Every RPC command sent to services starts with a u32 header code:

Bits Description
0-5 Number of translate parameters (=x)
6-15 Number of normal parameters (=y)
16-23 Command ID
24-31 Unknown

The entire command has the following structure:

Word Size Description
0 1 Header code
1 x Normal parameters
x y Translate parameters

Translate parameters are modified/translated transparently by the kernel. They are used to transfer handles/buffers between the different processes.

The type of parameter is described by the bits 1-3 in the translation descriptor. Parameter types accepted by the kernel are: 0, 1, (2?), 5, 6, 7.

The number of parameters covered by a descriptor is type-dependent:

Type 0:
    length = (desc >> 26) + 1
Type 1, (2?), 5, 6, 7:
    length = 1

Type 0 does the following:

if desc & 0x30 == 0x20:
  write process id to value
else:
  translate handle
  if desc & 0x30 == 0x10:
    close handle for caller

--

Descriptor Description
0x00000000 The corresponding value is a KHandle
0x00000010 The corresponding value is a KHandle, that should not be closed locally?
0x00000020 Let kernel set value to local ProcessID
0x0000???2 | (size<<14) The corresponding value contains a ptr to a buffer of said size.
0x0000000A | (size<<4) The corresponding value contains a ptr to a buffer of said size.
0x0000000C | (size<<4) The corresponding value contains a ptr to a buffer of said size.