3dbrew - User contributions [en]

Kernel ABI

2018-04-15T07:30:19Z

Phijor:

Inputs are read from registers starting from r0 and outputs are written back to the same registers (also starting with r0).

{| class="wikitable" border="1"
|-
! ID
! Name
! Inputs
! Outputs
|-
| 0x01
| ControlMemory
|
<code>r0</code>: <code>[[Memory Management#enum_MemoryOperation|MemoryOperation]] operation</code> 
<code>r1</code>: <code>u32 addr0</code> 
<code>r2</code>: <code>u32 addr1</code> 
<code>r3</code>: <code>u32 size</code> 
<code>r4</code>: <code>[[Memory Management#enum_MemoryPermission|MemoryPermission]] permissions</code>
|
<code>r0</code>: <code>Result</code> 
<code>r1</code>: <code>u32 addr_out</code>
|-
| 0x02
| QueryMemory
|
<code>r2</code>?: <code>u32 addr</code>
|
<code>r0</code>: <code>Result</code> 
<code>r1</code>: <code>u32 base_process_virtual_address</code> 
<code>r2</code>: <code>u32 size</code> 
<code>r3</code>: <code>[[Memory Management#enum_MemoryPermission|MemoryPermission]] permission</code> 
<code>r4</code>: <code>[[Memory_Management#enum_MemoryState|MemoryState]] state</code> 
<code>r5</code>: <code>[[Memory_Management#enum_PageFlags|PageFlags]] page_flags</code>
|-
| 0x03
| ExitProcess
| None
| None
|-
| 0x04
| GetProcessAffinityMask
|
<code>r0</code>: <code>[out] u8* affinitymask</code> 
<code>r1</code>: <code>Handle process</code> 
<code>r2</code>: <code>s32 processorcount</code>
|
<code>r0</code>: <code>Result</code>
|-
| 0x04
| SetProcessAffinityMask
|
<code>r0</code>: <code>Handle process</code> 
<code>r1</code>: <code>[in] u8* affinitymask</code> 
<code>r2</code>: <code>s32 processorcount</code>
|
<code>r0</code>: <code>Result</code>
|-
| 0x05
| GetProcessIdealProcessor
|
<code>r1</code>?: <code>Handle process</code>
|
<code>r0</code>: <code>Result</code> 
<code>r1</code>: <code>s32 processorid</code>
|-
| 0x24
| WaitSynchronization1
|
<code>r0</code>: <code>Handle handle</code> 
<code>r2-r3</code>: <code>s64 timeout</code>
|
<code>r0</code>: <code>Result</code>
|-
| 0x1B
| SetTimer
| Timer handle, initial_low, interval_low, initial_high, interval_high
| Result
|-
| 0x2D
| ConnectToPort
| ??, pointer to port name
| Result, handle to [[KClientSession]]
|-
| 0x32
| SendSyncRequest
| handle to [[KClientSession]]
| Result
|}

FS:FormatSaveData

2018-03-25T15:03:53Z

Phijor: Fix link to bucket count calculation

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x084C0242]
|-
| 1
| [[Filesystem_services#ArchiveId|Archive ID]]. This must be either 0x4 (SaveData) or 0x567890B2, otherwise error 0xE0E046BE is returned.
|-
| 2
| [[Filesystem_services#PathType|Path Type]]
|-
| 3
| Path Size
|-
| 4
| Size in Blocks (1 block = 512 bytes). The value of this word is hard-coded to 0x200 in official titles it appears, regardless of savedata-size.
|-
| 5
| Number of Directories
|-
| 6
| Max number of Files
|-
| 7
| Directory Bucket Count
|-
| 8
| File Bucket Count
|-
| 9
| u8, 0 = don't duplicate data, 1 = duplicate data
|-
| 10
| (PathSize << 14) <nowiki>|</nowiki> 2
|-
| 11
| Path Data Pointer
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code
|-
| 1
| Result code
|}

=Description=
This clears the SaveData archive for the specified game, if the LowPath.Type is Empty then this will clear the SaveData for the current game. The target SaveData to format is determined by a Binary path, a game needs an exheader permission set in order to format the SaveData of another program.

See [[RomFS#Hash_Table_Structure|here]] for an example of how bucket counts should be calculated.

Mii Selector

2017-08-03T17:16:11Z

Phijor: Fix copy/paste typo

This is the library applet used to select a [[Mii]]. Internally it is called
''appletEd''.

=Launching the applet=

''appletEd'' can be launched by calling [[APT:StartLibraryApplet]] with
[[NS_and_APT_Services#AppIDs|AppID]] 0x402. It expects a pointer to a
[[#Parameter Buffer|buffer]] of 0x104 bytes to be passed as parameter. It does
not use other ressources, so an invalid [[SVC#typedef_Handle|handle]] of value 0
is expected.

After returning from the applet, [[#Return Buffer|part of the parameter buffer]]
is filled with the data of any selected Mii and some other related values.

=Parameter Buffer=

The applet can be configured to work in a flexible way by setting values in a
0x104 byte long buffer that is passed when launching it.

{| class="wikitable" border="1"
|-
! Index Byte
! Size
! Type
! Name
! Description
|-
| 0x000
| 1
| <code>1*u8</code>
| Cancel button flag
| If set to a nonzero value, a Button labeled ''(B) Cancel'' is displayed at the bottom of the applet.
This allows to cancel the selection of a Mii.
|-
| 0x001
| 1
| <code>1*u8</code>
| Enable Guest Mii selection flag
| If set to a nonzero value, 6 predefined ''Guest Miis'' can be selected on their own page.
|-
| 0x002
| 1
| <code>1*u8</code>
| Show on top screen flag
| If set to a nonzero value, the applet is displayed at the top screen instead of the touchscreen.
|-
| 0x003
| 5
| <code>5*u8</code>
| ''Unknown''
| May be padding to align the following data to a 8-byte boundary.
|-
| 0x008
| 128 (0x80)
| <code>64*u16</code>
| Title
| This is a UTF16-LE[https://en.wikipedia.org/wiki/UTF-16]-encoded, zero-terminated string that is displayed at the top of the applet.
If the first character is set to <code>'\x0000'</code> (null-terminator), a default title is displayed.
|-
| 0x088
| 4
| <code>4*u8</code>
| ''Unknown''
| May be padding.
|-
| 0x08C
| 1
| <code>1*u8</code>
| Show Guest Miis flag
| If set to a nonzero value, the applet initially shows the page where the Guest Miis are located.
Otherwise, it displays the user-created/-imported Miis after launch.
|-
| 0x08D
| 3
| <code>3*u8</code>
| ''Unknown''
| May be padding to align the following data to a 8-byte boundary.
|-
| 0x090
| 4
| <code>1*u32</code>
| Initially selected Mii index
| If set to a value <code>i</code>, the cursor is initially placed on the <code>i+1</code>st Mii in the [[Mii#Mii_Database|Mii database]].
If ''Show Guest Miis'' is set and <code>i</code> is in [0,...,5], the cursor is placed on the <code>i+1</code>st Guest Mii. In any other case a user's personal Mii is selected.
|-
| 0x094
| 6
| <code>6*u8</code>
| Guest Mii whitelist
| For each nonzero byte in this array, the corresponding Guest Mii is made selectable.
Otherwise they are greyed out and can't be selected.
|-
| 0x09A
| 100 (0x64)
| <code>100*u8</code>
| User Mii whitelist
| Like the above, only for the Miis found in the system's database.
A Mii's index in this array corresponds to its index in the system database.
|-
| 0x0FE
| 2
| <code>1*u16</code>
| ''Unknown''
| May be padding to align the following data to a 8-byte boundary.
|-
| 0x100
| 4
| <code>1*u32</code>
| Magic value <code>0x13DE28CF</code> (little Endian)
| Without this value, the applet refuses to display any Miis.
|}

=Return Buffer=

After selecting a Mii or canceling the operation, ''appletEd'' writes 0x84 byte
to the parameter buffer it was passed, starting at offset 0.

{| class="wikitable" border="1"
|-
! Index Byte
! Size
! Type
! Name
! Description
|-
| 0x00
| 4
| <code>1*u32</code>
| Return code
| Set to 1 if the action was canceled, 0 if a Mii was selected.
|-
| 0x04
| 4
| <code>1*u32</code>
| Guest Mii selected flag
| Set to 1 if a Guest Mii was selected, 0 if it was a user Mii.
|-
| 0x08
| 4
| <code>1*u32</code>
| Selected Guest Mii index
| If a Guest Mii was selected, this is set to the value corresponding to its index (i.e. 3 for Guest D).
Set to 0xFFFFFFFF (-1) if a user Mii was selected.
|-
| 0x0C
| 92 (0x5c)
| <code>1*struct mii</code>
| Selected Mii data
| If a Mii was selected, its data is copied here.
The same [[Mii#Mii format|format]] as in the system's Mii database is used.
|-
| 0x68
| 2
| <code>2*u8</code>
| ''Unknown''
| -
|-
| 0x6a
| 2
| <code>1*u16</code>
| Mii data checksum (?)
| This may be a [[Mii#Checksum|checksum]] of the returned Mii data.
|-
| 0x6c
| 24
| <code>12*u16</code>
| Guest Mii name
| The localized name as a UTF16-LE string of a Guest Mii if one was selected, zeroed otherwise.
|}

NS and APT Services

2017-08-03T17:13:34Z

Phijor: Add link to Mii Selector (appletEd) library applet

[[Category:Services]]
The NS ('''N'''intendo User Interface '''S'''hell) system module is the first module launched from a CTR-NAND title after the [[FIRM]] processes are loaded (also see [[Bootloader]]). This module is launched by the pm process, with the titleID loaded from NS state(hard-coded TID initialized during applet TID-array initialization). NS first launches [[ErrDisp]], then the menu. On retail the menu TID is loaded from NS state, while on dev/debug the menu TID is loaded from [[Config_Savegame|config]]. On dev-units if the menu TID block doesn't exist in [[Config_Savegame|config]], NS will attempt to launch the alternate menu instead. The TID of the launched menu is then written to [[Configuration Memory|ACTIVEMENUTID]]. NS uses [[PMApp:LaunchTitle|pm:app]] to launch titles.

NS will not trigger the [[ErrDisp|fatal-error]] screen when launching the regular/alternate menu fails.

Like home menu NS is constantly running while the system is in 3DS-mode. When attempting to return to home-menu when the home-menu process isn't running(like when the process terminated/crashed), NS will trigger a [[ErrDisp|fatal]] error.

= Alternate menu =
When launching the regular menu fails, NS will then attempt to launch the alternate menu. This title could be used as a recovery process, however it's normally not used after the factory.

At the factory for all 3DS systems, [[3DS Development Unit GUI#Test Menu|Test Menu]] is installed with this TID. On retail this title is eventually deleted during [[Factory Setup]].

= Auto-boot =
After [[PMApp:GetFIRMLaunchParams|loading]] [[FIRM]] params and prior to launching [[ErrDisp]]/Home Menu, NS handles auto-booting titles. The same code called by [[APT:Reboot]] is used for launching FIRM here. When the [[Configuration_Memory|UPDATEFLAG]] is set, NS will launch SAFE_MODE_FIRM with the application titleID set to the [[System_Settings#System_Updater|System Updater]] titleID for this region. When the UPDATEFLAG is not set, NS can auto-boot the following titles as well if [[Configuration_Memory|0x1FF80016]] bit0 is set.

When bit1 and bit2 are value zero in [[Configuration_Memory|0x1FF80016]], NS will [[NSS:LaunchFIRM|launch]] the title specified by the [[FIRM]] parameters if the title-info is set. This FIRM launch is done after launching [[ErrDisp]] and Home Menu. Otherwise when [[Configuration_Memory|0x1FF80016]] is value 2 and the output u8 from [[PTM|PTMSYSM]] command 0x08140000 is value 0, NS will boot the title specified from the TWL TLNC block from FIRMparams+0x300. This is the same TLNC block which DSi titles wrote to RAM+0x300 for launching other titles via the launcher title. When handling the TLNC block, NS will boot the 3DS System Settings title when the TLNC titleID is the DSi System Settings titleID(the region field in the TLNC TID is not checked/used). When the TLNC titleID is not System Settings, NS will convert the input DSi titleID-high to the 3DS TWL titleID-high(tidhigh = (TLNCtidhigh & 0x7FFF) | 0x48000), then launch TWL_FIRM to run the title. NS does not support launching from gamecard via TLNC.

= NS Workaround =
A "ns_workaround" was [[5.1.0-11|added]] in NS to workaround the flaw added with [[5.0.0-11]]. When NS is loading before launching any ARM11 processes and certain [[Configuration Memory]] fields are set, NS will launch [[Application_Manager_Services|AM]] then use command [[AM:InstallNATIVEFIRM]]. NS will then execute the code called by [[APT:StartNewestHomeMenu]], the code related to APT:PrepareToStartNewestHomeMenu is not executed here.

NS will only execute this code-path when [[Configuration Memory|0x1FF80016]] is value zero, when KERNEL_VERSIONMAJOR is value 2, and when KERNEL_VERSIONMINOR is less than 35. Therefore, this code-path is only executed when the running NATIVE_FIRM version is prior to [[5.0.0-11]].

= NS Service "ns:s" =
{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Description
|-
| 0x000100C0
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:LaunchFIRM|LaunchFIRM]]
|-
| 0x000200C0
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:LaunchTitle|LaunchTitle]]
|-
| 0x00030000
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:TerminateApplication|TerminateApplication]]
|-
| 0x00040040
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:TerminateProcess|TerminateProcess]]
|-
| 0x000500C0
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:LaunchApplicationFIRM|LaunchApplicationFIRM]]
|-
| 0x00060042
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:SetWirelessRebootInfo|SetWirelessRebootInfo]]
|-
| 0x00070042
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:CardUpdateInitialize|CardUpdateInitialize]]
|-
| 0x00080000
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:CardUpdateShutdown|CardUpdateShutdown]]
|-
| 0x00090000
| [[1.0.0-0]] - [[2.0.0-2]]
| Gamecard system update related.
|-
| 0x000A0000
| [[1.0.0-0]] - [[2.0.0-2]]
| Gamecard system update related.
|-
| 0x000B0000
| [[1.0.0-0]] - [[2.0.0-2]]
| Gamecard system update related.
|-
| 0x000C0000
| [[1.0.0-0]] - [[2.0.0-2]]
| Gamecard system update related.
|-
| 0x000D0140
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:SetTWLBannerHMAC|SetTWLBannerHMAC]]
|-
| 0x000E0000
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:ShutdownAsync|ShutdownAsync]]
|-
| 0x000F0000
| [[1.0.0-0]] - [[2.0.0-2]]
| This calls [[APT:AppletUtility]] with fixed input params.
|-
| 0x00100180
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:RebootSystem|RebootSystem]]
|-
| 0x00110100
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:TerminateTitle|TerminateTitle]]
|-
| 0x001200C0
| ?
| [[NSS:SetApplicationCpuTimeLimit|SetApplicationCpuTimeLimit]]
|-
| 0x00130000
| ?
| ?
|-
| 0x00140042
| ?
| ?
|-
| 0x00150140
| ?
| [[NSS:LaunchApplication|LaunchApplication]]
|-
| 0x00160000
| [[8.0.0-18]]
| [[NSS:RebootSystemClean|RebootSystemClean]]
|}

The maximum sessions that can be used with this service is two, therefore only two processes can use this service at the same time.

=NS Power Service "ns:p"=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010040
| [[NSP:RebootSystem|RebootSystem]]
|-
| 0x00020000
| [[NSS:ShutdownAsync|ShutdownAsync]]
|}

This was added with [[3.0.0-5]]. The PTM sysmodule connects to this service, and syncs whenever [[PTM|ptm:s GetShellState()]] changes.

=NS Service "ns:c"=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010100
| ?
|-
| 0x00020100
| ?
|}

This was added with [[5.0.0-11]], it's unknown what this is used for.

=APT Services=
{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Accessible with APT:U
! Description
|-
| 0x00010040
|
| Yes
| [[APT:GetLockHandle|GetLockHandle]]
|-
| 0x00020080
|
| See [[APT:Initialize|here]].
| [[APT:Initialize|Initialize]]
|-
| 0x00030040
|
| Yes
| [[APT:Enable|Enable]]
|-
| 0x00040040
|
| Yes
| [[APT:Finalize|Finalize]]
|-
| 0x00050040
|
| Yes
| [[APT:GetAppletManInfo|GetAppletManInfo]]
|-
| 0x00060040
|
| Yes
| [[APT:GetAppletInfo|GetAppletInfo]]
|-
| 0x00070000
|
| Yes
| [[APT:GetLastSignaledAppletId|GetLastSignaledAppletId]]
|-
| 0x00080000
|
| Yes
| [[APT:CountRegisteredApplet|CountRegisteredApplet]]
|-
| 0x00090040
|
| Yes
| [[APT:IsRegistered|IsRegistered]]
|-
| 0x000A0040
|
| Yes
| [[APT:GetAttribute|GetAttribute]]
|-
| 0x000B0040
|
| Yes
| [[APT:InquireNotification|InquireNotification]]
|-
| 0x000C0104
|
| Yes
| [[APT:SendParameter|SendParameter]]
|-
| 0x000D0080
|
| Yes
| [[APT:ReceiveParameter|ReceiveParameter]]
|-
| 0x000E0080
|
| Yes
| [[APT:GlanceParameter|GlanceParameter]]
|-
| 0x000F0100
|
| Yes
| [[APT:CancelParameter|CancelParameter]]
|-
| 0x001000C2
|
| Yes
| [[APT:DebugFunc|DebugFunc]]
|-
| 0x001100C0
|
| Yes
| [[APT:MapProgramIdForDebug|MapProgramIdForDebug]]
|-
| 0x00120040
|
| Yes
| [[APT:SetHomeMenuAppletIdForDebug|SetHomeMenuAppletIdForDebug]]
|-
| 0x00130000
|
| Yes
| [[APT:GetPreparationState|GetPreparationState]]
|-
| 0x00140040
|
| Yes
| [[APT:SetPreparationState|SetPreparationState]]
|-
| 0x00150140
|
| No
| [[APT:PrepareToStartApplication|PrepareToStartApplication]]
|-
| 0x00160040
|
| Yes
| [[APT:PreloadLibraryApplet|PreloadLibraryApplet]]
|-
| 0x00170040
|
| Yes
| [[APT:FinishPreloadingLibraryApplet|FinishPreloadingLibraryApplet]]
|-
| 0x00180040
|
| Yes
| [[APT:PrepareToStartLibraryApplet|PrepareToStartLibraryApplet]]
|-
| 0x00190040
|
| Yes
| [[APT:PrepareToStartSystemApplet|PrepareToStartSystemApplet]]
|-
| 0x001A0000
|
| Yes
| [[APT:PrepareToStartNewestHomeMenu|PrepareToStartNewestHomeMenu]]
|-
| 0x001B00C4
|
| Yes
| [[APT:StartApplication|StartApplication]]
|-
| 0x001C0000
|
| Yes
| [[APT:WakeupApplication|WakeupApplication]]
|-
| 0x001D0000
|
| Yes
| [[APT:CancelApplication|CancelApplication]]
|-
| 0x001E0084
|
| Yes
| [[APT:StartLibraryApplet|StartLibraryApplet]]
|-
| 0x001F0084
|
| Yes
| [[APT:StartSystemApplet|StartSystemApplet]]
|-
| 0x00200044
|
| Yes
| [[APT:StartNewestHomeMenu|StartNewestHomeMenu]]
|-
| 0x00210000
|
| No
| [[APT:OrderToCloseApplication|OrderToCloseApplication]]
|-
| 0x00220040
|
| Yes
| [[APT:PrepareToCloseApplication|PrepareToCloseApplication]]
|-
| 0x00230040
|
| Yes
| [[APT:PrepareToJumpToApplication|PrepareToJumpToApplication]]
|-
| 0x00240044
|
| Yes
| [[APT:JumpToApplication|JumpToApplication]]
|-
| 0x002500C0
|
| Yes
| [[APT:PrepareToCloseLibraryApplet|PrepareToCloseLibraryApplet]]
|-
| 0x00260000
|
| Yes
| [[APT:PrepareToCloseSystemApplet|PrepareToCloseSystemApplet]]
|-
| 0x00270044
|
| Yes
| [[APT:CloseApplication|CloseApplication]]
|-
| 0x00280044
|
| Yes
| [[APT:CloseLibraryApplet|CloseLibraryApplet]]
|-
| 0x00290044
|
| Yes
| [[APT:CloseSystemApplet|CloseSystemApplet]]
|-
| 0x002A0000
|
| Yes
| [[APT:OrderToCloseSystemApplet|OrderToCloseSystemApplet]]
|-
| 0x002B0000
|
| Yes
| [[APT:PrepareToJumpToHomeMenu|PrepareToJumpToHomeMenu]]
|-
| 0x002C0044
|
| Yes
| [[APT:JumpToHomeMenu|JumpToHomeMenu]]
|-
| 0x002D0000
|
| Yes
| [[APT:PrepareToLeaveHomeMenu|PrepareToLeaveHomeMenu]]
|-
| 0x002E0044
|
| Yes
| [[APT:LeaveHomeMenu|LeaveHomeMenu]]
|-
| 0x002F0040
|
| Yes
| [[APT:PrepareToLeaveResidentApplet|PrepareToLeaveResidentApplet]]
|-
| 0x00300044
|
| Yes
| [[APT:LeaveResidentApplet|LeaveResidentApplet]]
|-
| 0x00310100
|
| Yes
| [[APT:PrepareToDoApplicationJump|PrepareToDoApplicationJump]]
|-
| 0x00320084
|
| Yes
| [[APT:DoApplicationJump|DoApplicationJump]]
|-
| 0x00330000
|
| Yes
| [[APT:GetProgramIdOnApplicationJump|GetProgramIdOnApplicationJump]]
|-
| 0x00340084
|
| Yes
| [[APT:SendDeliverArg|SendDeliverArg]]
|-
| 0x00350080
|
| Yes
| [[APT:ReceiveDeliverArg|ReceiveDeliverArg]]
|-
| 0x00360040
|
| Yes
| [[APT:LoadSysMenuArg|LoadSysMenuArg]]
|-
| 0x00370042
|
| Yes
| [[APT:StoreSysMenuArg|StoreSysMenuArg]]
|-
| 0x00380040
|
| Yes
| [[APT:PreloadResidentApplet|PreloadResidentApplet]]
|-
| 0x00390040
|
| Yes
| [[APT:PrepareToStartResidentApplet|PrepareToStartResidentApplet]]
|-
| 0x003A0044
|
| Yes
| [[APT:StartResidentApplet|StartResidentApplet]]
|-
| 0x003B0040
|
| Yes
| [[APT:CancelLibraryApplet|CancelLibraryApplet]]
|-
| 0x003C0042
|
| Yes
| [[APT:SendDspSleep|SendDspSleep]]
|-
| 0x003D0042
|
| Yes
| [[APT:SendDspWakeUp|SendDspWakeUp]]
|-
| 0x003E0080
|
| Yes
| [[APT:ReplySleepQuery|ReplySleepQuery]]
|-
| 0x003F0040
|
| Yes
| [[APT:ReplySleepNotificationComplete|ReplySleepNotificationComplete]]
|-
| 0x00400042
|
| Yes
| [[APT:SendCaptureBufferInfo|SendCaptureBufferInfo]]
|-
| 0x00410040
|
| Yes
| [[APT:ReceiveCaptureBufferInfo|ReceiveCaptureBufferInfo]]
|-
| 0x00420080
|
| Yes
| [[APT:SleepSystem|SleepSystem]]
|-
| 0x00430040
|
| Yes
| [[APT:NotifyToWait|NotifyToWait]]
|-
| 0x00440000
|
| Yes
| [[APT:GetSharedFont|GetSharedFont]]
|-
| 0x00450040
|
| Yes
| [[APT:GetWirelessRebootInfo|GetWirelessRebootInfo]]
|-
| 0x00460104
|
| Yes
| [[APT:Wrap|Wrap]]
|-
| 0x00470104
|
| Yes
| [[APT:Unwrap|Unwrap]]
|-
| 0x00480100
|
| No
| [[APT:GetProgramInfo|GetProgramInfo]]
|-
| 0x00490180
|
| No
| [[APT:Reboot|Reboot]]
|-
| 0x004A0040
|
| Yes
| [[APT:GetCaptureInfo|GetCaptureInfo]]
|-
| 0x004B00C2
|
| Yes
| [[APT:AppletUtility|AppletUtility]]
|-
| 0x004C0000
|
| Yes
| [[APT:SetFatalErrDispMode|SetFatalErrDispMode]]
|-
| 0x004D0080
|
| Yes
| [[APT:GetAppletProgramInfo|GetAppletProgramInfo]]
|-
| 0x004E0000
|
| Yes
| [[APT:HardwareResetAsync|HardwareResetAsync]]
|-
| 0x004F0080
| [[2.2.0-X]]
| Yes
| [[APT:SetApplicationCpuTimeLimit|SetApplicationCpuTimeLimit]]
|-
| 0x00500040
| [[2.2.0-X]]
| Yes
| [[APT:GetApplicationCpuTimeLimit|GetApplicationCpuTimeLimit]]
|-
| 0x00510080
| [[3.0.0-5]]
| Yes
| [[APT:GetStartupArgument|GetStartupArgument]]
|-
| 0x00520104
| [[4.0.0-7]]
| Yes
| [[APT:Wrap1|Wrap1]]
|-
| 0x00530104
| [[4.0.0-7]]
| Yes
| [[APT:Unwrap1|Unwrap1]]
|-
| 0x00540040
| [[5.0.0-11]]
| ?
| ?
|-
| 0x00550040
| [[7.0.0-13]]
| Yes
| [[APT:SetScreencapPostPermission|SetScreencapPostPermission]]
|-
| 0x00560000
| [[7.0.0-13]]
| Yes
| [[APT:GetScreencapPostPermission|GetScreencapPostPermission]]
|-
| 0x00570044
| [[7.0.0-13]]
| ?
| [[APT:WakeupApplication2|WakeupApplication2]]
|-
| 0x00580002
| [[7.0.0-13]]
| Yes
| [[APT:GetProgramID|GetProgramID]]
|-
| 0x01010000
| [[8.0.0-18]]
| Yes
| [[APT:CheckNew3DSApp|CheckNew3DSApp]]
|-
| 0x01020000
| [[8.0.0-18]]
| Yes
| [[APT:CheckNew3DS|CheckNew3DS]]
|-
| 0x01030000
| [[8.0.0-18]]
| Yes
| This writes an output u8 to cmdreply[2], the value is determined by checking various NS internal state + whether this is a New3DS.
The normal output seems to be value 0x2. Forcing this value to 0x1 causes New3DS HID usage(via ir:USER) in Smash Bros to be disabled.
|-
| 0x01040000
| [[8.0.0-18]]
| ?
| [[APT:IsStandardMemoryLayout|IsStandardMemoryLayout]]
|-
| 0x01050100
| [[10.4.0-29]]
| ?
| [[APT:IsTitleAllowed|IsTitleAllowed]]
|}

These "APT:U" and "APT:S" NS services can handle launching titles/"applets", these services handle signaling for home/power button as well. Only one session for either APT service can be open at a time, normally processes close the service handle immediately once finished using the service. The commands for APT:U and APT:S are exactly the same, however certain commands are only accessible with APT:S(NS module will call [[SVC|svcBreak]] when the command isn't accessible).

Applets returning to home-menu first use commands APT:PrepareToJumpToHomeMenu and APT:JumpToHomeMenu, followed by these commands to launch home-menu: [[APT:PrepareToStartSystemApplet]] and [[APT:StartSystemApplet]]. [[APT:PrepareToStartSystemApplet]] and [[APT:StartSystemApplet]] are also used for launching the [[Internet Browser]], the camera applet, etc.

Processes launch applications via home-menu, not directly with [[APT:PrepareToStartApplication]] and [[APT:StartApplication]]. Regular applications can't directly launch applications since [[APT:StartApplication]] launches the process without terminating the currently running application.

APT:PrepareToDoApplicationJump and APT:DoApplicationJump are used by applications, for launching native/<non-NATIVE_FIRM> applications. These commands notify Home Menu that title launching needs done, Home Menu does the actual title launching via NS commands.

== AppletAttr ==
{| class="wikitable" border="1"
|-
! Bits
! Description
|-
| 0-2
| [[NS_and_APT_Services#AppletPos|AppletPos]]
|-
| 3
| Manually Acquire/Release GPU Rights
|-
| 4
| Manually Acquire/Release DSP Rights
|-
| 5
| ?
|}

== DisplayBufferMode ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| FORMAT_R8G8B8A8
|-
| 1
| FORMAT_R8G8B8
|-
| 2
| FORMAT_R5G6B5
|-
| 3
| FORMAT_R5G5B5A1
|-
| 4
| FORMAT_R4G4B4A4
|-
| 0xFFFFFFFF
| FORMAT_UNIMPORTABLE
|}

This is the same mapping as used for the [[GPU/External_Registers#Framebuffer_color_formats|GPU framebuffer color formats]].

== AppletPos ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| -1
| POS_NONE
|-
| 0
| POS_APP
|-
| 1
| POS_APPLIB
|-
| 2
| POS_SYS
|-
| 3
| POS_SYSLIB
|-
| 4
| POS_RESIDENT
|}

== QueryReply ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| REPLY_REJECT
|-
| 1
| REPLY_ACCEPT
|-
| 2
| REPLY_LATER
|}

== Notification ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| NOTIFICATION_NONE
|-
| 1
| NOTIFICATION_HOME_BUTTON_1
|-
| 2
| NOTIFICATION_HOME_BUTTON_2
|-
| 3
| NOTIFICATION_SLEEP_QUERY
|-
| 4
| NOTIFICATION_SLEEP_CANCELED_BY_OPEN
|-
| 5
| NOTIFICATION_SLEEP_ACCEPTED
|-
| 6
| NOTIFICATION_SLEEP_AWAKE
|-
| 7
| NOTIFICATION_SHUTDOWN
|-
| 8
| NOTIFICATION_POWER_BUTTON_CLICK
|-
| 9
| NOTIFICATION_POWER_BUTTON_CLEAR
|-
| 10
| NOTIFICATION_TRY_SLEEP
|-
| 11
| NOTIFICATION_ORDER_TO_CLOSE
|}

== Command ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| COMMAND_NONE
|-
| 1
| COMMAND_WAKEUP
|-
| 2
| COMMAND_REQUEST
|-
| 3
| COMMAND_RESPONSE
|-
| 4
| COMMAND_EXIT
|-
| 5
| COMMAND_MESSAGE
|-
| 6
| COMMAND_HOME_BUTTON_SINGLE
|-
| 7
| COMMAND_HOME_BUTTON_DOUBLE
|-
| 8
| COMMAND_DSP_SLEEP
|-
| 9
| COMMAND_DSP_WAKEUP
|-
| 10
| COMMAND_WAKEUP_BY_EXIT
|-
| 11
| COMMAND_WAKEUP_BY_PAUSE
|-
| 12
| COMMAND_WAKEUP_BY_CANCEL
|-
| 13
| COMMAND_WAKEUP_BY_CANCELALL
|-
| 14
| COMMAND_WAKEUP_BY_POWER_BUTTON_CLICK
|-
| 15
| COMMAND_WAKEUP_TO_JUMP_HOME
|-
| 16
| COMMAND_REQUEST_FOR_SYS_APPLET
|-
| 17
| COMMAND_WAKEUP_TO_LAUNCH_APPLICATION
|-
| 0x41
| Unknown. [[APT:ReceiveParameter|Received]] by Home Menu during boot when the Home Menu process doesn't terminate properly(svcExitProcess/crash).
|}

== AppletPreparationState ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| NO_PREPARATION
|-
| 1
| PREPARED_TO_LAUNCH_APP
|-
| 2
| PREPARED_TO_CLOSE_APP
|-
| 3
| PREPARED_TO_FORCE_TO_CLOSE_APP
|-
| 4
| PREPARED_TO_PRELOAD_APPLIB
|-
| 5
| PREPARED_TO_LAUNCH_APPLIB
|-
| 6
| PREPARED_TO_CLOSE_APPLIB
|-
| 7
| PREPARED_TO_LAUNCH_SYS
|-
| 8
| PREPARED_TO_CLOSE_SYS
|-
| 9
| PREPARED_TO_PRELOAD_SYSLIB
|-
| 10
| PREPARED_TO_LAUNCH_SYSLIB
|-
| 11
| PREPARED_TO_CLOSE_SYSLIB
|-
| 12
| PREPARED_TO_LAUNCH_RESIDENT
|-
| 13
| PREPARED_TO_LEAVE_RESIDENT
|-
| 14
| PREPARED_TO_DO_HOMEMENU
|-
| 15
| PREPARED_TO_LEAVE_HOMEMENU
|-
| 16
| PREPARED_TO_START_RESIDENT
|-
| 17
| PREPARED_TO_DO_APP_JUMP
|-
| 18
| PREPARED_TO_FORCE_TO_CLOSE_SYS
|-
| 19
| PREPARED_TO_LAUNCH_OTHER_SYS
|-
| 20
| PREPARED_TO_JUMP_TO_APP
|}

== StartupArgumentType ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| STARTUP_ARGUMENT_TYPE_OTHER_APP
|-
| 1
| STARTUP_ARGUMENT_TYPE_RESTART
|-
| 2
| STARTUP_ARGUMENT_TYPE_OTHER_MEDIA
|}

== CaptureBufferInfo ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| u32, Size
|-
| 0x4
| 0x1
| u8, 3D (0 = not 3D, 1 = 3D)
|-
| 0x5
| 0x3
| Reserved
|-
| 0x8
| 0x4
| Main Screen Left Offset
|-
| 0xC
| 0x4
| Main Screen Right Offset
|-
| 0x10
| 0x4
| Main Screen [[NS_and_APT_Services#DisplayBufferMode|DisplayBufferMode]]
|-
| 0x14
| 0x4
| Sub Screen Left Offset
|-
| 0x18
| 0x4
| Sub Screen Right Offset
|-
| 0x1C
| 0x4
| Sub Screen [[NS_and_APT_Services#DisplayBufferMode|DisplayBufferMode]]
|}

==WirelessRebootInfo==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x6
| Host MAC address.
|-
| 0x6
| 0x9
| WirelessRebootPassphrase
|-
| 0xF
| 0x1
| Uninitialized
|}

This is [[NSS:SetWirelessRebootInfo|setup]] by the dlplay system-application, before launching the DLP-child which can then use [[APT:GetWirelessRebootInfo]]. The MAC address and passphrase is used for connecting to the host by the DLP-child. See also [[DLP_Services|here]].

="APT:A" Service=
This was added with [[7.0.0-13|7.0.0-X]]. Official apps built with the CTRSDK for system-version >=[[7.0.0-13|7.0.0-X]] normally use the "APT:A" service instead of "APT:U". Those processes also have "APT:A" instead of "APT:U" in the service-access-control. It's unknown whether there's anything which is only accessible via "APT:A".

=Applets=
NS module does not verify that the input appID for the APT service cmds are correct for that type of command. For example, a process-launch of a SystemApplet via LibraryApplet commands works fine(minus the launched-process side of APT probably).

==System Applets==
On Old3DS there could only be one applet here(Home Menu, Internet Browser, Friend-List, etc) with programID-high 00040030 running at a time. On Old3DS when directly launching one of these 00040030 applets with Home Menu, the Home Menu process will terminate once the process is launched. On Old3DS when returning to Home Menu from that launched process, the Home Menu process is launched again.

On New3DS the Home Menu process is still running/in-memory, while another system-applet is running. On New3DS it appears that the Home Menu process is terminated+relaunched, when another system-applet terminated without exiting with APT properly.

==Library Applets==
Library applets can be launched by applications and regular applets. These library applets render to the screen(s) when running, etc. For example, this includes swkbd for text input. See the below appIDs in the 0x2XX range, the actual appID used is 0x4XX however.

Input data can be sent to the library applet via the NS [[APT:SendParameter|parameter]] buffer, and/or with shared-memory with a shared-mem handle sent to the library applet. Output data from the library applet can be received by [[APT:ReceiveParameter]], the library applet can also use the specified shared-mem for output too.

=AppIDs=
{| class="wikitable" border="1"
|-
! AppID
! Description
|-
| 0x101
| [[Home Menu]] (menu)
|-
| 0x103
| Alternate Menu
|-
| 0x110
| Camera applet ([[Camera Applet|CtrApp]])
|-
| 0x112
| Friends List applet ([[Friend List|friend]])
|-
| 0x113
| Game Notes applet (Cherry)
|-
| 0x114
| [[Internet Browser]] (spider/SKATER)
|-
| 0x115
| Instruction Manual applet
|-
| 0x116
| [[Notifications]] applet (newslist)
|-
| 0x117
| Miiverse applet (olv)
|-
| 0x118
| [[Miiverse]] posting applet (solv3)
|-
| 0x119
| Amiibo settings (cabinet)
|-
| 0x201
| Software Keyboard (swkbd) (?)
|-
| 0x202
| [[Mii Selector]] (appletEd) (?)
|-
| 0x204
| Photo Selector (PNOTE_AP) (?)
|-
| 0x205
| Sound Selector (SNOTE_AP) (?)
|-
| 0x206
| Error Display ([[ErrDisp|error]]) (?)
|-
| 0x207
| eShop applet ([[EShop#NS_eShop_application_parameters|mint]]) (?)
|-
| 0x208
| Circle Pad Pro Calibrator ([[Extrapad_Applet|extrapad]]) (?)
|-
| 0x209
| Notepad (memolib) (?)
|-
| 0x300
| Application
|-
| 0x301
| eShop (tiger)
|-
| 0x401
| Software Keyboard (swkbd)
|-
| 0x402
| Mii Selector (appletEd)
|-
| 0x404
| Photo Selector (PNOTE_AP)
|-
| 0x405
| Sound Selector (SNOTE_AP)
|-
| 0x406
| Error Display (error)
|-
| 0x407
| eShop applet (mint)
|-
| 0x408
| Circle Pad Pro Calibrator ([[Extrapad_Applet|extrapad]])
|-
| 0x409
| Notepad (memolib)
|-
| 0xF10
| ProgramID: 0004003000008900.
|-
| 0xF11
| ProgramID: 000400000FFFFD00.
|-
| 0xF12
| ProgramID: 000400000FFFFC00.
|-
| 0xF13
| ProgramID: 000400000FFFFB00.
|-
| 0xF14
| ProgramID: 000400000FFFF900.
|-
| 0xF15
| ProgramID: 000400000FFFF800.
|-
| 0xF16
| ProgramID: 000400000FFFF700.
|-
| 0xF17
| ProgramID: 000400000FFFF600.
|-
| 0xF18
| ProgramID: 000400000FFFF500.
|}

These AppIDs are all for NAND titles, except for 0x300. AppIDs in the 0x1XX range are applets(programID-high 00040030), and the AppIDs in the 0x2XX range are "system libraries"(programID-high 00040030). The 0xFXX AppID range is for development NAND applications, these are not available for retail.

Note that at some point the total AppID entry count was changed from 28 to 27.

NS and APT Services

2017-08-03T17:12:25Z

Phijor: Add links to system and libray applets

[[Category:Services]]
The NS ('''N'''intendo User Interface '''S'''hell) system module is the first module launched from a CTR-NAND title after the [[FIRM]] processes are loaded (also see [[Bootloader]]). This module is launched by the pm process, with the titleID loaded from NS state(hard-coded TID initialized during applet TID-array initialization). NS first launches [[ErrDisp]], then the menu. On retail the menu TID is loaded from NS state, while on dev/debug the menu TID is loaded from [[Config_Savegame|config]]. On dev-units if the menu TID block doesn't exist in [[Config_Savegame|config]], NS will attempt to launch the alternate menu instead. The TID of the launched menu is then written to [[Configuration Memory|ACTIVEMENUTID]]. NS uses [[PMApp:LaunchTitle|pm:app]] to launch titles.

NS will not trigger the [[ErrDisp|fatal-error]] screen when launching the regular/alternate menu fails.

Like home menu NS is constantly running while the system is in 3DS-mode. When attempting to return to home-menu when the home-menu process isn't running(like when the process terminated/crashed), NS will trigger a [[ErrDisp|fatal]] error.

= Alternate menu =
When launching the regular menu fails, NS will then attempt to launch the alternate menu. This title could be used as a recovery process, however it's normally not used after the factory.

At the factory for all 3DS systems, [[3DS Development Unit GUI#Test Menu|Test Menu]] is installed with this TID. On retail this title is eventually deleted during [[Factory Setup]].

= Auto-boot =
After [[PMApp:GetFIRMLaunchParams|loading]] [[FIRM]] params and prior to launching [[ErrDisp]]/Home Menu, NS handles auto-booting titles. The same code called by [[APT:Reboot]] is used for launching FIRM here. When the [[Configuration_Memory|UPDATEFLAG]] is set, NS will launch SAFE_MODE_FIRM with the application titleID set to the [[System_Settings#System_Updater|System Updater]] titleID for this region. When the UPDATEFLAG is not set, NS can auto-boot the following titles as well if [[Configuration_Memory|0x1FF80016]] bit0 is set.

When bit1 and bit2 are value zero in [[Configuration_Memory|0x1FF80016]], NS will [[NSS:LaunchFIRM|launch]] the title specified by the [[FIRM]] parameters if the title-info is set. This FIRM launch is done after launching [[ErrDisp]] and Home Menu. Otherwise when [[Configuration_Memory|0x1FF80016]] is value 2 and the output u8 from [[PTM|PTMSYSM]] command 0x08140000 is value 0, NS will boot the title specified from the TWL TLNC block from FIRMparams+0x300. This is the same TLNC block which DSi titles wrote to RAM+0x300 for launching other titles via the launcher title. When handling the TLNC block, NS will boot the 3DS System Settings title when the TLNC titleID is the DSi System Settings titleID(the region field in the TLNC TID is not checked/used). When the TLNC titleID is not System Settings, NS will convert the input DSi titleID-high to the 3DS TWL titleID-high(tidhigh = (TLNCtidhigh & 0x7FFF) | 0x48000), then launch TWL_FIRM to run the title. NS does not support launching from gamecard via TLNC.

= NS Workaround =
A "ns_workaround" was [[5.1.0-11|added]] in NS to workaround the flaw added with [[5.0.0-11]]. When NS is loading before launching any ARM11 processes and certain [[Configuration Memory]] fields are set, NS will launch [[Application_Manager_Services|AM]] then use command [[AM:InstallNATIVEFIRM]]. NS will then execute the code called by [[APT:StartNewestHomeMenu]], the code related to APT:PrepareToStartNewestHomeMenu is not executed here.

NS will only execute this code-path when [[Configuration Memory|0x1FF80016]] is value zero, when KERNEL_VERSIONMAJOR is value 2, and when KERNEL_VERSIONMINOR is less than 35. Therefore, this code-path is only executed when the running NATIVE_FIRM version is prior to [[5.0.0-11]].

= NS Service "ns:s" =
{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Description
|-
| 0x000100C0
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:LaunchFIRM|LaunchFIRM]]
|-
| 0x000200C0
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:LaunchTitle|LaunchTitle]]
|-
| 0x00030000
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:TerminateApplication|TerminateApplication]]
|-
| 0x00040040
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:TerminateProcess|TerminateProcess]]
|-
| 0x000500C0
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:LaunchApplicationFIRM|LaunchApplicationFIRM]]
|-
| 0x00060042
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:SetWirelessRebootInfo|SetWirelessRebootInfo]]
|-
| 0x00070042
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:CardUpdateInitialize|CardUpdateInitialize]]
|-
| 0x00080000
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:CardUpdateShutdown|CardUpdateShutdown]]
|-
| 0x00090000
| [[1.0.0-0]] - [[2.0.0-2]]
| Gamecard system update related.
|-
| 0x000A0000
| [[1.0.0-0]] - [[2.0.0-2]]
| Gamecard system update related.
|-
| 0x000B0000
| [[1.0.0-0]] - [[2.0.0-2]]
| Gamecard system update related.
|-
| 0x000C0000
| [[1.0.0-0]] - [[2.0.0-2]]
| Gamecard system update related.
|-
| 0x000D0140
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:SetTWLBannerHMAC|SetTWLBannerHMAC]]
|-
| 0x000E0000
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:ShutdownAsync|ShutdownAsync]]
|-
| 0x000F0000
| [[1.0.0-0]] - [[2.0.0-2]]
| This calls [[APT:AppletUtility]] with fixed input params.
|-
| 0x00100180
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:RebootSystem|RebootSystem]]
|-
| 0x00110100
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:TerminateTitle|TerminateTitle]]
|-
| 0x001200C0
| ?
| [[NSS:SetApplicationCpuTimeLimit|SetApplicationCpuTimeLimit]]
|-
| 0x00130000
| ?
| ?
|-
| 0x00140042
| ?
| ?
|-
| 0x00150140
| ?
| [[NSS:LaunchApplication|LaunchApplication]]
|-
| 0x00160000
| [[8.0.0-18]]
| [[NSS:RebootSystemClean|RebootSystemClean]]
|}

The maximum sessions that can be used with this service is two, therefore only two processes can use this service at the same time.

=NS Power Service "ns:p"=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010040
| [[NSP:RebootSystem|RebootSystem]]
|-
| 0x00020000
| [[NSS:ShutdownAsync|ShutdownAsync]]
|}

This was added with [[3.0.0-5]]. The PTM sysmodule connects to this service, and syncs whenever [[PTM|ptm:s GetShellState()]] changes.

=NS Service "ns:c"=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010100
| ?
|-
| 0x00020100
| ?
|}

This was added with [[5.0.0-11]], it's unknown what this is used for.

=APT Services=
{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Accessible with APT:U
! Description
|-
| 0x00010040
|
| Yes
| [[APT:GetLockHandle|GetLockHandle]]
|-
| 0x00020080
|
| See [[APT:Initialize|here]].
| [[APT:Initialize|Initialize]]
|-
| 0x00030040
|
| Yes
| [[APT:Enable|Enable]]
|-
| 0x00040040
|
| Yes
| [[APT:Finalize|Finalize]]
|-
| 0x00050040
|
| Yes
| [[APT:GetAppletManInfo|GetAppletManInfo]]
|-
| 0x00060040
|
| Yes
| [[APT:GetAppletInfo|GetAppletInfo]]
|-
| 0x00070000
|
| Yes
| [[APT:GetLastSignaledAppletId|GetLastSignaledAppletId]]
|-
| 0x00080000
|
| Yes
| [[APT:CountRegisteredApplet|CountRegisteredApplet]]
|-
| 0x00090040
|
| Yes
| [[APT:IsRegistered|IsRegistered]]
|-
| 0x000A0040
|
| Yes
| [[APT:GetAttribute|GetAttribute]]
|-
| 0x000B0040
|
| Yes
| [[APT:InquireNotification|InquireNotification]]
|-
| 0x000C0104
|
| Yes
| [[APT:SendParameter|SendParameter]]
|-
| 0x000D0080
|
| Yes
| [[APT:ReceiveParameter|ReceiveParameter]]
|-
| 0x000E0080
|
| Yes
| [[APT:GlanceParameter|GlanceParameter]]
|-
| 0x000F0100
|
| Yes
| [[APT:CancelParameter|CancelParameter]]
|-
| 0x001000C2
|
| Yes
| [[APT:DebugFunc|DebugFunc]]
|-
| 0x001100C0
|
| Yes
| [[APT:MapProgramIdForDebug|MapProgramIdForDebug]]
|-
| 0x00120040
|
| Yes
| [[APT:SetHomeMenuAppletIdForDebug|SetHomeMenuAppletIdForDebug]]
|-
| 0x00130000
|
| Yes
| [[APT:GetPreparationState|GetPreparationState]]
|-
| 0x00140040
|
| Yes
| [[APT:SetPreparationState|SetPreparationState]]
|-
| 0x00150140
|
| No
| [[APT:PrepareToStartApplication|PrepareToStartApplication]]
|-
| 0x00160040
|
| Yes
| [[APT:PreloadLibraryApplet|PreloadLibraryApplet]]
|-
| 0x00170040
|
| Yes
| [[APT:FinishPreloadingLibraryApplet|FinishPreloadingLibraryApplet]]
|-
| 0x00180040
|
| Yes
| [[APT:PrepareToStartLibraryApplet|PrepareToStartLibraryApplet]]
|-
| 0x00190040
|
| Yes
| [[APT:PrepareToStartSystemApplet|PrepareToStartSystemApplet]]
|-
| 0x001A0000
|
| Yes
| [[APT:PrepareToStartNewestHomeMenu|PrepareToStartNewestHomeMenu]]
|-
| 0x001B00C4
|
| Yes
| [[APT:StartApplication|StartApplication]]
|-
| 0x001C0000
|
| Yes
| [[APT:WakeupApplication|WakeupApplication]]
|-
| 0x001D0000
|
| Yes
| [[APT:CancelApplication|CancelApplication]]
|-
| 0x001E0084
|
| Yes
| [[APT:StartLibraryApplet|StartLibraryApplet]]
|-
| 0x001F0084
|
| Yes
| [[APT:StartSystemApplet|StartSystemApplet]]
|-
| 0x00200044
|
| Yes
| [[APT:StartNewestHomeMenu|StartNewestHomeMenu]]
|-
| 0x00210000
|
| No
| [[APT:OrderToCloseApplication|OrderToCloseApplication]]
|-
| 0x00220040
|
| Yes
| [[APT:PrepareToCloseApplication|PrepareToCloseApplication]]
|-
| 0x00230040
|
| Yes
| [[APT:PrepareToJumpToApplication|PrepareToJumpToApplication]]
|-
| 0x00240044
|
| Yes
| [[APT:JumpToApplication|JumpToApplication]]
|-
| 0x002500C0
|
| Yes
| [[APT:PrepareToCloseLibraryApplet|PrepareToCloseLibraryApplet]]
|-
| 0x00260000
|
| Yes
| [[APT:PrepareToCloseSystemApplet|PrepareToCloseSystemApplet]]
|-
| 0x00270044
|
| Yes
| [[APT:CloseApplication|CloseApplication]]
|-
| 0x00280044
|
| Yes
| [[APT:CloseLibraryApplet|CloseLibraryApplet]]
|-
| 0x00290044
|
| Yes
| [[APT:CloseSystemApplet|CloseSystemApplet]]
|-
| 0x002A0000
|
| Yes
| [[APT:OrderToCloseSystemApplet|OrderToCloseSystemApplet]]
|-
| 0x002B0000
|
| Yes
| [[APT:PrepareToJumpToHomeMenu|PrepareToJumpToHomeMenu]]
|-
| 0x002C0044
|
| Yes
| [[APT:JumpToHomeMenu|JumpToHomeMenu]]
|-
| 0x002D0000
|
| Yes
| [[APT:PrepareToLeaveHomeMenu|PrepareToLeaveHomeMenu]]
|-
| 0x002E0044
|
| Yes
| [[APT:LeaveHomeMenu|LeaveHomeMenu]]
|-
| 0x002F0040
|
| Yes
| [[APT:PrepareToLeaveResidentApplet|PrepareToLeaveResidentApplet]]
|-
| 0x00300044
|
| Yes
| [[APT:LeaveResidentApplet|LeaveResidentApplet]]
|-
| 0x00310100
|
| Yes
| [[APT:PrepareToDoApplicationJump|PrepareToDoApplicationJump]]
|-
| 0x00320084
|
| Yes
| [[APT:DoApplicationJump|DoApplicationJump]]
|-
| 0x00330000
|
| Yes
| [[APT:GetProgramIdOnApplicationJump|GetProgramIdOnApplicationJump]]
|-
| 0x00340084
|
| Yes
| [[APT:SendDeliverArg|SendDeliverArg]]
|-
| 0x00350080
|
| Yes
| [[APT:ReceiveDeliverArg|ReceiveDeliverArg]]
|-
| 0x00360040
|
| Yes
| [[APT:LoadSysMenuArg|LoadSysMenuArg]]
|-
| 0x00370042
|
| Yes
| [[APT:StoreSysMenuArg|StoreSysMenuArg]]
|-
| 0x00380040
|
| Yes
| [[APT:PreloadResidentApplet|PreloadResidentApplet]]
|-
| 0x00390040
|
| Yes
| [[APT:PrepareToStartResidentApplet|PrepareToStartResidentApplet]]
|-
| 0x003A0044
|
| Yes
| [[APT:StartResidentApplet|StartResidentApplet]]
|-
| 0x003B0040
|
| Yes
| [[APT:CancelLibraryApplet|CancelLibraryApplet]]
|-
| 0x003C0042
|
| Yes
| [[APT:SendDspSleep|SendDspSleep]]
|-
| 0x003D0042
|
| Yes
| [[APT:SendDspWakeUp|SendDspWakeUp]]
|-
| 0x003E0080
|
| Yes
| [[APT:ReplySleepQuery|ReplySleepQuery]]
|-
| 0x003F0040
|
| Yes
| [[APT:ReplySleepNotificationComplete|ReplySleepNotificationComplete]]
|-
| 0x00400042
|
| Yes
| [[APT:SendCaptureBufferInfo|SendCaptureBufferInfo]]
|-
| 0x00410040
|
| Yes
| [[APT:ReceiveCaptureBufferInfo|ReceiveCaptureBufferInfo]]
|-
| 0x00420080
|
| Yes
| [[APT:SleepSystem|SleepSystem]]
|-
| 0x00430040
|
| Yes
| [[APT:NotifyToWait|NotifyToWait]]
|-
| 0x00440000
|
| Yes
| [[APT:GetSharedFont|GetSharedFont]]
|-
| 0x00450040
|
| Yes
| [[APT:GetWirelessRebootInfo|GetWirelessRebootInfo]]
|-
| 0x00460104
|
| Yes
| [[APT:Wrap|Wrap]]
|-
| 0x00470104
|
| Yes
| [[APT:Unwrap|Unwrap]]
|-
| 0x00480100
|
| No
| [[APT:GetProgramInfo|GetProgramInfo]]
|-
| 0x00490180
|
| No
| [[APT:Reboot|Reboot]]
|-
| 0x004A0040
|
| Yes
| [[APT:GetCaptureInfo|GetCaptureInfo]]
|-
| 0x004B00C2
|
| Yes
| [[APT:AppletUtility|AppletUtility]]
|-
| 0x004C0000
|
| Yes
| [[APT:SetFatalErrDispMode|SetFatalErrDispMode]]
|-
| 0x004D0080
|
| Yes
| [[APT:GetAppletProgramInfo|GetAppletProgramInfo]]
|-
| 0x004E0000
|
| Yes
| [[APT:HardwareResetAsync|HardwareResetAsync]]
|-
| 0x004F0080
| [[2.2.0-X]]
| Yes
| [[APT:SetApplicationCpuTimeLimit|SetApplicationCpuTimeLimit]]
|-
| 0x00500040
| [[2.2.0-X]]
| Yes
| [[APT:GetApplicationCpuTimeLimit|GetApplicationCpuTimeLimit]]
|-
| 0x00510080
| [[3.0.0-5]]
| Yes
| [[APT:GetStartupArgument|GetStartupArgument]]
|-
| 0x00520104
| [[4.0.0-7]]
| Yes
| [[APT:Wrap1|Wrap1]]
|-
| 0x00530104
| [[4.0.0-7]]
| Yes
| [[APT:Unwrap1|Unwrap1]]
|-
| 0x00540040
| [[5.0.0-11]]
| ?
| ?
|-
| 0x00550040
| [[7.0.0-13]]
| Yes
| [[APT:SetScreencapPostPermission|SetScreencapPostPermission]]
|-
| 0x00560000
| [[7.0.0-13]]
| Yes
| [[APT:GetScreencapPostPermission|GetScreencapPostPermission]]
|-
| 0x00570044
| [[7.0.0-13]]
| ?
| [[APT:WakeupApplication2|WakeupApplication2]]
|-
| 0x00580002
| [[7.0.0-13]]
| Yes
| [[APT:GetProgramID|GetProgramID]]
|-
| 0x01010000
| [[8.0.0-18]]
| Yes
| [[APT:CheckNew3DSApp|CheckNew3DSApp]]
|-
| 0x01020000
| [[8.0.0-18]]
| Yes
| [[APT:CheckNew3DS|CheckNew3DS]]
|-
| 0x01030000
| [[8.0.0-18]]
| Yes
| This writes an output u8 to cmdreply[2], the value is determined by checking various NS internal state + whether this is a New3DS.
The normal output seems to be value 0x2. Forcing this value to 0x1 causes New3DS HID usage(via ir:USER) in Smash Bros to be disabled.
|-
| 0x01040000
| [[8.0.0-18]]
| ?
| [[APT:IsStandardMemoryLayout|IsStandardMemoryLayout]]
|-
| 0x01050100
| [[10.4.0-29]]
| ?
| [[APT:IsTitleAllowed|IsTitleAllowed]]
|}

These "APT:U" and "APT:S" NS services can handle launching titles/"applets", these services handle signaling for home/power button as well. Only one session for either APT service can be open at a time, normally processes close the service handle immediately once finished using the service. The commands for APT:U and APT:S are exactly the same, however certain commands are only accessible with APT:S(NS module will call [[SVC|svcBreak]] when the command isn't accessible).

Applets returning to home-menu first use commands APT:PrepareToJumpToHomeMenu and APT:JumpToHomeMenu, followed by these commands to launch home-menu: [[APT:PrepareToStartSystemApplet]] and [[APT:StartSystemApplet]]. [[APT:PrepareToStartSystemApplet]] and [[APT:StartSystemApplet]] are also used for launching the [[Internet Browser]], the camera applet, etc.

Processes launch applications via home-menu, not directly with [[APT:PrepareToStartApplication]] and [[APT:StartApplication]]. Regular applications can't directly launch applications since [[APT:StartApplication]] launches the process without terminating the currently running application.

APT:PrepareToDoApplicationJump and APT:DoApplicationJump are used by applications, for launching native/<non-NATIVE_FIRM> applications. These commands notify Home Menu that title launching needs done, Home Menu does the actual title launching via NS commands.

== AppletAttr ==
{| class="wikitable" border="1"
|-
! Bits
! Description
|-
| 0-2
| [[NS_and_APT_Services#AppletPos|AppletPos]]
|-
| 3
| Manually Acquire/Release GPU Rights
|-
| 4
| Manually Acquire/Release DSP Rights
|-
| 5
| ?
|}

== DisplayBufferMode ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| FORMAT_R8G8B8A8
|-
| 1
| FORMAT_R8G8B8
|-
| 2
| FORMAT_R5G6B5
|-
| 3
| FORMAT_R5G5B5A1
|-
| 4
| FORMAT_R4G4B4A4
|-
| 0xFFFFFFFF
| FORMAT_UNIMPORTABLE
|}

This is the same mapping as used for the [[GPU/External_Registers#Framebuffer_color_formats|GPU framebuffer color formats]].

== AppletPos ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| -1
| POS_NONE
|-
| 0
| POS_APP
|-
| 1
| POS_APPLIB
|-
| 2
| POS_SYS
|-
| 3
| POS_SYSLIB
|-
| 4
| POS_RESIDENT
|}

== QueryReply ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| REPLY_REJECT
|-
| 1
| REPLY_ACCEPT
|-
| 2
| REPLY_LATER
|}

== Notification ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| NOTIFICATION_NONE
|-
| 1
| NOTIFICATION_HOME_BUTTON_1
|-
| 2
| NOTIFICATION_HOME_BUTTON_2
|-
| 3
| NOTIFICATION_SLEEP_QUERY
|-
| 4
| NOTIFICATION_SLEEP_CANCELED_BY_OPEN
|-
| 5
| NOTIFICATION_SLEEP_ACCEPTED
|-
| 6
| NOTIFICATION_SLEEP_AWAKE
|-
| 7
| NOTIFICATION_SHUTDOWN
|-
| 8
| NOTIFICATION_POWER_BUTTON_CLICK
|-
| 9
| NOTIFICATION_POWER_BUTTON_CLEAR
|-
| 10
| NOTIFICATION_TRY_SLEEP
|-
| 11
| NOTIFICATION_ORDER_TO_CLOSE
|}

== Command ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| COMMAND_NONE
|-
| 1
| COMMAND_WAKEUP
|-
| 2
| COMMAND_REQUEST
|-
| 3
| COMMAND_RESPONSE
|-
| 4
| COMMAND_EXIT
|-
| 5
| COMMAND_MESSAGE
|-
| 6
| COMMAND_HOME_BUTTON_SINGLE
|-
| 7
| COMMAND_HOME_BUTTON_DOUBLE
|-
| 8
| COMMAND_DSP_SLEEP
|-
| 9
| COMMAND_DSP_WAKEUP
|-
| 10
| COMMAND_WAKEUP_BY_EXIT
|-
| 11
| COMMAND_WAKEUP_BY_PAUSE
|-
| 12
| COMMAND_WAKEUP_BY_CANCEL
|-
| 13
| COMMAND_WAKEUP_BY_CANCELALL
|-
| 14
| COMMAND_WAKEUP_BY_POWER_BUTTON_CLICK
|-
| 15
| COMMAND_WAKEUP_TO_JUMP_HOME
|-
| 16
| COMMAND_REQUEST_FOR_SYS_APPLET
|-
| 17
| COMMAND_WAKEUP_TO_LAUNCH_APPLICATION
|-
| 0x41
| Unknown. [[APT:ReceiveParameter|Received]] by Home Menu during boot when the Home Menu process doesn't terminate properly(svcExitProcess/crash).
|}

== AppletPreparationState ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| NO_PREPARATION
|-
| 1
| PREPARED_TO_LAUNCH_APP
|-
| 2
| PREPARED_TO_CLOSE_APP
|-
| 3
| PREPARED_TO_FORCE_TO_CLOSE_APP
|-
| 4
| PREPARED_TO_PRELOAD_APPLIB
|-
| 5
| PREPARED_TO_LAUNCH_APPLIB
|-
| 6
| PREPARED_TO_CLOSE_APPLIB
|-
| 7
| PREPARED_TO_LAUNCH_SYS
|-
| 8
| PREPARED_TO_CLOSE_SYS
|-
| 9
| PREPARED_TO_PRELOAD_SYSLIB
|-
| 10
| PREPARED_TO_LAUNCH_SYSLIB
|-
| 11
| PREPARED_TO_CLOSE_SYSLIB
|-
| 12
| PREPARED_TO_LAUNCH_RESIDENT
|-
| 13
| PREPARED_TO_LEAVE_RESIDENT
|-
| 14
| PREPARED_TO_DO_HOMEMENU
|-
| 15
| PREPARED_TO_LEAVE_HOMEMENU
|-
| 16
| PREPARED_TO_START_RESIDENT
|-
| 17
| PREPARED_TO_DO_APP_JUMP
|-
| 18
| PREPARED_TO_FORCE_TO_CLOSE_SYS
|-
| 19
| PREPARED_TO_LAUNCH_OTHER_SYS
|-
| 20
| PREPARED_TO_JUMP_TO_APP
|}

== StartupArgumentType ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| STARTUP_ARGUMENT_TYPE_OTHER_APP
|-
| 1
| STARTUP_ARGUMENT_TYPE_RESTART
|-
| 2
| STARTUP_ARGUMENT_TYPE_OTHER_MEDIA
|}

== CaptureBufferInfo ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| u32, Size
|-
| 0x4
| 0x1
| u8, 3D (0 = not 3D, 1 = 3D)
|-
| 0x5
| 0x3
| Reserved
|-
| 0x8
| 0x4
| Main Screen Left Offset
|-
| 0xC
| 0x4
| Main Screen Right Offset
|-
| 0x10
| 0x4
| Main Screen [[NS_and_APT_Services#DisplayBufferMode|DisplayBufferMode]]
|-
| 0x14
| 0x4
| Sub Screen Left Offset
|-
| 0x18
| 0x4
| Sub Screen Right Offset
|-
| 0x1C
| 0x4
| Sub Screen [[NS_and_APT_Services#DisplayBufferMode|DisplayBufferMode]]
|}

==WirelessRebootInfo==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x6
| Host MAC address.
|-
| 0x6
| 0x9
| WirelessRebootPassphrase
|-
| 0xF
| 0x1
| Uninitialized
|}

This is [[NSS:SetWirelessRebootInfo|setup]] by the dlplay system-application, before launching the DLP-child which can then use [[APT:GetWirelessRebootInfo]]. The MAC address and passphrase is used for connecting to the host by the DLP-child. See also [[DLP_Services|here]].

="APT:A" Service=
This was added with [[7.0.0-13|7.0.0-X]]. Official apps built with the CTRSDK for system-version >=[[7.0.0-13|7.0.0-X]] normally use the "APT:A" service instead of "APT:U". Those processes also have "APT:A" instead of "APT:U" in the service-access-control. It's unknown whether there's anything which is only accessible via "APT:A".

=Applets=
NS module does not verify that the input appID for the APT service cmds are correct for that type of command. For example, a process-launch of a SystemApplet via LibraryApplet commands works fine(minus the launched-process side of APT probably).

==System Applets==
On Old3DS there could only be one applet here(Home Menu, Internet Browser, Friend-List, etc) with programID-high 00040030 running at a time. On Old3DS when directly launching one of these 00040030 applets with Home Menu, the Home Menu process will terminate once the process is launched. On Old3DS when returning to Home Menu from that launched process, the Home Menu process is launched again.

On New3DS the Home Menu process is still running/in-memory, while another system-applet is running. On New3DS it appears that the Home Menu process is terminated+relaunched, when another system-applet terminated without exiting with APT properly.

==Library Applets==
Library applets can be launched by applications and regular applets. These library applets render to the screen(s) when running, etc. For example, this includes swkbd for text input. See the below appIDs in the 0x2XX range, the actual appID used is 0x4XX however.

Input data can be sent to the library applet via the NS [[APT:SendParameter|parameter]] buffer, and/or with shared-memory with a shared-mem handle sent to the library applet. Output data from the library applet can be received by [[APT:ReceiveParameter]], the library applet can also use the specified shared-mem for output too.

=AppIDs=
{| class="wikitable" border="1"
|-
! AppID
! Description
|-
| 0x101
| [[Home Menu]] (menu)
|-
| 0x103
| Alternate Menu
|-
| 0x110
| Camera applet ([[Camera Applet|CtrApp]])
|-
| 0x112
| Friends List applet ([[Friend List|friend]])
|-
| 0x113
| Game Notes applet (Cherry)
|-
| 0x114
| [[Internet Browser]] (spider/SKATER)
|-
| 0x115
| Instruction Manual applet
|-
| 0x116
| [[Notifications]] applet (newslist)
|-
| 0x117
| Miiverse applet (olv)
|-
| 0x118
| [[Miiverse]] posting applet (solv3)
|-
| 0x119
| Amiibo settings (cabinet)
|-
| 0x201
| Software Keyboard (swkbd) (?)
|-
| 0x202
| Mii Selector (appletEd) (?)
|-
| 0x204
| Photo Selector (PNOTE_AP) (?)
|-
| 0x205
| Sound Selector (SNOTE_AP) (?)
|-
| 0x206
| Error Display ([[ErrDisp|error]]) (?)
|-
| 0x207
| eShop applet ([[EShop#NS_eShop_application_parameters|mint]]) (?)
|-
| 0x208
| Circle Pad Pro Calibrator ([[Extrapad_Applet|extrapad]]) (?)
|-
| 0x209
| Notepad (memolib) (?)
|-
| 0x300
| Application
|-
| 0x301
| eShop (tiger)
|-
| 0x401
| Software Keyboard (swkbd)
|-
| 0x402
| Mii Selector (appletEd)
|-
| 0x404
| Photo Selector (PNOTE_AP)
|-
| 0x405
| Sound Selector (SNOTE_AP)
|-
| 0x406
| Error Display (error)
|-
| 0x407
| eShop applet (mint)
|-
| 0x408
| Circle Pad Pro Calibrator ([[Extrapad_Applet|extrapad]])
|-
| 0x409
| Notepad (memolib)
|-
| 0xF10
| ProgramID: 0004003000008900.
|-
| 0xF11
| ProgramID: 000400000FFFFD00.
|-
| 0xF12
| ProgramID: 000400000FFFFC00.
|-
| 0xF13
| ProgramID: 000400000FFFFB00.
|-
| 0xF14
| ProgramID: 000400000FFFF900.
|-
| 0xF15
| ProgramID: 000400000FFFF800.
|-
| 0xF16
| ProgramID: 000400000FFFF700.
|-
| 0xF17
| ProgramID: 000400000FFFF600.
|-
| 0xF18
| ProgramID: 000400000FFFF500.
|}

These AppIDs are all for NAND titles, except for 0x300. AppIDs in the 0x1XX range are applets(programID-high 00040030), and the AppIDs in the 0x2XX range are "system libraries"(programID-high 00040030). The 0xFXX AppID range is for development NAND applications, these are not available for retail.

Note that at some point the total AppID entry count was changed from 28 to 27.

Mii Selector

2017-08-03T16:56:03Z

Phijor: Created page with "with is the library applet used to select a Mii. Internally it is called ''appletEd''. =Launching the applet= ''appletEd'' can be launched by calling APT:StartLibraryA..."

with is the library applet used to select a [[Mii]]. Internally it is called
''appletEd''.

=Launching the applet=

''appletEd'' can be launched by calling [[APT:StartLibraryApplet]] with
[[NS_and_APT_Services#AppIDs|AppID]] 0x402. It expects a pointer to a
[[#Parameter Buffer|buffer]] of 0x104 bytes to be passed as parameter. It does
not use other ressources, so an invalid [[SVC#typedef_Handle|handle]] of value 0
is expected.

After returning from the applet, [[#Return Buffer|part of the parameter buffer]]
is filled with the data of any selected Mii and some other related values.

=Parameter Buffer=

The applet can be configured to work in a flexible way by setting values in a
0x104 byte long buffer that is passed when launching it.

{| class="wikitable" border="1"
|-
! Index Byte
! Size
! Type
! Name
! Description
|-
| 0x000
| 1
| <code>1*u8</code>
| Cancel button flag
| If set to a nonzero value, a Button labeled ''(B) Cancel'' is displayed at the bottom of the applet.
This allows to cancel the selection of a Mii.
|-
| 0x001
| 1
| <code>1*u8</code>
| Enable Guest Mii selection flag
| If set to a nonzero value, 6 predefined ''Guest Miis'' can be selected on their own page.
|-
| 0x002
| 1
| <code>1*u8</code>
| Show on top screen flag
| If set to a nonzero value, the applet is displayed at the top screen instead of the touchscreen.
|-
| 0x003
| 5
| <code>5*u8</code>
| ''Unknown''
| May be padding to align the following data to a 8-byte boundary.
|-
| 0x008
| 128 (0x80)
| <code>64*u16</code>
| Title
| This is a UTF16-LE[https://en.wikipedia.org/wiki/UTF-16]-encoded, zero-terminated string that is displayed at the top of the applet.
If the first character is set to <code>'\x0000'</code> (null-terminator), a default title is displayed.
|-
| 0x088
| 4
| <code>4*u8</code>
| ''Unknown''
| May be padding.
|-
| 0x08C
| 1
| <code>1*u8</code>
| Show Guest Miis flag
| If set to a nonzero value, the applet initially shows the page where the Guest Miis are located.
Otherwise, it displays the user-created/-imported Miis after launch.
|-
| 0x08D
| 3
| <code>3*u8</code>
| ''Unknown''
| May be padding to align the following data to a 8-byte boundary.
|-
| 0x090
| 4
| <code>1*u32</code>
| Initially selected Mii index
| If set to a value <code>i</code>, the cursor is initially placed on the <code>i+1</code>st Mii in the [[Mii#Mii_Database|Mii database]].
If ''Show Guest Miis'' is set and <code>i</code> is in [0,...,5], the cursor is placed on the <code>i+1</code>st Guest Mii. In any other case a user's personal Mii is selected.
|-
| 0x094
| 6
| <code>6*u8</code>
| Guest Mii whitelist
| For each nonzero byte in this array, the corresponding Guest Mii is made selectable.
Otherwise they are greyed out and can't be selected.
|-
| 0x09A
| 100 (0x64)
| <code>100*u8</code>
| User Mii whitelist
| Like the above, only for the Miis found in the system's database.
A Mii's index in this array corresponds to its index in the system database.
|-
| 0x0FE
| 2
| <code>1*u16</code>
| ''Unknown''
| May be padding to align the following data to a 8-byte boundary.
|-
| 0x100
| 4
| <code>1*u32</code>
| Magic value <code>0x13DE28CF</code> (little Endian)
| Without this value, the applet refuses to display any Miis.
|}

=Return Buffer=

After selecting a Mii or canceling the operation, ''appletEd'' writes 0x84 byte
to the parameter buffer it was passed, starting at offset 0.

{| class="wikitable" border="1"
|-
! Index Byte
! Size
! Type
! Name
! Description
|-
| 0x00
| 4
| <code>1*u32</code>
| Return code
| Set to 1 if the action was canceled, 0 if a Mii was selected.
|-
| 0x04
| 4
| <code>1*u32</code>
| Guest Mii selected flag
| Set to 1 if a Guest Mii was selected, 0 if it was a user Mii.
|-
| 0x08
| 4
| <code>1*u32</code>
| Selected Guest Mii index
| If a Guest Mii was selected, this is set to the value corresponding to its index (i.e. 3 for Guest D).
Set to 0xFFFFFFFF (-1) if a user Mii was selected.
|-
| 0x0C
| 92 (0x5c)
| <code>1*struct mii</code>
| Selected Mii data
| If a Mii was selected, its data is copied here.
The same [[Mii#Mii format|format]] as in the system's Mii database is used.
|-
| 0x68
| 2
| <code>2*u8</code>
| ''Unknown''
| -
|-
| 0x6a
| 2
| <code>1*u16</code>
| Mii data checksum (?)
| This may be a [[Mii#Checksum|checksum]] of the returned Mii data.
|-
| 0x6c
| 24
| <code>12*u16</code>
| Guest Mii name
| The localized name as a UTF16-LE string of a Guest Mii if one was selected, zeroed otherwise.
|}

ERR:Throw

2017-08-01T18:48:31Z

Phijor: Add observed value for FatalErrInfo::Revision Low

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x00010800]
|-
| 1-32
| [[#FatalErrInfo|FatalErrInfo]]
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code
|-
| 1
| Result code
|}

=FatalErrInfo=
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| [[#FatalErrType|FatalErrType]]
|-
| 0x1
| 0x1
| Revision High (0x0 observed)
|-
| 0x2
| 0x2
| Revision Low (0x8436 and 0xCACA observed)
|-
| 0x4
| 0x4
| Result Code
|-
| 0x8
| 0x4
| PC Address
|-
| 0xC
| 0x4
| Process ID
|-
| 0x10
| 0x8
| Title ID [[FS:GetProgramLaunchInfo|placeholder]]
|-
| 0x18
| 0x8
| Applet Title ID [[APT:GetAppletInfo|placeholder]]
|-
| 0x20
| 0x60
| Data (type 3 = [[#Exception|Exception]], type 4 = [[#Failure|Failure]])
|}

==FatalErrType==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| Generic
|-
| 1
| Corrupted
|-
| 2
| Card removed
|-
| 3
| Exception
|-
| 4
| Result Failure
|-
| 5
| Logged
|}

==Exception==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x18
| [[#ExceptionInfo|ExceptionInfo]]
|-
| 0x18
| 0x44
| CpuRegisters (r0-r12, sp, lr, pc, cpsr)
|}

===ExceptionType===
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| Prefetch Abort
|-
| 1
| Data Abort
|-
| 2
| Undefined Exception
|-
| 3
| VFP Exception
|}

===ExceptionInfo===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| [[#ExceptionType|ExceptionType]]
|-
| 0x1
| 0x3
| Padding
|-
| 0x4
| 0x4
| IFSR (Prefetch Abort)/DFSR (Data Abort)
|-
| 0x8
| 0x4
| r15 (Prefetch Abort)/DFAR (Data Abort)
|-
| 0xC
| 0x4
| FPEXC (VFP Exception)
|-
| 0x10
| 0x4
| FPINST (VFP Exception)
|-
| 0x14
| 0x4
| FPINST2 (VFP Exception)
|}

==Failure==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x60
| char*, Message
|}

=Output=
==Generic==
{| class="wikitable" border="1"
|-
! Entry
! Format string
! Format args
|-
| PID
| 0x%08X_0x%08X
| [[#FatalErrInfo|FatalErrInfo]] Title ID
|-
| REV
| %d
| [[#FatalErrInfo|FatalErrInfo]] Revision Low <nowiki>|</nowiki> ([[#FatalErrInfo|FatalErrInfo]] Revision High << 16)
|-
| AID
| 0x%08X_0x%08X
| [[#FatalErrInfo|FatalErrInfo]] Application Title ID
|-
| ADR
| 0x%08X
| [[#FatalErrInfo|FatalErrInfo]] PC Address
|-
| RSL
| 0x%08X
| [[#FatalErrInfo|FatalErrInfo]] Result Code
|-
| Level
| %d
| [[#FatalErrInfo|FatalErrInfo]] Result Code & 0x80000000 ? ([[#FatalErrInfo|FatalErrInfo]] Result Code >> 27) - 0x20 : [[#FatalErrInfo|FatalErrInfo]] Result Code >> 27
|-
| Summary
| %d
| ([[#FatalErrInfo|FatalErrInfo]] Result Code & 0x7E00000) >> 21
|-
| Module
| %d
| ([[#FatalErrInfo|FatalErrInfo]] Result Code & 0x3FC00) >> 10
|-
| Desc
| %d
| [[#FatalErrInfo|FatalErrInfo]] Result Code & 0x3FF
|-
| Datetime
| %04d/%02d/%02d %02d:%02d:%02d
| Current Time
|}

==Corrupted==

Follows the same general output format as Generic, but the bottom screen instead displays the following:

"The System Memory has been damaged.
For help, please contact your local customer support centre. For contact details, check the Operations Manual or visit support.nintendo.com."

==Result Failure==
{| class="wikitable" border="1"
|-
! Entry
! Format string
! Format args
|-
| PID
| 0x%08X_0x%08X
| [[#FatalErrInfo|FatalErrInfo]] Title ID
|-
| REV
| %d
| [[#FatalErrInfo|FatalErrInfo]] Revision Low <nowiki>|</nowiki> ([[#FatalErrInfo|FatalErrInfo]] Revision High << 16)
|-
| AID
| 0x%08X_0x%08X
| [[#FatalErrInfo|FatalErrInfo]] Application Title ID
|-
| RSL
| 0x%08X
| [[#FatalErrInfo|FatalErrInfo]] Result Code
|-
| Level
| %d
| [[#FatalErrInfo|FatalErrInfo]] Result Code & 0x80000000 ? ([[#FatalErrInfo|FatalErrInfo]] Result Code >> 27) - 0x20 : [[#FatalErrInfo|FatalErrInfo]] Result Code >> 27
|-
| Summary
| %d
| ([[#FatalErrInfo|FatalErrInfo]] Result Code & 0x7E00000) >> 21
|-
| Module
| %d
| ([[#FatalErrInfo|FatalErrInfo]] Result Code & 0x3FC00) >> 10
|-
| Desc
| %d
| [[#FatalErrInfo|FatalErrInfo]] Result Code & 0x3FF
|-
| ?
| %.*s
| [[#FatalErrInfo|FatalErrInfo]] Data [[#Failure|Failure]] Message
|-
| Datetime
| %04d/%02d/%02d %02d:%02d:%02d
| Current Time
|}

== Cart Removed ==

No actual error information. Shows the error screen normally shown when pulling a game cart while in DS mode.

Mii

2016-10-11T18:39:04Z

Phijor: Identify specialness-bit and date of creation

Originally [http://wiibrew.org/wiki/Mii_Data created for the Nintendo Wii] (and backported to a selection of DS/i games), the '''Mii''' format was expanded with a larger selection of facial features and a new "copying" permission for the 3DS family, and later implemented as-is on Wii U.

See [[Mii Maker]] for the application chiefly designed to create, edit, delete, and trade Miis or convert them from and to a QR code.

==Mii Database==
Format of the Mii main database '''CFL_DB.dat''', found in [[Extdata#NAND_Shared_Extdata|shared extdata]] archive f0000000b.

{| class="wikitable"
|-
! Offset
! Length
!
|-
| 0x0
| 0x4
| Header "CFOG" (Mii Maker section)
|-
| 0x4
| 0x4
| Header 0x00010000
|-
| 0x8
| 0x23F7
| Array of owned (saved in Mii Maker) Miis. Order in file is unrelated to canonical order in-app.
|-
| 0x23FC
| 0x4
| Header "CFHE"
|-
| 0x23F8
| 0x4
| Header 0xFFFFFFFF
|-
| 0x2400
| 0xA41E
| Array of objects? See chapter
|-
| 0xC81E
| 0x2
| Checksum of all of the above (the first 0xC81E byte). See section [[#Checksum|below]].
|-
| 0xC820
| 0x4
| Header "CFRA" (Invitations section)
|-
| 0xC824
| 0x4
| Header? 0x39000000
|-
| 0xC861
| 0x2B
| Weird padding? 0x00
|-
| 0xC88C
| 0x1C20 (?)
| Array of Miis contributed from games, used for Mii Plaza "invitations" feature. The format isn't that of a full Mii.
|-
| 0xE4AC
| 0x14
| 01 00 [..] 00 D2 74
|-
| 0xE4C0
| 0x3D860
| Empty (00)
|}
When encrypted in QR codes, 4 additional bytes are added. Two null bytes and a CRC-16. It's the exact same CRC-16 as for the Wii blocks on the 0x5e first bytes. It seems that the CRC is ignored, the Mii Maker expecting the result of APT:Unwrap to detect integrity loss.

==CFHE object==

A 0xE-byte long item.

On my database, they're all 0000 0000 0000 0000 0000 FF7F FF7F.

Wild speculation: blacklist of already scanned celebrity (gold) Mii QRs?

Alternative interpretation: FFFF FFFF 0000 0000 0000 0000 0000 is the 1st item; FF7F FF7F 0000 [...] the 2nd, etc;

==Checksum==

The algorithm used to verify the integrity of the database is based on [http://srecord.sourceforge.net/crc16-ccitt.html CRC16-CCITT], though it's an incorrect implementation. It is the same algorithm used to verify [http://wiibrew.org/wiki/Mii_Data#Block_format Mii Data on the Wii].

To obtain the correct value for the checksum, apply the algorithm to the first 0xC81E bytes of the database. This can be done using [https://www.dropbox.com/s/863idp5wmh50c1v/Gold_Mii_Tools.zip?dl=0 FixCRC for Windows]; alternativly a pseudocode implementation of the checksum algorithm is given below:

<source lang="python">
def crc16_CCITTWii(u8[]: data) -> u16:
"""Calculate a checksum of data using the CRC16-CCITT implementation of the Wii

This implementation uses 0x0000 as the starting value, which is different
from what CRC16-CCITT specifies.
"""

# note: a correct implementation of CRC16-CCITT
# would initialize this to 0xffff
u32 crc := 0x0

for byte in data:
# Iterate over every of the 8 bits in byte.
# Begin with the most significant bit. (7, 6, ... , 1, 0)
for bit in 7..0:
# & - binary `and'; <</>> - bitshift left/right; ^ - binary `xor'
crc := (
(crc << 1) | ((byte >> bit) & 0x1)
^ (0x1021 if crc & 0x8000 else 0)
)

for _ in 0..15:
crc := (crc << 1) ^ (0x1021 if crc & 0x8000 else 0)

# only return the lowest 16 bit of crc
return (u16) (crc & 0xffff)

checksum := crc16_CCITTWii(miidb[0:0xc81e]) # checksum over the first 0xc81e bytes
</source>

==Mii format==

Note: 0x18-3B have been copied as-is from [https://www.3dbrew.org/w/index.php?title=Mii_Maker&oldid=11464 the QR code specification], so they're unverified.

{| class="wikitable"
|-
! Offset
! Length
!
|-
| 0x0
| 0x4
| Mii ID (see chapter)
|-
| 0x4
| 0x8
| System ID (identifies owner, for purpose of enforcing editing restrictions and blue pants). Is not tied to the MAC address anymore.
|-
| 0xC
| 0x4
| Specialness and date of creation (big-endian 32bit unsigned integer): Bit 0..27: (bit[0..27] * 2) = date of creation (seconds since 01/01/2010 00:00:00) Bit 31: not set iff Mii is special
|-
| 0x10
| 0x6
| Creator's full MAC
|-
| 0x16
| 0x2
| Padding (0000)
|-
| 0x18
| 0x2
| Bit-mapped: Birthday (4bit-day,5bit-month), Sex, Shirt color, Favorite (0x40 bit at 0x19)
|-
| 0x1A
| 0x14
| UTF-16 Mii Name (10 chars max, 0000 terminated)
|-
| 0x2E
| 0x2
| width & height
|-
| 0x30
| 0x1
| bit 0: disable sharing bit 1-4: face shape bit 5-7: skin color
|-
| 0x31
| 0x1
| bit 0-3: wrinkles bit 4-7: makeup
|-
| 0x32
| 0x1
| hair style
|-
| 0x33
| 0x1
| bit 0-2: hair color bit 3: flip hair
|-
| 0x34
| 0x4
| unknown
|-
| 0x38
| 0x1
| bit 0-4: eyebrow style bit 5-7: eyebrow color
|-
| 0x39
| 0x1
| bit 0-3: eyebrow scale bit 4-6: eyebrow yscale
|-
| 0x3A
| 0x2
| note that the bytes are swapped over (little-endian layout) bit 0-3: eyebrow rotation bit 5-8: eyebrow x spacing bit 9-13: eyebrow y position
|-
| 0x3C
| 0x4
| unknown
|-
| 0x40
| 0x1
| Allow Copying (?) (0D on 0E off 8D on)
|-
| 0x41
| 0x7
| unknown
|-
| 0x48
| 0x14
| UTF-16 Author Name (10 chars max, 0000 terminated)
|}

==Mii ID==
* Byte 0: generally equals 3 (category?)
* Byte 1: 0/1 = copying off/on
* Byte 2, most significant hex digit: position on page (0-9)
* Byte 2, least significant hex digit: page (0-9)
* Byte 3: generally 0x30 (always for user-created ones?)

===Mii categories (pants colors)===

====Special (gold) Miis====
Specialness will override any other color and make the Mii non-editable.

Copying is rumored to have to be disabled.

Zeroed system-id and timestamp?

====Imported (blue) Miis====
Any (non-gold) Mii with a different System ID will appear as a foreign one.

There is also a range of Mii IDs that are always foreign and uneditable, regardless of the System ID:

====Regular (black/red) Miis====
Always editable, since they can only appear as such on the console that created them.

====Personal (red) Mii====
A red Mii that happens to be the first in the file!

==Mii values==
Each of the following values were found with NTR Debugger:
If you want to access the value, grab the given "NTR address" and add 0x08815000.

{| class="wikitable"
|-
! Data
! NTR address
! Variation (hex)
! Notes
|-
| Face style
| 0x894
| 00-0B
| Not ordered as in editor, read below
|-
| Face color
| 0x898
| 00-05
| From top to bottom
|-
| Wrinkles
| 0x89C
| 00-0B
| Same order as displayed in editor
|-
| Makeup
| 0x8A0
| 00-0B
| Same order as displayed in editor
|-
| Hair style
| 0x8A4
| 00-84
| Not ordered as in editor, read below
|-
| Hair color
| 0x8A8
| 00-07
| From top to bottom
|-
| Hair flipped
| 0x8AC
| 1 if true
| From top to bottom
|-
| Eye style
| 0x8B0
| 00-3C
| Not ordered as in editor, read below
|-
| Eyes color
| 0x8B4
| 00-05
| From top to bottom
|-
| Eyes size
| 0x8B8
| 07-00
| Left button increases value.
|-
| Eyes thickness
| 0x8BC
| 06-00
| Left button increases value.
|-
| Eyes rotation
| 0x8C0
| 00-07
|
|-
| Eyes spacing
| 0x8C4
| 00-0C
|
|-
| Eyes height
| 0x8C8
| 00-12
|
|-
| Eyebrows style
| 0x8CC
| 00-18
| Not ordered as in editor, read below
|-
| Eyebrows color
| 0x8D0
| 00-07
| From top to bottom
|-
| Eyebrows size
| 0x8D4
| 08-00
| Left button increases value.
|-
| Eyebrows thickness
| 0x8D8
| 06-00
| Left button increases value.
|-
| Eyebrows rotation
| 0x8DC
| 00-0B
|
|-
| Eyebrows spacing
| 0x8E0
| 00-0C
|
|-
| Eyebrows height
| 0x8E4
| 03-12
| Yup, minimum is 0x03
|-
| Nose style
| 0x8E8
| 00-11
| Not ordered as in editor, read below
|-
| Nose size
| 0x8EC
| 08-00
| Left button increases value.
|-
| Nose height
| 0x8F0
| 00-12
|
|-
| Mouth style
| 0x8F4
| 00-23
| Not ordered as in editor, read below
|-
| Mouth color
| 0x8F8
| 00-04
| From top to bottom.
|-
| Mouth size
| 0x8FC
| 08-00
| Left button increases value.
|-
| Mouth thickness
| 0x900
| 06-00
| Left button increases value.
|-
| Mouth height
| 0x904
| 00-12
|
|-
| Mustache style
| 0x908
| 00-05
| Order like in editor.
|-
| Beard style
| 0x90C
| 00-05
| Order like in editor.
|-
| Mustache/Beard color
| 0x910
| 00-07
| From top to button.
|-
| Mustache size
| 0x914
| 08-00
| Left button increases value.
|-
| Mustache height
| 0x918
| 00-10
|
|-
| Glasses style
| 0x91C
| 00-08
| Order like in editor.
|-
| Glasses color
| 0x920
| 00-05
| From top to bottom
|-
| Glasses size
| 0x924
| 07-00
| Left button increases value.
|-
| Glasses height
| 0x928
| 00-14
|
|-
| Mole enable
| 0x92C
| 1 if enabled, 0 else.
|
|-
| Mole size
| 0x930
| 08-00
| Left button increases value.
|-
| Mole horiz pos
| 0x934
| 00-10
|
|-
| Mole vert pos
| 0x938
| 00-1E
|
|-
| Mii height
| 0x93C
| 00-7F
|
|-
| Mii weight
| 0x940
| 00-7F
|
|-
| Mii name
| 0x944-0x959
| UTF-16
| Terminated with 0x0000. Not updated immediatly?
|-
| Creator's name
| 0x95A-96F
| UTF-16
| Terminated with 0x0000. Not updated immediatly?
|-
| Mii gender
| 0x970
| 0: Male, 1: Female
|
|-
| Birthdate month
| 0x974
| 01-0C
|
|-
| Birthdate day
| 0x978
| 01-1F
|
|-
| Mii shirt color
| 0x97C
| 00-0B
| Ordered like in editor.
|-
| Favorite
| 0x980
| 0: false, 1: true
|
|-
| Allow copy
| 0x981
| 0: false, 1: true
|
|-
| Unused byte?
| 0x982
|
|
|-
| Allow sharing
| 0x983
| 0: true, 1: false
|
|-
| ???
| 0x984-0x98F
| All zero?
|
|-
| ???
| 0x990-0x997
| 4?
|
|}
0x08815998: Same 4 bytes as encrypted Mii: first 4 bits for Mii type, 4 next for number of seconds since 01/01/2010 00:00:00 UTC+3 (should be verified by other country and region 3DS) divided by 2.
0x0881599C: 6 bytes of MAC address of the 3DS that created the Mii.
0x088159A2: 6 unknow uses bytes
0x088159A8: Same 8 bytes as decrypted Mii at 0x04 through 0x0B. Seems NAND specific, kept the same on Miis created on same NAND but different 3DS via System Transfer. Might be a coincidence but the two first bytes are in ID0 folder name in the Nintendo 3DS folder.

===Mapped Editor <-> Hex values===

Most of the values are ordered (left button decreases, right increases, color choices are top to bottom...) but for most "main" part of the UI, where you choose the style of the part being edited, hex values has no correlation with displayed order.
Here is a JSON that can go from a Part, a Page and Position to the right hex value. This is 0 indexed (eg: datas["face"][0][11]).

<nowiki>{
face: [
0x00,0x01,0x08,
0x02,0x03,0x09,
0x04,0x05,0x0a,
0x06,0x07,0x0b
],
hairs: [
[0x21,0x2f,0x28,
0x25,0x20,0x6b,
0x30,0x33,0x37,
0x46,0x2c,0x42],
[0x34,0x32,0x26,
0x31,0x2b,0x1f,
0x38,0x44,0x3e,
0x73,0x4c,0x77],
[0x40,0x51,0x74,
0x79,0x16,0x3a,
0x3c,0x57,0x7d,
0x75,0x49,0x4b],
[0x2a,0x59,0x39,
0x36,0x50,0x22,
0x17,0x56,0x58,
0x76,0x27,0x24],
[0x2d,0x43,0x3b,
0x41,0x29,0x1e,
0x0c,0x10,0x0a,
0x52,0x80,0x81],
[0x0e,0x5f,0x69,
0x64,0x06,0x14,
0x5d,0x66,0x1b,
0x04,0x11,0x6e]
[0x7b,0x08,0x6a,
0x48,0x03,0x15,
0x00,0x62,0x3f,
0x5a,0x0b,0x78],
[0x05,0x4a,0x6c,
0x5e,0x7c,0x19,
0x63,0x45,0x23,
0x0d,0x7a,0x71],
[0x35,0x18,0x55,
0x53,0x47,0x83,
0x60,0x65,0x1d,
0x07,0x0f,0x70],
[0x4f,0x01,0x6d,
0x7f,0x5b,0x1a,
0x3d,0x67,0x02,
0x4d,0x12,0x5c],
[0x54,0x09,0x13,
0x82,0x61,0x68,
0x2e,0x4e,0x1c,
0x72,0x7e,0x6f]
],
eyebrows: [
[0x06,0x00,0x0c,
0x01,0x09,0x13,
0x07,0x15,0x08,
0x11,0x05,0x04],
[0x0b,0x0a,0x02,
0x03,0x0e,0x14,
0x0f,0x0d,0x16,
0x12,0x10,0x17]
],
nose: [
[0x01,0x0a,0x02,
0x03,0x06,0x00,
0x05,0x04,0x08,
0x09,0x07,0x0B],
[0x0d,0x0e,0x0c,
0x11,0x10,0x0f]
],
mouth: [
[0x17,0x01,0x13,
0x15,0x16,0x05,
0x00,0x08,0x0a,
0x10,0x06,0x0d],
[0x07,0x09,0x02,
0x11,0x03,0x04,
0x0f,0x0b,0x14,
0x12,0x0e,0x0c],
[0x1b,0x1e,0x18,
0x19,0x1d,0x1c,
0x1a,0x23,0x1f,
0x22,0x21,0x20]
]
}</nowiki>

Mii

2016-09-29T15:59:20Z

Phijor: Add checksum section: explain the checksum algorithm using pseudo code.

Originally [http://wiibrew.org/wiki/Mii_Data created for the Nintendo Wii] (and backported to a selection of DS/i games), the '''Mii''' format was expanded with a larger selection of facial features and a new "copying" permission for the 3DS family, and later implemented as-is on Wii U.

See [[Mii Maker]] for the application chiefly designed to create, edit, delete, and trade Miis or convert them from and to a QR code.

==Mii Database==
Format of the Mii main database '''CFL_DB.dat''', found in [[Extdata#NAND_Shared_Extdata|shared extdata]] archive f0000000b.

{| class="wikitable"
|-
! Offset
! Length
!
|-
| 0x0
| 0x4
| Header "CFOG" (Mii Maker section)
|-
| 0x4
| 0x4
| Header 0x00010000
|-
| 0x8
| 0x23F7
| Array of owned (saved in Mii Maker) Miis. Order in file is unrelated to canonical order in-app.
|-
| 0x23FC
| 0x4
| Header "CFHE"
|-
| 0x23F8
| 0x4
| Header 0xFFFFFFFF
|-
| 0x2400
| 0xA41E
| Array of objects? See chapter
|-
| 0xC81E
| 0x2
| Checksum of all of the above (the first 0xC81E byte). See section [[#Checksum|below]].
|-
| 0xC820
| 0x4
| Header "CFRA" (Invitations section)
|-
| 0xC824
| 0x4
| Header? 0x39000000
|-
| 0xC861
| 0x2B
| Weird padding? 0x00
|-
| 0xC88C
| 0x1C20 (?)
| Array of Miis contributed from games, used for Mii Plaza "invitations" feature. The format isn't that of a full Mii.
|-
| 0xE4AC
| 0x14
| 01 00 [..] 00 D2 74
|-
| 0xE4C0
| 0x3D860
| Empty (00)
|}
When encrypted in QR codes, 4 additional bytes are added. Two null bytes and a CRC-16. It's the exact same CRC-16 as for the Wii blocks on the 0x5e first bytes. It seems that the CRC is ignored, the Mii Maker expecting the result of APT:Unwrap to detect integrity loss.

==CFHE object==

A 0xE-byte long item.

On my database, they're all 0000 0000 0000 0000 0000 FF7F FF7F.

Wild speculation: blacklist of already scanned celebrity (gold) Mii QRs?

Alternative interpretation: FFFF FFFF 0000 0000 0000 0000 0000 is the 1st item; FF7F FF7F 0000 [...] the 2nd, etc;

==Checksum==

The algorithm used to verify the integrity of the database is based on [http://srecord.sourceforge.net/crc16-ccitt.html CRC16-CCITT], though it's an incorrect implementation. It is the same algorithm used to verify [http://wiibrew.org/wiki/Mii_Data#Block_format Mii Data on the Wii].

To obtain the correct value for the checksum, apply the algorithm to the first 0xC81E bytes of the database. This can be done using [https://www.dropbox.com/s/863idp5wmh50c1v/Gold_Mii_Tools.zip?dl=0 FixCRC for Windows]; alternativly a pseudocode implementation of the checksum algorithm is given below:

<source lang="python">
def crc16_CCITTWii(u8[]: data) -> u16:
"""Calculate a checksum of data using the CRC16-CCITT implementation of the Wii

This implementation uses 0x0000 as the starting value, which is different
from what CRC16-CCITT specifies.
"""

# note: a correct implementation of CRC16-CCITT
# would initialize this to 0xffff
u32 crc := 0x0

for byte in data:
# Iterate over every of the 8 bits in byte.
# Begin with the most significant bit. (7, 6, ... , 1, 0)
for bit in 7..0:
# & - binary `and'; <</>> - bitshift left/right; ^ - binary `xor'
crc := (
(crc << 1) | ((byte >> bit) & 0x1)
^ (0x1021 if crc & 0x8000 else 0)
)

for _ in 0..15:
crc := (crc << 1) ^ (0x1021 if crc & 0x8000 else 0)

# only return the lowest 16 bit of crc
return (u16) (crc & 0xffff)

checksum := crc16_CCITTWii(miidb[0:0xc81e]) # checksum over the first 0xc81e bytes
</source>

==Mii format==

Note: 0x18-3B have been copied as-is from [https://www.3dbrew.org/w/index.php?title=Mii_Maker&oldid=11464 the QR code specification], so they're unverified.

{| class="wikitable"
|-
! Offset
! Length
!
|-
| 0x0
| 0x4
| Mii ID (see chapter)
|-
| 0x4
| 0x8
| System ID (identifies owner, for purpose of enforcing editing restrictions and blue pants). Is not tied to the MAC address anymore.
|-
| 0xC
| 0x2
| Unknown (related to user-controllable variables)
|-
| 0xD
| 0x2
| unknown; variable (range A-F may alternatively be a timestamp?)
|-
| 0x10
| 0x6
| Creator's full MAC
|-
| 0x16
| 0x2
| Padding (0000)
|-
| 0x18
| 0x2
| Bit-mapped: Birthday (4bit-day,5bit-month), Sex, Shirt color, Favorite (0x40 bit at 0x19)
|-
| 0x1A
| 0x14
| UTF-16 Mii Name (10 chars max, 0000 terminated)
|-
| 0x2E
| 0x2
| width & height
|-
| 0x30
| 0x1
| bit 0: disable sharing bit 1-4: face shape bit 5-7: skin color
|-
| 0x31
| 0x1
| bit 0-3: wrinkles bit 4-7: makeup
|-
| 0x32
| 0x1
| hair style
|-
| 0x33
| 0x1
| bit 0-2: hair color bit 3: flip hair
|-
| 0x34
| 0x4
| unknown
|-
| 0x38
| 0x1
| bit 0-4: eyebrow style bit 5-7: eyebrow color
|-
| 0x39
| 0x1
| bit 0-3: eyebrow scale bit 4-6: eyebrow yscale
|-
| 0x3A
| 0x2
| note that the bytes are swapped over (little-endian layout) bit 0-3: eyebrow rotation bit 5-8: eyebrow x spacing bit 9-13: eyebrow y position
|-
| 0x3C
| 0x4
| unknown
|-
| 0x40
| 0x1
| Allow Copying (?) (0D on 0E off 8D on)
|-
| 0x41
| 0x7
| unknown
|-
| 0x48
| 0x14
| UTF-16 Author Name (10 chars max, 0000 terminated)
|}

==Mii ID==
* Byte 0: generally equals 3 (category?)
* Byte 1: 0/1 = copying off/on
* Byte 2, most significant hex digit: position on page (0-9)
* Byte 2, least significant hex digit: page (0-9)
* Byte 3: generally 0x30 (always for user-created ones?)

===Mii categories (pants colors)===

====Special (gold) Miis====
Specialness will override any other color and make the Mii non-editable.

Copying is rumored to have to be disabled.

Zeroed system-id and timestamp?

====Imported (blue) Miis====
Any (non-gold) Mii with a different System ID will appear as a foreign one.

There is also a range of Mii IDs that are always foreign and uneditable, regardless of the System ID:

====Regular (black/red) Miis====
Always editable, since they can only appear as such on the console that created them.

====Personal (red) Mii====
A red Mii that happens to be the first in the file!

==Mii values==
Each of the following values were found with NTR Debugger:
If you want to access the value, grab the given "NTR address" and add 0x08815000.

{| class="wikitable"
|-
! Data
! NTR address
! Variation (hex)
! Notes
|-
| Face style
| 0x894
| 00-0B
| Not ordered as in editor, read below
|-
| Face color
| 0x898
| 00-05
| From top to bottom
|-
| Wrinkles
| 0x89C
| 00-0B
| Same order as displayed in editor
|-
| Makeup
| 0x8A0
| 00-0B
| Same order as displayed in editor
|-
| Hair style
| 0x8A4
| 00-84
| Not ordered as in editor, read below
|-
| Hair color
| 0x8A8
| 00-07
| From top to bottom
|-
| Hair flipped
| 0x8AC
| 1 if true
| From top to bottom
|-
| Eye style
| 0x8B0
| 00-3C
| Not ordered as in editor, read below
|-
| Eyes color
| 0x8B4
| 00-05
| From top to bottom
|-
| Eyes size
| 0x8B8
| 07-00
| Left button increases value.
|-
| Eyes thickness
| 0x8BC
| 06-00
| Left button increases value.
|-
| Eyes rotation
| 0x8C0
| 00-07
|
|-
| Eyes spacing
| 0x8C4
| 00-0C
|
|-
| Eyes height
| 0x8C8
| 00-12
|
|-
| Eyebrows style
| 0x8CC
| 00-18
| Not ordered as in editor, read below
|-
| Eyebrows color
| 0x8D0
| 00-07
| From top to bottom
|-
| Eyebrows size
| 0x8D4
| 08-00
| Left button increases value.
|-
| Eyebrows thickness
| 0x8D8
| 06-00
| Left button increases value.
|-
| Eyebrows rotation
| 0x8DC
| 00-0B
|
|-
| Eyebrows spacing
| 0x8E0
| 00-0C
|
|-
| Eyebrows height
| 0x8E4
| 03-12
| Yup, minimum is 0x03
|-
| Nose style
| 0x8E8
| 00-11
| Not ordered as in editor, read below
|-
| Nose size
| 0x8EC
| 08-00
| Left button increases value.
|-
| Nose height
| 0x8F0
| 00-12
|
|-
| Mouth style
| 0x8F4
| 00-23
| Not ordered as in editor, read below
|-
| Mouth color
| 0x8F8
| 00-04
| From top to bottom.
|-
| Mouth size
| 0x8FC
| 08-00
| Left button increases value.
|-
| Mouth thickness
| 0x900
| 06-00
| Left button increases value.
|-
| Mouth height
| 0x904
| 00-12
|
|-
| Mustache style
| 0x908
| 00-05
| Order like in editor.
|-
| Beard style
| 0x90C
| 00-05
| Order like in editor.
|-
| Mustache/Beard color
| 0x910
| 00-07
| From top to button.
|-
| Mustache size
| 0x914
| 08-00
| Left button increases value.
|-
| Mustache height
| 0x918
| 00-10
|
|-
| Glasses style
| 0x91C
| 00-08
| Order like in editor.
|-
| Glasses color
| 0x920
| 00-05
| From top to bottom
|-
| Glasses size
| 0x924
| 07-00
| Left button increases value.
|-
| Glasses height
| 0x928
| 00-14
|
|-
| Mole enable
| 0x92C
| 1 if enabled, 0 else.
|
|-
| Mole size
| 0x930
| 08-00
| Left button increases value.
|-
| Mole horiz pos
| 0x934
| 00-10
|
|-
| Mole vert pos
| 0x938
| 00-1E
|
|-
| Mii height
| 0x93C
| 00-7F
|
|-
| Mii weight
| 0x940
| 00-7F
|
|-
| Mii name
| 0x944-0x959
| UTF-16
| Terminated with 0x0000. Not updated immediatly?
|-
| Creator's name
| 0x95A-96F
| UTF-16
| Terminated with 0x0000. Not updated immediatly?
|-
| Mii gender
| 0x970
| 0: Male, 1: Female
|
|-
| Birthdate month
| 0x974
| 01-0C
|
|-
| Birthdate day
| 0x978
| 01-1F
|
|-
| Mii shirt color
| 0x97C
| 00-0B
| Ordered like in editor.
|-
| Favorite
| 0x980
| 0: false, 1: true
|
|-
| Allow copy
| 0x981
| 0: false, 1: true
|
|-
| Unused byte?
| 0x982
|
|
|-
| Allow sharing
| 0x983
| 0: true, 1: false
|
|-
| ???
| 0x984-0x98F
| All zero?
|
|-
| ???
| 0x990-0x997
| 4?
|
|}
0x08815998: Same 4 bytes as encrypted Mii: first 4 bits for Mii type, 4 next for number of seconds since 01/01/2010 00:00:00 UTC+3 (should be verified by other country and region 3DS) divided by 2.
0x0881599C: 6 bytes of MAC address of the 3DS that created the Mii.
0x088159A2: 6 unknow uses bytes
0x088159A8: Same 8 bytes as decrypted Mii at 0x04 through 0x0B. Seems NAND specific, kept the same on Miis created on same NAND but different 3DS via System Transfer. Might be a coincidence but the two first bytes are in ID0 folder name in the Nintendo 3DS folder.

===Mapped Editor <-> Hex values===

Most of the values are ordered (left button decreases, right increases, color choices are top to bottom...) but for most "main" part of the UI, where you choose the style of the part being edited, hex values has no correlation with displayed order.
Here is a JSON that can go from a Part, a Page and Position to the right hex value. This is 0 indexed (eg: datas["face"][0][11]).

<nowiki>{
face: [
0x00,0x01,0x08,
0x02,0x03,0x09,
0x04,0x05,0x0a,
0x06,0x07,0x0b
],
hairs: [
[0x21,0x2f,0x28,
0x25,0x20,0x6b,
0x30,0x33,0x37,
0x46,0x2c,0x42],
[0x34,0x32,0x26,
0x31,0x2b,0x1f,
0x38,0x44,0x3e,
0x73,0x4c,0x77],
[0x40,0x51,0x74,
0x79,0x16,0x3a,
0x3c,0x57,0x7d,
0x75,0x49,0x4b],
[0x2a,0x59,0x39,
0x36,0x50,0x22,
0x17,0x56,0x58,
0x76,0x27,0x24],
[0x2d,0x43,0x3b,
0x41,0x29,0x1e,
0x0c,0x10,0x0a,
0x52,0x80,0x81],
[0x0e,0x5f,0x69,
0x64,0x06,0x14,
0x5d,0x66,0x1b,
0x04,0x11,0x6e]
[0x7b,0x08,0x6a,
0x48,0x03,0x15,
0x00,0x62,0x3f,
0x5a,0x0b,0x78],
[0x05,0x4a,0x6c,
0x5e,0x7c,0x19,
0x63,0x45,0x23,
0x0d,0x7a,0x71],
[0x35,0x18,0x55,
0x53,0x47,0x83,
0x60,0x65,0x1d,
0x07,0x0f,0x70],
[0x4f,0x01,0x6d,
0x7f,0x5b,0x1a,
0x3d,0x67,0x02,
0x4d,0x12,0x5c],
[0x54,0x09,0x13,
0x82,0x61,0x68,
0x2e,0x4e,0x1c,
0x72,0x7e,0x6f]
],
eyebrows: [
[0x06,0x00,0x0c,
0x01,0x09,0x13,
0x07,0x15,0x08,
0x11,0x05,0x04],
[0x0b,0x0a,0x02,
0x03,0x0e,0x14,
0x0f,0x0d,0x16,
0x12,0x10,0x17]
],
nose: [
[0x01,0x0a,0x02,
0x03,0x06,0x00,
0x05,0x04,0x08,
0x09,0x07,0x0B],
[0x0d,0x0e,0x0c,
0x11,0x10,0x0f]
],
mouth: [
[0x17,0x01,0x13,
0x15,0x16,0x05,
0x00,0x08,0x0a,
0x10,0x06,0x0d],
[0x07,0x09,0x02,
0x11,0x03,0x04,
0x0f,0x0b,0x14,
0x12,0x0e,0x0c],
[0x1b,0x1e,0x18,
0x19,0x1d,0x1c,
0x1a,0x23,0x1f,
0x22,0x21,0x20]
]
}</nowiki>