3dbrew - User contributions [en]

User talk:IReir

2016-07-31T13:56:40Z

IReir: test change

testing123 peekaboo[[User:IReir|IReir]] ([[User talk:IReir|talk]]) 17:56, 31 July 2016 (CEST)

FRDU:PrincipalIdToFriendCode

2016-07-28T13:00:56Z

IReir: Created page with "=Request= {| class="wikitable" border="1" |- ! Index Word ! Description |- | 0 | Header code [0x00240040] |- | 1 | principalId |} This function takes the principalId given..."

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x00240040]
|-
| 1
| principalId
|}

This function takes the principalId given and applies SHA-1 over it (byte order: little endian). The first byte of the SHA-1 digest is then shifted right by 1, which forms the checksum byte.

It returns an u64. The lower word is the principalId, the upper word is the checksum byte.

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code
|-
| 1
| Result code
|-
| 2-3
| (u64)the shareable friend code
|}

FRDU:IsValidFriendCode

2016-07-28T12:56:58Z

IReir: Created page with "=Request= {| class="wikitable" border="1" |- ! Index Word ! Description |- | 0 | Header code [0x00260080] |- | 1-2 | (u64) friend code to validate |} The friend code can be..."

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x00260080]
|-
| 1-2
| (u64) friend code to validate
|}

The friend code can be derived from the textual form of "1234-5678-9012" by stripping the slashes and then converting the string to an integer.

This function just calls [[FRDU:PrincipalIdToFriendCode]] with the lower half of the friend code and checks if the checksum byte returned matches the input.

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code
|-
| 1
| Result code
|-
| 2
| 1 if the provided friend code is valid, 0 otherwise
|}

OTP Registers

2016-07-27T06:03:04Z

IReir: Fix misnomer

This region (0x10012000-0x10012100) is used as persistent storage on SoC and for passing the TWL console ID around (0x10012100-0x10012108).

== Overview ==

Console-unique keys seem to be derived from here, though it is unknown how. Access to this region is disabled once the ARM9 writes 0x2 to [[CONFIG|REG_SYSPROT9]].

This is very likely the console-unique data store, including [[CTCert]] and other unit info values, that ends up in ITCM at 0x01FFB800. Bootrom would decrypt it, check for magic (0xDEADB00F), and then set CFG_UNITINFO, etc to match the specific console at hand. This is a guess based on the matching size of both sets of data (ITCM's is padded to 0x100, specifically) and the lack of another known source for this data on the system (it is not sourced from eMMC). On top of this, the latter half of this data is likely used as console-unique keydata, thus explaining ITCM's copy being memcleared and the OTP lock mechanism existing. Refer to [[Memory_layout#ARM9_ITCM]] for what is contained in the decrypted OTP.

On [[FIRM]] versions prior to [[3.0.0-6|3.0.0-X]], this region was left unprotected. On versions since [[3.0.0-6|3.0.0-X]], this has been fixed, and the region disable is now done by Kernel9 after doing console-unique TWL keyinit, by setting bit 1 of [[CONFIG|REG_SYSPROT9]]. However, with the [[New_3DS]] FIRM ARM9 binary this is now done in the [[FIRM]] ARM9 binary loader, which also uses the 0x10012000 region for New 3DS key generation.

On development units ([[CONFIG|UNITINFO]] != 0) ARM9 uses the first 8-bytes from 0x10012000 for the TWL Console ID. This region doesn't seem to be used by NATIVE_FIRM on retail at all, besides New3DS key-generation in the [[FIRM|ARM9-loader]]. It is unknown if bootrom reads from it, but it is likely.

== Sections ==

{| class="wikitable" border="1"
! Offset
! Size
! Description
|-
| 0x0
| 0x100
| Console-unique data. This data appears to be random, even when multiple consoles' dumps from this area are XORed. None of the raw data here seems to match any of the console-unique keys (tested: keyX, keyY and normal-key, both big and little u32 endianness for all keyslots) for the AES engine. It's unknown whether there's any encryption on this area.
|-
| 0x100
| 0x8
| Before writing REG_SYSPROT9 bit1, the ARM9 copies the 8-byte TWL Console ID here. This sets the registers at 0x4004D00 for ARM7.
|}

OTP Registers

2016-07-27T06:01:54Z

IReir:

This region (0x10012000-0x10012100) is used as persistent storage on SoC and for passing the TWL console ID around (0x10012100-0x10012108).

== Overview ==

Console-unique keys seem to be derived from here, though it is unknown how. Access to this region is disabled once the ARM9 writes 0x2 to [[CONFIG|REG_SYSPROT9]].

This is very likely the console-unique data store, including [[CTCert]] and other unit info values, that ends up in ITCM at 0x01FFB800. Bootrom would decrypt it, check for magic (0xDEADB00F), and then set CFG_UNITINFO, etc to match the specific console at hand. This is a guess based on the matching size of both sets of data (ITCM's is padded to 0x100, specifically) and the lack of another known source for this data on the system (it is not sourced from eMMC). On top of this, the latter half of this data is likely used as console-unique keydata, thus explaining ITCM's copy being memcleared and the OTP lock mechanism existing. Refer to [[Memory_layout#ARM9_ITCM]] for what is contained in the decrypted OTP.

On [[FIRM]] versions prior to [[3.0.0-6|3.0.0-X]], this region was left unprotected. On versions since [[3.0.0-6|3.0.0-X]], this has been fixed, and the region disable is now done by Kernel9 after doing console-unique TWL keyinit, by setting bit 1 of [[CONFIG|REG_SYSPROT9]]. However, with the [[New_3DS]] FIRM ARM9 binary this is now done in the [[FIRM]] ARM9 binary loader, which also uses the 0x10012000 region for New 3DS key generation.

On development units ([[CONFIG|UNITINFO]] != 0) ARM9 uses the first 8-bytes from 0x10012000 for the TWL Console ID. This region doesn't seem to be used by NATIVE_FIRM on retail at all, besides New3DS key-generation in the [[FIRM|ARM9-loader]]. It is unknown if bootrom reads from it, but it is likely.

== Sections Before Decryption ==

{| class="wikitable" border="1"
! Offset
! Size
! Description
|-
| 0x0
| 0x100
| Console-unique data. This data appears to be random, even when multiple consoles' dumps from this area are XORed. None of the raw data here seems to match any of the console-unique keys (tested: keyX, keyY and normal-key, both big and little u32 endianness for all keyslots) for the AES engine. It's unknown whether there's any encryption on this area.
|-
| 0x100
| 0x8
| Before writing REG_SYSPROT9 bit1, the ARM9 copies the 8-byte TWL Console ID here. This sets the registers at 0x4004D00 for ARM7.
|}

Talk:ExeFS

2016-07-23T03:17:39Z

IReir:

== Code binary? ==

What is the format of the "Code Binary"? Surely it's not a raw stream of ARM opcodes. There has to be data for the loader to work with!--[[User:Henke37|Henke37]] ([[User talk:Henke37|talk]]) 17:44, 22 July 2016 (CEST)
:ExeFS:/.code ''is'' a raw stream of ARM opcodes, plus data/rodata sections. The beginning of ExeFS:/.code is just plain ARM code (starting in ARM mode), however. The location and size of the data/rodata sections is described in the [[NCCH/Extended_Header#Code_Set_Info|exheader]]. Look up the thing called "ctr-elf", which takes a decrypted NCCH and converts it to an ELF file. Besides, these talk pages are kind of deserted; join the relevant IRC channels instead. [[User:IReir|IReir]] ([[User talk:IReir|talk]]) 07:17, 23 July 2016 (CEST)

EShop

2015-09-17T11:50:43Z

IReir: /* samurai */ list most important URLs

The Nintendo 3DS eShop was added in the June 2011 update for JP/EUR/USA.

From here, you can download Virtual Console games, 3D Classics, DSiware software, view screenshots, and 3D trailers for upcoming 3DS titles.

While eShop is loading, eShop will use command [[NIMS:CheckSysupdateAvailableSOAP]]. If a system update is available where title installation for system titles still needs finalized (or when the updated titles were not downloaded at all), eShop will then display the "system update is available" message.

The eShop application uses command [[AMNet:FinishInstallToMedia]] to finalize the SD title install (if the whole title is downloaded while eShop is still running), however, before using that command the eShop application also uses [[AMNet:FinishInstallToMedia]] to finalize installing all system titles (from system updates).

== eShop QR Codes ==
eShop QR Codes can be scanned with the camera, allowing one to quickly navigate to the desired eShop title with just two clicks. The QR Codes themselves is a simple text/url QR, started with "ESHOP://" string followed by a decimal eShop content link id(same IDs used internally by eShop for all content) and then some special data, delimited by a dot symbol, which can be ommited.

In order for the QR-code string data to be valid for eShop, it must begin with "ESHOP://5", with the first ID being all decimal.

{| class="wikitable"
|-
! QR Code source
! Region
! Title
! Serial
! Title ID
|-
| ESHOP://50010000000201.PEAALL000000 || EUR || Nintendogs & Cats Demo || ADA/B/C || 0004000200030c01
|-
| ESHOP://50010000007870.PEAALL000000 || EUR || Crush 3D || A??P || 00040002
|-
| ESHOP://50010000008009.PEAALL000000 || EUR || Resident Evil Revelations Demo || ABRE || 000400020005ee01
|-
| ESHOP://50010000008123.J00101Z00095 || JPN || Rhythm Thief And The Emperor's Treasure Demo || ARTJ || 00040002
|-
| ESHOP://50010000008404.PEAALL000000 || EUR || Mario And Sonic At The London 2012 Olympic Games Demo || ACMP [http://mediacontent.nintendo-europe.com/NOE/images/game_content/ACMP-MarioAndSonicAtTheLondon2012OlympicGames-QRCode-EA_ALL_000_001.bmp] || 00040002
|-
| ESHOP://50010000008447.J00101Z00094 || JPN || Resident Evil Revelations Demo || ABRJ || 00040002
|-
| ESHOP://50010000008449.J00101Z00082 || JPN || Swapnote || JFRJ ||?
|-
| ESHOP://50010000008561 || USA || Swapnote || JFRE || 0004000000051700
|-
| ESHOP://50010000008647.J00101Z00096 || JPN || Metal Gear Solid Snake Eater 3D Demo || AMGJ || 0004000200048101
|-
| ESHOP://50010000008648.J00101Z00097 || JPN || Theatrythm Final Fantasy || ATHJ ||?
|-
| ESHOP://50010000008782.PEAALL000000 || EUR || Metal Gear Solid Snake Eater 3D Demo || AMGE || 0004000200082401
|-
| ESHOP://50010000008842.PEAALL000000 || EUR || Rhythm Thief And The Emperor's Treasure Demo || ARTP [http://mediacontent.nintendo-europe.com/NOE/images/game_content/ARTP-RhythmThief_TheEmperorsTreasure-QRCode-EA_ALL_000_001.bmp] || 00040002
|-
| ESHOP://50010000009084.J00101Z00121 || JPN || Hatsune Miku And Future Stars: Project Mirai Demo || AM9J || 00040002
|-
| ESHOP://50010000009102.J00101Z00106 || JPN || Denpa Ningen RPG || JD8J ||?
|-
| ESHOP://50010000009161.J00101Z00118 || JPN || Dillon's Rolling Western || JAMJ || 00040000
|-
| ESHOP://50010000009261 || USA || Dillon's Rolling Western || JAME? || 00040000
|-
| ESHOP://50010000009401.J00101Z00120 || JPN || Kingdom Hearts 3D Video Download || JZ8J ||?
|-
| ESHOP://50010000009403.J00101Z00119 || JPN || DQM 3D Video Download || JZ7J ||?
|-
| ESHOP://50010000009575.PEAALL000000 || EUR || Kid Icarus: Of Myths And Monsters (Virtual Console) ||? ||?
|-
| ESHOP://50010000009846 || USA || Ketzal's Corridors ||? ||?
|}

* New QR Code for Japanese "Photos with Super Mario" has a different code string: ESHOP://50010000013120.J00108Z00001.CD588EAE95A3A68D15C647DA2AC0945FD88F70AB8A31149E51C4B05FB927B0B8

* There is a link in the Japanese eShop <nowiki>[http://www.nintendo.co.jp/3ds/eshop/qrCode.html?####]</nowiki> where you can replace the #### with the Japanese eShop title's serial and you will get it's QR code. (i.e. http://www.nintendo.co.jp/3ds/eshop/qrCode.html?jcaj will get you the pushmo QR code)

* You could use Google's Chart API to create a QR code from the codes above: https://chart.googleapis.com/chart?chs=150x150&cht=qr&chl=ESHOP (replace the ESHOP text with the ESHOP:// link from one of the above)

== NS eShop application parameters ==
This section describes the 0x1C-byte structure stored at the application parameters from [[APT:StartApplication]], under the 0x300-byte buffer listed there.

{| class="wikitable"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Unknown, usually 0x3?
|-
| 0x4
| 0x4
| Unknown, usually 0x0?
|-
| 0x8
| 0x8
| u64 binary eShop content ID, same ID from the first string in eShop QR-codes except in binary form.
|-
| 0x10
| 0x10
| This is the last string from the QR-code(if any), no NUL-termination.
|}

== ExtData ==
The ExtData [[Extdata#Filesystem|File System]] for eShop is as follows:

root
├── icon
├── boss
│ └── TIGER100.tmp
└── user

{| class="wikitable" border="1"
|-
! File
! Details
! Size
! Firmware Introduced
! Plain text
|-
| icon
| Duplicate from application ExeFS. Always image 00000002
| 0x36C0 Bytes
| [[2.0.0-2]]
| [https://dl.dropboxusercontent.com/u/60710927/CTR/Sample/eShopExtdata/icon Download_EUR]
|-
| TIGER100.tmp
| Always image 00000003.
| 0xCE47 bytes (varies?)
| [[2.0.0-2]]
|
|}

== Music ==
The eShop pulls its music from a static, region-specific link in a format similar to the following:

https:// a248.e.akamai.net/f/248/103046/10m/npdl.c.app.nintendowifi.net/p01/nsa/CtfKXACbUPl8s7lk/BGM1/US_BGM1 ,
where region is one of the primary system regions (JP, US, EU, KR, etc.) Support also exists for 'BGM2', but this seems to be unused.
The music is held in a [[SpotPass|BOSS]] container.

The format consists of a brief XML header describing the audio (including the date it was set as the main eShop theme, loop times, size, etc) followed by a raw AAC stream. Tools such as FFmpeg can handle rebuilding this stream with ADTS headers for proper time info and such.

The [[Home_Menu|Home Menu]] uses nearly the same format for the Theme Shop's background music.

== URLs ==

eShop uses the following domains over HTTPS:

* cp3s-auth.c.shop.nintendowifi.net
* a248.e.akamai.net
* ninja.ctr.shop.nintendo.net
* samurai.ctr.shop.nintendo.net
* ccif.ctr.shop.nintendo.net
* eou.c.shop.nintendowifi.net

These domains are used by [[NIM_Services|NIM]]:

* nus.c.shop.nintendowifi.net
* ecs.c.shop.nintendowifi.net
* cas.c.shop.nintendowifi.net

ninja.ctr.shop.nintendo.net and samurai.ctr.shop.nintendo.net contain the bulk of the eShop information.

=== Common Parameters to ninja and samurai ===

For every request to the ninja and samurai servers, three parameters are always sent, though are not necessarily required:

{| class="wikitable" border="1"
|-
! Parameter
! Required
! Description
! Type
! Normal value
|-
| shop_id
| depends on the URL, usually no
| Describes which eShop instance should be used. 1 indicates the 3DS eShop, 2 indicates the Wii U eShop. 3 seems to yield the same results as 2. Values greater than 3 or less than 1 are invalid. Defaults to 2 or 3 if not given.
| unsigned integer
| 1
|-
| lang
| no
| Describes the language. Seems to be an ISO 639-1 code in lower case. Every eShop region has a default language that is used if this parameter is not given. Some regions have multiple languages, such as CA (en and fr).
| string (two characters)
| depends on region and eShop settings; for US: en
|-
| _type
| no
| Describes whether the client wants to receive JSON or XML. This parameter seems actually unused and the servers always return XML.
| string
| json
|}

=== samurai ===

samurai.ctr.shop.nintendo.net (samurai) provides metadata about titles. The samurai server provides the backend for the eShop title search.

Common parameters described above can always be sent.

{| class="wikitable" border="1"
|-
! Path
! Description
! Parameters
|-
| /samurai/ws/'''region'''/titles
| Fetches the title list, containing the content id (not the 3DS title id), the product code and the localized title name
| All of these are optional.
* genre[]: genre ID (unsigned int)
* publisher[]: publisher ID (unsigned int)
* price_min: minimum price in region currency (signed int)
* price_max: maximum price in region currency (signed int)
* video_format: "moflex"
* freeword: keyword(s?) to look for (string)
* limit: maximum results
* offset: results to skip
* sort: one of "new", "popular" or "score"
* release_date_before: date/time title must have been released before (UNIX timestamp prefixed by +)
* release_date_after: date/time title must have been released after (UNIX timestamp prefixed by -)
|-
| /samurai/ws/'''region'''/news
| eShop news section
| (none)
|-
| /samurai/ws/'''region'''/telops
| Some kind of news?
| shop_id is required
|-
| /samurai/ws/'''region'''/directory/'''(long long unsigned int)''' and /samurai/ws/'''region'''/directory/~'''(string)'''
| (unknown)
| (unknown)
|-
| /samurai/ws/'''region'''/title/'''content id'''
| Returns information about the title, more verbose than /titles.
| (none)
|-
| /samurai/ws/'''region'''/contents
| Seems identical to /titles.
| see /titles
|-
| /samurai/ws/'''region'''/genres
| Returns a list of human-readable genre names and their corresponding genre id.
| (none)
|-
| /samurai/ws/'''region'''/publishers
| Returns a list of human-readable publisher names and their corresponding publisher id.
| (none)
|-
| /samurai/ws/'''region'''/title/'''content id'''/aocs
| Returns a list of add-on contents/downloadable content and prices in eShop region currency.
| (none)
|}

=== ninja ===

ninja.ctr.shop.nintendo.net (ninja) contains the seeds for the new 9.6 crypto, pricing information and handles actions that require authentication, such as purchases. Authentication information seems to be obtained from the [[ACT_Services|act:u sysmodule]] and works through OAuth2.

EShop

2015-09-17T11:25:23Z

IReir: Begin overhaul

The Nintendo 3DS eShop was added in the June 2011 update for JP/EUR/USA.

From here, you can download Virtual Console games, 3D Classics, DSiware software, view screenshots, and 3D trailers for upcoming 3DS titles.

While eShop is loading, eShop will use command [[NIMS:CheckSysupdateAvailableSOAP]]. If a system update is available where title installation for system titles still needs finalized (or when the updated titles were not downloaded at all), eShop will then display the "system update is available" message.

The eShop application uses command [[AMNet:FinishInstallToMedia]] to finalize the SD title install (if the whole title is downloaded while eShop is still running), however, before using that command the eShop application also uses [[AMNet:FinishInstallToMedia]] to finalize installing all system titles (from system updates).

== eShop QR Codes ==
eShop QR Codes can be scanned with the camera, allowing one to quickly navigate to the desired eShop title with just two clicks. The QR Codes themselves is a simple text/url QR, started with "ESHOP://" string followed by a decimal eShop content link id(same IDs used internally by eShop for all content) and then some special data, delimited by a dot symbol, which can be ommited.

In order for the QR-code string data to be valid for eShop, it must begin with "ESHOP://5", with the first ID being all decimal.

{| class="wikitable"
|-
! QR Code source
! Region
! Title
! Serial
! Title ID
|-
| ESHOP://50010000000201.PEAALL000000 || EUR || Nintendogs & Cats Demo || ADA/B/C || 0004000200030c01
|-
| ESHOP://50010000007870.PEAALL000000 || EUR || Crush 3D || A??P || 00040002
|-
| ESHOP://50010000008009.PEAALL000000 || EUR || Resident Evil Revelations Demo || ABRE || 000400020005ee01
|-
| ESHOP://50010000008123.J00101Z00095 || JPN || Rhythm Thief And The Emperor's Treasure Demo || ARTJ || 00040002
|-
| ESHOP://50010000008404.PEAALL000000 || EUR || Mario And Sonic At The London 2012 Olympic Games Demo || ACMP [http://mediacontent.nintendo-europe.com/NOE/images/game_content/ACMP-MarioAndSonicAtTheLondon2012OlympicGames-QRCode-EA_ALL_000_001.bmp] || 00040002
|-
| ESHOP://50010000008447.J00101Z00094 || JPN || Resident Evil Revelations Demo || ABRJ || 00040002
|-
| ESHOP://50010000008449.J00101Z00082 || JPN || Swapnote || JFRJ ||?
|-
| ESHOP://50010000008561 || USA || Swapnote || JFRE || 0004000000051700
|-
| ESHOP://50010000008647.J00101Z00096 || JPN || Metal Gear Solid Snake Eater 3D Demo || AMGJ || 0004000200048101
|-
| ESHOP://50010000008648.J00101Z00097 || JPN || Theatrythm Final Fantasy || ATHJ ||?
|-
| ESHOP://50010000008782.PEAALL000000 || EUR || Metal Gear Solid Snake Eater 3D Demo || AMGE || 0004000200082401
|-
| ESHOP://50010000008842.PEAALL000000 || EUR || Rhythm Thief And The Emperor's Treasure Demo || ARTP [http://mediacontent.nintendo-europe.com/NOE/images/game_content/ARTP-RhythmThief_TheEmperorsTreasure-QRCode-EA_ALL_000_001.bmp] || 00040002
|-
| ESHOP://50010000009084.J00101Z00121 || JPN || Hatsune Miku And Future Stars: Project Mirai Demo || AM9J || 00040002
|-
| ESHOP://50010000009102.J00101Z00106 || JPN || Denpa Ningen RPG || JD8J ||?
|-
| ESHOP://50010000009161.J00101Z00118 || JPN || Dillon's Rolling Western || JAMJ || 00040000
|-
| ESHOP://50010000009261 || USA || Dillon's Rolling Western || JAME? || 00040000
|-
| ESHOP://50010000009401.J00101Z00120 || JPN || Kingdom Hearts 3D Video Download || JZ8J ||?
|-
| ESHOP://50010000009403.J00101Z00119 || JPN || DQM 3D Video Download || JZ7J ||?
|-
| ESHOP://50010000009575.PEAALL000000 || EUR || Kid Icarus: Of Myths And Monsters (Virtual Console) ||? ||?
|-
| ESHOP://50010000009846 || USA || Ketzal's Corridors ||? ||?
|}

* New QR Code for Japanese "Photos with Super Mario" has a different code string: ESHOP://50010000013120.J00108Z00001.CD588EAE95A3A68D15C647DA2AC0945FD88F70AB8A31149E51C4B05FB927B0B8

* There is a link in the Japanese eShop <nowiki>[http://www.nintendo.co.jp/3ds/eshop/qrCode.html?####]</nowiki> where you can replace the #### with the Japanese eShop title's serial and you will get it's QR code. (i.e. http://www.nintendo.co.jp/3ds/eshop/qrCode.html?jcaj will get you the pushmo QR code)

* You could use Google's Chart API to create a QR code from the codes above: https://chart.googleapis.com/chart?chs=150x150&cht=qr&chl=ESHOP (replace the ESHOP text with the ESHOP:// link from one of the above)

== NS eShop application parameters ==
This section describes the 0x1C-byte structure stored at the application parameters from [[APT:StartApplication]], under the 0x300-byte buffer listed there.

{| class="wikitable"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Unknown, usually 0x3?
|-
| 0x4
| 0x4
| Unknown, usually 0x0?
|-
| 0x8
| 0x8
| u64 binary eShop content ID, same ID from the first string in eShop QR-codes except in binary form.
|-
| 0x10
| 0x10
| This is the last string from the QR-code(if any), no NUL-termination.
|}

== ExtData ==
The ExtData [[Extdata#Filesystem|File System]] for eShop is as follows:

root
├── icon
├── boss
│ └── TIGER100.tmp
└── user

{| class="wikitable" border="1"
|-
! File
! Details
! Size
! Firmware Introduced
! Plain text
|-
| icon
| Duplicate from application ExeFS. Always image 00000002
| 0x36C0 Bytes
| [[2.0.0-2]]
| [https://dl.dropboxusercontent.com/u/60710927/CTR/Sample/eShopExtdata/icon Download_EUR]
|-
| TIGER100.tmp
| Always image 00000003.
| 0xCE47 bytes (varies?)
| [[2.0.0-2]]
|
|}

== Music ==
The eShop pulls its music from a static, region-specific link in a format similar to the following:

https:// a248.e.akamai.net/f/248/103046/10m/npdl.c.app.nintendowifi.net/p01/nsa/CtfKXACbUPl8s7lk/BGM1/US_BGM1 ,
where region is one of the primary system regions (JP, US, EU, KR, etc.) Support also exists for 'BGM2', but this seems to be unused.
The music is held in a [[SpotPass|BOSS]] container.

The format consists of a brief XML header describing the audio (including the date it was set as the main eShop theme, loop times, size, etc) followed by a raw AAC stream. Tools such as FFmpeg can handle rebuilding this stream with ADTS headers for proper time info and such.

The [[Home_Menu|Home Menu]] uses nearly the same format for the Theme Shop's background music.

== URLs ==

eShop uses the following domains over HTTPS:

* cp3s-auth.c.shop.nintendowifi.net
* a248.e.akamai.net
* ninja.ctr.shop.nintendo.net
* samurai.ctr.shop.nintendo.net
* ccif.ctr.shop.nintendo.net
* eou.c.shop.nintendowifi.net

These domains are used by [[NIM_Services|NIM]]:

* nus.c.shop.nintendowifi.net
* ecs.c.shop.nintendowifi.net
* cas.c.shop.nintendowifi.net

ninja.ctr.shop.nintendo.net and samurai.ctr.shop.nintendo.net contain the bulk of the eShop information.

=== Common Parameters to ninja and samurai ===

For every request to the ninja and samurai servers, three parameters are always sent, though are not necessarily required:

{| class="wikitable" border="1"
|-
! Parameter
! Required
! Description
! Type
! Normal value
|-
| shop_id
| no
| Describes which eShop instance should be used. 1 indicates the 3DS eShop, 2 indicates the Wii U eShop. 3 seems to yield the same results as 2. Values greater than 3 or less than 1 are invalid. Defaults to 2 or 3 if not given.
| unsigned integer
| 1
|-
| lang
| no
| Describes the language. Seems to be an ISO 639-1 code in lower case. Every eShop region has a default language that is used if this parameter is not given. Some regions have multiple languages, such as CA (en and fr).
| string (two characters)
| depends on region and eShop settings; for US: en
|-
| _type
| no
| Describes whether the client wants to receive JSON or XML. This parameter seems actually unused and the servers always return XML.
| string
| json
|}

=== samurai ===

samurai.ctr.shop.nintendo.net (samurai) provides metadata about titles. The samurai server provides the backend for the eShop title search.

=== ninja ===

ninja.ctr.shop.nintendo.net (ninja) contains the seeds for the new 9.6 crypto, pricing information and handles actions that require authentication, such as purchases. Authentication information seems to be obtained from the [[ACT_Services|act:u sysmodule]] and works through OAuth2.

NS and APT Services

2015-08-31T08:28:16Z

IReir: /* NS Service "ns:s" */ Sync headercode with page NSS:LaunchFirm

[[Category:Services]]
The NS ('''N'''intendo User Interface '''S'''hell) system module is the first module launched from a CTR-NAND title after the [[FIRM]] processes are loaded. This module is launched by the pm process, with the titleID loaded from NS state(hard-coded TID initialized during applet TID-array initialization). NS first launches [[ErrDisp]], then the menu. On retail the menu TID is loaded from NS state, while on dev/debug the menu TID is loaded from [[Config_Savegame|config]]. On dev-units if the menu TID block doesn't exist in [[Config_Savegame|config]], NS will attempt to launch the alternate menu instead. The TID of the launched menu is then written to [[Configuration Memory|ACTIVEMENUTID]]. NS uses [[PMApp:LaunchTitle|pm:app]] to launch titles.

NS will not trigger the [[ErrDisp|fatal-error]] screen when launching the regular/alternate menu fails.

Like home menu NS is constantly running while the system is in 3DS-mode. When attempting to return to home-menu when the home-menu process isn't running(like when the process terminated/crashed), NS will trigger a [[ErrDisp|fatal]] error.

= Alternate menu =
When launching the regular menu fails, NS will then attempt to launch the alternate menu. This title could be used as a recovery process, however it's normally not used after the factory.

At the factory for all 3DS systems, [[3DS Development Unit GUI#Test Menu|Test Menu]] is installed with this TID. On retail this title is eventually deleted during [[Factory Setup]].

= Auto-boot =
After [[PMApp:GetFIRMLaunchParams|loading]] [[FIRM]] params and prior to launching [[ErrDisp]]/Home Menu, NS handles auto-booting titles. The same code called by [[APT:Reboot]] is used for launching FIRM here. When the [[Configuration_Memory|UPDATEFLAG]] is set, NS will launch SAFE_MODE_FIRM with the application titleID set to the [[System_Settings#System_Updater|System Updater]] titleID for this region. When the UPDATEFLAG is not set, NS can auto-boot the following titles as well if [[Configuration_Memory|0x1FF80016]] bit0 is set.

When bit1 and bit2 are value zero in [[Configuration_Memory|0x1FF80016]], NS will [[NSS:LaunchFIRM|launch]] the title specified by the [[FIRM]] parameters if the title-info is set. This FIRM launch is done after launching [[ErrDisp]] and Home Menu. Otherwise when [[Configuration_Memory|0x1FF80016]] is value 2 and the output u8 from [[PTM|PTMSYSM]] command 0x08140000 is value 0, NS will boot the title specified from the TWL TLNC block from FIRMparams+0x300. This is the same TLNC block which DSi titles wrote to RAM+0x300 for launching other titles via the launcher title. When handling the TLNC block, NS will boot the 3DS System Settings title when the TLNC titleID is the DSi System Settings titleID(the region field in the TLNC TID is not checked/used). When the TLNC titleID is not System Settings, NS will convert the input DSi titleID-high to the 3DS TWL titleID-high(tidhigh = (TLNCtidhigh & 0x7FFF) | 0x48000), then launch TWL_FIRM to run the title. NS does not support launching from gamecard via TLNC.

= NS Workaround =
A "ns_workaround" was [[5.1.0-11|added]] in NS to workaround the flaw added with [[5.0.0-11]]. When NS is loading before launching any ARM11 processes and certain [[Configuration Memory]] fields are set, NS will launch [[Application_Manager_Services|AM]] then use command [[AM:InstallNATIVEFIRM]]. NS will then execute the code called by [[APT:StartNewestHomeMenu]], the code related to APT:PrepareToStartNewestHomeMenu is not executed here.

NS will only execute this code-path when [[Configuration Memory|0x1FF80016]] is value zero, when KERNEL_VERSIONMAJOR is value 2, and when KERNEL_VERSIONMINOR is less than 35. Therefore, this code-path is only executed when the running NATIVE_FIRM version is prior to [[5.0.0-11]].

= NS Service "ns:s" =
{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Description
|-
| 0x000100C0
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:LaunchFIRM|LaunchFIRM]]
|-
| 0x000200C0
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:LaunchTitle|LaunchTitle]]
|-
| 0x0003....
| [[1.0.0-0]] - [[2.0.0-2]]
| Wrapper for [[Process_Manager_Services|PMApp]] command 0x00030080.
|-
| 0x0004....
| [[1.0.0-0]] - [[2.0.0-2]]
| Wrapper for [[Process_Manager_Services|PMApp]] command 0x000500C0.
|-
| 0x000500C0
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:LaunchApplicationFIRM|LaunchApplicationFIRM]]
|-
| 0x00060042
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:SetFIRMParams4A0|SetFIRMParams4A0]]
|-
| 0x00070042
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:CardUpdateInitialize|CardUpdateInitialize]]
|-
| 0x00080000
| [[1.0.0-0]] - [[2.0.0-2]]
| This shuts down the gamecard system update interface: the shared memory is unmapped, the CFA archive is closed, state is cleared, etc.
|-
| 0x0009....
| [[1.0.0-0]] - [[2.0.0-2]]
| Gamecard system update related.
|-
| 0x000A....
| [[1.0.0-0]] - [[2.0.0-2]]
| Gamecard system update related.
|-
| 0x000B....
| [[1.0.0-0]] - [[2.0.0-2]]
| Gamecard system update related.
|-
| 0x000C....
| [[1.0.0-0]] - [[2.0.0-2]]
| Gamecard system update related.
|-
| 0x000D0140
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:SetFIRMParams4B0|SetFIRMParams4B0]]
|-
| 0x000E....
| [[1.0.0-0]] - [[2.0.0-2]]
| Wrapper for "ptm:sysm" service command 0x040700C0.
|-
| 0x000F0000
| [[1.0.0-0]] - [[2.0.0-2]]
| This calls [[APT:AppletUtility]] with fixed input params.
|-
| 0x00100180
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:RebootSystem|RebootSystem]]
|-
| 0x0011....
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:TerminateProcessTID|TerminateProcessTID]]
|-
| 0x0012....
| ?
| Uses pm:app cmdA&B
|-
| 0x0013....
| ?
| ?
|-
| 0x0014....
| ?
| ?
|-
| 0x0015....
| ?
| ?
|-
| 0x00160000
| [[8.0.0-18]]
| This triggers a hw-reboot.
|}

The maximum sessions that can be used with this service is two, therefore only two processes can use this service at the same time.

=NS Service "ns:p"=
This was added with [[3.0.0-5]]. The PTM sysmodule connects to this service, and syncs whenever [[PTM|ptm:s GetShellState()]] changes.

=NS Service "ns:c"=
This was added with [[5.0.0-11]], it's unknown what this is used for.

=APT Services=
{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Accessible with APT:U
! Description
|-
| 0x00010040
|
| Yes
| GetLockHandle
|-
| 0x00020080
|
| See [[APTU:Initialize|here]].
| [[APTU:Initialize|Initialize]]
|-
| 0x00030040
|
| Yes
| Enable
|-
| 0x00040040
|
| Yes
| Finalize
|-
| 0x00050040
|
| Yes
| [[APT:GetAppletManInfo|GetAppletManInfo]]
|-
| 0x00060040
|
| Yes
| [[APT:GetAppletInfo|GetAppletInfo]]
|-
| 0x00070000
|
| Yes
| GetLastSignaledAppletId
|-
| 0x00080000
|
| Yes
| CountRegisteredApplet
|-
| 0x00090040
|
| Yes
| [[APT:IsRegistered|IsRegistered]]
|-
| 0x000A0040
|
| Yes
| GetAttribute
|-
| 0x000B0040
|
| Yes
| [[APTU:GetSignalType|InquireNotification]]
|-
| 0x000C0104
|
| Yes
| [[APT:SendParameter|SendParameter]]
|-
| 0x000D0080
|
| Yes
| [[APT:ReceiveParameter|ReceiveParameter]]
|-
| 0x000E0080
|
| Yes
| [[APT:GlanceParameter|GlanceParameter]]
|-
| 0x000F0100
|
| Yes
| [[APT:CancelParameter|CancelParameter]]
|-
| 0x001000C2
|
| Yes
| DebugFunc
|-
| 0x001100C0
|
| Yes
| [[APT:MapProgramIdForDebug|MapProgramIdForDebug]]
|-
| 0x00120040
|
| Yes
| SetHomeMenuAppletIdForDebug
|-
| 0x00130000
|
| Yes
| GetPreparationState
|-
| 0x00140040
|
| Yes
| SetPreparationState
|-
| 0x00150140
|
| No
| [[APT:PrepareToStartApplication|PrepareToStartApplication]]
|-
| 0x00160040
|
| Yes
| PreloadLibraryApplet
|-
| 0x00170040
|
| Yes
| FinishPreloadingLibraryApplet
|-
| 0x00180040
|
| Yes
| PrepareToStartLibraryApplet
|-
| 0x00190040
|
| Yes
| [[APT:PrepareToStartSystemApplet|PrepareToStartSystemApplet]]
|-
| 0x001A0000
|
| Yes
| PrepareToStartNewestHomeMenu
|-
| 0x001B00C4
|
| Yes
| [[APT:StartApplication|StartApplication]]
|-
| 0x001C0000
|
| Yes
| WakeupApplication
|-
| 0x001D0000
|
| Yes
| CancelApplication
|-
| 0x001E0084
|
| Yes
| StartLibraryApplet
|-
| 0x001F0084
|
| Yes
| [[APT:StartSystemApplet|StartSystemApplet]]
|-
| 0x00200044
|
| Yes
| [[APT:StartNewestHomeMenu|StartNewestHomeMenu]]
|-
| 0x00210000
|
| No
| OrderToCloseApplication
|-
| 0x00220040
|
| Yes
| PrepareToCloseApplication(bool isJumpToHome)
|-
| 0x00230040
|
| Yes
| PrepareToJumpToApplication
|-
| 0x00240044
|
| Yes
| JumpToApplication
|-
| 0x002500C0
|
| Yes
| PrepareToCloseLibraryApplet
|-
| 0x00260000
|
| Yes
| PrepareToCloseSystemApplet
|-
| 0x00270044
|
| Yes
| CloseApplication
|-
| 0x00280044
|
| Yes
| CloseLibraryApplet
|-
| 0x00290044
|
| Yes
| CloseSystemApplet
|-
| 0x002A0000
|
| Yes
| OrderToCloseSystemApplet
|-
| 0x002B0000
|
| Yes
| PrepareToJumpToHomeMenu
|-
| 0x002C0044
|
| Yes
| JumpToHomeMenu
|-
| 0x002D0000
|
| Yes
| PrepareToLeaveHomeMenu
|-
| 0x002E0044
|
| Yes
| LeaveHomeMenu
|-
| 0x002F0040
|
| Yes
| PrepareToLeaveResidentApplet
|-
| 0x00300044
|
| Yes
| LeaveResidentApplet
|-
| 0x00310100
|
| Yes
| [[APT:PrepareToDoApplicationJump|PrepareToDoApplicationJump]]
|-
| 0x00320084
|
| Yes
| [[APT:DoApplicationJump|DoApplicationJump]]
|-
| 0x00330000
|
| Yes
| GetProgramIdOnApplicationJump
|-
| 0x00340084
|
| Yes
| [[APT:SendDeliverArg|SendDeliverArg]]
|-
| 0x00350080
|
| Yes
| ReceiveDeliverArg
|-
| 0x00360040
|
| Yes
| [[APT:LoadSysMenuArg|LoadSysMenuArg]]
|-
| 0x00370042
|
| Yes
| [[APT:StoreSysMenuArg|StoreSysMenuArg]]
|-
| 0x00380040
|
| Yes
| PreloadResidentApplet
|-
| 0x00390040
|
| Yes
| PrepareToStartResidentApplet
|-
| 0x003A0044
|
| Yes
| StartResidentApplet
|-
| 0x003B0040
|
| Yes
| CancelLibraryApplet
|-
| 0x003C0042
|
| Yes
| SendDspSleep
|-
| 0x003D0042
|
| Yes
| SendDspWakeUp
|-
| 0x003E0080
|
| Yes
| ReplySleepQuery
|-
| 0x003F0040
|
| Yes
| ReplySleepNotificationComplete
|-
| 0x00400042
|
| Yes
| [[APT:SendCaptureBufferInfo|SendCaptureBufferInfo]]
|-
| 0x00410040
|
| Yes
| [[APT:ReceiveCaptureBufferInfo|ReceiveCaptureBufferInfo]]
|-
| 0x00420080
|
| Yes
| SleepSystem
|-
| 0x00430040
|
| Yes
| NotifyToWait
|-
| 0x00440000
|
| Yes
| GetSharedFont
|-
| 0x00450040
|
| Yes
| GetWirelessRebootInfo
|-
| 0x00460104
|
| Yes
| [[APT:Wrap|Wrap]]
|-
| 0x00470104
|
| Yes
| [[APT:Unwrap|Unwrap]]
|-
| 0x00480100
|
| No
| [[APT:GetProgramInfo|GetProgramInfo]]
|-
| 0x00490180
|
| No
| [[APT:Reboot|Reboot]]
|-
| 0x004A0040
|
| Yes
| [[APT:GetCaptureInfo|GetCaptureInfo]]
|-
| 0x004B00C2
|
| Yes
| [[APT:AppletUtility|AppletUtility]]
|-
| 0x004C0000
|
| Yes
| SetFatalErrDispMode
|-
| 0x004D0080
|
| Yes
| [[APT:GetAppletProgramInfo|GetAppletProgramInfo]]
|-
| 0x004E0000
|
| Yes
| HardwareResetAsync
|-
| 0x004F0080
| [[2.2.0-X]]
| Yes
| [[APT:SetApplicationCpuTimeLimit|SetApplicationCpuTimeLimit]]
|-
| 0x00500040
| [[2.2.0-X]]
| Yes
| [[APT:GetApplicationCpuTimeLimit|GetApplicationCpuTimeLimit]]
|-
| 0x0051....
| [[3.0.0-5]]
| ?
| Uses pm:app cmdB
|-
| 0x00520104
| [[4.0.0-7]]
| ?
| Wrap1
|-
| 0x00530104
| [[4.0.0-7]]
| ?
| Unwrap1
|-
| 0x00540040
| [[5.0.0-11]]
| ?
| ?
|-
| 0x00550040
| [[7.0.0-13]]
| Yes
| This writes the input u8 to a NS state field.
|-
| 0x00560000
| [[7.0.0-13]]
| Yes
| This returns an u8 NS state field(which can be set by cmd 0x00550040), at cmdreply+8.
|-
| 0x00570044
| [[7.0.0-13]]
| ?
| WakeupApplication2?
|-
| 0x00580002
| [[7.0.0-13]]
| ?
| ?
|-
| 0x01010000
| [[8.0.0-18]]
| Yes
| This writes an output u8 to cmdreply indexword[2]. This uses [[PTMSYSM:CheckNew3DS]]. When a certain NS state field is non-zero, the output value is zero, otherwise the output is from [[PTMSYSM:CheckNew3DS]]. Normally this NS state field is zero, however this state field is set to 1 when [[APT:PrepareToStartApplication]] is used with flags bit8 is set.
|-
| 0x01020000
| [[8.0.0-18]]
| Yes
| Wrapper for [[PTMSYSM:CheckNew3DS]].
|-
| 0x01030000
| [[8.0.0-18]]
| Yes
| ?
|-
| 0x01040000
| [[8.0.0-18]]
| ?
| ?
|}

These "APT:U" and "APT:S" NS services can handle launching titles/"applets", these services handle signaling for home/power button as well. Only one session for either APT service can be open at a time, normally processes close the service handle immediately once finished using the service. The commands for APT:U and APT:S are exactly the same, however certain commands are only accessible with APT:S(NS module will call [[SVC|svcBreak]] when the command isn't accessible).

Applets returning to home-menu first use commands APT:PrepareToJumpToHomeMenu and APT:JumpToHomeMenu, followed by these commands to launch home-menu: [[APT:PrepareToStartSystemApplet]] and [[APT:StartSystemApplet]]. [[APT:PrepareToStartSystemApplet]] and [[APT:StartSystemApplet]] are also used for launching the [[Internet Browser]], the camera applet, etc.

Processes launch applications via home-menu, not directly with [[APT:PrepareToStartApplication]] and [[APT:StartApplication]]. Regular applications can't directly launch applications since [[APT:StartApplication]] launches the process without terminating the currently running application.

APT:PrepareToDoApplicationJump and APT:DoApplicationJump are used by applications, for launching native/<non-NATIVE_FIRM> applications. These commands notify Home Menu that title launching needs done, Home Menu does the actual title launching via NS commands.

="APT:A" Service=
This was added with [[7.0.0-13|7.0.0-X]]. Official apps built with the CTRSDK for system-version >=[[7.0.0-13|7.0.0-X]] normally use the "APT:A" service instead of "APT:U". Those processes also have "APT:A" instead of "APT:U" in the service-access-control. It's unknown whether there's anything which is only accessible via "APT:A".

=Library Applets=
Library applets can be launched by applications and regular applets. These library applets render to the screen(s) when running, etc. For example, this includes swkbd for text input. See the below appIDs in the 0x2XX range, the actual appID used is 0x4XX however.

Input data can be sent to the library applet via the NS [[APT:SendParameter|parameter]] buffer, and/or with shared-memory with a shared-mem handle sent to the library applet. Output data from the library applet can be received by [[APT:ReceiveParameter]], the library applet can also use the specified shared-mem for output too.

=AppIDs=
{| class="wikitable" border="1"
|-
! AppID
! Description
|-
| 0x101
| Home Menu (menu)
|-
| 0x103
| Alternate Menu
|-
| 0x110
| Camera applet (CtrApp)
|-
| 0x112
| Friends List applet (friend)
|-
| 0x113
| Game Notes applet (Cherry)
|-
| 0x114
| [[Internet Browser]] (spider/SKATER)
|-
| 0x115
| Instruction Manual applet
|-
| 0x116
| Notifications applet (newslist)
|-
| 0x117
| Miiverse applet (olv)
|-
| 0x201
| Software Keyboard (swkbd) (?)
|-
| 0x202
| Mii Selector (appletEd) (?)
|-
| 0x204
| Photo Selector (PNOTE_AP) (?)
|-
| 0x205
| Sound Selector (SNOTE_AP) (?)
|-
| 0x206
| Error Display (error) (?)
|-
| 0x207
| eShop applet (mint) (?)
|-
| 0x208
| Circle Pad Pro Calibrator ([[Extrapad_Applet|extrapad]]) (?)
|-
| 0x209
| Notepad (memolib) (?)
|-
| 0x300
| Application
|-
| 0x401
| Software Keyboard (swkbd)
|-
| 0x402
| Mii Selector (appletEd)
|-
| 0x404
| Photo Selector (PNOTE_AP)
|-
| 0x405
| Sound Selector (SNOTE_AP)
|-
| 0x406
| Error Display (error)
|-
| 0x407
| eShop applet (mint)
|-
| 0x408
| Circle Pad Pro Calibrator ([[Extrapad_Applet|extrapad]])
|-
| 0x409
| Notepad (memolib)
|-
| 0xF10
| ProgramID: 0004003000008900.
|-
| 0xF11
| ProgramID: 000400000FFFFD00.
|-
| 0xF12
| ProgramID: 000400000FFFFC00.
|-
| 0xF13
| ProgramID: 000400000FFFFB00.
|-
| 0xF14
| ProgramID: 000400000FFFF900.
|-
| 0xF15
| ProgramID: 000400000FFFF800.
|-
| 0xF16
| ProgramID: 000400000FFFF700.
|-
| 0xF17
| ProgramID: 000400000FFFF600.
|-
| 0xF18
| ProgramID: 000400000FFFF500.
|}

These AppIDs are all for NAND titles, except for 0x300. AppIDs in the 0x1XX range are applets(programID-high 00040030), and the AppIDs in the 0x2XX range are "system libraries"(programID-high 00040030). The 0xFXX AppID range is for development NAND applications, these are not available for retail.

Note that at some point the total AppID entry count was changed from 28 to 27.

NIM Services

2015-08-31T08:18:02Z

IReir: /* NIM server service "nim:s" */ Sync headercode with page CheckSysupdateAvailableSOAP

[[Category:Services]]
= NIM user service "nim:u" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010000
| Related to starting a sysupdate?
|-
| 0x00020000
| [[NIMU:GetUpdateDownloadProgress|GetUpdateDownloadProgress]]
|-
| 0x0003....
| ?
|-
| 0x00040000
| [[NIMU:FinishTitlesInstall|FinishTitlesInstall]]
|-
| 0x00050000
| This obtains an event handle. Home Menu will check whether a system update is available when this event is triggered.
|-
| 0x0006....
| ?
|-
| 0x0007....
| ?
|-
| 0x0008....
| ?
|-
| 0x00090000
| [[NIMU:CheckSysupdateAvailable|CheckSysupdateAvailable]]
|-
| 0x000A0000
| GetState
|-
| 0x000B....
| GetSystemTitleHash (unique hash for each sysupdate titlelist)
|}

= NIM server service "nim:s" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x000A0000
| [[NIMS:CheckSysupdateAvailableSOAP|CheckSysupdateAvailableSOAP]]
|-
| 0x00060080
| The input at cmdreq[1-2] is an u64 titleID. This writes an u8 to cmdreply[2]. It's unknown what exactly the [[eShop]] application uses this for, it only uses this command for apps which are installed(checked via [[Application_Manager_Services|AM]] probably). In those cases, it seems the outval for this command(with result-code=0) is normally 0?
|}

= NIM server service "nim:aoc" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00030042
| SetApplicationId
|-
| 0x00040042
| SetTin
|-
| 0x000902D0
| ListContentSetsEx
|-
| 0x00180000
| GetBalance
|-
| 0x001D0000
| GetCustomerSupportCode
|-
| 0x00210000
| Initialize
|-
| 0x00240282
| CalculateContentsRequiredSize
|-
| 0x00250000
| RefreshServerTime
|}

= NIM service "nim:ndm" =

ClCertA

2015-08-31T07:31:08Z

IReir: Point out TID

This [[NCCH#CFA|CFA]] (title id: [[Title_list#0004001B_-_System_Data_Archives|0004001b00010002]]) contains the following [[PSPXI:EncryptDecryptAes|encrypted]] files in the RomFS:
* "ctr-common-1-cert.bin", this is the default SSL client cert used by the SSL module in DER format.
* "ctr-common-1-key.bin", this is the default SSL client private key used by the SSL module in DER format.

For retail this is the "CTR Common Prod 1" cert.

Each file is encrypted in CBC mode. The first 16 bytes of each file are the IV for decrypting the rest of the file.

The following servers require usage of ClCertA to connect:

* https://ninja.ctr.shop.nintendo.net/ (eShop-related)
* https://nus.c.shop.nintendowifi.net/ (used by the [[NIM_Services|nim system module]] to check for updates)

ClCertA

2015-08-31T07:28:25Z

IReir: Document certificate file format

This [[NCCH#CFA|CFA]] contains the following [[PSPXI:EncryptDecryptAes|encrypted]] files in the RomFS:
* "ctr-common-1-cert.bin", this is the default SSL client cert used by the SSL module in DER format.
* "ctr-common-1-key.bin", this is the default SSL client private key used by the SSL module in DER format.

For retail this is the "CTR Common Prod 1" cert.

Each file is encrypted in CBC mode. The first 16 bytes of each file are the IV for decrypting the rest of the file.

The following servers require usage of ClCertA to connect:

* https://ninja.ctr.shop.nintendo.net/ (eShop-related)
* https://nus.c.shop.nintendowifi.net/ (used by the [[NIM_Services|nim system module]] to check for updates)

ClCertA

2015-08-31T07:27:07Z

IReir: Start listing servers that require ClCertA

This [[NCCH#CFA|CFA]] contains the following [[PSPXI:EncryptDecryptAes|encrypted]] files in the RomFS:
* "ctr-common-1-cert.bin", this is the default SSL client cert used by the SSL module.
* "ctr-common-1-key.bin", this is the default SSL client private key used by the SSL module.

For retail this is the "CTR Common Prod 1" cert.

Each file is encrypted in CBC mode. The first 16 bytes of each file are the IV for decrypting the rest of the file.

The following servers require usage of ClCertA to connect:

* https://ninja.ctr.shop.nintendo.net/ (eShop-related)
* https://nus.c.shop.nintendowifi.net/ (used by the [[NIM_Services|nim system module]] to check for updates)

ClCertA

2015-08-31T07:20:45Z

IReir: Explain how ClCertA is encrypted to aid decryption.