3dbrew - User contributions [en]

Serials

2025-06-01T04:41:52Z

MassExplosion213: /* NCCH Product Code */

This page talks about the 3DS products' serial number and model number structures (the console, manual, accessories, games, etc...).

== Console Serial Numbers ==

A 3DS console serial number is composed of at least two letters followed by nine decimal digits. The ninth digit is a "check digit", meaning that it is derived from the other digits.

The check digit is an industry-standard algorithm, the one used for UPC codes. To calculate the check digit of a 3DS console, separate the non-check digits into "odd" and "even" groups, where the "odd" group is digits in odd-numbered positions, and the "even" group is digits in even-numbered positions. (The first digit is "odd", with "first" representing "1".)

After separating the digits, add the digits in each group together. Multiply the sum of the even digits by 3, then add the sum of the odd digits. To calculate the check digit, take this value modulo 10, and if not 0, subtract from 10.

Example: CW404567772

The non-check digits are 40456777. Separating into odd and even groups, we get the following:

Odds: 4 + 4 + 6 + 7 = 21
Evens: 0 + 5 + 7 + 7 = 19

Applying the algorithm, we get ((3 * 19) + 21) % 10 = 8, which is not 0, thus 10 - 8 = 2, matching the example's check digit.

The letter prefixes are a letter specifying the device, followed by one letter specifying the region in which it was sold. In some regions, a third letter is present; a current guess is that this letter distinguishes among factories for a given sales region. Note that several different sales regions' console may be considered to be the same region for region-locking purposes, such as Europe and Australia.

The current serial number scheme began with the DSi, hence its listing in the tables below. Among standalone consoles, the Wii U belongs to this scheme as well; the Switch started a new scheme.

{| class="wikitable"
! Model !! Device Prefix (Retail) !! Device Prefix (Dev/Test)
|-
| ''Wii'' || L || R
|-
| ''DSi'' || T || V
|-
| ''DSi XL/LL'' || W || D
|-
| ''Nintendo Zone Box'' || Z || ''N/A''
|-
| ''Wii U'' || F/G || ''unknown''
|-
| ''Wii U gamepad'' || J || J
|-
| ''3DS'' || C || E
|-
| ''3DS XL/LL'' || S || R
|-
| ''2DS'' || A || P
|-
| ''New 3DS'' || Y || Y
|-
| ''New 3DS XL/LL'' || Q || Q
|-
| ''New 2DS XL/LL'' || N || N
|}

Some United Kingdom models' serial numbers will include "UH" after the device model prefix.

Test ("Panda") units with the same prefix as retail can be distinguished by test units having 00 or 01 as the first two digits of the serial number portion. 00 was used with the New 3DS and New 3DS XL for test units; 01 was used with the New 2DS XL test unit. Preview versions of the N2DS XL given out to the press had 01; these appear to have been test units with the development titles deleted.

Old 3DS development systems (Partner-CTR, IS-CTR-BOX, IS-SPR-BOX) use the "E" and "R" prefixes like test systems, but have 90 (Partner-CTR) or 91 (IS-CTR-BOX, IS-SPR-BOX) as their first two digits. Similarly, the main New 3DS development unit, IS-SNAKE-BOX, uses the Y prefix (same as retail) with 91. It is currently unknown what is the serial number format of the rare New 3DS XL development system (IS-CLOSER-BOX).

{| class="wikitable"
! Sales Region !! Region Lock !! Region Suffix
|-
| Japan || Japan || JE, JF, JH, JM
|-
| North America || North America || W
|-
| Brazil || North America || B
|-
| Middle East / Southeast Asia || North America || S
|-
| Europe || Europe || EE, EF, EH, EM
|-
| Australia || Europe || AF, AH, AG, AM
|-
| South Korea || Korea || KF, KH, KM
|-
| China (iQue) || China || CF, CH, CM
|}

== Console Models ==

{| class="wikitable"
! Device !! Product Code
|-
| ''DS'' || NTR
|-
| ''DS lite'' || USG
|-
| ''DSi'' || TWL
|-
| ''DSi XL/LL'' || UTL
|-
| ''Wii U'' || WUP
|-
| 3DS || CTR
|-
| 3DS XL/LL || SPR
|-
| 2DS || FTR
|-
| [[New 3DS]] || KTR
|-
| [[New 3DS]] XL/LL || RED
|-
| New 2DS XL/LL || JAN
|}

The DS had the product code NTR (short for Nitro), so we see the TR is recurring.

== Title ID and Unique ID ==
''see [[Titles]]''

== NCCH Product Code ==

This serial is similiar to the "physical serial" described later in this page; it is the canonical identifier for a specific title in the field of business formalities with Nintendo, but this is not reflected in the 3DS's software architecture (where it is vastly unused in favor of the Title ID: it is therefore considered the successor of the "internal name" contained in ROMs of previous handhelds), is not guaranteed to be unique.

The product code is located in a [[NCCH]]'s header (not its ExHeader).

The product code "CTR-P-CTAP" is the default generic product code for NCCH files. Most [[NCSD|NCCHs apart from the first one]] in a title are generally CTR-P-CTAP.
Referring to "the product code of a title" is therefore a simplification for "the product code of the NCCH in its first partition".

So, for example, a Japanese copy of Ridge Racer 3D would have a product code of "CTR-P-ARRJ" and a serial of "LNA-CTR-ARRJ-JPN".

A Nintendo-assigned product code follows this format, however, there is no requirement for a product code to match or resemble this structure as long as it's within the length limit:

[CTR/KTR]-[Category letter]-[Type][Identifier][Region]-[Sub ID]

{| class="wikitable"
! Category letter !! Description
|-
| P || Cartridge software, or downloadable versions of them.
|-
| B || Cartridge demos
|-
| N || Digital-only releases, including [[Title list|system applications and applets]].
|-
| M || [[DLC]]
|-
| T || [[eShop Demos]], excluding so-called "special demos" which are category N.
|-
| U || [[Title list#0004000E - Add-on Content (Updates)|Patches]] for category P titles.
|}

The "sub ID" only applies to DLC, demos, and local copies of Download Play titles. It's a 2-digit number associated with the [[Title list|Title ID Variation]].

See the next chapter for explanation of the other components of the Product Code.

== Physical Serial ==
[Product][Retail/Demo]-[Platform]-[Type][Game ID][Region]-[Label Region]

{| class="wikitable"
! Field !! Length !! Description !! colspan=2 | Values
|-
|-align=center
| rowspan="6" | Product
| rowspan="6" | 2
| rowspan="6" | Product type
|-
| LN || Cartridge
|-
| MA || Instruction manual
|-
| TS || Game box
|-
| FA || Leaflet
|-
| MK || Quick-start Guide
|-align=center
| rowspan="3" | Retail/Demo
| rowspan="3" | 1
| rowspan="3" |
|-
| A || Retail
|-
| Z || Demo
|-align=center
| rowspan="3" | CTR/KTR
| rowspan="3" | 3
| rowspan="3" | Platform
|-
| CTR || 3DS
|-
| KTR || New 3DS
|-align=center
| rowspan="11" | Type
| rowspan="11" | 1
| rowspan="11" |
|-
| A || retail
|-
| B || retail
|-
| C || used for N3DS exclusive retail and default 'CTAP'
|-
| E || used for card 2 type retail cartridges
|-
| H || used for built in applications like [[Mii Maker]]
|-
| J || normal eShop Title
|-
| K || normal eShop Title?
|-
| S || 3D Classics
|-
| P || used with GBA eShop titles
|-
| T || used with NES eShop titles
|-align=center
| Identifier
| 2
| colspan=3 |Game ID (two alphanumeric characters)
|-align=center
| rowspan="10" | Region
| rowspan="10" | 1
| rowspan="10" |
|-
| E || English (US)
|-
| P || PAL (Europe/Australia)
|-
| J || Japanese (Japan)
|-
| K || Korean (Korea)
|-
| C || Chinese (China/Taiwan)
|-
| Y || Multiple regions
|-
| W || Tai'''w'''an(?) (Taiwan/Hong Kong)
|-
| Z || Multiple regions
|-
| A || All (region-free)
|-
|-align=center
| rowspan="12" | Label Region
| rowspan="12" | 3
| rowspan="12" |
|-
| USA || United States
|-
| EUR || Europe
|-
| CAN || Canada (US version with additional French text added to box)
|-
| AUS || Australia
|-
| JPN || Japan
|-
| KOR || Korea
|-
| TWN || Taiwan/Hong Kong
|-
| CHT || Taiwan/Hong Kong ("Chinese-Traditional")
|-
| CHN || China
|-
| UKV || United Kingdom ("United Kingdom version")
|-
| MDE || Saudi Arabia/U.A.E./Malaysia/Singapore ("Middle East")
|}

=== Electronic Manuals ===

Some eShop titles have [[NCCH#CFA|Electronic Manuals]] which store the product code at the end of the 'Health & Safety' section of the manual. However, product codes can differ from the above format as shown below:

CTR-[P/N/T/U]-[Type][Game ID][Region]-[Region]-[Digit]

CTR-[Type][Game ID][Region]-[Region]-[Digit]

* P/N/T/U - Same as in product code structure
* [Type][Game ID][Region] - Same as in serial structure
* [Region] - A three character representation of the title region, i.e. 'EUR' (not always present)
* [Digit] - A single digit usually '1' or '0' (not always present). Possibly revision or manual revision.

'''Note:''' These alternate versions of the product code, potentially found in [[NCCH#CFA|Electronic Manuals]] don't represent the actual product code, as found in the game's CXI. They are only found in the game's Home Menu manual, and on the game's packaging and external labeling.

==Back of Card Serial==
AREPY10111 (example)

AAAABCDEEE 
'''A''' - Identifier (last 4 digits of product code) 
'''B''' - Production Month (numbers, then after Sep its X,Y,Z for Oct,Nov,Dec) 
'''C''' - Production Year (2010 + C)* 
'''D''' - Revision/Remaster Version (should match the main NCCH's Exheader Remaster Version) 
'''E''' - Production Run? (000-999)**

<nowiki>* </nowiki>Or (2020 + C), if produced in that decade. Example [https://www.youtube.com/watch?v=DcH8mK6yXj4 here] at the 2:10 mark. 
<nowiki>** </nowiki>European demo/kiosk carts have "08B" or "08H"

Nandrw/sys/LocalFriendCodeSeed B

2017-06-05T07:58:52Z

MassExplosion213: /* Format */ Verified with another devkit.

{{DISPLAYTITLE:Nandrw/sys/LocalFriendCodeSeed_B}}
=Format=
{| class="wikitable" border="1"
! Offset
! Size
! Description
|-
| 0x0
| 0x100
| RSA-2048 signature over the following 0x10-bytes.
|-
| 0x100
| 0x8
| Normally zero? The second byte (offset 0x101) appears to be 0x01 if system is a devkit.
|-
| 0x108
| 0x8
| LocalFriendCodeSeed. Since the data of the whole file gets copied to [[Nand/private/movable.sed|movable.sed]], this also becomes the first 8 bytes of the keyY there.
|}

This contains the same LocalFriendCodeSeed data that [[PSPXI:GetLocalFriendCodeSeed]] retrieves from memory.

=See Also=
* [[Config Services]]

Title list

2017-02-24T03:23:39Z

MassExplosion213: These don't actually exist.

NOTE: This Title list is a condensed version, only the System Titles lists are full lists. For a full list of titles on Nintendo's CDN, see [http://mtheall.com/~mtheall/tmdlist.php here]. The reports/title-lists from [https://yls8.mtheall.com/ninupdates/reports.php here] are automatically obtained from the system update SOAP.

== CTR System Titles ==
{| class="wikitable" border="1"
|-
! System Category
! Bit Mask(s)
! Category Bit Mask
|-
| Application (SYSTEM_APPLICATION)
| Normal<nowiki>|</nowiki>System
| 0x0010
|-
| System Data Archives (SYSTEM_CONTENT)
| Contents<nowiki>|</nowiki>CannotExecution<nowiki>|</nowiki>System
| 0x001B
|-
| Shared Data Archives (SHARED_CONTENT)
| Contents<nowiki>|</nowiki>CannotExecution<nowiki>|</nowiki>System<nowiki>|</nowiki>NotRequireRightForMount
| 0x009B
|-
| System Data Archives (AUTO_UPDATE_CONTENT)
| Contents<nowiki>|</nowiki>CannotExecution<nowiki>|</nowiki>System<nowiki>|</nowiki>NotRequireUserApproval<nowiki>|</nowiki>NotRequireRightForMount
| 0x00DB
|-
| Applet (APPLET)
| Normal<nowiki>|</nowiki>System<nowiki>|</nowiki>RequireBatchUpdate
| 0x0030
|-
| Module (BASE)
| Normal<nowiki>|</nowiki>System<nowiki>|</nowiki>RequireBatchUpdate<nowiki>|</nowiki>CanSkipConvertJumpId
| 0x0130
|-
| Firmware (FIRMWARE)
| Normal<nowiki>|</nowiki>CannotExecution<nowiki>|</nowiki>System<nowiki>|</nowiki>RequireBatchUpdate<nowiki>|</nowiki>CanSkipConvertJumpId
| 0x0138
|}

=== 00040010 - System Applications ===
The versions for CHN, KOR, and TWN are separate from the other regions.

{| class="wikitable" border="1"
|-
! JPN TIDLow
! USA TIDLow
! EUR TIDLow
! CHN TIDLow
! KOR TIDLow
! TWN TIDLow
! [[Product code]]
! Description
! JPN Versions
! EUR Versions
! USA Versions
! CHN Versions
! KOR Versions
! TWN Versions
! Status
|-
| 00020000
| 00021000
| 00022000
| 00026000
| 00027000
| 00028000
| CTR-N-HAS?
| [[System Settings]] (mset)
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[3.0.0-5|v2060]], [[4.0.0-7|v3074]], [[5.0.0-11|v4097]], [[6.0.0-11|v5127]], [[7.0.0-13|v6157]], [[7.2.0-17|v7173]], [[8.1.0-0_New3DS|v8198]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v9224]], [[9.6.0-24|v10245]], [[10.6.0-31|v10256]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[3.0.0-5|v2061]], [[4.0.0-7|v3075]], [[5.0.0-11|v4097]], [[6.0.0-11|v5127]], [[7.0.0-13|v6157]], [[7.2.0-17|v7174]], [[9.0.0-20|v8202]], [[9.6.0-24|v9220]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[3.0.0-5|v2062]], [[4.0.0-7|v3078]], [[5.0.0-11|v4098]], [[6.0.0-11|v5128]], [[7.0.0-13|v6157]], [[7.2.0-17|v7174]], [[9.0.0-20|v8203]], [[9.6.0-24|v9221]]
| [[4.0.0-7|v8]], [[4.4.0-10|v1024]](CHN-only sysupdate for just mset), [[5.0.0-11|v2049]], [[7.0.0-13|v3075]]
| [[4.0.0-7|v1026]], [[5.0.0-11|v2049]], [[7.0.0-13|v4098]]
| [[4.1.0-8|v8]], [[4.2.0-9|v1024]], [[5.0.0-11|v2050]], [[7.0.0-13|v3074]]
| Active
|-
| 00020100
| 00021100
| 00022100
| 00026100
| 00027100
| 00028100
| CTR-N-HDL?
| [[Download Play]] (dlplay)
| [[1.0.0-0|v0]], [[2.1.0-4|v1026]], [[4.0.0-7|v2051]], [[9.0.0-20|v3072]](Also for [[8.1.0-0_New3DS]])
| [[1.0.0-0|v0]], [[2.1.0-4|v1026]], [[4.0.0-7|v2051]], [[9.0.0-20|v3073]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1026]], [[4.0.0-7|v2051]], [[9.0.0-20|v3073]]
| [[4.0.0-7|v4]]
| [[4.0.0-7|v1027]]
| [[4.1.0-8|v4]]
| Active
|-
| 00020200
| 00021200
| 00022200
| 00026200
| 00027200
| 00028200
| CTR-N-HMK?
| [[Activity Log]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[3.0.0-5|v2051]], [[10.6.0-31|v2080]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[3.0.0-5|v2054]], [[7.0.0-13|v2064]]
| Same as EUR
| [[4.0.0-7|v3]]
| [[4.0.0-7|v2]], [[7.0.0-13|v16]]
| [[4.1.0-8|v2]]
| Active
|-
| 00020300
| 00021300
| 00022300
| 00026300
| 00027300
| 00028300
| ?
| [[Health and Safety Information]] (safe)
| [[1.0.0-0|v0]], [[4.0.0-7|v1024]], [[6.0.0-11|v2050]]
| [[1.0.0-0|v0]], [[3.0.0-5|v1024]], [[4.0.0-7|v2050]], [[6.0.0-11|v3077]]
| [[1.0.0-0|v0]], [[4.0.0-7|v1026]], [[6.1.0-12U|v2051]]
| [[4.0.0-7|v5]]
| [[4.0.0-7|v2]]
| [[4.1.0-8|v5]]
| Active
|-
| 20020300
| 20021300
| 20022300
| N/A
| 20027300
| N/A
| CTR-N-HAC?
| [[New_3DS]] [[Health and Safety Information]]
| [[8.1.0-0_New3DS|v2]], [[9.3.0-21|v17]]
| [[8.1.0-0_New3DS|v1]]
| Same as EUR.
| N/A
| [[9.6.0-24|v2]]
| N/A
| Active
|-
| 00020400
| 00021400
| 00022400
| 00026400
| 00027400
| 00028400
| CTR-N-HEP?
| [[Nintendo 3DS Camera]] (CtrApp)
| [[1.0.0-0|v0]], [[2.1.0-4|v16]], [[3.0.0-5|v1038]], [[4.0.0-7|v2048]], [[6.0.0-11|v3073]], [[9.0.0-20|v4097]](Also for [[8.1.0-0_New3DS]]), [[10.6.0-31|v4112]]
| [[1.0.0-0|v0]], [[2.1.0-4|v16]], [[3.0.0-5|v1039]], [[4.0.0-7|v2048]], [[6.0.0-11|v3073]], [[7.0.0-13|v3088]], [[9.0.0-20|v4097]]
| [[1.0.0-0|v0]], [[2.1.0-4|v16]], [[3.0.0-5|v1039]], [[4.0.0-7|v2048]], [[6.1.0-12U|v3074]], [[7.0.0-13|v3088]], [[9.0.0-20|v4097]]
| [[4.0.0-7|v3]]
| [[4.0.0-7|v2]], [[7.0.0-13|v1040]]
| [[4.1.0-8|v3]]
| Active
|-
| 00020500
| 00021500
| 00022500
| 00026500
| 00027500
| 00028500
| CTR-N-HES?
| [[Nintendo 3DS Sound]] (CtrApp)
| [[1.0.0-0|v0]], [[2.1.0-4|v1027]], [[3.0.0-5|v2049]], [[4.0.0-7|v3072]], [[7.0.0-13|v3089]], [[10.6.0-31|3104]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1027]], [[3.0.0-5|v2049]], [[4.0.0-7|v3072]], [[7.0.0-13|v3088]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1027]], [[3.0.0-5|v2049]], [[4.0.0-7|v3072]], [[7.0.0-13|v3088]]
| [[4.0.0-7|v2]]
| [[4.0.0-7|v2]], [[7.0.0-13|v16]]
| [[4.1.0-8|v3]]
| Active
|-
| 00020700
| 00021700
| 00022700
| 00026700
| 00027700
| 00028700
| CTR-N-HED?
| [[Mii Maker]] (EDIT)
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[7.0.0-13|v2055]], [[10.6.0-31|v2064]]
| Same as JPN
| Same as JPN
| [[4.0.0-7|v1]]
| [[4.0.0-7|v1]], [[7.0.0-13|v16]]
| [[4.1.0-8|v2]]
| Active
|-
| 00020800
| 00021800
| 00022800
| 00026800
| 00027800
| 00028800
| CTR-N-HME?
| [[StreetPass Mii Plaza]] (MEET)
| [[1.0.0-0|v0]], v1027, [[2.1.0-4|v2048]], [[3.0.0-5|v3087]], [[3.0.0-6|v4096]], [[6.0.0-11|v5121]]
| [[1.0.0-0|v0]], v1027, [[2.1.0-4|v2048]], [[3.0.0-5|v3087]], [[3.0.0-6|v4096]], [[6.0.0-11|v5122]]
| [[1.0.0-0|v0]], v1027, [[2.1.0-4|v2048]], [[3.0.0-5|v3087]], [[3.0.0-6|v4096]], [[6.1.0-12U|v5124]], [[7.0.0-13|v5136]]
| [[4.0.0-7|v0]], [[4.4.0-10|v4096]]
| [[4.0.0-7|v1]], [[4.4.0-10|v4096]], [[7.0.0-13|v5120]]
| [[4.1.0-8|v1]], [[4.4.0-10|v4096]]
| Active
|-
| 00020900
| 00021900
| 00022900
| N/A
| 00027900
| 00028900
| CTR-N-HGR?
| [[eShop]] (tiger)
| [[2.0.0-2|v4]], [[2.1.0-3|v1026]], [[3.0.0-5|v2057]], [[4.0.0-7|v3081]], [[4.1.0-8|v4096]], [[4.2.0-9|v5123]], [[4.3.0-10|v6146]], [[5.0.0-11|v7169]], [[7.0.0-13|v8206]], [[7.1.0-14|v9231]], [[7.2.0-17|v10245]], [[8.0.0-18|v11265]], [[8.1.0-19|v12288]], [[9.0.0-20|v13320]], [[9.3.0-21|v15366]], [[9.5.0-22|v16384]], [[9.6.0-24|v17421]], [[9.7.0-25|v18432]], [[10.0.0-27|v19465]], [[10.4.0-29|v20483]], [[10.7.0-32|v21504]], [[11.3.0-36|v23552]]
| [[2.0.0-2|v4]], [[2.1.0-3|v1026]], [[3.0.0-5|v2058]], [[4.0.0-7|v3081]], [[4.1.0-8|v4096]], [[4.2.0-9|v5123]], [[4.3.0-10|v6146]], [[5.0.0-11|v7171]], [[7.0.0-13|v8206]], [[7.1.0-14|v9231]], [[7.2.0-17|v10245]], [[8.0.0-18|v11265]], [[8.1.0-19|v12288]], [[9.0.0-20|v13320]], [[9.3.0-21|v15366]], [[9.5.0-22|v16384]], [[9.6.0-24|v17421]], [[9.7.0-25|v18432]], [[10.0.0-27|v19465]], [[10.4.0-29|v20482]], [[10.7.0-32|v21505]], [[11.2.0-35|v22528]], [[11.3.0-36|v23552]]
| [[2.0.0-2|v4]], [[2.1.0-3|v1026]], [[3.0.0-5|v2058]], [[4.0.0-7|v3081]], [[4.1.0-8|v4096]], [[4.2.0-9|v5123]], [[4.3.0-10|v6146]], [[5.0.0-11|v7170]], [[7.0.0-13|v8206]], [[7.1.0-14|v9231]], [[7.2.0-17|v10246]], [[8.0.0-18|v11265]], [[8.1.0-19|v12288]], [[9.0.0-20|v13321]], [[9.3.0-21|v15366]], [[9.5.0-22|v16384]], [[9.6.0-24|v17422]], [[9.7.0-25|v18432]], [[10.0.0-27|v19465]], [[10.4.0-29|v20482]], [[10.7.0-32|v21506]], [[11.3.0-36|v23552]]
| N/A
| [[4.0.0-7|v3082]], [[4.1.0-8|v4096]], [[4.2.0-9|v5123]], [[4.3.0-10|v6146]], [[5.0.0-11|v7169]], [[7.0.0-13|v8205]], [[7.1.0-14|v9231]], [[8.1.0-19|v12288]], [[9.0.0-20|v13320]], [[9.3.0-21|v15366]], [[9.5.0-22|v16384]], [[9.6.0-24|v17420]], [[9.7.0-25|v18432]], [[10.0.0-27|v19465]], [[10.4.0-29|v20482]]
| [[4.1.0-8|v4096]], [[4.2.0-9|v5123]], [[4.3.0-10|v6146]], [[5.0.0-11|v7170]], [[7.0.0-13|v8205]], [[7.1.0-14|v9231]], [[8.1.0-19|v12288]], [[9.3.0-21|v15366]], [[9.5.0-22|v16384]], [[9.6.0-24|v17421]], [[9.7.0-25|v18432]], [[10.0.0-27|v19465]]
| Active
|-
| 00020A00
| 00021A00
| 00022A00
| N/A
| 00027A00
| 00028A00
| CTR-N-HCB?
| [[System Transfer]] (CARDBOARD)
| [[2.0.0-2|v4]], [[3.0.0-5|v1035]], [[4.0.0-7|v2050]], [[5.0.0-11|v3074]], [[7.0.0-13|v4109]], [[9.0.0-20|v5130]], [[9.6.0-24|v6154]]
| [[2.0.0-2|v4]], [[3.0.0-5|v1035]], [[4.0.0-7|v2050]], [[5.0.0-11|v3073]], [[7.0.0-13|v4109]], [[9.0.0-20|v5131]], [[9.6.0-24|v6155]]
| [[2.0.0-2|v4]], [[3.0.0-5|v1035]], [[4.0.0-7|v2051]], [[5.0.0-11|v3073]], [[7.0.0-13|v4109]], [[9.0.0-20|v5131]], [[9.6.0-24|v6156]]
| N/A
| [[4.0.0-7|v2]], [[5.0.0-11|v1025]], [[7.0.0-13|v2061]], [[9.0.0-20|v3082]]
| [[4.1.0-8|v2]], [[5.0.0-11|v1025]], [[7.0.0-13|v2061]]
| Active
|-
| 00020B00
| 00021B00
| 00022B00
| N/A
| N/A
| N/A
| CTR-N-HMA?
| [[Nintendo Zone]] ("Nintendo")
| [[1.0.0-0|v0]], [[3.0.0-5|v1034]]
| Same as JPN
| Same as JPN
| N/A
| N/A
| N/A
| Active
|-
| 00020D00
| 00021D00
| 00022D00
| 00026D00
| 00027D00
| 00028D00
| CTR-N-HCH?
| [[Face Raiders]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1028]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1028]], [[7.0.0-13|v1040]]
| Same as EUR
| [[4.0.0-7|v0]]
| [[4.0.0-7|v0]]
| [[4.1.0-8|v2]]
| Active
|-
| 20020D00
| 20021D00
| 20022D00
| N/A
| 20027D00
| N/A
| ?
| [[New_3DS]] [[Face Raiders]]
| [[8.1.0-0_New3DS|v2050]]
| [[8.1.0-0_New3DS|v2049]]
| Same as EUR.
| N/A
| [[9.6.0-24|v2049]]
| N/A
| Active
|-
| 00020E00
| 00021E00
| 00022E00
| 00026E00
| 00027E00
| 00028E00
| CTR-N-HAR?
| [[AR Games]] (AR_ACT)
| [[1.0.0-0|v0]], [[2.1.0-4|v1026]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1026]], [[7.0.0-13|v1040]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1027]], [[7.0.0-13|v1040]]
| [[4.0.0-7|v0]]
| [[4.0.0-7|v0]], [[7.0.0-13|v16]]
| [[4.1.0-8|v1]]
| Active
|-
| 00020F00
| 00021F00
| 00022F00
| 00026F00
| 00027F00
| 00028F00
| CTR-N-HSH?
| SAFE_MODE [[System Settings#System Updater|System Updater]] (mset)
| [[1.0.0-0|v0]], [[3.0.0-5|v1024]], [[6.0.0-11|v2049]]
| [[1.0.0-0|v0]], [[3.0.0-5|v1024]], [[6.0.0-11|v2050]]
| Same as JPN
| [[4.0.0-7|v1]], [[6.0.0-11|v1026]]
| [[4.0.0-7|v1]]
| [[4.1.0-8|v1]]
| Active
|-
| 00023000
| 00024000
| 00025000
| N/A
| N/A
| N/A
| (Variable?)
| Promotional video
| [[1.1.0-1|v2]], [[2.0.0-2|v2048]]
| [[1.1.0-1|v<unknown>]], [[2.0.0-2|v2048]]
| [[1.1.0-1|v0]], [[2.0.0-2|v2048]]
| N/A
| N/A
| N/A
| Stubbed
|-
| 0002BF00
| 0002C000
| 0002C100
| N/A
| N/A
| N/A
| CTR-N-HAF?
| Nintendo Network ID Settings (act)
| [[7.0.0-13|v14]], [[7.2.0-17|v1029]], [[9.0.0-20|v2051]], [[9.3.0-21|v3072]]
| Same as JPN
| Same as JPN
| N/A
| N/A
| N/A
| Active
|-
| 20023100
| 20024100
| 20025100
| N/A
| N/A
| N/A
| CTR-N-HAJ?
| [[microSD Management]] ('mcopy') ([[New_3DS]]-only)
| [[8.1.0-0_New3DS|v8]], [[9.0.0-20|v1024]]
| [[8.1.0-0_New3DS|v4]]
| [[8.1.0-0_New3DS|v5]]
| N/A
| N/A
| N/A
| Available
|-
| 2002C800
| 2002CF00
| 2002D000
| N/A
| 2002D700
| N/A
| CTR-P-CTAP
| [[New_3DS]]-only, currently stubbed. "HOME menu/menu".
| [[8.1.0-0_New3DS|v2]], [[9.0.0-20|v18]], [[9.3.0-21|v34]], [[9.6.0-24|v50]]
| [[8.1.0-0_New3DS|v1]], [[9.3.0-21|v17]], [[9.6.0-24|v34]]
| [[8.1.0-0_New3DS|v1]], [[9.3.0-21|v18]], [[9.6.0-24|v33]]
| N/A
| [[9.6.0-24|v2]]
| N/A
| Stubbed
|-
| 2002C900
| 2002D100
| 2002D200
| N/A
| 2002D800
| N/A
| CTR-P-CTAP
| [[New_3DS]]-only, currently stubbed. "Friends list/friend".
| [[8.1.0-0_New3DS|v1]]
| Same as JPN.
| [[8.1.0-0_New3DS|v0]], [[9.3.0-21|v16]]
| N/A
| [[9.6.0-24|v2]]
| N/A
| Stubbed
|-
| 2002CA00
| 2002D300
| 2002D400
| N/A
| 2002D900
| N/A
| CTR-P-CTAP
| [[New_3DS]]-only, currently stubbed. "Notifications/newslist".
| [[8.1.0-0_New3DS|v0]], v1([[Home_Menu|JPN-only]] Oct 2, 2014 "sysupdate", actually uploaded on 09-29-14. Identical to v0, same TMDs besides title-versions)
| [[8.1.0-0_New3DS|v2]]
| [[8.1.0-0_New3DS|v0]]
| N/A
| [[9.6.0-24|v2]]
| N/A
| Stubbed
|-
| 2002CB00
| 2002D500
| 2002D600
| N/A
| 2002DA00
| N/A
| CTR-P-CTAP
| [[New_3DS]]-only, currently stubbed. "Game notes/cherry".
| [[8.1.0-0_New3DS|v0]], [[9.0.0-20|v1]]
| [[8.1.0-0_New3DS|v2]]
| Same as EUR.
| N/A
| [[9.6.0-24|v1]]
| N/A
| Stubbed
|}

The "act" application seems to use a web browser with webkit?

Regardless of version, the ExeFS:/.code for mset is the same for USA/EUR/JPN. The [[4.0.0-7]] version of mset([[4.1.0-8]] for TWN) has the same ExeFS:/.code for all regions(JPN, USA, EUR, CHN, KOR, TWN). The [[5.0.0-11]] mset ExeFS:/.code is the same for all regions as well, except for CHN. The [[7.0.0-13]] mset ExeFS:/.code is unique for the following regions: CHN, KOR, and TWN.

The ''only'' system-applications included with gamecard-sysupdates are: [[System Settings]], [[Download Play]], and SAFE_MODE [[System Settings#System Updater|System Updater]]. The only system-applications included with the New3DS gamecard-sysupdate partition are: "menu" stub and "friend" stub.

=== 0004001B - [[NCCH#CFA|System Data Archives]] ===
{| class="wikitable" border="1"
|-
! TitleID Low
! Description
! Versions
|-
| 00010002
| [[ClCertA]]
| [[1.0.0-0|v0]]
|-
| 00010702
| [[NS CFA]]
| [[3.0.0-5|v0]], [[6.0.0-11|v1028]], [[6.3.0-12|v2048]], [[7.0.0-13|v3073]], [[9.0.0-20|v4096]](also for [[8.1.0-0_New3DS]])
|-
| 00010802
| This CFA only contains a 1-byte "dummy.txt" in the RomFS, which contains '0'.
| [[6.3.0-12|v0]], [[9.5.0-23|v1024]], [[10.5.0-30|v2048]], [[11.0.0-33|v3072]]
|-
| 00018002
| Same contents as 00010802. Starting with [[7.1.0-15]], the "dummy.txt" file was removed from RomFS: this CFA RomFS now contains web-browser data(similar to 00018102) for NNID / networking, etc.
| [[7.0.0-13|v14]], [[7.1.0-15|v1025]], [[7.2.0-17|v2055]], [[9.0.0-20|v3078]], [[9.3.0-21|v4096]], [[9.6.0-24|v5120]]
|-
| 00018102
| This contains local web-browser data(html/js, gfx, etc) for the Miiverse Offline-mode.
| [[7.0.0-13|v11]], [[9.0.0-20|v1025]](also for [[8.1.0-0_New3DS]])
|-
| 00018202
| This contains the webkit/OSS [[CRO0|CROs]] used with the Miiverse applet and the "act" application.
| [[7.0.0-13|v7]], [[8.1.0-0_New3DS|v1026]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v2050]]
|-
| 00019002
| [[Fangate_updater]]
| [[9.3.0-21|v2]], [[9.6.0-24|v1026]]
|}

=== 00040030 - Applets===
{| class="wikitable" border="1"
|-
! JPN TitleIDLow
! USA TitleIDLow
! EUR TitleIDLow
! CHN TitleIDLow
! KOR TitleIDLow
! TWN TitleIDLow
! [[Product code]]
! Description
! JPN Versions
! USA Versions
! EUR Versions
|-
|colspan=6 align=center| 00008102
| CTR-P-CTAP
| [[NS#Alternate menu|Test Menu]] (Demo1)
|colspan=3 align=center| ..., v64, ..., v27648
|-
| 00008202
| 00008F02
| 00009802
| 0000A102
| 0000A902
| 0000B102
| CTR-P-HMM?
| [[Home Menu]] (menu)
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[2.1.0-3|v2049]], [[2.2.0-X|v3075]], [[3.0.0-5|v4111]], [[4.0.0-7|v5131]], [[4.2.0-9|v6146]], [[5.0.0-11|v7172]], [[6.0.0-11|v8198]], [[7.0.0-13|v9230]], [[8.1.0-0_New3DS|v10250]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v13313]], [[9.1.0-20J|v14336]], [[9.2.0-20|v15360]], [[9.3.0-21|v16402]], [[9.4.0-21|v17408]], [[9.5.0-22|v18432]], [[9.6.0-24|v19476]], [[9.7.0-25|v20487]], [[9.8.0-25|v22528]], [[10.1.0-27|v23552]], [[10.2.0-28|v24576]], [[10.3.0-28|v25600]], [[10.4.0-29|v26626]], [[10.6.0-31|v27648]], [[11.1.0-34|v28672]], [[11.3.0-36|v29696]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[2.1.0-3|v2049]], [[2.2.0-X|v3075]], [[3.0.0-5|v4111]], [[4.0.0-7|v5131]], [[4.2.0-9|v6146]], [[5.0.0-11|v7172]], [[6.0.0-11|v8198]], [[7.0.0-13|v9230]], [[9.0.0-20|v11272]], [[9.2.0-20|v12288]], [[9.3.0-21|v13330]], [[9.4.0-21|v14336]], [[9.5.0-22|v15360]], [[9.6.0-24|v16404]], [[9.7.0-25|v17415]], [[9.8.0-25|v19456]], [[9.9.0-26|v20480]], [[10.1.0-27|v21504]], [[10.2.0-28|v22528]], [[10.3.0-28|v23552]], [[10.4.0-29|v24578]], [[10.6.0-31|v25600]], [[11.1.0-34|v26624]], [[11.3.0-36|v27648]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[2.1.0-3|v2049]], [[2.2.0-X|v3075]], [[3.0.0-5|v4111]], [[4.0.0-7|v5131]], [[4.2.0-9|v6146]], [[5.0.0-11|v7172]], [[6.0.0-11|v8198]], [[7.0.0-13|v9230]], [[9.0.0-20|v11272]], [[9.2.0-20|v12288]], [[9.3.0-21|v13330]], [[9.4.0-21|v14336]], [[9.5.0-22|v15360]], [[9.6.0-24|v16404]], [[9.7.0-25|v17415]], [[9.8.0-25|v19456]], [[10.1.0-27|v20480]], [[10.2.0-28|v21504]], [[10.3.0-28|v22528]], [[10.4.0-29|v23554]], [[10.6.0-31|v24576]], [[11.1.0-34|v25600]], [[11.3.0-36|v26624]]
|-
| 00008402
| 00009002
| 00009902
| 0000A202
| 0000AA02
| 0000B202
| CTR-N-HCS?
| Camera applet used by Home-menu (CtrApp)
|colspan=3| v0, v1036, [[9.0.0-20|v2049]](Also for [[8.1.0-0_New3DS]])
|-
| 00008502
| 00009102
| 00009A02
| ?
| ?
| ?
| ?
| Not available on CDN
| ?
| ?
| ?
|-
| 00008602
| 00009202
| 00009B02
| 0000A402
| 0000AC02
| 0000B402
|
| Instruction Manual, applet for displaying instruction manuals
|colspan=3| v0, v1026, v2048, v3072, [[5.0.0-11|v4097]], [[9.0.0-20|v5120]](Also for [[8.1.0-0_New3DS]])
|-
| 00008702
| 00009302
| 00009C02
| 0000A502
| 0000AD02
| 0000B502
| CTR-N-HGM?
| Game Notes (Cherry)
|colspan=3| v0, v1026, v2049, [[5.0.0-11|v3073]], [[9.0.0-20|v4096]](Also for [[8.1.0-0_New3DS]])
|-
| 00008802
| 00009402
| 00009D02
| 0000A602
| 0000AE02
| 0000B602
|
| [[Internet Browser]] (spider)
|colspan=3| [[2.0.0-2|v6]], [[2.1.0-4|v1024]], [[4.0.0-7|v2050]], [[5.0.0-11|v3074 (EUR)/v3075(USA,JAP)]], [[7.0.0-13|v3088]], [[7.1.0-16|v4096]], [[9.5.0-23|v5121]], [[9.9.0-26|v6149]], [[10.2.0-28|v7168]], [[10.6.0-31|v8192]], [[10.7.0-32|v9232]], [[11.1.0-34|v10240]]
|-
| 20008802
| 20009402
| 20009D02
| ?
| 2000AE02
| N/A
| CTR-N-HBR?
| [[New 3DS]] [[Internet Browser]] (SKATER)
|colspan=3| [[8.1.0-0_New3DS|v10]], [[9.3.0-21|v1027]], [[9.6.0-24|v2051]], [[9.9.0-26|v3077]], [[10.2.0-28|v4096]], [[10.4.0-29|v5121]], [[10.6.0-31|v6144]], [[10.7.0-32|v7184]], [[11.1.0-34|v8192]]
|-
|colspan=6| 00008A02
|
| Fatal error viewer ([[ErrDisp]])
|colspan=3| v0, v1025, [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[5.0.0-11|v5121]], [[8.0.0-18|v6144]], [[9.0.0-20|v7168]](Also for [[8.1.0-0_New3DS]])
|-
|colspan=6| 00008A03
|
| SAFE_MODE [[ErrDisp]]
|colspan=3| v0
|-
| 20008A03
| 20008A03
| 20008A03
| ?
| 20008A03
| N/A
|
| [[New_3DS]] SAFE_MODE [[ErrDisp]]
|colspan=3| [[8.1.0-0_New3DS|v7169]]
|-
| 00008D02
| 00009602
| 00009F02
| 0000A702
| 0000AF02
| 0000B702
| CTR-N-HFR?
| Friend List (friend)
|colspan=3| v0, v1026, [[2.2.0-X|v2051]], v3082, v4099, [[7.0.0-13|v5120]], [[9.0.0-20|v6144]](Also for [[8.1.0-0_New3DS]]) (EUR v6, v1024, v3082, v4099, [[7.0.0-13|v5120]], [[9.0.0-20|v6144]])
|-
| 00008E02
| 00009702
| 0000A002
| 0000A802
| 0000B002
| 0000B802
| CTR-N-HCR?
| Notifications (newslist)
|colspan=3| v0, v1029, v2054, v3075, [[9.0.0-20|v4097]] (EUR v6, v1024, v2054, v3075, [[9.0.0-20|v4097]]) (JPN: ..., [[8.1.0-0_New3DS|v4096]], [[9.0.0-20|v5121]])
|-
| 0000C002
| 0000C802
| 0000D002
| 0000D802
| 0000DE02
| 0000E402
| CTR-N-HKY?
| Software Keyboard (swkbd)
|colspan=3| v0, v1026, v2053, [[7.0.0-13|v3072]], [[9.0.0-20|v4096]](Also for [[8.1.0-0_New3DS]])
|-
| 0000C003
| 0000C803
| 0000D003
| 0000D803
| 0000DE03
| 0000E403
|
| SAFE_MODE Software Keyboard (swkbd)
|colspan=3| v0
|-
| 2000C003
| 2000C803
| 2000D003
| ?
| 2000DE03
| N/A
|
| [[New 3DS]] SAFE_MODE Software Keyboard (swkbd)
| [[8.1.0-0_New3DS|v1024]]
|colspan=2|[[9.0.0-20|v0]]
|-
| 0000C102
| 0000C902
| 0000D102
| 0000D902
| 0000DF02
| 0000E502
|
| Mii picker (appletEd)
|colspan=3| v0, v1026, [[9.0.0-20|v2048]](Also for [[8.1.0-0_New3DS]]), [[9.3.0-21|v3077]]
|-
| 0000C302
| 0000CB02
| 0000D302
| 0000DB02
| 0000E102
| 0000E702
|
| Picture picker (PNOTE_AP)
|colspan=3| v0, v1024, [[8.1.0-0_New3DS|v2049]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v3075]], [[9.3.0-21|v4096]]
|-
| 0000C402
| 0000CC02
| 0000D402
| 0000DC02
| 0000E202
| 0000E802
|
| [[Nintendo 3DS Sound|Voice memo]] picker (SNOTE_AP)
|colspan=3| v0, v3, [[8.0.0-18|v1026]], [[9.0.0-20|v2048]](Also for [[8.1.0-0_New3DS]])
|-
|colspan=3| 0000C502
|colspan=3| 0000CF02
|
| Non-critical (online, etc) error display (error)
|colspan=3| v0, v1026, v2053, v3074, [[8.1.0-0_New3DS|v4096]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v5128]], [[9.6.0-24|v6145]]
|-
|colspan=3| 0000C503
|colspan=3| 0000CF03
|
| SAFE_MODE error applet
|colspan=3| v0
|-
| 2000C503
| 2000C503
| 2000C503
| ?
| 2000CF03
| N/A
|
| [[New 3DS]] SAFE_MODE error applet
|colspan=3| [[8.1.0-0_New3DS|v1024]]
|-
|colspan=3| 0000CD02
|colspan=3| 0000D502
|
| [[Circle Pad Pro]] test/calibration applet (extrapad)
|colspan=3| v1, v1026, [[8.1.0-0_New3DS|v2048]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v3073]]
|-
| 0000C602
| 0000CE02
| 0000D602
| N/A
| 0000E302
| 0000E902
| CTR-N-HAA?
| eShop applet, used by applications for accessing the eShop, for DLC/etc. Also used by the eShop application itself. (mint)
|colspan=3| v5, v1028, [[4.2.0-9|v2050]], [[5.0.0-11|v3072]], [[7.0.0-13|v4109]], [[7.2.0-17|v5125]](v5123 for JPN), [[8.0.0-18|v6145]], [[8.1.0-0_New3DS|v7168]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v8200]], [[9.3.0-21|v9224]], [[9.6.0-24|v10247]], [[9.8.0-25|v11264]], [[10.0.0-27|v12293]], [[10.1.0-27|v13312]], [[10.3.0-28|v14337]], [[10.4.0-29|v15360]], [[10.7.0-32|v16384]], [[11.2.0-35|v17408]](EUR), [[11.3.0-36|v18432]]
|-
| 0000BC02
| 0000BD02
| 0000BE02
| ?
| ?
| ?
| CTR-N-HAE?
| Miiverse (olv)
|colspan=3| [[7.0.0-13|v14]], [[7.2.0-17|v1024]], [[9.0.0-20|v2048]](Also for [[8.1.0-0_New3DS]]), [[9.3.0-21|v3072]], [[9.6.0-24|v4096]]
|-
| 0000F602
| 0000F602
| 0000F602
| ?
| ?
| ?
|
| Likely the "system library" for Miiverse (memolib)
|colspan=3| [[7.0.0-13|v5]], [[8.1.0-0_New3DS|v1024]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v2050]], [[9.3.0-21|v3072]]
|-
| 00008302
| 00008B02
| 0000BA02
| ?
| ?
| ?
| CTR-N-HAH?
| In-app Miiverse-posting applet (solv3)
|colspan=3| [[9.0.0-20|v6]]
|-
| 00009502
| 00009E02
| 0000B902
| ?
| 00008C02
| 0000BF02
| CTR-N-HA3?
| Cabinet ([[amiibo Settings]])
|colspan=3| [[9.3.0-21|v7]], (v1024 for TWN), [[9.6.0-24|v1031]]
|}

Most of these processes are applets, see [[NS_and_APT_Services|here]] for details.

All of the above processes use the "SYSTEM" [[SVC|memory-region]].

The ExeFS for Home Menu is exactly the same for USA/EUR/JPN.

The Miiverse applet seems to use a web browser with webkit.

=== 0004009B - [[NCCH#CFA|System Data Archives]] (Shared Archives) ===
{| class="wikitable" border="1"
|-
! JPN TitleIDLow
! USA TitleIDLow
! EUR TitleIDLow
! KOR TitleIDLow
! Description
! Versions
|-
| 00010202
| 00010202
| 00010202
| 00010202
| Probably Mii-related, contains "CFL_Res.dat" in the RomFS.
| v0
|-
| 00010402
| 00010402
| 00010402
| 00010402
| Mounted as "area:", contains Country and Region names
| v0, v1024, v2050, v3072, [[7.0.0-13|v4098]], [[9.6.0-24|v5122]]
|-
| 00010602
| 00010602
| 00010602
| 00010602
| Non-Nintendo TLS Root-CA Certificates (RomFS contains files with filename "CACERT_PUBLIC_CA_<val>.der", where <val> is 5..8)
| v2, [[10.5.0-30|v1024]]
|-
|
|
| 00011202
|
| "NL/NL" dictionary.
| v0
|-
|
|
| 00011302
|
| "EN/GB" dictionary.
| v0
|-
|
| 00011402
|
|
| "EN/US" dictionary.
| v0
|-
|
|
| 00011502
|
| "FR/FR/regular" dictionary.
| v0
|-
|
| 00011602
|
|
| "FR/CA/regular" dictionary.
| v0
|-
|
|
| 00011702
|
| "DE/regular" dictionary.
| v0
|-
|
|
| 00011802
|
| "IT/IT" dictionary.
| v0
|-
| 00011902
|
|
|
| "JA_small/32" dictionary.
| v0
|-
|
|
|
| 00011A02
| ?
| v1
|-
|
|
| 00011B02
|
| "PT/PT/regular" dictionary.
| v0
|-
|
|
| 00011C02
|
| "RU/regular" dictionary.
| v0
|-
|
| 00011D02
| 00011D02
|
| "ES/ES" dictionary.
| v0
|-
|
| 00011E02
|
|
| "PT/BR/regular" dictionary.
| v0
|-
| 00012202
| 00012302
| 00012102
| 00012502
| ?contains a lists with error strings
| v1026, v2053, v3073, [[4.2.0-9|v4096]], [[5.0.0-11|v5120]], [[7.0.0-13|v6149]], [[7.2.0-17|v7168]], [[8.0.0-18|v8192]], [[9.0.0-20|v9218]], [[9.3.0-21|v10242]], [[9.6.0-24|v11269]], [[10.0.0-27|v12289]], [[10.4.0-29|v13312]], [[10.7.0-32|v13313]] (JPN: [[11.1.0-34|v14336]]) (KOR: [[9.6.0-24|v6148]], [[10.0.0-27|v7169]], [[10.3.0-28|v8193]], [[10.4.0-29|v9216]], [[11.1.0-34|v10240]])
|-
| 00013202
| 00013302
| 00013102
| 00013502
| Mounted as "eula:"
| v0, v1024, v2049 USA: v1024, v2051, [[7.0.0-13|v3074]], [[7.2.0-17|v4100]](EUR-only), [[9.0.0-20|v4099]], [[9.9.0-26|v6144]], [[10.4.0-29|v7168]] (KOR: [[9.7.0-25|v1025]])
|-
| 00014002
| 00014002
| 00014002
| 00014002
| JPN/EUR/USA [[System Font]] ("font:")
| v0
|-
| 00014102
| 00014102
| 00014102
| 00014102
| CHN [[System Font]] ("font:")
| v0, v1024
|-
| 00014202
| 00014202
| 00014202
| 00014202
| KOR [[System Font]] ("font:")
| v0, v1024
|-
| 00014302
| 00014302
| 00014302
| 00014302
| TWN [[System Font]] ("font:")
| v0, v1024
|-
| 00015202
| 00015302
| 00015102
| 00015502
| Mounted as "rate:"
| v0 (EUR: v0, v1024) (KOR: v1024)
|}

=== 000400DB - [[NCCH#CFA|System Data Archives]] ===
These [[NVer]] titleIDs can be found @ offset 0x320 in every [[CCI]].

{| class="wikitable" border="1"
|-
! EUR TitleIDLow
! JPN TitleIDLow
! USA TitleIDLow
! CHN TitleIDLow
! KOR TitleIDLow
! TWN TitleIDLow
! Description
! USA/EUR/JPN Versions
! CHN Versions
! TWN Versions
! KOR Versions
|-
| 00010302
| 00010302
| 00010302
| 00010302
| 00010302
| 00010302
| NGWord bad word list
| [[1.0.0-0|v0]], [[2.0.0-2|v1024]], [[3.0.0-5|v2052]], [[4.0.0-7|v3072]], [[4.3.0-10|v4096]], [[5.0.0-11|v5120]], [[9.0.0-20|v6144]], [[9.3.0-21|v7168]], [[9.6.0-24|v8192]], [[11.1.0-34|v9217]]
| Same as USA
| Same as USA
| Same as USA
|-
| 00010502
| 00010502
| 00010502
| 00010502
| 00010502
| 00010502
| [[Nintendo Zone]] hotspot list
| [[1.0.0-0|v0]], [[2.0.0-2|v1024]], [[3.0.0-5|v2048]], [[4.0.0-7|v3073]], [[4.3.0-10|v4096]], [[4.4.0-10|v5120]], [[4.5.0-10|v6144]], [[5.0.0-11|v7169]], [[6.0.0-11|v8192]], [[6.2.0-12|v9216]], [[7.0.0-13|v10242]], [[7.2.0-17|v11267]], [[8.0.0-18|v12288]], [[9.0.0-20|v14336]], [[9.3.0-21|v15360]], [[9.6.0-24|v16386]], [[10.0.0-27|v17409]], [[10.4.0-29|v18432]], [[11.1.0-34|v19457]]
| Same as USA
| Same as USA
| Same as USA
|-
| 00016102
| 00016202
| 00016302
| 00016402
| 00016502
| 00016602
| [[NVer]]
| [[1.0.0-0|v0]], [[1.1.0-1|v16]], [[2.0.0-2|v32]], [[2.1.0-3|v48]], [[2.1.0-4|v64]], [[3.0.0-5|v80]], [[3.0.0-6|v96]], [[4.0.0-7|v112]], [[4.1.0-8|v128]], [[4.2.0-9|v144]], [[4.3.0-10|v160]], [[5.0.0-11|v176]], non-USA=[[6.0.0-11|v192]]/USA=[[6.1.0-12U|v192]], [[7.0.0-13|v208]], [[7.1.0-14|v224]], [[7.1.0-15|v240]], [[7.1.0-16|v256]], [[7.2.0-17|v272]], [[8.0.0-18|v288]], [[8.1.0-19|v304]], [[9.0.0-20|v320]], [[9.3.0-21|v336]], [[9.5.0-22|v352]], [[9.5.0-23|v368]], [[9.6.0-24|v384]], [[9.7.0-25|v400]], [[9.9.0-26|v416]], [[10.0.0-27|v432]], [[10.2.0-28|v448]], [[10.4.0-29|v464]], [[10.5.0-30|v480]], [[10.6.0-31|v496]], [[10.7.0-32|v512]], [[11.0.0-33|v528]], [[11.1.0-34|v544]], [[11.2.0-35|v560]], [[11.3.0-36|v576]]
| [[4.0.0-7|v113]], [[4.2.0-9|v128]], [[5.0.0-11|v129]], [[7.1.0-16|v130]], [[7.2.0-17|v272]], [[9.5.0-23|v131]], [[9.9.0-26|v132]]
| [[4.1.0-8|v114]], [[4.2.0-9|v133]], [[4.3.0-10|v134]], [[5.0.0-11|v136]], [[7.0.0-13|v144]], [[7.1.0-14|v160]] [[7.1.0-16|v192]], [[7.2.0-17|v272]], [[8.0.0-18|v208]], [[8.1.0-19|v224]], [[9.0.0-20|v240]], [[9.5.0-22|v272]], [[9.5.0-23|v288]], [[9.6.0-24|v304]], [[9.7.0-25|v320]], [[9.9.0-26|v336]], [[10.0.0-27|v352]], [[10.2.0-28|v368]], [[10.4.0-29|v384]], [[10.5.0-30|v400]], [[10.6.0-31|v416]], [[10.7.0-32|v432]], [[11.0.0-33|v448]], [[11.1.0-34|v464]], [[11.2.0-35|v480]], [[11.3.0-36|v496]]
| [[4.0.0-7|v113]], [[4.1.0-8|v114]], [[4.2.0-9|v133]], [[4.3.0-10|v134]], [[5.0.0-11|v136]], [[7.0.0-13|v160]], [[7.1.0-14|v176]], [[7.1.0-16|v176]], [[7.2.0-17|v272]], [[8.0.0-18|v224]], [[8.1.0-19|v240]], [[9.0.0-20|v256]], [[9.3.0-21|v272]], [[9.5.0-22|v288]], [[9.5.0-23|v304]], [[9.6.0-24|v320]], [[9.7.0-25|v336]], [[9.9.0-26|v352]], [[10.0.0-27|v368]], [[10.2.0-28|v384]], [[10.4.0-29|v400]], [[10.5.0-30|v416]], [[10.6.0-31|v432]], [[10.7.0-32|v448]], [[11.0.0-33|v464]], [[11.1.0-34|v480]], [[11.2.0-35|v496]], [[11.3.0-36|v512]]
|-
| 20016102
| 20016202
| 20016302
| N/A
| 20016502
| N/A
| [[New_3DS]] [[NVer]]
| [[8.1.0-0_New3DS|v0]], [[9.0.0-20|v320]], [[9.3.0-21|v336]], [[9.5.0-22|v352]], [[9.5.0-22|v352]], [[9.5.0-23|v368]], [[9.6.0-24|v384]], [[9.7.0-25|v400]], [[9.9.0-26|v416]], [[10.0.0-27|v432]], [[10.2.0-28|v448]], [[10.4.0-29|v464]], [[10.5.0-30|v480]], [[10.6.0-31|v496]], [[10.7.0-32|v512]], [[11.0.0-33|v528]], [[11.1.0-34|v544]], [[11.2.0-35|v560]], [[11.3.0-36|v576]]
| N/A
| N/A
| [[9.6.0-24|v320]], [[9.7.0-25|v336]], [[9.9.0-26|v352]], [[10.0.0-27|v368]], [[10.2.0-28|v384]], [[10.4.0-29|v400]], [[10.5.0-30|v416]], [[10.6.0-31|v432]], [[10.7.0-32|v448]], [[11.0.0-33|v464]], [[11.2.0-35|v496]], [[11.3.0-36|v512]]
|-
| 00017102
| 00017202
| 00017302
| 00017402
| 00017502
| 00017602
| [[CVer]]
| [[1.0.0-0|v1024]], [[1.1.0-1|v1045]], [[2.0.0-2|v2049]], [[2.1.0-3|v2069]], [[2.2.0-X|v2088]] [[3.0.0-5|v3088]], [[4.0.0-7|v4098]], [[4.1.0-8|v4113]], [[4.2.0-9|v4130]], [[4.3.0-10|v4145]], [[4.4.0-10|v4163]], [[4.5.0-10|v4176]], [[5.0.0-11|v5120]], [[5.1.0-11|v5136]], [[6.0.0-11|v6146]], [[6.1.0-11|v6160]], [[6.2.0-12|v6178]], [[6.3.0-12|v6192]], [[7.0.0-13|v7175]], [[7.1.0-14|v7187]], [[7.2.0-17|v7203]], [[8.0.0-18|v8196]], [[8.1.0-18|v8208]], [[8.1.0-0_New3DS|v8215]](8.1.0-0_New3DS), [[9.0.0-20|v9218]], [[9.1.0-20J|v9232]](JPN-only), [[9.2.0-20|v9248]], [[9.3.0-21|v9264]], [[9.4.0-21|v9280]], [[9.5.0-22|v9296]], [[9.6.0-24|v9319]], [[9.7.0-25|v9328]], [[9.8.0-25|v9344]], [[9.9.0-26|v9360]], [[10.0.0-27|v10240]], [[10.1.0-27|v10256]], [[10.2.0-28|v10272]], [[10.3.0-28|v10288]], [[10.4.0-29|v10304]], [[10.5.0-30|v10320]], [[10.6.0-31|v10336]], [[10.7.0-32|v10352]], [[11.0.0-33|v11264]], [[11.1.0-34|v11280]], [[11.2.0-35|v11296]], [[11.3.0-36|v11312]]
| [[1.0.0-0|v1024]], [[1.1.0-1|v1045]], [[2.0.0-2|v2049]], [[2.1.0-3|v2069]], [[2.2.0-X|v2088]] [[3.0.0-5|v3088]], [[4.0.0-7|v4098]], [[4.1.0-8|v4113]], [[4.2.0-9|v4130]], [[4.3.0-10|v4145]], [[4.4.0-10|v4163]], [[4.5.0-10|v4176]], [[5.0.0-11|v5120]], [[5.1.0-11|v5136]], [[6.0.0-11|v6146]], [[6.1.0-11|v6160]], [[6.2.0-12|v6178]], [[6.3.0-12|v6192]], [[7.0.0-13|v7175]], [[7.1.0-14|v7187]], [[7.2.0-17|v7203]], [[8.0.0-18|v8196]], [[8.1.0-18|v8208]], [[9.0.0-20|v9217]], [[9.3.0-21|v9264]], [[9.5.0-22|v9296]], [[9.6.0-24|v9319]], [[9.7.0-25|v9328]], [[9.8.0-25|v9344]], [[9.9.0-26|v9360]], [[10.0.0-27|v10240]], [[10.2.0-28|v10272]], [[10.4.0-29|v10304]], [[10.5.0-30|v10320]], [[10.6.0-31|v10336]], [[10.7.0-32|v10352]], [[11.2.0-35|v11296]], [[11.3.0-36|v11312]]
| Same as CHN
| Same as CHN + [[11.1.0-34|v11280]]
|}

=== 00040130 - System [[Services API|Modules]] ===
{| class="wikitable" border="1"
|-
! TitleID Low
! Description
! Versions
|-
| 00001002
| [[Services|sm]] (Stored in [[FIRM|NATIVE_FIRM]])
| N/A
|-
| 00001003
| SAFE_MODE [[Services|sm]] (Stored in SAFE_MODE NATIVE_FIRM)
| N/A
|-
| 00001102
| [[Filesystem services‎|fs]] (Stored in [[FIRM|NATIVE_FIRM]])
| N/A
|-
| 00001103
| SAFE_MODE [[Filesystem services‎|fs]] (Stored in SAFE_MODE NATIVE_FIRM)
| N/A
|-
| 00001202
| [[Process Manager Services|pm]] (Stored in [[FIRM|NATIVE_FIRM]])
| N/A
|-
| 00001203
| SAFE_MODE [[Process Manager Services|pm]] (Stored in SAFE_MODE NATIVE_FIRM)
| N/A
|-
| 00001302
| [[Loader Services‎|loader]] (Stored in [[FIRM|NATIVE_FIRM]])
| N/A
|-
| 00001303
| SAFE_MODE [[Loader Services‎|loader]] (Stored in SAFE_MODE NATIVE_FIRM)
| N/A
|-
| 00001402
| [[PXI Services‎|pxi]] (Stored in [[FIRM|NATIVE_FIRM]])
| N/A
|-
| 00001403
| SAFE_MODE [[PXI Services‎|pxi]] (Stored in SAFE_MODE NATIVE_FIRM)
| N/A
|-
| 00001502
| [[Application Manager Services|AM]] ( Application Manager )
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[3.0.0-5|v2053]], [[4.0.0-7|v3072]], [[5.0.0-11|v4098]], [[6.0.0-11|v5120]], [[8.0.0-18|v6148]], [[8.1.0-0_New3DS|v7168]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v8192]], [[10.0.0-27|v9217]]
|-
| 00001503
| SAFE_MODE [[Application Manager Services|AM]]
| [[1.0.0-0|v0]]
|-
| 20001503
| [[New_3DS]] SAFE_MODE [[Application Manager Services|AM]]
| [[8.1.0-0_New3DS|v7169]]
|-
| 00001602
| [[Camera Services|Camera]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[3.0.0-5|v2048]], [[4.0.0-7|v3074]], [[5.0.0-11|v4098]], [[6.0.0-11|v5120]], [[7.1.0-14|v6146]], [[8.0.0-18|v7172]], [[9.0.0-20|v9216]], [[9.3.0-21|v10242]], [[10.0.0-27|v11265]]
|-
| 20001602
| [[New_3DS]] [[Camera Services|Camera]]
| [[8.1.0-0_New3DS|v8200]], [[9.0.0-20|v9218]], [[9.3.0-21|v10242]], [[10.0.0-27|v11265]]
|-
| 00001702
| [[Config Services|Config]] (cfg)
| [[1.0.0-0|v0]], [[2.0.0-2|v1024]], [[3.0.0-5|v2049]], v3072, [[4.0.0-7|v4096]], [[5.0.0-11|v5122]], [[6.0.0-11|v6145]], [[6.1.0-11|v7168]], [[7.0.0-13|v8196]], [[7.2.0-17|v9220]], [[8.0.0-18|v10243]], [[8.1.0-0_New3DS|v11265]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v12290]], [[9.3.0-21|v13315]], [[9.6.0-24|v14342]]
|-
| 00001703
| SAFE_MODE [[Config Services|Config]] (cfg)
| [[1.0.0-0|v0]]
|-
| 20001703
| [[New_3DS]] SAFE_MODE [[Config Services|Config]] (cfg)
| [[8.1.0-0_New3DS|v11265]]
|-
| 00001802
| [[Codec Services|Codec]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[5.0.0-11|v4098]], [[7.0.0-13|v5120]], [[8.0.0-18|v6144]], [[9.0.0-20|v7168]](Also for [[8.1.0-0_New3DS]])
|-
| 00001803
| SAFE_MODE [[Codec Services|Codec]]
| [[1.0.0-0|v0]]
|-
| 20001803
| [[New_3DS]] SAFE_MODE [[Codec Services|Codec]]
| [[8.1.0-0_New3DS|v7169]]
|-
| 00001902
| dmnt, debugger sysmodule. This use devunit-only HIO for devunit<>pc comms. This only exists for development units(launched by NS during startup depending on certain [[Configuration_Memory]] fields' values). This is installed at the [[Factory_Setup|factory]], then later deleted at the factory on retail units.
|
|-
| 00001A02
| [[DSP Services|DSP]]
| [[1.0.0-0|v0]], [[3.0.0-5|v1024]], [[4.0.0-7|v2048]], [[5.0.0-11|v3074]], [[6.0.0-11|v4096]], [[8.0.0-18|v5120]], [[9.7.0-25|v6145]], [[11.1.0-34|v7169]]
|-
| 00001A03
| SAFE_MODE [[DSP Services|DSP]]
| [[1.0.0-0|v0]]
|-
| 20001A03
| [[New_3DS]] SAFE_MODE [[DSP Services|DSP]]
| [[8.1.0-0_New3DS|v6145]]
|-
| 00001B02
| [[GPIO Services|GPIO]]
| [[1.0.0-0|v0]], [[5.0.0-11|v1025]], [[8.0.0-18|v2048]], [[9.5.0-22|v3073]]
|-
| 00001B03
| SAFE_MODE [[GPIO Services|GPIO]]
| [[1.0.0-0|v0]]
|-
| 20001B03
| [[New_3DS]] SAFE_MODE [[GPIO Services|GPIO]]
| [[8.1.0-0_New3DS|v3073]]
|-
| 00001C02
| [[GSP Services|GSP]]
| [[1.0.0-0|v0]], [[1.1.0-1|v1040]], [[2.0.0-2|v2049]], [[3.0.0-5|v3075]], v4098, [[4.0.0-7|v5120]], [[5.0.0-11|v6145]], [[6.0.0-11|v7168]], [[8.0.0-18|v8196]], [[9.0.0-20|v10240]], [[9.3.0-21|v11264]], [[9.6.0-24|v12294]], [[11.3.0-36|v13312]]
|-
| 20001C02
| [[New_3DS]] [[GSP Services|GSP]]
| [[8.1.0-0_New3DS|v10243]], [[9.3.0-21|v11267]], [[9.6.0-24|v12294]], [[11.3.0-36|v13312]]
|-
| 00001C03
| SAFE_MODE [[GSP Services|GSP]]
| [[1.0.0-0|v0]]
|-
| 20001C03
| [[New_3DS]] SAFE_MODE [[GSP Services|GSP]]
| [[8.1.0-0_New3DS|v9217]]
|-
| 00001D02
| [[HID Services|HID]] (Human Interface Devices)
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[5.0.0-11|v5121]], [[7.2.0-17|v6148]], [[8.0.0-18|v7168]], [[8.1.0-0_New3DS|v8192]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v9216]], [[9.3.0-21|v10240]]
|-
| 00001D03
| SAFE_MODE [[HID Services|HID]]
| [[1.0.0-0|v0]]
|-
| 20001D03
| [[New_3DS]] SAFE_MODE [[HID Services|HID]]
| [[8.1.0-0_New3DS|v8193]]
|-
| 00001E02
| [[I2C Services|i2c]]
| [[1.0.0-0|v0]], [[3.0.0-5|v1024]], [[5.0.0-11|v2049]], [[8.0.0-18|v3076]], [[9.3.0-21|v5120]]
|-
| 20001E02
| [[New_3DS]] [[I2C Services|i2c]]
| [[8.1.0-0_New3DS|v4096]], [[9.3.0-21|v5121]]
|-
| 00001E03
| SAFE_MODE [[I2C Services|i2c]]
| [[1.0.0-0|v0]]
|-
| 20001E03
| [[New_3DS]] SAFE_MODE [[I2C Services|i2c]]
| [[8.1.0-0_New3DS|v4097]]
|-
| 00001F02
| [[MCU Services|MCU]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.1.0-3|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4102]], [[5.0.0-11|v5122]], [[6.0.0-11|v6145]], [[7.0.0-13|v7168]], [[8.0.0-18|v8192]]
|-
| 20001F02
| [[New_3DS]] [[MCU Services|MCU]]
| [[8.1.0-0_New3DS|v8192]]
|-
| 00001F03
| SAFE_MODE [[MCU Services|MCU]]
| [[1.0.0-0|v0]]
|-
| 20001F03
| [[New_3DS]] SAFE_MODE [[MCU Services|MCU]]
| [[8.1.0-0_New3DS|v9217]]
|-
| 00002002
| [[MIC Services|MIC]] (Microphone)
| [[1.0.0-0|v0]], [[5.0.0-11|v1025]], [[8.0.0-18|v2048]]
|-
| 00002102
| [[PDN Services|PDN]]
| [[1.0.0-0|v0]], [[5.0.0-11|v1025]], [[8.0.0-18|v2048]]
|-
| 00002103
| SAFE_MODE [[PDN Services|PDN]]
| [[1.0.0-0|v0]]
|-
| 20002103
| [[New_3DS]] SAFE_MODE [[PDN Services|PDN]]
| [[8.1.0-0_New3DS|v3073]]
|-
| 00002202
| [[PTM Services|PTM]] (Play time, pedometer, and battery manager)
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.2.0-X|v2048]], [[3.0.0-5|v3075]], v4096, [[4.0.0-7|v5120]], [[5.0.0-11|v6146]], [[6.0.0-11|v7168]], [[7.0.0-13|v8192]], [[8.0.0-18|v9219]], [[9.6.0-24|v11264]]
|-
| 20002202
| [[New_3DS]] [[PTM Services|PTM]] (Play time, pedometer, and battery manager)
| [[8.1.0-0_New3DS|v10240]], [[9.6.0-24|v11264]]
|-
| 00002203
| SAFE_MODE [[PTM Services|PTM]]
| [[1.0.0-0|v0]]
|-
| 20002203
| [[New_3DS]] SAFE_MODE [[PTM Services|PTM]]
| [[8.1.0-0_New3DS|v10241]]
|-
| 00002302
| [[SPI Services|spi]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[5.0.0-11|v2049]], [[8.0.0-18|v3072]]
|-
| 20002302
| [[New_3DS]] [[SPI Services|spi]]
| [[8.1.0-0_New3DS|v4096]]
|-
| 00002303
| SAFE_MODE [[SPI Services|spi]]
| [[1.0.0-0|v0]]
|-
| 20002303
| [[New_3DS]] SAFE_MODE [[SPI Services|spi]]
| [[8.1.0-0_New3DS|v4097]]
|-
| 00002402
| [[AC Services|AC]] (Network manager)
| [[1.0.0-0|v0]], [[1.1.0-1|v1024]], [[2.0.0-2|v2052]], [[2.1.0-3|v3072]], [[3.0.0-5|v4101]], [[5.0.0-11|v5122]], [[7.0.0-13|v6145]], [[8.0.0-18|v7172]], [[9.0.0-20|v8192]](Also for [[8.1.0-0_New3DS]]), [[9.3.0-21|v9216]]
|-
| 00002403
| SAFE_MODE [[AC Services|AC]]
| [[1.0.0-0|v0]]
|-
| 20002403
| [[New_3DS]] SAFE_MODE [[AC Services|AC]]
| [[8.1.0-0_New3DS|v8193]]
|-
| 00002602
| [[CECD Services|Cecd]] (StreetPass)
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.2.0-X|v2048]], [[3.0.0-5|v3073]], [[4.0.0-7|v4097]], [[5.0.0-11|v5122]], [[6.0.0-11|v6144]], [[6.2.0-12|v7170]], [[7.0.0-13|v8193]], [[8.0.0-18|v9216]], [[9.0.0-20|v10240]]
|-
| 00002702
| [[CSND Services|CSND]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[4.0.0-7|v2048]], [[5.0.0-11|v3073]], [[8.0.0-18|v4096]], [[9.0.0-20|v5120]]
|-
| 00002703
| SAFE_MODE [[CSND Services|CSND]]
| [[1.0.0-0|v0]]
|-
| 20002703
| [[New_3DS]] SAFE_MODE [[CSND Services|CSND]]
| [[8.1.0-0_New3DS|v5121]]
|-
| 00002802
| [[DLP Services|DLP]] ([[Download Play]])
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.2.0-X|v2048]], [[3.0.0-5|v3078]], [[5.0.0-11|v4099]], [[8.0.0-18|v5123]], [[9.0.0-20|v6145]](Also for [[8.1.0-0_New3DS]]), [[9.6.0-24|v7174]], [[10.0.0-27|v8192]]
|-
| 00002902
| [[HTTP Services|HTTP]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.1.0-3|v2049]], [[2.2.0-X|v3072]], [[3.0.0-5|v4099]], [[4.0.0-7|v5122]], [[5.0.0-11|v6145]], [[7.0.0-13|v7171]], [[7.1.0-14|v8192]], [[8.0.0-18|v9220]], [[8.1.0-18|v10245]], [[8.1.0-0_New3DS|v11264]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v12288]], [[9.6.0-24|v13318]]
|-
| 00002903
| SAFE_MODE [[HTTP Services|HTTP]]
| [[1.0.0-0|v0]]
|-
| 20002903
| [[New_3DS]] SAFE_MODE [[HTTP Services|HTTP]]
| [[8.1.0-0_New3DS|v10241]]
|-
| 00002A02
| [[MP Services|MP]]
| [[1.0.0-0|v0]], [[5.0.0-11|v1025]], [[8.0.0-18|v2048]]
|-
| 00002A03
| SAFE_MODE [[MP Services|MP]]
| [[1.0.0-0|v0]]
|-
| 00002B02
| [[NDM Services|NDM]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[3.0.0-5|v2049]], [[4.0.0-7|v3072]], [[5.0.0-11|v4098]], [[8.0.0-18|v5124]], [[8.1.0-0_New3DS|v6144]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v7169]]
|-
| 00002C02
| [[NIM Services|NIM]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1028]], [[3.0.0-5|v2055]], [[4.0.0-7|v3074]], [[5.0.0-11|v4100]], [[6.0.0-11|v5120]], [[7.0.0-13|v6148]], [[7.2.0-17|v7174]], [[8.0.0-18|v8195]], [[8.1.0-0_New3DS|v9217]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v10249]], [[9.3.0-21|v11267]], [[9.6.0-24|v12296]], [[10.0.0-27|v13313]]
|-
| 00002C03
| SAFE_MODE [[NIM Services|NIM]]
| [[1.0.0-0|v0]]
|-
| 20002C03
| [[New_3DS]] SAFE_MODE [[NIM Services|NIM]]
| [[8.1.0-0_New3DS|v9217]]
|-
| 00002D02
| [[NWM Services|NWM]] ( Low-level wifi manager )
| [[1.0.0-0|v0]], [[1.1.0-1|v1024]], [[2.0.0-2|v2052]], [[2.2.0-X|v3072]], [[3.0.0-5|v4101]], [[4.0.0-7|v5120]], [[5.0.0-11|v6148]], [[6.0.0-11|v7169]], [[7.2.0-17|v8196]], [[8.0.0-18|v9216]], [[9.0.0-20|v10240]]
|-
| 00002D03
| SAFE_MODE [[NWM Services|NWM]]
| [[1.0.0-0|v0]], [[6.0.0-11|v5120]]
|-
| 20002D03
| [[New_3DS]] SAFE_MODE [[NWM Services|NWM]]
| [[8.1.0-0_New3DS|v10241]]
|-
| 00002E02
| [[Socket Services|Sockets]]
| [[1.0.0-0|v0]], [[1.1.0-1|v1024]], [[2.0.0-2|v2053]], [[3.0.0-5|v3075]], [[4.0.0-7|v4096]], [[5.0.0-11|v5121]], [[8.0.0-18|v6144]], [[9.0.0-20|v7168]], [[10.6.0-31|v8192]]
|-
| 00002E03
| SAFE_MODE [[Socket Services|Sockets]]
| [[1.0.0-0|v0]]
|-
| 20002E03
| [[New_3DS]] SAFE_MODE [[Socket Services|Sockets]]
| [[8.1.0-0_New3DS|v7169]]
|-
| 00002F02
| [[SSL Services|SSL]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1024]], [[2.1.0-3|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[5.0.0-11|v5122]], [[8.0.0-18|v6144]], [[9.0.0-20|v7168]], [[9.6.0-24|v8198]]
|-
| 00002F03
| SAFE_MODE [[SSL Services|SSL]]
| [[1.0.0-0|v0]]
|-
| 20002F03
| [[New_3DS]] SAFE_MODE [[SSL Services|SSL]]
| [[8.1.0-0_New3DS|v7169]]
|-
| 00003000
| [[FIRM|Process9]] (in SAFE_MODE and normal NATIVE_FIRM)
| N/A
|-
| 00003102
| [[Process Services‎|PS]] ( Process Manager )
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[5.0.0-11|v2049]], [[6.0.0-11|v3072]], [[8.0.0-18|v4096]], [[9.0.0-20|v5120]]
|-
| 00003103
| SAFE_MODE [[Process Services‎|PS]]
| [[1.0.0-0|v0]]
|-
| 20003103
| [[New_3DS]] SAFE_MODE [[Process Services‎|PS]]
| [[8.1.0-0_New3DS|v5121]]
|-
| 00003202
| [[Friend Services‎|friends]] (Friends list)
| [[1.0.0-0|v0]], [[2.0.0-2|v1028]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[5.0.0-11|v5122]], [[7.0.0-13|v6145]], [[8.0.0-18|v7172]], [[9.0.0-20|v8192]](Also for [[8.1.0-0_New3DS]]), [[10.5.0-30|v9216]], [[10.7.0-32|v10240]], [[11.0.0-33|v11264]], [[11.1.0-34|v12288]], [[11.2.0-35|v13312]], [[11.3.0-36|v14336]]
|-
| 00003203
| SAFE_MODE [[Friend Services‎|friends]] (Friends list)
| [[1.0.0-0|v0]]
|-
| 20003203
| [[New_3DS]] SAFE_MODE [[Friend Services‎|friends]] (Friends list)
| [[8.1.0-0_New3DS|v8193]]
|-
| 00003302
| [[IR Services‎|IR]] (Infrared)
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[5.0.0-11|v5121]], [[8.0.0-18|v6148]], [[8.1.0-0_New3DS|v7170]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v8192]], [[9.3.0-21|v9216]], [[9.6.0-24|v10246]], [[10.0.0-27|v11265]], [[10.6.0-31|v12289]]
|-
| 00003303
| SAFE_MODE [[IR Services‎|IR]]
| [[1.0.0-0|v0]]
|-
| 20003303
| [[New_3DS]] SAFE_MODE [[IR Services‎|IR]]
| [[8.1.0-0_New3DS|v7169]]
|-
| 00003402
| [[BOSS Services‎|BOSS]] (SpotPass)
| [[1.0.0-0|v0]], [[1.1.0-1|v1024]], [[2.0.0-2|v2053]], [[2.2.0-X|v3073]], [[3.0.0-5|v4101]], [[4.0.0-7|v5122]], [[5.0.0-11|v6146]], [[6.0.0-11|v7169]], [[6.2.0-12|v8193]], [[7.0.0-13|v9222]], [[8.0.0-18|v10240]], [[9.0.0-20|v11266]], [[10.0.0-27|v12289]], [[10.4.0-29|v13314]]
|-
| 00003502
| [[News Services‎|News]] (Notifications)
| [[1.0.0-0|v0]], [[2.0.0-2|v1028]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[5.0.0-11|v4097]], [[8.0.0-18|v5120]], [[9.0.0-20|v6147]], [[9.7.0-25|v7168]]
|-
| 00003602
| "debugger". This only exist for development units(launched by NS during startup depending on certain [[Configuration_Memory]] fields' values).
|
|-
| 00003702
| [[RO_Services|RO]]
| [[2.0.0-2|v0]], [[4.0.0-7|v1024]], [[5.0.0-11|v2049]], [[7.2.0-17|v3074]], [[8.0.0-18|v4096]], [[9.0.0-20|v5120]](Also for [[8.1.0-0_New3DS]]), [[9.3.0-21|v6148]]
|-
| 00003802
| [[ACT Services‎|act]] (handles Nintendo Network '''a'''c'''c'''oun'''t'''s)
| [[7.0.0-13|v1029]], [[7.1.0-14|v2050]], [[7.2.0-17|v3077]], [[8.0.0-18|v4099]], [[8.1.0-0_New3DS|v5120]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v6144]], [[9.3.0-21|v7168]], [[9.6.0-24|v8198]]
|-
| 00004002
| Old3DS [[NFC_Services|nfc]]
| [[9.3.0-21|v2053]], [[9.6.0-24|v4106]], [[9.7.0-25|v5121]], [[10.0.0-27|v6145]], [[10.6.0-31|v7168]], [[10.7.0-32|v8192]]
|-
| 20004002
| [[New_3DS]] [[NFC_Services|nfc]]
| [[8.1.0-0_New3DS|v0]], [[9.0.0-20|v1024]], [[9.3.0-21|v2053]], [[9.5.0-22|v3073]], [[9.6.0-24|v4102]], [[10.0.0-27|v6145]], [[10.6.0-31|v7168]]
|-
| 20004102
| [[New_3DS]] [[MVD Services|mvd]]
| [[8.1.0-0_New3DS|v0]], [[9.0.0-20|v1024]]
|-
| 20004202
| [[New_3DS]] [[QTM Services|qtm]]
| [[8.1.0-0_New3DS|v8]], [[9.0.0-20|v1024]], [[9.3.0-21|v2052]]
|-
| 00008002
| [[NS]] (Memory-region: "SYSTEM")
| [[1.0.0-0|v0]], [[2.0.0-2|v1028]], [[2.2.0-X|v2048]], [[3.0.0-5|v3077]], v4096, [[4.0.0-7|v5121]], [[5.0.0-11|v6148]], [[5.1.0-11|v7168]], [[6.0.0-11|v8193]], [[6.1.0-11|v9216]], [[7.0.0-13|v10248]], [[7.2.0-17|v11268]], [[8.0.0-18|v12291]], [[8.1.0-0_New3DS|v13312]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v14336]], [[9.3.0-21|v15360]], [[9.6.0-24|v16390]], [[9.8.0-25|v17408]], [[10.0.0-27|v18433]], [[10.4.0-29|v19458]], [[11.1.0-34|v20482]], [[11.3.0-36|v21504]]
|-
| 00008003
| SAFE_MODE [[NS]] (Memory-region: "SYSTEM")
| [[1.0.0-0|v0]]
|-
| 20008003
| [[New_3DS]] SAFE_MODE [[NS]] (Memory-region: "SYSTEM")
| [[8.1.0-0_New3DS|v13313]]
|}

Once Home Menu finishes loading, all of the above system modules are running, except for MP, RO, and act which are automatically [[Process_Manager_Services|loaded]] when a process requires them. When [[Process_Manager_Services|PM]]-module terminates processes, it will check whether the processes listed as dependencies for this process are listed as dependencies for other processes. Any processes which are no longer listed in any processes dependencies lists are then terminated. On [[New_3DS]], the only New3DS-specific system-module which automatically gets loaded during system boot is qtm.

All of the above system modules use the "BASE" [[SVC|memory-region]](specified in the exheader), except when listed otherwise for certain modules.

When handling the exheader dependency list starting with [[8.0.0-18]], Old3DS FIRM [[Process_Manager_Services|PM]]-module now skips handling titles in this list which have any bits in programID-low bitmask 0xF0000000 set(with [[8.0.0-18]] this is hard-coded). The exheader dependency list handling change is for the [[New 3DS]] system-module(s), which do not exist on Old3DS. When the New3DS pm-module is launching any title except [[NS]], it first attempts to launch the title with programID-low bitmask 0x20000000 set, then with that bitmask clear if launching fails.

=== 00040138 - [[FIRM|System Firmware]] ===
NATIVE_FIRM and SAFE_MODE_FIRM for the initial versions are exactly the same, besides [[Configuration_Memory|core-version]] fields. SAFE_MODE_FIRM is used for running SAFE_MODE titles, on retail SAFE_MODE_FIRM seems to be only used for running the [[System_Settings#System_Updater|System Updater]] application. When a GBA VC title is launched, AGB_FIRM is launched to handle running this title. GBA VC savegames stored under SD card /title/<TID>/data use a custom format, this is handled by AGB_FIRM.

{| class="wikitable" border="1"
|-
! TitleID Low
! Description
! USA/EUR/JPN Versions
! CHN Versions
! KOR Versions
! TWN Versions
|-
| 00000001
| Unknown, very similar to SAFE_MODE_FIRM. Exists only on dev units and seems to only be used by SystemUpdaters.
| v0
|
|
|
|-
| 00000002
| NATIVE_FIRM (Native Firmware)
| [[1.0.0-0|v432]], [[1.1.0-1|v1472]], [[2.0.0-2|v2516]], [[2.1.0-3|v3553]], [[2.2.0-X|v4595]], [[3.0.0-5|v5647]], [[4.0.0-7|v6677]], [[4.1.0-8|v7712]], [[5.0.0-11|v8758]], [[5.1.0-11|v9792]], [[6.0.0-11|v10833]], [[6.1.0-11|v11872]], [[7.0.0-13|v12916]], [[7.2.0-17|v13956]], v15043, [[8.0.0-18|v15047]], [[9.0.0-20|v17120]], [[9.3.0-21|v18182]], [[9.5.0-22|v19216]], [[9.6.0-24|v20262]], [[10.0.0-27|v21288]], [[10.2.0-28|v22313]], [[10.4.0-29|v23341]], [[11.0.0-33|v24368]], [[11.1.0-34|v25396]], [[11.2.0-35|v26432]], [[11.3.0-36|v27476]]
| Same as USA/EUR/JPN starting with the USA/EUR/JPN [[4.0.0-7]] title-version
| Same as CHN.
| Same as CHN.
|-
| 20000002
| [[New_3DS]] NATIVE_FIRM (Native Firmware)
| [[8.1.0-0_New3DS|v16085]], [[9.0.0-20|v17120]], [[9.3.0-21|v18182]], [[9.5.0-22|v19218]], [[9.6.0-24|v20262]], [[10.0.0-27|v21288]], [[10.2.0-28|v22313]], [[10.4.0-29|v23341]], [[11.0.0-33|v24368]], [[11.1.0-34|v25396]], [[11.2.0-35|v26432]], [[11.3.0-36|v27476]]
| N/A
| Same as CHN.
| Same as CHN.
|-
| 00000003
| SAFE_MODE_FIRM
| [[1.0.0-0|v432]], [[3.0.0-5|v5632]]
| Same as USA/EUR/JPN starting with the USA/EUR/JPN [[3.0.0-5]] title-version
| Same as CHN.
| Same as CHN.
|-
| 20000003
| [[New_3DS]] SAFE_MODE_FIRM
| [[8.1.0-0_New3DS|v16081]]
| N/A
| Same as CHN.
| Same as CHN.
|-
| 00000102
| TWL_FIRM ( DSi Firmware )
| [[1.0.0-0|v432]], [[2.0.0-2|v1489]], [[3.0.0-5|v2565]], v3601, [[4.0.0-7|v4625]], [[4.4.0-10|v5681]], [[4.5.0-10|v6704]], [[6.0.0-11|v7762]], [[6.2.0-12|v8817]]
| Same as USA/EUR/JPN starting with the USA/EUR/JPN [[4.0.0-7]] title-version
| Same as CHN.
| Same as CHN.
|-
| 20000102
| [[New_3DS]] TWL_FIRM ( DSi Firmware )
| [[8.1.0-0_New3DS|v9936]]
| N/A
| Same as CHN.
| Same as CHN.
|-
| 00000202
| AGB_FIRM ( GBA Firmware )
| [[3.0.0-5|v519]], v1553, [[4.0.0-7|v2576]], [[6.0.0-11|v3665]]
| [[4.0.0-7|v2576]]
| [[4.0.0-7|v2576]], [[6.0.0-11|v3665]]
| Same as CHN.
|-
| 20000202
| [[New_3DS]] AGB_FIRM ( GBA Firmware )
| [[8.1.0-0_New3DS|v4816]]
| N/A
| N/A
| N/A
|}

== Application Titles ==
{| class="wikitable" border="1"
|-
! Content Category
! Bit Mask(s)
! Category Bit Mask
|-
| [[Title list/eShop Titles|Application]] (eShop Title)
| Normal
| 0x0000
|-
| DLP Child
| DlpChild
| 0x0001
|-
| [[EShop Demos|Demo]]
| Demo
| 0x0002
|-
| [[Title list/Patches|Patch]]
| CannotExecution<nowiki>|</nowiki>Patch
| 0x000E
|-
| [[Title list/DLC|Add-on Content]] (DLC)
| NotRequireRightForMount<nowiki>|</nowiki>CannotExecution<nowiki>|</nowiki>AddOnContents
| 0x008C
|}

=== 00040001 - [[Download Play]] Titles ===
This titleID-high/programID-high is used for the titles sent over [[Download Play]]. Only one 00040001 Download Play title is installed to NAND /title at a time. There can be a maximum of 255 Download Play child titles per Unique ID, indexed by Title ID Variation. The legal index range: 0x0 - 0xff.

== Other Titles ==
{| class="wikitable" border="1"
|-
! TitleID
! Description
! Versions
|-
| 000400000F802A00
| Unknown. Appears to be a [[9.8.0-25|gamecard]] title. See also [[11.3.0-36|here]].
Used during [[Nintendo_Service_Center_Tools|repair]], first non-system title listed in [[PTM_Services|playlog]] from repair.
|
|-
| 000400000F802100
| Used during [[Nintendo_Service_Center_Tools|repair]], second non-system title listed in [[PTM_Services|playlog]] from repair.
|
|-
| 000400000F802200
| Used during [[Nintendo_Service_Center_Tools|repair]], third non-system title listed in [[PTM_Services|playlog]] from repair.
|
|-
| 0004003000008900
| Used by retail NS for appID 0xF10, but this isn't available on retail CDN.
| ?
|-
| 000400000FFFFD00
| Used by retail NS for appID 0xF11, but this isn't available on retail CDN.
| ?
|-
| 000400000FFFFC00
| Used by retail NS for appID 0xF12, but this isn't available on retail CDN.
| ?
|-
| 000400000FFFFB00
| Used by retail NS for appID 0xF13, but this isn't available on retail CDN.
| ?
|-
| 000400000FFFF900
| Used by retail NS for appID 0xF14, but this isn't available on retail CDN.
| ?
|-
| 000400000FFFF800
| Used by retail NS for appID 0xF15, but this isn't available on retail CDN.
| ?
|-
| 000400000FFFF700
| Used by retail NS for appID 0xF16, but this isn't available on retail CDN.
| ?
|-
| 000400000FFFF600
| Used by retail NS for appID 0xF17, but this isn't available on retail CDN.
| ?
|-
| 000400000FFFF500
| Used by retail NS for appID 0xF18, but this isn't available on retail CDN.
| ?
|}

This section is for hard-coded titleIDs referenced in codebins on retail. This can include [[Factory_Setup|factory]]/[[Nintendo_Service_Center_Tools|repair]] titles as well.

== TWL (DSi) Titles ==

{| class="wikitable" border="1"
|-
! Content Category
! Bit Mask(s)
! Category Bit Mask
|-
| Application (DSiWare)
| TWL<nowiki>|</nowiki>0x4
| 0x8004
|-
| System Application
| TWL<nowiki>|</nowiki>0x1<nowiki>|</nowiki>0x4
| 0x8005
|-
| System Archive
| TWL<nowiki>|</nowiki>0x1<nowiki>|</nowiki>0x2<nowiki>|</nowiki>0x4<nowiki>|</nowiki>0x8
| 0x800F
|-
| Developer Tool
| TWL<nowiki>|</nowiki>0x1<nowiki>|</nowiki>0x4<nowiki>|</nowiki>0x10
| 0x8015
|}

Bitmask 0x1 for TWL titles denotes a system title (determining whether the title will be updated during a System Update). It appears to be sufficient, but not necessary, to make the title invisible on the [[Home Menu]].

Bitmask 0x2 for TWL titles may indicate no-execute.

Bitmask 0x4 for TWL titles indicates internal storage.

Bitmask 0x10 for TWL titles is found on developer tools.

=== 00048005 - System Applications===
{| class="wikitable" border="1"
|-
! TitleID Low
! Region
! Description
! Versions
! Information
|-
| 42383841(B88A)
| ALL
| [[DS Internet]]
| v0, [[2.1.0-4|v1025]], [[3.0.0-5|v2048]]
| [[DS Internet]] is the DS-mode application, (also integrated in every online-enabled DS game) and now accessible through [[System Settings]] for configuring network settings for DS software.
|-
| 484E4441(HNDA)
| ALL
| [[Download Play]]
| v1024
| This [[Download Play]] application is the DS-mode Download Play client, launched by the 3DS-mode Download Play application.
|-
| 484E4443(HNDC)
| CHN
| [[Download Play]]
| v1024
| See Above Description.
|-
| 484E444B(HNDK)
| KOR
| [[Download Play]]
| v1024
| See Above Description.
|}

=== 0004800F - System Data Archives===
{| class="wikitable" border="1"
|-
! TitleID Low
! Description
! Versions
|-
| 484E4841(HNHA)
| [[Nintendo DS Cart Whitelist]]
| v0, [[2.0.0-2|v1026]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[4.2.0-9|v5120]], [[4.3.0-10|v6145]], [[4.4.0-10|v7168]], [[4.5.0-10|v8192]], [[5.0.0-11|v9216]], [[6.0.0-11|v10240]], [[7.0.0-13|v11264]]
|-
| 484E4C41(HNLA)
| [[Version Data]]
| v0
|}

New system updates only block DS flash-cards when the above whitelist was updated, or when TWL_FIRM was updated. The whitelist contains the data used for detecting flash-cards, this is used by TWL_FIRM.

=== 00048004 - DSiWare ===
Although these have a titleID high separate from DSi and a titleID is stored in the SRLs, the content of these SRLs are identical to DSi.

{| class="wikitable" border="1"
|-
! TitleID Low
! Region
! Description
! Versions
|-
| 4B4B5456(KKTV)
| EUR
| Cut the Rope
| v0, v64
|-
| 4B4E5256(KNRV)
| EUR
| A Little Bit of... Brain Training™: Maths Edition
| v0
|-
| 4B5A4C56(KZLV)
| EUR
| Plants vs. Zombies™
| v0
|-
| 4B454256(KEBV)
| EUR
| ELECTROPLANKTON (Hanenbow)
| v0
|-
| 4B513956(KQ9V)
| EUR
| Zelda: Four Swords Anniversary Edition
| v16
|-
| 4B574256(KWBV)
| EUR
| Mario Calculator
| v0
|-
| 4B574656(KWFV)
| EUR
| Mario Clock
| v0
|}

Title list

2017-02-22T01:11:21Z

MassExplosion213: /* 0004009B - System Data Archives (Shared Archives) */

NOTE: This Title list is a condensed version, only the System Titles lists are full lists. For a full list of titles on Nintendo's CDN, see [http://mtheall.com/~mtheall/tmdlist.php here]. The reports/title-lists from [https://yls8.mtheall.com/ninupdates/reports.php here] are automatically obtained from the system update SOAP.

== CTR System Titles ==
{| class="wikitable" border="1"
|-
! System Category
! Bit Mask(s)
! Category Bit Mask
|-
| Application (SYSTEM_APPLICATION)
| Normal<nowiki>|</nowiki>System
| 0x0010
|-
| System Data Archives (SYSTEM_CONTENT)
| Contents<nowiki>|</nowiki>CannotExecution<nowiki>|</nowiki>System
| 0x001B
|-
| Shared Data Archives (SHARED_CONTENT)
| Contents<nowiki>|</nowiki>CannotExecution<nowiki>|</nowiki>System<nowiki>|</nowiki>NotRequireRightForMount
| 0x009B
|-
| System Data Archives (AUTO_UPDATE_CONTENT)
| Contents<nowiki>|</nowiki>CannotExecution<nowiki>|</nowiki>System<nowiki>|</nowiki>NotRequireUserApproval<nowiki>|</nowiki>NotRequireRightForMount
| 0x00DB
|-
| Applet (APPLET)
| Normal<nowiki>|</nowiki>System<nowiki>|</nowiki>RequireBatchUpdate
| 0x0030
|-
| Module (BASE)
| Normal<nowiki>|</nowiki>System<nowiki>|</nowiki>RequireBatchUpdate<nowiki>|</nowiki>CanSkipConvertJumpId
| 0x0130
|-
| Firmware (FIRMWARE)
| Normal<nowiki>|</nowiki>CannotExecution<nowiki>|</nowiki>System<nowiki>|</nowiki>RequireBatchUpdate<nowiki>|</nowiki>CanSkipConvertJumpId
| 0x0138
|}

=== 00040010 - System Applications ===
The versions for CHN, KOR, and TWN are separate from the other regions.

{| class="wikitable" border="1"
|-
! JPN TIDLow
! USA TIDLow
! EUR TIDLow
! CHN TIDLow
! KOR TIDLow
! TWN TIDLow
! [[Product code]]
! Description
! JPN Versions
! EUR Versions
! USA Versions
! CHN Versions
! KOR Versions
! TWN Versions
! Status
|-
| 00020000
| 00021000
| 00022000
| 00026000
| 00027000
| 00028000
| CTR-N-HAS?
| [[System Settings]] (mset)
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[3.0.0-5|v2060]], [[4.0.0-7|v3074]], [[5.0.0-11|v4097]], [[6.0.0-11|v5127]], [[7.0.0-13|v6157]], [[7.2.0-17|v7173]], [[8.1.0-0_New3DS|v8198]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v9224]], [[9.6.0-24|v10245]], [[10.6.0-31|v10256]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[3.0.0-5|v2061]], [[4.0.0-7|v3075]], [[5.0.0-11|v4097]], [[6.0.0-11|v5127]], [[7.0.0-13|v6157]], [[7.2.0-17|v7174]], [[9.0.0-20|v8202]], [[9.6.0-24|v9220]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[3.0.0-5|v2062]], [[4.0.0-7|v3078]], [[5.0.0-11|v4098]], [[6.0.0-11|v5128]], [[7.0.0-13|v6157]], [[7.2.0-17|v7174]], [[9.0.0-20|v8203]], [[9.6.0-24|v9221]]
| [[4.0.0-7|v8]], [[4.4.0-10|v1024]](CHN-only sysupdate for just mset), [[5.0.0-11|v2049]], [[7.0.0-13|v3075]]
| [[4.0.0-7|v1026]], [[5.0.0-11|v2049]], [[7.0.0-13|v4098]]
| [[4.1.0-8|v8]], [[4.2.0-9|v1024]], [[5.0.0-11|v2050]], [[7.0.0-13|v3074]]
| Active
|-
| 00020100
| 00021100
| 00022100
| 00026100
| 00027100
| 00028100
| CTR-N-HDL?
| [[Download Play]] (dlplay)
| [[1.0.0-0|v0]], [[2.1.0-4|v1026]], [[4.0.0-7|v2051]], [[9.0.0-20|v3072]](Also for [[8.1.0-0_New3DS]])
| [[1.0.0-0|v0]], [[2.1.0-4|v1026]], [[4.0.0-7|v2051]], [[9.0.0-20|v3073]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1026]], [[4.0.0-7|v2051]], [[9.0.0-20|v3073]]
| [[4.0.0-7|v4]]
| [[4.0.0-7|v1027]]
| [[4.1.0-8|v4]]
| Active
|-
| 00020200
| 00021200
| 00022200
| 00026200
| 00027200
| 00028200
| CTR-N-HMK?
| [[Activity Log]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[3.0.0-5|v2051]], [[10.6.0-31|v2080]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[3.0.0-5|v2054]], [[7.0.0-13|v2064]]
| Same as EUR
| [[4.0.0-7|v3]]
| [[4.0.0-7|v2]], [[7.0.0-13|v16]]
| [[4.1.0-8|v2]]
| Active
|-
| 00020300
| 00021300
| 00022300
| 00026300
| 00027300
| 00028300
| ?
| [[Health and Safety Information]] (safe)
| [[1.0.0-0|v0]], [[4.0.0-7|v1024]], [[6.0.0-11|v2050]]
| [[1.0.0-0|v0]], [[3.0.0-5|v1024]], [[4.0.0-7|v2050]], [[6.0.0-11|v3077]]
| [[1.0.0-0|v0]], [[4.0.0-7|v1026]], [[6.1.0-12U|v2051]]
| [[4.0.0-7|v5]]
| [[4.0.0-7|v2]]
| [[4.1.0-8|v5]]
| Active
|-
| 20020300
| 20021300
| 20022300
| N/A
| 20027300
| N/A
| CTR-N-HAC?
| [[New_3DS]] [[Health and Safety Information]]
| [[8.1.0-0_New3DS|v2]], [[9.3.0-21|v17]]
| [[8.1.0-0_New3DS|v1]]
| Same as EUR.
| N/A
| [[9.6.0-24|v2]]
| N/A
| Active
|-
| 00020400
| 00021400
| 00022400
| 00026400
| 00027400
| 00028400
| CTR-N-HEP?
| [[Nintendo 3DS Camera]] (CtrApp)
| [[1.0.0-0|v0]], [[2.1.0-4|v16]], [[3.0.0-5|v1038]], [[4.0.0-7|v2048]], [[6.0.0-11|v3073]], [[9.0.0-20|v4097]](Also for [[8.1.0-0_New3DS]]), [[10.6.0-31|v4112]]
| [[1.0.0-0|v0]], [[2.1.0-4|v16]], [[3.0.0-5|v1039]], [[4.0.0-7|v2048]], [[6.0.0-11|v3073]], [[7.0.0-13|v3088]], [[9.0.0-20|v4097]]
| [[1.0.0-0|v0]], [[2.1.0-4|v16]], [[3.0.0-5|v1039]], [[4.0.0-7|v2048]], [[6.1.0-12U|v3074]], [[7.0.0-13|v3088]], [[9.0.0-20|v4097]]
| [[4.0.0-7|v3]]
| [[4.0.0-7|v2]], [[7.0.0-13|v1040]]
| [[4.1.0-8|v3]]
| Active
|-
| 00020500
| 00021500
| 00022500
| 00026500
| 00027500
| 00028500
| CTR-N-HES?
| [[Nintendo 3DS Sound]] (CtrApp)
| [[1.0.0-0|v0]], [[2.1.0-4|v1027]], [[3.0.0-5|v2049]], [[4.0.0-7|v3072]], [[7.0.0-13|v3089]], [[10.6.0-31|3104]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1027]], [[3.0.0-5|v2049]], [[4.0.0-7|v3072]], [[7.0.0-13|v3088]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1027]], [[3.0.0-5|v2049]], [[4.0.0-7|v3072]], [[7.0.0-13|v3088]]
| [[4.0.0-7|v2]]
| [[4.0.0-7|v2]], [[7.0.0-13|v16]]
| [[4.1.0-8|v3]]
| Active
|-
| 00020700
| 00021700
| 00022700
| 00026700
| 00027700
| 00028700
| CTR-N-HED?
| [[Mii Maker]] (EDIT)
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[7.0.0-13|v2055]], [[10.6.0-31|v2064]]
| Same as JPN
| Same as JPN
| [[4.0.0-7|v1]]
| [[4.0.0-7|v1]], [[7.0.0-13|v16]]
| [[4.1.0-8|v2]]
| Active
|-
| 00020800
| 00021800
| 00022800
| 00026800
| 00027800
| 00028800
| CTR-N-HME?
| [[StreetPass Mii Plaza]] (MEET)
| [[1.0.0-0|v0]], v1027, [[2.1.0-4|v2048]], [[3.0.0-5|v3087]], [[3.0.0-6|v4096]], [[6.0.0-11|v5121]]
| [[1.0.0-0|v0]], v1027, [[2.1.0-4|v2048]], [[3.0.0-5|v3087]], [[3.0.0-6|v4096]], [[6.0.0-11|v5122]]
| [[1.0.0-0|v0]], v1027, [[2.1.0-4|v2048]], [[3.0.0-5|v3087]], [[3.0.0-6|v4096]], [[6.1.0-12U|v5124]], [[7.0.0-13|v5136]]
| [[4.0.0-7|v0]], [[4.4.0-10|v4096]]
| [[4.0.0-7|v1]], [[4.4.0-10|v4096]], [[7.0.0-13|v5120]]
| [[4.1.0-8|v1]], [[4.4.0-10|v4096]]
| Active
|-
| 00020900
| 00021900
| 00022900
| N/A
| 00027900
| 00028900
| CTR-N-HGR?
| [[eShop]] (tiger)
| [[2.0.0-2|v4]], [[2.1.0-3|v1026]], [[3.0.0-5|v2057]], [[4.0.0-7|v3081]], [[4.1.0-8|v4096]], [[4.2.0-9|v5123]], [[4.3.0-10|v6146]], [[5.0.0-11|v7169]], [[7.0.0-13|v8206]], [[7.1.0-14|v9231]], [[7.2.0-17|v10245]], [[8.0.0-18|v11265]], [[8.1.0-19|v12288]], [[9.0.0-20|v13320]], [[9.3.0-21|v15366]], [[9.5.0-22|v16384]], [[9.6.0-24|v17421]], [[9.7.0-25|v18432]], [[10.0.0-27|v19465]], [[10.4.0-29|v20483]], [[10.7.0-32|v21504]], [[11.3.0-36|v23552]]
| [[2.0.0-2|v4]], [[2.1.0-3|v1026]], [[3.0.0-5|v2058]], [[4.0.0-7|v3081]], [[4.1.0-8|v4096]], [[4.2.0-9|v5123]], [[4.3.0-10|v6146]], [[5.0.0-11|v7171]], [[7.0.0-13|v8206]], [[7.1.0-14|v9231]], [[7.2.0-17|v10245]], [[8.0.0-18|v11265]], [[8.1.0-19|v12288]], [[9.0.0-20|v13320]], [[9.3.0-21|v15366]], [[9.5.0-22|v16384]], [[9.6.0-24|v17421]], [[9.7.0-25|v18432]], [[10.0.0-27|v19465]], [[10.4.0-29|v20482]], [[10.7.0-32|v21505]], [[11.2.0-35|v22528]], [[11.3.0-36|v23552]]
| [[2.0.0-2|v4]], [[2.1.0-3|v1026]], [[3.0.0-5|v2058]], [[4.0.0-7|v3081]], [[4.1.0-8|v4096]], [[4.2.0-9|v5123]], [[4.3.0-10|v6146]], [[5.0.0-11|v7170]], [[7.0.0-13|v8206]], [[7.1.0-14|v9231]], [[7.2.0-17|v10246]], [[8.0.0-18|v11265]], [[8.1.0-19|v12288]], [[9.0.0-20|v13321]], [[9.3.0-21|v15366]], [[9.5.0-22|v16384]], [[9.6.0-24|v17422]], [[9.7.0-25|v18432]], [[10.0.0-27|v19465]], [[10.4.0-29|v20482]], [[10.7.0-32|v21506]], [[11.3.0-36|v23552]]
| N/A
| [[4.0.0-7|v3082]], [[4.1.0-8|v4096]], [[4.2.0-9|v5123]], [[4.3.0-10|v6146]], [[5.0.0-11|v7169]], [[7.0.0-13|v8205]], [[7.1.0-14|v9231]], [[8.1.0-19|v12288]], [[9.0.0-20|v13320]], [[9.3.0-21|v15366]], [[9.5.0-22|v16384]], [[9.6.0-24|v17420]], [[9.7.0-25|v18432]], [[10.0.0-27|v19465]], [[10.4.0-29|v20482]]
| [[4.1.0-8|v4096]], [[4.2.0-9|v5123]], [[4.3.0-10|v6146]], [[5.0.0-11|v7170]], [[7.0.0-13|v8205]], [[7.1.0-14|v9231]], [[8.1.0-19|v12288]], [[9.3.0-21|v15366]], [[9.5.0-22|v16384]], [[9.6.0-24|v17421]], [[9.7.0-25|v18432]], [[10.0.0-27|v19465]]
| Active
|-
| 00020A00
| 00021A00
| 00022A00
| N/A
| 00027A00
| 00028A00
| CTR-N-HCB?
| [[System Transfer]] (CARDBOARD)
| [[2.0.0-2|v4]], [[3.0.0-5|v1035]], [[4.0.0-7|v2050]], [[5.0.0-11|v3074]], [[7.0.0-13|v4109]], [[9.0.0-20|v5130]], [[9.6.0-24|v6154]]
| [[2.0.0-2|v4]], [[3.0.0-5|v1035]], [[4.0.0-7|v2050]], [[5.0.0-11|v3073]], [[7.0.0-13|v4109]], [[9.0.0-20|v5131]], [[9.6.0-24|v6155]]
| [[2.0.0-2|v4]], [[3.0.0-5|v1035]], [[4.0.0-7|v2051]], [[5.0.0-11|v3073]], [[7.0.0-13|v4109]], [[9.0.0-20|v5131]], [[9.6.0-24|v6156]]
| N/A
| [[4.0.0-7|v2]], [[5.0.0-11|v1025]], [[7.0.0-13|v2061]], [[9.0.0-20|v3082]]
| [[4.1.0-8|v2]], [[5.0.0-11|v1025]], [[7.0.0-13|v2061]]
| Active
|-
| 00020B00
| 00021B00
| 00022B00
| N/A
| N/A
| N/A
| CTR-N-HMA?
| [[Nintendo Zone]] ("Nintendo")
| [[1.0.0-0|v0]], [[3.0.0-5|v1034]]
| Same as JPN
| Same as JPN
| N/A
| N/A
| N/A
| Active
|-
| 00020D00
| 00021D00
| 00022D00
| 00026D00
| 00027D00
| 00028D00
| CTR-N-HCH?
| [[Face Raiders]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1028]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1028]], [[7.0.0-13|v1040]]
| Same as EUR
| [[4.0.0-7|v0]]
| [[4.0.0-7|v0]]
| [[4.1.0-8|v2]]
| Active
|-
| 20020D00
| 20021D00
| 20022D00
| N/A
| 20027D00
| N/A
| ?
| [[New_3DS]] [[Face Raiders]]
| [[8.1.0-0_New3DS|v2050]]
| [[8.1.0-0_New3DS|v2049]]
| Same as EUR.
| N/A
| [[9.6.0-24|v2049]]
| N/A
| Active
|-
| 00020E00
| 00021E00
| 00022E00
| 00026E00
| 00027E00
| 00028E00
| CTR-N-HAR?
| [[AR Games]] (AR_ACT)
| [[1.0.0-0|v0]], [[2.1.0-4|v1026]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1026]], [[7.0.0-13|v1040]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1027]], [[7.0.0-13|v1040]]
| [[4.0.0-7|v0]]
| [[4.0.0-7|v0]], [[7.0.0-13|v16]]
| [[4.1.0-8|v1]]
| Active
|-
| 00020F00
| 00021F00
| 00022F00
| 00026F00
| 00027F00
| 00028F00
| CTR-N-HSH?
| SAFE_MODE [[System Settings#System Updater|System Updater]] (mset)
| [[1.0.0-0|v0]], [[3.0.0-5|v1024]], [[6.0.0-11|v2049]]
| [[1.0.0-0|v0]], [[3.0.0-5|v1024]], [[6.0.0-11|v2050]]
| Same as JPN
| [[4.0.0-7|v1]], [[6.0.0-11|v1026]]
| [[4.0.0-7|v1]]
| [[4.1.0-8|v1]]
| Active
|-
| 00023000
| 00024000
| 00025000
| N/A
| N/A
| N/A
| (Variable?)
| Promotional video
| [[1.1.0-1|v2]], [[2.0.0-2|v2048]]
| [[1.1.0-1|v<unknown>]], [[2.0.0-2|v2048]]
| [[1.1.0-1|v0]], [[2.0.0-2|v2048]]
| N/A
| N/A
| N/A
| Stubbed
|-
| 0002BF00
| 0002C000
| 0002C100
| N/A
| N/A
| N/A
| CTR-N-HAF?
| Nintendo Network ID Settings (act)
| [[7.0.0-13|v14]], [[7.2.0-17|v1029]], [[9.0.0-20|v2051]], [[9.3.0-21|v3072]]
| Same as JPN
| Same as JPN
| N/A
| N/A
| N/A
| Active
|-
| 20023100
| 20024100
| 20025100
| N/A
| N/A
| N/A
| CTR-N-HAJ?
| [[microSD Management]] ('mcopy') ([[New_3DS]]-only)
| [[8.1.0-0_New3DS|v8]], [[9.0.0-20|v1024]]
| [[8.1.0-0_New3DS|v4]]
| [[8.1.0-0_New3DS|v5]]
| N/A
| N/A
| N/A
| Available
|-
| 2002C800
| 2002CF00
| 2002D000
| N/A
| 2002D700
| N/A
| CTR-P-CTAP
| [[New_3DS]]-only, currently stubbed. "HOME menu/menu".
| [[8.1.0-0_New3DS|v2]], [[9.0.0-20|v18]], [[9.3.0-21|v34]], [[9.6.0-24|v50]]
| [[8.1.0-0_New3DS|v1]], [[9.3.0-21|v17]], [[9.6.0-24|v34]]
| [[8.1.0-0_New3DS|v1]], [[9.3.0-21|v18]], [[9.6.0-24|v33]]
| N/A
| [[9.6.0-24|v2]]
| N/A
| Stubbed
|-
| 2002C900
| 2002D100
| 2002D200
| N/A
| 2002D800
| N/A
| CTR-P-CTAP
| [[New_3DS]]-only, currently stubbed. "Friends list/friend".
| [[8.1.0-0_New3DS|v1]]
| Same as JPN.
| [[8.1.0-0_New3DS|v0]], [[9.3.0-21|v16]]
| N/A
| [[9.6.0-24|v2]]
| N/A
| Stubbed
|-
| 2002CA00
| 2002D300
| 2002D400
| N/A
| 2002D900
| N/A
| CTR-P-CTAP
| [[New_3DS]]-only, currently stubbed. "Notifications/newslist".
| [[8.1.0-0_New3DS|v0]], v1([[Home_Menu|JPN-only]] Oct 2, 2014 "sysupdate", actually uploaded on 09-29-14. Identical to v0, same TMDs besides title-versions)
| [[8.1.0-0_New3DS|v2]]
| [[8.1.0-0_New3DS|v0]]
| N/A
| [[9.6.0-24|v2]]
| N/A
| Stubbed
|-
| 2002CB00
| 2002D500
| 2002D600
| N/A
| 2002DA00
| N/A
| CTR-P-CTAP
| [[New_3DS]]-only, currently stubbed. "Game notes/cherry".
| [[8.1.0-0_New3DS|v0]], [[9.0.0-20|v1]]
| [[8.1.0-0_New3DS|v2]]
| Same as EUR.
| N/A
| [[9.6.0-24|v1]]
| N/A
| Stubbed
|}

The "act" application seems to use a web browser with webkit?

Regardless of version, the ExeFS:/.code for mset is the same for USA/EUR/JPN. The [[4.0.0-7]] version of mset([[4.1.0-8]] for TWN) has the same ExeFS:/.code for all regions(JPN, USA, EUR, CHN, KOR, TWN). The [[5.0.0-11]] mset ExeFS:/.code is the same for all regions as well, except for CHN. The [[7.0.0-13]] mset ExeFS:/.code is unique for the following regions: CHN, KOR, and TWN.

The ''only'' system-applications included with gamecard-sysupdates are: [[System Settings]], [[Download Play]], and SAFE_MODE [[System Settings#System Updater|System Updater]]. The only system-applications included with the New3DS gamecard-sysupdate partition are: "menu" stub and "friend" stub.

=== 0004001B - [[NCCH#CFA|System Data Archives]] ===
{| class="wikitable" border="1"
|-
! TitleID Low
! Description
! Versions
|-
| 00010002
| [[ClCertA]]
| [[1.0.0-0|v0]]
|-
| 00010702
| [[NS CFA]]
| [[3.0.0-5|v0]], [[6.0.0-11|v1028]], [[6.3.0-12|v2048]], [[7.0.0-13|v3073]], [[9.0.0-20|v4096]](also for [[8.1.0-0_New3DS]])
|-
| 00010802
| This CFA only contains a 1-byte "dummy.txt" in the RomFS, which contains '0'.
| [[6.3.0-12|v0]], [[9.5.0-23|v1024]], [[10.5.0-30|v2048]], [[11.0.0-33|v3072]]
|-
| 00018002
| Same contents as 00010802. Starting with [[7.1.0-15]], the "dummy.txt" file was removed from RomFS: this CFA RomFS now contains web-browser data(similar to 00018102) for NNID / networking, etc.
| [[7.0.0-13|v14]], [[7.1.0-15|v1025]], [[7.2.0-17|v2055]], [[9.0.0-20|v3078]], [[9.3.0-21|v4096]], [[9.6.0-24|v5120]]
|-
| 00018102
| This contains local web-browser data(html/js, gfx, etc) for the Miiverse Offline-mode.
| [[7.0.0-13|v11]], [[9.0.0-20|v1025]](also for [[8.1.0-0_New3DS]])
|-
| 00018202
| This contains the webkit/OSS [[CRO0|CROs]] used with the Miiverse applet and the "act" application.
| [[7.0.0-13|v7]], [[8.1.0-0_New3DS|v1026]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v2050]]
|-
| 00019002
| [[Fangate_updater]]
| [[9.3.0-21|v2]], [[9.6.0-24|v1026]]
|}

=== 00040030 - Applets===
{| class="wikitable" border="1"
|-
! JPN TitleIDLow
! USA TitleIDLow
! EUR TitleIDLow
! CHN TitleIDLow
! KOR TitleIDLow
! TWN TitleIDLow
! [[Product code]]
! Description
! JPN Versions
! USA Versions
! EUR Versions
|-
|colspan=6 align=center| 00008102
| CTR-P-CTAP
| [[NS#Alternate menu|Test Menu]] (Demo1)
|colspan=3 align=center| ..., v64, ..., v27648
|-
| 00008202
| 00008F02
| 00009802
| 0000A102
| 0000A902
| 0000B102
| CTR-P-HMM?
| [[Home Menu]] (menu)
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[2.1.0-3|v2049]], [[2.2.0-X|v3075]], [[3.0.0-5|v4111]], [[4.0.0-7|v5131]], [[4.2.0-9|v6146]], [[5.0.0-11|v7172]], [[6.0.0-11|v8198]], [[7.0.0-13|v9230]], [[8.1.0-0_New3DS|v10250]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v13313]], [[9.1.0-20J|v14336]], [[9.2.0-20|v15360]], [[9.3.0-21|v16402]], [[9.4.0-21|v17408]], [[9.5.0-22|v18432]], [[9.6.0-24|v19476]], [[9.7.0-25|v20487]], [[9.8.0-25|v22528]], [[10.1.0-27|v23552]], [[10.2.0-28|v24576]], [[10.3.0-28|v25600]], [[10.4.0-29|v26626]], [[10.6.0-31|v27648]], [[11.1.0-34|v28672]], [[11.3.0-36|v29696]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[2.1.0-3|v2049]], [[2.2.0-X|v3075]], [[3.0.0-5|v4111]], [[4.0.0-7|v5131]], [[4.2.0-9|v6146]], [[5.0.0-11|v7172]], [[6.0.0-11|v8198]], [[7.0.0-13|v9230]], [[9.0.0-20|v11272]], [[9.2.0-20|v12288]], [[9.3.0-21|v13330]], [[9.4.0-21|v14336]], [[9.5.0-22|v15360]], [[9.6.0-24|v16404]], [[9.7.0-25|v17415]], [[9.8.0-25|v19456]], [[9.9.0-26|v20480]], [[10.1.0-27|v21504]], [[10.2.0-28|v22528]], [[10.3.0-28|v23552]], [[10.4.0-29|v24578]], [[10.6.0-31|v25600]], [[11.1.0-34|v26624]], [[11.3.0-36|v27648]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[2.1.0-3|v2049]], [[2.2.0-X|v3075]], [[3.0.0-5|v4111]], [[4.0.0-7|v5131]], [[4.2.0-9|v6146]], [[5.0.0-11|v7172]], [[6.0.0-11|v8198]], [[7.0.0-13|v9230]], [[9.0.0-20|v11272]], [[9.2.0-20|v12288]], [[9.3.0-21|v13330]], [[9.4.0-21|v14336]], [[9.5.0-22|v15360]], [[9.6.0-24|v16404]], [[9.7.0-25|v17415]], [[9.8.0-25|v19456]], [[10.1.0-27|v20480]], [[10.2.0-28|v21504]], [[10.3.0-28|v22528]], [[10.4.0-29|v23554]], [[10.6.0-31|v24576]], [[11.1.0-34|v25600]], [[11.3.0-36|v26624]]
|-
| 00008402
| 00009002
| 00009902
| 0000A202
| 0000AA02
| 0000B202
| CTR-N-HCS?
| Camera applet used by Home-menu (CtrApp)
|colspan=3| v0, v1036, [[9.0.0-20|v2049]](Also for [[8.1.0-0_New3DS]])
|-
| 00008502
| 00009102
| 00009A02
| ?
| ?
| ?
| ?
| Not available on CDN
| ?
| ?
| ?
|-
| 00008602
| 00009202
| 00009B02
| 0000A402
| 0000AC02
| 0000B402
|
| Instruction Manual, applet for displaying instruction manuals
|colspan=3| v0, v1026, v2048, v3072, [[5.0.0-11|v4097]], [[9.0.0-20|v5120]](Also for [[8.1.0-0_New3DS]])
|-
| 00008702
| 00009302
| 00009C02
| 0000A502
| 0000AD02
| 0000B502
| CTR-N-HGM?
| Game Notes (Cherry)
|colspan=3| v0, v1026, v2049, [[5.0.0-11|v3073]], [[9.0.0-20|v4096]](Also for [[8.1.0-0_New3DS]])
|-
| 00008802
| 00009402
| 00009D02
| 0000A602
| 0000AE02
| 0000B602
|
| [[Internet Browser]] (spider)
|colspan=3| [[2.0.0-2|v6]], [[2.1.0-4|v1024]], [[4.0.0-7|v2050]], [[5.0.0-11|v3074 (EUR)/v3075(USA,JAP)]], [[7.0.0-13|v3088]], [[7.1.0-16|v4096]], [[9.5.0-23|v5121]], [[9.9.0-26|v6149]], [[10.2.0-28|v7168]], [[10.6.0-31|v8192]], [[10.7.0-32|v9232]], [[11.1.0-34|v10240]]
|-
| 20008802
| 20009402
| 20009D02
| ?
| 2000AE02
| N/A
| CTR-N-HBR?
| [[New 3DS]] [[Internet Browser]] (SKATER)
|colspan=3| [[8.1.0-0_New3DS|v10]], [[9.3.0-21|v1027]], [[9.6.0-24|v2051]], [[9.9.0-26|v3077]], [[10.2.0-28|v4096]], [[10.4.0-29|v5121]], [[10.6.0-31|v6144]], [[10.7.0-32|v7184]], [[11.1.0-34|v8192]]
|-
|colspan=6| 00008A02
|
| Fatal error viewer ([[ErrDisp]])
|colspan=3| v0, v1025, [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[5.0.0-11|v5121]], [[8.0.0-18|v6144]], [[9.0.0-20|v7168]](Also for [[8.1.0-0_New3DS]])
|-
|colspan=6| 00008A03
|
| SAFE_MODE [[ErrDisp]]
|colspan=3| v0
|-
| 20008A03
| 20008A03
| 20008A03
| ?
| 20008A03
| N/A
|
| [[New_3DS]] SAFE_MODE [[ErrDisp]]
|colspan=3| [[8.1.0-0_New3DS|v7169]]
|-
| 00008D02
| 00009602
| 00009F02
| 0000A702
| 0000AF02
| 0000B702
| CTR-N-HFR?
| Friend List (friend)
|colspan=3| v0, v1026, [[2.2.0-X|v2051]], v3082, v4099, [[7.0.0-13|v5120]], [[9.0.0-20|v6144]](Also for [[8.1.0-0_New3DS]]) (EUR v6, v1024, v3082, v4099, [[7.0.0-13|v5120]], [[9.0.0-20|v6144]])
|-
| 00008E02
| 00009702
| 0000A002
| 0000A802
| 0000B002
| 0000B802
| CTR-N-HCR?
| Notifications (newslist)
|colspan=3| v0, v1029, v2054, v3075, [[9.0.0-20|v4097]] (EUR v6, v1024, v2054, v3075, [[9.0.0-20|v4097]]) (JPN: ..., [[8.1.0-0_New3DS|v4096]], [[9.0.0-20|v5121]])
|-
| 0000C002
| 0000C802
| 0000D002
| 0000D802
| 0000DE02
| 0000E402
| CTR-N-HKY?
| Software Keyboard (swkbd)
|colspan=3| v0, v1026, v2053, [[7.0.0-13|v3072]], [[9.0.0-20|v4096]](Also for [[8.1.0-0_New3DS]])
|-
| 0000C003
| 0000C803
| 0000D003
| 0000D803
| 0000DE03
| 0000E403
|
| SAFE_MODE Software Keyboard (swkbd)
|colspan=3| v0
|-
| 2000C003
| 2000C803
| 2000D003
| ?
| 2000DE03
| N/A
|
| [[New 3DS]] SAFE_MODE Software Keyboard (swkbd)
| [[8.1.0-0_New3DS|v1024]]
|colspan=2|[[9.0.0-20|v0]]
|-
| 0000C102
| 0000C902
| 0000D102
| 0000D902
| 0000DF02
| 0000E502
|
| Mii picker (appletEd)
|colspan=3| v0, v1026, [[9.0.0-20|v2048]](Also for [[8.1.0-0_New3DS]]), [[9.3.0-21|v3077]]
|-
| 0000C302
| 0000CB02
| 0000D302
| 0000DB02
| 0000E102
| 0000E702
|
| Picture picker (PNOTE_AP)
|colspan=3| v0, v1024, [[8.1.0-0_New3DS|v2049]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v3075]], [[9.3.0-21|v4096]]
|-
| 0000C402
| 0000CC02
| 0000D402
| 0000DC02
| 0000E202
| 0000E802
|
| [[Nintendo 3DS Sound|Voice memo]] picker (SNOTE_AP)
|colspan=3| v0, v3, [[8.0.0-18|v1026]], [[9.0.0-20|v2048]](Also for [[8.1.0-0_New3DS]])
|-
|colspan=3| 0000C502
|colspan=3| 0000CF02
|
| Non-critical (online, etc) error display (error)
|colspan=3| v0, v1026, v2053, v3074, [[8.1.0-0_New3DS|v4096]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v5128]], [[9.6.0-24|v6145]]
|-
|colspan=3| 0000C503
|colspan=3| 0000CF03
|
| SAFE_MODE error applet
|colspan=3| v0
|-
| 2000C503
| 2000C503
| 2000C503
| ?
| 2000CF03
| N/A
|
| [[New 3DS]] SAFE_MODE error applet
|colspan=3| [[8.1.0-0_New3DS|v1024]]
|-
|colspan=3| 0000CD02
|colspan=3| 0000D502
|
| [[Circle Pad Pro]] test/calibration applet (extrapad)
|colspan=3| v1, v1026, [[8.1.0-0_New3DS|v2048]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v3073]]
|-
| 0000C602
| 0000CE02
| 0000D602
| N/A
| 0000E302
| 0000E902
| CTR-N-HAA?
| eShop applet, used by applications for accessing the eShop, for DLC/etc. Also used by the eShop application itself. (mint)
|colspan=3| v5, v1028, [[4.2.0-9|v2050]], [[5.0.0-11|v3072]], [[7.0.0-13|v4109]], [[7.2.0-17|v5125]](v5123 for JPN), [[8.0.0-18|v6145]], [[8.1.0-0_New3DS|v7168]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v8200]], [[9.3.0-21|v9224]], [[9.6.0-24|v10247]], [[9.8.0-25|v11264]], [[10.0.0-27|v12293]], [[10.1.0-27|v13312]], [[10.3.0-28|v14337]], [[10.4.0-29|v15360]], [[10.7.0-32|v16384]], [[11.2.0-35|v17408]](EUR), [[11.3.0-36|v18432]]
|-
| 0000BC02
| 0000BD02
| 0000BE02
| ?
| ?
| ?
| CTR-N-HAE?
| Miiverse (olv)
|colspan=3| [[7.0.0-13|v14]], [[7.2.0-17|v1024]], [[9.0.0-20|v2048]](Also for [[8.1.0-0_New3DS]]), [[9.3.0-21|v3072]], [[9.6.0-24|v4096]]
|-
| 0000F602
| 0000F602
| 0000F602
| ?
| ?
| ?
|
| Likely the "system library" for Miiverse (memolib)
|colspan=3| [[7.0.0-13|v5]], [[8.1.0-0_New3DS|v1024]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v2050]], [[9.3.0-21|v3072]]
|-
| 00008302
| 00008B02
| 0000BA02
| ?
| ?
| ?
| CTR-N-HAH?
| In-app Miiverse-posting applet (solv3)
|colspan=3| [[9.0.0-20|v6]]
|-
| 00009502
| 00009E02
| 0000B902
| ?
| 00008C02
| 0000BF02
| CTR-N-HA3?
| Cabinet ([[amiibo Settings]])
|colspan=3| [[9.3.0-21|v7]], (v1024 for TWN), [[9.6.0-24|v1031]]
|}

Most of these processes are applets, see [[NS_and_APT_Services|here]] for details.

All of the above processes use the "SYSTEM" [[SVC|memory-region]].

The ExeFS for Home Menu is exactly the same for USA/EUR/JPN.

The Miiverse applet seems to use a web browser with webkit.

=== 0004009B - [[NCCH#CFA|System Data Archives]] (Shared Archives) ===
{| class="wikitable" border="1"
|-
! JPN TitleIDLow
! USA TitleIDLow
! EUR TitleIDLow
! KOR TitleIDLow
! Description
! Versions
|-
| 00010202
| 00010202
| 00010202
| 00010202
| Probably Mii-related, contains "CFL_Res.dat" in the RomFS.
| v0
|-
| 00010302
| 00010302
| 00010302
|
| Only exists for (some?) dev-units.
| v0, v2052
|-
| 00010402
| 00010402
| 00010402
| 00010402
| Mounted as "area:", contains Country and Region names
| v0, v1024, v2050, v3072, [[7.0.0-13|v4098]], [[9.6.0-24|v5122]]
|-
| 00010502
| 00010502
| 00010502
|
| Only exists for (some?) dev-units.
| v0, v1024, v2048
|-
| 00010602
| 00010602
| 00010602
| 00010602
| Non-Nintendo TLS Root-CA Certificates (RomFS contains files with filename "CACERT_PUBLIC_CA_<val>.der", where <val> is 5..8)
| v2, [[10.5.0-30|v1024]]
|-
|
|
| 00011202
|
| "NL/NL" dictionary.
| v0
|-
|
|
| 00011302
|
| "EN/GB" dictionary.
| v0
|-
|
| 00011402
|
|
| "EN/US" dictionary.
| v0
|-
|
|
| 00011502
|
| "FR/FR/regular" dictionary.
| v0
|-
|
| 00011602
|
|
| "FR/CA/regular" dictionary.
| v0
|-
|
|
| 00011702
|
| "DE/regular" dictionary.
| v0
|-
|
|
| 00011802
|
| "IT/IT" dictionary.
| v0
|-
| 00011902
|
|
|
| "JA_small/32" dictionary.
| v0
|-
|
|
|
| 00011A02
| ?
| v1
|-
|
|
| 00011B02
|
| "PT/PT/regular" dictionary.
| v0
|-
|
|
| 00011C02
|
| "RU/regular" dictionary.
| v0
|-
|
| 00011D02
| 00011D02
|
| "ES/ES" dictionary.
| v0
|-
|
| 00011E02
|
|
| "PT/BR/regular" dictionary.
| v0
|-
| 00012202
| 00012302
| 00012102
| 00012502
| ?contains a lists with error strings
| v1026, v2053, v3073, [[4.2.0-9|v4096]], [[5.0.0-11|v5120]], [[7.0.0-13|v6149]], [[7.2.0-17|v7168]], [[8.0.0-18|v8192]], [[9.0.0-20|v9218]], [[9.3.0-21|v10242]], [[9.6.0-24|v11269]], [[10.0.0-27|v12289]], [[10.4.0-29|v13312]], [[10.7.0-32|v13313]] (JPN: [[11.1.0-34|v14336]]) (KOR: [[9.6.0-24|v6148]], [[10.0.0-27|v7169]], [[10.3.0-28|v8193]], [[10.4.0-29|v9216]], [[11.1.0-34|v10240]])
|-
| 00013202
| 00013302
| 00013102
| 00013502
| Mounted as "eula:"
| v0, v1024, v2049 USA: v1024, v2051, [[7.0.0-13|v3074]], [[7.2.0-17|v4100]](EUR-only), [[9.0.0-20|v4099]], [[9.9.0-26|v6144]], [[10.4.0-29|v7168]] (KOR: [[9.7.0-25|v1025]])
|-
| 00014002
| 00014002
| 00014002
| 00014002
| JPN/EUR/USA [[System Font]] ("font:")
| v0
|-
| 00014102
| 00014102
| 00014102
| 00014102
| CHN [[System Font]] ("font:")
| v0, v1024
|-
| 00014202
| 00014202
| 00014202
| 00014202
| KOR [[System Font]] ("font:")
| v0, v1024
|-
| 00014302
| 00014302
| 00014302
| 00014302
| TWN [[System Font]] ("font:")
| v0, v1024
|-
| 00015202
| 00015302
| 00015102
| 00015502
| Mounted as "rate:"
| v0 (EUR: v0, v1024) (KOR: v1024)
|}

=== 000400DB - [[NCCH#CFA|System Data Archives]] ===
These [[NVer]] titleIDs can be found @ offset 0x320 in every [[CCI]].

{| class="wikitable" border="1"
|-
! EUR TitleIDLow
! JPN TitleIDLow
! USA TitleIDLow
! CHN TitleIDLow
! KOR TitleIDLow
! TWN TitleIDLow
! Description
! USA/EUR/JPN Versions
! CHN Versions
! TWN Versions
! KOR Versions
|-
| 00010302
| 00010302
| 00010302
| 00010302
| 00010302
| 00010302
| NGWord bad word list
| [[1.0.0-0|v0]], [[2.0.0-2|v1024]], [[3.0.0-5|v2052]], [[4.0.0-7|v3072]], [[4.3.0-10|v4096]], [[5.0.0-11|v5120]], [[9.0.0-20|v6144]], [[9.3.0-21|v7168]], [[9.6.0-24|v8192]], [[11.1.0-34|v9217]]
| Same as USA
| Same as USA
| Same as USA
|-
| 00010502
| 00010502
| 00010502
| 00010502
| 00010502
| 00010502
| [[Nintendo Zone]] hotspot list
| [[1.0.0-0|v0]], [[2.0.0-2|v1024]], [[3.0.0-5|v2048]], [[4.0.0-7|v3073]], [[4.3.0-10|v4096]], [[4.4.0-10|v5120]], [[4.5.0-10|v6144]], [[5.0.0-11|v7169]], [[6.0.0-11|v8192]], [[6.2.0-12|v9216]], [[7.0.0-13|v10242]], [[7.2.0-17|v11267]], [[8.0.0-18|v12288]], [[9.0.0-20|v14336]], [[9.3.0-21|v15360]], [[9.6.0-24|v16386]], [[10.0.0-27|v17409]], [[10.4.0-29|v18432]], [[11.1.0-34|v19457]]
| Same as USA
| Same as USA
| Same as USA
|-
| 00016102
| 00016202
| 00016302
| 00016402
| 00016502
| 00016602
| [[NVer]]
| [[1.0.0-0|v0]], [[1.1.0-1|v16]], [[2.0.0-2|v32]], [[2.1.0-3|v48]], [[2.1.0-4|v64]], [[3.0.0-5|v80]], [[3.0.0-6|v96]], [[4.0.0-7|v112]], [[4.1.0-8|v128]], [[4.2.0-9|v144]], [[4.3.0-10|v160]], [[5.0.0-11|v176]], non-USA=[[6.0.0-11|v192]]/USA=[[6.1.0-12U|v192]], [[7.0.0-13|v208]], [[7.1.0-14|v224]], [[7.1.0-15|v240]], [[7.1.0-16|v256]], [[7.2.0-17|v272]], [[8.0.0-18|v288]], [[8.1.0-19|v304]], [[9.0.0-20|v320]], [[9.3.0-21|v336]], [[9.5.0-22|v352]], [[9.5.0-23|v368]], [[9.6.0-24|v384]], [[9.7.0-25|v400]], [[9.9.0-26|v416]], [[10.0.0-27|v432]], [[10.2.0-28|v448]], [[10.4.0-29|v464]], [[10.5.0-30|v480]], [[10.6.0-31|v496]], [[10.7.0-32|v512]], [[11.0.0-33|v528]], [[11.1.0-34|v544]], [[11.2.0-35|v560]], [[11.3.0-36|v576]]
| [[4.0.0-7|v113]], [[4.2.0-9|v128]], [[5.0.0-11|v129]], [[7.1.0-16|v130]], [[7.2.0-17|v272]], [[9.5.0-23|v131]], [[9.9.0-26|v132]]
| [[4.1.0-8|v114]], [[4.2.0-9|v133]], [[4.3.0-10|v134]], [[5.0.0-11|v136]], [[7.0.0-13|v144]], [[7.1.0-14|v160]] [[7.1.0-16|v192]], [[7.2.0-17|v272]], [[8.0.0-18|v208]], [[8.1.0-19|v224]], [[9.0.0-20|v240]], [[9.5.0-22|v272]], [[9.5.0-23|v288]], [[9.6.0-24|v304]], [[9.7.0-25|v320]], [[9.9.0-26|v336]], [[10.0.0-27|v352]], [[10.2.0-28|v368]], [[10.4.0-29|v384]], [[10.5.0-30|v400]], [[10.6.0-31|v416]], [[10.7.0-32|v432]], [[11.0.0-33|v448]], [[11.1.0-34|v464]], [[11.2.0-35|v480]], [[11.3.0-36|v496]]
| [[4.0.0-7|v113]], [[4.1.0-8|v114]], [[4.2.0-9|v133]], [[4.3.0-10|v134]], [[5.0.0-11|v136]], [[7.0.0-13|v160]], [[7.1.0-14|v176]], [[7.1.0-16|v176]], [[7.2.0-17|v272]], [[8.0.0-18|v224]], [[8.1.0-19|v240]], [[9.0.0-20|v256]], [[9.3.0-21|v272]], [[9.5.0-22|v288]], [[9.5.0-23|v304]], [[9.6.0-24|v320]], [[9.7.0-25|v336]], [[9.9.0-26|v352]], [[10.0.0-27|v368]], [[10.2.0-28|v384]], [[10.4.0-29|v400]], [[10.5.0-30|v416]], [[10.6.0-31|v432]], [[10.7.0-32|v448]], [[11.0.0-33|v464]], [[11.1.0-34|v480]], [[11.2.0-35|v496]], [[11.3.0-36|v512]]
|-
| 20016102
| 20016202
| 20016302
| N/A
| 20016502
| N/A
| [[New_3DS]] [[NVer]]
| [[8.1.0-0_New3DS|v0]], [[9.0.0-20|v320]], [[9.3.0-21|v336]], [[9.5.0-22|v352]], [[9.5.0-22|v352]], [[9.5.0-23|v368]], [[9.6.0-24|v384]], [[9.7.0-25|v400]], [[9.9.0-26|v416]], [[10.0.0-27|v432]], [[10.2.0-28|v448]], [[10.4.0-29|v464]], [[10.5.0-30|v480]], [[10.6.0-31|v496]], [[10.7.0-32|v512]], [[11.0.0-33|v528]], [[11.1.0-34|v544]], [[11.2.0-35|v560]], [[11.3.0-36|v576]]
| N/A
| N/A
| [[9.6.0-24|v320]], [[9.7.0-25|v336]], [[9.9.0-26|v352]], [[10.0.0-27|v368]], [[10.2.0-28|v384]], [[10.4.0-29|v400]], [[10.5.0-30|v416]], [[10.6.0-31|v432]], [[10.7.0-32|v448]], [[11.0.0-33|v464]], [[11.2.0-35|v496]], [[11.3.0-36|v512]]
|-
| 00017102
| 00017202
| 00017302
| 00017402
| 00017502
| 00017602
| [[CVer]]
| [[1.0.0-0|v1024]], [[1.1.0-1|v1045]], [[2.0.0-2|v2049]], [[2.1.0-3|v2069]], [[2.2.0-X|v2088]] [[3.0.0-5|v3088]], [[4.0.0-7|v4098]], [[4.1.0-8|v4113]], [[4.2.0-9|v4130]], [[4.3.0-10|v4145]], [[4.4.0-10|v4163]], [[4.5.0-10|v4176]], [[5.0.0-11|v5120]], [[5.1.0-11|v5136]], [[6.0.0-11|v6146]], [[6.1.0-11|v6160]], [[6.2.0-12|v6178]], [[6.3.0-12|v6192]], [[7.0.0-13|v7175]], [[7.1.0-14|v7187]], [[7.2.0-17|v7203]], [[8.0.0-18|v8196]], [[8.1.0-18|v8208]], [[8.1.0-0_New3DS|v8215]](8.1.0-0_New3DS), [[9.0.0-20|v9218]], [[9.1.0-20J|v9232]](JPN-only), [[9.2.0-20|v9248]], [[9.3.0-21|v9264]], [[9.4.0-21|v9280]], [[9.5.0-22|v9296]], [[9.6.0-24|v9319]], [[9.7.0-25|v9328]], [[9.8.0-25|v9344]], [[9.9.0-26|v9360]], [[10.0.0-27|v10240]], [[10.1.0-27|v10256]], [[10.2.0-28|v10272]], [[10.3.0-28|v10288]], [[10.4.0-29|v10304]], [[10.5.0-30|v10320]], [[10.6.0-31|v10336]], [[10.7.0-32|v10352]], [[11.0.0-33|v11264]], [[11.1.0-34|v11280]], [[11.2.0-35|v11296]], [[11.3.0-36|v11312]]
| [[1.0.0-0|v1024]], [[1.1.0-1|v1045]], [[2.0.0-2|v2049]], [[2.1.0-3|v2069]], [[2.2.0-X|v2088]] [[3.0.0-5|v3088]], [[4.0.0-7|v4098]], [[4.1.0-8|v4113]], [[4.2.0-9|v4130]], [[4.3.0-10|v4145]], [[4.4.0-10|v4163]], [[4.5.0-10|v4176]], [[5.0.0-11|v5120]], [[5.1.0-11|v5136]], [[6.0.0-11|v6146]], [[6.1.0-11|v6160]], [[6.2.0-12|v6178]], [[6.3.0-12|v6192]], [[7.0.0-13|v7175]], [[7.1.0-14|v7187]], [[7.2.0-17|v7203]], [[8.0.0-18|v8196]], [[8.1.0-18|v8208]], [[9.0.0-20|v9217]], [[9.3.0-21|v9264]], [[9.5.0-22|v9296]], [[9.6.0-24|v9319]], [[9.7.0-25|v9328]], [[9.8.0-25|v9344]], [[9.9.0-26|v9360]], [[10.0.0-27|v10240]], [[10.2.0-28|v10272]], [[10.4.0-29|v10304]], [[10.5.0-30|v10320]], [[10.6.0-31|v10336]], [[10.7.0-32|v10352]], [[11.2.0-35|v11296]], [[11.3.0-36|v11312]]
| Same as CHN
| Same as CHN + [[11.1.0-34|v11280]]
|}

=== 00040130 - System [[Services API|Modules]] ===
{| class="wikitable" border="1"
|-
! TitleID Low
! Description
! Versions
|-
| 00001002
| [[Services|sm]] (Stored in [[FIRM|NATIVE_FIRM]])
| N/A
|-
| 00001003
| SAFE_MODE [[Services|sm]] (Stored in SAFE_MODE NATIVE_FIRM)
| N/A
|-
| 00001102
| [[Filesystem services‎|fs]] (Stored in [[FIRM|NATIVE_FIRM]])
| N/A
|-
| 00001103
| SAFE_MODE [[Filesystem services‎|fs]] (Stored in SAFE_MODE NATIVE_FIRM)
| N/A
|-
| 00001202
| [[Process Manager Services|pm]] (Stored in [[FIRM|NATIVE_FIRM]])
| N/A
|-
| 00001203
| SAFE_MODE [[Process Manager Services|pm]] (Stored in SAFE_MODE NATIVE_FIRM)
| N/A
|-
| 00001302
| [[Loader Services‎|loader]] (Stored in [[FIRM|NATIVE_FIRM]])
| N/A
|-
| 00001303
| SAFE_MODE [[Loader Services‎|loader]] (Stored in SAFE_MODE NATIVE_FIRM)
| N/A
|-
| 00001402
| [[PXI Services‎|pxi]] (Stored in [[FIRM|NATIVE_FIRM]])
| N/A
|-
| 00001403
| SAFE_MODE [[PXI Services‎|pxi]] (Stored in SAFE_MODE NATIVE_FIRM)
| N/A
|-
| 00001502
| [[Application Manager Services|AM]] ( Application Manager )
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[3.0.0-5|v2053]], [[4.0.0-7|v3072]], [[5.0.0-11|v4098]], [[6.0.0-11|v5120]], [[8.0.0-18|v6148]], [[8.1.0-0_New3DS|v7168]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v8192]], [[10.0.0-27|v9217]]
|-
| 00001503
| SAFE_MODE [[Application Manager Services|AM]]
| [[1.0.0-0|v0]]
|-
| 20001503
| [[New_3DS]] SAFE_MODE [[Application Manager Services|AM]]
| [[8.1.0-0_New3DS|v7169]]
|-
| 00001602
| [[Camera Services|Camera]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[3.0.0-5|v2048]], [[4.0.0-7|v3074]], [[5.0.0-11|v4098]], [[6.0.0-11|v5120]], [[7.1.0-14|v6146]], [[8.0.0-18|v7172]], [[9.0.0-20|v9216]], [[9.3.0-21|v10242]], [[10.0.0-27|v11265]]
|-
| 20001602
| [[New_3DS]] [[Camera Services|Camera]]
| [[8.1.0-0_New3DS|v8200]], [[9.0.0-20|v9218]], [[9.3.0-21|v10242]], [[10.0.0-27|v11265]]
|-
| 00001702
| [[Config Services|Config]] (cfg)
| [[1.0.0-0|v0]], [[2.0.0-2|v1024]], [[3.0.0-5|v2049]], v3072, [[4.0.0-7|v4096]], [[5.0.0-11|v5122]], [[6.0.0-11|v6145]], [[6.1.0-11|v7168]], [[7.0.0-13|v8196]], [[7.2.0-17|v9220]], [[8.0.0-18|v10243]], [[8.1.0-0_New3DS|v11265]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v12290]], [[9.3.0-21|v13315]], [[9.6.0-24|v14342]]
|-
| 00001703
| SAFE_MODE [[Config Services|Config]] (cfg)
| [[1.0.0-0|v0]]
|-
| 20001703
| [[New_3DS]] SAFE_MODE [[Config Services|Config]] (cfg)
| [[8.1.0-0_New3DS|v11265]]
|-
| 00001802
| [[Codec Services|Codec]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[5.0.0-11|v4098]], [[7.0.0-13|v5120]], [[8.0.0-18|v6144]], [[9.0.0-20|v7168]](Also for [[8.1.0-0_New3DS]])
|-
| 00001803
| SAFE_MODE [[Codec Services|Codec]]
| [[1.0.0-0|v0]]
|-
| 20001803
| [[New_3DS]] SAFE_MODE [[Codec Services|Codec]]
| [[8.1.0-0_New3DS|v7169]]
|-
| 00001902
| dmnt, debugger sysmodule. This use devunit-only HIO for devunit<>pc comms. This only exists for development units(launched by NS during startup depending on certain [[Configuration_Memory]] fields' values). This is installed at the [[Factory_Setup|factory]], then later deleted at the factory on retail units.
|
|-
| 00001A02
| [[DSP Services|DSP]]
| [[1.0.0-0|v0]], [[3.0.0-5|v1024]], [[4.0.0-7|v2048]], [[5.0.0-11|v3074]], [[6.0.0-11|v4096]], [[8.0.0-18|v5120]], [[9.7.0-25|v6145]], [[11.1.0-34|v7169]]
|-
| 00001A03
| SAFE_MODE [[DSP Services|DSP]]
| [[1.0.0-0|v0]]
|-
| 20001A03
| [[New_3DS]] SAFE_MODE [[DSP Services|DSP]]
| [[8.1.0-0_New3DS|v6145]]
|-
| 00001B02
| [[GPIO Services|GPIO]]
| [[1.0.0-0|v0]], [[5.0.0-11|v1025]], [[8.0.0-18|v2048]], [[9.5.0-22|v3073]]
|-
| 00001B03
| SAFE_MODE [[GPIO Services|GPIO]]
| [[1.0.0-0|v0]]
|-
| 20001B03
| [[New_3DS]] SAFE_MODE [[GPIO Services|GPIO]]
| [[8.1.0-0_New3DS|v3073]]
|-
| 00001C02
| [[GSP Services|GSP]]
| [[1.0.0-0|v0]], [[1.1.0-1|v1040]], [[2.0.0-2|v2049]], [[3.0.0-5|v3075]], v4098, [[4.0.0-7|v5120]], [[5.0.0-11|v6145]], [[6.0.0-11|v7168]], [[8.0.0-18|v8196]], [[9.0.0-20|v10240]], [[9.3.0-21|v11264]], [[9.6.0-24|v12294]], [[11.3.0-36|v13312]]
|-
| 20001C02
| [[New_3DS]] [[GSP Services|GSP]]
| [[8.1.0-0_New3DS|v10243]], [[9.3.0-21|v11267]], [[9.6.0-24|v12294]], [[11.3.0-36|v13312]]
|-
| 00001C03
| SAFE_MODE [[GSP Services|GSP]]
| [[1.0.0-0|v0]]
|-
| 20001C03
| [[New_3DS]] SAFE_MODE [[GSP Services|GSP]]
| [[8.1.0-0_New3DS|v9217]]
|-
| 00001D02
| [[HID Services|HID]] (Human Interface Devices)
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[5.0.0-11|v5121]], [[7.2.0-17|v6148]], [[8.0.0-18|v7168]], [[8.1.0-0_New3DS|v8192]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v9216]], [[9.3.0-21|v10240]]
|-
| 00001D03
| SAFE_MODE [[HID Services|HID]]
| [[1.0.0-0|v0]]
|-
| 20001D03
| [[New_3DS]] SAFE_MODE [[HID Services|HID]]
| [[8.1.0-0_New3DS|v8193]]
|-
| 00001E02
| [[I2C Services|i2c]]
| [[1.0.0-0|v0]], [[3.0.0-5|v1024]], [[5.0.0-11|v2049]], [[8.0.0-18|v3076]], [[9.3.0-21|v5120]]
|-
| 20001E02
| [[New_3DS]] [[I2C Services|i2c]]
| [[8.1.0-0_New3DS|v4096]], [[9.3.0-21|v5121]]
|-
| 00001E03
| SAFE_MODE [[I2C Services|i2c]]
| [[1.0.0-0|v0]]
|-
| 20001E03
| [[New_3DS]] SAFE_MODE [[I2C Services|i2c]]
| [[8.1.0-0_New3DS|v4097]]
|-
| 00001F02
| [[MCU Services|MCU]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.1.0-3|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4102]], [[5.0.0-11|v5122]], [[6.0.0-11|v6145]], [[7.0.0-13|v7168]], [[8.0.0-18|v8192]]
|-
| 20001F02
| [[New_3DS]] [[MCU Services|MCU]]
| [[8.1.0-0_New3DS|v8192]]
|-
| 00001F03
| SAFE_MODE [[MCU Services|MCU]]
| [[1.0.0-0|v0]]
|-
| 20001F03
| [[New_3DS]] SAFE_MODE [[MCU Services|MCU]]
| [[8.1.0-0_New3DS|v9217]]
|-
| 00002002
| [[MIC Services|MIC]] (Microphone)
| [[1.0.0-0|v0]], [[5.0.0-11|v1025]], [[8.0.0-18|v2048]]
|-
| 00002102
| [[PDN Services|PDN]]
| [[1.0.0-0|v0]], [[5.0.0-11|v1025]], [[8.0.0-18|v2048]]
|-
| 00002103
| SAFE_MODE [[PDN Services|PDN]]
| [[1.0.0-0|v0]]
|-
| 20002103
| [[New_3DS]] SAFE_MODE [[PDN Services|PDN]]
| [[8.1.0-0_New3DS|v3073]]
|-
| 00002202
| [[PTM Services|PTM]] (Play time, pedometer, and battery manager)
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.2.0-X|v2048]], [[3.0.0-5|v3075]], v4096, [[4.0.0-7|v5120]], [[5.0.0-11|v6146]], [[6.0.0-11|v7168]], [[7.0.0-13|v8192]], [[8.0.0-18|v9219]], [[9.6.0-24|v11264]]
|-
| 20002202
| [[New_3DS]] [[PTM Services|PTM]] (Play time, pedometer, and battery manager)
| [[8.1.0-0_New3DS|v10240]], [[9.6.0-24|v11264]]
|-
| 00002203
| SAFE_MODE [[PTM Services|PTM]]
| [[1.0.0-0|v0]]
|-
| 20002203
| [[New_3DS]] SAFE_MODE [[PTM Services|PTM]]
| [[8.1.0-0_New3DS|v10241]]
|-
| 00002302
| [[SPI Services|spi]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[5.0.0-11|v2049]], [[8.0.0-18|v3072]]
|-
| 20002302
| [[New_3DS]] [[SPI Services|spi]]
| [[8.1.0-0_New3DS|v4096]]
|-
| 00002303
| SAFE_MODE [[SPI Services|spi]]
| [[1.0.0-0|v0]]
|-
| 20002303
| [[New_3DS]] SAFE_MODE [[SPI Services|spi]]
| [[8.1.0-0_New3DS|v4097]]
|-
| 00002402
| [[AC Services|AC]] (Network manager)
| [[1.0.0-0|v0]], [[1.1.0-1|v1024]], [[2.0.0-2|v2052]], [[2.1.0-3|v3072]], [[3.0.0-5|v4101]], [[5.0.0-11|v5122]], [[7.0.0-13|v6145]], [[8.0.0-18|v7172]], [[9.0.0-20|v8192]](Also for [[8.1.0-0_New3DS]]), [[9.3.0-21|v9216]]
|-
| 00002403
| SAFE_MODE [[AC Services|AC]]
| [[1.0.0-0|v0]]
|-
| 20002403
| [[New_3DS]] SAFE_MODE [[AC Services|AC]]
| [[8.1.0-0_New3DS|v8193]]
|-
| 00002602
| [[CECD Services|Cecd]] (StreetPass)
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.2.0-X|v2048]], [[3.0.0-5|v3073]], [[4.0.0-7|v4097]], [[5.0.0-11|v5122]], [[6.0.0-11|v6144]], [[6.2.0-12|v7170]], [[7.0.0-13|v8193]], [[8.0.0-18|v9216]], [[9.0.0-20|v10240]]
|-
| 00002702
| [[CSND Services|CSND]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[4.0.0-7|v2048]], [[5.0.0-11|v3073]], [[8.0.0-18|v4096]], [[9.0.0-20|v5120]]
|-
| 00002703
| SAFE_MODE [[CSND Services|CSND]]
| [[1.0.0-0|v0]]
|-
| 20002703
| [[New_3DS]] SAFE_MODE [[CSND Services|CSND]]
| [[8.1.0-0_New3DS|v5121]]
|-
| 00002802
| [[DLP Services|DLP]] ([[Download Play]])
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.2.0-X|v2048]], [[3.0.0-5|v3078]], [[5.0.0-11|v4099]], [[8.0.0-18|v5123]], [[9.0.0-20|v6145]](Also for [[8.1.0-0_New3DS]]), [[9.6.0-24|v7174]], [[10.0.0-27|v8192]]
|-
| 00002902
| [[HTTP Services|HTTP]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.1.0-3|v2049]], [[2.2.0-X|v3072]], [[3.0.0-5|v4099]], [[4.0.0-7|v5122]], [[5.0.0-11|v6145]], [[7.0.0-13|v7171]], [[7.1.0-14|v8192]], [[8.0.0-18|v9220]], [[8.1.0-18|v10245]], [[8.1.0-0_New3DS|v11264]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v12288]], [[9.6.0-24|v13318]]
|-
| 00002903
| SAFE_MODE [[HTTP Services|HTTP]]
| [[1.0.0-0|v0]]
|-
| 20002903
| [[New_3DS]] SAFE_MODE [[HTTP Services|HTTP]]
| [[8.1.0-0_New3DS|v10241]]
|-
| 00002A02
| [[MP Services|MP]]
| [[1.0.0-0|v0]], [[5.0.0-11|v1025]], [[8.0.0-18|v2048]]
|-
| 00002A03
| SAFE_MODE [[MP Services|MP]]
| [[1.0.0-0|v0]]
|-
| 00002B02
| [[NDM Services|NDM]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[3.0.0-5|v2049]], [[4.0.0-7|v3072]], [[5.0.0-11|v4098]], [[8.0.0-18|v5124]], [[8.1.0-0_New3DS|v6144]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v7169]]
|-
| 00002C02
| [[NIM Services|NIM]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1028]], [[3.0.0-5|v2055]], [[4.0.0-7|v3074]], [[5.0.0-11|v4100]], [[6.0.0-11|v5120]], [[7.0.0-13|v6148]], [[7.2.0-17|v7174]], [[8.0.0-18|v8195]], [[8.1.0-0_New3DS|v9217]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v10249]], [[9.3.0-21|v11267]], [[9.6.0-24|v12296]], [[10.0.0-27|v13313]]
|-
| 00002C03
| SAFE_MODE [[NIM Services|NIM]]
| [[1.0.0-0|v0]]
|-
| 20002C03
| [[New_3DS]] SAFE_MODE [[NIM Services|NIM]]
| [[8.1.0-0_New3DS|v9217]]
|-
| 00002D02
| [[NWM Services|NWM]] ( Low-level wifi manager )
| [[1.0.0-0|v0]], [[1.1.0-1|v1024]], [[2.0.0-2|v2052]], [[2.2.0-X|v3072]], [[3.0.0-5|v4101]], [[4.0.0-7|v5120]], [[5.0.0-11|v6148]], [[6.0.0-11|v7169]], [[7.2.0-17|v8196]], [[8.0.0-18|v9216]], [[9.0.0-20|v10240]]
|-
| 00002D03
| SAFE_MODE [[NWM Services|NWM]]
| [[1.0.0-0|v0]], [[6.0.0-11|v5120]]
|-
| 20002D03
| [[New_3DS]] SAFE_MODE [[NWM Services|NWM]]
| [[8.1.0-0_New3DS|v10241]]
|-
| 00002E02
| [[Socket Services|Sockets]]
| [[1.0.0-0|v0]], [[1.1.0-1|v1024]], [[2.0.0-2|v2053]], [[3.0.0-5|v3075]], [[4.0.0-7|v4096]], [[5.0.0-11|v5121]], [[8.0.0-18|v6144]], [[9.0.0-20|v7168]], [[10.6.0-31|v8192]]
|-
| 00002E03
| SAFE_MODE [[Socket Services|Sockets]]
| [[1.0.0-0|v0]]
|-
| 20002E03
| [[New_3DS]] SAFE_MODE [[Socket Services|Sockets]]
| [[8.1.0-0_New3DS|v7169]]
|-
| 00002F02
| [[SSL Services|SSL]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1024]], [[2.1.0-3|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[5.0.0-11|v5122]], [[8.0.0-18|v6144]], [[9.0.0-20|v7168]], [[9.6.0-24|v8198]]
|-
| 00002F03
| SAFE_MODE [[SSL Services|SSL]]
| [[1.0.0-0|v0]]
|-
| 20002F03
| [[New_3DS]] SAFE_MODE [[SSL Services|SSL]]
| [[8.1.0-0_New3DS|v7169]]
|-
| 00003000
| [[FIRM|Process9]] (in SAFE_MODE and normal NATIVE_FIRM)
| N/A
|-
| 00003102
| [[Process Services‎|PS]] ( Process Manager )
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[5.0.0-11|v2049]], [[6.0.0-11|v3072]], [[8.0.0-18|v4096]], [[9.0.0-20|v5120]]
|-
| 00003103
| SAFE_MODE [[Process Services‎|PS]]
| [[1.0.0-0|v0]]
|-
| 20003103
| [[New_3DS]] SAFE_MODE [[Process Services‎|PS]]
| [[8.1.0-0_New3DS|v5121]]
|-
| 00003202
| [[Friend Services‎|friends]] (Friends list)
| [[1.0.0-0|v0]], [[2.0.0-2|v1028]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[5.0.0-11|v5122]], [[7.0.0-13|v6145]], [[8.0.0-18|v7172]], [[9.0.0-20|v8192]](Also for [[8.1.0-0_New3DS]]), [[10.5.0-30|v9216]], [[10.7.0-32|v10240]], [[11.0.0-33|v11264]], [[11.1.0-34|v12288]], [[11.2.0-35|v13312]], [[11.3.0-36|v14336]]
|-
| 00003203
| SAFE_MODE [[Friend Services‎|friends]] (Friends list)
| [[1.0.0-0|v0]]
|-
| 20003203
| [[New_3DS]] SAFE_MODE [[Friend Services‎|friends]] (Friends list)
| [[8.1.0-0_New3DS|v8193]]
|-
| 00003302
| [[IR Services‎|IR]] (Infrared)
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[5.0.0-11|v5121]], [[8.0.0-18|v6148]], [[8.1.0-0_New3DS|v7170]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v8192]], [[9.3.0-21|v9216]], [[9.6.0-24|v10246]], [[10.0.0-27|v11265]], [[10.6.0-31|v12289]]
|-
| 00003303
| SAFE_MODE [[IR Services‎|IR]]
| [[1.0.0-0|v0]]
|-
| 20003303
| [[New_3DS]] SAFE_MODE [[IR Services‎|IR]]
| [[8.1.0-0_New3DS|v7169]]
|-
| 00003402
| [[BOSS Services‎|BOSS]] (SpotPass)
| [[1.0.0-0|v0]], [[1.1.0-1|v1024]], [[2.0.0-2|v2053]], [[2.2.0-X|v3073]], [[3.0.0-5|v4101]], [[4.0.0-7|v5122]], [[5.0.0-11|v6146]], [[6.0.0-11|v7169]], [[6.2.0-12|v8193]], [[7.0.0-13|v9222]], [[8.0.0-18|v10240]], [[9.0.0-20|v11266]], [[10.0.0-27|v12289]], [[10.4.0-29|v13314]]
|-
| 00003502
| [[News Services‎|News]] (Notifications)
| [[1.0.0-0|v0]], [[2.0.0-2|v1028]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[5.0.0-11|v4097]], [[8.0.0-18|v5120]], [[9.0.0-20|v6147]], [[9.7.0-25|v7168]]
|-
| 00003602
| "debugger". This only exist for development units(launched by NS during startup depending on certain [[Configuration_Memory]] fields' values).
|
|-
| 00003702
| [[RO_Services|RO]]
| [[2.0.0-2|v0]], [[4.0.0-7|v1024]], [[5.0.0-11|v2049]], [[7.2.0-17|v3074]], [[8.0.0-18|v4096]], [[9.0.0-20|v5120]](Also for [[8.1.0-0_New3DS]]), [[9.3.0-21|v6148]]
|-
| 00003802
| [[ACT Services‎|act]] (handles Nintendo Network '''a'''c'''c'''oun'''t'''s)
| [[7.0.0-13|v1029]], [[7.1.0-14|v2050]], [[7.2.0-17|v3077]], [[8.0.0-18|v4099]], [[8.1.0-0_New3DS|v5120]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v6144]], [[9.3.0-21|v7168]], [[9.6.0-24|v8198]]
|-
| 00004002
| Old3DS [[NFC_Services|nfc]]
| [[9.3.0-21|v2053]], [[9.6.0-24|v4106]], [[9.7.0-25|v5121]], [[10.0.0-27|v6145]], [[10.6.0-31|v7168]], [[10.7.0-32|v8192]]
|-
| 20004002
| [[New_3DS]] [[NFC_Services|nfc]]
| [[8.1.0-0_New3DS|v0]], [[9.0.0-20|v1024]], [[9.3.0-21|v2053]], [[9.5.0-22|v3073]], [[9.6.0-24|v4102]], [[10.0.0-27|v6145]], [[10.6.0-31|v7168]]
|-
| 20004102
| [[New_3DS]] [[MVD Services|mvd]]
| [[8.1.0-0_New3DS|v0]], [[9.0.0-20|v1024]]
|-
| 20004202
| [[New_3DS]] [[QTM Services|qtm]]
| [[8.1.0-0_New3DS|v8]], [[9.0.0-20|v1024]], [[9.3.0-21|v2052]]
|-
| 00008002
| [[NS]] (Memory-region: "SYSTEM")
| [[1.0.0-0|v0]], [[2.0.0-2|v1028]], [[2.2.0-X|v2048]], [[3.0.0-5|v3077]], v4096, [[4.0.0-7|v5121]], [[5.0.0-11|v6148]], [[5.1.0-11|v7168]], [[6.0.0-11|v8193]], [[6.1.0-11|v9216]], [[7.0.0-13|v10248]], [[7.2.0-17|v11268]], [[8.0.0-18|v12291]], [[8.1.0-0_New3DS|v13312]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v14336]], [[9.3.0-21|v15360]], [[9.6.0-24|v16390]], [[9.8.0-25|v17408]], [[10.0.0-27|v18433]], [[10.4.0-29|v19458]], [[11.1.0-34|v20482]], [[11.3.0-36|v21504]]
|-
| 00008003
| SAFE_MODE [[NS]] (Memory-region: "SYSTEM")
| [[1.0.0-0|v0]]
|-
| 20008003
| [[New_3DS]] SAFE_MODE [[NS]] (Memory-region: "SYSTEM")
| [[8.1.0-0_New3DS|v13313]]
|}

Once Home Menu finishes loading, all of the above system modules are running, except for MP, RO, and act which are automatically [[Process_Manager_Services|loaded]] when a process requires them. When [[Process_Manager_Services|PM]]-module terminates processes, it will check whether the processes listed as dependencies for this process are listed as dependencies for other processes. Any processes which are no longer listed in any processes dependencies lists are then terminated. On [[New_3DS]], the only New3DS-specific system-module which automatically gets loaded during system boot is qtm.

All of the above system modules use the "BASE" [[SVC|memory-region]](specified in the exheader), except when listed otherwise for certain modules.

When handling the exheader dependency list starting with [[8.0.0-18]], Old3DS FIRM [[Process_Manager_Services|PM]]-module now skips handling titles in this list which have any bits in programID-low bitmask 0xF0000000 set(with [[8.0.0-18]] this is hard-coded). The exheader dependency list handling change is for the [[New 3DS]] system-module(s), which do not exist on Old3DS. When the New3DS pm-module is launching any title except [[NS]], it first attempts to launch the title with programID-low bitmask 0x20000000 set, then with that bitmask clear if launching fails.

=== 00040138 - [[FIRM|System Firmware]] ===
NATIVE_FIRM and SAFE_MODE_FIRM for the initial versions are exactly the same, besides [[Configuration_Memory|core-version]] fields. SAFE_MODE_FIRM is used for running SAFE_MODE titles, on retail SAFE_MODE_FIRM seems to be only used for running the [[System_Settings#System_Updater|System Updater]] application. When a GBA VC title is launched, AGB_FIRM is launched to handle running this title. GBA VC savegames stored under SD card /title/<TID>/data use a custom format, this is handled by AGB_FIRM.

{| class="wikitable" border="1"
|-
! TitleID Low
! Description
! USA/EUR/JPN Versions
! CHN Versions
! KOR Versions
! TWN Versions
|-
| 00000001
| Unknown, very similar to SAFE_MODE_FIRM. Exists only on dev units and seems to only be used by SystemUpdaters.
| v0
|
|
|
|-
| 00000002
| NATIVE_FIRM (Native Firmware)
| [[1.0.0-0|v432]], [[1.1.0-1|v1472]], [[2.0.0-2|v2516]], [[2.1.0-3|v3553]], [[2.2.0-X|v4595]], [[3.0.0-5|v5647]], [[4.0.0-7|v6677]], [[4.1.0-8|v7712]], [[5.0.0-11|v8758]], [[5.1.0-11|v9792]], [[6.0.0-11|v10833]], [[6.1.0-11|v11872]], [[7.0.0-13|v12916]], [[7.2.0-17|v13956]], v15043, [[8.0.0-18|v15047]], [[9.0.0-20|v17120]], [[9.3.0-21|v18182]], [[9.5.0-22|v19216]], [[9.6.0-24|v20262]], [[10.0.0-27|v21288]], [[10.2.0-28|v22313]], [[10.4.0-29|v23341]], [[11.0.0-33|v24368]], [[11.1.0-34|v25396]], [[11.2.0-35|v26432]], [[11.3.0-36|v27476]]
| Same as USA/EUR/JPN starting with the USA/EUR/JPN [[4.0.0-7]] title-version
| Same as CHN.
| Same as CHN.
|-
| 20000002
| [[New_3DS]] NATIVE_FIRM (Native Firmware)
| [[8.1.0-0_New3DS|v16085]], [[9.0.0-20|v17120]], [[9.3.0-21|v18182]], [[9.5.0-22|v19218]], [[9.6.0-24|v20262]], [[10.0.0-27|v21288]], [[10.2.0-28|v22313]], [[10.4.0-29|v23341]], [[11.0.0-33|v24368]], [[11.1.0-34|v25396]], [[11.2.0-35|v26432]], [[11.3.0-36|v27476]]
| N/A
| Same as CHN.
| Same as CHN.
|-
| 00000003
| SAFE_MODE_FIRM
| [[1.0.0-0|v432]], [[3.0.0-5|v5632]]
| Same as USA/EUR/JPN starting with the USA/EUR/JPN [[3.0.0-5]] title-version
| Same as CHN.
| Same as CHN.
|-
| 20000003
| [[New_3DS]] SAFE_MODE_FIRM
| [[8.1.0-0_New3DS|v16081]]
| N/A
| Same as CHN.
| Same as CHN.
|-
| 00000102
| TWL_FIRM ( DSi Firmware )
| [[1.0.0-0|v432]], [[2.0.0-2|v1489]], [[3.0.0-5|v2565]], v3601, [[4.0.0-7|v4625]], [[4.4.0-10|v5681]], [[4.5.0-10|v6704]], [[6.0.0-11|v7762]], [[6.2.0-12|v8817]]
| Same as USA/EUR/JPN starting with the USA/EUR/JPN [[4.0.0-7]] title-version
| Same as CHN.
| Same as CHN.
|-
| 20000102
| [[New_3DS]] TWL_FIRM ( DSi Firmware )
| [[8.1.0-0_New3DS|v9936]]
| N/A
| Same as CHN.
| Same as CHN.
|-
| 00000202
| AGB_FIRM ( GBA Firmware )
| [[3.0.0-5|v519]], v1553, [[4.0.0-7|v2576]], [[6.0.0-11|v3665]]
| [[4.0.0-7|v2576]]
| [[4.0.0-7|v2576]], [[6.0.0-11|v3665]]
| Same as CHN.
|-
| 20000202
| [[New_3DS]] AGB_FIRM ( GBA Firmware )
| [[8.1.0-0_New3DS|v4816]]
| N/A
| N/A
| N/A
|}

== Application Titles ==
{| class="wikitable" border="1"
|-
! Content Category
! Bit Mask(s)
! Category Bit Mask
|-
| [[Title list/eShop Titles|Application]] (eShop Title)
| Normal
| 0x0000
|-
| DLP Child
| DlpChild
| 0x0001
|-
| [[EShop Demos|Demo]]
| Demo
| 0x0002
|-
| [[Title list/Patches|Patch]]
| CannotExecution<nowiki>|</nowiki>Patch
| 0x000E
|-
| [[Title list/DLC|Add-on Content]] (DLC)
| NotRequireRightForMount<nowiki>|</nowiki>CannotExecution<nowiki>|</nowiki>AddOnContents
| 0x008C
|}

=== 00040001 - [[Download Play]] Titles ===
This titleID-high/programID-high is used for the titles sent over [[Download Play]]. Only one 00040001 Download Play title is installed to NAND /title at a time. There can be a maximum of 255 Download Play child titles per Unique ID, indexed by Title ID Variation. The legal index range: 0x0 - 0xff.

== Other Titles ==
{| class="wikitable" border="1"
|-
! TitleID
! Description
! Versions
|-
| 000400000F802A00
| Unknown. Appears to be a [[9.8.0-25|gamecard]] title. See also [[11.3.0-36|here]].
Used during [[Nintendo_Service_Center_Tools|repair]], first non-system title listed in [[PTM_Services|playlog]] from repair.
|
|-
| 000400000F802100
| Used during [[Nintendo_Service_Center_Tools|repair]], second non-system title listed in [[PTM_Services|playlog]] from repair.
|
|-
| 000400000F802200
| Used during [[Nintendo_Service_Center_Tools|repair]], third non-system title listed in [[PTM_Services|playlog]] from repair.
|
|-
| 0004003000008900
| Used by retail NS for appID 0xF10, but this isn't available on retail CDN.
| ?
|-
| 000400000FFFFD00
| Used by retail NS for appID 0xF11, but this isn't available on retail CDN.
| ?
|-
| 000400000FFFFC00
| Used by retail NS for appID 0xF12, but this isn't available on retail CDN.
| ?
|-
| 000400000FFFFB00
| Used by retail NS for appID 0xF13, but this isn't available on retail CDN.
| ?
|-
| 000400000FFFF900
| Used by retail NS for appID 0xF14, but this isn't available on retail CDN.
| ?
|-
| 000400000FFFF800
| Used by retail NS for appID 0xF15, but this isn't available on retail CDN.
| ?
|-
| 000400000FFFF700
| Used by retail NS for appID 0xF16, but this isn't available on retail CDN.
| ?
|-
| 000400000FFFF600
| Used by retail NS for appID 0xF17, but this isn't available on retail CDN.
| ?
|-
| 000400000FFFF500
| Used by retail NS for appID 0xF18, but this isn't available on retail CDN.
| ?
|}

This section is for hard-coded titleIDs referenced in codebins on retail. This can include [[Factory_Setup|factory]]/[[Nintendo_Service_Center_Tools|repair]] titles as well.

== TWL (DSi) Titles ==

{| class="wikitable" border="1"
|-
! Content Category
! Bit Mask(s)
! Category Bit Mask
|-
| Application (DSiWare)
| TWL<nowiki>|</nowiki>0x4
| 0x8004
|-
| System Application
| TWL<nowiki>|</nowiki>0x1<nowiki>|</nowiki>0x4
| 0x8005
|-
| System Archive
| TWL<nowiki>|</nowiki>0x1<nowiki>|</nowiki>0x2<nowiki>|</nowiki>0x4<nowiki>|</nowiki>0x8
| 0x800F
|-
| Developer Tool
| TWL<nowiki>|</nowiki>0x1<nowiki>|</nowiki>0x4<nowiki>|</nowiki>0x10
| 0x8015
|}

Bitmask 0x1 for TWL titles denotes a system title (determining whether the title will be updated during a System Update). It appears to be sufficient, but not necessary, to make the title invisible on the [[Home Menu]].

Bitmask 0x2 for TWL titles may indicate no-execute.

Bitmask 0x4 for TWL titles indicates internal storage.

Bitmask 0x10 for TWL titles is found on developer tools.

=== 00048005 - System Applications===
{| class="wikitable" border="1"
|-
! TitleID Low
! Region
! Description
! Versions
! Information
|-
| 42383841(B88A)
| ALL
| [[DS Internet]]
| v0, [[2.1.0-4|v1025]], [[3.0.0-5|v2048]]
| [[DS Internet]] is the DS-mode application, (also integrated in every online-enabled DS game) and now accessible through [[System Settings]] for configuring network settings for DS software.
|-
| 484E4441(HNDA)
| ALL
| [[Download Play]]
| v1024
| This [[Download Play]] application is the DS-mode Download Play client, launched by the 3DS-mode Download Play application.
|-
| 484E4443(HNDC)
| CHN
| [[Download Play]]
| v1024
| See Above Description.
|-
| 484E444B(HNDK)
| KOR
| [[Download Play]]
| v1024
| See Above Description.
|}

=== 0004800F - System Data Archives===
{| class="wikitable" border="1"
|-
! TitleID Low
! Description
! Versions
|-
| 484E4841(HNHA)
| [[Nintendo DS Cart Whitelist]]
| v0, [[2.0.0-2|v1026]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[4.2.0-9|v5120]], [[4.3.0-10|v6145]], [[4.4.0-10|v7168]], [[4.5.0-10|v8192]], [[5.0.0-11|v9216]], [[6.0.0-11|v10240]], [[7.0.0-13|v11264]]
|-
| 484E4C41(HNLA)
| [[Version Data]]
| v0
|}

New system updates only block DS flash-cards when the above whitelist was updated, or when TWL_FIRM was updated. The whitelist contains the data used for detecting flash-cards, this is used by TWL_FIRM.

=== 00048004 - DSiWare ===
Although these have a titleID high separate from DSi and a titleID is stored in the SRLs, the content of these SRLs are identical to DSi.

{| class="wikitable" border="1"
|-
! TitleID Low
! Region
! Description
! Versions
|-
| 4B4B5456(KKTV)
| EUR
| Cut the Rope
| v0, v64
|-
| 4B4E5256(KNRV)
| EUR
| A Little Bit of... Brain Training™: Maths Edition
| v0
|-
| 4B5A4C56(KZLV)
| EUR
| Plants vs. Zombies™
| v0
|-
| 4B454256(KEBV)
| EUR
| ELECTROPLANKTON (Hanenbow)
| v0
|-
| 4B513956(KQ9V)
| EUR
| Zelda: Four Swords Anniversary Edition
| v16
|-
| 4B574256(KWBV)
| EUR
| Mario Calculator
| v0
|-
| 4B574656(KWFV)
| EUR
| Mario Clock
| v0
|}

Title list

2017-02-22T01:08:59Z

MassExplosion213: /* 0004009B - System Data Archives (Shared Archives) */

NOTE: This Title list is a condensed version, only the System Titles lists are full lists. For a full list of titles on Nintendo's CDN, see [http://mtheall.com/~mtheall/tmdlist.php here]. The reports/title-lists from [https://yls8.mtheall.com/ninupdates/reports.php here] are automatically obtained from the system update SOAP.

== CTR System Titles ==
{| class="wikitable" border="1"
|-
! System Category
! Bit Mask(s)
! Category Bit Mask
|-
| Application (SYSTEM_APPLICATION)
| Normal<nowiki>|</nowiki>System
| 0x0010
|-
| System Data Archives (SYSTEM_CONTENT)
| Contents<nowiki>|</nowiki>CannotExecution<nowiki>|</nowiki>System
| 0x001B
|-
| Shared Data Archives (SHARED_CONTENT)
| Contents<nowiki>|</nowiki>CannotExecution<nowiki>|</nowiki>System<nowiki>|</nowiki>NotRequireRightForMount
| 0x009B
|-
| System Data Archives (AUTO_UPDATE_CONTENT)
| Contents<nowiki>|</nowiki>CannotExecution<nowiki>|</nowiki>System<nowiki>|</nowiki>NotRequireUserApproval<nowiki>|</nowiki>NotRequireRightForMount
| 0x00DB
|-
| Applet (APPLET)
| Normal<nowiki>|</nowiki>System<nowiki>|</nowiki>RequireBatchUpdate
| 0x0030
|-
| Module (BASE)
| Normal<nowiki>|</nowiki>System<nowiki>|</nowiki>RequireBatchUpdate<nowiki>|</nowiki>CanSkipConvertJumpId
| 0x0130
|-
| Firmware (FIRMWARE)
| Normal<nowiki>|</nowiki>CannotExecution<nowiki>|</nowiki>System<nowiki>|</nowiki>RequireBatchUpdate<nowiki>|</nowiki>CanSkipConvertJumpId
| 0x0138
|}

=== 00040010 - System Applications ===
The versions for CHN, KOR, and TWN are separate from the other regions.

{| class="wikitable" border="1"
|-
! JPN TIDLow
! USA TIDLow
! EUR TIDLow
! CHN TIDLow
! KOR TIDLow
! TWN TIDLow
! [[Product code]]
! Description
! JPN Versions
! EUR Versions
! USA Versions
! CHN Versions
! KOR Versions
! TWN Versions
! Status
|-
| 00020000
| 00021000
| 00022000
| 00026000
| 00027000
| 00028000
| CTR-N-HAS?
| [[System Settings]] (mset)
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[3.0.0-5|v2060]], [[4.0.0-7|v3074]], [[5.0.0-11|v4097]], [[6.0.0-11|v5127]], [[7.0.0-13|v6157]], [[7.2.0-17|v7173]], [[8.1.0-0_New3DS|v8198]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v9224]], [[9.6.0-24|v10245]], [[10.6.0-31|v10256]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[3.0.0-5|v2061]], [[4.0.0-7|v3075]], [[5.0.0-11|v4097]], [[6.0.0-11|v5127]], [[7.0.0-13|v6157]], [[7.2.0-17|v7174]], [[9.0.0-20|v8202]], [[9.6.0-24|v9220]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[3.0.0-5|v2062]], [[4.0.0-7|v3078]], [[5.0.0-11|v4098]], [[6.0.0-11|v5128]], [[7.0.0-13|v6157]], [[7.2.0-17|v7174]], [[9.0.0-20|v8203]], [[9.6.0-24|v9221]]
| [[4.0.0-7|v8]], [[4.4.0-10|v1024]](CHN-only sysupdate for just mset), [[5.0.0-11|v2049]], [[7.0.0-13|v3075]]
| [[4.0.0-7|v1026]], [[5.0.0-11|v2049]], [[7.0.0-13|v4098]]
| [[4.1.0-8|v8]], [[4.2.0-9|v1024]], [[5.0.0-11|v2050]], [[7.0.0-13|v3074]]
| Active
|-
| 00020100
| 00021100
| 00022100
| 00026100
| 00027100
| 00028100
| CTR-N-HDL?
| [[Download Play]] (dlplay)
| [[1.0.0-0|v0]], [[2.1.0-4|v1026]], [[4.0.0-7|v2051]], [[9.0.0-20|v3072]](Also for [[8.1.0-0_New3DS]])
| [[1.0.0-0|v0]], [[2.1.0-4|v1026]], [[4.0.0-7|v2051]], [[9.0.0-20|v3073]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1026]], [[4.0.0-7|v2051]], [[9.0.0-20|v3073]]
| [[4.0.0-7|v4]]
| [[4.0.0-7|v1027]]
| [[4.1.0-8|v4]]
| Active
|-
| 00020200
| 00021200
| 00022200
| 00026200
| 00027200
| 00028200
| CTR-N-HMK?
| [[Activity Log]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[3.0.0-5|v2051]], [[10.6.0-31|v2080]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[3.0.0-5|v2054]], [[7.0.0-13|v2064]]
| Same as EUR
| [[4.0.0-7|v3]]
| [[4.0.0-7|v2]], [[7.0.0-13|v16]]
| [[4.1.0-8|v2]]
| Active
|-
| 00020300
| 00021300
| 00022300
| 00026300
| 00027300
| 00028300
| ?
| [[Health and Safety Information]] (safe)
| [[1.0.0-0|v0]], [[4.0.0-7|v1024]], [[6.0.0-11|v2050]]
| [[1.0.0-0|v0]], [[3.0.0-5|v1024]], [[4.0.0-7|v2050]], [[6.0.0-11|v3077]]
| [[1.0.0-0|v0]], [[4.0.0-7|v1026]], [[6.1.0-12U|v2051]]
| [[4.0.0-7|v5]]
| [[4.0.0-7|v2]]
| [[4.1.0-8|v5]]
| Active
|-
| 20020300
| 20021300
| 20022300
| N/A
| 20027300
| N/A
| CTR-N-HAC?
| [[New_3DS]] [[Health and Safety Information]]
| [[8.1.0-0_New3DS|v2]], [[9.3.0-21|v17]]
| [[8.1.0-0_New3DS|v1]]
| Same as EUR.
| N/A
| [[9.6.0-24|v2]]
| N/A
| Active
|-
| 00020400
| 00021400
| 00022400
| 00026400
| 00027400
| 00028400
| CTR-N-HEP?
| [[Nintendo 3DS Camera]] (CtrApp)
| [[1.0.0-0|v0]], [[2.1.0-4|v16]], [[3.0.0-5|v1038]], [[4.0.0-7|v2048]], [[6.0.0-11|v3073]], [[9.0.0-20|v4097]](Also for [[8.1.0-0_New3DS]]), [[10.6.0-31|v4112]]
| [[1.0.0-0|v0]], [[2.1.0-4|v16]], [[3.0.0-5|v1039]], [[4.0.0-7|v2048]], [[6.0.0-11|v3073]], [[7.0.0-13|v3088]], [[9.0.0-20|v4097]]
| [[1.0.0-0|v0]], [[2.1.0-4|v16]], [[3.0.0-5|v1039]], [[4.0.0-7|v2048]], [[6.1.0-12U|v3074]], [[7.0.0-13|v3088]], [[9.0.0-20|v4097]]
| [[4.0.0-7|v3]]
| [[4.0.0-7|v2]], [[7.0.0-13|v1040]]
| [[4.1.0-8|v3]]
| Active
|-
| 00020500
| 00021500
| 00022500
| 00026500
| 00027500
| 00028500
| CTR-N-HES?
| [[Nintendo 3DS Sound]] (CtrApp)
| [[1.0.0-0|v0]], [[2.1.0-4|v1027]], [[3.0.0-5|v2049]], [[4.0.0-7|v3072]], [[7.0.0-13|v3089]], [[10.6.0-31|3104]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1027]], [[3.0.0-5|v2049]], [[4.0.0-7|v3072]], [[7.0.0-13|v3088]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1027]], [[3.0.0-5|v2049]], [[4.0.0-7|v3072]], [[7.0.0-13|v3088]]
| [[4.0.0-7|v2]]
| [[4.0.0-7|v2]], [[7.0.0-13|v16]]
| [[4.1.0-8|v3]]
| Active
|-
| 00020700
| 00021700
| 00022700
| 00026700
| 00027700
| 00028700
| CTR-N-HED?
| [[Mii Maker]] (EDIT)
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[7.0.0-13|v2055]], [[10.6.0-31|v2064]]
| Same as JPN
| Same as JPN
| [[4.0.0-7|v1]]
| [[4.0.0-7|v1]], [[7.0.0-13|v16]]
| [[4.1.0-8|v2]]
| Active
|-
| 00020800
| 00021800
| 00022800
| 00026800
| 00027800
| 00028800
| CTR-N-HME?
| [[StreetPass Mii Plaza]] (MEET)
| [[1.0.0-0|v0]], v1027, [[2.1.0-4|v2048]], [[3.0.0-5|v3087]], [[3.0.0-6|v4096]], [[6.0.0-11|v5121]]
| [[1.0.0-0|v0]], v1027, [[2.1.0-4|v2048]], [[3.0.0-5|v3087]], [[3.0.0-6|v4096]], [[6.0.0-11|v5122]]
| [[1.0.0-0|v0]], v1027, [[2.1.0-4|v2048]], [[3.0.0-5|v3087]], [[3.0.0-6|v4096]], [[6.1.0-12U|v5124]], [[7.0.0-13|v5136]]
| [[4.0.0-7|v0]], [[4.4.0-10|v4096]]
| [[4.0.0-7|v1]], [[4.4.0-10|v4096]], [[7.0.0-13|v5120]]
| [[4.1.0-8|v1]], [[4.4.0-10|v4096]]
| Active
|-
| 00020900
| 00021900
| 00022900
| N/A
| 00027900
| 00028900
| CTR-N-HGR?
| [[eShop]] (tiger)
| [[2.0.0-2|v4]], [[2.1.0-3|v1026]], [[3.0.0-5|v2057]], [[4.0.0-7|v3081]], [[4.1.0-8|v4096]], [[4.2.0-9|v5123]], [[4.3.0-10|v6146]], [[5.0.0-11|v7169]], [[7.0.0-13|v8206]], [[7.1.0-14|v9231]], [[7.2.0-17|v10245]], [[8.0.0-18|v11265]], [[8.1.0-19|v12288]], [[9.0.0-20|v13320]], [[9.3.0-21|v15366]], [[9.5.0-22|v16384]], [[9.6.0-24|v17421]], [[9.7.0-25|v18432]], [[10.0.0-27|v19465]], [[10.4.0-29|v20483]], [[10.7.0-32|v21504]], [[11.3.0-36|v23552]]
| [[2.0.0-2|v4]], [[2.1.0-3|v1026]], [[3.0.0-5|v2058]], [[4.0.0-7|v3081]], [[4.1.0-8|v4096]], [[4.2.0-9|v5123]], [[4.3.0-10|v6146]], [[5.0.0-11|v7171]], [[7.0.0-13|v8206]], [[7.1.0-14|v9231]], [[7.2.0-17|v10245]], [[8.0.0-18|v11265]], [[8.1.0-19|v12288]], [[9.0.0-20|v13320]], [[9.3.0-21|v15366]], [[9.5.0-22|v16384]], [[9.6.0-24|v17421]], [[9.7.0-25|v18432]], [[10.0.0-27|v19465]], [[10.4.0-29|v20482]], [[10.7.0-32|v21505]], [[11.2.0-35|v22528]], [[11.3.0-36|v23552]]
| [[2.0.0-2|v4]], [[2.1.0-3|v1026]], [[3.0.0-5|v2058]], [[4.0.0-7|v3081]], [[4.1.0-8|v4096]], [[4.2.0-9|v5123]], [[4.3.0-10|v6146]], [[5.0.0-11|v7170]], [[7.0.0-13|v8206]], [[7.1.0-14|v9231]], [[7.2.0-17|v10246]], [[8.0.0-18|v11265]], [[8.1.0-19|v12288]], [[9.0.0-20|v13321]], [[9.3.0-21|v15366]], [[9.5.0-22|v16384]], [[9.6.0-24|v17422]], [[9.7.0-25|v18432]], [[10.0.0-27|v19465]], [[10.4.0-29|v20482]], [[10.7.0-32|v21506]], [[11.3.0-36|v23552]]
| N/A
| [[4.0.0-7|v3082]], [[4.1.0-8|v4096]], [[4.2.0-9|v5123]], [[4.3.0-10|v6146]], [[5.0.0-11|v7169]], [[7.0.0-13|v8205]], [[7.1.0-14|v9231]], [[8.1.0-19|v12288]], [[9.0.0-20|v13320]], [[9.3.0-21|v15366]], [[9.5.0-22|v16384]], [[9.6.0-24|v17420]], [[9.7.0-25|v18432]], [[10.0.0-27|v19465]], [[10.4.0-29|v20482]]
| [[4.1.0-8|v4096]], [[4.2.0-9|v5123]], [[4.3.0-10|v6146]], [[5.0.0-11|v7170]], [[7.0.0-13|v8205]], [[7.1.0-14|v9231]], [[8.1.0-19|v12288]], [[9.3.0-21|v15366]], [[9.5.0-22|v16384]], [[9.6.0-24|v17421]], [[9.7.0-25|v18432]], [[10.0.0-27|v19465]]
| Active
|-
| 00020A00
| 00021A00
| 00022A00
| N/A
| 00027A00
| 00028A00
| CTR-N-HCB?
| [[System Transfer]] (CARDBOARD)
| [[2.0.0-2|v4]], [[3.0.0-5|v1035]], [[4.0.0-7|v2050]], [[5.0.0-11|v3074]], [[7.0.0-13|v4109]], [[9.0.0-20|v5130]], [[9.6.0-24|v6154]]
| [[2.0.0-2|v4]], [[3.0.0-5|v1035]], [[4.0.0-7|v2050]], [[5.0.0-11|v3073]], [[7.0.0-13|v4109]], [[9.0.0-20|v5131]], [[9.6.0-24|v6155]]
| [[2.0.0-2|v4]], [[3.0.0-5|v1035]], [[4.0.0-7|v2051]], [[5.0.0-11|v3073]], [[7.0.0-13|v4109]], [[9.0.0-20|v5131]], [[9.6.0-24|v6156]]
| N/A
| [[4.0.0-7|v2]], [[5.0.0-11|v1025]], [[7.0.0-13|v2061]], [[9.0.0-20|v3082]]
| [[4.1.0-8|v2]], [[5.0.0-11|v1025]], [[7.0.0-13|v2061]]
| Active
|-
| 00020B00
| 00021B00
| 00022B00
| N/A
| N/A
| N/A
| CTR-N-HMA?
| [[Nintendo Zone]] ("Nintendo")
| [[1.0.0-0|v0]], [[3.0.0-5|v1034]]
| Same as JPN
| Same as JPN
| N/A
| N/A
| N/A
| Active
|-
| 00020D00
| 00021D00
| 00022D00
| 00026D00
| 00027D00
| 00028D00
| CTR-N-HCH?
| [[Face Raiders]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1028]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1028]], [[7.0.0-13|v1040]]
| Same as EUR
| [[4.0.0-7|v0]]
| [[4.0.0-7|v0]]
| [[4.1.0-8|v2]]
| Active
|-
| 20020D00
| 20021D00
| 20022D00
| N/A
| 20027D00
| N/A
| ?
| [[New_3DS]] [[Face Raiders]]
| [[8.1.0-0_New3DS|v2050]]
| [[8.1.0-0_New3DS|v2049]]
| Same as EUR.
| N/A
| [[9.6.0-24|v2049]]
| N/A
| Active
|-
| 00020E00
| 00021E00
| 00022E00
| 00026E00
| 00027E00
| 00028E00
| CTR-N-HAR?
| [[AR Games]] (AR_ACT)
| [[1.0.0-0|v0]], [[2.1.0-4|v1026]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1026]], [[7.0.0-13|v1040]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1027]], [[7.0.0-13|v1040]]
| [[4.0.0-7|v0]]
| [[4.0.0-7|v0]], [[7.0.0-13|v16]]
| [[4.1.0-8|v1]]
| Active
|-
| 00020F00
| 00021F00
| 00022F00
| 00026F00
| 00027F00
| 00028F00
| CTR-N-HSH?
| SAFE_MODE [[System Settings#System Updater|System Updater]] (mset)
| [[1.0.0-0|v0]], [[3.0.0-5|v1024]], [[6.0.0-11|v2049]]
| [[1.0.0-0|v0]], [[3.0.0-5|v1024]], [[6.0.0-11|v2050]]
| Same as JPN
| [[4.0.0-7|v1]], [[6.0.0-11|v1026]]
| [[4.0.0-7|v1]]
| [[4.1.0-8|v1]]
| Active
|-
| 00023000
| 00024000
| 00025000
| N/A
| N/A
| N/A
| (Variable?)
| Promotional video
| [[1.1.0-1|v2]], [[2.0.0-2|v2048]]
| [[1.1.0-1|v<unknown>]], [[2.0.0-2|v2048]]
| [[1.1.0-1|v0]], [[2.0.0-2|v2048]]
| N/A
| N/A
| N/A
| Stubbed
|-
| 0002BF00
| 0002C000
| 0002C100
| N/A
| N/A
| N/A
| CTR-N-HAF?
| Nintendo Network ID Settings (act)
| [[7.0.0-13|v14]], [[7.2.0-17|v1029]], [[9.0.0-20|v2051]], [[9.3.0-21|v3072]]
| Same as JPN
| Same as JPN
| N/A
| N/A
| N/A
| Active
|-
| 20023100
| 20024100
| 20025100
| N/A
| N/A
| N/A
| CTR-N-HAJ?
| [[microSD Management]] ('mcopy') ([[New_3DS]]-only)
| [[8.1.0-0_New3DS|v8]], [[9.0.0-20|v1024]]
| [[8.1.0-0_New3DS|v4]]
| [[8.1.0-0_New3DS|v5]]
| N/A
| N/A
| N/A
| Available
|-
| 2002C800
| 2002CF00
| 2002D000
| N/A
| 2002D700
| N/A
| CTR-P-CTAP
| [[New_3DS]]-only, currently stubbed. "HOME menu/menu".
| [[8.1.0-0_New3DS|v2]], [[9.0.0-20|v18]], [[9.3.0-21|v34]], [[9.6.0-24|v50]]
| [[8.1.0-0_New3DS|v1]], [[9.3.0-21|v17]], [[9.6.0-24|v34]]
| [[8.1.0-0_New3DS|v1]], [[9.3.0-21|v18]], [[9.6.0-24|v33]]
| N/A
| [[9.6.0-24|v2]]
| N/A
| Stubbed
|-
| 2002C900
| 2002D100
| 2002D200
| N/A
| 2002D800
| N/A
| CTR-P-CTAP
| [[New_3DS]]-only, currently stubbed. "Friends list/friend".
| [[8.1.0-0_New3DS|v1]]
| Same as JPN.
| [[8.1.0-0_New3DS|v0]], [[9.3.0-21|v16]]
| N/A
| [[9.6.0-24|v2]]
| N/A
| Stubbed
|-
| 2002CA00
| 2002D300
| 2002D400
| N/A
| 2002D900
| N/A
| CTR-P-CTAP
| [[New_3DS]]-only, currently stubbed. "Notifications/newslist".
| [[8.1.0-0_New3DS|v0]], v1([[Home_Menu|JPN-only]] Oct 2, 2014 "sysupdate", actually uploaded on 09-29-14. Identical to v0, same TMDs besides title-versions)
| [[8.1.0-0_New3DS|v2]]
| [[8.1.0-0_New3DS|v0]]
| N/A
| [[9.6.0-24|v2]]
| N/A
| Stubbed
|-
| 2002CB00
| 2002D500
| 2002D600
| N/A
| 2002DA00
| N/A
| CTR-P-CTAP
| [[New_3DS]]-only, currently stubbed. "Game notes/cherry".
| [[8.1.0-0_New3DS|v0]], [[9.0.0-20|v1]]
| [[8.1.0-0_New3DS|v2]]
| Same as EUR.
| N/A
| [[9.6.0-24|v1]]
| N/A
| Stubbed
|}

The "act" application seems to use a web browser with webkit?

Regardless of version, the ExeFS:/.code for mset is the same for USA/EUR/JPN. The [[4.0.0-7]] version of mset([[4.1.0-8]] for TWN) has the same ExeFS:/.code for all regions(JPN, USA, EUR, CHN, KOR, TWN). The [[5.0.0-11]] mset ExeFS:/.code is the same for all regions as well, except for CHN. The [[7.0.0-13]] mset ExeFS:/.code is unique for the following regions: CHN, KOR, and TWN.

The ''only'' system-applications included with gamecard-sysupdates are: [[System Settings]], [[Download Play]], and SAFE_MODE [[System Settings#System Updater|System Updater]]. The only system-applications included with the New3DS gamecard-sysupdate partition are: "menu" stub and "friend" stub.

=== 0004001B - [[NCCH#CFA|System Data Archives]] ===
{| class="wikitable" border="1"
|-
! TitleID Low
! Description
! Versions
|-
| 00010002
| [[ClCertA]]
| [[1.0.0-0|v0]]
|-
| 00010702
| [[NS CFA]]
| [[3.0.0-5|v0]], [[6.0.0-11|v1028]], [[6.3.0-12|v2048]], [[7.0.0-13|v3073]], [[9.0.0-20|v4096]](also for [[8.1.0-0_New3DS]])
|-
| 00010802
| This CFA only contains a 1-byte "dummy.txt" in the RomFS, which contains '0'.
| [[6.3.0-12|v0]], [[9.5.0-23|v1024]], [[10.5.0-30|v2048]], [[11.0.0-33|v3072]]
|-
| 00018002
| Same contents as 00010802. Starting with [[7.1.0-15]], the "dummy.txt" file was removed from RomFS: this CFA RomFS now contains web-browser data(similar to 00018102) for NNID / networking, etc.
| [[7.0.0-13|v14]], [[7.1.0-15|v1025]], [[7.2.0-17|v2055]], [[9.0.0-20|v3078]], [[9.3.0-21|v4096]], [[9.6.0-24|v5120]]
|-
| 00018102
| This contains local web-browser data(html/js, gfx, etc) for the Miiverse Offline-mode.
| [[7.0.0-13|v11]], [[9.0.0-20|v1025]](also for [[8.1.0-0_New3DS]])
|-
| 00018202
| This contains the webkit/OSS [[CRO0|CROs]] used with the Miiverse applet and the "act" application.
| [[7.0.0-13|v7]], [[8.1.0-0_New3DS|v1026]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v2050]]
|-
| 00019002
| [[Fangate_updater]]
| [[9.3.0-21|v2]], [[9.6.0-24|v1026]]
|}

=== 00040030 - Applets===
{| class="wikitable" border="1"
|-
! JPN TitleIDLow
! USA TitleIDLow
! EUR TitleIDLow
! CHN TitleIDLow
! KOR TitleIDLow
! TWN TitleIDLow
! [[Product code]]
! Description
! JPN Versions
! USA Versions
! EUR Versions
|-
|colspan=6 align=center| 00008102
| CTR-P-CTAP
| [[NS#Alternate menu|Test Menu]] (Demo1)
|colspan=3 align=center| ..., v64, ..., v27648
|-
| 00008202
| 00008F02
| 00009802
| 0000A102
| 0000A902
| 0000B102
| CTR-P-HMM?
| [[Home Menu]] (menu)
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[2.1.0-3|v2049]], [[2.2.0-X|v3075]], [[3.0.0-5|v4111]], [[4.0.0-7|v5131]], [[4.2.0-9|v6146]], [[5.0.0-11|v7172]], [[6.0.0-11|v8198]], [[7.0.0-13|v9230]], [[8.1.0-0_New3DS|v10250]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v13313]], [[9.1.0-20J|v14336]], [[9.2.0-20|v15360]], [[9.3.0-21|v16402]], [[9.4.0-21|v17408]], [[9.5.0-22|v18432]], [[9.6.0-24|v19476]], [[9.7.0-25|v20487]], [[9.8.0-25|v22528]], [[10.1.0-27|v23552]], [[10.2.0-28|v24576]], [[10.3.0-28|v25600]], [[10.4.0-29|v26626]], [[10.6.0-31|v27648]], [[11.1.0-34|v28672]], [[11.3.0-36|v29696]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[2.1.0-3|v2049]], [[2.2.0-X|v3075]], [[3.0.0-5|v4111]], [[4.0.0-7|v5131]], [[4.2.0-9|v6146]], [[5.0.0-11|v7172]], [[6.0.0-11|v8198]], [[7.0.0-13|v9230]], [[9.0.0-20|v11272]], [[9.2.0-20|v12288]], [[9.3.0-21|v13330]], [[9.4.0-21|v14336]], [[9.5.0-22|v15360]], [[9.6.0-24|v16404]], [[9.7.0-25|v17415]], [[9.8.0-25|v19456]], [[9.9.0-26|v20480]], [[10.1.0-27|v21504]], [[10.2.0-28|v22528]], [[10.3.0-28|v23552]], [[10.4.0-29|v24578]], [[10.6.0-31|v25600]], [[11.1.0-34|v26624]], [[11.3.0-36|v27648]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[2.1.0-3|v2049]], [[2.2.0-X|v3075]], [[3.0.0-5|v4111]], [[4.0.0-7|v5131]], [[4.2.0-9|v6146]], [[5.0.0-11|v7172]], [[6.0.0-11|v8198]], [[7.0.0-13|v9230]], [[9.0.0-20|v11272]], [[9.2.0-20|v12288]], [[9.3.0-21|v13330]], [[9.4.0-21|v14336]], [[9.5.0-22|v15360]], [[9.6.0-24|v16404]], [[9.7.0-25|v17415]], [[9.8.0-25|v19456]], [[10.1.0-27|v20480]], [[10.2.0-28|v21504]], [[10.3.0-28|v22528]], [[10.4.0-29|v23554]], [[10.6.0-31|v24576]], [[11.1.0-34|v25600]], [[11.3.0-36|v26624]]
|-
| 00008402
| 00009002
| 00009902
| 0000A202
| 0000AA02
| 0000B202
| CTR-N-HCS?
| Camera applet used by Home-menu (CtrApp)
|colspan=3| v0, v1036, [[9.0.0-20|v2049]](Also for [[8.1.0-0_New3DS]])
|-
| 00008502
| 00009102
| 00009A02
| ?
| ?
| ?
| ?
| Not available on CDN
| ?
| ?
| ?
|-
| 00008602
| 00009202
| 00009B02
| 0000A402
| 0000AC02
| 0000B402
|
| Instruction Manual, applet for displaying instruction manuals
|colspan=3| v0, v1026, v2048, v3072, [[5.0.0-11|v4097]], [[9.0.0-20|v5120]](Also for [[8.1.0-0_New3DS]])
|-
| 00008702
| 00009302
| 00009C02
| 0000A502
| 0000AD02
| 0000B502
| CTR-N-HGM?
| Game Notes (Cherry)
|colspan=3| v0, v1026, v2049, [[5.0.0-11|v3073]], [[9.0.0-20|v4096]](Also for [[8.1.0-0_New3DS]])
|-
| 00008802
| 00009402
| 00009D02
| 0000A602
| 0000AE02
| 0000B602
|
| [[Internet Browser]] (spider)
|colspan=3| [[2.0.0-2|v6]], [[2.1.0-4|v1024]], [[4.0.0-7|v2050]], [[5.0.0-11|v3074 (EUR)/v3075(USA,JAP)]], [[7.0.0-13|v3088]], [[7.1.0-16|v4096]], [[9.5.0-23|v5121]], [[9.9.0-26|v6149]], [[10.2.0-28|v7168]], [[10.6.0-31|v8192]], [[10.7.0-32|v9232]], [[11.1.0-34|v10240]]
|-
| 20008802
| 20009402
| 20009D02
| ?
| 2000AE02
| N/A
| CTR-N-HBR?
| [[New 3DS]] [[Internet Browser]] (SKATER)
|colspan=3| [[8.1.0-0_New3DS|v10]], [[9.3.0-21|v1027]], [[9.6.0-24|v2051]], [[9.9.0-26|v3077]], [[10.2.0-28|v4096]], [[10.4.0-29|v5121]], [[10.6.0-31|v6144]], [[10.7.0-32|v7184]], [[11.1.0-34|v8192]]
|-
|colspan=6| 00008A02
|
| Fatal error viewer ([[ErrDisp]])
|colspan=3| v0, v1025, [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[5.0.0-11|v5121]], [[8.0.0-18|v6144]], [[9.0.0-20|v7168]](Also for [[8.1.0-0_New3DS]])
|-
|colspan=6| 00008A03
|
| SAFE_MODE [[ErrDisp]]
|colspan=3| v0
|-
| 20008A03
| 20008A03
| 20008A03
| ?
| 20008A03
| N/A
|
| [[New_3DS]] SAFE_MODE [[ErrDisp]]
|colspan=3| [[8.1.0-0_New3DS|v7169]]
|-
| 00008D02
| 00009602
| 00009F02
| 0000A702
| 0000AF02
| 0000B702
| CTR-N-HFR?
| Friend List (friend)
|colspan=3| v0, v1026, [[2.2.0-X|v2051]], v3082, v4099, [[7.0.0-13|v5120]], [[9.0.0-20|v6144]](Also for [[8.1.0-0_New3DS]]) (EUR v6, v1024, v3082, v4099, [[7.0.0-13|v5120]], [[9.0.0-20|v6144]])
|-
| 00008E02
| 00009702
| 0000A002
| 0000A802
| 0000B002
| 0000B802
| CTR-N-HCR?
| Notifications (newslist)
|colspan=3| v0, v1029, v2054, v3075, [[9.0.0-20|v4097]] (EUR v6, v1024, v2054, v3075, [[9.0.0-20|v4097]]) (JPN: ..., [[8.1.0-0_New3DS|v4096]], [[9.0.0-20|v5121]])
|-
| 0000C002
| 0000C802
| 0000D002
| 0000D802
| 0000DE02
| 0000E402
| CTR-N-HKY?
| Software Keyboard (swkbd)
|colspan=3| v0, v1026, v2053, [[7.0.0-13|v3072]], [[9.0.0-20|v4096]](Also for [[8.1.0-0_New3DS]])
|-
| 0000C003
| 0000C803
| 0000D003
| 0000D803
| 0000DE03
| 0000E403
|
| SAFE_MODE Software Keyboard (swkbd)
|colspan=3| v0
|-
| 2000C003
| 2000C803
| 2000D003
| ?
| 2000DE03
| N/A
|
| [[New 3DS]] SAFE_MODE Software Keyboard (swkbd)
| [[8.1.0-0_New3DS|v1024]]
|colspan=2|[[9.0.0-20|v0]]
|-
| 0000C102
| 0000C902
| 0000D102
| 0000D902
| 0000DF02
| 0000E502
|
| Mii picker (appletEd)
|colspan=3| v0, v1026, [[9.0.0-20|v2048]](Also for [[8.1.0-0_New3DS]]), [[9.3.0-21|v3077]]
|-
| 0000C302
| 0000CB02
| 0000D302
| 0000DB02
| 0000E102
| 0000E702
|
| Picture picker (PNOTE_AP)
|colspan=3| v0, v1024, [[8.1.0-0_New3DS|v2049]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v3075]], [[9.3.0-21|v4096]]
|-
| 0000C402
| 0000CC02
| 0000D402
| 0000DC02
| 0000E202
| 0000E802
|
| [[Nintendo 3DS Sound|Voice memo]] picker (SNOTE_AP)
|colspan=3| v0, v3, [[8.0.0-18|v1026]], [[9.0.0-20|v2048]](Also for [[8.1.0-0_New3DS]])
|-
|colspan=3| 0000C502
|colspan=3| 0000CF02
|
| Non-critical (online, etc) error display (error)
|colspan=3| v0, v1026, v2053, v3074, [[8.1.0-0_New3DS|v4096]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v5128]], [[9.6.0-24|v6145]]
|-
|colspan=3| 0000C503
|colspan=3| 0000CF03
|
| SAFE_MODE error applet
|colspan=3| v0
|-
| 2000C503
| 2000C503
| 2000C503
| ?
| 2000CF03
| N/A
|
| [[New 3DS]] SAFE_MODE error applet
|colspan=3| [[8.1.0-0_New3DS|v1024]]
|-
|colspan=3| 0000CD02
|colspan=3| 0000D502
|
| [[Circle Pad Pro]] test/calibration applet (extrapad)
|colspan=3| v1, v1026, [[8.1.0-0_New3DS|v2048]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v3073]]
|-
| 0000C602
| 0000CE02
| 0000D602
| N/A
| 0000E302
| 0000E902
| CTR-N-HAA?
| eShop applet, used by applications for accessing the eShop, for DLC/etc. Also used by the eShop application itself. (mint)
|colspan=3| v5, v1028, [[4.2.0-9|v2050]], [[5.0.0-11|v3072]], [[7.0.0-13|v4109]], [[7.2.0-17|v5125]](v5123 for JPN), [[8.0.0-18|v6145]], [[8.1.0-0_New3DS|v7168]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v8200]], [[9.3.0-21|v9224]], [[9.6.0-24|v10247]], [[9.8.0-25|v11264]], [[10.0.0-27|v12293]], [[10.1.0-27|v13312]], [[10.3.0-28|v14337]], [[10.4.0-29|v15360]], [[10.7.0-32|v16384]], [[11.2.0-35|v17408]](EUR), [[11.3.0-36|v18432]]
|-
| 0000BC02
| 0000BD02
| 0000BE02
| ?
| ?
| ?
| CTR-N-HAE?
| Miiverse (olv)
|colspan=3| [[7.0.0-13|v14]], [[7.2.0-17|v1024]], [[9.0.0-20|v2048]](Also for [[8.1.0-0_New3DS]]), [[9.3.0-21|v3072]], [[9.6.0-24|v4096]]
|-
| 0000F602
| 0000F602
| 0000F602
| ?
| ?
| ?
|
| Likely the "system library" for Miiverse (memolib)
|colspan=3| [[7.0.0-13|v5]], [[8.1.0-0_New3DS|v1024]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v2050]], [[9.3.0-21|v3072]]
|-
| 00008302
| 00008B02
| 0000BA02
| ?
| ?
| ?
| CTR-N-HAH?
| In-app Miiverse-posting applet (solv3)
|colspan=3| [[9.0.0-20|v6]]
|-
| 00009502
| 00009E02
| 0000B902
| ?
| 00008C02
| 0000BF02
| CTR-N-HA3?
| Cabinet ([[amiibo Settings]])
|colspan=3| [[9.3.0-21|v7]], (v1024 for TWN), [[9.6.0-24|v1031]]
|}

Most of these processes are applets, see [[NS_and_APT_Services|here]] for details.

All of the above processes use the "SYSTEM" [[SVC|memory-region]].

The ExeFS for Home Menu is exactly the same for USA/EUR/JPN.

The Miiverse applet seems to use a web browser with webkit.

=== 0004009B - [[NCCH#CFA|System Data Archives]] (Shared Archives) ===
{| class="wikitable" border="1"
|-
! JPN TitleIDLow
! USA TitleIDLow
! EUR TitleIDLow
! KOR TitleIDLow
! Description
! Versions
|-
| 00010202
| 00010202
| 00010202
| 00010202
| Probably Mii-related, contains "CFL_Res.dat" in the RomFS.
| v0
|-
| 00010302
| 00010302
| 00010302
|
| Only exists for (some?) dev-units.
| v0, v2052
|-
| 00010402
| 00010402
| 00010402
| 00010402
| Mounted as "area:", contains Country and Region names
| v0, v1024, v2050, v3072, [[7.0.0-13|v4098]], [[9.6.0-24|v5122]]
|-
| 00010502
| 00010502
| 00010502
|
| Only exists for dev-units.
| v0, v1024, v2048
|-
| 00010602
| 00010602
| 00010602
| 00010602
| Non-Nintendo TLS Root-CA Certificates (RomFS contains files with filename "CACERT_PUBLIC_CA_<val>.der", where <val> is 5..8)
| v2, [[10.5.0-30|v1024]]
|-
|
|
| 00011202
|
| "NL/NL" dictionary.
| v0
|-
|
|
| 00011302
|
| "EN/GB" dictionary.
| v0
|-
|
| 00011402
|
|
| "EN/US" dictionary.
| v0
|-
|
|
| 00011502
|
| "FR/FR/regular" dictionary.
| v0
|-
|
| 00011602
|
|
| "FR/CA/regular" dictionary.
| v0
|-
|
|
| 00011702
|
| "DE/regular" dictionary.
| v0
|-
|
|
| 00011802
|
| "IT/IT" dictionary.
| v0
|-
| 00011902
|
|
|
| "JA_small/32" dictionary.
| v0
|-
|
|
|
| 00011A02
| ?
| v1
|-
|
|
| 00011B02
|
| "PT/PT/regular" dictionary.
| v0
|-
|
|
| 00011C02
|
| "RU/regular" dictionary.
| v0
|-
|
| 00011D02
| 00011D02
|
| "ES/ES" dictionary.
| v0
|-
|
| 00011E02
|
|
| "PT/BR/regular" dictionary.
| v0
|-
| 00012202
| 00012302
| 00012102
| 00012502
| ?contains a lists with error strings
| v1026, v2053, v3073, [[4.2.0-9|v4096]], [[5.0.0-11|v5120]], [[7.0.0-13|v6149]], [[7.2.0-17|v7168]], [[8.0.0-18|v8192]], [[9.0.0-20|v9218]], [[9.3.0-21|v10242]], [[9.6.0-24|v11269]], [[10.0.0-27|v12289]], [[10.4.0-29|v13312]], [[10.7.0-32|v13313]] (JPN: [[11.1.0-34|v14336]]) (KOR: [[9.6.0-24|v6148]], [[10.0.0-27|v7169]], [[10.3.0-28|v8193]], [[10.4.0-29|v9216]], [[11.1.0-34|v10240]])
|-
| 00013202
| 00013302
| 00013102
| 00013502
| Mounted as "eula:"
| v0, v1024, v2049 USA: v1024, v2051, [[7.0.0-13|v3074]], [[7.2.0-17|v4100]](EUR-only), [[9.0.0-20|v4099]], [[9.9.0-26|v6144]], [[10.4.0-29|v7168]] (KOR: [[9.7.0-25|v1025]])
|-
| 00014002
| 00014002
| 00014002
| 00014002
| JPN/EUR/USA [[System Font]] ("font:")
| v0
|-
| 00014102
| 00014102
| 00014102
| 00014102
| CHN [[System Font]] ("font:")
| v0, v1024
|-
| 00014202
| 00014202
| 00014202
| 00014202
| KOR [[System Font]] ("font:")
| v0, v1024
|-
| 00014302
| 00014302
| 00014302
| 00014302
| TWN [[System Font]] ("font:")
| v0, v1024
|-
| 00015202
| 00015302
| 00015102
| 00015502
| Mounted as "rate:"
| v0 (EUR: v0, v1024) (KOR: v1024)
|}

=== 000400DB - [[NCCH#CFA|System Data Archives]] ===
These [[NVer]] titleIDs can be found @ offset 0x320 in every [[CCI]].

{| class="wikitable" border="1"
|-
! EUR TitleIDLow
! JPN TitleIDLow
! USA TitleIDLow
! CHN TitleIDLow
! KOR TitleIDLow
! TWN TitleIDLow
! Description
! USA/EUR/JPN Versions
! CHN Versions
! TWN Versions
! KOR Versions
|-
| 00010302
| 00010302
| 00010302
| 00010302
| 00010302
| 00010302
| NGWord bad word list
| [[1.0.0-0|v0]], [[2.0.0-2|v1024]], [[3.0.0-5|v2052]], [[4.0.0-7|v3072]], [[4.3.0-10|v4096]], [[5.0.0-11|v5120]], [[9.0.0-20|v6144]], [[9.3.0-21|v7168]], [[9.6.0-24|v8192]], [[11.1.0-34|v9217]]
| Same as USA
| Same as USA
| Same as USA
|-
| 00010502
| 00010502
| 00010502
| 00010502
| 00010502
| 00010502
| [[Nintendo Zone]] hotspot list
| [[1.0.0-0|v0]], [[2.0.0-2|v1024]], [[3.0.0-5|v2048]], [[4.0.0-7|v3073]], [[4.3.0-10|v4096]], [[4.4.0-10|v5120]], [[4.5.0-10|v6144]], [[5.0.0-11|v7169]], [[6.0.0-11|v8192]], [[6.2.0-12|v9216]], [[7.0.0-13|v10242]], [[7.2.0-17|v11267]], [[8.0.0-18|v12288]], [[9.0.0-20|v14336]], [[9.3.0-21|v15360]], [[9.6.0-24|v16386]], [[10.0.0-27|v17409]], [[10.4.0-29|v18432]], [[11.1.0-34|v19457]]
| Same as USA
| Same as USA
| Same as USA
|-
| 00016102
| 00016202
| 00016302
| 00016402
| 00016502
| 00016602
| [[NVer]]
| [[1.0.0-0|v0]], [[1.1.0-1|v16]], [[2.0.0-2|v32]], [[2.1.0-3|v48]], [[2.1.0-4|v64]], [[3.0.0-5|v80]], [[3.0.0-6|v96]], [[4.0.0-7|v112]], [[4.1.0-8|v128]], [[4.2.0-9|v144]], [[4.3.0-10|v160]], [[5.0.0-11|v176]], non-USA=[[6.0.0-11|v192]]/USA=[[6.1.0-12U|v192]], [[7.0.0-13|v208]], [[7.1.0-14|v224]], [[7.1.0-15|v240]], [[7.1.0-16|v256]], [[7.2.0-17|v272]], [[8.0.0-18|v288]], [[8.1.0-19|v304]], [[9.0.0-20|v320]], [[9.3.0-21|v336]], [[9.5.0-22|v352]], [[9.5.0-23|v368]], [[9.6.0-24|v384]], [[9.7.0-25|v400]], [[9.9.0-26|v416]], [[10.0.0-27|v432]], [[10.2.0-28|v448]], [[10.4.0-29|v464]], [[10.5.0-30|v480]], [[10.6.0-31|v496]], [[10.7.0-32|v512]], [[11.0.0-33|v528]], [[11.1.0-34|v544]], [[11.2.0-35|v560]], [[11.3.0-36|v576]]
| [[4.0.0-7|v113]], [[4.2.0-9|v128]], [[5.0.0-11|v129]], [[7.1.0-16|v130]], [[7.2.0-17|v272]], [[9.5.0-23|v131]], [[9.9.0-26|v132]]
| [[4.1.0-8|v114]], [[4.2.0-9|v133]], [[4.3.0-10|v134]], [[5.0.0-11|v136]], [[7.0.0-13|v144]], [[7.1.0-14|v160]] [[7.1.0-16|v192]], [[7.2.0-17|v272]], [[8.0.0-18|v208]], [[8.1.0-19|v224]], [[9.0.0-20|v240]], [[9.5.0-22|v272]], [[9.5.0-23|v288]], [[9.6.0-24|v304]], [[9.7.0-25|v320]], [[9.9.0-26|v336]], [[10.0.0-27|v352]], [[10.2.0-28|v368]], [[10.4.0-29|v384]], [[10.5.0-30|v400]], [[10.6.0-31|v416]], [[10.7.0-32|v432]], [[11.0.0-33|v448]], [[11.1.0-34|v464]], [[11.2.0-35|v480]], [[11.3.0-36|v496]]
| [[4.0.0-7|v113]], [[4.1.0-8|v114]], [[4.2.0-9|v133]], [[4.3.0-10|v134]], [[5.0.0-11|v136]], [[7.0.0-13|v160]], [[7.1.0-14|v176]], [[7.1.0-16|v176]], [[7.2.0-17|v272]], [[8.0.0-18|v224]], [[8.1.0-19|v240]], [[9.0.0-20|v256]], [[9.3.0-21|v272]], [[9.5.0-22|v288]], [[9.5.0-23|v304]], [[9.6.0-24|v320]], [[9.7.0-25|v336]], [[9.9.0-26|v352]], [[10.0.0-27|v368]], [[10.2.0-28|v384]], [[10.4.0-29|v400]], [[10.5.0-30|v416]], [[10.6.0-31|v432]], [[10.7.0-32|v448]], [[11.0.0-33|v464]], [[11.1.0-34|v480]], [[11.2.0-35|v496]], [[11.3.0-36|v512]]
|-
| 20016102
| 20016202
| 20016302
| N/A
| 20016502
| N/A
| [[New_3DS]] [[NVer]]
| [[8.1.0-0_New3DS|v0]], [[9.0.0-20|v320]], [[9.3.0-21|v336]], [[9.5.0-22|v352]], [[9.5.0-22|v352]], [[9.5.0-23|v368]], [[9.6.0-24|v384]], [[9.7.0-25|v400]], [[9.9.0-26|v416]], [[10.0.0-27|v432]], [[10.2.0-28|v448]], [[10.4.0-29|v464]], [[10.5.0-30|v480]], [[10.6.0-31|v496]], [[10.7.0-32|v512]], [[11.0.0-33|v528]], [[11.1.0-34|v544]], [[11.2.0-35|v560]], [[11.3.0-36|v576]]
| N/A
| N/A
| [[9.6.0-24|v320]], [[9.7.0-25|v336]], [[9.9.0-26|v352]], [[10.0.0-27|v368]], [[10.2.0-28|v384]], [[10.4.0-29|v400]], [[10.5.0-30|v416]], [[10.6.0-31|v432]], [[10.7.0-32|v448]], [[11.0.0-33|v464]], [[11.2.0-35|v496]], [[11.3.0-36|v512]]
|-
| 00017102
| 00017202
| 00017302
| 00017402
| 00017502
| 00017602
| [[CVer]]
| [[1.0.0-0|v1024]], [[1.1.0-1|v1045]], [[2.0.0-2|v2049]], [[2.1.0-3|v2069]], [[2.2.0-X|v2088]] [[3.0.0-5|v3088]], [[4.0.0-7|v4098]], [[4.1.0-8|v4113]], [[4.2.0-9|v4130]], [[4.3.0-10|v4145]], [[4.4.0-10|v4163]], [[4.5.0-10|v4176]], [[5.0.0-11|v5120]], [[5.1.0-11|v5136]], [[6.0.0-11|v6146]], [[6.1.0-11|v6160]], [[6.2.0-12|v6178]], [[6.3.0-12|v6192]], [[7.0.0-13|v7175]], [[7.1.0-14|v7187]], [[7.2.0-17|v7203]], [[8.0.0-18|v8196]], [[8.1.0-18|v8208]], [[8.1.0-0_New3DS|v8215]](8.1.0-0_New3DS), [[9.0.0-20|v9218]], [[9.1.0-20J|v9232]](JPN-only), [[9.2.0-20|v9248]], [[9.3.0-21|v9264]], [[9.4.0-21|v9280]], [[9.5.0-22|v9296]], [[9.6.0-24|v9319]], [[9.7.0-25|v9328]], [[9.8.0-25|v9344]], [[9.9.0-26|v9360]], [[10.0.0-27|v10240]], [[10.1.0-27|v10256]], [[10.2.0-28|v10272]], [[10.3.0-28|v10288]], [[10.4.0-29|v10304]], [[10.5.0-30|v10320]], [[10.6.0-31|v10336]], [[10.7.0-32|v10352]], [[11.0.0-33|v11264]], [[11.1.0-34|v11280]], [[11.2.0-35|v11296]], [[11.3.0-36|v11312]]
| [[1.0.0-0|v1024]], [[1.1.0-1|v1045]], [[2.0.0-2|v2049]], [[2.1.0-3|v2069]], [[2.2.0-X|v2088]] [[3.0.0-5|v3088]], [[4.0.0-7|v4098]], [[4.1.0-8|v4113]], [[4.2.0-9|v4130]], [[4.3.0-10|v4145]], [[4.4.0-10|v4163]], [[4.5.0-10|v4176]], [[5.0.0-11|v5120]], [[5.1.0-11|v5136]], [[6.0.0-11|v6146]], [[6.1.0-11|v6160]], [[6.2.0-12|v6178]], [[6.3.0-12|v6192]], [[7.0.0-13|v7175]], [[7.1.0-14|v7187]], [[7.2.0-17|v7203]], [[8.0.0-18|v8196]], [[8.1.0-18|v8208]], [[9.0.0-20|v9217]], [[9.3.0-21|v9264]], [[9.5.0-22|v9296]], [[9.6.0-24|v9319]], [[9.7.0-25|v9328]], [[9.8.0-25|v9344]], [[9.9.0-26|v9360]], [[10.0.0-27|v10240]], [[10.2.0-28|v10272]], [[10.4.0-29|v10304]], [[10.5.0-30|v10320]], [[10.6.0-31|v10336]], [[10.7.0-32|v10352]], [[11.2.0-35|v11296]], [[11.3.0-36|v11312]]
| Same as CHN
| Same as CHN + [[11.1.0-34|v11280]]
|}

=== 00040130 - System [[Services API|Modules]] ===
{| class="wikitable" border="1"
|-
! TitleID Low
! Description
! Versions
|-
| 00001002
| [[Services|sm]] (Stored in [[FIRM|NATIVE_FIRM]])
| N/A
|-
| 00001003
| SAFE_MODE [[Services|sm]] (Stored in SAFE_MODE NATIVE_FIRM)
| N/A
|-
| 00001102
| [[Filesystem services‎|fs]] (Stored in [[FIRM|NATIVE_FIRM]])
| N/A
|-
| 00001103
| SAFE_MODE [[Filesystem services‎|fs]] (Stored in SAFE_MODE NATIVE_FIRM)
| N/A
|-
| 00001202
| [[Process Manager Services|pm]] (Stored in [[FIRM|NATIVE_FIRM]])
| N/A
|-
| 00001203
| SAFE_MODE [[Process Manager Services|pm]] (Stored in SAFE_MODE NATIVE_FIRM)
| N/A
|-
| 00001302
| [[Loader Services‎|loader]] (Stored in [[FIRM|NATIVE_FIRM]])
| N/A
|-
| 00001303
| SAFE_MODE [[Loader Services‎|loader]] (Stored in SAFE_MODE NATIVE_FIRM)
| N/A
|-
| 00001402
| [[PXI Services‎|pxi]] (Stored in [[FIRM|NATIVE_FIRM]])
| N/A
|-
| 00001403
| SAFE_MODE [[PXI Services‎|pxi]] (Stored in SAFE_MODE NATIVE_FIRM)
| N/A
|-
| 00001502
| [[Application Manager Services|AM]] ( Application Manager )
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[3.0.0-5|v2053]], [[4.0.0-7|v3072]], [[5.0.0-11|v4098]], [[6.0.0-11|v5120]], [[8.0.0-18|v6148]], [[8.1.0-0_New3DS|v7168]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v8192]], [[10.0.0-27|v9217]]
|-
| 00001503
| SAFE_MODE [[Application Manager Services|AM]]
| [[1.0.0-0|v0]]
|-
| 20001503
| [[New_3DS]] SAFE_MODE [[Application Manager Services|AM]]
| [[8.1.0-0_New3DS|v7169]]
|-
| 00001602
| [[Camera Services|Camera]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[3.0.0-5|v2048]], [[4.0.0-7|v3074]], [[5.0.0-11|v4098]], [[6.0.0-11|v5120]], [[7.1.0-14|v6146]], [[8.0.0-18|v7172]], [[9.0.0-20|v9216]], [[9.3.0-21|v10242]], [[10.0.0-27|v11265]]
|-
| 20001602
| [[New_3DS]] [[Camera Services|Camera]]
| [[8.1.0-0_New3DS|v8200]], [[9.0.0-20|v9218]], [[9.3.0-21|v10242]], [[10.0.0-27|v11265]]
|-
| 00001702
| [[Config Services|Config]] (cfg)
| [[1.0.0-0|v0]], [[2.0.0-2|v1024]], [[3.0.0-5|v2049]], v3072, [[4.0.0-7|v4096]], [[5.0.0-11|v5122]], [[6.0.0-11|v6145]], [[6.1.0-11|v7168]], [[7.0.0-13|v8196]], [[7.2.0-17|v9220]], [[8.0.0-18|v10243]], [[8.1.0-0_New3DS|v11265]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v12290]], [[9.3.0-21|v13315]], [[9.6.0-24|v14342]]
|-
| 00001703
| SAFE_MODE [[Config Services|Config]] (cfg)
| [[1.0.0-0|v0]]
|-
| 20001703
| [[New_3DS]] SAFE_MODE [[Config Services|Config]] (cfg)
| [[8.1.0-0_New3DS|v11265]]
|-
| 00001802
| [[Codec Services|Codec]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[5.0.0-11|v4098]], [[7.0.0-13|v5120]], [[8.0.0-18|v6144]], [[9.0.0-20|v7168]](Also for [[8.1.0-0_New3DS]])
|-
| 00001803
| SAFE_MODE [[Codec Services|Codec]]
| [[1.0.0-0|v0]]
|-
| 20001803
| [[New_3DS]] SAFE_MODE [[Codec Services|Codec]]
| [[8.1.0-0_New3DS|v7169]]
|-
| 00001902
| dmnt, debugger sysmodule. This use devunit-only HIO for devunit<>pc comms. This only exists for development units(launched by NS during startup depending on certain [[Configuration_Memory]] fields' values). This is installed at the [[Factory_Setup|factory]], then later deleted at the factory on retail units.
|
|-
| 00001A02
| [[DSP Services|DSP]]
| [[1.0.0-0|v0]], [[3.0.0-5|v1024]], [[4.0.0-7|v2048]], [[5.0.0-11|v3074]], [[6.0.0-11|v4096]], [[8.0.0-18|v5120]], [[9.7.0-25|v6145]], [[11.1.0-34|v7169]]
|-
| 00001A03
| SAFE_MODE [[DSP Services|DSP]]
| [[1.0.0-0|v0]]
|-
| 20001A03
| [[New_3DS]] SAFE_MODE [[DSP Services|DSP]]
| [[8.1.0-0_New3DS|v6145]]
|-
| 00001B02
| [[GPIO Services|GPIO]]
| [[1.0.0-0|v0]], [[5.0.0-11|v1025]], [[8.0.0-18|v2048]], [[9.5.0-22|v3073]]
|-
| 00001B03
| SAFE_MODE [[GPIO Services|GPIO]]
| [[1.0.0-0|v0]]
|-
| 20001B03
| [[New_3DS]] SAFE_MODE [[GPIO Services|GPIO]]
| [[8.1.0-0_New3DS|v3073]]
|-
| 00001C02
| [[GSP Services|GSP]]
| [[1.0.0-0|v0]], [[1.1.0-1|v1040]], [[2.0.0-2|v2049]], [[3.0.0-5|v3075]], v4098, [[4.0.0-7|v5120]], [[5.0.0-11|v6145]], [[6.0.0-11|v7168]], [[8.0.0-18|v8196]], [[9.0.0-20|v10240]], [[9.3.0-21|v11264]], [[9.6.0-24|v12294]], [[11.3.0-36|v13312]]
|-
| 20001C02
| [[New_3DS]] [[GSP Services|GSP]]
| [[8.1.0-0_New3DS|v10243]], [[9.3.0-21|v11267]], [[9.6.0-24|v12294]], [[11.3.0-36|v13312]]
|-
| 00001C03
| SAFE_MODE [[GSP Services|GSP]]
| [[1.0.0-0|v0]]
|-
| 20001C03
| [[New_3DS]] SAFE_MODE [[GSP Services|GSP]]
| [[8.1.0-0_New3DS|v9217]]
|-
| 00001D02
| [[HID Services|HID]] (Human Interface Devices)
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[5.0.0-11|v5121]], [[7.2.0-17|v6148]], [[8.0.0-18|v7168]], [[8.1.0-0_New3DS|v8192]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v9216]], [[9.3.0-21|v10240]]
|-
| 00001D03
| SAFE_MODE [[HID Services|HID]]
| [[1.0.0-0|v0]]
|-
| 20001D03
| [[New_3DS]] SAFE_MODE [[HID Services|HID]]
| [[8.1.0-0_New3DS|v8193]]
|-
| 00001E02
| [[I2C Services|i2c]]
| [[1.0.0-0|v0]], [[3.0.0-5|v1024]], [[5.0.0-11|v2049]], [[8.0.0-18|v3076]], [[9.3.0-21|v5120]]
|-
| 20001E02
| [[New_3DS]] [[I2C Services|i2c]]
| [[8.1.0-0_New3DS|v4096]], [[9.3.0-21|v5121]]
|-
| 00001E03
| SAFE_MODE [[I2C Services|i2c]]
| [[1.0.0-0|v0]]
|-
| 20001E03
| [[New_3DS]] SAFE_MODE [[I2C Services|i2c]]
| [[8.1.0-0_New3DS|v4097]]
|-
| 00001F02
| [[MCU Services|MCU]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.1.0-3|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4102]], [[5.0.0-11|v5122]], [[6.0.0-11|v6145]], [[7.0.0-13|v7168]], [[8.0.0-18|v8192]]
|-
| 20001F02
| [[New_3DS]] [[MCU Services|MCU]]
| [[8.1.0-0_New3DS|v8192]]
|-
| 00001F03
| SAFE_MODE [[MCU Services|MCU]]
| [[1.0.0-0|v0]]
|-
| 20001F03
| [[New_3DS]] SAFE_MODE [[MCU Services|MCU]]
| [[8.1.0-0_New3DS|v9217]]
|-
| 00002002
| [[MIC Services|MIC]] (Microphone)
| [[1.0.0-0|v0]], [[5.0.0-11|v1025]], [[8.0.0-18|v2048]]
|-
| 00002102
| [[PDN Services|PDN]]
| [[1.0.0-0|v0]], [[5.0.0-11|v1025]], [[8.0.0-18|v2048]]
|-
| 00002103
| SAFE_MODE [[PDN Services|PDN]]
| [[1.0.0-0|v0]]
|-
| 20002103
| [[New_3DS]] SAFE_MODE [[PDN Services|PDN]]
| [[8.1.0-0_New3DS|v3073]]
|-
| 00002202
| [[PTM Services|PTM]] (Play time, pedometer, and battery manager)
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.2.0-X|v2048]], [[3.0.0-5|v3075]], v4096, [[4.0.0-7|v5120]], [[5.0.0-11|v6146]], [[6.0.0-11|v7168]], [[7.0.0-13|v8192]], [[8.0.0-18|v9219]], [[9.6.0-24|v11264]]
|-
| 20002202
| [[New_3DS]] [[PTM Services|PTM]] (Play time, pedometer, and battery manager)
| [[8.1.0-0_New3DS|v10240]], [[9.6.0-24|v11264]]
|-
| 00002203
| SAFE_MODE [[PTM Services|PTM]]
| [[1.0.0-0|v0]]
|-
| 20002203
| [[New_3DS]] SAFE_MODE [[PTM Services|PTM]]
| [[8.1.0-0_New3DS|v10241]]
|-
| 00002302
| [[SPI Services|spi]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[5.0.0-11|v2049]], [[8.0.0-18|v3072]]
|-
| 20002302
| [[New_3DS]] [[SPI Services|spi]]
| [[8.1.0-0_New3DS|v4096]]
|-
| 00002303
| SAFE_MODE [[SPI Services|spi]]
| [[1.0.0-0|v0]]
|-
| 20002303
| [[New_3DS]] SAFE_MODE [[SPI Services|spi]]
| [[8.1.0-0_New3DS|v4097]]
|-
| 00002402
| [[AC Services|AC]] (Network manager)
| [[1.0.0-0|v0]], [[1.1.0-1|v1024]], [[2.0.0-2|v2052]], [[2.1.0-3|v3072]], [[3.0.0-5|v4101]], [[5.0.0-11|v5122]], [[7.0.0-13|v6145]], [[8.0.0-18|v7172]], [[9.0.0-20|v8192]](Also for [[8.1.0-0_New3DS]]), [[9.3.0-21|v9216]]
|-
| 00002403
| SAFE_MODE [[AC Services|AC]]
| [[1.0.0-0|v0]]
|-
| 20002403
| [[New_3DS]] SAFE_MODE [[AC Services|AC]]
| [[8.1.0-0_New3DS|v8193]]
|-
| 00002602
| [[CECD Services|Cecd]] (StreetPass)
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.2.0-X|v2048]], [[3.0.0-5|v3073]], [[4.0.0-7|v4097]], [[5.0.0-11|v5122]], [[6.0.0-11|v6144]], [[6.2.0-12|v7170]], [[7.0.0-13|v8193]], [[8.0.0-18|v9216]], [[9.0.0-20|v10240]]
|-
| 00002702
| [[CSND Services|CSND]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[4.0.0-7|v2048]], [[5.0.0-11|v3073]], [[8.0.0-18|v4096]], [[9.0.0-20|v5120]]
|-
| 00002703
| SAFE_MODE [[CSND Services|CSND]]
| [[1.0.0-0|v0]]
|-
| 20002703
| [[New_3DS]] SAFE_MODE [[CSND Services|CSND]]
| [[8.1.0-0_New3DS|v5121]]
|-
| 00002802
| [[DLP Services|DLP]] ([[Download Play]])
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.2.0-X|v2048]], [[3.0.0-5|v3078]], [[5.0.0-11|v4099]], [[8.0.0-18|v5123]], [[9.0.0-20|v6145]](Also for [[8.1.0-0_New3DS]]), [[9.6.0-24|v7174]], [[10.0.0-27|v8192]]
|-
| 00002902
| [[HTTP Services|HTTP]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.1.0-3|v2049]], [[2.2.0-X|v3072]], [[3.0.0-5|v4099]], [[4.0.0-7|v5122]], [[5.0.0-11|v6145]], [[7.0.0-13|v7171]], [[7.1.0-14|v8192]], [[8.0.0-18|v9220]], [[8.1.0-18|v10245]], [[8.1.0-0_New3DS|v11264]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v12288]], [[9.6.0-24|v13318]]
|-
| 00002903
| SAFE_MODE [[HTTP Services|HTTP]]
| [[1.0.0-0|v0]]
|-
| 20002903
| [[New_3DS]] SAFE_MODE [[HTTP Services|HTTP]]
| [[8.1.0-0_New3DS|v10241]]
|-
| 00002A02
| [[MP Services|MP]]
| [[1.0.0-0|v0]], [[5.0.0-11|v1025]], [[8.0.0-18|v2048]]
|-
| 00002A03
| SAFE_MODE [[MP Services|MP]]
| [[1.0.0-0|v0]]
|-
| 00002B02
| [[NDM Services|NDM]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[3.0.0-5|v2049]], [[4.0.0-7|v3072]], [[5.0.0-11|v4098]], [[8.0.0-18|v5124]], [[8.1.0-0_New3DS|v6144]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v7169]]
|-
| 00002C02
| [[NIM Services|NIM]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1028]], [[3.0.0-5|v2055]], [[4.0.0-7|v3074]], [[5.0.0-11|v4100]], [[6.0.0-11|v5120]], [[7.0.0-13|v6148]], [[7.2.0-17|v7174]], [[8.0.0-18|v8195]], [[8.1.0-0_New3DS|v9217]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v10249]], [[9.3.0-21|v11267]], [[9.6.0-24|v12296]], [[10.0.0-27|v13313]]
|-
| 00002C03
| SAFE_MODE [[NIM Services|NIM]]
| [[1.0.0-0|v0]]
|-
| 20002C03
| [[New_3DS]] SAFE_MODE [[NIM Services|NIM]]
| [[8.1.0-0_New3DS|v9217]]
|-
| 00002D02
| [[NWM Services|NWM]] ( Low-level wifi manager )
| [[1.0.0-0|v0]], [[1.1.0-1|v1024]], [[2.0.0-2|v2052]], [[2.2.0-X|v3072]], [[3.0.0-5|v4101]], [[4.0.0-7|v5120]], [[5.0.0-11|v6148]], [[6.0.0-11|v7169]], [[7.2.0-17|v8196]], [[8.0.0-18|v9216]], [[9.0.0-20|v10240]]
|-
| 00002D03
| SAFE_MODE [[NWM Services|NWM]]
| [[1.0.0-0|v0]], [[6.0.0-11|v5120]]
|-
| 20002D03
| [[New_3DS]] SAFE_MODE [[NWM Services|NWM]]
| [[8.1.0-0_New3DS|v10241]]
|-
| 00002E02
| [[Socket Services|Sockets]]
| [[1.0.0-0|v0]], [[1.1.0-1|v1024]], [[2.0.0-2|v2053]], [[3.0.0-5|v3075]], [[4.0.0-7|v4096]], [[5.0.0-11|v5121]], [[8.0.0-18|v6144]], [[9.0.0-20|v7168]], [[10.6.0-31|v8192]]
|-
| 00002E03
| SAFE_MODE [[Socket Services|Sockets]]
| [[1.0.0-0|v0]]
|-
| 20002E03
| [[New_3DS]] SAFE_MODE [[Socket Services|Sockets]]
| [[8.1.0-0_New3DS|v7169]]
|-
| 00002F02
| [[SSL Services|SSL]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1024]], [[2.1.0-3|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[5.0.0-11|v5122]], [[8.0.0-18|v6144]], [[9.0.0-20|v7168]], [[9.6.0-24|v8198]]
|-
| 00002F03
| SAFE_MODE [[SSL Services|SSL]]
| [[1.0.0-0|v0]]
|-
| 20002F03
| [[New_3DS]] SAFE_MODE [[SSL Services|SSL]]
| [[8.1.0-0_New3DS|v7169]]
|-
| 00003000
| [[FIRM|Process9]] (in SAFE_MODE and normal NATIVE_FIRM)
| N/A
|-
| 00003102
| [[Process Services‎|PS]] ( Process Manager )
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[5.0.0-11|v2049]], [[6.0.0-11|v3072]], [[8.0.0-18|v4096]], [[9.0.0-20|v5120]]
|-
| 00003103
| SAFE_MODE [[Process Services‎|PS]]
| [[1.0.0-0|v0]]
|-
| 20003103
| [[New_3DS]] SAFE_MODE [[Process Services‎|PS]]
| [[8.1.0-0_New3DS|v5121]]
|-
| 00003202
| [[Friend Services‎|friends]] (Friends list)
| [[1.0.0-0|v0]], [[2.0.0-2|v1028]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[5.0.0-11|v5122]], [[7.0.0-13|v6145]], [[8.0.0-18|v7172]], [[9.0.0-20|v8192]](Also for [[8.1.0-0_New3DS]]), [[10.5.0-30|v9216]], [[10.7.0-32|v10240]], [[11.0.0-33|v11264]], [[11.1.0-34|v12288]], [[11.2.0-35|v13312]], [[11.3.0-36|v14336]]
|-
| 00003203
| SAFE_MODE [[Friend Services‎|friends]] (Friends list)
| [[1.0.0-0|v0]]
|-
| 20003203
| [[New_3DS]] SAFE_MODE [[Friend Services‎|friends]] (Friends list)
| [[8.1.0-0_New3DS|v8193]]
|-
| 00003302
| [[IR Services‎|IR]] (Infrared)
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[5.0.0-11|v5121]], [[8.0.0-18|v6148]], [[8.1.0-0_New3DS|v7170]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v8192]], [[9.3.0-21|v9216]], [[9.6.0-24|v10246]], [[10.0.0-27|v11265]], [[10.6.0-31|v12289]]
|-
| 00003303
| SAFE_MODE [[IR Services‎|IR]]
| [[1.0.0-0|v0]]
|-
| 20003303
| [[New_3DS]] SAFE_MODE [[IR Services‎|IR]]
| [[8.1.0-0_New3DS|v7169]]
|-
| 00003402
| [[BOSS Services‎|BOSS]] (SpotPass)
| [[1.0.0-0|v0]], [[1.1.0-1|v1024]], [[2.0.0-2|v2053]], [[2.2.0-X|v3073]], [[3.0.0-5|v4101]], [[4.0.0-7|v5122]], [[5.0.0-11|v6146]], [[6.0.0-11|v7169]], [[6.2.0-12|v8193]], [[7.0.0-13|v9222]], [[8.0.0-18|v10240]], [[9.0.0-20|v11266]], [[10.0.0-27|v12289]], [[10.4.0-29|v13314]]
|-
| 00003502
| [[News Services‎|News]] (Notifications)
| [[1.0.0-0|v0]], [[2.0.0-2|v1028]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[5.0.0-11|v4097]], [[8.0.0-18|v5120]], [[9.0.0-20|v6147]], [[9.7.0-25|v7168]]
|-
| 00003602
| "debugger". This only exist for development units(launched by NS during startup depending on certain [[Configuration_Memory]] fields' values).
|
|-
| 00003702
| [[RO_Services|RO]]
| [[2.0.0-2|v0]], [[4.0.0-7|v1024]], [[5.0.0-11|v2049]], [[7.2.0-17|v3074]], [[8.0.0-18|v4096]], [[9.0.0-20|v5120]](Also for [[8.1.0-0_New3DS]]), [[9.3.0-21|v6148]]
|-
| 00003802
| [[ACT Services‎|act]] (handles Nintendo Network '''a'''c'''c'''oun'''t'''s)
| [[7.0.0-13|v1029]], [[7.1.0-14|v2050]], [[7.2.0-17|v3077]], [[8.0.0-18|v4099]], [[8.1.0-0_New3DS|v5120]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v6144]], [[9.3.0-21|v7168]], [[9.6.0-24|v8198]]
|-
| 00004002
| Old3DS [[NFC_Services|nfc]]
| [[9.3.0-21|v2053]], [[9.6.0-24|v4106]], [[9.7.0-25|v5121]], [[10.0.0-27|v6145]], [[10.6.0-31|v7168]], [[10.7.0-32|v8192]]
|-
| 20004002
| [[New_3DS]] [[NFC_Services|nfc]]
| [[8.1.0-0_New3DS|v0]], [[9.0.0-20|v1024]], [[9.3.0-21|v2053]], [[9.5.0-22|v3073]], [[9.6.0-24|v4102]], [[10.0.0-27|v6145]], [[10.6.0-31|v7168]]
|-
| 20004102
| [[New_3DS]] [[MVD Services|mvd]]
| [[8.1.0-0_New3DS|v0]], [[9.0.0-20|v1024]]
|-
| 20004202
| [[New_3DS]] [[QTM Services|qtm]]
| [[8.1.0-0_New3DS|v8]], [[9.0.0-20|v1024]], [[9.3.0-21|v2052]]
|-
| 00008002
| [[NS]] (Memory-region: "SYSTEM")
| [[1.0.0-0|v0]], [[2.0.0-2|v1028]], [[2.2.0-X|v2048]], [[3.0.0-5|v3077]], v4096, [[4.0.0-7|v5121]], [[5.0.0-11|v6148]], [[5.1.0-11|v7168]], [[6.0.0-11|v8193]], [[6.1.0-11|v9216]], [[7.0.0-13|v10248]], [[7.2.0-17|v11268]], [[8.0.0-18|v12291]], [[8.1.0-0_New3DS|v13312]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v14336]], [[9.3.0-21|v15360]], [[9.6.0-24|v16390]], [[9.8.0-25|v17408]], [[10.0.0-27|v18433]], [[10.4.0-29|v19458]], [[11.1.0-34|v20482]], [[11.3.0-36|v21504]]
|-
| 00008003
| SAFE_MODE [[NS]] (Memory-region: "SYSTEM")
| [[1.0.0-0|v0]]
|-
| 20008003
| [[New_3DS]] SAFE_MODE [[NS]] (Memory-region: "SYSTEM")
| [[8.1.0-0_New3DS|v13313]]
|}

Once Home Menu finishes loading, all of the above system modules are running, except for MP, RO, and act which are automatically [[Process_Manager_Services|loaded]] when a process requires them. When [[Process_Manager_Services|PM]]-module terminates processes, it will check whether the processes listed as dependencies for this process are listed as dependencies for other processes. Any processes which are no longer listed in any processes dependencies lists are then terminated. On [[New_3DS]], the only New3DS-specific system-module which automatically gets loaded during system boot is qtm.

All of the above system modules use the "BASE" [[SVC|memory-region]](specified in the exheader), except when listed otherwise for certain modules.

When handling the exheader dependency list starting with [[8.0.0-18]], Old3DS FIRM [[Process_Manager_Services|PM]]-module now skips handling titles in this list which have any bits in programID-low bitmask 0xF0000000 set(with [[8.0.0-18]] this is hard-coded). The exheader dependency list handling change is for the [[New 3DS]] system-module(s), which do not exist on Old3DS. When the New3DS pm-module is launching any title except [[NS]], it first attempts to launch the title with programID-low bitmask 0x20000000 set, then with that bitmask clear if launching fails.

=== 00040138 - [[FIRM|System Firmware]] ===
NATIVE_FIRM and SAFE_MODE_FIRM for the initial versions are exactly the same, besides [[Configuration_Memory|core-version]] fields. SAFE_MODE_FIRM is used for running SAFE_MODE titles, on retail SAFE_MODE_FIRM seems to be only used for running the [[System_Settings#System_Updater|System Updater]] application. When a GBA VC title is launched, AGB_FIRM is launched to handle running this title. GBA VC savegames stored under SD card /title/<TID>/data use a custom format, this is handled by AGB_FIRM.

{| class="wikitable" border="1"
|-
! TitleID Low
! Description
! USA/EUR/JPN Versions
! CHN Versions
! KOR Versions
! TWN Versions
|-
| 00000001
| Unknown, very similar to SAFE_MODE_FIRM. Exists only on dev units and seems to only be used by SystemUpdaters.
| v0
|
|
|
|-
| 00000002
| NATIVE_FIRM (Native Firmware)
| [[1.0.0-0|v432]], [[1.1.0-1|v1472]], [[2.0.0-2|v2516]], [[2.1.0-3|v3553]], [[2.2.0-X|v4595]], [[3.0.0-5|v5647]], [[4.0.0-7|v6677]], [[4.1.0-8|v7712]], [[5.0.0-11|v8758]], [[5.1.0-11|v9792]], [[6.0.0-11|v10833]], [[6.1.0-11|v11872]], [[7.0.0-13|v12916]], [[7.2.0-17|v13956]], v15043, [[8.0.0-18|v15047]], [[9.0.0-20|v17120]], [[9.3.0-21|v18182]], [[9.5.0-22|v19216]], [[9.6.0-24|v20262]], [[10.0.0-27|v21288]], [[10.2.0-28|v22313]], [[10.4.0-29|v23341]], [[11.0.0-33|v24368]], [[11.1.0-34|v25396]], [[11.2.0-35|v26432]], [[11.3.0-36|v27476]]
| Same as USA/EUR/JPN starting with the USA/EUR/JPN [[4.0.0-7]] title-version
| Same as CHN.
| Same as CHN.
|-
| 20000002
| [[New_3DS]] NATIVE_FIRM (Native Firmware)
| [[8.1.0-0_New3DS|v16085]], [[9.0.0-20|v17120]], [[9.3.0-21|v18182]], [[9.5.0-22|v19218]], [[9.6.0-24|v20262]], [[10.0.0-27|v21288]], [[10.2.0-28|v22313]], [[10.4.0-29|v23341]], [[11.0.0-33|v24368]], [[11.1.0-34|v25396]], [[11.2.0-35|v26432]], [[11.3.0-36|v27476]]
| N/A
| Same as CHN.
| Same as CHN.
|-
| 00000003
| SAFE_MODE_FIRM
| [[1.0.0-0|v432]], [[3.0.0-5|v5632]]
| Same as USA/EUR/JPN starting with the USA/EUR/JPN [[3.0.0-5]] title-version
| Same as CHN.
| Same as CHN.
|-
| 20000003
| [[New_3DS]] SAFE_MODE_FIRM
| [[8.1.0-0_New3DS|v16081]]
| N/A
| Same as CHN.
| Same as CHN.
|-
| 00000102
| TWL_FIRM ( DSi Firmware )
| [[1.0.0-0|v432]], [[2.0.0-2|v1489]], [[3.0.0-5|v2565]], v3601, [[4.0.0-7|v4625]], [[4.4.0-10|v5681]], [[4.5.0-10|v6704]], [[6.0.0-11|v7762]], [[6.2.0-12|v8817]]
| Same as USA/EUR/JPN starting with the USA/EUR/JPN [[4.0.0-7]] title-version
| Same as CHN.
| Same as CHN.
|-
| 20000102
| [[New_3DS]] TWL_FIRM ( DSi Firmware )
| [[8.1.0-0_New3DS|v9936]]
| N/A
| Same as CHN.
| Same as CHN.
|-
| 00000202
| AGB_FIRM ( GBA Firmware )
| [[3.0.0-5|v519]], v1553, [[4.0.0-7|v2576]], [[6.0.0-11|v3665]]
| [[4.0.0-7|v2576]]
| [[4.0.0-7|v2576]], [[6.0.0-11|v3665]]
| Same as CHN.
|-
| 20000202
| [[New_3DS]] AGB_FIRM ( GBA Firmware )
| [[8.1.0-0_New3DS|v4816]]
| N/A
| N/A
| N/A
|}

== Application Titles ==
{| class="wikitable" border="1"
|-
! Content Category
! Bit Mask(s)
! Category Bit Mask
|-
| [[Title list/eShop Titles|Application]] (eShop Title)
| Normal
| 0x0000
|-
| DLP Child
| DlpChild
| 0x0001
|-
| [[EShop Demos|Demo]]
| Demo
| 0x0002
|-
| [[Title list/Patches|Patch]]
| CannotExecution<nowiki>|</nowiki>Patch
| 0x000E
|-
| [[Title list/DLC|Add-on Content]] (DLC)
| NotRequireRightForMount<nowiki>|</nowiki>CannotExecution<nowiki>|</nowiki>AddOnContents
| 0x008C
|}

=== 00040001 - [[Download Play]] Titles ===
This titleID-high/programID-high is used for the titles sent over [[Download Play]]. Only one 00040001 Download Play title is installed to NAND /title at a time. There can be a maximum of 255 Download Play child titles per Unique ID, indexed by Title ID Variation. The legal index range: 0x0 - 0xff.

== Other Titles ==
{| class="wikitable" border="1"
|-
! TitleID
! Description
! Versions
|-
| 000400000F802A00
| Unknown. Appears to be a [[9.8.0-25|gamecard]] title. See also [[11.3.0-36|here]].
Used during [[Nintendo_Service_Center_Tools|repair]], first non-system title listed in [[PTM_Services|playlog]] from repair.
|
|-
| 000400000F802100
| Used during [[Nintendo_Service_Center_Tools|repair]], second non-system title listed in [[PTM_Services|playlog]] from repair.
|
|-
| 000400000F802200
| Used during [[Nintendo_Service_Center_Tools|repair]], third non-system title listed in [[PTM_Services|playlog]] from repair.
|
|-
| 0004003000008900
| Used by retail NS for appID 0xF10, but this isn't available on retail CDN.
| ?
|-
| 000400000FFFFD00
| Used by retail NS for appID 0xF11, but this isn't available on retail CDN.
| ?
|-
| 000400000FFFFC00
| Used by retail NS for appID 0xF12, but this isn't available on retail CDN.
| ?
|-
| 000400000FFFFB00
| Used by retail NS for appID 0xF13, but this isn't available on retail CDN.
| ?
|-
| 000400000FFFF900
| Used by retail NS for appID 0xF14, but this isn't available on retail CDN.
| ?
|-
| 000400000FFFF800
| Used by retail NS for appID 0xF15, but this isn't available on retail CDN.
| ?
|-
| 000400000FFFF700
| Used by retail NS for appID 0xF16, but this isn't available on retail CDN.
| ?
|-
| 000400000FFFF600
| Used by retail NS for appID 0xF17, but this isn't available on retail CDN.
| ?
|-
| 000400000FFFF500
| Used by retail NS for appID 0xF18, but this isn't available on retail CDN.
| ?
|}

This section is for hard-coded titleIDs referenced in codebins on retail. This can include [[Factory_Setup|factory]]/[[Nintendo_Service_Center_Tools|repair]] titles as well.

== TWL (DSi) Titles ==

{| class="wikitable" border="1"
|-
! Content Category
! Bit Mask(s)
! Category Bit Mask
|-
| Application (DSiWare)
| TWL<nowiki>|</nowiki>0x4
| 0x8004
|-
| System Application
| TWL<nowiki>|</nowiki>0x1<nowiki>|</nowiki>0x4
| 0x8005
|-
| System Archive
| TWL<nowiki>|</nowiki>0x1<nowiki>|</nowiki>0x2<nowiki>|</nowiki>0x4<nowiki>|</nowiki>0x8
| 0x800F
|-
| Developer Tool
| TWL<nowiki>|</nowiki>0x1<nowiki>|</nowiki>0x4<nowiki>|</nowiki>0x10
| 0x8015
|}

Bitmask 0x1 for TWL titles denotes a system title (determining whether the title will be updated during a System Update). It appears to be sufficient, but not necessary, to make the title invisible on the [[Home Menu]].

Bitmask 0x2 for TWL titles may indicate no-execute.

Bitmask 0x4 for TWL titles indicates internal storage.

Bitmask 0x10 for TWL titles is found on developer tools.

=== 00048005 - System Applications===
{| class="wikitable" border="1"
|-
! TitleID Low
! Region
! Description
! Versions
! Information
|-
| 42383841(B88A)
| ALL
| [[DS Internet]]
| v0, [[2.1.0-4|v1025]], [[3.0.0-5|v2048]]
| [[DS Internet]] is the DS-mode application, (also integrated in every online-enabled DS game) and now accessible through [[System Settings]] for configuring network settings for DS software.
|-
| 484E4441(HNDA)
| ALL
| [[Download Play]]
| v1024
| This [[Download Play]] application is the DS-mode Download Play client, launched by the 3DS-mode Download Play application.
|-
| 484E4443(HNDC)
| CHN
| [[Download Play]]
| v1024
| See Above Description.
|-
| 484E444B(HNDK)
| KOR
| [[Download Play]]
| v1024
| See Above Description.
|}

=== 0004800F - System Data Archives===
{| class="wikitable" border="1"
|-
! TitleID Low
! Description
! Versions
|-
| 484E4841(HNHA)
| [[Nintendo DS Cart Whitelist]]
| v0, [[2.0.0-2|v1026]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[4.2.0-9|v5120]], [[4.3.0-10|v6145]], [[4.4.0-10|v7168]], [[4.5.0-10|v8192]], [[5.0.0-11|v9216]], [[6.0.0-11|v10240]], [[7.0.0-13|v11264]]
|-
| 484E4C41(HNLA)
| [[Version Data]]
| v0
|}

New system updates only block DS flash-cards when the above whitelist was updated, or when TWL_FIRM was updated. The whitelist contains the data used for detecting flash-cards, this is used by TWL_FIRM.

=== 00048004 - DSiWare ===
Although these have a titleID high separate from DSi and a titleID is stored in the SRLs, the content of these SRLs are identical to DSi.

{| class="wikitable" border="1"
|-
! TitleID Low
! Region
! Description
! Versions
|-
| 4B4B5456(KKTV)
| EUR
| Cut the Rope
| v0, v64
|-
| 4B4E5256(KNRV)
| EUR
| A Little Bit of... Brain Training™: Maths Edition
| v0
|-
| 4B5A4C56(KZLV)
| EUR
| Plants vs. Zombies™
| v0
|-
| 4B454256(KEBV)
| EUR
| ELECTROPLANKTON (Hanenbow)
| v0
|-
| 4B513956(KQ9V)
| EUR
| Zelda: Four Swords Anniversary Edition
| v16
|-
| 4B574256(KWBV)
| EUR
| Mario Calculator
| v0
|-
| 4B574656(KWFV)
| EUR
| Mario Clock
| v0
|}

CONFIG11 Registers

2017-02-09T18:43:24Z

MassExplosion213: Fix links

= Registers =
{| class="wikitable" border="1"
! Old3DS
! Name
! Address
! Width
! Used by
|-
| style="background: green" | Yes
| [[#CFG11_SHAREDWRAM_32K_DATA|CFG11_SHAREDWRAM_32K_DATA]]<0-7>
| 0x10140000
| 1*8
| Boot11, Process9, [[DSP Services]]
|-
| style="background: green" | Yes
| [[#CFG11_SHAREDWRAM_32K_CODE|CFG11_SHAREDWRAM_32K_CODE]]<0-7>
| 0x10140008
| 1*8
| Boot11, Process9, [[DSP Services]]
|-
| style="background: green" | Yes
| ?
| 0x10140100
| 2
|
|-
| style="background: green" | Yes
| ?
| 0x10140102
| 2
|
|-
| style="background: green" | Yes
| [[#CFG11_FIQ_CNT|CFG11_FIQ_CNT]]
| 0x10140104
| 1
| Kernel11.
|-
| style="background: green" | Yes
| ?
| 0x10140105
| 1
| Kernel11.
|-
| style="background: green" | Yes
| Related to [[HID_Registers|HID_?]]
| 0x10140108
| 2
| TwlBg
|-
| style="background: green" | Yes
| Related to [[HID_Registers|HID_?]]
| 0x1014010C
| 2
| TwlBg
|-
| style="background: green" | Yes
| [[#CFG11_GPUPROT|CFG11_GPUPROT]]
| 0x10140140
| 4
| Kernel11
|-
| style="background: green" | Yes
| [[#CFG11_WIFICNT|CFG11_WIFICNT]]
| 0x10140180
| 1
| TwlBg, [[NWM Services]]
|-
| style="background: green" | Yes
| [[#CFG11_SPI_CNT|CFG11_SPI_CNT]]
| 0x101401C0
| 4
| [[SPI Services]], TwlBg
|-
| style="background: green" | Yes
| ?
| 0x10140200
| 4
|
|-style="border-top: double"
| style="background: red" | No
| Clock related?
| 0x10140400
| 1
| NewKernel11
|-
| style="background: red" | No
| Clock related?
| 0x10140410
| 4
| NewKernel11
|-
| style="background: red" | No
| [[#CFG11_BOOTROM_OVERLAY_CNT|CFG11_BOOTROM_OVERLAY_CNT]]
| 0x10140420
| 1
| NewKernel11
|-
| style="background: red" | No
| [[#CFG11_BOOTROM_OVERLAY_VAL|CFG11_BOOTROM_OVERLAY_VAL]]
| 0x10140424
| 4
| NewKernel11
|-
| style="background: red" | No
| ?
| 0x10140428
| 4
|
|-style="border-top: double"
| style="background: green" | Yes
| [[#CFG11_SOCINFO|CFG11_SOCINFO]]
| 0x10140FFC
| 2
| Boot11, Kernel11
|-style="border-top: double"
| style="background: green" | Yes
| CFG11_GPU_STATUS?
| 0x10141000
| 4
| Kernel11, TwlBg
|-
| style="background: green" | Yes
| CFG11_PTM_0
| 0x10141008
| 4
| [[PTM Services]], [[PDN Services]]
|-
| style="background: green" | Yes
| CFG11_PTM_1
| 0x1014100C
| 4
| [[PTM Services]], TwlBg, [[PDN Services]]
|-style="border-top: double"
| style="background: green" | Yes
| [[#CFG11_TWLMODE_0|CFG11_TWLMODE_0]]
| 0x10141100
| 2
| TwlProcess9, TwlBg
|-
| style="background: green" | Yes
| [[#CFG11_TWLMODE_1|CFG11_TWLMODE_1]]
| 0x10141104
| 2
| TwlBg
|-
| style="background: green" | Yes
| [[#CFG11_TWLMODE_2|CFG11_TWLMODE_2]]
| 0x10141108
| 2
| TwlBg
|-
| style="background: green" | Yes
| [[#CFG11_TWLMODE_HID|CFG11_TWLMODE_HID]]
| 0x1014110A
| 2
| TwlBg
|-
| style="background: green" | Yes
| [[#CFG11_WIFIUNK|CFG11_WIFIUNK]]
| 0x1014110C
| 1
| [[NWM Services]]
|-
| style="background: green" | Yes
| ?
| 0x10141110
| 2
| TwlBg
|-
| style="background: green" | Yes
| ?
| 0x10141112
| 2
| TwlBg
|-
| style="background: green" | Yes
| [[#CFG11_CODEC|CFG11_CODEC_0]]
| 0x10141114
| 2
| [[CDC Services]], TwlBg
|-
| style="background: green" | Yes
| [[#CFG11_CODEC|CFG11_CODEC_1]]
| 0x10141116
| 2
| [[CDC Services]], TwlBg
|-
| style="background: green" | Yes
| ?
| 0x10141118
| 1
| TwlBg
|-
| style="background: green" | Yes
| ?
| 0x10141119
| 1
| TwlBg
|-
| style="background: green" | Yes
| ?
| 0x10141120
| 1
| TwlBg
|-
|-style="border-top: double"
| style="background: green" | Yes
| [[#CFG11_GPU_CNT|CFG11_GPU_CNT]]
| 0x10141200
| 4
| Boot11, Kernel11, [[PDN Services]]
|-
| style="background: green" | Yes
| [[#CFG11_GPU_CNT2|CFG11_GPU_CNT2]]
| 0x10141204
| 4
| Boot11, Kernel11
|-
| style="background: green" | Yes
| CFG11_GPU_CNT3
| 0x10141210
| 2
| Kernel11, TwlBg
|-
| style="background: green" | Yes
| [[#CFG11_CODEC_CNT|CFG11_CODEC_CNT]]
| 0x10141220
| 1
| Boot11, TwlBg, [[PDN Services]]
|-
| style="background: green" | Yes
| [[#CFG11_CAMERA_CNT|CFG11_CAMERA_CNT]]
| 0x10141224
| 1
| [[PDN Services]]
|-
| style="background: green" | Yes
| CFG11_DSP_CNT
| 0x10141230
| 1
| Process9, [[PDN Services]]
|-style="border-top: double"
| style="background: red" | No
| [[#CFG11_MPCORE_CLKCNT|CFG11_MPCORE_CLKCNT]]
| 0x10141300
| 2
| NewKernel11
|-
| style="background: red" | No
| [[#CFG11_MPCORE_CNT|CFG11_MPCORE_CNT]]
| 0x10141304
| 2
| NewKernel11
|-
| style="background: red" | No
| [[#CFG11_MPCORE_BOOTCNT<0-3>|CFG11_MPCORE_BOOTCNT]]<0-3>
| 0x10141310
| 1*4
| NewKernel11
|}

== CFG11_SHAREDWRAM_32K_DATA ==
Used for mapping 32K chunks of shared WRAM for DSP data.

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| Master (0=ARM9?, 1=ARM11?, 2 or 3=DSP/data)
|-
| 2-4
| Offset (0..7) (slot 0..7) (LSB of address in 32Kbyte units)
|-
| 5-6
| Not used (0)
|-
| 7
| Enable (0=Disable, 1=Enable)
|}

== CFG11_SHAREDWRAM_32K_CODE ==
Used for mapping 32K chunks of shared WRAM for DSP data.

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| Master (0=ARM9?, 1=ARM11?, 2 or 3=DSP/code)
|-
| 2-4
| Offset (0..7) (slot 0..7) (LSB of address in 32Kbyte units)
|-
| 5-6
| Not used (0)
|-
| 7
| Enable (0=Disable, 1=Enable)
|}

== CFG11_FIQ_CNT ==
Writing bit1 to this register disables FIQ interrupts.

This bit is set upon receipt of a FIQ interrupt and when [[SVC|svcUnbindInterrupt]] is called on the FIQ-abstraction [[ARM11_Interrupts#Private_Interrupts|software interrupt]] for the current core.
It is cleared when binding that software interrupt to an event and just before that event is signaled.

== CFG11_SPI_CNT ==
When the corresponding bit is 0, the bus has to be accessed using the DS SPI registers. Otherwise it has to be accessed using the 3DS SPI registers.
{| class="wikitable" border="1"
! Bit
! Description
|-
| 0
| Enable [[SPI Registers]] 0x10160000.
|-
| 1
| Enable [[SPI Registers]] 0x10142000.
|-
| 2
| Enable [[SPI Registers]] 0x10143000.
|}

== CFG11_BOOTROM_OVERLAY_CNT ==
Bit0: Enable bootrom overlay functionality.

== CFG11_BOOTROM_OVERLAY_VAL ==
The 32-bit value to overlay data-reads to bootrom with. See [[#CFG11_MPCORE_BOOTCNT|CFG11_MPCORE_BOOTCNT]].

== CFG11_SOCINFO ==
Read-only register.

{| class="wikitable" border="1"
! Bits
! Description
! Used by
|-
| 0
| 1 on both Old3DS and New3DS.
| Boot11
|-
| 1
| 1 on New3DS.
| Kernel11
|-
| 2
| Clock modifier: if set, use a 3x multiplier, otherwise 2x
| Kernel11
|}

== CFG11_MPCORE_CLKCNT ==
This is used for configuring the New3DS ARM11 CPU clock-rate. This register is New3DS-only: reading from here on Old3DS always returns all-zeros even when one tried writing data here prior to the read.

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Enable clock multiplier? This must be set to 1 before writing a non-zero value to bit1-2, otherwise freeze.
|-
| 1-2
| Clock multiplier (0=1x, 1=2x, 2=3x, 3=hang)
|-
| 15
| Busy
|}

[[SVC#KernelSetState|svcKernelSetState]] type10, only implemented on New3DS, uses this register. That code writes the following values to this register, depending on the input Param0 bit0 state, and the state of CFG11_MPCORE_CFG:
{| class="wikitable" border="1"
! Register value
! Higher-clockrate bit set in svcKernelSetState Param0
! CFG11_MPCORE_CFG bit2 set
! MPCore timer/watchdog prescaler value, prior to subtracting it by 0x1 when writing it into hw/state
! Clock-rate multiplier
! Description
|-
| 0x01
| No
| Yes
| 0x01
| 1x
| 268MHz
|-
| 0x02
| No
| No
| 0x01
| 1x
| 268MHz
|-
| 0x05
| Yes
| Yes
| 0x03
| 3x
| 804MHz
|-
| 0x03
| Yes
| No
| 0x02
| 2x
| 536MHz (tested on New3DS)
|}

Note that the above CFG11_MPCORE_CFG bit is 1 on New3DS, and 0 on Old3DS. Since this SVC is only available with the New3DS ARM11-kernel, the only additional available clock-rate is 804MHz when running on New3DS(with official kernel code).

The following register value(s) were tested on New3DS by patching the kernel:
* 0x00: Entire system hangs.
* 0x02: Entire system hangs.
* 0x03: ARM11 runs at 536MHz.
* 0x04: Entire system hangs.
* 0x06: Entire system hangs.
* 0x07: Same result as 0x05.
* 0x08: Entire system hangs.
* 0x09: Entire system hangs.
* 0x0A: Entire system hangs.
* 0x0B: Same result as 0x03.
* 0x0C: Entire system hangs.
* 0x0D: Same result as 0x05.
* 0x0E: Entire system hangs.
* 0x0F: Same result as 0x05.
* 0x1F, 0x2F, 0x4F, 0x8F, 0xFF: Same result as 0x05.

== CFG11_MPCORE_CNT ==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Power on 3rd ARM11 MPCore maybe?
|-
| 8
| Power on 4th ARM11 MPCore maybe?
|}

== CFG11_MPCORE_BOOTCNT<0-3> ==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Enable bootrom instruction overlay, maybe? This bit is only writable for core2 and core3.
|-
| 1
| Enable bootrom data overlay. This bit is only writable for core2 and core3.
|-
| 4
| Has core booted maybe?
|-
| 5
| Always 1?
|}

The normal ARM11 bootrom checks cpuid and hangs if cpuid >= 2. This is a problem when booting the 2 additional New3DS ARM11 MPCores. NewKernel11 solves this by using a hardware feature to overlay the bootrom with a configurable branch to a kernel function. This overlay feature was added with the New3DS.

Bit1 in register above enables a bootrom data-override for physical addresses 0xFFFF0000-0xFFFF1000 and 0x10000-0x11000. All _data reads_ made to those regions now read the 32-bit value provided in [[#CFG11_BOOTROM_OVERLAY_VAL|CFG11_BOOTROM_OVERLAY_VAL]].

Bit0 enables a bootrom instruction-overlay which means that _instruction reads_ made to the bootrom region are overridden. We have not been able to dump what instructions are actually placed at bootrom by this switch (because reading the area only yields data-reads). Jumping randomly into the 0xFFFF0000-0xFFFF1000 region works fine and jumps to the value provided by the data overlay [[#CFG11_BOOTROM_OVERLAY_VAL|CFG11_BOOTROM_OVERLAY_VAL]]. Thus we may predict that the entire bootrom region is filled by:
ldr pc, [pc]

Or equivalent. However, jumping to some high addresses such as 0xFFFF0FF0+ will crash the core. This may be explained by prefetching in the ARM pipeline, and might help us identify what instructions are placed by the instruction-overlay.

==CFG11_GPUPROT==
{| class="wikitable" border="1"
! Old3DS
! Bits
! Description
|-
| style="background: green" | Yes
| 3-0
| Old FCRAM DMA cutoff size, 0 = no protection.
|-
| style="background: red" | No
| 7-4
| New FCRAM DMA cutoff size, 0 = no protection.
|-
| style="background: green" | Yes
| 8
| AXIWRAM protection, 0 = accessible.
|-
| style="background: red" | No
| 10-9
| QTM DMA cutoff size
|-
| style="background: green" | Yes
| 31-11
| Zeroes
|}

For the old FCRAM DMA cutoff, it protects starting from 0x28000000-(0x800000*x) until end of FCRAM. There is no way to protect the first 0x800000-bytes.

For the new FCRAM DMA cutoff, it protects starting from 0x30000000-(0x800000*x) until end of FCRAM. When the old FCRAM cutoff is set to non-zero, the first 0x800000-bytes bytes of new FCRAM are protected.

On New3DS the old+new FCRAM cutoff can be used at the same time, however this isn't done officially.

For the QTM DMA cutoff, it protects starting from 0x1F400000-(0x100000*x) until end of QTM mem.

On cold boot this reg is set to 0.

When this register is set to value 0, the GPU can access the entire FCRAM, AXIWRAM, and on New3DS all QTM-mem.

[[SVC|Initialized]] during kernel boot, and used with [[SVC]] 0x59 which was implemented with [[11.3.0-36|v11.3]].

==CFG11_WIFICNT==
{| class="wikitable" border="1"
! Old3DS
! Bits
! Description
|-
| style="background: green" | Yes
| 0
| Enable wifi subsystem
|}

==CFG11_TWLMODE_0==
Observed 0x8001 when running under TWL_ and AGB_FIRM, 0 NATIVE_FIRM.

This address is poked from ARM7 to signal that it has booted and begun executing code. The ARM7-mode address for this register is 0x4700000.

The very last 3DS-mode register poke the [[FIRM|TWL_FIRM]] Process9 does before it gets switched into TWL-mode, is writing 0x8000 to this register. Before writing this register, TWL Process9 waits for ARM7 to change the value of this register. The Process9 code for this runs from ITCM, since switching into TWL-mode includes remapping all ARM9 physical memory.

Writing 0x8000 to here from the ARM9 with NATIVE_FIRM running doesn't seem to do anything, other reg-pokes likely need done first.

==CFG11_TWLMODE_1==
Observed 0x8000 when running under TWL_FIRM, 0 NATIVE_FIRM.

==CFG11_TWLMODE_2==
Bitfield.

==CFG11_TWLMODE_HID==
The value of this register is copied to [[HID_Registers|HID_?]] under certain conditions.

==CFG11_WIFIUNK==
{| class="wikitable" border="1"
! Old3DS
! Bits
! Description
|-
| style="background: green" | Yes
| 4
| Wifi-related? Set to 1 very early in NWM-module.
|}

==CFG11_GPU_CNT==
This one seems to control the LCD/GPU/Backlight.

Bit0: Enable GPU registers at 0x10400000+.
Bit16: Turn on LCD backlight.

==CFG11_GPU_CNT2==
Bit0: Power on GPU?

==CFG11_GPU_CNT3==
Bit1: FCRAM access from ARM11? Clearing this bit in 3DS-mode causes the ARM11 and ARM9 to hang/crash.

==CFG11_CODEC==
The following is the only time the ARM11 CODEC module uses any 0x1EC41XXX registers. In one case CODEC module clears bit1 in register 0x1EC41114, in the other case CODEC module sets bit1 in registers 0x1EC41114 and 0x1EC41116.

==CFG11_CODEC_CNT==
This is the power register used for the [[CFG11_Services|PDN]] CODEC service.

bit0 = unknown, bit1 = turn on/off DSP, rest = always 0.

==CFG11_CAMERA_CNT==
This is the power register used for the [[CFG11_Services|PDN]] camera service.

bit0 = unknown, bit1 = turn on/off cameras, rest = always 0.

PDN Services

2017-02-09T18:29:26Z

MassExplosion213: Register cleanup

[[Category:Services]]

= PDN PTM Service "pdn:s" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010000
| This loads [[CONFIG11 Registers|CFG11_PTM_0]] and [[CONFIG11 Registers|CFG11_PTM_1]], then writes them to cmdreplyword[2] and cmdreplyword[3].
|-
| 0x00020080
| [[CONFIG11 Registers|CFG11_PTM_1]] = cmdword[2] & cmdword[1]. This then writes cmdword[1] to [[CONFIG11 Registers|CFG11_PTM_0]]. [[CONFIG11 Registers|CFG11_PTM_1]] = cmdword[2] & ~cmdword[1].
|-
| 0x00030040
| This writes cmdword[1] to [[CONFIG11 Registers|CFG11_PTM_1]].
|}

= PDN DSP Service "pdn:d" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x000100C0
| (u8 unk0, u8 unk1, u8 unk2) ?controls power to the DSP <just a guess>?
|}

= PDN CODEC Service "pdn:i" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010040
| This sets bit0 in [[CONFIG11 Registers#CFG11_CODEC_CNT|CFG11_CODEC_CNT]] to u8 cmd+4.
|-
| 0x00020040
| This sets bit1 in [[CONFIG11 Registers#CFG11_CODEC_CNT|CFG11_CODEC_CNT]] to u8 cmd+4.
|}

= PDN GSP service "pdn:g" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x000100C0
| (u8 value, u32 unk1, u16 unk2) ?controls power to the GPU <just a guess>?
|}

= PDN Camera Service "pdn:c" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010040
| This sets bit0 in [[CONFIG11 Registers#CFG11_CAMERA_CNT|CFG11_CAMERA_CNT]] to u8 cmd+4.
|-
| 0x000200000
| This writes [[CONFIG11 Registers#CFG11_CAMERA_CNT|CFG11_CAMERA_CNT]] & 1 to u8 cmdreply+8.
|}

1.0.0-0

2017-01-04T05:41:06Z

MassExplosion213: Created page with "Initial firmware version"

Initial firmware version

Homebrew Exploits

2016-09-28T02:31:09Z

MassExplosion213: Add color, because why not

==Payload==
{| class="wikitable" border="1"
|-
! Works on latest fw
! Name
! Description
! Supported firmwares
|-
| style="background: lightgreen" | Yes
| [https://smealum.github.io/3ds/ *hax payload]
| Booted by all of the below non-sysmodule exploits.
| From '''9.0.0-7''' up to and including '''11.1.0-34'''.
|}

For the rest of this page, "Supported firmwares" refers to the exploit ''itself'', not whether *hax payload supports it.

==Standalone Homebrew Launcher Exploits==
The following homebrew exploits can be executed on a previously un-exploited system. ''Please'' see the above Payload section regarding what "Supported firmwares" indicates ''exactly''.

{| class="wikitable" border="1"
|-
! Works on latest fw
! Name
! Supported firmwares
! Requirements
! Author
! Install
|-
| style="background: salmon" | No
| [[ninjhax|Ninjhax 1.1b]]
| From '''4.0.0-7''' up to and including '''9.2.0-20'''.
| A cartridge or eShop version (JPN-only) of "Cubic Ninja".
| smea
| [http://smealum.net/ninjhax/ Install]
|-
| style="background: lightgreen" | Yes
| [[ninjhax|Ninjhax 2.x]]
| From '''9.0.0-7''' up to and including '''11.1.0-34'''.
| A cartridge or eShop version (JPN-only, not available anymore for purchase) of "Cubic Ninja".
| smea
| [https://smealum.github.io/ninjhax2/ Install]
|-
| style="background: lightgreen" | Yes
| [http://plutooo.github.io/freakyhax/ freakyhax]
| From '''9.0.0-7''' up to and including '''11.1.0-34'''.
| A cartridge or eShop version (USA/EUR/JAP, not available anymore for purchase) of "Freakyform Deluxe".
| plutoo
| [http://plutooo.github.io/freakyhax/ Install]
|-
| style="background: salmon" | No
| [http://plutooo.github.io/smilehax/ smilehax]
| From '''9.0.0-7''' up to and including '''11.0.0-33'''
| SmileBASIC (JPN all versions up to 3.32 excluded, USA 3.31 only)
| plutoo
| [http://plutooo.github.io/smilehax/ Install]
|-
| style="background: salmon" | No
| [http://mrnbayoh.github.io/basicsploit/ BASICSploit]
| From '''9.0.0-7''' up to and including '''11.0.0-33'''
| SmileBASIC (USA all versions)
| MrNbaYoh
| [http://mrnbayoh.github.io/basicsploit/ Install]
|-
| style="background: lightgreen" | Yes
| [[smashbroshax|smashbroshax]] (beaconhax)
| (New 3DS only) From '''9.0.0-X''' up to and including '''11.1.0-34'''.
| Super Smash Bros 3DS (full-game) and a way to broadcast raw wifi beacons. The demo (prior to the updated November 2015 [https://github.com/yellows8/3ds_smashbroshax version]) isn't usable with the *hax payloads. Game-version v1.1.3 fixed the vuln used with this, see the repo for a workaround for that.
| [[User:Yellows8|Yellows8]]
| [https://github.com/yellows8/3ds_smashbroshax Install]
|-
| style="background: salmon" | No
| [[browserhax]]
| From '''9.0.0-2''' to '''11.0.0-33'''
Note that the browser-version-check bypass is only usable prior to [[10.7.0-32]].
| A USA, EUR, JPN, or KOR system.
| [[User:Yellows8|Yellows8]]
| [http://yls8.mtheall.com/3dsbrowserhax.php Install]
|}

Note that ninjhax 1.x is still not obsolete. Even though ninjhax 2.x can be run on 9.3+, this was made possible (amongst other things) by sacrificing the memory remapping exploit used in ninjhax 1.x (rohax). Therefore, things like JIT engines for emulators can only be supported on ninjhax 1.x. Furthermore, ninjhax 2.x does not run on system versions below 9.0.0-X, while ninjhax 1.x does.

==Secondary Exploits==
Installation of these exploits requires a previously exploited system to install. After installation, they can be used on their own. ''Please'' see the above Payload section regarding what "Supported firmwares" indicates ''exactly''.

{| class="wikitable" border="1"
! Works on latest fw
! Name
! Supported firmwares
! Requirements
! Author
! Install
|-
| style="background: salmon" | No
| [[ironhax]]
| From '''9.5.0-X''' up to and including '''10.3.0-X''', for '''X''' up to and including 28.
| A copy of "Ironfall: Invasion" downloaded from eShop before August 11th, 2015. Note the updated version that was released on October 13th, 2015 is not supported.
| smea
| [http://smealum.github.io/3ds/ Install]
|-
| style="background: lightgreen" | Yes
| [http://vegaroxas.github.io/ steelhax]
| From '''9.0.0-X''' up to and including '''11.1.0-X''', for '''X''' up to and including 34.
| A copy of Steel Diver: Sub wars
| Vegaroxas
| [https://github.com/VegaRoXas/vegaroxas.github.io/raw/master/files/steelhax-installer.zip Install]
|-
| style="background: lightgreen" | Yes
| [https://github.com/yellows8/oot3dhax oot3dhax]
| From '''9.0.0-X''' up to and including '''11.1.0-X''', for '''X''' up to and including 34.
| A gamecard or eShop-install of Legend of Zelda: Ocarina of Time 3D. Besides using the installer app, writing raw saveimages with a save dongle for example is another option. Before compression was introduced in the 2016-7-18 release, the size of the *hax payload meant the exploit can't coexist with regular saves on a physical version of the game.
| Yellows8 / smea et al.
| See [https://smealum.github.io/3ds/ here].
|-
| style="background: salmon" | No
| [[menuhax]]
| JPN/USA/EUR: From '''9.0.0-X''' up to and including '''11.0.0-X'''.
KOR: From '''9.6.0-X''' up to and including '''11.0.0-X'''.
| JPN/USA/EUR: Having created [[Home_Menu#Home_Menu_Theme_SD_ExtData|theme extdata]] through opening the official theme selector at least once.
| [[User:Yellows8|Yellows8]]
| [https://github.com/yellows8/3ds_homemenuhax/releases Download]
|-
| style="background: lightgreen" | Yes
| [https://github.com/shinyquagsire23/supermysterychunkhax supermysterychunkhax]
| From '''9.9.0-X''' (USA/JPN) / '''10.2.0-X''' (EUR) up to and including '''11.1.0-X''', for '''X''' up to and including 34.
| A gamecard or eShop-install of Pokémon Super Mystery Dungeon.
| Shiny Quagsire / SALT team
| [https://smd.salthax.org/ Install].
|-
| style="background: salmon" | No, exploit update required.
| [https://github.com/shinyquagsire23/v_hax (v*)hax]
| From '''9.0.0-X''' up to and including '''11.0.0-X''', for '''X''' up to and including 33.
Note that '''9.0.0-X''' is only required for the Homebrew Launcher - the game itself only requires '''2.1.0-X''' for primitive userland code execution.
| A copy of VVVVVV downloaded after March 2012 (v1). The game is not available anymore for purchase.
| Shiny Quagsire / SALT team
| [https://vvvvvv.salthax.org/ Install].
|-
| style="background: salmon" | No, exploit update required.
| [https://github.com/Dazzozo/humblehax humblehax]
| From '''9.0.0-X''' (USA/EUR) up to and including '''11.0.0-X''', for '''X''' up to and including 33.
| An eShop-install of Citizens of Earth (either v1 or v2), featured in the Humble "Friends of Nintendo" Bundle.
| Dazzozo / SALT team
| [https://citizens.salthax.org/ Install].
|-
| style="background: salmon" | No, exploit update required.
| [http://mrnbayoh.github.io/basehaxx/ basehaxx]
| From '''9.0.0-X''' up to and including '''11.0.0-X''', for '''X''' up to and including 33.
| A gamecard or eShop-install of Pokémon Omega Ruby / Alpha Sapphire.
| MrNbaYoh
| [http://mrnbayoh.github.io/basehaxx/ install]
|-
| style="background: lightgreen" | Yes
| [https://github.com/yellows8/stickerhax stickerhax]
| From '''9.0.0-X''' up to and including '''11.1.0-X'''.
| A gamecard or eShop-install of Paper Mario: Sticker Star.
| [[User:Yellows8|Yellows8]]
| [https://github.com/yellows8/stickerhax Here]
|}

==Exploits without Homebrew Launcher (Not recommended)==

'''Warning:''' The following exploits can run code, but are missing a 3DSX launcher. They cannot launch any homebrew in the 3DSX format.

{| class="wikitable" border="1"
|-
! Works on latest fw
! Name
! Supported firmwares
! Requirements
! Author
! Install
|-
| style="background: salmon" | No
| [[browserhax]] (Without the loader in the 3ds_browserhax_common repo)
| (Old3DS) From '''5.0.0-2''' to '''11.0.0-33''' (Pre-v5.0 is supported for some versions if you manually modify the source)

(New3DS) From '''9.0.0-20''' to '''11.0.0-33'''

Note that the browser-version-check bypass is only usable prior to [[10.7.0-32]].
| An USA, EUR, or JPN system.
| [[User:Yellows8|Yellows8]]
| [[browserhax|Install]]
|-
| style="background: salmon" | No
| Ninjhax (with specialized payloads)
| Up to '''9.2.0-20'''?
|
| smea + independent developers
| N/A
|}

==Previous Exploits==
'''Warning:''' These exploits '''do not work'''. They are exploits which no longer function at all, regardless of software or firmware revision.
{| class="wikitable" border="1"
! Works on latest fw
! Name
! Supported firmwares
! Requirements
! Author
! Install
|-
| style="background: salmon" | No
| [[tubehax|Tubehax]]
| None. '''Was''': From '''9.0.0-X''' up to and including '''10.1.0-X''', for '''X''' up to and including 27.
| The YouTube application and an Internet connection. As of October 15, 2015, this is no longer usable due to an update being released which fixes the vuln used by tubehax + app update being forced (see [[YouTube|here]]).
| smea
| [http://smealum.github.io/3ds/ Install]
|}

==Other Homebrew Loaders==
The [https://github.com/yellows8/hblauncher_loader hblauncher_loader] title can be used when running under modded-FIRM which allows running unsigned titles, to boot the *hax payloads.

==Sysmodule Exploits==
This section is for system-module exploits, which can be run from the *hax payloads.

{| class="wikitable" border="1"
! Works on latest fw
! Name
! Supported firmwares
! Requirements
! Author
|-
| style="background: lightgreen" | Yes, that's not the intended default use however.
| [https://github.com/yellows8/ctr-httpwn/releases ctr-httpwn]
| From '''9.6.0-X''' up to and including '''11.1.0-X'''.
| None
| [[User:Yellows8|Yellows8]]
|}

==WebKit vuln testing==
See [https://github.com/yellows8/3ds_browserhax_common/issues/28 here].

Talk:Homebrew Exploits

2016-08-15T11:38:20Z

MassExplosion213: /* Save File exploits of cartridger games */

== Save File exploits of cartridger games ==

do they really need a previously hacked system to be installed, I mean wouldnt it be possible that one person could make the exploit, backup the savegame via Powersaves or whatever and then others could reimport that?

Depends on the save crypto. Newer games have to have it done via exploits.

Homebrew Exploits

2016-07-17T22:17:01Z

MassExplosion213: Leave the page alone please.

==Standalone Homebrew Launcher Exploits==
The following homebrew exploits can be executed on a previously un-exploited system.

{| class="wikitable" border="1"
|-
! Works on latest fw
! Name
! Supported firmwares
! Requirements
! Author
! Install
|-
| style="background: salmon" | No
| [[ninjhax|Ninjhax 1.1b]]
| From '''4.0.0-7''' up to and including '''9.2.0-20'''.
| A cartridge or eShop version (JPN-only) of "Cubic Ninja".
| smea
| [http://smealum.net/ninjhax/ Install]
|-
| style="background: orange" | No; needs update.
| [[ninjhax|Ninjhax 2.x]]
| From '''9.0.0-7''' up to and including '''10.7.0-32'''.
| A cartridge or eShop version (JPN-only) of "Cubic Ninja". (note that this can be used on 11.0.0-33, but the savegame cannot be installed via the QR scanner, due to httpc access being revoked)
| smea
| [https://smealum.github.io/ninjhax2/ Install]
|-
| style="background: lightgreen" | Yes
| [http://plutooo.github.io/freakyhax/ freakyhax]
| From '''9.0.0-7''' up to and including '''11.0.0-33'''.
| A cartridge or eShop version (USA/EUR/JAP) of "Freakyform Deluxe".
| plutoo
| [http://plutooo.github.io/freakyhax/ Install]
|-
| style="background: lightgreen" | Yes
| [[smashbroshax|smashbroshax]] (beaconhax)
| (New 3DS only) From '''9.0.0-X''' up to and including '''11.0.0-33'''.
| Super Smash Bros 3DS (full-game) and a way to broadcast raw wifi beacons. The demo (prior to the updated November 2015 [https://github.com/yellows8/3ds_smashbroshax version]) isn't usable with the *hax payloads. Game-version v1.1.3 fixed the vuln used with this, see the repo for a workaround for that.
| [[User:Yellows8|Yellows8]]
| [https://github.com/yellows8/3ds_smashbroshax Install]
|-
| style="background: salmon" | No
| [[browserhax]]
| (Old 3DS) From '''9.0.0-16''' to '''9.5.0-22''', '''9.5.0-23''' to '''9.8.0-25''', '''9.9.0-26''' to '''10.1.0-27''', '''10.2.0-28''' to '''10.5.0-30'''

(New 3DS) From '''9.0.0-20''' to '''9.2.0-20''', '''9.3.0-21''' to '''9.5.0-23''', '''9.6.0-24''' to '''9.8.0-25''', '''9.9.0-26''' to '''10.1.0-27''', '''10.2.0-28''' to '''10.5.0-30'''

Note that the browser-version-check bypass is only usable prior to [[10.7.0-32]].
| An USA, EUR, or JPN system.
| [[User:Yellows8|Yellows8]]
| [http://yls8.mtheall.com/3dsbrowserhax.php Install]
|-
| style="background: lightgreen" | Yes
| [http://mrnbayoh.github.io/basicsploit/ BASICSploit]
| From '''9.0.0-7''' up to and including '''11.0.0-33'''
| SmileBASIC (USA only, JPN to be supported soon.) downloaded from the eShop. This vuln is not yet fixed as of v3.3.1.
| MrNbaYoh
| [http://mrnbayoh.github.io/basicsploit/ Install]
|}

Note that ninjhax 1.x is still not obsolete. Even though ninjhax 2.x can be run on 9.3+, this was made possible (amongst other things) by sacrificing the memory remapping exploit used in ninjhax 1.x (rohax). Therefore, things like JIT engines for emulators can only be supported on ninjhax 1.x. Furthermore, ninjhax 2.x does not run on system versions below 9.0.0-X, while ninjhax 1.x does.

==Secondary Exploits==
Installation of these exploits requires a previously exploited system to install. After installation, they can be used on their own.

{| class="wikitable" border="1"
! Works on latest fw
! Name
! Supported firmwares
! Requirements
! Author
! Install
|-
| style="background: salmon" | No
| [[ironhax]]
| From '''9.5.0-X''' up to and including '''10.3.0-X''', for '''X''' up to and including 28.
| A copy of "Ironfall: Invasion" downloaded from eShop before August 11th, 2015. Note the updated version that was released on October 13th, 2015 is not supported.
| smea
| [http://smealum.github.io/3ds/ Install]
|-
| style="background: lightgreen" | Yes
| [https://github.com/yellows8/oot3dhax oot3dhax]
| From '''9.0.0-X''' up to and including '''11.0.0-X''', for '''X''' up to and including 33.
| A gamecard or eShop-install of Legend of Zelda: Ocarina of Time 3D. Besides using the installer app, writing raw saveimages with a save dongle for example is another option. Due to lack of free space with the size of the *hax payload, the only save-slot that can exist in the *gamecard* savedata is the oot3dhax save-slot.
| Yellows8 / smea et al.
| See [https://smealum.github.io/3ds/ here].
|-
| style="background: salmon" | No
| [[menuhax]]
| From '''9.0.0-X''' up to and including '''10.5.0-X''', for '''X''' up to and including 30.
|
| [[User:Yellows8|Yellows8]]
| [https://github.com/yellows8/3ds_homemenuhax/releases Download]
|-
| style="background: lightgreen" | Yes
| [https://github.com/shinyquagsire23/supermysterychunkhax supermysterychunkhax]
| From '''9.9.0-X''' (USA/JPN) / '''10.2.0-X''' (EUR) up to and including '''11.0.0-X''', for '''X''' up to and including 33.
| A gamecard or eShop-install of Pokémon Super Mystery Dungeon.
| Shiny Quagsire / SALT team
| [https://smd.salthax.org/ Install].
|-
| style="background: lightgreen" | Yes
| [https://github.com/shinyquagsire23/v_hax (v*)hax]
| From '''9.0.0-X''' up to and including '''11.0.0-X''', for '''X''' up to and including 33.
Note that '''9.0.0-X''' is only required for the Homebrew Launcher - the game itself only requires '''2.1.0-X''' for primitive userland code execution.
| A copy of VVVVVV downloaded after March 2012 (v1)
| Shiny Quagsire / SALT team
| [https://vvvvvv.salthax.org/ Install].
|-
| style="background: lightgreen" | Yes
| [https://github.com/Dazzozo/humblehax humblehax]
| From '''9.0.0-X''' (USA/EUR) up to and including '''11.0.0-X''', for '''X''' up to and including 33.
| An eShop-install of Citizens of Earth, featured in the Humble "Friends of Nintendo" Bundle.
| Dazzozo / SALT team
| [https://citizens.salthax.org/ Install].
|-
| style="background: lightgreen" | Yes
| [http://mrnbayoh.github.io/basehaxx/ basehaxx]
| From '''9.0.0-X''' up to and including '''11.0.0-X''', for '''X''' up to and including 33.
| A gamecard or eShop-install of Pokémon Omega Ruby / Alpha Sapphire.
| MrNbaYoh
| [http://mrnbayoh.github.io/basehaxx/ install]
|}

==Exploits without Homebrew Launcher (Not recommended)==

'''Warning:''' The following exploits can run code, but are missing a 3DSX launcher. They cannot launch any homebrew in the 3DSX format.

{| class="wikitable" border="1"
|-
! Works on latest fw
! Name
! Supported firmwares
! Requirements
! Author
! Install
|-
| style="background: salmon" | No
| [[browserhax]] (Without the loader in the 3ds_browserhax_common repo)
| (Old3DS) From '''2.1.0-4''' to '''3.0.0-6''', '''4.0.0-7''' to '''4.5.0-10''', '''5.0.0-11''' to '''7.0.0-13''', '''7.1.0-16''' to '''9.5.0-22''', '''9.5.0-23''' to '''9.8.0-25''', '''9.9.0-26''' to '''10.1.0-27''', '''10.2.0-28''' to '''10.5.0-30'''

(New3DS) From '''9.0.0-20''' to '''9.2.0-20''', '''9.3.0-21''' to '''9.5.0-23''', '''9.6.0-24''' to '''9.8.0-25''', '''9.9.0-26''' to '''10.1.0-27''', '''10.2.0-28''' to '''10.5.0-30'''

Note that the browser-version-check bypass is only usable prior to [[10.7.0-32]].
| An USA, EUR, or JPN system.
| [[User:Yellows8|Yellows8]]
| [[browserhax|Install]]
|}

==Previous Exploits==
'''Warning:''' These exploits '''do not work'''. They are exploits which no longer function at all, regardless of software or firmware revision.
{| class="wikitable" border="1"
! Works on latest fw
! Name
! Supported firmwares
! Requirements
! Author
! Install
|-
| style="background: salmon" | No
| [[tubehax|Tubehax]]
| None. '''Was''': From '''9.0.0-X''' up to and including '''10.1.0-X''', for '''X''' up to and including 27.
| The YouTube application and an Internet connection. As of October 15, 2015, this is no longer usable due to an update being released which fixes the vuln used by tubehax + app update being forced(see [[YouTube|here]]).
| smea
| [http://smealum.github.io/3ds/ Install]
|}

==Other Homebrew Loaders==
The [https://github.com/yellows8/hblauncher_loader hblauncher_loader] title can be used when running under modded-FIRM which allows running unsigned titles, to boot the *hax payloads.

==Sysmodule Exploits==
This section is for system-module exploits, which can be run from the *hax payloads.

{| class="wikitable" border="1"
! Works on latest fw
! Name
! Supported firmwares
! Requirements
! Author
|-
| Yes, that's not the intended default use however.
| [https://github.com/yellows8/ctr-httpwn/releases ctr-httpwn]
| From '''9.6.0-X''' up to and including '''11.0.0-X'''.
| None
| [[User:Yellows8|Yellows8]]
|}

==WebKit vuln testing==
See [https://github.com/yellows8/3ds_browserhax_common/issues/28 here].

Homebrew Exploits

2016-07-17T22:12:03Z

MassExplosion213: Please stop..

Homebrew Exploits

2016-07-17T22:08:21Z

MassExplosion213: Stop.

Homebrew Exploits

2016-07-17T22:04:51Z

MassExplosion213: Seriously, stop with the vandalism

Homebrew Exploits

2016-07-17T21:57:47Z

MassExplosion213: Yea..no.

3DS Development Unit Software

2016-06-23T11:21:58Z

MassExplosion213: /* TWLNandFiler */

The following is a description of the functions what is possible with the applications unique to 3DS Development Units.

For information on 3DS Development Hardware see [http://gbatemp.net/topic/327858-3ds-development-hardware/]
[[File:CTR_HMN_DEV.png|300px|thumb|right|Beautifully clear picture of the Dev Apps + Home Menu. Click to view in great quality. - Xcution]]

=CTR-SDK=
Descriptions Derived from SDK 2.3.4 except where notified otherwise.

== Dev Menu ==
[[File:Devmenuicon.png|||left]]

[[File:Devmenscnsht.jpg|250px|thumb|right|Dev Menu Screenshots]]
[[File:Old_Dev_Menu.png|200px|thumb|right|Old Dev Menu Screenshot]]

This application on the top screen displays the firmware and revision of the Dev Menu, the free space available on the [[Flash Filesystem#TWL partition|TWL(DSi) NAND partition]] and [[SD Filesystem|SD card]] if present. It also provides information on the current file or device selected, as well as navigation instructions for the bottom screen.The bottom screen has three different windows, which are:

*Program - From this tab, applications can be loaded from the [[Flash Filesystem|NAND]], the [[SD Filesystem|SD card]] and the slot 1 card (only a select scope of applications, see below for Dev Menu revisions and their corresponding scope of applications). Installed software can be uninstalled by pressing X on it.

*Import - From this tab, the SD card can be browsed to select and install a .[[CIA]] file. In later revisions this was renamed to ''SDMC''. In addition to the marked controls, also pressing X while requesting the installation of one or more CIA will delete them after a successful installation.

*HIO - "Host IO" A tab available in later revisions of the Dev Menu. Used for installing CIAs stored on the host PC, this is supported by hio services, and hio daemon on the host PC. Only usable on PARTNER-CTR (Capture+)Debugger, as HIO requires a direct USB connection with the console.

*ExtData - From this tab, the 3DS's [[Extdata]] (except NAND shared extdata) can be deleted.

*SExtData - "Shared Extdata", this feature was removed early on in the history of this app.

Titles are shown in the Program tab by [[Titles|Unique ID]] and by their [[Product code]] (CTR)/name in header (TWL); some other non-executable special titles (applets or CFAs), explicitly programmed in the specific version of DevMenu, are displayed in red.

To perform a manual update with CIAs on a dev unit, pressing Start + Y while highlighting the NATIVE_FIRM CIA will trigger an option to update firmware, thus allowing a downgrade.

Pressing L + R + Left + B + Start will, after confirmation, bulk uninstall all SDK tools. DevMenu itself will crash a few seconds later.

{| class="wikitable" border="1"
|-
! SDK Version
! Titles Accessible
|-
| 0.9.2 - 0.13.2
| Applications(NAND), System Applications , TWL Titles
|-
| 0.14.0 - 1.1.0
| Dev NAND Applications, System Applications , TWL Titles
|-
| 1.2.0 - 2.0.0
| Dev NAND Applications, DSiWare
|-
| 2.1.0 - 2.4.0
| Applications(SD), Dev NAND Applications, DSiWare
|-
| 3.0.0 - 3.1.0
| Applications(SD), Dev NAND Applications, Demos, DSiWare
|-
| 3.2.0
| Applications(SD), Dev NAND Applications, Demos, DSiWare, WebBrowser
|-
| 3.3.0 - ?
| Applications(SD), Dev NAND Applications, Demos, DSiWare, WebBrowser, TwlNandFiler
|-
| 11.4 (0.24.67)
| Applications(SD), Dev NAND Applications, Demos, DSiWare, WebBrowser, eShop, Miiverse, TwlNandFiler, dummy CFA
|}

== Config ==
[[File:Configicon.png|||left]]

[[File:3DS_dev_configmenu.JPG|250px|thumb|right|Config Menu Screenshot]]
[[File:Dev config.jpg|250px|thumb|right|Newer Config Menu Screenshot]]

This application is a text-mode advanced configuration menu for the 3DS.

When open, similiarly to the regular [[System Settings]], the Home menu is not accessible, and the console is forced to be rebooted on exit (accomplished by pressing the Power button).

The functionality and menu layout of this app has changed a lot over its continuous development; some features include:

*Menu - (Home Menu/Test Menu) This function edits the [[Config_Savegame|configuration]] field containing the menu TID for dev units, allowing the user to choose between the [[Home Menu]] or the [[3DS Development Unit GUI#Test Menu|Test Menu]], as the menu loaded by the [[NS]] module.

*Language - same options found in the Language section of [[System Settings]] but also has an "invalid" option

*System Mode - [[Memory_layout#FCRAM_memory-regions_layout|Changes the memory mode]] for the Home/Test Menu. (Launching applications will be able to override this setting)
:*Prod - 64MB Memory mode ([[Home Menu]] can usually only run in this mode and ''most'' retail-looking units cannot switch out of this mode)
:*Dev1 - 96MB Memory mode (No browser/Miiverse)
:*Dev2 - 80MB Memory mode
:*Dev3 - 72MB Memory mode
:*Dev4 - 32MB Memory mode
:*snake Prod - 124MB for New-3DS
:*snake dev1 - 178MB for New-3DS (No browser/Miiverse)
:*snake dev2 - 124MB for New-3DS
:All CTR Debuggers/Prototype units can change memory allowance. For Developer Test Units, the ability to change Memory Allowance, appears to be dependent on an option when buying the Test Unit (similar to having a choice to purchase IS-Nitro's Wireless/USG options when buying an IS-Nitro from Nintendo). If anything other than prod or dev2 is selected, menu settings are automatically changed to test menu.
:On some Test Units, it's possible to run the [[Home Menu]] outside of Prod. However, software with limited memory (such as the web browser) cannot be launched from the home menu if the home menu is outside of Prod.

*Exception handler - Selects whether to enable or disable the application's handling of exceptions that arise in the non-debug environment.
:If the application is not set to handle exceptions, the application quits when an exception occurs. - enable/disable

*Break Stop - (enable/disable) - Selects whether to enable or disable stopping the application when a break is encountered in the non-debug environment. If the application is not made to stop, it quits on a break.

*Debug Mode - (enable/disable) - Select enable or disable to enable and disable debugging functions.
:Debugging is always disabled for retail products.

*Dlp Force Child Import/Dlp Debug - (enable/disable) - normally the 3ds caches downloaded "Download Play (Dlp)" applications on the nand and only re-downloads, overwriting the cached copy if the version application being requested to downloaded is higher than what is currently present on the nand. Enabling this option forces the 3ds to download and overwrite the cached copy on the nand, regardless of the version of the application being downloaded. This is of course for testing purposes.

*Fangate Failure Emulation - Unknown, related to the external Amiibo receiver?

*Nup - Unknown

*FS Latency Emulation - Filesystem Latency, in milliseconds (0ms-2550ms). Selection is in increments of 10. (ie 0ms->10ms->20ms...)

*User Name - Console owner's "profile" nickname, unrelated to the Personal Mii

*NG Name Flag - declares whether the name is "not good", i.e. contains a banned word. Normally automatically set by System Settings after a warning; effect unknown.

*CountryId - Changes 3DS between installed countries. It can also be set to an undefined ID (255).

*RegionId - Selects the sub-location (region, state, county), if supported by the selected country. Unidentified is displayed when RegionId is set to 255.

*Hid Setting - (human interface device) Calibrates Touch-Pad and Analog stick.

*FLICKER TOP - Bias voltage for top screen (the misattributed "contrast" or "scanline" control found as potentiometers in the battery compartment in previous color-display Nintendo portables)

*FLICKER BOTTOM - Bias voltage for bottom screen

* ABL ENABLE - "Power Save mode", adjusts backlight according to displayed image. Can also be enabled on 2DS, on which it is fully functional but the single backlight design may bring questionable results.

* LUMINANCE LEVEL - Brightness. In older versions of Config, it could be set above 5, with no further increment and resulting in crashes of the Home Menu's quick settings.

* BACKLIGHT DIMMING - Camera-controlled automatic backlight of New-3DS

*RTC Setting - (real time clock) Sets system time, with equivalent results to System Settings.

*Raw RTC Setting - Adjusts time [[Anti Time-Travel|directly on the hardware RTC]]. The resulting time is also displayed as a convenience. If the application being tested uses GetUserTimeOffset() to detect if the user has changed the clock, this can be used to change the clock without the application detecting it.

*Eula Setting - Allows user to change "Agree Version" namely: "ff.ff" the two symbol sets are interchangeable with combination variations from aa to 99 (default is 00.00 where the Eula is not accepted yet).

*Sound Mode - mono/stereo/surround

*Coppacs Setting - In the U.S., a law called the Children's Online Privacy Protection Act (COPPA) requires consent from the parent or guardian for collection and use of personal information from children under the age of 13. Canada has a nearly identical law. This setting is [[Cfg:GetRegionCanadaUSA|only enabled for software for the Americas region, and when the country in System Settings is set to the US or Canada]].

*Olv Access Key - Unknown (Might refer to Olive/OLV Miiverse Library). Always appears to be 0 on retail units.

*Test Setting - Verify operation and calibration of touchscreen and joystick.

*Stereo Camera Cal for Check - Apparently writes incorrect calibration data for the camera.

*Gyro / Accel Cal for Check - Apparently writes incorrect calibration data for the motion sensors.

*Ctr Info Setting - Loads settings from a ctrsetting.txt present on the SD. Such a sample file is provided in the resources/configtool folder of the SDK.
:The feature set of this option is only in most part the same as the interactive UI's, for instance ctrsetting.txt can also configure the DS Profile and [[Parental Controls]].

*Reset Settings - Resets all settings to default. The initial configuration will be run again, but installed applications or their data will not be deleted unlike in a [[System Format]].

== Downloadplay Client ==
[[File:Dlpcliscnsht.jpg|250px|thumb|right|Downloadplay Client Screenshots]]
[[File:Dlpcliicon.png|||left]]

Even though a Developer 3DS has a "Download Play" application visually identical to the retail 3DS [[Download Play|application]], the "Downloadplay Client" application can be installed as an alternative to the regular Download Play application. (Note: a Developer 3DS' and Retail 3DS' cannot receive download play 'children' from each-other.) This Developer application is a stripped down version of 'Download Play' which has the following options and limitations:

*It can only download 3ds download play titles

*Scraps the GUI found in the normal Download Play application (see screenshot)

*Can select from a maximum of 16 Download play 'servers'

This application is clearly used for easy testing of download play 'child' apps, without the hassle of constantly re-navigating the normal Download Play interface

== Network Settings ==
[[File:Netsetscnsht.jpg|250px|thumb|right|Network Settings Screenshots]]
[[File:Netseticon.png|||left]]

This Developer application allows the users to directly modify the following from any of the three possible network setting 'slots'

*Security Mode :(the wireless encryption the network is using) OPEN/WEP 40bit/WEP 104bit/128bit/WPA TKIP/WPA2 TKIP/WPA AES/WPA2 AES

*SSID :(self-explanitory) maximum 32 characters

*KEY :(the key for the encrytion is here in plain text) the maximum length depends on encryption type

*AutoDNS :(whether the 3DS obtains the DNS automatically or not) |True-3DS obtains the DNS automatically|False-3DS uses the DNS server address provided by the user(it is possible to edit this here)|

At the bottom of the setting options there are two choices:

*Write Setting & Connect Test To AP - Applies the settings above and performs a connection test(note any settings made in system settings for this connection, which are not present in the above settings will be nullified, for example any proxy server settings)

*Remove Setting - removes all settings for this 'slot'

== SaveDataFiler ==
[[File:Saveflicon.png|||left]]
[[File:Saveflscnsht.jpg|250px|thumb|right|SaveDataFiler Screenshots]]

This 3DS Developer application allows save files and extdata to be exported and imported from an SD Card. The window has three tabs:

*User - This is where saves for 3DS-mode installed and cartridge applications can be exported to the SD Card. After the initial release, button combinations for deleting the entire save archive or resetting the [[Anti Savegame Restore|secure value system]] for the selected title were added. The selected save archive can also be browsed by pressing A.
The entire save or individual files can be deliberately corrupted.

*ExtData - This is where application extdata can be deleted or exported to the SD Card for later use

*SD - This is where backups created through the first two tebs can be re-imported (with the options of an automatic target selection, or explicitly choosing the SD or the Game Card). Exported data can also be deleted here.

Applications are listed only by Unique Id. TWL-mode software is ignored by this application, while GBA-mode apps will always be shown as not ever having saved ("broken" and highlighted in red).

User save data is exported to sdmc:/filer/UserSaveData/YYYYMMDD(Hour)(Minute)(Second)

It creates a folder in that path and 3 files. The 2 files exported to the above path are <uniqueID>.dat and <uniqueID>_.dat while a folder named /<uniqueID>/ in that path contains <ExHeader Name>.dat

Pressing L+R+Start will, after confirmation, delete all [[Shared Extdata]]. Home Menu will crash if returned to before rebooting.

== CTR MenuSelector ==
[[File:MenuSelector.png|120px|thumb|right|Menu Selector Screenshot]]
[[File:Menuselectoricon.jpg|||left]]

This application when loaded can change the current 'Active Menu'(being used at the moment) by editing the menu TID [[Config_Savegame|configuration]] field, allowing the user to choose between the [[Home Menu]] or the [[3DS Development Unit GUI#Test Menu|Test Menu]], as the menu loaded by the [[NS]] module.
With the release of SDK 1.1.0, this application was superseded by the introduction of the "Menu" choice in the [[3DS Development Unit Software#Config|Config Menu]] and consequently removed as a standard application.

== CecBoxTool ==
Streetpass backup and restore tool, can also reset the MAC filter.

== CecLotCheckTool ==
[[File:Ceclotscnsht.jpg|250px|thumb|right|CecLotcheckTool Screenshot]]
[[File:Cecloticon.png|||left]]

This application is used to manage CECs (Chance Encounter Communications, AKA StreetPass hits) for any of the twelve possible applications used on the 3DS, if there are any. The application has twelve possible slots which can be filled by BOXes . The BOXes are individual applications which are permitted by the user to use CECs, such as StreetPass Mii Plaza or Nintendo 3DS Sound. And as such, the boxes in this application correspond to the applications in 'StreetPass Management', in 'System Settings' (StreetPass Management is accessible from retail 3DSs). The functions of this application:

*<Y> BOX Options - this opens up a sub menu with the following options(when hovering over Nintendo 3DS Sounds BOX - the only one I can test the app with):

*Box Info - Gives the Out-Box parameters [[File:Boxinf.jpg|250px|]]

*Message Info (OUT-BOX) - Gives the Message Parameters For the current BOX [[File:Mesinf.jpg|250px|]]

*Dummy Message Settings - Not quite sure what the options do here [[File:Dummesinf.jpg|250px|]]

*<A> Create Dummy BOXes - Creates dummy BOXes to fill any unused slots. (does not overwrite any present slots)

*<X> Delete BOXes - Deletes all of the BOXes from the slots.

*<START> CEC Filter Reset - Resets 8-hour per source rate limit. Requires other party to also do so (thus "abuse" of [[Nintendo Zone]]s can't be accomplished through this)

== BossLotCheckTool ==
[[File:Bosslcscnsht.png|100px|thumb|right|BossLotCheckTool Screenshot]]
[[File:Bosslcicon.png|||left]]

This application is used to manage BOSS (SpotPass) tasks/data for 3DS titles which utilise BOSS communications. 'Pokedex' is an application which utilizes BOSS comunications. This application also displays the 3DS's friend code, although this code is not to be confused with the 3DS's Friend Card code found in 'Friends List'. The user can browse by unique ID the 3DS titles(excluding system titles) registered to use BOSS. For each title you can view details about the downloaded 'NsData' which accompanies BOSS downloads, view the BOSS task lists (implies applications can perform more than one BOSS task). You can also view various details about each BOSS task, including:

TaskStatus : DONE?
TaskExecCount : How many times the BOSS task has been executed
TaskExecInterval : Period of time (in seconds) in the task is to be executed, in intervals
TaskPriority : Is a number value
URL : The URL to the BOSS content
AP Info : NONE?
TaskResultCode : Success or not
HTTP_StatusCode : Self explanatory
DataSize : Size of Content (in bytes)
Last_Modified : Last time the BOSS content (on server) was modified
StartTime : when the BOSS task was registered
OptOut : Whether the user can/has opted out of BOSS communication for this task

It also possible to manually execute the BOSS task from here

== Stereo Camera Calibrator ==
[[File:Stecamscnsht.png|100px|thumb|right|Stereo Camera Calibrator Screenshot]]
[[File:Stecamicon.png|||left]]

The Stereo Camera Calibrator (SCC), in a nutshell, allows the user to adjust the configuration of the outer cameras in relation to each other. It can be configured automatically by positioning the 3DS a set distance away from a special chart. It can also be configured manually, by setting the rotation of each camera image and the size of the right eye camera. The 3D effect can be perceived by superimposing the right eye camera image translucently with the left eye camera image or by viewing the 3D image directly by use of the parallax barrier in the 3DS Screen.

== FragDisk ==
Creates many small files on the SD card and deletes one out of two to fragment the free space.

== Model Viewer ==
[[File:ModelViewer.png|100px|thumb|right|3DS Model Viewer Screenshot]]
[[File:ModelViewericon.png|||left]]

As the name suggests this application allows the user to view models. It is supposed to be used with a CTR-Debugger, assumingly so models can be entered in the memory of the program. But the program can be used on Test Units, but the model is restricted to three coloured lines depicting the 3 dimensions (x,y,z). The model can be viewed from any angle or scale, the perspective is controlled by the circle pad and directional buttons. And of course the application utilises the 3D effect

== Friend Add Tool ==
Delete all friends, fill the Friend List with dummy FCs, or with ones loaded from friend_code.txt on the root of the SD card.

This file must contain 1-100 friend codes, one per line. Digits may be grouped at the user's discretion with spaces, dashes, or nothing.

== Friend Testing Partner ==
[[File:Ftestpscnsht.png|250px|thumb|right|Friend Testing Partner Screenshot]]
[[File:Ftestpicon.png|||left]]

The Friend Testing Partner application is used to test/monitor the 3DS's Friend List function. It allows the user to test various functions of the 3DS's out-going Friend Card, by giving the following options:
*Master Control - (RUN/STOP) (STOP is the default setting) when ‘STOP’ is selected the 3DS Friend Card uses the user’s settings/data. When ‘RUN’ is selected the 3DS Friend Card uses the dummy settings/data chosen to test from the settings bellow.

*Login/Logout - (ON/OFF) (ON is the default setting) What effect this has on the Friend Card is not known

*Playing Title - (ON/OFF) (ON is the default setting) When ‘ON’ is selected the currently used title is ignored and a dummy applications are cycled through as the ‘Playing Title’ approximately every ten seconds in its place. The dummy applications used are the applications found in Firmware version 1.0.0-0 of a retail 3DS including the ‘Nintendo Zone viewer’ app. When ‘OFF’ is selected the currently used title (which is the Friend Testing Partner app) is used as the ‘Playing Title’

*Mode Description - (ON/OFF) (ON is the default setting) When ‘ON’ is selected the Software in Use(Playing Title) is accompanied by the Date and Time found on that user’s 3DS. The Mode Description is refreshed every ten or so seconds. When ‘OFF’ is selected the date and time on the user’s 3DS is not displayed.

*Message - (ON/OFF) (ON is the default setting) When ‘ON’ is selected the message made by the user is replaced(not overwritten as it reverts back to the user’s choice when this is ‘OFF’) by the current date and time in the format “YYYYMMDD HHMMSS”, this is refreshed every ten or so seconds.

*Mii - (ON/OFF) (ON is the default setting) When 'ON' the currently used Mii is replaced with one of 4 dummy Miis and cycles them through every ten seconds with a new dummy mii. This effect can only be seen from another 3DS not the host

*Favorite Title (ON/OFF) (ON is the default setting) When 'ON' is selected, the user’s favorite title is replaced with a dummy, which is replaced every 10 or so seconds.
Also this application allows the user to monitor the whether the 3DS is online or not and whether the 3DS’s Friend Presence is online or offline. Every time a dummy setting is refreshed it is displayed on the top screen with a time stamp.

== Game Coin Setter ==
[[File:Coinsticon.png|||left]]
[[File:Coinstscnsht.png|100px|thumb|right|Game Coin Setter Screenshot]]

This application is used to set the Play Coin count on the 3DS. Obviously this was created so a developer can test parts of their game in which the player can exchange earned play coins for in-game content or similar. It has a very simple interface showing the current play coin count and the adjustable option, the target coin count. These are the controls with explanation of each:

*LEFT/RIGHT - using the D-pad only to adjust the 'Target Count' to a number between 0-300.

*A - Sets the 'Current Count' (amount of play coins the system has) to the user selected 'Target Count' (the user specified amount of play coins)

*L+R+X - "Preclude today's Increment" Sets byte 6 of [[Extdata#Shared_Extdata_0xf000000b_gamecoin.dat|the play coin database]] so that no coins will be earned for the current day anymore.

== IR Communication Checker ==
Counts data seen by the infrared port. It doesn't have to be valid, as it happily measures a camera flash...

== Dummy Nintendo eShop ==
This application exists to debug API(JumPToEshop( ) ) on the 3DS. This was created so a developer can test parts of their game in which the player can preview or purchase titles within a game. It is mainly used in conjunction with Downloadable content. It has a very simple interface showing the reason for its existence and controls for exiting to the home menu or finalizing the Dummy Shop. The Dummy Nintendo eShop also shares the same Title ID and Unique ID as the Retail Nintendo E-Shop.
[[File:INdummyshop.png|100px|thumb|right|SDK 7 DummyEshop Screenshot]]
[[File:dummyshop.png]]

== FangateFwUpdater ==
This is a tool for updating or destroying NFC reader/writer firmware. This tool cannot be used with SNAKE development devices or SNAKE development tools. It operates only with CTR development devices and CTR development tools.

== UdsLocalIdChecker ==
A scanner for local, console-to-console networks.

== TWL Development Tools ==

These are DSi/DS mode development tools repackaged into a [[CIA]], for installing to the TWL NAND.

=== NINTENDO DS - WMtest ===
[[File:Wmtestscnsht.jpg|300px|thumb|right|WMtest Screenshot]]
[[File:Wmtesttool.png|||left‎]]

This application is a TWL(DSi) application compiled for use on the 3DS. It is an wireless test tool with its uses explained below:

*Scan Test - Scans Wireless channels 1-13(can be focused on one specific channel) for broadcasting stations. It can detect two types of broadcasting stations:

:Wifi Access Points - Giving the Mac Address, Broadcasting Channel, 'c', and the SSID

:DS Stations such as DS Download stations and Pokemon distributors - Giving the Mac Address, Brodcasting Channel, TGID and GGID

*ScanEx Test - and has two Scan Types. Passive which lets you individually scan channels 1-13 (only one at at time) and the DS distribution channels (1,7,13 all at once). And Active which scans all 13 channels at once. when it finds a channel it prints on the bottom screen next to 'Found' 'bssDescCount='

*MeasureChannel Test - not quite sure what this does but it for a given channel it gives a ratio(in percentage form), which it finds in its allocated test time ranging from 10ms to 1000ms. And for every interval of time which is specified, it tests and gives a ratio.

*Noise Mode - Seeks wireless channels in which to make wireless noise (This is not made very clear on the app). You can specify the:

Channel where the scanner will seek to make noise

Noise Rate, ranging from 0% to 100%

Frequency, ranging from 10ms to 50ms

Seek Mode, ranging from 1000ms to 1500ms

When the settings are chosen the top screen has two counters which display 'Noise ON count' and 'Noise OFF count' the counters are affected by the noise rate. Starting at 0% the 'Noise ON count' does not change but as the Noise rate gets closer to 100% the count moves and gets faster as Noise rate reaches 100%. For 'Noise OFF count' it is the exact opposite to the ' Noise ON count' in regards to counting.

=== TWLNandFiler ===

Browse, export, delete and import save archives from TWL Nand. Includes a basic hex viewer.

=NW4C=
NintendoWare for CTR is comprised of tools that deal with creating effects, fonts, models, layouts, sound, and text. There are CTR versions of some of the viewers.

==H3D Model Viewer==
[[File:H3Dscrnshot.png|180px|thumb|right|H3D Viewer Screenshot]]
[[File:H3Dicon.png|||left]]

Used for viewing Binary CTR Models (.bcmdl). Models need to be loaded into memory via CTR-PARTNER. There is also a PC equivalent program with the same layout.

==Layout Viewer==
[[File:LYTscrnshot.png|180px|thumb|right|Layout Viewer bottom screen]]
[[File:LYTicon.png|||left]]

Used for viewing Binary CTR Layouts (.bclyt). It is used with CTR-PARTNER to load layouts into RAM.

==Effect Viewer==
[[File:EFTscrnshot.png|180px|thumb|right|EffectViewer4C Screenshot]]
[[File:EFTicon.png|||left]]

=System Updaters=
[[File:CSUscrnshot.png|300px|thumb|right|CSU Screenshot]]

There are two kinds of system updaters for dev (panda) units, CTR System Updater (CSU) and SNAKE System Updater. As the names imply, the former is for original 3DS and the latter is for New 3DS. They are used to update the panda unit's 'firmware'/SDK Version. The romfs of the CSU contains the contents that will be installed to NAND. They contain all system titles as well as Devmenu and Config.

----
[[Category:3DS Development Unit Related Pages]]

3DS Userland Flaws

2016-04-19T11:13:23Z

MassExplosion213: Fixing a table

This page lists vulnerabilities / exploits for 3DS applications and applets. Exploiting these initially results in ROP, from that ROP one can then for example try exploiting [[3DS_System_Flaws|system]] flaw(s).

=Non-system applications=
{| class="wikitable" border="1"
|-
! Application name
! Summary
! Description
! Fixed in app/system version
! Last app/system version this flaw was checked for
! Timeframe info related to this was added to wiki
! Timeframe this vuln was discovered
! Vuln discovered by
|-
| Cubic Ninja
| Map-data stack smash
| See [[Ninjhax|here]] regarding Ninjhax.
| None
| App: Initial version. System: [[10.4.0-29]].
| Ninjhax release
| July 2014
| [[User:smea|smea]]
|-
| The Legend of Zelda: Ocarina of Time 3D
| UTF-16 name string buffer overflow via unchecked u8 length field
| The u8 at offset 0x2C in the savefile is the character-length of the UTF-16 string at offset 0x1C. When copying this string, it's essentially a memory-copy with lenval*2, not a string-copy. This can be used to trigger buffer overflows at various locations depending on the string length.
* When value is >=0x6E it crashes when saving the saveslot, this causes a stack-smash however it normally crashes before it returns from the function which had the stack-frame overwritten.
* With value >=0x9A, it crashes via stack-smash in-game once any dialogs are opened(touching buttons on the touch-screen can trigger it too).
* Length value>=0xCD causes a crash while loading the saveslot, via a heap buffer overflow. This buf-overflow overwrites a heap memchunk following the allocated buffer. When the first 16-bits overwriting that heap memchunk is not the memchunk magic-number(0x7373), the mem-alloc code will just return a NULL ptr which later results in a crash. When the magic-number is valid, the mem-alloc code will continue to attempt to parse the memchunk, which may crash depending on the data which overwrote the memchunk. This heap code is separate from the CTRSDK heap code. Exploiting this doesn't seem to be possible: since the heap code actually verifies that the magic-number for the next/prev memchunk ptrs are correct(unlike CTRSDK), it's not possible to change those ptrs to useful arbitrary addresses outside of savedata(like with triggering a write to a c++ object ptr which later is used with a vtable func-call, this is what one would do with CTRSDK heap here).

On March 11, 2015, an exploit using this vuln was released, that one was intended for warez/etc. The following exploit wasn't released before then mainly because doing so would (presumably) result in the vuln being fixed. The following old exploit was released on March 14, 2015: [https://github.com/yellows8/oot3dhax].
| None
| App: Initial version. System: [[10.6.0-31]].
| March 11, 2015
| Around October 22, 2012
| [[User:Yellows8|Yellows8]]
|-
| Super Smash Bros 3DS
| Buffer overflow in local-multiplayer beacon handling.
| See [[smashbroshax|here]].
| None
| See [[smashbroshax|here]]. System: [[10.3.0-28]].
| Time of exploit release.
| See [[smashbroshax|here]].
| [[User:Yellows8|Yellows8]]
|}

==Useless crashes / applications which were fuzzed==
* Pushmo (3DSWare), QR codes: level name is properly limited to 16 characters, game doesn't crash with a longer name. The only possible crashes are triggered by out-of-bounds array index values, these crashes are not exploitable due to the index value being 8bit.

* Pyramids (3DSWare), QR codes: no strings. Only crashes are from out-of-bounds values (like background ID) and are not exploitable.

* [https://github.com/yellows8/mm3d_re The Legend of Zelda: Majora's Mask 3D]

* "The Legend of Zelda: A Link Between Worlds" and "The Legend of Zelda: Tri Force Heroes": these games don't crash at all when the entire save-file(minus constant header data) is overwritten with /dev/random output / 0xFF-bytes. All of the CRC32s were updated for this of course.

==Crashes needing investigation==
* Disney Infinity crashes when all savedata overwritten with /dev/urandom. No checksums. 0xFF bytes don't cause a crash.

* Football Up Online / Soccer Up Online and Football Up 3D / Soccer Up 3D crash when teamname(UTF-16) length = 0x48 AND 0x20 null bytes are removed after just the name or if teamname length is way longer than 0x48.

=System applications=
{| class="wikitable" border="1"
|-
! Summary
! Description
! Fixed in version
! Last version this flaw was checked for
! Timeframe this was discovered
! Discovered by
|-
| 3DS [[System Settings]] DS profile string stack-smash
| Too long or corrupted strings (01Ah 2 Nickname length in characters 050h 2 Message length in characters) in the NVRAM DS user settings (System Settings->Other Settings->Profile->Nintendo DS Profile) cause it to crash in 3DS-mode due to a stack-smash. The DSi is not vulnerable to this, DSi launcher(menu) and DSi System Settings will reset the NVRAM user-settings if the length field values are too long(same result as when the CRCs are invalid). TWL_FIRM also resets the NVRAM user-settings when the string-length(s) are too long.
| [[7.0.0-13]]
| [[7.0.0-13]]
| 2012
| [[User:Ichfly|Ichfly]]
|}

=System applets=
{| class="wikitable" border="1"
|-
! Summary
! Description
! Fixed in version
! Last version this flaw was checked for
! Timeframe info related to this was added to wiki
! Timeframe this was discovered
! Discovered by
|-
| [[Home Menu]] [[System_SaveData|NAND-savedata]] Launcher.dat icons
| The homemenu code processing the titleid list @ launcherdat+8 copies those titleIDs to another buffer, where the offset relative to that buffer is calculated using the corresponding s8/s16 entries. Those two values are not range checked at all. Hence, one can use this to write u64(s) with arbitrary values to before/after this allocated output buffer. See [[Home_Menu|here]] regarding Launcher.dat structure.

This can be exploited(with Launcher.dat loading at startup at least) by using a s16 for the icon entry with value 0xFFEC(-20)(and perhaps more icons with similar s16 values to write multiple u64s). The result is that the u64 value is written to outbuf-0xA0, which overwrites object+0(vtable) and object+4(doesn't matter here) for an object that gets used a bit after the vulnerable function triggers. The low 32bits of the u64 can then be set to the address of controlled memory(either outbuf in regular heap or the entire launcherdat buffer in linearmem), for use as a fake vtable in order to get control of PC. From there one can begin ROP via vtable funcptrs to do a stack-pivot(r4=objectaddr at the time the above object gets used).

Originally this vuln could only be triggered via Launcher.dat at Home Menu startup, right after Launcher.dat gets loaded + memory gets allocated, once the file-format version code is finished running. Starting with v9.6 this can be triggered when loading layouts from SD extdata as well. The vuln itself triggers before the layout data is written to Launcher.dat, but it doesn't seem to be possible to overwrite anything which actually gets used before the function which writes Launcher.dat into the layout gets called.

Home Menu has some sort of fail-safe system(or at least on v9.7) when Home Menu crashes due to Launcher.dat(this also applies for other things with Home Menu): after crashing once, Home Menu resets Launcher.dat to a state where it no longer crashes anymore. However, note that any exploits using this which hang/etc without crashing will still brick the system. '''Hence, attempting anything with this on physnand without hw-nand-access isn't really recommended.'''
| None
| [[10.3.0-28|10.3.0-X]]
|
| May 14, 2015
| [[User:Yellows8|Yellows8]]
|-
| [[Home Menu]] theme-data decompression buffer overflow ([[menuhax|themehax]])
| The only func-call size parameter used by the theme decompression function is one for the compressed size, none for the decompressed size. The decompressed-size value from the LZ header is used by this function to check when to stop decompressing, but this function itself has nothing to verify the decompressed_size with. The code calling this function does not check or even use the decompressed size from the header either.

This function is separate from the rest of the Home Menu code: the function used for decompressing themes is *only* used for decompressing themes, nothing else. There's a separate decompression function in Home Menu used for decompressing everything else.

That other decompression function in Home Menu handles decompression size properly(decompressed size check for max buffer size is done by code calling the other function, not in the function itself). Unlike the other function, the theme function supports multiple LZ algorithms, but the one which actually gets used in official themes is the same one supported by the other function anyway.

See also [[menuhax|here]].

With [[10.2.0-28|10.2.0-X]] Home Menu, the only code change was that the following was added right after theme-load and before actual decompression: "if(<get_lzheader_decompressed_size>(compressed_buf) > 0x150000)<exit>;". This fixed the vuln.
| [[10.2.0-28|10.2.0-X]]
| [[10.2.0-28|10.2.0-X]]
|
| December 22, 2014
| [[User:Yellows8|Yellows8]], [[User:Myria|Myria]] independently (~spring 2015)
|-
| [[Home Menu]] shuffle body-data buffer overflow ([[menuhax|shufflehax]])
| See [[menuhax|here]].
| [[10.6.0-31|10.6.0-X]]
| [[10.6.0-31|10.6.0-X]]
|
| January 3, 2015
| [[User:Yellows8|Yellows8]]
|-
| Webkit/web-browser bugs
| spider has had at least three different code-execution exploits. Majority of them are use-after-free issues. See also [[browserhax|here]].
|
|
| 2013?
|
| A lot of people.
|-
| Old3DS/New3DS [[Internet_Browser|Browser-version-check]] bypass
| When the browser-version-check code runs where the savedata for it was never initialized(such as when the user used the "Initialize savedata" option), it will use base_timestamp=0 instead of the timestamp loaded from savedata. This is then used with "if(cur_timestamp - base_timestamp >= <24h timestamp>){Run browser-version-check HTTPS request code}".
Hence, if the savedata was just initialized, and if the system datetime is set to before January 2, 2000, the browser-version-check will be skipped. This includes January 1, 2000, 00:00, because that's the epoch(timestamp value 0x0) used with this timestamp.

See [http://yls8.mtheall.com/3dsbrowserhax.php here] for bypass usage instructions.

This was fixed with [[10.7.0-32|10.7.0-32]], see [[Internet_Browser|here]] for details.
| [[10.7.0-32|10.7.0-32]]
|
| February 25, 2016
| November 2, 2015 (Exactly one week after the browser version pages were initially updated server-side)
| [[User:Yellows8|Yellows8]]
|}

==Useless crashes==
Old3DS system web-browser:
* 2^32 characters long string(''finally'' fixed with v10.6): this is similar to the vulnerability fixed [http://git.chromium.org/gitweb/?p=external/Webkit.git;a=commitdiff;h=ec471f16fbd1f879cb631f9b022fd16acd75f4d4 here], concat-large-strings-crash2.html triggers a crash which is about the same as the one triggered by a 2^32 string. Most of the time this vulnerability will cause a memory page permissions fault, since the WebKit code attempts to copy the string text data to the output buffer located in read-only [[CRO0|CRO]] heap memory. The only difference between a crash triggered by a 2^32 string and the concat-large-strings-crash2.html crash is at the former copies the string data using the original string length(like 1 text character for "x", 4 for "xxxx") while the latter attempts to copy >12MB. In some ''very'' rare cases a thread separate from the string data-copy thread will crash, this might be exploitable. However, this is mostly useless since it rarely crashes this way.

* Trying to directly load a page via the browser "URL" option with [https://github.com/yellows8/3ds_browserhax_common webkitdebug] setup, causes a crash to trigger in oss.cro due to an use-after-free being caught with webkitdebug. This is presumably some sort of realloc() issue in the libcurl version used by the <={v10.2-v10.3} browser. This happens with *every* *single* *page* one tries to load via the "URL" option, but not when loading links on the current page, hence this is probably useless. A different use-after-free with realloc triggers with loading any page at all regardless of method too(libcurl probably).

* This WebKit build has ''a lot'' of crash-trigger bugs that only happen with [https://github.com/yellows8/3ds_browserhax_common webkitdebug] completely setup(addr accesses near 0x0), with ''just'' trying to load any page at all.

Talk:Flash Filesystem

2016-04-17T19:04:15Z

MassExplosion213: Because I'm awful at hitting buttons

* Can't help with nand reading but lib references give some indication of the filesystem.

'''Note! some of these NAND paths below may be outdated'''. Confirmed NAND directories/directory structures are on the [[Flash Filesystem]] page.

{| class="wikitable" border="1"
|-
|nand:/extdata
|-
|nand:/ro/
|-
|nand:/ro/sys/HWCAL0.dat
|-
|nand:/ro/sys/HWCAL1.dat
|-
|nand:/rw/
|-
|nand:/rw/sys/
|-
|nand:/rw/sys/config
|-
|nand:/rw/sys/updater.log
|-
|nand:/rw/sys/PlayHistory.dat
|-
|nand:/rw/sys/PedometerHistory.dat
|-
|nand:/rw/sys/LocalFriendCodeSeed
|-
|nand:/rw/sys/SecureInfo
|-
|nand:/title
|-
|nand:/title/%08x/%08x
|-
|nand:/title/%08x/%08x/%08x.app
|-
|nand:/title/%08x/%08x/title.tmd
|-
|nand:/ticket
|-
|nand:/ticket/%08x/%08x.tik
|-
|nand:/tmp
|}

@yellows8, since the \titles directory is similar between nand and sdmc, do you think it should have a separate page from the [[SD Filesystem]] page?--[[User:3dsguy|3dsguy]] 02:36, 23 August 2012 (CEST)
:Go ahead.(SD/NAND /title is exactly the same, except for the additional encryption for SD perhaps) NAND has .db files too, but I'm not sure where those are located. --[[User:Yellows8|Yellows8]] 02:59, 23 August 2012 (CEST)

== Possible firmware downgrade vulnerability ==

Please correct where I'm wrong. Assume we have NAND-dumps from two 3DS units A and B for both firmware versions X and Y. I.e. 4 data sets AX, AY, BX, BY. Assume that all clear data is identical for the same firmware version or unique per console and stay untouched with firmware version change (i.e. AX, BX is a brand-new console with a factory reset dumps and AY, BY have just updated firmwares). Then AX xor AY = BX xor BY and BX = BY xor AX xor AY.
:There's no way to convert a NAND image from one 3DS for use on another 3DS, without generating the NAND xorpad(s) for both systems(requires ARM9 code exec on both). Another reason why ARM9 exec is needed here is because there's certain files stored in CTRNAND containing console-unique AESMACs. Since that keyslot is initialized by bootrom those AESMACs can only be calculated on the same 3DS which you're calculating these CTRNAND AESMACs for. --[[User:Yellows8|Yellows8]] 18:02, 10 April 2014 (CEST)
::I'm not about converting a NAND image from system to another directly. Can we alculate for a various firmware byte-to-byte XOR-difference, which result the same xorpads for each system to annihilate. And for the same CTRNAND files untouched with a firmware update this difference will be zero. So applying this difference for another console CTRNAND will update a firmware without the need of the actual console-unique xorpad--[[User:Duke srg|Duke srg]] 21:48, 10 April 2014 (CEST)
:::The CTRNAND files /w console-unique AESMACs I'm referring to get updated when sys-updates get installed, if those don't get updated properly(invalid AESMACs for example) you would have a system which would fail to boot when it tries to launch titles from CTRNAND-FS. There's no way to properly update those files without proper NAND xorpads/etc. --[[User:Yellows8|Yellows8]] 22:11, 10 April 2014 (CEST)
::::Ok, just to clarify, during system update AESMAC init file IS updated with the new console-unique data. So after transferring firmware changes from one system to another without complete decypher, during next boot at least AESMAC file on CTR NAND partition contents will have wrong data and REG_AESMAC being initialized with that will fail the following boot process. Smart enough.--[[User:Duke srg|Duke srg]] 05:59, 11 April 2014 (CEST)
:::::Yeah, at least one of those console-unique AESMACs would be rendered invalid with method you're describing. --[[User:Yellows8|Yellows8]] 06:21, 11 April 2014 (CEST)
::::::Aren't you talking about a movable.sed file or there are others not mentioned explicitly?--[[User:Duke srg|Duke srg]] 14:01, 11 April 2014 (CEST)
:::::::No, I mean this: [[Title_Database]]. --[[User:Yellows8|Yellows8]] 18:23, 11 April 2014 (CEST)

== Note: ==

There is currently a third TWL partition who's location in NAND is currently unknown. Said partition is TWLS, or TWL Sound. By default, this partition is empty, however, if you record a sound with the DSi Sound app, the partition is populated, similar to TWLP. --[[User:MassExplosion213|MassExplosion213]] 23:03, 17 April 2016 (CEST)

Talk:Flash Filesystem

2016-04-17T19:03:33Z

MassExplosion213:

Mii

2016-03-30T01:52:27Z

MassExplosion213: Remove partial duplication of info

Originally [http://wiibrew.org/wiki/Mii_Data created for the Nintendo Wii] (and backported to a selection of DS/i games), the '''Mii''' format was expanded with a larger selection of facial features and a new "copying" permission for the 3DS family, and later implemented as-is on Wii U.

See [[Mii Maker]] for the application chiefly designed to create, edit, delete, and trade Miis or convert them from and to a QR code.

==Mii Database==
Format of the Mii main database '''CFL_DB.dat''', found in [[Extdata#NAND_Shared_Extdata|shared extdata]] archive f0000000b.

{| class="wikitable"
|-
! Offset
! Length
!
|-
| 0x0
| 0x4
| Header "CFOG" (Mii Maker section)
|-
| 0x4
| 0x4
| Header 0x00010000
|-
| 0x8
| 0x23F7
| Array of owned (saved in Mii Maker) Miis. Order in file is unrelated to canonical order in-app.
|-
| 0x23FC
| 0x4
| Header "CFHE"
|-
| 0x23F8
| 0x4
| Header 0xFFFFFFFF
|-
| 0x2400
| 0xA410
| Array of objects? See chapter
|-
| 0xC810
| 0x10
| Terminator? 00 [..] 00 08 83
|-
| 0xC820
| 0x4
| Header "CFRA" (Invitations section)
|-
| 0xC824
| 0x4
| Header? 0x39000000
|-
| 0xC861
| 0x2B
| Weird padding? 0x00
|-
| 0xC88C
| 0x1C20 (?)
| Array of Miis contributed from games, used for Mii Plaza "invitations" feature. The format isn't that of a full Mii.
|-
| 0xE4AC
| 0x14
| 01 00 [..] 00 D2 74
|-
| 0xE4C0
| 0x3D860
| Empty (00)
|}
When encrypted in QR codes, 4 additionnal bytes are added. Two null bytes and a CRC-16. It's the exact same CRC-16 as for the Wii blocks on the 0x5e first bytes. It seems that the CRC is ignored, the Mii Maker expecting the result of APT:Unwrap to detect integrity loss.

==Mii format==

Note: 0x18-3B have been copied as-is from [https://www.3dbrew.org/w/index.php?title=Mii_Maker&oldid=11464 the QR code specification], so they're unverified.

{| class="wikitable"
|-
! Offset
! Length
!
|-
| 0x0
| 0x4
| Mii ID
|-
| 0x4
| 0x4
| System ID (identifies owner, for purpose of enforcing editing restrictions and blue pants). Is not tied to the MAC address anymore.
|-
| 0x8
| 0x1
| Unknown (always 71?)
|-
| 0x9
| 0x1
| Allow Copying (?) (A2=on?)
|-
| 0xA
| 0x3
| unknown; apparently constant for the same source console
|-
| 0xD
| 0x1
| unknown; apparently constant for the same source console - subtract 2 for personal Mii?
|-
| 0xE
| 0x2
| unknown; variable (range A-F may alternatively be a timestamp?)
|-
| 0x10
| 0x6
| Creator's full MAC
|-
| 0x16
| 0x2
| Padding (0000)
|-
| 0x18
| 0x2
| Bit-mapped: Birthday (4bit-day,5bit-month), Sex, Shirt, ??
|-
| 0x1A
| 0x14
| UTF-16 Mii Name (10 chars max, 0000 terminated)
|-
| 0x2E
| 0x2
| width & height
|-
| 0x30
| 0x1
| bit 0: disable sharing bit 1-4: face shape bit 5-7: skin color
|-
| 0x31
| 0x1
| bit 0-3: wrinkles bit 4-7: makeup
|-
| 0x32
| 0x1
| hair style
|-
| 0x33
| 0x1
| bit 0-2: hair color bit 3: flip hair
|-
| 0x34
| 0x4
| unknown
|-
| 0x38
| 0x1
| bit 0-4: eyebrow style bit 5-7: eyebrow color
|-
| 0x39
| 0x1
| bit 0-3: eyebrow scale bit 4-6: eyebrow yscale
|-
| 0x3A
| 0x2
| note that the bytes are swapped over (little-endian layout) bit 0-3: eyebrow rotation bit 5-8: eyebrow x spacing bit 9-13: eyebrow y position
|-
| 0x3C
| 0x4
| unknown
|-
| 0x40
| 0x1
| Allow Copying (?) (0D on 0E off 8D on)
|-
| 0x41
| 0x7
| unknown
|-
| 0x48
| 0x14
| UTF-16 Author Name (10 chars max, 0000 terminated)
|}

==CFHE object==

A 0xE-byte long item.

On my database, they're all 0000 0000 0000 0000 0000 FF7F FF7F.

Wild speculation: blacklist of already scanned celebrity (gold) Mii QRs?

Alternative interpretation: FFFF FFFF 0000 0000 0000 0000 0000 is the 1st item; FF7F FF7F 0000 [...] the 2nd, etc;

==Mii categories (pants colors)==

Initial digits have been mirrored from David Hawley's defunct Wii research. Some information may be outdated.

===Special (gold) Miis===
Specialness will override any other color and make the Mii non-editable.

Copying is rumored to have to be disabled.

First digit of Mii ID: 0, 1, 4, 5

===Imported (blue) Miis===
Any (non-gold) Mii with a different System ID will appear as a foreign one.

There is also a range of Mii IDs that are always foreign and uneditable, regardless of the System ID:

First digit of Mii ID: C, D

===Regular (black/red) Miis===
Always editable, since they can only appear as such on the console that created them.

First digit of Mii ID: 2, 3, 6, 7, 8, 9, A, B, E, F

FirmwareNews

2016-01-19T12:49:11Z

MassExplosion213:

As of this writing, the latest firmware is '''10.4.0-29'''.

There are ways to run homebrew on this version, see [[Homebrew Exploits]].

----

Full system control exploits are only public for system versions up to and including '''9.2.0-X'''.

3DS System Flaws

2016-01-13T17:09:35Z

MassExplosion213: /* Kernel9 */

Exploits are used to execute unofficial code (homebrew) on the Nintendo 3DS. This page is a list of publicly known system flaws, for userland applications/applets flaws see [[3DS_Userland_Flaws|here]].

=Stale / Rejected Efforts=
* Neimod has been working on a RAM dumping setup for a little while now. He's de-soldered the 3DS's RAM chip and hooked it and the RAM pinouts on the 3DS' PCB up to a custom RAM dumping setup. A while ago he published photos showing his setup to be working quite well, with the 3DS successfully booting up. However, his flickr stream is now private along with most of his work.

* Someone (who will remain unnamed) has released CFW and CIA installers, all of which is copied from the work of others, or copyrighted material.

==Tips and info==
The 3DS uses the XN feature of the ARM11 processor. There's no official way from applications to enable executable permission for memory containing arbitrary unsigned code(there's a [[SVC]] for this, but only [[RO_Services|RO-module]] has access to it). An usable userland exploit would still be useful: you could only do return-oriented-programming with it initially. From ROP one could then exploit system flaw(s), see below.

SD card [[extdata]] and SD savegames can be attacked, for consoles where the console-unique [[Nand/private/movable.sed|movable.sed]] was dumped(accessing SD data is far easier by running code on the target 3DS however).

=System flaws=
== Hardware ==
{| class="wikitable" border="1"
! Summary
! Description
! Fixed with hardware model/revision
! Newest hardware model/revision this flaw was checked for
! Timeframe this was discovered
! Discovered by
|-
| ARM9/ARM11 bootrom vectors point at unitialized RAM
| ARM9's and ARM11's exception vectors are hardcoded to point at the CPU's internal memory (0x08000000 region for ARM9, AXIWRAM for ARM11). While the bootrom does set them up to point to an endless loop at some point during boot, it does not do so immediately. As such, a carefully-timed fault injection (via hardware) to trigger an exception (such as an invalid instruction) will cause execution to fall into ARM9 RAM.
Since RAM isn't cleared on boot (see below), one can immediately start execution of their own code here to dump bootrom, OTP, etc.
The ARM9 bootrom does the following at reset: reset vector branches to another instruction, then branches to bootrom+0x8000. Hence, there's no way to know for certain when exactly the ARM9 exception-vector data stored in memory gets initialized.

This requires *very* *precise* timing for triggering the hardware fault: it's unknown if anyone actually exploited this successfully at the time of writing(the one who attempted+discovered it *originally* as listed in this wiki section hasn't).
| None: all available 3DS models at the time of writing have the exact same ARM9/ARM11 bootrom for the unprotected areas.
| New3DS
| End of February 2014
| [[User:Derrek|derrek]], WulfyStylez (May 2015) independently
|-
| Missing AES key clearing
| The hardware AES engine does not clear keys when doing a hard reset/reboot.
| None
| New3DS
| August 2014
| Mathieulh/Others
|-
| No RAM clearing on reboots
| On an MCU-triggered reboot all RAM including FCRAM/ARM9 memory/AXIWRAM/VRAM keeps its contents.
| None
| New3DS
| March 2014
| [[User:Derrek|derrek]]
|-
| 32bits of actual console-unique TWLNAND keydata
| On retail the 8-bytes at ARM9 address [[Memory_layout|0x01FFB808]] are XORed with hard-coded data, to generate the TWL console-unique keys, including TWLNAND. On Old3DS the high u32 is always 0x0, while on New3DS that u32 is always 0x2. On top of this, the lower u32's highest bit is always ORed. only 31 bits of the TWL console-unique keydata / TWL consoleID are actually console-unique.
This allows one to easily bruteforce the TWL console-unique keydata with *just* data from TWLNAND. On DSi the actual console-unique data for key generation is 8-bytes(all bytes actually set).
| None
| New3DS
| 2012?
| [[User:Yellows8|Yellows8]]
|-
| DSi / 3DS-TWL key-generator
| After using the key generator to generate the normal-key, you could overwrite parts of the normal-key with your own data and then recover the key-generator output by comparing the new crypto output with the original crypto output. From the normal-key outputs, you could deduce the TWL key-generator function.
This applies to the keyX/keyY too.

This attack does not work for the 3DS key-generator because keyslots 0-3 are only for TWL keys.
| None
| New3DS
| 2011
| [[User:Yellows8|Yellows8]]
|-
| 3DS key-generator
| The algorithm for generating the normal-keys for keyslots is cryptographically weak. As a result, it is easily susceptible to differential cryptanalysis if the normal-key corresponding to any scrambler-generated keyslot is discovered.

Several such pairs of matching normal-keys and KeyY values were found, leading to deducing the key-generator function.
| None
| New3DS
| February 2015
| [[User:Yellows8|Yellows8]], [[User:Plutooo|plutoo]]
|}

== ARM9 software ==
=== arm9loader ===
{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in [[FIRM]] system version
! Last [[FIRM]] system version this flaw was checked for
! Timeframe this was discovered
! Public disclosure timeframe
! Discovered by
|-
| Uncleared OTP hash keydata in console-unique 0x11 key-generation
| Kernel9Loader does not clear the [[SHA_Registers#SHA_HASH|SHA_HASH register]] after use. As a result, the data stored here as K9L hands over to Kernel9 is the hash of [[OTP_Registers|OTP data]] used to seed the [[FIRM#New_3DS_FIRM|console-unique NAND keystore decryption key]] set on keyslot 0x11.

Retrieving this keydata and the [[Flash_Filesystem#0x12C00|NAND keystore]] of the same device allows calculating the decrypted New3DS NAND keystore (non-unique, common to all New3DS units), which contains AES normal keys, also set on keyslot 0x11, which are then used to derive all current [[AES_Registers#Keyslots|New3DS-only AES keyXs]] including the newer batch introduced in [[9.6.0-24#arm9loader|9.6.0-X]]. From there, it is trivial to perform the same key derivation in order to initialize those keys on any system version, and even on Old3DS.

This can be performed by exploiting the "arm9loaderhax" vulnerability to obtain post-K9L code execution after an MCU reboot (the bootrom section-loading fail is not relevant here, this attack was performed without OTP data by brute-forcing keys), and using this to dump the SHA_HASH register. This attack works on any FIRM version shipping a vulnerable version of K9L, whereas OTP dumping required a boot of <[[3.0.0-6|3.0.0-X]].

This attack results in obtaining the entire (0x200-bytes) NAND keystore - it was confirmed at a later date that this keystore is encrypted with the same key (by comparing the decrypted data from multiple units), and therefore using another key in this store will not remedy the issue as all keys are known (i.e. later, unused keys decrypt to the same 0x200-bytes constant with the same OTP hash). Later keys could have been encrypted differently but this is not the case. As a result of this, it is not possible for Nintendo to use K9L again in its current format for its intended purpose, though this was not news from the moment people dumped a New3DS OTP.
| Derivation of all New3DS keys generated via the NAND keystore (0x1B "Secure4" etc.)
| None
| [[10.2.0-28|10.2.0-X]]
| ~April 2015, implemented in May 2015
| 13 January 2016
| [[User:WulfyStylez|WulfyStylez]], [[User:Dazzozo|Dazzozo]], [[User:Shinyquagsire23|shinyquagsire23]] (complimentary + implemented), [[User:Plutooo|plutoo]], Normmatt (discovered independently)
|-
| enhanced-arm9loaderhax
| See the 32c3 3ds talk.
Since this is a combination of a trick with the arm9-bootrom + arm9loaderhax, and since you have to manually write FIRM to the firm0/firm1 NAND partitions, this can't really be completely fixed. More New3DS keys could be generated differently/etc in an updated arm9loader which also fixes arm9loaderhax, but that's about all really.
| arm9loaderhax which automatically occurs at hard-boot.
| See arm9loaderhax / description.
| See arm9loaderhax / description.
| Theorized around mid July, 2015. Later implemented+tested by [[User:Plutooo|plutoo]] and derrek.
| 32c3 3ds talk (December 27, 2015)
| [[User:Yellows8|Yellows8]]
|-
| Missing verification-block for the 9.6 keys (arm9loaderhax)
| Starting with [[9.6.0-24|9.6.0-X]] a new set of NAND-based keys were introduced. However, no verification block was added to verify that the new key read from NAND is correct. This was technically an issue from [[9.5.0-22|9.5.0-X]] with the original sector+0 keydata, however the below is only possible with [[9.6.0-24|9.6.0-X]] since keyslots 0x15 and 0x16 are generated from different 0x11 keyXs.

Writing an incorrect key to NAND will cause arm9loader to decrypt the ARM9 kernel as garbage and then jump to it.

This allows an hardware-based attack where you can boot into an older exploited firmware, fill all memory with NOP sleds/jump-instructions, and then reboot into executing garbage. By automating this process with various input keydata, eventually you'll find some garbage that jumps to your code.

This gives very early ARM9 code execution (pre-ARM9 kernel). As such, it is possible to dump RSA keyslots with this and calculate the 6.x [[Savegames#6.0.0-11_Savegame_keyY|save]], and 7.x [[NCCH]] keys. This cannot be used to recover keys initialized by arm9loader itself. This is due to it wiping the area used for its stack during NAND sector decryption and keyslot init.

Due to FIRMs on both Old and New 3DS using the same RSA data, this can be exploited on Old3DS as well, but only if one already has the actual plaintext normalkey from New3DS NAND sector 0x96 offset-0 and has dumped the OTP area of the Old3DS.
| Recovery of 6.x [[Savegames#6.0.0-11_Savegame_keyY|save key]]/7.x [[NCCH]] key
| None
| [[10.2.0-28|10.2.0-X]]
| March, 2015
|
| [[User:Plutooo|plutoo]]
|-
| Uncleared New3DS keyslot 0x11
| Originally the New3DS [[FIRM]] arm9bin loader only cleared keyslot 0x11 when it gets executed at firmlaunch. This was fixed with [[9.5.0-22|9.5.0-X]] by completely clearing keyslot 0x11 immediately after the loader finishes using keyslot 0x11.
This means that any ARM9 code that can execute before the loader clears the keyslot at firmlaunch(including firmlaunch-hax) can get access to the uncleared keyslot 0x11, which then allows one to generate all <=v9.5 New3DS keyXs which are generated by keyslot 0x11.

Therefore, to completely fix this the loader would have to generate more keys using different keyslot 0x11 keydata. This was done with [[9.6.0-24|9.6.0-X]].
| New3DS keyXs generation
| Mostly fixed with [[9.5.0-22|9.5.0-X]], completely fixed with new keys with [[9.6.0-24|9.6.0-X]].
|
| February 3, 2015 (one day after [[9.5.0-22|9.5.0-X]] release)
|
| [[User:Yellows8|Yellows8]]
|}

=== Process9 ===
{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in [[FIRM]] system version
! Last [[FIRM]] system version this flaw was checked for
! Timeframe this was discovered
! Public disclosure timeframe
! Discovered by
|-
| Leak of normal-key matching a key-scrambler key
| New 3DS firmware versions [[8.1.0-0 New3DS|8.1.0]] through [[9.2.0-20|9.2.0]] set the encryption key for [[Amiibo]] data using a hardcoded normal-key in Process9. In firmware [[9.3.0-21|9.3.0]], Nintendo "fixed" this by using the key scrambler instead, by calculating the keyY value for keyslot 0x39 that results in the same normal-key, then hardcoding that keyY into Process9.

Nintendo's fix is actually the problem: Nintendo revealed the normal-key matching an unknown keyX and a known keyY. Combined with the key scrambler using an insecure scrambling algorithm (see "Hardware" above), the key scrambler function could be deduced.
| Deducing the keyX for keyslot 0x39 and the key scrambler algorithm
| New 3DS [[9.3.0-21|9.3.0-X]], sort of
| [[10.0.0-27|10.0.0-X]]
| Sometime in 2015 after the hardware key-generator was broken.
| 32c3 3ds talk (December 27, 2015)
| [[User:Yellows8|Yellows8]]
|-
| ntrcardhax
|
| ARM9 code execution
| None
| [[10.3.0-28|10.3.0-X]]
| March 2015
| 32c3 3ds talk (December 27, 2015)
| [[User:Plutooo|plutoo]]
|-
| Title downgrading via [[Application_Manager_Services|AM]]([[Application_Manager_Services_PXI|PXI]])
| When a title is *already* installed, Process9 will compare the installed title-version with the title-version being installed. When the one being installed is older, Process9 would return an error.

However, this can be bypassed by just deleting the title first via the service command(s) for that: with the title removed from the [[Title_Database]], Process9 can't compare the input title-version with anything. Hence, titles can be downgraded this way.
| Bypassing title version check at installation, which then allows downgrading any title.
| None
| NATIVE_FIRM / AM-sysmodule [[10.0.0-27|10.0.0-X]]
| ?
|
| ?
|-
| FAT FS code null-deref
| When FSFile:Read is used with a file which is corrupted on a FAT filesystem(in particular SD), Process9 can crash. This particular crash is caused by a function returning NULL instead of an actual ptr due to an error. The caller of that function doesn't check for NULL which then triggers a read based at NULL.

Sample "fsck.vfat -n -v -V <fat image backup>" output for the above crash:

<pre>...
Starting check/repair pass.
<FilePath0> and
<FilePath1>
share clusters.
Truncating second to 3375104 bytes.
<FilePath1>
File size is 2787392 bytes, cluster chain length is 16384 bytes.
Truncating file to 16384 bytes.
Checking for unused clusters.
Reclaimed 1 unused cluster (16384 bytes).
Checking free cluster summary.
Free cluster summary wrong (1404490 vs. really 1404491)
Auto-correcting.
Starting verification pass.
Checking for unused clusters.
Leaving filesystem unchanged.</pre>
| Useless null-based-read
| None
| [[9.6.0-24|9.6.0-X]]
| July 8-9, 2015
|
| [[User:Yellows8|Yellows8]]
|-
| RSA signature padding checks
| The TWL_FIRM RSA sig padding check code used for all TWL RSA sig-checks has issues, see [[FIRM|here]].
The main 3DS RSA padding check code(non-certificate, including NATIVE_FIRM) uses the function used with the above to extract more padding + the actual hash from the additional padding. This isn't really a problem here because there's proper padding check code which is executed prior to this.
|
| None
| [[9.5.0-22|9.5.0-X]]
| March 2015
|
| [[User:Yellows8|Yellows8]]
|-
| [[AMPXI:ValidateDSiWareSectionMAC]] [[AES_Registers|AES]] keyslot reuse
| When the input DSiWare section index is higher than <max number of DSiWare sections supported by this FIRM>, Process9 uses keyid 0x40 for calculating the AESMAC, which translates to keyslot 0x40. The result is that the keyslot is left at whatever was already selected before, since the AES selectkeyslot code will immediately return when keyslot is >=0x40. However, actually exploiting this is difficult: the calculated AESMAC is never returned, this command just compares the calculated AESMAC with the input AESMAC(result-code depends on whether the AESMACs match). It's unknown whether a timing attack would work with this.
This is basically a different form of the pxips9 keyslot vuln, except with AESMAC etc.
| See description.
| None
| [[10.2.0-28|10.2.0-X]]
| March 15, 2015
| December 29, 2015
| [[User:Yellows8|Yellows8]]
|-
| pxips9 [[AES_Registers|AES]] keyslot reuse
| This requires access to the [[Process_Services|ps:ps]]/pxi:ps9 services. One way to get access to this would be snshax on system-version <=10.1.0-X(see 32c3 3ds talk).
When an invalid key-type value is passed to any of the PS commands, Process9 will try to select keyslot 0x40. That aesengine_setkeyslot() code will then immediately return due to the invalid keyslot value. Since that function doesn't return any errors, Process9 will just continue to do crypto with whatever AES keyslot was selected before the PS command was sent.
| Reusing the previously used keyslot, for crypto with PS.
| None
| [[10.2.0-28|10.2.0-X]]
| Roughly the same time(same day?) as firmlaunch-hax.
| December 29, 2015
| [[User:Yellows8|Yellows8]]
|-
| firmlaunch-hax: FIRM header ToCToU
| This can't be exploited from ARM11 userland.
During [[FIRM]] launch, the only FIRM header the ARM9 uses at all is stored in FCRAM, this is 0x200-bytes(the actual used FIRM RSA signature is read to the Process9 stack however). The ARM9 doesn't expect "anything" besides the ARM9 to access this data.
With [[9.5.0-22]] the address of this FIRM header was changed from a FCRAM address, to ARM9-only address 0x01fffc00.
| ARM9 code execution
| [[9.5.0-22]]
|
| 2012, 3 days after [[User:Yellows8|Yellows8]] started Process9 code RE.
|
| [[User:Yellows8|Yellows8]]
|-
| Uninitialized data output for (PXI) command replies
| PXI commands for various services(including some [[Filesystem_services_PXI|here]] and many others) can write uninitialized data (like from ARM registers) to the command reply. This happens with stubbed commands, but this can also occur with certain commands when returning an error.
Certain ARM11 service commands have this same issue as well.
|
| None
| [[9.3.0-21|9.3.0-X]]
| ?
|
| [[User:Yellows8|Yellows8]]
|-
| [[Filesystem_services_PXI|FSPXI]] OpenArchive SD permissions
| Process9 does not use the exheader ARM9 access-mount permission flag for SD at all.
This would mean ARM11-kernelmode code / fs-module itself could directly use FSPXI to access SD card without ARM9 checking for SD access, but this is rather useless since a process is usually running with SD access(Home Menu for example) anyway.
|
| None
| [[9.3.0-21|9.3.0-X]]
| 2012
|
| [[User:Yellows8|Yellows8]]
|-
| [[AMPXI:ExportDSiWare]] export path
| Process9 allocates memory on Process9 heap for the export path then verifies that the actual allocated size matches the input size. Then Process9 copies the input path from FCRAM to this buffer, and uses it with the Process9 FS openfile code, which use paths in the form of "<mountpoint>:/<path>".
Process9 does not check the contents of this path at all before passing it to the FS code, besides writing a NUL-terminator to the end of the buffer.
| Exporting of DSiWare to arbitrary Process9 file-paths, such as "nand:/<path>" etc. This isn't really useful since the data which gets written can't be controlled.
| None
| [[9.5.0-22]]
| April 2013
|
| [[User:Yellows8|Yellows8]]
|-
| [[DSiWare_Exports]] [[CTCert]] verification
| Just like DSi originally did, 3DS verifies the APCert for DSiWare on SD with the CTCert also in the DSiWare .bin. On DSi this was fixed with with system-version 1.4.2 by verifying with the actual console-unique cert instead(stored in NAND), while on 3DS it's still not(?) fixed.
On 3DS however this is rather useless, due to the entire DSiWare .bin being encrypted with the console-unique movable.sed keyY.
| When the movable.sed keyY for the target 3DS is known and the target 3DS CTCert private-key is unknown, importing of modified DSiWare SD .bin files.
| Unknown, probably none.
| ?
| April 2013
|
| [[User:Yellows8|Yellows8]]
|-
| [[Gamecard_Services_PXI]] unchecked REG_CTRCARDCNT transfer-size
| The u8 REG_CTRCARDCNT transfer-size parameter for the [[Gamecard_Services_PXI]] read/write CTRCARD commands is used as an index for an array of u16 values. Before [[5.0.0-11|5.0.0-X]] this u8 value wasn't checked, thus out-of-bounds reads could be triggered(which is rather useless in this case).
| Out-of-bounds read for a value which gets written to a register.
| [[5.0.0-11|5.0.0-X]]
|
| 2013?
|
| [[User:Yellows8|Yellows8]]
|-
| [[PXI_Registers|PXI]] cmdbuf buffer overrun
| The Process9 code responsible [[PXI_Registers|PXI]] communications didn't verify the size of the incoming command before writing it to a C++ member variable.
| Probably ARM9 code execution
| [[5.0.0-11|5.0.0-11]]
|
| March 2015, original timeframe if any unknown
|
| [[User:Plutooo|plutoo]]/[[User:Yellows8|Yellows8]]/maybe others(?)
|-
| [[Application_Manager_Services_PXI|PXIAM]] command 0x003D0108(See also [[Application_Manager_Services|this]])
| When handling this command, Process9 allocates a 0x2800-byte heap buffer, then copies the 4 FCRAM input buffers to this heap buffer without checking the sizes at all(only the buffers with non-zero sizes are copied). Starting with [[5.0.0-11|5.0.0-X]], the total combined size of the input data must be <=0x2800.
| ARM9 code execution
| [[5.0.0-11|5.0.0-X]]
|
| May 2013
|
| [[User:Yellows8|Yellows8]]
|-
| [[Process_Services_PXI|PS RSA]] commands buffer overflows
| pxips9 cmd1(not accessible via ps:ps) and VerifyRsaSha256: unchecked copy to a buffer in Process9's .bss, from the input FCRAM buffer. The buffer is located before the pxi cmdhandler threads' stacks. SignRsaSha256 also has a buf overflow, but this isn't exploitable.
The buffer for this is the buffer for the signature data. With v5.0, the signature buffer was moved to stack, with a check for the signature data size. When the signature data size is too large, Process9 uses [[SVC|svcBreak]].
| ARM9 code execution
| [[5.0.0-11|5.0.0-X]]
|
| 2012
|
| [[User:Yellows8|Yellows8]]
|-
| [[PXI_Registers|PXI]] pxi_id bad check
| The Process9 code responsible for [[PXI_Registers|PXI]] communications read pxi_id as a signed char. There were two flaws:
* They used it as index to a lookup-table without checking the value at all.
* Another function verified that pxi_id < 7, allowing negative values to pass the check. This would also cause an out-of-range table-lookup.
| Maybe ARM9 code execution
| [[3.0.0-5|3.0.0-5]]
|
| March 2015, originally 2012 for the first issue at least
|
| [[User:Plutooo|plutoo]], [[User:Yellows8|Yellows8]], maybe others(?)
|}

=== Kernel9 ===
{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in [[FIRM]] system version
! Last [[FIRM]] system version this flaw was checked for
! Timeframe this was discovered
! Discovered by
|-
| [[CONFIG Registers#CFG_SYSPROT9|CFG_SYSPROT9]] bit1 not set by Kernel9
| Old versions of Kernel9 never set bit1 of [[CONFIG Registers#CFG_SYSPROT9|CFG_SYSPROT9]]. This leaves the [[OTP Registers|0x10012000]]-region unprotected (this region should be locked early during boot!). Since it's never locked, you can dump it once you get ARM9 code execution. See [[OTP Registers|here]] regarding the data stored there.

From [[3.0.0-5|3.0.0-X]] this was fixed by setting the bit in Kernel9 after poking some registers in that region. On New3DS arm9loader sets this bit instead of Kernel9. This is exploitable on N3DS however if you downgrade to 1.0 and reencrypt the NAND with keyslot 0x4 instead of 0x5.
| Dumping of the [[OTP Registers|OTP]] area
| [[3.0.0-5|3.0.0-X]]
|
| February 2015
| [[User:Plutooo|plutoo]], Normmatt independently, TiniVi (N3DS)
|}

== ARM11 software ==
=== Kernel11 ===
{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in [[FIRM]] system version
! Last [[FIRM]] system version this flaw was checked for
! Timeframe this was discovered
! Discovered by
|-
| [[SVC]] table too small
| The table of function pointers for SVC's only contains entries up to 0x7D, but the biggest allowed SVC for the table is 0x7F. Thus, executing SVC7E or SVC7F would make the SVC-handler read after the buffer, and interpret some ARM instructions as function pointers.

However, this would require patching the kernel .text or modifying SVC-access-control. Even if you could get these to execute, they would still jump to memory that isn't mapped as executable.
|
| None
| [[10.2.0-28|10.2.0-X]]
| 2012
| Everyone
|-
| [[SVC|svcBackdoor (0x7B)]]
| This backdoor allows executing SVC-mode code at the user-specified code-address. This is used by Process9, using this on the ARM11(with NATIVE_FIRM) requires patching the kernel .text or modifying SVC-access-control.
| See description
| None
| [[10.2.0-28|10.2.0-X]]
|
| Everyone
|-
| [[Memory_layout#ARM11_Detailed_virtual_memory_map|0xEFF00000]] / 0xDFF00000 ARM11 kernel virtual-memory
| The ARM11 kernel-mode 0xEFF00000/0xDFF00000 virtual-memory(size 0x100000) is mapped to phys-mem 0x1FF00000(entire DSP-mem + entire AXIWRAM), with permissions RW-. This is used during ARM11 kernel startup for loading the FIRM-modules from the FIRM section located in DSP-mem, this never seems to be used after that, however. This is never unmapped either.
|
| None
| [[10.2.0-28|10.2.0-X]]
|
|
|-
| Memchunkhax2
|
| ARM11 kernel code execution
| None
| [[10.3.0-28|10.3.0-X]]
|
| derrek
|-
| AffinityMask/processorid validation
| With [[10.0.0-27|10.0.0-X]] the following functions were updated: svcGetThreadAffinityMask, svcGetProcessAffinityMask, svcSetProcessAffinityMask, and svcCreateThread. The code changes for all but svcCreateThread are identical.
The original code with the first 3 did the following:
* if(u32_processorcount > ~0x80000001)return 0xe0e01bfd;
* if(s32_processorcount > <total_cores>)return 0xd8e007fd;
The following code replaced the above:
* if(u32_processorcount >= <total_cores+1>)return 0xd8e007fd;
In theory the latter should catch everything that the former did, so it's unknown if this was really a security issue.

The svcCreateThread changes with [[10.0.0-27|10.0.0-X]] definitely did fix a security issue.
* Original code: "if(s32_processorid > <total_cores>)return 0xd8e007fd;"
* New code: "if(s32_processorid >= <total_cores> || s32_processorid <= -4)return 0xd8e007fd;"
This fixed an off-by-one issue: if one would use processorid=total_cores, which isn't actually a valid value, svcCreateThread would accept that value on <[[10.0.0-27|10.0.0-X]]. This results in data being written out-of-bounds(baseaddr = arrayaddr + entrysize*processorid), which has the following result:
* Old3DS: Useless kernel-mode crash due to accessing unmapped memory.
* New3DS: uncontrolled data write into a kernel-mode L1 MMU-table. This isn't really useful: the data can't be controlled, and the data which gets overwritten is all-zero anyway(this isn't anywhere near MMU L1 entries for actually mapped memory).
The previous version also allowed large negative s32_processorid values(negative processorid values are special values not actual procids), but it appears using values like that won't actually do anything(meaning no crash) besides the thread not running / thread not running for a while(besides triggering a kernelpanic with certain s32_processorid value(s)).
| Nothing useful
| [[10.0.0-27|10.0.0-X]]
| [[10.0.0-27|10.0.0-X]]
| svcCreateThread issue: May 31, 2015. The rest: September 8, 2015, via v9.6->v10.0 ARM11-kernel code-diff.
| [[User:Yellows8|Yellows8]]
|-
| memchunkhax
| The kernel originally did not validate the data stored in the FCRAM kernel heap [[Memchunkhdr|memchunk-headers]] for free-memory at all. Exploiting this requires raw R/W access to these memchunk-headers, like physical-memory access with gspwn.

There are ''multiple'' ways to exploit this, but the end-result for most of these is the same: overwrite code in AXIWRAM via the 0xEFF00000/0xDFF00000 kernel virtual-memory mapping.

This was fixed in [[9.3.0-21|9.3.0-X]] by checking that the memchunk(including size, next, and prev ptrs) is located within the currently used heap memory. The kernel may also check that the next/prev ptrs are valid compared to other memchunk-headers basically. When any of these checks fail, kernelpanic() is called.
| When combined with other flaws: ARM11-kernelmode code execution
| [[9.3.0-21|9.3.0-21]]
|
| February 2014
| [[User:Yellows8|Yellows8]]
|-
| Multiple [[KLinkedListNode|KLinkedListNode]] SlabHeap use after free bugs
| The ARM11-kernel did access the 'key' field of [[KLinkedListNode|KLinkedListNode]] objects, which are located on the SlabHeap, after freeing them. Thus, triggering an allocation of a new [[KLinkedListNode|KLinkedListNode]] object at the right time could result in a type-confusion. Pseudo-code:
SlabHeap_free(KLinkedListNode);
KObject *obj = KLinkedListNode->key; // the object there might have changed!
This bug appeared all over the place.
| ARM11-kernelmode code exec maybe
| [[8.0.0-18|8.0.0-18]]
|
| April 2015
| [[User:Derrek|derrek]]
|-
| PXI [[RPC_Command_Structure|Command]] input/output buffer permissions
| Originally the ARM11-kernel didn't check permissions for PXI input/output buffers for commands. Starting with [[6.0.0-11|6.0.0]] PXI input/output buffers must have RW permissions, otherwise kernelpanic is triggered.
|
| [[6.0.0-11|6.0.0-11]]
|
| 2012
| [[User:Yellows8|Yellows8]]
|-
| [[SVC|svcStartInterProcessDma]]
| For svcStartInterProcessDma, the kernel code had the following flaws:

* Originally the ARM11-kernel read the input DmaConfig structure directly in kernel-mode(ldr(b/h) instructions), without checking whether the DmaConfig address is readable under userland. This was fixed by copying that structure to the SVC-mode stack, using the ldrbt instruction.

* Integer overflows for srcaddr+size and dstaddr+size are now checked(with [[6.0.0-11]]), which were not checked before.

* The kernel now also checks whether the srcaddr/dstaddr (+size) is within userland memory (0x20000000), the kernel now (with [[6.0.0-11]]) returns an error when the address is beyond userland memory. Using an address >=0x20000000 would result in the kernel reading from the process L1 MMU table, beyond the memory allocated for that MMU table(for vaddr->physaddr conversion).
|
| [[6.0.0-11]]
|
| DmaConfig issue: unknown. The rest: 2014
| [[User:Plutooo|plutoo]], [[User:Yellows8|Yellows8]] independently
|-
| [[SVC|svcControlMemory]] Parameter checks
| For svcControlMemory the parameter check had these two flaws:

* The allowed range for addr0, addr1, size parameters depends on which MemoryOperation is being specified. The limitation for GSP heap was only checked if op=(u32)0x10003. By setting a random bit in op that has no meaning (like bit17?), op would instead be (u32)0x30003, and the range-check would be less strict and not accurate. However, the kernel doesn't actually use the input address for LINEAR memory-mapping at all besides the range-checks, so this isn't actually useful. This was fixed in the kernel by just checking for the LINEAR bit, instead of comparing the entire MemoryOperation value with 0x10003.

* Integer overflows on (addr0+size) are now checked that previously weren't (this also applies to most other address checks elsewhere in the kernel).

|
| [[5.0.0-11]]
|
|
| [[User:Plutooo|plutoo]]
|-
| [[RPC_Command_Structure|Command]] request/response buffer overflow
| Originally the kernel did not check the word-values from the command-header. Starting with [[5.0.0-11]], the kernel will trigger a kernelpanic() when the total word-size of the entire command(including the cmd-header) is larger than 0x40-words (0x100-bytes). This allows overwriting threadlocalstorage+0x180 in the destination thread. However, since the data written there would be translate parameters (such as header-words + buffer addresses), exploiting this would likely be very difficult, if possible at all.

If the two words at threadlocalstorage+0x180 could be overwritten with controlled data this way, one could then use a command with a buffer-header of <nowiki>((size<<14) | 2)</nowiki> to write arbitrary memory to any RW userland memory in the destination process.
|
| [[5.0.0-11]]
|
| v4.1 FIRM -> v5.0 code diff
| [[User:Yellows8|Yellows8]]
|-
| [[SVC|SVC stack allocation overflows]]
|
* Syscalls that allocate a variable-length array on stack, only checked bit31 before multiplying by 4/16 (when calculating how much memory to allocate). If a large integer was passed as input to one of these syscalls, an integer overflow would occur, and too little memory would have been allocated on stack resulting in a buffer overrun.
* The alignment (size+7)&~7 calculation before allocation was not checked for integer overflow.

This might allow for ARM11 kernel code-execution.

(Applies to svcSetResourceLimitValues, svcGetThreadList, svcGetProcessList, svcReplyAndReceive, svcWaitSynchronizationN.)
|
| [[5.0.0-11]]
|
| v4.1 FIRM -> v5.0 code diff
| [[User:Plutooo|plutoo]], [[User:Yellows8|Yellows8]] complementary
|-
| [[SVC|svcControlMemory]] MemoryOperation MAP memory-permissions
| svcControlMemory with MemoryOperation=MAP allows mapping the already-mapped process virtual-mem at addr1, to addr0. The lowest address permitted for addr1 is 0x00100000. Originally the ARM11 kernel didn't check memory permissions for addr1. Therefore .text as addr1 could be mapped elsewhere as RW- memory, which allowed ARM11 userland code-execution.
|
| [[4.1.0-8]]
|
| 2012
| [[User:Yellows8|Yellows8]]
|-
| [[RPC_Command_Structure|Command]] input/output buffer permissions
| Originally the ARM11 kernel didn't check memory permissions for the input/output buffers for commands. Starting with [[4.0.0-7]] the ARM11 kernel will trigger a kernelpanic() if the input/output buffers don't have the required memory permissions. For example, this allowed a FSUSER file-read to .text, which therefore allowed ARM11-userland code execution.
|
| [[4.0.0-7]]
|
| 2012
| [[User:Yellows8|Yellows8]]
|-
| [[SVC|svcReadProcessMemory/svcWriteProcessMemory memory]] permissions
| Originally the kernel only checked the first page(0x1000-bytes) of the src/dst buffers, for svcReadProcessMemory and svcWriteProcessMemory. There is no known retail processes which have access to these SVCs.
|
| [[4.0.0-7]]
|
| 2012?
| [[User:Yellows8|Yellows8]]
|}

=== [[FIRM]] Sysmodules ===
{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in [[FIRM]] system version
! Last [[FIRM]] system version this flaw was checked for
! Timeframe this was discovered
! Discovered by
|-
| [[Services|"srv:pm"]] process registration
| Originally any process had access to the port "srv:pm". The PID's used for the (un)registration commands are not checked either. This allowed any process to re-register itself with "srv:pm", and therefore allowed the process to give itself access to any service, bypassing the exheader service-access-control list.

This was fixed in [[7.0.0-13]]: starting with [[7.0.0-13]] "srv:pm" is now a service instead of a globally accessible port. Only processes with PID's less than 6 (in other words: fs, ldr, sm, pm, pxi modules) have access to it. With [[7.0.0-13]] there can only be one session for "srv:pm" open at a time(this is used by pm module), svcBreak will be executed if more sessions are opened by the processes which can access this.

This flaw was needed for exploiting the <=v4.x Process9 PXI vulnerabilities from ARM11 userland ROP, since most applications don't have access to those service(s).
| Access to arbitrary services
| [[7.0.0-13]]
|
| 2012
| [[User:Yellows8|Yellows8]]
|-
| FSDIR null-deref
| [[Filesystem_services|FS]]-module may crash in some cases when handling directory reading. The trigger seems to be due to using [[FSDir:Close]] without closing the dir-handle afterwards?(Perhaps this is caused by out-of-memory?) This seems to be useless since it's just a null-deref.
|
| None
| [[9.6.0-24|9.6.0-X]]
| May 19(?)-20, 2015
| [[User:Yellows8|Yellows8]]
|}

=== Standalone Sysmodules ===
{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in system-module system-version
! Last system-module system-version this flaw was checked for
! Timeframe this was discovered
! Timeframe this was added to wiki
! Discovered by
|-
| [[NIM_Services|NIM]]: Downloading old title-versions from eShop
| Multiple NIM service commands(such as [[NIMS:StartDownload]]) use a title-version value specified by the user-process, NIM does not validate that this input version matches the latest version available via SOAP. Therefore, when combined with AM(PXI) [[#Process9|title-downgrading]] via deleting the target eShop title with System Settings Data Management(if the title was already installed), this allows downloading+installing any title-version from eShop ''if'' it's still available from CDN.
The easiest way to exploit this is to just patch the eShop system-application code using these NIM commands(ideally the code which loads the title-version).

Originally this was tested with a debugging-system via modded-FIRM, eventually smea implemented it in HANS for the 32c3 release.
| Downloading old title-versions from eShop
| None
| [[10.0.0-27|10.0.0-X]]
| October 24, 2015 (Unknown when exactly the first eShop title downgrade was actually tested, maybe November)
| January 7, 2016 (Same day Ironfall v1.0 was removed from CDN via the main-CXI files)
| [[User:Yellows8|Yellows8]]
|-
| [[SPI_Services|SPI]] service out-of-bounds write
| cmd1 has out-of-bounds write allowing overwrite of some static variables in .data.
|
| None
| [[9.5.0-22]]
| March 2015
|
| [[User:Plutooo|plutoo]]
|-
| [[NFC_Services|NFC]] module service command buf-overflows
| NFC module copies data with certain commands, from command input buffers to stack without checking the size. These commands include the following, it's unknown if there's more commands with similar issues: "nfc:dev" <0x000C....> and "nfc:s" <0x0037....>.
Since both of these commands are stubbed in the Old3DS NFC module from the very first version(those just return an error), these issues only affect the New3DS NFC module.

There's no known retail titles which have access to either of these services.
| ROP under NFC module.
| New3DS: None
| New3DS: [[9.5.0-22]]
| December 2014?
|
| [[User:Yellows8|Yellows8]]
|-
| [[News_Services|NEWSS]] service command notificationID validation failure
| This module does not validate the input notificationID for <nowiki>"news:s"</nowiki> service commands. This is an out-of-bounds array index bug. For example, [[NEWSS:SetNotificationHeader]] could be used to exploit news module: this copies the input data(size is properly checked) to: out = newsdb_savedata+0x10 + (someu32array[notificationID]*0x70).
| ROP under news module.
| None
| [[9.7.0-25|9.7.0-X]]
| December 2014
|
| [[User:Yellows8|Yellows8]]
|-
| [[NWMUDS:DecryptBeaconData]] heap buffer overflow
| input_size = 0x1E * <value the u8 from input_[[NWM_Services|networkstruct]]+0x1D>. Then input_tag0 is copied to a heap buffer. When input_size is larger than 0xFA-bytes, it will then copy input_tag1 to <end_address_of_previous_outbuf>, with size=input_size-0xFA.

This can be triggered by either using this command directly, or by boadcasting a wifi beacon which triggers it while a 3DS system running the target process is in range, when the process is scanning for hosts to connect to. Processes will only pass tag data to this command when the wlancommID and other thing(s) match the values for the process.

There's no known way to actually exploit this for getting ROP under NWM-module, at the time of originally adding this to the wiki. This is because the data which gets copied out-of-bounds *and* actually causes crash(es), can't be controlled it seems(with just broadcasting a beacon at least). It's unknown whether this could be exploited from just using NWMUDS service-cmd(s) directly.
| Without any actual way to exploit this: NWM-module DoS, resulting in process termination(process crash). This breaks *everything* involving wifi comms, a reboot is required to recover from this.
| None
| [[9.0.0-20]]
| ~September 23, 2014(see the [[NWMUDS:DecryptBeaconData]] page history)
| August 3, 2015
| [[User:Yellows8|Yellows8]]
|-
| [[HID_Services|HID]] module shared-mem
| HID module does not validate the index values in [[HID_Shared_Memory|sharedmem]](just changes index to 0 when index == maxval when updating), therefore large values will result in HID module writing HID data to arbitrary addresses.
| ROP under HID module, but this is *very* unlikely to be exploitable since the data written is HID data.
| None
| [[9.3.0-21]]
| 2014?
|
| [[User:Yellows8|Yellows8]]
|-
| gspwn
| GSP module does not validate addresses given to the GPU. This allows a user-mode application/applet to read/write to a large part of physical FCRAM using GPU DMA. From this, you can overwrite the .text segment of the application you're running under, and gain real code-execution from a ROP-chain. Normally applets' .text([[Home Menu]], [[Internet Browser]], etc) is located beyond the area accessible by the GPU, except for [[RO_Services|CROs]] used by applets([[Internet Browser]] for example).

FCRAM is gpu-accessible up to physaddr 0x26800000 on Old3DS, and 0x2DC00000 on New3DS. This is BASE_memregion_start(aka SYSTEM_memregion_end)-0x400000 with the default memory-layout on Old3DS/New3DS.
| User-mode code execution.
| None
| [[9.6.0-24|9.6.0-X]]
| Early 2014
|
| smea, [[User:Yellows8|Yellows8]]/others before then
|-
| rohax
| Using gspwn, it is possible to overwrite a loaded [[CRO0]]/[[CRR0]] after its RSA-signature has been validated. Badly validated [[CRO0]] header leads to arbitrary read/write of memory in the ro-process. This gives code-execution in the ro module, who has access to [[SVC|syscalls]] 0x70-0x72, 0x7D.

This was fixed after [[ninjhax]] release by adding checks on [[CRO0]]-based pointers before writing to them.
| Memory-mapping syscalls.
| [[9.3.0-21]]
| [[9.4.0-21]]
|
|
| smea, [[User:Plutooo|plutoo]] joint effort
|-
| Region free
| Only [[Home Menu]] itself checks gamecards' region when launching them. Therefore, any application launch that is done directly with [[NS]] without signaling Home Menu to launch the app, will result in region checks being bypassed.
This essentially means launching the gamecard with the [[NS_and_APT_Services|"ns:s"]] service. The main way to exploit this is to trigger a FIRM launch with an application specified, either with a normal FIRM launch or a hardware [[NSS:RebootSystem|reboot]].
| Launching gamecards from any region + bypassing Home Menu gamecard-sysupdate installation
| None
| Last tested with [[10.1.0-27|10.1.0-X]].
| June(?) 2014
|
| [[User:Yellows8|Yellows8]]
|-
| [[NWM_Services|NWM]] service-cmd state null-ptr deref
| The NWMUDS service command code loads a ptr from .data, adds an offset to that, then passes that as the state address for the actual command-handler function. The value of the ptr loaded from .data is not checked, therefore this will cause crashes due to that being 0x0 when NWMUDS was not properly initialized.
It's unknown whether any NWM services besides NWMUDS have this issue.
| This is rather useless since it's only a crash caused by a state ptr based at 0x0.
| None
| [[9.0.0-20]]
| 2013?
|
| [[User:Yellows8|Yellows8]]
|}

=== General/CTRSDK ===
{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in version
! Last version this flaw was checked for
! Timeframe this was discovered
! Discovered by
|-
| [[NWM_Services|UDS]] beacon additional-data buffer overflow
| Originally CTRSDK did not validate the UDS additional-data size before using that size to copy the additional-data to a [[NWM_Services|networkstruct]]. This was eventually fixed.
This was discovered while doing code RE with an old dlp-module version. It's unknown in what specific CTRSDK version this was fixed, or even what system-version updated titles with a fixed version.

It's unknown if there's any titles using a vulnerable CTRSDK version which are also exploitable with this(dlp module can't be exploited with this).

The maximum number of bytes that can be written beyond the end of the outbuf is 0x37-bytes, with additionaldata_size=0xFF.
| Perhaps ROP, very difficult if possible with anything at all
| ?
|
| September(?) 2014
| [[User:Yellows8|Yellows8]]
|}

3DS System Flaws

2016-01-13T17:02:30Z

MassExplosion213: /* Kernel9 */

Exploits are used to execute unofficial code (homebrew) on the Nintendo 3DS. This page is a list of publicly known system flaws, for userland applications/applets flaws see [[3DS_Userland_Flaws|here]].

=Stale / Rejected Efforts=
* Neimod has been working on a RAM dumping setup for a little while now. He's de-soldered the 3DS's RAM chip and hooked it and the RAM pinouts on the 3DS' PCB up to a custom RAM dumping setup. A while ago he published photos showing his setup to be working quite well, with the 3DS successfully booting up. However, his flickr stream is now private along with most of his work.

* Someone (who will remain unnamed) has released CFW and CIA installers, all of which is copied from the work of others, or copyrighted material.

==Tips and info==
The 3DS uses the XN feature of the ARM11 processor. There's no official way from applications to enable executable permission for memory containing arbitrary unsigned code(there's a [[SVC]] for this, but only [[RO_Services|RO-module]] has access to it). An usable userland exploit would still be useful: you could only do return-oriented-programming with it initially. From ROP one could then exploit system flaw(s), see below.

SD card [[extdata]] and SD savegames can be attacked, for consoles where the console-unique [[Nand/private/movable.sed|movable.sed]] was dumped(accessing SD data is far easier by running code on the target 3DS however).

=System flaws=
== Hardware ==
{| class="wikitable" border="1"
! Summary
! Description
! Fixed with hardware model/revision
! Newest hardware model/revision this flaw was checked for
! Timeframe this was discovered
! Discovered by
|-
| ARM9/ARM11 bootrom vectors point at unitialized RAM
| ARM9's and ARM11's exception vectors are hardcoded to point at the CPU's internal memory (0x08000000 region for ARM9, AXIWRAM for ARM11). While the bootrom does set them up to point to an endless loop at some point during boot, it does not do so immediately. As such, a carefully-timed fault injection (via hardware) to trigger an exception (such as an invalid instruction) will cause execution to fall into ARM9 RAM.
Since RAM isn't cleared on boot (see below), one can immediately start execution of their own code here to dump bootrom, OTP, etc.
The ARM9 bootrom does the following at reset: reset vector branches to another instruction, then branches to bootrom+0x8000. Hence, there's no way to know for certain when exactly the ARM9 exception-vector data stored in memory gets initialized.

This requires *very* *precise* timing for triggering the hardware fault: it's unknown if anyone actually exploited this successfully at the time of writing(the one who attempted+discovered it *originally* as listed in this wiki section hasn't).
| None: all available 3DS models at the time of writing have the exact same ARM9/ARM11 bootrom for the unprotected areas.
| New3DS
| End of February 2014
| [[User:Derrek|derrek]], WulfyStylez (May 2015) independently
|-
| Missing AES key clearing
| The hardware AES engine does not clear keys when doing a hard reset/reboot.
| None
| New3DS
| August 2014
| Mathieulh/Others
|-
| No RAM clearing on reboots
| On an MCU-triggered reboot all RAM including FCRAM/ARM9 memory/AXIWRAM/VRAM keeps its contents.
| None
| New3DS
| March 2014
| [[User:Derrek|derrek]]
|-
| 32bits of actual console-unique TWLNAND keydata
| On retail the 8-bytes at ARM9 address [[Memory_layout|0x01FFB808]] are XORed with hard-coded data, to generate the TWL console-unique keys, including TWLNAND. On Old3DS the high u32 is always 0x0, while on New3DS that u32 is always 0x2. On top of this, the lower u32's highest bit is always ORed. only 31 bits of the TWL console-unique keydata / TWL consoleID are actually console-unique.
This allows one to easily bruteforce the TWL console-unique keydata with *just* data from TWLNAND. On DSi the actual console-unique data for key generation is 8-bytes(all bytes actually set).
| None
| New3DS
| 2012?
| [[User:Yellows8|Yellows8]]
|-
| DSi / 3DS-TWL key-generator
| After using the key generator to generate the normal-key, you could overwrite parts of the normal-key with your own data and then recover the key-generator output by comparing the new crypto output with the original crypto output. From the normal-key outputs, you could deduce the TWL key-generator function.
This applies to the keyX/keyY too.

This attack does not work for the 3DS key-generator because keyslots 0-3 are only for TWL keys.
| None
| New3DS
| 2011
| [[User:Yellows8|Yellows8]]
|-
| 3DS key-generator
| The algorithm for generating the normal-keys for keyslots is cryptographically weak. As a result, it is easily susceptible to differential cryptanalysis if the normal-key corresponding to any scrambler-generated keyslot is discovered.

Several such pairs of matching normal-keys and KeyY values were found, leading to deducing the key-generator function.
| None
| New3DS
| February 2015
| [[User:Yellows8|Yellows8]], [[User:Plutooo|plutoo]]
|}

== ARM9 software ==
=== arm9loader ===
{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in [[FIRM]] system version
! Last [[FIRM]] system version this flaw was checked for
! Timeframe this was discovered
! Public disclosure timeframe
! Discovered by
|-
| Uncleared OTP hash keydata in console-unique 0x11 key-generation
| Kernel9Loader does not clear the [[SHA_Registers#SHA_HASH|SHA_HASH register]] after use. As a result, the data stored here as K9L hands over to Kernel9 is the hash of [[OTP_Registers|OTP data]] used to seed the [[FIRM#New_3DS_FIRM|console-unique NAND keystore decryption key]] set on keyslot 0x11.

Retrieving this keydata and the [[Flash_Filesystem#0x12C00|NAND keystore]] of the same device allows calculating the decrypted New3DS NAND keystore (non-unique, common to all New3DS units), which contains AES normal keys, also set on keyslot 0x11, which are then used to derive all current [[AES_Registers#Keyslots|New3DS-only AES keyXs]] including the newer batch introduced in [[9.6.0-24#arm9loader|9.6.0-X]]. From there, it is trivial to perform the same key derivation in order to initialize those keys on any system version, and even on Old3DS.

This can be performed by exploiting the "arm9loaderhax" vulnerability to obtain post-K9L code execution after an MCU reboot (the bootrom section-loading fail is not relevant here, this attack was performed without OTP data by brute-forcing keys), and using this to dump the SHA_HASH register. This attack works on any FIRM version shipping a vulnerable version of K9L, whereas OTP dumping required a boot of <[[3.0.0-6|3.0.0-X]].

This attack results in obtaining the entire (0x200-bytes) NAND keystore - it was confirmed at a later date that this keystore is encrypted with the same key (by comparing the decrypted data from multiple units), and therefore using another key in this store will not remedy the issue as all keys are known (i.e. later, unused keys decrypt to the same 0x200-bytes constant with the same OTP hash). Later keys could have been encrypted differently but this is not the case. As a result of this, it is not possible for Nintendo to use K9L again in its current format for its intended purpose, though this was not news from the moment people dumped a New3DS OTP.
| Derivation of all New3DS keys generated via the NAND keystore (0x1B "Secure4" etc.)
| None
| [[10.2.0-28|10.2.0-X]]
| ~April 2015, implemented in May 2015
| 13 January 2016
| [[User:WulfyStylez|WulfyStylez]], [[User:Dazzozo|Dazzozo]], [[User:Shinyquagsire23|shinyquagsire23]] (complimentary + implemented), [[User:Plutooo|plutoo]], Normmatt (discovered independently)
|-
| enhanced-arm9loaderhax
| See the 32c3 3ds talk.
Since this is a combination of a trick with the arm9-bootrom + arm9loaderhax, and since you have to manually write FIRM to the firm0/firm1 NAND partitions, this can't really be completely fixed. More New3DS keys could be generated differently/etc in an updated arm9loader which also fixes arm9loaderhax, but that's about all really.
| arm9loaderhax which automatically occurs at hard-boot.
| See arm9loaderhax / description.
| See arm9loaderhax / description.
| Theorized around mid July, 2015. Later implemented+tested by [[User:Plutooo|plutoo]] and derrek.
| 32c3 3ds talk (December 27, 2015)
| [[User:Yellows8|Yellows8]]
|-
| Missing verification-block for the 9.6 keys (arm9loaderhax)
| Starting with [[9.6.0-24|9.6.0-X]] a new set of NAND-based keys were introduced. However, no verification block was added to verify that the new key read from NAND is correct. This was technically an issue from [[9.5.0-22|9.5.0-X]] with the original sector+0 keydata, however the below is only possible with [[9.6.0-24|9.6.0-X]] since keyslots 0x15 and 0x16 are generated from different 0x11 keyXs.

Writing an incorrect key to NAND will cause arm9loader to decrypt the ARM9 kernel as garbage and then jump to it.

This allows an hardware-based attack where you can boot into an older exploited firmware, fill all memory with NOP sleds/jump-instructions, and then reboot into executing garbage. By automating this process with various input keydata, eventually you'll find some garbage that jumps to your code.

This gives very early ARM9 code execution (pre-ARM9 kernel). As such, it is possible to dump RSA keyslots with this and calculate the 6.x [[Savegames#6.0.0-11_Savegame_keyY|save]], and 7.x [[NCCH]] keys. This cannot be used to recover keys initialized by arm9loader itself. This is due to it wiping the area used for its stack during NAND sector decryption and keyslot init.

Due to FIRMs on both Old and New 3DS using the same RSA data, this can be exploited on Old3DS as well, but only if one already has the actual plaintext normalkey from New3DS NAND sector 0x96 offset-0 and has dumped the OTP area of the Old3DS.
| Recovery of 6.x [[Savegames#6.0.0-11_Savegame_keyY|save key]]/7.x [[NCCH]] key
| None
| [[10.2.0-28|10.2.0-X]]
| March, 2015
|
| [[User:Plutooo|plutoo]]
|-
| Uncleared New3DS keyslot 0x11
| Originally the New3DS [[FIRM]] arm9bin loader only cleared keyslot 0x11 when it gets executed at firmlaunch. This was fixed with [[9.5.0-22|9.5.0-X]] by completely clearing keyslot 0x11 immediately after the loader finishes using keyslot 0x11.
This means that any ARM9 code that can execute before the loader clears the keyslot at firmlaunch(including firmlaunch-hax) can get access to the uncleared keyslot 0x11, which then allows one to generate all <=v9.5 New3DS keyXs which are generated by keyslot 0x11.

Therefore, to completely fix this the loader would have to generate more keys using different keyslot 0x11 keydata. This was done with [[9.6.0-24|9.6.0-X]].
| New3DS keyXs generation
| Mostly fixed with [[9.5.0-22|9.5.0-X]], completely fixed with new keys with [[9.6.0-24|9.6.0-X]].
|
| February 3, 2015 (one day after [[9.5.0-22|9.5.0-X]] release)
|
| [[User:Yellows8|Yellows8]]
|}

=== Process9 ===
{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in [[FIRM]] system version
! Last [[FIRM]] system version this flaw was checked for
! Timeframe this was discovered
! Public disclosure timeframe
! Discovered by
|-
| Leak of normal-key matching a key-scrambler key
| New 3DS firmware versions [[8.1.0-0 New3DS|8.1.0]] through [[9.2.0-20|9.2.0]] set the encryption key for [[Amiibo]] data using a hardcoded normal-key in Process9. In firmware [[9.3.0-21|9.3.0]], Nintendo "fixed" this by using the key scrambler instead, by calculating the keyY value for keyslot 0x39 that results in the same normal-key, then hardcoding that keyY into Process9.

Nintendo's fix is actually the problem: Nintendo revealed the normal-key matching an unknown keyX and a known keyY. Combined with the key scrambler using an insecure scrambling algorithm (see "Hardware" above), the key scrambler function could be deduced.
| Deducing the keyX for keyslot 0x39 and the key scrambler algorithm
| New 3DS [[9.3.0-21|9.3.0-X]], sort of
| [[10.0.0-27|10.0.0-X]]
| Sometime in 2015 after the hardware key-generator was broken.
| 32c3 3ds talk (December 27, 2015)
| [[User:Yellows8|Yellows8]]
|-
| ntrcardhax
|
| ARM9 code execution
| None
| [[10.3.0-28|10.3.0-X]]
| March 2015
| 32c3 3ds talk (December 27, 2015)
| [[User:Plutooo|plutoo]]
|-
| Title downgrading via [[Application_Manager_Services|AM]]([[Application_Manager_Services_PXI|PXI]])
| When a title is *already* installed, Process9 will compare the installed title-version with the title-version being installed. When the one being installed is older, Process9 would return an error.

However, this can be bypassed by just deleting the title first via the service command(s) for that: with the title removed from the [[Title_Database]], Process9 can't compare the input title-version with anything. Hence, titles can be downgraded this way.
| Bypassing title version check at installation, which then allows downgrading any title.
| None
| NATIVE_FIRM / AM-sysmodule [[10.0.0-27|10.0.0-X]]
| ?
|
| ?
|-
| FAT FS code null-deref
| When FSFile:Read is used with a file which is corrupted on a FAT filesystem(in particular SD), Process9 can crash. This particular crash is caused by a function returning NULL instead of an actual ptr due to an error. The caller of that function doesn't check for NULL which then triggers a read based at NULL.

Sample "fsck.vfat -n -v -V <fat image backup>" output for the above crash:

<pre>...
Starting check/repair pass.
<FilePath0> and
<FilePath1>
share clusters.
Truncating second to 3375104 bytes.
<FilePath1>
File size is 2787392 bytes, cluster chain length is 16384 bytes.
Truncating file to 16384 bytes.
Checking for unused clusters.
Reclaimed 1 unused cluster (16384 bytes).
Checking free cluster summary.
Free cluster summary wrong (1404490 vs. really 1404491)
Auto-correcting.
Starting verification pass.
Checking for unused clusters.
Leaving filesystem unchanged.</pre>
| Useless null-based-read
| None
| [[9.6.0-24|9.6.0-X]]
| July 8-9, 2015
|
| [[User:Yellows8|Yellows8]]
|-
| RSA signature padding checks
| The TWL_FIRM RSA sig padding check code used for all TWL RSA sig-checks has issues, see [[FIRM|here]].
The main 3DS RSA padding check code(non-certificate, including NATIVE_FIRM) uses the function used with the above to extract more padding + the actual hash from the additional padding. This isn't really a problem here because there's proper padding check code which is executed prior to this.
|
| None
| [[9.5.0-22|9.5.0-X]]
| March 2015
|
| [[User:Yellows8|Yellows8]]
|-
| [[AMPXI:ValidateDSiWareSectionMAC]] [[AES_Registers|AES]] keyslot reuse
| When the input DSiWare section index is higher than <max number of DSiWare sections supported by this FIRM>, Process9 uses keyid 0x40 for calculating the AESMAC, which translates to keyslot 0x40. The result is that the keyslot is left at whatever was already selected before, since the AES selectkeyslot code will immediately return when keyslot is >=0x40. However, actually exploiting this is difficult: the calculated AESMAC is never returned, this command just compares the calculated AESMAC with the input AESMAC(result-code depends on whether the AESMACs match). It's unknown whether a timing attack would work with this.
This is basically a different form of the pxips9 keyslot vuln, except with AESMAC etc.
| See description.
| None
| [[10.2.0-28|10.2.0-X]]
| March 15, 2015
| December 29, 2015
| [[User:Yellows8|Yellows8]]
|-
| pxips9 [[AES_Registers|AES]] keyslot reuse
| This requires access to the [[Process_Services|ps:ps]]/pxi:ps9 services. One way to get access to this would be snshax on system-version <=10.1.0-X(see 32c3 3ds talk).
When an invalid key-type value is passed to any of the PS commands, Process9 will try to select keyslot 0x40. That aesengine_setkeyslot() code will then immediately return due to the invalid keyslot value. Since that function doesn't return any errors, Process9 will just continue to do crypto with whatever AES keyslot was selected before the PS command was sent.
| Reusing the previously used keyslot, for crypto with PS.
| None
| [[10.2.0-28|10.2.0-X]]
| Roughly the same time(same day?) as firmlaunch-hax.
| December 29, 2015
| [[User:Yellows8|Yellows8]]
|-
| firmlaunch-hax: FIRM header ToCToU
| This can't be exploited from ARM11 userland.
During [[FIRM]] launch, the only FIRM header the ARM9 uses at all is stored in FCRAM, this is 0x200-bytes(the actual used FIRM RSA signature is read to the Process9 stack however). The ARM9 doesn't expect "anything" besides the ARM9 to access this data.
With [[9.5.0-22]] the address of this FIRM header was changed from a FCRAM address, to ARM9-only address 0x01fffc00.
| ARM9 code execution
| [[9.5.0-22]]
|
| 2012, 3 days after [[User:Yellows8|Yellows8]] started Process9 code RE.
|
| [[User:Yellows8|Yellows8]]
|-
| Uninitialized data output for (PXI) command replies
| PXI commands for various services(including some [[Filesystem_services_PXI|here]] and many others) can write uninitialized data (like from ARM registers) to the command reply. This happens with stubbed commands, but this can also occur with certain commands when returning an error.
Certain ARM11 service commands have this same issue as well.
|
| None
| [[9.3.0-21|9.3.0-X]]
| ?
|
| [[User:Yellows8|Yellows8]]
|-
| [[Filesystem_services_PXI|FSPXI]] OpenArchive SD permissions
| Process9 does not use the exheader ARM9 access-mount permission flag for SD at all.
This would mean ARM11-kernelmode code / fs-module itself could directly use FSPXI to access SD card without ARM9 checking for SD access, but this is rather useless since a process is usually running with SD access(Home Menu for example) anyway.
|
| None
| [[9.3.0-21|9.3.0-X]]
| 2012
|
| [[User:Yellows8|Yellows8]]
|-
| [[AMPXI:ExportDSiWare]] export path
| Process9 allocates memory on Process9 heap for the export path then verifies that the actual allocated size matches the input size. Then Process9 copies the input path from FCRAM to this buffer, and uses it with the Process9 FS openfile code, which use paths in the form of "<mountpoint>:/<path>".
Process9 does not check the contents of this path at all before passing it to the FS code, besides writing a NUL-terminator to the end of the buffer.
| Exporting of DSiWare to arbitrary Process9 file-paths, such as "nand:/<path>" etc. This isn't really useful since the data which gets written can't be controlled.
| None
| [[9.5.0-22]]
| April 2013
|
| [[User:Yellows8|Yellows8]]
|-
| [[DSiWare_Exports]] [[CTCert]] verification
| Just like DSi originally did, 3DS verifies the APCert for DSiWare on SD with the CTCert also in the DSiWare .bin. On DSi this was fixed with with system-version 1.4.2 by verifying with the actual console-unique cert instead(stored in NAND), while on 3DS it's still not(?) fixed.
On 3DS however this is rather useless, due to the entire DSiWare .bin being encrypted with the console-unique movable.sed keyY.
| When the movable.sed keyY for the target 3DS is known and the target 3DS CTCert private-key is unknown, importing of modified DSiWare SD .bin files.
| Unknown, probably none.
| ?
| April 2013
|
| [[User:Yellows8|Yellows8]]
|-
| [[Gamecard_Services_PXI]] unchecked REG_CTRCARDCNT transfer-size
| The u8 REG_CTRCARDCNT transfer-size parameter for the [[Gamecard_Services_PXI]] read/write CTRCARD commands is used as an index for an array of u16 values. Before [[5.0.0-11|5.0.0-X]] this u8 value wasn't checked, thus out-of-bounds reads could be triggered(which is rather useless in this case).
| Out-of-bounds read for a value which gets written to a register.
| [[5.0.0-11|5.0.0-X]]
|
| 2013?
|
| [[User:Yellows8|Yellows8]]
|-
| [[PXI_Registers|PXI]] cmdbuf buffer overrun
| The Process9 code responsible [[PXI_Registers|PXI]] communications didn't verify the size of the incoming command before writing it to a C++ member variable.
| Probably ARM9 code execution
| [[5.0.0-11|5.0.0-11]]
|
| March 2015, original timeframe if any unknown
|
| [[User:Plutooo|plutoo]]/[[User:Yellows8|Yellows8]]/maybe others(?)
|-
| [[Application_Manager_Services_PXI|PXIAM]] command 0x003D0108(See also [[Application_Manager_Services|this]])
| When handling this command, Process9 allocates a 0x2800-byte heap buffer, then copies the 4 FCRAM input buffers to this heap buffer without checking the sizes at all(only the buffers with non-zero sizes are copied). Starting with [[5.0.0-11|5.0.0-X]], the total combined size of the input data must be <=0x2800.
| ARM9 code execution
| [[5.0.0-11|5.0.0-X]]
|
| May 2013
|
| [[User:Yellows8|Yellows8]]
|-
| [[Process_Services_PXI|PS RSA]] commands buffer overflows
| pxips9 cmd1(not accessible via ps:ps) and VerifyRsaSha256: unchecked copy to a buffer in Process9's .bss, from the input FCRAM buffer. The buffer is located before the pxi cmdhandler threads' stacks. SignRsaSha256 also has a buf overflow, but this isn't exploitable.
The buffer for this is the buffer for the signature data. With v5.0, the signature buffer was moved to stack, with a check for the signature data size. When the signature data size is too large, Process9 uses [[SVC|svcBreak]].
| ARM9 code execution
| [[5.0.0-11|5.0.0-X]]
|
| 2012
|
| [[User:Yellows8|Yellows8]]
|-
| [[PXI_Registers|PXI]] pxi_id bad check
| The Process9 code responsible for [[PXI_Registers|PXI]] communications read pxi_id as a signed char. There were two flaws:
* They used it as index to a lookup-table without checking the value at all.
* Another function verified that pxi_id < 7, allowing negative values to pass the check. This would also cause an out-of-range table-lookup.
| Maybe ARM9 code execution
| [[3.0.0-5|3.0.0-5]]
|
| March 2015, originally 2012 for the first issue at least
|
| [[User:Plutooo|plutoo]], [[User:Yellows8|Yellows8]], maybe others(?)
|}

=== Kernel9 ===
{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in [[FIRM]] system version
! Last [[FIRM]] system version this flaw was checked for
! Timeframe this was discovered
! Discovered by
|-
| [[CONFIG Registers#CFG_SYSPROT9|CFG_SYSPROT9]] bit1 not set by Kernel9
| Old versions of Kernel9 never set bit1 of [[CONFIG Registers#CFG_SYSPROT9|CFG_SYSPROT9]]. This leaves the [[OTP Registers|0x10012000]]-region unprotected (this region should be locked early during boot!). Since it's never locked, you can dump it once you get ARM9 code execution. See [[OTP Registers|here]] regarding the data stored there.

From [[3.0.0-5|3.0.0-X]] this was fixed by setting the bit in Kernel9 after poking some registers in that region. On New3DS arm9loader sets this bit instead of Kernel9. This is exploitable on N3DS however if you downgrade to 1.0 and reencrypt the NAND with keyslot 0x4 instead of 0x5.
| Dumping of the [[OTP Registers|OTP]] area
| [[3.0.0-5|3.0.0-X]]
|
| February 2015
| [[User:Plutooo|plutoo]], Normmatt independently
|}

== ARM11 software ==
=== Kernel11 ===
{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in [[FIRM]] system version
! Last [[FIRM]] system version this flaw was checked for
! Timeframe this was discovered
! Discovered by
|-
| [[SVC]] table too small
| The table of function pointers for SVC's only contains entries up to 0x7D, but the biggest allowed SVC for the table is 0x7F. Thus, executing SVC7E or SVC7F would make the SVC-handler read after the buffer, and interpret some ARM instructions as function pointers.

However, this would require patching the kernel .text or modifying SVC-access-control. Even if you could get these to execute, they would still jump to memory that isn't mapped as executable.
|
| None
| [[10.2.0-28|10.2.0-X]]
| 2012
| Everyone
|-
| [[SVC|svcBackdoor (0x7B)]]
| This backdoor allows executing SVC-mode code at the user-specified code-address. This is used by Process9, using this on the ARM11(with NATIVE_FIRM) requires patching the kernel .text or modifying SVC-access-control.
| See description
| None
| [[10.2.0-28|10.2.0-X]]
|
| Everyone
|-
| [[Memory_layout#ARM11_Detailed_virtual_memory_map|0xEFF00000]] / 0xDFF00000 ARM11 kernel virtual-memory
| The ARM11 kernel-mode 0xEFF00000/0xDFF00000 virtual-memory(size 0x100000) is mapped to phys-mem 0x1FF00000(entire DSP-mem + entire AXIWRAM), with permissions RW-. This is used during ARM11 kernel startup for loading the FIRM-modules from the FIRM section located in DSP-mem, this never seems to be used after that, however. This is never unmapped either.
|
| None
| [[10.2.0-28|10.2.0-X]]
|
|
|-
| Memchunkhax2
|
| ARM11 kernel code execution
| None
| [[10.3.0-28|10.3.0-X]]
|
| derrek
|-
| AffinityMask/processorid validation
| With [[10.0.0-27|10.0.0-X]] the following functions were updated: svcGetThreadAffinityMask, svcGetProcessAffinityMask, svcSetProcessAffinityMask, and svcCreateThread. The code changes for all but svcCreateThread are identical.
The original code with the first 3 did the following:
* if(u32_processorcount > ~0x80000001)return 0xe0e01bfd;
* if(s32_processorcount > <total_cores>)return 0xd8e007fd;
The following code replaced the above:
* if(u32_processorcount >= <total_cores+1>)return 0xd8e007fd;
In theory the latter should catch everything that the former did, so it's unknown if this was really a security issue.

The svcCreateThread changes with [[10.0.0-27|10.0.0-X]] definitely did fix a security issue.
* Original code: "if(s32_processorid > <total_cores>)return 0xd8e007fd;"
* New code: "if(s32_processorid >= <total_cores> || s32_processorid <= -4)return 0xd8e007fd;"
This fixed an off-by-one issue: if one would use processorid=total_cores, which isn't actually a valid value, svcCreateThread would accept that value on <[[10.0.0-27|10.0.0-X]]. This results in data being written out-of-bounds(baseaddr = arrayaddr + entrysize*processorid), which has the following result:
* Old3DS: Useless kernel-mode crash due to accessing unmapped memory.
* New3DS: uncontrolled data write into a kernel-mode L1 MMU-table. This isn't really useful: the data can't be controlled, and the data which gets overwritten is all-zero anyway(this isn't anywhere near MMU L1 entries for actually mapped memory).
The previous version also allowed large negative s32_processorid values(negative processorid values are special values not actual procids), but it appears using values like that won't actually do anything(meaning no crash) besides the thread not running / thread not running for a while(besides triggering a kernelpanic with certain s32_processorid value(s)).
| Nothing useful
| [[10.0.0-27|10.0.0-X]]
| [[10.0.0-27|10.0.0-X]]
| svcCreateThread issue: May 31, 2015. The rest: September 8, 2015, via v9.6->v10.0 ARM11-kernel code-diff.
| [[User:Yellows8|Yellows8]]
|-
| memchunkhax
| The kernel originally did not validate the data stored in the FCRAM kernel heap [[Memchunkhdr|memchunk-headers]] for free-memory at all. Exploiting this requires raw R/W access to these memchunk-headers, like physical-memory access with gspwn.

There are ''multiple'' ways to exploit this, but the end-result for most of these is the same: overwrite code in AXIWRAM via the 0xEFF00000/0xDFF00000 kernel virtual-memory mapping.

This was fixed in [[9.3.0-21|9.3.0-X]] by checking that the memchunk(including size, next, and prev ptrs) is located within the currently used heap memory. The kernel may also check that the next/prev ptrs are valid compared to other memchunk-headers basically. When any of these checks fail, kernelpanic() is called.
| When combined with other flaws: ARM11-kernelmode code execution
| [[9.3.0-21|9.3.0-21]]
|
| February 2014
| [[User:Yellows8|Yellows8]]
|-
| Multiple [[KLinkedListNode|KLinkedListNode]] SlabHeap use after free bugs
| The ARM11-kernel did access the 'key' field of [[KLinkedListNode|KLinkedListNode]] objects, which are located on the SlabHeap, after freeing them. Thus, triggering an allocation of a new [[KLinkedListNode|KLinkedListNode]] object at the right time could result in a type-confusion. Pseudo-code:
SlabHeap_free(KLinkedListNode);
KObject *obj = KLinkedListNode->key; // the object there might have changed!
This bug appeared all over the place.
| ARM11-kernelmode code exec maybe
| [[8.0.0-18|8.0.0-18]]
|
| April 2015
| [[User:Derrek|derrek]]
|-
| PXI [[RPC_Command_Structure|Command]] input/output buffer permissions
| Originally the ARM11-kernel didn't check permissions for PXI input/output buffers for commands. Starting with [[6.0.0-11|6.0.0]] PXI input/output buffers must have RW permissions, otherwise kernelpanic is triggered.
|
| [[6.0.0-11|6.0.0-11]]
|
| 2012
| [[User:Yellows8|Yellows8]]
|-
| [[SVC|svcStartInterProcessDma]]
| For svcStartInterProcessDma, the kernel code had the following flaws:

* Originally the ARM11-kernel read the input DmaConfig structure directly in kernel-mode(ldr(b/h) instructions), without checking whether the DmaConfig address is readable under userland. This was fixed by copying that structure to the SVC-mode stack, using the ldrbt instruction.

* Integer overflows for srcaddr+size and dstaddr+size are now checked(with [[6.0.0-11]]), which were not checked before.

* The kernel now also checks whether the srcaddr/dstaddr (+size) is within userland memory (0x20000000), the kernel now (with [[6.0.0-11]]) returns an error when the address is beyond userland memory. Using an address >=0x20000000 would result in the kernel reading from the process L1 MMU table, beyond the memory allocated for that MMU table(for vaddr->physaddr conversion).
|
| [[6.0.0-11]]
|
| DmaConfig issue: unknown. The rest: 2014
| [[User:Plutooo|plutoo]], [[User:Yellows8|Yellows8]] independently
|-
| [[SVC|svcControlMemory]] Parameter checks
| For svcControlMemory the parameter check had these two flaws:

* The allowed range for addr0, addr1, size parameters depends on which MemoryOperation is being specified. The limitation for GSP heap was only checked if op=(u32)0x10003. By setting a random bit in op that has no meaning (like bit17?), op would instead be (u32)0x30003, and the range-check would be less strict and not accurate. However, the kernel doesn't actually use the input address for LINEAR memory-mapping at all besides the range-checks, so this isn't actually useful. This was fixed in the kernel by just checking for the LINEAR bit, instead of comparing the entire MemoryOperation value with 0x10003.

* Integer overflows on (addr0+size) are now checked that previously weren't (this also applies to most other address checks elsewhere in the kernel).

|
| [[5.0.0-11]]
|
|
| [[User:Plutooo|plutoo]]
|-
| [[RPC_Command_Structure|Command]] request/response buffer overflow
| Originally the kernel did not check the word-values from the command-header. Starting with [[5.0.0-11]], the kernel will trigger a kernelpanic() when the total word-size of the entire command(including the cmd-header) is larger than 0x40-words (0x100-bytes). This allows overwriting threadlocalstorage+0x180 in the destination thread. However, since the data written there would be translate parameters (such as header-words + buffer addresses), exploiting this would likely be very difficult, if possible at all.

If the two words at threadlocalstorage+0x180 could be overwritten with controlled data this way, one could then use a command with a buffer-header of <nowiki>((size<<14) | 2)</nowiki> to write arbitrary memory to any RW userland memory in the destination process.
|
| [[5.0.0-11]]
|
| v4.1 FIRM -> v5.0 code diff
| [[User:Yellows8|Yellows8]]
|-
| [[SVC|SVC stack allocation overflows]]
|
* Syscalls that allocate a variable-length array on stack, only checked bit31 before multiplying by 4/16 (when calculating how much memory to allocate). If a large integer was passed as input to one of these syscalls, an integer overflow would occur, and too little memory would have been allocated on stack resulting in a buffer overrun.
* The alignment (size+7)&~7 calculation before allocation was not checked for integer overflow.

This might allow for ARM11 kernel code-execution.

(Applies to svcSetResourceLimitValues, svcGetThreadList, svcGetProcessList, svcReplyAndReceive, svcWaitSynchronizationN.)
|
| [[5.0.0-11]]
|
| v4.1 FIRM -> v5.0 code diff
| [[User:Plutooo|plutoo]], [[User:Yellows8|Yellows8]] complementary
|-
| [[SVC|svcControlMemory]] MemoryOperation MAP memory-permissions
| svcControlMemory with MemoryOperation=MAP allows mapping the already-mapped process virtual-mem at addr1, to addr0. The lowest address permitted for addr1 is 0x00100000. Originally the ARM11 kernel didn't check memory permissions for addr1. Therefore .text as addr1 could be mapped elsewhere as RW- memory, which allowed ARM11 userland code-execution.
|
| [[4.1.0-8]]
|
| 2012
| [[User:Yellows8|Yellows8]]
|-
| [[RPC_Command_Structure|Command]] input/output buffer permissions
| Originally the ARM11 kernel didn't check memory permissions for the input/output buffers for commands. Starting with [[4.0.0-7]] the ARM11 kernel will trigger a kernelpanic() if the input/output buffers don't have the required memory permissions. For example, this allowed a FSUSER file-read to .text, which therefore allowed ARM11-userland code execution.
|
| [[4.0.0-7]]
|
| 2012
| [[User:Yellows8|Yellows8]]
|-
| [[SVC|svcReadProcessMemory/svcWriteProcessMemory memory]] permissions
| Originally the kernel only checked the first page(0x1000-bytes) of the src/dst buffers, for svcReadProcessMemory and svcWriteProcessMemory. There is no known retail processes which have access to these SVCs.
|
| [[4.0.0-7]]
|
| 2012?
| [[User:Yellows8|Yellows8]]
|}

=== [[FIRM]] Sysmodules ===
{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in [[FIRM]] system version
! Last [[FIRM]] system version this flaw was checked for
! Timeframe this was discovered
! Discovered by
|-
| [[Services|"srv:pm"]] process registration
| Originally any process had access to the port "srv:pm". The PID's used for the (un)registration commands are not checked either. This allowed any process to re-register itself with "srv:pm", and therefore allowed the process to give itself access to any service, bypassing the exheader service-access-control list.

This was fixed in [[7.0.0-13]]: starting with [[7.0.0-13]] "srv:pm" is now a service instead of a globally accessible port. Only processes with PID's less than 6 (in other words: fs, ldr, sm, pm, pxi modules) have access to it. With [[7.0.0-13]] there can only be one session for "srv:pm" open at a time(this is used by pm module), svcBreak will be executed if more sessions are opened by the processes which can access this.

This flaw was needed for exploiting the <=v4.x Process9 PXI vulnerabilities from ARM11 userland ROP, since most applications don't have access to those service(s).
| Access to arbitrary services
| [[7.0.0-13]]
|
| 2012
| [[User:Yellows8|Yellows8]]
|-
| FSDIR null-deref
| [[Filesystem_services|FS]]-module may crash in some cases when handling directory reading. The trigger seems to be due to using [[FSDir:Close]] without closing the dir-handle afterwards?(Perhaps this is caused by out-of-memory?) This seems to be useless since it's just a null-deref.
|
| None
| [[9.6.0-24|9.6.0-X]]
| May 19(?)-20, 2015
| [[User:Yellows8|Yellows8]]
|}

=== Standalone Sysmodules ===
{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in system-module system-version
! Last system-module system-version this flaw was checked for
! Timeframe this was discovered
! Timeframe this was added to wiki
! Discovered by
|-
| [[NIM_Services|NIM]]: Downloading old title-versions from eShop
| Multiple NIM service commands(such as [[NIMS:StartDownload]]) use a title-version value specified by the user-process, NIM does not validate that this input version matches the latest version available via SOAP. Therefore, when combined with AM(PXI) [[#Process9|title-downgrading]] via deleting the target eShop title with System Settings Data Management(if the title was already installed), this allows downloading+installing any title-version from eShop ''if'' it's still available from CDN.
The easiest way to exploit this is to just patch the eShop system-application code using these NIM commands(ideally the code which loads the title-version).

Originally this was tested with a debugging-system via modded-FIRM, eventually smea implemented it in HANS for the 32c3 release.
| Downloading old title-versions from eShop
| None
| [[10.0.0-27|10.0.0-X]]
| October 24, 2015 (Unknown when exactly the first eShop title downgrade was actually tested, maybe November)
| January 7, 2016 (Same day Ironfall v1.0 was removed from CDN via the main-CXI files)
| [[User:Yellows8|Yellows8]]
|-
| [[SPI_Services|SPI]] service out-of-bounds write
| cmd1 has out-of-bounds write allowing overwrite of some static variables in .data.
|
| None
| [[9.5.0-22]]
| March 2015
|
| [[User:Plutooo|plutoo]]
|-
| [[NFC_Services|NFC]] module service command buf-overflows
| NFC module copies data with certain commands, from command input buffers to stack without checking the size. These commands include the following, it's unknown if there's more commands with similar issues: "nfc:dev" <0x000C....> and "nfc:s" <0x0037....>.
Since both of these commands are stubbed in the Old3DS NFC module from the very first version(those just return an error), these issues only affect the New3DS NFC module.

There's no known retail titles which have access to either of these services.
| ROP under NFC module.
| New3DS: None
| New3DS: [[9.5.0-22]]
| December 2014?
|
| [[User:Yellows8|Yellows8]]
|-
| [[News_Services|NEWSS]] service command notificationID validation failure
| This module does not validate the input notificationID for <nowiki>"news:s"</nowiki> service commands. This is an out-of-bounds array index bug. For example, [[NEWSS:SetNotificationHeader]] could be used to exploit news module: this copies the input data(size is properly checked) to: out = newsdb_savedata+0x10 + (someu32array[notificationID]*0x70).
| ROP under news module.
| None
| [[9.7.0-25|9.7.0-X]]
| December 2014
|
| [[User:Yellows8|Yellows8]]
|-
| [[NWMUDS:DecryptBeaconData]] heap buffer overflow
| input_size = 0x1E * <value the u8 from input_[[NWM_Services|networkstruct]]+0x1D>. Then input_tag0 is copied to a heap buffer. When input_size is larger than 0xFA-bytes, it will then copy input_tag1 to <end_address_of_previous_outbuf>, with size=input_size-0xFA.

This can be triggered by either using this command directly, or by boadcasting a wifi beacon which triggers it while a 3DS system running the target process is in range, when the process is scanning for hosts to connect to. Processes will only pass tag data to this command when the wlancommID and other thing(s) match the values for the process.

There's no known way to actually exploit this for getting ROP under NWM-module, at the time of originally adding this to the wiki. This is because the data which gets copied out-of-bounds *and* actually causes crash(es), can't be controlled it seems(with just broadcasting a beacon at least). It's unknown whether this could be exploited from just using NWMUDS service-cmd(s) directly.
| Without any actual way to exploit this: NWM-module DoS, resulting in process termination(process crash). This breaks *everything* involving wifi comms, a reboot is required to recover from this.
| None
| [[9.0.0-20]]
| ~September 23, 2014(see the [[NWMUDS:DecryptBeaconData]] page history)
| August 3, 2015
| [[User:Yellows8|Yellows8]]
|-
| [[HID_Services|HID]] module shared-mem
| HID module does not validate the index values in [[HID_Shared_Memory|sharedmem]](just changes index to 0 when index == maxval when updating), therefore large values will result in HID module writing HID data to arbitrary addresses.
| ROP under HID module, but this is *very* unlikely to be exploitable since the data written is HID data.
| None
| [[9.3.0-21]]
| 2014?
|
| [[User:Yellows8|Yellows8]]
|-
| gspwn
| GSP module does not validate addresses given to the GPU. This allows a user-mode application/applet to read/write to a large part of physical FCRAM using GPU DMA. From this, you can overwrite the .text segment of the application you're running under, and gain real code-execution from a ROP-chain. Normally applets' .text([[Home Menu]], [[Internet Browser]], etc) is located beyond the area accessible by the GPU, except for [[RO_Services|CROs]] used by applets([[Internet Browser]] for example).

FCRAM is gpu-accessible up to physaddr 0x26800000 on Old3DS, and 0x2DC00000 on New3DS. This is BASE_memregion_start(aka SYSTEM_memregion_end)-0x400000 with the default memory-layout on Old3DS/New3DS.
| User-mode code execution.
| None
| [[9.6.0-24|9.6.0-X]]
| Early 2014
|
| smea, [[User:Yellows8|Yellows8]]/others before then
|-
| rohax
| Using gspwn, it is possible to overwrite a loaded [[CRO0]]/[[CRR0]] after its RSA-signature has been validated. Badly validated [[CRO0]] header leads to arbitrary read/write of memory in the ro-process. This gives code-execution in the ro module, who has access to [[SVC|syscalls]] 0x70-0x72, 0x7D.

This was fixed after [[ninjhax]] release by adding checks on [[CRO0]]-based pointers before writing to them.
| Memory-mapping syscalls.
| [[9.3.0-21]]
| [[9.4.0-21]]
|
|
| smea, [[User:Plutooo|plutoo]] joint effort
|-
| Region free
| Only [[Home Menu]] itself checks gamecards' region when launching them. Therefore, any application launch that is done directly with [[NS]] without signaling Home Menu to launch the app, will result in region checks being bypassed.
This essentially means launching the gamecard with the [[NS_and_APT_Services|"ns:s"]] service. The main way to exploit this is to trigger a FIRM launch with an application specified, either with a normal FIRM launch or a hardware [[NSS:RebootSystem|reboot]].
| Launching gamecards from any region + bypassing Home Menu gamecard-sysupdate installation
| None
| Last tested with [[10.1.0-27|10.1.0-X]].
| June(?) 2014
|
| [[User:Yellows8|Yellows8]]
|-
| [[NWM_Services|NWM]] service-cmd state null-ptr deref
| The NWMUDS service command code loads a ptr from .data, adds an offset to that, then passes that as the state address for the actual command-handler function. The value of the ptr loaded from .data is not checked, therefore this will cause crashes due to that being 0x0 when NWMUDS was not properly initialized.
It's unknown whether any NWM services besides NWMUDS have this issue.
| This is rather useless since it's only a crash caused by a state ptr based at 0x0.
| None
| [[9.0.0-20]]
| 2013?
|
| [[User:Yellows8|Yellows8]]
|}

=== General/CTRSDK ===
{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in version
! Last version this flaw was checked for
! Timeframe this was discovered
! Discovered by
|-
| [[NWM_Services|UDS]] beacon additional-data buffer overflow
| Originally CTRSDK did not validate the UDS additional-data size before using that size to copy the additional-data to a [[NWM_Services|networkstruct]]. This was eventually fixed.
This was discovered while doing code RE with an old dlp-module version. It's unknown in what specific CTRSDK version this was fixed, or even what system-version updated titles with a fixed version.

It's unknown if there's any titles using a vulnerable CTRSDK version which are also exploitable with this(dlp module can't be exploited with this).

The maximum number of bytes that can be written beyond the end of the outbuf is 0x37-bytes, with additionaldata_size=0xFF.
| Perhaps ROP, very difficult if possible with anything at all
| ?
|
| September(?) 2014
| [[User:Yellows8|Yellows8]]
|}

User:H2o2x

2015-12-14T20:53:18Z

MassExplosion213:

Hey, working on DLP documentation? I may can help some. Contact me on Skype at MassExplosion213. P.S.: I am not the owner of this page, only trying to get in touch with him.

User:H2o2x

2015-12-14T20:51:38Z

MassExplosion213: Created page with "Hey, working on DLP documentation? I may can help some. Contact me on Skype at MassExplosion213."

Hey, working on DLP documentation? I may can help some. Contact me on Skype at MassExplosion213.

AES Registers

2015-11-02T21:40:51Z

MassExplosion213: Whoops. Forgot the info.

== Registers ==
{| class="wikitable" border="1"
! Old3DS
! Name
! Address
! Width
! RW
|-
| style="background: green" | Yes
| [[#AES_CNT|AES_CNT]]
| 0x10009000
| 4
| RW
|-
| style="background: green" | Yes
| [[#AES_BLKCNT|AES_BLKCNT]]
| 0x10009004
| 4
| W?
|-
| style="background: green" | Yes
| [[#AES_WRFIFO/AES_RDFIFO|AES_WRFIFO]]
| 0x10009008
| 4
| W
|-
| style="background: green" | Yes
| [[#AES_WRFIFO/AES_RDFIFO|AES_RDFIFO]]
| 0x1000900C
| 4
| R
|-
| style="background: green" | Yes
| AES_KEYSEL
| 0x10009010
| 1
| RW
|-
| style="background: green" | Yes
| [[#AES_KEYCNT|AES_KEYCNT]]
| 0x10009011
| 1
| RW
|-
| style="background: green" | Yes
| [[#AES_CTR|AES_CTR]]
| 0x10009020
| 16
| W
|-
| style="background: green" | Yes
| [[#AES_MAC|AES_MAC]]
| 0x10009030
| 16
| W
|-
| style="background: green" | Yes
| AES_KEY0
| 0x10009040
| 48
| W
|-
| style="background: green" | Yes
| AES_KEY1
| 0x10009070
| 48
| W
|-
| style="background: green" | Yes
| AES_KEY2
| 0x100090A0
| 48
| W
|-
| style="background: green" | Yes
| AES_KEY3
| 0x100090D0
| 48
| W
|-
| style="background: green" | Yes
| AES_KEYFIFO
| 0x10009100
| 4
| W
|-
| style="background: green" | Yes
| AES_KEYXFIFO
| 0x10009104
| 4
| W
|-
| style="background: green" | Yes
| AES_KEYYFIFO
| 0x10009108
| 4
| W
|}

== AES_CNT ==
{| class="wikitable" border="1"
! Bit
! Description
|-
| 4-0
| Write FIFO count (0-16)
|-
| 9-5
| Read FIFO count (0-16)
|-
| 10
| Flush write FIFO (1=Clear write FIFO)
|-
| 11
| Flush read fifo (1=Clear read FIFO)
|-
| 18-16
| MAC size (encoding = (maclen-2)/2)
|-
| 19
|? (MAC related)
|-
| 20
| MAC input control (0 = read MAC from FIFO, 1 = read from MAC register)
|-
| 21
| MAC status (0 = invalid, 1 = verified)
|-
| 22
| Output endianness (1=Big endian, 0=Little endian)
|-
| 23
| Input endianness (1=Big endian, 0=Little endian)
|-
| 24
| Output word order (1=Normal order, 0=Reversed order)
|-
| 25
| Input word order (1=Normal order, 0=Reversed order)
|-
|-
| 26
| Update keyslot (selects the keyslot specified by REG_AESKEYSEL when this bit is set)
|-
| 29-27
| Mode (0=CCM decrypt, 1=CCM encrypt, 2=CTR, 3=CTR, 4=CBC decrypt, 5=CBC encrypt, 6=ECB decrypt, 7=ECB encrypt)
|-
| 30
| Interrupt enable (1=enable, 0=disable)
|-
| 31
| Start (1=enable/busy, 0=idle)
|}

When bit31 is clear, the AES engine will handle keyslot-selection when bit26 is set immediately. When bit31 is set, the AES engine won't handle bit26 immediately, instead the AES engine will automatically handle the already-set bit26 once bit31 clears(current AES operation finishes).

Clearing bit31 while the AES engine is doing crypto will result in the AES engine stopping crypto, once it finishes processing the current block.

== AES_BLKCNT ==

{| class="wikitable" border="1"
! Bit
! Description
|-
| 16-31
| (Data length)>>4
|}

== AES_WRFIFO/AES_RDFIFO ==
Up to 128 bytes of input data can be buffered.

The input data for the AES crypto operation is written to REG_AESWRFIFO, the output data is read from REG_AESRDFIFO.

Reading from REG_AESRDFIFO when there's no data available in the RDFIFO will result in reading the last word that was in the RDFIFO.

== AES_KEYCNT ==
{| class="wikitable" border="1"
! Bit
! Description
|-
| 5-0
| Keyslot
|-
| 6
| Hardware key-generator type: 0 = 3DS, 1 = DSi.
|-
| 7
| This normally has value 1 written here when updating keys. 0 = disable key FIFO flush, 1 = enable key FIFO flush.
|}

Bit6 is only used when keyslots >=4 are used, value1 has the same affect as doing key-init with the TWL keyslots. Bit6 is only checked when a keyY was completely written, for when the final-normalkey needs updated via the key-generator. Changing bit6 has no affect on the generated normalkey when writing to this bit immediately after writing the last keyY word.

== AES_CTR ==
This register specifies the counter (CTR mode), nonce (CCM mode) or the initialization vector (CBC mode) depending on the mode of operation.
For CBC and CTR mode this register takes up the full 16 bytes, but for CCM mode the nonce is only the first 12 bytes.
The AES engine will automatically increment the counter up to the maximum BLKCNT, after which point it must be manually incremented and set again.

== AES_MAC ==
This register specifies the message authentication code (MAC) for use in CCM mode.

== AES_KEY0/1/2/3 ==
{| class="wikitable" border="1"
! Byte
! Description
|-
| 0-15
| Normalkey
|-
| 16-31
| KeyX
|-
| 32-47
| KeyY
|-}

These registers are the same as they were on TWL, and are likely preserved for compatibility reasons. The keyslot is updated immediately after *any* data(u8/u32/...) is written here, which was used on DSi to [[3DS_System_Flaws|break]] the key-generator.

== Endianness and word order ==
When writing to the AES_CTR or AES_MAC register, the hardware will process the written data according to the current input endianness specified in AES_CNT. However, the current specified input word order will not be honored for this register, and always defaults to reversed word order. Therefore, for normal word order, the reversal must be carried out manually if required.

== Keyslot ranges ==
This is approximately a table of what is set by bootrom before booting into FIRM. Often it appears that keyslots in groups of 4 have the same keyX, and sometimes also same keyY set.

{| class="wikitable" border="1"
! Keyslot
! Name
! KeyX
! KeyY/Normal-key
! Console unique.
|-
| 0x00-0x03
| TWL keys.
| Probably unset.
| Probably unset.
| -
|-
| 0x04-0x07
| NAND partition keys.
| Same for all.
| Different for all.
| style="background: green" | Yes
|-
| 0x08-0x0B
| See below.
| Same for all.
| Different for all.
| style="background: green" | Yes
|-
| 0x0C-0x0F
| SSL cert key.
| Same for all.
| Same for all.
| style="background: red" | No
|-
| 0x10-0x17
| -
| Not set.
| Not set.
| -
|-
| 0x18-0x1B
| Never used.
| Same for all.
| Same for all.
| style="background: green" | Yes
|-
| 0x1C-0x1F
| Never used.
| Same for all.
| Same for all.
| style="background: green" | Yes
|-
| 0x20-0x23
| Never used.
| Same for all.
| Same for all.
| style="background: orange" | Normalkey is not. keyX is. keyY unknown.
|-
| 0x24
| Never used.
| Individually set.
| Individually set.
| style="background: orange" | Normalkey is not. keyX is. keyY unknown.
|-
| 0x25-0x27
| -
| Not set.
| Not set.
| -
|-
| 0x28-0x2B
| Never used.
| Individually set.
| Individually set.
| style="background: orange" | Normalkey is not. keyX is. keyY unknown.
|-
| 0x2C-0x2F
| Various uniques.
| Same for all.
| Same for all, probably.
| style="background: red" | No
|-
| 0x30-0x33
| Various uniques.
| Same for all.
| Same for all, probably.
| style="background: red" | No
|-
| 0x34-0x37
| Various uniques.
| Same for all.
| Same for all, probably.
| style="background: red" | No
|-
| 0x38-0x3B
| Various uniques.
| Same for all.
| Different for all.
| style="background: red" | No
|-
| 0x3C-0x3F
| Various uniques.
| Individually set.
| Individually set.
| style="background: red" | No
|}

Keyslot pairs (0x24, 0x28) and (0x38, 0x3C) shares the same normal-key, while at the same time having different keyX's. This suggests they were set to same normal-key by bootrom.

== Keyslots ==
There are 0x40 keyslots, each of which stores three keys called keyX, keyY and normalkey. All keys can be set explicitly, but the normalkey can optionally be generated using a hardware key generator instead (see [[#Hardware_key_generator|below]]). There is no way to read the contents of a keyslot.

{| class="wikitable" border="1"
! Keyslot
! Description
! KeyX set by
! KeyY set by
! Normal-key
! Old3DS
|-
| 0x00-0x03
| TWL keys.
| NATIVE_FIRM hard-boot.
| NATIVE_FIRM hard-boot.
| -
| Yes
|-
| 0x04..0x07
| [[Flash_Filesystem|NAND]] partition keys.

Keyslot is determined by [[NCSD]] partition FS type and encryption type.
The New3DS Process9 sets the keyY for keyslot 0x05 (New3DS CTRNAND) to a key from .(ro)data. Its keyX is console-unique and set by the bootloader.
| Bootrom.
| Bootrom.
| -
| Yes
|-
| 0x0A
| DSiWare export key.

Used for encrypting the all-zero 0x10-byte block in the [[DSiWare_Exports|DSiWare_Exports]] header. Console-unique.
| See above keyslot info.
| See above keyslot info.
| -
| Yes
|-
| 0x0B
| This is console-unique. This keyslot is used for the NAND [[Title_Database|dbs]] images AESMACs, and the [[Nand/private/movable.sed]] AESMAC(when used).
| See above keyslot info.
| See above keyslot info.
| -
| Yes
|-
| 0x0D
| SSL-certificate key.

See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].
| -
| -
| Bootrom.
| Yes
|-
| 0x11
| Temporary keyslot.

Used by FIRM for general normal-key crypto. Also used by the New3DS [[FIRM]] arm9 binary loader.
| Arm9Loader.
| Arm9Loader.
| NATIVE_FIRM.
| Yes
|-
| 0x14
| Starting with [[5.0.0-11]], NATIVE_FIRM Process9 now sets the keyY for this to the same one it uses for initializing 3 of the keyslots' keyYs from [[PSPXI:EncryptDecryptAes|here]].
| Bootrom.
| NATIVE_FIRM boot.
| -
| Yes
|-
| 0x15
| Used/initialized by the New3DS arm9 binary loader, see [[FIRM|here]].
| Arm9Loader.
| Arm9Loader.
| See previous info for this keyslot.
| No
|-
| 0x16
| Used/initialized by the New3DS arm9 binary loader starting with [[9.5.0-22|9.5.0-X]], see [[FIRM|here]].
| Arm9Loader.
| Arm9Loader.
| See previous info for this keyslot.
| No
|-
| 0x18..0x1F
| These are the New3DS keyslots, where the keyX is generated with keyslot 0x11 by the New3DS arm9 binary [[FIRM|loader]]. As of [[FIRM]] [[9.6.0-24|9.6.0-X]] keyslots 0x1C..0x1F are not yet used by Process9.
| Arm9Loader.
| NATIVE_FIRM / see previous info for these keyslots.
| See previous info for these keyslots.
| No
|-
| 0x18
| New3DS [[9.3.0-21|9.3.0-X]] [[NCCH]] key, when ncchflag[3] is 0x0A.
| Arm9Loader.
| NATIVE_FIRM
| -
| No
|-
| 0x19
| New3DS gamecard [[Savegames|savedata]] AES-MAC key.

Equivalent of keyslot 0x33, used when a [[NCSD]] flag is set to a certain value (implemented with [[9.3.0-21|9.3.0-X]]).
| Arm9Loader.
| NATIVE_FIRM
| -
| No
|-
| 0x1A
| New3DS gamecard [[Savegames|savedata]] actual key.

Equivalent of keyslot 0x37, used when a [[NCSD]] flag is set to a certain value (implemented with [[9.3.0-21|9.3.0-X]]).
| Arm9Loader.
| NATIVE_FIRM
| -
| No
|-
| 0x1B
| New3DS [[9.6.0-24|9.6.0-X]] [[NCCH]] key, when ncchflag[3] is 0x0B.
| Arm9Loader.
| NATIVE_FIRM
| -
| No
|-
| 0x24
| AGB_FIRM savegame AES-MAC key.
| Bootrom.
| AGB/NATIVE_FIRM.
| -
| Yes
|-
| 0x25
| [[7.0.0-13|v7.0]] [[NCCH]] key, when ncchflag[3] is 0x01.
| NATIVE_FIRM [[Savegames#6.0.0-11_Savegame_keyY|boot]].
| NATIVE_FIRM.
| -
| Yes
|-
| 0x2C
| Original [[NCCH|NCCH]] key, when ncchflag[3] is 0x00 and always for certain NCCH sections.
| Bootrom.
| Process9.
| -
| Yes
|-
| 0x2D
| UDS local-WLAN CCMP key.

See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].
| Bootrom.
| Bootrom.
| -
| Yes
|-
| 0x2E
| Streetpass key.

See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x2F
| [[Savegames#6.0.0-11_Savegame_keyY|v6.0]] save key.
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x30
| SD/NAND AES-MAC key.

This keyY is initialized via [[Nand/private/movable.sed|movable.sed]]. This is used for calculating the AESMACs under SD [[SD_Filesystem|/Nintendo 3DS/<ID0>/<ID1>/]] (except [[DSiWare_Exports]]) and [[Flash_Filesystem|NAND]] /data/.
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x31
| APT wrap key.

See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]]. NATIVE_FIRM sets this keyY to the same one used for keyslot 0x2E.
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x32
| Unknown.

See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].
| Bootrom.
| Bootrom.
| -
| Yes
|-
| 0x33
| Gamecard [[Savegames|savedata]] AES-MAC.
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x34
| SD key.

This keyY is initialized via [[Nand/private/movable.sed|movable.sed]]. This is used for encrypting *all* SD card data under [[SD_Filesystem|/Nintendo 3DS/<ID0>/<ID1>/]].
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x35
| Movable.sed key.

This is the keyslot used for movable.sed encryption + AES-MAC with the import/export [[FSPXI:ImportIntegrityVerificationSeed|commands]].
| Bootrom.
| Bootrom.
| -
| Yes
|-
| 0x36
| Unknown. Used by friends module.

See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].
| Bootrom.
| Bootrom.
| -
| Yes
|-
| 0x37
| Gamecard [[Savegames|savedata]] actual key.
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x38
| BOSS key.

See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].
| Bootrom.
| Bootrom.
| -
| Yes
|-
| 0x39
| Download Play key, and the actual NFC key for generating retail [[Amiibo]] keys.

This keyslot is used for two different keys. Both are available via [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]]. NATIVE_FIRM sets this keyY to the same one used for keyslot 0x2E.
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x3A
| DSiWare export key.

This keyY is initialized via [[Nand/private/movable.sed|movable.sed]]. This is used for calculating the AESMACs for SD [[DSiWare_Exports]].
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x3B
| [[CTRCARD_Registers#CTRCARD_SECSEED|CTR-CARD hardware-crypto seed]] decryption key.

AES-CCM is used, the keyY, nonce and MAC are stored in the [[NCSD#Card_Info_Header|Card Info Header]].
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x3D
| Common key.

Used to decrypt title keys in [[Ticket]].
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|}

=== Updating keydata ===
The contents of the keyslot specified in REG_AESKEYCNT can be updated by consecutively writing four words to REG_AESKEYXFIFO (keyX), REG_AESKEYYFIFO(keyY), or REG_AESKEYFIFO (normalkey).

After writing to a keyslot, the keyslot must be selected again(write REG_AESKEYSEL + set REG_AESCNT bit26), even when writing to the same keyslot. Writing the last word to a key FIFO immediately after selecting a keyslot will not affect the keyslot keydata that gets used at that time, the new keydata will not get used until the keyslot gets selected again.

Writing to the key FIFOs with byte writes results in the AES engine converting the byte to a word for setting the key word, with this: word = (byteval) | (byteval<<8) | (byteval<<16) | (byteval<<24). The result is the same regardless of which FIFO register byte was written to.

The TWL keyslots 0x00-0x03 can be set directly by writing to the REG_AESKEY0-REG_AESKEY3 registers.

The key FIFOs can be written simultaneously. For example, executing the following 4 times will result in the keyX and keyY being set to all-zero(unknown for normalkey): memset(0x10009100, 0, 0x100);

Each key FIFO has a 0x10-byte tmp-buffer for storing the words written to that FIFO. Once the last word is written to a key FIFO, the filled tmp-buffer is then written to the key-data for the keyslot selected by REG_AESKEYCNT at the time the last word was written.

=== Hardware key generator ===
A dedicated hardware key generator can be used to generate a keyslot's normalkey from its keyX and keyY. The hardware key generator is triggered by writing the keyY, which is the only way to trigger it with the 3DS keyslots. The algorithm used for key generation is unknown.

Unless noted otherwise, all keyslots on retail units use the hardware key-generator.

=== FIRM-launch key clearing ===
Starting with [[9.0.0-20]] the Process9 FIRM-launch code now "clears" the following AES keyslots, with certain keydata by writing the normal-key: 0x15 and 0x18-0x20. These are the keyslots used by the New3DS [[FIRM]] arm9bin loader(minus keyslot 0x11), the New3DS Process9 does this too.

AES Registers

2015-11-02T21:40:07Z

MassExplosion213: Fixing a table.

== Registers ==
{| class="wikitable" border="1"
! Old3DS
! Name
! Address
! Width
! RW
|-
| style="background: green" | Yes
| [[#AES_CNT|AES_CNT]]
| 0x10009000
| 4
| RW
|-
| style="background: green" | Yes
| [[#AES_BLKCNT|AES_BLKCNT]]
| 0x10009004
| 4
| W?
|-
| style="background: green" | Yes
| [[#AES_WRFIFO/AES_RDFIFO|AES_WRFIFO]]
| 0x10009008
| 4
| W
|-
| style="background: green" | Yes
| [[#AES_WRFIFO/AES_RDFIFO|AES_RDFIFO]]
| 0x1000900C
| 4
| R
|-
| style="background: green" | Yes
| AES_KEYSEL
| 0x10009010
| 1
| RW
|-
| style="background: green" | Yes
| [[#AES_KEYCNT|AES_KEYCNT]]
| 0x10009011
| 1
| RW
|-
| style="background: green" | Yes
| [[#AES_CTR|AES_CTR]]
| 0x10009020
| 16
| W
|-
| style="background: green" | Yes
| [[#AES_MAC|AES_MAC]]
| 0x10009030
| 16
| W
|-
| style="background: green" | Yes
| AES_KEY0
| 0x10009040
| 48
| W
|-
| style="background: green" | Yes
| AES_KEY1
| 0x10009070
| 48
| W
|-
| style="background: green" | Yes
| AES_KEY2
| 0x100090A0
| 48
| W
|-
| style="background: green" | Yes
| AES_KEY3
| 0x100090D0
| 48
| W
|-
| style="background: green" | Yes
| AES_KEYFIFO
| 0x10009100
| 4
| W
|-
| style="background: green" | Yes
| AES_KEYXFIFO
| 0x10009104
| 4
| W
|-
| style="background: green" | Yes
| AES_KEYYFIFO
| 0x10009108
| 4
| W
|}

== AES_CNT ==
{| class="wikitable" border="1"
! Bit
! Description
|-
| 4-0
| Write FIFO count (0-16)
|-
| 9-5
| Read FIFO count (0-16)
|-
| 10
| Flush write FIFO (1=Clear write FIFO)
|-
| 11
| Flush read fifo (1=Clear read FIFO)
|-
| 18-16
| MAC size (encoding = (maclen-2)/2)
|-
| 19
|? (MAC related)
|-
| 20
| MAC input control (0 = read MAC from FIFO, 1 = read from MAC register)
|-
| 21
| MAC status (0 = invalid, 1 = verified)
|-
| 22
| Output endianness (1=Big endian, 0=Little endian)
|-
| 23
| Input endianness (1=Big endian, 0=Little endian)
|-
| 24
| Output word order (1=Normal order, 0=Reversed order)
|-
| 25
| Input word order (1=Normal order, 0=Reversed order)
|-
|-
| 26
| Update keyslot (selects the keyslot specified by REG_AESKEYSEL when this bit is set)
|-
| 29-27
| Mode (0=CCM decrypt, 1=CCM encrypt, 2=CTR, 3=CTR, 4=CBC decrypt, 5=CBC encrypt, 6=ECB decrypt, 7=ECB encrypt)
|-
| 30
| Interrupt enable (1=enable, 0=disable)
|-
| 31
| Start (1=enable/busy, 0=idle)
|}

When bit31 is clear, the AES engine will handle keyslot-selection when bit26 is set immediately. When bit31 is set, the AES engine won't handle bit26 immediately, instead the AES engine will automatically handle the already-set bit26 once bit31 clears(current AES operation finishes).

Clearing bit31 while the AES engine is doing crypto will result in the AES engine stopping crypto, once it finishes processing the current block.

== AES_BLKCNT ==

{| class="wikitable" border="1"
! Bit
! Description
|-
| 16-31
| (Data length)>>4
|}

== AES_WRFIFO/AES_RDFIFO ==
Up to 128 bytes of input data can be buffered.

The input data for the AES crypto operation is written to REG_AESWRFIFO, the output data is read from REG_AESRDFIFO.

Reading from REG_AESRDFIFO when there's no data available in the RDFIFO will result in reading the last word that was in the RDFIFO.

== AES_KEYCNT ==
{| class="wikitable" border="1"
! Bit
! Description
|-
| 5-0
| Keyslot
|-
| 6
| Hardware key-generator type: 0 = 3DS, 1 = DSi.
|-
| 7
| This normally has value 1 written here when updating keys. 0 = disable key FIFO flush, 1 = enable key FIFO flush.
|}

Bit6 is only used when keyslots >=4 are used, value1 has the same affect as doing key-init with the TWL keyslots. Bit6 is only checked when a keyY was completely written, for when the final-normalkey needs updated via the key-generator. Changing bit6 has no affect on the generated normalkey when writing to this bit immediately after writing the last keyY word.

== AES_CTR ==
This register specifies the counter (CTR mode), nonce (CCM mode) or the initialization vector (CBC mode) depending on the mode of operation.
For CBC and CTR mode this register takes up the full 16 bytes, but for CCM mode the nonce is only the first 12 bytes.
The AES engine will automatically increment the counter up to the maximum BLKCNT, after which point it must be manually incremented and set again.

== AES_MAC ==
This register specifies the message authentication code (MAC) for use in CCM mode.

== AES_KEY0/1/2/3 ==
{| class="wikitable" border="1"
! Byte
! Description
|-
| 0-15
| Normalkey
|-
| 16-31
| KeyX
|-
| 32-47
| KeyY
|-}

These registers are the same as they were on TWL, and are likely preserved for compatibility reasons. The keyslot is updated immediately after *any* data(u8/u32/...) is written here, which was used on DSi to [[3DS_System_Flaws|break]] the key-generator.

== Endianness and word order ==
When writing to the AES_CTR or AES_MAC register, the hardware will process the written data according to the current input endianness specified in AES_CNT. However, the current specified input word order will not be honored for this register, and always defaults to reversed word order. Therefore, for normal word order, the reversal must be carried out manually if required.

== Keyslot ranges ==
This is approximately a table of what is set by bootrom before booting into FIRM. Often it appears that keyslots in groups of 4 have the same keyX, and sometimes also same keyY set.

{| class="wikitable" border="1"
! Keyslot
! Name
! KeyX
! KeyY/Normal-key
! Console unique.
|-
| 0x00-0x03
| TWL keys.
| Probably unset.
| Probably unset.
| -
|-
| 0x04-0x07
| NAND partition keys.
| Same for all.
| Different for all.
| style="background: green" | Yes
|-
| 0x08-0x0B
| See below.
| Same for all.
| Different for all.
| style="background: green" | Yes
|-
| 0x0C-0x0F
| SSL cert key.
| Same for all.
| Same for all.
| style="background: red" | No
|-
| 0x10-0x17
| -
| Not set.
| Not set.
| -
|-
| 0x18-0x1B
| Never used.
| Same for all.
| Same for all.
| style="background: green" | Yes
|-
| 0x1C-0x1F
| Never used.
| Same for all.
| Same for all.
| style="background: green" | Yes
|-
| 0x20-0x23
| Never used.
| Same for all.
| Same for all.
| style="background: orange" | Normalkey is not. keyX is. keyY unknown.
|-
| 0x24
| Never used.
| Individually set.
| Individually set.
| style="background: orange" | Normalkey is not. keyX is. keyY unknown.
|-
| 0x25-0x27
| -
| Not set.
| Not set.
| -
|-
| 0x28-0x2B
| Never used.
| Individually set.
| Individually set.
| style="background: orange" | Normalkey is not. keyX is. keyY unknown.
|-
| 0x2C-0x2F
| Various uniques.
| Same for all.
| Same for all, probably.
| style="background: red" | No
|-
| 0x30-0x33
| Various uniques.
| Same for all.
| Same for all, probably.
| style="background: red" | No
|-
| 0x34-0x37
| Various uniques.
| Same for all.
| Same for all, probably.
| style="background: red" | No
|-
| 0x38-0x3B
| Various uniques.
| Same for all.
| Different for all.
| style="background: red" | No
|-
| 0x3C-0x3F
| Various uniques.
| Individually set.
| Individually set.
| style="background: red" | No
|}

Keyslot pairs (0x24, 0x28) and (0x38, 0x3C) shares the same normal-key, while at the same time having different keyX's. This suggests they were set to same normal-key by bootrom.

== Keyslots ==
There are 0x40 keyslots, each of which stores three keys called keyX, keyY and normalkey. All keys can be set explicitly, but the normalkey can optionally be generated using a hardware key generator instead (see [[#Hardware_key_generator|below]]). There is no way to read the contents of a keyslot.

{| class="wikitable" border="1"
! Keyslot
! Description
! KeyX set by
! KeyY set by
! Normal-key
! Old3DS
|-
| 0x00-0x03
| TWL keys.
| NATIVE_FIRM hard-boot.
| NATIVE_FIRM hard-boot.
| -
| Yes
|-
| 0x04..0x07
| [[Flash_Filesystem|NAND]] partition keys.

Keyslot is determined by [[NCSD]] partition FS type and encryption type.
The New3DS Process9 sets the keyY for keyslot 0x05 (New3DS CTRNAND) to a key from .(ro)data. Its keyX is console-unique and set by the bootloader.
| Bootrom.
| Bootrom.
| -
| Yes
|-
| 0x0A
| DSiWare export key.

Used for encrypting the all-zero 0x10-byte block in the [[DSiWare_Exports|DSiWare_Exports]] header. Console-unique.
| See above keyslot info.
| See above keyslot info.
|
|
|-
| 0x0B
| This is console-unique. This keyslot is used for the NAND [[Title_Database|dbs]] images AESMACs, and the [[Nand/private/movable.sed]] AESMAC(when used).
| See above keyslot info.
| See above keyslot info.
| -
| Yes
|-
| 0x0D
| SSL-certificate key.

See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].
| -
| -
| Bootrom.
| Yes
|-
| 0x11
| Temporary keyslot.

Used by FIRM for general normal-key crypto. Also used by the New3DS [[FIRM]] arm9 binary loader.
| Arm9Loader.
| Arm9Loader.
| NATIVE_FIRM.
| Yes
|-
| 0x14
| Starting with [[5.0.0-11]], NATIVE_FIRM Process9 now sets the keyY for this to the same one it uses for initializing 3 of the keyslots' keyYs from [[PSPXI:EncryptDecryptAes|here]].
| Bootrom.
| NATIVE_FIRM boot.
| -
| Yes
|-
| 0x15
| Used/initialized by the New3DS arm9 binary loader, see [[FIRM|here]].
| Arm9Loader.
| Arm9Loader.
| See previous info for this keyslot.
| No
|-
| 0x16
| Used/initialized by the New3DS arm9 binary loader starting with [[9.5.0-22|9.5.0-X]], see [[FIRM|here]].
| Arm9Loader.
| Arm9Loader.
| See previous info for this keyslot.
| No
|-
| 0x18..0x1F
| These are the New3DS keyslots, where the keyX is generated with keyslot 0x11 by the New3DS arm9 binary [[FIRM|loader]]. As of [[FIRM]] [[9.6.0-24|9.6.0-X]] keyslots 0x1C..0x1F are not yet used by Process9.
| Arm9Loader.
| NATIVE_FIRM / see previous info for these keyslots.
| See previous info for these keyslots.
| No
|-
| 0x18
| New3DS [[9.3.0-21|9.3.0-X]] [[NCCH]] key, when ncchflag[3] is 0x0A.
| Arm9Loader.
| NATIVE_FIRM
| -
| No
|-
| 0x19
| New3DS gamecard [[Savegames|savedata]] AES-MAC key.

Equivalent of keyslot 0x33, used when a [[NCSD]] flag is set to a certain value (implemented with [[9.3.0-21|9.3.0-X]]).
| Arm9Loader.
| NATIVE_FIRM
| -
| No
|-
| 0x1A
| New3DS gamecard [[Savegames|savedata]] actual key.

Equivalent of keyslot 0x37, used when a [[NCSD]] flag is set to a certain value (implemented with [[9.3.0-21|9.3.0-X]]).
| Arm9Loader.
| NATIVE_FIRM
| -
| No
|-
| 0x1B
| New3DS [[9.6.0-24|9.6.0-X]] [[NCCH]] key, when ncchflag[3] is 0x0B.
| Arm9Loader.
| NATIVE_FIRM
| -
| No
|-
| 0x24
| AGB_FIRM savegame AES-MAC key.
| Bootrom.
| AGB/NATIVE_FIRM.
| -
| Yes
|-
| 0x25
| [[7.0.0-13|v7.0]] [[NCCH]] key, when ncchflag[3] is 0x01.
| NATIVE_FIRM [[Savegames#6.0.0-11_Savegame_keyY|boot]].
| NATIVE_FIRM.
| -
| Yes
|-
| 0x2C
| Original [[NCCH|NCCH]] key, when ncchflag[3] is 0x00 and always for certain NCCH sections.
| Bootrom.
| Process9.
| -
| Yes
|-
| 0x2D
| UDS local-WLAN CCMP key.

See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].
| Bootrom.
| Bootrom.
| -
| Yes
|-
| 0x2E
| Streetpass key.

See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x2F
| [[Savegames#6.0.0-11_Savegame_keyY|v6.0]] save key.
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x30
| SD/NAND AES-MAC key.

This keyY is initialized via [[Nand/private/movable.sed|movable.sed]]. This is used for calculating the AESMACs under SD [[SD_Filesystem|/Nintendo 3DS/<ID0>/<ID1>/]] (except [[DSiWare_Exports]]) and [[Flash_Filesystem|NAND]] /data/.
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x31
| APT wrap key.

See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]]. NATIVE_FIRM sets this keyY to the same one used for keyslot 0x2E.
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x32
| Unknown.

See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].
| Bootrom.
| Bootrom.
| -
| Yes
|-
| 0x33
| Gamecard [[Savegames|savedata]] AES-MAC.
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x34
| SD key.

This keyY is initialized via [[Nand/private/movable.sed|movable.sed]]. This is used for encrypting *all* SD card data under [[SD_Filesystem|/Nintendo 3DS/<ID0>/<ID1>/]].
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x35
| Movable.sed key.

This is the keyslot used for movable.sed encryption + AES-MAC with the import/export [[FSPXI:ImportIntegrityVerificationSeed|commands]].
| Bootrom.
| Bootrom.
| -
| Yes
|-
| 0x36
| Unknown. Used by friends module.

See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].
| Bootrom.
| Bootrom.
| -
| Yes
|-
| 0x37
| Gamecard [[Savegames|savedata]] actual key.
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x38
| BOSS key.

See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].
| Bootrom.
| Bootrom.
| -
| Yes
|-
| 0x39
| Download Play key, and the actual NFC key for generating retail [[Amiibo]] keys.

This keyslot is used for two different keys. Both are available via [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]]. NATIVE_FIRM sets this keyY to the same one used for keyslot 0x2E.
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x3A
| DSiWare export key.

This keyY is initialized via [[Nand/private/movable.sed|movable.sed]]. This is used for calculating the AESMACs for SD [[DSiWare_Exports]].
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x3B
| [[CTRCARD_Registers#CTRCARD_SECSEED|CTR-CARD hardware-crypto seed]] decryption key.

AES-CCM is used, the keyY, nonce and MAC are stored in the [[NCSD#Card_Info_Header|Card Info Header]].
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x3D
| Common key.

Used to decrypt title keys in [[Ticket]].
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|}

=== Updating keydata ===
The contents of the keyslot specified in REG_AESKEYCNT can be updated by consecutively writing four words to REG_AESKEYXFIFO (keyX), REG_AESKEYYFIFO(keyY), or REG_AESKEYFIFO (normalkey).

After writing to a keyslot, the keyslot must be selected again(write REG_AESKEYSEL + set REG_AESCNT bit26), even when writing to the same keyslot. Writing the last word to a key FIFO immediately after selecting a keyslot will not affect the keyslot keydata that gets used at that time, the new keydata will not get used until the keyslot gets selected again.

Writing to the key FIFOs with byte writes results in the AES engine converting the byte to a word for setting the key word, with this: word = (byteval) | (byteval<<8) | (byteval<<16) | (byteval<<24). The result is the same regardless of which FIFO register byte was written to.

The TWL keyslots 0x00-0x03 can be set directly by writing to the REG_AESKEY0-REG_AESKEY3 registers.

The key FIFOs can be written simultaneously. For example, executing the following 4 times will result in the keyX and keyY being set to all-zero(unknown for normalkey): memset(0x10009100, 0, 0x100);

Each key FIFO has a 0x10-byte tmp-buffer for storing the words written to that FIFO. Once the last word is written to a key FIFO, the filled tmp-buffer is then written to the key-data for the keyslot selected by REG_AESKEYCNT at the time the last word was written.

=== Hardware key generator ===
A dedicated hardware key generator can be used to generate a keyslot's normalkey from its keyX and keyY. The hardware key generator is triggered by writing the keyY, which is the only way to trigger it with the 3DS keyslots. The algorithm used for key generation is unknown.

Unless noted otherwise, all keyslots on retail units use the hardware key-generator.

=== FIRM-launch key clearing ===
Starting with [[9.0.0-20]] the Process9 FIRM-launch code now "clears" the following AES keyslots, with certain keydata by writing the normal-key: 0x15 and 0x18-0x20. These are the keyslots used by the New3DS [[FIRM]] arm9bin loader(minus keyslot 0x11), the New3DS Process9 does this too.

Title list/DLC

2015-11-02T16:57:29Z

MassExplosion213: /* List */

[[Title list|Go Back to Title list]]

== Overview ==
These are titles which provide downloadable content to a specific title. The reason why these titles can only be purchased in game, is because all DLC content is under a set of title(s), downloading via the eShop would download all DLC content. And because all DLC content is under a set of title(s), they are viewed as one(?) title in system settings, and individual DLC can only be deleted from within the game which uses the DLC.

The titleID-low for DLC is: ((uniqueID<<8) | DLC_title_index). DLC_title_index starts at zero. Each DLC item is grouped under a DLC_title_index. Usually an application only has one DLC_title_index, but for applications which have a *lot* of DLC there's more than one DLC_title_index(JPN Home Menu for themes for example).

== List ==
{| class="wikitable" border="1"
|-
! TitleID Low
! Region
! Description
! Versions
|-
| 00008800
| JPN
| [[New 3DS]] [[Internet Browser]] DLC, used for disabling the web filter.
| v0
|-
| 0015D800
| USA
| IronFall Invasion [DLC]
| Unknown
|-
| 00022800
| EUR
| StreetPass Mii Plaza [DLC]
| v5
|-
| 00068300
| ?
| ?
| v0, v256
|-
| 00072000
| ?
| ?
| v0, v128
|-
| 00072A00
| ?
| ?
| v0
|-
| 00078200
| ?
| ?
| v0, v64
|-
| 0007AD00
| JPN
| New SUPER MARIO BROS. 2 [DLC]
| v16, v48
|-
| 0007AE00
| USA
| New SUPER MARIO BROS. 2 [DLC]
| v16, v48
|-
| 0007AF00
| EUR
| New SUPER MARIO BROS. 2 [DLC]
| v0, v48
|-
| 00084F00
| ?
| ?
| v0, v80
|-
| 0008CC00
| ?
| ?
| v0, v16
|-
| 00090E00
| ?
| ?
| v0
|-
| 00091600
| ?
| ?
| v0, v16
|-
| 00095100
| ?
| ?
| v0, v16
|-
| 00095700
| ?
| ?
| v0, v96
|-
| 00095800
| ?
| ?
| v0, v32, v48
|-
| 0009AB00
| ?
| ?
| v0
|-
| 0009AC00
| ?
| ?
| v0
|-
| 0009AD00
| ?
| ?
| v0
|-
| 0009AE00
| ?
| ?
| v0
|-
| 000A4D00
| ?
| ?
| v0
|}

Anti Savegame Restore

2015-10-04T17:20:28Z

MassExplosion213: Fixed typo. Sorry for double edit.

=Summary=
Anti Savegame Restore (internally referred to as ''Save Data Rollback Prevention'') is a feature originally implemented in [[Filesystem_services|FS]] module with [[4.0.0-7]], which prevents the user from restoring previous versions of a savegame image. This feature is not used for gamecard games. When an old version of the save is detected, the application will display an error regarding old savegame version, then delete+recreate the save(similar to when the savegame is corrupted).

=Implementation=
When creating the SD savedata, the application generates a random u64 value, then stores it in an arbitary savefile in the savegame FS. The application then uses the anti-savegame-restore [[Filesystem_services|FS]] commands to verify the stored u64(with the u64 loaded by FS module), and to update the u64 used by FS module. The u64 used by FS module is stored in the FS module [[System_SaveData]].

Each time the application writes to the savegame, the u64 value stored in the savefile should be updated(and the command for updating the NAND u64 value should be used as well). Usually applications update this value by incrementing it, however generating a new random-number or other methods of updating it can be used as well.

=Applications using this feature=
* Animal Crossing: New Leaf
* Pokemon X & Y
* Pokemon Omega ruby & Alpha Sapphire
* Pokemon ORAS Demo
* Pokemon Shuffle
* Super Smash Bros

Anti Savegame Restore

2015-10-04T17:20:01Z

MassExplosion213: ORAS Demo is e-shop only.

=Summary=
Anti Savegame Restore (internally referred to as ''Save Data Rollback Prevention'') is a feature originally implemented in [[Filesystem_services|FS]] module with [[4.0.0-7]], which prevents the user from restoring previous versions of a savegame image. This feature is not used for gamecard games. When an old version of the save is detected, the application will display an error regarding old savegame version, then delete+recreate the save(similar to when the savegame is corrupted).

=Implementation=
When creating the SD savedata, the application generates a random u64 value, then stores it in an arbitary savefile in the savegame FS. The application then uses the anti-savegame-restore [[Filesystem_services|FS]] commands to verify the stored u64(with the u64 loaded by FS module), and to update the u64 used by FS module. The u64 used by FS module is stored in the FS module [[System_SaveData]].

Each time the application writes to the savegame, the u64 value stored in the savefile should be updated(and the command for updating the NAND u64 value should be used as well). Usually applications update this value by incrementing it, however generating a new random-number or other methods of updating it can be used as well.

=Applications using this feature=
* Animal Crossing: New Leaf
* Pokemon X & Y
* Pokemon Omega ruby & Alpha Saphire
* Pokemon ORAS Demo
* Pokemon Shuffle
* Super Smash Bros

FirmwareNews

2015-09-09T20:34:01Z

MassExplosion213: Fixing an ironhax misconception. Feel free to change back.

Original [[ninjhax]]: From '''4.0.0-X''' up to and including '''9.2.0-X''', when '''X''' is between 7 and 20.

[[ninjhax|ninjhax2]], [[tubehax]]: From '''9.0.0-X''' up to and including '''10.0.0-X''', for '''X''' up to and including '''27'''.

[[ironhax]]: From '''9.5.0-X''' up to and including '''10.0.0-X''', for '''X''' up to and including '''27'''.

For more detailed info, see the [[Homebrew_Exploits|Homebrew Exploits]] page.

----

Full system control exploits are only public for system versions up to and including '''9.2.0'''.

FirmwareNews

2015-09-09T20:33:17Z

MassExplosion213: Fixing an ironhax misconception. Feel free to change back.

Original [[ninjhax]]: From '''4.0.0-X''' up to and including '''9.2.0-X''', when '''X''' is between 7 and 20.

[[ninjhax|ninjhax2]], [[tubehax]]]: From '''9.0.0-X''' up to and including '''10.0.0-X''', for '''X''' up to and including '''27'''.
[[ironhax]]: From '''9.5.0-X''' up to and including '''10.0.0-X''', for '''X''' up to and including '''27'''.

For more detailed info, see the [[Homebrew_Exploits|Homebrew Exploits]] page.

----

Full system control exploits are only public for system versions up to and including '''9.2.0'''.

User talk:Yellows8

2015-09-09T03:40:36Z

MassExplosion213: /* Contact */

Thanks for clearing that up about the free space on the "TWL", what confused me about the name was how the dev unit handled ds games. You know how the 3ds's code name is CTR(we don't know what that stands for yet) and the ds's code name is NTR which mean Nitro. When a 3DS game is inserted, the dev menu says a "CTR CARD" is inserted, but when a DS game is inserted it says a "TWL CARD" is inserted instead of what I expected which would be "NTR CARD". I still do not understand this. - 3dsguy
:DS=NTR, DSLite=USG (japanese for thin..), DSi=TWL(Twelve), DSiXL=UTL, 3DS=CTR... DS (on the 3DS) is usually associated with DSi.. --[[User:Elisherer|Elisherer]] 02:32, 19 October 2011 (CEST)
::3dsguy, that game you inserted was released *long* before DSi right?(also, sign your comments with the signature button) --[[User:Yellows8|Yellows8]] 04:02, 19 October 2011 (CEST)
:Elisherer thanks for clearing that up :).--[[User:3dsguy|3dsguy]] 09:46, 19 October 2011 (CEST)
::Yellows8, no that game was not, but just now i tryed it with a game released in 2006 and it still said 'TWL CARD', but what Elisherer said explained this.--[[User:3dsguy|3dsguy]] 09:46, 19 October 2011 (CEST)

:DS = NTR/Nitro
:DSi = TWL/Twilight
:3DS = CTR/Horizon
:Wii = RVL/Revolution

:Yellows8 - if you have DS/Nitro code running on a DSi system, can you escalate to DSi/TWL mode or load a TWL/DSi binary or similar. [[User:Jl12|Jl12]]
::No, that's impossible. When DSi launcher/sysmenu switches to DS-mode, launcher clears the MSB of a DSi register disabling access to the registers controlling what hw is enabled and the clock rate etc. Once those regs are disabled, it's impossible to re-enable them again without resetting the system via I2C etc.(Also, by the time any exploited title is running homebrew code, those regs are already disabled too.) --[[User:Yellows8|Yellows8]] 19:53, 7 November 2011 (CET)
: Is the NAND encrypted as it is on 3DS? Also, does DSi use DLP [for TWL games] at all? [[User:Jl12|Jl12]]
::Yes, DSi NAND is encrypted with AES-CTR. DSiWare uses download-play but the WMB/dlp binaries are DS-mode only.--[[User:Yellows8|Yellows8]] 06:27, 14 November 2011 (CET)

@Yellows8 - I'm sorry for asking this so late, but what does NUS stand for in this context "redistributing copyrighted content, in this case NUS content, is *not* allowed here.". I do not understand why you deleted my page: [[Update Data|Update Data]]
:NUS = Nintendo Update Servers. Those archive(s) you linked to contained files you downloaded from NUS, all of which are copyrighted. Besides, mirroring NUS content without any decryption done at all is *completely* pointless. --[[User:Yellows8|Yellows8]] 16:41, 12 December 2011 (CET)
::So would it be better to provide update logs, so it can point people to which update data is from which version as on the NUS the individual update data for each title is not stored the same way for all titles, providing people with further reference, so they know what they are using. You may ask me what would they use them for, they are still not decrypted and therefore pointless. ATM knowing which version is which on the NUS *maybe* very important, but I can't tell you more until later.--[[User:3dsguy|3dsguy]] 01:19, 13 December 2011 (CET)
:::Yeah a list of titleIDs and versions would be fine. One could grab that info from [[Title_list]] diffs, but that's not the best way to handle this. I have lists of updated titles for each 3DS system update, but of course I never bothered to document which version was from what sysupdate beyond just adding them to the title list page.(obtained from their system update SOAP) --[[User:Yellows8|Yellows8]] 02:20, 13 December 2011 (CET)

@Yellows8 - Thanks for your progress everyday, really. i have questions.. If feeling uneasy please tell me politely (and i will remove these).
* Would you need a tool that can use specified patterns to mark the decrypted binary (certainly it can not be perfect) ? Or have you find a disassembler so powerful that you don't need that a tool any more? please tell me. if that is useful, let me and my friend make that.
:The tool would have such ability in resolving the configuration file. Comment, Include, CmdID (with no params), CmdID (with specified params), CmdID (with no specified params). such as 80001000:0103:4,0102:4,Any:4. (ie this can mark 800010000102 out as a second type).
* Just curious. It has been a long time since neimod's latest update. Have you got a board from him, or you are only using the exploit (not with the board). If the board is helpful, is there any access to get/purchase one? (if no i think i should learn how to diy one then)
it seems to be a long time for you to do all the documentations by yourself. (Orz i forgot my suggestion) --[[User:Syphurith|Syphurith]] 02:35, 15 April 2013 (CEST)
:I don't have any 3DS ramhaxx, I use software savegame haxx of course. "is there any access to get/purchase one? (if no i think i should learn how to diy one then)" You should be asking neimod about that instead, but [https://secure.flickr.com/photos/neimod/6238747088/in/photostream the] [https://secure.flickr.com/photos/neimod/6212627980/in/photostream soldering] for 3DS ramhaxx would be *really* difficult. I'm not sure what you mean regarding that tool either, are you referring to a tool which would locate the code for service commands in a binary? --[[User:Yellows8|Yellows8]] 03:10, 15 April 2013 (CEST)
::Thanks for reply. I will try to contact him for boards. About the tool --sniff--.
::* Cons: can not detect structures; may make mistake; need configuration file (can be made by writing the header code)
::* Pros: can visually color the matched patterns; can load unlimited size of file (result will be divided into segments of 1MB or other)
::It would not be too difficult to make. However may take one or two weeks. --[[User:Syphurith|Syphurith]] 03:49, 15 April 2013 (CEST)
:::I have no need for a tool which searches for service commandIDs, when I can just search for commandIDs etc in my text-editor for disassembled code. --[[User:Yellows8|Yellows8]] 04:04, 15 April 2013 (CEST)
::::Well thanks for reply. I removed the details above. I will left it undone. Have a good day.--[[User:Syphurith|Syphurith]] 04:21, 15 April 2013 (CEST)
I've seen there are users without contributions flew in. There are even some guys cheating (or just making jokes) with your names.. What's your opinion about that? PS3Brew is blocking those without edits (daily). --[[User:Syphurith|Syphurith]] 17:03, 17 April 2013 (CEST)
:I don't care much about either,(neither of those fake accounts were used to edit anything at least) I'm not an admin here though. --[[User:Yellows8|Yellows8]] 17:36, 17 April 2013 (CEST)

Hello Yellows8,
I have a question regarding the release of the hack. You guys said, that you won't release it, because it is very easy to patch. Now the new firmware was released and in fact the exploit was patched. So releasing it now wouldn't change anything, because Nintendo already patched it.

But if you release it now, people could start develloping homebrew and when you guys find a new exploit for the new firmware, we would already have a good base of homebrew applications.

So why still hiding it from the world?

Best regards and thank you for your work

elBirx
:"the exploit was patched" Only the code execution haxx was [[5.0.0-11|fixed]], the savegame haxx was not fixed. "But if you release it now, people could start develloping homebrew" No, currently it's '''only''' useful for reverse engineers. Almost everyone that wants that savegame haxx would have no use for it right now, since "it's '''only''' useful for reverse engineers". --[[User:Yellows8|Yellows8]] 18:46, 21 April 2013 (CEST)
::So i do think only one that want to do Reverse engineering and do have skills in ARM disassembly can ask you for such a thing. Yellows8, what would i need to learn if i want to analyse those (taken ARM references in consideration)? --[[User:Syphurith|Syphurith]] 03:07, 22 April 2013 (CEST)
:::What are you referring to by "those"? --[[User:Yellows8|Yellows8]] 04:26, 22 April 2013 (CEST)
::::I'm so sorry for my poor expression skill. If i want to analyse the ram or anything that you used as a material.. Exefs is ARM code so i think to check those (you can get using exploit/haxx) need arm knowledges. i mean, that is those service APIs. you did say you can check disassembled code. Even i don't know what is left to be done. --[[User:Syphurith|Syphurith]] 07:31, 22 April 2013 (CEST)
:::::"what would i need to learn..." You could learn to read/write ARM assembly, and learn reverse engineering. --[[User:Yellows8|Yellows8]] 07:38, 22 April 2013 (CEST)
::::::Thanks. Confirmed~ That's clear to me now. --[[User:Syphurith|Syphurith]] 11:53, 22 April 2013 (CEST)

Eh. Yellows8, i got some n00b questions about the ARM execution.

There is non-executable sections in the memory layout, but where did these "This can be executed" flags got initialized (I mean that is made of hardware circuits or bios or other software section)? If that is not changable, would all those ARM cores use the same non-execution flags settings(possibly no so we may change the core to keep that work?). Even more, can we sniffer the data app to core and change its execution length then inject.

Also, is there any method to let the core execute those commands (that you detected) and use that to produce something you interested in?
:The ARM11 kernel [[Memory_layout#ARM11_User-land_memory_regions|initializes]] the MMU tables. "Also, is there any method to let the core execute those commands (that you detected) and use that to produce something you interested in?" By running code on a 3DS of course. --[[User:Yellows8|Yellows8]] 17:27, 17 June 2013 (CEST)
::Thanks. But still feeling strange of that strategy. I think at least the Home Menu may be able to re-map or deactive this mark.
::-snip- Sorry for being noob (i would try learning arm soon). Hope you good work.--[[User:Syphurith|Syphurith]] 02:46, 19 June 2013 (CEST)

Home Menu starts application processes via [[NS]], terminating and "suspending" process execution(the process is still running with that, the application threads wait for a [[NS]] notification for resuming actual execution) is done via NS as well. The ARM11 kernel handles mapping the processes' virtual memory for .text, .rodata, and .data. The ARM11 kernel handles terminating processes as well of course. The only process which has access to [[SVC|svcControlProcessMemory]] for mapping memory or changing memory permissions, is [[RO_Services|RO]] module, and of course that module will only map R-X .text pages for the signed [[CRO0|CRO]] .text. --[[User:Yellows8|Yellows8]] 03:16, 19 June 2013 (CEST)
:I can still remember ns/ro is also a title in title list. (if manually start that may fails/cause failure) if you launch a title with those commands manually, would it be exposed (in ram?)(, if so we may dump the firmware/modules)? MPS let multiple processes can share the same resources (with home menu?). or have we to modify the real memory externally? There are just thoughts, if interesting please think for a while; if not just tell me "NONE".--[[User:Syphurith|Syphurith]] 05:17, 19 June 2013 (CEST)
:I saw you update the AES page recently. you can confirm some keyslots are with the same data, but how had you done that (by comparing the data, or just the same memory location)? Can you even fetch those keys to decrypt the CDN TMD key strings? if so that would be a potential way to go.. BTW you're disasm those in-memory content not the decrypted Romfs right?
:I do wonder if contents decrypted succussfully, shall we need any customed disassembler? --[[User:Syphurith|Syphurith]] 16:51, 26 June 2013 (CEST)
::"some keyslots are with the same data" I encrypted an all-zero block with each AES engine keyslot with CTR=0, and encrypted that data again with each keyslot with keyY=0. When the output block for the former is the same for multiple keyslots, those keyslots use the same keyX/keyY. When the latter output block is the same for multiple keyslots, those keyslots use the same keyX. "decrypt the CDN TMD key strings" TMDs have nothing to do with decrypting the ticket titlekey. [[RomFS]] does not contain code(besides [[CRO0]] for web browser), that's stored in [[ExeFS]]:/.code. There's no need to dump code from memory when one can just use the [[AES]] engine. --[[User:Yellows8|Yellows8]] 17:40, 26 June 2013 (CEST)
:::oh well. sorry for been n00b again. then have you ever found something that you can execute to decrypt those CDN data? i badly wanna try it.. ExeFS.. okey.. hope good work--[[User:Syphurith|Syphurith]] 08:04, 27 June 2013 (CEST)
:::-snip- --[[User:Syphurith|Syphurith]] 08:36, 27 June 2013 (CEST)
::::You do not "call" crypto functions here, this is a hardware [[AES]] engine with a hardware key-scrambler. "found something that you can execute to decrypt those CDN data" Not sure what you mean when we had system-version v4.5 total-control code exec haxx since December. --[[User:Yellows8|Yellows8]] 09:52, 27 June 2013 (CEST)
:::::I forgot that hours ago. sorry. I thought we would be able to feed those raw data we got from CDN, and let it decrypt and extract for us. then at least we may be able to find those differences in modules implemented between two nearby versions. Some just fix crash - stablility, and some would fix some vulnerables we may use, and some would indicates those internal logical process of the module's implementation. we can not always rely on those ROP or other black-box methods. when we get the opportunity to build a CFW or a special homebrew that would affect the original behaviours of the system, we may need to modify it right? also that should show us some interesting points if we have ones dedicated on analysing those. --[[User:Syphurith|Syphurith]] 14:51, 27 June 2013 (CEST)
::::::Total-control code exec haxx = access to the [[AES]] engine obviously. "build a 'CFW'" That's not possible because of [[NCCH|RSA]], the only way around that would be to exploit software while the system is booting or exploit Home Menu. And patching the NCCH signature checks(from like savegame haxx with a game) is rather pointless, because you would have to re-patch *every* time you boot your 3DS(there's no need to run a regular homebrew application via NCCH this way either tbh). --[[User:Yellows8|Yellows8]] 16:06, 27 June 2013 (CEST)
:::::Thx. That's exactly how cfw works. (sorry i only have psp and 3ds) procfw on psp, have ipl flashed (psp has one special section inside its battery) can auto-patch the cfw code into the system while booting. But have no news for how those men repair customer's device i definitely have no clubs about the existence of similiar mechism. Besides, patching is not that easy, well. i know you have full access to AES engine, and i just want to know have you ever tried or thought of using contents from CDN and decrypt them and disassemble to seek something interesting. --[[User:Syphurith|Syphurith]] 05:31, 28 June 2013 (CEST)
::::::Using the AES engine is basically the only way to obtain cleartext NCCH for updated titles, without finalizing the install for titles. That's obviously where stuff like the new [[6.0.0-11|savegame]] keyY info came from. --[[User:Yellows8|Yellows8]] 07:16, 28 June 2013 (CEST)
:::::Okey, good. you can take use of that (however still not related to exefs..) have a good day.
::There is ClCertA on CDN. Important keys are stored in hardware key-scrambler right? A.ClCertA's private key stored in hardware and there is api called with write access in the package. B.ClCertA's key stored in NAND or somewhere else so we can eventually grab that and setup a proxy to remote while replacing the original ninty ones to our own self-sign ones (Then we would be able to decode the data transfers between proxy to 3ds and proxy to remote). C.ClCertA.. The workers think their private key can never be leaked so no CRL and just stored in hardware with a package cheating their boss. Which one you think would be the best answer? BTW i do really think there is ones with R/W access to the hardware.. Hope you find new apis.--[[User:Syphurith|Syphurith]] 02:35, 4 July 2013 (CEST)
:::ClCertA contains the SSL client RSA cert/private-key, when one has that one can only access their servers(like with a PC) with that, *nothing* more. I'm not sure why they store that data in a CFA seperate from SSL module, those two files stored in the ClCertA RomFS use additional encryption to begin with. "BTW i do really think there is ones with R/W access to the hardware" I'm not sure what you mean by that. --[[User:Yellows8|Yellows8]] 03:24, 4 July 2013 (CEST)
::::-snip-
:::::I don't think you understand what "SSL client certificate authentication" is, you should google it etc. A fake server would require the SSL server private-key from the real server, which you can't obtain of course. The AES engine has *nothing* to do with this besides being used to decrypt those two files in that CFA RomFS. This CFA is a system title so it's obviously stored in NAND, but of course you can't change any NCCH data due to RSA signing of course(modifying ClCertA is pointless anyway). There's not much point changing the SSL client cert/private-key, each 3DS prior to that update would be using the old ClCertA, and system updates require that SSL client auth for SOAP(besides SOAP that stuff isn't really interesting tbh). SSL module is the only process which uses ClCertA. "... write/read which section of memory" I have no use for that. --[[User:Yellows8|Yellows8]] 17:30, 4 July 2013 (CEST)
::::::oh well thanks. So only SSL module then. Without the ability to modify the original data, even a tunnel proxy would not work properly..(what annoying the rsa signature is - maybe as me to you. i means, 3ds with replaced, child cert and key of a self-signed, connects to a proxy with self-signed cert and key; the proxy takes the original cert and key that of 3ds client, to connects to ninty CDN. the two connections are all connecting with proper key and cert, that client signed by server; but 3ds's original cert and key must be replaced by one signed by our proxy's server cert and key, as what ninty does with 3ds. cause inability to change the content, it is nothing now.)(maybe better quick head to learning disasm and someday to have a try) BTW haven't seen Jl12 for long, seeing someone impeach him for just taking $ away lol. (even i don't think about that before. oh no this is your page and i should not be short to you) --[[User:Syphurith|Syphurith]] 02:16, 5 July 2013 (CEST)
::::::So please let me say that. "Sorry". also hope you find something today.

===Spam attack===
I guess the simple captcha isn't enough, do you have an idea what to do? (i'm asking you because you are the most active admin here). 
I think we should adopt a method of registration and waiting for an admin to approve it. the recent changes page is spammed hard and a lot of google pages, I guess, are being created linking to those pages. --[[User:Elisherer|Elisherer]] 09:40, 31 May 2013 (CEST)
:Mha is the only one that can do anything about anti-spam, I can't do much about it myself. Mha said that he would work on this tomorrow. --[[User:Yellows8|Yellows8]] 22:19, 31 May 2013 (CEST)
::A. Stop registeration for several weeks (NOT GOOD).
::B. Ajax to load captcha (maybe reCAPTCHA?). Not well-made bots will have trouble loading the javascript code or lose the speed (there is ones with javascript but can not act so quickly)(MAYBE USEFUL). This method is widely used ''it may be not so useful'' (against latest tools).
::C. Use auto filter to auto check those suspicious content and block those users, given an access for those by accident closed guys to talk about their opinion. (I do wonder if the wiki admin backdoor provide you such a tool)(Hey Regex~)
::D.find their IP and block the IP section for a while.(Similiar as A)
::E. Use man-made Email to validate (I means, instead of the system writing mail to user to validate, let user write mails to admin or other trusted -- use SPAM filter)(NOT WELL PRATICAL, Haven't tested, SO..)
::F. Calls for someone can trust and give him only those block and delete power (DIFFICULT). Well just a little tries..
::G. Try to update your wiki version first, i mean the version of this website framework. (MAYBE USEFUL? DOUBT..)
::If you tried the actions of blocking and the spam still flow in you need to update or call wiki program's supporters (may be exploit..) But i do wonder why they tried to attack here, a (script) guy (with latest tool)?(if so he should try to improve his skill first).
::Oh well, Recent changes. Guys have a good day (International Children's Day).--[[User:Syphurith|Syphurith]] 09:39, 1 June 2013 (CEST)
:We are able to mark those pages as spam but however no effects in deed if no one comes to remove those spam accounts. Well.--[[User:Syphurith|Syphurith]] 10:17, 17 June 2013 (CEST)

===Fundraiser===
Hello Yellows8,
I know you're not the one that is responsible for the chip decapping fundraiser, but I didn't manage to contact Jl12 via E-Mail (He's not responding). So, have you guys noticed that the donations hit the 2000$ last week? Will the decapping start anytime soon or do you need some more money for buying the 3DS itself?
Best regards
:Jl12 has had a broken 3DS for decapping before the fundraiser even started. And of course we noticed that, however since Jl12 is usually very busy it might be a while before he sends his 3DS for decapping. --[[User:Yellows8|Yellows8]] 00:26, 5 June 2013 (CEST)
Hi again,
anything regarding the chip decapping happened in the past week? Will the images be released to the public?
Best regards
:We still haven't heard anything from Jl12. --[[User:Yellows8|Yellows8]] 19:34, 15 June 2013 (CEST)
So Still no news from Jl12? Seems not seeing him for long.--[[User:Syphurith|Syphurith]] 02:35, 4 July 2013 (CEST)

Hi Yellows8,
sorry to bother you again, but I would like to know, if you heard something from Jl12 since July. As far as I know [http://gbatemp.net/members/mercluke.109574/ mercluke] donated the remaining 300$ months ago. Has this money never arrived or is this whole thing nothing but a scam after all and Jl12 ran off with the money? This would be really disappointing for all donaters and a very sad end for a very promising project.
:"if you heard something from Jl12 since July" Nope, he's very busy. When we do hear anything from him he would presumably update the donate page anyway, so no need to ask here. --[[User:Yellows8|Yellows8]] 17:14, 5 November 2013 (CET)

http://n-dev.net/donate.php is gone.

== I have tried to send you an email ==

I don't know if it will go through though. It is about help with dumping a 3DS kiosk demo, which is an earlier build than the final game. --[[User:Hiccup|Hiccup]] 16:15, 31 May 2015 (CEST)

== Contact ==

Look, I'm sorry to bother you, but I was wondering, how would I get in contact with you? --[[User:MassExplosion213|MassExplosion213]] 06:20, 9 September 2015 (CEST)
:EFNet IRC is preferred. --[[User:Yellows8|Yellows8]] 06:24, 9 September 2015 (CEST)

User talk:Yellows8

2015-09-09T03:22:19Z

MassExplosion213: /* Contact */

Homebrew Exploits

2015-09-09T02:22:22Z

MassExplosion213: /* Self-Exploitable */

==Self-Exploitable==
The following homebrew exploits can be executed on a previously un-exploited system.
{| class="wikitable" border="1"
|-
! Name
! Supported firmwares
! Requirements
! Author
! Install
|-
| [[ninjhax|Ninjhax 1.1b]]
| From '''4.0.0-X''' up to and including '''9.2.0-X''', for '''X''' is between 7 and 20.
| A cartridge or eShop version (JPN-only) of "Cubic Ninja".
| smea
| [http://smealum.net/ninjhax/ Install]
|-
| [[ninjhax|Ninjhax 2.1]]
| From '''9.0.0-X''' up to and including '''10.0.0-X''', for '''X''' up to and including 27.
| A cartridge or eShop version (JPN-only) of "Cubic Ninja".
| smea
| [http://smealum.github.io/ninjhax2/ Install]
|-
| [[tubehax|Tubehax]]
| From '''9.0.0-X''' up to and including '''10.0.0-X''', for '''X''' up to and including 27.
| The YouTube application and an internet connection.
| smea
| [http://smealum.github.io/3ds/ Install]
|}

Note that ninjhax 1.x is still not obsolete. Even though ninjhax 2.x can be run on 9.3+, this was made possible (amongst other things) by sacrificing the memory remapping exploit used in ninjhax 1.x (rohax). Therefore, things like JIT engines for emulators can only be supported on ninjhax 1.x. Furthermore, ninjhax 2.x does not run on system versions below 9.0.0-X, while ninjhax 1.x does.

==Secondary Exploits==
Installation of these exploits requires a previously exploited system.
{| class="wikitable" border="1"
! Name
! Supported firmwares
! Requirements
! Author
! Install
|-
| [[ironhax]]
| From '''9.5.0-X''' up to and including '''10.0.0-X''', for '''X''' up to and including 27.
| A copy of "Ironfall: Invasion" (not available on eShop as of August 11th, 2015) and a self-exploitable title.
| smea
| [http://smealum.github.io/3ds/ Install]
|-
| [https://github.com/yellows8/oot3dhax oot3dhax]
| From '''9.5.0-X''' up to and including '''10.0.0-X''', for '''X''' up to and including 27.
| A gamecard or eShop-install of Legend of Zelda: Ocarina of Time 3D.
| Actual hax/payload: Yellows8/smea et all. Installer linked here(modified version of the ironhax installer): Meladroit.
| OoT3DHax can be used to boot the otherapp homebrew-launcher payload. An installer for installing the hax-save + payload into the OoT3D savedata can be found [https://github.com/meladroit/oot3dhax_installer here].
|}

User talk:Yellows8

2015-09-09T02:20:18Z

MassExplosion213: /* Contact */ new section

Homebrew Exploits

2015-09-09T02:07:50Z

MassExplosion213: 10.0.0 Fix

==Self-Exploitable==
The following homebrew exploits can be executed on a previously un-exploited system.
{| class="wikitable" border="1"
|-
! Name
! Supported firmwares
! Requirements
! Author
! Install
|-
| [[ninjhax]] (1.1b)
| From '''4.0.0-X''' up to and including '''9.2.0-X''', for '''X''' is between 7 and 20.
| A cartridge or eShop version (JPN-only) of "Cubic Ninja".
| smea
| [http://smealum.net/ninjhax/ Install]
|-
| [[ninjhax]] (2.1)
| From '''9.0.0-X''' up to and including '''10.0.0-X''', for '''X''' up to and including 27.
| A cartridge or eShop version (JPN-only) of "Cubic Ninja".
| smea
| [http://smealum.github.io/ninjhax2/ Install]
|-
| [[tubehax]]
| From '''9.0.0-X''' up to and including '''10.0.0-X''', for '''X''' up to and including 27.
| The YouTube application and an internet connection.
| smea
| [http://smealum.github.io/3ds/ Install]
|}

Note that ninjhax 1.x is still not obsolete. Even though ninjhax 2.x can be run on 9.3+, this was made possible (amongst other things) by sacrificing the memory remapping exploit used in ninjhax 1.x (rohax). Therefore, things like JIT engines for emulators can only be supported on ninjhax 1.x. Furthermore, ninjhax 2.x does not run on system versions below 9.0.0-X, while ninjhax 1.x does.

==Secondary Exploits==
Installation of these exploits requires a previously exploited system.
{| class="wikitable" border="1"
! Name
! Supported firmwares
! Requirements
! Author
! Install
|-
| [[ironhax]]
| From '''9.5.0-X''' up to and including '''10.0.0-X''', for '''X''' up to and including 27.
| A copy of "Ironfall: Invasion" (not available on eShop as of August 11th, 2015) and a self-exploitable title.
| smea
| [http://smealum.github.io/3ds/ Install]
|-
| [https://github.com/yellows8/oot3dhax oot3dhax]
| From '''9.5.0-X''' up to and including '''10.0.0-X''', for '''X''' up to and including 27.
| A gamecard or eShop-install of Legend of Zelda: Ocarina of Time 3D.
| Actual hax/payload: Yellows8/smea et all. Installer linked here(modified version of the ironhax installer): Meladroit.
| OoT3DHax can be used to boot the otherapp homebrew-launcher payload. An installer for installing the hax-save + payload into the OoT3D savedata can be found [https://github.com/meladroit/oot3dhax_installer here].
|}

Homebrew Exploits

2015-09-09T02:06:51Z

MassExplosion213: 10.0.0 Fix

==Self-Exploitable==
The following homebrew exploits can be executed on a previously un-exploited system.
{| class="wikitable" border="1"
|-
! Name
! Supported firmwares
! Requirements
! Author
! Install
|-
| [[ninjhax]] (1.1b)
| From '''4.0.0-X''' up to and including '''9.2.0-X''', for '''X''' is between 7 and 20.
| A cartridge or eShop version (JPN-only) of "Cubic Ninja".
| smea
| [http://smealum.net/ninjhax/ Install]
|-
| [[ninjhax]] (2.1)
| From '''9.0.0-X''' up to and including '''10.0.0-X''', for '''X''' up to and including 27.
| A cartridge or eShop version (JPN-only) of "Cubic Ninja".
| smea
| [http://smealum.github.io/ninjhax2/ Install]
|-
| [[tubehax]]
| From '''9.0.0-X''' up to and including '''10.0.0-X''', for '''X''' up to and including 27.
| The YouTube application and an internet connection.
| smea
| [http://smealum.github.io/3ds/ Install]
|}

Note that ninjhax 1.x is still not obsolete. Even though ninjhax 2.x can be run on 9.3+, this was made possible (amongst other things) by sacrificing the memory remapping exploit used in ninjhax 1.x (rohax). Therefore, things like JIT engines for emulators can only be supported on ninjhax 1.x. Furthermore, ninjhax 2.x does not run on system versions below 9.0.0-X, while ninjhax 1.x does.

==Secondary Exploits==
Installation of these exploits requires a previously exploited system.
{| class="wikitable" border="1"
! Name
! Supported firmwares
! Requirements
! Author
! Install
|-
| [[ironhax]]
| From '''9.5.0-X''' up to and including '''9.9.0-X''', for '''X''' up to and including 26.
| A copy of "Ironfall: Invasion" (not available on eShop as of August 11th, 2015) and a self-exploitable title.
| smea
| [http://smealum.github.io/3ds/ Install]
|-
| [https://github.com/yellows8/oot3dhax oot3dhax]
| From '''9.5.0-X''' up to and including '''9.9.0-X''', for '''X''' up to and including 26.
| A gamecard or eShop-install of Legend of Zelda: Ocarina of Time 3D.
| Actual hax/payload: Yellows8/smea et all. Installer linked here(modified version of the ironhax installer): Meladroit.
| OoT3DHax can be used to boot the otherapp homebrew-launcher payload. An installer for installing the hax-save + payload into the OoT3D savedata can be found [https://github.com/meladroit/oot3dhax_installer here].
|}

Homebrew Exploits

2015-09-09T01:47:31Z

MassExplosion213: /* Self-Exploitable */

==Self-Exploitable==
The following homebrew exploits can be executed on a previously un-exploited system.
{| class="wikitable" border="1"
|-
! Name
! Supported firmwares
! Requirements
! Author
! Install
|-
| [[ninjhax]] (1.1b)
| From '''4.0.0-X''' up to and including '''9.2.0-X''', for '''X''' is between 7 and 20.
| A cartridge or eShop version (JPN-only) of "Cubic Ninja".
| smea
| [http://smealum.net/ninjhax/ Install]
|-
| [[ninjhax]] (2.1)
| From '''9.0.0-X''' up to and including '''9.9.0-X''', for '''X''' up to and including 26.
| A cartridge or eShop version (JPN-only) of "Cubic Ninja".
| smea
| [http://smealum.github.io/ninjhax2/ Install]
|-
| [[tubehax]]
| From '''9.0.0-X''' up to and including '''9.9.0-X''', for '''X''' up to and including 26.
| The YouTube application and an internet connection.
| smea
| [http://smealum.github.io/3ds/ Install]
|}

Note that ninjhax 1.x is still not obsolete. Even though ninjhax 2.x can be run on 9.3+, this was made possible (amongst other things) by sacrificing the memory remapping exploit used in ninjhax 1.x (rohax). Therefore, things like JIT engines for emulators can only be supported on ninjhax 1.x. Furthermore, ninjhax 2.x does not run on system versions below 9.0.0-X, while ninjhax 1.x does.

==Secondary Exploits==
Installation of these exploits requires a previously exploited system.
{| class="wikitable" border="1"
! Name
! Supported firmwares
! Requirements
! Author
! Install
|-
| [[ironhax]]
| From '''9.5.0-X''' up to and including '''9.9.0-X''', for '''X''' up to and including 26.
| A copy of "Ironfall: Invasion" (not available on eShop as of August 11th, 2015) and a self-exploitable title.
| smea
| [http://smealum.github.io/3ds/ Install]
|-
| [https://github.com/yellows8/oot3dhax oot3dhax]
| From '''9.5.0-X''' up to and including '''9.9.0-X''', for '''X''' up to and including 26.
| A gamecard or eShop-install of Legend of Zelda: Ocarina of Time 3D.
| Actual hax/payload: Yellows8/smea et all. Installer linked here(modified version of the ironhax installer): Meladroit.
| OoT3DHax can be used to boot the otherapp homebrew-launcher payload. An installer for installing the hax-save + payload into the OoT3D savedata can be found [https://github.com/meladroit/oot3dhax_installer here].
|}

Homebrew Exploits

2015-09-09T01:46:09Z

MassExplosion213: /* Self-Exploitable */

==Self-Exploitable==
The following homebrew exploits can be executed on a previously un-exploited system.
{| class="wikitable" border="1"
|-
! Name
! Supported firmwares
! Requirements
! Author
! Install
|-
| [[ninjhax]] (1.1b)
| From '''4.0.0-X''' up to and including '''9.2.0-X''', for '''X''' is between 7 and 20.
| A cartridge or eShop version (JPN-only) of "Cubic Ninja".
| smea
| [http://smealum.net/ninjhax/ Install]
|-
| [[ninjhax]] (2.1)
| From '''9.0.0-X''' up to and including '''9.9.0-X''', for '''X''' up to and including 26.
| A copy of "Cubic Ninja" (cartridge or eShop version).
| smea
| [http://smealum.github.io/ninjhax2/ Install]
|-
| [[tubehax]]
| From '''9.0.0-X''' up to and including '''9.9.0-X''', for '''X''' up to and including 26.
| The YouTube application and an internet connection.
| smea
| [http://smealum.github.io/3ds/ Install]
|}

Note that ninjhax 1.x is still not obsolete. Even though ninjhax 2.x can be run on 9.3+, this was made possible (amongst other things) by sacrificing the memory remapping exploit used in ninjhax 1.x (rohax). Therefore, things like JIT engines for emulators can only be supported on ninjhax 1.x. Furthermore, ninjhax 2.x does not run on system versions below 9.0.0-X, while ninjhax 1.x does.

==Secondary Exploits==
Installation of these exploits requires a previously exploited system.
{| class="wikitable" border="1"
! Name
! Supported firmwares
! Requirements
! Author
! Install
|-
| [[ironhax]]
| From '''9.5.0-X''' up to and including '''9.9.0-X''', for '''X''' up to and including 26.
| A copy of "Ironfall: Invasion" (not available on eShop as of August 11th, 2015) and a self-exploitable title.
| smea
| [http://smealum.github.io/3ds/ Install]
|-
| [https://github.com/yellows8/oot3dhax oot3dhax]
| From '''9.5.0-X''' up to and including '''9.9.0-X''', for '''X''' up to and including 26.
| A gamecard or eShop-install of Legend of Zelda: Ocarina of Time 3D.
| Actual hax/payload: Yellows8/smea et all. Installer linked here(modified version of the ironhax installer): Meladroit.
| OoT3DHax can be used to boot the otherapp homebrew-launcher payload. An installer for installing the hax-save + payload into the OoT3D savedata can be found [https://github.com/meladroit/oot3dhax_installer here].
|}