Nintendo Switch Brew - User contributions [en]

NPDM

2017-08-03T14:15:01Z

Aerosoul: /* META */

This is the Switch equivalent of 3DS exheader. This is the file with extension ".npdm" in {Switch ExeFS}. The size of this file varies.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x80
| META
|-
| 0x80
| <Varies>
| ACID
|-
| <See META>
| <See META>
| ACI0
|}

= META =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Magic "META".
|-
| 0x4
| 0x8
| Reserved1
|-
| 0xC
| 1
| Flags
|-
| 0xD
| 1
| UnusedData
|-
| 0xE
| 1
| MainThreadPriority
|-
| 0xF
| 1
| MainThreadCoreNumber
|-
| 0x10
| 0x8
| Reserved2
|-
| 0x18
| 0x4
| Version
|-
| 0x1C
| 0x4
| MainThreadStackSize
|-
| 0x20
| 0x10
| Title name
|-
| 0x30
| 0x10
| ProductCode
|-
| 0x40
| 0x30
| Reserved3
|-
| 0x70
| 0x4
| [[#ACI0]] offset
|-
| 0x74
| 0x4
| [[#ACI0]] size
|-
| 0x78
| 0x4
| [[#ACID]] offset
|-
| 0x7C
| 0x4
| [[#ACID]] size
|}

= ACID =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0
| 0x100
| RSA-2048 signature, seems to verify the data starting at 0x100 with the size field from 0x204.
|-
| 0x100
| 0x100
| RSA-2048 public key, seems to be used for the second [[NCA_Format|NCA]] signature.
|-
| 0x200
| 0x4
| Magic "ACID".
|-
| 0x204
| 0x4
| s32 Size field used with the above signature(?).
|-
| 0x208
| 0x4
| Zeroes
|-
| 0x20C
| 0x4
| Retail flag. Must be 1 on retail, on devunit 0 is also allowed.
|-
| 0x210
| 0x8
| Title id
|-
| 0x218
| 0x8
| Title id again
|-
| 0x220
| 0x4
| [[#FS Access Control]] offset
|-
| 0x224
| 0x4
| [[#FS Access Control]] size
|-
| 0x228
| 0x4
| [[#Service Access Control]] offset
|-
| 0x22C
| 0x4
| [[#Service Access Control]] size
|-
| 0x230
| 4
| [[#Kernel Access Control]] offset
|-
| 0x234
| 4
| [[#Kernel Access Control]] size
|-
| 0x238
| 0x8
| Padding
|}

= ACI0 =
Looks like an old crappy version of ACID. It has the guessed version field 0 instead of 1.

= FS Access Control =

{| class="wikitable" border="1"
|-
! Word
! Bit
! Description
|-
| 0
|
| Version? Always 1.
|-
| 1
| 0
| MountContent* is accessible when set.
|-
| 1
| 2
| Enables access to [[Filesystem_services|Bis]] partitionID 27 and 28?
|}

Web-applets access control:
* "LibAppletWeb" and "LibAppletOff" have same access control: word0 bit0 set, word1 bit0 and bit3 set, and word2 bit30 set.
* Rest of the web-applets: Same as above except word1 bit0 isn't set.

= Service Access Control =
This is a list of [[Services_API|service]]-name strings which the title has access to, with the following structure:
+0: control_byte
+1: {service-name without nul-terminator}

Bitmask 0x0F in control_byte is the {length of the service-name without nul-terminator} - 1.

Bitmask 0x80 in control_byte means service is allowed to be registered.

The service string can contain a wildcard <code>*</code> character.

= Kernel Access Control =
On Switch, descriptors are identified by pattern 01..11 in low bits.

{| class="wikitable" border="1"
|-
! Pattern of lower bits
! Lowest clear bitmask/bit
! Type
! Fields
|-
| <code>0bxxxxxxxxxxxx0111</code>
|
| Kernel flags
| Bit31-24: Highest allowed cpu id, bit23-16: Lowest allowed cpu id, bit15-10: Highest allowed thread prio, bit9-4: Lowest allowed thread prio
|-
| <code>0bxxxxxxxxxxx01111</code>
|
| Syscall mask
| Bits 29-31: Syscall mask table index; Bits 5-28: Mask
|-
| <code>0bxxxxxxxxx0111111</code>
|
| Map IO page (RW)
| Bits 7-31: Page
|-
| <code>0bxxxxxxxx01111111</code>
|
| Map IO range
| Bits 7-30: Alternating start page and number of pages, bit31: Alternating read-only flag then MemoryAttribute 0x2001/0x42002 selector flag
|-
| <code>0bxxxx011111111111</code>
|
| Interrupt pair
| Bits 12-21: Irq0, bits 20-31: Irq1, 0x3FF means empty.
|-
| <code>0xxxx0111111111111</code>
|
|
|
|-
| <code>0xxx01111111111111</code>
|
|
|
|-
| <code>0xx011111111111111</code>
| bit14
| Kernel release version
| Bits 15-X: Version. The raw descriptor is compared with 0x80000, when less than an error is returned. This is equivalent to comparing the bits starting at bit15 with 0x10. The raw descriptor is also stored into {state}. This enforces a minimum required version, not a maximum.
|-
| <code>0x0111111111111111</code>
| bit15
|
|
|-
| All ones
|
| Ignored
|
|}

Only certain memory ranges are allowed to be mapped via these descriptors.

NPDM

2017-08-03T14:14:32Z

Aerosoul: /* META */

This is the Switch equivalent of 3DS exheader. This is the file with extension ".npdm" in {Switch ExeFS}. The size of this file varies.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x80
| META
|-
| 0x80
| <Varies>
| ACID
|-
| <See META>
| <See META>
| ACI0
|}

= META =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Magic "META".
|-
| 0x4
| 0x8
| Reserved1
|-
| 0xC
| 1
| Flags
|-
| 0xD
| 1
| UnusedData
|-
| 0xE
| 1
| MainThreadPriority
|-
| 0xF
| 1
| MainThreadCoreNumber
|-
| 0x10
| 0x8
| Reserved2
|-
| 0x18
| 0x4
| Version
|-
| 0x1C
| 0x4
| MainThreadStackSize
|-
| 0x20
| 0x10
| Title name
|-
| 0x30
| 0x10
| ProductCode
|-
| 0x30
| 0x30
| Reserved3
|-
| 0x70
| 0x4
| [[#ACI0]] offset
|-
| 0x74
| 0x4
| [[#ACI0]] size
|-
| 0x78
| 0x4
| [[#ACID]] offset
|-
| 0x7C
| 0x4
| [[#ACID]] size
|}

= ACID =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0
| 0x100
| RSA-2048 signature, seems to verify the data starting at 0x100 with the size field from 0x204.
|-
| 0x100
| 0x100
| RSA-2048 public key, seems to be used for the second [[NCA_Format|NCA]] signature.
|-
| 0x200
| 0x4
| Magic "ACID".
|-
| 0x204
| 0x4
| s32 Size field used with the above signature(?).
|-
| 0x208
| 0x4
| Zeroes
|-
| 0x20C
| 0x4
| Retail flag. Must be 1 on retail, on devunit 0 is also allowed.
|-
| 0x210
| 0x8
| Title id
|-
| 0x218
| 0x8
| Title id again
|-
| 0x220
| 0x4
| [[#FS Access Control]] offset
|-
| 0x224
| 0x4
| [[#FS Access Control]] size
|-
| 0x228
| 0x4
| [[#Service Access Control]] offset
|-
| 0x22C
| 0x4
| [[#Service Access Control]] size
|-
| 0x230
| 4
| [[#Kernel Access Control]] offset
|-
| 0x234
| 4
| [[#Kernel Access Control]] size
|-
| 0x238
| 0x8
| Padding
|}

= ACI0 =
Looks like an old crappy version of ACID. It has the guessed version field 0 instead of 1.

= FS Access Control =

{| class="wikitable" border="1"
|-
! Word
! Bit
! Description
|-
| 0
|
| Version? Always 1.
|-
| 1
| 0
| MountContent* is accessible when set.
|-
| 1
| 2
| Enables access to [[Filesystem_services|Bis]] partitionID 27 and 28?
|}

Web-applets access control:
* "LibAppletWeb" and "LibAppletOff" have same access control: word0 bit0 set, word1 bit0 and bit3 set, and word2 bit30 set.
* Rest of the web-applets: Same as above except word1 bit0 isn't set.

= Service Access Control =
This is a list of [[Services_API|service]]-name strings which the title has access to, with the following structure:
+0: control_byte
+1: {service-name without nul-terminator}

Bitmask 0x0F in control_byte is the {length of the service-name without nul-terminator} - 1.

Bitmask 0x80 in control_byte means service is allowed to be registered.

The service string can contain a wildcard <code>*</code> character.

= Kernel Access Control =
On Switch, descriptors are identified by pattern 01..11 in low bits.

{| class="wikitable" border="1"
|-
! Pattern of lower bits
! Lowest clear bitmask/bit
! Type
! Fields
|-
| <code>0bxxxxxxxxxxxx0111</code>
|
| Kernel flags
| Bit31-24: Highest allowed cpu id, bit23-16: Lowest allowed cpu id, bit15-10: Highest allowed thread prio, bit9-4: Lowest allowed thread prio
|-
| <code>0bxxxxxxxxxxx01111</code>
|
| Syscall mask
| Bits 29-31: Syscall mask table index; Bits 5-28: Mask
|-
| <code>0bxxxxxxxxx0111111</code>
|
| Map IO page (RW)
| Bits 7-31: Page
|-
| <code>0bxxxxxxxx01111111</code>
|
| Map IO range
| Bits 7-30: Alternating start page and number of pages, bit31: Alternating read-only flag then MemoryAttribute 0x2001/0x42002 selector flag
|-
| <code>0bxxxx011111111111</code>
|
| Interrupt pair
| Bits 12-21: Irq0, bits 20-31: Irq1, 0x3FF means empty.
|-
| <code>0xxxx0111111111111</code>
|
|
|
|-
| <code>0xxx01111111111111</code>
|
|
|
|-
| <code>0xx011111111111111</code>
| bit14
| Kernel release version
| Bits 15-X: Version. The raw descriptor is compared with 0x80000, when less than an error is returned. This is equivalent to comparing the bits starting at bit15 with 0x10. The raw descriptor is also stored into {state}. This enforces a minimum required version, not a maximum.
|-
| <code>0x0111111111111111</code>
| bit15
|
|
|-
| All ones
|
| Ignored
|
|}

Only certain memory ranges are allowed to be mapped via these descriptors.

NSO0

2017-08-03T14:07:49Z

Aerosoul:

NSO is the main executable format.

It starts with the "NSO" header and mainly describes .text, .rodata, and .data segments (like a short-form of ELF program headers):

=== .rodata-relative extent ===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 4
| offset (relative to .rodata)
|-
| 0x4
| 4
| size of region
|}

=== NSO Header ===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 4
| Magic "NSO0"
|-
| 0x4
| 4
| Version
|-
| 0x8
| 4
| Reserved1
|-
| 0xC
| 4
| Flags: TextCompress = 1, RoCompress = 2, DataCompress = 4, TextHash = 8, RoHash = 0x10, DataHash = 0x20
|-
| 0x10
| 4
| TextFileOffset
|-
| 0x14
| 4
| TextMemoryOffset
|-
| 0x18
| 4
| TextSize
|-
| 0x1C
| 4
| ModuleNameOffset
|-
| 0x20
| 4
| RoFileOffset
|-
| 0x24
| 4
| RoMemoryOffset
|-
| 0x28
| 4
| RoSize
|-
| 0x2C
| 4
| ModuleNameSize
|-
| 0x30
| 4
| DataFileOffset
|-
| 0x34
| 4
| DataMemoryOffset
|-
| 0x38
| 4
| DataSize
|-
| 0x3C
| 4
| BssSize
|-
| 0x40
| 0x20
| Value of "build id" from ELF's GNU .note section. Contains variable sized digest, up to 32bytes.
|-
| 0x60
| 0x4
| TextFileSize
|-
| 0x64
| 0x4
| RoFileSize
|-
| 0x68
| 0x4
| DataFileSize
|-
| 0x6c
| 0x24
| Padding
|-
| 0x90
| 8
| .rodata-relative extents of .dynstr
|-
| 0x98
| 8
| .rodata-relative extents of .dynsym
|-
| 0xA0
| 0x20 * 3
| SHA256 hashes over the decompressed sections using the above byte-sizes: .text, .rodata, and .data.
|-
| 0x100
|
| Compressed sections
|}

Most data in Switch binaries are standard ELF structures, however some are custom.
For example, the MOD header is essentially a replacement for a PT_DYNAMIC program header.

=== MOD ===
All offsets are signed 32bit values relative to the magic field.
The 32bits at image base + 4 must point to the magic field.
The MOD structure is designed such that it can be placed at image base and point to itself.
The 2 fields preceding the magic field get copied around with the structure, even if it is relocated to somewhere besides the image base. If MOD is not located at image base, the value at offset 4 must still point to the MOD magic. In the case of .text being at image base, this implies that the first instruction can only be an unconditional branch over the offset literal.
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x00
| 4
| zero padding
|-
| 0x04
| 4
| offset to magic. Always 8 (so it works when MOD is at image_base + 0).
|-
| 0x08
| 4
| magic "MOD0"
|-
| 0x0C
| 4
| .dynamic offset
|-
| 0x10
| 4
| .bss start offset
|-
| 0x14
| 4
| .bss end offset
|-
| 0x18
| 4
| .eh_frame_hdr start offset
|-
| 0x1C
| 4
| .eh_frame_hdr end offset
|-
| 0x20
| 4
| offset to runtime-generated module object. typically equal to .bss base.
|}