3dbrew - User contributions [en]

AMPXI:ExportDSiWare

2015-12-06T09:22:04Z

Slashmolder: /* Request */

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x004D0144]
|-
| 1
| TWL TitleID lower word
|-
| 2
| TWL TitleID upper word
|-
| 3
| Input path buffer size
|-
| 4
| Size of working buffer, normally this is 0x20000.
|-
| 5
| u8 DSiWare export type.
|-
| 6
| (PathSize<<8) <nowiki>|</nowiki> 0x4
|-
| 7
| Input path buffer ptr
|-
| 8
| (WorkBufSize<<8) <nowiki>|</nowiki> 0x14
|-
| 9
| Ptr for the working buffer
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code
|-
| 1
| Result code
|}

=Description=
This is used for [[DSiWare_Exports|exporting]] DSiWare. The UTF-16 input path is normally in the format "[[SD_Filesystem|sdmc]]:/Nintendo 3DS/<ID0>/<ID1>/Nintendo DSiWare/<TitleID-Low.bin>", however this can be arbitrary.

3DS System Flaws

2015-03-21T22:11:39Z

Slashmolder: /* Hardware */

Exploits are used to execute unofficial code (homebrew) on the Nintendo 3DS. This page is a list of publicly known system flaws, for userland applications/applets flaws see [[3DS_Userland_Flaws|here]].

==Stale / Rejected Efforts==
* Neimod has been working on a RAM dumping setup for a little while now. He's de-soldered the 3DS's RAM chip and hooked it and the RAM pinouts on the 3DS' PCB up to a custom RAM dumping setup. A while ago he published photos showing his setup to be working quite well, with the 3DS successfully booting up. However, his flickr stream is now private along with most of his work.

* Someone (who will remain unnamed) has released CFW and CIA installers, all of which is copied from the work of others, or copyrighted material.

==Tips and info==
The 3DS uses the XN feature of the ARM11 processor. There's no official way from applications to enable executable permission for memory containing arbitrary unsigned code(there's a [[SVC]] for this, but only [[RO_Services|RO-module]] has access to it). An usable userland exploit would still be useful: you could only do return-oriented-programming with it initially. From ROP one could then exploit system flaw(s), see below.

SD card [[extdata]] and SD savegames can be attacked, for consoles where the console-unique [[Nand/private/movable.sed|movable.sed]] was dumped(accessing SD data is far easier by running code on the target 3DS however).

Note that the publicly-available <v5.0 total-control exploits are [[FIRM|Process9]] exploits, not "kernel exploits".

==System flaws==
=== Hardware ===
{| class="wikitable" border="1"
! Summary
! Description
! Timeframe this was discovered
! Discovered by
|-
| Missing AES key clearing
| The hardware AES engine does not clear keys when doing a hard reset/reboot.
This applies for New3DS too.
| August 2014
| Mathieulh/Others
|-
| DSi / 3DS-TWL key-generator
| After using the key generator to generate the normal-key, you could overwrite parts of the normal-key with your own data and then recover the key-generator output by comparing the new crypto output with the original crypto output. From the normal-key outputs, you could deduce the TWL key-generator function.
This applies to the keyX/keyY too.

This attack does not work for the 3DS key-generator because keyslots 0-3 are only for TWL keys.
| 2011
| [[User:Yellows8|Yellows8]]
|}

=== [[TWL_FIRM]] ===
==== Process9 ====

=== [[FIRM]] Process9 ===
{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in [[FIRM]] system version
! Last [[FIRM]] system version this flaw was checked for
! Timeframe this was discovered
! Discovered by
|-
| RSA signature padding checks
| The TWL_FIRM RSA sig padding check code used for all TWL RSA sig-checks has issues, see [[FIRM|here]].
The main 3DS RSA padding check code(non-certificate) uses the function used with the above to extract PKCS padding + the actual hash from the message. This is not a problem here however.
|
| None
| [[9.5.0-22|9.5.0-X]]
| March 2015
| [[User:Yellows8|Yellows8]]
|-
| Uncleared New3DS keyslot 0x11
| Originally the New3DS [[FIRM]] arm9bin loader only cleared keyslot 0x11 when it gets executed at firmlaunch. This was fixed with [[9.5.0-22|9.5.0-X]] by completely clearing keyslot 0x11 immediately after the loader finishes using keyslot 0x11.
This means that any ARM9 code that can execute before the loader clears the keyslot at firmlaunch(including firmlaunch-hax) can get access to the uncleared keyslot 0x11, which then allows one to generate all <=v9.5 New3DS keyXs which are generated by keyslot 0x11.

Therefore, to completely fix this the loader would have to generate more keys using different keyslot 0x11 keydata.
| New3DS keyXs generation
| Mostly fixed with [[9.5.0-22|9.5.0-X]], see description.
|
| February 3, 2015 (one day after [[9.5.0-22|9.5.0-X]] release)
| [[User:Yellows8|Yellows8]]
|-
| firmlaunch-hax: FIRM header ToCToU
| This can't be exploited from ARM11 userland.
During [[FIRM]] launch, the only FIRM header the ARM9 uses at all is stored in FCRAM, this is 0x200-bytes(the actual used FIRM RSA signature is read to the Process9 stack however). The ARM9 doesn't expect "anything" besides the ARM9 to access this data.
With [[9.5.0-22]] the address of this FIRM header was changed from a FCRAM address, to ARM9-only address 0x01fffc00.
| ARM9 code execution
| [[9.5.0-22]]
|
| 2012, 3 days after [[User:Yellows8|Yellows8]] started Process9 code RE.
| [[User:Yellows8|Yellows8]]
|-
| Uninitialized data output for PXI command replies
| Various (stubbed?) PXI commands(including some [[Filesystem_services_PXI|here]]) just write uninitialized data (like from ARM registers) to the command reply.
|
| None
| [[9.3.0-21|9.3.0-X]]
| ?
| [[User:Yellows8|Yellows8]]
|-
| [[Filesystem_services_PXI|FSPXI]] OpenArchive SD permissions
| Process9 does not use the exheader ARM9 access-mount permission flag for SD at all.
This would mean ARM11-kernelmode code / fs-module itself could directly use FSPXI to access SD card without ARM9 checking for SD access, but this is rather useless since a process is usually running with SD access(Home Menu for example) anyway.
|
| None
| [[9.3.0-21|9.3.0-X]]
| 2012
| [[User:Yellows8|Yellows8]]
|-
| [[AMPXI:ExportDSiWare]] export path
| Process9 allocates memory on Process9 heap for the export path then verifies that the actual allocated size matches the input size. Then Process9 copies the input path from FCRAM to this buffer, and uses it with the Process9 FS openfile code, which use paths in the form of "<mountpoint>:/<path>".
Process9 does not check the contents of this path at all before passing it to the FS code, besides writing a NUL-terminator to the end of the buffer.
| Exporting of DSiWare to arbitrary Process9 file-paths, such as "nand:/<path>" etc. This isn't really useful since the data which gets written can't be controlled.
| None
| [[9.5.0-22]]
| April 2013
| [[User:Yellows8|Yellows8]]
|-
| [[DSiWare_Exports]] [[CTCert]] verification
| Just like DSi originally did, 3DS verifies the APCert for DSiWare on SD with the CTCert also in the DSiWare .bin. On DSi this was fixed with with system-version 1.4.2 by verifying with the actual console-unique cert instead(stored in NAND), while on 3DS it's still not(?) fixed.
On 3DS however this is rather useless, due to the entire DSiWare .bin being encrypted with the console-unique movable.sed keyY.
| When the movable.sed keyY for the target 3DS is known and the target 3DS CTCert private-key is unknown, importing of modified DSiWare SD .bin files.
| Unknown, probably none.
| ?
| April 2013
| [[User:Yellows8|Yellows8]]
|-
| [[Gamecard_Services_PXI]] unchecked REG_CTRCARDCNT transfer-size
| The u8 REG_CTRCARDCNT transfer-size parameter for the [[Gamecard_Services_PXI]] read/write CTRCARD commands is used as an index for an array of u16 values. Before [[5.0.0-11|5.0.0-X]] this u8 value wasn't checked, thus out-of-bounds reads could be triggered(which is rather useless in this case).
| Out-of-bounds read for a value which gets written to a register.
| [[5.0.0-11|5.0.0-X]]
|
| 2013?
| [[User:Yellows8|Yellows8]]
|-
| [[Application_Manager_Services_PXI|PXIAM]] command 0x003D0108(See also [[Application_Manager_Services|this]])
| When handling this command, Process9 allocates a 0x2800-byte heap buffer, then copies the 4 FCRAM input buffers to this heap buffer without checking the sizes at all(only the buffers with non-zero sizes are copied). Starting with [[5.0.0-11|5.0.0-X]], the total combined size of the input data must be <=0x2800.
| ARM9 code execution
| [[5.0.0-11|5.0.0-X]]
|
| May 2013
| [[User:Yellows8|Yellows8]]
|-
| [[Process_Services_PXI|PS RSA]] commands buffer overflows
| pxips9 cmd1(not accessible via ps:ps) and VerifyRsaSha256: unchecked copy to a buffer in Process9's .bss, from the input FCRAM buffer. The buffer is located before the pxi cmdhandler threads' stacks. SignRsaSha256 also has a buf overflow, but this isn't exploitable.
The buffer for this is the buffer for the signature data. With v5.0, the signature buffer was moved to stack, with a check for the signature data size. When the signature data size is too large, Process9 uses [[SVC|svcBreak]].
| ARM9 code execution
| [[5.0.0-11|5.0.0-X]]
|
| 2012
| [[User:Yellows8|Yellows8]]
|}

=== ARM11 kernel ===
{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in [[FIRM]] system version
! Last [[FIRM]] system version this flaw was checked for
! Timeframe this was discovered
! Discovered by
|-
| [[SVC]] table too small
| The table of function pointers for SVC's only contains entries up to 0x7D, but the biggest allowed SVC for the table is 0x7F. Thus, executing SVC7E or SVC7F would make the SVC-handler read after the buffer, and interpret some ARM instructions as function pointers.

However, this would require patching the kernel .text or modifying SVC-access-control. Even if you could get these to execute, they would still jump to memory that isn't mapped as executable.
|
| None
| [[9.5.0-22|9.5.0-X]]
| 2012
| Everyone
|-
| [[SVC|svcBackdoor (0x7B)]]
| This backdoor allows executing SVC-mode code at the user-specified code-address. This is used by Process9, using this on the ARM11(with NATIVE_FIRM) requires patching the kernel .text or modifying SVC-access-control.
| See description
| None
| [[9.5.0-22|9.5.0-X]]
|
| Everyone
|-
| [[Memory_layout#ARM11_Detailed_virtual_memory_map|0xEFF00000]] / 0xDFF00000 ARM11 kernel virtual-memory
| The ARM11 kernel-mode 0xEFF00000/0xDFF00000 virtual-memory(size 0x100000) is mapped to phys-mem 0x1FF00000(entire DSP-mem + entire AXIWRAM), with permissions RW-. This is used during ARM11 kernel startup, this never seems to be used after that, however.
|
| None
| [[9.5.0-22|9.5.0-X]]
|
|
|-
| memchunkhax
| The kernel originally did not validate the data stored in the FCRAM kernel heap memchunk-headers for free-memory at all. Exploiting this requires raw R/W access to these memchunk-headers, like physical-memory access with gspwn.

There are ''multiple'' ways to exploit this, but the end-result for most of these is the same: overwrite code in AXIWRAM via the 0xEFF00000/0xDFF00000 kernel virtual-memory mapping.

This was fixed in [[9.3.0-21|9.3.0-X]] by checking that the memchunk(including size, next, and prev ptrs) is located within the currently used heap memory. The kernel may also check that the next/prev ptrs are valid compared to other memchunk-headers basically. When any of these checks fail, kernelpanic() is called.
| When combined with other flaws: ARM11-kernelmode code execution
| [[9.3.0-21|9.3.0-21]]
|
| February 2014
| [[User:Yellows8|Yellows8]]
|-
| PXI [[RPC_Command_Structure|Command]] input/output buffer permissions
| Originally the ARM11-kernel didn't check permissions for PXI input/output buffers for commands. Starting with [[6.0.0-11|6.0.0]] PXI input/output buffers must have RW permissions, otherwise kernelpanic is triggered.
|
| [[6.0.0-11|6.0.0-11]]
|
| 2012
| [[User:Yellows8|Yellows8]]
|-
| [[SVC|svcStartInterProcessDma]]
| For svcStartInterProcessDma, the kernel code had the following flaws:

* Originally the ARM11-kernel read the input DmaConfig structure directly in kernel-mode(ldr(b/h) instructions), without checking whether the DmaConfig address is readable under userland. This was fixed by copying that structure to the SVC-mode stack, using the ldrbt instruction.

* Integer overflows for srcaddr+size and dstaddr+size are now checked(with [[6.0.0-11]]), which were not checked before.

* The kernel now also checks whether the srcaddr/dstaddr (+size) is within userland memory (0x20000000), the kernel now (with [[6.0.0-11]]) returns an error when the address is beyond userland memory. Using an address >=0x20000000 would result in the kernel reading from the process L1 MMU table, beyond the memory allocated for that MMU table(for vaddr->physaddr conversion).
|
| [[6.0.0-11]]
|
| DmaConfig issue: unknown. The rest: 2014
| plutoo, [[User:Yellows8|Yellows8]] independently
|-
| [[SVC|svcControlMemory]] Parameter checks
| For svcControlMemory the parameter check had these two flaws:

* The allowed range for addr0, addr1, size parameters depends on which MemoryOperation is being specified. The limitation for GSP heap was only checked if op=(u32)0x10003. By setting a random bit in op that has no meaning (like bit17?), op would instead be (u32)0x30003, and the range-check would be less strict and not accurate. However, the kernel doesn't actually use the input address for LINEAR memory-mapping at all besides the range-checks, so this isn't actually useful. This was fixed in the kernel by just checking for the LINEAR bit, instead of comparing the entire MemoryOperation value with 0x10003.

* Integer overflows on (addr0+size) are now checked that previously weren't (this also applies to most other address checks elsewhere in the kernel).

|
| [[5.0.0-11]]
|
|
| plutoo
|-
| [[RPC_Command_Structure|Command]] request/response buffer overflow
| Originally the kernel did not check the word-values from the command-header. Starting with [[5.0.0-11]], the kernel will trigger a kernelpanic() when the total word-size of the entire command(including the cmd-header) is larger than 0x40-words (0x100-bytes). This allows overwriting threadlocalstorage+0x180 in the destination thread. However, since the data written there would be translate parameters (such as header-words + buffer addresses), exploiting this would likely be very difficult, if possible at all.

If the two words at threadlocalstorage+0x180 could be overwritten with controlled data this way, one could then use a command with a buffer-header of <nowiki>((size<<14) | 2)</nowiki> to write arbitrary memory to any RW userland memory in the destination process.
|
| [[5.0.0-11]]
|
| v4.1 FIRM -> v5.0 code diff
| [[User:Yellows8|Yellows8]]
|-
| [[SVC|SVC stack allocation overflows]]
|
* Syscalls that allocate a variable-length array on stack, only checked bit31 before multiplying by 4/16 (when calculating how much memory to allocate). If a large integer was passed as input to one of these syscalls, an integer overflow would occur, and too little memory would have been allocated on stack resulting in a buffer overrun.
* The alignment (size+7)&~7 calculation before allocation was not checked for integer overflow.

This might allow for ARM11 kernel code-execution.

(Applies to svcSetResourceLimitValues, svcGetThreadList, svcGetProcessList, svcReplyAndReceive, svcWaitSynchronizationN.)
|
| [[5.0.0-11]]
|
| v4.1 FIRM -> v5.0 code diff
| plutoo, [[User:Yellows8|Yellows8]] complementary
|-
| [[SVC|svcControlMemory]] MemoryOperation MAP memory-permissions
| svcControlMemory with MemoryOperation=MAP allows mapping the already-mapped process virtual-mem at addr1, to addr0. The lowest address permitted for addr1 is 0x00100000. Originally the ARM11 kernel didn't check memory permissions for addr1. Therefore .text as addr1 could be mapped elsewhere as RW- memory, which allowed ARM11 userland code-execution.
|
| [[4.1.0-8]]
|
| 2012
| [[User:Yellows8|Yellows8]]
|-
| [[RPC_Command_Structure|Command]] input/output buffer permissions
| Originally the ARM11 kernel didn't check memory permissions for the input/output buffers for commands. Starting with [[4.0.0-7]] the ARM11 kernel will trigger a kernelpanic() if the input/output buffers don't have the required memory permissions. For example, this allowed a FSUSER file-read to .text, which therefore allowed ARM11-userland code execution.
|
| [[4.0.0-7]]
|
| 2012
| [[User:Yellows8|Yellows8]]
|-
| [[SVC|svcReadProcessMemory/svcWriteProcessMemory memory]] permissions
| Originally the kernel only checked the first page(0x1000-bytes) of the src/dst buffers, for svcReadProcessMemory and svcWriteProcessMemory. There is no known retail processes which have access to these SVCs.
|
| [[4.0.0-7]]
|
| 2012?
| [[User:Yellows8|Yellows8]]
|}

=== [[FIRM]] ARM11 modules ===
{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in [[FIRM]] system version
! Last [[FIRM]] system version this flaw was checked for
! Timeframe this was discovered
! Discovered by
|-
| [[Services|"srv:pm"]] process registration
| Originally any process had access to the port "srv:pm". The PID's used for the (un)registration commands are not checked either. This allowed any process to re-register itself with "srv:pm", and therefore allowed the process to give itself access to any service, bypassing the exheader service-access-control list.

This was fixed in [[7.0.0-13]]: starting with [[7.0.0-13]] "srv:pm" is now a service instead of a globally accessible port. Only processes with PID's less than 6 (in other words: fs, ldr, sm, pm, pxi modules) have access to it. With [[7.0.0-13]] there can only be one session for "srv:pm" open at a time(this is used by pm module), svcBreak will be executed if more sessions are opened by the processes which can access this.

This flaw was needed for exploiting the <=v4.x Process9 PXI vulnerabilities from ARM11 userland ROP, since most applications don't have access to those service(s).
| Access to arbitrary services
| [[7.0.0-13]]
|
| 2012
| [[User:Yellows8|Yellows8]]
|}

=== ARM11 system modules ===
{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in system-module system-version
! Last system-module system-version this flaw was checked for
! Timeframe this was discovered
! Discovered by
|-
| [[SPI_Services|SPI]] service out-of-bounds write
| cmd1 has out-of-bounds write allowing overwrite of some static variables in .data.
|
| None
| [[9.5.0-22]]
| March 2015
| plutoo
|-
| [[News_Services|NEWSS]] service command notificationID validation failure
| This module does not validate the input notificationID for <nowiki>"news:s"</nowiki> service commands. This is an out-of-bounds array index bug. For example, [[NEWSS:SetNotificationHeader]] could be used to exploit news module: this copies the input data(size is properly checked) to: out = newsdb_savedata+0x10 + (someu32array[notificationID]*0x70).
| ROP under news module.
| None
| [[9.0.0-20]]
| December 2014
| [[User:Yellows8|Yellows8]]
|-
| [[HID_Services|HID]] module shared-mem
| HID module does not validate the index values in [[HID_Shared_Memory|sharedmem]](just changes index to 0 when index == maxval when updating), therefore large values will result in HID module writing HID data to arbitrary addresses.
| ROP under HID module, but this is *very* unlikely to be exploitable since the data written is HID data.
| None
| [[9.3.0-21]]
| 2014?
| [[User:Yellows8|Yellows8]]
|-
| gspwn
| GSP module does not validate addresses given to the GPU. This allows a user-mode application/applet to read/write to a large part of physical FCRAM using GPU DMA. From this, you can overwrite the .text segment of the application you're running under, and gain real code-execution from a ROP-chain. Normally applets' .text([[Home Menu]], [[Internet Browser]], etc) is located beyond the area accessible by the GPU, except for [[RO_Services|CROs]] used by applets([[Internet Browser]] for example).
| User-mode code execution.
| None
| [[9.5.0-22]]
| Early 2014
| smea, [[User:Yellows8|Yellows8]]/others before then
|-
| rohax
| Using gspwn, it is possible to overwrite a loaded [[CRO0]]/[[CRR0]] after its RSA-signature has been validated. Badly validated [[CRO0]] header leads to arbitrary read/write of memory in the ro-process. This gives code-execution in the ro module, who has access to [[SVC|syscalls]] 0x70-0x72, 0x7D.

This was fixed after [[ninjhax]] release by adding checks on [[CRO0]]-based pointers before writing to them.
| Memory-mapping syscalls.
| [[9.3.0-21]]
| [[9.4.0-21]]
|
| smea, plutoo joint effort
|-
| Region free
| Only [[Home Menu]] itself checks gamecards' region when launching them. Therefore, any application launch that is done directly with [[NS]] without signaling Home Menu to launch the app, will result in region checks being bypassed.
This essentially means launching the gamecard with the [[NS_and_APT_Services|"ns:s"]] service. The main way to exploit this is to trigger a FIRM launch with an application specified, either with a normal FIRM launch or a hardware [[NSS:RebootSystem|reboot]].
| Launching gamecards from any region + bypassing Home Menu gamecard-sysupdate installation
| None
| [[9.5.0-22]]
| June(?) 2014
| [[User:Yellows8|Yellows8]]
|-
| [[NWM_Services|NWM]] service-cmd state null-ptr deref
| The NWMUDS service command code loads a ptr from .data, adds an offset to that, then passes that as the state address for the actual command-handler function. The value of the ptr loaded from .data is not checked, therefore this will cause crashes due to that being 0x0 when NWMUDS was not properly initialized.
It's unknown whether any NWM services besides NWMUDS have this issue.
| This is rather useless since it's only a crash caused by a state ptr based at 0x0.
| None
| [[9.0.0-20]]
| 2013?
| [[User:Yellows8|Yellows8]]
|}

=== General/CTRSDK ===
{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in version
! Last version this flaw was checked for
! Timeframe this was discovered
! Discovered by
|-
| [[NWM_Services|UDS]] beacon additional-data buffer overflow
| Originally CTRSDK did not validate the UDS additional-data size before using that size to copy the additional-data to a [[NWM_Services|networkstruct]]. This was eventually fixed.
This was discovered while doing code RE with an old dlp-module version. It's unknown in what specific CTRSDK version this was fixed, or even what system-version updated titles with a fixed version.

It's unknown if there's any titles using a vulnerable CTRSDK version which are also exploitable with this(dlp module can't be exploited with this).

The maximum number of bytes that can be written beyond the end of the outbuf is 0x37-bytes, with additionaldata_size=0xFF.
| Perhaps ROP, very difficult if possible with anything at all
| ?
|
| September(?) 2014
| [[User:Yellows8|Yellows8]]
|}

QTM Services

2015-03-17T21:20:27Z

Slashmolder: /* QTM service "qtm:sp" */

[[Category:Services]]

QTM is the [[New_3DS]] system module in charge of handling head tracking. A maximum of two sessions can be opened for each QTM service.

Head tracking is not usable when any other process is using any of the cameras, QTM returns error 0xC8A18008 for this.

=QTM services=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010080
| [[QTM:GetHeadtrackingInfoRaw|GetHeadtrackingInfoRaw]]
|-
| 0x00020080
| [[QTM:GetHeadtrackingInfo|GetHeadtrackingInfo]]
|-
| 0x00030000
|
|-
| 0x00040000
|
|-
| 0x00050040
| (u8 input)
|-
| 0x00060000
| Writes an output u8 to cmdreply[2].
|}

The commands under this section are available for all QTM services except for "qtm:c".

= QTM user service "qtm:u" =
The commands available for this are exactly the same as the commands listed under the "QTM services" section.

= QTM system service "qtm:s" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x04010040
| (float input)
|-
| 0x04020000
| Writes float output to cmdreply[2].
|-
| 0x04030000
|
|-
| 0x04040000
|
|-
| 0x04050040
| (u8 input)
|-
| 0x04060000
| Writes an u8 to cmdreply[2].
|-
| 0x04070040
| (u8 input)
|-
| 0x040801C0
|
|-
| 0x04090000
| Writes an u8 to cmdreply[2].
|-
| 0x040A0040
| (u8 input)
|}

See also the "QTM services" section.

= QTM service "qtm:sp" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x08010040
| (u8 input) Internally compared with 2
|-
| 0x08020000
| Writes 1 to a flag
|-
| 0x08030040
| Returns a byte loaded from a flag
|-
| 0x08040000
| Writes 1 to a flag
|}

This service has all of the commands listed under the "QTM services" section and the "qtm:s" section, in addition to the above commands.

This service is used by [[NS]] and [[GSP_Services|GSP]]-module, hence no other processes can use this service.

= QTM service "qtm:c" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
|-
| 0x00010000
|
|-
| 0x00020000
|
|-
| 0x00030040
|
|-
| 0x00040000
| Writes an output u8 to cmdreply[2].
|-
| 0x00050040
| (u8 input)
|}

The commands for this service are separate from the commands under the "QTM services" section.

AES Registers

2015-03-12T02:57:44Z

Slashmolder: Not true anymore plus why reference Gateway in the wiki?

== Registers ==
{| class="wikitable" border="1"
! NAME
! PHYSICAL ADDRESS
! WIDTH
! RW
|-
| REG_AESCNT
| 0x10009000
| 4
| RW
|-
| REG_AESBLKCNT
| 0x10009004
| 4
| W?
|-
| REG_AESWRFIFO
| 0x10009008
| 4
| W
|-
| REG_AESRDFIFO
| 0x1000900C
| 4
| R
|-
| REG_AESKEYSEL
| 0x10009010
| 1
| RW
|-
| REG_AESKEYCNT
| 0x10009011
| 1
| RW
|-
| REG_AESCTR
| 0x10009020
| 16
| W
|-
| REG_AESMAC
| 0x10009030
| 16
| W
|-
| REG_AESKEY0
| 0x10009040
| 48
| W
|-
| REG_AESKEY1
| 0x10009070
| 48
| W
|-
| REG_AESKEY2
| 0x100090A0
| 48
| W
|-
| REG_AESKEY3
| 0x100090D0
| 48
| W
|-
| REG_AESKEYFIFO
| 0x10009100
| 4
| W
|-
| REG_AESKEYXFIFO
| 0x10009104
| 4
| W
|-
| REG_AESKEYYFIFO
| 0x10009108
| 4
| W
|}

== REG_AESCNT ==
{| class="wikitable" border="1"
! Bit
! Description
|-
| 4-0
| Write FIFO count (0-16)
|-
| 9-5
| Read FIFO count (0-16)
|-
| 10
| Flush write FIFO (1=Clear write FIFO)
|-
| 11
| Flush read fifo (1=Clear read FIFO)
|-
| 18-16
| MAC size (encoding = (maclen-2)/2)
|-
| 19
|? (MAC related)
|-
| 20
| MAC input control (0 = read MAC from FIFO, 1 = read from MAC register)
|-
| 21
| MAC status (0 = invalid, 1 = verified)
|-
| 22
| Output endianness (1=Big endian, 0=Little endian)
|-
| 23
| Input endianness (1=Big endian, 0=Little endian)
|-
| 24
| Output word order (1=Normal order, 0=Reversed order)
|-
| 25
| Input word order (1=Normal order, 0=Reversed order)
|-
|-
| 26
| Update keyslot (selects the keyslot specified by REG_AESKEYSEL when this bit is set)
|-
| 29-27
| Mode (0=CCM decrypt, 1=CCM encrypt, 2=CTR, 3=CTR, 4=CBC decrypt, 5=CBC encrypt, 6=ECB decrypt, 7=ECB encrypt)
|-
| 30
| Interrupt enable (1=enable, 0=disable)
|-
| 31
| Start (1=enable/busy, 0=idle)
|}

When bit31 is clear, the AES engine will handle keyslot-selection when bit26 is set immediately. When bit31 is set, the AES engine won't handle bit26 immediately, instead the AES engine will automatically handle the already-set bit26 once bit31 clears(current AES operation finishes).

Clearing bit31 while the AES engine is doing crypto will result in the AES engine stopping crypto, once it finishes processing the current block.

== REG_AESBLKCNT ==

{| class="wikitable" border="1"
! Bit
! Description
|-
| 16-31
| (Data length)>>4
|}

== REG_AESWRFIFO/REG_AESRDFIFO ==
Up to 128 bytes of input data can be buffered.

The input data for the AES crypto operation is written to REG_AESWRFIFO, the output data is read from REG_AESRDFIFO.

Reading from REG_AESRDFIFO when there's no data available in the RDFIFO will result in reading the last word that was in the RDFIFO.

== REG_AESKEYCNT ==
{| class="wikitable" border="1"
! Bit
! Description
|-
| 5-0
| Keyslot
|-
| 6
| Hardware key-generator type: 0 = 3DS, 1 = DSi.
|-
| 7
| This normally has value 1 written here when updating keys. 0 = disable key FIFO flush, 1 = enable key FIFO flush.
|}

Bit6 is only used when keyslots >=4 are used, value1 has the same affect as doing key-init with the TWL keyslots. Bit6 is only checked when a keyY was completely written, for when the final-normalkey needs updated via the key-generator. Changing bit6 has no affect on the generated normalkey when writing to this bit immediately after writing the last keyY word.

== REG_AESCTR ==
This register specifies the counter (CTR mode), nonce (CCM mode) or the initialization vector (CBC mode) depending on the mode of operation.
For CBC and CTR mode this register takes up the full 16 bytes, but for CCM mode the nonce is only the first 12 bytes.

== REG_AESMAC ==
This register specifies the message authentication code (MAC) for use in CCM mode.

== Endianness and word order ==
When writing to the REG_AESCTR or REG_AESMAC register, the hardware will process the written data according to the current input endianness specified in AESCNT. However, the current specified input word order will not be honored for this register, and always defaults to reversed word order. Therefore, for normal word order, the reversal must be carried out manually if required.

== Keyslot ranges ==
This is approximately a table of what is set by bootrom before booting into FIRM. Often it appears that keyslots in groups of 4 have the same keyX, and sometimes also same keyY set.

{| class="wikitable" border="1"
! Keyslot
! Name
! KeyX
! KeyY/Normal-key
! Console unique.
|-
| 0x00-0x03
| TWL keys.
| Probably unset.
| Probably unset.
| -
|-
| 0x04-0x07
| NAND partition keys.
| Same for all.
| Different for all.
| Yes.
|-
| 0x08-0x0B
| DSiWare export key, and rest unknown.
| Same for all.
| Different for all.
| Yes.
|-
| 0x0C-0x0F.
| SSL cert key.
| Same for all.
| Same for all.
| No.
|-
| 0x10-0x17
| -
| Not set.
| Not set.
| -
|-
| 0x18-0x1B:
| Never used.
| Same for all.
| Same for all.
| Yes.
|-
| 0x1C-0x1F:
| Never used.
| Same for all.
| Same for all.
| Yes.
|-
| 0x20-0x23:
| Never used?
| Same for all.
| Same for all.
| Only keyX/keyY.
|-
| 0x24-0x2B
| Never used?
| Individually set.
| Individually set.
| Mixed.
|-
| 0x2C-0x2F
| Various uniques.
| Same for all.
| Same for all, probably.
| No.
|-
| 0x30-0x33
| Various.
| Same for all.
| Same for all???
| No.
|-
| 0x34-0x37
| Various uses.
| Same for all.
| Same for all, probably.
| No.
|-
| 0x38-0x3B
| Various uses.
| Same for all.
| Different for all.
| No.
|-
| 0x3D-3F
| Various uses.
| Individually set.
| Individually set.
| No.
|}

Keyslot pairs (0x24, 0x28) and (0x38, 0x3C) shares the same normal-key, while at the same time having different keyX's. This suggests they were set to same normal-key by bootrom.

== Keyslots ==
There are 0x40 keyslots, each of which stores three keys called keyX, keyY and normalkey. All keys can be set explicitly, but the normalkey can optionally be generated using a hardware key scrambler instead (see below). There is no way to read the contents of a keyslot.

{| class="wikitable" border="1"
! Keyslot
! Description
! KeyX
! KeyY
! Normal-key
! Old3DS
|-
| 0x00-0x03
| TWL keys.
| NATIVE_FIRM hard-boot.
| NATIVE_FIRM hard-boot.
| -
| Yes
|-
| 0x04..0x07
| [[Flash_Filesystem|NAND]] partition keys.

Keyslot is determined by [[NCSD]] partition FS type and encryption type. The New3DS Process9 sets the keyY for keyslot 0x05 (New3DS CTRNAND) to a key from .(ro)data.
| Bootrom.
| Bootrom.
| -
| Yes
|-
| 0x0A
| DSiWare export key.

Used for encrypting the all-zero 0x10-byte block in the [[DSiWare_Exports|DSiWare_Exports]] header. Console-unique.
| See above keyslot info.
| See above keyslot info.
| -
| Yes
|-
| 0x0D
| SSL-certificate key.

See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].
| -
| -
| Bootrom.
| Yes
|-
| 0x11
| Temporary keyslot.

Used by FIRM for general normal-key crypto. Also used by the New3DS [[FIRM]] arm9 binary loader.
| Arm9Loader.
| Arm9Loader.
| NATIVE_FIRM.
| Yes
|-
| 0x14
| Starting with [[5.0.0-11]], NATIVE_FIRM Process9 now sets the keyY for this to the same one it uses for initializing 3 of the keyslots' keyYs from [[PSPXI:EncryptDecryptAes|here]].
| Bootrom.
| NATIVE_FIRM boot.
| -
| Yes
|-
| 0x15
| Used/initialized by the New3DS arm9 binary loader, see [[FIRM|here]].
| Arm9Loader.
| Arm9Loader.
| See previous info for this keyslot.
| No
|-
| 0x16
| Used/initialized by the New3DS arm9 binary loader starting with [[9.5.0-22|9.5.0-X]], see [[FIRM|here]].
| Arm9Loader.
| Arm9Loader.
| See previous info for this keyslot.
| No
|-
| 0x18..0x1F
| These are the New3DS keyslots, where the keyX is generated with keyslot 0x11 by the New3DS arm9 binary [[FIRM|loader]]. As of [[FIRM]] [[9.5.0-22|9.5.0-X]] keyslots 0x1B..0x1F are not yet used by Process9.
| Arm9Loader.
| NATIVE_FIRM / see previous info for these keyslots.
| See previous info for these keyslots.
| No
|-
| 0x18
| New3DS [[NCCH]] key.

Starting with [[9.3.0-21|9.3.0-X]].
| Arm9Loader.
| NATIVE_FIRM
| -
| No
|-
| 0x19
| New3DS gamecard [[Savegames|savedata]] AES-MAC key.

Equivalent of keyslot 0x33, used when a [[NCSD]] flag is set to a certain value (implemented with [[9.3.0-21|9.3.0-X]]).
| Arm9Loader.
| NATIVE_FIRM
| -
| No
|-
| 0x1A
| New3DS gamecard [[Savegames|savedata]] actual key.

Equivalent of keyslot 0x37, used when a [[NCSD]] flag is set to a certain value (implemented with [[9.3.0-21|9.3.0-X]]).
| Arm9Loader.
| NATIVE_FIRM
| -
| No
|-
| 0x25
| [[7.0.0-13|v7.0]] [[NCCH]] key.
| NATIVE_FIRM [[Savegames#6.0.0-11_Savegame_keyY|boot]].
| NATIVE_FIRM.
| -
| Yes
|-
| 0x2C
| [[NCCH|NCCH]] key.
| Bootrom.
| Process9.
| -
| Yes
|-
| 0x2D
| UDS local-WLAN CCMP key.

See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].
| Bootrom.
| Bootrom.
| -
| Yes
|-
| 0x2E
| Streetpass key.

See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x2F
| [[Savegames#6.0.0-11_Savegame_keyY|v6.0]] save key.
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x30
| SD/NAND AES-MAC key.

This keyY is initialized via [[Nand/private/movable.sed|movable.sed]]. This is used for calculating the AESMACs under SD [[SD_Filesystem|/Nintendo 3DS/<ID0>/<ID1>/]] (except [[DSiWare_Exports]]) and [[Flash_Filesystem|NAND]] /data/.
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x31
| APT wrap key.

See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]]. NATIVE_FIRM sets this keyY to the same one used for keyslot 0x2E.
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x32
| Unknown.

See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].
| Bootrom.
| Bootrom.
| -
| Yes
|-
| 0x33
| Gamecard [[Savegames|savedata]] AES-MAC.
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x34
| SD key.

This keyY is initialized via [[Nand/private/movable.sed|movable.sed]]. This is used for encrypting *all* SD card data under [[SD_Filesystem|/Nintendo 3DS/<ID0>/<ID1>/]].
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x35
| Movable.sed key.

This is the keyslot used for movable.sed encryption + AES-MAC with the import/export [[FSPXI:ImportIntegrityVerificationSeed|commands]].
| Bootrom.
| Bootrom.
| -
| Yes
|-
| 0x36
| Unknown. Used by friends module.

See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].
| Bootrom.
| Bootrom.
| -
| Yes
|-
| 0x37
| Gamecard [[Savegames|savedata]] actual key.
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x38
| BOSS key.

See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].
| Bootrom.
| Bootrom.
| -
| Yes
|-
| 0x39
| Download Play key, and unknown key.

This keyslot is used for two different keys. One is available via [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]]. NATIVE_FIRM sets this keyY to the same one used for keyslot 0x2E.
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x3A
| DSiWare export key.

This keyY is initialized via [[Nand/private/movable.sed|movable.sed]]. This is used for calculating the AESMACs for SD [[DSiWare_Exports]].
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|-
| 0x3D
| Common key.

Used to decrypt title keys in [[Ticket]].
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
|}

=== Updating keydata ===
The contents of the keyslot specified in REG_AESKEYCNT can be updated by consecutively writing four words to REG_AESKEYXFIFO (keyX), REG_AESKEYYFIFO(keyY), or REG_AESKEYFIFO (normalkey).

After writing to a keyslot, the keyslot must be selected again(write REG_AESKEYSEL + set REG_AESCNT bit26), even when writing to the same keyslot. Writing the last word to a key FIFO immediately after selecting a keyslot will not affect the keyslot keydata that gets used at that time, the new keydata will not get used until the keyslot gets selected again.

Writing to the key FIFOs with byte writes results in the AES engine converting the byte to a word for setting the key word, with this: word = (byteval) | (byteval<<8) | (byteval<<16) | (byteval<<24). The result is the same regardless of which FIFO register byte was written to.

The TWL keyslots 0x00-0x03 can be set directly by writing to the REG_AESKEY0-REG_AESKEY3 registers.

The key FIFOs can be written simultaneously. For example, executing the following 4 times will result in the keyX and keyY being set to all-zero(unknown for normalkey): memset(0x10009100, 0, 0x100);

Each key FIFO has a 0x10-byte tmp-buffer for storing the words written to that FIFO. Once the last word is written to a key FIFO, the filled tmp-buffer is then written to the key-data for the keyslot selected by REG_AESKEYCNT at the time the last word was written.

=== keyX ===
The ARM9 bootrom initializes the keyX for certain 3DS keyslots, the ARM9 bootrom may also initialize the keyY for certain keyslots. In certain cases Process9 may also set the keyX.

=== Hardware key generator ===
A dedicated hardware key generator can be used to generate a keyslot's normalkey from its keyX and keyY. The hardware key generator is triggered by writing the keyY, which is the only way to trigger it with the 3DS keyslots. The algorithm used for key generation is unknown.

Unless noted otherwise, all keyslots on retail units use the hardware key-generator.

=== FIRM-launch key clearing ===
Starting with [[9.0.0-20]] the Process9 FIRM-launch code now "clears" the following AES keyslots, with certain keydata by writing the normal-key: 0x15 and 0x18-0x20. These are the keyslots used by the New3DS [[FIRM]] arm9bin loader(minus keyslot 0x11), the New3DS Process9 does this too.

Recovery Mode

2015-03-05T06:11:49Z

Slashmolder:

The recovery mode (also known as Safe Mode Boot) can be accessed when turning on the Nintendo 3DS while holding A+R+L+Up(DPad).
This menu is made to update your Nintendo 3DS through internet, if an update previously failed.

However it is possible to use this menu to delete the nagging update message if your console downloaded an update while in sleep mode. It is believed that this menu simply erases all update data, as it should normally be accessed when the update files are corrupted.

3DS System Flaws

2015-01-11T21:34:37Z

Slashmolder: /* FIRM Process9 */

Exploits are used to execute unofficial code (homebrew) on the Nintendo 3DS. This page is a list of known 3DS-mode exploits.

==List of 3DS exploits==

==Current Efforts==
There are people working on finding exploits and documenting the 3DS. Here's a list of some current efforts being made to make homebrew on the 3DS possible:

* See [[Ninjhax|here]] regarding Ninjhax.

==Stale / Rejected Efforts==
* Neimod has been working on a RAM dumping setup for a little while now. He's de-soldered the 3DS's RAM chip and hooked it and the RAM pinouts on the 3DS' PCB up to a custom RAM dumping setup. Recent photos show that the setup is working quite well, with the 3DS successfully booting up. Pictures of neimod's work can be found on [http://www.flickr.com/photos/neimod/ his Flickr stream].

Neimod's flickr stream is now private and his work is considered awesome.

* A loser (who will remain unnamed) has released CFW and CIA installers along with other stolen and illegal stuff.

==Failed attempts==
Here are listed all attempts at exploiting 3DS software that have failed so far.

* Pushmo (3DSWare), QR codes: level name is properly limited to 16 characters, game doesn't crash with a longer name. The only possible crashes are triggered by out-of-bounds array index values, these crashes are not exploitable.

* Pyramids (3DSWare), QR codes: no strings. Only crashes are from out-of-bounds values (like background ID) and are not exploitable.

* 3DS browser, 2^32 characters long string: this is similar to the vulnerability fixed [http://git.chromium.org/gitweb/?p=external/Webkit.git;a=commitdiff;h=ec471f16fbd1f879cb631f9b022fd16acd75f4d4 here], concat-large-strings-crash2.html triggers a crash which is about the same as the one triggered by a 2^32 string. Most of the time this vulnerability will cause a memory page permissions fault, since the WebKit code attempts to copy the string text data to the output buffer located in read-only [[CRO0|CRO]] heap memory. The only difference between a crash triggered by a 2^32 string and the concat-large-strings-crash2.html crash is at the former copies the string data using the original string length(like 1 text character for "x", 4 for "xxxx") while the latter attempts to copy >12MB. In some ''very'' rare cases a thread separate from the string data-copy thread will crash, this might be exploitable. However, this is mostly useless since it rarely crashes this way.

==Tips and info==
The 3DS uses the XN feature of the ARM processor, and only apps that have the necessary permissions in their headers can set memory to be executable. This means that although a usable buffer overflow exploit would still be useful, it would not go the entire way towards allowing code to be run in an easy or practical fashion (like an actual homebrew launcher). For that, an exploit in the system is required. A buffer overflow exploit does, however, provide enough wiggle room through the use of return-oriented programming to potentially trigger a system exploit.

SD card [[extdata]] and SD savegames can be attacked, for consoles where the console-unique [[Nand/private/movable.sed|movable.sed]] was dumped.

Note that the publicly-available <v5.0 total-control exploits are [[FIRM|Process9]] exploits, not "kernel exploits".

==System flaws==

=== [[FIRM]] Process9 ===
{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in system version
! Last FIRM version this flaw was checked for
! Timeframe this was discovered
|-
|
| This can't be exploited from ARM11 userland.
| ARM9 code execution
| None
| [[9.3.0-21|9.3.0-X]]
| 2012
|-
| [[Process_Services_PXI|ps:VerifyRsaSha256]] buffer overflow
| Unchecked copy to a buffer in Process9's .bss. The buffer is located before the pxi cmdhandler threads' stacks.
| ARM9 code execution
| [[5.0.0-11]]
|
| 2012
|}

=== ARM11 kernel ===
{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in system version
! Last FIRM version this flaw was checked for
! Timeframe this was discovered
|-
| [[SVC]] table too small
| The table of function pointers for SVC's only contains entries up to 0x7D, but the biggest allowed SVC for the table is 0x7F. Thus, executing SVC7E or SVC7F would make the SVC-handler read after the buffer, and interpret some ARM instructions as function pointers.

However, this would require patching the kernel .text or modifying SVC-access-control. Even if you could get these to execute, they would still jump to memory that isn't mapped as executable.
|
| None
| [[9.3.0-21|9.3.0-21]]
| 2012
|-
| [[SVC|svcBackdoor (0x7B)]]
| This backdoor allows executing SVC-mode code at the user-specified code-address. This is used by Process9, using this on the ARM11(with NATIVE_FIRM) requires patching the kernel .text or modifying SVC-access-control.
| See description
| None
| [[9.3.0-21|9.3.0-21]]
|
|-
| [[Memory_layout#ARM11_Detailed_virtual_memory_map|0xEFF00000]] / 0xDFF00000 ARM11 kernel virtual-memory
| The ARM11 kernel-mode 0xEFF00000/0xDFF00000 virtual-memory(size 0x100000) is mapped to phys-mem 0x1FF00000(entire DSP-mem + entire AXIWRAM), with permissions RW-. This is used during ARM11 kernel startup, this never seems to be used after that, however.
|
| None
| [[9.3.0-21|9.3.0-21]]
|
|-
|
|
| When combined with other flaws: ARM11-kernelmode code execution
| [[9.3.0-21|9.3.0-21]]
|
| February 2014
|-
| PXI [[RPC_Command_Structure|Command]] input/output buffer permissions
| Originally the ARM11-kernel didn't check permissions for PXI input/output buffers for commands. Starting with [[6.0.0-11|6.0.0]] PXI input/output buffers must have RW permissions, otherwise kernelpanic is triggered.
|
| [[6.0.0-11|6.0.0-11]]
|
| 2012
|-
| [[SVC|svcStartInterProcessDma]]
| For svcStartInterProcessDma, the kernel code had the following flaws:

* Originally the ARM11-kernel read the input DmaConfig structure directly in kernel-mode(ldr(b/h) instructions), without checking whether the DmaConfig address is readable under userland. This was fixed by copying that structure to the SVC-mode stack, using the ldrbt instruction.

* Integer overflows for srcaddr+size and dstaddr+size are now checked(with [[6.0.0-11]]), which were not checked before.

* The kernel now also checks whether the srcaddr/dstaddr (+size) is within userland memory (0x20000000), the kernel now (with [[6.0.0-11]]) returns an error when the address is beyond userland memory. Using an address >=0x20000000 would result in the kernel reading from the process L1 MMU table, beyond the memory allocated for that MMU table(for vaddr->physaddr conversion).
|
| [[6.0.0-11]]
|
| DmaConfig issue: unknown. The rest: 2014
|-
| [[SVC|svcControlMemory]] Parameter checks
| For svcControlMemory the parameter check had these two flaws:

* The allowed range for addr0, addr1, size parameters depends on which MemoryOperation is being specified. The limitation for GSP heap was only checked if op=(u32)0x10003. By setting a random bit in op that has no meaning (like bit17?), op would instead be (u32)0x30003, and the range-check would be less strict and not accurate. However, the kernel doesn't actually use the input address for LINEAR memory-mapping at all besides the range-checks, so this isn't actually useful. This was fixed in the kernel by just checking for the LINEAR bit, instead of comparing the entire MemoryOperation value with 0x10003.

* Integer overflows on (addr0+size) are now checked that previously weren't (this also applies to most other address checks elsewhere in the kernel).

|
| [[5.0.0-11]]
|
|
|-
| [[RPC_Command_Structure|Command]] request/response buffer overflow
| Originally the kernel did not check the word-values from the command-header. Starting with [[5.0.0-11]], the kernel will trigger a kernelpanic() when the total word-size of the entire command(including the cmd-header) is larger than 0x40-words (0x100-bytes). This allows overwriting threadlocalstorage+0x180 in the destination thread. However, since the data written there would be translate parameters (such as header-words + buffer addresses), exploiting this would likely be very difficult, if possible at all.

If the two words at threadlocalstorage+0x180 could be overwritten with controlled data this way, one could then use a command with a buffer-header of <nowiki>((size<<14) | 2)</nowiki> to write arbitrary memory to any RW userland memory in the destination process.
|
| [[5.0.0-11]]
|
| v4.1 FIRM -> v5.0 code diff
|-
| [[SVC|SVC stack allocation overflows]]
|
* Syscalls that allocate a variable-length array on stack, only checked bit31 before multiplying by 4/16 (when calculating how much memory to allocate). If a large integer was passed as input to one of these syscalls, an integer overflow would occur, and too little memory would have been allocated on stack resulting in a buffer overrun.
* The alignment (size+7)&~7 calculation before allocation was not checked for integer overflow.

This might allow for ARM11 kernel code-execution.

(Applies to svcSetResourceLimitValues, svcGetThreadList, svcGetProcessList, svcReplyAndReceive, svcWaitSynchronizationN.)
|
| [[5.0.0-11]]
|
| v4.1 FIRM -> v5.0 code diff
|-
| [[SVC|svcControlMemory]] MemoryOperation MAP memory-permissions
| svcControlMemory with MemoryOperation=MAP allows mapping the already-mapped process virtual-mem at addr1, to addr0. The lowest address permitted for addr1 is 0x00100000. Originally the ARM11 kernel didn't check memory permissions for addr1. Therefore .text as addr1 could be mapped elsewhere as RW- memory, which allowed ARM11 userland code-execution.
|
| [[4.1.0-8]]
|
| 2012
|-
| [[RPC_Command_Structure|Command]] input/output buffer permissions
| Originally the ARM11 kernel didn't check memory permissions for the input/output buffers for commands. Starting with [[4.0.0-7]] the ARM11 kernel will trigger a kernelpanic() if the input/output buffers don't have the required memory permissions. For example, this allowed a FSUSER file-read to .text, which therefore allowed ARM11-userland code execution.
|
| [[4.0.0-7]]
|
| 2012
|-
| [[SVC|svcReadProcessMemory/svcWriteProcessMemory memory]] permissions
| Originally the kernel only checked the first page(0x1000-bytes) of the src/dst buffers, for svcReadProcessMemory and svcWriteProcessMemory. There is no known retail processes which have access to these SVCs.
|
| [[4.0.0-7]]
|
| 2012?
|}

=== [[FIRM]] ARM11 modules ===
{| class="wikitable" border="1"
|-
! Summary
! Description
! Fixed in system version
|-
| [[Services|"srv:pm"]] process registration
| Originally any process had access to the port "srv:pm". The PID's used for the (un)registration commands are not checked either. This allowed any process to re-register itself with "srv:pm", and therefore allowed the process to give itself access to any service, bypassing the exheader service-access-control list.

This was fixed in [[7.0.0-13]]: starting with [[7.0.0-13]] "srv:pm" is now a service instead of a globally accessible port. Only processes with PID's less than 6 (in other words: fs, ldr, sm, pm, pxi modules) have access to it. With [[7.0.0-13]] there can only be one session for "srv:pm" open at a time(this is used by pm module), svcBreak will be executed if more sessions are opened by the processes which can access this.

This flaw was needed for exploiting the <=v4.x Process9 PXI vulnerabilities from ARM11 userland ROP, since most applications don't have access to those service(s).
| [[7.0.0-13]]
|}

=== ARM11 system modules ===

=== ARM11 system applications and applets ===
{| class="wikitable" border="1"
|-
! Summary
! Description
! Fixed in system version
|-
| 3DS [[System Settings]] DS profile string stack-smash
| Too long or corrupted strings (01Ah 2 Nickname length in characters 050h 2 Message length in characters) in the NVRAM DS user settings (System Settings->Other Settings->Profile->Nintendo DS Profile) cause it to crash in 3DS-mode due to a stack-smash. The DSi is not vulnerable to this, DSi launcher(menu) and DSi System Settings will reset the NVRAM user-settings if the length field values are too long(same result as when the CRCs are invalid). TWL_FIRM also resets the NVRAM user-settings when the string-length(s) are too long.
| [[7.0.0-13]]
|}

3DS System Flaws

2015-01-07T21:47:05Z

Slashmolder: /* ARM11 kernel */

Exploits are used to execute unofficial code (homebrew) on the Nintendo 3DS. This page is a list of known 3DS-mode exploits.

==List of 3DS exploits==

==Current Efforts==
There are people working on finding exploits and documenting the 3DS. Here's a list of some current efforts being made to make homebrew on the 3DS possible:

* See [[Ninjhax|here]] regarding Ninjhax.

==Stale / Rejected Efforts==
* Neimod has been working on a RAM dumping setup for a little while now. He's de-soldered the 3DS's RAM chip and hooked it and the RAM pinouts on the 3DS' PCB up to a custom RAM dumping setup. Recent photos show that the setup is working quite well, with the 3DS successfully booting up. Pictures of neimod's work can be found on [http://www.flickr.com/photos/neimod/ his Flickr stream].

Neimod's flickr stream is now private and his work is considered awesome.

* A loser (who will remain unnamed) has released CFW and CIA installers along with other stolen and illegal stuff.

==Failed attempts==
Here are listed all attempts at exploiting 3DS software that have failed so far.

* Pushmo (3DSWare), QR codes: level name is properly limited to 16 characters, game doesn't crash with a longer name. The only possible crashes are triggered by out-of-bounds array index values, these crashes are not exploitable.

* Pyramids (3DSWare), QR codes: no strings. Only crashes are from out-of-bounds values (like background ID) and are not exploitable.

* 3DS browser, 2^32 characters long string: this is similar to the vulnerability fixed [http://git.chromium.org/gitweb/?p=external/Webkit.git;a=commitdiff;h=ec471f16fbd1f879cb631f9b022fd16acd75f4d4 here], concat-large-strings-crash2.html triggers a crash which is about the same as the one triggered by a 2^32 string. Most of the time this vulnerability will cause a memory page permissions fault, since the WebKit code attempts to copy the string text data to the output buffer located in read-only [[CRO0|CRO]] heap memory. The only difference between a crash triggered by a 2^32 string and the concat-large-strings-crash2.html crash is at the former copies the string data using the original string length(like 1 text character for "x", 4 for "xxxx") while the latter attempts to copy >12MB. In some ''very'' rare cases a thread separate from the string data-copy thread will crash, this might be exploitable. However, this is mostly useless since it rarely crashes this way.

==Tips and info==
The 3DS uses the XN feature of the ARM processor, and only apps that have the necessary permissions in their headers can set memory to be executable. This means that although a usable buffer overflow exploit would still be useful, it would not go the entire way towards allowing code to be run in an easy or practical fashion (like an actual homebrew launcher). For that, an exploit in the system is required. A buffer overflow exploit does, however, provide enough wiggle room through the use of return-oriented programming to potentially trigger a system exploit.

SD card [[extdata]] and SD savegames can be attacked, for consoles where the console-unique [[Nand/private/movable.sed|movable.sed]] was dumped.

Note that the publicly-available <v5.0 total-control exploits are [[FIRM|Process9]] exploits, not "kernel exploits".

==System flaws==

=== [[FIRM]] Process9 ===
{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in system version
! Last FIRM version this was flaw was checked for
! Timeframe this was discovered
|-
|
| This can't be exploited from ARM11 userland.
| ARM9 code execution
| None
| [[9.3.0-21|9.3.0-X]]
| 2012
|}

=== ARM11 kernel ===
{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in system version
! Last FIRM version this was flaw was checked for
! Timeframe this was discovered
|-
| [[SVC]] table too small
| The table of function pointers for SVC's only contains entries up to 0x7D, but the biggest allowed SVC for the table is 0x7F. Thus, executing SVC7E or SVC7F would make the SVC-handler read after the buffer, and interpret some ARM instructions as function pointers.

However, this would require patching the kernel .text or modifying SVC-access-control. Even if you could get these to execute, they would still jump to memory that isn't mapped as executable.
|
| None
| [[9.3.0-21|9.3.0-21]]
| 2012
|-
| [[SVC|svcBackdoor (0x7B)]]
| This backdoor allows executing SVC-mode code at the user-specified code-address. This is used by Process9, using this on the ARM11(with NATIVE_FIRM) requires patching the kernel .text or modifying SVC-access-control.
| See description
| None
| [[9.3.0-21|9.3.0-21]]
|
|-
| [[Memory_layout#ARM11_Detailed_virtual_memory_map|0xEFF00000]] / 0xDFF00000 ARM11 kernel virtual-memory
| The ARM11 kernel-mode 0xEFF00000/0xDFF00000 virtual-memory(size 0x100000) is mapped to phys-mem 0x1FF00000(entire DSP-mem + entire AXIWRAM), with permissions RW-. This is used during ARM11 kernel startup, this never seems to be used after that, however.
|
| None
| [[9.3.0-21|9.3.0-21]]
|
|-
|
|
| When combined with other flaws: ARM11-kernelmode code execution
| [[9.3.0-21|9.3.0-21]]
|
| February 2014
|-
| PXI [[RPC_Command_Structure|Command]] input/output buffer permissions
| Originally the ARM11-kernel didn't check permissions for PXI input/output buffers for commands. Starting with [[6.0.0-11|6.0.0]] PXI input/output buffers must have RW permissions, otherwise kernelpanic is triggered.
|
| [[6.0.0-11|6.0.0-11]]
|
| 2012
|-
| [[SVC|svcStartInterProcessDma]]
| For svcStartInterProcessDma, the kernel code had the following flaws:

* Originally the ARM11-kernel read the input DmaConfig structure directly in kernel-mode(ldr(b/h) instructions), without checking whether the DmaConfig address is readable under userland. This was fixed by copying that structure to the SVC-mode stack, using the ldrbt instruction.

* Integer overflows for srcaddr+size and dstaddr+size are now checked(with [[6.0.0-11]]), which were not checked before.

* The kernel now also checks whether the srcaddr/dstaddr (+size) is within userland memory (0x20000000), the kernel now (with [[6.0.0-11]]) returns an error when the address is beyond userland memory. Using an address >=0x20000000 would result in the kernel reading from the process L1 MMU table, beyond the memory allocated for that MMU table(for vaddr->physaddr conversion).
|
| [[6.0.0-11]]
|
| DmaConfig issue: unknown. The rest: 2014
|-
| [[SVC|svcControlMemory]] Parameter checks
| For svcControlMemory the parameter check had these two flaws:

* The allowed range for addr0, addr1, size parameters depends on which MemoryOperation is being specified. The limitation for GSP heap was only checked if op=(u32)0x10003. By setting a random bit in op that has no meaning (like bit17?), op would instead be (u32)0x30003, and the range-check would be less strict and not accurate. However, the kernel doesn't actually use the input address for LINEAR memory-mapping at all besides the range-checks, so this isn't actually useful. This was fixed in the kernel by just checking for the LINEAR bit, instead of comparing the entire MemoryOperation value with 0x10003.

* Integer overflows on (addr0+size) are now checked that previously weren't (this also applies to most other address checks elsewhere in the kernel).

|
| [[5.0.0-11]]
|
|
|-
| [[RPC_Command_Structure|Command]] request/response buffer overflow
| Originally the kernel did not check the word-values from the command-header. Starting with [[5.0.0-11]], the kernel will trigger a kernelpanic() when the total word-size of the entire command(including the cmd-header) is larger than 0x40-words (0x100-bytes). This allows overwriting threadlocalstorage+0x180 in the destination thread. However, since the data written there would be translate parameters (such as header-words + buffer addresses), exploiting this would likely be very difficult, if possible at all.

If the two words at threadlocalstorage+0x180 could be overwritten with controlled data this way, one could then use a command with a buffer-header of <nowiki>((size<<14) | 2)</nowiki> to write arbitrary memory to any RW userland memory in the destination process.
|
| [[5.0.0-11]]
|
| v4.1 FIRM -> v5.0 code diff
|-
| [[SVC|SVC stack allocation overflows]]
|
* Syscalls that allocate a variable-length array on stack, only checked bit31 before multiplying by 4/16 (when calculating how much memory to allocate). If a large integer was passed as input to one of these syscalls, an integer overflow would occur, and too little memory would have been allocated on stack resulting in a buffer overrun.
* The alignment (size+7)&~7 calculation before allocation was not checked for integer overflow.

This might allow for ARM11 kernel code-execution.

(Applies to svcSetResourceLimitValues, svcGetThreadList, svcGetProcessList, svcReplyAndReceive, svcWaitSynchronizationN.)
|
| [[5.0.0-11]]
|
| v4.1 FIRM -> v5.0 code diff
|-
| [[SVC|svcControlMemory]] MemoryOperation MAP memory-permissions
| svcControlMemory with MemoryOperation=MAP allows mapping the already-mapped process virtual-mem at addr1, to addr0. The lowest address permitted for addr1 is 0x00100000. Originally the ARM11 kernel didn't check memory permissions for addr1. Therefore .text as addr1 could be mapped elsewhere as RW- memory, which allowed ARM11 userland code-execution.
|
| [[4.1.0-8]]
|
| 2012
|-
| [[RPC_Command_Structure|Command]] input/output buffer permissions
| Originally the ARM11 kernel didn't check memory permissions for the input/output buffers for commands. Starting with [[4.0.0-7]] the ARM11 kernel will trigger a kernelpanic() if the input/output buffers don't have the required memory permissions. For example, this allowed a FSUSER file-read to .text, which therefore allowed ARM11-userland code execution.
|
| [[4.0.0-7]]
|
| 2012
|-
| [[SVC|svcReadProcessMemory/svcWriteProcessMemory memory]] permissions
| Originally the kernel only checked the first page(0x1000-bytes) of the src/dst buffers, for svcReadProcessMemory and svcWriteProcessMemory. There is no known retail processes which have access to these SVCs.
|
| [[4.0.0-7]]
|
| 2012?
|}

=== [[FIRM]] ARM11 modules ===
{| class="wikitable" border="1"
|-
! Summary
! Description
! Fixed in system version
|-
| [[Services|"srv:pm"]] process registration
| Originally any process had access to the port "srv:pm". The PID's used for the (un)registration commands are not checked either. This allowed any process to re-register itself with "srv:pm", and therefore allowed the process to give itself access to any service, bypassing the exheader service-access-control list.

This was fixed in [[7.0.0-13]]: starting with [[7.0.0-13]] "srv:pm" is now a service instead of a globally accessible port. Only processes with PID's less than 6 (in other words: fs, ldr, sm, pm, pxi modules) have access to it. With [[7.0.0-13]] there can only be one session for "srv:pm" open at a time(this is used by pm module), svcBreak will be executed if more sessions are opened by the processes which can access this.

This flaw was needed for exploiting the <=v4.x Process9 PXI vulnerabilities from ARM11 userland ROP, since most applications don't have access to those service(s).
| [[7.0.0-13]]
|}

=== ARM11 system modules ===

=== ARM11 system applications and applets ===
{| class="wikitable" border="1"
|-
! Summary
! Description
! Fixed in system version
|-
| 3DS [[System Settings]] DS profile string stack-smash
| Too long or corrupted strings (01Ah 2 Nickname length in characters 050h 2 Message length in characters) in the NVRAM DS user settings (System Settings->Other Settings->Profile->Nintendo DS Profile) cause it to crash in 3DS-mode due to a stack-smash. The DSi is not vulnerable to this, DSi launcher(menu) and DSi System Settings will reset the NVRAM user-settings if the length field values are too long(same result as when the CRCs are invalid). TWL_FIRM also resets the NVRAM user-settings when the string-length(s) are too long.
| [[7.0.0-13]]
|}

HTTP Services

2014-12-16T02:45:35Z

Slashmolder: /* HTTP service "http:C" */

[[Category:Services]]
= HTTP service "http:C" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010044
| [[HTTPC:Initialize|Initialize]]
|-
| 0x00020082
| [[HTTPC:CreateContext|CreateContext]]
|-
| 0x00030040
| [[HTTPC:CloseContext|CloseContext]]
|-
| 0x00040040
| CancelConnection (Context)
|-
| 0x00050040
| [[HTTPC:GetRequestState|GetRequestState]]
|-
| 0x00060040
| [[HTTPC:GetDownloadSizeState|GetDownloadSizeState]]
|-
| 0x00070040
| GetRequestError
|-
| 0x00080042
| [[HTTPC:InitializeConnectionSession|InitializeConnectionSession]]
|-
| 0x00090040
| [[HTTPC:BeginRequest|BeginRequest]]
|-
| 0x000A0040
| BeginRequestAsync
|-
| 0x000B0082
| [[HTTPC:ReceiveData|ReceiveData]]
|-
| 0x000C0102
| [[HTTPC:ReceiveDataTimeout|ReceiveDataTimeout]]
|-
| 0x000D0146
| SetProxy
|-
| 0x000E0040
| [[HTTPC:SetProxyDefault|SetProxyDefault]]
|-
| 0x000F00C4
| SetBasicAuthorization (char *user, u32 user_size, char *pass, u32 pass_size)
|-
| 0x00100080
| SetSocketBufferSize
|-
| 0x001100C4
| [[HTTPC:AddRequestHeader|AddRequestHeader]]
|-
| 0x001200C4
| [[HTTPC:AddPostDataAscii|AddPostDataAscii]]
|-
| 0x001300C4
| AddPostDataBinary
|-
| 0x00140082
| AddPostDataRaw
|-
| 0x00150080
| SetPostDataType(u8 enum)
|-
| 0x001600C4
| SendPostDataAscii
|-
| 0x00170144
| SendPostDataAsciiTimeout
|-
| 0x001800C4
| SendPostDataBinary
|-
| 0x00190144
| SendPostDataBinaryTimeout
|-
| 0x001A0082
| SendPostDataRaw
|-
| 0x001B0102
| [[HTTPC:SendPOSTDataTimeout|SendPOSTDataRawTimeout]]
|-
| 0x001C0080
| SetPostDataEncoding
|-
| 0x001D0040
| NotifyFinishSendPostData
|-
| 0x001E00C4
| [[HTTPC:GetResponseHeader|GetResponseHeader]]
|-
| 0x001F0144
| [[HTTPC:GetResponseHeaderTimeout|GetResponseHeaderTimeout]]
|-
| 0x00200082
| [[HTTPC:GetResponseData|GetResponseData]]
|-
| 0x00210102
| GetResponseDataTimeout
|-
| 0x00220040
| [[HTTPC:GetResponseStatusCode|GetResponseStatusCode]]
|-
| 0x002300C0
| [[HTTPC:GetResponseStatusCodeTimeout|GetResponseStatusCodeTimeout]]
|-
| 0x00240082
| [[HTTPC:AddTrustedRootCA|AddTrustedRootCA]]
|-
| 0x00250080
|
|-
| 0x00260080
|
|-
| 0x002700C4
|
|-
| 0x00280080
|
|-
| 0x00290080
|
|-
| 0x002A0040
|
|-
| 0x002B0080
|
|-
| 0x002C0080
|
|-
| 0x002D0000
|
|-
| 0x002E0040
|
|-
| 0x002F0082
|
|-
| 0x00300080
|
|-
| 0x00310080
|
|-
| 0x00320084
|
|-
| 0x00330040
|
|-
| 0x00340040
|
|-
| 0x00350186
| SetDefaultProxy
|-
| 0x00360000
| ClearDNSCache
|-
| 0x00370080
| SetKeepAlive (bool)
|-
| 0x003800C0
| SetPostDataTypeSize (u8 enum, u32 size) (similar to SetPostDataType)
|-
| 0x00390000
| Finalize
|-
| 0x003A....
|
|-
| 0x003B0082
|
|-
| 0x003C....
|
|-
| 0x003D....
|
|-
| 0x003E....
|
|-
| 0x003F....
|
|-
| 0x00400082
|
|-
| 0x0041....
|
|-
| 0x0042....
|
|}

HTTP Services

2014-12-16T02:22:00Z

Slashmolder:

[[Category:Services]]
= HTTP service "http:C" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010044
| [[HTTPC:Initialize|Initialize]] ?
|-
| 0x00020082
| [[HTTPC:CreateContext|CreateContext]]
|-
| 0x00030040
| [[HTTPC:CloseContext|CloseContext]]
|-
| 0x00040040
| CancelConnection (Context)
|-
| 0x00050040
| [[HTTPC:GetRequestState|GetRequestState]]
|-
| 0x00060040
| [[HTTPC:GetDownloadSizeState|GetDownloadSizeState]]
|-
| 0x00070040
| GetRequestError
|-
| 0x00080042
| [[HTTPC:InitializeConnectionSession|InitializeConnectionSession]]
|-
| 0x00090040
| [[HTTPC:BeginRequest|BeginRequest]]
|-
| 0x000A0040
| BeginRequestAsync
|-
| 0x000B0082
| [[HTTPC:ReceiveData|ReceiveData]]
|-
| 0x000C0102
| [[HTTPC:ReceiveDataTimeout|ReceiveDataTimeout]]
|-
| 0x000D0146
| SetProxy
|-
| 0x000E0040
| [[HTTPC:SetProxyDefault|SetProxyDefault]]
|-
| 0x000F00C4
| SetBasicAuthorization (char *user, u32 user_size, char *pass, u32 pass_size)
|-
| 0x00100080
| SetSocketBufferSize
|-
| 0x001100C4
| [[HTTPC:AddRequestHeader|AddRequestHeader]]
|-
| 0x001200C4
| [[HTTPC:AddPostDataAscii|AddPostDataAscii]]
|-
| 0x001300C4
| AddPostDataBinary
|-
| 0x00140082
| AddPostDataRaw
|-
| 0x00150080
| SetPostDataType(u8 enum)
|-
| 0x001600C4
| SendPostDataAscii
|-
| 0x00170144
| SendPostDataAsciiTimeout
|-
| 0x001800C4
| SendPostDataBinary
|-
| 0x00190144
| SendPostDataBinaryTimeout
|-
| 0x001A0082
| SendPostDataRaw
|-
| 0x001B0102
| [[HTTPC:SendPOSTDataTimeout|SendPOSTDataRawTimeout]]
|-
| 0x001C0080
| SetPostDataEncoding
|-
| 0x001D0040
| NofityFinishSendPostData
|-
| 0x001E00C4
| [[HTTPC:GetResponseHeader|GetResponseHeader]]
|-
| 0x001F0144
| [[HTTPC:GetResponseHeaderTimeout|GetResponseHeaderTimeout]]
|-
| 0x00200082
| [[HTTPC:GetResponseData|GetResponseData]]
|-
| 0x00210102
| GetResponseDataTimeout
|-
| 0x00220040
| [[HTTPC:GetResponseStatusCode|GetResponseStatusCode]]
|-
| 0x002300C0
| [[HTTPC:GetResponseStatusCodeTimeout|GetResponseStatusCodeTimeout]]
|-
| 0x00240082
| [[HTTPC:AddTrustedRootCA|AddTrustedRootCA]]
|-
| 0x00250080
|
|-
| 0x00260080
|
|-
| 0x002700C4
|
|-
| 0x00280080
|
|-
| 0x00290080
|
|-
| 0x002A0040
|
|-
| 0x002B0080
|
|-
| 0x002C0080
|
|-
| 0x002D0000
|
|-
| 0x002E0040
|
|-
| 0x002F0082
|
|-
| 0x00300080
|
|-
| 0x00310080
|
|-
| 0x00320084
|
|-
| 0x00330040
|
|-
| 0x00340040
|
|-
| 0x00350186
| SetDefaultProxy
|-
| 0x00360000
| ClearDNSCache
|-
| 0x00370080
| SetKeepAlive (bool)
|-
| 0x003800C0
| SetPostDataTypeSize (u8 enum, u32 size) (similar to SetPostDataType)
|-
| 0x00390000
| Finalize
|-
| 0x003A....
|
|-
| 0x003B0082
|
|-
| 0x003C....
|
|-
| 0x003D....
|
|-
| 0x003E....
|
|-
| 0x003F....
|
|-
| 0x00400082
|
|-
| 0x0041....
|
|-
| 0x0042....
|
|}

HTTPC:GetResponseStatusCodeTimeout

2014-12-16T01:35:44Z

Slashmolder: /* Request */

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x002300C0]
|-
| 1
| HTTP context handle
|-
| 2-3
| u64 nanoseconds timeout
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code
|-
| 1
| Result code
|-
| 2
| HTTP response status code
|}

HTTPC:GetResponseStatusCodeDelay

2014-12-16T01:35:30Z

Slashmolder: moved HTTPC:GetResponseStatusCodeDelay to HTTPC:GetResponseStatusCodeTimeout

#REDIRECT [[HTTPC:GetResponseStatusCodeTimeout]]

HTTPC:GetResponseStatusCodeTimeout

2014-12-16T01:35:30Z

Slashmolder: moved HTTPC:GetResponseStatusCodeDelay to HTTPC:GetResponseStatusCodeTimeout

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x002300C0]
|-
| 1
| HTTP context handle
|-
| 2-3
| u64 nanoseconds [[HTTPC:ReceiveDataDelay|delay]]
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code
|-
| 1
| Result code
|-
| 2
| HTTP response status code
|}

HTTPC:GetResponseHeaderDelay

2014-12-16T01:34:46Z

Slashmolder: moved HTTPC:GetResponseHeaderDelay to HTTPC:GetResponseHeaderTimeout

#REDIRECT [[HTTPC:GetResponseHeaderTimeout]]

HTTPC:GetResponseHeaderTimeout

2014-12-16T01:34:46Z

Slashmolder: moved HTTPC:GetResponseHeaderDelay to HTTPC:GetResponseHeaderTimeout

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x001F0144]
|-
| 1
| HTTP context handle
|-
| 2
| Header name buffer size, including null-terminator.
|-
| 3
| Header value buffer max size, including null-terminator.
|-
| 4-5
| u64 nanoseconds timeout
|-
| 6
| (HeaderNameSize<<14) <nowiki>|</nowiki> 0xC02
|-
| 7
| Header name input data pointer
|-
| 8
| (HeaderValueSize<<4) <nowiki>|</nowiki> 12
|-
| 9
| Header value output data pointer
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code
|-
| 1
| Result code
|-
| 2
| Total header value buffer size
|}

=Description=
This obtains the string value for the specified HTTP response header. This returns error-code 0xD8A0A028 when the specified header doesn't exist in the received response.

HTTPC:GetResponseHeaderTimeout

2014-12-16T01:34:37Z

Slashmolder: /* Request */

HTTPC:SendPOSTDataTimeout

2014-12-16T01:33:33Z

Slashmolder:

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x001B0102]
|-
| 1
| HTTP context handle
|-
| 2
| Buffer size
|-
| 3-4
| u64 nanoseconds timeout
|-
| 5
| (Size<<4) <nowiki>|</nowiki> 10
|-
| 6
| Input data pointer
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code
|-
| 1
| Result code
|}

=Description=
This uploads the specified raw POST data content.

HTTPC:SendPOSTDataDelay

2014-12-16T01:31:14Z

Slashmolder: moved HTTPC:SendPOSTDataDelay to HTTPC:SendPOSTDataTimeout

#REDIRECT [[HTTPC:SendPOSTDataTimeout]]

HTTPC:SendPOSTDataTimeout

2014-12-16T01:31:14Z

Slashmolder: moved HTTPC:SendPOSTDataDelay to HTTPC:SendPOSTDataTimeout

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x001B0102]
|-
| 1
| HTTP context handle
|-
| 2
| Buffer size
|-
| 3-4
| u64 nanoseconds [[HTTPC:ReceiveDataDelay|delay]]
|-
| 5
| (Size<<4) <nowiki>|</nowiki> 10
|-
| 6
| Input data pointer
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code
|-
| 1
| Result code
|}

=Description=
This uploads the specified raw POST data content.

HTTPC:AddRequestFormEntry

2014-12-16T01:30:25Z

Slashmolder: moved HTTPC:AddRequestFormEntry to HTTPC:AddPostDataAscii

#REDIRECT [[HTTPC:AddPostDataAscii]]

HTTPC:AddPostDataAscii

2014-12-16T01:30:25Z

Slashmolder: moved HTTPC:AddRequestFormEntry to HTTPC:AddPostDataAscii

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x001200C4]
|-
| 1
| HTTP context handle
|-
| 2
| Form name buffer size, including null-terminator.
|-
| 3
| Form value buffer size, including null-terminator.
|-
| 4
| (FormNameSize<<14) <nowiki>|</nowiki> 0xC02
|-
| 5
| Form name data pointer
|-
| 6
| (FormValueSize<<4) <nowiki>|</nowiki> 10
|-
| 7
| Form value data pointer
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code
|-
| 1
| Result code
|}

=Description=
This URL-encodes the specified "name=value" data, then adds it to the POST data which will be uploaded once the request is [[HTTPC:BeginRequest|sent]]. When using this command, [[HTTPC:AddRequestHeader]] must be used to add a "Content-Type: application/x-www-form-urlencoded" header.

HTTPC:ReceiveDataTimeout

2014-12-16T01:26:52Z

Slashmolder: /* Request */

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x000C0102]
|-
| 1
| HTTP context handle
|-
| 2
| Buffer size
|-
| 3-4
| u64 nanoseconds delay, this specifies the maximum length of time to wait for the server to reply/send data before returning a time-out error
|-
| 5
| (OutSize<<4) <nowiki>|</nowiki> 12
|-
| 6
| Output data pointer
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code
|-
| 1
| Result code
|}

=Description=
This writes the downloaded content(after the HTTP headers) to the output buffer.
Returns error code 0xd840a02b if the buffer is too small.

HTTPC:ReceiveDataDelay

2014-12-16T01:25:32Z

Slashmolder: moved HTTPC:ReceiveDataDelay to HTTPC:ReceiveDataTimeout: More descriptive title

#REDIRECT [[HTTPC:ReceiveDataTimeout]]

HTTPC:ReceiveDataTimeout

2014-12-16T01:25:32Z

Slashmolder: moved HTTPC:ReceiveDataDelay to HTTPC:ReceiveDataTimeout: More descriptive title

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x000C0102]
|-
| 1
| HTTP context handle
|-
| 2
| Buffer size
|-
| 3-4
| u64 nanoseconds delay, this specifies the maximum length of time to wait for the server to reply/send data before returning a time-out error?
|-
| 5
| (OutSize<<4) <nowiki>|</nowiki> 12
|-
| 6
| Output data pointer
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code
|-
| 1
| Result code
|}

=Description=
This writes the downloaded content(after the HTTP headers) to the output buffer.
Returns error code 0xd840a02b if the buffer is too small.

HTTP Services

2014-12-16T00:47:18Z

Slashmolder: /* HTTP service "http:C" */

[[Category:Services]]
= HTTP service "http:C" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010044
| [[HTTPC:Initialize|Initialize]] ?
|-
| 0x00020082
| [[HTTPC:CreateContext|CreateContext]]
|-
| 0x00030040
| [[HTTPC:CloseContext|CloseContext]]
|-
| 0x00040040
| CancelConnection (Context)
|-
| 0x00050040
| [[HTTPC:GetRequestState|GetRequestState]]
|-
| 0x00060040
| [[HTTPC:GetDownloadSizeState|GetDownloadSizeState]]
|-
| 0x00070040
| GetRequestError
|-
| 0x00080042
| [[HTTPC:InitializeConnectionSession|InitializeConnectionSession]]
|-
| 0x00090040
| [[HTTPC:BeginRequest|BeginRequest]]
|-
| 0x000A0040
| BeginRequestAsync
|-
| 0x000B0082
| [[HTTPC:ReceiveData|ReceiveData]]
|-
| 0x000C0102
| [[HTTPC:ReceiveDataDelay|ReceiveDataDelay]] 
|-
| 0x000E0040
| [[HTTPC:SetProxyDefault|SetProxyDefault]] 
|-
| 0x000F00C4
| SetBasicAuthorization (char *user, u32 user_size, char *pass, u32 pass_size)
|-
| 0x00100080
| SetSocketBufferSize
|-
| 0x001100C4
| [[HTTPC:AddRequestHeader|AddRequestHeader]]
|-
| 0x001200C4
| [[HTTPC:AddRequestFormEntry|AddRequestFormEntry]] 
|-
| 0x001300C4
| AddPostDataBinary
|-
| 0x00140082
| AddPostDataRaw
|-
| 0x00150080
|
|-
| 0x001600C4
| SendPostDataAscii
|-
| 0x00170144
| SendPostDataAsciiTimeout
|-
| 0x001800C4
| SendPostDataBinary
|-
| 0x00190144
| SendPostDataBinaryTimeeout
|-
| 0x001A0082
| SendPostDataRaw
|-
| 0x001B0102
| [[HTTPC:SendPOSTDataDelay|SendPOSTDataDelay]] 
|-
| 0x001C0080
| SetPostDataEncoding
|-
| 0x001D0040
| NofityFinishSendPostData
|-
| 0x001E00C4
| [[HTTPC:GetResponseHeader|GetResponseHeader]]
|-
| 0x001F0144
| [[HTTPC:GetResponseHeaderDelay|GetResponseHeaderDelay]] 
|-
| 0x00200082
| [[HTTPC:GetResponseData|GetResponseData]]
|-
| 0x00210102
| GetResponseDataTimeout
|-
| 0x00220040
| [[HTTPC:GetResponseStatusCode|GetResponseStatusCode]]
|-
| 0x002300C0
| [[HTTPC:GetResponseStatusCodeDelay|GetResponseStatusCodeDelay]] 
|-
| 0x00240082
| [[HTTPC:AddTrustedRootCA|AddTrustedRootCA]]
|-
| 0x00250080
|
|-
| 0x00260080
|
|-
| 0x002700C4
|
|-
| 0x00280080
|
|-
| 0x00290080
|
|-
| 0x002A0040
|
|-
| 0x002B0080
|
|-
| 0x002C0080
|
|-
| 0x002D0000
|
|-
| 0x002E0040
|
|-
| 0x002F0082
|
|-
| 0x00300080
|
|-
| 0x00310080
|
|-
| 0x00320084
|
|-
| 0x00330040
|
|-
| 0x00340040
|
|-
| 0x00350186
| SetDefaultProxy
|-
| 0x00360000
| ClearDNSCache
|-
| 0x00370080
| SetKeepAlive (bool)
|-
| 0x003800C0
|
|-
| 0x00390000
| Finalize
|-
| 0x003A....
|
|-
| 0x003B0082
|
|-
| 0x003C....
|
|-
| 0x003D....
|
|-
| 0x003E....
|
|-
| 0x003F....
|
|-
| 0x00400082
|
|-
| 0x0041....
|
|-
| 0x0042....
|
|}

HTTPC:CreateContext

2014-12-15T23:10:59Z

Slashmolder:

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x00020082]
|-
| 1
| URL buffer size, including null-terminator.
|-
| 2
| u8 RequestMethod
|-
| 3
| (URLSize<<4) <nowiki>|</nowiki> 10
|-
| 4
| URL data pointer
|}

== enum RequestMethod ==
{| class="wikitable" border="1"
! Memory state flags
! Bit
|-
| NONE (this causes an error)
| 0
|-
| GET
| 1
|-
| POST 
| 2
|-
| HEAD
| 3
|-
| PUT 
|4
|-
| DELETE
|5
|-
| POST
|6
|-
| PUT
|7
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code
|-
| 1
| Result code
|-
| 2
| HTTP context handle
|}

HTTPC:CreateContext

2014-12-15T23:09:15Z

Slashmolder:

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x00020082]
|-
| 1
| URL buffer size, including null-terminator.
|-
| 2
| u8 RequestMethod
|-
| 3
| (URLSize<<4) <nowiki>|</nowiki> 10
|-
| 4
| URL data pointer
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code
|-
| 1
| Result code
|-
| 2
| HTTP context handle
|}

== enum RequestMethod ==
{| class="wikitable" border="1"
! Memory state flags
! Bit
|-
| NONE (this causes an error)
| 0
|-
| GET
| 1
|-
| POST 
| 2
|-
| HEAD
| 3
|-
| PUT 
|4
|-
| DELETE
|5
|-
| POST
|6
|-
| PUT
|7
|}

HTTP Services

2014-12-15T02:17:45Z

Slashmolder: /* HTTP service "http:C" */

[[Category:Services]]
= HTTP service "http:C" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010044
| [[HTTPC:Initialize|Initialize]] ?
|-
| 0x00020082
| [[HTTPC:CreateContext|CreateContext]]
|-
| 0x00030040
| [[HTTPC:CloseContext|CloseContext]]
|-
| 0x00050040
| [[HTTPC:GetRequestState|GetRequestState]]
|-
| 0x00060040
| [[HTTPC:GetDownloadSizeState|GetDownloadSizeState]]
|-
| 0x00070040
| GetRequestError
|-
| 0x00080042
| [[HTTPC:InitializeConnectionSession|InitializeConnectionSession]]
|-
| 0x00090040
| [[HTTPC:BeginRequest|BeginRequest]]
|-
| 0x000A0040
| BeginRequestAsync
|-
| 0x000B0082
| [[HTTPC:ReceiveData|ReceiveData]]
|-
| 0x000C0102
| [[HTTPC:ReceiveDataDelay|ReceiveDataDelay]] 
|-
| 0x000E0040
| [[HTTPC:SetProxyDefault|SetProxyDefault]] 
|-
| 0x000F00C4
| SetBasicAuthorization (char *user, u32 user_size, char *pass, u32 pass_size)
|-
| 0x00100080
| SetSocketBufferSize
|-
| 0x001100C4
| [[HTTPC:AddRequestHeader|AddRequestHeader]]
|-
| 0x001200C4
| [[HTTPC:AddRequestFormEntry|AddRequestFormEntry]] 
|-
| 0x001300C4
| AddPostDataBinary
|-
| 0x00140082
| AddPostDataRaw
|-
| 0x00150080
|
|-
| 0x001600C4
| SendPostDataAscii
|-
| 0x00170144
| SendPostDataAsciiTimeout
|-
| 0x001800C4
| SendPostDataBinary
|-
| 0x00190144
| SendPostDataBinaryTimeeout
|-
| 0x001A0082
| SendPostDataRaw
|-
| 0x001B0102
| [[HTTPC:SendPOSTDataDelay|SendPOSTDataDelay]] 
|-
| 0x001C0080
| SetPostDataEncoding
|-
| 0x001D0040
| NofityFinishSendPostData
|-
| 0x001E00C4
| [[HTTPC:GetResponseHeader|GetResponseHeader]]
|-
| 0x001F0144
| [[HTTPC:GetResponseHeaderDelay|GetResponseHeaderDelay]] 
|-
| 0x00200082
| [[HTTPC:GetResponseData|GetResponseData]]
|-
| 0x00210102
| GetResponseDataTimeout
|-
| 0x00220040
| [[HTTPC:GetResponseStatusCode|GetResponseStatusCode]]
|-
| 0x002300C0
| [[HTTPC:GetResponseStatusCodeDelay|GetResponseStatusCodeDelay]] 
|-
| 0x00240082
| [[HTTPC:AddTrustedRootCA|AddTrustedRootCA]]
|-
| 0x00250080
|
|-
| 0x00260080
|
|-
| 0x002700C4
|
|-
| 0x00280080
|
|-
| 0x00290080
|
|-
| 0x002A0040
|
|-
| 0x002B0080
|
|-
| 0x002C0080
|
|-
| 0x002D0000
|
|-
| 0x002E0040
|
|-
| 0x002F0082
|
|-
| 0x00300080
|
|-
| 0x00310080
|
|-
| 0x00320084
|
|-
| 0x00330040
|
|-
| 0x00340040
|
|-
| 0x00350186
| SetDefaultProxy
|-
| 0x00360000
| ClearDNSCache
|-
| 0x00370080
| SetKeepAlive (bool)
|-
| 0x003800C0
|
|-
| 0x00390000
| Finalize
|-
| 0x003A....
|
|-
| 0x003B0082
|
|-
| 0x003C....
|
|-
| 0x003D....
|
|-
| 0x003E....
|
|-
| 0x003F....
|
|-
| 0x00400082
|
|-
| 0x0041....
|
|-
| 0x0042....
|
|}

Title list

2014-12-13T21:59:29Z

Slashmolder: /* 0004009B - System Data Archives (Shared Archives) */

The Nintendo 3DS utilizes a similar title-based organization as seen in the Wii and DSi platforms. The update server is located [http://nus.cdn.c.shop.nintendowifi.net/ccs/download/ here]. When using SSL, the update/shop servers must be accessed via SSLv3.

The organization of Title IDs has not been documented fully yet. Region info isn't stored in title IDs however there does appear to be evidence that the regions are sequential, similar to how Wii System Menu Updates are ordered: JPN USA EUR KOR and CHN (introduced with the DSi). 3DS has one additional region: TWN.

Note: The terms 'Title ID', 'Partition ID' and 'Media ID' are interchangeable.

The 3DS retrieves system [[CommonETicket|tickets]] with SOAP request GetSystemCommonETicket, instead of directly downloading the cetk with HTTPS. The cetk is still accessible via HTTP, however 3DS doesn't use direct HTTP for this.

'''TitleID Structure''': 0xCCCCABCDLLLLLLRR

* CCCC defines the console '''Platform''' (5=WiiU, 4=3DS, 3=DSi, 1=[http://wiibrew.org/wiki/Title_database Wii])
* ABCD defines the '''Content Category''' of the title, Demo, DLPChild, etc.
* LLLLLL For CTR titles, this is the title's '''Unique ID'''. For TWL converted titles this is in two sections grouped as SSLLLL. SS is the old title identification used by the DSi and is made redundant by 'ABCD'. LLLL is the TWL title's 'Unique ID'. There are restrictions on the Unique ID, see below for more info.
* RR This is the Title ID '''Variation''', and has various uses.

'''Content Categories''':

This u16 is a collection bit mask flag. Each Category is a group of one or more bit masks.

Specific Bitmask Flags:
{| class="wikitable" border="1"
|-
! Category
! Bitmask
|-
| Normal
| 0x0
|-
| DlpChild
| 0x1
|-
| Demo
| 0x2
|-
| Contents
| 0x3
|-
| AddOnContents
| 0x4
|-
| Patch
| 0x6
|-
| CannotExecution
| 0x8
|-
| System
| 0x10
|-
| RequireBatchUpdate
| 0x20
|-
| NotRequireUserApproval
| 0x40
|-
| NotRequireRightForMount
| 0x80
|-
| CanSkipConvertJumpId
| 0x100
|-
| TWL
| 0x8000
|}

* TWL Category bit mask are carried over from original TWL category bitmasks (ignoring bit mask 0x8000), so TWL system titles have the bitmask of 0x8001.

* System titles (TWL and CTR) are eligible to be updated during a System Update.

* Bit Mask 0x4000 appears to be reserved, as it renders the ''TWL'' and ''System'' bit masks useless.

'''Unique ID Restrictions''':

For the CTR titles, there appears to be is a correlation between Unique IDs (UID) and 3DS 'title types'. For developer titles this is known(shown below), and retail titles *appear* to follow suite. It is unknown if this correlation is enforced on retail units, or if it is just for organisation purposes.

{| class="wikitable" border="1"
|-
! TITLE TYPE
! UNIQUE ID RANGE
|-
| System
| 0x0 - 0x2FF
|-
| Application
| 0x300 - 0xF7FFF
|-
| Evaluation
| 0xF8000 -0xFFFFF
|-
| Prototype*
| 0xFF000 - 0xFF3FF
|}
<nowiki>*</nowiki>On the home menu, titles with UIDs within the 'Prototype' range, appear on the home menu after install without the gift fanfare.

ProgramID/titleID low bitmask 0xF0000000(uniqueID bitmask 0xF00000) seems to be related to which hardware the title is allowed to run on. 3DS code tends to clear this bitmask when handling programIDs. This bitmask is normally zero. When this is 0x2, this indicates that the title only runs on [[New_3DS]](that is, programID-low 0x20000000 / uniqueID 0x200000).

'''TitleID Variation''':

This u8 allows enumeration of titles from the same category and unique ID. Common uses are explained below:

* CTR System Titles: The 3DS has two copies of most modules/applets/archives for usage with either the NATIVE_FIRM or SAFE_MODE_FIRM. This is allowed for, by changing the title ID variation of the title to match the core version set by the FIRM it is designed to be used with:
{| class="wikitable" border="1"
|-
! RR
! MEANING
|-
| 02
| System Title (Core version 0x2)
|-
| 03
| SAFE_MODE System Title (Core version 0x3)
|}
Normally on retail SAFE_MODE ARM11 [[NCCH#CXI|CXI]] titles can't be launched, since the [[Configuration_Memory|system]] core version doesn't match the CXI exheader core version.

* Only most non-Normal Applications are known to utilise Title ID variation, this is explained in their respective sections on this page.

* [[3DS Development Unit Software|Dev Menu]] installs CTR Applications with a TitleID variation of 0x02 to the CTR NAND.

* Title ID variation is ignored for TWL titles, this value is carried over from the original TWL title ID and is used for region lock:

=== Versions ===

v## = 0xHHHH = 0bBBBBBBBB...

* The version major,minor and micro can be extracted from the version number by converting the 16 bit number to binary
* 6 bits : Major
* 6 bits : Minor
* 4 bits : Micro ('Build' in some contexts)
* i.e. v2069 (Taken from 000400DB00017302) = 0b000010 000001 0101 means that the title version is v2.1.5. For reasons unknown, the CVer build, stored in the RomFS of the title, has always been zero (at time of writing), regardless of the CVer build in the TMD. So when predicting the firmware version, this should be taken into account.

NOTE: This Title list is a condensed version, only the System Titles lists are full lists. For a full list of titles on Nintendo's CDN, see [http://mtheall.com/~mtheall/tmdlist.php here]. The reports/title-lists from [http://yls8.mtheall.com/ninupdates/reports.php here] are automatically obtained from the system update SOAP.

== CTR System Titles ==
{| class="wikitable" border="1"
|-
! System Category
! Bit Mask(s)
! Category Bit Mask
|-
| Application (SYSTEM_APPLICATION)
| Normal<nowiki>|</nowiki>System
| 0x0010
|-
| System Data Archives (SYSTEM_CONTENT)
| Contents<nowiki>|</nowiki>CannotExecution<nowiki>|</nowiki>System
| 0x001B
|-
| Shared Data Archives (SHARED_CONTENT)
| Contents<nowiki>|</nowiki>CannotExecution<nowiki>|</nowiki>System<nowiki>|</nowiki>NotRequireRightForMount
| 0x009B
|-
| System Data Archives (AUTO_UPDATE_CONTENT)
| Contents<nowiki>|</nowiki>CannotExecution<nowiki>|</nowiki>System<nowiki>|</nowiki>NotRequireUserApproval<nowiki>|</nowiki>NotRequireRightForMount
| 0x00DB
|-
| Applet (APPLET)
| Normal<nowiki>|</nowiki>System<nowiki>|</nowiki>RequireBatchUpdate
| 0x0030
|-
| Module (BASE)
| Normal<nowiki>|</nowiki>System<nowiki>|</nowiki>RequireBatchUpdate<nowiki>|</nowiki>CanSkipConvertJumpId
| 0x0130
|-
| Firmware (FIRMWARE)
| Normal<nowiki>|</nowiki>CannotExecution<nowiki>|</nowiki>System<nowiki>|</nowiki>RequireBatchUpdate<nowiki>|</nowiki>CanSkipConvertJumpId
| 0x0138
|}

=== 00040010 - System Applications ===
The versions for CHN, KOR, and TWN are separate from the other regions.

{| class="wikitable" border="1"
|-
! JPN TIDLow
! USA TIDLow
! EUR TIDLow
! CHN TIDLow
! KOR TIDLow
! TWN TIDLow
! Description
! JPN Versions
! EUR Versions
! USA Versions
! CHN Versions
! KOR Versions
! TWN Versions
! Status
|-
| 00020000
| 00021000
| 00022000
| 00026000
| 00027000
| 00028000
| [[System Settings]] (mset)
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[3.0.0-5|v2060]], [[4.0.0-7|v3074]], [[5.0.0-11|v4097]], [[6.0.0-11|v5127]], [[7.0.0-13|v6157]], [[7.2.0-17|v7173]], [[8.1.0-0_New3DS|v8198]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v9224]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[3.0.0-5|v2061]], [[4.0.0-7|v3075]], [[5.0.0-11|v4097]], [[6.0.0-11|v5127]], [[7.0.0-13|v6157]], [[7.2.0-17|v7174]], [[9.0.0-20|v8203]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1027]], [[3.0.0-5|v2062]], [[4.0.0-7|v3078]], [[5.0.0-11|v4098]], [[6.0.0-11|v5128]], [[7.0.0-13|v6157]], [[7.2.0-17|v7174]], [[9.0.0-20|v8202]]
| [[4.0.0-7|v8]], [[4.4.0-10|v1024]](CHN-only sysupdate for just mset), [[5.0.0-11|v2049]], [[7.0.0-13|v3075]]
| [[4.0.0-7|v1026]], [[5.0.0-11|v2049]], [[7.0.0-13|v4098]]
| [[4.1.0-8|v8]], [[4.2.0-9|v1024]], [[5.0.0-11|v2050]], [[7.0.0-13|v3074]]
| Active
|-
| 00020100
| 00021100
| 00022100
| 00026100
| 00027100
| 00028100
| [[Download Play]] (dlplay)
| [[1.0.0-0|v0]], [[2.1.0-4|v1026]], [[4.0.0-7|v2051]], [[9.0.0-20|v3072]](Also for [[8.1.0-0_New3DS]])
| [[1.0.0-0|v0]], [[2.1.0-4|v1026]], [[4.0.0-7|v2051]], [[9.0.0-20|v3073]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1026]], [[4.0.0-7|v2051]], [[9.0.0-20|v3073]]
| [[4.0.0-7|v4]]
| [[4.0.0-7|v1027]]
| [[4.1.0-8|v4]]
| Active
|-
| 00020200
| 00021200
| 00022200
| 00026200
| 00027200
| 00028200
| [[Activity Log]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[3.0.0-5|v2051]]
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[3.0.0-5|v2054]], [[7.0.0-13|v2064]]
| Same as EUR
| [[4.0.0-7|v3]]
| [[4.0.0-7|v2]], [[7.0.0-13|v16]]
| [[4.1.0-8|v2]]
| Active
|-
| 00020300
| 00021300
| 00022300
| 00026300
| 00027300
| 00028300
| [[Health and Safety Information]]
| [[1.0.0-0|v0]], [[4.0.0-7|v1024]], [[6.0.0-11|v2050]]
| [[1.0.0-0|v0]], [[3.0.0-5|v1024]], [[4.0.0-7|v2050]], [[6.0.0-11|v3077]]
| [[1.0.0-0|v0]], [[4.0.0-7|v1026]], [[6.1.0-12U|v2051]]
| [[4.0.0-7|v5]]
| [[4.0.0-7|v2]]
| [[4.1.0-8|v5]]
| Active
|-
| 20020300
| 20021300
| 20022300
| N/A
| N/A
| N/A
| [[New_3DS]] [[Health and Safety Information]]
| [[8.1.0-0_New3DS|v2]], [[9.3.0-21|v17]]
| [[8.1.0-0_New3DS|v1]]
| Same as EUR.
| N/A
| N/A
| N/A
| Active
|-
| 00020400
| 00021400
| 00022400
| 00026400
| 00027400
| 00028400
| [[Nintendo 3DS Camera]] (CtrApp)
| [[1.0.0-0|v0]], [[2.1.0-4|v16]], [[3.0.0-5|v1038]], [[4.0.0-7|v2048]], [[6.0.0-11|v3073]], [[9.0.0-20|v4097]](Also for [[8.1.0-0_New3DS]])
| [[1.0.0-0|v0]], [[2.1.0-4|v16]], [[3.0.0-5|v1039]], [[4.0.0-7|v2048]], [[6.0.0-11|v3073]], [[7.0.0-13|v3088]], [[9.0.0-20|v4097]]
| [[1.0.0-0|v0]], [[2.1.0-4|v16]], [[3.0.0-5|v1039]], [[4.0.0-7|v2048]], [[6.1.0-12U|v3074]], [[7.0.0-13|v3088]], [[9.0.0-20|v4097]]
| [[4.0.0-7|v3]]
| [[4.0.0-7|v2]], [[7.0.0-13|v1040]]
| [[4.1.0-8|v3]]
| Active
|-
| 00020500
| 00021500
| 00022500
| 00026500
| 00027500
| 00028500
| [[Nintendo 3DS Sound]] (CtrApp)
| [[1.0.0-0|v0]], [[2.1.0-4|v1027]], [[3.0.0-5|v2049]], [[4.0.0-7|v3072]], [[7.0.0-13|v3089]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1027]], [[3.0.0-5|v2049]], [[4.0.0-7|v3072]], [[7.0.0-13|v3088]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1027]], [[3.0.0-5|v2049]], [[4.0.0-7|v3072]], [[7.0.0-13|v3088]]
| [[4.0.0-7|v2]]
| [[4.0.0-7|v2]], [[7.0.0-13|v16]]
| [[4.1.0-8|v3]]
| Active
|-
| 00020700
| 00021700
| 00022700
| 00026700
| 00027700
| 00028700
| [[Mii Maker]] (EDIT)
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[7.0.0-13|v2055]]
| Same as JPN
| Same as JPN
| [[4.0.0-7|v1]]
| [[4.0.0-7|v1]], [[7.0.0-13|v16]]
| [[4.1.0-8|v2]]
| Active
|-
| 00020800
| 00021800
| 00022800
| 00026800
| 00027800
| 00028800
| [[StreetPass Mii Plaza]] (MEET)
| [[1.0.0-0|v0]], v1027, [[2.1.0-4|v2048]], [[3.0.0-5|v3087]], [[3.0.0-6|v4096]], [[6.0.0-11|v5121]]
| [[1.0.0-0|v0]], v1027, [[2.1.0-4|v2048]], [[3.0.0-5|v3087]], [[3.0.0-6|v4096]], [[6.0.0-11|v5122]]
| [[1.0.0-0|v0]], v1027, [[2.1.0-4|v2048]], [[3.0.0-5|v3087]], [[3.0.0-6|v4096]], [[6.1.0-12U|v5124]], [[7.0.0-13|v5136]]
| [[4.0.0-7|v0]], [[4.4.0-10|v4096]]
| [[4.0.0-7|v1]], [[4.4.0-10|v4096]], [[7.0.0-13|v5120]]
| [[4.1.0-8|v1]], [[4.4.0-10|v4096]]
| Active
|-
| 00020900
| 00021900
| 00022900
| N/A
| 00027900
| 00028900
| [[eShop]] (tiger)
| [[2.0.0-2|v4]], [[2.1.0-3|v1026]], [[3.0.0-5|v2057]], [[4.0.0-7|v3081]], [[4.1.0-8|v4096]], [[4.2.0-9|v5123]], [[4.3.0-10|v6146]], [[5.0.0-11|v7169]], [[7.0.0-13|v8206]], [[7.1.0-14|v9231]], [[7.2.0-17|v10245]], [[8.0.0-18|v11265]], [[8.1.0-19|v12288]], [[9.0.0-20|v13320]], [[9.3.0-21|v15366]]
| [[2.0.0-2|v4]], [[2.1.0-3|v1026]], [[3.0.0-5|v2058]], [[4.0.0-7|v3081]], [[4.1.0-8|v4096]], [[4.2.0-9|v5123]], [[4.3.0-10|v6146]], [[5.0.0-11|v7171]], [[7.0.0-13|v8206]], [[7.1.0-14|v9231]], [[7.2.0-17|v10245]], [[8.0.0-18|v11265]], [[8.1.0-19|v12288]], [[9.0.0-20|v13321]], [[9.3.0-21|v15366]]
| [[2.0.0-2|v4]], [[2.1.0-3|v1026]], [[3.0.0-5|v2058]], [[4.0.0-7|v3081]], [[4.1.0-8|v4096]], [[4.2.0-9|v5123]], [[4.3.0-10|v6146]], [[5.0.0-11|v7170]], [[7.0.0-13|v8206]], [[7.1.0-14|v9231]], [[7.2.0-17|v10246]], [[8.0.0-18|v11265]], [[8.1.0-19|v12288]], [[9.0.0-20|v13320]], [[9.3.0-21|v15366]]
| N/A
| [[4.0.0-7|v3082]], [[4.1.0-8|v4096]], [[4.2.0-9|v5123]], [[4.3.0-10|v6146]], [[5.0.0-11|v7169]], [[7.0.0-13|v8205]], [[7.1.0-14|v9231]], [[8.1.0-19|v12288]], [[9.0.0-20|v13320]], [[9.3.0-21|v15366]]
| [[4.1.0-8|v4096]], [[4.2.0-9|v5123]], [[4.3.0-10|v6146]], [[5.0.0-11|v7170]], [[7.0.0-13|v8205]], [[7.1.0-14|v9231]], [[8.1.0-19|v12288]], [[9.3.0-21|v15366]]
| Active
|-
| 00020A00
| 00021A00
| 00022A00
| N/A
| 00027A00
| 00028A00
| [[System Transfer]] (CARDBOAR)
| [[2.0.0-2|v4]], [[3.0.0-5|v1035]], [[4.0.0-7|v2050]], [[5.0.0-11|v3074]], [[7.0.0-13|v4109]], [[9.0.0-20|v5130]]
| [[2.0.0-2|v4]], [[3.0.0-5|v1035]], [[4.0.0-7|v2050]], [[5.0.0-11|v3073]], [[7.0.0-13|v4109]], [[9.0.0-20|v5131]]
| [[2.0.0-2|v4]], [[3.0.0-5|v1035]], [[4.0.0-7|v2051]], [[5.0.0-11|v3073]], [[7.0.0-13|v4109]], [[9.0.0-20|v5131]]
| N/A
| [[4.0.0-7|v2]], [[5.0.0-11|v1025]], [[7.0.0-13|v2061]], [[9.0.0-20|v3082]]
| [[4.1.0-8|v2]], [[5.0.0-11|v1025]], [[7.0.0-13|v2061]]
| Active
|-
| 00020B00
| 00021B00
| 00022B00
| N/A
| N/A
| N/A
| [[Nintendo Zone]] ("Nintendo")
| [[1.0.0-0|v0]], [[3.0.0-5|v1034]]
| Same as JPN
| Same as JPN
| N/A
| N/A
| N/A
| Active
|-
| 00020D00
| 00021D00
| 00022D00
| 00026D00
| 00027D00
| 00028D00
| [[Face Raiders]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1028]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1028]], [[7.0.0-13|v1040]]
| Same as EUR
| [[4.0.0-7|v0]]
| [[4.0.0-7|v0]]
| [[4.1.0-8|v2]]
| Active
|-
| 20020D00
| 20021D00
| 20022D00
| N/A
| N/A
| N/A
| [[New_3DS]] [[Face Raiders]]
| [[8.1.0-0_New3DS|v2050]]
| [[8.1.0-0_New3DS|v2049]]
| Same as EUR.
| N/A
| N/A
| N/A
| Active
|-
| 00020E00
| 00021E00
| 00022E00
| 00026E00
| 00027E00
| 00028E00
| [[AR Games]] (AR_ACT)
| [[1.0.0-0|v0]], [[2.1.0-4|v1026]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1026]], [[7.0.0-13|v1040]]
| [[1.0.0-0|v0]], [[2.1.0-4|v1027]], [[7.0.0-13|v1040]]
| [[4.0.0-7|v0]]
| [[4.0.0-7|v0]], [[7.0.0-13|v16]]
| [[4.1.0-8|v1]]
| Active
|-
| 00020F00
| 00021F00
| 00022F00
| 00026F00
| 00027F00
| 00028F00
| SAFE_MODE [[System Settings#System Updater|System Updater]] (mset)
| [[1.0.0-0|v0]], [[3.0.0-5|v1024]], [[6.0.0-11|v2049]]
| [[1.0.0-0|v0]], [[3.0.0-5|v1024]], [[6.0.0-11|v2050]]
| Same as JPN
| [[4.0.0-7|v1]], [[6.0.0-11|v1026]]
| [[4.0.0-7|v1]]
| [[4.1.0-8|v1]]
| Active
|-
| 00023000
| 00024000
| 00025000
| N/A
| N/A
| N/A
| Promotional video
| [[1.1.0-1|v2]], [[2.0.0-2|v2048]]
| [[1.1.0-1|v<unknown>]], [[2.0.0-2|v2048]]
| [[1.1.0-1|v0]], [[2.0.0-2|v2048]]
| N/A
| N/A
| N/A
| Stubbed
|-
| 0002BF00
| 0002C000
| 0002C100
| N/A
| N/A
| N/A
| Nintendo Network ID Settings (act)
| [[7.0.0-13|v14]], [[7.2.0-17|v1029]], [[9.0.0-20|v2051]], [[9.3.0-21|v3072]]
| Same as JPN
| Same as JPN
| N/A
| N/A
| N/A
| Active
|-
| 20023100
| 20024100
| 20025100
| N/A
| N/A
| N/A
| [[microSD Management]] ('mcopy') ([[New_3DS]]-only)
| [[8.1.0-0_New3DS|v8]], [[9.0.0-20|v1024]]
| [[8.1.0-0_New3DS|v4]]
| [[8.1.0-0_New3DS|v5]]
| N/A
| N/A
| N/A
| Available
|-
| 2002C800
| 2002CF00
| 2002D000
| N/A
| N/A
| N/A
| [[New_3DS]]-only, currently stubbed. Placeholder exheader name is "menu".
| [[8.1.0-0_New3DS|v2]], [[9.0.0-20|v18]], [[9.3.0-21|v34]]
| [[8.1.0-0_New3DS|v1]], [[9.3.0-21|v17]]
| [[8.1.0-0_New3DS|v1]], [[9.3.0-21|v18]]
| N/A
| N/A
| N/A
| Stubbed
|-
| 2002C900
| 2002D100
| 2002D200
| N/A
| N/A
| N/A
| [[New_3DS]]-only, currently stubbed. Placeholder exheader name is "friend".
| [[8.1.0-0_New3DS|v1]]
| Same as JPN.
| [[8.1.0-0_New3DS|v0]], [[9.3.0-21|v16]]
| N/A
| N/A
| N/A
| Stubbed
|-
| 2002CA00
| 2002D300
| 2002D400
| N/A
| N/A
| N/A
| [[New_3DS]]-only, currently stubbed. Placeholder exheader name is "newslist".
| [[8.1.0-0_New3DS|v0]], v1([[Home_Menu|JPN-only]] Oct 2, 2014 "sysupdate", actually uploaded on 09-29-14. Identical to v0, same TMDs besides title-versions)
| [[8.1.0-0_New3DS|v2]]
| [[8.1.0-0_New3DS|v0]]
| N/A
| N/A
| N/A
| Stubbed
|-
| 2002CB00
| 2002D500
| 2002D600
| N/A
| N/A
| N/A
| [[New_3DS]]-only, currently stubbed. Placeholder exheader name is "cherry".
| [[8.1.0-0_New3DS|v0]], [[9.0.0-20|v1]]
| [[8.1.0-0_New3DS|v2]]
| Same as EUR.
| N/A
| N/A
| N/A
| Stubbed
|}

The "act" application seems to use a web browser with webkit?

Regardless of version, the ExeFS:/.code for mset is the same for USA/EUR/JPN. The [[4.0.0-7]] version of mset([[4.1.0-8]] for TWN) has the same ExeFS:/.code for all regions(JPN, USA, EUR, CHN, KOR, TWN). The [[5.0.0-11]] mset ExeFS:/.code is the same for all regions as well, except for CHN. The [[7.0.0-13]] mset ExeFS:/.code is unique for the following regions: CHN, KOR, and TWN.

=== 0004001B - [[NCCH#CFA|System Data Archives]] ===
{| class="wikitable" border="1"
|-
! TitleID Low
! Description
! Versions
|-
| 00010002
| [[ClCertA]]
| [[1.0.0-0|v0]]
|-
| 00010702
| [[NS CFA]]
| [[3.0.0-5|v0]], [[6.0.0-11|v1028]], [[6.3.0-12|v2048]], [[7.0.0-13|v3073]], [[9.0.0-20|v4096]](also for [[8.1.0-0_New3DS]])
|-
| 00010802
| This CFA only contains a 1-byte "dummy.txt" in the RomFS, which contains '0'.
| [[6.3.0-12|v0]]
|-
| 00018002
| Same contents as 00010802. Starting with [[7.1.0-15]], the "dummy.txt" file was removed from RomFS: this CFA RomFS now contains web-browser data(similar to 00018102) for NNID / networking, etc.
| [[7.0.0-13|v14]], [[7.1.0-15|v1025]], [[7.2.0-17|v2055]], [[9.0.0-20|v3078]], [[9.3.0-21|v4096]]
|-
| 00018102
| This contains local web-browser data(html/js, gfx, etc) for the Miiverse Offline-mode.
| [[7.0.0-13|v11]], [[9.0.0-20|v1025]](also for [[8.1.0-0_New3DS]])
|-
| 00018202
| This contains the webkit/OSS [[CRO0|CROs]] used with the Miiverse applet and the "act" application.
| [[7.0.0-13|v7]], [[8.1.0-0_New3DS|v1026]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v2050]]
|-
| 00019002
| [[Fangate_updater]]
| [[9.3.0-21|v2]]
|}

=== 00040030 - Applets===
{| class="wikitable" border="1"
|-
! JPN TitleIDLow
! USA TitleIDLow
! EUR TitleIDLow
! Description
! JPN Versions
! USA Versions
! EUR Versions
|-
| 00008102
| 00008102
| 00008102
| [[NS#Alternate menu|Alternate menu]]
| N/A
|-
| 00008202
| 00008F02
| 00009802
| [[Home Menu|SYSMENU]] (menu)
| v0, v1029, v2049, [[2.2.0-X|v3075]], v4111, v5131, [[4.2.0-9|v6146]], [[5.0.0-11|v7172]], [[6.0.0-11|v8198]], [[7.0.0-13|v9230]], [[8.1.0-0_New3DS|v10250]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v11272]], [[9.1.0-20J|v14336]], [[9.2.0-20|v15360]], [[9.3.0-21|v16402]], [[9.4.0-21|v17408]]
| v0, v1029, v2049, [[2.2.0-X|v3075]], v4111, v5131, [[4.2.0-9|v6146]], [[5.0.0-11|v7172]], [[6.0.0-11|v8198]], [[7.0.0-13|v9230]], [[8.1.0-0_New3DS|v10250]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v11272]], [[9.2.0-20|v12288]], [[9.3.0-21|v13330]], [[9.4.0-21|v14336]]
| v0, v1029, v2049, [[2.2.0-X|v3075]], v4111, v5131, [[4.2.0-9|v6146]], [[5.0.0-11|v7172]], [[6.0.0-11|v8198]], [[7.0.0-13|v9230]], [[8.1.0-0_New3DS|v10250]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v11272]], [[9.2.0-20|v12288]], [[9.3.0-21|v13330]], [[9.4.0-21|v14336]]
|-
| 00008402
| 00009002
| 00009902
| Camera applet used by Home-menu (CtrApp)
| v0, v1036, [[9.0.0-20|v2049]](Also for [[8.1.0-0_New3DS]])
| Same as JPN
| Same as JPN
|-
| 00008502
| 00009102
| 00009A02
| Not available on CDN
| ?
|
|
|-
| 00008602
| 00009202
| 00009B02
| Instruction Manual, applet for displaying instruction manuals
| v0, v1026, v2048, v3072, [[5.0.0-11|v4097]], [[9.0.0-20|v5120]](Also for [[8.1.0-0_New3DS]])
| Same as JPN
|-
| 00008702
| 00009302
| 00009C02
| Game Notes (Cherry)
| v0, v1026, v2049, [[5.0.0-11|v3073]], [[9.0.0-20|v4096]](Also for [[8.1.0-0_New3DS]])
| Same as JPN
| Same as JPN
|-
| 00008802
| 00009402
| 00009D02
| [[Internet Browser]] (spider)
| [[2.0.0-2|v6]], [[2.1.0-4|v1024]], [[4.0.0-7|v2050]], [[5.0.0-11|v3074 (EUR)/v3075(USA,JAP)]], [[7.0.0-13|v3088]], [[7.1.0-16|v4096]]
| Same as JPN
| Same as JPN
|-
| 20008802
| 20009402
| 20009D02
| [[New_3DS]] [[Internet Browser]] (SKATER)
| [[8.1.0-0_New3DS|v10]], [[9.3.0-21|v1027]]
| Same as JPN
| Same as JPN
|-
| 00008A02
| 00008A02
| 00008A02
| [[ErrDisp]]
| v0, v1025, [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[5.0.0-11|v5121]], [[8.0.0-18|v6144]], [[9.0.0-20|v7168]](Also for [[8.1.0-0_New3DS]])
| Same as JPN
| Same as JPN
|-
| 00008A03
| 00008A03
| 00008A03
| SAFE_MODE [[ErrDisp]]
| v0
| Same as JPN
| Same as JPN
|-
| 20008A03
| 20008A03
| 20008A03
| [[New_3DS]] SAFE_MODE [[ErrDisp]]
| [[8.1.0-0_New3DS|v7169]]
| Same as JPN
| Same as JPN
|-
| 00008D02
| 00009602
| 00009F02
| Friend List (friend)
| v0, v1026, [[2.2.0-X|v2051]], v3082, v4099, [[7.0.0-13|v5120]], [[9.0.0-20|v6144]](Also for [[8.1.0-0_New3DS]]) (EUR v6, v1024, v3082, v4099, [[7.0.0-13|v5120]], [[9.0.0-20|v6144]])
| Same as JPN
| Same as JPN
|-
| 00008E02
| 00009702
| 0000A002
| Notifications (newslist)
| v0, v1029, v2054, v3075, [[9.0.0-20|v4097]] (EUR v6, v1024, v2054, v3075, [[9.0.0-20|v4097]]) (JPN: ..., [[8.1.0-0_New3DS|v4096]], [[9.0.0-20|v5121]])
| Same as JPN
| Same as JPN
|-
| 0000C002
| 0000C802
| 0000D002
| Software Keyboard (swkbd)
| v0, v1026, v2053, [[7.0.0-13|v3072]], [[9.0.0-20|v4096]](Also for [[8.1.0-0_New3DS]])
| Same as JPN
| Same as JPN
|-
| 0000C003
| 0000C803
| 0000D003
| SAFE_MODE Software Keyboard (swkbd)
| v0
| Same as JPN
| Same as JPN
|-
| 2000C003
| 2000C803
| 2000D003
| [[New_3DS]] SAFE_MODE Software Keyboard (swkbd)
| [[8.1.0-0_New3DS|v0]](for JPN this is v1024)
| Same as JPN
| Same as JPN
|-
| 0000C102
| 0000C902
| 0000D102
| appletEd
| v0, v1026, [[9.0.0-20|v2048]](Also for [[8.1.0-0_New3DS]]), [[9.3.0-21|v3077]]
| Same as JPN
| Same as JPN
|-
| 0000C302
| 0000CB02
| 0000D302
| PNOTE_AP (Photo file selector applet, for SD-card/etc?)
| v0, v1024, [[8.1.0-0_New3DS|v2049]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v3075]], [[9.3.0-21|v4096]]
| Same as JPN
| Same as JPN
|-
| 0000C402
| 0000CC02
| 0000D402
| SNOTE_AP (Sound file selector applet, for SD-card/etc?)
| v0, v3, [[8.0.0-18|v1026]], [[9.0.0-20|v2048]](Also for [[8.1.0-0_New3DS]])
| Same as JPN
| Same as JPN
|-
| 0000C502
| 0000C502
| 0000C502
| error (This applet displays networking errors, etc)
| v0, v1026, v2053, v3074, [[8.1.0-0_New3DS|v4096]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v5128]]
| Same as JPN
| Same as JPN
|-
| 0000C503
| 0000C503
| 0000C503
| SAFE_MODE error applet
| v0
| Same as JPN
| Same as JPN
|-
| 2000C503
| 2000C503
| 2000C503
| [[New_3DS]] SAFE_MODE error applet
| [[8.1.0-0_New3DS|v1024]]
| Same as JPN
| Same as JPN
|-
| 0000CD02
| 0000CD02
| 0000CD02
| extrapad ([[Circle Pad Pro]] calibration applet)
| v1, v1026, [[8.1.0-0_New3DS|v2048]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v3073]]
| Same as JPN
| Same as JPN
|-
| 0000C602
| 0000CE02
| 0000D602
| mint. eShop applet, used by applications for accessing the eShop, for DLC/etc. Also used by the eShop application itself.
| v5, v1028, [[4.2.0-9|v2050]], [[5.0.0-11|v3072]], [[7.0.0-13|v4109]], [[7.2.0-17|v5125]](v5123 for JPN), [[8.0.0-18|v6145]], [[8.1.0-0_New3DS|v7168]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v8200]], [[9.3.0-21|v9224]]
| Same as JPN
| Same as JPN
|-
| 0000BC02
| 0000BD02
| 0000BE02
| olv (Miiverse applet)
| [[7.0.0-13|v14]], [[7.2.0-17|v1024]], [[9.0.0-20|v2048]](Also for [[8.1.0-0_New3DS]]), [[9.3.0-21|v3072]]
| Same as JPN
| Same as JPN
|-
| 0000F602
| 0000F602
| 0000F602
| memolib (Uses Miiverse, likely the "system library" for Miiverse)
| [[7.0.0-13|v5]], [[8.1.0-0_New3DS|v1024]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v2050]], [[9.3.0-21|v3072]]
| Same as JPN
| Same as JPN
|-
| 00008302
| 00008B02
| 0000BA02
| solv3 (Miiverse-posting applet)
| [[9.0.0-20|v6]]
| Same as JPN
| Same as JPN
|-
| 00009502
| 00009E02
| 0000B902
| Cabinet ([[amiibo Settings]])
| [[9.3.0-21|v7]]
| Same as JPN
| Same as JPN
|}

Most of these processes are applets. There can only be one application here(Home Menu, Internet Browser, Friend-List, etc) with programID-high 00040030 running at a time. When directly launching one of these 00040030 applications with Home Menu, the Home Menu process will terminate once the process is launched. When returning to Home Menu from that launched process, the Home Menu process is launched again.

All of the above processes use the "SYSTEM" [[SVC|memory-region]].

The ExeFS for Home Menu is exactly the same for USA/EUR/JPN.

The Miiverse applet seems to use a web browser with webkit.

=== 0004009B - [[NCCH#CFA|System Data Archives]] (Shared Archives) ===
{| class="wikitable" border="1"
|-
! JPN TitleIDLow
! USA TitleIDLow
! EUR TitleIDLow
! Description
! Versions
|-
| 00010202
| 00010202
| 00010202
| Probably Mii-related, contains "CFL_Res.dat" in the RomFS.
| v0
|-
| 00010302
| 00010302
| 00010302
| Doesn't exist on CDN?
| v0, v2052
|-
| 00010402
| 00010402
| 00010402
| Mounted as "area:", contains Country and Region names
| v0, v1024, v2050, v3072, [[7.0.0-13|v4098]]
|-
| 00010502
| 00010502
| 00010502
| Doesn't exist on CDN?
| v0, v1024, v2048
|-
| 00010602
| 00010602
| 00010602
| Non-Nintendo TLS Root-CA Certificates (RomFS contains files with filename "CACERT_PUBLIC_CA_<val>.der", where <val> is 5..8)
| v2
|-
| 00011902
| ?
| ?
| ?
| v0
|-
| ?
| 00011402
| ?
| ?
| v0
|-
| ?
| 00011602
| ?
| ?
| v0
|-
| ?
| 00011D02
| ?
| ?
| v0
|-
| ?
| 00011E02
| ?
| ?
| v0
|-
| ?
| ?
| 00011202
| ?
| v0
|-
| ?
| ?
| 00011302
| ?
| v0
|-
| ?
| ?
| 00011502
| ?
| v0
|-
| ?
| ?
| 00011702
| ?
| v0
|-
| ?
| ?
| 00011802
| ?
| v0
|-
| 00011902
| ?
| ?
| ?
| v0
|-
| ?
| ?
| 00011B02
| ?
| v0
|-
| ?
| ?
| 00011C02
| ?
| v0
|-
| ?
| ?
| 00011D02
| ?
| v0
|-
| ?
| ?
| 00012102
| ?
| v0, v1026, v2051, v3074
|-
| 00012202
| 00012302
| 00012102
| ?contains a lists with error strings
| v1026, v2053, v3073, [[4.2.0-9|v4096]], [[5.0.0-11|v5120]], [[7.0.0-13|v6149]], [[7.2.0-17|v7168]], [[8.0.0-18|v8192]], [[9.0.0-20|v9218]], [[9.3.0-21|v10242]]
|-
| 00013202
| 00013302
| 00013102
| Mounted as "eula:"
| v0, v1024, v2049 USA: v1024, v2051, [[7.0.0-13|v3074]], [[7.2.0-17|v4100]](EUR-only), [[9.0.0-20|v4099]]
|-
| 00014002
| 00014002
| 00014002
| JPN/EUR/USA System Font ("font:")
| v0
|-
| 00014102
| 00014102
| 00014102
| CHN System Font ("font:")
| v0, v1024
|-
| 00014202
| 00014202
| 00014202
| KOR System Font ("font:")
| v0, v1024
|-
| 00014302
| 00014302
| 00014302
| TWN System Font ("font:")
| v0, v1024
|-
| 00015202
| 00015302
| 00015102
| Mounted as "rate:"
| v0 (EUR: v0, v1024)
|-
| ?
| 00016302
| ?
| ?
| v80
|-
| ?
| 00017302
| ?
| ?
| v3088
|}

=== 000400DB - [[NCCH#CFA|System Data Archives]] ===
These [[NVer]] titleIDs can be found @ offset 0x320 in every [[CCI]].

{| class="wikitable" border="1"
|-
! EUR TitleIDLow
! JPN TitleIDLow
! USA TitleIDLow
! CHN TitleIDLow
! KOR TitleIDLow
! TWN TitleIDLow
! Description
! USA/EUR/JPN Versions
! CHN Versions
! TWN Versions
! KOR Versions
|-
| 00010302
| 00010302
| 00010302
| 00010302
| 00010302
| 00010302
| NGWord bad word list
| [[1.0.0-0|v0]], [[2.0.0-2|v1024]], [[3.0.0-5|v2052]], [[4.0.0-7|v3072]], [[4.3.0-10|v4096]], [[5.0.0-11|v5120]], [[9.0.0-20|v6144]], [[9.3.0-21|v7168]]
| Same as USA
| Same as USA
| Same as USA
|-
| 00010502
| 00010502
| 00010502
| 00010502
| 00010502
| 00010502
| [[Nintendo Zone]] hotspot list
| [[1.0.0-0|v0]], [[2.0.0-2|v1024]], [[3.0.0-5|v2048]], [[4.0.0-7|v3073]], [[4.3.0-10|v4096]], [[4.4.0-10|v5120]], [[4.5.0-10|v6144]], [[5.0.0-11|v7169]], [[6.0.0-11|v8192]], [[6.2.0-12|v9216]], [[7.0.0-13|v10242]], [[7.2.0-17|v11267]], [[8.0.0-18|v12288]], [[9.0.0-20|v14336]], [[9.3.0-21|v15360]]
| Same as USA
| Same as USA
| Same as USA
|-
| 00016102
| 00016202
| 00016302
| 00016402
| 00016502
| 00016602
| [[NVer]]
| [[1.0.0-0|v0]], [[1.1.0-1|v16]], [[2.0.0-2|v32]], [[2.1.0-3|v48]], [[2.1.0-4|v64]], [[3.0.0-5|v80]], [[3.0.0-6|v96]], [[4.0.0-7|v112]], [[4.1.0-8|v128]], [[4.2.0-9|v144]], [[4.3.0-10|v160]], [[5.0.0-11|v176]], non-USA=[[6.0.0-11|v192]]/USA=[[6.1.0-12U|v192]], [[7.0.0-13|v208]], [[7.1.0-14|v224]], [[7.1.0-15|v240]], [[7.1.0-16|v256]], [[7.2.0-17|v272]], [[8.0.0-18|v288]], [[8.1.0-19|v304]], [[9.0.0-20|v320]], [[9.3.0-21|v336]]
| [[4.0.0-7|v113]], [[4.2.0-9|v128]], [[5.0.0-11|v129]], [[7.1.0-16|v130]], [[7.2.0-17|v272]]
| [[4.1.0-8|v114]], [[4.2.0-9|v133]], [[4.3.0-10|v134]], [[5.0.0-11|v136]], [[7.0.0-13|v144]], [[7.1.0-14|v160]] [[7.1.0-16|v192]], [[7.2.0-17|v272]], [[8.0.0-18|v208]], [[8.1.0-19|v224]], [[9.0.0-20|v240]]
| [[4.0.0-7|v113]], [[4.1.0-8|v114]], [[4.2.0-9|v133]], [[4.3.0-10|v134]], [[5.0.0-11|v136]], [[7.0.0-13|v160]], [[7.1.0-14|v176]], [[7.1.0-16|v176]], [[7.2.0-17|v272]], [[8.0.0-18|v224]], [[8.1.0-19|v240]], [[9.0.0-20|v256]], [[9.3.0-21|v272]]
|-
| 20016102
| 20016202
| 20016302
| N/A
| N/A
| N/A
| [[New_3DS]] [[NVer]]
| [[8.1.0-0_New3DS|v0]], [[9.0.0-20|v320]], [[9.3.0-21|v336]]
| N/A
| N/A
| N/A
|-
| 00017102
| 00017202
| 00017302
| 00017402
| 00017502
| 00017602
| [[CVer]]
| [[1.0.0-0|v1024]], [[1.1.0-1|v1045]], [[2.0.0-2|v2049]], [[2.1.0-3|v2069]], [[2.2.0-X|v2088]] [[3.0.0-5|v3088]], [[4.0.0-7|v4098]], [[4.1.0-8|v4113]], [[4.2.0-9|v4130]], [[4.3.0-10|v4145]], [[4.4.0-10|v4163]], [[4.5.0-10|v4176]], [[5.0.0-11|v5120]], [[5.1.0-11|v5136]], [[6.0.0-11|v6146]], [[6.1.0-11|v6160]], [[6.2.0-12|v6178]], [[6.3.0-12|v6192]], [[7.0.0-13|v7175]], [[7.1.0-14|v7187]], [[7.2.0-17|v7203]], [[8.0.0-18|v8196]], [[8.1.0-18|v8208]], [[8.1.0-0_New3DS|v8215]](8.1.0-0_New3DS), [[9.0.0-20|v9218]], [[9.1.0-20J|v9232]](JPN-only), [[9.2.0-20|v9248]], [[9.3.0-21|v9264]], [[9.4.0-21|v9280]]
| [[1.0.0-0|v1024]], [[1.1.0-1|v1045]], [[2.0.0-2|v2049]], [[2.1.0-3|v2069]], [[2.2.0-X|v2088]] [[3.0.0-5|v3088]], [[4.0.0-7|v4098]], [[4.1.0-8|v4113]], [[4.2.0-9|v4130]], [[4.3.0-10|v4145]], [[4.4.0-10|v4163]], [[4.5.0-10|v4176]], [[5.0.0-11|v5120]], [[5.1.0-11|v5136]], [[6.0.0-11|v6146]], [[6.1.0-11|v6160]], [[6.2.0-12|v6178]], [[6.3.0-12|v6192]], [[7.0.0-13|v7175]], [[7.1.0-14|v7187]], [[7.2.0-17|v7203]], [[8.0.0-18|v8196]], [[8.1.0-18|v8208]], [[9.0.0-20|v9217]], [[9.3.0-21|v9264]]
| Same as CHN
| Same as CHN
|}

=== 00040130 - System [[Services API|Modules]] ===
{| class="wikitable" border="1"
|-
! TitleID Low
! Description
! Versions
|-
| 00001002
| sm (Stored in [[FIRM|NATIVE_FIRM]])
| N/A
|-
| 00001102
| [[Filesystem services‎|fs]] (Stored in [[FIRM|NATIVE_FIRM]])
| N/A
|-
| 00001202
| [[Process Manager Services|pm]] (Stored in [[FIRM|NATIVE_FIRM]])
| N/A
|-
| 00001302
| loader (Stored in [[FIRM|NATIVE_FIRM]])
| N/A
|-
| 00001402
| pxi (Stored in [[FIRM|NATIVE_FIRM]])
| N/A
|-
| 00001502
| [[Application Manager Services|AM]] ( Application Manager )
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[3.0.0-5|v2053]], [[4.0.0-7|v3072]], [[5.0.0-11|v4098]], [[6.0.0-11|v5120]], [[8.0.0-18|v6148]], [[8.1.0-0_New3DS|v7168]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v8192]]
|-
| 00001503
| SAFE_MODE AM
| [[1.0.0-0|v0]]
|-
| 20001503
| [[New_3DS]] SAFE_MODE AM
| [[8.1.0-0_New3DS|v7169]]
|-
| 00001602
| Camera
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[3.0.0-5|v2048]], [[4.0.0-7|v3074]], [[5.0.0-11|v4098]], [[6.0.0-11|v5120]], [[7.1.0-14|v6146]], [[8.0.0-18|v7172]], [[9.0.0-20|v9216]], [[9.3.0-21|v10242]]
|-
| 20001602
| [[New_3DS]] Camera
| [[8.1.0-0_New3DS|v8200]], [[9.0.0-20|v9218]], [[9.3.0-21|v10242]]
|-
| 00001702
| [[Config Services|Config]] (cfg)
| [[1.0.0-0|v0]], [[2.0.0-2|v1024]], [[3.0.0-5|v2049]], v3072, [[4.0.0-7|v4096]], [[5.0.0-11|v5122]], [[6.0.0-11|v6145]], [[6.1.0-11|v7168]], [[7.0.0-13|v8196]], [[7.2.0-17|v9220]], [[8.0.0-18|v10243]], [[8.1.0-0_New3DS|v11265]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v12290]], [[9.3.0-21|v13315]]
|-
| 00001703
| SAFE_MODE Config (cfg)
| [[1.0.0-0|v0]]
|-
| 20001703
| [[New_3DS]] SAFE_MODE Config (cfg)
| [[8.1.0-0_New3DS|v11265]]
|-
| 00001802
| Codec
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[5.0.0-11|v4098]], [[7.0.0-13|v5120]], [[8.0.0-18|v6144]], [[9.0.0-20|v7168]](Also for [[8.1.0-0_New3DS]])
|-
| 00001803
| SAFE_MODE Codec
| [[1.0.0-0|v0]]
|-
| 20001803
| [[New_3DS]] SAFE_MODE Codec
| [[8.1.0-0_New3DS|v7169]]
|-
| 00001902
| dmnt, debugger sysmodule. This use devunit-only HIO for devunit<>pc comms. This only exists for development units(launched by NS during startup depending on certain [[Configuration_Memory]] fields' values). This is installed at the [[Factory_Setup|factory]], then later deleted at the factory on retail units.
|
|-
| 00001A02
| DSP
| [[1.0.0-0|v0]], [[3.0.0-5|v1024]], [[4.0.0-7|v2048]], [[5.0.0-11|v3074]], [[6.0.0-11|v4096]], [[8.0.0-18|v5120]]
|-
| 00001A03
| SAFE_MODE DSP
| [[1.0.0-0|v0]]
|-
| 20001A03
| [[New_3DS]] SAFE_MODE DSP
| [[8.1.0-0_New3DS|v6145]]
|-
| 00001B02
| GPIO
| [[1.0.0-0|v0]], [[5.0.0-11|v1025]], [[8.0.0-18|v2048]]
|-
| 00001B03
| SAFE_MODE GPIO
| [[1.0.0-0|v0]]
|-
| 20001B03
| [[New_3DS]] SAFE_MODE GPIO
| [[8.1.0-0_New3DS|v3073]]
|-
| 00001C02
| GSP
| [[1.0.0-0|v0]], [[1.1.0-1|v1040]], [[2.0.0-2|v2049]], [[3.0.0-5|v3075]], v4098, [[4.0.0-7|v5120]], [[5.0.0-11|v6145]], [[6.0.0-11|v7168]], [[8.0.0-18|v8196]], [[9.0.0-20|v10240]], [[9.3.0-21|v11264]]
|-
| 20001C02
| [[New_3DS]] GSP
| [[8.1.0-0_New3DS|v10243]], [[9.3.0-21|v11267]]
|-
| 00001C03
| SAFE_MODE GSP
| [[1.0.0-0|v0]]
|-
| 20001C03
| [[New_3DS]] SAFE_MODE GSP
| [[8.1.0-0_New3DS|v9217]]
|-
| 00001D02
| HID (Human Interface Devices)
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[5.0.0-11|v5121]], [[7.2.0-17|v6148]], [[8.0.0-18|v7168]], [[8.1.0-0_New3DS|v8192]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v9216]], [[9.3.0-21|v10240]]
|-
| 00001D03
| SAFE_MODE HID
| [[1.0.0-0|v0]]
|-
| 20001D03
| [[New_3DS]] SAFE_MODE HID
| [[8.1.0-0_New3DS|v8193]]
|-
| 00001E02
| i2c
| [[1.0.0-0|v0]], [[3.0.0-5|v1024]], [[5.0.0-11|v2049]], [[8.0.0-18|v3076]], [[9.3.0-21|v5120]]
|-
| 20001E02
| [[New_3DS]] i2c
| [[8.1.0-0_New3DS|v4096]], [[9.3.0-21|v5121]]
|-
| 00001E03
| SAFE_MODE i2c
| [[1.0.0-0|v0]]
|-
| 20001E03
| [[New_3DS]] SAFE_MODE i2c
| [[8.1.0-0_New3DS|v4097]]
|-
| 00001F02
| MCU
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.1.0-3|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4102]], [[5.0.0-11|v5122]], [[6.0.0-11|v6145]], [[7.0.0-13|v7168]], [[8.0.0-18|v8192]]
|-
| 20001F02
| [[New_3DS]] MCU
| [[8.1.0-0_New3DS|v8192]]
|-
| 00001F03
| SAFE_MODE MCU
| [[1.0.0-0|v0]]
|-
| 20001F03
| [[New_3DS]] SAFE_MODE MCU
| [[8.1.0-0_New3DS|v9217]]
|-
| 00002002
| Microphone (mic)
| [[1.0.0-0|v0]], [[5.0.0-11|v1025]], [[8.0.0-18|v2048]]
|-
| 00002102
| PDN
| [[1.0.0-0|v0]], [[5.0.0-11|v1025]], [[8.0.0-18|v2048]]
|-
| 00002103
| SAFE_MODE PDN
| [[1.0.0-0|v0]]
|-
| 20002103
| [[New_3DS]] SAFE_MODE PDN
| [[8.1.0-0_New3DS|v3073]]
|-
| 00002202
| PTM (Play time, pedometer, and battery manager)
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.2.0-X|v2048]], [[3.0.0-5|v3075]], v4096, [[4.0.0-7|v5120]], [[5.0.0-11|v6146]], [[6.0.0-11|v7168]], [[7.0.0-13|v8192]], [[8.0.0-18|v9219]]
|-
| 20002202
| [[New_3DS]] PTM (Play time, pedometer, and battery manager)
| [[8.1.0-0_New3DS|v10240]]
|-
| 00002203
| SAFE_MODE PTM
| [[1.0.0-0|v0]]
|-
| 20002203
| [[New_3DS]] SAFE_MODE PTM
| [[8.1.0-0_New3DS|v10241]]
|-
| 00002302
| spi
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[5.0.0-11|v2049]], [[8.0.0-18|v3072]]
|-
| 20002302
| [[New_3DS]] spi
| [[8.1.0-0_New3DS|v4096]]
|-
| 00002303
| SAFE_MODE spi
| [[1.0.0-0|v0]]
|-
| 20002303
| [[New_3DS]] SAFE_MODE spi
| [[8.1.0-0_New3DS|v4097]]
|-
| 00002402
| Network manager (AC)
| [[1.0.0-0|v0]], [[1.1.0-1|v1024]], [[2.0.0-2|v2052]], [[2.1.0-3|v3072]], [[3.0.0-5|v4101]], [[5.0.0-11|v5122]], [[7.0.0-13|v6145]], [[8.0.0-18|v7172]], [[9.0.0-20|v8192]](Also for [[8.1.0-0_New3DS]]), [[9.3.0-21|v9216]]
|-
| 00002403
| SAFE_MODE AC
| [[1.0.0-0|v0]]
|-
| 20002403
| [[New_3DS]] SAFE_MODE AC
| [[8.1.0-0_New3DS|v8193]]
|-
| 00002602
| Cecd (StreetPass)
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.2.0-X|v2048]], [[3.0.0-5|v3073]], [[4.0.0-7|v4097]], [[5.0.0-11|v5122]], [[6.0.0-11|v6144]], [[6.2.0-12|v7170]], [[7.0.0-13|v8193]], [[8.0.0-18|v9216]], [[9.0.0-20|v10240]]
|-
| 00002702
| CSND
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[4.0.0-7|v2048]], [[5.0.0-11|v3073]], [[8.0.0-18|v4096]], [[9.0.0-20|v5120]]
|-
| 00002703
| SAFE_MODE CSND
| [[1.0.0-0|v0]]
|-
| 20002703
| [[New_3DS]] SAFE_MODE CSND
| [[8.1.0-0_New3DS|v5121]]
|-
| 00002802
| dlp ([[Download Play]])
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.2.0-X|v2048]], [[3.0.0-5|v3078]], [[5.0.0-11|v4099]], [[8.0.0-18|v5123]], [[9.0.0-20|v6145]](Also for [[8.1.0-0_New3DS]])
|-
| 00002902
| http
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.1.0-3|v2049]], [[2.2.0-X|v3072]], [[3.0.0-5|v4099]], [[4.0.0-7|v5122]], [[5.0.0-11|v6145]], [[7.0.0-13|v7171]], [[7.1.0-14|v8192]], [[8.0.0-18|v9220]], [[8.1.0-18|v10245]], [[8.1.0-0_New3DS|v11264]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v12288]]
|-
| 00002903
| SAFE_MODE http
| [[1.0.0-0|v0]]
|-
| 20002903
| [[New_3DS]] SAFE_MODE http
| [[8.1.0-0_New3DS|v10241]]
|-
| 00002A02
| MP
| [[1.0.0-0|v0]], [[5.0.0-11|v1025]], [[8.0.0-18|v2048]]
|-
| 00002A03
| SAFE_MODE MP
| [[1.0.0-0|v0]]
|-
| 00002B02
| NDM
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[3.0.0-5|v2049]], [[4.0.0-7|v3072]], [[5.0.0-11|v4098]], [[8.0.0-18|v5124]], [[8.1.0-0_New3DS|v6144]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v7169]]
|-
| 00002C02
| [[NIM Services|NIM]] (Memory-region: "SYSTEM")
| [[1.0.0-0|v0]], [[2.0.0-2|v1028]], [[3.0.0-5|v2055]], [[4.0.0-7|v3074]], [[5.0.0-11|v4100]], [[6.0.0-11|v5120]], [[7.0.0-13|v6148]], [[7.2.0-17|v7174]], [[8.0.0-18|v8195]], [[8.1.0-0_New3DS|v9217]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v10249]], [[9.3.0-21|v11267]]
|-
| 00002C03
| SAFE_MODE NIM
| [[1.0.0-0|v0]]
|-
| 20002C03
| [[New_3DS]] SAFE_MODE NIM
| [[8.1.0-0_New3DS|v9217]]
|-
| 00002D02
| NWM ( Low-level wifi manager )
| [[1.0.0-0|v0]], [[1.1.0-1|v1024]], [[2.0.0-2|v2052]], [[2.2.0-X|v3072]], [[3.0.0-5|v4101]], [[4.0.0-7|v5120]], [[5.0.0-11|v6148]], [[6.0.0-11|v7169]], [[7.2.0-17|v8196]], [[8.0.0-18|v9216]], [[9.0.0-20|v10240]]
|-
| 00002D03
| SAFE_MODE NWM
| [[1.0.0-0|v0]], [[6.0.0-11|v5120]]
|-
| 20002D03
| [[New_3DS]] SAFE_MODE NWM
| [[8.1.0-0_New3DS|v10241]]
|-
| 00002E02
| Sockets
| [[1.0.0-0|v0]], [[1.1.0-1|v1024]], [[2.0.0-2|v2053]], [[3.0.0-5|v3075]], [[4.0.0-7|v4096]], [[5.0.0-11|v5121]], [[8.0.0-18|v6144]], [[9.0.0-20|v7168]]
|-
| 00002E03
| SAFE_MODE Sockets
| [[1.0.0-0|v0]]
|-
| 20002E03
| [[New_3DS]] SAFE_MODE Sockets
| [[8.1.0-0_New3DS|v7169]]
|-
| 00002F02
| SSL (Memory-region: "SYSTEM")
| [[1.0.0-0|v0]], [[2.0.0-2|v1024]], [[2.1.0-3|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[5.0.0-11|v5122]], [[8.0.0-18|v6144]], [[9.0.0-20|v7168]]
|-
| 00002F03
| SAFE_MODE SSL
| [[1.0.0-0|v0]]
|-
| 20002F03
| [[New_3DS]] SAFE_MODE SSL
| [[8.1.0-0_New3DS|v7169]]
|-
| 00003102
| [[Process Services‎|PS]] ( Process Manager )
| [[1.0.0-0|v0]], [[2.0.0-2|v1025]], [[5.0.0-11|v2049]], [[6.0.0-11|v3072]], [[8.0.0-18|v4096]], [[9.0.0-20|v5120]]
|-
| 00003103
| SAFE_MODE PS
| [[1.0.0-0|v0]]
|-
| 20003103
| [[New_3DS]] SAFE_MODE PS
| [[8.1.0-0_New3DS|v5121]]
|-
| 00003202
| FriendsList (friends)
| [[1.0.0-0|v0]], [[2.0.0-2|v1028]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[5.0.0-11|v5122]], [[7.0.0-13|v6145]], [[8.0.0-18|v7172]], [[9.0.0-20|v8192]](Also for [[8.1.0-0_New3DS]])
|-
| 00003203
| SAFE_MODE FriendsList (friends)
| [[1.0.0-0|v0]]
|-
| 20003203
| [[New_3DS]] SAFE_MODE FriendsList (friends)
| [[8.1.0-0_New3DS|v8193]]
|-
| 00003302
| IR (Infrared)
| [[1.0.0-0|v0]], [[2.0.0-2|v1026]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[5.0.0-11|v5121]], [[8.0.0-18|v6148]], [[8.1.0-0_New3DS|v7170]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v8192]], [[9.3.0-21|v9216]]
|-
| 00003303
| SAFE_MODE IR
| [[1.0.0-0|v0]]
|-
| 20003303
| [[New_3DS]] SAFE_MODE IR
| [[8.1.0-0_New3DS|v7169]]
|-
| 00003402
| BOSS (SpotPass)
| [[1.0.0-0|v0]], [[1.1.0-1|v1024]], [[2.0.0-2|v2053]], [[2.2.0-X|v3073]], [[3.0.0-5|v4101]], [[4.0.0-7|v5122]], [[5.0.0-11|v6146]], [[6.0.0-11|v7169]], [[6.2.0-12|v8193]], [[7.0.0-13|v9222]], [[8.0.0-18|v10240]], [[9.0.0-20|v11266]]
|-
| 00003502
| News (Notifications)
| [[1.0.0-0|v0]], [[2.0.0-2|v1028]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[5.0.0-11|v4097]], [[8.0.0-18|v5120]], [[9.0.0-20|v6147]]
|-
| 00003602
| This only exist for development units(launched by NS during startup depending on certain [[Configuration_Memory]] fields' values).
|
|-
| 00003702
| [[RO_Services|RO]]
| [[2.0.0-2|v0]], [[4.0.0-7|v1024]], [[5.0.0-11|v2049]], [[7.2.0-17|v3074]], [[8.0.0-18|v4096]], [[9.0.0-20|v5120]](Also for [[8.1.0-0_New3DS]]), [[9.3.0-21|v6148]]
|-
| 00003802
| act (handles Nintendo Network '''a'''c'''c'''oun'''t'''s)
| [[7.0.0-13|v1029]], [[7.1.0-14|v2050]], [[7.2.0-17|v3077]], [[8.0.0-18|v4099]], [[8.1.0-0_New3DS|v5120]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v6144]], [[9.3.0-21|v7168]]
|-
| 00004002
| Old3DS [[NFC_Services|nfc]]
| [[9.3.0-21|v2053]]
|-
| 20004002
| [[New_3DS]] [[NFC_Services|nfc]]
| [[8.1.0-0_New3DS|v0]], [[9.0.0-20|v1024]], [[9.3.0-21|v2053]]
|-
| 20004102
| [[New_3DS]] mvd
| [[8.1.0-0_New3DS|v0]], [[9.0.0-20|v1024]]
|-
| 20004202
| [[New_3DS]] [[QTM Services|qtm]]
| [[8.1.0-0_New3DS|v8]], [[9.0.0-20|v1024]], [[9.3.0-21|v2052]]
|-
| 00008002
| [[NS]] (Memory-region: "SYSTEM")
| [[1.0.0-0|v0]], [[2.0.0-2|v1028]], [[2.2.0-X|v2048]], [[3.0.0-5|v3077]], v4096, [[4.0.0-7|v5121]], [[5.0.0-11|v6148]], [[5.1.0-11|v7168]], [[6.0.0-11|v8193]], [[6.1.0-11|v9216]], [[7.0.0-13|v10248]], [[7.2.0-17|v11268]], [[8.0.0-18|v12291]], [[8.1.0-0_New3DS|v13312]]([[8.1.0-0_New3DS]]), [[9.0.0-20|v14336]], [[9.3.0-21|v15360]]
|-
| 00008003
| SAFE_MODE NS
| [[1.0.0-0|v0]]
|-
| 20008003
| [[New_3DS]] SAFE_MODE NS
| [[8.1.0-0_New3DS|v13313]]
|}

Once Home Menu finishes loading, all of the above system modules are running, except for MP, RO, and act which are automatically [[Process_Manager_Services|loaded]] when a process requires them. When [[Process_Manager_Services|PM]]-module terminates processes, it will check whether the processes listed as dependencies for this process are listed as dependencies for other processes. Any processes which are no longer listed in any processes dependencies lists are then terminated. On [[New_3DS]], the only New3DS-specific system-module which automatically gets loaded during system boot is qtm.

All of the above system modules use the "BASE" [[SVC|memory-region]](specified in the exheader), except when listed otherwise for certain modules.

When handling the exheader dependency list starting with [[8.0.0-18]], Old3DS FIRM [[Process_Manager_Services|PM]]-module now skips handling titles in this list which have any bits in programID-low bitmask 0xF0000000 set(with [[8.0.0-18]] this is hard-coded). The exheader dependency list handling change is for the [[New 3DS]] system-module(s), which do not exist on Old3DS.

=== 00040138 - [[FIRM|System Firmware]] ===
NATIVE_FIRM and SAFE_MODE_FIRM for the initial versions are exactly the same, besides [[Configuration_Memory|core-version]] fields. SAFE_MODE_FIRM is used for running SAFE_MODE titles, on retail SAFE_MODE_FIRM seems to be only used for running the [[System_Settings#System_Updater|System Updater]] application. When a GBA VC title is launched, AGB_FIRM is launched to handle running this title. GBA VC savegames stored under SD card /title/<TID>/data use a custom format, this is handled by AGB_FIRM.

{| class="wikitable" border="1"
|-
! TitleID Low
! Description
! USA/EUR/JPN Versions
! CHN Versions
! KOR Versions
! TWN Versions
|-
| 00000001
| Unknown, very similar to SAFE_MODE_FIRM. Exists only on dev units and seems to only be used by SystemUpdaters.
| v0
|
|
|
|-
| 00000002
| NATIVE_FIRM (Native Firmware)
| [[1.0.0-0|v432]], [[1.1.0-1|v1472]], [[2.0.0-2|v2516]], [[2.1.0-3|v3553]], [[2.2.0-X|v4595]], [[3.0.0-5|v5647]], [[4.0.0-7|v6677]], [[4.1.0-8|v7712]], [[5.0.0-11|v8758]], [[5.1.0-11|v9792]], [[6.0.0-11|v10833]], [[6.1.0-11|v11872]], [[7.0.0-13|v12916]], [[7.2.0-17|v13956]], [[8.0.0-18|v15047]], [[9.0.0-20|v17120]], [[9.3.0-21|v18182]]
| Same as USA/EUR/JPN starting with the USA/EUR/JPN [[4.0.0-7]] title-version
| Same as CHN.
| Same as CHN.
|-
| 20000002
| [[New_3DS]] NATIVE_FIRM (Native Firmware)
| [[8.1.0-0_New3DS|v16085]], [[9.0.0-20|v17120]], [[9.3.0-21|v18182]]
| N/A
| Same as CHN.
| Same as CHN.
|-
| 00000003
| SAFE_MODE_FIRM
| [[1.0.0-0|v432]], [[3.0.0-5|v5632]]
| Same as USA/EUR/JPN starting with the USA/EUR/JPN [[3.0.0-5]] title-version
| Same as CHN.
| Same as CHN.
|-
| 20000003
| [[New_3DS]] SAFE_MODE_FIRM
| [[8.1.0-0_New3DS|v16081]]
| N/A
| Same as CHN.
| Same as CHN.
|-
| 00000102
| TWL_FIRM ( DSi Firmware )
| [[1.0.0-0|v432]], [[2.0.0-2|v1489]], [[3.0.0-5|v2565]], [[4.0.0-7|v4625]], [[4.4.0-10|v5681]], [[4.5.0-10|v6704]], [[6.0.0-11|v7762]], [[6.2.0-12|v8817]]
| Same as USA/EUR/JPN starting with the USA/EUR/JPN [[4.0.0-7]] title-version
| Same as CHN.
| Same as CHN.
|-
| 20000102
| [[New_3DS]] TWL_FIRM ( DSi Firmware )
| [[8.1.0-0_New3DS|v9936]]
| N/A
| Same as CHN.
| Same as CHN.
|-
| 00000202
| AGB_FIRM ( GBA Firmware )
| [[3.0.0-5|v519]], [[4.0.0-7|v2576]], [[6.0.0-11|v3665]]
| [[4.0.0-7|v2576]]
| [[4.0.0-7|v2576]], [[6.0.0-11|v3665]]
| Same as CHN.
|-
| 20000202
| [[New_3DS]] AGB_FIRM ( GBA Firmware )
| [[8.1.0-0_New3DS|v4816]]
| N/A
| N/A
| N/A
|}

== TWL System Titles ==

{| class="wikitable" border="1"
|-
! Content Category
! Bit Mask(s)
! Category Bit Mask
|-
| System Application
| TWL<nowiki>|</nowiki>0x1<nowiki>|</nowiki>0x4
| 0x8005
|-
| System Archive
| TWL<nowiki>|</nowiki>0x1<nowiki>|</nowiki>0x2<nowiki>|</nowiki>0x4<nowiki>|</nowiki>0x8
| 0x800F
|}
Bitmask 0x1 for TWL titles determines whether the title will be updated during a System Update.

=== 00048005 - System Applications===
{| class="wikitable" border="1"
|-
! TitleID Low
! Region
! Description
! Versions
! Information
|-
| 42383841(B88A)
| ALL
| [[DS Internet]]
| v0, [[2.1.0-4|v1025]], [[3.0.0-5|v2048]]
| [[DS Internet]] is the DSi-mode application launched by [[System Settings]] for setting TWL wifi configuration.
|-
| 484E4441(HNDA)
| ALL
| [[Download Play]]
| v1024
| This [[Download Play]] application is the DS-mode Download Play client, launched by the 3DS-mode Download Play application.
|-
| 484E4443(HNDC)
| CHN
| [[Download Play]]
| v1024
| See Above Description.
|-
| 484E444B(HNDK)
| KOR
| [[Download Play]]
| v1024
| See Above Description.
|}

=== 0004800F - System Data Archives===
{| class="wikitable" border="1"
|-
! TitleID Low
! Description
! Versions
|-
| 484E4841(HNHA)
| [[Nintendo DS Cart Whitelist]]
| v0, [[2.0.0-2|v1026]], [[2.2.0-X|v2048]], [[3.0.0-5|v3072]], [[4.0.0-7|v4096]], [[4.2.0-9|v5120]], [[4.3.0-10|v6145]], [[4.4.0-10|v7168]], [[4.5.0-10|v8192]], [[5.0.0-11|v9216]], [[6.0.0-11|v10240]], [[7.0.0-13|v11264]]
|-
| 484E4C41(HNLA)
| [[Version Data]]
| v0
|}

New system updates only block DS flash-cards when the above whitelist was updated, or when TWL_FIRM was updated. The whitelist contains the data used for detecting flash-cards, this is used by TWL_FIRM.

== Application Titles ==
{| class="wikitable" border="1"
|-
! Content Category
! Bit Mask(s)
! Category Bit Mask
|-
| [[Title list/eShop Titles|Application]] (eShop Title)
| Normal
| 0x0000
|-
| DLP Child
| DlpChild
| 0x0001
|-
| [[EShop Demos|Demo]]
| Demo
| 0x0002
|-
| [[Title list/Patches|Patch]]
| CannotExecution<nowiki>|</nowiki>Patch
| 0x000E
|-
| [[Title list/DLC|Add-on Content]] (DLC)
| NotRequireRightForMount<nowiki>|</nowiki>CannotExecution<nowiki>|</nowiki>AddOnContents
| 0x008C
|}

=== 00040001 - [[Download Play]] Titles ===
This titleID-high/programID-high is used for the titles sent over [[Download Play]]. Only one 00040001 Download Play title is installed to NAND /title at a time. There can be a maximum of 255 Download Play child titles per Unique ID, indexed by Title ID Variation. The legal index range: 0x0 - 0xff.

== TWL Application Titles ==
{| class="wikitable" border="1"
|-
! Content Category
! Bit Mask(s)
! Category Bit Mask
|-
| Application (DSiWare)
| TWL<nowiki>|</nowiki>0x4
| 0x8004
|}

=== 00048004 - DSiWare ===
Although these have a titleID high separate from DSi and a titleID is stored in the SRLs, the content of these SRLs are identical to DSi.

{| class="wikitable" border="1"
|-
! TitleID Low
! Region
! Description
! Versions
|-
| 4B4B5456(KKTV)
| EUR
| Cut the Rope
| v0, v64
|-
| 4B4E5256(KNRV)
| EUR
| A Little Bit of... Brain Training™: Maths Edition
| v0
|-
| 4B5A4C56(KZLV)
| EUR
| Plants vs. Zombies™
| v0
|-
| 4B454256(KEBV)
| EUR
| ELECTROPLANKTON (Hanenbow)
| v0
|-
| 4B513956(KQ9V)
| EUR
| Zelda: Four Swords Anniversary Edition
| v16
|-
| 4B574256(KWBV)
| EUR
| Mario Calculator
| v0
|-
| 4B574656(KWFV)
| EUR
| Mario Clock
| v0
|}

Ninjhax

2014-11-28T23:23:36Z

Slashmolder: /* Service access */

ninjhax is the an exploit by smea for the game Cubic Ninja. It was released on November 20th, 2014.

When triggered, it will boot a [[3DSX_Format | 3dsx-file]] from the sdcard root called "boot.3dsx". This file is usually the [[Homebrew Launcher]], which in turn can be used to launch other games/apps from the (micro)SD card.

==Installation==

Visit [http://smealum.net/ninjhax/ here] for instructions on how to install Ninjhax!

==Service access==

ninjhax gives developers access to a number of services. These include :

* ac:u
* APT:U
* boss:U
* cam:u
* cecd:u
* cfg:u
* dlp:FKCL
* dlp:SRVR
* dsp::DSP
* frd:u
* fs:USER
* gsp::Gpu
* hid:USER
* http:C
* ir:u
* mic:u
* ndm:u
* <nowiki>news:u</nowiki>
* nwm::UDS
* ptm:u
* pxi:dev
* soc:U
* ssl:C
* y2r:u

Additionally, Old 3DS models (3DS, 3DS XL and 2DS) are given access to the following :

* csnd:SND

In contrast, New 3DS models (New 3DS, New 3DS XL) get access to :

* am:app
* ir:rst
* l2b2:u
* l2b:u
* mvd:STD
* nim:aoc
* y2r2:u

The normal service used for accessing [[Circle Pad Pro]] is not accessible: [[IR_Services|ir:USER]].

==Limitations==

At the moment, ninjhax only allows users to access 64MB of RAM, including on the New 3DS. This may change in the future.

As there is currently no good way to use the DSP from homebrew, sound output is not yet possible on the New 3DS. At the moment, there is also no known way of running code on the New 3DS's extra CPU cores under ninjhax, though it is possible to use 80% of the system core's time using [[APT:SetApplicationCpuTimeLimit]] rather than 30% as was the case on the Old 3DS.

Games

2014-10-24T20:54:00Z

Slashmolder: /* Game list */

This page lists off many 3DS games and info about them, as well info about the product code and serial format. If the list is missing a game, and you have info about it, feel free to add it to the list.

Some of these games also have a savegame dumped, which can be downloaded under the Savegame column of the table. Info about the savegames' filesystem can be found on the [[Savegames]] page.

== Game list ==
Note the [DEMO] in the title name denotes that the game is a demo. Also, when adding games, please keep them in alphabetical order, keeping demos at the start of the list. The [DEV] in the title name denotes that the title is a developer encrypted application, and may not follow retail serial/product code conventions. The 'X' at the end of the Serials and Product codes of the below, takes the place of the region identifier, so there is not more than one entry per game.

{| class="wikitable sortable" border="1"
|-
! width="35%" | Title
! width="12%" | [[Serials|Serial]]
! width="12% | [[Serials#Product Code|Product Code]]
! width="5%" | EUR (P)
! width="5%" | USA (E)
! width="5%" | JPN (J)
! width="5%" | ROM Size
! width="5%" | FLASH Size
! width="5%" | FLASH ID
! width="5%" | FLASH Chip #
! width="6%" | Savegame
|-
| [DEMO][DEV] Mario Kart 7 (E3)
| ?
| CTR-P-AMKU
| No
| No
| No
| ?
| ?
| ?
| ?
| ?
|-
| [DEMO][DEV] Super Mario 3D Land (E3)
| ?
| CTR-P-CTAP
| No
| No
| No
| ?
| ?
| ?
| ?
| ?
|-
| [DEMO] Nintendogs+Cats
| LNZ-CTR-ADAX
| CTR-P-ADAX
| Yes
| ?
| ?
| ?
| 128kByte
| 0xC22211
| 25L1001
|
|-
| [DEMO] Pokémon Omega Ruby and Alpha Sapphire Special Demo
| ?
| CTR-N-NAHA
| Yes
| Yes
| Yes
| 2GBit
| 1MByte
| -
| -
|
|-
| [DEMO] Steel Diver
| LNZ-CTR-ASDX
| CTR-P-ASDX
| Yes
| No
| No
| ?
| ?
| ?
| ?
| ?
|-
| [DEMO] Super Mario 3D Land
| LNZ-CTR-AREX
| CTR-P-AREX
| Yes
| No
| ?
| ?
| ?
| ?
| ?
| ?
|-
| [DEMO] Super Smash Bros.
| LNA-CTR-NXCX
| CTR-P-NXCX
| Yes
| Yes
| Yes
| 2GBit
| 512kByte
| ?
| ?
|
|-
| [DEMO] Super Smash Bros. Special Demo Version
| LNA-CTR-NXCX
| CTR-P-NXCX
| Yes
| Yes
| Yes
| 2Gbit
| 512kByte
| ?
| ?
|
|-
| [DEMO] The Legend of Zelda: Ocarina of Time 3D
| LNZ-CTR-AQEX
| CTR-P-AQEX
| Yes
| Yes
| Yes
| ?
| ?
| ?
| ?
| ?
|-
| Animal Crossing: New Leaf
| LNA-CTR-EGDX
| CTR-P-EGDX
| Yes
| Yes
| Yes
| 8GBit
| 10MByte
| -
| -
|
|-
| Asphalt 3D
| LNA-CTR-ASFX
| CTR-P-ASFX
| Yes
| Yes
| Yes
| 4GBit
| 128kByte
| ?
| ?
|
|-
| Cubic Ninja
| LNA-CTR-AQNX
| CTR-P-AQNX
| Yes
| Yes
| Yes
| 1GBit
| 128kByte
| ?
| ?
|
|-
| Dead or Alive - Dimensions
| LNA-CTR-ADDX
| CTR-P-ADDX
| Yes
| Yes
| Yes
| 16GBit
| 128kByte
| 0xC22211
| 25L1001
|
|-
| Lego Star Wars III: The Clone Wars
| LNA-CTR-ALGX
| CTR-P-ALGX
| Yes
| Yes
| No
| 4GBit
| 128kByte
| 0xC22211
| 25L1001
|
|-
| Mario & Luigi: Dream Team Bros.
| LNA-CTR-AYMX
| CTR-P-AYMX
| Yes
| Yes
| Yes
| 8GBit
| 512kByte
| ?
| ?
|
|-
| Mario Kart 7
| LNA-CTR-AMKX
| CTR-P-AMKX
| Yes
| Yes
| Yes
| 8GBit
| 512kByte
| ?
| ?
|
|-
| Nintendogs+Cats: French Bulldog & New Friends
| LNA-CTR-ADBX
| CTR-P-ADBX
| Yes
| Yes
| Yes
| 4GBit
| 512kByte
| 0xC22213
| 25L4001
|
|-
| One Piece: Unlimited Cruise SP
| LNA-CTR-ALFX
| CTR-P-ALFX
| No
| No
| Yes
| 4GBit
| 128kByte
| 0xC22211
| 25L1001
|
|-
| Pilotwings Resort
| LNA-CTR-AWAX
| CTR-P-AWAX
| Yes
| Yes
| Yes
| 1GBit
| 128kByte
| 0xC22211
| 25L1001
|
|-
| Pokémon Mystery Dungeon: Gates to Infinity
| LNA-CTR-APDX
| CTR-P-APDX
| Yes
| Yes
| Yes
| 8GBit
| 512kByte
| ?
| ?
|
|-
| Pokémon Y
| LNA-CTR-EK2X
| CTR-P-EK2A
| Yes
| Yes
| Yes
| 16GBit
| 1MByte
| -
| -
|
|-
| Puzzle Bobble Universe
| LNA-CTR-ABBX
| CTR-P-ABBX
| Yes
| Yes
| Yes
| 4GBit
| 128kByte
| 0xC22211
| 25L1001
|
|-
| [[Raving Rabbids: Travel in Time 3D]]
| LNA-CTR-ARBX
| CTR-P-ARBX
| Yes
| Yes
| Yes
| 2GBit
| 128kByte
| 0xC22211
| 25L1001
| [http://dl.dropbox.com/u/7830918/3DS%20Upload/decrypted.bin de]/[http://dl.dropbox.com/u/7830918/3DS%20Upload/encrypted.bin en]
|-
| Ridge Racer 3D
| LNA-CTR-ARRX
| CTR-P-ARRX
| Yes
| Yes
| Yes
| 8GBit
| 512kByte
| 0xC22213
| 25L4001
|
|-
| Samurai Warriors - Chronicles
| LNA-CTR-A66X
| CTR-P-A66X
| Yes
| Yes
| Yes
| 16GBit
| 512kByte
| 0xC22213
| 25L4001
|
|-
| Sonic: Lost World
| LNA-CTR-ARVX
| CTR-P-ARVX
| Yes
| Yes
| Yes
| 16GBit
| 128kByte
| ?
| ?
|
|-
| Splinter Cell 3D
| LNA-CTR-ASCX
| CTR-P-ASCX
| Yes
| Yes
| Yes
| 16Gbit
| 128kByte
| 0xC22211
| 25L1001
|
|-
| Steel Diver
| LNA-CTR-ASDX
| CTR-P-ASDX
| Yes
| Yes
| Yes
| 2GBit
| 512kByte
| 0xC22213
| 25L4001
| [http://dl.dropbox.com/u/32759832/3DS_saves/Steel_Diver/decrypted.sav de]/[http://dl.dropbox.com/u/32759832/3DS_saves/Steel_Diver/encrypted.sav en]
|-
| Super Mario 3D Land
| LNA-CTR-AREX
| CTR-P-AREX
| Yes
| Yes
| Yes
| 4GBit
| 128kByte
| 0xC22211
| 25L1001
|
|-
| Super Monkey Ball 3D PAL
| LNA-CTR-ASMX
| CTR-P-ASMX
| Yes
| Yes
| Yes
| 2GBit
| 128kByte
| 0xC22211
| 25L1001
|
|-
| Super Smash Bros.
| LNA-CTR-NXCX
| CTR-P-NXCX
| Yes
| Yes
| Yes
| 16GBit
| 512kByte
| ?
| ?
|
|-
| Super Street Fighter IV - 3D Edition
| LNA-CTR-ASSX
| CTR-P-ASSX
| Yes
| Yes
| Yes
| 16GBit
| 128kByte
| 0xC22211
| 25L1001
|
|-
| The Legend of Zelda: A Link between Worlds
| LNA-CTR-BZLX
| CTR-P-BZLX
| Yes
| Yes
| Yes
| 8GBit
| 128kByte
| ?
| ?
|
|-
| [[The Legend of Zelda: Ocarina of Time 3D]]
| LNA-CTR-AQEX
| CTR-P-AQEX
| Yes
| Yes
| Yes
| 4GBit
| 128kByte
| 0xC22211
| 25L1001
| [http://dl.dropbox.com/u/32759832/3DS_saves/Zelda_OoT/decrypted.sav de]/[http://dl.dropbox.com/u/32759832/3DS_saves/Zelda_OoT/encrypted.sav en]
|-
| The Sims 3
| LNA-CTR-AS3X
| CTR-P-AS3X
| Yes
| Yes
| Yes
| 4GBit
| 512kByte
| 0xC22213
| 25L4001
|
|-
| Tom Clancy's Ghost Recon: Shadow Wars
| LNA-CTR-AGRX
| CTR-P-ARGX
| Yes
| Yes
| Yes
| 2GBit
| 128kByte
| 0xC22211
| 25L1001
|
|-
|}

Elisherer's Savefile collection: [http://sherer.co.il/saves http://sherer.co.il/saves]

== SD Savegames ==
{| class="wikitable sortable" border="1"
|-
! Title
! Savegame
|-
| Crashmo
| [https://dl.dropbox.com/u/20520664/crashmo_usa.sav cleartext]
|}

MIC Services

2014-10-05T05:17:19Z

Slashmolder: /* Microphone service "mic:u" */

[[Category:Services]]
= Microphone service "mic:u" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010042
| [[MIC:MapSharedMem|MapSharedMem]]
|-
| 0x00020000
| [[MIC:UnmapSharedMem|UnmapSharedMem]]
|-
| 0x00030140
| [[MICU:Initialize|Initialize]]
|-
| 0x00040040
| AdjustSampling(u8 input)
|-
| 0x00050000
| StopSampling
|-
| 0x00060000
| IsSampling
|-
| 0x00070000
| GetEventHandle. This event is signaled by MIC-module when more audio-data is available in shared-mem.
|-
| 0x00080040
| SetControl(u8 input). This is a wrapper for CDCMIC command 0x00010040.
|-
| 0x00090000
| GetControl. This is a wrapper for CDCMIC command 0x00020000.
|-
| 0x000A0040
| SetRecording(u8 input). This is a wrapper for CDCMIC command 0x00030040. 0 = disable recording, 1 = enable recording. When recording is disabled with this, MIC-module writes value 0xFFFF to the output audio sample data in shared-mem, since that's what the [[MIC]] hardware returns here.
|-
| 0x000B0000
| IsRecording. This is a wrapper for CDCMIC command 0x00040000.
|-
| 0x000C0042
| (size, [[IPC Command Structure|<translate-header>]], bufptr) This is a wrapper for CDCMIC command 0x00050042.
|-
| 0x000D0040
| (u8 input) This writes the input value to a MIC-module state field.
|-
| 0x000E0000
| This writes the u8 value of the MIC-module field also used by command 0x000D0040, to cmdreply indexword[2].
|-
| 0x000F0040
| (u8 input) This writes the input u8 value to a MIC-module state field.
|-
| 0x00100040
| When the input value is 0, value 1 is written to an u8 MIC module state field. Otherwise, value 0 is written there. Normally the input value is non-zero.
|}

This is an interface for using the MIC hardware via the "cdc:MIC" service and the MIC [[IO]] registers.

Only one session can be open for this service total(that is, only one process can use this service at a time).

=Control value=
{| class="wikitable" border="1"
|-
! Bit
! Description
|-
| 6-0
| Amplification, 0=none.
|-
| 7
| Doesn't affect output audio data in shared-mem?
|}

=See Also=
[[MIC Shared Memory]]

I2C Services

2014-10-01T05:03:54Z

Slashmolder: /* I2C Service */

[[Category:Services]]
= I2C Service Names =
* "i2c::MCU"
* "i2c::CAM"
* "i2c::LCD"
* "i2c::DEB"
* "i2c::HID"
* "i2c::IR"
* "i2c::EEP"

= I2C Service =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010100
| SetRegisterBits8 (u8 devid, u8 regid, u8 regdata, u8 mask)
|-
| 0x0002....
| EnableRegisterBits8 (u8 devid, u8 regid, u8 enablemask)
|-
| 0x000300C0
| DisableRegisterBits8 (u8 devid, u8 regid, u8 disablemask)
|-
| 0x00040102
| MultiSetRegisterBits16 (u16 regid, u16 regdata, u16 mask, devcount, u8* devidlistptr)
|-
| 0x0005....
| WriteRegister8 (u8 devid, u8 regid, u8 regdata)
|-
| 0x0006....
| WriteCommand8 (u8 devid, u8 cmdid)
|-
| 0x0007....
| WriteRegister16 (u8 devid, u16 regid, u16 regdata)
|-
| 0x000800C2
| MultiWriteRegister16 (u16 regid, u16 regdata, devcount, u8* devidlistptr)
|-
| 0x0009....
| u8 ReadRegister8 (u8 devid, u8 regid)
|-
| 0x000A....
| u16 ReadRegister16 (u8 devid, u16 regid)
|-
| 0x000B00C2
| WriteRegisterBuffer8 (u8 devid, u8 regid, buffersize, u8* bufferptr)
|-
| 0x000C00C2
| WriteRegisterBuffer16 (u8 devid, u16 regid, buffersize, u16* bufferptr)
|-
| 0x000D....
|
|-
| 0x000E00C2
| WriteRegisterBuffer8_again? (u8 devid, u8 regid, buffersize, u8* bufferptr)
|-
| 0x000F....
|
|-
| 0x0010....
|
|-
| 0x001100C2
| ReadRegisterBuffer(u8 devid, u16 regid, buffersize, u8 *buff)
|-
| 0x001200C2
| WriteRegisterBuffer(u8 devid, u16 regid, buffersize, u8 *buff)
|-
| 0x0013....
|
|-
| 0x00140082
|
|-
| 0x0015....
|
|}

GPIO Services

2014-10-01T04:35:27Z

Slashmolder: /* I2C Service */

[[Category:Services]]
= GPIO Service Names =
* "gpio:CDC"
* "gpio:MCU"
* "gpio:HID"
* "gpio:NWM"
* "gpio:IR"

= I2C Service =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x0001....
| ?(u32 unk1,u32* ret) //reads from 0x1ec47020
|-
| 0x0002....
| ?(u32 unk1,u32 unk2)
|-
| 0x0003....
| ?(u32 unk1,u32* ret)
|-
| 0x0004....
| ?(u32 unk1,u32 unk2)
|-
| 0x0005....
| ?(u32 unk1,u32* ret)
|-
| 0x0006....
| ?(u32 unk1,u32 unk2)
|-
| 0x0007....
| GetIRGPIO(u32 unk1,u32* ret)
|-
| 0x0008....
| SetIRGPIO(u32 unk1,u32 unk2)
|-
| 0x00090082
| ?(u32 unk1,u32 unk2,HANDEL unk3)
|}

GPIO Services

2014-10-01T04:33:47Z

Slashmolder: /* I2C Service */

[[Category:Services]]
= GPIO Service Names =
* "gpio:CDC"
* "gpio:MCU"
* "gpio:HID"
* "gpio:NWM"
* "gpio:IR"

= I2C Service =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x0001....
| ?(u32 unk1,u32* ret) //reads from 0x1ec47020
|-
| 0x0002....
| ?(u32 unk1,u32 unk2)
|-
| 0x0003....
| ?(u32 unk1,u32* ret)
|-
| 0x0004....
| ?(u32 unk1,u32 unk2)
|-
| 0x0005....
| ?(u32 unk1,u32* ret)
|-
| 0x0006....
| ?(u32 unk1,u32 unk2)
|-
| 0x0007....
| GetIRGPIO(u32 unk1,u32* ret) recieve
|-
| 0x0008....
| SetIRGPIO(u32 unk1,u32 unk2) send
|-
| 0x00090082
| ?(u32 unk1,u32 unk2,HANDEL unk3)
|}

Filesystem services

2014-10-01T04:13:52Z

Slashmolder: /* Filesystem service "fs:USER" */

[[Category:Services]]

= Filesystem service "fs:USER" =
You can at most have 32 fs archive handles.

{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Description
! scope="col" width="400" | Required [[NCCH/Extended_Header|exheader]] accessinfo bitmask
|-
| 0x000100C6
|
| Dummy1
| None
|-
| 0x040100C4
|
| Control
| None
|-
| 0x08010002
|
| [[FS:Initialize|Initialize]]
| None
|-
| 0x080201C2
|
| [[FS:OpenFile|OpenFile]]
| None
|-
| 0x08030204
|
| [[FS:OpenFileDirectly|OpenFileDirectly]]
| None
|-
| 0x08040142
|
| [[FS:DeleteFile|DeleteFile]]
| None
|-
| 0x08050244
|
| RenameFile
| None
|-
| 0x08060142
|
| DeleteDirectory
| None
|-
| 0x08070142
|
| DeleteDirectoryRecursively
| None
|-
| 0x08080202
|
| CreateFile
| None
|-
| 0x08090182
|
| [[FS:CreateDirectory|CreateDirectory]]
| None
|-
| 0x080A0244
|
| RenameDirectory
| None
|-
| 0x080B0102
|
| [[FS:OpenDirectory|OpenDirectory]]
| None
|-
| 0x080C00C2
|
| [[FS:OpenArchive|OpenArchive]]
| Each archive idcode has separate accessinfo bitmasks, if any.
|-
| 0x080D0144
|
| ControlArchive
| None
|-
| 0x080E0080
|
| [[FS:CloseArchive|CloseArchive]]
| None
|-
| 0x080F0180
|
| FormatThisUserSaveData
| None
|-
| 0x08100200
|
| CreateSystemSaveData
| 0x4, for when the input saveID doesn't match the exheader saveID.
|-
| 0x08110040
|
| DeleteSystemSaveData
| 0x1004, for when the input saveID doesn't match the exheader saveID.
|-
| 0x08120080
|
| GetFreeBytes
| None
|-
| 0x08130000
|
| GetCardType
| 0x1017
|-
| 0x08140000
|
| [[FS:GetSdmcArchiveResource|GetSdmcArchiveResource]]
| None
|-
| 0x08150000
|
| [[FS:GetNandArchiveResource|GetNandArchiveResource]]
| None
|-
| 0x08160000
|
| GetSdmcFatfsError
| 0x2
|-
| 0x08170000
|
| [[FS:IsSdmcDetected|IsSdmcDetected]]
| None
|-
| 0x08180000
|
| [[FS:IsSdmcWritable|IsSdmcWritable]]
| None
|-
| 0x08190042
|
| GetSdmcCid
| 0x2
|-
| 0x081A0042
|
| GetNandCid
| 0x2
|-
| 0x081B0000
|
| GetSdmcSpeedInfo
| 0x2
|-
| 0x081C0000
|
| GetNandSpeedInfo
| 0x2
|-
| 0x081D0042
|
| GetSdmcLog
| 0x2
|-
| 0x081E0042
|
| GetNandLog
| 0x2
|-
| 0x081F0000
|
| ClearSdmcLog
| 0x2
|-
| 0x08200000
|
| ClearNandLog
| 0x2
|-
| 0x08210000
|
| CardSlotIsInserted
| 0x1017
|-
| 0x08220000
|
| CardSlotPowerOn
| 0x2
|-
| 0x08230000
|
| CardSlotPowerOff
| 0x2
|-
| 0x08240000
|
| CardSlotGetCardIFPowerStatus
| 0x2
|-
| 0x08250040
|
| CardNorDirectCommand
| 0x2
|-
| 0x08260080
|
| CardNorDirectCommandWithAddress
| 0x2
|-
| 0x08270082
|
| CardNorDirectRead
| 0x2
|-
| 0x082800C2
|
| CardNorDirectReadWithAddress
| 0x2
|-
| 0x08290082
|
| CardNorDirectWrite
| 0x2
|-
| 0x082A00C2
|
| CardNorDirectWriteWithAddress
| 0x2
|-
| 0x082B00C2
|
| CardNorDirectRead_4xIO
| 0x2
|-
| 0x082C0082
|
| CardNorDirectCpuWriteWithoutVerify
| 0x2
|-
| 0x082D0040
|
| CardNorDirectSectorEraseWithoutVerify
| 0x2
|-
| 0x082E0040
|
| [[FS:GetProductInfo|GetProductInfo]]
| 0x1005
|-
| 0x082F0040
|
| [[FS:GetProgramLaunchInfo|GetProgramLaunchInfo]]
| 0x1005
|-
| 0x08300182
|
| CreateExtSaveData
| 0xC, for when the input extdataID doesn't match the exheader extdataID.
|-
| 0x08310180
|
| CreateSharedExtSaveData
| 0x1005
|-
| 0x08320102
|
| [[FS:ReadExtSaveDataIcon|ReadExtSaveDataIcon]]
| 0x100D, for when the input extdataID doesn't match the exheader extdataID.
|-
| 0x08330082
|
| EnumerateExtSaveData
| 0x1005
|-
| 0x08340082
|
| EnumerateSharedExtSaveData
| 0x1005
|-
| 0x08350080
|
| DeleteExtSaveData
| 0x100D, for when the input extdataID doesn't match the exheader extdataID.
|-
| 0x08360080
|
| DeleteSharedExtSaveData
| 0x1005
|-
| 0x08370040
|
| SetCardSpiBaudRate
| 0x2
|-
| 0x08380040
|
| SetCardSpiBusMode
| 0x2
|-
| 0x08390000
|
| SendInitializeInfoTo9
| None
|-
| 0x083A0100
|
| GetSpecialContentIndex
| 0x1005
|-
| 0x083B00C2
|
| GetLegacyRomHeader
| 0x1015
|-
| 0x083C00C2
|
| GetLegacyBannerData
| 0x1015
|-
| 0x083D0100
|
| CheckAuthorityToAccessExtSaveData
| 0x44
|-
| 0x083E00C2
|
| QueryTotalQuotaSize
| None
|-
| 0x083F00C0
|
| GetExtDataBlockSize
| None
|-
| 0x08400040
|
| AbnegateAccessRight
|
|-
| 0x08410000
|
| DeleteSdmcRoot
| 0x1005
|-
| 0x08420040
|
| DeleteAllExtSaveDataOnNand
| 0x1005
|-
| 0x08430000
|
| [[FS:InitializeCtrFileSystem|InitializeCtrFileSystem]]
| None
|-
| 0x08440000
|
| CreateSeed
| 0x2
|-
| 0x084500C2
|
| GetFormatInfo
| ?
|-
| 0x08460102
|
| GetLegacyRomHeader2
| 0x1015
|-
| 0x08470180
|
| FormatCtrCardUserSaveData
| 0x6
|-
| 0x08480042
|
| GetSdmcCtrRootPath
| 0x100D
|-
| 0x08490040
|
| GetArchiveResource
| ?
|-
| 0x084A0002
|
| ExportIntegrityVerificationSeed
| 0x4000
|-
| 0x084B0002
|
| ImportIntegrityVerificationSeed
| 0x4000
|-
| 0x084C0242
|
| FormatSaveData
| 0x6, in some cases this right isn't needed however.
|-
| 0x084D0102
|
| GetLegacySubBannerData
| 0x1015
|-
| 0x084E0342
|
| [[FS:UpdateSha256Context|UpdateSha256Context]]
| 0x5
|-
| 0x084F0102
|
| ReadSpecialFile
| None
|-
| 0x08500040
|
| GetSpecialFileSize
| None
|-
| 0x08510242
| [[3.0.0-5]]
| CreateExtSaveData
| Shared extdata: 0x101005. Regular extdata in certain cases: 0xC.
|-
| 0x08520100
| [[3.0.0-5]]
| DeleteExtSaveData (u32 flags, u64 extdataID)
| Shared extdata: 0x101005. Regular extdata in certain cases: 0x10100D.
|-
| 0x08530142
| [[3.0.0-5]]
| ReadExtSaveDataIcon
| 0x10100D(this doesn't apply in certain cases however)
|-
| 0x085400C0
| [[3.0.0-5]]
| GetExtDataBlockSize?
| 0x10100D(this doesn't apply in certain cases however)
|-
| 0x08550102
| [[3.0.0-5]]
| EnumerateExtSaveData
| 0x101005
|-
| 0x08560200
| [[3.0.0-5]]
| FsCreateSystemSaveData?
| 0x4(this doesn't apply in certain cases however)
|-
| 0x08570080
| [[3.0.0-5]]
| DeleteSystemSaveData
| 0x1004(this doesn't apply in certain cases however)
|-
| 0x08580000
| [[3.0.0-5]]
| [[FS:GetMovableSedHashedKeyYRandomData|GetMovableSedHashedKeyYRandomData]]
| 0x2004
|-
| 0x08590200
| [[3.0.0-5]]
| SetMovableSedHashedKeyYRandomData?
| 0x2004
|-
| 0x085A00C0
| [[3.0.0-5]]
| SetArchivePriority(u64 ID,u32 priority)
| None
|-
| 0x085B0080
| [[3.0.0-5]]
| GetArchivePriority(u64 ID,u32 *priority)
| None
|-
| 0x085C00C0
| [[3.0.0-5]]
| SetCtrCardLatencyParameter
| 0xE
|-
| 0x085D0180
| [[3.0.0-5]]
| ?
| 0x100001
|-
| 0x085E0040
| [[3.0.0-5]]
| ResetCardCompatibilityParameter
| 0xE
|-
| 0x085F0040
| [[3.0.0-5]]
| SwitchCleanupInvalidSaveData
| 0x12004
|-
| 0x08600042
| [[3.0.0-5]]
| EnumerateSystemSaveData
| 0x2004
|-
| 0x08610042
| [[3.0.0-5]]
| InitializeWithSdkVersion
| None
|-
| 0x08620040
| [[3.0.0-5]]
| SetPriority
| None
|-
| 0x08630000
| [[3.0.0-5]]
| GetPriority
| None
|-
| 0x08640000
| [[3.0.0-5]]
| Obsoleted_4_0_GetNandInfo Stubbed, this returns an error.
| None
|-
| 0x08650140
| [[4.0.0-7]]
| SetSaveDataSecureValue, this is used with [[Anti Savegame Restore]].
| 0x121004(in certain cases this doesn't apply however)
|-
| 0x086600C0
| [[4.0.0-7]]
| GetSaveDataSecureValue, this is used with [[Anti Savegame Restore]].
| 0x121004(in certain cases this doesn't apply however)
|-
| 0x086700C4
| [[4.0.0-7]]
| ControlSecureSave
| 0x121004
|-
| 0x08680000
| [[4.0.0-7]]
| GetMediaType, This loads the u8 mediatype for the current application from already initialized state, this u8 was originally loaded from the same data used by [[FS:GetProgramLaunchInfo|GetProgramLaunchInfo]]. This then writes the u8 to response-word[2]. This is used with [[Anti Savegame Restore]].
| None
|-
| 0x08690000
| [[4.0.0-7]]
| Obsoleted_4_0_GetNandEraseCount Stubbed, this returns an error.
| None
|-
| 0x086A0082
| [[4.0.0-7]]
| ReadNandReport This is a wrapper for [[Filesystem_services_PXI|FSPXI]] command 0x00550082.
| None
|-
| 0x086B00C2
| ?
| ?
| 00121004
|-
| 0x086C00C2
| ?
| ?
| 00121004
|-
| 0x086D0040
| ?
| ?
| 00020004
|-
| 0x086E00C0
| ?
| ?
| ?None?
|-
| 0x086F0040
| ?
| ?
| 0xE
|-
| 0x087000C2
| ?
| ?
| ?None?
|-
| 0x08710100
| ?
| ?
| 0xC
|-
| 0x087201C0
| ?
| ?
| 00080004
|-
| 0x087300C0
| ?
| ?
| 00080004
|-
| 0x08740000
| ?
| ?
| 00080004
|-
| 0x08750140
| ?
| ?
| ?None?
|-
| 0x087600C0
| ?
| ?
| ?None?
|-
| 0x08770100
| ?
| ?
| ?
|-
| 0x087800C0
| ?
| ?
| ?
|}

When access rights are required for a command, at least one of the bits in the process accessinfo specified in the above table for the command must be set. Error 0xD9004676 is returned when a process attempts to use a command which it doesn't have access rights for the command. The exheader accessinfo field is all-zero for most applications. Note that the permissions listed in the above table is for system-version v2.x, therefore permission bit(s) added with newer FIRM may be missing from this.

Each session for fs:USER has separate permissions, initially these are set to all-zero for new fs:USER sessions. The permissions/etc for fs:USER sessions are initialized via [[FS:Initialize]](loaded from the user process exheader).

=File service=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x000100C6
| Dummy1
|-
| 0x040100C4
| Control
|-
| 0x08010100
| OpenSubFile
|-
| 0x080200C2
| [[FSFile:Read|Read]]
|-
| 0x08030102
| [[FSFile:Write|Write]]
|-
| 0x08040000
| [[FSFile:GetSize|GetSize]]
|-
| 0x08050080
| [[FSFile:SetSize|SetSize]]
|-
| 0x08060000
| GetAttributes
|-
| 0x08070040
| SetAttributes
|-
| 0x08080000
| [[FSFile:Close|Close]]
|-
| 0x08090000
| Flush
|-
| 0x080A0040
| SetPriority
|-
| 0x080B0000
| GetPriority
|-
| 0x080C0000
| OpenLinkFile
|}

=Directory service=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x000100C6
| Dummy1
|-
| 0x040100C4
| Control
|-
| 0x08010042
| [[FSDir:Read|Read]]
|-
| 0x08020000
| [[FSDir:Close|Close]]
|}

= Filesystem service "fs:LDR" =
This service is identical to fs:USER, except [[FS:OpenArchive]] archive 0x2345678E can only be accessed with fs:LDR.

= ProgramRegistry service "fs:REG" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x000100C6
| Dummy1
|-
| 0x040103C0
| Register
|-
| 0x04020040
| Unregister
|-
| 0x040300C0
| GetProgramInfo
|-
| 0x04040100
| LoadProgram
|-
| 0x04050080
| UnloadProgram
|-
| 0x04060080
| CheckHostLoadId
|}

=Errors=
See [[Filesystem_services_PXI]].

Filesystem services PXI

2014-10-01T04:12:49Z

Slashmolder:

{| class="wikitable" border="1"
|-
! Command Header, prior to [[3.0.0-5]]
! Command Header, starting with [[3.0.0-5]]
! Available since system version
! Description
|-
| 0x000101C2
|
| [[1.0.0-0]]
| OpenFile
|-
| 0x00020142
|
| [[1.0.0-0]]
| DeleteFile? (unknown_u32, archivehandlelo, archivehandlehi, pathtype, pathsize, pathptrsize, pathptr)
|-
| 0x00030244
|
| [[1.0.0-0]]
| RenameFile? (unknown_u32, archivehandlelo, archivehandlehi, pathtype, pathsize, secondarchivehandlelo, secondarchivehandlehi, secondpathtype, secondpathsize, pathptrsize, pathptr, secondpathptrsize, secondpathptr)
|-
| 0x00040142
|
| [[1.0.0-0]]
| DeleteDirectory? (unknown_u32, archivehandlelo, archivehandlehi, pathtype, pathsize, pathptrsize, pathptr)
|-
| 0x00050202
|
| [[1.0.0-0]]
| CreateFile? (unknown_u32, archivehandlelo, archivehandlehi, pathtype, pathsize, unknown_u32, unknown_lo, unknown_hi, pathptrsize, pathptr)
|-
| 0x00060182
|
| [[1.0.0-0]]
| CreateDirectory? (unknown_u32, archivehandlelo, archivehandlehi, pathtype, pathsize, unknown_u32, pathptrsize, pathptr)
|-
| 0x00070244
|
| [[1.0.0-0]]
| RenameDirectory? (unknown_u32, archivehandlelo, archivehandlehi, pathtype, pathsize, secondarchivehandlelo, secondarchivehandlehi, secondpathtype, secondpathsize, pathptrsize, pathptr, secondpathptrsize, secondpathptr)
|-
| 0x00080102
|
| [[1.0.0-0]]
| OpenDirectory (archivehandlelo, archivehandlehi, pathtype, pathsize, pathptrsize, pathptr)
|-
| 0x00090142
|
| [[1.0.0-0]]
| ReadFile
|-
| 0x000A00C2
|
| [[1.0.0-0]]
| CalculateFileHashSHA256
|-
| 0x000B0182
|
| [[1.0.0-0]]
| WriteFile
|-
| 0x000C0104
|
| [[1.0.0-0]]
| [[FSPXI:CalcSavegameMAC|CalcSavegameMAC]]
|-
| 0x000D0080
|
| [[1.0.0-0]]
| GetFileSize
|-
| 0x000E0100
|
| [[1.0.0-0]]
| SetFileSize (sizelo, sizehi, filehandlelo, filehandlehi)
|-
| 0x000F0080
|
| [[1.0.0-0]]
| CloseFile (filehandlelo, filehandlehi)
|-
| 0x001000C2
|
| [[1.0.0-0]]
| ReadDirectory (dirhandlelo, dirhandlehi, count, ptrsize, ptr)
|-
| 0x00110080
|
| [[1.0.0-0]]
| CloseDirectory (dirhandlelo, dirhandlehi)
|-
| 0x001200C2
|
| [[1.0.0-0]]
| [[FSPXI:OpenArchive|OpenArchive]]
|-
| 0x00130102
|
| [[1.0.0-0]]
| CreateExtSaveData? (archivehandlelo, archivehandlehi, pathtype, pathsize, pathptrsize, pathptr)
|-
| 0x00140102
|
| [[1.0.0-0]]
| (archivehandlelo, archivehandlehi, pathtype, pathsize, pathptrsize, pathptr)
|-
| 0x00150102
|
| [[1.0.0-0]]
| (archivehandlelo, archivehandlehi, pathtype, pathsize, pathptrsize, pathptr)
|-
| 0x00160080
|
| [[1.0.0-0]]
| CloseArchive (archivehandlelo, archivehandlehi)
|-
| 0x00170080
|
| [[1.0.0-0]]
| ReopenArchive? (archivehandlelo, archivehandlehi)
|-
| 0x00180000
|
| [[1.0.0-0]]
| GetCardType
|-
| 0x00190000
|
| [[1.0.0-0]]
| [[FSPXI:GetSdmcArchiveResource|GetSdmcArchiveResource]]
|-
| 0x001A0000
|
| [[1.0.0-0]]
| [[FSPXI:GetNandArchiveResource|GetNandArchiveResource]]
|-
| 0x001B0000
|
| [[1.0.0-0]]
| GetSdmcFatFsError
|-
| 0x001C0000
|
| [[1.0.0-0]]
| GetSdmcDetected
|-
| 0x001D0000
|
| [[1.0.0-0]]
| GetSdmcWritable
|-
| 0x001E0042
|
| [[1.0.0-0]]
| [[FSPXI:GetSdmcCid|GetSdmcCid]]
|-
| 0x001F0042
|
| [[1.0.0-0]]
| [[FSPXI:GetNandCid|GetNandCid]]
|-
| 0x00200000
|
| [[1.0.0-0]]
| GetSdmcSpeedInfo
|-
| 0x00210000
|
| [[1.0.0-0]]
| GetNandSpeedInfo
|-
| 0x00220042
|
| [[1.0.0-0]]
| GetSdmcLog
|-
| 0x00230042
|
| [[1.0.0-0]]
| GetNandLog
|-
| 0x00240000
|
| [[1.0.0-0]]
| ClearSdmcLog
|-
| 0x00250000
|
| [[1.0.0-0]]
| ClearNandLog
|-
| 0x00260000
|
| [[1.0.0-0]]
| GetCardSlotInserted
|-
| 0x00270000
|
| [[1.0.0-0]]
| CardSlotPowerOn
|-
| 0x00280000
|
| [[1.0.0-0]]
| CardSlotPowerOff
|-
| 0x00290000
|
| [[1.0.0-0]]
| CardSlotGetIfPowerStatus
|-
| 0x002A0040
|
| [[1.0.0-0]]
| [[FSPXI:CardNorDirectCommand|CardNorDirectCommand]] (These CardNor commands are used for accessing the raw gamecard flash savedata)
|-
| 0x002B0080
|
| [[1.0.0-0]]
| [[FSPXI:CardNorDirectCommandWithAddress|CardNorDirectCommandWithAddress]]
|-
| 0x002C0082
|
| [[1.0.0-0]]
| [[FSPXI:CardNorDirectRead|CardNorDirectRead]]
|-
| 0x002D00C2
|
| [[1.0.0-0]]
| [[FSPXI:CardNorDirectReadWithAddress|CardNorDirectReadWithAddress]]
|-
| 0x002E0082
|
| [[1.0.0-0]]
| [[FSPXI:CardNorDirectWrite|CardNorDirectWrite]]
|-
| 0x002F00C2
|
| [[1.0.0-0]]
| [[FSPXI:CardNorDirectWriteWithAddress|CardNorDirectWriteWithAddress]]
|-
| 0x003000C2
|
| [[1.0.0-0]]
| [[FSPXI:CardNorDirectRead4IO|CardNorDirectRead4IO]]
|-
| 0x00310082
|
| [[1.0.0-0]]
| CardNorDirectCpuWriteWithoutVerify
|-
| 0x00320040
|
| [[1.0.0-0]]
| [[FSPXI:CardNorDirectSectorEraseWithoutVerify|CardNorDirectSectorEraseWithoutVerify]]
|-
| 0x00330080
|
| [[1.0.0-0]]
| GetProductInfo
|-
| 0x00340040
|
| [[1.0.0-0]]
| SetCardSpiBaudrate
|-
| 0x00350040
|
| [[1.0.0-0]]
| SetCardSpiBusMode
|-
| 0x00360040
|
| [[1.0.0-0]]
| SendInitializeInfo
|-
| 0x00370140
|
| [[1.0.0-0]]
| CreateExtSaveData
|-
| 0x003800C0
|
| [[1.0.0-0]]
| DeleteExtSaveData
|-
| 0x00390082
|
| [[1.0.0-0]]
| EnumerateExtSaveData
|-
| 0x003A0100
|
| [[1.0.0-0]]
| GetSpecialContentIndex
|-
| 0x003B00C2
|
| [[1.0.0-0]]
| GetLegacyRomHeader
|-
| 0x003C00C2
|
| [[1.0.0-0]]
| GetLegacyBannerData
|-
| 0x003F0000
|
| [[1.0.0-0]]
| [[FSPXI:DeleteSdmcRoot|DeleteSdmcRoot]]
|-
| 0x00400040
|
| [[1.0.0-0]]
| DeleteAllExtSaveDataOnNand
|-
| 0x00410000
|
| [[1.0.0-0]]
| [[FSPXI:InitializeCtrFilesystem|InitializeCtrFilesystem]]
|-
| 0x00420000
|
| [[1.0.0-0]]
| CreateSeed
|-
| 0x00430042
|
| [[2.0.0-2]]
| [[FSPXI:GetSdmcCtrRootPath|GetSdmcCtrRootPath]]
|-
| 0x00440040
|
| [[2.0.0-2]]
| GetArchiveResource
|-
| 0x00450002
|
| [[2.0.0-2]]
| [[FSPXI:ExportIntegrityVerificationSeed|ExportIntegrityVerificationSeed]]
|-
| 0x00460002
|
| [[2.0.0-2]]
| [[FSPXI:ImportIntegrityVerificationSeed|ImportIntegrityVerificationSeed]]
|-
| 0x00470082
|
| [[2.0.0-2]]
| EnumerateSharedExtSaveData
|-
| 0x00480102
|
| [[2.0.0-2]]
| GetLegacySubBannerData
|-
| 0x00490042
|
| [[2.0.0-2]]
| Initialize (?)
|-
| 0x004A00C2
|
| [[2.0.0-2]]
| OpenSpecialFile? (archivehandlelo, archivehandlehi, size, ptrsize_mul2, ptr)
|-
| 0x004B0102
|
| [[2.0.0-2]]
| ReadSpecialFile
|-
|
| 0x004B0000
| [[3.0.0-5]]
| [[FSPXI:GetMovableSedHashedKeyYRandomData|GetMovableSedHashedKeyYRandomData]]
|-
| 0x004C0040
|
| [[2.0.0-2]]
| GetSpecialFileSize
|-
|
| 0x004D01C4
| [[3.0.0-5]]
| This is a wrapper for ReadFile. If the first ReadFile call fails, this calls ReadFile again then executes hash-related code.
|-
|
| 0x004E0204
| [[3.0.0-5]]
| This is a wrapper for WriteFile, this is similar to command 0x004D01C4.
|-
|
| 0x004F....
| [[3.0.0-5]]
| (unknown_u64)
|-
|
| 0x00500000
| [[3.0.0-5]]
| Stubbed, this only returns value 0.
|-
|
| 0x0051....
| [[3.0.0-5]]
| (unknown_u8)
|-
|
| 0x00520042
| [[3.0.0-5]]
| (outbuffersize, outbufferptr)
|-
|
| 0x00530000
| [[3.0.0-5]]
| Unknown, stubbed with [[4.0.0-7]].
|-
|
| 0x0054....
| [[4.0.0-7]]
| Stubbed with [[4.0.0-7]].
|-
|
| 0x00550082
| [[4.0.0-7]]
| ReadNandReport (outbuffersize, u8 mediatype, outbufferptr)
|}

=Errors=
{| class="wikitable" border="1"
|-
! Error-code
! Description
|-
| 0xC8804478
| Object doesn't exist / failed to open object(file). Or: The specified title does not exist in the [[Title_Database|database]].
|-
| 0xC88044AB
| [[SDMC]]/NAND bus error, REG_SDSTATUS: TMIO_STAT_CMD_BUSY or TMIO_STAT_TXUNDERRUN
|-
| 0xC88044AC
| [[SDMC]]/NAND bus error, REG_SDSTATUS: TMIO_STAT_ILL_FUNC
|-
| 0xC92044E6
| File already opened?
|-
| 0xC9204509
| [[SDMC]]/NAND bus error, REG_SDSTATUS: TMIO_STAT_CMDTIMEOUT
|-
| 0xC960454B
| [[SDMC]]/NAND bus error, when an error-bit in REG_SDSTATUS separate from the above errors is set. This can also indicate that the TWL partition table in the NAND sector0 is invalid, or that the sector signature for sector0 at offset 0x1FE is invalid?
|-
| 0xC960454C
| [[SDMC]]/NAND bus error, REG_SDSTATUS: TMIO_STAT_STOPBIT_ERR
|-
| 0xC960F401
| [[SDMC]]/NAND bus error, REG_SDSTATUS: Bit23(0x00800000)
|-
| 0xD9004588
| FSPXI/FSUSER: Verification failure for RSA or hashes. FSUSER: Verification failed for [[Savegames|savegame]] AES-MAC.
|-
| 0xD900458B
| FSUSER: A corrupted [[RomFS]] block was read. (hash check fail)
|-
| 0xD9004676
| FSUSER: The specified service-command / archive is not accessible, due to the currently used exheader accessinfo not having the required bit(s) set. (This error can also indicate that the required ARM9 access-control mount flag is not enabled, in the exheader for any of the running ARM11 processes)
|-
| 0xE0E046BE
| Invalid lowpath. This can also indicate that the specified archive-id does not exist, or that the specified archive-id is not accessible over FSPXI. In certain cases this can also be caused by attempting to open a FSUSER archive where none of the required bit(s) for the archive are set in the user-process exheader accessinfo.
|-
| 0xE160F402
| [[SDMC]]/NAND bus error, REG_SDSTATUS: TMIO_STAT_RXRDY
|-
| 0xE160F403
| [[SDMC]]/NAND bus error, REG_SDSTATUS: Bit28(0x10000000)
|-
| 0xE160F404
| [[SDMC]]/NAND bus error, REG_SDSTATUS: Bit27(0x08000000)
|}

Filesystem services

2014-10-01T03:20:27Z

Slashmolder: /* File service */

[[Category:Services]]

= Filesystem service "fs:USER" =
You can at most have 32 fs archive handles.

{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Description
! scope="col" width="400" | Required [[NCCH/Extended_Header|exheader]] accessinfo bitmask
|-
| 0x000100C6
|
| Dummy1
| None
|-
| 0x040100C4
|
| Control
| None
|-
| 0x08010002
|
| [[FS:Initialize|Initialize]]
| None
|-
| 0x080201C2
|
| [[FS:OpenFile|OpenFile]]
| None
|-
| 0x08030204
|
| [[FS:OpenFileDirectly|OpenFileDirectly]]
| None
|-
| 0x08040142
|
| [[FS:DeleteFile|DeleteFile]]
| None
|-
| 0x08050244
|
| RenameFile
| None
|-
| 0x08060142
|
| DeleteDirectory
| None
|-
| 0x08070142
|
| DeleteDirectoryRecursively
| None
|-
| 0x08080202
|
| CreateFile
| None
|-
| 0x08090182
|
| [[FS:CreateDirectory|CreateDirectory]]
| None
|-
| 0x080A0244
|
| RenameDirectory
| None
|-
| 0x080B0102
|
| [[FS:OpenDirectory|OpenDirectory]]
| None
|-
| 0x080C00C2
|
| [[FS:OpenArchive|OpenArchive]]
| Each archive idcode has separate accessinfo bitmasks, if any.
|-
| 0x080D0144
|
| ControlArchive
| None
|-
| 0x080E0080
|
| [[FS:CloseArchive|CloseArchive]]
| None
|-
| 0x080F0180
|
| FormatThisUserSaveData
| None
|-
| 0x08100200
|
| CreateSystemSaveData
| 0x4, for when the input saveID doesn't match the exheader saveID.
|-
| 0x08110040
|
| DeleteSystemSaveData
| 0x1004, for when the input saveID doesn't match the exheader saveID.
|-
| 0x08120080
|
| GetFreeBytes
| None
|-
| 0x08130000
|
| GetCardType
| 0x1017
|-
| 0x08140000
|
| [[FS:GetSdmcArchiveResource|GetSdmcArchiveResource]]
| None
|-
| 0x08150000
|
| [[FS:GetNandArchiveResource|GetNandArchiveResource]]
| None
|-
| 0x08160000
|
| GetSdmcFatfsError
| 0x2
|-
| 0x08170000
|
| [[FS:IsSdmcDetected|IsSdmcDetected]]
| None
|-
| 0x08180000
|
| [[FS:IsSdmcWritable|IsSdmcWritable]]
| None
|-
| 0x08190042
|
| GetSdmcCid
| 0x2
|-
| 0x081A0042
|
| GetNandCid
| 0x2
|-
| 0x081B0000
|
| GetSdmcSpeedInfo
| 0x2
|-
| 0x081C0000
|
| GetNandSpeedInfo
| 0x2
|-
| 0x081D0042
|
| GetSdmcLog
| 0x2
|-
| 0x081E0042
|
| GetNandLog
| 0x2
|-
| 0x081F0000
|
| ClearSdmcLog
| 0x2
|-
| 0x08200000
|
| ClearNandLog
| 0x2
|-
| 0x08210000
|
| CardSlotIsInserted
| 0x1017
|-
| 0x08220000
|
| CardSlotPowerOn
| 0x2
|-
| 0x08230000
|
| CardSlotPowerOff
| 0x2
|-
| 0x08240000
|
| CardSlotGetCardIFPowerStatus
| 0x2
|-
| 0x08250040
|
| CardNorDirectCommand
| 0x2
|-
| 0x08260080
|
| CardNorDirectCommandWithAddress
| 0x2
|-
| 0x08270082
|
| CardNorDirectRead
| 0x2
|-
| 0x082800C2
|
| CardNorDirectReadWithAddress
| 0x2
|-
| 0x08290082
|
| CardNorDirectWrite
| 0x2
|-
| 0x082A00C2
|
| CardNorDirectWriteWithAddress
| 0x2
|-
| 0x082B00C2
|
| CardNorDirectRead_4xIO
| 0x2
|-
| 0x082C0082
|
| CardNorDirectCpuWriteWithoutVerify
| 0x2
|-
| 0x082D0040
|
| CardNorDirectSectorEraseWithoutVerify
| 0x2
|-
| 0x082E0040
|
| [[FS:GetProductInfo|GetProductInfo]]
| 0x1005
|-
| 0x082F0040
|
| [[FS:GetProgramLaunchInfo|GetProgramLaunchInfo]]
| 0x1005
|-
| 0x08300182
|
| CreateExtSaveData
| 0xC, for when the input extdataID doesn't match the exheader extdataID.
|-
| 0x08310180
|
| CreateSharedExtSaveData
| 0x1005
|-
| 0x08320102
|
| [[FS:ReadExtSaveDataIcon|ReadExtSaveDataIcon]]
| 0x100D, for when the input extdataID doesn't match the exheader extdataID.
|-
| 0x08330082
|
| EnumerateExtSaveData
| 0x1005
|-
| 0x08340082
|
| EnumerateSharedExtSaveData
| 0x1005
|-
| 0x08350080
|
| DeleteExtSaveData
| 0x100D, for when the input extdataID doesn't match the exheader extdataID.
|-
| 0x08360080
|
| DeleteSharedExtSaveData
| 0x1005
|-
| 0x08370040
|
| SetCardSpiBaudRate
| 0x2
|-
| 0x08380040
|
| SetCardSpiBusMode
| 0x2
|-
| 0x08390000
|
| SendInitializeInfoTo9
| None
|-
| 0x083A0100
|
| GetSpecialContentIndex
| 0x1005
|-
| 0x083B00C2
|
| GetLegacyRomHeader
| 0x1015
|-
| 0x083C00C2
|
| GetLegacyBannerData
| 0x1015
|-
| 0x083D0100
|
| CheckAuthorityToAccessExtSaveData
| 0x44
|-
| 0x083E00C2
|
| QueryTotalQuotaSize
| None
|-
| 0x083F00C0
|
| GetExtDataBlockSize
| None
|-
| 0x08400040
|
| AbnegateAccessRight
|
|-
| 0x08410000
|
| DeleteSdmcRoot
| 0x1005
|-
| 0x08420040
|
| DeleteAllExtSaveDataOnNand
| 0x1005
|-
| 0x08430000
|
| [[FS:InitializeCtrFileSystem|InitializeCtrFileSystem]]
| None
|-
| 0x08440000
|
| CreateSeed
| 0x2
|-
| 0x084500C2
|
| GetFormatInfo
| ?
|-
| 0x08460102
|
| GetLegacyRomHeader2
| 0x1015
|-
| 0x08470180
|
| FormatCtrCardUserSaveData
| 0x6
|-
| 0x08480042
|
| GetSdmcCtrRootPath
| 0x100D
|-
| 0x08490040
|
| GetArchiveResource
| ?
|-
| 0x084A0002
|
| ExportIntegrityVerificationSeed
| 0x4000
|-
| 0x084B0002
|
| ImportIntegrityVerificationSeed
| 0x4000
|-
| 0x084C0242
|
| FormatSaveData
| 0x6, in some cases this right isn't needed however.
|-
| 0x084D0102
|
| GetLegacySubBannerData
| 0x1015
|-
| 0x084E0342
|
| [[FS:UpdateSha256Context|UpdateSha256Context]]
| 0x5
|-
| 0x084F0102
|
| ReadSpecialFile
| None
|-
| 0x08500040
|
| GetSpecialFileSize
| None
|-
| 0x08510242
| [[3.0.0-5]]
| CreateExtSaveData
| Shared extdata: 0x101005. Regular extdata in certain cases: 0xC.
|-
| 0x08520100
| [[3.0.0-5]]
| DeleteExtSaveData (u32 flags, u64 extdataID)
| Shared extdata: 0x101005. Regular extdata in certain cases: 0x10100D.
|-
| 0x08530142
| [[3.0.0-5]]
| ReadExtSaveDataIcon
| 0x10100D(this doesn't apply in certain cases however)
|-
| 0x085400C0
| [[3.0.0-5]]
| GetExtDataBlockSize?
| 0x10100D(this doesn't apply in certain cases however)
|-
| 0x08550102
| [[3.0.0-5]]
| EnumerateExtSaveData
| 0x101005
|-
| 0x08560200
| [[3.0.0-5]]
| FsCreateSystemSaveData?
| 0x4(this doesn't apply in certain cases however)
|-
| 0x08570080
| [[3.0.0-5]]
| DeleteSystemSaveData
| 0x1004(this doesn't apply in certain cases however)
|-
| 0x08580000
| [[3.0.0-5]]
| [[FS:GetMovableSedHashedKeyYRandomData|GetMovableSedHashedKeyYRandomData]]
| 0x2004
|-
| 0x08590200
| [[3.0.0-5]]
| SetMovableSedHashedKeyYRandomData?
| 0x2004
|-
| 0x085A00C0
| [[3.0.0-5]]
| SetArchivePriority(u64 ID,u32 priority)
| None
|-
| 0x085B0080
| [[3.0.0-5]]
| GetArchivePriority(u64 ID,u32 *priority)
| None
|-
| 0x085C00C0
| [[3.0.0-5]]
| ?
| 0xE
|-
| 0x085D0180
| [[3.0.0-5]]
| ?
| 0x100001
|-
| 0x085E0040
| [[3.0.0-5]]
| ?
| 0xE
|-
| 0x085F0040
| [[3.0.0-5]]
| ?
| 0x12004
|-
| 0x08600042
| [[3.0.0-5]]
| EnumerateSystemSaveData
| 0x2004
|-
| 0x08610042
| [[3.0.0-5]]
| InitializeWithSdkVersion
| None
|-
| 0x08620040
| [[3.0.0-5]]
| SetPriority
| None
|-
| 0x08630000
| [[3.0.0-5]]
| GetPriority
| None
|-
| 0x08640000
| [[3.0.0-5]]
| Stubbed, this returns an error.
| None
|-
| 0x08650140
| [[4.0.0-7]]
| Unknown, this is used with [[Anti Savegame Restore]].
| 0x121004(in certain cases this doesn't apply however)
|-
| 0x086600C0
| [[4.0.0-7]]
| Unknown, this is used with [[Anti Savegame Restore]].
| 0x121004(in certain cases this doesn't apply however)
|-
| 0x086700C4
| [[4.0.0-7]]
| ?
| 0x121004
|-
| 0x08680000
| [[4.0.0-7]]
| This loads the u8 mediatype for the current application from already initialized state, this u8 was originally loaded from the same data used by [[FS:GetProgramLaunchInfo|GetProgramLaunchInfo]]. This then writes the u8 to response-word[2]. This is used with [[Anti Savegame Restore]].
| None
|-
| 0x08690000
| [[4.0.0-7]]
| Stubbed, this returns an error.
| None
|-
| 0x086A0082
| [[4.0.0-7]]
| This is a wrapper for [[Filesystem_services_PXI|FSPXI]] command 0x00550082.
| None
|-
| 0x086B00C2
| ?
| ?
| 00121004
|-
| 0x086C00C2
| ?
| ?
| 00121004
|-
| 0x086D0040
| ?
| ?
| 00020004
|-
| 0x086E00C0
| ?
| ?
| ?None?
|-
| 0x086F0040
| ?
| ?
| 0xE
|-
| 0x087000C2
| ?
| ?
| ?None?
|-
| 0x08710100
| ?
| ?
| 0xC
|-
| 0x087201C0
| ?
| ?
| 00080004
|-
| 0x087300C0
| ?
| ?
| 00080004
|-
| 0x08740000
| ?
| ?
| 00080004
|-
| 0x08750140
| ?
| ?
| ?None?
|-
| 0x087600C0
| ?
| ?
| ?None?
|-
| 0x08770100
| ?
| ?
| ?
|-
| 0x087800C0
| ?
| ?
| ?
|}

When access rights are required for a command, at least one of the bits in the process accessinfo specified in the above table for the command must be set. Error 0xD9004676 is returned when a process attempts to use a command which it doesn't have access rights for the command. The exheader accessinfo field is all-zero for most applications. Note that the permissions listed in the above table is for system-version v2.x, therefore permission bit(s) added with newer FIRM may be missing from this.

Each session for fs:USER has separate permissions, initially these are set to all-zero for new fs:USER sessions. The permissions/etc for fs:USER sessions are initialized via [[FS:Initialize]](loaded from the user process exheader).

=File service=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x000100C6
| Dummy1
|-
| 0x040100C4
| Control
|-
| 0x08010100
| OpenSubFile
|-
| 0x080200C2
| [[FSFile:Read|Read]]
|-
| 0x08030102
| [[FSFile:Write|Write]]
|-
| 0x08040000
| [[FSFile:GetSize|GetSize]]
|-
| 0x08050080
| [[FSFile:SetSize|SetSize]]
|-
| 0x08060000
| GetAttributes
|-
| 0x08070040
| SetAttributes
|-
| 0x08080000
| [[FSFile:Close|Close]]
|-
| 0x08090000
| Flush
|-
| 0x080A0040
| SetPriority
|-
| 0x080B0000
| GetPriority
|-
| 0x080C0000
| OpenLinkFile
|}

=Directory service=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x000100C6
| Dummy1
|-
| 0x040100C4
| Control
|-
| 0x08010042
| [[FSDir:Read|Read]]
|-
| 0x08020000
| [[FSDir:Close|Close]]
|}

= Filesystem service "fs:LDR" =
This service is identical to fs:USER, except [[FS:OpenArchive]] archive 0x2345678E can only be accessed with fs:LDR.

= ProgramRegistry service "fs:REG" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x000100C6
| Dummy1
|-
| 0x040103C0
| Register
|-
| 0x04020040
| Unregister
|-
| 0x040300C0
| GetProgramInfo
|-
| 0x04040100
| LoadProgram
|-
| 0x04050080
| UnloadProgram
|-
| 0x04060080
| CheckHostLoadId
|}

=Errors=
See [[Filesystem_services_PXI]].

IR Services

2014-09-30T20:36:41Z

Slashmolder: /* IR Service "ir:u" */

[[Category:Services]]
= IR Service "ir:u" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010000
| [[IRU:Initialize|Initialize]]
|-
| 0x00020000
| [[IRU:Shutdown|Shutdown]]
|-
| 0x00030042
| [[IRU:StartSendTransfer|StartSendTransfer]]
|-
| 0x00040000
| [[IRU:WaitSendTransfer|WaitSendTransfer]]
|-
| 0x000500C2
| [[IRU:StartRecvTransfer|StartRecvTransfer]]
|-
| 0x00060000
| [[IRU:WaitRecvTransfer|WaitRecvTransfer]]
|-
| 0x00070000
| [[IRU:GetRecvTransferCount|GetRecvTransferCount]]
|-
| 0x00080000
| [[IRU:GetSendState|GetSendState]]
|-
| 0x00090040
| [[IRU:SetBitRate|SetBitRate]]
|-
| 0x000A0000
| [[IRU:GetBitRate|GetBitRate]]
|-
| 0x000B0040
| [[IRU:SetIRLEDState|SetIRLEDState]]
|-
| 0x000C0000
| [[IRU:GetIRLEDRecvState|GetIRLEDRecvState]]
|-
| 0x000D0000
| [[IRU:GetSendFinishedEvent|GetSendFinishedEvent]]
|-
| 0x000E0000
| [[IRU:GetRecvFinishedEvent|GetRecvFinishedEvent]]
|-
| 0x000F0000
| [[IRU:GetTransferState|GetTransferState]]
|-
| 0x00100000
| GetErrorStatus
|-
| 0x00110040
| [[IRU:SetSleepModeActive|SetSleepModeActive]]
|-
| 0x00120040
| [[IRU:SetSleepModeState|SetSleepModeState]]
|}

= IR Service "ir:USER" =
{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Description
|-
| 0x00010182
|
| InitializeIrnop
|-
| 0x00020000
|
| FinalizeIrnop
|-
| 0x00030000
|
| ClearReceiveBuffer
|-
| 0x00040000
|
| ClearSendBuffer
|-
| 0x00050000
|
| WaitConnection
|-
| 0x00060000
|
| RequireConnection
|-
| 0x00070000
|
| AutoConnection
|-
| 0x00080000
|
| AnyConnection
|-
| 0x00090000
|
| Disconnect
|-
| 0x000A0000
|
| GetReceiveEvent
|-
| 0x000B0000
|
| GetSendEvent
|-
| 0x000C0000
|
| GetConnectionStatusEvent
|-
| 0x000D0000
|
| SendIrnop
|-
| 0x000E0000
|
| SendIrnopLarge
|-
| 0x000F0000
|
| ReceiveIrnop
|-
| 0x00100000
|
| ReceiveIrnopLarge
|-
| 0x00110000
|
| GetLatestReceiveErrorResult
|-
| 0x00120000
|
| GetLatestSendErrorResult
|-
| 0x00130000
|
| GetConnectionStatus
|-
| 0x00140000
|
| GetTryingToConnectStatus
|-
| 0x00150000
|
| GetReceiveSizeFreeAndUsed
|-
| 0x00160000
|
| GetSendSizeFreeAndUsed
|-
| 0x00170000
| Unknown, >[[2.0.0-2]]
| GetConnectionRole
|-
| 0x00180000
| Unknown, >[[2.0.0-2]]
| InitializeIrnopShared
|-
| 0x00190000
| Unknown, >[[2.0.0-2]]
| ReleaseReceivedData
|-
| 0x001A0000
| Unknown, >[[2.0.0-2]]
| SetOwnMachineId
|}

= IR Service "ir:rst" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010000
| [[IRRST:GetHandles|GetHandles]]
|-
| 0x00020080
| [[IRRST:Initialize|Initialize]]
|-
| 0x00030000
| [[IRRST:Shutdown|Shutdown]]
|-
| 0x00040000
| This writes an unknown u8 to index-word cmdreply[2], from data loaded from an I2C device register.
|-
| 0x00050000
| This writes an unknown u8 from IR-module state to index-word cmdreply[2].
|-
| 0x00060000
| This writes two unknown u8 fields from IR-module state to index-word cmdreply[2] and cmdreply[3].
|}

This service was added with [[8.0.0-18]]. Unlike the other IR services, this uses [[I2C]] deviceid 17(this deviceid isn't actually handled by the [[8.0.0-18]] I2C module). Therefore, this is probably for the new IR LED for the [[New 3DS]].

=IR Services=
Only one session(two sessions starting with [[8.0.0-18]]) to any of these services can be open at a time, thus only one/two process(es) can use any of these services at once. These services interface with hardware services gpio::IR and i2c::IR. The i2c::IR service is used for sending/receiving data.

IRU is for regular IR comms. IRUSER uses a custom IR protocol(above the physical layer). Both of these services use IrDA-SIR. The IR hardware seems to only support IrDA-SIR, other physical protocols such as the one for TV-remotes are not supported(going by the datasheet linked [[Hardware|here]] for a different IC at least).

The protocol used with IRUSER involves encryption implemented in software. IRUSER is used for the [[Circle Pad Pro]].

IR Services

2014-09-30T20:34:44Z

Slashmolder: /* IR Service "ir:USER" */

[[Category:Services]]
= IR Service "ir:u" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010000
| [[IRU:Initialize|Initialize]]
|-
| 0x00020000
| [[IRU:Shutdown|Shutdown]]
|-
| 0x00030042
| [[IRU:StartSendTransfer|StartSendTransfer]]
|-
| 0x00040000
| [[IRU:WaitSendTransfer|WaitSendTransfer]]
|-
| 0x000500C2
| [[IRU:StartRecvTransfer|StartRecvTransfer]]
|-
| 0x00060000
| [[IRU:WaitRecvTransfer|WaitRecvTransfer]]
|-
| 0x00070000
| [[IRU:GetRecvTransferCount|GetRecvTransferCount]]
|-
| 0x00080000
| [[IRU:GetSendState|GetSendState]]
|-
| 0x00090040
| [[IRU:SetBitRate|SetBitRate]]
|-
| 0x000A0000
| [[IRU:GetBitRate|GetBitRate]]
|-
| 0x000B0040
| [[IRU:SetIRLEDState|SetIRLEDState]]
|-
| 0x000C0000
| [[IRU:GetIRLEDRecvState|GetIRLEDRecvState]]
|-
| 0x000D0000
| [[IRU:GetSendFinishedEvent|GetSendFinishedEvent]]
|-
| 0x000E0000
| [[IRU:GetRecvFinishedEvent|GetRecvFinishedEvent]]
|-
| 0x000F0000
| [[IRU:GetTransferState|GetTransferState]]
|-
| 0x00100000
|
|-
| 0x00110040
| [[IRU:SetSleepModeActive|SetSleepModeActive]]
|-
| 0x00120040
| [[IRU:SetSleepModeState|SetSleepModeState]]
|}

= IR Service "ir:USER" =
{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Description
|-
| 0x00010182
|
| InitializeIrnop
|-
| 0x00020000
|
| FinalizeIrnop
|-
| 0x00030000
|
| ClearReceiveBuffer
|-
| 0x00040000
|
| ClearSendBuffer
|-
| 0x00050000
|
| WaitConnection
|-
| 0x00060000
|
| RequireConnection
|-
| 0x00070000
|
| AutoConnection
|-
| 0x00080000
|
| AnyConnection
|-
| 0x00090000
|
| Disconnect
|-
| 0x000A0000
|
| GetReceiveEvent
|-
| 0x000B0000
|
| GetSendEvent
|-
| 0x000C0000
|
| GetConnectionStatusEvent
|-
| 0x000D0000
|
| SendIrnop
|-
| 0x000E0000
|
| SendIrnopLarge
|-
| 0x000F0000
|
| ReceiveIrnop
|-
| 0x00100000
|
| ReceiveIrnopLarge
|-
| 0x00110000
|
| GetLatestReceiveErrorResult
|-
| 0x00120000
|
| GetLatestSendErrorResult
|-
| 0x00130000
|
| GetConnectionStatus
|-
| 0x00140000
|
| GetTryingToConnectStatus
|-
| 0x00150000
|
| GetReceiveSizeFreeAndUsed
|-
| 0x00160000
|
| GetSendSizeFreeAndUsed
|-
| 0x00170000
| Unknown, >[[2.0.0-2]]
| GetConnectionRole
|-
| 0x00180000
| Unknown, >[[2.0.0-2]]
| InitializeIrnopShared
|-
| 0x00190000
| Unknown, >[[2.0.0-2]]
| ReleaseReceivedData
|-
| 0x001A0000
| Unknown, >[[2.0.0-2]]
| SetOwnMachineId
|}

= IR Service "ir:rst" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010000
| [[IRRST:GetHandles|GetHandles]]
|-
| 0x00020080
| [[IRRST:Initialize|Initialize]]
|-
| 0x00030000
| [[IRRST:Shutdown|Shutdown]]
|-
| 0x00040000
| This writes an unknown u8 to index-word cmdreply[2], from data loaded from an I2C device register.
|-
| 0x00050000
| This writes an unknown u8 from IR-module state to index-word cmdreply[2].
|-
| 0x00060000
| This writes two unknown u8 fields from IR-module state to index-word cmdreply[2] and cmdreply[3].
|}

This service was added with [[8.0.0-18]]. Unlike the other IR services, this uses [[I2C]] deviceid 17(this deviceid isn't actually handled by the [[8.0.0-18]] I2C module). Therefore, this is probably for the new IR LED for the [[New 3DS]].

=IR Services=
Only one session(two sessions starting with [[8.0.0-18]]) to any of these services can be open at a time, thus only one/two process(es) can use any of these services at once. These services interface with hardware services gpio::IR and i2c::IR. The i2c::IR service is used for sending/receiving data.

IRU is for regular IR comms. IRUSER uses a custom IR protocol(above the physical layer). Both of these services use IrDA-SIR. The IR hardware seems to only support IrDA-SIR, other physical protocols such as the one for TV-remotes are not supported(going by the datasheet linked [[Hardware|here]] for a different IC at least).

The protocol used with IRUSER involves encryption implemented in software. IRUSER is used for the [[Circle Pad Pro]].

I2C Registers

2014-07-25T04:15:17Z

Slashmolder: /* Device 13 */

== Registers ==
{| class="wikitable" border="1"
! NAME
! PHYSICAL ADDRESS
! PROCESS ADDRESS
! WIDTH
|-
| REG_I2C1DATA
| 0x10161000
| 0x1EC61000
| 1
|-
| REG_I2C1CNT
| 0x10161001
| 0x1EC61001
| 1
|-
| REG_I2C1CNTEX
| 0x10161002
| 0x1EC61002
| 2
|-
| REG_I2C1SCL
| 0x10161004
| 0x1EC61004
| 2
|-
| REG_I2C2DATA
| 0x10144000
| 0x1EC44000
| 1
|-
| REG_I2C2CNT
| 0x10144001
| 0x1EC44001
| 1
|-
| REG_I2C2CNTEX
| 0x10144002
| 0x1EC44002
| 2
|-
| REG_I2C2SCL
| 0x10144004
| 0x1EC44004
| 2
|-
| REG_I2C3DATA
| 0x10148000
| 0x1EC48000
| 1
|-
| REG_I2C3CNT
| 0x10148001
| 0x1EC48001
| 1
|-
| REG_I2C3CNTEX
| 0x10148002
| 0x1EC48002
| 2
|-
| REG_I2C3SCL
| 0x10148004
| 0x1EC48004
| 2
|}

== I2C Devices ==
{| class="wikitable" border="1"
! Device id
! Device bus id
! Device address
! Device description
|-
| 0
| 1
| 0x4a
| Power management?(same device addr as the DSi power-management)
|-
| 1
| 1
| 0x7a
| Camera0?(same dev-addr as DSi cam0)
|-
| 2
| 1
| 0x78
| Camera1?(same dev-addr as DSi cam1)
|-
| 3
| 2
| 0x4a
| MCU
|-
| 4
| 2
| 0x78
| ?
|-
| 5
| 2
| 0x2c
| ?
|-
| 6
| 2
| 0x2e
| ?
|-
| 7
| 2
| 0x40
| ?
|-
| 8
| 2
| 0x44
| ?
|-
| 9
| 3
| 0xa6
| ?
|-
| 10
| 3
| 0xd0
| ?
|-
| 11
| 3
| 0xd2
| ?
|-
| 12
| 3
| 0xa4
| ?
|-
| 13
| 3
| 0x9a
| IR
|-
| 14
| 3
| 0xa0
| eeprom?
|}

== Device 3 ==
{| class="wikitable" border="1"
! REGISTER
! WIDTH
! DESCRIPTION
|-
| 0x03
| 8
| ?
|-
| 0x04
| 8
| ?
|-
| 0x09
| 1
| Sound volume: 0x0..0x3F.
|-
| 0x18
| 8
| ?
|-
| 0x20
| 8
| Writing u8 value 4 here triggers a hardware system reboot. Writing u8 value 8 triggers a shutdown via power-off?
|-
| 0x22
| 8
| ?
|-
| 0x23
| 8
| ?
|-
| 0x24
| 8
| ?
|-
| 0x28
| 8
| ?
|-
| 0x29
| 8
| ?
|-
| 0x2A
| 8
| ?
|-
| 0x2B
| 8
| ?
|-
| 0x2C
| 8
| ?
|-
| 0x2D
| 0x64
| This is used for [[MCURTC:SetInfoLEDPattern|controlling]] the notification LED(see [[MCURTC:SetInfoLEDPatternHeader]] as well), when this register is written.
|-
| 0x2E
| 1
| This [[MCURTC:GetInfoLEDStatus|returns]] the notification LED status when read.
|-
| 0x30
| 8
| ?
|-
| 0x31
| 8
| ?
|-
| 0x32
| 8
| ?
|-
| 0x33
| 8
| ?
|-
| 0x34
| 8
| ?
|-
| 0x35
| 8
| ?
|-
| 0x36
| 8
| ?
|-
| 0x37
| 8
| ?
|-
| 0x38
| 8
| ?
|-
| 0x39
| 8
| ?
|-
| 0x3A
| 8
| ?
|-
| 0x3B
| 8
| ?
|-
| 0x3C
| 8
| ?
|-
| 0x41
| 8
| ?
|-
| 0x43
| 8
| ?
|-
| 0x4E
| 8
| ?
|-
| 0x50
| 8
| ?
|-
| 0x51
| 8
| ?
|-
| 0x58
| 8
| ?
|-
| 0x60
| 8
| ?
|}

== Device 13 ==
{| class="wikitable" border="1"
! Raw I2C register address
! Internal register address
! Width
! Description
|-
| 0x0
| 0x0
| 0x40
| RHR / THR (data receive/send FIFO)
|-
| 0x8
| 0x1
| 0x1
| IER
|-
| 0x10
| 0x2
| 0x1
| FCR/IIR
|-
| 0x18
| 0x3
| 0x1
| LCR
|-
| 0x20
| 0x4
| 0x1
| MCR
|-
| 0x28
| 0x5
| 0x1
| LSR
|-
| 0x30
| 0x6
| 0x1
| MSR/TCR
|-
| 0x38
| 0x7
| 0x1
| SPR/TLR
|-
| 0x40
| 0x8
| 0x1
| TXLVL
|-
| 0x48
| 0x9
| 0x1
| RXLVL
|-
| 0x50
| 0xA
| 0x1
| IODir
|-
| 0x58
| 0xB
| 0x1
| IOState
|-
| 0x60
| 0xC
| 0x1
| IoIntEna
|-
| 0x68
| 0xD
| 0x1
| reserved
|-
| 0x70
| 0xE
| 0x1
| IOControl
|-
| 0x78
| 0xF
| 0x1
| EFCR
|}

See the datasheet linked to on the [[Hardware]] page for reference. From that datasheet, for the structure of the I2C register address u8: "Bit 0 is not used, bits 2:1 select the channel, bits 6:3 select one of the UART internal registers. Bit 7 is not used with the I2C-bus interface, but it is used by the SPI interface to indicate a read or a write operation."

= I2CCNT =
{| class="wikitable" border="1"
|+ REG_I2CxCNT
! BIT
! DESCRIPTION
|-
| 0
| HOLD (0=Last byte of transaction, 1=More bytes coming)
|-
| 2
| Error flag/ack?
|-
| 4
| Read mode related?
|-
| 5
| Read mode?
|-
| 6
| IRQ enable?
|-
| 7
| Enable?
|}

Application Manager Services PXI

2014-06-11T04:12:36Z

Slashmolder: /* Errors */

{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Description
|-
| 0x00010040
| [[1.0.0-0]]
| [[AMPXI:GetTitleCount|GetTitleCount]]
|-
| 0x00020082
| [[1.0.0-0]]
| [[AMPXI:GetTitleList|GetTitleList]]
|-
| 0x00030084
| [[1.0.0-0]]
| [[AMPXI:GetTitleInfo|GetTitleInfo]]
|-
| 0x000400C0
| [[1.0.0-0]]
| [[AMPXI:DeleteTitle|DeleteTitle]]
|-
| 0x000500C0
| [[1.0.0-0]]
| [[AMPXI:GetTitleProductCode|GetTitleProductCode]]
|-
| 0x000600C0
| [[1.0.0-0]]
| (unknown_u8, unknown_u64)
|-
| 0x00070080
| [[1.0.0-0]]
| (unknown_u8, unknown_u32)
|-
| 0x00080080
| [[1.0.0-0]]
| [[AMPXI:InstallFIRM|InstallFIRM]]
|-
| 0x00090000
| [[1.0.0-0]]
| InstallTikBegin
|-
| 0x000A0042
| [[1.0.0-0]]
| InstallTikWrite (size, ptr, ptrsize)
|-
| 0x000B0000
| [[1.0.0-0]]
|
|-
| 0x000C0000
| [[1.0.0-0]]
| InstallTikFinish
|-
| 0x000D0080
| [[1.0.0-0]]
| (unknown_u64)
|-
| 0x000E0000
| [[1.0.0-0]]
| GetTitleAllCount
|-
| 0x000F0082
| [[1.0.0-0]]
| GetTitleAllList
|-
| 0x00100100
| [[1.0.0-0]]
| InstallTitleBegin (?)
|-
| 0x00110000
| [[1.0.0-0]]
| InstallTitleAbort (?)
|-
| 0x00120100
| [[1.0.0-0]]
| InstallTitleResume (?)
|-
| 0x00130000
| [[1.0.0-0]]
| InstallTmdBegin (?)
|-
| 0x00140042
| [[1.0.0-0]]
| [[AMPXI:InstallTmdWrite|InstallTmdWrite]]
|-
| 0x00150000
| [[1.0.0-0]]
|
|-
| 0x00160040
| [[1.0.0-0]]
| InstallTmdFinish (?)
|-
| 0x00170040
| [[1.0.0-0]]
| [[AMPXI:InstallContentBegin|InstallContentBegin]]
|-
| 0x00180042
| [[1.0.0-0]]
| [[AMPXI:InstallContentWrite|InstallContentWrite]]
|-
| 0x00190000
| [[1.0.0-0]]
| InstallContentAbort (?)
|-
| 0x001A0000
| [[1.0.0-0]]
|
|-
| 0x001B0040
| [[1.0.0-0]]
| [[AMPXI:InstallContentResume|InstallContentResume]]
|-
| 0x001C0000
| [[1.0.0-0]]
| [[AMPXI:InstallContentFinish|InstallContentFinish]]
|-
| 0x001D0040
| [[1.0.0-0]]
| (unknown_u8, unknown_u32)
|-
| 0x001E00C2
| [[1.0.0-0]]
| (unknown_entrycount, unknown_u8, unknown_u32, ptr, ptrsize)
|-
| 0x001F0084
| [[1.0.0-0]]
| [[AMPXI:GetTitleTemporaryInfo|GetTitleTemporaryInfo]]
|-
| 0x002000C0
| [[1.0.0-0]]
| (unknown_u8, unknown_u64)
|-
| 0x002100C0
| [[1.0.0-0]]
| (unknown_u8, unknown_u64)
|-
| 0x00220102
| [[1.0.0-0]]
| (count, unknown_u8, unknown_u64, ptrsize_count_mul_2, ptr)
|-
| 0x00230104
| [[1.0.0-0]]
| (count, unknown_u8, unknown_u64, ptr1size_count_mul_2, ptr1, ptr2size_count_mul_24, ptr2)
|-
| 0x00240102
| [[1.0.0-0]]
| (count, unknown_u8, unknown_u64, ptrsize_count_mul2, ptr)
|-
| 0x00250000
| [[1.0.0-0]]
| GetContentCount (?)
|-
| 0x00260042
| [[1.0.0-0]]
| GetContentIds (?)
|-
| 0x00270044
| [[1.0.0-0]]
| GetContentInfoForIds (?)
|-
| 0x00280000
| [[1.0.0-0]]
|
|-
| 0x00290000
| [[1.0.0-0]]
| InstallTitleFinish (?)
|-
| 0x002A00C2
| [[1.0.0-0]]
| (unknown_u8, count, unknown_u8, ptrsize_count_mul_8, ptr)
|-
| 0x002B....
| [[1.0.0-0]]
| ?
|-
| 0x002C....
| [[1.0.0-0]]
| ?
|-
| 0x002D....
| [[1.0.0-0]]
| ?
|-
| 0x002E....
| [[1.0.0-0]]
| ?
|-
| 0x002F....
| [[1.0.0-0]]
| ?
|-
| 0x0030....
| [[1.0.0-0]]
| ?
|-
| 0x0031....
| [[1.0.0-0]]
| ?
|-
| 0x0032....
| [[1.0.0-0]]
| ?
|-
| 0x0033....
| [[1.0.0-0]]
| ?
|-
| 0x0034....
| [[1.0.0-0]]
| ?
|-
| 0x0035....
| [[1.0.0-0]]
| ?
|-
| 0x0036....
| [[1.0.0-0]]
| ?
|-
| 0x0037....
| [[1.0.0-0]]
| ?
|-
| 0x0038....
| [[1.0.0-0]]
| ?
|-
| 0x00390146
| [[1.0.0-0]]
| (size2, size3, unknown_u64, size1, ptr1size_size1, ptr1, ptr2size_size2, ptr2, ptr3size_size3, ptr3)
|-
| 0x003A0146
| [[1.0.0-0]]
| (unknown_u64, size1, size2, size3, ptr1size_size1, ptr1, ptr2size_size2, ptr2, ptr3size_size3, ptr3)
|-
| 0x003B0042
| [[1.0.0-0]]
| (size, ptrsize, ptr)
|-
| 0x003C0000
| [[1.0.0-0]]
|
|-
| 0x003D0108
| [[1.0.0-0]]
| (size1, size2, size3, size4, ptr1size, ptr1, ptr2size, ptr2, ptr3size, ptr3, ptr4size, ptr4)
|-
| 0x003E0042
| [[1.0.0-0]]
| (size, ptrsize, ptr)
|-
| 0x003F0040
| [[1.0.0-0]]
| (unknown_u8)
|-
| 0x00400040
| [[1.0.0-0]]
| FinishInstallToMedia (u8 mediatype)
|-
| 0x00410000
| [[1.0.0-0]]
|
|-
| 0x00420142
| [[1.0.0-0]]
| InstallCommit
|-
| 0x004301C8
| [[2.0.0-2]]
| [[AMPXI:VerifyDSiWareFooter|VerifyDSiWareFooter]]
|-
| 0x004400C4
| [[2.0.0-2]]
| ?
|-
| 0x00450108
| [[2.0.0-2]]
| (size1, size3, size2, unknown_u8, ptr1size, ptr1, ptr2size, ptr2, ptr3size, ptr3, ptr4size_size2, ptr4) (DecryptDSiWareData)
|-
| 0x00460182
| [[2.0.0-2]]
| [[AMPXI:WriteTWLSavedata|WriteTWLSavedata]]
|-
| 0x00470080
| [[2.0.0-2]]
| (unknown_u8, unknown_u8)
|-
| 0x00480040
| [[2.0.0-2]]
| [[AMPXI:ReloadDBS|ReloadDBS]]
|-
| 0x00490080
| [[2.0.0-2]]
| (unknown_u64)
|-
| 0x004A0102
| [[2.0.0-2]]
| (count, unknown_u64, unknown_u8, ptrsize_count_mul_8, ptr)
|-
| 0x004B0100
| [[2.0.0-2]]
| (unknown_u64, unknown_u64)
|-
| 0x004C0042
| [[2.0.0-2]]
| (count, ptrsize_count_mul_24, ptr)
|-
| 0x004D0144
| [[2.0.0-2]]
| [[AMPXI:ExportDSiWare|ExportDSiWare]]
|-
| 0x004E00C0
| [[2.0.0-2]]
| (unknown_u64, unknown_u8)
|-
| 0x004F00C0
| [[2.0.0-2]]
| [[AMPXI:GetDSiWareExportSize|GetDSiWareExportSize]]
|-
| 0x00500044
| [[2.0.0-2]]
| (count, ptr1size_count_mul_8, ptr1, ptr2size_count_mul_4, ptr2)
|-
| 0x00510000
| [[2.0.0-2]]
|
|-
| 0x00520040
| [[2.0.0-2]]
| (unknown_u8)
|-
| 0x00530084
| [[2.0.0-2]]
| [[AMPXI:ValidateDSiWareMovableSedHash|ValidateDSiWareMovableSedHash]]
|-
| 0x00540000
| [[2.0.0-2]]
|
|-
| 0x005500C4
| [[2.0.0-2]]
| [[AMPXI:ValidateDSiWareSectionMAC|ValidateDSiWareSectionMAC]]
|-
| 0x005600C0
| [[2.0.0-2]]
| (unknown_u64, unknown_u16)
|-
| 0x00570042
| [[4.0.0-7]]
| ?
|-
| 0x0058....
| [[4.0.0-7]]
| ?
|-
| 0x00590104
| [[4.0.0-7]]
| ?
|-
| 0x005A0142
| [[4.0.0-7]]
| ?
|-
| 0x005B....
| [[4.0.0-7]]
| ?
|-
| 0x005C0044
| [[4.0.0-7]]
| ?
|-
| 0x005D0082
| [[4.0.0-7]]
| ?
|-
| 0x005E0102
| [[4.0.0-7]]
| ?
|-
| 0x005F....
| [[4.0.0-7]]
| ?
|-
| 0x00600102
| [[4.0.0-7]]
| ?
|-
| 0x00610142
| [[4.0.0-7]]
| ?
|-
| 0x00620044
| [[4.0.0-7]]
| ?
|-
| 0x00630042
| [[4.0.0-7]]
| ?
|-
| 0x0064....
| [[4.0.0-7]]
| ?
|-
| 0x0065....
| [[4.0.0-7]]
| ?
|-
| 0x0066....
| [[4.0.0-7]]
| Stubbed starting with [[4.0.0-7]], this only returns zero for the command result-code.
|-
| 0x00670082
| [[4.0.0-7]]
| ?
|-
| 0x006801C2
| [[4.0.0-7]]
| ?
|-
| 0x0069....
| [[4.0.0-7]]
| ?
|-
| 0x006A....
| [[4.0.0-7]]
| ?
|-
| 0x006B0142
| [[4.0.0-7]]
| ?
|-
| 0x006C....
| [[5.0.0-11]]
| (u8 [[Mediatypes|Mediatype]], u64 programID)
|}

=Errors=
{| class="wikitable" border="1"
|-
! Error-code
! Description
|-
| 0xC8A0802B
| This indicates the the [[Title_Database|dbs]] image(.db) does not exist, or opening the .db file failed.
|-
| 0xC8E083FC
| This error indicates that the title is already installed, with the same title-version as the title being installed?
|-
| 0xD8E08027
| Invalid title-version, or the title-version of the title being installed is older than the currently installed title-version.
|-
| 0xD8A08004
| Invalid ticket title version.
|-
| 0xD8E08025
| Invalid NCCH. returned from InstallContentFinish
|-
| 0xD8A08029
| Error-type 1
|-
| 0xD8E08065
| Error-type -1
|-
| 0xD8E08065+1 / 0xD8E08066
| Error-type -2
|-
| 0xD8E08065+2 / 0xD8E08067
| Error-type -3
|-
| 0xD8E08065+3 / 0xD8E08068
| Error-type -4
|-
| 0xD8E08065+4 / 0xD8E08069
| Error-type -5
|-
| 0xD8E08065+5 / 0xD8E0806A
| Error-type -6. Returned when a function returns error -2011: signature check for cert(TMD/TIK/cert-chain, ...) failed.
|-
| 0xD8E08065+6 / 0xD8E0806B
| Error-type -7
|-
| 0xD8E08065+7 / 0xD8E0806C
| Error-type -8
|-
| 0xD8E08065+8 / 0xD8E0806D
| Error-type -9
|-
| 0xD8E08065+9 / 0xD8E0806E
| Error-type -10
|-
| 0xD8E08065+10 / 0xD8E0806F
| Error-type -11
|-
| 0xD8E08065+11 / 0xD8E08070
| Error-type -12
|-
| 0xD8E08065+12 / 0xD8E08071
| Error-type -13
|-
| 0xD8E08065+13 / 0xD8E08072
| Error-type -14
|-
| 0xD8A083FA
| Invalid titleID.
|-
| 0xE0E0802C
| AM module returns this error when the system-title bit is set for the input CTR/TWL titleID-high, for [[AM:DeleteApplicationTitle]].
|}

Memory layout

2014-06-01T09:46:28Z

Slashmolder:

=ARM11 Physical memory regions =
{| class="wikitable" border="1"
|-
! Address
! Size
! Description
|-
| 0x0
| 0x10000
| Bootrom (super secret code/data @ 0x8000)
|-
| 0x10000
| 0x10000
| Bootrom mirror
|-
| 0x10000000
| ?
| [[IO]] memory
|-
| 0x17E00000
| 0x2000
| MPCore private memory region
|-
| 0x18000000
| 0x600000
| VRAM
|-
| 0x1FF00000
| 0x80000
| DSP memory
|-
| 0x1FF80000
| 0x80000
| AXI WRAM
|-
| 0x20000000
| 0x8000000
| FCRAM
|}

=ARM9 Physical memory regions =
{| class="wikitable" border="1"
|-
! Address
! Size
! Description
|-
| 0x00000000
| 0x08000000
| Instruction TCM, repeating each 0x8000 bytes.
|-
| 0x01FF8000
| 0x8000
| Instruction TCM (Accessed by the kernel and process by this address)
|-
| 0x07FF8000
| 0x8000
| Instruction TCM (Accessed by bootrom by this address)
|-
| 0x08000000
| 0x00100000
| ARM9-only internal memory
|-
| 0x10000000
| 0x08000000
| [[IO]] memory
|-
| 0x18000000
| 0x600000
| VRAM
|-
| 0x1FF00000
| 0x80000
| DSP memory
|-
| 0x1FF80000
| 0x80000
| AXI WRAM
|-
| 0x20000000
| 0x8000000
| FCRAM
|-
| 0xFFF00000
| 0x4000
| Data TCM (Mapped during bootrom)
|-
| 0xFFFF0000
| 0x10000
| Bootrom, the main region is at +0x8000, which is disabled during system boot.
|}

=Memory map by firmware=
* [[Virtual address mapping FW0B]]
* [[Virtual address mapping FW1F]]
* [[Virtual address mapping FW25]]
* [[Virtual address mapping FW2E]]

* [[Virtual address mapping TWLFIRM04]]

=ARM11 Detailed physical memory map=
18000000 - 18600000: VRAM

1FF80000 - 1FFAB000: Kernel code
1FFAB000 - 1FFF0000: SlabHeap [temporarily contains boot processes]
1FFF0000 - 1FFF1000: ?
1FFF1000 - 1FFF2000: ?
1FFF2000 - 1FFF3000: ?
1FFF3000 - 1FFF4000: ?
1FFF4000 - 1FFF5000: Exception vectors
1FFF5000 - 1FFF5800: Unused?
1FFF5800 - 1FFF5C00: 256-entry L2 MMU table for VA FF4xx000
1FFF5C00 - 1FFF6000: 256-entry L2 MMU table for VA FF5xx000
1FFF6000 - 1FFF6400: 256-entry L2 MMU table for VA FF6xx000
1FFF6400 - 1FFF6800: 256-entry L2 MMU table for VA FF7xx000
1FFF6800 - 1FFF6C00: 256-entry L2 MMU table for VA FF8xx000
1FFF6C00 - 1FFF7000: 256-entry L2 MMU table for VA FF9xx000
1FFF7000 - 1FFF7400: 256-entry L2 MMU table for VA FFAxx000
1FFF7400 - 1FFF7800: 256-entry L2 MMU table for VA FFBxx000
1FFF7800 - 1FFF7C00: MMU table but unused?
1FFF7C00 - 1FFF8000: 256-entry L2 MMU table for VA FFFxx000
1FFF8000 - 1FFFC000: 4096-entry L1 MMU table for VA xxx00000 (CPU 0)
1FFFC000 - 20000000: 4096-entry L1 MMU table for VA xxx00000 (CPU 1)
20000000 - 28000000: Main memory

The entire FCRAM is cleared during NATIVE_FIRM boot. This is probably done by the ARM11 kernel(after loading [[FIRM]] launch parameters from FCRAM)?

== FCRAM layout with the default retail memory-regions ==
{| class="wikitable" border="1"
! Region
! Base address relative to FCRAM+0
! Region size
! Used memory once [[Home Menu]] finishes loading for system boot, on [[4.5.0-10]]
! Used memory with [[Internet Browser]] running instead of [[Home Menu]], on [[4.5.0-10]]
! Free memory once [[Home Menu]] finishes loading for system boot, on [[4.5.0-10]]
! Free memory with [[Internet Browser]] running instead of [[Home Menu]], on [[4.5.0-10]]
|-
| APPLICATION
| 0x0
| 0x04000000
| 0x0
|
| 0x04000000
|
|-
| SYSTEM
| 0x04000000
| 0x02C00000
| 0x01488000
| 0x02A50000
| 0x01778000
| 0x001B0000
|-
| BASE
| 0x06C00000
| 0x01400000
| 0x01202000
| 0x01236000
| 0x001FE000
| 0x001CA000
|}

=ARM11 Detailed virtual memory map=
(valid only for FW0B, see [[#Memory map by firmware|Memory map by firmware]] for subsequent versions)

E8000000 - E8600000: mapped VRAM (18000000 - 18600000)

EFF00000 - F0000000: mapped Internal memory (1FF00000 - 20000000)
F0000000 - F8000000: mapped Main memory

FF401000 - FF402000: mapped ? (27FC7000 - 27FC8000)

FF403000 - FF404000: mapped ? (27FC2000 - 27FC3000)

FF405000 - FF406000: mapped ? (27FBB000 - 27FBC000)

FF407000 - FF408000: mapped ? (27FB3000 - 27FB4000)

FF409000 - FF40A000: mapped ? (27F8E000 - 27F8F000)

FFF00000 - FFF45000: mapped SlabHeap

FFF60000 - FFF8B000: mapped Kernel code

FFFCC000 - FFFCD000: mapped IO [[I2C|I2C]] second bus (10144000 - 10145000)

FFFCE000 - FFFCF000: mapped IO PDC([[LCD]]) (10400000 - 10401000)

FFFD0000 - FFFD1000: mapped IO PDN (10141000 - 10142000)

FFFD2000 - FFFD3000: mapped IO PXI (10163000 - 10164000)

FFFD4000 - FFFD5000: mapped IO PAD (10146000 - 10147000)

FFFD6000 - FFFD7000: mapped IO LCD (10202000 - 10203000)

FFFD8000 - FFFD9000: mapped IO DSP (10140000 - 10141000)

FFFDA000 - FFFDB000: mapped IO XDMA (10200000 - 10201000)

FFFDC000 - FFFE0000: mapped ? (1FFF8000 - 1FFFC000)

FFFE1000 - FFFE2000: mapped ? (1FFF0000 - 1FFF1000)

FFFE3000 - FFFE4000: mapped ? (1FFF2000 - 1FFF3000)

FFFE5000 - FFFE9000: mapped L1 MMU table for VA xxx00000

FFFEA000 - FFFEB000: mapped ? (1FFF1000 - 1FFF2000)

FFFEC000 - FFFED000: mapped ? (1FFF3000 - 1FFF4000)

FFFEE000 - FFFF0000: mapped IO IRQ (17E00000 - 17E02000)

FFFF0000 - FFFF1000: mapped Exception vectors

FFFF2000 - FFFF6000: mapped L1 MMU table for VA xxx00000

FFFF7000 - FFFF8000: mapped ? (1FFF1000 - 1FFF2000)

FFFF9000 - FFFFA000: mapped ? (1FFF3000 - 1FFF4000)

FFFFB000 - FFFFE000: mapped L2 MMU tables (1FFF5000 - 1FFF8000)

==0xFF4XX000==
Each [[KThread|thread]] is allocated a 0x1000-byte page in this region: the first page at 0xFF401000 is for the first created thread, 0xFF403000 for the second thread. This region is used to store the SVC-mode stack for the thread, and thread context data used for context switching. When the IRQ handler, prefetch/data abort handlers, and undefined instruction handler are entered where the SPSR-mode=user, these handlers then store LR+SPSR for the current mode on the SVC-mode stack, then these handlers switch to SVC-mode.

This page does not contain a dedicated block for storing R0-PC(etc). For user-mode, the user-mode regs are instead saved on the SVC-mode stack when IRQs such as timers for context switching are triggered.

Structure of this page, relative to page_endaddr-0xC8:
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
|
| SVC-mode stack-top
|-
| 0x18
| 0x28
| SVC-mode saved registers, stored/loaded during context switches: R4-R9, SL, FP, SP, LR. After loading these registers, the context switch code will jump to the loaded LR.
|-
| 0xC0
| 4
| fpexc from vmrs, used during context switches with the above saved registers.
|}

For NATIVE_FIRM the memory pages for this region are located in FCRAM, however for TWL_FIRM these are located in AXI WRAM. For TWL_FIRM v6704 the first thread's page for this region is located at physical address 0x1FF93000, the next one at 0x1FF92000, etc.

=ARM11 User-land memory regions=
==NATIVE_FIRM/SAFE_MODE_FIRM Userland Memory==
{| class="wikitable" border="1"
|-
! Virtual Address Base
! Physical Address Base
! Region Max Size
! Description
|-
| 0x00100000 / 0x14000000
|
| 0x03F00000
| The [[ExeFS]]:/.code is loaded here, executables must be loaded to the 0x00100000 region when the exheader "special memory" flag is clear. The 0x03F00000-byte size restriction only applies when this flag is clear. Executables are usually loaded to 0x14000000 when the exheader "special memory" flag is set, however this address can be arbitrary.
|-
| 0x08000000
| For applications: FCRAM + GSP heap size
| 0x08000000
| Heap mapped by [[SVC|ControlMemory]]
|-
| 0x10000000-StackSize
| .bss physical address - total stack pages
| StackSize from process exheader
| Stack for the main-thread, initialized by the ARM11 kernel. The StackSize from the exheader is usually 0x4000, therefore the stack-bottom is usually 0x0FFFC000. The stack for the other threads is normally located in the process .data section however this can be arbitrary.
|-
| 0x10000000
|
| 0x04000000
| [[SVC|Shared]] memory
|-
| 0x14000000
| FCRAM+0
| 0x08000000
| Can be mapped by [[SVC|ControlMemory]], this is used for processes' [[SVC|LINEAR]]/GSP heap.
|-
| 0x1EC00000
| 0x10100000
| 0x01000000
| [[IO]] registers, the mapped IO pages which each process can access is specified in the [[NCCH#CXI|CXI]] exheader.(Applications normally don't have access to registers in this range)
|-
| 0x1F000000
| 0x18000000
| 0x00600000
| VRAM, access to this is specified by the exheader.
|-
| 0x1FF00000
| 0x1FF00000
| 0x00080000
| DSP memory, access to this is specified by the exheader.
|-
| 0x1FF80000
| FCRAM memory page allocated by the ARM11 kernel.
| 0x1000
| [[Configuration Memory]], all processes have read-only access to this.
|-
| 0x1FF81000
| FCRAM memory page allocated by the ARM11 kernel.
| 0x1000
| [[Configuration Memory|Shared]] page, all processes have read-access to this. Write access to this is specified by the exheader "Shared page writing" kernel flag.
|}

All executable pages are read-only, and data pages have the execute-never permission set. Normally .text from the loaded ExeFS:/.code is the only mapped executable memory. Executable [[RO Services|CROs]] can be loaded into memory, once loaded the CRO .text section memory page permissions are changed via [[SVC|ControlProcessMemory]] from RW- to R-X. The address and size of each ExeFS:/.code section is stored in the exheader, the permissions for each section is: .text R-X, .rodata R--, .data RW-, and .bss RW-. The loaded .code is mapped to the addresses specified in the exheader by the ARM11 kernel. The stack permissions is initialized by the ARM11 kernel: RW-. The heap permissions is normally RW-.

All userland memory is mapped with RW permissions for privileged-mode. However, normally the ARM11 kernel only uses userland read/write instructions(or checks that the memory can be written from userland first) for accessing memory specified by [[SVC|SVCs]].

The virtual memory located below 0x20000000 is process-unique, processes can't directly access memory for other processes. The virtual memory starting at 0x20000000 is only accessible in privileged-mode. When service [[Services API|commands]] are used, the kernel maps memory in the destination process for input/output buffers, where the addresses in the command received by the process is replaced by this mapped memory. When this is an input buffer, the buffer data is copied to the mapped memory. When this is an output buffer, the data stored in the mapped memory is copied to the destination buffer specified in the command.

The physical address which memory for the application memory-type is mapped to begins at FCRAM+0, the total memory allocated for this memory-type is stored in [[Configuration_Memory]]. Applications' .text + .rodata + .data under the application memory-type is mapped at FCRAM + APPMEMALLOC - (aligned page-size for .text + .rodata + .data). The application .bss is mapped at CODEADDR - .bss size aligned down to the page size.

==TWL_FIRM Userland Memory==
{| class="wikitable" border="1"
|-
! Virtual Address Base
! Physical Address Base
! Size
! Description
|-
| 0x00100000
| 0x1FFAB000 (with newer TWL_FIRM such as v6704 this is located at 0x1FFAC000)
| 0x00055000
| Code + .(ro)data copied from the process 0x00300000 region is located here(.bss is located here as well).
|-
| 0x00155000
| 0x18555000
| 0x000AB000
|
|-
| 0x00200000
| 0x18500000
| 0x00100000
|
|-
| 0x00300000
| 0x24000000
| 0x04000000
| The beginning of the ARM11 process .text is located here.
|-
| 0x08000000
| 0x20000000
| 0x07E00000
|
|-
| 0x1EC00000
| 0x10100000
| 0x00400000
| [[IO]]
|-
| 0x1F000000
| 0x18000000
| 0x00600000
| VRAM
|-
| 0x1FF00000
| 0x1FF00000
| 0x00080000
| This is mapped to the DSP memory.
|}

The above regions are mapped by the ARM11 kernel. Later when the ARM11 process uses [[SVC|svcKernelSetState]] with type4, the kernel unmaps(?) the following regions: 0x00300000..0x04300000, 0x08000000..0x0FE00000, and 0x10000000..0xF8000000.

=== Detailed TWL_FIRM ARM11 Memory ===
{| class="wikitable" border="1"
|-
! Process Virtual Address
! Physical Address
! Size
! Description
|-
| 0x08000000
| 0x20000000
| 0x01000000*4
| DS(i) 0x02000000 RAM. Vaddr = (DSRAMOffset*4) + 0x08000000, where DSRAMOffset is DSRAMAddr-0x02000000.
|-
| 0x0FC00000
| 0x27C00000
|
| Loaded SRL binary, initially the dev DSi launcher SRL is located here(copied here by the ARM11 process).
|-
| 0x0FD00000
| 0x27D00000
|
| The data located here is copied to here by the ARM11 process. The data located here is a TWL NAND [http://dsibrew.org/wiki/Bootloader bootloader] image, using the same format+encryption/verification methods as the DSi NAND bootloader(stage2). The keyX for this bootloader keyslot is initially set to the retail DSi key-data, however when TWL_FIRM is launched this keyX key-data is replaced with a separate keyX. TWL_FIRM can use either the retail DSi bootloader RSA-1024 modulo, or a seperate modulo: normally only the latter is used(the former is only used when loading the image from FS instead of FCRAM). When using the image from FCRAM(default code-path), TWL_FIRM will not calculate+check the hashes for the bootloader code binaries(this is done when loading from FS however).
|-
| 0x0FDF7000
| 0x27DF7000
| 0x1000
| SRL header
|}

= System memory details =
0xFFFF9000 Pointer to the current KThread instance
0xFFFF9004 Pointer to the current KProcess instance
0xFFFF9010 Pointer a KThread (not sure what its role is)

= Handles =
The handle 0xFFFF8001 is a reference to the current KProcess.

= IO Process/Kernel virtual addressing equivalence =
It seems an IO register's process virtual address can be calculated by adding 0xEB00000 to its physical address.

= VRAM Map While Running System Applets =
*0x1E6000-0x22C500 -- top screen 3D left framebuffer 0(240x400x3) (The "3D right first-framebuf" addr stored in the LCD register is set to this, when the 3D is set to "off")
*0x22C800-0x272D00 -- top screen 3D left framebuffer 1(240x400x3)
*0x273000-0x2B9500 -- top screen 3D right framebuffer 0(240x400x3)
*0x2B9800-0x2FFD00 -- top screen 3D right framebuffer 1(240x400x3)
*0x48F000-0x4C7400 -- bottom screen framebuffer 0(240x320x3)
*0x4C7800-0x4FF800 -- bottom screen framebuffer 1(240x320x3)

These LCD framebuffer addresses are not changed by the system when launching regular applications, the application itself handles that if needed.