax.org/ Install].
|-
| style="background: lightgreen" | Yes
| [https://github.com/shinyquagsire23/v_hax (v*)hax]
| From '''9.0.0-X''' up to and including '''11.0.0-X''', for '''X''' up to and including 33.
Note that '''9.0.0-X''' is only required for the Homebrew Launcher - the game itself only requires '''2.1.0-X''' for primitive userland code execution.
| A copy of VVVVVV downloaded after March 2012 (v1)
| Shiny Quagsire / SALT team
| [https://vvvvvv.salthax.org/ Install].
|-
| style="background: lightgreen" | Yes
| [https://github.com/Dazzozo/humblehax humblehax]
| From '''9.0.0-X''' (USA/EUR) up to and including '''11.0.0-X''', for '''X''' up to and including 33.
| An eShop-install of Citizens of Earth, featured in the Humble "Friends of Nintendo" Bundle.
| Dazzozo / SALT team
| [https://citizens.salthax.org/ Install].
|}

==Exploits without Homebrew Launcher (Not recommended)==

'''Warning:''' The following exploits can run code, but are missing a 3DSX launcher. They cannot launch any homebrew in the 3DSX format.

{| class="wikitable" border="1"
|-
! Works on latest fw
! Name
! Supported firmwares
! Requirements
! Author
! Install
|-
| style="background: salmon" | No
| [[browserhax]] (Without the loader in the 3ds_browserhax_common repo)
| (Old3DS) From '''2.1.0-4''' to '''3.0.0-6''', '''4.0.0-7''' to '''4.5.0-10''', '''5.0.0-11''' to '''7.0.0-13''', '''7.1.0-16''' to '''9.5.0-22''', '''9.5.0-23''' to '''9.8.0-25''', '''9.9.0-26''' to '''10.1.0-27''', '''10.2.0-28''' to '''10.5.0-30'''

(New3DS) From '''9.0.0-20''' to '''9.2.0-20''', '''9.3.0-21''' to '''9.5.0-23''', '''9.6.0-24''' to '''9.8.0-25''', '''9.9.0-26''' to '''10.1.0-27''', '''10.2.0-28''' to '''10.5.0-30'''

Note that the browser-version-check bypass is only usable prior to [[10.7.0-32]].
| An USA, EUR, or JPN system.
| [[User:Yellows8|Yellows8]]
| [[browserhax|Install]]
|}

==Previous Exploits==
'''Warning:''' These exploits '''do not work'''. They are exploits which no longer function at all, regardless of software or firmware revision.
{| class="wikitable" border="1"
! Works on latest fw
! Name
! Supported firmwares
! Requirements
! Author
! Install
|-
| style="background: salmon" | No
| [[tubehax|Tubehax]]
| None. '''Was''': From '''9.0.0-X''' up to and including '''10.1.0-X''', for '''X''' up to and including 27.
| The YouTube application and an Internet connection. As of October 15, 2015, this is no longer usable due to an update being released which fixes the vuln used by tubehax + app update being forced(see [[YouTube|here]]).
| smea
| [http://smealum.github.io/3ds/ Install]
|}

==Other Homebrew Loaders==
The [https://github.com/yellows8/hblauncher_loader hblauncher_loader] title can be used when running under modded-FIRM which allows running unsigned titles, to boot the *hax payloads.

==Sysmodule Exploits==
This section is for system-module exploits, which can be run from the *hax payloads.

{| class="wikitable" border="1"
! Works on latest fw
! Name
! Supported firmwares
! Requirements
! Author
|-
| Yes, that's not the intended default use however.
| [https://github.com/yellows8/ctr-httpwn/releases ctr-httpwn]
| From '''9.6.0-X''' up to and including '''10.7.0-X''', for '''X''' up to and including 32.
| None
| [[User:Yellows8|Yellows8]]
|}

==WebKit vuln testing==
See [https://github.com/yellows8/3ds_browserhax_common/issues/28 here].

Homebrew Exploits

2016-05-09T23:30:31Z

Dazzozo:

==Standalone Homebrew Launcher Exploits==
The following homebrew exploits can be executed on a previously un-exploited system.
'''WARNING!!! These exploits are only proven at best to work on 10.7.0-32!!! These may no longer function in 11.0.0-33!!!'''

{| class="wikitable" border="1"
|-
! Works on latest fw
! Name
! Supported firmwares
! Requirements
! Author
! Install
|-
| style="background: salmon" | No
| [[ninjhax|Ninjhax 1.1b]]
| From '''4.0.0-7''' up to and including '''9.2.0-20'''.
| A cartridge or eShop version (JPN-only) of "Cubic Ninja".
| smea
| [http://smealum.net/ninjhax/ Install]
|-
| style="background: salmon" | No
| [[ninjhax|Ninjhax 2.5]]
| From '''9.0.0-7''' up to and including '''10.7.0-32'''.
| A cartridge or eShop version (JPN-only) of "Cubic Ninja".
| smea
| [https://smealum.github.io/ninjhax2/ Install]
|-
| style="background: lightgreen" | Yes
| [[smashbroshax|smashbroshax]] (beaconhax)
| (New 3DS only) From '''9.0.0-X''' up to and including '''11.0.0-33'''.
| Super Smash Bros 3DS (full-game) and a way to broadcast raw wifi beacons. The demo(prior to the updated November 2015 [https://github.com/yellows8/3ds_smashbroshax version]) isn't usable with the *hax payloads. Game-version v1.1.3 fixed the vuln used with this, see the repo for a workaround for that.
| [[User:Yellows8|Yellows8]]
| [https://github.com/yellows8/3ds_smashbroshax Install]
|-
| style="background: salmon" | No
| [[browserhax]]
| (Old 3DS) From '''9.0.0-16''' to '''9.5.0-22''', '''9.5.0-23''' to '''9.8.0-25''', '''9.9.0-26''' to '''10.1.0-27''', '''10.2.0-28''' to '''10.5.0-30'''

(New 3DS) From '''9.0.0-20''' to '''9.2.0-20''', '''9.3.0-21''' to '''9.5.0-23''', '''9.6.0-24''' to '''9.8.0-25''', '''9.9.0-26''' to '''10.1.0-27''', '''10.2.0-28''' to '''10.5.0-30'''

Note that the browser-version-check bypass is only usable prior to [[10.7.0-32]].
| An USA, EUR, or JPN system.
| [[User:Yellows8|Yellows8]]
| [http://yls8.mtheall.com/3dsbrowserhax.php Install]
|}

Note that ninjhax 1.x is still not obsolete. Even though ninjhax 2.x can be run on 9.3+, this was made possible (amongst other things) by sacrificing the memory remapping exploit used in ninjhax 1.x (rohax). Therefore, things like JIT engines for emulators can only be supported on ninjhax 1.x. Furthermore, ninjhax 2.x does not run on system versions below 9.0.0-X, while ninjhax 1.x does.

==Secondary Exploits==
Installation of these exploits requires a previously exploited system to install. After installation, they can be used on their own.
'''Again, these exploits are only at best proven to work on 10.7.0-32!!! These may no longer function in 11.0.0-33!!!'''

{| class="wikitable" border="1"
! Works on latest fw
! Name
! Supported firmwares
! Requirements
! Author
! Install
|-
| style="background: salmon" | No
| [[ironhax]]
| From '''9.5.0-X''' up to and including '''10.3.0-X''', for '''X''' up to and including 28.
| A copy of "Ironfall: Invasion" downloaded from eShop before August 11th, 2015. Note the updated version that was released on October 13th, 2015 is not supported.
| smea
| [http://smealum.github.io/3ds/ Install]
|-
| style="background: salmon" | No
| [https://github.com/yellows8/oot3dhax oot3dhax]
| From '''9.0.0-X''' up to and including '''10.7.0-X''', for '''X''' up to and including 32.
| A gamecard or eShop-install of Legend of Zelda: Ocarina of Time 3D. Besides using the installer app, writing raw saveimages with a save dongle for example is another option. Due to lack of free space with the size of the *hax payload, the only save-slot that can exist in the *gamecard* savedata is the oot3dhax save-slot.
| Yellows8 / smea et al.
| See [https://smealum.github.io/3ds/ here].
|-
| style="background: salmon" | No
| [[menuhax]]
| From '''9.0.0-X''' up to and including '''10.5.0-X''', for '''X''' up to and including 30.
|
| [[User:Yellows8|Yellows8]]
| [https://github.com/yellows8/3ds_homemenuhax/releases Download]
|-
| style="background: lightgreen" | Yes
| [https://github.com/shinyquagsire23/supermysterychunkhax supermysterychunkhax]
| From '''9.9.0-X''' (USA/JPN) / '''11.0.0-X''' (EUR) up to and including '''10.7.0-X''', for '''X''' up to and including 33.
| A gamecard or eShop-install of Pokémon Super Mystery Dungeon.
| Shiny Quagsire / SALT team
| [https://smd.salthax.org/ Install].
|-
| style="background: lightgreen" | Yes
| [https://github.com/shinyquagsire23/v_hax (v*)hax]
| From '''9.0.0-X''' up to and including '''11.0.0-X''', for '''X''' up to and including 33.
Note that '''9.0.0-X''' is only required for the Homebrew Launcher - the game itself only requires '''2.1.0-X''' for primitive userland code execution.
| A copy of VVVVVV downloaded after March 2012 (v1)
| Shiny Quagsire / SALT team
| [https://vvvvvv.salthax.org/ Install].
|-
| style="background: lightgreen" | Yes
| [https://github.com/Dazzozo/humblehax humblehax]
| From '''9.0.0-X''' (USA/EUR) up to and including '''11.0.0-X''', for '''X''' up to and including 33.
| An eShop-install of Citizens of Earth, featured in the Humble "Friends of Nintendo" Bundle.
| Dazzozo / SALT team
| [https://citizens.salthax.org/ Install].
|}

==Exploits without Homebrew Launcher (Not recommended)==

'''Warning:''' The following exploits can run code, but are missing a 3DSX launcher. They cannot launch any homebrew in the 3DSX format.

{| class="wikitable" border="1"
|-
! Works on latest fw
! Name
! Supported firmwares
! Requirements
! Author
! Install
|-
| style="background: salmon" | No
| [[browserhax]] (Without the loader in the 3ds_browserhax_common repo)
| (Old3DS) From '''2.1.0-4''' to '''3.0.0-6''', '''4.0.0-7''' to '''4.5.0-10''', '''5.0.0-11''' to '''7.0.0-13''', '''7.1.0-16''' to '''9.5.0-22''', '''9.5.0-23''' to '''9.8.0-25''', '''9.9.0-26''' to '''10.1.0-27''', '''10.2.0-28''' to '''10.5.0-30'''

(New3DS) From '''9.0.0-20''' to '''9.2.0-20''', '''9.3.0-21''' to '''9.5.0-23''', '''9.6.0-24''' to '''9.8.0-25''', '''9.9.0-26''' to '''10.1.0-27''', '''10.2.0-28''' to '''10.5.0-30'''

Note that the browser-version-check bypass is only usable prior to [[10.7.0-32]].
| An USA, EUR, or JPN system.
| [[User:Yellows8|Yellows8]]
| [[browserhax|Install]]
|}

==Previous Exploits==
'''Warning:''' These exploits '''do not work'''. They are exploits which no longer function at all, regardless of software or firmware revision.
{| class="wikitable" border="1"
! Works on latest fw
! Name
! Supported firmwares
! Requirements
! Author
! Install
|-
| style="background: salmon" | No
| [[tubehax|Tubehax]]
| None. '''Was''': From '''9.0.0-X''' up to and including '''10.1.0-X''', for '''X''' up to and including 27.
| The YouTube application and an Internet connection. As of October 15, 2015, this is no longer usable due to an update being released which fixes the vuln used by tubehax + app update being forced(see [[YouTube|here]]).
| smea
| [http://smealum.github.io/3ds/ Install]
|}

==Other Homebrew Loaders==
The [https://github.com/yellows8/hblauncher_loader hblauncher_loader] title can be used when running under modded-FIRM which allows running unsigned titles, to boot the *hax payloads.

==Sysmodule Exploits==
This section is for system-module exploits, which can be run from the *hax payloads.

{| class="wikitable" border="1"
! Works on latest fw
! Name
! Supported firmwares
! Requirements
! Author
|-
| Maybe, that's not the intended default use however.
| [https://github.com/yellows8/ctr-httpwn/releases ctr-httpwn]
| From '''9.6.0-X''' up to and including '''10.7.0-X''', for '''X''' up to and including 32.
| None
| [[User:Yellows8|Yellows8]]
|}

==WebKit vuln testing==
See [https://github.com/yellows8/3ds_browserhax_common/issues/28 here].

Homebrew Exploits

2016-05-09T21:49:17Z

Dazzozo: wat

==Standalone Homebrew Launcher Exploits==
The following homebrew exploits can be executed on a previously un-exploited system.

{| class="wikitable" border="1"
|-
! Works on latest fw
! Name
! Supported firmwares
! Requirements
! Author
! Install
|-
| style="background: salmon" | No
| [[ninjhax|Ninjhax 1.1b]]
| From '''4.0.0-7''' up to and including '''9.2.0-20'''.
| A cartridge or eShop version (JPN-only) of "Cubic Ninja".
| smea
| [http://smealum.net/ninjhax/ Install]
|-
| style="background: lightgreen" | Yes
| [[ninjhax|Ninjhax 2.5]]
| From '''9.0.0-7''' up to and including '''10.7.0-32'''.
| A cartridge or eShop version (JPN-only) of "Cubic Ninja".
| smea
| [https://smealum.github.io/ninjhax2/ Install]
|-
| style="background: lightgreen" | Yes
| [[smashbroshax|smashbroshax]] (beaconhax)
| (New 3DS only) From '''9.0.0-X''' up to and including '''10.7.0-32'''.
| Super Smash Bros 3DS (full-game) and a way to broadcast raw wifi beacons. The demo(prior to the updated November 2015 [https://github.com/yellows8/3ds_smashbroshax version]) isn't usable with the *hax payloads. Game-version v1.1.3 fixed the vuln used with this, see the repo for a workaround for that.
| [[User:Yellows8|Yellows8]]
| [https://github.com/yellows8/3ds_smashbroshax Install]
|-
| style="background: salmon" | No
| [[browserhax]]
| (Old 3DS) From '''9.0.0-16''' to '''9.5.0-22''', '''9.5.0-23''' to '''9.8.0-25''', '''9.9.0-26''' to '''10.1.0-27''', '''10.2.0-28''' to '''10.5.0-30'''

(New 3DS) From '''9.0.0-20''' to '''9.2.0-20''', '''9.3.0-21''' to '''9.5.0-23''', '''9.6.0-24''' to '''9.8.0-25''', '''9.9.0-26''' to '''10.1.0-27''', '''10.2.0-28''' to '''10.5.0-30'''

Note that the browser-version-check bypass is only usable prior to [[10.7.0-32]].
| An USA, EUR, or JPN system.
| [[User:Yellows8|Yellows8]]
| [http://yls8.mtheall.com/3dsbrowserhax.php Install]
|}

Note that ninjhax 1.x is still not obsolete. Even though ninjhax 2.x can be run on 9.3+, this was made possible (amongst other things) by sacrificing the memory remapping exploit used in ninjhax 1.x (rohax). Therefore, things like JIT engines for emulators can only be supported on ninjhax 1.x. Furthermore, ninjhax 2.x does not run on system versions below 9.0.0-X, while ninjhax 1.x does.

==Secondary Exploits==
Installation of these exploits requires a previously exploited system to install. After installation, they can be used on their own.

{| class="wikitable" border="1"
! Works on latest fw
! Name
! Supported firmwares
! Requirements
! Author
! Install
|-
| style="background: salmon" | No
| [[ironhax]]
| From '''9.5.0-X''' up to and including '''10.3.0-X''', for '''X''' up to and including 28.
| A copy of "Ironfall: Invasion" downloaded from eShop before August 11th, 2015. Note the updated version that was released on October 13th, 2015 is not supported.
| smea
| [http://smealum.github.io/3ds/ Install]
|-
| style="background: lightgreen" | Yes
| [https://github.com/yellows8/oot3dhax oot3dhax]
| From '''9.0.0-X''' up to and including '''10.7.0-X''', for '''X''' up to and including 32.
| A gamecard or eShop-install of Legend of Zelda: Ocarina of Time 3D. Besides using the installer app, writing raw saveimages with a save dongle for example is another option. Due to lack of free space with the size of the *hax payload, the only save-slot that can exist in the *gamecard* savedata is the oot3dhax save-slot.
| Yellows8 / smea et al.
| See [https://smealum.github.io/3ds/ here].
|-
| style="background: salmon" | No
| [[menuhax]]
| From '''9.0.0-X''' up to and including '''10.5.0-X''', for '''X''' up to and including 30.
|
| [[User:Yellows8|Yellows8]]
| [https://github.com/yellows8/3ds_homemenuhax/releases Download]
|-
| style="background: lightgreen" | Yes
| [https://github.com/shinyquagsire23/supermysterychunkhax supermysterychunkhax]
| From '''9.9.0-X''' (USA/JPN) / '''10.2.0-X''' (EUR) up to and including '''10.7.0-X''', for '''X''' up to and including 32.
| A gamecard or eShop-install of Pokémon Super Mystery Dungeon.
| Shiny Quagsire / SALT team
| [https://smd.salthax.org/ Install].
|-
| style="background: lightgreen" | Yes
| [https://github.com/shinyquagsire23/v_hax (v*)hax]
| From '''9.0.0-X''' up to and including '''10.7.0-X''', for '''X''' up to and including 32.
Note that '''9.0.0-X''' is only required for the Homebrew Launcher - the game itself only requires '''2.1.0-X''' for primitive userland code execution.
| A copy of VVVVVV downloaded after March 2012 (v1)
| Shiny Quagsire / SALT team
| [https://vvvvvv.salthax.org/ Install].
|-
| style="background: lightgreen" | Yes
| [https://github.com/Dazzozo/humblehax humblehax]
| From '''9.0.0-X''' (USA/EUR) up to and including '''10.7.0-X''', for '''X''' up to and including 32.
| An eShop-install of Citizens of Earth, featured in the Humble "Friends of Nintendo" Bundle.
| Dazzozo / SALT team
| [https://citizens.salthax.org/ Install].
|}

==Exploits without Homebrew Launcher (Not recommended)==

'''Warning:''' The following exploits can run code, but are missing a 3DSX launcher. They cannot launch any homebrew in the 3DSX format.

{| class="wikitable" border="1"
|-
! Works on latest fw
! Name
! Supported firmwares
! Requirements
! Author
! Install
|-
| style="background: salmon" | No
| [[browserhax]] (Without the loader in the 3ds_browserhax_common repo)
| (Old3DS) From '''2.1.0-4''' to '''3.0.0-6''', '''4.0.0-7''' to '''4.5.0-10''', '''5.0.0-11''' to '''7.0.0-13''', '''7.1.0-16''' to '''9.5.0-22''', '''9.5.0-23''' to '''9.8.0-25''', '''9.9.0-26''' to '''10.1.0-27''', '''10.2.0-28''' to '''10.5.0-30'''

(New3DS) From '''9.0.0-20''' to '''9.2.0-20''', '''9.3.0-21''' to '''9.5.0-23''', '''9.6.0-24''' to '''9.8.0-25''', '''9.9.0-26''' to '''10.1.0-27''', '''10.2.0-28''' to '''10.5.0-30'''

Note that the browser-version-check bypass is only usable prior to [[10.7.0-32]].
| An USA, EUR, or JPN system.
| [[User:Yellows8|Yellows8]]
| [[browserhax|Install]]
|}

==Previous Exploits==
'''Warning:''' These exploits '''do not work'''. They are exploits which no longer function at all, regardless of software or firmware revision.
{| class="wikitable" border="1"
! Works on latest fw
! Name
! Supported firmwares
! Requirements
! Author
! Install
|-
| style="background: salmon" | No
| [[tubehax|Tubehax]]
| None. '''Was''': From '''9.0.0-X''' up to and including '''10.1.0-X''', for '''X''' up to and including 27.
| The YouTube application and an Internet connection. As of October 15, 2015, this is no longer usable due to an update being released which fixes the vuln used by tubehax + app update being forced(see [[YouTube|here]]).
| smea
| [http://smealum.github.io/3ds/ Install]
|}

==Other Homebrew Loaders==
The [https://github.com/yellows8/hblauncher_loader hblauncher_loader] title can be used when running under modded-FIRM which allows running unsigned titles, to boot the *hax payloads.

==Sysmodule Exploits==
This section is for system-module exploits, which can be run from the *hax payloads.

{| class="wikitable" border="1"
! Works on latest fw
! Name
! Supported firmwares
! Requirements
! Author
|-
| Yes, that's not the intended default use however.
| [https://github.com/yellows8/ctr-httpwn/releases ctr-httpwn]
| From '''9.6.0-X''' up to and including '''10.7.0-X''', for '''X''' up to and including 32.
| None
| [[User:Yellows8|Yellows8]]
|}

==WebKit vuln testing==
See [https://github.com/yellows8/3ds_browserhax_common/issues/28 here].

Homebrew Exploits

2016-05-09T21:48:43Z

Dazzozo:

==Standalone Homebrew Launcher Exploits==
The following homebrew exploits can be executed on a previously un-exploited system.

{| class="wikitable" border="1"
|-
! Works on latest fw
! Name
! Supported firmwares
! Requirements
! Author
! Install
|-
| style="background: salmon" | No
| [[ninjhax|Ninjhax 1.1b]]
| From '''4.0.0-7''' up to and including '''9.2.0-20'''.
| A cartridge or eShop version (JPN-only) of "Cubic Ninja".
| smea
| [http://smealum.net/ninjhax/ Install]
|-
| style="background: lightgreen" | Yes
| [[ninjhax|Ninjhax 2.5]]
| From '''9.0.0-7''' up to and including '''10.7.0-32'''.
| A cartridge or eShop version (JPN-only) of "Cubic Ninja".
| smea
| [https://smealum.github.io/ninjhax2/ Install]
|-
| style="background: lightgreen" | Yes
| [[smashbroshax|smashbroshax]] (beaconhax)
| (New 3DS only) From '''9.0.0-X''' up to and including '''10.7.0-32'''.
| Super Smash Bros 3DS (full-game) and a way to broadcast raw wifi beacons. The demo(prior to the updated November 2015 [https://github.com/yellows8/3ds_smashbroshax version]) isn't usable with the *hax payloads. Game-version v1.1.3 fixed the vuln used with this, see the repo for a workaround for that.
| [[User:Yellows8|Yellows8]]
| [https://github.com/yellows8/3ds_smashbroshax Install]
|-
| style="background: salmon" | No
| [[browserhax]]
| (Old 3DS) From '''9.0.0-16''' to '''9.5.0-22''', '''9.5.0-23''' to '''9.8.0-25''', '''9.9.0-26''' to '''10.1.0-27''', '''10.2.0-28''' to '''10.5.0-30'''

(New 3DS) From '''9.0.0-20''' to '''9.2.0-20''', '''9.3.0-21''' to '''9.5.0-23''', '''9.6.0-24''' to '''9.8.0-25''', '''9.9.0-26''' to '''10.1.0-27''', '''10.2.0-28''' to '''10.5.0-30'''

Note that the browser-version-check bypass is only usable prior to [[10.7.0-32]].
| An USA, EUR, or JPN system.
| [[User:Yellows8|Yellows8]]
| [http://yls8.mtheall.com/3dsbrowserhax.php Install]
|}

Note that ninjhax 1.x is still not obsolete. Even though ninjhax 2.x can be run on 9.3+, this was made possible (amongst other things) by sacrificing the memory remapping exploit used in ninjhax 1.x (rohax). Therefore, things like JIT engines for emulators can only be supported on ninjhax 1.x. Furthermore, ninjhax 2.x does not run on system versions below 9.0.0-X, while ninjhax 1.x does.

==Secondary Exploits==
Installation of these exploits requires a previously exploited system to install. After installation, they can be used on their own.

{| class="wikitable" border="1"
! Works on latest fw
! Name
! Supported firmwares
! Requirements
! Author
! Install
|-
| style="background: salmon" | No
| [[ironhax]]
| From '''9.5.0-X''' up to and including '''10.3.0-X''', for '''X''' up to and including 28.
| A copy of "Ironfall: Invasion" downloaded from eShop before August 11th, 2015. Note the updated version that was released on October 13th, 2015 is not supported.
| smea
| [http://smealum.github.io/3ds/ Install]
|-
| style="background: lightgreen" | Yes
| [https://github.com/yellows8/oot3dhax oot3dhax]
| From '''9.0.0-X''' up to and including '''10.7.0-X''', for '''X''' up to and including 32.
| A gamecard or eShop-install of Legend of Zelda: Ocarina of Time 3D. Besides using the installer app, writing raw saveimages with a save dongle for example is another option. Due to lack of free space with the size of the *hax payload, the only save-slot that can exist in the *gamecard* savedata is the oot3dhax save-slot.
| Yellows8 / smea et al.
| See [https://smealum.github.io/3ds/ here].
|-
| style="background: salmon" | No
| [[menuhax]]
| From '''9.0.0-X''' up to and including '''10.5.0-X''', for '''X''' up to and including 30.
|
| [[User:Yellows8|Yellows8]]
| [https://github.com/yellows8/3ds_homemenuhax/releases Download]
|-
| style="background: lightgreen" | Yes
| [https://github.com/shinyquagsire23/supermysterychunkhax supermysterychunkhax]
| From '''9.9.0-X''' (USA/JPN) / '''10.2.0-X''' (EUR) up to and including '''10.7.0-X''', for '''X''' up to and including 32.
| A gamecard or eShop-install of Pokémon Super Mystery Dungeon.
| Shiny Quagsire / SALT team
| [https://smd.salthax.org/ Install].
|-
| style="background: lightgreen" | Yes
| [https://github.com/shinyquagsire23/v_hax (v*)hax]
| From '''9.0.0-X''' up to and including '''10.7.0-X''', for '''X''' up to and including 32.
Note that '''9.0.0-X''' is only required for the Homebrew Launcher - the game itself only requires '''2.1.0-X''' for primitive userland code execution.
| A copy of VVVVVV downloaded after March 2012 (v1)
| Shiny Quagsire / SALT team
| [https://vvvvvv.salthax.org/ Install].
|-
| style="background: lightgreen" | Yes
| [https://github.com/Dazzozo/humblehax humblehax]
| From '''9.0.0-X''' (USA) / '''9.0.0-X''' (EUR) up to and including '''10.7.0-X''', for '''X''' up to and including 32.
| An eShop-install of Citizens of Earth, featured in the Humble "Friends of Nintendo" Bundle.
| Dazzozo / SALT team
| [https://citizens.salthax.org/ Install].
|}

==Exploits without Homebrew Launcher (Not recommended)==

'''Warning:''' The following exploits can run code, but are missing a 3DSX launcher. They cannot launch any homebrew in the 3DSX format.

{| class="wikitable" border="1"
|-
! Works on latest fw
! Name
! Supported firmwares
! Requirements
! Author
! Install
|-
| style="background: salmon" | No
| [[browserhax]] (Without the loader in the 3ds_browserhax_common repo)
| (Old3DS) From '''2.1.0-4''' to '''3.0.0-6''', '''4.0.0-7''' to '''4.5.0-10''', '''5.0.0-11''' to '''7.0.0-13''', '''7.1.0-16''' to '''9.5.0-22''', '''9.5.0-23''' to '''9.8.0-25''', '''9.9.0-26''' to '''10.1.0-27''', '''10.2.0-28''' to '''10.5.0-30'''

(New3DS) From '''9.0.0-20''' to '''9.2.0-20''', '''9.3.0-21''' to '''9.5.0-23''', '''9.6.0-24''' to '''9.8.0-25''', '''9.9.0-26''' to '''10.1.0-27''', '''10.2.0-28''' to '''10.5.0-30'''

Note that the browser-version-check bypass is only usable prior to [[10.7.0-32]].
| An USA, EUR, or JPN system.
| [[User:Yellows8|Yellows8]]
| [[browserhax|Install]]
|}

==Previous Exploits==
'''Warning:''' These exploits '''do not work'''. They are exploits which no longer function at all, regardless of software or firmware revision.
{| class="wikitable" border="1"
! Works on latest fw
! Name
! Supported firmwares
! Requirements
! Author
! Install
|-
| style="background: salmon" | No
| [[tubehax|Tubehax]]
| None. '''Was''': From '''9.0.0-X''' up to and including '''10.1.0-X''', for '''X''' up to and including 27.
| The YouTube application and an Internet connection. As of October 15, 2015, this is no longer usable due to an update being released which fixes the vuln used by tubehax + app update being forced(see [[YouTube|here]]).
| smea
| [http://smealum.github.io/3ds/ Install]
|}

==Other Homebrew Loaders==
The [https://github.com/yellows8/hblauncher_loader hblauncher_loader] title can be used when running under modded-FIRM which allows running unsigned titles, to boot the *hax payloads.

==Sysmodule Exploits==
This section is for system-module exploits, which can be run from the *hax payloads.

{| class="wikitable" border="1"
! Works on latest fw
! Name
! Supported firmwares
! Requirements
! Author
|-
| Yes, that's not the intended default use however.
| [https://github.com/yellows8/ctr-httpwn/releases ctr-httpwn]
| From '''9.6.0-X''' up to and including '''10.7.0-X''', for '''X''' up to and including 32.
| None
| [[User:Yellows8|Yellows8]]
|}

==WebKit vuln testing==
See [https://github.com/yellows8/3ds_browserhax_common/issues/28 here].

Homebrew Exploits

2016-05-09T21:48:03Z

Dazzozo: /* Secondary Exploits */

==Standalone Homebrew Launcher Exploits==
The following homebrew exploits can be executed on a previously un-exploited system.

{| class="wikitable" border="1"
|-
! Works on latest fw
! Name
! Supported firmwares
! Requirements
! Author
! Install
|-
| style="background: salmon" | No
| [[ninjhax|Ninjhax 1.1b]]
| From '''4.0.0-7''' up to and including '''9.2.0-20'''.
| A cartridge or eShop version (JPN-only) of "Cubic Ninja".
| smea
| [http://smealum.net/ninjhax/ Install]
|-
| style="background: lightgreen" | Yes
| [[ninjhax|Ninjhax 2.5]]
| From '''9.0.0-7''' up to and including '''10.7.0-32'''.
| A cartridge or eShop version (JPN-only) of "Cubic Ninja".
| smea
| [https://smealum.github.io/ninjhax2/ Install]
|-
| style="background: lightgreen" | Yes
| [[smashbroshax|smashbroshax]] (beaconhax)
| (New 3DS only) From '''9.0.0-X''' up to and including '''10.7.0-32'''.
| Super Smash Bros 3DS (full-game) and a way to broadcast raw wifi beacons. The demo(prior to the updated November 2015 [https://github.com/yellows8/3ds_smashbroshax version]) isn't usable with the *hax payloads. Game-version v1.1.3 fixed the vuln used with this, see the repo for a workaround for that.
| [[User:Yellows8|Yellows8]]
| [https://github.com/yellows8/3ds_smashbroshax Install]
|-
| style="background: salmon" | No
| [[browserhax]]
| (Old 3DS) From '''9.0.0-16''' to '''9.5.0-22''', '''9.5.0-23''' to '''9.8.0-25''', '''9.9.0-26''' to '''10.1.0-27''', '''10.2.0-28''' to '''10.5.0-30'''

(New 3DS) From '''9.0.0-20''' to '''9.2.0-20''', '''9.3.0-21''' to '''9.5.0-23''', '''9.6.0-24''' to '''9.8.0-25''', '''9.9.0-26''' to '''10.1.0-27''', '''10.2.0-28''' to '''10.5.0-30'''

Note that the browser-version-check bypass is only usable prior to [[10.7.0-32]].
| An USA, EUR, or JPN system.
| [[User:Yellows8|Yellows8]]
| [http://yls8.mtheall.com/3dsbrowserhax.php Install]
|}

Note that ninjhax 1.x is still not obsolete. Even though ninjhax 2.x can be run on 9.3+, this was made possible (amongst other things) by sacrificing the memory remapping exploit used in ninjhax 1.x (rohax). Therefore, things like JIT engines for emulators can only be supported on ninjhax 1.x. Furthermore, ninjhax 2.x does not run on system versions below 9.0.0-X, while ninjhax 1.x does.

==Secondary Exploits==
Installation of these exploits requires a previously exploited system to install. After installation, they can be used on their own.

{| class="wikitable" border="1"
! Works on latest fw
! Name
! Supported firmwares
! Requirements
! Author
! Install
|-
| style="background: salmon" | No
| [[ironhax]]
| From '''9.5.0-X''' up to and including '''10.3.0-X''', for '''X''' up to and including 28.
| A copy of "Ironfall: Invasion" downloaded from eShop before August 11th, 2015. Note the updated version that was released on October 13th, 2015 is not supported.
| smea
| [http://smealum.github.io/3ds/ Install]
|-
| style="background: lightgreen" | Yes
| [https://github.com/yellows8/oot3dhax oot3dhax]
| From '''9.0.0-X''' up to and including '''10.7.0-X''', for '''X''' up to and including 32.
| A gamecard or eShop-install of Legend of Zelda: Ocarina of Time 3D. Besides using the installer app, writing raw saveimages with a save dongle for example is another option. Due to lack of free space with the size of the *hax payload, the only save-slot that can exist in the *gamecard* savedata is the oot3dhax save-slot.
| Yellows8 / smea et al.
| See [https://smealum.github.io/3ds/ here].
|-
| style="background: salmon" | No
| [[menuhax]]
| From '''9.0.0-X''' up to and including '''10.5.0-X''', for '''X''' up to and including 30.
|
| [[User:Yellows8|Yellows8]]
| [https://github.com/yellows8/3ds_homemenuhax/releases Download]
|-
| style="background: lightgreen" | Yes
| [https://github.com/shinyquagsire23/supermysterychunkhax supermysterychunkhax]
| From '''9.9.0-X''' (USA/JPN) / '''10.2.0-X''' (EUR) up to and including '''10.7.0-X''', for '''X''' up to and including 32.
| A gamecard or eShop-install of Pokémon Super Mystery Dungeon.
| Shiny Quagsire / SALT team
| [https://smd.salthax.org/ Install].
|-
| style="background: lightgreen" | Yes
| [https://github.com/shinyquagsire23/v_hax (v*)hax]
| From '''9.0.0-X''' up to and including '''10.7.0-X''', for '''X''' up to and including 32.
Note that '''9.0.0-X''' is only required for the Homebrew Launcher - the game itself only requires '''2.1.0-X''' for primitive userland code execution.
| A copy of VVVVVV downloaded after March 2012 (v1)
| Shiny Quagsire / SALT team
| [https://vvvvvv.salthax.org/ Install].
|-
| style="background: lightgreen" | Yes
| [https://github.com/Dazzozo/humblehax humblehax]
| From '''9.0.0-X''' (USA/JPN) / '''9.0.0-X''' (EUR) up to and including '''10.7.0-X''', for '''X''' up to and including 32.
| An eShop-install of Citizens of Earth, featured in the Humble "Friends of Nintendo" Bundle.
| Dazzozo / SALT team
| [https://citizens.salthax.org/ Install].
|}

==Exploits without Homebrew Launcher (Not recommended)==

'''Warning:''' The following exploits can run code, but are missing a 3DSX launcher. They cannot launch any homebrew in the 3DSX format.

{| class="wikitable" border="1"
|-
! Works on latest fw
! Name
! Supported firmwares
! Requirements
! Author
! Install
|-
| style="background: salmon" | No
| [[browserhax]] (Without the loader in the 3ds_browserhax_common repo)
| (Old3DS) From '''2.1.0-4''' to '''3.0.0-6''', '''4.0.0-7''' to '''4.5.0-10''', '''5.0.0-11''' to '''7.0.0-13''', '''7.1.0-16''' to '''9.5.0-22''', '''9.5.0-23''' to '''9.8.0-25''', '''9.9.0-26''' to '''10.1.0-27''', '''10.2.0-28''' to '''10.5.0-30'''

(New3DS) From '''9.0.0-20''' to '''9.2.0-20''', '''9.3.0-21''' to '''9.5.0-23''', '''9.6.0-24''' to '''9.8.0-25''', '''9.9.0-26''' to '''10.1.0-27''', '''10.2.0-28''' to '''10.5.0-30'''

Note that the browser-version-check bypass is only usable prior to [[10.7.0-32]].
| An USA, EUR, or JPN system.
| [[User:Yellows8|Yellows8]]
| [[browserhax|Install]]
|}

==Previous Exploits==
'''Warning:''' These exploits '''do not work'''. They are exploits which no longer function at all, regardless of software or firmware revision.
{| class="wikitable" border="1"
! Works on latest fw
! Name
! Supported firmwares
! Requirements
! Author
! Install
|-
| style="background: salmon" | No
| [[tubehax|Tubehax]]
| None. '''Was''': From '''9.0.0-X''' up to and including '''10.1.0-X''', for '''X''' up to and including 27.
| The YouTube application and an Internet connection. As of October 15, 2015, this is no longer usable due to an update being released which fixes the vuln used by tubehax + app update being forced(see [[YouTube|here]]).
| smea
| [http://smealum.github.io/3ds/ Install]
|}

==Other Homebrew Loaders==
The [https://github.com/yellows8/hblauncher_loader hblauncher_loader] title can be used when running under modded-FIRM which allows running unsigned titles, to boot the *hax payloads.

==Sysmodule Exploits==
This section is for system-module exploits, which can be run from the *hax payloads.

{| class="wikitable" border="1"
! Works on latest fw
! Name
! Supported firmwares
! Requirements
! Author
|-
| Yes, that's not the intended default use however.
| [https://github.com/yellows8/ctr-httpwn/releases ctr-httpwn]
| From '''9.6.0-X''' up to and including '''10.7.0-X''', for '''X''' up to and including 32.
| None
| [[User:Yellows8|Yellows8]]
|}

==WebKit vuln testing==
See [https://github.com/yellows8/3ds_browserhax_common/issues/28 here].

3DS Userland Flaws

2016-05-09T21:40:56Z

Dazzozo: /* Non-system applications */

This page lists vulnerabilities / exploits for 3DS applications and applets. Exploiting these initially results in ROP, from that ROP one can then for example try exploiting [[3DS_System_Flaws|system]] flaw(s).

=Non-system applications=
{| class="wikitable" border="1"
|-
! Application name
! Summary
! Description
! Fixed in app/system version
! Last app/system version this flaw was checked for
! Timeframe info related to this was added to wiki
! Timeframe this vuln was discovered
! Vuln discovered by
|-
| Cubic Ninja
| Map-data stack smash
| See [[Ninjhax|here]] regarding Ninjhax.
| None
| App: Initial version. System: [[10.4.0-29]].
| Ninjhax release
| July 2014
| [[User:smea|smea]]
|-
| The Legend of Zelda: Ocarina of Time 3D
| UTF-16 name string buffer overflow via unchecked u8 length field
| The u8 at offset 0x2C in the savefile is the character-length of the UTF-16 string at offset 0x1C. When copying this string, it's essentially a memory-copy with lenval*2, not a string-copy. This can be used to trigger buffer overflows at various locations depending on the string length.
* When value is >=0x6E it crashes when saving the saveslot, this causes a stack-smash however it normally crashes before it returns from the function which had the stack-frame overwritten.
* With value >=0x9A, it crashes via stack-smash in-game once any dialogs are opened(touching buttons on the touch-screen can trigger it too).
* Length value>=0xCD causes a crash while loading the saveslot, via a heap buffer overflow. This buf-overflow overwrites a heap memchunk following the allocated buffer. When the first 16-bits overwriting that heap memchunk is not the memchunk magic-number(0x7373), the mem-alloc code will just return a NULL ptr which later results in a crash. When the magic-number is valid, the mem-alloc code will continue to attempt to parse the memchunk, which may crash depending on the data which overwrote the memchunk. This heap code is separate from the CTRSDK heap code. Exploiting this doesn't seem to be possible: since the heap code actually verifies that the magic-number for the next/prev memchunk ptrs are correct(unlike CTRSDK), it's not possible to change those ptrs to useful arbitrary addresses outside of savedata(like with triggering a write to a c++ object ptr which later is used with a vtable func-call, this is what one would do with CTRSDK heap here).

On March 11, 2015, an exploit using this vuln was released, that one was intended for warez/etc. The following exploit wasn't released before then mainly because doing so would (presumably) result in the vuln being fixed. The following old exploit was released on March 14, 2015: [https://github.com/yellows8/oot3dhax].
| None
| App: Initial version. System: [[10.6.0-31]].
| March 11, 2015
| Around October 22, 2012
| [[User:Yellows8|Yellows8]]
|-
| Super Smash Bros 3DS
| Buffer overflow in local-multiplayer beacon handling.
| See [[smashbroshax|here]].
| App: v1.1.3
| See [[smashbroshax|here]]. System: [[10.3.0-28]].
| Time of exploit release.
| See [[smashbroshax|here]].
| [[User:Yellows8|Yellows8]]
|-
| Pokemon Super Mystery Dungeon
| Heap overflow within linear memory via unchecked save file length
| Pokemon Super Mystery Dungeon uses zlib compression for most of its save files, possibly due to the save files being larger than it's predecessor, Gates to Infinity. When a save file is being prepared to be loaded and read from, only a 0x32000 large buffer is allocated for file reading, and a 0x3e800-large buffer for decompression is also allocated before the file is read. However, the game does not limit the size of the file read to this allocation bound, allowing for the file to overflow into the linear memory heap and into the next allocation. Since Pokemon Super Mystery Dungeon stores allocation memchunks directly before the allocation, overwriting the next memchunk with a corrupted one allows for arbitrary writes of linear heap pointers when the next buffer is allocated or arbitrary writes of any pointer within writable memory when the corrupted buffer is freed.
| None
| [[10.7.0-32]].
| Time of exploit release.
| April 14, 2016
| [[User:Shinyquagsire23|Shiny Quagsire]]
|-
| VVVVVV
| Buffer overflow in XML save file array parsing
| VVVVVV utilizes several XML files (renamed with a .vvv extension) to store level save data, stats and settings. Within these XML files are several tags containing an array of data which, when parsed, is not properly checked to be of proper length for the tag being parsed from. This allows for an overflow of 16-bit array values from the location where the array is parsed. With unlock.vvv, XML data is parsed to the stack, and with level saves the heap. This allows for the pointer where the level save worldmap tag array should be parsed into to be overwritten with a stack address, allowing for ROP from within the XML array parsing function on the next level load.
| None
| [[10.7.0-32]].
| Time of exploit release.
| April 25, 2016
| [[User:Shinyquagsire23|Shiny Quagsire]]
|-
| Citizens of Earth
| Save file read stack smash
| Citizens of Earth also uses "XML" files for saves, which are actually entirely binary data (not XML at all) with no checksums. These files are read from the filesystem on to a fixed size stack buffer which leads to an incredibly trivial stack smash. When using the autosave slot for this, the save is parsed when the user selects "continue". When using one of the dedicated save slots (1-3), the save is parsed shortly after the company splash screens fade. Note that the save is read quite high (descending) on the stack - when exploiting this, one would likely need to move SP due to almost instantly overflowing the physical stack.
| None
| [[10.7.0-32]].
| Time of exploit release.
| May 5, 2016
| [[User:Dazzozo|Dazzozo]]
|}

==Useless crashes / applications which were fuzzed==
* Pushmo (3DSWare), QR codes: level name is properly limited to 16 characters, game doesn't crash with a longer name. The only possible crashes are triggered by out-of-bounds array index values, these crashes are not exploitable due to the index value being 8bit.

* Pyramids (3DSWare), QR codes: no strings. Only crashes are from out-of-bounds values (like background ID) and are not exploitable.

* [https://github.com/yellows8/mm3d_re The Legend of Zelda: Majora's Mask 3D]

* "The Legend of Zelda: A Link Between Worlds" and "The Legend of Zelda: Tri Force Heroes": these games don't crash at all when the entire save-file(minus constant header data) is overwritten with /dev/random output / 0xFF-bytes. All of the CRC32s were updated for this of course.

* Pokemon Mystery Dungeon: Gates to Infinity has the same unchecked file bounds as Pokemon Super Mystery Dungeon, however since save compression was introduced in Pokemon Super Mystery Dungeon, it only allocates one buffer within the application heap instead of several within the linear heap, resulting in nothing to corrupt or overwrite even if the file's length is extended past it's allocation.

==Crashes needing investigation==
* Disney Infinity crashes when all savedata overwritten with /dev/urandom. No checksums. 0xFF bytes don't cause a crash.

* Football Up Online / Soccer Up Online and Football Up 3D / Soccer Up 3D crash when teamname(UTF-16) length = 0x48 AND 0x20 null bytes are removed after just the name or if teamname length is way longer than 0x48.
* Brunswick Pro Bowling's Debug Screen is crashable by editing lines 0340 to 0500 in the binary code of the savegame. It crashes onto itself and not onto the home menu which previous attempts have.

=System applications=
{| class="wikitable" border="1"
|-
! Summary
! Description
! Fixed in version
! Last version this flaw was checked for
! Timeframe this was discovered
! Discovered by
|-
| 3DS [[System Settings]] DS profile string stack-smash
| Too long or corrupted strings (01Ah 2 Nickname length in characters 050h 2 Message length in characters) in the NVRAM DS user settings (System Settings->Other Settings->Profile->Nintendo DS Profile) cause it to crash in 3DS-mode due to a stack-smash. The DSi is not vulnerable to this, DSi launcher(menu) and DSi System Settings will reset the NVRAM user-settings if the length field values are too long(same result as when the CRCs are invalid). TWL_FIRM also resets the NVRAM user-settings when the string-length(s) are too long.
| [[7.0.0-13]]
| [[7.0.0-13]]
| 2012
| [[User:Ichfly|Ichfly]]
|}

=System applets=
{| class="wikitable" border="1"
|-
! Summary
! Description
! Fixed in version
! Last version this flaw was checked for
! Timeframe info related to this was added to wiki
! Timeframe this was discovered
! Discovered by
|-
| [[Home Menu]] [[System_SaveData|NAND-savedata]] Launcher.dat icons
| The homemenu code processing the titleid list @ launcherdat+8 copies those titleIDs to another buffer, where the offset relative to that buffer is calculated using the corresponding s8/s16 entries. Those two values are not range checked at all. Hence, one can use this to write u64(s) with arbitrary values to before/after this allocated output buffer. See [[Home_Menu|here]] regarding Launcher.dat structure.

This can be exploited(with Launcher.dat loading at startup at least) by using a s16 for the icon entry with value 0xFFEC(-20)(and perhaps more icons with similar s16 values to write multiple u64s). The result is that the u64 value is written to outbuf-0xA0, which overwrites object+0(vtable) and object+4(doesn't matter here) for an object that gets used a bit after the vulnerable function triggers. The low 32bits of the u64 can then be set to the address of controlled memory(either outbuf in regular heap or the entire launcherdat buffer in linearmem), for use as a fake vtable in order to get control of PC. From there one can begin ROP via vtable funcptrs to do a stack-pivot(r4=objectaddr at the time the above object gets used).

Originally this vuln could only be triggered via Launcher.dat at Home Menu startup, right after Launcher.dat gets loaded + memory gets allocated, once the file-format version code is finished running. Starting with v9.6 this can be triggered when loading layouts from SD extdata as well. The vuln itself triggers before the layout data is written to Launcher.dat, but it doesn't seem to be possible to overwrite anything which actually gets used before the function which writes Launcher.dat into the layout gets called.

Home Menu has some sort of fail-safe system(or at least on v9.7) when Home Menu crashes due to Launcher.dat(this also applies for other things with Home Menu): after crashing once, Home Menu resets Launcher.dat to a state where it no longer crashes anymore. However, note that any exploits using this which hang/etc without crashing will still brick the system. '''Hence, attempting anything with this on physnand without hw-nand-access isn't really recommended.'''
| None
| [[10.3.0-28|10.3.0-X]]
|
| May 14, 2015
| [[User:Yellows8|Yellows8]]
|-
| [[Home Menu]] theme-data decompression buffer overflow ([[menuhax|themehax]])
| The only func-call size parameter used by the theme decompression function is one for the compressed size, none for the decompressed size. The decompressed-size value from the LZ header is used by this function to check when to stop decompressing, but this function itself has nothing to verify the decompressed_size with. The code calling this function does not check or even use the decompressed size from the header either.

This function is separate from the rest of the Home Menu code: the function used for decompressing themes is *only* used for decompressing themes, nothing else. There's a separate decompression function in Home Menu used for decompressing everything else.

That other decompression function in Home Menu handles decompression size properly(decompressed size check for max buffer size is done by code calling the other function, not in the function itself). Unlike the other function, the theme function supports multiple LZ algorithms, but the one which actually gets used in official themes is the same one supported by the other function anyway.

See also [[menuhax|here]].

With [[10.2.0-28|10.2.0-X]] Home Menu, the only code change was that the following was added right after theme-load and before actual decompression: "if(<get_lzheader_decompressed_size>(compressed_buf) > 0x150000)<exit>;". This fixed the vuln.
| [[10.2.0-28|10.2.0-X]]
| [[10.2.0-28|10.2.0-X]]
|
| December 22, 2014
| [[User:Yellows8|Yellows8]], [[User:Myria|Myria]] independently (~spring 2015)
|-
| [[Home Menu]] shuffle body-data buffer overflow ([[menuhax|shufflehax]])
| See [[menuhax|here]].
| [[10.6.0-31|10.6.0-X]]
| [[10.6.0-31|10.6.0-X]]
|
| January 3, 2015
| [[User:Yellows8|Yellows8]]
|-
| Webkit/web-browser bugs
| spider has had at least three different code-execution exploits. Majority of them are use-after-free issues. See also [[browserhax|here]].
|
|
| 2013?
|
| A lot of people.
|-
| Old3DS/New3DS [[Internet_Browser|Browser-version-check]] bypass
| When the browser-version-check code runs where the savedata for it was never initialized(such as when the user used the "Initialize savedata" option), it will use base_timestamp=0 instead of the timestamp loaded from savedata. This is then used with "if(cur_timestamp - base_timestamp >= <24h timestamp>){Run browser-version-check HTTPS request code}".
Hence, if the savedata was just initialized, and if the system datetime is set to before January 2, 2000, the browser-version-check will be skipped. This includes January 1, 2000, 00:00, because that's the epoch(timestamp value 0x0) used with this timestamp.

See [http://yls8.mtheall.com/3dsbrowserhax.php here] for bypass usage instructions.

This was fixed with [[10.7.0-32|10.7.0-32]], see [[Internet_Browser|here]] for details.
| [[10.7.0-32|10.7.0-32]]
|
| February 25, 2016
| November 2, 2015 (Exactly one week after the browser version pages were initially updated server-side)
| [[User:Yellows8|Yellows8]]
|}

==Useless crashes==
Old3DS system web-browser:
* 2^32 characters long string(''finally'' fixed with v10.6): this is similar to the vulnerability fixed [http://git.chromium.org/gitweb/?p=external/Webkit.git;a=commitdiff;h=ec471f16fbd1f879cb631f9b022fd16acd75f4d4 here], concat-large-strings-crash2.html triggers a crash which is about the same as the one triggered by a 2^32 string. Most of the time this vulnerability will cause a memory page permissions fault, since the WebKit code attempts to copy the string text data to the output buffer located in read-only [[CRO0|CRO]] heap memory. The only difference between a crash triggered by a 2^32 string and the concat-large-strings-crash2.html crash is at the former copies the string data using the original string length(like 1 text character for "x", 4 for "xxxx") while the latter attempts to copy >12MB. In some ''very'' rare cases a thread separate from the string data-copy thread will crash, this might be exploitable. However, this is mostly useless since it rarely crashes this way.

* Trying to directly load a page via the browser "URL" option with [https://github.com/yellows8/3ds_browserhax_common webkitdebug] setup, causes a crash to trigger in oss.cro due to an use-after-free being caught with webkitdebug. This is presumably some sort of realloc() issue in the libcurl version used by the <={v10.2-v10.3} browser. This happens with *every* *single* *page* one tries to load via the "URL" option, but not when loading links on the current page, hence this is probably useless. A different use-after-free with realloc triggers with loading any page at all regardless of method too(libcurl probably).

* This WebKit build has ''a lot'' of crash-trigger bugs that only happen with [https://github.com/yellows8/3ds_browserhax_common webkitdebug] completely setup(addr accesses near 0x0), with ''just'' trying to load any page at all.

PTMSYSM:GetSoftwareClosedFlag

2016-05-02T07:38:52Z

Dazzozo:

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x080F0000]
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code
|-
| 1
| Result code
|-
| 2
| bool flag
|}

=Description=
This is an abstraction for [[MCURTC:GetSoftwareClosedFlag]], used by Home Menu to determine if "Software closed" dialog was requested by the last FIRM and should now be displayed. This screen looks similar to the normal power off screen (HOME to return to menu, POWER to continue shutdown).

MCUNWM:GetWirelessDisabledFlag

2016-05-02T03:43:49Z

Dazzozo: Created page with "=Request= {| class="wikitable" border="1" |- ! Index Word ! Description |- | 0 | Header code [0x00080000] |} =Response= {| class="wikitable" border="1" |- ! Index Word !..."

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x00080000]
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code
|-
| 1
| Result code
|-
| 2
| bool flag
|}

=Description=
See [[MCUNWM:SetWirelessDisabledFlag]].

This returns whether the WirelessDisabled bit is set, in the MCU system-state buffer.

MCURTC:GetLegacyJumpProhibitedFlag

2016-05-02T03:42:54Z

Dazzozo: Created page with "=Request= {| class="wikitable" border="1" |- ! Index Word ! Description |- | 0 | Header code [0x005A0000] |} =Response= {| class="wikitable" border="1" |- ! Index Word !..."

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x005A0000]
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code
|-
| 1
| Result code
|-
| 2
| bool flag
|}

=Description=
See [[MCURTC:SetLegacyJumpProhibitedFlag]].

This returns whether the LegacyJumpProhibited bit is set, in the MCU system-state buffer.

MCURTC:SetLegacyJumpProhibitedFlag

2016-05-02T03:03:52Z

Dazzozo: Created page with "=Request= {| class="wikitable" border="1" |- ! Index Word ! Description |- | 0 | Header code [0x00590040] |- | 1 | bool |} =Response= {| class="wikitable" border="1" |- !..."

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x00590040]
|-
| 1
| bool
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code
|-
| 1
| Result code
|}

=Description=
This writes to the MCU system-state buffer and updates the LegacyJumpProhibited bit.

This is set by LgyBg during title launch to deny the title of the rights to launch other titles via TWL Launcher (TLNC) block.

This is read by NS when handling the TLNC block. If this flag is set, NS ignores and memclears the TLNC block.