Nintendo Switch Brew - User contributions [en]

LDN services

2021-02-27T16:00:36Z

CFSworks: /* Beacon */ DTIM count is a countdown (in beacon frames) until the DTIM is reset; it's not static

LDN handles all local network communication.

= ldn:m =
This is "nn::ldn::detail::IMonitorServiceCreator".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#CreateMonitorService]]
|}

== CreateMonitorService ==
Returns an [[#IMonitorService]].

The user-process closes the IMonitorServiceCreator object immediately after using this cmd.

== IMonitorService ==
This is "nn::ldn::detail::IMonitorService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#GetStateForMonitor]]
|-
| 1 || [[#GetNetworkInfoForMonitor]]
|-
| 2 || [[#GetIpv4AddressForMonitor]]
|-
| 3 || [[#GetDisconnectReasonForMonitor]]
|-
| 4 || [[#GetSecurityParameterForMonitor]]
|-
| 5 || [[#GetNetworkConfigForMonitor]]
|-
| 100 || [[#InitializeMonitor]]
|-
| 101 || [[#FinalizeMonitor]]
|}

=== GetStateForMonitor ===
No input, returns an output u32.

sdknso implements this by <code>return</code>ing the u32, with 0 being returned on error.

=== GetNetworkInfoForMonitor ===
Takes a type-0x1A output buffer containing a [[#NetworkInfo]].

=== GetIpv4AddressForMonitor ===
No input, returns an output [[#Ipv4Address]] and a [[#SubnetMask]].

=== GetDisconnectReasonForMonitor ===
No input, returns an output s16.

This is not exposed by sdknso.

This just returns 0.

=== GetSecurityParameterForMonitor ===
No input, returns an output [[#SecurityParameter]].

This is not exposed by sdknso.

=== GetNetworkConfigForMonitor ===
No input, returns an output [[#NetworkConfig]].

This is not exposed by sdknso.

=== InitializeMonitor ===
No input/output.

This is used immediately after object creation. Official sw will Abort if this fails.

This just returns 0.

=== FinalizeMonitor ===
No input/output.

This is used during service exit, prior to closing the object. Official sw will Abort if this fails.

This just returns 0.

= ldn:s =
This is "nn::ldn::detail::ISystemServiceCreator".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#CreateSystemLocalCommunicationService]]
|}

== CreateSystemLocalCommunicationService ==
Returns an [[#ISystemLocalCommunicationService]].

The user-process closes the ISystemServiceCreator object immediately after using this cmd. Official sw ignores errors from this cmd.

== ISystemLocalCommunicationService ==
This is "nn::ldn::detail::ISystemLocalCommunicationService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#GetState]]
|-
| 1 || [[#GetNetworkInfo]]
|-
| 2 || [[#GetIpv4Address]]
|-
| 3 || [[#GetDisconnectReason]]
|-
| 4 || [[#GetSecurityParameter]]
|-
| 5 || [[#GetNetworkConfig]]
|-
| 100 || [[#AttachStateChangeEvent]]
|-
| 101 || [[#GetNetworkInfoLatestUpdate]]
|-
| 102 || [[#Scan]]
|-
| 103 || [[#ScanPrivate]]
|-
| 104 || [5.0.0+] [[#SetWirelessControllerRestriction]]
|-
| 200 || [[#OpenAccessPoint]]
|-
| 201 || [[#CloseAccessPoint]]
|-
| 202 || [[#CreateNetwork]]
|-
| 203 || [[#CreateNetworkPrivate]]
|-
| 204 || [[#DestroyNetwork]]
|-
| 205 || [[#Reject]]
|-
| 206 || [[#SetAdvertiseData]]
|-
| 207 || [[#SetStationAcceptPolicy]]
|-
| 208 || [[#AddAcceptFilterEntry]]
|-
| 209 || [[#ClearAcceptFilter]]
|-
| 300 || [[#OpenStation]]
|-
| 301 || [[#CloseStation]]
|-
| 302 || [[#Connect]]
|-
| 303 || [[#ConnectPrivate]]
|-
| 304 || [[#Disconnect]]
|-
| 400 || [[#InitializeSystem]]
|-
| 401 || [[#FinalizeSystem]]
|-
| 402 || [4.0.0+] [[#SetOperationMode]]
|-
| 403 || [7.0.0+] [[#InitializeSystem2]]
|}

=== GetState ===
No input, returns an output u32.

sdknso implements this by <code>return</code>ing the u32, with 0 being returned on error / when service isn't initialized.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || None
|-
| 1 || Initialized
|-
| 2 || AccessPointOpened
|-
| 3 || AccessPointCreated
|-
| 4 || StationOpened
|-
| 5 || StationConnected
|-
| 6 || Error
|-
|}

=== GetNetworkInfo ===
Takes a type-0x1A output buffer containing a [[#NetworkInfo]].

=== GetIpv4Address ===
No input, returns an output [[#Ipv4Address]] and a [[#SubnetMask]].

=== GetDisconnectReason ===
No input, returns an output s16.

sdknso implements this by <code>return</code>ing the s16 as a s32, with -1 being returned on error.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| -1 || See above.
|-
| 0 || None
|-
| 1 || User
|-
| 2 || SystemRequest
|-
| 3 || DestroyedByAdmin
|-
| 4 || DestroyedBySystemRequest
|-
| 5 || Admin
|-
| 6 || SignalLost
|}

=== GetSecurityParameter ===
No input, returns an output [[#SecurityParameter]].

=== GetNetworkConfig ===
No input, returns an output [[#NetworkConfig]].

=== AttachStateChangeEvent ===
No input, returns an output Event handle.

sdknso uses EventClearMode=1 with this. sdknso will Abort if this cmd fails.

This is signaled when the data returned by [[#GetNetworkInfo]]/[[#GetNetworkInfoLatestUpdate]] is updated.

=== GetNetworkInfoLatestUpdate ===
Takes a type-0x1A output buffer containing a [[#NetworkInfo]] and a type-0xA output buffer containing an array of [[#NodeLatestUpdate]].

The array count must be 8.

=== Scan ===
Takes a type-0x22 output buffer containing an array of [[#NetworkInfo]], a s16 channel, a [[#ScanFilter]], returns an output s16 total_out.

sdknso copies the output s16 to a s32, the value passed for the input s16 is from an user-specified s32 (user-apps generally use value 0 for this).

This is the same as [[#ScanPrivate]], except this also has the same channel-override functionality as [[#CreateNetwork]].

[[#GetState|State]] must be 3-5.

The array count must be at least 1. This is clamped to a maximum of 0x18.

=== ScanPrivate ===
Takes a type-0x22 output buffer containing an array of [[#NetworkInfo]], a s16 channel, a [[#ScanFilter]], returns an output s16 total_out.

sdknso copies the output s16 to a s32, the value passed for the input s16 is from an user-specified s32.

See [[#Scan]].

=== SetWirelessControllerRestriction ===
Takes an input [[#WirelessControllerRestriction]], no output.

[[#GetState|State]] must be 1.

The input value is written into state.

=== OpenAccessPoint ===
No input/output.

[[#GetState|State]] must be 1, this cmd eventually sets the State to value 2.

=== CloseAccessPoint ===
No input/output.

[[#GetState|State]] must be 2-3, this cmd eventually sets the State to value 1.

=== CreateNetwork ===
Takes an input [[#SecurityConfig]], an [[#UserConfig]], a [[#NetworkConfig]], no output.

This is the same as [[#CreateNetworkPrivate]], except the [[#AddressEntry]] params are 0, and the [[#SecurityParameter]] is generated from "nn::util::TinyMt::GenerateRandomBytes".

Unlike CreateNetworkPrivate, this overwrites the channel field in the [[#NetworkConfig]]. When the cached [[SPL_services#IsDevelopment|IsDevelopment]] value is true, the output from [[Settings_services|GetLdnChannel]] will overwrite that field if the s32 setting value is >=0, otherwise the original value is used. Otherwise when the IsDevelopment field is false (retail), the channel is overwritten with value 0.

This overwrites the u16 field at [[#SecurityConfig]]+0. When the cached [[SPL_services#IsDevelopment|IsDevelopment]] value is false (retail), value 1 is used, otherwise the original value is used.

[[#GetState|State]] must be 2, this cmd eventually sets the State to value 3.

=== CreateNetworkPrivate ===
Takes an input [[#SecurityConfig]], a [[#SecurityParameter]], an [[#UserConfig]], a [[#NetworkConfig]], a type-0x9 input buffer containing an array of [[#AddressEntry]], no output.

The buffer/count for [[#AddressEntry]] can be 0, in which case the network will be non-Private like [[#CreateNetwork]]. The count must be <=8.

See [[#CreateNetwork]].

=== DestroyNetwork ===
No input/output.

[[#GetState|State]] must be 3, this cmd eventually sets the State to value 2.

=== Reject ===
Takes an input [[#Ipv4Address]], no output.

[[#GetState|State]] must be 3.

=== SetAdvertiseData ===
Takes a type-0x21 input buffer, no output.

The input buffer contains arbitrary user data.

The buffer size must be <=0x180. An empty buffer (addr=NULL/size=0) can be used to reset the AdvertiseData size in state to zero.

[[#GetState|State]] must be 2-3.

=== SetStationAcceptPolicy ===
Takes an input [[#AcceptPolicy]], no output.

[[#GetState|State]] must be 2-3.

=== AddAcceptFilterEntry ===
Takes an input [[#MacAddress|MacAddress]], no output.

There are two sdknso funcs implementing this: one which takes a [[#MacAddress|MacAddress]] directly, the other loads the [[#MacAddress|MacAddress]] from the input [[#NodeInfo|NodeInfo]].

[[#GetState|State]] must be 2-3.

=== ClearAcceptFilter ===
No input/output.

[[#GetState|State]] must be 2-3.

=== OpenStation ===
No input/output.

[[#GetState|State]] must be 1, this cmd eventually sets the State to value 4.

=== CloseStation ===
No input/output.

[[#GetState|State]] must be 4-5, this cmd eventually sets the State to value 1.

=== Connect ===
Takes a type-0x19 input buffer containing a [[#NetworkInfo]], a [[#SecurityConfig]], an [[#UserConfig]], a s32 LocalCommunicationVersion, a [[#ConnectOption]], no output.

[[#GetState|State]] must be 4, this cmd eventually sets the State to value 5.

This is identical to [[#ConnectPrivate]] (besides the below), except the data internally passed for [[#SecurityParameter]]/[[#NetworkConfig]] are loaded from the input [[#NetworkInfo]].

This overwrites the u16 field at [[#SecurityConfig]]+0. When the cached [[SPL_services#IsDevelopment|IsDevelopment]] value is false (retail), value 1 is used, otherwise the used value is: original_field == 0 ? {u16 [[#NetworkInfo]]+0x60} : original_field.

u32 LocalCommunicationVersion>>15 must be 0.

=== ConnectPrivate ===
Takes a [[#SecurityConfig]], [[#SecurityParameter]], an [[#UserConfig]], a s32 LocalCommunicationVersion, a [[#ConnectOption]], a [[#NetworkConfig]], no output.

See [[#Connect]].

This overwrites the u16 field at [[#SecurityConfig]]+0. When the cached [[SPL_services#IsDevelopment|IsDevelopment]] value is false (retail), value 1 is used, otherwise the original value is used.

=== Disconnect ===
No input/output.

[[#GetState|State]] must be 5, this cmd eventually sets the State to value 4.

=== InitializeSystem ===
Takes an input PID and an u64 pid_placeholder.

This is used immediately after object creation.

With [7.0.0+] [[#InitializeSystem2]] is used instead.

=== FinalizeSystem ===
No input/output.

This is used during service exit, prior to closing the object. Official sw will Abort if this fails.

If State is set for it, this will run the equivalent of [[#CloseAccessPoint]]/[[#CloseStation]] when needed.

[[#GetState|State]] must be non-zero, this cmd eventually sets the State to value 0.

=== SetOperationMode ===
Takes an input [[#OperationMode]], no output.

[[#GetState|State]] must be 1.

The input value is written into state.

=== InitializeSystem2 ===
Takes an input PID, an u32, and an u64 pid_placeholder.

Official sw uses hard-coded value 0x1 for the u32.

The input u32 is ignored, the impl for this cmd is identical to [[#InitializeSystem]].

Internally this calls a func with params: (..., PID, &{u16 value 0x38}). On success, this then calls another func (which sets two state fields to the input) with params: (state, 0) (these state fields are used during [[#Authentication]] to check which service is being used).

The first func uses various [[Network_Interface_services|nifm]] funcs. The input value is used to determine the value for [[Network_Interface_services#CreateRequest|nn::nifm::RequestParameters]]: essentially, value 0x4 is used for ldn:u, and value 0x8 is used for ldn:s. The input value is also copied into state.

[[#GetState|State]] must be 0, this cmd eventually sets the State to value 1.

= ldn:u =
This is "nn::ldn::detail::IUserServiceCreator".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#CreateUserLocalCommunicationService]]
|}

== CreateUserLocalCommunicationService==
Returns an [[#IUserLocalCommunicationService]].

The user-process closes the IUserServiceCreator object immediately after using this cmd. Official sw ignores errors from this cmd.

== IUserLocalCommunicationService ==
This is "nn::ldn::detail::IUserLocalCommunicationService".

This is identical to [[#ISystemLocalCommunicationService]], except for the System-only cmd(s), and [[#Initialize]]/[[#Initialize2]] differ.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#GetState]]
|-
| 1 || [[#GetNetworkInfo]]
|-
| 2 || [[#GetIpv4Address]]
|-
| 3 || [[#GetDisconnectReason]]
|-
| 4 || [[#GetSecurityParameter]]
|-
| 5 || [[#GetNetworkConfig]]
|-
| 100 || [[#AttachStateChangeEvent]]
|-
| 101 || [[#GetNetworkInfoLatestUpdate]]
|-
| 102 || [[#Scan]]
|-
| 103 || [[#ScanPrivate]]
|-
| 104 || [5.0.0+] [[#SetWirelessControllerRestriction]]
|-
| 200 || [[#OpenAccessPoint]]
|-
| 201 || [[#CloseAccessPoint]]
|-
| 202 || [[#CreateNetwork]]
|-
| 203 || [[#CreateNetworkPrivate]]
|-
| 204 || [[#DestroyNetwork]]
|-
| 205 || [[#Reject]]
|-
| 206 || [[#SetAdvertiseData]]
|-
| 207 || [[#SetStationAcceptPolicy]]
|-
| 208 || [[#AddAcceptFilterEntry]]
|-
| 209 || [[#ClearAcceptFilter]]
|-
| 300 || [[#OpenStation]]
|-
| 301 || [[#CloseStation]]
|-
| 302 || [[#Connect]]
|-
| 303 || [[#ConnectPrivate]]
|-
| 304 || [[#Disconnect]]
|-
| 400 || [[#Initialize]]
|-
| 401 || [[#Finalize]]
|-
| 402 || [7.0.0+] [[#Initialize2]]
|}

=== Initialize ===
Takes an input PID and an u64 pid_placeholder.

This is used immediately after object creation.

With [7.0.0+] [[#Initialize2]] is used instead.

This is identical to [[#InitializeSystem]] except different params are used for the funcs called internally.

=== Finalize ===
No input/output.

This is used during service exit, prior to closing the object. Official sw will Abort if this fails.

This is identical to [[#FinalizeSystem]].

=== Initialize2 ===
Takes an input PID, an u32, and an u64 pid_placeholder.

Official sw uses hard-coded value 0x1 for the u32.

The input u32 is ignored, the impl for this cmd is identical to [[#Initialize]].

This is identical to [[#InitializeSystem2]] except different params are used for the funcs called internally: the u16 value is 0x5A, and the value for the second func is 1.

= ndd =
This is "nn::ndd::IService".

This was added with [5.0.0] and removed with [6.0.0].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || EnableAutoCommunication
|-
| 1 || DisableAutoCommunication
|-
| 2 || IsAutoCommunicationEnabled
|-
| 3 || EnablePowerSave
|-
| 4 || DisablePowerSave
|-
| 5 || IsPowerSaveEnabled
|-
| 6 || IsNetworkActive
|-
| 7 || AcquireSendDataUpdateEvent
|-
| 8 || AddSendData
|-
| 9 || ClearSendData
|-
| 10 || GetSendData
|-
| 11 || AcquireReceiveDataEvent
|-
| 12 || GetCurrentReceiveDataCounter
|-
| 13 || GetOldestReceiveDataCounter
|-
| 14 || GetNextReceiveDataCounter
|-
| 15 || GetAvailableReceiveDataCount
|-
| 16 || GetRecentReceiveDataCounter
|-
| 17 || GetReceiveData
|-
| 18 || AddReceiveData
|-
| 19 || ClearReceiveData
|-
| 20 || ClearDataIdFilter
|-
| 21 || AcquireDeviceScanEvent
|-
| 22 || StartDeviceScan
|-
| 23 || CancelDeviceScan
|-
| 24 || GetDeviceScanResult
|}

= lp2p:app, lp2p:sys =
These are "nn::lp2p::detail::INetworkServiceCreator".

These were added with [9.0.0+].

lp2p:app is used by [[Mario Kart Live: Home Circuit]]. lp2p:sys is used by [[Album_Applet|LibraryAppletPhotoViewer]] with [11.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#CreateNetworkService]]
|-
| 8 || [[#CreateNetworkServiceMonitor]]
|}

== CreateNetworkService ==
Takes a PID-descriptor, a reserved input u64 and an input u32. Returns an output [[#INetworkService]].

The input u32 must be value 0x1.

== CreateNetworkServiceMonitor ==
Takes a PID-descriptor and a reserved input u64. Returns an output [[#INetworkServiceMonitor]].

== INetworkService ==
This is "nn::lp2p::detail::INetworkService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Initialize|Initialize]]
|-
| [9.0.0-9.0.1] 256 || [[#AttachNetworkInterfaceStateChangeEvent]]
|-
| [9.0.0-9.0.1] 264 || [[#GetNetworkInterfaceLastError]]
|-
| [9.0.0-9.0.1] 272 || [[#GetRole]]
|-
| [9.0.0-9.0.1] 280 || [[#GetAdvertiseData]]
|-
| [9.0.0-9.0.1] 288 || [[#GetGroupInfo]]
|-
| [9.0.0-9.0.1] 296 || [[#GetGroupInfo2]]
|-
| [9.0.0-9.0.1] 304 || [[#GetGroupOwner]]
|-
| [9.0.0-9.0.1] 312 || [[#GetIpConfig]]
|-
| [9.0.0-9.0.1] 320 || [[#GetLinkLevel]]
|-
| 512 || [[#Scan]]
|-
| 768 || [[#CreateGroup]]
|-
| 776 || [[#DestroyGroup]]
|-
| 784 || [[#SetAdvertiseData]]
|-
| 1536 || [[#SendToOtherGroup]]
|-
| 1544 || [[#RecvFromOtherGroup]]
|-
| 1552 || [[#AddAcceptableGroupId]]
|-
| 1560 || [9.1.0+] [[#ClearAcceptableGroupId]]
|}

=== Initialize ===
No input/output.

Returns 0.

Unused by official sw.

=== Scan ===
Takes a type-0x19 input buffer containing a [[#GroupInfo]] and a type-0x22 output buffer containing an array of [[#ScanResult]]. Returns an output s32 '''TotalOut'''.

=== CreateGroup ===
Takes a type-0x31 input buffer containing a [[#GroupInfo]]. No output.

[[Mario Kart Live: Home Circuit|mklive]] uses the following string with this: "Failed to create a group: %08X".

The [[#GetRole|role]] must be 0. This eventually sets the [[#GetRole|role]] to value 1.

=== DestroyGroup ===
No input/output.

This destroys the previously [[#CreateGroup|created]] group. If no group was previously created ([[#GetRole|role]] is not 1), this just returns 0.

=== SetAdvertiseData ===
Takes a type-0x21 input buffer. No output.

The buffer size must be <=0x80. The [[#GetRole|role]] must be <=1.

A string in [[Mario Kart Live: Home Circuit|mklive]] refers to the buffer data as "scan advertise data".

=== SendToOtherGroup ===
Takes an input [[#MacAddress_2|MacAddress]], a [[#GroupId]], a s16 '''Frequency''', a s16 '''Channel''', an u32 '''MessageFlag''' and a type-0x21 input buffer. No output.

The buffer size must be <=0x400.

The MacAddress must be non-zero. The s16s must be >=1.

Only bit0 is used from flags: clear = block until the data can be sent, set = return error when the data can't be sent.

A string in [[Mario Kart Live: Home Circuit|mklive]] refers to the buffer data as "Action frame".

The [[#GetRole|role]] must be non-zero. The error from [[#GetNetworkInterfaceLastError]] will be returned if it's set.

[11.0.0+] [[#GroupInfo]]+0x8A must be value 2, otherwise an error is returned.

This sends an Action frame to the specified [[#GroupId]], with the specified destination [[#MacAddress_2|MacAddress]] (can be a broadcast address).

The frequency param is the same as the [[#GroupInfo]]+0x84 field.

=== RecvFromOtherGroup ===
Takes an input u32 '''MessageFlag''' and a type-0x22 output buffer. Returns a [[#MacAddress_2|MacAddress]], an u16 '''Frequency''', a s16 '''Channel''', an u32 '''OutSize''' and a s32.

The OutSize is the original size used for copying to the output buffer, before it's clamped to the output-buffer size.

Only bit0 is used from MessageFlag: clear = block until data is available, set = return error when data is not available.

When data is not available, the error from [[#GetNetworkInterfaceLastError]] will be returned if it's set.

The [[#GetRole|role]] must be non-zero.

This receives an Action frame.

=== AddAcceptableGroupId ===
Takes an input [[#GroupId]]. No output.

=== ClearAcceptableGroupId ===
No input/output.

== INetworkServiceMonitor ==
This is "nn::lp2p::detail::INetworkServiceMonitor".

This interface has no commands, until [9.1.0+] which added actual commands.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Initialize_2|Initialize]]
|-
| 256 || [[#AttachNetworkInterfaceStateChangeEvent]]
|-
| 264 || [[#GetNetworkInterfaceLastError]]
|-
| 272 || [[#GetRole]]
|-
| 280 || [[#GetAdvertiseData]]
|-
| 281 || [[#GetAdvertiseData2]]
|-
| 288 || [[#GetGroupInfo]]
|-
| 296 || [[#GetGroupInfo2]]
|-
| 304 || [[#GetGroupOwner]]
|-
| 312 || [[#GetIpConfig]]
|-
| 320 || [[#GetLinkLevel]]
|-
| 328 || [[#AttachJoinEvent]]
|-
| 336 || [[#GetMembers]]
|}

=== Initialize ===
Returns 0.

Unused by official sw.

=== AttachNetworkInterfaceStateChangeEvent ===
No input. Returns an output Event handle with EventClearMode=0.

=== GetNetworkInterfaceLastError ===
No input/output.

=== GetRole ===
No input. Returns an output u8.

=== GetAdvertiseData ===
Takes a type-0x22 output buffer. Returns two output u16s.

Validates that the [[#GetRole|role]] is value 2, then copies data from state into the output buffer. The first output u16 is the size used for the memcpy, the second u16 is the original size from state.

=== GetAdvertiseData2 ===
Takes a type-0x22 output buffer. Returns two output u16s.

This is identical to [[#GetAdvertiseData]] except this doesn't run the role validation.

=== GetGroupInfo ===
Takes a type-0x32 output buffer containing a [[#GroupInfo]].

Validates that the [[#GetRole|role]] is non-zero, then copies the struct from state into the output buffer.

=== GetGroupInfo2 ===
Takes a type-0x32 output buffer containing a [[#GroupInfo]] and a type-0x31 input buffer containing a [[#GroupInfo]].

This runs the same code as [[#CreateGroup]] to generate the [[#GroupInfo]] for the input struct (which with [[#CreateGroup]] would be available with [[#GetGroupInfo]]). The input struct is the same as [[#CreateGroup]].

=== GetGroupOwner ===
No input. Returns an output [[#NodeInfo_2|NodeInfo]].

Validates that the [[#GetRole|role]] is non-zero, then copies the data from state to output.

=== GetIpConfig ===
Takes a type-0x1A output buffer containing a 0x100-byte struct.

Validates that the [[#GetRole|role]] is non-zero, then copies the struct from state into the output buffer.

+0x20 is the <code>struct sockaddr</code> IP address, +0x40 is the <code>struct sockaddr</code> subnet-mask, +0x60 is the <code>struct sockaddr</code> gateway(?). The address for the last one is set to localhost.

=== GetLinkLevel ===
No input. Returns an output u32.

=== AttachJoinEvent ===
No input. Returns an output Event handle with EventClearMode=0.

=== GetMembers ===
Takes a type-0x22 output buffer containing an array of [[#NodeInfo_2|NodeInfo]]. Returns an output s32 '''TotalOut'''.

Validates that the [[#GetRole|role]] is value 1. Then any entries from state which are available are copied into the output array buffer, if there's space available. A maximum of 8 entries can be returned.

A string in [[Mario Kart Live: Home Circuit|mklive]] refers to the array data as "connected members".

= lp2p:m =
This is "nn::lp2p::detail::IMonitorServiceCreator".

This was added with [9.1.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#CreateMonitorService]]
|}

== CreateMonitorService ==
Takes a PID-descriptor, a reserved input u64 and an input u64. Returns an [[#IMonitorService]].

== IMonitorService ==
This is "nn::lp2p::detail::IMonitorService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Initialize_3|Initialize]]
|-
| 288 || [[#GetGroupInfo]]
|-
| 320 || [[#GetLinkLevel]]
|}

=== Initialize ===
Returns 0.

= Ipv4Address =
This is "nn::ldn::Ipv4Address". This is a 0x4-byte struct with 4-byte alignment.

This is essentially the same as <code>struct in_addr</code>, except this is little-endian.

This is generally "169.254.XXX.{...}", where XXX is random per created network.

= SubnetMask =
This is "nn::ldn::SubnetMask". This is a 0x4-byte struct with 4-byte alignment.

This is essentially the same as <code>struct in_addr</code>, except this is little-endian.

= Ssid =
This is "nn::ldn::Ssid".

When converting a Ssid to a string, the loaded chars from the string must be in the range of 0x20-0x7F, otherwise the byte written to the string will be 0.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || Length excluding NUL-terminator, must be 0x1-0x20.
|-
| 0x1 || 0x21 || SSID string including NUL-terminator, str[{above length}] must be 0.
|}

= NetworkInfo =
This is "nn::ldn::NetworkInfo". This is a 0x480-byte struct. The data at +0x50 is another struct.

The fields listed as Reserved (besides the fields before +0x10) are cleared during the memset and are not written to again afterwards, with cmds which return NetworkInfo.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || LocalCommunicationId
|-
| 0x8 || 0x2 || Reserved
|-
| 0xA || 0x2 || Arbitrary user data which can be used for filtering with [[#ScanFilter]].
|-
| 0xC || 0x4 || Reserved
|-
| 0x10 || 0x10 || Last 0x10-bytes of [[#SecurityParameter]]. NetworkId which is used to generate/overwrite the [[#Ssid]]. With [[#Scan]]/[[#ScanPrivate]], this is only done after filtering when +0x4B is value 0x2. The converted Ssid is a 0x20-byte lowercase hex string version of the input NetworkId.
|-
| 0x20 || 0x6 || [[#MacAddress|MacAddress]]
|-
| 0x26 || 0x22 || [[#Ssid]]
|-
| 0x48 || 0x2 || s16 NetworkChannel
|-
| 0x4A || 0x1 || s8 LinkLevel
|-
| 0x4B || 0x1 || Set to hard-coded value 0x2 with output structs, except with [[#Scan]]/[[#ScanPrivate]] which can also set value 0x1 in certain cases. 0x1 = normal network without an [[#ActionFrame]], 0x2 = LDN network with a valid [[#ActionFrame]].
|-
| 0x4C || 0x4 || Padding
|-
| 0x50 || 0x10 || First 0x10-bytes of [[#SecurityParameter]].
|-
| 0x60 || 0x2 || Same as [[#SecurityConfig]]+0x0.
|-
| 0x62 || 0x1 || [[#AcceptPolicy]]
|-
| 0x63 || 0x1 || Only set with [[#Scan]]/[[#ScanPrivate]], when +0x4B is value 0x2. See [[#ActionFrame]].
|-
| 0x64 || 0x2 || Padding
|-
| 0x66 || 0x1 || Maximum participants, for the [[#NodeInfo|NodeInfo]] array.
|-
| 0x67 || 0x1 || ParticipantNum, number of set entries in the [[#NodeInfo|NodeInfo]] array. If +0x4B is not 0x2, ParticipantNum should be handled as if it's 0.
|-
| 0x68 || 0x200(0x40*8) || Array of [[#NodeInfo|NodeInfo]] with 8 entries, starting with the AccessPoint node.
|-
| 0x268 || 0x2 || Reserved
|-
| 0x26A || 0x2 || AdvertiseData size
|-
| 0x26C || 0x180 || AdvertiseData
|-
| 0x3EC || 0x8C || Reserved
|-
| 0x478 || 0x8 || [6.0.0+] Random AuthenticationId. Set to the output from [[ETicket_services|es]] cmd1501 during network creation.
|}

= ScanFilter =
This is "nn::ldn::ScanFilter". This is a 0x60-byte struct with 8-byte alignment.

sdknso copies the input ScanFilter to a tmp struct on stack, which is then used with the cmd.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || When enabled, this will be overwritten if it's -1. The data written for this is the first [[NACP_Format|LocalCommunicationId]] for the user-process loaded via [[Glue_services|arp:r]], if loading fails value 0 is written instead. During filtering if enabled, u8 [[#NetworkInfo]]+0x4B must match 0x2, and this ScanFilter field must match [[#NetworkInfo]]+0x0.
|-
| 0x8 || 0x2 || Padding
|-
| 0xA || 0x2 || During filtering if enabled, u8 [[#NetworkInfo]]+0x4B must match 0x2, and this ScanFilter field must match [[#NetworkInfo]]+0xA.
|-
| 0xC || 0x4 || Padding
|-
| 0x10 || 0x10 || During filtering if enabled, u8 [[#NetworkInfo]]+0x4B must match 0x2, and this ScanFilter data must match [[#NetworkInfo]]+0x10.
|-
| 0x20 || 0x4 || When enabled, must be <=0x3, and during filtering must match u8 [[#NetworkInfo]]+0x4B.
|-
| 0x24 || 0x6 || [[#MacAddress|MacAddress]]. Only copied with [[#ScanPrivate]]. During filtering if enabled, this must match [[#NetworkInfo]]+0x20.
|-
| 0x2A || 0x22 || [[#Ssid]]. During filtering if enabled, this must match [[#NetworkInfo]]+0x26 (the [[#Ssid]] there must be valid for this as well). The strings are compared, without verifying the length field in [[#Ssid]] matches.
|-
| 0x4C || 0x10 || Cleared to zero for the tmp struct.
|-
| 0x5C || 0x4 || Flags. Masked with 0x37 for [[#Scan]], with [[#ScanPrivate]] this is masked with 0x3F.
|}

Flags:

{| class="wikitable" border="1"
|-
! Bit
! Description
|-
| 0 || When set, enables using ScanFilter+0.
|-
| 1 || When set, enables using ScanFilter+0x10.
|-
| 2 || When set, enables using ScanFilter+0x20.
|-
| 3 || When set, enables using the ScanFilter [[#MacAddress|MacAddress]].
|-
| 4 || When set, enables using the ScanFilter [[#Ssid]].
|-
| 5 || When set, enables using ScanFilter+0xA.
|}

= NetworkConfig =
This is "nn::ldn::NetworkConfig". This is a 0x20-byte struct with 8-byte alignment.

sdknso copies the input NetworkConfig to a tmp struct on stack, which is then used with the cmd ([[#CreateNetwork]], [[#CreateNetworkPrivate]], [[#ConnectPrivate]]).

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || LocalCommunicationId. Same as [[#NetworkInfo]]+0x0. [[#CreateNetwork]]/[[#CreateNetworkPrivate]]/[[#Connect]]/[[#ConnectPrivate]]: When -1, this is overwritten with the first [[NACP_Format|LocalCommunicationId]] for the user-process loaded via [[Glue_services|arp:r]], if loading fails value 0 is written instead. Otherwise when not -1, if control.nacp loading is successful with [[Glue_services|arp:r]], this field must match one of the LocalCommunicationIds from there otherwise an error is thrown.
|-
| 0x8 || 0x2 || Cleared to zero during the copy.
|-
| 0xA || 0x2 || Same as [[#NetworkInfo]]+0xA.
|-
| 0xC || 0x4 || Cleared to zero during the copy.
|-
| 0x10 || 0x2 || s16 Channel, can be zero. Same as [[#NetworkInfo]]+0x48.
|-
| 0x12 || 0x1 || s8. Same as [[#NetworkInfo]]+0x66. [[#CreateNetwork]]/[[#CreateNetworkPrivate]]: Must be 0x1-0x8.
|-
| 0x13 || 0x1 || Cleared to zero during the copy.
|-
| 0x14 || 0x2 || Same as [[#NetworkInfo]]+0x96 (LocalCommunicationVersion from the first [[#NodeInfo|NodeInfo]]). Must not be negative. [[#Connect]]/[[#ConnectPrivate]]: This must match the value for the AccessPoint LocalCommunicationVersion.
|-
| 0x16 || 0xA || Cleared to zero during the copy.
|}

= NodeLatestUpdate =
This is "nn::ldn::NodeLatestUpdate". This is a 0x8-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || The field in state is reset to zero by [[#GetNetworkInfoLatestUpdate]] after loading it. Official apps checks whether this is non-zero.
|-
| 0x1 || 0x7 || Not initialized with [[#GetNetworkInfoLatestUpdate]].
|}

= WirelessControllerRestriction =
This is "nn::ldn::WirelessControllerRestriction". This is an u32 enum.

This is used to determine the value passed to [[BTM_services|btm]] SetWlanMode.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 ||
|-
| 1 || This is the default.
|}

= SecurityConfig =
This is "nn::ldn::SecurityConfig". This is a 0x44-byte struct with 2-byte alignment.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x2 || Type, a default of value 1 can be used here. Overwritten by [[#CreateNetwork]]/[[#CreateNetworkPrivate]] and [[#Connect]]/[[#ConnectPrivate]]. The value used internally by these cmds must be 1-3.
|-
| 0x2 || 0x2 || Data size. Must be 0x10-0x40.
|-
| 0x4 || 0x40 || Data, used with key derivation.
|}

Type:
* 1-2: Broadcast Action frame data is encrypted and is verified with SHA256.
* 3: Broadcast Action frame data is plaintext and is verified with SHA256.

* 1: Data frames are encrypted.
* 2-3: Data frames for normal data-transfer are plaintext - the network is Open.

= SecurityParameter =
This is "nn::ldn::SecurityParameter". This is a 0x20-byte struct with 1-byte alignment.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x10 || Data, used with the same key derivation as [[#SecurityConfig]].
|-
| 0x10 || 0x10 || NetworkId, see [[#NetworkInfo]].
|}

= UserConfig =
This is "nn::ldn::UserConfig". This is a 0x30-byte struct with 1-byte alignment.

sdknso copies the input UserConfig to a tmp struct on stack, which is then used with the cmd.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x20 || NUL-terminated string for the user nickname.
|-
| 0x20 || 0x10 || Cleared to zero during the copy.
|}

= AddressEntry =
This is "nn::ldn::AddressEntry". This is a 0xC-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || [[#Ipv4Address]]
|-
| 0x4 || 0x6 || [[#MacAddress|MacAddress]]
|-
| 0xA || 0x2 || Padding
|}

= AcceptPolicy =
This is "nn::ldn::AcceptPolicy". This is an u8.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || Allow all.
|-
| 1 || Deny all.
|-
| 2 || Blacklist, addresses in the [[#AddAcceptFilterEntry|list]] are not allowed.
|-
| 3 || Whitelist, only addresses in the [[#AddAcceptFilterEntry|list]] are allowed.
|}

= MacAddress =
This is "nn::ldn::MacAddress". This is a 6-byte struct with 1-byte alignment.

= NodeInfo =
This is "nn::ldn::NodeInfo".

The fields listed as Reserved are cleared during the memset and are not written to again afterwards, with cmds which return [[#NetworkInfo]].

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || [[#Ipv4Address]]
|-
| 0x4 || 0x6 || [[#MacAddress|MacAddress]]
|-
| 0xA || 0x1 || s8 ID / index
|-
| 0xB || 0x1 || IsConnected
|-
| 0xC || 0x20 || First 0x20-bytes of [[#UserConfig]].
|-
| 0x2C || 0x2 || Reserved
|-
| 0x2E || 0x2 || s16 LocalCommunicationVersion
|-
| 0x30 || 0x10 || Reserved
|}

= ConnectOption =
This is "nn::ldn::ConnectOption". This is an u32 bitmask.

There's two versions of the sdknso funcs for [[#Connect]]/[[#ConnectPrivate]]: the version where the ConnectOption isn't user-specified uses a default value of 0x1 for it, with the same ShowError code without the bit0 check.

When bit0 here is set after using the above cmds, the sdknso funcs will use [[Error_Applet|ShowError]] with the returned Result if: (rc & 0x3FE1FF) == 0xE0CB.

This must be <=0x1, besides this validation ConnectOption is ignored by [[#Connect]]/[[#ConnectPrivate]].

= OperationMode =
This is "nn::ldn::OperationMode". This is an u32 enum.

This controls bit1 in the value passed to [[WLAN_services|wlan:lcl]] cmd0/cmd1: bit1 = OperationMode==1.

Value 1 seems to affect power (?) related fields in the beacon tags?

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || This is the default.
|-
| 1 ||
|}

= MacAddress =
This is "nn::lp2p::MacAddress". Same as [[#MacAddress|MacAddress]].

= GroupId =
This is "nn::lp2p::GroupId". This is a 6-byte struct with 1-byte alignment.

This is a WiFi BSSID.

= NodeInfo =
This is "nn::lp2p::NodeInfo". This is a 0x80-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || || <code>struct sockaddr</code> for the IP address.
|-
| 0x24 || 0x6 || [[#MacAddress_2|MacAddress]]
|}

= GroupInfo =
This is "nn::lp2p::GroupInfo". This is a 0x200-byte struct.

[[Mario Kart Live: Home Circuit|mklive]] sets the SSID to a string generated from random data.

[[#Scan_2|Scan]] only uses the following fields for the cmd input struct: SupportedPlatform/Priority, Frequency/Channel, and PresharedKeyBinarySize/PresharedKey.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x10 || Wrapped master key. When zero, set to randomly-generated data. This is decrypted with a "static AES key" and used to derive the 4 encryption keys for the session.
|-
| 0x10 || 0x8 || LocalCommunicationId. When zero, the value from control.nacp is loaded. This is later validated by [[#Join]]/[[#CreateGroup]] the same way as the [[#NetworkConfig]] field. Used during key derivation to derive keys B and D.
|-
| 0x18 || 0x6 || [[#GroupId]] ("GROUP ID (BSSID)"). When zero, the default is used. The default should be used here: an error is thrown if the data here doesn't match the output from [[WLAN_services|wlan:lcl]] cmd2.
|-
| 0x1E || 0x21 || ServiceName ("GROUP NAME (SSID)"). NUL-terminated string. See below.
|-
| 0x3F || 0x1 || s8 Flags count. Must be <=0x3F.
|-
| 0x40 || 0x40 || Array of s8 with the above count. Each entry value must be <=0x3F. Each entry is an array index used to load a set of flags from a global array with the specified index. global_flags are also masked with flags loaded from here. User-processes use entryval=1 as the default, with [11.0.0+] entryval=0 can be used for standard WPA2-PSK (see +0x8A).
|-
| 0x80 || 0x1 || SupportedPlatform. Must match value 1. 0 is PlatformIdNX, 1 is PlatformIdRcd.
|-
| 0x81 || 0x1 || MemberCountMax. s8, Must be <=0x8. During group creation this is passed to [[WLAN_services|wlan:lcl]] cmd40, when this is value 0 a default of value 1 is passed. During group-creation when the below +0x88 field is not value 0x2, the passed [[BTM_services#SetWlanMode|WlanMode]] is <code>x81_field_val > 3</code>.
|-
| 0x82 || 0x1 ||
|-
| 0x84 || 0x2 || Frequency. Wifi frequency: 24 = 2.4GHz, 50 = 5GHz.
|-
| 0x86 || 0x2 || s16 Channel ("CHANNEL"). Wifi channel number. 0 = use default, otherwise this must be one of the following depending on the frequency field:
* 24: 1, 6, 11.
* 50: 36, 40, 44, 48.
|-
| 0x88 || 0x1 || NetworkMode. Used during group-creation to determine the [[BTM_services#SetWlanMode|WlanMode]] to use. When this is value 0x2, mode=3 is used, otherwise it's determined via the +0x81 field.
|-
| 0x89 || 0x1 || PerformanceRequirement.
|-
| 0x8A || 0x1 || Security type, used during key derivation. 0 = use defaults, 1 = plaintext, 2 = encrypted. [11.0.0+] 3: Standard WPA2-PSK.
|-
| 0x8B || 0x1 || StaticAesKeyIndex. s8, used as the array-index for selecting the KeySource used with [[SPL_services#GenerateAesKek|GenerateAesKek]] during key derivation. Should be 1-2, otherwise GenerateAesKek is skipped and zeros are used for the AccessKey instead.
|-
| 0x8D || 0x1 || Priority. Must match one of the following, depending on the used service (doesn't apply to [[#Join]]): 55 = SystemPriority (lp2p:sys), 90 = ApplicationPriority (lp2p:app and lp2p:sys).
|-
| 0x8E || 0x1 || StealthEnabled. Bool flag, controls whether the SSID is hidden.
|-
| 0x8F || 0x1 || If zero, a default value of 0x20 is used.
|-
| 0x1C0 || 0x1 || PresharedKeyBinarySize. Must be 0x20 for PresharedKeyBinary. [11.0.0+] With WPA2-PSK, this must be value 1.
|-
| 0x1C1 || 0x3F ([9.0.0-10.2.0] 0x20) || PresharedKey. Used to derive encryption keys A and C. [11.0.0+] With WPA2-PSK, this is the passphrase string (length must be at least 8).
|}

In order for the ServiceName to be valid without a new one being generated, the following checks must pass:
* It loops through the characters in the string, looking for the first '_' character:
** The loop will exit once a '_' character is found.
** The character must be '-', or alphanumeric (lowercase/uppercase), otherwise the function will immediately return failure.
** The loop will also exit once string_pos is >19, in which case the function will also immediately return failure.
* Then it checks the 11 characters which follow the above:
** The character must be hex: '0'-'9', or 'A-F' / 'a-'f.
* The following character must be a NUL-terminator.
* The last hex character above, then the characters for the whole string prior to the last hex character are summed. return sum % 0x2B == 0. u32 is used for these calculations. (Return success when sum is a multiple of 0x2B, otherwise return failure)

If the above fails, then the following runs, otherwise it just returns 0:
* It loops through the characters in the string.
** The character must be '-', or alphanumeric (lowercase/uppercase), otherwise the function will immediately return failure.
** The loop will exit once string_pos>20 is reached, or when a NUL-terminator is reached.
* Once finished, success is returned if string_pos-1 is <20, otherwise failure is returned (which also immediately occurs if the first character is a NUL-terminator).

If the above fails, an error is returned, otherwise a new ServiceName is generated:
* Up to 20 characters are copied from the original ServiceName to the output ServiceName, stopping once the limit is reached or when a NUL-terminator is reached.
* '_' is appended to the string.
* <code>nn::util::TSNPrintf({strptr following the above character}, {remaining size}, "%02X%02X%02X%02X%02X", [[#GroupId|GroupId_byte3]], [[#GroupId|GroupId_byte4]], [[#GroupId|GroupId_byte5]], ([[SPL_services#IsDevelopment|IsDevelopment]] ? 0x80 : 0) | 0x1, 0);</code>
* Then the last character is set to the output from a calling a function:
** All string characters which were already written are summed same way as above. Then: <code>return character_lookup_table[sum % 0x2B];</code> (If the length passed to this function is 0, this will instead just return character_lookup_table[0])
*** character_lookup_table contains 0x2B entries: [V-A][k-a][5-0][Z-W].

loaded_flags are first loaded from elsewhere, then masked with the above flags when available. loaded_flags are used when +0x8A is 0. global_flags are loaded from global data. These flags are only used with [[#CreateGroup]]/[[#Join]]. Flags (note that the following was updated with [11.0.0+], and differs from below):
* Bit2 clear:
** global_flags must be non-zero, and loaded_flags bit1 must be set.
** u8 +0x8A is set to value 1.
** When the cached [[SPL_services#IsDevelopment|IsDevelopment]] value is false (retail), an error is thrown.
** u8 +0x8B is set to value 0.
* Otherwise, if bit2 is set:
** u8 +0x8A is set to value 2.
** global_flags bit1 set:
*** u8 +0x8B is set to value 1.
** Otherwise, if global_flags bit2 is set:
*** u8 +0x8B is set to value 2.

= ScanResult =
This is "nn::lp2p::ScanResult". This is a 0x300-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x200 || [[#GroupInfo]]
|-
| 0x200 || 0x1 ||
|-
| 0x206 || 0x2 || AdvertiseData size.
|-
| 0x208 || 0x80 || AdvertiseData
|}

= Network protocol =
== ldn ==
A beacon and Action frame are broadcasted. The SSID in the beacon is hidden (32-bytes with value 0). For [[#Scan]]/[[#ScanPrivate]] it doesn't matter if no beacon is available ([[#NetworkInfo]] is the same), as long as the Action frame is broadcasted. However, the Station will not send a probe-request during connection if no beacon is available (and therefore not attempt any communication with the AccessPoint). The beacon doesn't have any custom Nintendo data, that data is in the Acton frame.

During connection, the Station first sends a probe-request using the [[#NetworkInfo|generated]] SSID from the Action frame. If the probe-response contains the expected data for the [[#SecurityConfig]] type, the Station then proceeds to connect to the AccessPoint. The key for data-frames, if [[#SecurityConfig|enabled]], is derived from a buffer containing: {[[#SecurityParameter]]+0x0} followed by {[[#SecurityConfig]] data with the specified data-size}. The [[#ActionFrame]]/data-frame keys are derived with the same func, the only difference is the input passed to this func + the passed constant data. The key derived by ldn is used directly as the static CCMP key for all data-frames (CCMP / MIC is standard).

Then the Station scans for an [[#ActionFrame]] for loading the [[#NetworkInfo]].

Once connected, the AccessPoint sends Epigram-vendor Action frame(s) (same data) to the Station, the Station doesn't require these frames: <code>dd1afeedfacedeadbeef010000000a00000000000000000000000000</code>. Then the Station must Authenticate with the AccessPoint, this is custom. The Station sends a frame (a maximum of 3 times in some cases if errors occur, with the same data), and the AccessPoint sends a response. Once Authenticated, the node is added to the [[#NodeInfo|NodeInfo]] array in [[#NetworkInfo]]. If the Station does not successfully Authenticate X-seconds after connecting, the AccessPoint disconnects the Station. If the Station fails to Authenticate, the Station itself will disconnect as well.

After Authentication the Station will scan for another [[#ActionFrame]], with frame-comparision enabled with the above frame (frame must have been updated since the previous scan). The Station locates the index for a [[#MacAddress|MacAddress]] matching itself in the [[#NetworkInfo]] [[#NodeInfo|NodeInfo]] array (the entry for the AccessPoint is skipped), throwing an error if not found. After validating the LocalCommunicationVersion, it proceeds to handle ARP setup below.

This does not use DHCP, each node on the network has to manually setup ARP (without sending ARP network requests) with the [[#NodeInfo|NodeInfo]] array in [[#NetworkInfo]].

At this point standard sockets can be used over Data frames.

=== EthFrame ===
The custom Ethernet frames have the following structure:
* "Type: IEEE 802a OUI Extended Ethertype (0x88b7)"
* "IEEE802a OUI Extended Ethertype":
** "Organization Code: 00:22:aa (Nintendo Co., Ltd.)"
** "Protocol ID: {...}"
*** Depends on the frame:
*** 0x0102: [[#Authentication]]
*** 0x0103: ?
* The first byte of Data is value 0, then the ProtocolID-specific data follows, see below.
** ProtocolID 0x0103 frames are sent by the AccessPoint to the Station. This is 0x20-bytes of zeros, except for the first byte which is 0x3. This is sent by the AccessPoint prior to destroying the network.

==== Authentication ====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || [[#AuthVersion]]
|-
| 0x1 || 0x1 || Low u8 for the size.
|-
| 0x2 || 0x1 || Status. 0 = success, non-zero = error.
|-
| 0x3 || 0x1 || [2.0.0+] bool flag. The AccessPoint verifies that this is not set. Always set to 1 by the AccessPoint in the response. The Station only uses this when the [[#AuthVersion]] is >=2.
|-
| 0x4 || 0x1 || [6.0.0+] High u8 for the size.
|-
| 0x5 || 0x3 || Unused, zeros.
|-
| 0x8 || 0x20 || [[#NetworkInfo]]+0, must match the corresponding data in [[#NetworkInfo]] when the receiving node verifies this. With the
AccessPoint->Station frame, the Station verifies that this matches the data previously sent to the AccessPoint.
|-
| 0x28 || 0x10 || [[#NetworkInfo]]+0x50, must match the corresponding data in [[#NetworkInfo]] when the receiving node verifies this. With the
AccessPoint->Station frame, the Station verifies that this matches the data previously sent to the AccessPoint.
|-
| 0x38 || 0x10 || See below.
|-
| 0x48 || || Frame-specific data, with the above size. The total frame size - {offset of the start of this data in the frame} must match the above size.
|}

The Station sets the above size to 0x40 ([6.0.0+] if [[#NetworkInfo]]+0x13 is <3). [6.0.0+] The Authentication challenge is only used/enabled if that value is >=3, and [[#IUserLocalCommunicationService]] is being used.

The AccessPoint sets the above size to 0x40 ([6.0.0+] 0x0 if the +0x0 [[#AuthVersion]] is <3). [6.0.0+] The AccessPoint will only use/enable the Authentication challenge when the +0x0 [[#AuthVersion]] is >=3, and [[#IUserLocalCommunicationService]] is being used. This data will not be included in the frame if the status field indicates error.

[6.0.0+] Support for the Authentication challenge with [[ETicket_services|es]] cmds 1501-1504 was added.

Station->AccessPoint frame, relative to +0x0 above (frame size depends on whether +0xAC is enabled):

The AccessPoint will not respond to frames where the source mac-address is unrecognized.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x38 || 0x10 || The Station sets this to random data. Unused by the AccessPoint, except for copying into the response.
|-
| 0x48 || 0x20 || [[#UserConfig]]+0. Copied into state by the AccessPoint.
|-
| 0x68 || 0x2 || Big-endian LocalCommunicationVersion. Byte-swapped by the AccessPoint then copied into state.
|-
| 0x6A || 0x1E || Zeros, unused by the AccessPoint.
|-
| 0x88 || 0x24 || [6.0.0+] Zeros, unused by the AccessPoint.
|-
| 0xAC || 0x300 || [6.0.0+] Authentication challenge data. If enabled, the total frame size must be >= {end offset of this data in the frame}. The frame data does not include this if it's not enabled.
|}

AccessPoint->Station response frame, relative to +0x0 above (frame size depends on whether +0x48/+0xCC are enabled):

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x38 || 0x10 || +0x38 from the data originally sent by the Station. The Station verifies that this matches the previously sent data.
|-
| 0x48 || 0x40 || Zeros. [6.0.0+] Only included in the frame if it's enabled (+0x0 [[#AuthVersion]] >= 3). Unused by the Station.
|-
| 0x88 || 0x44 || [6.0.0+] Only included in the frame if it's enabled (+0x0 [[#AuthVersion]] >= 3). Unused by the Station.
|-
| 0xCC || 0x100 || [6.0.0+] If enabled, Authentication challenge response data. Not included in the frame if it's not enabled.
|}

===== AuthVersion =====
Must be 0x1-0xF.

{| class="wikitable" border="1"
|-
! Value || SystemVersion
|-
| 1 || [1.0.0+]
|-
| 2 || [2.0.0+]
|-
| 3 || [6.0.0+]
|}

=== ActionFrame ===
The Action frames have the following structure:
* "Fixed parameters":
** "Category code: Vendor Specific (127)"
** "OUI: 00:22:aa (Nintendo Co., Ltd.)"
* The Data starts with the following header:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x2 || 04 00 in sent frames.
|-
| 0x2 || 0x2 || Protocol ID, must be 0x0101.
|-
| 0x4 || 0x2 || Must be 0.
|-
| 0x6 || 0x2 || Zeros, unused.
|}

Then the actual data follows:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x20 || [[#NetworkInfo]]+0x0. The u64/u16 are big-endian. Outside of [[#Scan]]/[[#ScanPrivate]], this must match the previously loaded data for this.
|-
| 0x20 || 0x1 || [[#AuthVersion]]. Copied to [[#NetworkInfo]]+0x63. When comparing with a previous frame is enabled, this must match the value from the previous frame.
|-
| 0x21 || 0x1 || Encryption type: 1 = plaintext, 2 = encrypted, {frames with other values are ignored by [[#Scan]]/[[#ScanPrivate]]}. Must match the type which is currently being used: with [[#Scan]]/[[#ScanPrivate]] this is determined via this field, otherwise [[#SecurityConfig]] is used to determine this.
|-
| 0x22 || 0x2 || Big-endian u16 size for the data starting at +0x48, must be <=0x500, and must match {total frame size relative to +0x0 above} + 0x48.
|-
| 0x24 || 0x4 || Big-endian u32 Counter. The initial value is randomly-generated. This is incremented each time the below content is updated (including initial creation). Also used by the Station to determine whether the frame changed compared to a previous one. When comparing against a previous frame, new_counter-prev_counter must be <= 0xFF, and the counters must not match.
|-
| 0x28 || 0x20 || SHA256 hash over the entire frame starting at +0x0, with the above size + 0x48. During hashing, this hash is cleared, with the new hash overwriting the original in memory (the original is copied to stack for comparing).
|}

When encryption is enabled, the encrypted data is +0x28 with size {remaining frame size}. This is encrypted with AES-128-CTR. The key is derived from the raw 0x20-bytes at +0x0. The CTR is {raw Counter above without byte-swap}, with the rest cleared to zeros.

The content data at +0x48 follows, which has the size specified above (which must be >=0x500), where all fields are big-endian:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x10 || [[#NetworkInfo]]+0x50
|-
| 0x10 || 0x2 || [[#NetworkInfo]]+0x60
|-
| 0x12 || 0x1 || [[#NetworkInfo]]+0x62
|-
| 0x13 || 0x3 || Unused
|-
| 0x16 || 0x1 || s8 [[#NetworkInfo]]+0x66, clamped to range 1-8.
|-
| 0x17 || 0x1 || s8 [[#NetworkInfo]]+0x67, clamped to range 1-8.
|-
| 0x18 || 0x1C0(0x38*8) || Array of the below node struct.
|-
| 0x1D8 || 0x2 || Unused
|-
| 0x1DA || 0x2 || [[#NetworkInfo]]+0x26A
|-
| 0x1DC || 0x180 || [[#NetworkInfo]]+0x26C
|-
| 0x35C || 0x19C || Unused
|-
| 0x4F8 || 0x8 || [6.0.0+] [[#NetworkInfo]]+0x478
|}

The data here is copied into [[#NetworkInfo]].

Node data used in the above array (all fields big-endian), which are copied into the [[#NetworkInfo]] [[#NodeInfo|NodeInfo]] array:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || [[#Ipv4Address]]
|-
| 0x4 || 0x6 || [[#MacAddress|MacAddress]]
|-
| 0xA || 0x1 || bool IsConnected
|-
| 0xB || 0x1 || Unused
|-
| 0xC || 0x20 || First 0x20-bytes of [[#UserConfig]].
|-
| 0x2C || 0x2 || s16 LocalCommunicationVersion
|-
| 0x2E || 0xA || Unused
|}

== lp2p ==
This is used for communicating with accessories (external devices on [11.0.0+]) over local wifi. [[Mario Kart Live: Home Circuit]] uses this. [11.0.0+] [[Album_Applet|LibraryAppletPhotoViewer]] uses this.

A beacon is broadcasted.

Action frames are only sent when done so by [[#SendToOtherGroup]] (other than the Epigram one mentioned below).

Communication uses sockets with standard Data frames and the above Action frames. Switch consoles presumably only use the Action frames to communicate with each other?

Key A derived by ldn-sysmodule is used directly as the static CCMP key for all data-frames (CCMP / MIC is standard). However, with [[#GroupInfo]]+0x8A value 3, standard WPA2-PSK is used instead.

This uses infrastructure-mode (AccessPoint), and DHCP is used. The group-owner is the AccessPoint. Note that the probe response includes the same Nintendo tags included with the beacon. Once connected, the group-owner sends the same Epigram-vendor Action frame(s) described in [[#ldn]]. At this point socket communication can begin, including DHCP usage.

The DHCP server thread is started by the "nn.lp2p.StateMachine" thread eventually during group [[#CreateGroup|creation]]. The DHCP Offer option values are the following:
* "Subnet Mask: 255.255.255.0"
* "DHCP Server Identifier: {...}"
* "Broadcast Address: {...}"
* "IP Address Lease Time: (5s) 5 seconds"
* "Renewal Time Value: (0s) 0 seconds"
* "Rebinding Time Value: (0s) 0 seconds"
* "Interface MTU: 1500"

Note that the above options doesn't include "Domain Name Server" or "Router", the client device may fail to connect if it doesn't allow those DHCP options to be missing.

=== Beacon ===
The SSID in the beacon can optionally be [[#GroupInfo|hidden]] (all-zero with the same length as the original SSID). The beacon contains two vendor-specific Nintendo information elements with OUI <code>00:22:aa</code>; each IE has a 2-byte ID following the OUI. These Nintendo IEs are not used when standard WPA2-PSK is being used.

The beacon is identical to ldn, except for the following (besides SSID length difference and the lp2p-only Nintendo tags):
* "Tag: HT Capabilities (802.11n D1.10)": "HT Short GI for 20MHz" is set to "Not supported", for ldn it's "Supported".
* "Tag: Vendor Specific: Microsoft Corp.: WMM/WME: Parameter Element" "Ac Parameters ACI 0": "CW Min: 15" for lp2p, "CW Min: 63" for ldn.

Note that during group creation the beacon may be missing the Nintendo IEs in some cases, since group creation didn't finish yet.

==== Nintendo IE 0 ====

The first Nintendo IE (ID 0x0600) contains the following fixed parameters:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || Fixed 0x20; perhaps a version or other magic number.
|-
| 0x1 || 0x1 || [[#GroupInfo|SecurityType]]
|-
| 0x2 || 0x1 || [[#GroupInfo|StaticAesKeyIndex]]
|-
| 0x3 || 0x1 || Fixed zero; padding byte.
|-
| 0x4 || 0x8 || Big-endian (i.e. byte-reversed) version of [[#GroupInfo|LocalCommunicationId]]. This is the only context where LocalCommunicationId is reversed.
|-
| 0xC || 0x10 || Wrapped master key. Same as [[#GroupInfo]]+0x0.
|-
| 0x1C || 0x4 || If encryption is enabled, a randomly-generated nonce, else nothing. Appending 8 zero bytes to this yields the AES-GCM IV.
|-
| 0x20 || 0x10 || If encryption is enabled, the AES-GCM MAC tag, else nothing. All bytes prior to this (fixed 0x20 through nonce) are the additional authenticated data. All bytes after this are encrypted with key B.
|}

After this, TLV tagged parameters occur. Each TLV tag is formatted as:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || Tag type
|-
| 0x1 || 0x1 || Length
|-
| 0x2 || {above size} || Data for the tag
|}

Known TLV tags:

{| class="wikitable" border="1"
|-
! Type
! Size
! Description
|-
| 0x1 || 0x2 || Additional network parameters: 0xAB 0xCD. A=[[#GroupInfo]]+0x82, B=[[#GroupInfo|MemberCountMax]], C=[[#GroupInfo|NetworkMode]], D=[[#GroupInfo|PerformanceRequirement]].
|-
| 0x2 || 0x8 || Flags: Bitwise-or of (1<<f) for each entry in [[#GroupInfo]]+0x40
|}

==== Nintendo IE 1 ====

The second Nintendo IE (ID 0x0601) contains only TLVs. If encryption is enabled, a 0x4-byte nonce and 0x10-byte AES-GCM tag are written first, as above, and the TLVs are encrypted. Key C is used.

Known TLV tags:

{| class="wikitable" border="1"
|-
! Type
! Size
! Description
|-
| 0x21 || Varies || AdvertiseData
|}

=== ActionFrame ===
The Action frames have the following structure:
* "Fixed parameters":
** "Category code: Vendor Specific (127)"
** "OUI: 00:22:aa (Nintendo Co., Ltd.)"
* The Data starts with the following:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x2 || Usually 06 00?
|-
| 0x2 || 0x2 || Usually 20 02?(Second byte depends on whether encryption is used?)
|-
| 0x4 || 0x2 || Usually 02 00?(varies)
|-
| 0x6 || 0x8 || Big-endian version of [[#GroupInfo]]+0x10.
|-
| 0xE || 0x10 || Same as [[#GroupInfo]]+0x0.
|}

When encryption is used, the remaining data is:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || Big-endian u32 Counter. The initial value is randomly-generated (?). This is incremented with each sent Action frame.
|-
| 0x4 || {remaining size} || Encrypted user-data. Also includes 0x10-bytes of unknown data.
|}

When plaintext is used, the remaining data is:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || {remaining size} || Plaintext user-data.
|}

[[Category:Services]]

Mario Kart Live: Home Circuit

2021-02-26T17:10:12Z

CFSworks: /* Type 0x01: Battery Status */ First byte actually indicates cable status

This page documents the Mario Kart Live: Home Circuit game.

Communication with the kart is done directly over local-WLAN via an access point that the game sets up using [[LDN services|lp2p:app]], making it the first title on retail to use lp2p. The underlying device management uses [[RCD]]. The RCD implementation is in the main-codebin itself, without symbols - however there are strings for this.

This is also the first known title on retail which uses stack cookies. This is used by main-codebin, the ssp functionality in sdknso is still not used other than being called from an initialization func. This is implemented in the main-codebin as follows:

* The global u64 __stack_chk_guard is loaded then saved immediately before {first saved register} on stack, during func entry. During func exit, the global u64 is compared with the cookie on stack, it will call __stack_chk_fail on mismatch. __stack_chk_fail just executes an undefined instruction to trigger a crash.
* There is no initialization func for __stack_chk_guard, it's just a hard-coded constant: 0xDEADBEEFDEADBEEF. Since it's constant, this renders the stack cookie useless.

RomFs contains only two files:

* "data.zip"
* "update.pua": This is the firmware update data for the Kart. This is a tar archive. The extracted archive contains "update.pui" and "pui.hash". The latter is a binary 0x100-byte file. The former is another tar archive, the content of that archive is the following:
** "config.txt": Contains config which includes fields for efuse_key, efuse_fw, secure_boot, etc. Also references the data under generic/. Seems to be configuration for firmware installation, not uboot.
** "audiofw_sha": 0x20-byte binary SHA256 hash for the "bluecore.audio.aes" file.
** "dtb_sha": 0x20-byte binary SHA256 hash for the .dtb file.
** "rootfs_sha": 0x20-byte binary SHA256 hash for the "root.nand.cpio.gz_pad.img.aes" file.
** "tee_sha": 0x20-byte binary SHA256 hash for the tee file.
** "uImage_sha": 0x20-byte binary SHA256 hash for the "nand.uImage.aes" file.
** "generic/": This contains:
*** "android.nand.dtb": Plaintext "kernelDT".
*** "bluecore.audio.aes": Encrypted "audioKernel".
*** "nand.uImage.aes": Encrypted "linuxKernel".
*** "root.nand.cpio.gz_pad.img.aes": Encrypted "InitrdRootFS".
*** "tee.bin.aes": Encrypted "tee".

Note that the only firmware archive files accessed by the game are "update.pui", "pui.hash", and "config.txt". The content of "config.txt" is only used with sscanf() to extract the version fields. "update.pui"/"pui.hash" are probably sent over the network connection to the kart - it's unknown whether the game does anything with the content of "pui.hash" other than this.

= Kart =
The kart is likely codenamed "Fuji" as this is both what the game calls it internally, and how it identifies itself during RCD handshake. Various strings in the kart OSS refer to it as "DHC".

OSS is [https://www.nintendo.co.jp/support/oss/index.html available] for the kart itself.

This uses Linux. The 1.1.0_3 archive contains the following:
busybox-1.22.1.tar.bz2
eudev-1.5.3.tar.gz
kmod-17.tar.xz
libnl-3.2.24.tar.gz
linux-kernel_5c3cb2e0be2243f6d4553ccad2047c9d72e25ea2.tar.gz
lrzsz-0.12.20.tar.gz
PsdDriver_5a8d821.zip
rtl8188eu_074cc66fece232b0d5f1e1f7de57e72022ec12b1.tar.gz
uboot_53a0fa98b176329e340b0a2fca6edb7117209751.tar.gz
util-linux-2.24.2.tar.xz

PsdDriver is Nintendo's custom kernel module, the GPL license header used in the source starts with the following:
* Sensors and Motors driver
* Copyright (C) 2020 Nintendo Co, Ltd

The only changes in the OSS for 1.0.0_1 -> 1.1.0_3 are the following (note that there are more versions between these):

* The following archives were updated: linux-kernel, PsdDriver, rtl8188eu, uboot.
* In the PsdDriver source, the line-ending at the start of various source files was updated.
** In sources/psd_util.c, <code>initialize_table();</code> is now called by a dedicated <code>psd_util_init_crc8</code> function instead of <code>psd_util_get_crc8</code>, which is now called by <code>device_init</code> in sources/psd.c.

The above git-commit-hashes (?) from the filenames doesn't seem to match commits in the upstream repos.

On October 28, 2020, the existing OSS archives were updated without adding a new version. With 1.1.0_3, the uboot archive (which has the same filename) had the "/examples" directory removed.

== Hardware ==

{| class="wikitable" border="1"
!Component
!Manufacturer
!Part
!Notes
|-
|SoC
|Realtek
|RTD1195 (PB)
|Contains hardware H.264 encoder
|-
|DDR3 RAM
|Winbond
|W631GG6MB-15
|128 MiB
|-
|NAND Flash
|Winbond
|W29N01HVSINA
|128 MiB
|-
|WNIC
|Realtek
|RTL8188E
|Connected to SoC via USB
|-
|MCU
|STMicroelectronics
|STM32F
|Responsible for real-time steering and throttle control loops, six-axis IMU acquisition, GPIO, battery status
|-
|IMU
|STMicroelectronics
|LSM6DSL
|Unconfirmed. Mounted "upside-down" on the PCB: +X=right +Y=back +Z=down. Sensitivities: 4.375 m°/s, 0.244 mg.
|-
|Li-ion pouch cell
|Nintendo branded; OEM unknown
|HAC-038
|3.7V nominal; 1750 mAh capacity
|-
|Camera
|Unknown
|Unknown
|Possibly connected via MIPI CSI
|}

== Pairing process ==
The kart communicates with the Switch via standard 802.11 frames on channel 1/6/11, with standard CCMP encryption, but the authentication and key exchange protocol is Nintendo-proprietary. See [[LDN services]] for more information.

On first startup, ''Home Circuit'' generates a random SSID (beginning with 'G') and 0x20-byte PSK (for use in the aforementioned key exchange; it is not standard WPA). These are saved and reused on every subsequent startup, so that any kart(s) with this information stored can reconnect without needing to be paired again.

When pairing, ''Home Circuit'' creates a temporary network (random SSID beginning with 'P', randomized PSK, neither stored) and shows the details for this "pairing network" in a QR code for the kart to scan. Once the kart connects, it fetches the main "game" network SSID+PSK and stores them, and both it and ''Home Circuit'' exit pairing mode. The pairing network is only active while the QR code is displayed, otherwise the main "game" network runs.

The QR code is a "version 4" (33x33) code with level-M error correction. It uses byte encoding, and stores 0x3E bytes:

{| class="wikitable" border="1"
!Offset
!Size
!Description
|-
|0x0
|0x10
|Pairing seed. LP2P PSK is SHA256(seed)
|-
|0x10
|0x20
|Pairing SSID. Remaining space is filled with zeros.
|-
|0x30
|0x2
|Pairing channel. Encoded little-endian. Usually 0.
|-
|0x32
|0xC
|Padding bytes; zero.
|}

== Network protocols ==
Once the kart connects to the "game" network hosted by ''Home Circuit'', it requests an IP address via DHCP, then connects to the Switch via standard TCP/IP to announce its presence. A series of TCP and UDP connections are established to exchange information, stream video, transmit control signals, monitor kart telemetry, etc.

{| class="wikitable" border="1"
|+Summary of ports
!Protocol
!Endpoint
!Port
!Description
![[RCD]] service ID
|-
! colspan="5" |Management
|-
| rowspan="5" |TCP
| rowspan="2" |Switch
|5201
|[[RCD#Handshake protocol|RCD handshake]] service (pairing only)
|0x0001
|-
|5202
|RCD handshake service (non-pairing only)
|0x0001
|-
| rowspan="3" |Kart
|5103
|"Fuji Control" RCD service
|0x0100
|-
|5106
|"Fuji Pairing" RCD service (pairing only)
|0x0102
|-
|5107
|Unknown ("Event"?) RCD service
|0x0103
|-
|UDP
|Kart
|5004
|Time synchronization
|N/A
|-
! colspan="5" |Video
|-
|UDP
| rowspan="2" |Switch
|5016+kartid
|"LSP" video streaming
|N/A
|-
|TCP
|5032+kartid
|"LSP" control channel
|N/A (non-RCD)
|-
! colspan="5" |Control
|-
| rowspan="2" |UDP
|Kart
|5102
|Teleoperation (throttle, steering, tail light control)
|N/A
|-
|Switch
|5116+kartid
|Telemetry
|N/A
|}

Note: The ports determined by the kart ID are actually assigned by the Switch and configured via the "Fuji Control" service. The kart itself will actually use any port it is told to use; shown above are how ''Home Circuit'' calculates the port numbers.

=== Handshaking ===

After the kart connects to the LP2P network and requests an IP address via DHCP, it connects to the RCD handshake service. The port it uses is determined by whether it is in pairing mode (i.e. it learned the network details from a QR code) or not. When pairing, it connects to port 5201, otherwise it uses port 5202. The RCD handshake is the same in either case.

Upon a successful RCD handshake, the handshake channel is left open. The kart will then open ports 5103 and 5107 (or, when pairing, only port 5106) and expect a single connection on each: The listening socket is closed once connection(s) are established to prevent multiple connections, and if connection(s) aren't made within 5 seconds of a completed handshake, the kart will reset its network connection (it closes all TCP connections, releases its IP back to DHCP, disassociates the wireless link, and starts the connection process anew). It will also reset the network connection in this manner if any RCD connection is lost/closed.

=== "Fuji Pairing" RCD service ===

The pairing service implements a single command, and is only available immediately after a handshake and when pairing. A network reset will occur if the connection is idle for 1 second.

==== Command 0x01: SetGroupInfo ====

Accepts a 0x40-byte payload:
{| class="wikitable" border="1"
!Offset
!Size
!Description
|-
|0x00
|0x20
|SSID, zero-terminated. ''Home Circuit'' copies this straight from GroupInfo, so uninitialized bytes may follow.
|-
|0x20
|0x20
|LP2P PSK
|}

On success, responds with an empty payload. The kart commits these network settings to non-volatile memory immediately, replacing the old settings (if present). A network reset is initiated, and the kart exits pairing mode, using these newly-provided network settings after the reset. The Switch also exits pairing mode to accept the newly-paired kart.

=== "Fuji Control" RCD service ===

This service is used to set up and manage the kart. It is only available when not in pairing mode.

==== Command 0x01: GetSystemInfo ====

Takes no payload as input, returns:

{| class="wikitable" border="1"
!Offset
!Size
!Description
|-
|0x0
|0x1
|boot_major_version
|-
|0x1
|0x1
|boot_minor_version
|-
|0x2
|0x1
|system_major_version
|-
|0x3
|0x1
|system_minor_version
|-
|0x4
|0x29
|Zero-terminated ASCII string which is a 160-bit value in hexadecimal. Appears to be some kind of SHA1.
|}

==== Command 0x02: SetParam ====

Returns no output (on success) or error code 0x1060e8 if the parameter isn't recognized. Input:

{| class="wikitable" border="1"
!Offset
!Size
!Description
|-
|0x0
|0x80
|Parameter name, zero-padded.
|-
|0x80
|0x2
|Value length
|-
|0x82
|0xE
|Zero padding to align to 0x10-byte boundary
|-
|0x90
|Varies
|Value to set
|}

Setting the parameter "connection_info" is required to prepare the kart to drive. It can only be set once (trying to set it again gives error 0x1040e8). It expects (all values little-endian):

{| class="wikitable" border="1"
!Offset
!Size
!Description
|-
|0x0
|0x2
|Fixed 0x0001; unknown purpose.
|-
|0x2
|0x2
|Telemetry (UDP) port on Switch
|-
|0x4
|0x2
|"LSP" control (TCP) port on Switch
|-
|0x6
|0x2
|"LSP" video (UDP) port on Switch
|-
|0x8
|0x8
|Current network time, per nn::time::StandardNetworkSystemClock::GetCurrentTime. (A Unix timestamp with one-second precision.)
|}

==== Command 0x03: GetParam ====

Returns the value of the parameter (on success) or error code 0x1060e8. Expected input:

{| class="wikitable" border="1"
!Offset
!Size
!Description
|-
|0x00
|0x80
|Parameter name, zero-padded.
|}

One of the known parameters is "product_code" which includes the kart's character as 1 byte, and includes a string with the value of the kart's serial number on the bottom of the kart (white-label barcode).

{| class="wikitable" border="1"
!Offset
!Size
!Description
|-
|0x00
|0x80
|Fixed 0x010000; unknown purpose
|-
|0x3
|0x1
|Fixed 0x03; unknown purpose
|-
|0x7
|0x1
|Fixed 0x24; unknown purpose
|-
|0xC
|0x1
|Fixed 0x01; unknown purpose
|-
|0x11
|0x1
|Fixed 0x14; unknown purpose
|-
|0x20
|0x2
|Fixed 0x0100; padding
|-
|0x22
|0x1
|Character ID; 0x01 = Mario, 0x02 = Luigi, unknown if there are other "hidden" characters
|-
|0x23
|0x2
|Fixed 0x0001; padding
|-
|0x24
|0xF
|Kart Serial Number;
'''X''': Nintendo Switch Platform

'''Q''': Hardware Identifier for the Mario Kart Live: Home Circuit kart.

'''J'''/'''W''': Factory Location; Either '''W''': US, or '''J''': Japan

'''10'''/'''14'''/'''40'''/'''70:''' Factory Number

'''Last 9 Numbers''': Unit Number
|}

==== Command 0x04: SetState ====

This sets the kart between drive mode and "parked" mode. "connection_info" must be set first; it will return error 0x1040e8 if not. Returns an empty payload on success. It expects:

{| class="wikitable" border="1"
!Offset
!Size
!Description
|-
|0x0
|0x1
|Drive mode. 0x01 enables driving controls (and video), 0x00 puts the kart to "sleep."
|-
|0x1
|0xF
|Zero padding.
|}

==== Command 0x09: Shutdown ====

Takes no input and gives no output.

Disables the "network reset" behavior so that the kart will power off when the RCD channel(s) are closed.

==== Command 0x11: StartFluorescentLightDetection ====

TBD

==== Command 0x12: ReadApplicationData ====

Expects 0x20-byte zero-padded application ID (''Home Circuit'' uses "YVCOQ00000000XFB") and retrieves data stored in the kart unique to the application.

=== Teleoperation ===

The kart is operated over UDP port 5102. This port is only open when the kart is in [[#Command 0x04: SetState|drive state]]. It expects packets of the form:

{| class="wikitable" border="1"
!Offset
!Size
!Description
|-
|0x0
|0x1
|Throttle; a signed integer. -128 is full-speed reverse, +127 is full-speed forward.
|-
|0x1
|0x1
|Steering; a signed integer. -128 is full left, +127 is full right.
|-
|0x2
|0x1
|Brake light control. 0x00 turns the brake light off, 0x01 turns it on. This is independent of throttle.
|-
|0x3
|0x1
|Pad byte, apparently always zero.
|-
|0x4
|0x4?
|Little-endian packet counter. Incremented by 1 for each sent packet. Unknown total size.
|-
|0x8?
|0x18?
|Zero padding to bring the total packet size to 0x20.
|}

''Home Circuit'' sends these packets at 30 Hz. Any rate that is at least 1 Hz will do, however. The kart will automatically zero the throttle (and only the throttle) if a valid packet is not received in a one-second period, as protection from loss of control.

The counter appears to be intended as a mechanism for detecting duplicated/reordered packets, as such packets will have a counter that is not greater than the previously-accepted packet and can be quickly discarded. However, it appears to be ignored entirely by the kart. Nevertheless, it is a good idea to include it anyway.

'''NOTICE:''' The throttle/steering values take effect immediately. ''Home Circuit'' applies smoothing to these values, possibly to simulate the physics of a much more massive kart. However, this smoothing may also be necessary to keep the kart from suffering undue mechanical stress.

'''NOTICE:''' ''Home Circuit'' contains logic to detect when the kart is being held, and it locks out the controls in such cases. This logic is not implemented in the kart, which will eagerly follow any valid throttle/steering command given. The kart is not likely to cause injury if operated while held, but nevertheless, if you do so, it is at your own risk.

=== Telemetry ===

The kart will send UDP packets to the Switch over a port it specifies in "connection_info" (but typically port 5116) indicating its current status. The packet type is indicated by the first byte. (The tables below ignore this first byte.)

==== Type 0x01: Battery Status ====

{| class="wikitable" border="1"
!Offset
!Size
!Description
|-
|0x0
|0x1
|Cable status bitmask: 0x1 = Cable connected; 0x2 = Unknown; 0x4 = Unknown
|-
|0x1
|0x2
|Zero padding
|-
|0x3
|0x1
|How many bars to show in the HUD for battery status (0x00-0x04)
|-
|0x4
|0x1C
|Zero padding, to bring total packet length to 0x20.
|}

One would think this would be a good location for wireless metrics (e.g. RSSI), but this is presumably measured only on the Switch side of the link.

==== Type 0x02: IMU ====

The kart contains a 6DoF IMU for measuring movement. This packet type communicates the motion status.

All integers are little-endian:

{| class="wikitable" border="1"
!Offset
!Size
! colspan="2" |Description
|-
|0x0
|0x2
| colspan="2" |Total IMU samples, as an unsigned integer. This number includes the samples in this packet. It overflows.
|-
|0x2
|0x1
| colspan="2" |Flags bitfield: IGA??NNN. I/G/A=High-precision units used, ?=Unknown, possibly clipping indicators. N=Number of IMU samples.
|-
|0x3
|0x1
| colspan="2" |Pad byte; zero.
|-
|0x4
|0x4
| colspan="2" |Microsecond-precision timer, as an unsigned integer.
|-
|0x8
|0x10
| colspan="2" |Orientation: s32 qi, qj, qk, qr; gives the coefficients of a quaternion. Units appear to be increments of 2^-30, but quaternions should always be normalized before use.
|-
|0x18
|0xC
|Integrator A position
| rowspan="2" |s32 x, y, z; gives an estimate of total displacement since this integrator was reset. Every 6ms step: pos += vel>>12; Units: (4096*0.006)² * 2^-30 m (I=1), 78.4348 * (4096*0.006)² * 2^-30 m (I=0)
|-
|0x24
|0xC
|Integrator B position
|-
|0x30
|0xC
|Integrator A velocity
| rowspan="2" |s32 x, y, z; gives an estimate of total change in velocity since this integrator was reset. Every 6ms step: vel += acc>>12; (where 'acc' is acceleration in 2^-30 m/s²). Units: (4096*0.006) * 2^-30 m/s (I=1), 78.4348 * (4096*0.006) * 2^-30 m/s (I=0)
|-
|0x3C
|0xC
|Integrator B velocity
|-
| rowspan="2" |0x48
| rowspan="2" |0xC*(NNN+1)
| rowspan="2" |1-8 raw IMU samples
|s16 accel_x, accel_y, accel_z; // Units: 9.81/4096 m/s² (A=1), 15.99*9.81/4096 m/s² (A=0) (9.81m/s² added to accel_z to compensate for gravity)
|-
|s16 ang_vel_x, ang_vel_y, ang_vel_z; // Units: 0.004375 °/s (G=1), 0.1 °/s (G=0)
|}

The exact rate at which these packets are sent appears to be somewhat variable. The raw IMU samples seem to be collected with a period of 6ms, and when not in drive mode, this packet always contains 8 IMU samples, for an overall period 48ms. However, when in drive mode, not all of these packets contain exactly 8 IMU samples, and the packets will arrive at an uneven rate. This is probably due to some logic in the kart that flushes the buffer early based on certain conditions.

The IMU itself is mounted on the PCB "upside down" which gives a reference frame different from what one would expect: While +X does correspond to the driver's right-hand side, the +Y vector extends beyond the rear of the vehicle, and +Z extends out the bottom. All measurements are taken with respect to this reference frame.

The orientation quaternion is reasonably stable, but should still only be trusted for relative measurements over short periods of time, as the quaternion can drift due to error (noise, clipping, quantization) in the IMU samples. The quaternion is initialized to 0i+0j+0k+1 once the IMU is enabled (i.e. when "connection_info" is set).

The integrators are useful in an environment where packet loss is expected to be reasonably high, and so not all raw IMU samples can be reliably collected. The integrators are periodically reset (every 0x2000 samples), as they will accumulate error over time.

Both integrators are reset at the same time when the IMU is enabled, but integrator A is reset at sample 0x1000 so that the resets are staggered.

==== Type 0x03: Motion feedback ====

TBD

= Versions =
This section documents the changes for game-updates.

== v1.0.1 ==
This only updated the Kart firmware.

ExeFs:

* Nothing changed besides the usual NPDM update.

RomFs:

* Only update.pua was updated, the following was changed in the extracted update.pui (pui.hash in update.pua was also updated):
** "config.txt": system_minor_version was changed from "3" to "4".
** "audiofw_sha"
** "rootfs_sha"
** "uImage_sha"
** "generic/bluecore.audio.aes": Starts differing at offset 0x1D0.
** "generic/nand.uImage.aes": Starts differing at offset 0x0.
** "generic/root.nand.cpio.gz_pad.img.aes": Starts differing at offset 0x0.

RCD

2021-02-26T15:23:32Z

CFSworks: Document RCD handshake

RCD is a framework that manages '''r'''emote '''c'''ontrolled '''d'''evices - RC toys that connect to the Nintendo Switch via 802.11 ("WiFi") link. The first (and currently only) released product to use this framework is [[Mario Kart Live: Home Circuit]].

RCD devices must be paired to the host Switch system in some way (e.g. QR code) and contain the connection settings in non-volatile memory so that they can reconnect on next use without needing to repeat the pairing process.

The RCD framework implements a very simple TCP-based RPC protocol that allows an RCD client to invoke methods on an RCD server. Note that multiple such connections may be established between the Switch and device.

= RCD RPC =

A client connects to a TCP server and sends as many commands as it likes, one at a time (and reading the response after each), before tearing down the TCP connection. It is not valid for a client to send a response to a server or for a server to send a request to a client.

Commands have a 0x10-byte header, followed by a payload of any size up to some maximum (typically 0x1000). All numbers are represented in big-endian format.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x2 || Service being accessed
|-
| 0x2 || 0x2 || Command being invoked on that service
|-
| 0x4 || 0x4 || Payload length (PLEN)
|-
| 0x8 || 0x4 || Status code; ignored (and set to 0) for requests, an [[Error codes|error code]] for responses
|-
| 0xC || 0x1 || Flags; currently only the 1s bit is significant: it indicates a response
|-
| 0xD || 0x3 || Padding; zero.
|-
| 0x10 || PLEN || The parameters to the command, or the response
|}

In theory, multiple "services" could be multiplexed over a single TCP connection, but in practice only a single service is allowed per TCP port.

= Handshake protocol =

Service ID: 0x0001<br />
Commands: 4

When a device first establishes a wireless connection, it connects to the Switch on a well-known port to access the "handshake" service and make its presence known. A successful handshake causes application-specific RCD connections to be established. Commands must be sent in order (and no more than once), or error code 0x810e8 is generated by the host.

== Command 0x1: Begin handshake ==

{| class="wikitable" border="1"
|+ Command 0x1 input+output payload
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x10 || Handshake protocol version; one byte followed by zero-padding. Must be 1.
|-
| 0x10 || 0x10 || Device "name" (e.g. 'Fuji'), followed by zero-padding. The Switch uses the empty string.
|-
| 0x20 || 0x10 || Device identifier. Devices embed their MAC as the last 6 bytes; host seems to use a randomly-generated UUID.
|-
| 0x30 || 0x20 || Nonce; cryptographic random bytes with no special purpose.
|}

This command is sent first (by the device). The host responds in kind. Error code 0x800e8 is generated if the handshake version is not 1.

== Command 0x2: Version negotiation ==

{| class="wikitable" border="1"
|+ Command 0x2 input payload
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x20 || Pairing identifier
|-
| 0x20 || 0x1 || Number of versions offered
|-
| 0x21 || Varies || One 8-bit integer per version offered. There is no padding.
|}

{| class="wikitable" border="1"
|+ Command 0x2 output payload
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x20 || Pairing identifier
|-
| 0x20 || 0x1 || Selected version
|-
| 0x21 || 0xF || Zero-padding
|}

There are a few moving parts here.

Firstly, this command is responsible for negotiating a version for the underlying protocols. The host looks at all versions offered by the device and selects the newest version that it recognizes. Error code 0x820e8 is sent if no (recognized) versions are offered.

Secondly, the device sends its "pairing identifier," if it recognizes the name/identifier of the host (from command 0x1). If the device does not recognize the host, it sends all-zeroes instead. If the host recognizes the pairing identifier for the device, it sends that same identifier back and expects command 0x4 next (and command 0x3, if sent, will result in error code 0x810e8). If the host doesn't recognize the identifier, it will either send error code 0x850e8 (if it isn't expecting to pair) or send a randomly-generated identifier and expect command 0x3 next.

== Command 0x3: Get secret key ==

{| class="wikitable" border="1"
|+ Command 0x3 input payload
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x20 || Unknown; always all zeroes?
|}

{| class="wikitable" border="1"
|+ Command 0x3 output payload
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x40 || Secret key
|}

When a new pairing is being established (see command 0x2), this is used to request the secret key generated for the pairing. It's currently unknown what purpose this "secret key" has.

When not expected (including when the RCD host isn't set up for pairing), it generates error code 0x810e8.

== Command 0x4: Finalize ==

{| class="wikitable" border="1"
|+ Command 0x4 input payload
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x20 || SHA256 of all payloads (not headers) up to this point after truncation to a multiple of 0x40 bytes.
|}

{| class="wikitable" border="1"
|+ Command 0x4 output payload
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x20 || SHA256 of all payloads (not headers) up to this point, including the input to this command.
|}

This is used to finalize the handshake. SHA256 hashes of the handshake up to this point are exchanged, as an integrity check. If the client sends the wrong hash, error code 0x830e8 is sent. If the device sends the correct hash, the host responds with its own hash, and carries on with using the device.

If the device accepts the response, it leaves the channel open, and activates other network services for the host to use. If the device rejects the response, it closes the channel, resets its networking stack, and attempts the connection again from scratch. Closing the handshake channel at any point afterward will trigger this same behavior.

Mario Kart Live: Home Circuit

2021-02-19T11:19:09Z

CFSworks: /* Network protocols */ Never mind about "Fuji Update" - I don't know what this RCD service is

This page documents the Mario Kart Live: Home Circuit game.

Communication with the kart is done directly over local-WLAN via an access point that the game sets up using [[LDN services|lp2p:app]], making it the first title on retail to use lp2p. The underlying device management uses [[RCD]]. The RCD implementation is in the main-codebin itself, without symbols - however there are strings for this.

This is also the first known title on retail which uses stack cookies. This is used by main-codebin, the ssp functionality in sdknso is still not used other than being called from an initialization func. This is implemented in the main-codebin as follows:

* The global u64 __stack_chk_guard is loaded then saved immediately before {first saved register} on stack, during func entry. During func exit, the global u64 is compared with the cookie on stack, it will call __stack_chk_fail on mismatch. __stack_chk_fail just executes an undefined instruction to trigger a crash.
* There is no initialization func for __stack_chk_guard, it's just a hard-coded constant: 0xDEADBEEFDEADBEEF. Since it's constant, this renders the stack cookie useless.

RomFs contains only two files:

* "data.zip"
* "update.pua": This is the firmware update data for the Kart. This is a tar archive. The extracted archive contains "update.pui" and "pui.hash". The latter is a binary 0x100-byte file. The former is another tar archive, the content of that archive is the following:
** "config.txt": Contains config which includes fields for efuse_key, efuse_fw, secure_boot, etc. Also references the data under generic/. Seems to be configuration for firmware installation, not uboot.
** "audiofw_sha": 0x20-byte binary SHA256 hash for the "bluecore.audio.aes" file.
** "dtb_sha": 0x20-byte binary SHA256 hash for the .dtb file.
** "rootfs_sha": 0x20-byte binary SHA256 hash for the "root.nand.cpio.gz_pad.img.aes" file.
** "tee_sha": 0x20-byte binary SHA256 hash for the tee file.
** "uImage_sha": 0x20-byte binary SHA256 hash for the "nand.uImage.aes" file.
** "generic/": This contains:
*** "android.nand.dtb": Plaintext "kernelDT".
*** "bluecore.audio.aes": Encrypted "audioKernel".
*** "nand.uImage.aes": Encrypted "linuxKernel".
*** "root.nand.cpio.gz_pad.img.aes": Encrypted "InitrdRootFS".
*** "tee.bin.aes": Encrypted "tee".

Note that the only firmware archive files accessed by the game are "update.pui", "pui.hash", and "config.txt". The content of "config.txt" is only used with sscanf() to extract the version fields. "update.pui"/"pui.hash" are probably sent over the network connection to the kart - it's unknown whether the game does anything with the content of "pui.hash" other than this.

= Kart =
The kart is likely codenamed "Fuji" as this is both what the game calls it internally, and how it identifies itself during RCD handshake. Various strings in the kart OSS refer to it as "DHC".

OSS is [https://www.nintendo.co.jp/support/oss/index.html available] for the kart itself.

This uses Linux. The 1.1.0_3 archive contains the following:
busybox-1.22.1.tar.bz2
eudev-1.5.3.tar.gz
kmod-17.tar.xz
libnl-3.2.24.tar.gz
linux-kernel_5c3cb2e0be2243f6d4553ccad2047c9d72e25ea2.tar.gz
lrzsz-0.12.20.tar.gz
PsdDriver_5a8d821.zip
rtl8188eu_074cc66fece232b0d5f1e1f7de57e72022ec12b1.tar.gz
uboot_53a0fa98b176329e340b0a2fca6edb7117209751.tar.gz
util-linux-2.24.2.tar.xz

PsdDriver is Nintendo's custom kernel module, the GPL license header used in the source starts with the following:
* Sensors and Motors driver
* Copyright (C) 2020 Nintendo Co, Ltd

The only changes in the OSS for 1.0.0_1 -> 1.1.0_3 are the following (note that there are more versions between these):

* The following archives were updated: linux-kernel, PsdDriver, rtl8188eu, uboot.
* In the PsdDriver source, the line-ending at the start of various source files was updated.
** In sources/psd_util.c, <code>initialize_table();</code> is now called by a dedicated <code>psd_util_init_crc8</code> function instead of <code>psd_util_get_crc8</code>, which is now called by <code>device_init</code> in sources/psd.c.

The above git-commit-hashes (?) from the filenames doesn't seem to match commits in the upstream repos.

On October 28, 2020, the existing OSS archives were updated without adding a new version. With 1.1.0_3, the uboot archive (which has the same filename) had the "/examples" directory removed.

== Hardware ==

{| class="wikitable" border="1"
!Component
!Manufacturer
!Part
!Notes
|-
|SoC
|Realtek
|RTD1195 (PB)
|Contains hardware H.264 encoder
|-
|DDR3 RAM
|Winbond
|W631GG6MB-15
|128 MiB
|-
|NAND Flash
|Winbond
|W29N01HVSINA
|128 MiB
|-
|WNIC
|Realtek
|RTL8188E
|Connected to SoC via USB
|-
|MCU
|STMicroelectronics
|STM32F
|Responsible for real-time steering and throttle control loops, six-axis IMU acquisition, GPIO, battery status
|-
|IMU
|STMicroelectronics
|LSM6DSL
|Unconfirmed. Mounted "upside-down" on the PCB: +X=right +Y=back +Z=down. Sensitivities: 4.375 m°/s, 0.244 mg.
|-
|Li-ion pouch cell
|Nintendo branded; OEM unknown
|HAC-038
|3.7V nominal; 1750 mAh capacity
|-
|Camera
|Unknown
|Unknown
|Possibly connected via MIPI CSI
|}

== Pairing process ==
The kart communicates with the Switch via standard 802.11 frames on channel 1/6/11, with standard CCMP encryption, but the authentication and key exchange protocol is Nintendo-proprietary. See [[LDN services]] for more information.

On first startup, ''Home Circuit'' generates a random SSID (beginning with 'G') and 0x20-byte PSK (for use in the aforementioned key exchange; it is not standard WPA). These are saved and reused on every subsequent startup, so that any kart(s) with this information stored can reconnect without needing to be paired again.

When pairing, ''Home Circuit'' creates a temporary network (random SSID beginning with 'P', randomized PSK, neither stored) and shows the details for this "pairing network" in a QR code for the kart to scan. Once the kart connects, it fetches the main "game" network SSID+PSK and stores them, and both it and ''Home Circuit'' exit pairing mode. The pairing network is only active while the QR code is displayed, otherwise the main "game" network runs.

The QR code is a "version 4" (33x33) code with level-M error correction. It uses byte encoding, and stores 0x3E bytes:

{| class="wikitable" border="1"
!Offset
!Size
!Description
|-
|0x0
|0x10
|Pairing seed. LP2P PSK is SHA256(seed)
|-
|0x10
|0x20
|Pairing SSID. Remaining space is filled with zeros.
|-
|0x30
|0x2
|Pairing channel. Encoded little-endian. Usually 0.
|-
|0x32
|0xC
|Padding bytes; zero.
|}

== Network protocols ==
Once the kart connects to the "game" network hosted by ''Home Circuit'', it requests an IP address via DHCP, then connects to the Switch via standard TCP/IP to announce its presence. A series of TCP and UDP connections are established to exchange information, stream video, transmit control signals, monitor kart telemetry, etc.

{| class="wikitable" border="1"
|+Summary of ports
!Protocol
!Endpoint
!Port
!Description
![[RCD]] service ID
|-
! colspan="5" |Management
|-
| rowspan="5" |TCP
| rowspan="2" |Switch
|5201
|[[RCD#Handshake protocol|RCD handshake]] service (pairing only)
|0x0001
|-
|5202
|RCD handshake service (non-pairing only)
|0x0001
|-
| rowspan="3" |Kart
|5103
|"Fuji Control" RCD service
|0x0100
|-
|5106
|"Fuji Pairing" RCD service (pairing only)
|0x0102
|-
|5107
|Unknown ("Event"?) RCD service
|0x0103
|-
|UDP
|Kart
|5004
|Time synchronization
|N/A
|-
! colspan="5" |Video
|-
|UDP
| rowspan="2" |Switch
|5016+kartid
|"LSP" video streaming
|N/A
|-
|TCP
|5032+kartid
|"LSP" control channel
|N/A (non-RCD)
|-
! colspan="5" |Control
|-
| rowspan="2" |UDP
|Kart
|5102
|Teleoperation (throttle, steering, tail light control)
|N/A
|-
|Switch
|5116+kartid
|Telemetry
|N/A
|}

Note: The ports determined by the kart ID are actually assigned by the Switch and configured via the "Fuji Control" service. The kart itself will actually use any port it is told to use; shown above are how ''Home Circuit'' calculates the port numbers.

=== Handshaking ===

After the kart connects to the LP2P network and requests an IP address via DHCP, it connects to the RCD handshake service. The port it uses is determined by whether it is in pairing mode (i.e. it learned the network details from a QR code) or not. When pairing, it connects to port 5201, otherwise it uses port 5202. The RCD handshake is the same in either case.

Upon a successful RCD handshake, the handshake channel is left open. The kart will then open ports 5103 and 5107 (or, when pairing, only port 5106) and expect a single connection on each: The listening socket is closed once connection(s) are established to prevent multiple connections, and if connection(s) aren't made within 5 seconds of a completed handshake, the kart will reset its network connection (it closes all TCP connections, releases its IP back to DHCP, disassociates the wireless link, and starts the connection process anew). It will also reset the network connection in this manner if any RCD connection is lost/closed.

=== "Fuji Pairing" RCD service ===

The pairing service implements a single command, and is only available immediately after a handshake and when pairing. A network reset will occur if the connection is idle for 1 second.

==== Command 0x01: SetGroupInfo ====

Accepts a 0x40-byte payload:
{| class="wikitable" border="1"
!Offset
!Size
!Description
|-
|0x00
|0x20
|SSID, zero-terminated. ''Home Circuit'' copies this straight from GroupInfo, so uninitialized bytes may follow.
|-
|0x20
|0x20
|LP2P PSK
|}

On success, responds with an empty payload. The kart commits these network settings to non-volatile memory immediately, replacing the old settings (if present). A network reset is initiated, and the kart exits pairing mode, using these newly-provided network settings after the reset. The Switch also exits pairing mode to accept the newly-paired kart.

=== "Fuji Control" RCD service ===

This service is used to set up and manage the kart. It is only available when not in pairing mode.

==== Command 0x01: GetSystemInfo ====

Takes no payload as input, returns:

{| class="wikitable" border="1"
!Offset
!Size
!Description
|-
|0x0
|0x1
|boot_major_version
|-
|0x1
|0x1
|boot_minor_version
|-
|0x2
|0x1
|system_major_version
|-
|0x3
|0x1
|system_minor_version
|-
|0x4
|0x29
|Zero-terminated ASCII string which is a 160-bit value in hexadecimal. Appears to be some kind of SHA1.
|}

==== Command 0x02: SetParam ====

Returns no output (on success) or error code 0x1060e8 if the parameter isn't recognized. Input:

{| class="wikitable" border="1"
!Offset
!Size
!Description
|-
|0x0
|0x80
|Parameter name, zero-padded.
|-
|0x80
|0x2
|Value length
|-
|0x82
|0xE
|Zero padding to align to 0x10-byte boundary
|-
|0x90
|Varies
|Value to set
|}

Setting the parameter "connection_info" is required to prepare the kart to drive. It can only be set once (trying to set it again gives error 0x1040e8). It expects (all values little-endian):

{| class="wikitable" border="1"
!Offset
!Size
!Description
|-
|0x0
|0x2
|Fixed 0x0001; unknown purpose.
|-
|0x2
|0x2
|Telemetry (UDP) port on Switch
|-
|0x4
|0x2
|"LSP" control (TCP) port on Switch
|-
|0x6
|0x2
|"LSP" video (UDP) port on Switch
|-
|0x8
|0x8
|Current network time, per nn::time::StandardNetworkSystemClock::GetCurrentTime. (A Unix timestamp with one-second precision.)
|}

==== Command 0x03: GetParam ====

Returns the value of the parameter (on success) or error code 0x1060e8. Expected input:

{| class="wikitable" border="1"
!Offset
!Size
!Description
|-
|0x00
|0x80
|Parameter name, zero-padded.
|}

One of the known parameters is "product_code" which includes the kart's character as 1 byte, and includes a string with the value of the kart's serial number on the bottom of the kart (white-label barcode).

{| class="wikitable" border="1"
!Offset
!Size
!Description
|-
|0x00
|0x80
|Fixed 0x010000; unknown purpose
|-
|0x3
|0x1
|Fixed 0x03; unknown purpose
|-
|0x7
|0x1
|Fixed 0x24; unknown purpose
|-
|0xC
|0x1
|Fixed 0x01; unknown purpose
|-
|0x11
|0x1
|Fixed 0x14; unknown purpose
|-
|0x20
|0x2
|Fixed 0x0100; padding
|-
|0x22
|0x1
|Character ID; 0x01 = Mario, 0x02 = Luigi, unknown if there are other "hidden" characters
|-
|0x23
|0x2
|Fixed 0x0001; padding
|-
|0x24
|0xF
|Kart Serial Number;
'''X''': Nintendo Switch Platform

'''Q''': Hardware Identifier for the Mario Kart Live: Home Circuit kart.

'''J'''/'''W''': Factory Location; Either '''W''': US, or '''J''': Japan

'''10'''/'''14'''/'''40'''/'''70:''' Factory Number

'''Last 9 Numbers''': Unit Number
|}

==== Command 0x04: SetState ====

This sets the kart between drive mode and "parked" mode. "connection_info" must be set first; it will return error 0x1040e8 if not. Returns an empty payload on success. It expects:

{| class="wikitable" border="1"
!Offset
!Size
!Description
|-
|0x0
|0x1
|Drive mode. 0x01 enables driving controls (and video), 0x00 puts the kart to "sleep."
|-
|0x1
|0xF
|Zero padding.
|}

==== Command 0x09: Shutdown ====

Takes no input and gives no output.

Disables the "network reset" behavior so that the kart will power off when the RCD channel(s) are closed.

==== Command 0x11: StartFluorescentLightDetection ====

TBD

==== Command 0x12: ReadApplicationData ====

Expects 0x20-byte zero-padded application ID (''Home Circuit'' uses "YVCOQ00000000XFB") and retrieves data stored in the kart unique to the application.

=== Teleoperation ===

The kart is operated over UDP port 5102. This port is only open when the kart is in [[#Command 0x04: SetState|drive state]]. It expects packets of the form:

{| class="wikitable" border="1"
!Offset
!Size
!Description
|-
|0x0
|0x1
|Throttle; a signed integer. -128 is full-speed reverse, +127 is full-speed forward.
|-
|0x1
|0x1
|Steering; a signed integer. -128 is full left, +127 is full right.
|-
|0x2
|0x1
|Brake light control. 0x00 turns the brake light off, 0x01 turns it on. This is independent of throttle.
|-
|0x3
|0x1
|Pad byte, apparently always zero.
|-
|0x4
|0x4?
|Little-endian packet counter. Incremented by 1 for each sent packet. Unknown total size.
|-
|0x8?
|0x18?
|Zero padding to bring the total packet size to 0x20.
|}

''Home Circuit'' sends these packets at 30 Hz. Any rate that is at least 1 Hz will do, however. The kart will automatically zero the throttle (and only the throttle) if a valid packet is not received in a one-second period, as protection from loss of control.

The counter appears to be intended as a mechanism for detecting duplicated/reordered packets, as such packets will have a counter that is not greater than the previously-accepted packet and can be quickly discarded. However, it appears to be ignored entirely by the kart. Nevertheless, it is a good idea to include it anyway.

'''NOTICE:''' The throttle/steering values take effect immediately. ''Home Circuit'' applies smoothing to these values, possibly to simulate the physics of a much more massive kart. However, this smoothing may also be necessary to keep the kart from suffering undue mechanical stress.

'''NOTICE:''' ''Home Circuit'' contains logic to detect when the kart is being held, and it locks out the controls in such cases. This logic is not implemented in the kart, which will eagerly follow any valid throttle/steering command given. The kart is not likely to cause injury if operated while held, but nevertheless, if you do so, it is at your own risk.

=== Telemetry ===

The kart will send UDP packets to the Switch over a port it specifies in "connection_info" (but typically port 5116) indicating its current status. The packet type is indicated by the first byte. (The tables below ignore this first byte.)

==== Type 0x01: Battery Status ====

{| class="wikitable" border="1"
!Offset
!Size
!Description
|-
|0x0
|0x3
|Zero padding
|-
|0x3
|0x1
|How many bars to show in the HUD for battery status (0x00-0x04)
|-
|0x4
|0x1C
|Zero padding, to bring total packet length to 0x20.
|}

One would think this would be a good location for wireless metrics (e.g. RSSI), but this is presumably measured only on the Switch side of the link.

==== Type 0x02: IMU ====

The kart contains a 6DoF IMU for measuring movement. This packet type communicates the motion status.

All integers are little-endian:

{| class="wikitable" border="1"
!Offset
!Size
! colspan="2" |Description
|-
|0x0
|0x2
| colspan="2" |Total IMU samples, as an unsigned integer. This number includes the samples in this packet. It overflows.
|-
|0x2
|0x1
| colspan="2" |Flags bitfield: IGA??NNN. I/G/A=High-precision units used, ?=Unknown, possibly clipping indicators. N=Number of IMU samples.
|-
|0x3
|0x1
| colspan="2" |Pad byte; zero.
|-
|0x4
|0x4
| colspan="2" |Microsecond-precision timer, as an unsigned integer.
|-
|0x8
|0x10
| colspan="2" |Orientation: s32 qi, qj, qk, qr; gives the coefficients of a quaternion. Units appear to be increments of 2^-30, but quaternions should always be normalized before use.
|-
|0x18
|0xC
|Integrator A position
| rowspan="2" |s32 x, y, z; gives an estimate of total displacement since this integrator was reset. Every 6ms step: pos += vel>>12; Units: (4096*0.006)² * 2^-30 m (I=1), 78.4348 * (4096*0.006)² * 2^-30 m (I=0)
|-
|0x24
|0xC
|Integrator B position
|-
|0x30
|0xC
|Integrator A velocity
| rowspan="2" |s32 x, y, z; gives an estimate of total change in velocity since this integrator was reset. Every 6ms step: vel += acc>>12; (where 'acc' is acceleration in 2^-30 m/s²). Units: (4096*0.006) * 2^-30 m/s (I=1), 78.4348 * (4096*0.006) * 2^-30 m/s (I=0)
|-
|0x3C
|0xC
|Integrator B velocity
|-
| rowspan="2" |0x48
| rowspan="2" |0xC*(NNN+1)
| rowspan="2" |1-8 raw IMU samples
|s16 accel_x, accel_y, accel_z; // Units: 9.81/4096 m/s² (A=1), 15.99*9.81/4096 m/s² (A=0) (9.81m/s² added to accel_z to compensate for gravity)
|-
|s16 ang_vel_x, ang_vel_y, ang_vel_z; // Units: 0.004375 °/s (G=1), 0.1 °/s (G=0)
|}

The exact rate at which these packets are sent appears to be somewhat variable. The raw IMU samples seem to be collected with a period of 6ms, and when not in drive mode, this packet always contains 8 IMU samples, for an overall period 48ms. However, when in drive mode, not all of these packets contain exactly 8 IMU samples, and the packets will arrive at an uneven rate. This is probably due to some logic in the kart that flushes the buffer early based on certain conditions.

The IMU itself is mounted on the PCB "upside down" which gives a reference frame different from what one would expect: While +X does correspond to the driver's right-hand side, the +Y vector extends beyond the rear of the vehicle, and +Z extends out the bottom. All measurements are taken with respect to this reference frame.

The orientation quaternion is reasonably stable, but should still only be trusted for relative measurements over short periods of time, as the quaternion can drift due to error (noise, clipping, quantization) in the IMU samples. The quaternion is initialized to 0i+0j+0k+1 once the IMU is enabled (i.e. when "connection_info" is set).

The integrators are useful in an environment where packet loss is expected to be reasonably high, and so not all raw IMU samples can be reliably collected. The integrators are periodically reset (every 0x2000 samples), as they will accumulate error over time.

Both integrators are reset at the same time when the IMU is enabled, but integrator A is reset at sample 0x1000 so that the resets are staggered.

==== Type 0x03: Motion feedback ====

TBD

= Versions =
This section documents the changes for game-updates.

== v1.0.1 ==
This only updated the Kart firmware.

ExeFs:

* Nothing changed besides the usual NPDM update.

RomFs:

* Only update.pua was updated, the following was changed in the extracted update.pui (pui.hash in update.pua was also updated):
** "config.txt": system_minor_version was changed from "3" to "4".
** "audiofw_sha"
** "rootfs_sha"
** "uImage_sha"
** "generic/bluecore.audio.aes": Starts differing at offset 0x1D0.
** "generic/nand.uImage.aes": Starts differing at offset 0x0.
** "generic/root.nand.cpio.gz_pad.img.aes": Starts differing at offset 0x0.

Mario Kart Live: Home Circuit

2021-02-19T11:06:14Z

CFSworks: /* Type 0x02: IMU */ Fix units

This page documents the Mario Kart Live: Home Circuit game.

Communication with the kart is done directly over local-WLAN via an access point that the game sets up using [[LDN services|lp2p:app]], making it the first title on retail to use lp2p. The underlying device management uses [[RCD]]. The RCD implementation is in the main-codebin itself, without symbols - however there are strings for this.

This is also the first known title on retail which uses stack cookies. This is used by main-codebin, the ssp functionality in sdknso is still not used other than being called from an initialization func. This is implemented in the main-codebin as follows:

* The global u64 __stack_chk_guard is loaded then saved immediately before {first saved register} on stack, during func entry. During func exit, the global u64 is compared with the cookie on stack, it will call __stack_chk_fail on mismatch. __stack_chk_fail just executes an undefined instruction to trigger a crash.
* There is no initialization func for __stack_chk_guard, it's just a hard-coded constant: 0xDEADBEEFDEADBEEF. Since it's constant, this renders the stack cookie useless.

RomFs contains only two files:

* "data.zip"
* "update.pua": This is the firmware update data for the Kart. This is a tar archive. The extracted archive contains "update.pui" and "pui.hash". The latter is a binary 0x100-byte file. The former is another tar archive, the content of that archive is the following:
** "config.txt": Contains config which includes fields for efuse_key, efuse_fw, secure_boot, etc. Also references the data under generic/. Seems to be configuration for firmware installation, not uboot.
** "audiofw_sha": 0x20-byte binary SHA256 hash for the "bluecore.audio.aes" file.
** "dtb_sha": 0x20-byte binary SHA256 hash for the .dtb file.
** "rootfs_sha": 0x20-byte binary SHA256 hash for the "root.nand.cpio.gz_pad.img.aes" file.
** "tee_sha": 0x20-byte binary SHA256 hash for the tee file.
** "uImage_sha": 0x20-byte binary SHA256 hash for the "nand.uImage.aes" file.
** "generic/": This contains:
*** "android.nand.dtb": Plaintext "kernelDT".
*** "bluecore.audio.aes": Encrypted "audioKernel".
*** "nand.uImage.aes": Encrypted "linuxKernel".
*** "root.nand.cpio.gz_pad.img.aes": Encrypted "InitrdRootFS".
*** "tee.bin.aes": Encrypted "tee".

Note that the only firmware archive files accessed by the game are "update.pui", "pui.hash", and "config.txt". The content of "config.txt" is only used with sscanf() to extract the version fields. "update.pui"/"pui.hash" are probably sent over the network connection to the kart - it's unknown whether the game does anything with the content of "pui.hash" other than this.

= Kart =
The kart is likely codenamed "Fuji" as this is both what the game calls it internally, and how it identifies itself during RCD handshake. Various strings in the kart OSS refer to it as "DHC".

OSS is [https://www.nintendo.co.jp/support/oss/index.html available] for the kart itself.

This uses Linux. The 1.1.0_3 archive contains the following:
busybox-1.22.1.tar.bz2
eudev-1.5.3.tar.gz
kmod-17.tar.xz
libnl-3.2.24.tar.gz
linux-kernel_5c3cb2e0be2243f6d4553ccad2047c9d72e25ea2.tar.gz
lrzsz-0.12.20.tar.gz
PsdDriver_5a8d821.zip
rtl8188eu_074cc66fece232b0d5f1e1f7de57e72022ec12b1.tar.gz
uboot_53a0fa98b176329e340b0a2fca6edb7117209751.tar.gz
util-linux-2.24.2.tar.xz

PsdDriver is Nintendo's custom kernel module, the GPL license header used in the source starts with the following:
* Sensors and Motors driver
* Copyright (C) 2020 Nintendo Co, Ltd

The only changes in the OSS for 1.0.0_1 -> 1.1.0_3 are the following (note that there are more versions between these):

* The following archives were updated: linux-kernel, PsdDriver, rtl8188eu, uboot.
* In the PsdDriver source, the line-ending at the start of various source files was updated.
** In sources/psd_util.c, <code>initialize_table();</code> is now called by a dedicated <code>psd_util_init_crc8</code> function instead of <code>psd_util_get_crc8</code>, which is now called by <code>device_init</code> in sources/psd.c.

The above git-commit-hashes (?) from the filenames doesn't seem to match commits in the upstream repos.

On October 28, 2020, the existing OSS archives were updated without adding a new version. With 1.1.0_3, the uboot archive (which has the same filename) had the "/examples" directory removed.

== Hardware ==

{| class="wikitable" border="1"
!Component
!Manufacturer
!Part
!Notes
|-
|SoC
|Realtek
|RTD1195 (PB)
|Contains hardware H.264 encoder
|-
|DDR3 RAM
|Winbond
|W631GG6MB-15
|128 MiB
|-
|NAND Flash
|Winbond
|W29N01HVSINA
|128 MiB
|-
|WNIC
|Realtek
|RTL8188E
|Connected to SoC via USB
|-
|MCU
|STMicroelectronics
|STM32F
|Responsible for real-time steering and throttle control loops, six-axis IMU acquisition, GPIO, battery status
|-
|IMU
|STMicroelectronics
|LSM6DSL
|Unconfirmed. Mounted "upside-down" on the PCB: +X=right +Y=back +Z=down. Sensitivities: 4.375 m°/s, 0.244 mg.
|-
|Li-ion pouch cell
|Nintendo branded; OEM unknown
|HAC-038
|3.7V nominal; 1750 mAh capacity
|-
|Camera
|Unknown
|Unknown
|Possibly connected via MIPI CSI
|}

== Pairing process ==
The kart communicates with the Switch via standard 802.11 frames on channel 1/6/11, with standard CCMP encryption, but the authentication and key exchange protocol is Nintendo-proprietary. See [[LDN services]] for more information.

On first startup, ''Home Circuit'' generates a random SSID (beginning with 'G') and 0x20-byte PSK (for use in the aforementioned key exchange; it is not standard WPA). These are saved and reused on every subsequent startup, so that any kart(s) with this information stored can reconnect without needing to be paired again.

When pairing, ''Home Circuit'' creates a temporary network (random SSID beginning with 'P', randomized PSK, neither stored) and shows the details for this "pairing network" in a QR code for the kart to scan. Once the kart connects, it fetches the main "game" network SSID+PSK and stores them, and both it and ''Home Circuit'' exit pairing mode. The pairing network is only active while the QR code is displayed, otherwise the main "game" network runs.

The QR code is a "version 4" (33x33) code with level-M error correction. It uses byte encoding, and stores 0x3E bytes:

{| class="wikitable" border="1"
!Offset
!Size
!Description
|-
|0x0
|0x10
|Pairing seed. LP2P PSK is SHA256(seed)
|-
|0x10
|0x20
|Pairing SSID. Remaining space is filled with zeros.
|-
|0x30
|0x2
|Pairing channel. Encoded little-endian. Usually 0.
|-
|0x32
|0xC
|Padding bytes; zero.
|}

== Network protocols ==
Once the kart connects to the "game" network hosted by ''Home Circuit'', it requests an IP address via DHCP, then connects to the Switch via standard TCP/IP to announce its presence. A series of TCP and UDP connections are established to exchange information, stream video, transmit control signals, monitor kart telemetry, etc.

{| class="wikitable" border="1"
|+Summary of ports
!Protocol
!Endpoint
!Port
!Description
![[RCD]] service ID
|-
! colspan="5" |Management
|-
| rowspan="5" |TCP
| rowspan="2" |Switch
|5201
|[[RCD#Handshake protocol|RCD handshake]] service (pairing only)
|0x0001
|-
|5202
|RCD handshake service (non-pairing only)
|0x0001
|-
| rowspan="3" |Kart
|5103
|"Fuji Control" RCD service
|0x0100
|-
|5106
|"Fuji Pairing" RCD service (pairing only)
|0x0102
|-
|5107
|"Fuji Update" RCD service
|0x0103
|-
|UDP
|Kart
|5004
|Time synchronization
|N/A
|-
! colspan="5" |Video
|-
|UDP
| rowspan="2" |Switch
|5016+kartid
|"LSP" video streaming
|N/A
|-
|TCP
|5032+kartid
|"LSP" control channel
|N/A (non-RCD)
|-
! colspan="5" |Control
|-
| rowspan="2" |UDP
|Kart
|5102
|Teleoperation (throttle, steering, tail light control)
|N/A
|-
|Switch
|5116+kartid
|Telemetry
|N/A
|}

Note: The ports determined by the kart ID are actually assigned by the Switch and configured via the "Fuji Control" service. The kart itself will actually use any port it is told to use; shown above are how ''Home Circuit'' calculates the port numbers.

=== Handshaking ===

After the kart connects to the LP2P network and requests an IP address via DHCP, it connects to the RCD handshake service. The port it uses is determined by whether it is in pairing mode (i.e. it learned the network details from a QR code) or not. When pairing, it connects to port 5201, otherwise it uses port 5202. The RCD handshake is the same in either case.

Upon a successful RCD handshake, the handshake channel is left open. The kart will then open ports 5103 and 5107 (or, when pairing, only port 5106) and expect a single connection on each: The listening socket is closed once connection(s) are established to prevent multiple connections, and if connection(s) aren't made within 5 seconds of a completed handshake, the kart will reset its network connection (it closes all TCP connections, releases its IP back to DHCP, disassociates the wireless link, and starts the connection process anew). It will also reset the network connection in this manner if any RCD connection is lost/closed.

=== "Fuji Pairing" RCD service ===

The pairing service implements a single command, and is only available immediately after a handshake and when pairing. A network reset will occur if the connection is idle for 1 second.

==== Command 0x01: SetGroupInfo ====

Accepts a 0x40-byte payload:
{| class="wikitable" border="1"
!Offset
!Size
!Description
|-
|0x00
|0x20
|SSID, zero-terminated. ''Home Circuit'' copies this straight from GroupInfo, so uninitialized bytes may follow.
|-
|0x20
|0x20
|LP2P PSK
|}

On success, responds with an empty payload. The kart commits these network settings to non-volatile memory immediately, replacing the old settings (if present). A network reset is initiated, and the kart exits pairing mode, using these newly-provided network settings after the reset. The Switch also exits pairing mode to accept the newly-paired kart.

=== "Fuji Control" RCD service ===

This service is used to set up and manage the kart. It is only available when not in pairing mode.

==== Command 0x01: GetSystemInfo ====

Takes no payload as input, returns:

{| class="wikitable" border="1"
!Offset
!Size
!Description
|-
|0x0
|0x1
|boot_major_version
|-
|0x1
|0x1
|boot_minor_version
|-
|0x2
|0x1
|system_major_version
|-
|0x3
|0x1
|system_minor_version
|-
|0x4
|0x29
|Zero-terminated ASCII string which is a 160-bit value in hexadecimal. Appears to be some kind of SHA1.
|}

==== Command 0x02: SetParam ====

Returns no output (on success) or error code 0x1060e8 if the parameter isn't recognized. Input:

{| class="wikitable" border="1"
!Offset
!Size
!Description
|-
|0x0
|0x80
|Parameter name, zero-padded.
|-
|0x80
|0x2
|Value length
|-
|0x82
|0xE
|Zero padding to align to 0x10-byte boundary
|-
|0x90
|Varies
|Value to set
|}

Setting the parameter "connection_info" is required to prepare the kart to drive. It can only be set once (trying to set it again gives error 0x1040e8). It expects (all values little-endian):

{| class="wikitable" border="1"
!Offset
!Size
!Description
|-
|0x0
|0x2
|Fixed 0x0001; unknown purpose.
|-
|0x2
|0x2
|Telemetry (UDP) port on Switch
|-
|0x4
|0x2
|"LSP" control (TCP) port on Switch
|-
|0x6
|0x2
|"LSP" video (UDP) port on Switch
|-
|0x8
|0x8
|Current network time, per nn::time::StandardNetworkSystemClock::GetCurrentTime. (A Unix timestamp with one-second precision.)
|}

==== Command 0x03: GetParam ====

Returns the value of the parameter (on success) or error code 0x1060e8. Expected input:

{| class="wikitable" border="1"
!Offset
!Size
!Description
|-
|0x00
|0x80
|Parameter name, zero-padded.
|}

One of the known parameters is "product_code" which includes the kart's character as 1 byte, and includes a string with the value of the kart's serial number on the bottom of the kart (white-label barcode).

{| class="wikitable" border="1"
!Offset
!Size
!Description
|-
|0x00
|0x80
|Fixed 0x010000; unknown purpose
|-
|0x3
|0x1
|Fixed 0x03; unknown purpose
|-
|0x7
|0x1
|Fixed 0x24; unknown purpose
|-
|0xC
|0x1
|Fixed 0x01; unknown purpose
|-
|0x11
|0x1
|Fixed 0x14; unknown purpose
|-
|0x20
|0x2
|Fixed 0x0100; padding
|-
|0x22
|0x1
|Character ID; 0x01 = Mario, 0x02 = Luigi, unknown if there are other "hidden" characters
|-
|0x23
|0x2
|Fixed 0x0001; padding
|-
|0x24
|0xF
|Kart Serial Number;
'''X''': Nintendo Switch Platform

'''Q''': Hardware Identifier for the Mario Kart Live: Home Circuit kart.

'''J'''/'''W''': Factory Location; Either '''W''': US, or '''J''': Japan

'''10'''/'''14'''/'''40'''/'''70:''' Factory Number

'''Last 9 Numbers''': Unit Number
|}

==== Command 0x04: SetState ====

This sets the kart between drive mode and "parked" mode. "connection_info" must be set first; it will return error 0x1040e8 if not. Returns an empty payload on success. It expects:

{| class="wikitable" border="1"
!Offset
!Size
!Description
|-
|0x0
|0x1
|Drive mode. 0x01 enables driving controls (and video), 0x00 puts the kart to "sleep."
|-
|0x1
|0xF
|Zero padding.
|}

==== Command 0x09: Shutdown ====

Takes no input and gives no output.

Disables the "network reset" behavior so that the kart will power off when the RCD channel(s) are closed.

==== Command 0x11: StartFluorescentLightDetection ====

TBD

==== Command 0x12: ReadApplicationData ====

Expects 0x20-byte zero-padded application ID (''Home Circuit'' uses "YVCOQ00000000XFB") and retrieves data stored in the kart unique to the application.

=== Teleoperation ===

The kart is operated over UDP port 5102. This port is only open when the kart is in [[#Command 0x04: SetState|drive state]]. It expects packets of the form:

{| class="wikitable" border="1"
!Offset
!Size
!Description
|-
|0x0
|0x1
|Throttle; a signed integer. -128 is full-speed reverse, +127 is full-speed forward.
|-
|0x1
|0x1
|Steering; a signed integer. -128 is full left, +127 is full right.
|-
|0x2
|0x1
|Brake light control. 0x00 turns the brake light off, 0x01 turns it on. This is independent of throttle.
|-
|0x3
|0x1
|Pad byte, apparently always zero.
|-
|0x4
|0x4?
|Little-endian packet counter. Incremented by 1 for each sent packet. Unknown total size.
|-
|0x8?
|0x18?
|Zero padding to bring the total packet size to 0x20.
|}

''Home Circuit'' sends these packets at 30 Hz. Any rate that is at least 1 Hz will do, however. The kart will automatically zero the throttle (and only the throttle) if a valid packet is not received in a one-second period, as protection from loss of control.

The counter appears to be intended as a mechanism for detecting duplicated/reordered packets, as such packets will have a counter that is not greater than the previously-accepted packet and can be quickly discarded. However, it appears to be ignored entirely by the kart. Nevertheless, it is a good idea to include it anyway.

'''NOTICE:''' The throttle/steering values take effect immediately. ''Home Circuit'' applies smoothing to these values, possibly to simulate the physics of a much more massive kart. However, this smoothing may also be necessary to keep the kart from suffering undue mechanical stress.

'''NOTICE:''' ''Home Circuit'' contains logic to detect when the kart is being held, and it locks out the controls in such cases. This logic is not implemented in the kart, which will eagerly follow any valid throttle/steering command given. The kart is not likely to cause injury if operated while held, but nevertheless, if you do so, it is at your own risk.

=== Telemetry ===

The kart will send UDP packets to the Switch over a port it specifies in "connection_info" (but typically port 5116) indicating its current status. The packet type is indicated by the first byte. (The tables below ignore this first byte.)

==== Type 0x01: Battery Status ====

{| class="wikitable" border="1"
!Offset
!Size
!Description
|-
|0x0
|0x3
|Zero padding
|-
|0x3
|0x1
|How many bars to show in the HUD for battery status (0x00-0x04)
|-
|0x4
|0x1C
|Zero padding, to bring total packet length to 0x20.
|}

One would think this would be a good location for wireless metrics (e.g. RSSI), but this is presumably measured only on the Switch side of the link.

==== Type 0x02: IMU ====

The kart contains a 6DoF IMU for measuring movement. This packet type communicates the motion status.

All integers are little-endian:

{| class="wikitable" border="1"
!Offset
!Size
! colspan="2" |Description
|-
|0x0
|0x2
| colspan="2" |Total IMU samples, as an unsigned integer. This number includes the samples in this packet. It overflows.
|-
|0x2
|0x1
| colspan="2" |Flags bitfield: IGA??NNN. I/G/A=High-precision units used, ?=Unknown, possibly clipping indicators. N=Number of IMU samples.
|-
|0x3
|0x1
| colspan="2" |Pad byte; zero.
|-
|0x4
|0x4
| colspan="2" |Microsecond-precision timer, as an unsigned integer.
|-
|0x8
|0x10
| colspan="2" |Orientation: s32 qi, qj, qk, qr; gives the coefficients of a quaternion. Units appear to be increments of 2^-30, but quaternions should always be normalized before use.
|-
|0x18
|0xC
|Integrator A position
| rowspan="2" |s32 x, y, z; gives an estimate of total displacement since this integrator was reset. Every 6ms step: pos += vel>>12; Units: (4096*0.006)² * 2^-30 m (I=1), 78.4348 * (4096*0.006)² * 2^-30 m (I=0)
|-
|0x24
|0xC
|Integrator B position
|-
|0x30
|0xC
|Integrator A velocity
| rowspan="2" |s32 x, y, z; gives an estimate of total change in velocity since this integrator was reset. Every 6ms step: vel += acc>>12; (where 'acc' is acceleration in 2^-30 m/s²). Units: (4096*0.006) * 2^-30 m/s (I=1), 78.4348 * (4096*0.006) * 2^-30 m/s (I=0)
|-
|0x3C
|0xC
|Integrator B velocity
|-
| rowspan="2" |0x48
| rowspan="2" |0xC*(NNN+1)
| rowspan="2" |1-8 raw IMU samples
|s16 accel_x, accel_y, accel_z; // Units: 9.81/4096 m/s² (A=1), 15.99*9.81/4096 m/s² (A=0) (9.81m/s² added to accel_z to compensate for gravity)
|-
|s16 ang_vel_x, ang_vel_y, ang_vel_z; // Units: 0.004375 °/s (G=1), 0.1 °/s (G=0)
|}

The exact rate at which these packets are sent appears to be somewhat variable. The raw IMU samples seem to be collected with a period of 6ms, and when not in drive mode, this packet always contains 8 IMU samples, for an overall period 48ms. However, when in drive mode, not all of these packets contain exactly 8 IMU samples, and the packets will arrive at an uneven rate. This is probably due to some logic in the kart that flushes the buffer early based on certain conditions.

The IMU itself is mounted on the PCB "upside down" which gives a reference frame different from what one would expect: While +X does correspond to the driver's right-hand side, the +Y vector extends beyond the rear of the vehicle, and +Z extends out the bottom. All measurements are taken with respect to this reference frame.

The orientation quaternion is reasonably stable, but should still only be trusted for relative measurements over short periods of time, as the quaternion can drift due to error (noise, clipping, quantization) in the IMU samples. The quaternion is initialized to 0i+0j+0k+1 once the IMU is enabled (i.e. when "connection_info" is set).

The integrators are useful in an environment where packet loss is expected to be reasonably high, and so not all raw IMU samples can be reliably collected. The integrators are periodically reset (every 0x2000 samples), as they will accumulate error over time.

Both integrators are reset at the same time when the IMU is enabled, but integrator A is reset at sample 0x1000 so that the resets are staggered.

==== Type 0x03: Motion feedback ====

TBD

= Versions =
This section documents the changes for game-updates.

== v1.0.1 ==
This only updated the Kart firmware.

ExeFs:

* Nothing changed besides the usual NPDM update.

RomFs:

* Only update.pua was updated, the following was changed in the extracted update.pui (pui.hash in update.pua was also updated):
** "config.txt": system_minor_version was changed from "3" to "4".
** "audiofw_sha"
** "rootfs_sha"
** "uImage_sha"
** "generic/bluecore.audio.aes": Starts differing at offset 0x1D0.
** "generic/nand.uImage.aes": Starts differing at offset 0x0.
** "generic/root.nand.cpio.gz_pad.img.aes": Starts differing at offset 0x0.

Mario Kart Live: Home Circuit

2021-02-13T04:31:03Z

CFSworks: /* Type 0x02: IMU */

This page documents the Mario Kart Live: Home Circuit game.

Communication with the kart is done directly over local-WLAN via an access point that the game sets up using [[LDN_services|lp2p:app]], making it the first title on retail to use lp2p. The underlying device management uses [[RCD]]. The RCD implementation is in the main-codebin itself, without symbols - however there are strings for this.

This is also the first known title on retail which uses stack cookies. This is used by main-codebin, the ssp functionality in sdknso is still not used other than being called from an initialization func. This is implemented in the main-codebin as follows:
* The global u64 __stack_chk_guard is loaded then saved immediately before {first saved register} on stack, during func entry. During func exit, the global u64 is compared with the cookie on stack, it will call __stack_chk_fail on mismatch. __stack_chk_fail just executes an undefined instruction to trigger a crash.
* There is no initialization func for __stack_chk_guard, it's just a hard-coded constant: 0xDEADBEEFDEADBEEF. Since it's constant, this renders the stack cookie useless.

RomFs contains only two files:
* "data.zip"
* "update.pua": This is the firmware update data for the Kart. This is a tar archive. The extracted archive contains "update.pui" and "pui.hash". The latter is a binary 0x100-byte file. The former is another tar archive, the content of that archive is the following:
** "config.txt": Contains config which includes fields for efuse_key, efuse_fw, secure_boot, etc. Also references the data under generic/. Seems to be configuration for firmware installation, not uboot.
** "audiofw_sha": 0x20-byte binary SHA256 hash for the "bluecore.audio.aes" file.
** "dtb_sha": 0x20-byte binary SHA256 hash for the .dtb file.
** "rootfs_sha": 0x20-byte binary SHA256 hash for the "root.nand.cpio.gz_pad.img.aes" file.
** "tee_sha": 0x20-byte binary SHA256 hash for the tee file.
** "uImage_sha": 0x20-byte binary SHA256 hash for the "nand.uImage.aes" file.
** "generic/": This contains:
*** "android.nand.dtb": Plaintext "kernelDT".
*** "bluecore.audio.aes": Encrypted "audioKernel".
*** "nand.uImage.aes": Encrypted "linuxKernel".
*** "root.nand.cpio.gz_pad.img.aes": Encrypted "InitrdRootFS".
*** "tee.bin.aes": Encrypted "tee".

Note that the only firmware archive files accessed by the game are "update.pui", "pui.hash", and "config.txt". The content of "config.txt" is only used with sscanf() to extract the version fields. "update.pui"/"pui.hash" are probably sent over the network connection to the kart - it's unknown whether the game does anything with the content of "pui.hash" other than this.

= Kart =
The kart is likely codenamed "Fuji" as this is both what the game calls it internally, and how it identifies itself during RCD handshake. Various strings in the kart OSS refer to it as "DHC".

OSS is [https://www.nintendo.co.jp/support/oss/index.html available] for the kart itself.

This uses Linux. The 1.1.0_3 archive contains the following:
busybox-1.22.1.tar.bz2
eudev-1.5.3.tar.gz
kmod-17.tar.xz
libnl-3.2.24.tar.gz
linux-kernel_5c3cb2e0be2243f6d4553ccad2047c9d72e25ea2.tar.gz
lrzsz-0.12.20.tar.gz
PsdDriver_5a8d821.zip
rtl8188eu_074cc66fece232b0d5f1e1f7de57e72022ec12b1.tar.gz
uboot_53a0fa98b176329e340b0a2fca6edb7117209751.tar.gz
util-linux-2.24.2.tar.xz

PsdDriver is Nintendo's custom kernel module, the GPL license header used in the source starts with the following:
* Sensors and Motors driver
* Copyright (C) 2020 Nintendo Co, Ltd

The only changes in the OSS for 1.0.0_1 -> 1.1.0_3 are the following (note that there are more versions between these):
* The following archives were updated: linux-kernel, PsdDriver, rtl8188eu, uboot.
* In the PsdDriver source, the line-ending at the start of various source files was updated.
** In sources/psd_util.c, <code>initialize_table();</code> is now called by a dedicated <code>psd_util_init_crc8</code> function instead of <code>psd_util_get_crc8</code>, which is now called by <code>device_init</code> in sources/psd.c.

The above git-commit-hashes (?) from the filenames doesn't seem to match commits in the upstream repos.

On October 28, 2020, the existing OSS archives were updated without adding a new version. With 1.1.0_3, the uboot archive (which has the same filename) had the "/examples" directory removed.

== Hardware ==

{| class="wikitable" border="1"
|-
! Component
! Manufacturer
! Part
! Notes
|-
| SoC
| Realtek
| RTD1195 (PB)
| Contains hardware H.264 encoder
|-
| DDR3 RAM
| Winbond
| W631GG6MB-15
| 128 MiB
|-
| NAND Flash
| Winbond
| W29N01HVSINA
| 128 MiB
|-
| WNIC
| Realtek
| RTL8188E
| Connected to SoC via USB
|-
| MCU
| STMicroelectronics
| STM32F
| Responsible for real-time steering and throttle control loops, six-axis IMU acquisition, GPIO, battery status
|-
| IMU
| STMicroelectronics
| LSM6DSL
| Unconfirmed. Mounted "upside-down" on the PCB: +X=right +Y=back +Z=down. Sensitivities: 4.375 m°/s, 0.244 mg.
|-
| Li-ion pouch cell
| Nintendo branded; OEM unknown
| HAC-038
| 3.7V nominal; 1750 mAh capacity
|-
| Camera
| Unknown
| Unknown
| Possibly connected via MIPI CSI
|}

== Pairing process ==
The kart communicates with the Switch via standard 802.11 frames on channel 1/6/11, with standard CCMP encryption, but the authentication and key exchange protocol is Nintendo-proprietary. See [[LDN services]] for more information.

On first startup, ''Home Circuit'' generates a random SSID (beginning with 'G') and 0x20-byte PSK (for use in the aforementioned key exchange; it is not standard WPA). These are saved and reused on every subsequent startup, so that any kart(s) with this information stored can reconnect without needing to be paired again.

When pairing, ''Home Circuit'' creates a temporary network (random SSID beginning with 'P', randomized PSK, neither stored) and shows the details for this "pairing network" in a QR code for the kart to scan. Once the kart connects, it fetches the main "game" network SSID+PSK and stores them, and both it and ''Home Circuit'' exit pairing mode. The pairing network is only active while the QR code is displayed, otherwise the main "game" network runs.

The QR code is a "version 4" (33x33) code with level-M error correction. It uses byte encoding, and stores 0x3E bytes:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x10 || Pairing seed. LP2P PSK is SHA256(seed)
|-
| 0x10 || 0x20 || Pairing SSID. Remaining space is filled with zeros.
|-
| 0x30 || 0x2 || Pairing channel. Encoded little-endian. Usually 0.
|-
| 0x32 || 0xC || Padding bytes; zero.
|}

== Network protocols ==
Once the kart connects to the "game" network hosted by ''Home Circuit'', it requests an IP address via DHCP, then connects to the Switch via standard TCP/IP to announce its presence. A series of TCP and UDP connections are established to exchange information, stream video, transmit control signals, monitor kart telemetry, etc.

{| class="wikitable" border="1"
|+ Summary of ports
|-
! Protocol
! Endpoint
! Port
! Description
! [[RCD]] service ID
|-
!colspan="5"| Management
|-
|rowspan="5"| TCP
|rowspan="2"| Switch
| 5201
| [[RCD#Handshake protocol|RCD handshake]] service (pairing only)
| 0x0001
|-
| 5202
| RCD handshake service (non-pairing only)
| 0x0001
|-
|rowspan="3"| Kart
| 5103
| "Fuji Control" RCD service
| 0x0100
|-
| 5106
| "Fuji Pairing" RCD service (pairing only)
| 0x0102
|-
| 5107
| "Fuji Update" RCD service
| 0x0103
|-
| UDP
| Kart
| 5004
| Time synchronization
| N/A
|-
!colspan="5"| Video
|-
| UDP
|rowspan="2"| Switch
| 5016+kartid
| "LSP" video streaming
| N/A
|-
| TCP
| 5032+kartid
| "LSP" control channel
| N/A (non-RCD)
|-
!colspan="5"| Control
|-
|rowspan="2"| UDP
| Kart
| 5102
| Teleoperation (throttle, steering, tail light control)
| N/A
|-
| Switch
| 5116+kartid
| Telemetry
| N/A
|}

Note: The ports determined by the kart ID are actually assigned by the Switch and configured via the "Fuji Control" service. The kart itself will actually use any port it is told to use; shown above are how ''Home Circuit'' calculates the port numbers.

=== Handshaking ===

After the kart connects to the LP2P network and requests an IP address via DHCP, it connects to the RCD handshake service. The port it uses is determined by whether it is in pairing mode (i.e. it learned the network details from a QR code) or not. When pairing, it connects to port 5201, otherwise it uses port 5202. The RCD handshake is the same in either case.

Upon a successful RCD handshake, the handshake channel is left open. The kart will then open ports 5103 and 5107 (or, when pairing, only port 5106) and expect a single connection on each: The listening socket is closed once connection(s) are established to prevent multiple connections, and if connection(s) aren't made within 5 seconds of a completed handshake, the kart will reset its network connection (it closes all TCP connections, releases its IP back to DHCP, disassociates the wireless link, and starts the connection process anew). It will also reset the network connection in this manner if any RCD connection is lost/closed.

=== "Fuji Pairing" RCD service ===

The pairing service implements a single command, and is only available immediately after a handshake and when pairing. A network reset will occur if the connection is idle for 1 second.

==== Command 0x01: SetGroupInfo ====

Accepts a 0x40-byte payload:
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x00
| 0x20
| SSID, zero-terminated. ''Home Circuit'' copies this straight from GroupInfo, so uninitialized bytes may follow.
|-
| 0x20
| 0x20
| LP2P PSK
|}

On success, responds with an empty payload. The kart commits these network settings to non-volatile memory immediately, replacing the old settings (if present). A network reset is initiated, and the kart exits pairing mode, using these newly-provided network settings after the reset. The Switch also exits pairing mode to accept the newly-paired kart.

=== "Fuji Control" RCD service ===

This service is used to set up and manage the kart. It is only available when not in pairing mode.

==== Command 0x01: GetSystemInfo ====

Takes no payload as input, returns:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| boot_major_version
|-
| 0x1
| 0x1
| boot_minor_version
|-
| 0x2
| 0x1
| system_major_version
|-
| 0x3
| 0x1
| system_minor_version
|-
| 0x4
| 0x29
| Zero-terminated ASCII string which is a 160-bit value in hexadecimal. Appears to be some kind of SHA1.
|}

==== Command 0x02: SetParam ====

Returns no output (on success) or error code 0x1060e8 if the parameter isn't recognized. Input:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x80
| Parameter name, zero-padded.
|-
| 0x80
| 0x2
| Value length
|-
| 0x82
| 0xE
| Zero padding to align to 0x10-byte boundary
|-
| 0x90
| Varies
| Value to set
|}

Setting the parameter "connection_info" is required to prepare the kart to drive. It can only be set once (trying to set it again gives error 0x1040e8). It expects (all values little-endian):

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x2
| Fixed 0x0001; unknown purpose.
|-
| 0x2
| 0x2
| Telemetry (UDP) port on Switch
|-
| 0x4
| 0x2
| "LSP" control (TCP) port on Switch
|-
| 0x6
| 0x2
| "LSP" video (UDP) port on Switch
|-
| 0x8
| 0x8
| Current network time, per nn::time::StandardNetworkSystemClock::GetCurrentTime. (A Unix timestamp with one-second precision.)
|}

==== Command 0x03: GetParam ====

Returns the value of the parameter (on success) or error code 0x1060e8. Expected input:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x00
| 0x80
| Parameter name, zero-padded.
|}

One known parameter is "product_code" which appears to include a string with the value of the white-label barcode on the bottom of the kart. Perhaps this is how ''Home Circuit'' distinguishes between Mario and Luigi.

==== Command 0x04: SetState ====

This sets the kart between drive mode and "parked" mode. "connection_info" must be set first; it will return error 0x1040e8 if not. Returns an empty payload on success. It expects:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| Drive mode. 0x01 enables driving controls (and video), 0x00 puts the kart to "sleep."
|-
| 0x1
| 0xF
| Zero padding.
|}

==== Command 0x09: Shutdown ====

Takes no input and gives no output.

Disables the "network reset" behavior so that the kart will power off when the RCD channel(s) are closed.

==== Command 0x11: StartFluorescentLightDetection ====

TBD

==== Command 0x12: ReadApplicationData ====

Expects 0x20-byte zero-padded application ID (''Home Circuit'' uses "YVCOQ00000000XFB") and retrieves data stored in the kart unique to the application.

=== Teleoperation ===

The kart is operated over UDP port 5102. This port is only open when the kart is in [[#Command 0x04: SetState|drive state]]. It expects packets of the form:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| Throttle; a signed integer. -128 is full-speed reverse, +127 is full-speed forward.
|-
| 0x1
| 0x1
| Steering; a signed integer. -128 is full left, +127 is full right.
|-
| 0x2
| 0x1
| Brake light control. 0x00 turns the brake light off, 0x01 turns it on. This is independent of throttle.
|-
| 0x3
| 0x1
| Pad byte, apparently always zero.
|-
| 0x4
| 0x4?
| Little-endian packet counter. Incremented by 1 for each sent packet. Unknown total size.
|-
| 0x8?
| 0x18?
| Zero padding to bring the total packet size to 0x20.
|}

''Home Circuit'' sends these packets at 30 Hz. Any rate that is at least 1 Hz will do, however. The kart will automatically zero the throttle (and only the throttle) if a valid packet is not received in a one-second period, as protection from loss of control.

The counter appears to be intended as a mechanism for detecting duplicated/reordered packets, as such packets will have a counter that is not greater than the previously-accepted packet and can be quickly discarded. However, it appears to be ignored entirely by the kart. Nevertheless, it is a good idea to include it anyway.

'''NOTICE:''' The throttle/steering values take effect immediately. ''Home Circuit'' applies smoothing to these values, possibly to simulate the physics of a much more massive kart. However, this smoothing may also be necessary to keep the kart from suffering undue mechanical stress.

'''NOTICE:''' ''Home Circuit'' contains logic to detect when the kart is being held, and it locks out the controls in such cases. This logic is not implemented in the kart, which will eagerly follow any valid throttle/steering command given. The kart is not likely to cause injury if operated while held, but nevertheless, if you do so, it is at your own risk.

=== Telemetry ===

The kart will send UDP packets to the Switch over a port it specifies in "connection_info" (but typically port 5116) indicating its current status. The packet type is indicated by the first byte. (The tables below ignore this first byte.)

==== Type 0x01: Battery Status ====

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x3
| Zero padding
|-
| 0x3
| 0x1
| How many bars to show in the HUD for battery status (0x00-0x04)
|-
| 0x4
| 0x1C
| Zero padding, to bring total packet length to 0x20.
|}

One would think this would be a good location for wireless metrics (e.g. RSSI), but this is presumably measured only on the Switch side of the link.

==== Type 0x02: IMU ====

The kart contains a 6DoF IMU for measuring movement. This packet type communicates the motion status.

All integers are little-endian:

{| class="wikitable" border="1"
|-
! Offset
! Size
!colspan="2"| Description
|-
| 0x0
| 0x2
|colspan="2"| Total IMU samples, as an unsigned integer. This number includes the samples in this packet. It overflows.
|-
| 0x2
| 0x1
|colspan="2"| Flags bitfield: PCCCCNNN. P=High-precision, C=Unknown, possibly clipping indicators. N=Number of IMU samples.
|-
| 0x3
| 0x1
|colspan="2"| Pad byte; zero.
|-
| 0x4
| 0x4
|colspan="2"| Microsecond-precision timer, as an unsigned integer.
|-
| 0x8
| 0x10
|colspan="2"| Orientation: s32 qi, qj, qk, qr; gives the coefficients of a quaternion. Units appear to be increments of 2^-30, but quaternions should always be normalized before use.
|-
| 0x18
| 0xC
| Integrator A position
|rowspan="2"| s32 x, y, z; gives an estimate of total displacement since this integrator was reset. Units: 24.59 * 2^-19 m(???)
|-
| 0x24
| 0xC
| Integrator B position
|-
| 0x30
| 0xC
| Integrator A velocity
|rowspan="2"| s32 x, y, z; gives an estimate of total change in velocity since this integrator was reset. Units: ~2^-19 m/s
|-
| 0x3C
| 0xC
| Integrator B velocity
|-
|rowspan="2"| 0x48
|rowspan="2"| 0xC*(NNN+1)
|rowspan="2"| 1-8 raw IMU samples
| s16 accel_x, accel_y, accel_z; // in units of 0.000244 Gs. 1G is added to accel_z to compensate for gravity.
|-
| s16 ang_vel_x, ang_vel_y, ang_vel_z; // in units of 0.004375 degrees per second.
|}

The exact rate at which these packets are sent appears to be somewhat variable. The raw IMU samples seem to be collected with a period of 6ms, and when not in drive mode, this packet always contains 8 IMU samples, for an overall period 48ms. However, when in drive mode, not all of these packets contain exactly 8 IMU samples, and the packets will arrive at an uneven rate. This is probably due to some logic in the kart that flushes the buffer early based on certain conditions.

The IMU itself is mounted on the PCB "upside down" which gives a reference frame different from what one would expect: While +X does correspond to the driver's right-hand side, the +Y vector extends beyond the rear of the vehicle, and +Z extends out the bottom. All measurements are taken with respect to this reference frame.

The orientation quaternion is reasonably stable, but should still only be trusted for relative measurements over short periods of time, as the quaternion can drift due to error (noise, clipping, quantization) in the IMU samples. The quaternion is initialized to 1+0i+0j+0k once the IMU is enabled (i.e. when "connection_info" is set).

The integrators are useful in an environment where packet loss is expected to be reasonably high, and so not all raw IMU samples can be reliably collected. The integrators are periodically reset (every 0x2000 samples), as they will accumulate error over time.

Both integrators are reset at the same time when the IMU is enabled, but integrator A is reset at sample 0x1000 so that the resets are staggered.

If the 'P' bit is set, the integrator values are multiplied by 78.5(???) prior to being sent, for added precision. The kart will always set the 'P' bit as long as all integrator values are small enough to permit it.

==== Type 0x03: Motion feedback ====

TBD

= Versions =
This section documents the changes for game-updates.

== v1.0.1 ==
This only updated the Kart firmware.

ExeFs:
* Nothing changed besides the usual NPDM update.

RomFs:
* Only update.pua was updated, the following was changed in the extracted update.pui (pui.hash in update.pua was also updated):
** "config.txt": system_minor_version was changed from "3" to "4".
** "audiofw_sha"
** "rootfs_sha"
** "uImage_sha"
** "generic/bluecore.audio.aes": Starts differing at offset 0x1D0.
** "generic/nand.uImage.aes": Starts differing at offset 0x0.
** "generic/root.nand.cpio.gz_pad.img.aes": Starts differing at offset 0x0.

Mario Kart Live: Home Circuit

2021-02-12T22:57:35Z

CFSworks: /* Network protocols */ Start documenting some telemetry protocols

This page documents the Mario Kart Live: Home Circuit game.

Communication with the kart is done directly over local-WLAN via an access point that the game sets up using [[LDN_services|lp2p:app]], making it the first title on retail to use lp2p. The underlying device management uses [[RCD]]. The RCD implementation is in the main-codebin itself, without symbols - however there are strings for this.

This is also the first known title on retail which uses stack cookies. This is used by main-codebin, the ssp functionality in sdknso is still not used other than being called from an initialization func. This is implemented in the main-codebin as follows:
* The global u64 __stack_chk_guard is loaded then saved immediately before {first saved register} on stack, during func entry. During func exit, the global u64 is compared with the cookie on stack, it will call __stack_chk_fail on mismatch. __stack_chk_fail just executes an undefined instruction to trigger a crash.
* There is no initialization func for __stack_chk_guard, it's just a hard-coded constant: 0xDEADBEEFDEADBEEF. Since it's constant, this renders the stack cookie useless.

RomFs contains only two files:
* "data.zip"
* "update.pua": This is the firmware update data for the Kart. This is a tar archive. The extracted archive contains "update.pui" and "pui.hash". The latter is a binary 0x100-byte file. The former is another tar archive, the content of that archive is the following:
** "config.txt": Contains config which includes fields for efuse_key, efuse_fw, secure_boot, etc. Also references the data under generic/. Seems to be configuration for firmware installation, not uboot.
** "audiofw_sha": 0x20-byte binary SHA256 hash for the "bluecore.audio.aes" file.
** "dtb_sha": 0x20-byte binary SHA256 hash for the .dtb file.
** "rootfs_sha": 0x20-byte binary SHA256 hash for the "root.nand.cpio.gz_pad.img.aes" file.
** "tee_sha": 0x20-byte binary SHA256 hash for the tee file.
** "uImage_sha": 0x20-byte binary SHA256 hash for the "nand.uImage.aes" file.
** "generic/": This contains:
*** "android.nand.dtb": Plaintext "kernelDT".
*** "bluecore.audio.aes": Encrypted "audioKernel".
*** "nand.uImage.aes": Encrypted "linuxKernel".
*** "root.nand.cpio.gz_pad.img.aes": Encrypted "InitrdRootFS".
*** "tee.bin.aes": Encrypted "tee".

Note that the only firmware archive files accessed by the game are "update.pui", "pui.hash", and "config.txt". The content of "config.txt" is only used with sscanf() to extract the version fields. "update.pui"/"pui.hash" are probably sent over the network connection to the kart - it's unknown whether the game does anything with the content of "pui.hash" other than this.

= Kart =
The kart is likely codenamed "Fuji" as this is both what the game calls it internally, and how it identifies itself during RCD handshake. Various strings in the kart OSS refer to it as "DHC".

OSS is [https://www.nintendo.co.jp/support/oss/index.html available] for the kart itself.

This uses Linux. The 1.1.0_3 archive contains the following:
busybox-1.22.1.tar.bz2
eudev-1.5.3.tar.gz
kmod-17.tar.xz
libnl-3.2.24.tar.gz
linux-kernel_5c3cb2e0be2243f6d4553ccad2047c9d72e25ea2.tar.gz
lrzsz-0.12.20.tar.gz
PsdDriver_5a8d821.zip
rtl8188eu_074cc66fece232b0d5f1e1f7de57e72022ec12b1.tar.gz
uboot_53a0fa98b176329e340b0a2fca6edb7117209751.tar.gz
util-linux-2.24.2.tar.xz

PsdDriver is Nintendo's custom kernel module, the GPL license header used in the source starts with the following:
* Sensors and Motors driver
* Copyright (C) 2020 Nintendo Co, Ltd

The only changes in the OSS for 1.0.0_1 -> 1.1.0_3 are the following (note that there are more versions between these):
* The following archives were updated: linux-kernel, PsdDriver, rtl8188eu, uboot.
* In the PsdDriver source, the line-ending at the start of various source files was updated.
** In sources/psd_util.c, <code>initialize_table();</code> is now called by a dedicated <code>psd_util_init_crc8</code> function instead of <code>psd_util_get_crc8</code>, which is now called by <code>device_init</code> in sources/psd.c.

The above git-commit-hashes (?) from the filenames doesn't seem to match commits in the upstream repos.

On October 28, 2020, the existing OSS archives were updated without adding a new version. With 1.1.0_3, the uboot archive (which has the same filename) had the "/examples" directory removed.

== Hardware ==

{| class="wikitable" border="1"
|-
! Component
! Manufacturer
! Part
! Notes
|-
| SoC
| Realtek
| RTD1195 (PB)
| Contains hardware H.264 encoder
|-
| DDR3 RAM
| Winbond
| W631GG6MB-15
| 128 MiB
|-
| NAND Flash
| Winbond
| W29N01HVSINA
| 128 MiB
|-
| WNIC
| Realtek
| RTL8188E
| Connected to SoC via USB
|-
| MCU
| STMicroelectronics
| STM32F
| Responsible for real-time steering and throttle control loops, six-axis IMU acquisition, GPIO, battery status
|-
| IMU
| STMicroelectronics
| LSM6DSL
| Unconfirmed. Mounted "upside-down" on the PCB: +X=right +Y=back +Z=down. Sensitivities: 4.375 m°/s, 0.244 mg.
|-
| Li-ion pouch cell
| Nintendo branded; OEM unknown
| HAC-038
| 3.7V nominal; 1750 mAh capacity
|-
| Camera
| Unknown
| Unknown
| Possibly connected via MIPI CSI
|}

== Pairing process ==
The kart communicates with the Switch via standard 802.11 frames on channel 1/6/11, with standard CCMP encryption, but the authentication and key exchange protocol is Nintendo-proprietary. See [[LDN services]] for more information.

On first startup, ''Home Circuit'' generates a random SSID (beginning with 'G') and 0x20-byte PSK (for use in the aforementioned key exchange; it is not standard WPA). These are saved and reused on every subsequent startup, so that any kart(s) with this information stored can reconnect without needing to be paired again.

When pairing, ''Home Circuit'' creates a temporary network (random SSID beginning with 'P', randomized PSK, neither stored) and shows the details for this "pairing network" in a QR code for the kart to scan. Once the kart connects, it fetches the main "game" network SSID+PSK and stores them, and both it and ''Home Circuit'' exit pairing mode. The pairing network is only active while the QR code is displayed, otherwise the main "game" network runs.

The QR code is a "version 4" (33x33) code with level-M error correction. It uses byte encoding, and stores 0x3E bytes:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x10 || Pairing seed. LP2P PSK is SHA256(seed)
|-
| 0x10 || 0x20 || Pairing SSID. Remaining space is filled with zeros.
|-
| 0x30 || 0x2 || Pairing channel. Encoded little-endian. Usually 0.
|-
| 0x32 || 0xC || Padding bytes; zero.
|}

== Network protocols ==
Once the kart connects to the "game" network hosted by ''Home Circuit'', it requests an IP address via DHCP, then connects to the Switch via standard TCP/IP to announce its presence. A series of TCP and UDP connections are established to exchange information, stream video, transmit control signals, monitor kart telemetry, etc.

{| class="wikitable" border="1"
|+ Summary of ports
|-
! Protocol
! Endpoint
! Port
! Description
! [[RCD]] service ID
|-
!colspan="5"| Management
|-
|rowspan="5"| TCP
|rowspan="2"| Switch
| 5201
| [[RCD#Handshake protocol|RCD handshake]] service (pairing only)
| 0x0001
|-
| 5202
| RCD handshake service (non-pairing only)
| 0x0001
|-
|rowspan="3"| Kart
| 5103
| "Fuji Control" RCD service
| 0x0100
|-
| 5106
| "Fuji Pairing" RCD service (pairing only)
| 0x0102
|-
| 5107
| "Fuji Update" RCD service
| 0x0103
|-
| UDP
| Kart
| 5004
| Time synchronization
| N/A
|-
!colspan="5"| Video
|-
| UDP
|rowspan="2"| Switch
| 5016+kartid
| "LSP" video streaming
| N/A
|-
| TCP
| 5032+kartid
| "LSP" control channel
| N/A (non-RCD)
|-
!colspan="5"| Control
|-
|rowspan="2"| UDP
| Kart
| 5102
| Teleoperation (throttle, steering, tail light control)
| N/A
|-
| Switch
| 5116+kartid
| Telemetry
| N/A
|}

Note: The ports determined by the kart ID are actually assigned by the Switch and configured via the "Fuji Control" service. The kart itself will actually use any port it is told to use; shown above are how ''Home Circuit'' calculates the port numbers.

=== Handshaking ===

After the kart connects to the LP2P network and requests an IP address via DHCP, it connects to the RCD handshake service. The port it uses is determined by whether it is in pairing mode (i.e. it learned the network details from a QR code) or not. When pairing, it connects to port 5201, otherwise it uses port 5202. The RCD handshake is the same in either case.

Upon a successful RCD handshake, the handshake channel is left open. The kart will then open ports 5103 and 5107 (or, when pairing, only port 5106) and expect a single connection on each: The listening socket is closed once connection(s) are established to prevent multiple connections, and if connection(s) aren't made within 5 seconds of a completed handshake, the kart will reset its network connection (it closes all TCP connections, releases its IP back to DHCP, disassociates the wireless link, and starts the connection process anew). It will also reset the network connection in this manner if any RCD connection is lost/closed.

=== "Fuji Pairing" RCD service ===

The pairing service implements a single command, and is only available immediately after a handshake and when pairing. A network reset will occur if the connection is idle for 1 second.

==== Command 0x01: SetGroupInfo ====

Accepts a 0x40-byte payload:
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x00
| 0x20
| SSID, zero-terminated. ''Home Circuit'' copies this straight from GroupInfo, so uninitialized bytes may follow.
|-
| 0x20
| 0x20
| LP2P PSK
|}

On success, responds with an empty payload. The kart commits these network settings to non-volatile memory immediately, replacing the old settings (if present). A network reset is initiated, and the kart exits pairing mode, using these newly-provided network settings after the reset. The Switch also exits pairing mode to accept the newly-paired kart.

=== "Fuji Control" RCD service ===

This service is used to set up and manage the kart. It is only available when not in pairing mode.

==== Command 0x01: GetSystemInfo ====

Takes no payload as input, returns:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| boot_major_version
|-
| 0x1
| 0x1
| boot_minor_version
|-
| 0x2
| 0x1
| system_major_version
|-
| 0x3
| 0x1
| system_minor_version
|-
| 0x4
| 0x29
| Zero-terminated ASCII string which is a 160-bit value in hexadecimal. Appears to be some kind of SHA1.
|}

==== Command 0x02: SetParam ====

Returns no output (on success) or error code 0x1060e8 if the parameter isn't recognized. Input:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x80
| Parameter name, zero-padded.
|-
| 0x80
| 0x2
| Value length
|-
| 0x82
| 0xE
| Zero padding to align to 0x10-byte boundary
|-
| 0x90
| Varies
| Value to set
|}

Setting the parameter "connection_info" is required to prepare the kart to drive. It can only be set once (trying to set it again gives error 0x1040e8). It expects (all values little-endian):

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x2
| Fixed 0x0001; unknown purpose.
|-
| 0x2
| 0x2
| Telemetry (UDP) port on Switch
|-
| 0x4
| 0x2
| "LSP" control (TCP) port on Switch
|-
| 0x6
| 0x2
| "LSP" video (UDP) port on Switch
|-
| 0x8
| 0x8
| Current network time, per nn::time::StandardNetworkSystemClock::GetCurrentTime. (A Unix timestamp with one-second precision.)
|}

==== Command 0x03: GetParam ====

Returns the value of the parameter (on success) or error code 0x1060e8. Expected input:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x00
| 0x80
| Parameter name, zero-padded.
|}

One known parameter is "product_code" which appears to include a string with the value of the white-label barcode on the bottom of the kart. Perhaps this is how ''Home Circuit'' distinguishes between Mario and Luigi.

==== Command 0x04: SetState ====

This sets the kart between drive mode and "parked" mode. "connection_info" must be set first; it will return error 0x1040e8 if not. Returns an empty payload on success. It expects:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| Drive mode. 0x01 enables driving controls (and video), 0x00 puts the kart to "sleep."
|-
| 0x1
| 0xF
| Zero padding.
|}

==== Command 0x09: Shutdown ====

Takes no input and gives no output.

Disables the "network reset" behavior so that the kart will power off when the RCD channel(s) are closed.

==== Command 0x11: StartFluorescentLightDetection ====

TBD

==== Command 0x12: ReadApplicationData ====

Expects 0x20-byte zero-padded application ID (''Home Circuit'' uses "YVCOQ00000000XFB") and retrieves data stored in the kart unique to the application.

=== Teleoperation ===

The kart is operated over UDP port 5102. This port is only open when the kart is in [[#Command 0x04: SetState|drive state]]. It expects packets of the form:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| Throttle; a signed integer. -128 is full-speed reverse, +127 is full-speed forward.
|-
| 0x1
| 0x1
| Steering; a signed integer. -128 is full left, +127 is full right.
|-
| 0x2
| 0x1
| Brake light control. 0x00 turns the brake light off, 0x01 turns it on. This is independent of throttle.
|-
| 0x3
| 0x1
| Pad byte, apparently always zero.
|-
| 0x4
| 0x4?
| Little-endian packet counter. Incremented by 1 for each sent packet. Unknown total size.
|-
| 0x8?
| 0x18?
| Zero padding to bring the total packet size to 0x20.
|}

''Home Circuit'' sends these packets at 30 Hz. Any rate that is at least 1 Hz will do, however. The kart will automatically zero the throttle (and only the throttle) if a valid packet is not received in a one-second period, as protection from loss of control.

The counter appears to be intended as a mechanism for detecting duplicated/reordered packets, as such packets will have a counter that is not greater than the previously-accepted packet and can be quickly discarded. However, it appears to be ignored entirely by the kart. Nevertheless, it is a good idea to include it anyway.

'''NOTICE:''' The throttle/steering values take effect immediately. ''Home Circuit'' applies smoothing to these values, possibly to simulate the physics of a much more massive kart. However, this smoothing may also be necessary to keep the kart from suffering undue mechanical stress.

'''NOTICE:''' ''Home Circuit'' contains logic to detect when the kart is being held, and it locks out the controls in such cases. This logic is not implemented in the kart, which will eagerly follow any valid throttle/steering command given. The kart is not likely to cause injury if operated while held, but nevertheless, if you do so, it is at your own risk.

=== Telemetry ===

The kart will send UDP packets to the Switch over a port it specifies in "connection_info" (but typically port 5116) indicating its current status. The packet type is indicated by the first byte. (The tables below ignore this first byte.)

==== Type 0x01: Battery Status ====

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x3
| Zero padding
|-
| 0x3
| 0x1
| How many bars to show in the HUD for battery status (0x00-0x04)
|-
| 0x4
| 0x1C
| Zero padding, to bring total packet length to 0x20.
|}

One would think this would be a good location for wireless metrics (e.g. RSSI), but this is presumably measured only on the Switch side of the link.

==== Type 0x02: IMU ====

The kart contains a 6DoF IMU for measuring movement. This packet type communicates the motion status.

All integers are little-endian:

{| class="wikitable" border="1"
|-
! Offset
! Size
!colspan="2"| Description
|-
| 0x0
| 0x2
|colspan="2"| Total IMU samples, as an unsigned integer. This number includes the samples in this packet. It overflows.
|-
| 0x2
| 0x1
|colspan="2"| Flags bitfield: PCCCCNNN. P=High-precision, C=Unknown, possibly clipping indicators. N=Number of IMU samples.
|-
| 0x3
| 0x1
|colspan="2"| Pad byte; zero.
|-
| 0x4
| 0x4
|colspan="2"| Microsecond-precision timer, as an unsigned integer.
|-
| 0x8
| 0x10
|colspan="2"| Orientation: s32 qi, qj, qk, qr; gives the coefficients of a quaternion. Units appear to be increments of 2^-30, but quaternions should always be normalized before use.
|-
| 0x18
| 0xC
| Integrator A position
|rowspan="2"| s32 x, y, z; gives an estimate of total displacement since this integrator was reset. Units: unknown
|-
| 0x24
| 0xC
| Integrator B position
|-
| 0x30
| 0xC
| Integrator A velocity
|rowspan="2"| s32 x, y, z; gives an estimate of total change in velocity since this integrator was reset. Units: ~2^-19 m/s
|-
| 0x3C
| 0xC
| Integrator B velocity
|-
|rowspan="2"| 0x48
|rowspan="2"| 0xC*(NNN+1)
|rowspan="2"| 1-8 raw IMU samples
| s16 accel_x, accel_y, accel_z; // in units of 0.000244 Gs. 1G is added to accel_z to compensate for gravity.
|-
| s16 ang_vel_x, ang_vel_y, ang_vel_z; // in units of 0.004375 degrees per second.
|}

The exact rate at which these packets are sent appears to be somewhat variable. The raw IMU samples seem to be collected with a period of 6ms, and when not in drive mode, this packet always contains 8 IMU samples, for an overall period 48ms. However, when in drive mode, not all of these packets contain exactly 8 IMU samples, and the packets will arrive at an uneven rate. This is probably due to some logic in the kart that flushes the buffer early based on certain conditions.

The IMU itself is mounted on the PCB "upside down" which gives a reference frame different from what one would expect: While +X does correspond to the driver's right-hand side, the +Y vector extends beyond the rear of the vehicle, and +Z extends out the bottom. All measurements are taken with respect to this reference frame.

The orientation quaternion is reasonably stable, but should still only be trusted for relative measurements over short periods of time, as the quaternion can drift due to error (noise, clipping, quantization) in the IMU samples. The quaternion is initialized to 1+0i+0j+0k once the IMU is enabled (i.e. when "connection_info" is set).

The integrators are useful in an environment where packet loss is expected to be reasonably high, and so not all raw IMU samples can be reliably collected. The integrators are periodically reset (every 0x2000 samples), as they will accumulate error over time.

Both integrators are reset at the same time when the IMU is enabled, but integrator A is reset at sample 0x1000 so that the resets are staggered.

If the 'P' bit is set, the integrator values are multiplied by 78.5(???) prior to being sent, for added precision. The kart will always set the 'P' bit as long as all integrator values are small enough to permit it.

==== Type 0x03: Motion feedback ====

TBD

= Versions =
This section documents the changes for game-updates.

== v1.0.1 ==
This only updated the Kart firmware.

ExeFs:
* Nothing changed besides the usual NPDM update.

RomFs:
* Only update.pua was updated, the following was changed in the extracted update.pui (pui.hash in update.pua was also updated):
** "config.txt": system_minor_version was changed from "3" to "4".
** "audiofw_sha"
** "rootfs_sha"
** "uImage_sha"
** "generic/bluecore.audio.aes": Starts differing at offset 0x1D0.
** "generic/nand.uImage.aes": Starts differing at offset 0x0.
** "generic/root.nand.cpio.gz_pad.img.aes": Starts differing at offset 0x0.

Mario Kart Live: Home Circuit

2021-02-12T21:32:26Z

CFSworks: /* Teleoperation */

This page documents the Mario Kart Live: Home Circuit game.

Communication with the kart is done directly over local-WLAN via an access point that the game sets up using [[LDN_services|lp2p:app]], making it the first title on retail to use lp2p. The underlying device management uses [[RCD]]. The RCD implementation is in the main-codebin itself, without symbols - however there are strings for this.

This is also the first known title on retail which uses stack cookies. This is used by main-codebin, the ssp functionality in sdknso is still not used other than being called from an initialization func. This is implemented in the main-codebin as follows:
* The global u64 __stack_chk_guard is loaded then saved immediately before {first saved register} on stack, during func entry. During func exit, the global u64 is compared with the cookie on stack, it will call __stack_chk_fail on mismatch. __stack_chk_fail just executes an undefined instruction to trigger a crash.
* There is no initialization func for __stack_chk_guard, it's just a hard-coded constant: 0xDEADBEEFDEADBEEF. Since it's constant, this renders the stack cookie useless.

RomFs contains only two files:
* "data.zip"
* "update.pua": This is the firmware update data for the Kart. This is a tar archive. The extracted archive contains "update.pui" and "pui.hash". The latter is a binary 0x100-byte file. The former is another tar archive, the content of that archive is the following:
** "config.txt": Contains config which includes fields for efuse_key, efuse_fw, secure_boot, etc. Also references the data under generic/. Seems to be configuration for firmware installation, not uboot.
** "audiofw_sha": 0x20-byte binary SHA256 hash for the "bluecore.audio.aes" file.
** "dtb_sha": 0x20-byte binary SHA256 hash for the .dtb file.
** "rootfs_sha": 0x20-byte binary SHA256 hash for the "root.nand.cpio.gz_pad.img.aes" file.
** "tee_sha": 0x20-byte binary SHA256 hash for the tee file.
** "uImage_sha": 0x20-byte binary SHA256 hash for the "nand.uImage.aes" file.
** "generic/": This contains:
*** "android.nand.dtb": Plaintext "kernelDT".
*** "bluecore.audio.aes": Encrypted "audioKernel".
*** "nand.uImage.aes": Encrypted "linuxKernel".
*** "root.nand.cpio.gz_pad.img.aes": Encrypted "InitrdRootFS".
*** "tee.bin.aes": Encrypted "tee".

Note that the only firmware archive files accessed by the game are "update.pui", "pui.hash", and "config.txt". The content of "config.txt" is only used with sscanf() to extract the version fields. "update.pui"/"pui.hash" are probably sent over the network connection to the kart - it's unknown whether the game does anything with the content of "pui.hash" other than this.

= Kart =
The kart is likely codenamed "Fuji" as this is both what the game calls it internally, and how it identifies itself during RCD handshake. Various strings in the kart OSS refer to it as "DHC".

OSS is [https://www.nintendo.co.jp/support/oss/index.html available] for the kart itself.

This uses Linux. The 1.1.0_3 archive contains the following:
busybox-1.22.1.tar.bz2
eudev-1.5.3.tar.gz
kmod-17.tar.xz
libnl-3.2.24.tar.gz
linux-kernel_5c3cb2e0be2243f6d4553ccad2047c9d72e25ea2.tar.gz
lrzsz-0.12.20.tar.gz
PsdDriver_5a8d821.zip
rtl8188eu_074cc66fece232b0d5f1e1f7de57e72022ec12b1.tar.gz
uboot_53a0fa98b176329e340b0a2fca6edb7117209751.tar.gz
util-linux-2.24.2.tar.xz

PsdDriver is Nintendo's custom kernel module, the GPL license header used in the source starts with the following:
* Sensors and Motors driver
* Copyright (C) 2020 Nintendo Co, Ltd

The only changes in the OSS for 1.0.0_1 -> 1.1.0_3 are the following (note that there are more versions between these):
* The following archives were updated: linux-kernel, PsdDriver, rtl8188eu, uboot.
* In the PsdDriver source, the line-ending at the start of various source files was updated.
** In sources/psd_util.c, <code>initialize_table();</code> is now called by a dedicated <code>psd_util_init_crc8</code> function instead of <code>psd_util_get_crc8</code>, which is now called by <code>device_init</code> in sources/psd.c.

The above git-commit-hashes (?) from the filenames doesn't seem to match commits in the upstream repos.

On October 28, 2020, the existing OSS archives were updated without adding a new version. With 1.1.0_3, the uboot archive (which has the same filename) had the "/examples" directory removed.

== Hardware ==

{| class="wikitable" border="1"
|-
! Component
! Manufacturer
! Part
! Notes
|-
| SoC
| Realtek
| RTD1195 (PB)
| Contains hardware H.264 encoder
|-
| DDR3 RAM
| Winbond
| W631GG6MB-15
| 128 MiB
|-
| NAND Flash
| Winbond
| W29N01HVSINA
| 128 MiB
|-
| WNIC
| Realtek
| RTL8188E
| Connected to SoC via USB
|-
| MCU
| STMicroelectronics
| STM32F
| Responsible for real-time steering and throttle control loops, six-axis IMU acquisition, GPIO, battery status
|-
| IMU
| STMicroelectronics
| LSM6DSL
| Unconfirmed. Mounted "upside-down" on the PCB: +X=right +Y=back +Z=down. Sensitivities: 4.375 m°/s, 0.244 mg.
|-
| Li-ion pouch cell
| Nintendo branded; OEM unknown
| HAC-038
| 3.7V nominal; 1750 mAh capacity
|-
| Camera
| Unknown
| Unknown
| Possibly connected via MIPI CSI
|}

== Pairing process ==
The kart communicates with the Switch via standard 802.11 frames on channel 1/6/11, with standard CCMP encryption, but the authentication and key exchange protocol is Nintendo-proprietary. See [[LDN services]] for more information.

On first startup, ''Home Circuit'' generates a random SSID (beginning with 'G') and 0x20-byte PSK (for use in the aforementioned key exchange; it is not standard WPA). These are saved and reused on every subsequent startup, so that any kart(s) with this information stored can reconnect without needing to be paired again.

When pairing, ''Home Circuit'' creates a temporary network (random SSID beginning with 'P', randomized PSK, neither stored) and shows the details for this "pairing network" in a QR code for the kart to scan. Once the kart connects, it fetches the main "game" network SSID+PSK and stores them, and both it and ''Home Circuit'' exit pairing mode. The pairing network is only active while the QR code is displayed, otherwise the main "game" network runs.

The QR code is a "version 4" (33x33) code with level-M error correction. It uses byte encoding, and stores 0x3E bytes:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x10 || Pairing seed. LP2P PSK is SHA256(seed)
|-
| 0x10 || 0x20 || Pairing SSID. Remaining space is filled with zeros.
|-
| 0x30 || 0x2 || Pairing channel. Encoded little-endian. Usually 0.
|-
| 0x32 || 0xC || Padding bytes; zero.
|}

== Network protocols ==
Once the kart connects to the "game" network hosted by ''Home Circuit'', it requests an IP address via DHCP, then connects to the Switch via standard TCP/IP to announce its presence. A series of TCP and UDP connections are established to exchange information, stream video, transmit control signals, monitor kart telemetry, etc.

{| class="wikitable" border="1"
|+ Summary of ports
|-
! Protocol
! Endpoint
! Port
! Description
! [[RCD]] service ID
|-
!colspan="5"| Management
|-
|rowspan="5"| TCP
|rowspan="2"| Switch
| 5201
| [[RCD#Handshake protocol|RCD handshake]] service (pairing only)
| 0x0001
|-
| 5202
| RCD handshake service (non-pairing only)
| 0x0001
|-
|rowspan="3"| Kart
| 5103
| "Fuji Control" RCD service
| 0x0100
|-
| 5106
| "Fuji Pairing" RCD service (pairing only)
| 0x0102
|-
| 5107
| "Fuji Update" RCD service
| 0x0103
|-
| UDP
| Kart
| 5004
| Time synchronization
| N/A
|-
!colspan="5"| Video
|-
| UDP
|rowspan="2"| Switch
| 5016+kartid
| "LSP" video streaming
| N/A
|-
| TCP
| 5032+kartid
| "LSP" control channel
| N/A (non-RCD)
|-
!colspan="5"| Control
|-
|rowspan="2"| UDP
| Kart
| 5102
| Teleoperation (throttle, steering, tail light control)
| N/A
|-
| Switch
| 5116+kartid
| Telemetry
| N/A
|}

Note: The ports determined by the kart ID are actually assigned by the Switch and configured via the "Fuji Control" service. The kart itself will actually use any port it is told to use; shown above are how ''Home Circuit'' calculates the port numbers.

=== Handshaking ===

After the kart connects to the LP2P network and requests an IP address via DHCP, it connects to the RCD handshake service. The port it uses is determined by whether it is in pairing mode (i.e. it learned the network details from a QR code) or not. When pairing, it connects to port 5201, otherwise it uses port 5202. The RCD handshake is the same in either case.

Upon a successful RCD handshake, the handshake channel is left open. The kart will then open ports 5103 and 5107 (or, when pairing, only port 5106) and expect a single connection on each: The listening socket is closed once connection(s) are established to prevent multiple connections, and if connection(s) aren't made within 5 seconds of a completed handshake, the kart will reset its network connection (it closes all TCP connections, releases its IP back to DHCP, disassociates the wireless link, and starts the connection process anew). It will also reset the network connection in this manner if any RCD connection is lost/closed.

=== "Fuji Pairing" RCD service ===

The pairing service implements a single command, and is only available immediately after a handshake and when pairing. A network reset will occur if the connection is idle for 1 second.

==== Command 0x01: SetGroupInfo ====

Accepts a 0x40-byte payload:
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x00
| 0x20
| SSID, zero-terminated. ''Home Circuit'' copies this straight from GroupInfo, so uninitialized bytes may follow.
|-
| 0x20
| 0x20
| LP2P PSK
|}

On success, responds with an empty payload. The kart commits these network settings to non-volatile memory immediately, replacing the old settings (if present). A network reset is initiated, and the kart exits pairing mode, using these newly-provided network settings after the reset. The Switch also exits pairing mode to accept the newly-paired kart.

=== "Fuji Control" RCD service ===

This service is used to set up and manage the kart. It is only available when not in pairing mode.

==== Command 0x01: GetSystemInfo ====

Takes no payload as input, returns:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| boot_major_version
|-
| 0x1
| 0x1
| boot_minor_version
|-
| 0x2
| 0x1
| system_major_version
|-
| 0x3
| 0x1
| system_minor_version
|-
| 0x4
| 0x29
| Zero-terminated ASCII string which is a 160-bit value in hexadecimal. Appears to be some kind of SHA1.
|}

==== Command 0x02: SetParam ====

Returns no output (on success) or error code 0x1060e8 if the parameter isn't recognized. Input:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x80
| Parameter name, zero-padded.
|-
| 0x80
| 0x2
| Value length
|-
| 0x82
| 0xE
| Zero padding to align to 0x10-byte boundary
|-
| 0x90
| Varies
| Value to set
|}

Setting the parameter "connection_info" is required to prepare the kart to drive. It can only be set once (trying to set it again gives error 0x1040e8). It expects (all values little-endian):

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x2
| Fixed 0x0001; unknown purpose.
|-
| 0x2
| 0x2
| Telemetry (UDP) port on Switch
|-
| 0x4
| 0x2
| "LSP" control (TCP) port on Switch
|-
| 0x6
| 0x2
| "LSP" video (UDP) port on Switch
|-
| 0x8
| 0x8
| Current network time, per nn::time::StandardNetworkSystemClock::GetCurrentTime. (A Unix timestamp with one-second precision.)
|}

==== Command 0x03: GetParam ====

Returns the value of the parameter (on success) or error code 0x1060e8. Expected input:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x00
| 0x80
| Parameter name, zero-padded.
|}

One known parameter is "product_code" which appears to include a string with the value of the white-label barcode on the bottom of the kart. Perhaps this is how ''Home Circuit'' distinguishes between Mario and Luigi.

==== Command 0x04: SetState ====

This sets the kart between drive mode and "parked" mode. "connection_info" must be set first; it will return error 0x1040e8 if not. Returns an empty payload on success. It expects:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| Drive mode. 0x01 enables driving controls (and video), 0x00 puts the kart to "sleep."
|-
| 0x1
| 0xF
| Zero padding.
|}

==== Command 0x09: Shutdown ====

Takes no input and gives no output.

Disables the "network reset" behavior so that the kart will power off when the RCD channel(s) are closed.

==== Command 0x11: StartFluorescentLightDetection ====

TBD

==== Command 0x12: ReadApplicationData ====

Expects 0x20-byte zero-padded application ID (''Home Circuit'' uses "YVCOQ00000000XFB") and retrieves data stored in the kart unique to the application.

=== Teleoperation ===

The kart is operated over UDP port 5102. This port is only open when the kart is in [[#Command 0x04: SetState|drive state]] It expects packets of the form:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| Throttle; a signed integer. -128 is full-speed reverse, +127 is full-speed forward.
|-
| 0x1
| 0x1
| Steering; a signed integer. -128 is full left, +127 is full right.
|-
| 0x2
| 0x1
| Brake light control. 0x00 turns the brake light off, 0x01 turns it on. This is independent of throttle.
|-
| 0x3
| 0x1
| Pad byte, apparently always zero.
|-
| 0x4
| 0x4?
| Little-endian packet counter. Incremented by 1 for each sent packet. Unknown total size.
|-
| 0x8?
| 0x18?
| Zero padding to bring the total packet size to 0x20.
|}

''Home Circuit'' sends these packets at 30 Hz. Any rate that is at least 1 Hz will do, however. The kart will automatically zero the throttle (and only the throttle) if a valid packet is not received in a one-second period, as protection from loss of control.

The counter appears to be intended as a mechanism for detecting duplicated/reordered packets, as such packets will have a counter that is not greater than the previously-accepted packet and can be quickly discarded. However, it appears to be ignored entirely by the kart. Nevertheless, it is a good idea to include it anyway.

'''NOTICE:''' The throttle/steering values take effect immediately. ''Home Circuit'' applies smoothing to these values, possibly to simulate the physics of a much more massive kart. However, this smoothing may also be necessary to keep the kart from suffering undue mechanical stress.

'''NOTICE:''' ''Home Circuit'' contains logic to detect when the kart is being held, and it locks out the controls in such cases. This logic is not implemented in the kart, which will eagerly follow any valid throttle/steering command given. The kart is not likely to cause injury if operated while held, but nevertheless, if you do so, it is at your own risk.

= Versions =
This section documents the changes for game-updates.

== v1.0.1 ==
This only updated the Kart firmware.

ExeFs:
* Nothing changed besides the usual NPDM update.

RomFs:
* Only update.pua was updated, the following was changed in the extracted update.pui (pui.hash in update.pua was also updated):
** "config.txt": system_minor_version was changed from "3" to "4".
** "audiofw_sha"
** "rootfs_sha"
** "uImage_sha"
** "generic/bluecore.audio.aes": Starts differing at offset 0x1D0.
** "generic/nand.uImage.aes": Starts differing at offset 0x0.
** "generic/root.nand.cpio.gz_pad.img.aes": Starts differing at offset 0x0.

Mario Kart Live: Home Circuit

2021-02-12T21:30:10Z

CFSworks: /* Network protocols */ Teleoperation

This page documents the Mario Kart Live: Home Circuit game.

Communication with the kart is done directly over local-WLAN via an access point that the game sets up using [[LDN_services|lp2p:app]], making it the first title on retail to use lp2p. The underlying device management uses [[RCD]]. The RCD implementation is in the main-codebin itself, without symbols - however there are strings for this.

This is also the first known title on retail which uses stack cookies. This is used by main-codebin, the ssp functionality in sdknso is still not used other than being called from an initialization func. This is implemented in the main-codebin as follows:
* The global u64 __stack_chk_guard is loaded then saved immediately before {first saved register} on stack, during func entry. During func exit, the global u64 is compared with the cookie on stack, it will call __stack_chk_fail on mismatch. __stack_chk_fail just executes an undefined instruction to trigger a crash.
* There is no initialization func for __stack_chk_guard, it's just a hard-coded constant: 0xDEADBEEFDEADBEEF. Since it's constant, this renders the stack cookie useless.

RomFs contains only two files:
* "data.zip"
* "update.pua": This is the firmware update data for the Kart. This is a tar archive. The extracted archive contains "update.pui" and "pui.hash". The latter is a binary 0x100-byte file. The former is another tar archive, the content of that archive is the following:
** "config.txt": Contains config which includes fields for efuse_key, efuse_fw, secure_boot, etc. Also references the data under generic/. Seems to be configuration for firmware installation, not uboot.
** "audiofw_sha": 0x20-byte binary SHA256 hash for the "bluecore.audio.aes" file.
** "dtb_sha": 0x20-byte binary SHA256 hash for the .dtb file.
** "rootfs_sha": 0x20-byte binary SHA256 hash for the "root.nand.cpio.gz_pad.img.aes" file.
** "tee_sha": 0x20-byte binary SHA256 hash for the tee file.
** "uImage_sha": 0x20-byte binary SHA256 hash for the "nand.uImage.aes" file.
** "generic/": This contains:
*** "android.nand.dtb": Plaintext "kernelDT".
*** "bluecore.audio.aes": Encrypted "audioKernel".
*** "nand.uImage.aes": Encrypted "linuxKernel".
*** "root.nand.cpio.gz_pad.img.aes": Encrypted "InitrdRootFS".
*** "tee.bin.aes": Encrypted "tee".

Note that the only firmware archive files accessed by the game are "update.pui", "pui.hash", and "config.txt". The content of "config.txt" is only used with sscanf() to extract the version fields. "update.pui"/"pui.hash" are probably sent over the network connection to the kart - it's unknown whether the game does anything with the content of "pui.hash" other than this.

= Kart =
The kart is likely codenamed "Fuji" as this is both what the game calls it internally, and how it identifies itself during RCD handshake. Various strings in the kart OSS refer to it as "DHC".

OSS is [https://www.nintendo.co.jp/support/oss/index.html available] for the kart itself.

This uses Linux. The 1.1.0_3 archive contains the following:
busybox-1.22.1.tar.bz2
eudev-1.5.3.tar.gz
kmod-17.tar.xz
libnl-3.2.24.tar.gz
linux-kernel_5c3cb2e0be2243f6d4553ccad2047c9d72e25ea2.tar.gz
lrzsz-0.12.20.tar.gz
PsdDriver_5a8d821.zip
rtl8188eu_074cc66fece232b0d5f1e1f7de57e72022ec12b1.tar.gz
uboot_53a0fa98b176329e340b0a2fca6edb7117209751.tar.gz
util-linux-2.24.2.tar.xz

PsdDriver is Nintendo's custom kernel module, the GPL license header used in the source starts with the following:
* Sensors and Motors driver
* Copyright (C) 2020 Nintendo Co, Ltd

The only changes in the OSS for 1.0.0_1 -> 1.1.0_3 are the following (note that there are more versions between these):
* The following archives were updated: linux-kernel, PsdDriver, rtl8188eu, uboot.
* In the PsdDriver source, the line-ending at the start of various source files was updated.
** In sources/psd_util.c, <code>initialize_table();</code> is now called by a dedicated <code>psd_util_init_crc8</code> function instead of <code>psd_util_get_crc8</code>, which is now called by <code>device_init</code> in sources/psd.c.

The above git-commit-hashes (?) from the filenames doesn't seem to match commits in the upstream repos.

On October 28, 2020, the existing OSS archives were updated without adding a new version. With 1.1.0_3, the uboot archive (which has the same filename) had the "/examples" directory removed.

== Hardware ==

{| class="wikitable" border="1"
|-
! Component
! Manufacturer
! Part
! Notes
|-
| SoC
| Realtek
| RTD1195 (PB)
| Contains hardware H.264 encoder
|-
| DDR3 RAM
| Winbond
| W631GG6MB-15
| 128 MiB
|-
| NAND Flash
| Winbond
| W29N01HVSINA
| 128 MiB
|-
| WNIC
| Realtek
| RTL8188E
| Connected to SoC via USB
|-
| MCU
| STMicroelectronics
| STM32F
| Responsible for real-time steering and throttle control loops, six-axis IMU acquisition, GPIO, battery status
|-
| IMU
| STMicroelectronics
| LSM6DSL
| Unconfirmed. Mounted "upside-down" on the PCB: +X=right +Y=back +Z=down. Sensitivities: 4.375 m°/s, 0.244 mg.
|-
| Li-ion pouch cell
| Nintendo branded; OEM unknown
| HAC-038
| 3.7V nominal; 1750 mAh capacity
|-
| Camera
| Unknown
| Unknown
| Possibly connected via MIPI CSI
|}

== Pairing process ==
The kart communicates with the Switch via standard 802.11 frames on channel 1/6/11, with standard CCMP encryption, but the authentication and key exchange protocol is Nintendo-proprietary. See [[LDN services]] for more information.

On first startup, ''Home Circuit'' generates a random SSID (beginning with 'G') and 0x20-byte PSK (for use in the aforementioned key exchange; it is not standard WPA). These are saved and reused on every subsequent startup, so that any kart(s) with this information stored can reconnect without needing to be paired again.

When pairing, ''Home Circuit'' creates a temporary network (random SSID beginning with 'P', randomized PSK, neither stored) and shows the details for this "pairing network" in a QR code for the kart to scan. Once the kart connects, it fetches the main "game" network SSID+PSK and stores them, and both it and ''Home Circuit'' exit pairing mode. The pairing network is only active while the QR code is displayed, otherwise the main "game" network runs.

The QR code is a "version 4" (33x33) code with level-M error correction. It uses byte encoding, and stores 0x3E bytes:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x10 || Pairing seed. LP2P PSK is SHA256(seed)
|-
| 0x10 || 0x20 || Pairing SSID. Remaining space is filled with zeros.
|-
| 0x30 || 0x2 || Pairing channel. Encoded little-endian. Usually 0.
|-
| 0x32 || 0xC || Padding bytes; zero.
|}

== Network protocols ==
Once the kart connects to the "game" network hosted by ''Home Circuit'', it requests an IP address via DHCP, then connects to the Switch via standard TCP/IP to announce its presence. A series of TCP and UDP connections are established to exchange information, stream video, transmit control signals, monitor kart telemetry, etc.

{| class="wikitable" border="1"
|+ Summary of ports
|-
! Protocol
! Endpoint
! Port
! Description
! [[RCD]] service ID
|-
!colspan="5"| Management
|-
|rowspan="5"| TCP
|rowspan="2"| Switch
| 5201
| [[RCD#Handshake protocol|RCD handshake]] service (pairing only)
| 0x0001
|-
| 5202
| RCD handshake service (non-pairing only)
| 0x0001
|-
|rowspan="3"| Kart
| 5103
| "Fuji Control" RCD service
| 0x0100
|-
| 5106
| "Fuji Pairing" RCD service (pairing only)
| 0x0102
|-
| 5107
| "Fuji Update" RCD service
| 0x0103
|-
| UDP
| Kart
| 5004
| Time synchronization
| N/A
|-
!colspan="5"| Video
|-
| UDP
|rowspan="2"| Switch
| 5016+kartid
| "LSP" video streaming
| N/A
|-
| TCP
| 5032+kartid
| "LSP" control channel
| N/A (non-RCD)
|-
!colspan="5"| Control
|-
|rowspan="2"| UDP
| Kart
| 5102
| Teleoperation (throttle, steering, tail light control)
| N/A
|-
| Switch
| 5116+kartid
| Telemetry
| N/A
|}

Note: The ports determined by the kart ID are actually assigned by the Switch and configured via the "Fuji Control" service. The kart itself will actually use any port it is told to use; shown above are how ''Home Circuit'' calculates the port numbers.

=== Handshaking ===

After the kart connects to the LP2P network and requests an IP address via DHCP, it connects to the RCD handshake service. The port it uses is determined by whether it is in pairing mode (i.e. it learned the network details from a QR code) or not. When pairing, it connects to port 5201, otherwise it uses port 5202. The RCD handshake is the same in either case.

Upon a successful RCD handshake, the handshake channel is left open. The kart will then open ports 5103 and 5107 (or, when pairing, only port 5106) and expect a single connection on each: The listening socket is closed once connection(s) are established to prevent multiple connections, and if connection(s) aren't made within 5 seconds of a completed handshake, the kart will reset its network connection (it closes all TCP connections, releases its IP back to DHCP, disassociates the wireless link, and starts the connection process anew). It will also reset the network connection in this manner if any RCD connection is lost/closed.

=== "Fuji Pairing" RCD service ===

The pairing service implements a single command, and is only available immediately after a handshake and when pairing. A network reset will occur if the connection is idle for 1 second.

==== Command 0x01: SetGroupInfo ====

Accepts a 0x40-byte payload:
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x00
| 0x20
| SSID, zero-terminated. ''Home Circuit'' copies this straight from GroupInfo, so uninitialized bytes may follow.
|-
| 0x20
| 0x20
| LP2P PSK
|}

On success, responds with an empty payload. The kart commits these network settings to non-volatile memory immediately, replacing the old settings (if present). A network reset is initiated, and the kart exits pairing mode, using these newly-provided network settings after the reset. The Switch also exits pairing mode to accept the newly-paired kart.

=== "Fuji Control" RCD service ===

This service is used to set up and manage the kart. It is only available when not in pairing mode.

==== Command 0x01: GetSystemInfo ====

Takes no payload as input, returns:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| boot_major_version
|-
| 0x1
| 0x1
| boot_minor_version
|-
| 0x2
| 0x1
| system_major_version
|-
| 0x3
| 0x1
| system_minor_version
|-
| 0x4
| 0x29
| Zero-terminated ASCII string which is a 160-bit value in hexadecimal. Appears to be some kind of SHA1.
|}

==== Command 0x02: SetParam ====

Returns no output (on success) or error code 0x1060e8 if the parameter isn't recognized. Input:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x80
| Parameter name, zero-padded.
|-
| 0x80
| 0x2
| Value length
|-
| 0x82
| 0xE
| Zero padding to align to 0x10-byte boundary
|-
| 0x90
| Varies
| Value to set
|}

Setting the parameter "connection_info" is required to prepare the kart to drive. It can only be set once (trying to set it again gives error 0x1040e8). It expects (all values little-endian):

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x2
| Fixed 0x0001; unknown purpose.
|-
| 0x2
| 0x2
| Telemetry (UDP) port on Switch
|-
| 0x4
| 0x2
| "LSP" control (TCP) port on Switch
|-
| 0x6
| 0x2
| "LSP" video (UDP) port on Switch
|-
| 0x8
| 0x8
| Current network time, per nn::time::StandardNetworkSystemClock::GetCurrentTime. (A Unix timestamp with one-second precision.)
|}

==== Command 0x03: GetParam ====

Returns the value of the parameter (on success) or error code 0x1060e8. Expected input:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x00
| 0x80
| Parameter name, zero-padded.
|}

One known parameter is "product_code" which appears to include a string with the value of the white-label barcode on the bottom of the kart. Perhaps this is how ''Home Circuit'' distinguishes between Mario and Luigi.

==== Command 0x04: SetState ====

This sets the kart between drive mode and "parked" mode. "connection_info" must be set first; it will return error 0x1040e8 if not. Returns an empty payload on success. It expects:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| Drive mode. 0x01 enables driving controls (and video), 0x00 puts the kart to "sleep."
|-
| 0x1
| 0xF
| Zero padding.
|}

==== Command 0x09: Shutdown ====

Takes no input and gives no output.

Disables the "network reset" behavior so that the kart will power off when the RCD channel(s) are closed.

==== Command 0x11: StartFluorescentLightDetection ====

TBD

==== Command 0x12: ReadApplicationData ====

Expects 0x20-byte zero-padded application ID (''Home Circuit'' uses "YVCOQ00000000XFB") and retrieves data stored in the kart unique to the application.

=== Teleoperation ===

The kart is operated over UDP port 5102. It expects packets of the form:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| Throttle; a signed integer. -128 is full-speed reverse, +127 is full-speed forward.
|-
| 0x1
| 0x1
| Steering; a signed integer. -128 is full left, +127 is full right.
|-
| 0x2
| 0x1
| Brake light control. 0x00 turns the brake light off, 0x01 turns it on. This is independent of throttle.
|-
| 0x3
| 0x1
| Pad byte, apparently always zero.
|-
| 0x4
| 0x4?
| Little-endian packet counter. Incremented by 1 for each sent packet. Unknown total size.
|-
| 0x8?
| 0x18?
| Zero padding to bring the total packet size to 0x20.
|}

''Home Circuit'' sends these packets at 30 Hz. Any rate that is at least 1 Hz will do, however. The kart will automatically zero the throttle (and only the throttle) if a valid packet is not received in a one-second period, as protection from loss of control.

The counter appears to be intended as a mechanism for detecting duplicated/reordered packets, as such packets will have a counter that is not greater than the previously-accepted packet and can be quickly discarded. However, it appears to be ignored entirely by the kart. Nevertheless, it is a good idea to include it anyway.

'''NOTICE:''' The throttle/steering values take effect immediately. ''Home Circuit'' applies smoothing to these values, possibly to simulate the physics of a much more massive kart. However, this smoothing may also be necessary to keep the kart from suffering undue mechanical stress.

'''NOTICE:''' ''Home Circuit'' contains logic to detect when the kart is being held, and it locks out the controls in such cases. This logic is not implemented in the kart, which will eagerly follow any valid throttle/steering command given. The kart is not likely to cause injury if operated while held, but nevertheless, if you do so, it is at your own risk.

= Versions =
This section documents the changes for game-updates.

== v1.0.1 ==
This only updated the Kart firmware.

ExeFs:
* Nothing changed besides the usual NPDM update.

RomFs:
* Only update.pua was updated, the following was changed in the extracted update.pui (pui.hash in update.pua was also updated):
** "config.txt": system_minor_version was changed from "3" to "4".
** "audiofw_sha"
** "rootfs_sha"
** "uImage_sha"
** "generic/bluecore.audio.aes": Starts differing at offset 0x1D0.
** "generic/nand.uImage.aes": Starts differing at offset 0x0.
** "generic/root.nand.cpio.gz_pad.img.aes": Starts differing at offset 0x0.

Mario Kart Live: Home Circuit

2021-02-12T03:05:49Z

CFSworks: /* Hardware */ I think I identified the IMU

Mario Kart Live: Home Circuit

2021-02-11T03:41:32Z

CFSworks: /* Command 0x09: Shutdown */

Mario Kart Live: Home Circuit

2021-02-11T03:22:21Z

CFSworks: /* Command 0x11: StartFluorescentLightDetection */

Mario Kart Live: Home Circuit

2021-02-11T00:04:49Z

CFSworks: /* Kart */ A kart hardware section seems prudent

Mario Kart Live: Home Circuit

2021-02-10T23:45:21Z

CFSworks: /* Network protocols */ Document out some of the Fuji RCD services

Mario Kart Live: Home Circuit

2021-02-09T21:33:45Z

CFSworks: /* Network protocols */ Add a summary of the ports

RCD

2021-02-06T23:36:26Z

CFSworks: Created page with "RCD is a framework that manages '''r'''emote '''c'''ontrolled '''d'''evices - RC toys that connect to the Nintendo Switch via 802.11 ("WiFi") link. The first (and currently on..."

Mario Kart Live: Home Circuit

2021-02-06T23:21:20Z

CFSworks: Create page link to RCD

Mario Kart Live: Home Circuit

2021-02-06T23:19:24Z

CFSworks: /* Kart */ Codename is most likely "Fuji"

This page documents the Mario Kart Live: Home Circuit game.

Communication with the kart is done directly over local-WLAN via [[LDN_services|lp2p:app]]. The service implementation is in the main-codebin itself, without symbols - however there are strings for this. This is the first title on retail which uses lp2p.

This is also the first known title on retail which uses stack cookies. This is used by main-codebin, the ssp functionality in sdknso is still not used other than being called from an initialization func. This is implemented in the main-codebin as follows:
* The global u64 __stack_chk_guard is loaded then saved immediately before {first saved register} on stack, during func entry. During func exit, the global u64 is compared with the cookie on stack, it will call __stack_chk_fail on mismatch. __stack_chk_fail just executes an undefined instruction to trigger a crash.
* There is no initialization func for __stack_chk_guard, it's just a hard-coded constant: 0xDEADBEEFDEADBEEF. Since it's constant, this renders the stack cookie useless.

RomFs contains only two files:
* "data.zip"
* "update.pua": This is the firmware update data for the Kart. This is a tar archive. The extracted archive contains "update.pui" and "pui.hash". The latter is a binary 0x100-byte file. The former is another tar archive, the content of that archive is the following:
** "config.txt": Contains config which includes fields for efuse_key, efuse_fw, secure_boot, etc. Also references the data under generic/. Seems to be configuration for firmware installation, not uboot.
** "audiofw_sha": 0x20-byte binary SHA256 hash for the "bluecore.audio.aes" file.
** "dtb_sha": 0x20-byte binary SHA256 hash for the .dtb file.
** "rootfs_sha": 0x20-byte binary SHA256 hash for the "root.nand.cpio.gz_pad.img.aes" file.
** "tee_sha": 0x20-byte binary SHA256 hash for the tee file.
** "uImage_sha": 0x20-byte binary SHA256 hash for the "nand.uImage.aes" file.
** "generic/": This contains:
*** "android.nand.dtb": Plaintext "kernelDT".
*** "bluecore.audio.aes": Encrypted "audioKernel".
*** "nand.uImage.aes": Encrypted "linuxKernel".
*** "root.nand.cpio.gz_pad.img.aes": Encrypted "InitrdRootFS".
*** "tee.bin.aes": Encrypted "tee".

Note that the only firmware archive files accessed by the game are "update.pui", "pui.hash", and "config.txt". The content of "config.txt" is only used with sscanf() to extract the version fields. "update.pui"/"pui.hash" are probably sent over the network connection to the kart - it's unknown whether the game does anything with the content of "pui.hash" other than this.

= Kart =
The kart is likely codenamed "Fuji" as this is both what the game calls it internally, and how it identifies itself during RCD handshake. Various strings in the kart OSS refer to it as "DHC".

OSS is [https://www.nintendo.co.jp/support/oss/index.html available] for the kart itself.

This uses Linux. The 1.1.0_3 archive contains the following:
busybox-1.22.1.tar.bz2
eudev-1.5.3.tar.gz
kmod-17.tar.xz
libnl-3.2.24.tar.gz
linux-kernel_5c3cb2e0be2243f6d4553ccad2047c9d72e25ea2.tar.gz
lrzsz-0.12.20.tar.gz
PsdDriver_5a8d821.zip
rtl8188eu_074cc66fece232b0d5f1e1f7de57e72022ec12b1.tar.gz
uboot_53a0fa98b176329e340b0a2fca6edb7117209751.tar.gz
util-linux-2.24.2.tar.xz

PsdDriver is Nintendo's custom kernel module, the GPL license header used in the source starts with the following:
* Sensors and Motors driver
* Copyright (C) 2020 Nintendo Co, Ltd

The only changes in the OSS for 1.0.0_1 -> 1.1.0_3 are the following (note that there are more versions between these):
* The following archives were updated: linux-kernel, PsdDriver, rtl8188eu, uboot.
* In the PsdDriver source, the line-ending at the start of various source files was updated.
** In sources/psd_util.c, <code>initialize_table();</code> is now called by a dedicated <code>psd_util_init_crc8</code> function instead of <code>psd_util_get_crc8</code>, which is now called by <code>device_init</code> in sources/psd.c.

The above git-commit-hashes (?) from the filenames doesn't seem to match commits in the upstream repos.

On October 28, 2020, the existing OSS archives were updated without adding a new version. With 1.1.0_3, the uboot archive (which has the same filename) had the "/examples" directory removed.

== Pairing process ==
The kart communicates with the Switch via standard 802.11 frames on channel 1/6/11, with standard CCMP encryption, but the authentication and key exchange protocol is Nintendo-proprietary. See [[LDN services]] for more information.

On first startup, ''Home Circuit'' generates a random SSID (beginning with 'G') and 0x20-byte PSK (for use in the aforementioned key exchange; it is not standard WPA). These are saved and reused on every subsequent startup, so that any kart(s) with this information stored can reconnect without needing to be paired again.

When pairing, ''Home Circuit'' creates a temporary network (random SSID beginning with 'P', randomized PSK, neither stored) and shows the details for this "pairing network" in a QR code for the kart to scan. Once the kart connects, it fetches the main "game" network SSID+PSK and stores them, and both it and ''Home Circuit'' exit pairing mode. The pairing network is only active while the QR code is displayed, otherwise the main "game" network runs.

The QR code is a "version 4" (33x33) code with level-M error correction. It uses byte encoding, and stores 0x3E bytes:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x10 || Pairing seed. LP2P PSK is SHA256(seed)
|-
| 0x10 || 0x20 || Pairing SSID. Remaining space is filled with zeros.
|-
| 0x30 || 0x2 || Pairing channel. Encoded little-endian. Usually 0.
|-
| 0x32 || 0xC || Padding bytes; zero.
|}

== Network protocols ==
Once the kart connects to the "game" network hosted by ''Home Circuit'', it requests an IP address via DHCP, then connects to the Switch via standard TCP/IP to announce its presence. A series of TCP and UDP connections are established to exchange information, stream video, transmit control signals, monitor kart telemetry, etc.

= Versions =
This section documents the changes for game-updates.

== v1.0.1 ==
This only updated the Kart firmware.

ExeFs:
* Nothing changed besides the usual NPDM update.

RomFs:
* Only update.pua was updated, the following was changed in the extracted update.pui (pui.hash in update.pua was also updated):
** "config.txt": system_minor_version was changed from "3" to "4".
** "audiofw_sha"
** "rootfs_sha"
** "uImage_sha"
** "generic/bluecore.audio.aes": Starts differing at offset 0x1D0.
** "generic/nand.uImage.aes": Starts differing at offset 0x0.
** "generic/root.nand.cpio.gz_pad.img.aes": Starts differing at offset 0x0.

LDN services

2021-02-05T18:56:37Z

CFSworks: PlatformIdFuji -> PlatformIdRcd

LDN handles all local network communication.

= ldn:m =
This is "nn::ldn::detail::IMonitorServiceCreator".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#CreateMonitorService]]
|}

== CreateMonitorService ==
Returns an [[#IMonitorService]].

The user-process closes the IMonitorServiceCreator object immediately after using this cmd.

== IMonitorService ==
This is "nn::ldn::detail::IMonitorService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#GetStateForMonitor]]
|-
| 1 || [[#GetNetworkInfoForMonitor]]
|-
| 2 || [[#GetIpv4AddressForMonitor]]
|-
| 3 || [[#GetDisconnectReasonForMonitor]]
|-
| 4 || [[#GetSecurityParameterForMonitor]]
|-
| 5 || [[#GetNetworkConfigForMonitor]]
|-
| 100 || [[#InitializeMonitor]]
|-
| 101 || [[#FinalizeMonitor]]
|}

=== GetStateForMonitor ===
No input, returns an output u32.

sdknso implements this by <code>return</code>ing the u32, with 0 being returned on error.

=== GetNetworkInfoForMonitor ===
Takes a type-0x1A output buffer containing a [[#NetworkInfo]].

=== GetIpv4AddressForMonitor ===
No input, returns an output [[#Ipv4Address]] and a [[#SubnetMask]].

=== GetDisconnectReasonForMonitor ===
No input, returns an output s16.

This is not exposed by sdknso.

This just returns 0.

=== GetSecurityParameterForMonitor ===
No input, returns an output [[#SecurityParameter]].

This is not exposed by sdknso.

=== GetNetworkConfigForMonitor ===
No input, returns an output [[#NetworkConfig]].

This is not exposed by sdknso.

=== InitializeMonitor ===
No input/output.

This is used immediately after object creation. Official sw will Abort if this fails.

This just returns 0.

=== FinalizeMonitor ===
No input/output.

This is used during service exit, prior to closing the object. Official sw will Abort if this fails.

This just returns 0.

= ldn:s =
This is "nn::ldn::detail::ISystemServiceCreator".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#CreateSystemLocalCommunicationService]]
|}

== CreateSystemLocalCommunicationService ==
Returns an [[#ISystemLocalCommunicationService]].

The user-process closes the ISystemServiceCreator object immediately after using this cmd. Official sw ignores errors from this cmd.

== ISystemLocalCommunicationService ==
This is "nn::ldn::detail::ISystemLocalCommunicationService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#GetState]]
|-
| 1 || [[#GetNetworkInfo]]
|-
| 2 || [[#GetIpv4Address]]
|-
| 3 || [[#GetDisconnectReason]]
|-
| 4 || [[#GetSecurityParameter]]
|-
| 5 || [[#GetNetworkConfig]]
|-
| 100 || [[#AttachStateChangeEvent]]
|-
| 101 || [[#GetNetworkInfoLatestUpdate]]
|-
| 102 || [[#Scan]]
|-
| 103 || [[#ScanPrivate]]
|-
| 104 || [5.0.0+] [[#SetWirelessControllerRestriction]]
|-
| 200 || [[#OpenAccessPoint]]
|-
| 201 || [[#CloseAccessPoint]]
|-
| 202 || [[#CreateNetwork]]
|-
| 203 || [[#CreateNetworkPrivate]]
|-
| 204 || [[#DestroyNetwork]]
|-
| 205 || [[#Reject]]
|-
| 206 || [[#SetAdvertiseData]]
|-
| 207 || [[#SetStationAcceptPolicy]]
|-
| 208 || [[#AddAcceptFilterEntry]]
|-
| 209 || [[#ClearAcceptFilter]]
|-
| 300 || [[#OpenStation]]
|-
| 301 || [[#CloseStation]]
|-
| 302 || [[#Connect]]
|-
| 303 || [[#ConnectPrivate]]
|-
| 304 || [[#Disconnect]]
|-
| 400 || [[#InitializeSystem]]
|-
| 401 || [[#FinalizeSystem]]
|-
| 402 || [4.0.0+] [[#SetOperationMode]]
|-
| 403 || [7.0.0+] [[#InitializeSystem2]]
|}

=== GetState ===
No input, returns an output u32.

sdknso implements this by <code>return</code>ing the u32, with 0 being returned on error / when service isn't initialized.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || None
|-
| 1 || Initialized
|-
| 2 || AccessPointOpened
|-
| 3 || AccessPointCreated
|-
| 4 || StationOpened
|-
| 5 || StationConnected
|-
| 6 || Error
|-
|}

=== GetNetworkInfo ===
Takes a type-0x1A output buffer containing a [[#NetworkInfo]].

=== GetIpv4Address ===
No input, returns an output [[#Ipv4Address]] and a [[#SubnetMask]].

=== GetDisconnectReason ===
No input, returns an output s16.

sdknso implements this by <code>return</code>ing the s16 as a s32, with -1 being returned on error.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| -1 || See above.
|-
| 0 || None
|-
| 1 || User
|-
| 2 || SystemRequest
|-
| 3 || DestroyedByAdmin
|-
| 4 || DestroyedBySystemRequest
|-
| 5 || Admin
|-
| 6 || SignalLost
|}

=== GetSecurityParameter ===
No input, returns an output [[#SecurityParameter]].

=== GetNetworkConfig ===
No input, returns an output [[#NetworkConfig]].

=== AttachStateChangeEvent ===
No input, returns an output Event handle.

sdknso uses EventClearMode=1 with this. sdknso will Abort if this cmd fails.

This is signaled when the data returned by [[#GetNetworkInfo]]/[[#GetNetworkInfoLatestUpdate]] is updated.

=== GetNetworkInfoLatestUpdate ===
Takes a type-0x1A output buffer containing a [[#NetworkInfo]] and a type-0xA output buffer containing an array of [[#NodeLatestUpdate]].

The array count must be 8.

=== Scan ===
Takes a type-0x22 output buffer containing an array of [[#NetworkInfo]], a s16 channel, a [[#ScanFilter]], returns an output s16 total_out.

sdknso copies the output s16 to a s32, the value passed for the input s16 is from an user-specified s32 (user-apps generally use value 0 for this).

This is the same as [[#ScanPrivate]], except this also has the same channel-override functionality as [[#CreateNetwork]].

[[#GetState|State]] must be 3-5.

The array count must be at least 1. This is clamped to a maximum of 0x18.

=== ScanPrivate ===
Takes a type-0x22 output buffer containing an array of [[#NetworkInfo]], a s16 channel, a [[#ScanFilter]], returns an output s16 total_out.

sdknso copies the output s16 to a s32, the value passed for the input s16 is from an user-specified s32.

See [[#Scan]].

=== SetWirelessControllerRestriction ===
Takes an input [[#WirelessControllerRestriction]], no output.

[[#GetState|State]] must be 1.

The input value is written into state.

=== OpenAccessPoint ===
No input/output.

[[#GetState|State]] must be 1, this cmd eventually sets the State to value 2.

=== CloseAccessPoint ===
No input/output.

[[#GetState|State]] must be 2-3, this cmd eventually sets the State to value 1.

=== CreateNetwork ===
Takes an input [[#SecurityConfig]], an [[#UserConfig]], a [[#NetworkConfig]], no output.

This is the same as [[#CreateNetworkPrivate]], except the [[#AddressEntry]] params are 0, and the [[#SecurityParameter]] is generated from "nn::util::TinyMt::GenerateRandomBytes".

Unlike CreateNetworkPrivate, this overwrites the channel field in the [[#NetworkConfig]]. When the cached [[SPL_services#IsDevelopment|IsDevelopment]] value is true, the output from [[Settings_services|GetLdnChannel]] will overwrite that field if the s32 setting value is >=0, otherwise the original value is used. Otherwise when the IsDevelopment field is false (retail), the channel is overwritten with value 0.

This overwrites the u16 field at [[#SecurityConfig]]+0. When the cached [[SPL_services#IsDevelopment|IsDevelopment]] value is false (retail), value 1 is used, otherwise the original value is used.

[[#GetState|State]] must be 2, this cmd eventually sets the State to value 3.

=== CreateNetworkPrivate ===
Takes an input [[#SecurityConfig]], a [[#SecurityParameter]], an [[#UserConfig]], a [[#NetworkConfig]], a type-0x9 input buffer containing an array of [[#AddressEntry]], no output.

The buffer/count for [[#AddressEntry]] can be 0, in which case the network will be non-Private like [[#CreateNetwork]]. The count must be <=8.

See [[#CreateNetwork]].

=== DestroyNetwork ===
No input/output.

[[#GetState|State]] must be 3, this cmd eventually sets the State to value 2.

=== Reject ===
Takes an input [[#Ipv4Address]], no output.

[[#GetState|State]] must be 3.

=== SetAdvertiseData ===
Takes a type-0x21 input buffer, no output.

The input buffer contains arbitrary user data.

The buffer size must be <=0x180. An empty buffer (addr=NULL/size=0) can be used to reset the AdvertiseData size in state to zero.

[[#GetState|State]] must be 2-3.

=== SetStationAcceptPolicy ===
Takes an input [[#AcceptPolicy]], no output.

[[#GetState|State]] must be 2-3.

=== AddAcceptFilterEntry ===
Takes an input [[#MacAddress|MacAddress]], no output.

There are two sdknso funcs implementing this: one which takes a [[#MacAddress|MacAddress]] directly, the other loads the [[#MacAddress|MacAddress]] from the input [[#NodeInfo|NodeInfo]].

[[#GetState|State]] must be 2-3.

=== ClearAcceptFilter ===
No input/output.

[[#GetState|State]] must be 2-3.

=== OpenStation ===
No input/output.

[[#GetState|State]] must be 1, this cmd eventually sets the State to value 4.

=== CloseStation ===
No input/output.

[[#GetState|State]] must be 4-5, this cmd eventually sets the State to value 1.

=== Connect ===
Takes a type-0x19 input buffer containing a [[#NetworkInfo]], a [[#SecurityConfig]], an [[#UserConfig]], a s32 LocalCommunicationVersion, a [[#ConnectOption]], no output.

[[#GetState|State]] must be 4, this cmd eventually sets the State to value 5.

This is identical to [[#ConnectPrivate]] (besides the below), except the data internally passed for [[#SecurityParameter]]/[[#NetworkConfig]] are loaded from the input [[#NetworkInfo]].

This overwrites the u16 field at [[#SecurityConfig]]+0. When the cached [[SPL_services#IsDevelopment|IsDevelopment]] value is false (retail), value 1 is used, otherwise the used value is: original_field == 0 ? {u16 [[#NetworkInfo]]+0x60} : original_field.

u32 LocalCommunicationVersion>>15 must be 0.

=== ConnectPrivate ===
Takes a [[#SecurityConfig]], [[#SecurityParameter]], an [[#UserConfig]], a s32 LocalCommunicationVersion, a [[#ConnectOption]], a [[#NetworkConfig]], no output.

See [[#Connect]].

This overwrites the u16 field at [[#SecurityConfig]]+0. When the cached [[SPL_services#IsDevelopment|IsDevelopment]] value is false (retail), value 1 is used, otherwise the original value is used.

=== Disconnect ===
No input/output.

[[#GetState|State]] must be 5, this cmd eventually sets the State to value 4.

=== InitializeSystem ===
Takes an input PID and an u64 pid_placeholder.

This is used immediately after object creation.

With [7.0.0+] [[#InitializeSystem2]] is used instead.

=== FinalizeSystem ===
No input/output.

This is used during service exit, prior to closing the object. Official sw will Abort if this fails.

If State is set for it, this will run the equivalent of [[#CloseAccessPoint]]/[[#CloseStation]] when needed.

[[#GetState|State]] must be non-zero, this cmd eventually sets the State to value 0.

=== SetOperationMode ===
Takes an input [[#OperationMode]], no output.

[[#GetState|State]] must be 1.

The input value is written into state.

=== InitializeSystem2 ===
Takes an input PID, an u32, and an u64 pid_placeholder.

Official sw uses hard-coded value 0x1 for the u32.

The input u32 is ignored, the impl for this cmd is identical to [[#InitializeSystem]].

Internally this calls a func with params: (..., PID, &{u16 value 0x38}). On success, this then calls another func (which sets two state fields to the input) with params: (state, 0) (these state fields are used during [[#Authentication]] to check which service is being used).

The first func uses various [[Network_Interface_services|nifm]] funcs. The input value is used to determine the value for [[Network_Interface_services#CreateRequest|nn::nifm::RequestParameters]]: essentially, value 0x4 is used for ldn:u, and value 0x8 is used for ldn:s. The input value is also copied into state.

[[#GetState|State]] must be 0, this cmd eventually sets the State to value 1.

= ldn:u =
This is "nn::ldn::detail::IUserServiceCreator".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#CreateUserLocalCommunicationService]]
|}

== CreateUserLocalCommunicationService==
Returns an [[#IUserLocalCommunicationService]].

The user-process closes the IUserServiceCreator object immediately after using this cmd. Official sw ignores errors from this cmd.

== IUserLocalCommunicationService ==
This is "nn::ldn::detail::IUserLocalCommunicationService".

This is identical to [[#ISystemLocalCommunicationService]], except for the System-only cmd(s), and [[#Initialize]]/[[#Initialize2]] differ.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#GetState]]
|-
| 1 || [[#GetNetworkInfo]]
|-
| 2 || [[#GetIpv4Address]]
|-
| 3 || [[#GetDisconnectReason]]
|-
| 4 || [[#GetSecurityParameter]]
|-
| 5 || [[#GetNetworkConfig]]
|-
| 100 || [[#AttachStateChangeEvent]]
|-
| 101 || [[#GetNetworkInfoLatestUpdate]]
|-
| 102 || [[#Scan]]
|-
| 103 || [[#ScanPrivate]]
|-
| 104 || [5.0.0+] [[#SetWirelessControllerRestriction]]
|-
| 200 || [[#OpenAccessPoint]]
|-
| 201 || [[#CloseAccessPoint]]
|-
| 202 || [[#CreateNetwork]]
|-
| 203 || [[#CreateNetworkPrivate]]
|-
| 204 || [[#DestroyNetwork]]
|-
| 205 || [[#Reject]]
|-
| 206 || [[#SetAdvertiseData]]
|-
| 207 || [[#SetStationAcceptPolicy]]
|-
| 208 || [[#AddAcceptFilterEntry]]
|-
| 209 || [[#ClearAcceptFilter]]
|-
| 300 || [[#OpenStation]]
|-
| 301 || [[#CloseStation]]
|-
| 302 || [[#Connect]]
|-
| 303 || [[#ConnectPrivate]]
|-
| 304 || [[#Disconnect]]
|-
| 400 || [[#Initialize]]
|-
| 401 || [[#Finalize]]
|-
| 402 || [7.0.0+] [[#Initialize2]]
|}

=== Initialize ===
Takes an input PID and an u64 pid_placeholder.

This is used immediately after object creation.

With [7.0.0+] [[#Initialize2]] is used instead.

This is identical to [[#InitializeSystem]] except different params are used for the funcs called internally.

=== Finalize ===
No input/output.

This is used during service exit, prior to closing the object. Official sw will Abort if this fails.

This is identical to [[#FinalizeSystem]].

=== Initialize2 ===
Takes an input PID, an u32, and an u64 pid_placeholder.

Official sw uses hard-coded value 0x1 for the u32.

The input u32 is ignored, the impl for this cmd is identical to [[#Initialize]].

This is identical to [[#InitializeSystem2]] except different params are used for the funcs called internally: the u16 value is 0x5A, and the value for the second func is 1.

= ndd =
This is "nn::ndd::IService".

This was added with [5.0.0] and removed with [6.0.0].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || EnableAutoCommunication
|-
| 1 || DisableAutoCommunication
|-
| 2 || IsAutoCommunicationEnabled
|-
| 3 || EnablePowerSave
|-
| 4 || DisablePowerSave
|-
| 5 || IsPowerSaveEnabled
|-
| 6 || IsNetworkActive
|-
| 7 || AcquireSendDataUpdateEvent
|-
| 8 || AddSendData
|-
| 9 || ClearSendData
|-
| 10 || GetSendData
|-
| 11 || AcquireReceiveDataEvent
|-
| 12 || GetCurrentReceiveDataCounter
|-
| 13 || GetOldestReceiveDataCounter
|-
| 14 || GetNextReceiveDataCounter
|-
| 15 || GetAvailableReceiveDataCount
|-
| 16 || GetRecentReceiveDataCounter
|-
| 17 || GetReceiveData
|-
| 18 || AddReceiveData
|-
| 19 || ClearReceiveData
|-
| 20 || ClearDataIdFilter
|-
| 21 || AcquireDeviceScanEvent
|-
| 22 || StartDeviceScan
|-
| 23 || CancelDeviceScan
|-
| 24 || GetDeviceScanResult
|}

= lp2p:app, lp2p:sys =
These are "nn::lp2p::detail::INetworkServiceCreator".

These were added with [9.0.0+].

lp2p:app is used by [[Mario Kart Live: Home Circuit]]. lp2p:sys is used by [[Album_Applet|LibraryAppletPhotoViewer]] with [11.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#CreateNetworkService]]
|-
| 8 || [[#CreateNetworkServiceMonitor]]
|}

== CreateNetworkService ==
Takes an input u32, an u64 pid_reserved, a PID, returns an output [[#INetworkService]].

The input u32 must be value 0x1.

== CreateNetworkServiceMonitor ==
Takes an input u64 pid_reserved, a PID, returns an output [[#INetworkServiceMonitor]].

== INetworkService ==
This is "nn::lp2p::detail::INetworkService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Initialize|Initialize]]
|-
| [9.0.0-9.0.1] 256 || [[#AttachNetworkInterfaceStateChangeEvent]]
|-
| [9.0.0-9.0.1] 264 || [[#GetNetworkInterfaceLastError]]
|-
| [9.0.0-9.0.1] 272 || [[#GetRole]]
|-
| [9.0.0-9.0.1] 280 || [[#GetAdvertiseData]]
|-
| [9.0.0-9.0.1] 288 || [[#GetGroupInfo]]
|-
| [9.0.0-9.0.1] 296 || [[#Join]]
|-
| [9.0.0-9.0.1] 304 || [[#GetGroupOwner]]
|-
| [9.0.0-9.0.1] 312 || [[#GetIpConfig]]
|-
| [9.0.0-9.0.1] 320 || [[#Leave]]
|-
| 512 || [[#Scan]]
|-
| 768 || [[#CreateGroup]]
|-
| 776 || [[#DestroyGroup]]
|-
| 784 || [[#SetAdvertiseData]]
|-
| 1536 || [[#SendToOtherGroup]]
|-
| 1544 || [[#RecvFromOtherGroup]]
|-
| 1552 || [[#AddAcceptableGroupId]]
|-
| 1560 || [9.1.0+] [[#RemoveAcceptableGroupId]]
|}

=== Initialize ===
No input/output.

Returns 0.

Unused by official sw.

=== Scan ===
Takes a type-0x19 input buffer containing a [[#GroupInfo]], a type-0x22 output buffer containing an array of [[#ScanResult]], returns an output s32 total_out.

=== CreateGroup ===
Takes a type-0x31 input buffer containing a [[#GroupInfo]], no output.

[[Mario Kart Live: Home Circuit|mklive]] uses the following string with this: "Failed to create a group: %08X".

The [[#GetRole|role]] must be 0. This eventually sets the [[#GetRole|role]] to value 1.

=== DestroyGroup ===
No input/output.

This destroys the previously [[#CreateGroup|created]] group. If no group was previously created ([[#GetRole|role]] is not 1), this just returns 0.

=== SetAdvertiseData ===
Takes a type-0x21 input buffer, no output.

The buffer size must be <=0x80. The [[#GetRole|role]] must be <=1.

A string in [[Mario Kart Live: Home Circuit|mklive]] refers to the buffer data as "scan advertise data".

=== SendToOtherGroup ===
Takes an input [[#MacAddress_2|MacAddress]], a [[#GroupId]], a s16 frequency, a s16 channel, an u32 flags, a type-0x21 input buffer, no output.

The buffer size must be <=0x400.

The MacAddress must be non-zero. The s16s must be >=1.

Only bit0 is used from flags: clear = block until the data can be sent, set = return error when the data can't be sent.

A string in [[Mario Kart Live: Home Circuit|mklive]] refers to the buffer data as "Action frame".

The [[#GetRole|role]] must be non-zero. The error from [[#GetNetworkInterfaceLastError]] will be returned if it's set.

[11.0.0+] [[#GroupInfo]]+0x8A must be value 2, otherwise an error is returned.

This sends an Action frame to the specified [[#GroupId]], with the specified destination [[#MacAddress_2|MacAddress]] (can be a broadcast address).

The frequency param is the same as the [[#GroupInfo]]+0x84 field.

=== RecvFromOtherGroup ===
Takes an input u32 flags, a type-0x22 output buffer, returns a [[#MacAddress_2|MacAddress]], an u16, a s16, an u32 out_size, a s32.

The out_size is the original size used for copying to the output buffer, before it's clamped to the output-buffer size.

Only bit0 is used from flags: clear = block until data is available, set = return error when data is not available.

When data is not available, the error from [[#GetNetworkInterfaceLastError]] will be returned if it's set.

The [[#GetRole|role]] must be non-zero.

This receives an Action frame.

=== AddAcceptableGroupId ===
Takes an input [[#GroupId]], no output.

=== RemoveAcceptableGroupId ===
No input/output.

== INetworkServiceMonitor ==
This is "nn::lp2p::detail::INetworkServiceMonitor".

This interface has no commands, until [9.1.0+] which added actual commands.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Initialize_2|Initialize]]
|-
| 256 || [[#AttachNetworkInterfaceStateChangeEvent]]
|-
| 264 || [[#GetNetworkInterfaceLastError]]
|-
| 272 || [[#GetRole]]
|-
| 280 || [[#GetAdvertiseData]]
|-
| 281 || [[#GetAdvertiseData2]]
|-
| 288 || [[#GetGroupInfo]]
|-
| 296 || [[#Join]]
|-
| 304 || [[#GetGroupOwner]]
|-
| 312 || [[#GetIpConfig]]
|-
| 320 || [[#Leave]]
|-
| 328 || [[#AttachJoinEvent]]
|-
| 336 || [[#GetMembers]]
|}

=== Initialize ===
Returns 0.

Unused by official sw.

=== AttachNetworkInterfaceStateChangeEvent ===
No input, returns an output Event handle with EventClearMode=0.

=== GetNetworkInterfaceLastError ===
No input/output.

=== GetRole ===
No input, returns an output u8.

=== GetAdvertiseData ===
Takes a type-0x22 output buffer, returns 2 output u16s.

Validates that the [[#GetRole|role]] is value 2, then copies data from state into the output buffer. The first output u16 is the size used for the memcpy, the second u16 is the original size from state.

=== GetAdvertiseData2 ===
Takes a type-0x22 output buffer, returns 2 output u16s.

This is identical to [[#GetAdvertiseData]] except this doesn't run the role validation.

=== GetGroupInfo ===
Takes a type-0x32 output buffer containing a [[#GroupInfo]].

Validates that the [[#GetRole|role]] is non-zero, then copies the struct from state into the output buffer.

=== Join ===
Takes a type-0x32 output buffer containing a [[#GroupInfo]] and a type-0x31 input buffer containing a [[#GroupInfo]].

This runs the same code as [[#CreateGroup]] to generate the [[#GroupInfo]] for the input struct (which with [[#CreateGroup]] would be available with [[#GetGroupInfo]]). The input struct is the same as [[#CreateGroup]].

=== GetGroupOwner ===
No input, returns an output 0x80-bytes [[#NodeInfo_2|NodeInfo]].

Validates that the [[#GetRole|role]] is non-zero, then copies the data from state to output.

=== GetIpConfig ===
Takes a type-0x1A output buffer containing a 0x100-byte struct.

Validates that the [[#GetRole|role]] is non-zero, then copies the struct from state into the output buffer.

+0x20 is the <code>struct sockaddr</code> IP address, +0x40 is the <code>struct sockaddr</code> subnet-mask, +0x60 is the <code>struct sockaddr</code> gateway(?). The address for the last one is set to localhost.

=== Leave ===
No input, returns an output u32.

=== AttachJoinEvent ===
No input, returns an output Event handle with EventClearMode=0.

=== GetMembers ===
Takes a type-0x22 output buffer containing an array of [[#NodeInfo_2|NodeInfo]], returns an output s32 total_out.

Validates that the [[#GetRole|role]] is value 1. Then any entries from state which are available are copied into the output array buffer, if there's space available. A maximum of 8 entries can be returned.

A string in [[Mario Kart Live: Home Circuit|mklive]] refers to the array data as "connected members".

= lp2p:m =
This is "nn::lp2p::detail::IMonitorServiceCreator".

This was added with [9.1.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#CreateMonitorService]]
|}

== CreateMonitorService ==
Takes a PID, a total of 0x10-bytes of input, and returns an [[#IMonitorService]].

== IMonitorService ==
This is "nn::lp2p::detail::IMonitorService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Initialize_3|Initialize]]
|-
| 288 || [[#GetGroupInfo]]
|-
| 320 || [[#Leave]]
|}

=== Initialize ===
Returns 0.

= Ipv4Address =
This is "nn::ldn::Ipv4Address". This is a 0x4-byte struct with 4-byte alignment.

This is essentially the same as <code>struct in_addr</code>, except this is little-endian.

This is generally "169.254.XXX.{...}", where XXX is random per created network.

= SubnetMask =
This is "nn::ldn::SubnetMask". This is a 0x4-byte struct with 4-byte alignment.

This is essentially the same as <code>struct in_addr</code>, except this is little-endian.

= Ssid =
This is "nn::ldn::Ssid".

When converting a Ssid to a string, the loaded chars from the string must be in the range of 0x20-0x7F, otherwise the byte written to the string will be 0.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || Length excluding NUL-terminator, must be 0x1-0x20.
|-
| 0x1 || 0x21 || SSID string including NUL-terminator, str[{above length}] must be 0.
|}

= NetworkInfo =
This is "nn::ldn::NetworkInfo". This is a 0x480-byte struct. The data at +0x50 is another struct.

The fields listed as Reserved (besides the fields before +0x10) are cleared during the memset and are not written to again afterwards, with cmds which return NetworkInfo.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || LocalCommunicationId
|-
| 0x8 || 0x2 || Reserved
|-
| 0xA || 0x2 || Arbitrary user data which can be used for filtering with [[#ScanFilter]].
|-
| 0xC || 0x4 || Reserved
|-
| 0x10 || 0x10 || Last 0x10-bytes of [[#SecurityParameter]]. NetworkId which is used to generate/overwrite the [[#Ssid]]. With [[#Scan]]/[[#ScanPrivate]], this is only done after filtering when +0x4B is value 0x2. The converted Ssid is a 0x20-byte lowercase hex string version of the input NetworkId.
|-
| 0x20 || 0x6 || [[#MacAddress|MacAddress]]
|-
| 0x26 || 0x22 || [[#Ssid]]
|-
| 0x48 || 0x2 || s16 NetworkChannel
|-
| 0x4A || 0x1 || s8 LinkLevel
|-
| 0x4B || 0x1 || Set to hard-coded value 0x2 with output structs, except with [[#Scan]]/[[#ScanPrivate]] which can also set value 0x1 in certain cases. 0x1 = normal network without an [[#ActionFrame]], 0x2 = LDN network with a valid [[#ActionFrame]].
|-
| 0x4C || 0x4 || Padding
|-
| 0x50 || 0x10 || First 0x10-bytes of [[#SecurityParameter]].
|-
| 0x60 || 0x2 || Same as [[#SecurityConfig]]+0x0.
|-
| 0x62 || 0x1 || [[#AcceptPolicy]]
|-
| 0x63 || 0x1 || Only set with [[#Scan]]/[[#ScanPrivate]], when +0x4B is value 0x2. See [[#ActionFrame]].
|-
| 0x64 || 0x2 || Padding
|-
| 0x66 || 0x1 || Maximum participants, for the [[#NodeInfo|NodeInfo]] array.
|-
| 0x67 || 0x1 || ParticipantNum, number of set entries in the [[#NodeInfo|NodeInfo]] array. If +0x4B is not 0x2, ParticipantNum should be handled as if it's 0.
|-
| 0x68 || 0x200(0x40*8) || Array of [[#NodeInfo|NodeInfo]] with 8 entries, starting with the AccessPoint node.
|-
| 0x268 || 0x2 || Reserved
|-
| 0x26A || 0x2 || AdvertiseData size
|-
| 0x26C || 0x180 || AdvertiseData
|-
| 0x3EC || 0x8C || Reserved
|-
| 0x478 || 0x8 || [6.0.0+] Random AuthenticationId. Set to the output from [[ETicket_services|es]] cmd1501 during network creation.
|}

= ScanFilter =
This is "nn::ldn::ScanFilter". This is a 0x60-byte struct with 8-byte alignment.

sdknso copies the input ScanFilter to a tmp struct on stack, which is then used with the cmd.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || When enabled, this will be overwritten if it's -1. The data written for this is the first [[NACP_Format|LocalCommunicationId]] for the user-process loaded via [[Glue_services|arp:r]], if loading fails value 0 is written instead. During filtering if enabled, u8 [[#NetworkInfo]]+0x4B must match 0x2, and this ScanFilter field must match [[#NetworkInfo]]+0x0.
|-
| 0x8 || 0x2 || Padding
|-
| 0xA || 0x2 || During filtering if enabled, u8 [[#NetworkInfo]]+0x4B must match 0x2, and this ScanFilter field must match [[#NetworkInfo]]+0xA.
|-
| 0xC || 0x4 || Padding
|-
| 0x10 || 0x10 || During filtering if enabled, u8 [[#NetworkInfo]]+0x4B must match 0x2, and this ScanFilter data must match [[#NetworkInfo]]+0x10.
|-
| 0x20 || 0x4 || When enabled, must be <=0x3, and during filtering must match u8 [[#NetworkInfo]]+0x4B.
|-
| 0x24 || 0x6 || [[#MacAddress|MacAddress]]. Only copied with [[#ScanPrivate]]. During filtering if enabled, this must match [[#NetworkInfo]]+0x20.
|-
| 0x2A || 0x22 || [[#Ssid]]. During filtering if enabled, this must match [[#NetworkInfo]]+0x26 (the [[#Ssid]] there must be valid for this as well). The strings are compared, without verifying the length field in [[#Ssid]] matches.
|-
| 0x4C || 0x10 || Cleared to zero for the tmp struct.
|-
| 0x5C || 0x4 || Flags. Masked with 0x37 for [[#Scan]], with [[#ScanPrivate]] this is masked with 0x3F.
|}

Flags:

{| class="wikitable" border="1"
|-
! Bit
! Description
|-
| 0 || When set, enables using ScanFilter+0.
|-
| 1 || When set, enables using ScanFilter+0x10.
|-
| 2 || When set, enables using ScanFilter+0x20.
|-
| 3 || When set, enables using the ScanFilter [[#MacAddress|MacAddress]].
|-
| 4 || When set, enables using the ScanFilter [[#Ssid]].
|-
| 5 || When set, enables using ScanFilter+0xA.
|}

= NetworkConfig =
This is "nn::ldn::NetworkConfig". This is a 0x20-byte struct with 8-byte alignment.

sdknso copies the input NetworkConfig to a tmp struct on stack, which is then used with the cmd ([[#CreateNetwork]], [[#CreateNetworkPrivate]], [[#ConnectPrivate]]).

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || LocalCommunicationId. Same as [[#NetworkInfo]]+0x0. [[#CreateNetwork]]/[[#CreateNetworkPrivate]]/[[#Connect]]/[[#ConnectPrivate]]: When -1, this is overwritten with the first [[NACP_Format|LocalCommunicationId]] for the user-process loaded via [[Glue_services|arp:r]], if loading fails value 0 is written instead. Otherwise when not -1, if control.nacp loading is successful with [[Glue_services|arp:r]], this field must match one of the LocalCommunicationIds from there otherwise an error is thrown.
|-
| 0x8 || 0x2 || Cleared to zero during the copy.
|-
| 0xA || 0x2 || Same as [[#NetworkInfo]]+0xA.
|-
| 0xC || 0x4 || Cleared to zero during the copy.
|-
| 0x10 || 0x2 || s16 Channel, can be zero. Same as [[#NetworkInfo]]+0x48.
|-
| 0x12 || 0x1 || s8. Same as [[#NetworkInfo]]+0x66. [[#CreateNetwork]]/[[#CreateNetworkPrivate]]: Must be 0x1-0x8.
|-
| 0x13 || 0x1 || Cleared to zero during the copy.
|-
| 0x14 || 0x2 || Same as [[#NetworkInfo]]+0x96 (LocalCommunicationVersion from the first [[#NodeInfo|NodeInfo]]). Must not be negative. [[#Connect]]/[[#ConnectPrivate]]: This must match the value for the AccessPoint LocalCommunicationVersion.
|-
| 0x16 || 0xA || Cleared to zero during the copy.
|}

= NodeLatestUpdate =
This is "nn::ldn::NodeLatestUpdate". This is a 0x8-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || The field in state is reset to zero by [[#GetNetworkInfoLatestUpdate]] after loading it. Official apps checks whether this is non-zero.
|-
| 0x1 || 0x7 || Not initialized with [[#GetNetworkInfoLatestUpdate]].
|}

= WirelessControllerRestriction =
This is "nn::ldn::WirelessControllerRestriction". This is an u32 enum.

This is used to determine the value passed to [[BTM_services|btm]] SetWlanMode.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 ||
|-
| 1 || This is the default.
|}

= SecurityConfig =
This is "nn::ldn::SecurityConfig". This is a 0x44-byte struct with 2-byte alignment.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x2 || Type, a default of value 1 can be used here. Overwritten by [[#CreateNetwork]]/[[#CreateNetworkPrivate]] and [[#Connect]]/[[#ConnectPrivate]]. The value used internally by these cmds must be 1-3.
|-
| 0x2 || 0x2 || Data size. Must be 0x10-0x40.
|-
| 0x4 || 0x40 || Data, used with key derivation.
|}

Type:
* 1-2: Broadcast Action frame data is encrypted and is verified with SHA256.
* 3: Broadcast Action frame data is plaintext and is verified with SHA256.

* 1: Data frames are encrypted.
* 2-3: Data frames for normal data-transfer are plaintext - the network is Open.

= SecurityParameter =
This is "nn::ldn::SecurityParameter". This is a 0x20-byte struct with 1-byte alignment.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x10 || Data, used with the same key derivation as [[#SecurityConfig]].
|-
| 0x10 || 0x10 || NetworkId, see [[#NetworkInfo]].
|}

= UserConfig =
This is "nn::ldn::UserConfig". This is a 0x30-byte struct with 1-byte alignment.

sdknso copies the input UserConfig to a tmp struct on stack, which is then used with the cmd.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x20 || NUL-terminated string for the user nickname.
|-
| 0x20 || 0x10 || Cleared to zero during the copy.
|}

= AddressEntry =
This is "nn::ldn::AddressEntry". This is a 0xC-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || [[#Ipv4Address]]
|-
| 0x4 || 0x6 || [[#MacAddress|MacAddress]]
|-
| 0xA || 0x2 || Padding
|}

= AcceptPolicy =
This is "nn::ldn::AcceptPolicy". This is an u8.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || Allow all.
|-
| 1 || Deny all.
|-
| 2 || Blacklist, addresses in the [[#AddAcceptFilterEntry|list]] are not allowed.
|-
| 3 || Whitelist, only addresses in the [[#AddAcceptFilterEntry|list]] are allowed.
|}

= MacAddress =
This is "nn::ldn::MacAddress". This is a 6-byte struct with 1-byte alignment.

= NodeInfo =
This is "nn::ldn::NodeInfo".

The fields listed as Reserved are cleared during the memset and are not written to again afterwards, with cmds which return [[#NetworkInfo]].

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || [[#Ipv4Address]]
|-
| 0x4 || 0x6 || [[#MacAddress|MacAddress]]
|-
| 0xA || 0x1 || s8 ID / index
|-
| 0xB || 0x1 || IsConnected
|-
| 0xC || 0x20 || First 0x20-bytes of [[#UserConfig]].
|-
| 0x2C || 0x2 || Reserved
|-
| 0x2E || 0x2 || s16 LocalCommunicationVersion
|-
| 0x30 || 0x10 || Reserved
|}

= ConnectOption =
This is "nn::ldn::ConnectOption". This is an u32 bitmask.

There's two versions of the sdknso funcs for [[#Connect]]/[[#ConnectPrivate]]: the version where the ConnectOption isn't user-specified uses a default value of 0x1 for it, with the same ShowError code without the bit0 check.

When bit0 here is set after using the above cmds, the sdknso funcs will use [[Error_Applet|ShowError]] with the returned Result if: (rc & 0x3FE1FF) == 0xE0CB.

This must be <=0x1, besides this validation ConnectOption is ignored by [[#Connect]]/[[#ConnectPrivate]].

= OperationMode =
This is "nn::ldn::OperationMode". This is an u32 enum.

This controls bit1 in the value passed to [[WLAN_services|wlan:lcl]] cmd0/cmd1: bit1 = OperationMode==1.

Value 1 seems to affect power (?) related fields in the beacon tags?

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || This is the default.
|-
| 1 ||
|}

= MacAddress =
This is "nn::lp2p::MacAddress". Same as [[#MacAddress|MacAddress]].

= GroupId =
This is "nn::lp2p::GroupId". This is a 6-byte struct with 1-byte alignment.

This is a WiFi BSSID.

= NodeInfo =
This is "nn::lp2p::NodeInfo". This is a 0x80-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || || <code>struct sockaddr</code> for the IP address.
|-
| 0x24 || 0x6 || [[#MacAddress_2|MacAddress]]
|}

= GroupInfo =
This is "nn::lp2p::GroupInfo". This is a 0x200-byte struct.

[[Mario Kart Live: Home Circuit|mklive]] sets the SSID to a string generated from random data.

[[#Scan_2|Scan]] only uses the following fields for the cmd input struct: SupportedPlatform/Priority, Frequency/Channel, and PresharedKeyBinarySize/PresharedKey.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x10 || Wrapped master key. When zero, set to randomly-generated data. This is decrypted with a "static AES key" and used to derive the 4 encryption keys for the session.
|-
| 0x10 || 0x8 || LocalCommunicationId. When zero, the value from control.nacp is loaded. This is later validated by [[#Join]]/[[#CreateGroup]] the same way as the [[#NetworkConfig]] field. Used during key derivation to derive keys B and D.
|-
| 0x18 || 0x6 || [[#GroupId]] ("GROUP ID (BSSID)"). When zero, the default is used. The default should be used here: an error is thrown if the data here doesn't match the output from [[WLAN_services|wlan:lcl]] cmd2.
|-
| 0x1E || 0x21 || ServiceName ("GROUP NAME (SSID)"). NUL-terminated string. See below.
|-
| 0x3F || 0x1 || s8 Flags count. Must be <=0x3F.
|-
| 0x40 || 0x40 || Array of s8 with the above count. Each entry value must be <=0x3F. Each entry is an array index used to load a set of flags from a global array with the specified index. global_flags are also masked with flags loaded from here. User-processes use entryval=1 as the default, with [11.0.0+] entryval=0 can be used for standard WPA2-PSK (see +0x8A).
|-
| 0x80 || 0x1 || SupportedPlatform. Must match value 1. 0 is PlatformIdNX, 1 is PlatformIdRcd.
|-
| 0x81 || 0x1 || MemberCountMax. s8, Must be <=0x8. During group creation this is passed to [[WLAN_services|wlan:lcl]] cmd40, when this is value 0 a default of value 1 is passed. During group-creation when the below +0x88 field is not value 0x2, the passed [[BTM_services#SetWlanMode|WlanMode]] is <code>x81_field_val > 3</code>.
|-
| 0x82 || 0x1 ||
|-
| 0x84 || 0x2 || Frequency. Wifi frequency: 24 = 2.4GHz, 50 = 5GHz.
|-
| 0x86 || 0x2 || s16 Channel ("CHANNEL"). Wifi channel number. 0 = use default, otherwise this must be one of the following depending on the frequency field:
* 24: 1, 6, 11.
* 50: 36, 40, 44, 48.
|-
| 0x88 || 0x1 || NetworkMode. Used during group-creation to determine the [[BTM_services#SetWlanMode|WlanMode]] to use. When this is value 0x2, mode=3 is used, otherwise it's determined via the +0x81 field.
|-
| 0x89 || 0x1 || PerformanceRequirement.
|-
| 0x8A || 0x1 || Security type, used during key derivation. 0 = use defaults, 1 = plaintext, 2 = encrypted. [11.0.0+] 3: Standard WPA2-PSK.
|-
| 0x8B || 0x1 || StaticAesKeyIndex. s8, used as the array-index for selecting the KeySource used with [[SPL_services#GenerateAesKek|GenerateAesKek]] during key derivation. Should be 1-2, otherwise GenerateAesKek is skipped and zeros are used for the AccessKey instead.
|-
| 0x8D || 0x1 || Priority. Must match one of the following, depending on the used service (doesn't apply to [[#Join]]): 55 = SystemPriority (lp2p:sys), 90 = ApplicationPriority (lp2p:app and lp2p:sys).
|-
| 0x8E || 0x1 || StealthEnabled. Bool flag, controls whether the SSID is hidden.
|-
| 0x8F || 0x1 || If zero, a default value of 0x20 is used.
|-
| 0x1C0 || 0x1 || PresharedKeyBinarySize. Must be 0x20 for PresharedKeyBinary. [11.0.0+] With WPA2-PSK, this must be value 1.
|-
| 0x1C1 || 0x3F ([9.0.0-10.2.0] 0x20) || PresharedKey. Used to derive encryption keys A and C. [11.0.0+] With WPA2-PSK, this is the passphrase string (length must be at least 8).
|}

In order for the ServiceName to be valid without a new one being generated, the following checks must pass:
* It loops through the characters in the string, looking for the first '_' character:
** The loop will exit once a '_' character is found.
** The character must be '-', or alphanumeric (lowercase/uppercase), otherwise the function will immediately return failure.
** The loop will also exit once string_pos is >19, in which case the function will also immediately return failure.
* Then it checks the 11 characters which follow the above:
** The character must be hex: '0'-'9', or 'A-F' / 'a-'f.
* The following character must be a NUL-terminator.
* The last hex character above, then the characters for the whole string prior to the last hex character are summed. return sum % 0x2B == 0. u32 is used for these calculations. (Return success when sum is a multiple of 0x2B, otherwise return failure)

If the above fails, then the following runs, otherwise it just returns 0:
* It loops through the characters in the string.
** The character must be '-', or alphanumeric (lowercase/uppercase), otherwise the function will immediately return failure.
** The loop will exit once string_pos>20 is reached, or when a NUL-terminator is reached.
* Once finished, success is returned if string_pos-1 is <20, otherwise failure is returned (which also immediately occurs if the first character is a NUL-terminator).

If the above fails, an error is returned, otherwise a new ServiceName is generated:
* Up to 20 characters are copied from the original ServiceName to the output ServiceName, stopping once the limit is reached or when a NUL-terminator is reached.
* '_' is appended to the string.
* <code>nn::util::TSNPrintf({strptr following the above character}, {remaining size}, "%02X%02X%02X%02X%02X", [[#GroupId|GroupId_byte3]], [[#GroupId|GroupId_byte4]], [[#GroupId|GroupId_byte5]], ([[SPL_services#IsDevelopment|IsDevelopment]] ? 0x80 : 0) | 0x1, 0);</code>
* Then the last character is set to the output from a calling a function:
** All string characters which were already written are summed same way as above. Then: <code>return character_lookup_table[sum % 0x2B];</code> (If the length passed to this function is 0, this will instead just return character_lookup_table[0])
*** character_lookup_table contains 0x2B entries: [V-A][k-a][5-0][Z-W].

loaded_flags are first loaded from elsewhere, then masked with the above flags when available. loaded_flags are used when +0x8A is 0. global_flags are loaded from global data. These flags are only used with [[#CreateGroup]]/[[#Join]]. Flags (note that the following was updated with [11.0.0+], and differs from below):
* Bit2 clear:
** global_flags must be non-zero, and loaded_flags bit1 must be set.
** u8 +0x8A is set to value 1.
** When the cached [[SPL_services#IsDevelopment|IsDevelopment]] value is false (retail), an error is thrown.
** u8 +0x8B is set to value 0.
* Otherwise, if bit2 is set:
** u8 +0x8A is set to value 2.
** global_flags bit1 set:
*** u8 +0x8B is set to value 1.
** Otherwise, if global_flags bit2 is set:
*** u8 +0x8B is set to value 2.

= ScanResult =
This is "nn::lp2p::ScanResult". This is a 0x300-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x200 || [[#GroupInfo]]
|-
| 0x200 || 0x1 ||
|-
| 0x206 || 0x2 || AdvertiseData size.
|-
| 0x208 || 0x80 || AdvertiseData
|}

= Network protocol =
== ldn ==
A beacon and Action frame are broadcasted. The SSID in the beacon is hidden (32-bytes with value 0). For [[#Scan]]/[[#ScanPrivate]] it doesn't matter if no beacon is available ([[#NetworkInfo]] is the same), as long as the Action frame is broadcasted. However, the Station will not send a probe-request during connection if no beacon is available (and therefore not attempt any communication with the AccessPoint). The beacon doesn't have any custom Nintendo data, that data is in the Acton frame.

During connection, the Station first sends a probe-request using the [[#NetworkInfo|generated]] SSID from the Action frame. If the probe-response contains the expected data for the [[#SecurityConfig]] type, the Station then proceeds to connect to the AccessPoint. The key for data-frames, if [[#SecurityConfig|enabled]], is derived from a buffer containing: {[[#SecurityParameter]]+0x0} followed by {[[#SecurityConfig]] data with the specified data-size}. The [[#ActionFrame]]/data-frame keys are derived with the same func, the only difference is the input passed to this func + the passed constant data. The key derived by ldn is used directly as the static CCMP key for all data-frames (CCMP / MIC is standard).

Then the Station scans for an [[#ActionFrame]] for loading the [[#NetworkInfo]].

Once connected, the AccessPoint sends Epigram-vendor Action frame(s) (same data) to the Station, the Station doesn't require these frames: <code>dd1afeedfacedeadbeef010000000a00000000000000000000000000</code>. Then the Station must Authenticate with the AccessPoint, this is custom. The Station sends a frame (a maximum of 3 times in some cases if errors occur, with the same data), and the AccessPoint sends a response. Once Authenticated, the node is added to the [[#NodeInfo|NodeInfo]] array in [[#NetworkInfo]]. If the Station does not successfully Authenticate X-seconds after connecting, the AccessPoint disconnects the Station. If the Station fails to Authenticate, the Station itself will disconnect as well.

After Authentication the Station will scan for another [[#ActionFrame]], with frame-comparision enabled with the above frame (frame must have been updated since the previous scan). The Station locates the index for a [[#MacAddress|MacAddress]] matching itself in the [[#NetworkInfo]] [[#NodeInfo|NodeInfo]] array (the entry for the AccessPoint is skipped), throwing an error if not found. After validating the LocalCommunicationVersion, it proceeds to handle ARP setup below.

This does not use DHCP, each node on the network has to manually setup ARP (without sending ARP network requests) with the [[#NodeInfo|NodeInfo]] array in [[#NetworkInfo]].

At this point standard sockets can be used over Data frames.

=== EthFrame ===
The custom Ethernet frames have the following structure:
* "Type: IEEE 802a OUI Extended Ethertype (0x88b7)"
* "IEEE802a OUI Extended Ethertype":
** "Organization Code: 00:22:aa (Nintendo Co., Ltd.)"
** "Protocol ID: {...}"
*** Depends on the frame:
*** 0x0102: [[#Authentication]]
*** 0x0103: ?
* The first byte of Data is value 0, then the ProtocolID-specific data follows, see below.
** ProtocolID 0x0103 frames are sent by the AccessPoint to the Station. This is 0x20-bytes of zeros, except for the first byte which is 0x3. This is sent by the AccessPoint prior to destroying the network.

==== Authentication ====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || [[#AuthVersion]]
|-
| 0x1 || 0x1 || Low u8 for the size.
|-
| 0x2 || 0x1 || Status. 0 = success, non-zero = error.
|-
| 0x3 || 0x1 || [2.0.0+] bool flag. The AccessPoint verifies that this is not set. Always set to 1 by the AccessPoint in the response. The Station only uses this when the [[#AuthVersion]] is >=2.
|-
| 0x4 || 0x1 || [6.0.0+] High u8 for the size.
|-
| 0x5 || 0x3 || Unused, zeros.
|-
| 0x8 || 0x20 || [[#NetworkInfo]]+0, must match the corresponding data in [[#NetworkInfo]] when the receiving node verifies this. With the
AccessPoint->Station frame, the Station verifies that this matches the data previously sent to the AccessPoint.
|-
| 0x28 || 0x10 || [[#NetworkInfo]]+0x50, must match the corresponding data in [[#NetworkInfo]] when the receiving node verifies this. With the
AccessPoint->Station frame, the Station verifies that this matches the data previously sent to the AccessPoint.
|-
| 0x38 || 0x10 || See below.
|-
| 0x48 || || Frame-specific data, with the above size. The total frame size - {offset of the start of this data in the frame} must match the above size.
|}

The Station sets the above size to 0x40 ([6.0.0+] if [[#NetworkInfo]]+0x13 is <3). [6.0.0+] The Authentication challenge is only used/enabled if that value is >=3, and [[#IUserLocalCommunicationService]] is being used.

The AccessPoint sets the above size to 0x40 ([6.0.0+] 0x0 if the +0x0 [[#AuthVersion]] is <3). [6.0.0+] The AccessPoint will only use/enable the Authentication challenge when the +0x0 [[#AuthVersion]] is >=3, and [[#IUserLocalCommunicationService]] is being used. This data will not be included in the frame if the status field indicates error.

[6.0.0+] Support for the Authentication challenge with [[ETicket_services|es]] cmds 1501-1504 was added.

Station->AccessPoint frame, relative to +0x0 above (frame size depends on whether +0xAC is enabled):

The AccessPoint will not respond to frames where the source mac-address is unrecognized.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x38 || 0x10 || The Station sets this to random data. Unused by the AccessPoint, except for copying into the response.
|-
| 0x48 || 0x20 || [[#UserConfig]]+0. Copied into state by the AccessPoint.
|-
| 0x68 || 0x2 || Big-endian LocalCommunicationVersion. Byte-swapped by the AccessPoint then copied into state.
|-
| 0x6A || 0x1E || Zeros, unused by the AccessPoint.
|-
| 0x88 || 0x24 || [6.0.0+] Zeros, unused by the AccessPoint.
|-
| 0xAC || 0x300 || [6.0.0+] Authentication challenge data. If enabled, the total frame size must be >= {end offset of this data in the frame}. The frame data does not include this if it's not enabled.
|}

AccessPoint->Station response frame, relative to +0x0 above (frame size depends on whether +0x48/+0xCC are enabled):

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x38 || 0x10 || +0x38 from the data originally sent by the Station. The Station verifies that this matches the previously sent data.
|-
| 0x48 || 0x40 || Zeros. [6.0.0+] Only included in the frame if it's enabled (+0x0 [[#AuthVersion]] >= 3). Unused by the Station.
|-
| 0x88 || 0x44 || [6.0.0+] Only included in the frame if it's enabled (+0x0 [[#AuthVersion]] >= 3). Unused by the Station.
|-
| 0xCC || 0x100 || [6.0.0+] If enabled, Authentication challenge response data. Not included in the frame if it's not enabled.
|}

===== AuthVersion =====
Must be 0x1-0xF.

{| class="wikitable" border="1"
|-
! Value || SystemVersion
|-
| 1 || [1.0.0+]
|-
| 2 || [2.0.0+]
|-
| 3 || [6.0.0+]
|}

=== ActionFrame ===
The Action frames have the following structure:
* "Fixed parameters":
** "Category code: Vendor Specific (127)"
** "OUI: 00:22:aa (Nintendo Co., Ltd.)"
* The Data starts with the following header:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x2 || 04 00 in sent frames.
|-
| 0x2 || 0x2 || Protocol ID, must be 0x0101.
|-
| 0x4 || 0x2 || Must be 0.
|-
| 0x6 || 0x2 || Zeros, unused.
|}

Then the actual data follows:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x20 || [[#NetworkInfo]]+0x0. The u64/u16 are big-endian. Outside of [[#Scan]]/[[#ScanPrivate]], this must match the previously loaded data for this.
|-
| 0x20 || 0x1 || [[#AuthVersion]]. Copied to [[#NetworkInfo]]+0x63. When comparing with a previous frame is enabled, this must match the value from the previous frame.
|-
| 0x21 || 0x1 || Encryption type: 1 = plaintext, 2 = encrypted, {frames with other values are ignored by [[#Scan]]/[[#ScanPrivate]]}. Must match the type which is currently being used: with [[#Scan]]/[[#ScanPrivate]] this is determined via this field, otherwise [[#SecurityConfig]] is used to determine this.
|-
| 0x22 || 0x2 || Big-endian u16 size for the data starting at +0x48, must be <=0x500, and must match {total frame size relative to +0x0 above} + 0x48.
|-
| 0x24 || 0x4 || Big-endian u32 Counter. The initial value is randomly-generated. This is incremented each time the below content is updated (including initial creation). Also used by the Station to determine whether the frame changed compared to a previous one. When comparing against a previous frame, new_counter-prev_counter must be <= 0xFF, and the counters must not match.
|-
| 0x28 || 0x20 || SHA256 hash over the entire frame starting at +0x0, with the above size + 0x48. During hashing, this hash is cleared, with the new hash overwriting the original in memory (the original is copied to stack for comparing).
|}

When encryption is enabled, the encrypted data is +0x28 with size {remaining frame size}. This is encrypted with AES-128-CTR. The key is derived from the raw 0x20-bytes at +0x0. The CTR is {raw Counter above without byte-swap}, with the rest cleared to zeros.

The content data at +0x48 follows, which has the size specified above (which must be >=0x500), where all fields are big-endian:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x10 || [[#NetworkInfo]]+0x50
|-
| 0x10 || 0x2 || [[#NetworkInfo]]+0x60
|-
| 0x12 || 0x1 || [[#NetworkInfo]]+0x62
|-
| 0x13 || 0x3 || Unused
|-
| 0x16 || 0x1 || s8 [[#NetworkInfo]]+0x66, clamped to range 1-8.
|-
| 0x17 || 0x1 || s8 [[#NetworkInfo]]+0x67, clamped to range 1-8.
|-
| 0x18 || 0x1C0(0x38*8) || Array of the below node struct.
|-
| 0x1D8 || 0x2 || Unused
|-
| 0x1DA || 0x2 || [[#NetworkInfo]]+0x26A
|-
| 0x1DC || 0x180 || [[#NetworkInfo]]+0x26C
|-
| 0x35C || 0x19C || Unused
|-
| 0x4F8 || 0x8 || [6.0.0+] [[#NetworkInfo]]+0x478
|}

The data here is copied into [[#NetworkInfo]].

Node data used in the above array (all fields big-endian), which are copied into the [[#NetworkInfo]] [[#NodeInfo|NodeInfo]] array:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || [[#Ipv4Address]]
|-
| 0x4 || 0x6 || [[#MacAddress|MacAddress]]
|-
| 0xA || 0x1 || bool IsConnected
|-
| 0xB || 0x1 || Unused
|-
| 0xC || 0x20 || First 0x20-bytes of [[#UserConfig]].
|-
| 0x2C || 0x2 || s16 LocalCommunicationVersion
|-
| 0x2E || 0xA || Unused
|}

== lp2p ==
This is used for communicating with accessories (external devices on [11.0.0+]) over local wifi. [[Mario Kart Live: Home Circuit]] uses this. [11.0.0+] [[Album_Applet|LibraryAppletPhotoViewer]] uses this.

A beacon is broadcasted.

Action frames are only sent when done so by [[#SendToOtherGroup]] (other than the Epigram one mentioned below).

Communication uses sockets with standard Data frames and the above Action frames. Switch consoles presumably only use the Action frames to communicate with each other?

Key A derived by ldn-sysmodule is used directly as the static CCMP key for all data-frames (CCMP / MIC is standard). However, with [[#GroupInfo]]+0x8A value 3, standard WPA2-PSK is used instead.

This uses infrastructure-mode (AccessPoint), and DHCP is used. The group-owner is the AccessPoint. Note that the probe response includes the same Nintendo tags included with the beacon. Once connected, the group-owner sends the same Epigram-vendor Action frame(s) described in [[#ldn]]. At this point socket communication can begin, including DHCP usage.

The DHCP server thread is started by the "nn.lp2p.StateMachine" thread eventually during group [[#CreateGroup|creation]]. The DHCP Offer option values are the following:
* "Subnet Mask: 255.255.255.0"
* "DHCP Server Identifier: {...}"
* "Broadcast Address: {...}"
* "IP Address Lease Time: (5s) 5 seconds"
* "Renewal Time Value: (0s) 0 seconds"
* "Rebinding Time Value: (0s) 0 seconds"
* "Interface MTU: 1500"

Note that the above options doesn't include "Domain Name Server" or "Router", the client device may fail to connect if it doesn't allow those DHCP options to be missing.

=== Beacon ===
The SSID in the beacon can optionally be [[#GroupInfo|hidden]] (all-zero with the same length as the original SSID). The beacon contains two vendor-specific Nintendo information elements with OUI <code>00:22:aa</code>; each IE has a 2-byte ID following the OUI. These Nintendo IEs are not used when standard WPA2-PSK is being used.

The beacon is identical to ldn, except for the following (besides SSID length difference and the lp2p-only Nintendo tags):
* "Tag: Traffic Indication Map (TIM)": "DTIM count" for lp2p is 1, with ldn it's 0.
* "Tag: HT Capabilities (802.11n D1.10)": "HT Short GI for 20MHz" is set to "Not supported", for ldn it's "Supported".
* "Tag: Vendor Specific: Microsoft Corp.: WMM/WME: Parameter Element" "Ac Parameters ACI 0": "CW Min: 15" for lp2p, "CW Min: 63" for ldn.

Note that during group creation the beacon may be missing the Nintendo IEs in some cases, since group creation didn't finish yet.

==== Nintendo IE 0 ====

The first Nintendo IE (ID 0x0600) contains the following fixed parameters:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || Fixed 0x20; perhaps a version or other magic number.
|-
| 0x1 || 0x1 || [[#GroupInfo|SecurityType]]
|-
| 0x2 || 0x1 || [[#GroupInfo|StaticAesKeyIndex]]
|-
| 0x3 || 0x1 || Fixed zero; padding byte.
|-
| 0x4 || 0x8 || Big-endian (i.e. byte-reversed) version of [[#GroupInfo|LocalCommunicationId]]. This is the only context where LocalCommunicationId is reversed.
|-
| 0xC || 0x10 || Wrapped master key. Same as [[#GroupInfo]]+0x0.
|-
| 0x1C || 0x4 || If encryption is enabled, a randomly-generated nonce, else nothing. Appending 8 zero bytes to this yields the AES-GCM IV.
|-
| 0x20 || 0x10 || If encryption is enabled, the AES-GCM MAC tag, else nothing. All bytes prior to this (fixed 0x20 through nonce) are the additional authenticated data. All bytes after this are encrypted with key B.
|}

After this, TLV tagged parameters occur. Each TLV tag is formatted as:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || Tag type
|-
| 0x1 || 0x1 || Length
|-
| 0x2 || {above size} || Data for the tag
|}

Known TLV tags:

{| class="wikitable" border="1"
|-
! Type
! Size
! Description
|-
| 0x1 || 0x2 || Additional network parameters: 0xAB 0xCD. A=[[#GroupInfo]]+0x82, B=[[#GroupInfo|MemberCountMax]], C=[[#GroupInfo|NetworkMode]], D=[[#GroupInfo|PerformanceRequirement]].
|-
| 0x2 || 0x8 || Flags: Bitwise-or of (1<<f) for each entry in [[#GroupInfo]]+0x40
|}

==== Nintendo IE 1 ====

The second Nintendo IE (ID 0x0601) contains only TLVs. If encryption is enabled, a 0x4-byte nonce and 0x10-byte AES-GCM tag are written first, as above, and the TLVs are encrypted. Key C is used.

Known TLV tags:

{| class="wikitable" border="1"
|-
! Type
! Size
! Description
|-
| 0x21 || Varies || AdvertiseData
|}

=== ActionFrame ===
The Action frames have the following structure:
* "Fixed parameters":
** "Category code: Vendor Specific (127)"
** "OUI: 00:22:aa (Nintendo Co., Ltd.)"
* The Data starts with the following:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x2 || Usually 06 00?
|-
| 0x2 || 0x2 || Usually 20 02?(Second byte depends on whether encryption is used?)
|-
| 0x4 || 0x2 || Usually 02 00?(varies)
|-
| 0x6 || 0x8 || Big-endian version of [[#GroupInfo]]+0x10.
|-
| 0xE || 0x10 || Same as [[#GroupInfo]]+0x0.
|}

When encryption is used, the remaining data is:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || Big-endian u32 Counter. The initial value is randomly-generated (?). This is incremented with each sent Action frame.
|-
| 0x4 || {remaining size} || Encrypted user-data. Also includes 0x10-bytes of unknown data.
|}

When plaintext is used, the remaining data is:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || {remaining size} || Plaintext user-data.
|}

[[Category:Services]]

Talk:LDN services

2021-02-05T18:55:44Z

CFSworks: /* PlatformIdFuji -> PlatformIdRcd? */

== PlatformIdFuji -> PlatformIdRcd? ==

I noticed that [[User:Hexkyz|Hexkyz]] made [https://switchbrew.org/w/index.php?title=LDN_services&diff=10087&oldid=10083 this edit] which dubs SupportedPlatform=1 as "PlatformIdFuji."

Does this come from a string in a system binary somewhere, or is it merely what we're calling it? If the latter, I think "PlatformIdRcd" fits better. The rationale being that Fuji appears to be the codename of the mklive kart/firmware, while "rcd" seems to be the part of the Switch SDK - albeit not (yet) part of sdknso - which handles communication with '''r'''emote '''c'''ontrolled '''d'''evices which are paired via LP2P link. And I would bet that there's an rcd device-side component as well. If this is a general-purpose framework (which "Fuji" is merely the first released product to leverage) then it would make sense for that to be what gets special treatment by the LDN sysmodule.

Thoughts? [[User:CFSworks|CFSworks]] ([[User talk:CFSworks|talk]]) 20:28, 4 February 2021 (UTC)

: That's a very good point. The string "PlatformIdFuji" is official, it was found in a leftover dev title (can't remember which one but I believe it was a version of DevMenuCommand) around the time service "ndd" was added (and later removed) to "ldn" by mistake. However, this was way before mklive was released. I only came to learn about the "rcd" namespace from mklive strings and my best guess is that "rcd" is indeed an umbrella namespace for the framework itself. "Fuji" was most likely a pre-release codename and might have been deprecated since, but no new strings/symbols have surfaced again so it's difficult to tell for sure.

: [[User:Hexkyz|Hexkyz]] ([[User talk:Hexkyz|talk]]) 15:48, 5 February 2021 (UTC)

:: For what it's worth, the kart is still called "Fuji." The "rcd" toolkit that appears in mklive implements a whole RPC protocol; the typename strings suggest it's fairly templated, and some of the templates implementing remote services are called "FujiControlClient," "FujiUpdateClient," "FujiPairingClient," and so on. There's also a "handshake" protocol which lacks any references to "Fuji," which suggests the Fuji*Client are specific to the kart, while the "handshake" is more generic. And to top it off, the kart calls itself "Fuji" (in an ASCII string, no less!) while handshaking.

:: From what you've said, it feels to me like Nintendo were originally intending the kart to be a one-off gimmick (hence the rcd tech wasn't considered separate from the "Fuji" project yet), but then decided they liked the idea of making RC toys that interoperate with the Switch, so they decided to spin off "rcd" as its own thing. I'm going to go ahead and make that edit; feel free to revert if you disagree.

:: [[User:CFSworks|CFSworks]] ([[User talk:CFSworks|talk]]) 20:55, 5 February 2021 (CET)

Talk:LDN services

2021-02-04T19:28:46Z

CFSworks: /* PlatformIdFuji -> PlatformIdRcd? */ new section

Error codes

2021-02-02T23:35:26Z

CFSworks: /* Modules */ I think module 232 is Rcd

= Structure =
These have been redesigned from the 3DS so that they fit within a Aarch64 MOV instruction immediate most of the time (without requiring the additional MOVK).

{| class=wikitable
! Bits || Field
|-
| 8-0 || Module
|-
| 21-9 || Description
|}

When a fatal-error is received the error code is outputted using the following formatter:
%04d-%04d

.. where the first code is <code>2000 + Module</code>, and the other being <code>Description</code>. Bits >=22 from the error-code are unused when displaying fatal-errors, since the Description ends with bit21.

= Result Errors =
General errors used by system modules and applications.

== Modules ==
{| class=wikitable
! Value || Name
|-
| 1 || Kernel
|-
| 2 || Fs
|-
| 3 || OS
|-
| 4 || Htcs
|-
| 5 || Ncm
|-
| 6 || Dd
|-
| 7 || Dmnt
|-
| 8 || Lr
|-
| 9 || Loader
|-
| 10 || Cmif
|-
| 11 || Hipc
|-
| 15 || Pm
|-
| 16 || Ns
|-
| 17 || Bsdsockets
|-
| 18 || Htc
|-
| 19 || Tsc
|-
| 20 || Ncm (content)
|-
| 21 || Sm
|-
| 22 || Ro (userland)
|-
| 23 || Gc
|-
| 24 || Sdmmc
|-
| 25 || Ovln
|-
| 26 || Spl
|-
| 27 || Socket
|-
| 29 || Htclow
|-
| 30 || Ddsf
|-
| 31 || Htcfs
|-
| 32 || Async
|-
| 100 || Ethc
|-
| 101 || I2c
|-
| 102 || Gpio
|-
| 103 || Uart
|-
| 105 || Settings
|-
| 107 || Wlan
|-
| 108 || Xcd
|-
| 110 || Nifm
|-
| 111 || Hwopus
|-
| 112 || Sasbus
|-
| 113 || Bluetooth
|-
| 114 || Vi
|-
| 115 || Nfp
|-
| 116 || Time
|-
| 117 || Fgm
|-
| 118 || Oe
|-
| 120 || Pcie
|-
| 121 || Friends
|-
| 122 || Bcat
|-
| 123 || Ssl
|-
| 124 || Account
|-
| 125 || News
|-
| 126 || Mii
|-
| 127 || Nfc
|-
| 128 || Am
|-
| 129 || Prepo
|-
| 130 || Ahid
|-
| 132 || Qlaunch
|-
| 133 || Pcv
|-
| 134 || Omm
|-
| 135 || Bpc
|-
| 136 || Psm
|-
| 137 || Nim
|-
| 138 || Psc
|-
| 139 || Tc
|-
| 140 || Usb
|-
| 141 || Nsd
|-
| 142 || Pctl
|-
| 143 || Btm
|-
| 144 || La
|-
| 145 || ETicket
|-
| 146 || Ngc
|-
| 147 || Erpt
|-
| 148 || Apm
|-
| 149 || Cec
|-
| 150 || Profiler
|-
| 151 || Eupld
|-
| 153 || Audio
|-
| 154 || Npns
|-
| 155 || Npns XMPP stream
|-
| 157 || Arp
|-
| 158 || Updater
|-
| 159 || Swkbd
|-
| 161 || Mifare
|-
| 162 || Userland (assert)
|-
| 163 || Fatal
|-
| 164 || Ec (shop)
|-
| 165 || Spsm
|-
| 167 || Bgtc
|-
| 168 || Userland (crash)
|-
| 169 || Sasbus periodic receive mode
|-
| 175 || Jit
|-
| 177 || Hdcp
|-
| 178 || Pdm
|-
| 179 || Olsc
|-
| 180 || Srepo
|-
| 181 || Dauth
|-
| 187 || Sasbus
|-
| 189 || Pwm
|-
| 191 || Rtc
|-
| 192 || Regulator
|-
| 193 || Led
|-
| 197 || Clkrst
|-
| 198 || Powctl
|-
| 202 || Hid
|-
| 203 || Ldn
|-
| 204 || Cs
|-
| 205 || Irsensor
|-
| 206 || Capture
|-
| 208 || Manu
|-
| 209 || Atk
|-
| 210 || Web
|-
| 211 || Lcs
|-
| 212 || Grc
|-
| 214 || Album
|-
| 216 || Migration
|-
| 217 || Migration idc server
|-
| 218 || Hidbus
|-
| 223 || Websocket
|-
| 227 || Capmtp
|-
| 228 || Pgl
|-
| 229 || Notification
|-
| 230 || Ins
|-
| 231 || Lp2p
|-
| 232 || Rcd?
|-
| 244 || Dp2hdmi
|}

== Error codes ==
{| class=wikitable
! Value || Module || Description || Notes
|-
| 0x0E01 || 1 || 7 || Session count exceeded
|-
| 0x1C01 || 1 || 14 || Invalid kernel capability descriptor
|-
| 0x4201 || 1 || 33 || Not Implemented
|-
| 0x7601 || 1 || 59 || Thread terminated/termination requested
|-
| 0x8C01 || 1 || 70 || No more debug events
|-
| 0xCA01 || 1 || 101 || Invalid size
|-
| 0xCC01 || 1 || 102 || Invalid address
|-
| 0xCE01 || 1 || 103 || Resource exhaustion
|-
| 0xD001 || 1 || 104 || Memory exhaustion
|-
| 0xD201 || 1 || 105 || Handle-table exhaustion
|-
| 0xD401 || 1 || 106 || Invalid memory state / invalid memory permissions.
|-
| 0xD801 || 1 || 108 || Invalid memory permissions.
|-
| 0xDC01 || 1 || 110 || Invalid memory range
|-
| 0xE001 || 1 || 112 || Invalid thread priority.
|-
| 0xE201 || 1 || 113 || Invalid processor id.
|-
| 0xE401 || 1 || 114 || Invalid handle.
|-
| 0xE601 || 1 || 115 || Invalid pointer/Syscall copy from user failed.
|-
| 0xE801 || 1 || 116 || Invalid combination
|-
| 0xEA01 || 1 || 117 || Time out. Also when you give 0 handles to svcWaitSynchronizationN.
|-
| 0xEC01 || 1 || 118 || Operation canceled
|-
| 0xEE01 || 1 || 119 || Out of range
|-
| 0xF001 || 1 || 120 || Invalid enum
|-
| 0xF201 || 1 || 121 || No such entry
|-
| 0xF401 || 1 || 122 || Irq/DeviceAddressSpace/{...} already registered
|-
| 0xF601 || 1 || 123 || Port remote dead
|-
| 0xF801 || 1 || 124 || [Usermode] Unhandled interrupt/exception
|-
| 0xFA01 || 1 || 125 || Invalid state
|-
| 0xFC01 || 1 || 126 || Reserved value
|-
| 0xFE01 || 1 || 127 || Invalid hardware breakpoint
|-
| 0x10001 || 1 || 128 || [Usermode] Fatal exception
|-
| 0x10201 || 1 || 129 || Last thread didn't belong to your process
|-
| 0x10601 || 1 || 131 || Port closed
|-
| 0x10801 || 1 || 132 || Resource limit exceeded
|-
| 0x20801 || 1 || 260 || Command buffer too small
|-
| 0x40A01 || 1 || 517 || Invalid process ID.
|-
| 0x40C01 || 1 || 518 || Invalid thread ID.
|-
| 0x40E01 || 1 || 519 || Invalid thread ID (used in svcGetDebugThreadParam).
|-
| 0x41001 || 1 || 520 || Process not being debugged
|-
| 0x202 || 2 || 1 || Path does not exist.
|-
| 0x402 || 2 || 2 || Path already exists.
|-
| 0xE02 || 2 || 7 || Resource already in use (file already opened, savedata filesystem already mounted).
|-
| 0x4602 || 2 || 35 || Not enough free space for BIS Calibration partition.
|-
| 0x4802 || 2 || 36 || Not enough free space for BIS Safe partition.
|-
| 0x4A02 || 2 || 37 || Not enough free space for BIS User partition.
|-
| 0x4C02 || 2 || 38 || Not enough free space for BIS System partition.
|-
| 0x4E02 || 2 || 39 || Not enough free space on SD card.
|-
| 0x6402 || 2 || 50 || NCA is older than version 3, or NCA SDK version is older than 0.11.0.0
|-
| 0x7802 || 2 || 60 || Specified mount name already exists.
|-
| 0x7D202 || 2 || 1001 || Process does not have RomFs
|-
| 0x7D402 || 2 || 1002 || Title-id not found / savedata not found.
|-
| 0xFA202 || 2 || 2001 || SD card not inserted
|-
| 0x13B002 || 2 || 2520 || Gamecard not inserted
|-
| 0x13B402 || 2 || 2522 || Attempted process an AsicHandler command in initial mode
|-
| 0x13D802 || 2 || 2540 || Attempted to read from the secure gamecard partition in normal mode
|-
| 0x13DA02 || 2 || 2541 || Attempted to read from the normal gamecard partition in secure mode
|-
| 0x13DC02 || 2 || 2542 || Attempted a read that spanned both the normal and secure gamecard partitions
|-
| 0x13E002 || 2 || 2544 || Gamecard initial data hash doesn't match the initial data hash in the card header
|-
| 0x13E202 || 2 || 2545 || Gamecard initial data reserved area is not all zeros
|-
| 0x13E402 || 2 || 2546 || Gamecard certificate kek index doesn't match card header kek index
|-
| 0x13EE02 || 2 || 2551 || Unable to read card header on gamecard init
|-
| 0x140A02 || 2 || 2565 || Encountered SDMMC error in write operation
|-
| 0x145002 || 2 || 2600 || Attempted to switch lotus state machine to secure mode from a mode other than normal
|-
| 0x145202 || 2 || 2601 || Attempted to switch lotus state machine to normal mode from a mode other than initial
|-
| 0x145402 || 2 || 2602 || Attempted to switch lotus state machine to write mode from a mode other than normal
|-
| 0x149402 || 2 || 2634 || Error processing lotus command SetUserAsicFirmware
|-
| 0x149A02 || 2 || 2637 || Error processing lotus command GetAsicCert
|-
| 0x14A002 || 2 || 2640 || Error processing lotus command SetEmmcEmbeddedSocCertificate
|-
| 0x14AA02 || 2 || 2645 || Error processing lotus command GetAsicEncryptedMessage
|-
| 0x14AC02 || 2 || 2646 || Error processing lotus command SetLibraryEncryptedMessage
|-
| 0x14B602 || 2 || 2651 || Error processing lotus command GetAsicAuthenticationData
|-
| 0x14B802 || 2 || 2652 || Error processing lotus command SetAsicAuthenticationDataHash
|-
| 0x14BA02 || 2 || 2653 || Error processing lotus command SetLibraryAuthenticationData
|-
| 0x14BC02 || 2 || 2654 || Error processing lotus command GetLibraryAuthenticationDataHash
|-
| 0x14C202 || 2 || 2657 || Error processing lotus command ExchangeRandomValuesInSecureMode
|-
| 0x14D802 || 2 || 2668 || Error calling nn::gc::detail::GcCrypto::GenerateRandomBytes
|-
| 0x14DE02 || 2 || 2671 || Error processing lotus command ReadAsicRegister
|-
| 0x14E002 || 2 || 2672 || Error processing lotus command GetGameCardIdSet
|-
| 0x14E402 || 2 || 2674 || Error processing lotus command GetCardHeader
|-
| 0x14E802 || 2 || 2676 || Error processing lotus command GetCardKeyArea
|-
| 0x14EA02 || 2 || 2677 || Error processing lotus command ChangeDebugMode
|-
| 0x14EC02 || 2 || 2678 || Error processing lotus command GetRmaInformation
|-
| 0x150802 || 2 || 2692 || Tried sending lotus card command Refresh when not in secure mode
|-
| 0x150A02 || 2 || 2693 || Tried sending lotus card command when not in correct mode
|-
| 0x155602 || 2 || 2731 || Error processing lotus card command ReadId1
|-
| 0x155802 || 2 || 2732 || Error processing lotus card command ReadId2
|-
| 0x155A02 || 2 || 2733 || Error processing lotus card command ReadId3
|-
| 0x155E02 || 2 || 2735 || Error processing lotus card command ReadPage
|-
| 0x156202 || 2 || 2737 || Error processing lotus card command WritePage
|-
| 0x156402 || 2 || 2738 || Error processing lotus card command Refresh
|-
| 0x156C02 || 2 || 2742 || Error processing lotus card command ReadCrc
|-
| 0x156E02 || 2 || 2743 || Error processing lotus card command Erase or UnlockForceErase
|-
| 0x157002 || 2 || 2744 || Error processing lotus card command ReadDevParam
|-
| 0x157202 || 2 || 2745 || Error processing lotus card command WriteDevParam
|-
| 0x16B002 || 2 || 2904 || Id2Normal did not match the value in the buffer returned by ChangeDebugMode
|-
| 0x16B202 || 2 || 2905 || Id1Normal did not match Id1Writer when switching gamecard to write mode
|-
| 0x16B402 || 2 || 2906 || Id2Normal did not match Id2Writer when switching gamecard to write mode
|-
| 0x171402 || 2 || 2954 || Invalid gamecard handle.
|-
| 0x172002 || 2 || 2960 || Invalid gamecard handle when opening normal gamecard partition
|-
| 0x172202 || 2 || 2961 || Invalid gamecard handle when opening secure gamecard partition
|-
| 0x177202 || 2 || 3001 || Unimplemented behavior
|-
| 0x177602 || 2 || 3003 || File/Directory already exists.
|-
| 0x190202 || 2 || 3201 || Memory allocation failure related to FAT filesystem code
|-
| 0x190602 || 2 || 3203 || Memory allocation failure related to FAT filesystem code
|-
| 0x190802 || 2 || 3204 || Memory allocation failure related to FAT filesystem code
|-
| 0x190A02 || 2 || 3205 || Memory allocation failure related to FAT filesystem code
|-
| 0x190C02 || 2 || 3206 || Memory allocation failure related to FAT filesystem code
|-
| 0x191002 || 2 || 3208 || Memory allocation failure related to FAT filesystem code
|-
| 0x195802 || 2 || 3244 || Allocation failure related to SD cards
|-
| 0x196002 || 2 || 3248 || Out of memory
|-
| 0x196202 || 2 || 3249 || Out of memory
|-
| 0x1A3E02 || 2 || 3359 || Out of memory
|-
| 0x1A4002 || 2 || 3360 || Out of memory
|-
| 0x1A4A02 || 2 || 3365 || Out of memory
|-
| 0x21BC02 || 2 || 4318 || Invalid save data filesystem magic (valid magic is SAVE in ASCII)
|-
| 0x234202 || 2 || 4513 || Error reading ACID section in NPDM
|-
| 0x234402 || 2 || 4514 || Invalid NPDM ACID section size
|-
| 0x234602 || 2 || 4515 || Last byte of the ACID modulus is zero
|-
| 0x234802 || 2 || 4516 || Invalid ACID fixed key signature
|-
| 0x234A02 || 2 || 4517 || Invalid NCA magic
|-
| 0x234C02 || 2 || 4518 || Invalid NCA header fixed key signature
|-
| 0x234E02 || 2 || 4519 || Invalid NCA header ACID signature
|-
| 0x235002 || 2 || 4520 || Invalid NCA header section hash
|-
| 0x235202 || 2 || 4521 || Invalid NCA Key index
|-
| 0x235602 || 2 || 4523 || Invalid encryption type
|-
| 0x235802 || 2 || 4524 || Redirection BKTR table size is negative
|-
| 0x235A02 || 2 || 4525 || Encryption BKTR table size is negative
|-
| 0x235C02 || 2 || 4526 || Redirection BKTR table end offset is past the Encryption BKTR table start offset
|-
| 0x235E02 || 2 || 4527 || NCA-path used with the wrong titleID.
|-
| 0x236002 || 2 || 4528 || NCA header value is out of range
|-
| 0x236202 || 2 || 4529 || NCA FS header value is out of range
|-
| 0x236802 || 2 || 4532 || PartitionFS hash block size is not a power of 2
|-
| 0x236A02 || 2 || 4533 || PartitionFS hash "always_2" field is not 2
|-
| 0x236C02 || 2 || 4534 || PartitionFS hash table is too small for main data
|-
| 0x236E02 || 2 || 4535 || Invalid PartitionFS block hash
|-
| 0x244402 || 2 || 4642 || Invalid Partition file hashed region bounds
|-
| 0x244602 || 2 || 4643 || Invalid Partition FS hash
|-
| 0x244802 || 2 || 4644 || Invalid PFS0 magic
|-
| 0x244A02 || 2 || 4645 || Invalid HFS0 magic
|-
| 0x244C02 || 2 || 4646 || Invalid name offset for Partition FS file entry
|-
| 0x244E02 || 2 || 4647 || Calculated Partition FS header size changed between 2 consecutive reads
|-
| 0x249802 || 2 || 4684 || Invalid FAT file number.
|-
| 0x249C02 || 2 || 4686 || Invalid FAT format for BIS User partition.
|-
| 0x249E02 || 2 || 4687 || Invalid FAT format for BIS System partition.
|-
| 0x24A002 || 2 || 4688 || Invalid FAT format for BIS Safe partition.
|-
| 0x24A202 || 2 || 4689 || Invalid FAT format for BIS Calibration partition.
|-
| 0x250E02 || 2 || 4743 || [[NAX0|Corrupted]] NAX0 header.
|-
| 0x251002 || 2 || 4744 || Invalid [[NAX0]] magicnum.
|-
| 0x280202 || 2 || 5121 || Invalid FAT size
|-
| 0x280402 || 2 || 5122 || Invalid FAT BPB (BIOS Parameter Block)
|-
| 0x280602 || 2 || 5123 || Invalid FAT parameter
|-
| 0x280802 || 2 || 5124 || Invalid FAT sector
|-
| 0x280A02 || 2 || 5125 || Invalid FAT sector
|-
| 0x280C02 || 2 || 5126 || Invalid FAT sector
|-
| 0x280E02 || 2 || 5127 || Invalid FAT sector
|-
| 0x296A02 || 2 || 5301 || Mountpoint not found
|-
| 0x2EE202 || 2 || 6001 || Invalid input
|-
| 0x2EE602 || 2 || 6003 || Path too long
|-
| 0x2EE802 || 2 || 6004 || Invalid character.
|-
| 0x2EEA02 || 2 || 6005 || Invalid directory path.
|-
| 0x2EEC02 || 2 || 6006 || Unable to retrieve directory from path
|-
| 0x2F5A02 || 2 || 6061 || Offset outside storage
|-
| 0x313802 || 2 || 6300 || Operation not supported
|-
| 0x313A02 || 2 || 6301 || A specified filesystem has no MultiCommitTarget when doing a multi-filesystem commit
|-
| 0x313C02 || 2 || 6302 || Attempted to resize a nn::fs::SubStorage or BufferedStorage that is marked as non-resizable
|-
| 0x313E02 || 2 || 6303 || Attempted to resize a nn::fs::SubStorage or BufferedStorage when the SubStorage ends before the base storage
|-
| 0x314002 || 2 || 6304 || Attempted to call nn::fs::MemoryStorage::SetSize
|-
| 0x314202 || 2 || 6305 || Invalid Operation ID in nn::fs::MemoryStorage::OperateRange
|-
| 0x314402 || 2 || 6306 || Invalid Operation ID in nn::fs::FileStorage::OperateRange
|-
| 0x314602 || 2 || 6307 || Invalid Operation ID in nn::fs::FileHandleStorage::OperateRange
|-
| 0x314802 || 2 || 6308 || Invalid Operation ID in nn::fssystem::SwitchStorage::OperateRange
|-
| 0x314A02 || 2 || 6309 || Invalid Operation ID in nn::fs::detail::StorageServiceObjectAdapter::OperateRange
|-
| 0x314C02 || 2 || 6310 || Attempted to call nn::fssystem::AesCtrCounterExtendedStorage::Write
|-
| 0x314E02 || 2 || 6311 || Attempted to call nn::fssystem::AesCtrCounterExtendedStorage::SetSize
|-
| 0x315002 || 2 || 6312 || Invalid Operation ID in nn::fssystem::AesCtrCounterExtendedStorage::OperateRange
|-
| 0x315202 || 2 || 6313 || Attempted to call nn::fssystem::AesCtrStorageExternal::Write
|-
| 0x315402 || 2 || 6314 || Attempted to call nn::fssystem::AesCtrStorageExternal::SetSize
|-
| 0x315602 || 2 || 6315 || Attempted to call nn::fssystem::AesCtrStorage::SetSize
|-
| 0x315802 || 2 || 6316 || Attempted to call nn::fssystem::save::HierarchicalIntegrityVerificationStorage::SetSize
|-
| 0x315A02 || 2 || 6317 || Attempted to call nn::fssystem::save::HierarchicalIntegrityVerificationStorage::OperateRange
|-
| 0x315C02 || 2 || 6318 || Attempted to call nn::fssystem::save::IntegrityVerificationStorage::SetSize
|-
| 0x315E02 || 2 || 6319 || Attempted to invalidate the cache of a RomFs IVFC storage in nn::fssystem::save::IntegrityVerificationStorage::OperateRange
|-
| 0x316002 || 2 || 6320 || Invalid Operation ID in nn::fssystem::save::IntegrityVerificationStorage::OperateRange
|-
| 0x316202 || 2 || 6321 || Attempted to call nn::fssystem::save::BlockCacheBufferedStorage::SetSize
|-
| 0x316402 || 2 || 6322 || Attempted to invalidate the cache of something other than a savedata IVFC storage in nn::fssystem::save::BlockCacheBufferedStorage::OperateRange
|-
| 0x316602 || 2 || 6323 || Invalid Operation ID in nn::fssystem::save::BlockCacheBufferedStorage::OperateRange
|-
| 0x316802 || 2 || 6324 || Attempted to call nn::fssystem::IndirectStorage::Write
|-
| 0x316A02 || 2 || 6325 || Attempted to call nn::fssystem::IndirectStorage::SetSize
|-
| 0x316C02 || 2 || 6326 || Invalid Operation ID in nn::fssystem::IndirectStorage::OperateRange
|-
| 0x316E02 || 2 || 6327 || Attempted to call nn::fssystem::SparseStorage::ZeroStorage::Write
|-
| 0x317002 || 2 || 6328 || Attempted to call nn::fssystem::SparseStorage::ZeroStorage::SetSize
|-
| 0x317202 || 2 || 6329 || Attempted to call nn::fssystem::HierarchicalSha256Storage::SetSize
|-
| 0x317402 || 2 || 6330 || Attempted to call nn::fssystem::ReadOnlyBlockCacheStorage::Write
|-
| 0x317602 || 2 || 6331 || Attempted to call nn::fssystem::ReadOnlyBlockCacheStorage::SetSize
|-
| 0x317802 || 2 || 6332 || Attempted to call nn::fssystem::IntegrityRomFsStorage::SetSize
|-
| 0x317A02 || 2 || 6333 || Attempted to call nn::fssystem::save::DuplexStorage::SetSize
|-
| 0x317C02 || 2 || 6334 || Invalid Operation ID in nn::fssystem::save::DuplexStorage::OperateRange
|-
| 0x317E02 || 2 || 6335 || Attempted to call nn::fssystem::save::HierarchicalDuplexStorage::SetSize
|-
| 0x318002 || 2 || 6336 || Attempted to call nn::fssystem::save::RemapStorage::GetSize
|-
| 0x318202 || 2 || 6337 || Attempted to call nn::fssystem::save::RemapStorage::SetSize
|-
| 0x318402 || 2 || 6338 || Invalid Operation ID in nn::fssystem::save::RemapStorage::OperateRange
|-
| 0x318602 || 2 || 6339 || Attempted to call nn::fssystem::save::IntegritySaveDataStorage::SetSize
|-
| 0x318802 || 2 || 6340 || Invalid Operation ID in nn::fssystem::save::IntegritySaveDataStorage::OperateRange
|-
| 0x318A02 || 2 || 6341 || Attempted to call nn::fssystem::save::JournalIntegritySaveDataStorage::SetSize
|-
| 0x318C02 || 2 || 6342 || Invalid Operation ID in nn::fssystem::save::JournalIntegritySaveDataStorage::OperateRange
|-
| 0x318E02 || 2 || 6343 || Attempted to call nn::fssystem::save::JournalStorage::GetSize
|-
| 0x319002 || 2 || 6344 || Attempted to call nn::fssystem::save::JournalStorage::SetSize
|-
| 0x319202 || 2 || 6345 || Invalid Operation ID in nn::fssystem::save::JournalStorage::OperateRange
|-
| 0x319402 || 2 || 6346 || Attempted to call nn::fssystem::save::UnionStorage::SetSize
|-
| 0x319602 || 2 || 6347 || Attempted to call nn::fssystem::dbm::AllocationTableStorage::SetSize
|-
| 0x319802 || 2 || 6348 || Attempted to call nn::fssrv::fscreator::WriteOnlyGameCardStorage::Read
|-
| 0x319A02 || 2 || 6349 || Attempted to call nn::fssrv::fscreator::WriteOnlyGameCardStorage::SetSize
|-
| 0x319C02 || 2 || 6350 || Attempted to call nn::fssrv::fscreator::ReadOnlyGameCardStorage::Write
|-
| 0x319E02 || 2 || 6351 || Attempted to call nn::fssrv::fscreator::ReadOnlyGameCardStorage::SetSize
|-
| 0x31A002 || 2 || 6352 || Invalid Operation ID in nn::fssrv::fscreator::ReadOnlyGameCardStorage::OperateRange
|-
| 0x31A202 || 2 || 6353 || Attempted to call SdStorage::SetSize
|-
| 0x31A402 || 2 || 6354 || Invalid Operation ID in SdStorage::OperateRange
|-
| 0x31A602 || 2 || 6355 || Invalid Operation ID in nn::fat::FatFile::DoOperateRange
|-
| 0x31A802 || 2 || 6356 || Invalid Operation ID in nn::fssystem::StorageFile::DoOperateRange
|-
| 0x31AA02 || 2 || 6357 || Attempted to call nn::fssystem::ConcatenationFile::SetSize
|-
| 0x31AC02 || 2 || 6358 || Attempted to call nn::fssystem::ConcatenationFile::OperateRange
|-
| 0x31AE02 || 2 || 6359 || Invalid Query ID in nn::fssystem::ConcatenationFileSystem::DoQueryEntry
|-
| 0x31B002 || 2 || 6360 || Invalid Operation ID in nn::fssystem::ConcatenationFile::DoOperateRange
|-
| 0x31B202 || 2 || 6361 || Attempted to call nn::fssystem::ZeroBitmapFile::SetSize
|-
| 0x31B402 || 2 || 6362 || Invalid Operation ID in nn::fs::detail::FileServiceObjectAdapter::DoOperateRange
|-
| 0x31B602 || 2 || 6363 || Invalid Operation ID in nn::fssystem::AesXtsFile::DoOperateRange
|-
| 0x31B802 || 2 || 6364 || Attempted to modify a nn::fs::RomFsFileSystem
|-
| 0x31BA02 || 2 || 6365 || Attempted to call nn::fs::RomFsFileSystem::DoCommitProvisionally
|-
| 0x31BC02 || 2 || 6366 || Attempted to query the space in a nn::fs::RomFsFileSystem
|-
| 0x31BE02 || 2 || 6367 || Attempted to modify a nn::fssystem::RomFsFile
|-
| 0x31C002 || 2 || 6368 || Invalid Operation ID in nn::fssystem::RomFsFile::DoOperateRange
|-
| 0x31C202 || 2 || 6369 || Attempted to modify a nn::fs::ReadOnlyFileSystemTemplate
|-
| 0x31C402 || 2 || 6370 || Attempted to call nn::fs::ReadOnlyFileSystemTemplate::DoCommitProvisionally
|-
| 0x31C602 || 2 || 6371 || Attempted to query the space in a nn::fs::ReadOnlyFileSystemTemplate
|-
| 0x31C802 || 2 || 6372 || Attempted to modify a nn::fs::ReadOnlyFileSystemFile
|-
| 0x31CA02 || 2 || 6373 || Invalid Operation ID in nn::fs::ReadOnlyFileSystemFile::DoOperateRange
|-
| 0x31CC02 || 2 || 6374 || Attempted to modify a nn::fssystem::PartitionFileSystemCore
|-
| 0x31CE02 || 2 || 6375 || Attempted to call nn::fssystem::PartitionFileSystemCore::DoCommitProvisionally
|-
| 0x31D002 || 2 || 6376 || Attempted to call nn::fssystem::PartitionFileSystemCore::PartitionFile::DoSetSize
|-
| 0x31D202 || 2 || 6377 || Invalid Operation ID in nn::fssystem::PartitionFileSystemCore::PartitionFile::DoOperateRange
|-
| 0x31D402 || 2 || 6378 || Invalid Operation ID in nn::fssystem::TmFileSystemFile::DoOperateRange
|-
| 0x31D602 || 2 || 6379 || Attempted to call unsupported functions in nn::fssrv::fscreator::SaveDataInternalStorageFileSystem, nn::fssrv::detail::SaveDataInternalStorageAccessor::PaddingFile or nn::fssystem::save::detail::SaveDataExtraDataInternalStorageFile
|-
| 0x31DC02 || 2 || 6382 || Attempted to call nn::fssystem::ApplicationTemporaryFileSystem::DoCommitProvisionally
|-
| 0x31DE02 || 2 || 6383 || Attempted to call nn::fssystem::SaveDataFileSystem::DoCommitProvisionally
|-
| 0x31E002 || 2 || 6384 || Attempted to call nn::fssystem::DirectorySaveDataFileSystem::DoCommitProvisionally
|-
| 0x31E202 || 2 || 6385 || Attempted to call nn::fssystem::ZeroBitmapHashStorageFile::Write
|-
| 0x31E402 || 2 || 6386 || Attempted to call nn::fssystem::ZeroBitmapHashStorageFile::SetSize
|-
| 0x320002 || 2 || 6400 || Permission denied
|-
| 0x326602 || 2 || 6451 || Missing titlekey(?) required to mount content
|-
| 0x326E02 || 2 || 6455 || File not closed
|-
| 0x327002 || 2 || 6456 || Directory not closed
|-
| 0x327202 || 2 || 6457 || Writable file not closed when committing
|-
| 0x327402 || 2 || 6458 || FS allocators already registered
|-
| 0x327602 || 2 || 6459 || FS allocators already used
|-
| 0x327A02 || 2 || 6461 || FS allocator alignment violation
|-
| 0x339402 || 2 || 6602 || File not found.
|-
| 0x339602 || 2 || 6603 || Directory not found.
|-
| 0x346C02 || 2 || 6710 || Multi-commit limit reached
|-
| 0x35F202 || 2 || 6905 || Mount name not found in table.
|-
| 0x3DBC02 || 2 || 7902 || RomFs table: Entry not found in dictionary
|-
| 0x3DBE02 || 2 || 7903 || RomFs table: File not found
|-
| 0x3DC002 || 2 || 7904 || RomFs table: Directory not found
|-
| 0x3DC402 || 2 || 7906 || RomFs table: Entry already exists when trying to add a new entry
|-
| 0x3DC602 || 2 || 7907 || RomFs table: Insufficient space to add new entry
|-
| 0x3DC802 || 2 || 7908 || RomFs table: Unable to add new directory
|-
| 0x3DCA02 || 2 || 7909 || RomFs table: Unable to add new file
|-
| 0x3DCC02 || 2 || 7910 || RomFs directory has no more child directories/files when iterating
|-
| 0x3DD402 || 2 || 7914 || RomFs table: Path is file, not directory
|-
| 0x803 || 3 || 4 || OS busy
|-
| 0xE03 || 3 || 7 || Invalid parameter
|-
| 0x1003 || 3 || 8 || Out of memory
|-
| 0x1203 || 3 || 9 || Out of resources
|-
| 0x3EA03 || 3 || 501 || Invalid handle
|-
| 0x3EE03 || 3 || 503 || Invalid memory mirror
|-
| 0x7FE03 || 3 || 1023 || TLS slot is not allocated
|-
| 0xA05 || 5 || 5 || [[Content_Manager_services|NcaID]] not found. Returned when attempting to mount titles which exist that aren't *8XX titles, the same way *8XX titles are mounted.
|-
| 0xE05 || 5 || 7 || TitleId not found
|-
| 0x1805 || 5 || 12 || Invalid StorageId
|-
| 0xDC05 || 5 || 110 || Gamecard not inserted
|-
| 0x17C05 || 5 || 190 || Gamecard not initialized
|-
| 0x1F405 || 5 || 250 || Sdcard not inserted
|-
| 0x20805 || 5 || 260 || Storage not mounted
|-
| 0x806 || 6 || 4 || Converted from error 0xD401
|-
| 0x1006 || 6 || 8 || Converted from error 0xE401
|-
| 0x408 || 8 || 2 || Program location entry not found
|-
| 0x608 || 8 || 3 || Invalid context for control location
|-
| 0x808 || 8 || 4 || Storage not found
|-
| 0xA08 || 8 || 5 || Access denied
|-
| 0xC08 || 8 || 6 || Offline manual HTML location entry not found
|-
| 0xE08 || 8 || 7 || Title is not registered
|-
| 0x1008 || 8 || 8 || Control location entry for host not found
|-
| 0x1208 || 8 || 9 || Legal info HTML location entry not found
|-
| 0x1408 || 8 || 10 || Program location for debug entry not found
|-
| 0x209 || 9 || 1 || Args too long.
|-
| 0x409 || 9 || 2 || Maximum processes loaded.
|-
| 0x609 || 9 || 3 || NPDM too big.
|-
| 0x809 || 9 || 4 || Invalid NPDM.
|-
| 0xA09 || 9 || 5 || Invalid NSO.
|-
| 0xC09 || 9 || 6 || Invalid Path.
|-
| 0xE09 || 9 || 7 || Already registered.
|-
| 0x1009 || 9 || 8 || Title not found.
|-
| 0x1209 || 9 || 9 || Title-id in ACI0 doesn't match range in ACID.
|-
| 0x1409 || 9 || 10 || Invalid version in NPDM.
|-
| 0x6609 || 9 || 51 || Insufficient address space.
|-
| 0x6809 || 9 || 52 || Insufficient NRO.
|-
| 0x6A09 || 9 || 53 || Invalid NRR
|-
| 0x6C09 || 9 || 54 || Invalid signature
|-
| 0x6E09 || 9 || 55 || Insufficient NRO registrations.
|-
| 0x7009 || 9 || 56 || Insufficient NRR registrations.
|-
| 0x7209 || 9 || 57 || NRO Already loaded.
|-
| 0xA209 || 9 || 81 || Unaligned NRR address
|-
| 0xA409 || 9 || 82 || Bad NRR size
|-
| 0xA809 || 9 || 84 || NRR Not Loaded.
|-
| 0xAA09 || 9 || 85 || Bad NRR address
|-
| 0xAE09 || 9 || 87 || Bad initialization
|-
| 0xC809 || 9 || 100 || Unknown ACI0 descriptor
|-
| 0xCE09 || 9 || 103 || ACID/ACI0 don't match for descriptor "KernelFlags"
|-
| 0xD009 || 9 || 104 || ACID/ACI0 don't match for descriptor "SyscallMask"
|-
| 0xD409 || 9 || 106 || ACID/ACI0 don't match for descriptor "MapIoOrNormalRange"
|-
| 0xD609 || 9 || 107 || ACID/ACI0 don't match for descriptor "MapNormalPage"
|-
| 0xDE09 || 9 || 111 || ACID/ACI0 don't match for descriptor "InterruptPair"
|-
| 0xE209 || 9 || 113 || ACID/ACI0 don't match for descriptor "ApplicationType"
|-
| 0xE409 || 9 || 114 || ACID/ACI0 don't match for descriptor "KernelReleaseVersion"
|-
| 0xE609 || 9 || 115 || ACID/ACI0 don't match for descriptor "HandleTableSize"
|-
| 0xE809 || 9 || 116 || ACID/ACI0 don't match for descriptor "DebugFlags"
|-
| 0x1940A || 10 || 202 || Invalid CMIF header size.
|-
| 0x1A60A || 10 || 211 || Invalid CMIF input header.
|-
| 0x1A80A || 10 || 212 || Invalid CMIF output header.
|-
| 0x1BA0A || 10 || 221 || Invalid method dispatch ID.
|-
| 0x1D60A || 10 || 235 || Invalid in object count.
|-
| 0x1D80A || 10 || 236 || Invalid out object count.
|-
| 0x25A0A || 10 || 301 || Out of domain entries.
|-
| 0x20B || 11 || 1 || Unsupported operation
|-
| 0xCC0B || 11 || 102 || Out of server session memory
|-
| 0x11A0B || 11 || 141 || Went past maximum during marshalling.
|-
| 0x1900B || 11 || 200 || Session doesn't support domains.
|-
| 0x25A0B || 11 || 301 || Remote process is dead.
|-
| 0x3240B || 11 || 402 || Data/buffer length(s) too large for IPC buffer.
|-
| 0x3260B || 11 || 403 || Unknown request type
|-
| 0x3480B || 11 || 420 || Number(s) of buffers/handles/PIDs passed differ from what method expects.
|-
| 0x3D60B || 11 || 491 || IPC Query 1 failed.
|-
| 0x20F || 15 || 1 || Pid not found
|-
| 0x60F || 15 || 3 || Process has no pending events
|-
| 0xA0F || 15 || 5 || Application already running
|-
| 0x410 || 16 || 2 || Title-id not found
|-
| 0xF010 || 16 || 120 || Sysupdate not required
|-
| 0x1F610 || 16 || 251 || Unexpected StorageId
|-
| 0x2A810 || 16 || 340 || [[Network_Interface_services#IsAnyInternetRequestAccepted|IsAnyInternetRequestAccepted]] with the output from [[#Network_Interface_services#GetClientId|GetClientId]] returned false.
|-
| 0x64210 || 16 || 801 || [[NS_Services#SystemDeliveryInfo|SystemDeliveryInfo]] system_delivery_protocol_version is less than the system-setting.
|-
| 0x64410 || 16 || 802 || [[NS_Services#SystemDeliveryInfo|SystemDeliveryInfo]] system_delivery_protocol_version is larger than the system-setting.
|-
| 0x74610 || 16 || 931 || Invalid [[NS_Services#SystemDeliveryInfo|SystemDeliveryInfo]] HMAC / invalid Meta Id.
|-
| 0x6F810 || 16 || 892 || Unknown state ref-count is zero.
|-
| 0x215 || 21 || 1 || Out of processes
|-
| 0x415 || 21 || 2 || Not initialized.
|-
| 0x615 || 21 || 3 || Max sessions
|-
| 0x815 || 21 || 4 || Service already registered
|-
| 0xA15 || 21 || 5 || Out of services
|-
| 0xC15 || 21 || 6 || Invalid name (all zeroes)
|-
| 0xE15 || 21 || 7 || Service not registered
|-
| 0x1015 || 21 || 8 || Permission denied
|-
| 0x1215 || 21 || 9 || Service Access Control too big.
|-
| 0x416 || 22 || 2 || Address space is full
|-
| 0x616 || 22 || 3 || NRO already loaded
|-
| 0x816 || 22 || 4 || Invalid NRO header values
|-
| 0xC16 || 22 || 6 || Bad NRR magic
|-
| 0x1016 || 22 || 8 || Reached max NRR count
|-
| 0x1216 || 22 || 9 || Unable to verify NRO hash or NRR signature
|-
| 0x80216 || 22 || 1025 || Address not page-aligned
|-
| 0x80416 || 22 || 1026 || Incorrect NRO size
|-
| 0x80816 || 22 || 1028 || NRO not loaded
|-
| 0x80A16 || 22 || 1029 || NRR not loaded
|-
| 0x80C16 || 22 || 1030 || Already initialized
|-
| 0x80E16 || 22 || 1031 || Not initialized
|-
| 0x21A || 26 || 1 || SMC is not implemented
|-
| 0x41A || 26 || 2 || SMC argument is invalid
|-
| 0x61A || 26 || 3 || SMC is currently in progress/secmon is busy
|-
| 0x81A || 26 || 4 || Secmon not currently performing async operation
|-
| 0xA1A || 26 || 5 || Invalid SMC async callback key
|-
| 0xC1A || 26 || 6 || SMC is blacklisted during current boot
|-
| 0xC81A || 26 || 100 || Invalid (buffer) size
|-
| 0xCA1A || 26 || 101 || Unknown SMC error
|-
| 0xCA1A || 26 || 101 || Decryption failure
|-
| 0xD01A || 26 || 104 || No AES keyslots available
|-
| 0xD21A || 26 || 105 || Invalid AES keyslot
|-
| 0xD41A || 26 || 106 || BootReason already set
|-
| 0xD61A || 26 || 107 || BootReason not set
|-
| 0xD81A || 26 || 108 || Invalid argument
|-
| 0x35B || 347 || 1 || Failed to init SM.
|-
| 0x55B || 347 || 2 || Failed to init FS.
|-
| 0x75B || 347 || 3 || Failed to open NRO file. May also happen when SD card isn't inserted / SD mounting failed earlier.
|-
| 0x95B || 347 || 4 || Failed to read NRO header.
|-
| 0xB5B || 347 || 5 || Invalid NRO magic.
|-
| 0xD5B || 347 || 6 || Invalid NRO segments.
|-
| 0xF5B || 347 || 7 || Failed to read NRO.
|-
| 0x135B || 347 || 9 || Failed to allocate heap.
|-
| 0x255B || 347 || 18 || Failed to map code-binary memory.
|-
| 0x275B || 347 || 19 || Failed to map code memory (.text).
|-
| 0x295B || 347 || 20 || Failed to map code memory (.rodata).
|-
| 0x2B5B || 347 || 21 || Failed to map code memory (.data+.bss).
|-
| 0x315B || 347 || 24 || Failed to unmap code memory (.text).
|-
| 0x335B || 347 || 25 || Failed to unmap code memory (.rodata).
|-
| 0x355B || 347 || 26 || Failed to unmap code memory (.data+.bss).
|-
| 0x19269 || 105 || 201 || Null settings name
|-
| 0x19469 || 105 || 202 || Null settings key
|-
| 0x19669 || 105 || 203 || Null settings value
|-
| 0x19A69 || 105 || 205 || Null settings value buffer
|-
| 0x1A069 || 105 || 208 || Null setting value size buffer
|-
| 0x1A269 || 105 || 209 || Null debug mode flag buffer
|-
| 0x1BA69 || 105 || 221 || Setting group name has zero length
|-
| 0x1BC69 || 105 || 222 || Empty settings item key
|-
| 0x1E269 || 105 || 241 || Setting group name is too long (64 character limit?)
|-
| 0x1E469 || 105 || 242 || Setting name is too long (64 character limit?)
|-
| 0x20A69 || 105 || 261 || Setting group name ends with '.' or contains invalid characters (allowed: [a-z0-9_\-.])
|-
| 0x20C69 || 105 || 262 || Setting name ends with '.' or contains invalid characters (allowed: [a-z0-9_\-.])
|-
| 0x4DA69 || 105 || 621 || Null language code buffer
|-
| 0x4E269 || 105 || 625 || Language out of valid range
|-
| 0x4EE69 || 105 || 631 || Null network settings buffer
|-
| 0x4F069 || 105 || 632 || Null network settings output count buffer
|-
| 0x50269 || 105 || 641 || Null backlight settings buffer
|-
| 0x51669 || 105 || 651 || Null Bluetooth device setting buffer
|-
| 0x51869 || 105 || 652 || Null Bluetooth device setting output count buffer
|-
| 0x51A69 || 105 || 653 || Null Bluetooth enable flag buffer
|-
| 0x51C69 || 105 || 654 || Null Bluetooth AFH enable flag buffer
|-
| 0x51E69 || 105 || 655 || Null Bluetooth boost enable flag buffer
|-
| 0x52069 || 105 || 656 || Null BLE pairing settings buffer
|-
| 0x52269 || 105 || 657 || Null BLE pairing settings entry count buffer
|-
| 0x52A69 || 105 || 661 || Null external steady clock source ID buffer
|-
| 0x52C69 || 105 || 662 || Null user system clock context buffer
|-
| 0x52E69 || 105 || 663 || Null network system clock context buffer
|-
| 0x53069 || 105 || 664 || Null user system clock automatic correction enabled flag buffer
|-
| 0x53269 || 105 || 665 || Null shutdown RTC value buffer
|-
| 0x53469 || 105 || 666 || Null external steady clock internal offset buffer
|-
| 0x53E69 || 105 || 671 || Null account settings buffer
|-
| 0x55269 || 105 || 681 || Null audio volume buffer
|-
| 0x55669 || 105 || 683 || Null ForceMuteOnHeadphoneRemoved buffer
|-
| 0x55869 || 105 || 684 || Null headphone volume warning count buffer
|-
| 0x55E69 || 105 || 687 || Invalid audio output mode
|-
| 0x56069 || 105 || 688 || Null headphone volume update flag buffer
|-
| 0x56669 || 105 || 691 || Null console information upload flag buffer
|-
| 0x57A69 || 105 || 701 || Null automatic application download flag buffer
|-
| 0x57C69 || 105 || 702 || Null notification settings buffer
|-
| 0x57E69 || 105 || 703 || Null account notification settings entry count buffer
|-
| 0x58069 || 105 || 704 || Null account notification settings buffer
|-
| 0x58E69 || 105 || 711 || Null vibration master volume buffer
|-
| 0x59069 || 105 || 712 || Null NX controller settings buffer
|-
| 0x59269 || 105 || 713 || Null NX controller settings entry count buffer
|-
| 0x59469 || 105 || 714 || Null USB full key enable flag buffer
|-
| 0x5A269 || 105 || 721 || Null TV settings buffer
|-
| 0x5A469 || 105 || 722 || Null EDID buffer
|-
| 0x5B669 || 105 || 731 || Null data deletion settings buffer
|-
| 0x5CA69 || 105 || 741 || Null initial system applet program ID buffer
|-
| 0x5CC69 || 105 || 742 || Null overlay disp program ID buffer
|-
| 0x5CE69 || 105 || 743 || Null IsInRepairProcess buffer
|-
| 0x5D069 || 105 || 744 || Null RequiresRunRepairTimeReviser buffer
|-
| 0x5DE69 || 105 || 751 || Null device timezone location name buffer
|-
| 0x5F269 || 105 || 761 || Null primary album storage buffer
|-
| 0x60669 || 105 || 771 || Null USB 3.0 enable flag buffer
|-
| 0x60869 || 105 || 772 || Null USB Type-C power source circuit version buffer
|-
| 0x61A69 || 105 || 781 || Null battery lot buffer
|-
| 0x62E69 || 105 || 791 || Null serial number buffer
|-
| 0x64269 || 105 || 801 || Null lock screen flag buffer
|-
| 0x64669 || 105 || 803 || Null color set ID buffer
|-
| 0x64869 || 105 || 804 || Null quest flag buffer
|-
| 0x64A69 || 105 || 805 || Null wireless certification file size buffer
|-
| 0x64C69 || 105 || 806 || Null wireless certification file buffer
|-
| 0x64E69 || 105 || 807 || Null initial launch settings buffer
|-
| 0x65069 || 105 || 808 || Null device nickname buffer
|-
| 0x65269 || 105 || 809 || Null battery percentage flag buffer
|-
| 0x65469 || 105 || 810 || Null applet launch flags buffer
|-
| 0x7E869 || 105 || 1012 || Null wireless LAN enable flag buffer
|-
| 0x7FA69 || 105 || 1021 || Null product model buffer
|-
| 0x80E69 || 105 || 1031 || Null NFC enable flag buffer
|-
| 0x82269 || 105 || 1041 || Null ECI device certificate buffer
|-
| 0x82469 || 105 || 1042 || Null E-Ticket device certificate buffer
|-
| 0x83669 || 105 || 1051 || Null sleep settings buffer
|-
| 0x84A69 || 105 || 1061 || Null EULA version buffer
|-
| 0x84C69 || 105 || 1062 || Null EULA version entry count buffer
|-
| 0x85E69 || 105 || 1071 || Null LDN channel buffer
|-
| 0x87269 || 105 || 1081 || Null SSL key buffer
|-
| 0x87469 || 105 || 1082 || Null SSL certificate buffer
|-
| 0x88669 || 105 || 1091 || Null telemetry flags buffer
|-
| 0x89A69 || 105 || 1101 || Null Gamecard key buffer
|-
| 0x89C69 || 105 || 1102 || Null Gamecard certificate buffer
|-
| 0x8AE69 || 105 || 1111 || Null PTM battery lot buffer
|-
| 0x8B069 || 105 || 1112 || Null PTM fuel gauge parameter buffer
|-
| 0x8C269 || 105 || 1121 || Null ECI device key buffer
|-
| 0x8C469 || 105 || 1122 || Null E-Ticket device key buffer
|-
| 0x8D669 || 105 || 1131 || Null speaker parameter buffer
|-
| 0x8EA69 || 105 || 1141 || Null firmware version buffer
|-
| 0x8EC69 || 105 || 1142 || Null firmware version digest buffer
|-
| 0x8EE69 || 105 || 1143 || Null rebootless system update version buffer
|-
| 0x8FE69 || 105 || 1151 || Null Mii author ID buffer
|-
| 0x91269 || 105 || 1161 || Null fatal flags buffer
|-
| 0x92669 || 105 || 1171 || Null auto update enable flag buffer
|-
| 0x93A69 || 105 || 1181 || Null external RTC reset flag buffer
|-
| 0x94E69 || 105 || 1191 || Null push notification activity mode buffer
|-
| 0x96269 || 105 || 1201 || Null service discovery control setting buffer
|-
| 0x97669 || 105 || 1211 || Null error report share permission buffer
|-
| 0x98A69 || 105 || 1221 || Null LCD vendor ID buffer
|-
| 0x99E69 || 105 || 1231 || Null console SixAxis sensor acceleration bias buffer
|-
| 0x9A069 || 105 || 1232 || Null console SixAxis sensor angular velocity bias buffer
|-
| 0x9A269 || 105 || 1233 || Null console SixAxis sensor acceleration gain buffer
|-
| 0x9A469 || 105 || 1234 || Null console SixAxis sensor angular velocity gain buffer
|-
| 0x9A669 || 105 || 1235 || Null console SixAxis sensor angular velocity time bias buffer
|-
| 0x9A869 || 105 || 1236 || Null console SixAxis sensor angular acceleration buffer
|-
| 0x9B269 || 105 || 1241 || Null keyboard layout buffer
|-
| 0x9BA69 || 105 || 1245 || Invalid keyboard layout
|-
| 0x9C669 || 105 || 1251 || Null web inspector flag buffer
|-
| 0x9C869 || 105 || 1252 || Null allowed SSL hosts buffer
|-
| 0x9CA69 || 105 || 1253 || Null allowed SSL hosts entry count buffer
|-
| 0x9CC69 || 105 || 1254 || Null host FS mount point buffer
|-
| 0x9EE69 || 105 || 1271 || Null Amiibo key buffer
|-
| 0x9F069 || 105 || 1272 || Null Amiibo ECQV certificate buffer
|-
| 0x9F269 || 105 || 1273 || Null Amiibo ECDSA certificate buffer
|-
| 0x9F469 || 105 || 1274 || Null Amiibo ECQV BLS key buffer
|-
| 0x9F669 || 105 || 1275 || Null Amiibo ECQV BLS certificate buffer
|-
| 0x9F869 || 105 || 1276 || Null Amiibo ECQV BLS root certificate buffer
|-
| 0x272 || 114 || 1 || Generic error
|-
| 0xC72 || 114 || 6 || Unsupported operation
|-
| 0x74 || 116 || 0 || Time service not initialized
|-
| 0x274 || 116 || 1 || Permission denied
|-
| 0xCC74 || 116 || 102 || Time not set / Clock Source Id mismatch
|-
| 0x19074 || 116 || 200 || Invalid time comparison
|-
| 0x19274 || 116 || 201 || Signed overflow/underflow
|-
| 0x64274 || 116 || 801 || Memory allocation failure
|-
| 0x70A74 || 116 || 901 || Null pointer
|-
| 0x70C74 || 116 || 902 || Value out of valid range
|-
| 0x70E74 || 116 || 903 || TimeZoneRule conversion failed
|-
| 0x7BA74 || 116 || 989 || TimeZone location name not found
|-
| 0x7BC74 || 116 || 990 || Unimplemented functionality
|-
| 0xC79 || 121 || 6 || [[Network_Interface_services#IsAnyInternetRequestAccepted|IsAnyInternetRequestAccepted]] with the output from [[#Network_Interface_services#GetClientId|GetClientId]] returned false.
|-
| 0x27A || 122 || 1 || Invalid argument
|-
| 0x47A || 122 || 2 || Object not found
|-
| 0x67A || 122 || 3 || Object locked/in used
|-
| 0x87A || 122 || 4 || Target already mounted
|-
| 0xA7A || 122 || 5 || Target not mounted
|-
| 0xC7A || 122 || 6 || Object already opened
|-
| 0xE7A || 122 || 7 || Object not opened
|-
| 0x107A || 122 || 8 || [[Network_Interface_services#IsAnyInternetRequestAccepted|IsAnyInternetRequestAccepted]] with the output from [[#Network_Interface_services#GetClientId|GetClientId]] returned false.
|-
| 0xA07A || 122 || 80 || Passphrase not found
|-
| 0xA27A || 122 || 81 || Data verification failed
|-
| 0xB47A || 122 || 90 || Invalid API call
|-
| 0xC47A || 122 || 98 || Invalid operation
|-
| 0x167B || 123 || 11 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SEC errors: -8192 (SEC_ERROR_IO), -8191 (SEC_ERROR_LIBRARY_FAILURE), -8190 (SEC_ERROR_BAD_DATA), -8189 (SEC_ERROR_OUTPUT_LEN), -8188 (SEC_ERROR_INPUT_LEN), -8187 (SEC_ERROR_INVALID_ARGS), -8186 (SEC_ERROR_INVALID_ALGORITHM), -8184 (SEC_ERROR_INVALID_TIME), -8152 (SEC_ERROR_INVALID_KEY).

Also converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSPR/Reference/NSPR_Error_Handling NSPR] errors: -5991 (PR_IO_ERROR), -5962 (PR_BUFFER_OVERFLOW_ERROR), -5950 (PR_FILE_NOT_FOUND_ERROR), -5949 (PR_NOT_DIRECTORY_ERROR), -5946 (PR_FILESYSTEM_MOUNTED_ERROR), -5938 (PR_END_OF_FILE_ERROR).

Also converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL errors: -12223 (SSL_ERROR_GENERATE_RANDOM_FAILURE), -12222 (SSL_ERROR_SIGN_HASHES_FAILURE), -12221 (SSL_ERROR_EXTRACT_PUBLIC_KEY_FAILURE), -12219 (SSL_ERROR_CLIENT_KEY_EXCHANGE_FAILURE), -12218 (SSL_ERROR_ENCRYPTION_FAILURE), -12217 (SSL_ERROR_DECRYPTION_FAILURE), -12216 (SSL_ERROR_SOCKET_WRITE_FAILURE), -12212 (SSL_ERROR_SYM_KEY_CONTEXT_FAILURE), -12209 (SSL_ERROR_IV_PARAM_FAILURE), -12207 (SSL_ERROR_SESSION_KEY_GEN_FAILURE), -12203 (SSL_ERROR_NO_COMPRESSION_OVERLAP), -12202 (SSL_ERROR_HANDSHAKE_NOT_COMPLETED), -12201 (SSL_ERROR_BAD_HANDSHAKE_HASH_VALUE), -12172 (SSL_ERROR_NEXT_PROTOCOL_DATA_INVALID).
|-
| 0x1A7B || 123 || 13 || Unrecognized error.
|-
| 0xCC7B || 123 || 102 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SEC error -8173 (SEC_ERROR_NO_MEMORY).

Also converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSPR/Reference/NSPR_Error_Handling NSPR] errors: -6000 (PR_OUT_OF_MEMORY_ERROR), -5974 (PR_INSUFFICIENT_RESOURCES_ERROR, -5971 (PR_PROC_DESC_TABLE_FULL_ERROR).
|-
| 0xE87B || 123 || 116 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSPR/Reference/NSPR_Error_Handling NSPR] error -5999 (PR_BAD_DESCRIPTOR_ERROR).
|-
| 0x1027B || 123 || 129 || DER CRL decoding failed.
|-
| 0x1987B || 123 || 204 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSPR/Reference/NSPR_Error_Handling NSPR] error -5998 (PR_WOULD_BLOCK_ERROR).
|-
| 0x19A7B || 123 || 205 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSPR/Reference/NSPR_Error_Handling NSPR] error -5990 (PR_IO_TIMEOUT_ERROR).
|-
| 0x19C7B || 123 || 206 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSPR/Reference/NSPR_Error_Handling NSPR] error -5935 (PR_OPERATION_ABORTED_ERROR).
|-
| 0x1A07B || 123 || 208 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSPR/Reference/NSPR_Error_Handling NSPR] error -5978 (PR_NOT_CONNECTED_ERROR).
|-
| 0x1A27B || 123 || 209 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSPR/Reference/NSPR_Error_Handling NSPR] error -5961 (PR_CONNECT_RESET_ERROR).
|-
| 0x1A47B || 123 || 210 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSPR/Reference/NSPR_Error_Handling NSPR] error -5928 (PR_CONNECT_ABORTED_ERROR).
|-
| 0x1A67B || 123 || 211 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSPR/Reference/NSPR_Error_Handling NSPR] error -5929 (PR_SOCKET_SHUTDOWN_ERROR).
|-
| 0x1A87B || 123 || 212 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSPR/Reference/NSPR_Error_Handling NSPR] error -5930 (PR_NETWORK_DOWN_ERROR).
|-
| 0x1AE7B || 123 || 215 || ClientPki/InternalPki was already previously imported/registered.
|-
| 0x1B47B || 123 || 218 || Maximum number of ServerPki objects were already imported.
|-
| 0x25A7B || 123 || 301 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12276 (SSL_ERROR_BAD_CERT_DOMAIN).
|-
| 0x25C7B || 123 || 302 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12285 (SSL_ERROR_NO_CERTIFICATE).
|-
| 0x25E7B || 123 || 303 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SEC errors: -8181 (SEC_ERROR_EXPIRED_CERTIFICATE), -8162 (SEC_ERROR_EXPIRED_ISSUER_CERTIFICATE).
|-
| 0x2607B || 123 || 304 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SEC error -8180 (SEC_ERROR_REVOKED_CERTIFICATE).
|-
| 0x2627B || 123 || 305 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SEC error -8183 (SEC_ERROR_BAD_DER).
|-
| 0x2647B || 123 || 306 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SEC errors: -8102 (SEC_ERROR_INADEQUATE_KEY_USAGE), -8101 (SEC_ERROR_INADEQUATE_CERT_TYPE).
|-
| 0x2667B || 123 || 307 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SEC errors: -8185 (SEC_ERROR_INVALID_AVA), -8182 (SEC_ERROR_BAD_SIGNATURE), -8158 (SEC_ERROR_EXTENSION_VALUE_INVALID), -8156 (SEC_ERROR_CA_CERT_INVALID), -8151 (SEC_ERROR_UNKNOWN_CRITICAL_EXTENSION), -8080 (SEC_ERROR_CERT_NOT_IN_NAME_SPACE).
|-
| 0x2687B || 123 || 308 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SEC errors: -8179 (SEC_ERROR_UNKNOWN_ISSUER), -8172 (SEC_ERROR_UNTRUSTED_ISSUER), -8014 (SEC_ERROR_APPLICATION_CALLBACK_ERROR).
|-
| 0x26A7B || 123 || 309 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SEC error -8171 (SEC_ERROR_UNTRUSTED_CERT).
|-
| 0x26C7B || 123 || 310 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL errors: -12233 (SSL_ERROR_RX_UNKNOWN_RECORD_TYPE), -12232 (SSL_ERROR_RX_UNKNOWN_HANDSHAKE), -12231 (SSL_ERROR_RX_UNKNOWN_ALERT). This is also returned by ImportClientPki when import fails.
|-
| 0x26E7B || 123 || 311 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL errors: -12261 (SSL_ERROR_RX_MALFORMED_HELLO_REQUEST), -12260 (SSL_ERROR_RX_MALFORMED_CLIENT_HELLO), -12259 (SSL_ERROR_RX_MALFORMED_SERVER_HELLO), -12258 (SSL_ERROR_RX_MALFORMED_CERTIFICATE), -12257 (SSL_ERROR_RX_MALFORMED_SERVER_KEY_EXCH), -12256 (SSL_ERROR_RX_MALFORMED_CERT_REQUEST), -12255 (SSL_ERROR_RX_MALFORMED_HELLO_DONE), -12254 (SSL_ERROR_RX_MALFORMED_CERT_VERIFY), -12253 (SSL_ERROR_RX_MALFORMED_CLIENT_KEY_EXCH), -12252 (SSL_ERROR_RX_MALFORMED_FINISHED), -12251 (SSL_ERROR_RX_MALFORMED_CHANGE_CIPHER), -12250 (SSL_ERROR_RX_MALFORMED_ALERT), -12249 (SSL_ERROR_RX_MALFORMED_HANDSHAKE), -12248 (SSL_ERROR_RX_MALFORMED_APPLICATION_DATA), -12166 (SSL_ERROR_RX_MALFORMED_HELLO_VERIFY_REQUEST).
|-
| 0x2707B || 123 || 312 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SEC error -8144 (SEC_ERROR_UNSUPPORTED_KEYALG).

Also converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL errors: -12274 (SSL_ERROR_SSL2_DISABLED), -12247 (SSL_ERROR_RX_UNEXPECTED_HELLO_REQUEST), -12246 (SSL_ERROR_RX_UNEXPECTED_CLIENT_HELLO), -12245 (SSL_ERROR_RX_UNEXPECTED_SERVER_HELLO), -12244 (SSL_ERROR_RX_UNEXPECTED_CERTIFICATE), -12243 (SSL_ERROR_RX_UNEXPECTED_SERVER_KEY_EXCH), -12242 (SSL_ERROR_RX_UNEXPECTED_CERT_REQUEST), -12241 (SSL_ERROR_RX_UNEXPECTED_HELLO_DONE), -12240 (SSL_ERROR_RX_UNEXPECTED_CERT_VERIFY), -12239 (SSL_ERROR_RX_UNEXPECTED_CLIENT_KEY_EXCH), -12238 (SSL_ERROR_RX_UNEXPECTED_FINISHED).
|-
| 0x2727B || 123 || 313 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL errors: -12237 (SSL_ERROR_RX_UNEXPECTED_CHANGE_CIPHER), -12236 (SSL_ERROR_RX_UNEXPECTED_ALERT), -12235 (SSL_ERROR_RX_UNEXPECTED_HANDSHAKE), -12234 (SSL_ERROR_RX_UNEXPECTED_APPLICATION_DATA).
|-
| 0x2747B || 123 || 314 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12263 (SSL_ERROR_RX_RECORD_TOO_LONG).
|-
| 0x2767B || 123 || 315 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12165 (SSL_ERROR_RX_UNEXPECTED_HELLO_VERIFY_REQUEST).
|-
| 0x2787B || 123 || 316 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12163 (SSL_ERROR_RX_UNEXPECTED_CERT_STATUS).
|-
| 0x27A7B || 123 || 317 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12160 (SSL_ERROR_INCORRECT_SIGNATURE_ALGORITHM).
|-
| 0x27C7B || 123 || 318 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL errors: -12173 (SSL_ERROR_WEAK_SERVER_EPHEMERAL_DH_KEY), -12156 (SSL_ERROR_WEAK_SERVER_CERT_KEY).
|-
| 0x27E7B || 123 || 319 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12273 (SSL_ERROR_BAD_MAC_READ).
|-
| 0x2827B || 123 || 321 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL errors: -12215 (SSL_ERROR_MD5_DIGEST_FAILURE), -12214 (SSL_ERROR_SHA_DIGEST_FAILURE), -12161 (SSL_ERROR_DIGEST_FAILURE).
|-
| 0x2847B || 123 || 322 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12213 (SSL_ERROR_MAC_COMPUTATION_FAILURE).
|-
| 0x2887B || 123 || 324 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SEC error -8157 (SEC_ERROR_EXTENSION_NOT_FOUND).
|-
| 0x28A7B || 123 || 325 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SEC error -8049 (SEC_ERROR_UNRECOGNIZED_OID).
|-
| 0x28C7B || 123 || 326 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SEC error -8032 (SEC_ERROR_POLICY_VALIDATION_FAILED).
|-
| 0x2947B || 123 || 330 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12177 (SSL_ERROR_DECOMPRESSION_FAILURE).
|-
| 0xBBA7B || 123 || 1501 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12230 (SSL_ERROR_CLOSE_NOTIFY_ALERT).
|-
| 0xBBC7B || 123 || 1502 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12229 (SSL_ERROR_HANDSHAKE_UNEXPECTED_ALERT).
|-
| 0xBBE7B || 123 || 1503 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12272 (SSL_ERROR_BAD_MAC_ALERT).
|-
| 0xBC07B || 123 || 1504 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12197 (SSL_ERROR_DECRYPTION_FAILED_ALERT).
|-
| 0xBC27B || 123 || 1505 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12196 (SSL_ERROR_RECORD_OVERFLOW_ALERT).
|-
| 0xBC47B || 123 || 1506 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12228 (SSL_ERROR_DECOMPRESSION_FAILURE_ALERT).
|-
| 0xBC67B || 123 || 1507 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12227 (SSL_ERROR_HANDSHAKE_FAILURE_ALERT).
|-
| 0xBCA7B || 123 || 1509 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12271 (SSL_ERROR_BAD_CERT_ALERT).
|-
| 0xBCC7B || 123 || 1510 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12225 (SSL_ERROR_UNSUPPORTED_CERT_ALERT).
|-
| 0xBCE7B || 123 || 1511 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12270 (SSL_ERROR_REVOKED_CERT_ALERT).
|-
| 0xBD07B || 123 || 1512 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12269 (SSL_ERROR_EXPIRED_CERT_ALERT).
|-
| 0xBD27B || 123 || 1513 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12224 (SSL_ERROR_CERTIFICATE_UNKNOWN_ALERT).
|-
| 0xBD47B || 123 || 1514 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12226 (SSL_ERROR_ILLEGAL_PARAMETER_ALERT).
|-
| 0xBD67B || 123 || 1515 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12195 (SSL_ERROR_UNKNOWN_CA_ALERT).
|-
| 0xBD87B || 123 || 1516 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12194 (SSL_ERROR_ACCESS_DENIED_ALERT).
|-
| 0xBDA7B || 123 || 1517 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12193 (SSL_ERROR_DECODE_ERROR_ALERT).
|-
| 0xBDC7B || 123 || 1518 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12192 (SSL_ERROR_DECRYPT_ERROR_ALERT).
|-
| 0xBDE7B || 123 || 1519 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12191 (SSL_ERROR_EXPORT_RESTRICTION_ALERT).
|-
| 0xBE07B || 123 || 1520 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12190 (SSL_ERROR_PROTOCOL_VERSION_ALERT).
|-
| 0xBE27B || 123 || 1521 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12189 (SSL_ERROR_INSUFFICIENT_SECURITY_ALERT).
|-
| 0xBE47B || 123 || 1522 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12188 (SSL_ERROR_INTERNAL_ERROR_ALERT).
|-
| 0xBE67B || 123 || 1523 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12157 (SSL_ERROR_INAPPROPRIATE_FALLBACK_ALERT).
|-
| 0xBE87B || 123 || 1524 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12187 (SSL_ERROR_USER_CANCELED_ALERT).
|-
| 0xBEA7B || 123 || 1525 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12186 (SSL_ERROR_NO_RENEGOTIATION_ALERT).
|-
| 0xBEC7B || 123 || 1526 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12184 (SSL_ERROR_UNSUPPORTED_EXTENSION_ALERT).
|-
| 0xBEE7B || 123 || 1527 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12183 (SSL_ERROR_CERTIFICATE_UNOBTAINABLE_ALERT).
|-
| 0xBF07B || 123 || 1528 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12182 (SSL_ERROR_UNRECOGNIZED_NAME_ALERT).
|-
| 0xBF27B || 123 || 1529 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12181 (SSL_ERROR_BAD_CERT_STATUS_RESPONSE_ALERT).
|-
| 0xBF47B || 123 || 1530 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12180 (SSL_ERROR_BAD_CERT_HASH_VALUE_ALERT).
|-
| 0x27127B || 123 || 5001 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12155 (SSL_ERROR_RX_SHORT_DTLS_READ).
|-
| 0x271E7B || 123 || 5007 || Out-of-bounds error during error conversion.
|-
| 0x287C || 124 || 20 || Argument is NULL
|-
| 0x2C7C || 124 || 22 || Argument is invalid
|-
| 0x3C7C || 124 || 30 || Bad input buffer size
|-
| 0x407C || 124 || 32 || Invalid input buffer
|-
| 0x767C || 124 || 59 || [[Network_Interface_services#IsAnyInternetRequestAccepted|IsAnyInternetRequestAccepted]] with the output from [[#Network_Interface_services#GetClientId|GetClientId]] returned false.
|-
| || 124 || 3000 || [https://en-americas-support.nintendo.com/app/answers/detail/a_id/27166/ System Update Required]
|-
| || 124 || 3001 || [https://en-americas-support.nintendo.com/app/answers/detail/a_id/28969/ Game Update Required]
|-
| || 124 || 4007 || [https://en-americas-support.nintendo.com/app/answers/detail/a_id/28046/ Account Permanent Ban]
|-
| || 124 || 4508 || [https://en-americas-support.nintendo.com/app/answers/detail/a_id/28046/ Account Permanent Ban]
|-
| || 124 || 4517 || [https://en-americas-support.nintendo.com/app/answers/detail/a_id/43652/ Account Ban]
|-
| || 124 || 4609 || [https://en-americas-support.nintendo.com/app/answers/detail/a_id/46482/ Service Discontinued]
|-
| 0x27E || 126 || 1 || Invalid argument
|-
| 0x87E || 126 || 4 || Entry not found
|-
| 0xCE7E || 126 || 67 || Invalid database signature value (should be "NFDB")
|-
| 0xD27E || 126 || 69 || Invalid database entry count
|-
| 0x1987E || 126 || 204 || Development/debug-only behavior
|-
| 0x480 || 128 || 2 || IStorage not available.
|-
| 0x680 || 128 || 3 || No messages
|-
| 0x4680 || 128 || 35 || Error while launching applet.
|-
| 0x4A80 || 128 || 37 || Title-ID not found. Caused by code 0x410 when applet launch fails
|-
| 0x3E880 || 128 || 500 || Invalid input
|-
| 0x3EC80 || 128 || 502 || IStorage has already been opened by another accessor
|-
| 0x3EE80 || 128 || 503 || IStorage Read/Write out-of-bounds
|-
| 0x3F480 || 128 || 506 || Invalid parameters
|-
| 0x3FE80 || 128 || 511 || IStorage opened as wrong type (data opened as transfermem, transfermem opened as data)
|-
| 0x40080 || 128 || 512 || Unbalanced fatal section leave (returned when executing LeaveFatalSection without a preceding EnterFatalSection call)
|-
| 0x40C80 || 128 || 518 || Null object
|-
| 0x4B080 || 128 || 600 || Failed to allocate memory for IStorage
|-
| 0x59080 || 128 || 712 || Thread stack pool exhausted (out of memory)
|-
| 0x79C80 || 128 || 974 || DebugMode not enabled
|-
| 0x7A880 || 128 || 980 || <code>am.debug!dev_function</code> setting needs to be set / DebugMode not enabled
|-
| 0x7CC80 || 128 || 998 || Not implemented
|-
| 0xCC81 || 129 || 102 || Transmission not agreed
|-
| 0xD281 || 129 || 105 || Network unavailable
|-
| 0x7DA81 || 129 || 1005 || HTTP error: Couldnt resolve proxy
|-
| 0x7DC81 || 129 || 1006 || HTTP error: Couldnt resolve host
|-
| 0x7DE81 || 129 || 1007 || HTTP error: Couldnt connect
|-
| 0x7FE81 || 129 || 1023 || HTTP error: Write error
|-
| 0x80481 || 129 || 1026 || HTTP error: Read error
|-
| 0x80681 || 129 || 1027 || HTTP error: Out of memory
|-
| 0x80881 || 129 || 1028 || HTTP error: Operation timedout
|-
| 0x81681 || 129 || 1035 || HTTP error: SSL connect error
|-
| 0x83681 || 129 || 1051 || HTTP error: Peer failed verification
|-
| 0x83881 || 129 || 1052 || HTTP error: Got nothing
|-
| 0x83E81 || 129 || 1055 || HTTP error: Send error
|-
| 0x84081 || 129 || 1056 || HTTP error: Recv error
|-
| 0x84481 || 129 || 1058 || HTTP error: SSL cert problem
|-
| 0x84681 || 129 || 1059 || HTTP error: SSL cipher
|-
| 0x84881 || 129 || 1060 || HTTP error: SSL CA cert
|-
| 0x12C081 || 129 || 2400 || Server error: Status 400
|-
| 0x12C281 || 129 || 2401 || Server error: Status 401
|-
| 0x12C681 || 129 || 2403 || Server error: Status 403
|-
| 0x138881 || 129 || 2500 || Server error: Status 500
|-
| 0x138E81 || 129 || 2503 || Server error: Status 503
|-
| 0x139081 || 129 || 2504 || Server error: Status 504
|-
| 0xA83 || 131 || 5 || Unrecognized applet ID
|-
| 0x485 || 133 || 2 || Invalid DVFS table ID
|-
| 0x685 || 133 || 3 || DVFS table ID for debug only, see [[PCV_services#Module|DVFS Table]] notes.
|-
| 0x885 || 133 || 4 || Invalid parameter
|-
| 0x1489 || 137 || 10 || Already initialized.
|-
| 0x3C89 || 137 || 30 || Task not found.
|-
| 0x5089 || 137 || 40 || Memory allocation failed / bad input.
|-
| 0x29489 || 137 || 330 || [[NCM_services#ContentMetaType|ContentMetaType]] doesn't match SystemUpdate.
|-
| 0x271289 || 137 || 5001 || One of the following socket errors occurred: ENETDOWN, ECONNRESET, EHOSTDOWN, EHOSTUNREACH, or EPIPE. Also occurs when the received size doesn't match the expected size (recvfrom() ret with [[NIM_services#Contents_Delivery|meta_size]] data receiving).
|-
| 0x272489 || 137 || 5010 || Socket was [[Sockets_services|shutdown()]] due to the async operation being cancelled.
|-
| 0x273889 || 137 || 5020 || Too many internal output entries with [[NIM_services|nim]] cmd42, system is [[NIM_services#Contents_Delivery|Internet-connected]], or an unrecognized socket error occured.
|-
| 0x27D889 || 137 || 5100 || Connection timeout.
|-
| 0x2A4489 || 137 || 5410 || Invalid [[NIM_services#Contents_Delivery|ID]].
|-
| 0x2A5889 || 137 || 5420 || Invalid [[NIM_services#Contents_Delivery|magicnum]]. Can also be caused by the connection being closed by the peer, since non-negative return values from recv() are ignored in this case.
|-
| 0x2A6C89 || 137 || 5430 || Invalid [[NIM_services#Contents_Delivery|data_size]].
|-
| 0x2A8089 || 137 || 5440 || The input [[NCM_services#ContentMetaKey|ContentMetaKey]] doesn't match the ContentMetaKey in state.
|-
| 0x2A9489 || 137 || 5450 || Invalid [[NIM_services#Contents_Delivery|meta_size]].
|-
| 0x36B289 || 137 || 7001 || HTTP invalid response code (>=600).
|-
| 0x36B489 || 137 || 7002 || HTTP invalid client response code (4xx).
|-
| 0x36B689 || 137 || 7003 || HTTP invalid server response code (5xx).
|-
| 0x36B889 || 137 || 7004 || HTTP invalid redirect response code (3xx).
|-
| 0x390889-0x391889 || 137 || 7300-7308 || HTTP response code 300-308.
|-
| 0x39D089-0x39F289 || 137 || 7400-7417 || HTTP response code 400-417.
|-
| 0x3A9889-0x3AAA89 || 137 || 7500-7509 || HTTP response code 500-509.
|-
| 0x3CF089 || 137 || 7800 || Unknown/invalid libcurl error.
|-
| 0x3E8289-0x3F4089 || 137 || 8001-8096 || libcurl error 1-96. Some of the libcurl errors in the error-table map to the above unknown-libcurl-error however.
|-
| 0x68A || 138 || 3 || Not initialized.
|-
| 0x668C || 140 || 51 || USB data-transfer in progress
|-
| 0xD48C || 140 || 106 || Invalid descriptor
|-
| 0x1928C || 140 || 201 || USB device not bound / interface already enabled
|-
| 0x1BE8E || 142 || 223 || [[Network_Interface_services#IsAnyInternetRequestAccepted|IsAnyInternetRequestAccepted]] with the output from [[#Network_Interface_services#GetClientId|GetClientId]] returned false.
|-
| 0x290 || 144 || 1 || Exited Abnormally ([[Applet_Manager_services#LibraryAppletExitReason|ExitReason]] == Abormal)
|-
| 0x690 || 144 || 3 || Canceled ([[Applet_Manager_services#LibraryAppletExitReason|ExitReason]] == Canceled)
|-
| 0x890 || 144 || 4 || Rejected
|-
| 0xA90 || 144 || 5 || Exited Unexpectedly ([[Applet_Manager_services#LibraryAppletExitReason|ExitReason]] == Unexpected)
|-
| 0x299 || 153 || 1 || Invalid audio device
|-
| 0x499 || 153 || 2 || Operation couldn't complete successfully
|-
| 0x699 || 153 || 3 || Invalid sample rate
|-
| 0x899 || 153 || 4 || Buffer size too small
|-
| 0x1099 || 153 || 8 || Too many buffers are still unreleased
|-
| 0x1499 || 153 || 10 || Invalid channel count
|-
| 0x40299 || 153 || 513 || Invalid/Unsupported operation
|-
| 0xC0099 || 153 || 1536 || Invalid handle
|-
| 0xC0899 || 153 || 1540 || Audio output was already started
|-
| 0x3C9D || 157 || 30 || Address is NULL
|-
| 0x3E9D || 157 || 31 || PID is NULL
|-
| 0x549D || 157 || 42 || Already bound
|-
| 0xCC9D || 157 || 102 || Invalid PID
|-
| 0x49E || 158 || 2 || BootImagePackage not found
|-
| 0x69E || 158 || 3 || Invalid BootImagePackage
|-
| 0x89E || 158 || 4 || Work buffer too small
|-
| 0xA9E || 158 || 5 || Work buffer not aligned
|-
| 0xC9E || 158 || 6 || BootImages need repair
|-
| 0x29F || 159 || 1 || Cancel was selected
|-
| 0xAA3 || 163 || 5 || System is booting up repair process without VOL+ held down.
|-
| 0xCA3 || 163 || 6 || System is booting up repair process that requires RepairTimeReviser but does not have special cartridge inserted.
|-
| 0x70A4 || 164 || 56 || [[Network_Interface_services#IsAnyInternetRequestAccepted|IsAnyInternetRequestAccepted]] with the output from [[#Network_Interface_services#GetClientId|GetClientId]] returned false.
|-
| 0x4AF || 175 || 2 || Bad version returned from calling the "nnjitpluginGetVersion" symbol.
|-
| 0xCAAF || 175 || 101 || Input NRO/NRR are too large for the storage buffer.
|-
| 0x4B0AF || 175 || 600 || Symbol funcptr used by this cmd is not initialized (Control/GenerateCode).
|-
| 0x4B2AF || 175 || 601 || DllPlugin Not initialized, or plugin NRO has already been loaded.
|-
| 0x4B4AF || 175 || 602 || An error was returned from calling the symbol funcptr with the Control cmd.
|-
| 0xC8B2 || 178 || 100 || Invalid user ID
|-
| 0xCAB2 || 178 || 101 || User does not exist
|-
| 0x12CB2 || 178 || 150 || Service unavailable
|-
| 0x190B2 || 178 || 200 || File storage failure
|-
| 0xAB4 || 180 || 5 || Invalid event ID
|-
| 0x1F4EB5 || 181 || 4007 || Device authentication error: System update required
|-
| 0x1F50B5 || 181 || 4008 || Device authentication error: [https://en-americas-support.nintendo.com/app/answers/detail/a_id/42061/ Permanant Ban]
|-
| 0x1F52B5 || 181 || 4009 || Device authentication error: Internal server error
|-
| 0x1F54B5 || 181 || 4007 || Device authentication error: Under maintenance
|-
| || 181 || 4017 || Device authentication error: [https://en-americas-support.nintendo.com/app/answers/detail/a_id/43653/ Ban]
|-
| 0x58ACA || 202 || 709 || Npad ID is out of range.
|-
| 0x2032CA || 202 || 4121 || [[Settings_services#ButtonConfigSettings|ButtonConfigSettings]] IsFull flag is clear.
|-
| 0x28CB || 203 || 20 || The [6.0.0+] Authentication challenge failed.
|-
| 0x40CB || 203 || 32 || Bad State / bad state ptr.
|-
| 0x82CB || 203 || 65 || Failed to connect to the AccessPoint.
|-
| 0x84CB || 203 || 66 || Timeout occured during Authentication / while attempting to find a valid ActionFrame.
|-
| 0x86CB || 203 || 67 || Maximum participants reached, Station not allowed to connect, ...
|-
| 0xC0CB || 203 || 96 || Bad input, or not initialized.
|-
| 0xC2CB || 203 || 97 || Matching LocalCommunicationId not found in the user-process [[NACP_Format|control.nacp]].
|-
| 0xE2CB || 203 || 113 || The specified LocalCommunicationVersion is less than the AccessPoint LocalCommunicationVersion.
|-
| 0xE4CB || 203 || 114 || The specified LocalCommunicationVersion is larger than the AccessPoint LocalCommunicationVersion.
|-
| 0xF0CD || 205 || 120 || IR image data not available/ready.
|-
| 0x1A8CD || 205 || 212 || IR camera handle pointer is null.
|-
| 0x198CD || 205 || 204 || IR camera invalid handle value.
|-
| 0x4CE || 206 || 2 || Invalid argument.
|-
| 0x6CE || 206 || 3 || Out of memory.
|-
| 0x10CE || 206 || 8 || Out of range. Buffer needs to be aligned.
|-
| 0x18CE || 206 || 12 || Invalid FileId.
|-
| 0x1ACE || 206 || 13 || Invalid storage ID.
|-
| 0x1CCE || 206 || 14 || Invalid content type.
|-
| 0x2ACE || 206 || 21 || Failed to mount Image Directory.
|-
| 0x2CCE || 206 || 23 || File too big.
|-
| 0x30CE || 206 || 24 || Invalid file size.
|-
| 0x3CCE || 206 || 30 || Buffer insufficient.
|-
| 0xAF2CE || 206 || 1401 || Too many files already saved.
|-
| 0x4DA || 218 || 2 || StatusManager entry IsValid flag not set, or controller-update currently in-progress.
|-
| 0x6DA || 218 || 3 || Controller-update failed via the LibraryApplet.
|-
| 0x8DA || 218 || 4 || Invalid BusHandle.
|-
| 0xADA || 218 || 5 || StatusManager entry flag +0x0 not set, or device not connected.
|-
| 0xEDA || 218 || 7 || PollingReceivedData not available.
|-
| 0x10DA || 218 || 8 || StatusManager entry DeviceEnabled flag not set, or flag +0x0 not set.
|-
| 0x12DA || 218 || 9 || ExternalDeviceId mismatch.
|-
| 0x14DA || 218 || 10 || BusHandle already initialized.
|-
| 0x104E7 || 231 || 130 || Nullptr passed to the LocalCommunicationId [[NACP_Format|control.nacp]] validation func.
|-
| 0x140E7 || 231 || 160 || GroupInfo field out of range.
|-
| 0x142E7 || 231 || 161 || SupportedPlatform not appropriate for this operation.
|-
| 0x146E7 || 231 || 163 || Invalid ServiceName.
|-
| 0x148E7 || 231 || 164 || Must provide PresharedBinaryKey.
|-
| 0x1C0E7 || 231 || 224 || Requested Priority value not allowed.
|-
| 0x1C2E7 || 231 || 225 || Matching LocalCommunicationId not found in the user-process [[NACP_Format|control.nacp]].
|-
| 0x200E7 || 231 || 256 || Invalid flag.
|-
| 0x204E7 || 231 || 258 || Invalid SupportedPlatform.
|-
| 0x208E7 || 231 || 260 || Invalid StaticAesKeyIndex.
|-
| 0x20AE7 || 231 || 261 || MemberCountMax cannot be greater than 8.
|-
| 0x210E7 || 231 || 264 || GroupInfo+8F must be 0x20.
|}

=== FS Error codes ===
The following are the error codes recognized by nn::fs::detail::LogErrorMessage found in some [[Factory Setup|factory]] titles:

{| class=wikitable
! Value || Description || Message
|-
| 0xD401 || 106 || nn::svc::ResultInvalidCurrentMemory: Error: Passed buffer is not usable for fs library. See a manual of fs library for more information.
|-
| 0x7802 || 60 || nn::fs::ResultMountNameAlreadyExists: Error: Specified mount name already exists.
|-
| 0x7D202 || 1001 || nn::fs::ResultPartitionNotFound: Error: Specified partition is not found.
|-
| 0x7D402 || 1002 || nn::fs::ResultTargetNotFound: Error: Specified target is not found.
|-
| 0xFA002 - 0x138602 || 2000 - 2499 || nn::fs::ResultSdCardAccessFailed: Error: Failed to access SD card.
|-
| 0x136802 - 0x176E02 || 2500 - 2999 || nn::fs::ResultGameCardAccessFailed: Error: Failed to access game card.
|-
| 0x177202 || 3001 || nn::fs::ResultNotImplemented: Error: Specified operation is not implemented.
|-
| 0x177A02 || 3005 || nn::fs::ResultOutOfRange: Error: Specified value is out of range.
|-
| 0x190002 - 0x1B5602 || 3200 - 3499 || nn::fs::ResultAllocationMemoryFailed: Error: Failed to allocate memory.
|-
| 0x1B5802 - 0x1F3E02 || 3500 - 3999 || nn::fs::ResultMmcAccessFailed: Error: Failed to access MMC.
|-
| 0x1F4202 - 0x219602 || 4001 - 4299 || nn::fs::ResultRomCorrupted: Error: ROM is corrupted.
|-
| 0x219A02 - 0x232602 || 4301 - 4499 || nn::fs::ResultSaveDataCorrupted: Error: Save data is corrupted.
|-
| 0x232A02 - 0x23EE02 || 4501 - 4599 || nn::fs::ResultNcaCorrupted: Error: NCA is corrupted.
|-
| 0x23F202 - 0x243E02 || 4601 - 4639 || nn::fs::ResultIntegrityVerificationStorageCorrupted: Error: Integrity verification failed.
|-
| 0x244202 - 0x246602 || 4641 - 4659 || nn::fs::ResultPartitionFileSystemCorrupted: Error: Partition FS is corrupted.
|-
| 0x246A02 - 0x248E02 || 4661 - 4679 || nn::fs::ResultBuiltInStorageCorrupted: Error: Built-in-storage is corrupted.
|-
| 0x249202 - 0x24B602 || 4681 - 4699 || nn::fs::ResultFatFileSystemCorrupted: Error: FAT FS is corrupted.
|-
| 0x24BA02 - 0x24DE02 || 4701 - 4719 || nn::fs::ResultHostFileSystemCorrupted: Error: HOST FS is corrupted.
|-
| 0x1F4002 - 0x270E02 || 4000, 4300, 4500, 4600, 4640, 4660, 4680, 4700, 4720-4999 || nn::fs::ResultDataCorrupted: Error: Data is corrupted.
|-
| 0x271002 - 0x2EDE02 || 5000-5999 || nn::fs::ResultUnexpected: Error: Unexpected failure occurred.
|-
| 0x2EE002 - 0x32C602 || 6000-6499 || nn::fs::ResultPreconditionViolation: Error: Precondition violation.
|-
| 0x2EE202 - 0x306E02 || 6001-6199 || nn::fs::ResultInvalidArgument: Error: Invalid argument was specified.
|-
| 0x2EE402 - 0x2F1A02 || 6002-6029 || nn::fs::ResultInvalidPath: Error: Invalid path was specified.
|-
| 0x2EE602 || 6003 || nn::fs::ResultTooLongPath: Error: Too long path was specified.
|-
| 0x2EE802 || 6004 || nn::fs::ResultInvalidCharacter: Error: Invalid path character was specified.
|-
| 0x2EEA02 || 6005 || nn::fs::ResultInvalidPathFormat: Error: Invalid path format was specified.
|-
| 0x2F5A02 || 6061 || nn::fs::ResultInvalidOffset: Error: Invalid offset was specified.
|-
| 0x2F5C02 || 6062 || nn::fs::ResultInvalidSize: Error: Invalid size was specified.
|-
| 0x2F5E02 || 6063 || nn::fs::ResultNullptrArgument: Error: Null pointer argument was specified.
|-
| 0x2F6202 || 6065 || nn::fs::ResultInvalidMountName: Error: Invalid mount name was specified.
|-
| 0x2F6402 || 6066 || nn::fs::ResultExtensionSizeTooLarge: Error: Extension size exceeds max value set in nmeta file.
|-
| 0x2F6602 || 6067 || nn::fs::ResultExtensionSizeInvalid: Error: Extension size is not a multiple of nn::fs::SaveDataExtensionUnitSize.
|-
| 0x307202 || 6201 || nn::fs::ResultFileExtensionWithoutOpenModeAllowAppend: Error: OpenMode_AllowAppend is required for implicit extension of file size by WriteFile().
|-
| 0x307002 - 0x313602 || 6200, 6202 - 6299 || nn::fs::ResultInvalidOperationForOpenMode: Error: Invalid operation for the open mode.
|-
| 0x313802 - 0x31FE02 || 6300-6399 || nn::fs::ResultUnsupportedOperation: Error: Unsupported operation.
|-
| 0x320002 - 0x326202 || 6400-6449 || nn::fs::ResultPermissionDenied: Error: Permission denied.
|-
| 0x327202 || 6457 || nn::fs::ResultWriteModeFileNotClosed: Error: Close files opened in write mode before committing.
|-
| 0x328202 || 6465 || nn::fs::ResultUserNotExist: Error: Specified user doesn't exist.
|-
| 0x346402 || 6706 || nn::fs::ResultMappingTableFull: Error: Enough journal space is not left.
|-
| 0x346A02 || 6709 || nn::fs::ResultOpenCountLimit: Error: The open count of files and directories reached the limitation.
|-
| 0x353602 || 6811 || nn::fs::ResultMapFull: Error: Save data extension count reached the limitation.
|-
| 0x35F202 || 6905 || nn::fs::ResultNotMounted: Error: Specified mount name is not found.
|}

= Fatal Errors =
{| class=wikitable
! Error || Description
|-
| 2162-0002
| Can be triggered by running [[SVC|svcBreak]]. The svcBreak params have no effect on the value of the thrown error-code.
|-
| 2168-0000
| Userland ARM undefined instruction exception
|-
| 2168-0001
| Userland ARM prefetch-abort due to PC set to non-executable region
|-
| 2168-0002
| Userland ARM data abort. Also caused by abnormal process termination via [[SVC|svcExitProcess]]. Note: directly jumping to nnMain()-retaddr from non-main-thread has the same result.
|-
| 2168-0003
| Userland PC address not aligned to 4 bytes
|-
| 2168-0008
| Can occur when attempting to call an svc outside the whitelist
|}

= Support Errors =
This section is for Support Errors displayed by the error-applet, separate from the normal Result Errors.

== Modules ==
{| class=wikitable
! Value || Name
|-
| 520 || Nverpt
|-
| 800 || [[Internet_Browser|General web-applet]]
|-
| 809 || [[Internet_Browser|WifiWebAuthApplet]]
|-
| 810 || [[Internet_Browser|Whitelisted-applet]]
|-
| 811 || [[Internet_Browser|ShopN]]
|}

8XX is for/includes system applets.

== Error codes ==
{| class=wikitable
! Value || Module || Description || Notes
|-
|
| {web-applets listed above}
| 2750
| MP4 parsing failed.
|}

Normal error-codes displayed by the system also use the same format as fatal-errors.

= Homebrew Errors =
Custom errors used by homebrew libraries and applications.

== Modules ==
{| class=wikitable
! Value || Name
|-
| 345 || libnx
|-
| 346 || [[Homebrew ABI]]
|-
| 347 || Homebrew Loader
|-
| 348 || libnx NVIDIA errors
|-
| 349 || libnx Binder errors
|}

Mario Kart Live: Home Circuit

2021-01-29T20:15:40Z

CFSworks: /* Pairing process & Network protocols */ New sections

This page documents the Mario Kart Live: Home Circuit game.

Communication with the kart is done directly over local-WLAN via [[LDN_services|lp2p:app]]. The service implementation is in the main-codebin itself, without symbols - however there are strings for this. This is the first title on retail which uses lp2p.

This is also the first known title on retail which uses stack cookies. This is used by main-codebin, the ssp functionality in sdknso is still not used other than being called from an initialization func. This is implemented in the main-codebin as follows:
* The global u64 __stack_chk_guard is loaded then saved immediately before {first saved register} on stack, during func entry. During func exit, the global u64 is compared with the cookie on stack, it will call __stack_chk_fail on mismatch. __stack_chk_fail just executes an undefined instruction to trigger a crash.
* There is no initialization func for __stack_chk_guard, it's just a hard-coded constant: 0xDEADBEEFDEADBEEF. Since it's constant, this renders the stack cookie useless.

RomFs contains only two files:
* "data.zip"
* "update.pua": This is the firmware update data for the Kart. This is a tar archive. The extracted archive contains "update.pui" and "pui.hash". The latter is a binary 0x100-byte file. The former is another tar archive, the content of that archive is the following:
** "config.txt": Contains config which includes fields for efuse_key, efuse_fw, secure_boot, etc. Also references the data under generic/. Seems to be configuration for firmware installation, not uboot.
** "audiofw_sha": 0x20-byte binary SHA256 hash for the "bluecore.audio.aes" file.
** "dtb_sha": 0x20-byte binary SHA256 hash for the .dtb file.
** "rootfs_sha": 0x20-byte binary SHA256 hash for the "root.nand.cpio.gz_pad.img.aes" file.
** "tee_sha": 0x20-byte binary SHA256 hash for the tee file.
** "uImage_sha": 0x20-byte binary SHA256 hash for the "nand.uImage.aes" file.
** "generic/": This contains:
*** "android.nand.dtb": Plaintext "kernelDT".
*** "bluecore.audio.aes": Encrypted "audioKernel".
*** "nand.uImage.aes": Encrypted "linuxKernel".
*** "root.nand.cpio.gz_pad.img.aes": Encrypted "InitrdRootFS".
*** "tee.bin.aes": Encrypted "tee".

Note that the only firmware archive files accessed by the game are "update.pui", "pui.hash", and "config.txt". The content of "config.txt" is only used with sscanf() to extract the version fields. "update.pui"/"pui.hash" are probably sent over the network connection to the kart - it's unknown whether the game does anything with the content of "pui.hash" other than this.

= Kart =
The kart is internally referred to by the game as "RCD" and "Fuji". Various strings in the kart OSS refer to it as "DHC".

OSS is [https://www.nintendo.co.jp/support/oss/index.html available] for the kart itself.

This uses Linux. The 1.1.0_3 archive contains the following:
busybox-1.22.1.tar.bz2
eudev-1.5.3.tar.gz
kmod-17.tar.xz
libnl-3.2.24.tar.gz
linux-kernel_5c3cb2e0be2243f6d4553ccad2047c9d72e25ea2.tar.gz
lrzsz-0.12.20.tar.gz
PsdDriver_5a8d821.zip
rtl8188eu_074cc66fece232b0d5f1e1f7de57e72022ec12b1.tar.gz
uboot_53a0fa98b176329e340b0a2fca6edb7117209751.tar.gz
util-linux-2.24.2.tar.xz

PsdDriver is Nintendo's custom kernel module, the GPL license header used in the source starts with the following:
* Sensors and Motors driver
* Copyright (C) 2020 Nintendo Co, Ltd

The only changes in the OSS for 1.0.0_1 -> 1.1.0_3 are the following (note that there are more versions between these):
* The following archives were updated: linux-kernel, PsdDriver, rtl8188eu, uboot.
* In the PsdDriver source, the line-ending at the start of various source files was updated.
** In sources/psd_util.c, <code>initialize_table();</code> is now called by a dedicated <code>psd_util_init_crc8</code> function instead of <code>psd_util_get_crc8</code>, which is now called by <code>device_init</code> in sources/psd.c.

The above git-commit-hashes (?) from the filenames doesn't seem to match commits in the upstream repos.

On October 28, 2020, the existing OSS archives were updated without adding a new version. With 1.1.0_3, the uboot archive (which has the same filename) had the "/examples" directory removed.

== Pairing process ==
The kart communicates with the Switch via standard 802.11 frames on channel 1/6/11, with standard CCMP encryption, but the authentication and key exchange protocol is Nintendo-proprietary. See [[LDN services]] for more information.

On first startup, ''Home Circuit'' generates a random SSID (beginning with 'G') and 0x20-byte PSK (for use in the aforementioned key exchange; it is not standard WPA). These are saved and reused on every subsequent startup, so that any kart(s) with this information stored can reconnect without needing to be paired again.

When pairing, ''Home Circuit'' creates a temporary network (random SSID beginning with 'P', randomized PSK, neither stored) and shows the details for this "pairing network" in a QR code for the kart to scan. Once the kart connects, it fetches the main "game" network SSID+PSK and stores them, and both it and ''Home Circuit'' exit pairing mode. The pairing network is only active while the QR code is displayed, otherwise the main "game" network runs.

The QR code is a "version 4" (33x33) code with level-M error correction. It uses byte encoding, and stores 0x3E bytes:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x10 || Pairing seed. LP2P PSK is SHA256(seed)
|-
| 0x10 || 0x20 || Pairing SSID. Remaining space is filled with zeros.
|-
| 0x30 || 0x2 || Pairing channel. Encoded little-endian. Usually 0.
|-
| 0x32 || 0xC || Padding bytes; zero.
|}

== Network protocols ==
Once the kart connects to the "game" network hosted by ''Home Circuit'', it requests an IP address via DHCP, then connects to the Switch via standard TCP/IP to announce its presence. A series of TCP and UDP connections are established to exchange information, stream video, transmit control signals, monitor kart telemetry, etc.

= Versions =
This section documents the changes for game-updates.

== v1.0.1 ==
This only updated the Kart firmware.

ExeFs:
* Nothing changed besides the usual NPDM update.

RomFs:
* Only update.pua was updated, the following was changed in the extracted update.pui (pui.hash in update.pua was also updated):
** "config.txt": system_minor_version was changed from "3" to "4".
** "audiofw_sha"
** "rootfs_sha"
** "uImage_sha"
** "generic/bluecore.audio.aes": Starts differing at offset 0x1D0.
** "generic/nand.uImage.aes": Starts differing at offset 0x0.
** "generic/root.nand.cpio.gz_pad.img.aes": Starts differing at offset 0x0.

LDN services

2021-01-29T19:29:55Z

CFSworks: /* lp2p */ Clarify that key A is used for CCMP

LDN handles all local network communication.

= ldn:m =
This is "nn::ldn::detail::IMonitorServiceCreator".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#CreateMonitorService]]
|}

== CreateMonitorService ==
Returns an [[#IMonitorService]].

The user-process closes the IMonitorServiceCreator object immediately after using this cmd.

== IMonitorService ==
This is "nn::ldn::detail::IMonitorService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#GetStateForMonitor]]
|-
| 1 || [[#GetNetworkInfoForMonitor]]
|-
| 2 || [[#GetIpv4AddressForMonitor]]
|-
| 3 || [[#GetDisconnectReasonForMonitor]]
|-
| 4 || [[#GetSecurityParameterForMonitor]]
|-
| 5 || [[#GetNetworkConfigForMonitor]]
|-
| 100 || [[#InitializeMonitor]]
|-
| 101 || [[#FinalizeMonitor]]
|}

=== GetStateForMonitor ===
No input, returns an output u32.

sdknso implements this by <code>return</code>ing the u32, with 0 being returned on error.

=== GetNetworkInfoForMonitor ===
Takes a type-0x1A output buffer containing a [[#NetworkInfo]].

=== GetIpv4AddressForMonitor ===
No input, returns an output [[#Ipv4Address]] and a [[#SubnetMask]].

=== GetDisconnectReasonForMonitor ===
No input, returns an output s16.

This is not exposed by sdknso.

This just returns 0.

=== GetSecurityParameterForMonitor ===
No input, returns an output [[#SecurityParameter]].

This is not exposed by sdknso.

=== GetNetworkConfigForMonitor ===
No input, returns an output [[#NetworkConfig]].

This is not exposed by sdknso.

=== InitializeMonitor ===
No input/output.

This is used immediately after object creation. Official sw will Abort if this fails.

This just returns 0.

=== FinalizeMonitor ===
No input/output.

This is used during service exit, prior to closing the object. Official sw will Abort if this fails.

This just returns 0.

= ldn:s =
This is "nn::ldn::detail::ISystemServiceCreator".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#CreateSystemLocalCommunicationService]]
|}

== CreateSystemLocalCommunicationService ==
Returns an [[#ISystemLocalCommunicationService]].

The user-process closes the ISystemServiceCreator object immediately after using this cmd. Official sw ignores errors from this cmd.

== ISystemLocalCommunicationService ==
This is "nn::ldn::detail::ISystemLocalCommunicationService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#GetState]]
|-
| 1 || [[#GetNetworkInfo]]
|-
| 2 || [[#GetIpv4Address]]
|-
| 3 || [[#GetDisconnectReason]]
|-
| 4 || [[#GetSecurityParameter]]
|-
| 5 || [[#GetNetworkConfig]]
|-
| 100 || [[#AttachStateChangeEvent]]
|-
| 101 || [[#GetNetworkInfoLatestUpdate]]
|-
| 102 || [[#Scan]]
|-
| 103 || [[#ScanPrivate]]
|-
| 104 || [5.0.0+] [[#SetWirelessControllerRestriction]]
|-
| 200 || [[#OpenAccessPoint]]
|-
| 201 || [[#CloseAccessPoint]]
|-
| 202 || [[#CreateNetwork]]
|-
| 203 || [[#CreateNetworkPrivate]]
|-
| 204 || [[#DestroyNetwork]]
|-
| 205 || [[#Reject]]
|-
| 206 || [[#SetAdvertiseData]]
|-
| 207 || [[#SetStationAcceptPolicy]]
|-
| 208 || [[#AddAcceptFilterEntry]]
|-
| 209 || [[#ClearAcceptFilter]]
|-
| 300 || [[#OpenStation]]
|-
| 301 || [[#CloseStation]]
|-
| 302 || [[#Connect]]
|-
| 303 || [[#ConnectPrivate]]
|-
| 304 || [[#Disconnect]]
|-
| 400 || [[#InitializeSystem]]
|-
| 401 || [[#FinalizeSystem]]
|-
| 402 || [4.0.0+] [[#SetOperationMode]]
|-
| 403 || [7.0.0+] [[#InitializeSystem2]]
|}

=== GetState ===
No input, returns an output u32.

sdknso implements this by <code>return</code>ing the u32, with 0 being returned on error / when service isn't initialized.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || None
|-
| 1 || Initialized
|-
| 2 || AccessPointOpened
|-
| 3 || AccessPointCreated
|-
| 4 || StationOpened
|-
| 5 || StationConnected
|-
| 6 || Error
|-
|}

=== GetNetworkInfo ===
Takes a type-0x1A output buffer containing a [[#NetworkInfo]].

=== GetIpv4Address ===
No input, returns an output [[#Ipv4Address]] and a [[#SubnetMask]].

=== GetDisconnectReason ===
No input, returns an output s16.

sdknso implements this by <code>return</code>ing the s16 as a s32, with -1 being returned on error.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| -1 || See above.
|-
| 0 || None
|-
| 1 || User
|-
| 2 || SystemRequest
|-
| 3 || DestroyedByAdmin
|-
| 4 || DestroyedBySystemRequest
|-
| 5 || Admin
|-
| 6 || SignalLost
|}

=== GetSecurityParameter ===
No input, returns an output [[#SecurityParameter]].

=== GetNetworkConfig ===
No input, returns an output [[#NetworkConfig]].

=== AttachStateChangeEvent ===
No input, returns an output Event handle.

sdknso uses EventClearMode=1 with this. sdknso will Abort if this cmd fails.

This is signaled when the data returned by [[#GetNetworkInfo]]/[[#GetNetworkInfoLatestUpdate]] is updated.

=== GetNetworkInfoLatestUpdate ===
Takes a type-0x1A output buffer containing a [[#NetworkInfo]] and a type-0xA output buffer containing an array of [[#NodeLatestUpdate]].

The array count must be 8.

=== Scan ===
Takes a type-0x22 output buffer containing an array of [[#NetworkInfo]], a s16 channel, a [[#ScanFilter]], returns an output s16 total_out.

sdknso copies the output s16 to a s32, the value passed for the input s16 is from an user-specified s32 (user-apps generally use value 0 for this).

This is the same as [[#ScanPrivate]], except this also has the same channel-override functionality as [[#CreateNetwork]].

[[#GetState|State]] must be 3-5.

The array count must be at least 1. This is clamped to a maximum of 0x18.

=== ScanPrivate ===
Takes a type-0x22 output buffer containing an array of [[#NetworkInfo]], a s16 channel, a [[#ScanFilter]], returns an output s16 total_out.

sdknso copies the output s16 to a s32, the value passed for the input s16 is from an user-specified s32.

See [[#Scan]].

=== SetWirelessControllerRestriction ===
Takes an input [[#WirelessControllerRestriction]], no output.

[[#GetState|State]] must be 1.

The input value is written into state.

=== OpenAccessPoint ===
No input/output.

[[#GetState|State]] must be 1, this cmd eventually sets the State to value 2.

=== CloseAccessPoint ===
No input/output.

[[#GetState|State]] must be 2-3, this cmd eventually sets the State to value 1.

=== CreateNetwork ===
Takes an input [[#SecurityConfig]], an [[#UserConfig]], a [[#NetworkConfig]], no output.

This is the same as [[#CreateNetworkPrivate]], except the [[#AddressEntry]] params are 0, and the [[#SecurityParameter]] is generated from "nn::util::TinyMt::GenerateRandomBytes".

Unlike CreateNetworkPrivate, this overwrites the channel field in the [[#NetworkConfig]]. When the cached [[SPL_services#IsDevelopment|IsDevelopment]] value is true, the output from [[Settings_services|GetLdnChannel]] will overwrite that field if the s32 setting value is >=0, otherwise the original value is used. Otherwise when the IsDevelopment field is false (retail), the channel is overwritten with value 0.

This overwrites the u16 field at [[#SecurityConfig]]+0. When the cached [[SPL_services#IsDevelopment|IsDevelopment]] value is false (retail), value 1 is used, otherwise the original value is used.

[[#GetState|State]] must be 2, this cmd eventually sets the State to value 3.

=== CreateNetworkPrivate ===
Takes an input [[#SecurityConfig]], a [[#SecurityParameter]], an [[#UserConfig]], a [[#NetworkConfig]], a type-0x9 input buffer containing an array of [[#AddressEntry]], no output.

The buffer/count for [[#AddressEntry]] can be 0, in which case the network will be non-Private like [[#CreateNetwork]]. The count must be <=8.

See [[#CreateNetwork]].

=== DestroyNetwork ===
No input/output.

[[#GetState|State]] must be 3, this cmd eventually sets the State to value 2.

=== Reject ===
Takes an input [[#Ipv4Address]], no output.

[[#GetState|State]] must be 3.

=== SetAdvertiseData ===
Takes a type-0x21 input buffer, no output.

The input buffer contains arbitrary user data.

The buffer size must be <=0x180. An empty buffer (addr=NULL/size=0) can be used to reset the AdvertiseData size in state to zero.

[[#GetState|State]] must be 2-3.

=== SetStationAcceptPolicy ===
Takes an input [[#AcceptPolicy]], no output.

[[#GetState|State]] must be 2-3.

=== AddAcceptFilterEntry ===
Takes an input [[#MacAddress|MacAddress]], no output.

There are two sdknso funcs implementing this: one which takes a [[#MacAddress|MacAddress]] directly, the other loads the [[#MacAddress|MacAddress]] from the input [[#NodeInfo|NodeInfo]].

[[#GetState|State]] must be 2-3.

=== ClearAcceptFilter ===
No input/output.

[[#GetState|State]] must be 2-3.

=== OpenStation ===
No input/output.

[[#GetState|State]] must be 1, this cmd eventually sets the State to value 4.

=== CloseStation ===
No input/output.

[[#GetState|State]] must be 4-5, this cmd eventually sets the State to value 1.

=== Connect ===
Takes a type-0x19 input buffer containing a [[#NetworkInfo]], a [[#SecurityConfig]], an [[#UserConfig]], a s32 LocalCommunicationVersion, a [[#ConnectOption]], no output.

[[#GetState|State]] must be 4, this cmd eventually sets the State to value 5.

This is identical to [[#ConnectPrivate]] (besides the below), except the data internally passed for [[#SecurityParameter]]/[[#NetworkConfig]] are loaded from the input [[#NetworkInfo]].

This overwrites the u16 field at [[#SecurityConfig]]+0. When the cached [[SPL_services#IsDevelopment|IsDevelopment]] value is false (retail), value 1 is used, otherwise the used value is: original_field == 0 ? {u16 [[#NetworkInfo]]+0x60} : original_field.

u32 LocalCommunicationVersion>>15 must be 0.

=== ConnectPrivate ===
Takes a [[#SecurityConfig]], [[#SecurityParameter]], an [[#UserConfig]], a s32 LocalCommunicationVersion, a [[#ConnectOption]], a [[#NetworkConfig]], no output.

See [[#Connect]].

This overwrites the u16 field at [[#SecurityConfig]]+0. When the cached [[SPL_services#IsDevelopment|IsDevelopment]] value is false (retail), value 1 is used, otherwise the original value is used.

=== Disconnect ===
No input/output.

[[#GetState|State]] must be 5, this cmd eventually sets the State to value 4.

=== InitializeSystem ===
Takes an input PID and an u64 pid_placeholder.

This is used immediately after object creation.

With [7.0.0+] [[#InitializeSystem2]] is used instead.

=== FinalizeSystem ===
No input/output.

This is used during service exit, prior to closing the object. Official sw will Abort if this fails.

If State is set for it, this will run the equivalent of [[#CloseAccessPoint]]/[[#CloseStation]] when needed.

[[#GetState|State]] must be non-zero, this cmd eventually sets the State to value 0.

=== SetOperationMode ===
Takes an input [[#OperationMode]], no output.

[[#GetState|State]] must be 1.

The input value is written into state.

=== InitializeSystem2 ===
Takes an input PID, an u32, and an u64 pid_placeholder.

Official sw uses hard-coded value 0x1 for the u32.

The input u32 is ignored, the impl for this cmd is identical to [[#InitializeSystem]].

Internally this calls a func with params: (..., PID, &{u16 value 0x38}). On success, this then calls another func (which sets two state fields to the input) with params: (state, 0) (these state fields are used during [[#Authentication]] to check which service is being used).

The first func uses various [[Network_Interface_services|nifm]] funcs. The input value is used to determine the value for [[Network_Interface_services#CreateRequest|nn::nifm::RequestParameters]]: essentially, value 0x4 is used for ldn:u, and value 0x8 is used for ldn:s. The input value is also copied into state.

[[#GetState|State]] must be 0, this cmd eventually sets the State to value 1.

= ldn:u =
This is "nn::ldn::detail::IUserServiceCreator".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#CreateUserLocalCommunicationService]]
|}

== CreateUserLocalCommunicationService==
Returns an [[#IUserLocalCommunicationService]].

The user-process closes the IUserServiceCreator object immediately after using this cmd. Official sw ignores errors from this cmd.

== IUserLocalCommunicationService ==
This is "nn::ldn::detail::IUserLocalCommunicationService".

This is identical to [[#ISystemLocalCommunicationService]], except for the System-only cmd(s), and [[#Initialize]]/[[#Initialize2]] differ.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#GetState]]
|-
| 1 || [[#GetNetworkInfo]]
|-
| 2 || [[#GetIpv4Address]]
|-
| 3 || [[#GetDisconnectReason]]
|-
| 4 || [[#GetSecurityParameter]]
|-
| 5 || [[#GetNetworkConfig]]
|-
| 100 || [[#AttachStateChangeEvent]]
|-
| 101 || [[#GetNetworkInfoLatestUpdate]]
|-
| 102 || [[#Scan]]
|-
| 103 || [[#ScanPrivate]]
|-
| 104 || [5.0.0+] [[#SetWirelessControllerRestriction]]
|-
| 200 || [[#OpenAccessPoint]]
|-
| 201 || [[#CloseAccessPoint]]
|-
| 202 || [[#CreateNetwork]]
|-
| 203 || [[#CreateNetworkPrivate]]
|-
| 204 || [[#DestroyNetwork]]
|-
| 205 || [[#Reject]]
|-
| 206 || [[#SetAdvertiseData]]
|-
| 207 || [[#SetStationAcceptPolicy]]
|-
| 208 || [[#AddAcceptFilterEntry]]
|-
| 209 || [[#ClearAcceptFilter]]
|-
| 300 || [[#OpenStation]]
|-
| 301 || [[#CloseStation]]
|-
| 302 || [[#Connect]]
|-
| 303 || [[#ConnectPrivate]]
|-
| 304 || [[#Disconnect]]
|-
| 400 || [[#Initialize]]
|-
| 401 || [[#Finalize]]
|-
| 402 || [7.0.0+] [[#Initialize2]]
|}

=== Initialize ===
Takes an input PID and an u64 pid_placeholder.

This is used immediately after object creation.

With [7.0.0+] [[#Initialize2]] is used instead.

This is identical to [[#InitializeSystem]] except different params are used for the funcs called internally.

=== Finalize ===
No input/output.

This is used during service exit, prior to closing the object. Official sw will Abort if this fails.

This is identical to [[#FinalizeSystem]].

=== Initialize2 ===
Takes an input PID, an u32, and an u64 pid_placeholder.

Official sw uses hard-coded value 0x1 for the u32.

The input u32 is ignored, the impl for this cmd is identical to [[#Initialize]].

This is identical to [[#InitializeSystem2]] except different params are used for the funcs called internally: the u16 value is 0x5A, and the value for the second func is 1.

= ndd =
This is "nn::ndd::IService".

This was added with [5.0.0] and removed with [6.0.0].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || EnableAutoCommunication
|-
| 1 || DisableAutoCommunication
|-
| 2 || IsAutoCommunicationEnabled
|-
| 3 || EnablePowerSave
|-
| 4 || DisablePowerSave
|-
| 5 || IsPowerSaveEnabled
|-
| 6 || IsNetworkActive
|-
| 7 || AcquireSendDataUpdateEvent
|-
| 8 || AddSendData
|-
| 9 || ClearSendData
|-
| 10 || GetSendData
|-
| 11 || AcquireReceiveDataEvent
|-
| 12 || GetCurrentReceiveDataCounter
|-
| 13 || GetOldestReceiveDataCounter
|-
| 14 || GetNextReceiveDataCounter
|-
| 15 || GetAvailableReceiveDataCount
|-
| 16 || GetRecentReceiveDataCounter
|-
| 17 || GetReceiveData
|-
| 18 || AddReceiveData
|-
| 19 || ClearReceiveData
|-
| 20 || ClearDataIdFilter
|-
| 21 || AcquireDeviceScanEvent
|-
| 22 || StartDeviceScan
|-
| 23 || CancelDeviceScan
|-
| 24 || GetDeviceScanResult
|}

= lp2p:app, lp2p:sys =
These are "nn::lp2p::detail::INetworkServiceCreator".

These were added with [9.0.0+].

lp2p:app is used by [[Mario Kart Live: Home Circuit]]. lp2p:sys is used by [[Album_Applet|LibraryAppletPhotoViewer]] with [11.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#CreateNetworkService]]
|-
| 8 || [[#CreateNetworkServiceMonitor]]
|}

== CreateNetworkService ==
Takes an input u32, an u64 pid_reserved, a PID, returns an output [[#INetworkService]].

The input u32 must be value 0x1.

== CreateNetworkServiceMonitor ==
Takes an input u64 pid_reserved, a PID, returns an output [[#INetworkServiceMonitor]].

== INetworkService ==
This is "nn::lp2p::detail::INetworkService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Initialize|Initialize]]
|-
| [9.0.0-9.0.1] 256 || [[#AttachNetworkInterfaceStateChangeEvent]]
|-
| [9.0.0-9.0.1] 264 || [[#GetNetworkInterfaceLastError]]
|-
| [9.0.0-9.0.1] 272 || [[#GetRole]]
|-
| [9.0.0-9.0.1] 280 || [[#GetAdvertiseData]]
|-
| [9.0.0-9.0.1] 288 || [[#GetGroupInfo]]
|-
| [9.0.0-9.0.1] 296 || [[#Join]]
|-
| [9.0.0-9.0.1] 304 || [[#GetGroupOwner]]
|-
| [9.0.0-9.0.1] 312 || [[#GetIpConfig]]
|-
| [9.0.0-9.0.1] 320 || [[#Leave]]
|-
| 512 || [[#Scan]]
|-
| 768 || [[#CreateGroup]]
|-
| 776 || [[#DestroyGroup]]
|-
| 784 || [[#SetAdvertiseData]]
|-
| 1536 || [[#SendToOtherGroup]]
|-
| 1544 || [[#RecvFromOtherGroup]]
|-
| 1552 || [[#AddAcceptableGroupId]]
|-
| 1560 || [9.1.0+] [[#RemoveAcceptableGroupId]]
|}

=== Initialize ===
No input/output.

Returns 0.

Unused by official sw.

=== Scan ===
Takes a type-0x19 input buffer containing a [[#GroupInfo]], a type-0x22 output buffer containing an array of [[#ScanResult]], returns an output s32 total_out.

=== CreateGroup ===
Takes a type-0x31 input buffer containing a [[#GroupInfo]], no output.

[[Mario Kart Live: Home Circuit|mklive]] uses the following string with this: "Failed to create a group: %08X".

The [[#GetRole|role]] must be 0. This eventually sets the [[#GetRole|role]] to value 1.

=== DestroyGroup ===
No input/output.

This destroys the previously [[#CreateGroup|created]] group. If no group was previously created ([[#GetRole|role]] is not 1), this just returns 0.

=== SetAdvertiseData ===
Takes a type-0x21 input buffer, no output.

The buffer size must be <=0x80. The [[#GetRole|role]] must be <=1.

A string in [[Mario Kart Live: Home Circuit|mklive]] refers to the buffer data as "scan advertise data".

=== SendToOtherGroup ===
Takes an input [[#MacAddress_2|MacAddress]], a [[#GroupId]], a s16 frequency, a s16 channel, an u32 flags, a type-0x21 input buffer, no output.

The buffer size must be <=0x400.

The MacAddress must be non-zero. The s16s must be >=1.

Only bit0 is used from flags: clear = block until the data can be sent, set = return error when the data can't be sent.

A string in [[Mario Kart Live: Home Circuit|mklive]] refers to the buffer data as "Action frame".

The [[#GetRole|role]] must be non-zero. The error from [[#GetNetworkInterfaceLastError]] will be returned if it's set.

[11.0.0+] [[#GroupInfo]]+0x8A must be value 2, otherwise an error is returned.

This sends an Action frame to the specified [[#GroupId]], with the specified destination [[#MacAddress_2|MacAddress]] (can be a broadcast address).

The frequency param is the same as the [[#GroupInfo]]+0x84 field.

=== RecvFromOtherGroup ===
Takes an input u32 flags, a type-0x22 output buffer, returns a [[#MacAddress_2|MacAddress]], an u16, a s16, an u32 out_size, a s32.

The out_size is the original size used for copying to the output buffer, before it's clamped to the output-buffer size.

Only bit0 is used from flags: clear = block until data is available, set = return error when data is not available.

When data is not available, the error from [[#GetNetworkInterfaceLastError]] will be returned if it's set.

The [[#GetRole|role]] must be non-zero.

This receives an Action frame.

=== AddAcceptableGroupId ===
Takes an input [[#GroupId]], no output.

=== RemoveAcceptableGroupId ===
No input/output.

== INetworkServiceMonitor ==
This is "nn::lp2p::detail::INetworkServiceMonitor".

This interface has no commands, until [9.1.0+] which added actual commands.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Initialize_2|Initialize]]
|-
| 256 || [[#AttachNetworkInterfaceStateChangeEvent]]
|-
| 264 || [[#GetNetworkInterfaceLastError]]
|-
| 272 || [[#GetRole]]
|-
| 280 || [[#GetAdvertiseData]]
|-
| 281 || [[#GetAdvertiseData2]]
|-
| 288 || [[#GetGroupInfo]]
|-
| 296 || [[#Join]]
|-
| 304 || [[#GetGroupOwner]]
|-
| 312 || [[#GetIpConfig]]
|-
| 320 || [[#Leave]]
|-
| 328 || [[#AttachJoinEvent]]
|-
| 336 || [[#GetMembers]]
|}

=== Initialize ===
Returns 0.

Unused by official sw.

=== AttachNetworkInterfaceStateChangeEvent ===
No input, returns an output Event handle with EventClearMode=0.

=== GetNetworkInterfaceLastError ===
No input/output.

=== GetRole ===
No input, returns an output u8.

=== GetAdvertiseData ===
Takes a type-0x22 output buffer, returns 2 output u16s.

Validates that the [[#GetRole|role]] is value 2, then copies data from state into the output buffer. The first output u16 is the size used for the memcpy, the second u16 is the original size from state.

=== GetAdvertiseData2 ===
Takes a type-0x22 output buffer, returns 2 output u16s.

This is identical to [[#GetAdvertiseData]] except this doesn't run the role validation.

=== GetGroupInfo ===
Takes a type-0x32 output buffer containing a [[#GroupInfo]].

Validates that the [[#GetRole|role]] is non-zero, then copies the struct from state into the output buffer.

=== Join ===
Takes a type-0x32 output buffer containing a [[#GroupInfo]] and a type-0x31 input buffer containing a [[#GroupInfo]].

This runs the same code as [[#CreateGroup]] to generate the [[#GroupInfo]] for the input struct (which with [[#CreateGroup]] would be available with [[#GetGroupInfo]]). The input struct is the same as [[#CreateGroup]].

=== GetGroupOwner ===
No input, returns an output 0x80-bytes [[#NodeInfo_2|NodeInfo]].

Validates that the [[#GetRole|role]] is non-zero, then copies the data from state to output.

=== GetIpConfig ===
Takes a type-0x1A output buffer containing a 0x100-byte struct.

Validates that the [[#GetRole|role]] is non-zero, then copies the struct from state into the output buffer.

+0x20 is the <code>struct sockaddr</code> IP address, +0x40 is the <code>struct sockaddr</code> subnet-mask, +0x60 is the <code>struct sockaddr</code> gateway(?). The address for the last one is set to localhost.

=== Leave ===
No input, returns an output u32.

=== AttachJoinEvent ===
No input, returns an output Event handle with EventClearMode=0.

=== GetMembers ===
Takes a type-0x22 output buffer containing an array of [[#NodeInfo_2|NodeInfo]], returns an output s32 total_out.

Validates that the [[#GetRole|role]] is value 1. Then any entries from state which are available are copied into the output array buffer, if there's space available. A maximum of 8 entries can be returned.

A string in [[Mario Kart Live: Home Circuit|mklive]] refers to the array data as "connected members".

= lp2p:m =
This is "nn::lp2p::detail::IMonitorServiceCreator".

This was added with [9.1.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#CreateMonitorService]]
|}

== CreateMonitorService ==
Takes a PID, a total of 0x10-bytes of input, and returns an [[#IMonitorService]].

== IMonitorService ==
This is "nn::lp2p::detail::IMonitorService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Initialize_3|Initialize]]
|-
| 288 || [[#GetGroupInfo]]
|-
| 320 || [[#Leave]]
|}

=== Initialize ===
Returns 0.

= Ipv4Address =
This is "nn::ldn::Ipv4Address". This is a 0x4-byte struct with 4-byte alignment.

This is essentially the same as <code>struct in_addr</code>, except this is little-endian.

This is generally "169.254.XXX.{...}", where XXX is random per created network.

= SubnetMask =
This is "nn::ldn::SubnetMask". This is a 0x4-byte struct with 4-byte alignment.

This is essentially the same as <code>struct in_addr</code>, except this is little-endian.

= Ssid =
This is "nn::ldn::Ssid".

When converting a Ssid to a string, the loaded chars from the string must be in the range of 0x20-0x7F, otherwise the byte written to the string will be 0.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || Length excluding NUL-terminator, must be 0x1-0x20.
|-
| 0x1 || 0x21 || SSID string including NUL-terminator, str[{above length}] must be 0.
|}

= NetworkInfo =
This is "nn::ldn::NetworkInfo". This is a 0x480-byte struct. The data at +0x50 is another struct.

The fields listed as Reserved (besides the fields before +0x10) are cleared during the memset and are not written to again afterwards, with cmds which return NetworkInfo.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || LocalCommunicationId
|-
| 0x8 || 0x2 || Reserved
|-
| 0xA || 0x2 || Arbitrary user data which can be used for filtering with [[#ScanFilter]].
|-
| 0xC || 0x4 || Reserved
|-
| 0x10 || 0x10 || Last 0x10-bytes of [[#SecurityParameter]]. NetworkId which is used to generate/overwrite the [[#Ssid]]. With [[#Scan]]/[[#ScanPrivate]], this is only done after filtering when +0x4B is value 0x2. The converted Ssid is a 0x20-byte lowercase hex string version of the input NetworkId.
|-
| 0x20 || 0x6 || [[#MacAddress|MacAddress]]
|-
| 0x26 || 0x22 || [[#Ssid]]
|-
| 0x48 || 0x2 || s16 NetworkChannel
|-
| 0x4A || 0x1 || s8 LinkLevel
|-
| 0x4B || 0x1 || Set to hard-coded value 0x2 with output structs, except with [[#Scan]]/[[#ScanPrivate]] which can also set value 0x1 in certain cases. 0x1 = normal network without an [[#ActionFrame]], 0x2 = LDN network with a valid [[#ActionFrame]].
|-
| 0x4C || 0x4 || Padding
|-
| 0x50 || 0x10 || First 0x10-bytes of [[#SecurityParameter]].
|-
| 0x60 || 0x2 || Same as [[#SecurityConfig]]+0x0.
|-
| 0x62 || 0x1 || [[#AcceptPolicy]]
|-
| 0x63 || 0x1 || Only set with [[#Scan]]/[[#ScanPrivate]], when +0x4B is value 0x2. See [[#ActionFrame]].
|-
| 0x64 || 0x2 || Padding
|-
| 0x66 || 0x1 || Maximum participants, for the [[#NodeInfo|NodeInfo]] array.
|-
| 0x67 || 0x1 || ParticipantNum, number of set entries in the [[#NodeInfo|NodeInfo]] array. If +0x4B is not 0x2, ParticipantNum should be handled as if it's 0.
|-
| 0x68 || 0x200(0x40*8) || Array of [[#NodeInfo|NodeInfo]] with 8 entries, starting with the AccessPoint node.
|-
| 0x268 || 0x2 || Reserved
|-
| 0x26A || 0x2 || AdvertiseData size
|-
| 0x26C || 0x180 || AdvertiseData
|-
| 0x3EC || 0x8C || Reserved
|-
| 0x478 || 0x8 || [6.0.0+] Random AuthenticationId. Set to the output from [[ETicket_services|es]] cmd1501 during network creation.
|}

= ScanFilter =
This is "nn::ldn::ScanFilter". This is a 0x60-byte struct with 8-byte alignment.

sdknso copies the input ScanFilter to a tmp struct on stack, which is then used with the cmd.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || When enabled, this will be overwritten if it's -1. The data written for this is the first [[NACP_Format|LocalCommunicationId]] for the user-process loaded via [[Glue_services|arp:r]], if loading fails value 0 is written instead. During filtering if enabled, u8 [[#NetworkInfo]]+0x4B must match 0x2, and this ScanFilter field must match [[#NetworkInfo]]+0x0.
|-
| 0x8 || 0x2 || Padding
|-
| 0xA || 0x2 || During filtering if enabled, u8 [[#NetworkInfo]]+0x4B must match 0x2, and this ScanFilter field must match [[#NetworkInfo]]+0xA.
|-
| 0xC || 0x4 || Padding
|-
| 0x10 || 0x10 || During filtering if enabled, u8 [[#NetworkInfo]]+0x4B must match 0x2, and this ScanFilter data must match [[#NetworkInfo]]+0x10.
|-
| 0x20 || 0x4 || When enabled, must be <=0x3, and during filtering must match u8 [[#NetworkInfo]]+0x4B.
|-
| 0x24 || 0x6 || [[#MacAddress|MacAddress]]. Only copied with [[#ScanPrivate]]. During filtering if enabled, this must match [[#NetworkInfo]]+0x20.
|-
| 0x2A || 0x22 || [[#Ssid]]. During filtering if enabled, this must match [[#NetworkInfo]]+0x26 (the [[#Ssid]] there must be valid for this as well). The strings are compared, without verifying the length field in [[#Ssid]] matches.
|-
| 0x4C || 0x10 || Cleared to zero for the tmp struct.
|-
| 0x5C || 0x4 || Flags. Masked with 0x37 for [[#Scan]], with [[#ScanPrivate]] this is masked with 0x3F.
|}

Flags:

{| class="wikitable" border="1"
|-
! Bit
! Description
|-
| 0 || When set, enables using ScanFilter+0.
|-
| 1 || When set, enables using ScanFilter+0x10.
|-
| 2 || When set, enables using ScanFilter+0x20.
|-
| 3 || When set, enables using the ScanFilter [[#MacAddress|MacAddress]].
|-
| 4 || When set, enables using the ScanFilter [[#Ssid]].
|-
| 5 || When set, enables using ScanFilter+0xA.
|}

= NetworkConfig =
This is "nn::ldn::NetworkConfig". This is a 0x20-byte struct with 8-byte alignment.

sdknso copies the input NetworkConfig to a tmp struct on stack, which is then used with the cmd ([[#CreateNetwork]], [[#CreateNetworkPrivate]], [[#ConnectPrivate]]).

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || LocalCommunicationId. Same as [[#NetworkInfo]]+0x0. [[#CreateNetwork]]/[[#CreateNetworkPrivate]]/[[#Connect]]/[[#ConnectPrivate]]: When -1, this is overwritten with the first [[NACP_Format|LocalCommunicationId]] for the user-process loaded via [[Glue_services|arp:r]], if loading fails value 0 is written instead. Otherwise when not -1, if control.nacp loading is successful with [[Glue_services|arp:r]], this field must match one of the LocalCommunicationIds from there otherwise an error is thrown.
|-
| 0x8 || 0x2 || Cleared to zero during the copy.
|-
| 0xA || 0x2 || Same as [[#NetworkInfo]]+0xA.
|-
| 0xC || 0x4 || Cleared to zero during the copy.
|-
| 0x10 || 0x2 || s16 Channel, can be zero. Same as [[#NetworkInfo]]+0x48.
|-
| 0x12 || 0x1 || s8. Same as [[#NetworkInfo]]+0x66. [[#CreateNetwork]]/[[#CreateNetworkPrivate]]: Must be 0x1-0x8.
|-
| 0x13 || 0x1 || Cleared to zero during the copy.
|-
| 0x14 || 0x2 || Same as [[#NetworkInfo]]+0x96 (LocalCommunicationVersion from the first [[#NodeInfo|NodeInfo]]). Must not be negative. [[#Connect]]/[[#ConnectPrivate]]: This must match the value for the AccessPoint LocalCommunicationVersion.
|-
| 0x16 || 0xA || Cleared to zero during the copy.
|}

= NodeLatestUpdate =
This is "nn::ldn::NodeLatestUpdate". This is a 0x8-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || The field in state is reset to zero by [[#GetNetworkInfoLatestUpdate]] after loading it. Official apps checks whether this is non-zero.
|-
| 0x1 || 0x7 || Not initialized with [[#GetNetworkInfoLatestUpdate]].
|}

= WirelessControllerRestriction =
This is "nn::ldn::WirelessControllerRestriction". This is an u32 enum.

This is used to determine the value passed to [[BTM_services|btm]] SetWlanMode.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 ||
|-
| 1 || This is the default.
|}

= SecurityConfig =
This is "nn::ldn::SecurityConfig". This is a 0x44-byte struct with 2-byte alignment.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x2 || Type, a default of value 1 can be used here. Overwritten by [[#CreateNetwork]]/[[#CreateNetworkPrivate]] and [[#Connect]]/[[#ConnectPrivate]]. The value used internally by these cmds must be 1-3.
|-
| 0x2 || 0x2 || Data size. Must be 0x10-0x40.
|-
| 0x4 || 0x40 || Data, used with key derivation.
|}

Type:
* 1-2: Broadcast Action frame data is encrypted and is verified with SHA256.
* 3: Broadcast Action frame data is plaintext and is verified with SHA256.

* 1: Data frames are encrypted.
* 2-3: Data frames for normal data-transfer are plaintext - the network is Open.

= SecurityParameter =
This is "nn::ldn::SecurityParameter". This is a 0x20-byte struct with 1-byte alignment.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x10 || Data, used with the same key derivation as [[#SecurityConfig]].
|-
| 0x10 || 0x10 || NetworkId, see [[#NetworkInfo]].
|}

= UserConfig =
This is "nn::ldn::UserConfig". This is a 0x30-byte struct with 1-byte alignment.

sdknso copies the input UserConfig to a tmp struct on stack, which is then used with the cmd.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x20 || NUL-terminated string for the user nickname.
|-
| 0x20 || 0x10 || Cleared to zero during the copy.
|}

= AddressEntry =
This is "nn::ldn::AddressEntry". This is a 0xC-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || [[#Ipv4Address]]
|-
| 0x4 || 0x6 || [[#MacAddress|MacAddress]]
|-
| 0xA || 0x2 || Padding
|}

= AcceptPolicy =
This is "nn::ldn::AcceptPolicy". This is an u8.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || Allow all.
|-
| 1 || Deny all.
|-
| 2 || Blacklist, addresses in the [[#AddAcceptFilterEntry|list]] are not allowed.
|-
| 3 || Whitelist, only addresses in the [[#AddAcceptFilterEntry|list]] are allowed.
|}

= MacAddress =
This is "nn::ldn::MacAddress". This is a 6-byte struct with 1-byte alignment.

= NodeInfo =
This is "nn::ldn::NodeInfo".

The fields listed as Reserved are cleared during the memset and are not written to again afterwards, with cmds which return [[#NetworkInfo]].

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || [[#Ipv4Address]]
|-
| 0x4 || 0x6 || [[#MacAddress|MacAddress]]
|-
| 0xA || 0x1 || s8 ID / index
|-
| 0xB || 0x1 || IsConnected
|-
| 0xC || 0x20 || First 0x20-bytes of [[#UserConfig]].
|-
| 0x2C || 0x2 || Reserved
|-
| 0x2E || 0x2 || s16 LocalCommunicationVersion
|-
| 0x30 || 0x10 || Reserved
|}

= ConnectOption =
This is "nn::ldn::ConnectOption". This is an u32 bitmask.

There's two versions of the sdknso funcs for [[#Connect]]/[[#ConnectPrivate]]: the version where the ConnectOption isn't user-specified uses a default value of 0x1 for it, with the same ShowError code without the bit0 check.

When bit0 here is set after using the above cmds, the sdknso funcs will use [[Error_Applet|ShowError]] with the returned Result if: (rc & 0x3FE1FF) == 0xE0CB.

This must be <=0x1, besides this validation ConnectOption is ignored by [[#Connect]]/[[#ConnectPrivate]].

= OperationMode =
This is "nn::ldn::OperationMode". This is an u32 enum.

This controls bit1 in the value passed to [[WLAN_services|wlan:lcl]] cmd0/cmd1: bit1 = OperationMode==1.

Value 1 seems to affect power (?) related fields in the beacon tags?

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || This is the default.
|-
| 1 ||
|}

= MacAddress =
This is "nn::lp2p::MacAddress". Same as [[#MacAddress|MacAddress]].

= GroupId =
This is "nn::lp2p::GroupId". This is a 6-byte struct with 1-byte alignment.

This is a WiFi BSSID.

= NodeInfo =
This is "nn::lp2p::NodeInfo". This is a 0x80-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || || <code>struct sockaddr</code> for the IP address.
|-
| 0x24 || 0x6 || [[#MacAddress_2|MacAddress]]
|}

= GroupInfo =
This is "nn::lp2p::GroupInfo". This is a 0x200-byte struct.

[[Mario Kart Live: Home Circuit|mklive]] sets the SSID to a string generated from random data.

[[#Scan_2|Scan]] only uses the following fields for the cmd input struct: SupportedPlatform/Priority, Frequency/Channel, and PresharedKeyBinarySize/PresharedKey.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x10 || Wrapped master key. When zero, set to randomly-generated data. This is decrypted with a "static AES key" and used to derive the 4 encryption keys for the session.
|-
| 0x10 || 0x8 || LocalCommunicationId. When zero, the value from control.nacp is loaded. This is later validated by [[#Join]]/[[#CreateGroup]] the same way as the [[#NetworkConfig]] field. Used during key derivation to derive keys B and D.
|-
| 0x18 || 0x6 || [[#GroupId]] ("GROUP ID (BSSID)"). When zero, the default is used. The default should be used here: an error is thrown if the data here doesn't match the output from [[WLAN_services|wlan:lcl]] cmd2.
|-
| 0x1E || 0x21 || ServiceName ("GROUP NAME (SSID)"). NUL-terminated string. See below.
|-
| 0x3F || 0x1 || s8 Flags count. Must be <=0x3F.
|-
| 0x40 || 0x40 || Array of s8 with the above count. Each entry value must be <=0x3F. Each entry is an array index used to load a set of flags from a global array with the specified index. global_flags are also masked with flags loaded from here. User-processes use entryval=1 as the default, with [11.0.0+] entryval=0 can be used for standard WPA2-PSK (see +0x8A).
|-
| 0x80 || 0x1 || SupportedPlatform. Must match value 1. 0 is PlatformIdNX, 1 is PlatformIdFuji.
|-
| 0x81 || 0x1 || MemberCountMax. s8, Must be <=0x8. During group creation this is passed to [[WLAN_services|wlan:lcl]] cmd40, when this is value 0 a default of value 1 is passed. During group-creation when the below +0x88 field is not value 0x2, the passed [[BTM_services#SetWlanMode|WlanMode]] is <code>x81_field_val > 3</code>.
|-
| 0x82 || 0x1 ||
|-
| 0x84 || 0x2 || Frequency. Wifi frequency: 24 = 2.4GHz, 50 = 5GHz.
|-
| 0x86 || 0x2 || s16 Channel ("CHANNEL"). Wifi channel number. 0 = use default, otherwise this must be one of the following depending on the frequency field:
* 24: 1, 6, 11.
* 50: 36, 40, 44, 48.
|-
| 0x88 || 0x1 || NetworkMode. Used during group-creation to determine the [[BTM_services#SetWlanMode|WlanMode]] to use. When this is value 0x2, mode=3 is used, otherwise it's determined via the +0x81 field.
|-
| 0x89 || 0x1 || PerformanceRequirement.
|-
| 0x8A || 0x1 || Security type, used during key derivation. 0 = use defaults, 1 = plaintext, 2 = encrypted. [11.0.0+] 3: Standard WPA2-PSK.
|-
| 0x8B || 0x1 || StaticAesKeyIndex. s8, used as the array-index for selecting the KeySource used with [[SPL_services#GenerateAesKek|GenerateAesKek]] during key derivation. Should be 1-2, otherwise GenerateAesKek is skipped and zeros are used for the AccessKey instead.
|-
| 0x8D || 0x1 || Priority. Must match one of the following, depending on the used service (doesn't apply to [[#Join]]): 55 = SystemPriority (lp2p:sys), 90 = ApplicationPriority (lp2p:app and lp2p:sys).
|-
| 0x8E || 0x1 || StealthEnabled. Bool flag, controls whether the SSID is hidden.
|-
| 0x8F || 0x1 || If zero, a default value of 0x20 is used.
|-
| 0x1C0 || 0x1 || PresharedKeyBinarySize. Must be 0x20 for PresharedKeyBinary. [11.0.0+] With WPA2-PSK, this must be value 1.
|-
| 0x1C1 || 0x3F ([9.0.0-10.2.0] 0x20) || PresharedKey. Used to derive encryption keys A and C. [11.0.0+] With WPA2-PSK, this is the passphrase string (length must be at least 8).
|}

In order for the ServiceName to be valid without a new one being generated, the following checks must pass:
* It loops through the characters in the string, looking for the first '_' character:
** The loop will exit once a '_' character is found.
** The character must be '-', or alphanumeric (lowercase/uppercase), otherwise the function will immediately return failure.
** The loop will also exit once string_pos is >19, in which case the function will also immediately return failure.
* Then it checks the 11 characters which follow the above:
** The character must be hex: '0'-'9', or 'A-F' / 'a-'f.
* The following character must be a NUL-terminator.
* The last hex character above, then the characters for the whole string prior to the last hex character are summed. return sum % 0x2B == 0. u32 is used for these calculations. (Return success when sum is a multiple of 0x2B, otherwise return failure)

If the above fails, then the following runs, otherwise it just returns 0:
* It loops through the characters in the string.
** The character must be '-', or alphanumeric (lowercase/uppercase), otherwise the function will immediately return failure.
** The loop will exit once string_pos>20 is reached, or when a NUL-terminator is reached.
* Once finished, success is returned if string_pos-1 is <20, otherwise failure is returned (which also immediately occurs if the first character is a NUL-terminator).

If the above fails, an error is returned, otherwise a new ServiceName is generated:
* Up to 20 characters are copied from the original ServiceName to the output ServiceName, stopping once the limit is reached or when a NUL-terminator is reached.
* '_' is appended to the string.
* <code>nn::util::TSNPrintf({strptr following the above character}, {remaining size}, "%02X%02X%02X%02X%02X", [[#GroupId|GroupId_byte3]], [[#GroupId|GroupId_byte4]], [[#GroupId|GroupId_byte5]], ([[SPL_services#IsDevelopment|IsDevelopment]] ? 0x80 : 0) | 0x1, 0);</code>
* Then the last character is set to the output from a calling a function:
** All string characters which were already written are summed same way as above. Then: <code>return character_lookup_table[sum % 0x2B];</code> (If the length passed to this function is 0, this will instead just return character_lookup_table[0])
*** character_lookup_table contains 0x2B entries: [V-A][k-a][5-0][Z-W].

loaded_flags are first loaded from elsewhere, then masked with the above flags when available. loaded_flags are used when +0x8A is 0. global_flags are loaded from global data. These flags are only used with [[#CreateGroup]]/[[#Join]]. Flags (note that the following was updated with [11.0.0+], and differs from below):
* Bit2 clear:
** global_flags must be non-zero, and loaded_flags bit1 must be set.
** u8 +0x8A is set to value 1.
** When the cached [[SPL_services#IsDevelopment|IsDevelopment]] value is false (retail), an error is thrown.
** u8 +0x8B is set to value 0.
* Otherwise, if bit2 is set:
** u8 +0x8A is set to value 2.
** global_flags bit1 set:
*** u8 +0x8B is set to value 1.
** Otherwise, if global_flags bit2 is set:
*** u8 +0x8B is set to value 2.

= ScanResult =
This is "nn::lp2p::ScanResult". This is a 0x300-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x200 || [[#GroupInfo]]
|-
| 0x200 || 0x1 ||
|-
| 0x206 || 0x2 || AdvertiseData size.
|-
| 0x208 || 0x80 || AdvertiseData
|}

= Network protocol =
== ldn ==
A beacon and Action frame are broadcasted. The SSID in the beacon is hidden (32-bytes with value 0). For [[#Scan]]/[[#ScanPrivate]] it doesn't matter if no beacon is available ([[#NetworkInfo]] is the same), as long as the Action frame is broadcasted. However, the Station will not send a probe-request during connection if no beacon is available (and therefore not attempt any communication with the AccessPoint). The beacon doesn't have any custom Nintendo data, that data is in the Acton frame.

During connection, the Station first sends a probe-request using the [[#NetworkInfo|generated]] SSID from the Action frame. If the probe-response contains the expected data for the [[#SecurityConfig]] type, the Station then proceeds to connect to the AccessPoint. The key for data-frames, if [[#SecurityConfig|enabled]], is derived from a buffer containing: {[[#SecurityParameter]]+0x0} followed by {[[#SecurityConfig]] data with the specified data-size}. The [[#ActionFrame]]/data-frame keys are derived with the same func, the only difference is the input passed to this func + the passed constant data. The key derived by ldn is used directly as the static CCMP key for all data-frames (CCMP / MIC is standard).

Then the Station scans for an [[#ActionFrame]] for loading the [[#NetworkInfo]].

Once connected, the AccessPoint sends Epigram-vendor Action frame(s) (same data) to the Station, the Station doesn't require these frames: <code>dd1afeedfacedeadbeef010000000a00000000000000000000000000</code>. Then the Station must Authenticate with the AccessPoint, this is custom. The Station sends a frame (a maximum of 3 times in some cases if errors occur, with the same data), and the AccessPoint sends a response. Once Authenticated, the node is added to the [[#NodeInfo|NodeInfo]] array in [[#NetworkInfo]]. If the Station does not successfully Authenticate X-seconds after connecting, the AccessPoint disconnects the Station. If the Station fails to Authenticate, the Station itself will disconnect as well.

After Authentication the Station will scan for another [[#ActionFrame]], with frame-comparision enabled with the above frame (frame must have been updated since the previous scan). The Station locates the index for a [[#MacAddress|MacAddress]] matching itself in the [[#NetworkInfo]] [[#NodeInfo|NodeInfo]] array (the entry for the AccessPoint is skipped), throwing an error if not found. After validating the LocalCommunicationVersion, it proceeds to handle ARP setup below.

This does not use DHCP, each node on the network has to manually setup ARP (without sending ARP network requests) with the [[#NodeInfo|NodeInfo]] array in [[#NetworkInfo]].

At this point standard sockets can be used over Data frames.

=== EthFrame ===
The custom Ethernet frames have the following structure:
* "Type: IEEE 802a OUI Extended Ethertype (0x88b7)"
* "IEEE802a OUI Extended Ethertype":
** "Organization Code: 00:22:aa (Nintendo Co., Ltd.)"
** "Protocol ID: {...}"
*** Depends on the frame:
*** 0x0102: [[#Authentication]]
*** 0x0103: ?
* The first byte of Data is value 0, then the ProtocolID-specific data follows, see below.
** ProtocolID 0x0103 frames are sent by the AccessPoint to the Station. This is 0x20-bytes of zeros, except for the first byte which is 0x3. This is sent by the AccessPoint prior to destroying the network.

==== Authentication ====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || [[#AuthVersion]]
|-
| 0x1 || 0x1 || Low u8 for the size.
|-
| 0x2 || 0x1 || Status. 0 = success, non-zero = error.
|-
| 0x3 || 0x1 || [2.0.0+] bool flag. The AccessPoint verifies that this is not set. Always set to 1 by the AccessPoint in the response. The Station only uses this when the [[#AuthVersion]] is >=2.
|-
| 0x4 || 0x1 || [6.0.0+] High u8 for the size.
|-
| 0x5 || 0x3 || Unused, zeros.
|-
| 0x8 || 0x20 || [[#NetworkInfo]]+0, must match the corresponding data in [[#NetworkInfo]] when the receiving node verifies this. With the
AccessPoint->Station frame, the Station verifies that this matches the data previously sent to the AccessPoint.
|-
| 0x28 || 0x10 || [[#NetworkInfo]]+0x50, must match the corresponding data in [[#NetworkInfo]] when the receiving node verifies this. With the
AccessPoint->Station frame, the Station verifies that this matches the data previously sent to the AccessPoint.
|-
| 0x38 || 0x10 || See below.
|-
| 0x48 || || Frame-specific data, with the above size. The total frame size - {offset of the start of this data in the frame} must match the above size.
|}

The Station sets the above size to 0x40 ([6.0.0+] if [[#NetworkInfo]]+0x13 is <3). [6.0.0+] The Authentication challenge is only used/enabled if that value is >=3, and [[#IUserLocalCommunicationService]] is being used.

The AccessPoint sets the above size to 0x40 ([6.0.0+] 0x0 if the +0x0 [[#AuthVersion]] is <3). [6.0.0+] The AccessPoint will only use/enable the Authentication challenge when the +0x0 [[#AuthVersion]] is >=3, and [[#IUserLocalCommunicationService]] is being used. This data will not be included in the frame if the status field indicates error.

[6.0.0+] Support for the Authentication challenge with [[ETicket_services|es]] cmds 1501-1504 was added.

Station->AccessPoint frame, relative to +0x0 above (frame size depends on whether +0xAC is enabled):

The AccessPoint will not respond to frames where the source mac-address is unrecognized.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x38 || 0x10 || The Station sets this to random data. Unused by the AccessPoint, except for copying into the response.
|-
| 0x48 || 0x20 || [[#UserConfig]]+0. Copied into state by the AccessPoint.
|-
| 0x68 || 0x2 || Big-endian LocalCommunicationVersion. Byte-swapped by the AccessPoint then copied into state.
|-
| 0x6A || 0x1E || Zeros, unused by the AccessPoint.
|-
| 0x88 || 0x24 || [6.0.0+] Zeros, unused by the AccessPoint.
|-
| 0xAC || 0x300 || [6.0.0+] Authentication challenge data. If enabled, the total frame size must be >= {end offset of this data in the frame}. The frame data does not include this if it's not enabled.
|}

AccessPoint->Station response frame, relative to +0x0 above (frame size depends on whether +0x48/+0xCC are enabled):

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x38 || 0x10 || +0x38 from the data originally sent by the Station. The Station verifies that this matches the previously sent data.
|-
| 0x48 || 0x40 || Zeros. [6.0.0+] Only included in the frame if it's enabled (+0x0 [[#AuthVersion]] >= 3). Unused by the Station.
|-
| 0x88 || 0x44 || [6.0.0+] Only included in the frame if it's enabled (+0x0 [[#AuthVersion]] >= 3). Unused by the Station.
|-
| 0xCC || 0x100 || [6.0.0+] If enabled, Authentication challenge response data. Not included in the frame if it's not enabled.
|}

===== AuthVersion =====
Must be 0x1-0xF.

{| class="wikitable" border="1"
|-
! Value || SystemVersion
|-
| 1 || [1.0.0+]
|-
| 2 || [2.0.0+]
|-
| 3 || [6.0.0+]
|}

=== ActionFrame ===
The Action frames have the following structure:
* "Fixed parameters":
** "Category code: Vendor Specific (127)"
** "OUI: 00:22:aa (Nintendo Co., Ltd.)"
* The Data starts with the following header:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x2 || 04 00 in sent frames.
|-
| 0x2 || 0x2 || Protocol ID, must be 0x0101.
|-
| 0x4 || 0x2 || Must be 0.
|-
| 0x6 || 0x2 || Zeros, unused.
|}

Then the actual data follows:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x20 || [[#NetworkInfo]]+0x0. The u64/u16 are big-endian. Outside of [[#Scan]]/[[#ScanPrivate]], this must match the previously loaded data for this.
|-
| 0x20 || 0x1 || [[#AuthVersion]]. Copied to [[#NetworkInfo]]+0x63. When comparing with a previous frame is enabled, this must match the value from the previous frame.
|-
| 0x21 || 0x1 || Encryption type: 1 = plaintext, 2 = encrypted, {frames with other values are ignored by [[#Scan]]/[[#ScanPrivate]]}. Must match the type which is currently being used: with [[#Scan]]/[[#ScanPrivate]] this is determined via this field, otherwise [[#SecurityConfig]] is used to determine this.
|-
| 0x22 || 0x2 || Big-endian u16 size for the data starting at +0x48, must be <=0x500, and must match {total frame size relative to +0x0 above} + 0x48.
|-
| 0x24 || 0x4 || Big-endian u32 Counter. The initial value is randomly-generated. This is incremented each time the below content is updated (including initial creation). Also used by the Station to determine whether the frame changed compared to a previous one. When comparing against a previous frame, new_counter-prev_counter must be <= 0xFF, and the counters must not match.
|-
| 0x28 || 0x20 || SHA256 hash over the entire frame starting at +0x0, with the above size + 0x48. During hashing, this hash is cleared, with the new hash overwriting the original in memory (the original is copied to stack for comparing).
|}

When encryption is enabled, the encrypted data is +0x28 with size {remaining frame size}. This is encrypted with AES-128-CTR. The key is derived from the raw 0x20-bytes at +0x0. The CTR is {raw Counter above without byte-swap}, with the rest cleared to zeros.

The content data at +0x48 follows, which has the size specified above (which must be >=0x500), where all fields are big-endian:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x10 || [[#NetworkInfo]]+0x50
|-
| 0x10 || 0x2 || [[#NetworkInfo]]+0x60
|-
| 0x12 || 0x1 || [[#NetworkInfo]]+0x62
|-
| 0x13 || 0x3 || Unused
|-
| 0x16 || 0x1 || s8 [[#NetworkInfo]]+0x66, clamped to range 1-8.
|-
| 0x17 || 0x1 || s8 [[#NetworkInfo]]+0x67, clamped to range 1-8.
|-
| 0x18 || 0x1C0(0x38*8) || Array of the below node struct.
|-
| 0x1D8 || 0x2 || Unused
|-
| 0x1DA || 0x2 || [[#NetworkInfo]]+0x26A
|-
| 0x1DC || 0x180 || [[#NetworkInfo]]+0x26C
|-
| 0x35C || 0x19C || Unused
|-
| 0x4F8 || 0x8 || [6.0.0+] [[#NetworkInfo]]+0x478
|}

The data here is copied into [[#NetworkInfo]].

Node data used in the above array (all fields big-endian), which are copied into the [[#NetworkInfo]] [[#NodeInfo|NodeInfo]] array:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || [[#Ipv4Address]]
|-
| 0x4 || 0x6 || [[#MacAddress|MacAddress]]
|-
| 0xA || 0x1 || bool IsConnected
|-
| 0xB || 0x1 || Unused
|-
| 0xC || 0x20 || First 0x20-bytes of [[#UserConfig]].
|-
| 0x2C || 0x2 || s16 LocalCommunicationVersion
|-
| 0x2E || 0xA || Unused
|}

== lp2p ==
This is used for communicating with accessories (external devices on [11.0.0+]) over local wifi. [[Mario Kart Live: Home Circuit]] uses this. [11.0.0+] [[Album_Applet|LibraryAppletPhotoViewer]] uses this.

A beacon is broadcasted.

Action frames are only sent when done so by [[#SendToOtherGroup]] (other than the Epigram one mentioned below).

Communication uses sockets with standard Data frames and the above Action frames. Switch consoles presumably only use the Action frames to communicate with each other?

Key A derived by ldn-sysmodule is used directly as the static CCMP key for all data-frames (CCMP / MIC is standard). However, with [[#GroupInfo]]+0x8A value 3, standard WPA2-PSK is used instead.

This uses infrastructure-mode (AccessPoint), and DHCP is used. The group-owner is the AccessPoint. Note that the probe response includes the same Nintendo tags included with the beacon. Once connected, the group-owner sends the same Epigram-vendor Action frame(s) described in [[#ldn]]. At this point socket communication can begin, including DHCP usage.

The DHCP server thread is started by the "nn.lp2p.StateMachine" thread eventually during group [[#CreateGroup|creation]]. The DHCP Offer option values are the following:
* "Subnet Mask: 255.255.255.0"
* "DHCP Server Identifier: {...}"
* "Broadcast Address: {...}"
* "IP Address Lease Time: (5s) 5 seconds"
* "Renewal Time Value: (0s) 0 seconds"
* "Rebinding Time Value: (0s) 0 seconds"
* "Interface MTU: 1500"

Note that the above options doesn't include "Domain Name Server" or "Router", the client device may fail to connect if it doesn't allow those DHCP options to be missing.

=== Beacon ===
The SSID in the beacon can optionally be [[#GroupInfo|hidden]] (all-zero with the same length as the original SSID). The beacon contains two vendor-specific Nintendo information elements with OUI <code>00:22:aa</code>; each IE has a 2-byte ID following the OUI. These Nintendo IEs are not used when standard WPA2-PSK is being used.

The beacon is identical to ldn, except for the following (besides SSID length difference and the lp2p-only Nintendo tags):
* "Tag: Traffic Indication Map (TIM)": "DTIM count" for lp2p is 1, with ldn it's 0.
* "Tag: HT Capabilities (802.11n D1.10)": "HT Short GI for 20MHz" is set to "Not supported", for ldn it's "Supported".
* "Tag: Vendor Specific: Microsoft Corp.: WMM/WME: Parameter Element" "Ac Parameters ACI 0": "CW Min: 15" for lp2p, "CW Min: 63" for ldn.

Note that during group creation the beacon may be missing the Nintendo IEs in some cases, since group creation didn't finish yet.

==== Nintendo IE 0 ====

The first Nintendo IE (ID 0x0600) contains the following fixed parameters:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || Fixed 0x20; perhaps a version or other magic number.
|-
| 0x1 || 0x1 || [[#GroupInfo|SecurityType]]
|-
| 0x2 || 0x1 || [[#GroupInfo|StaticAesKeyIndex]]
|-
| 0x3 || 0x1 || Fixed zero; padding byte.
|-
| 0x4 || 0x8 || Big-endian (i.e. byte-reversed) version of [[#GroupInfo|LocalCommunicationId]]. This is the only context where LocalCommunicationId is reversed.
|-
| 0xC || 0x10 || Wrapped master key. Same as [[#GroupInfo]]+0x0.
|-
| 0x1C || 0x4 || If encryption is enabled, a randomly-generated nonce, else nothing. Appending 8 zero bytes to this yields the AES-GCM IV.
|-
| 0x20 || 0x10 || If encryption is enabled, the AES-GCM MAC tag, else nothing. All bytes prior to this (fixed 0x20 through nonce) are the additional authenticated data. All bytes after this are encrypted with key B.
|}

After this, TLV tagged parameters occur. Each TLV tag is formatted as:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || Tag type
|-
| 0x1 || 0x1 || Length
|-
| 0x2 || {above size} || Data for the tag
|}

Known TLV tags:

{| class="wikitable" border="1"
|-
! Type
! Size
! Description
|-
| 0x1 || 0x2 || Additional network parameters: 0xAB 0xCD. A=[[#GroupInfo]]+0x82, B=[[#GroupInfo|MemberCountMax]], C=[[#GroupInfo|NetworkMode]], D=[[#GroupInfo|PerformanceRequirement]].
|-
| 0x2 || 0x8 || Flags: Bitwise-or of (1<<f) for each entry in [[#GroupInfo]]+0x40
|}

==== Nintendo IE 1 ====

The second Nintendo IE (ID 0x0601) contains only TLVs. If encryption is enabled, a 0x4-byte nonce and 0x10-byte AES-GCM tag are written first, as above, and the TLVs are encrypted. Key C is used.

Known TLV tags:

{| class="wikitable" border="1"
|-
! Type
! Size
! Description
|-
| 0x21 || Varies || AdvertiseData
|}

=== ActionFrame ===
The Action frames have the following structure:
* "Fixed parameters":
** "Category code: Vendor Specific (127)"
** "OUI: 00:22:aa (Nintendo Co., Ltd.)"
* The Data starts with the following:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x2 || Usually 06 00?
|-
| 0x2 || 0x2 || Usually 20 02?(Second byte depends on whether encryption is used?)
|-
| 0x4 || 0x2 || Usually 02 00?(varies)
|-
| 0x6 || 0x8 || Big-endian version of [[#GroupInfo]]+0x10.
|-
| 0xE || 0x10 || Same as [[#GroupInfo]]+0x0.
|}

When encryption is used, the remaining data is:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || Big-endian u32 Counter. The initial value is randomly-generated (?). This is incremented with each sent Action frame.
|-
| 0x4 || {remaining size} || Encrypted user-data. Also includes 0x10-bytes of unknown data.
|}

When plaintext is used, the remaining data is:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || {remaining size} || Plaintext user-data.
|}

[[Category:Services]]

LDN services

2021-01-29T19:27:23Z

CFSworks: /* GroupInfo */ GroupInfo+0x0 is some kind of wrapped "master" key - maybe a word other than "master" is good for this?

LDN handles all local network communication.

= ldn:m =
This is "nn::ldn::detail::IMonitorServiceCreator".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#CreateMonitorService]]
|}

== CreateMonitorService ==
Returns an [[#IMonitorService]].

The user-process closes the IMonitorServiceCreator object immediately after using this cmd.

== IMonitorService ==
This is "nn::ldn::detail::IMonitorService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#GetStateForMonitor]]
|-
| 1 || [[#GetNetworkInfoForMonitor]]
|-
| 2 || [[#GetIpv4AddressForMonitor]]
|-
| 3 || [[#GetDisconnectReasonForMonitor]]
|-
| 4 || [[#GetSecurityParameterForMonitor]]
|-
| 5 || [[#GetNetworkConfigForMonitor]]
|-
| 100 || [[#InitializeMonitor]]
|-
| 101 || [[#FinalizeMonitor]]
|}

=== GetStateForMonitor ===
No input, returns an output u32.

sdknso implements this by <code>return</code>ing the u32, with 0 being returned on error.

=== GetNetworkInfoForMonitor ===
Takes a type-0x1A output buffer containing a [[#NetworkInfo]].

=== GetIpv4AddressForMonitor ===
No input, returns an output [[#Ipv4Address]] and a [[#SubnetMask]].

=== GetDisconnectReasonForMonitor ===
No input, returns an output s16.

This is not exposed by sdknso.

This just returns 0.

=== GetSecurityParameterForMonitor ===
No input, returns an output [[#SecurityParameter]].

This is not exposed by sdknso.

=== GetNetworkConfigForMonitor ===
No input, returns an output [[#NetworkConfig]].

This is not exposed by sdknso.

=== InitializeMonitor ===
No input/output.

This is used immediately after object creation. Official sw will Abort if this fails.

This just returns 0.

=== FinalizeMonitor ===
No input/output.

This is used during service exit, prior to closing the object. Official sw will Abort if this fails.

This just returns 0.

= ldn:s =
This is "nn::ldn::detail::ISystemServiceCreator".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#CreateSystemLocalCommunicationService]]
|}

== CreateSystemLocalCommunicationService ==
Returns an [[#ISystemLocalCommunicationService]].

The user-process closes the ISystemServiceCreator object immediately after using this cmd. Official sw ignores errors from this cmd.

== ISystemLocalCommunicationService ==
This is "nn::ldn::detail::ISystemLocalCommunicationService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#GetState]]
|-
| 1 || [[#GetNetworkInfo]]
|-
| 2 || [[#GetIpv4Address]]
|-
| 3 || [[#GetDisconnectReason]]
|-
| 4 || [[#GetSecurityParameter]]
|-
| 5 || [[#GetNetworkConfig]]
|-
| 100 || [[#AttachStateChangeEvent]]
|-
| 101 || [[#GetNetworkInfoLatestUpdate]]
|-
| 102 || [[#Scan]]
|-
| 103 || [[#ScanPrivate]]
|-
| 104 || [5.0.0+] [[#SetWirelessControllerRestriction]]
|-
| 200 || [[#OpenAccessPoint]]
|-
| 201 || [[#CloseAccessPoint]]
|-
| 202 || [[#CreateNetwork]]
|-
| 203 || [[#CreateNetworkPrivate]]
|-
| 204 || [[#DestroyNetwork]]
|-
| 205 || [[#Reject]]
|-
| 206 || [[#SetAdvertiseData]]
|-
| 207 || [[#SetStationAcceptPolicy]]
|-
| 208 || [[#AddAcceptFilterEntry]]
|-
| 209 || [[#ClearAcceptFilter]]
|-
| 300 || [[#OpenStation]]
|-
| 301 || [[#CloseStation]]
|-
| 302 || [[#Connect]]
|-
| 303 || [[#ConnectPrivate]]
|-
| 304 || [[#Disconnect]]
|-
| 400 || [[#InitializeSystem]]
|-
| 401 || [[#FinalizeSystem]]
|-
| 402 || [4.0.0+] [[#SetOperationMode]]
|-
| 403 || [7.0.0+] [[#InitializeSystem2]]
|}

=== GetState ===
No input, returns an output u32.

sdknso implements this by <code>return</code>ing the u32, with 0 being returned on error / when service isn't initialized.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || None
|-
| 1 || Initialized
|-
| 2 || AccessPointOpened
|-
| 3 || AccessPointCreated
|-
| 4 || StationOpened
|-
| 5 || StationConnected
|-
| 6 || Error
|-
|}

=== GetNetworkInfo ===
Takes a type-0x1A output buffer containing a [[#NetworkInfo]].

=== GetIpv4Address ===
No input, returns an output [[#Ipv4Address]] and a [[#SubnetMask]].

=== GetDisconnectReason ===
No input, returns an output s16.

sdknso implements this by <code>return</code>ing the s16 as a s32, with -1 being returned on error.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| -1 || See above.
|-
| 0 || None
|-
| 1 || User
|-
| 2 || SystemRequest
|-
| 3 || DestroyedByAdmin
|-
| 4 || DestroyedBySystemRequest
|-
| 5 || Admin
|-
| 6 || SignalLost
|}

=== GetSecurityParameter ===
No input, returns an output [[#SecurityParameter]].

=== GetNetworkConfig ===
No input, returns an output [[#NetworkConfig]].

=== AttachStateChangeEvent ===
No input, returns an output Event handle.

sdknso uses EventClearMode=1 with this. sdknso will Abort if this cmd fails.

This is signaled when the data returned by [[#GetNetworkInfo]]/[[#GetNetworkInfoLatestUpdate]] is updated.

=== GetNetworkInfoLatestUpdate ===
Takes a type-0x1A output buffer containing a [[#NetworkInfo]] and a type-0xA output buffer containing an array of [[#NodeLatestUpdate]].

The array count must be 8.

=== Scan ===
Takes a type-0x22 output buffer containing an array of [[#NetworkInfo]], a s16 channel, a [[#ScanFilter]], returns an output s16 total_out.

sdknso copies the output s16 to a s32, the value passed for the input s16 is from an user-specified s32 (user-apps generally use value 0 for this).

This is the same as [[#ScanPrivate]], except this also has the same channel-override functionality as [[#CreateNetwork]].

[[#GetState|State]] must be 3-5.

The array count must be at least 1. This is clamped to a maximum of 0x18.

=== ScanPrivate ===
Takes a type-0x22 output buffer containing an array of [[#NetworkInfo]], a s16 channel, a [[#ScanFilter]], returns an output s16 total_out.

sdknso copies the output s16 to a s32, the value passed for the input s16 is from an user-specified s32.

See [[#Scan]].

=== SetWirelessControllerRestriction ===
Takes an input [[#WirelessControllerRestriction]], no output.

[[#GetState|State]] must be 1.

The input value is written into state.

=== OpenAccessPoint ===
No input/output.

[[#GetState|State]] must be 1, this cmd eventually sets the State to value 2.

=== CloseAccessPoint ===
No input/output.

[[#GetState|State]] must be 2-3, this cmd eventually sets the State to value 1.

=== CreateNetwork ===
Takes an input [[#SecurityConfig]], an [[#UserConfig]], a [[#NetworkConfig]], no output.

This is the same as [[#CreateNetworkPrivate]], except the [[#AddressEntry]] params are 0, and the [[#SecurityParameter]] is generated from "nn::util::TinyMt::GenerateRandomBytes".

Unlike CreateNetworkPrivate, this overwrites the channel field in the [[#NetworkConfig]]. When the cached [[SPL_services#IsDevelopment|IsDevelopment]] value is true, the output from [[Settings_services|GetLdnChannel]] will overwrite that field if the s32 setting value is >=0, otherwise the original value is used. Otherwise when the IsDevelopment field is false (retail), the channel is overwritten with value 0.

This overwrites the u16 field at [[#SecurityConfig]]+0. When the cached [[SPL_services#IsDevelopment|IsDevelopment]] value is false (retail), value 1 is used, otherwise the original value is used.

[[#GetState|State]] must be 2, this cmd eventually sets the State to value 3.

=== CreateNetworkPrivate ===
Takes an input [[#SecurityConfig]], a [[#SecurityParameter]], an [[#UserConfig]], a [[#NetworkConfig]], a type-0x9 input buffer containing an array of [[#AddressEntry]], no output.

The buffer/count for [[#AddressEntry]] can be 0, in which case the network will be non-Private like [[#CreateNetwork]]. The count must be <=8.

See [[#CreateNetwork]].

=== DestroyNetwork ===
No input/output.

[[#GetState|State]] must be 3, this cmd eventually sets the State to value 2.

=== Reject ===
Takes an input [[#Ipv4Address]], no output.

[[#GetState|State]] must be 3.

=== SetAdvertiseData ===
Takes a type-0x21 input buffer, no output.

The input buffer contains arbitrary user data.

The buffer size must be <=0x180. An empty buffer (addr=NULL/size=0) can be used to reset the AdvertiseData size in state to zero.

[[#GetState|State]] must be 2-3.

=== SetStationAcceptPolicy ===
Takes an input [[#AcceptPolicy]], no output.

[[#GetState|State]] must be 2-3.

=== AddAcceptFilterEntry ===
Takes an input [[#MacAddress|MacAddress]], no output.

There are two sdknso funcs implementing this: one which takes a [[#MacAddress|MacAddress]] directly, the other loads the [[#MacAddress|MacAddress]] from the input [[#NodeInfo|NodeInfo]].

[[#GetState|State]] must be 2-3.

=== ClearAcceptFilter ===
No input/output.

[[#GetState|State]] must be 2-3.

=== OpenStation ===
No input/output.

[[#GetState|State]] must be 1, this cmd eventually sets the State to value 4.

=== CloseStation ===
No input/output.

[[#GetState|State]] must be 4-5, this cmd eventually sets the State to value 1.

=== Connect ===
Takes a type-0x19 input buffer containing a [[#NetworkInfo]], a [[#SecurityConfig]], an [[#UserConfig]], a s32 LocalCommunicationVersion, a [[#ConnectOption]], no output.

[[#GetState|State]] must be 4, this cmd eventually sets the State to value 5.

This is identical to [[#ConnectPrivate]] (besides the below), except the data internally passed for [[#SecurityParameter]]/[[#NetworkConfig]] are loaded from the input [[#NetworkInfo]].

This overwrites the u16 field at [[#SecurityConfig]]+0. When the cached [[SPL_services#IsDevelopment|IsDevelopment]] value is false (retail), value 1 is used, otherwise the used value is: original_field == 0 ? {u16 [[#NetworkInfo]]+0x60} : original_field.

u32 LocalCommunicationVersion>>15 must be 0.

=== ConnectPrivate ===
Takes a [[#SecurityConfig]], [[#SecurityParameter]], an [[#UserConfig]], a s32 LocalCommunicationVersion, a [[#ConnectOption]], a [[#NetworkConfig]], no output.

See [[#Connect]].

This overwrites the u16 field at [[#SecurityConfig]]+0. When the cached [[SPL_services#IsDevelopment|IsDevelopment]] value is false (retail), value 1 is used, otherwise the original value is used.

=== Disconnect ===
No input/output.

[[#GetState|State]] must be 5, this cmd eventually sets the State to value 4.

=== InitializeSystem ===
Takes an input PID and an u64 pid_placeholder.

This is used immediately after object creation.

With [7.0.0+] [[#InitializeSystem2]] is used instead.

=== FinalizeSystem ===
No input/output.

This is used during service exit, prior to closing the object. Official sw will Abort if this fails.

If State is set for it, this will run the equivalent of [[#CloseAccessPoint]]/[[#CloseStation]] when needed.

[[#GetState|State]] must be non-zero, this cmd eventually sets the State to value 0.

=== SetOperationMode ===
Takes an input [[#OperationMode]], no output.

[[#GetState|State]] must be 1.

The input value is written into state.

=== InitializeSystem2 ===
Takes an input PID, an u32, and an u64 pid_placeholder.

Official sw uses hard-coded value 0x1 for the u32.

The input u32 is ignored, the impl for this cmd is identical to [[#InitializeSystem]].

Internally this calls a func with params: (..., PID, &{u16 value 0x38}). On success, this then calls another func (which sets two state fields to the input) with params: (state, 0) (these state fields are used during [[#Authentication]] to check which service is being used).

The first func uses various [[Network_Interface_services|nifm]] funcs. The input value is used to determine the value for [[Network_Interface_services#CreateRequest|nn::nifm::RequestParameters]]: essentially, value 0x4 is used for ldn:u, and value 0x8 is used for ldn:s. The input value is also copied into state.

[[#GetState|State]] must be 0, this cmd eventually sets the State to value 1.

= ldn:u =
This is "nn::ldn::detail::IUserServiceCreator".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#CreateUserLocalCommunicationService]]
|}

== CreateUserLocalCommunicationService==
Returns an [[#IUserLocalCommunicationService]].

The user-process closes the IUserServiceCreator object immediately after using this cmd. Official sw ignores errors from this cmd.

== IUserLocalCommunicationService ==
This is "nn::ldn::detail::IUserLocalCommunicationService".

This is identical to [[#ISystemLocalCommunicationService]], except for the System-only cmd(s), and [[#Initialize]]/[[#Initialize2]] differ.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#GetState]]
|-
| 1 || [[#GetNetworkInfo]]
|-
| 2 || [[#GetIpv4Address]]
|-
| 3 || [[#GetDisconnectReason]]
|-
| 4 || [[#GetSecurityParameter]]
|-
| 5 || [[#GetNetworkConfig]]
|-
| 100 || [[#AttachStateChangeEvent]]
|-
| 101 || [[#GetNetworkInfoLatestUpdate]]
|-
| 102 || [[#Scan]]
|-
| 103 || [[#ScanPrivate]]
|-
| 104 || [5.0.0+] [[#SetWirelessControllerRestriction]]
|-
| 200 || [[#OpenAccessPoint]]
|-
| 201 || [[#CloseAccessPoint]]
|-
| 202 || [[#CreateNetwork]]
|-
| 203 || [[#CreateNetworkPrivate]]
|-
| 204 || [[#DestroyNetwork]]
|-
| 205 || [[#Reject]]
|-
| 206 || [[#SetAdvertiseData]]
|-
| 207 || [[#SetStationAcceptPolicy]]
|-
| 208 || [[#AddAcceptFilterEntry]]
|-
| 209 || [[#ClearAcceptFilter]]
|-
| 300 || [[#OpenStation]]
|-
| 301 || [[#CloseStation]]
|-
| 302 || [[#Connect]]
|-
| 303 || [[#ConnectPrivate]]
|-
| 304 || [[#Disconnect]]
|-
| 400 || [[#Initialize]]
|-
| 401 || [[#Finalize]]
|-
| 402 || [7.0.0+] [[#Initialize2]]
|}

=== Initialize ===
Takes an input PID and an u64 pid_placeholder.

This is used immediately after object creation.

With [7.0.0+] [[#Initialize2]] is used instead.

This is identical to [[#InitializeSystem]] except different params are used for the funcs called internally.

=== Finalize ===
No input/output.

This is used during service exit, prior to closing the object. Official sw will Abort if this fails.

This is identical to [[#FinalizeSystem]].

=== Initialize2 ===
Takes an input PID, an u32, and an u64 pid_placeholder.

Official sw uses hard-coded value 0x1 for the u32.

The input u32 is ignored, the impl for this cmd is identical to [[#Initialize]].

This is identical to [[#InitializeSystem2]] except different params are used for the funcs called internally: the u16 value is 0x5A, and the value for the second func is 1.

= ndd =
This is "nn::ndd::IService".

This was added with [5.0.0] and removed with [6.0.0].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || EnableAutoCommunication
|-
| 1 || DisableAutoCommunication
|-
| 2 || IsAutoCommunicationEnabled
|-
| 3 || EnablePowerSave
|-
| 4 || DisablePowerSave
|-
| 5 || IsPowerSaveEnabled
|-
| 6 || IsNetworkActive
|-
| 7 || AcquireSendDataUpdateEvent
|-
| 8 || AddSendData
|-
| 9 || ClearSendData
|-
| 10 || GetSendData
|-
| 11 || AcquireReceiveDataEvent
|-
| 12 || GetCurrentReceiveDataCounter
|-
| 13 || GetOldestReceiveDataCounter
|-
| 14 || GetNextReceiveDataCounter
|-
| 15 || GetAvailableReceiveDataCount
|-
| 16 || GetRecentReceiveDataCounter
|-
| 17 || GetReceiveData
|-
| 18 || AddReceiveData
|-
| 19 || ClearReceiveData
|-
| 20 || ClearDataIdFilter
|-
| 21 || AcquireDeviceScanEvent
|-
| 22 || StartDeviceScan
|-
| 23 || CancelDeviceScan
|-
| 24 || GetDeviceScanResult
|}

= lp2p:app, lp2p:sys =
These are "nn::lp2p::detail::INetworkServiceCreator".

These were added with [9.0.0+].

lp2p:app is used by [[Mario Kart Live: Home Circuit]]. lp2p:sys is used by [[Album_Applet|LibraryAppletPhotoViewer]] with [11.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#CreateNetworkService]]
|-
| 8 || [[#CreateNetworkServiceMonitor]]
|}

== CreateNetworkService ==
Takes an input u32, an u64 pid_reserved, a PID, returns an output [[#INetworkService]].

The input u32 must be value 0x1.

== CreateNetworkServiceMonitor ==
Takes an input u64 pid_reserved, a PID, returns an output [[#INetworkServiceMonitor]].

== INetworkService ==
This is "nn::lp2p::detail::INetworkService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Initialize|Initialize]]
|-
| [9.0.0-9.0.1] 256 || [[#AttachNetworkInterfaceStateChangeEvent]]
|-
| [9.0.0-9.0.1] 264 || [[#GetNetworkInterfaceLastError]]
|-
| [9.0.0-9.0.1] 272 || [[#GetRole]]
|-
| [9.0.0-9.0.1] 280 || [[#GetAdvertiseData]]
|-
| [9.0.0-9.0.1] 288 || [[#GetGroupInfo]]
|-
| [9.0.0-9.0.1] 296 || [[#Join]]
|-
| [9.0.0-9.0.1] 304 || [[#GetGroupOwner]]
|-
| [9.0.0-9.0.1] 312 || [[#GetIpConfig]]
|-
| [9.0.0-9.0.1] 320 || [[#Leave]]
|-
| 512 || [[#Scan]]
|-
| 768 || [[#CreateGroup]]
|-
| 776 || [[#DestroyGroup]]
|-
| 784 || [[#SetAdvertiseData]]
|-
| 1536 || [[#SendToOtherGroup]]
|-
| 1544 || [[#RecvFromOtherGroup]]
|-
| 1552 || [[#AddAcceptableGroupId]]
|-
| 1560 || [9.1.0+] [[#RemoveAcceptableGroupId]]
|}

=== Initialize ===
No input/output.

Returns 0.

Unused by official sw.

=== Scan ===
Takes a type-0x19 input buffer containing a [[#GroupInfo]], a type-0x22 output buffer containing an array of [[#ScanResult]], returns an output s32 total_out.

=== CreateGroup ===
Takes a type-0x31 input buffer containing a [[#GroupInfo]], no output.

[[Mario Kart Live: Home Circuit|mklive]] uses the following string with this: "Failed to create a group: %08X".

The [[#GetRole|role]] must be 0. This eventually sets the [[#GetRole|role]] to value 1.

=== DestroyGroup ===
No input/output.

This destroys the previously [[#CreateGroup|created]] group. If no group was previously created ([[#GetRole|role]] is not 1), this just returns 0.

=== SetAdvertiseData ===
Takes a type-0x21 input buffer, no output.

The buffer size must be <=0x80. The [[#GetRole|role]] must be <=1.

A string in [[Mario Kart Live: Home Circuit|mklive]] refers to the buffer data as "scan advertise data".

=== SendToOtherGroup ===
Takes an input [[#MacAddress_2|MacAddress]], a [[#GroupId]], a s16 frequency, a s16 channel, an u32 flags, a type-0x21 input buffer, no output.

The buffer size must be <=0x400.

The MacAddress must be non-zero. The s16s must be >=1.

Only bit0 is used from flags: clear = block until the data can be sent, set = return error when the data can't be sent.

A string in [[Mario Kart Live: Home Circuit|mklive]] refers to the buffer data as "Action frame".

The [[#GetRole|role]] must be non-zero. The error from [[#GetNetworkInterfaceLastError]] will be returned if it's set.

[11.0.0+] [[#GroupInfo]]+0x8A must be value 2, otherwise an error is returned.

This sends an Action frame to the specified [[#GroupId]], with the specified destination [[#MacAddress_2|MacAddress]] (can be a broadcast address).

The frequency param is the same as the [[#GroupInfo]]+0x84 field.

=== RecvFromOtherGroup ===
Takes an input u32 flags, a type-0x22 output buffer, returns a [[#MacAddress_2|MacAddress]], an u16, a s16, an u32 out_size, a s32.

The out_size is the original size used for copying to the output buffer, before it's clamped to the output-buffer size.

Only bit0 is used from flags: clear = block until data is available, set = return error when data is not available.

When data is not available, the error from [[#GetNetworkInterfaceLastError]] will be returned if it's set.

The [[#GetRole|role]] must be non-zero.

This receives an Action frame.

=== AddAcceptableGroupId ===
Takes an input [[#GroupId]], no output.

=== RemoveAcceptableGroupId ===
No input/output.

== INetworkServiceMonitor ==
This is "nn::lp2p::detail::INetworkServiceMonitor".

This interface has no commands, until [9.1.0+] which added actual commands.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Initialize_2|Initialize]]
|-
| 256 || [[#AttachNetworkInterfaceStateChangeEvent]]
|-
| 264 || [[#GetNetworkInterfaceLastError]]
|-
| 272 || [[#GetRole]]
|-
| 280 || [[#GetAdvertiseData]]
|-
| 281 || [[#GetAdvertiseData2]]
|-
| 288 || [[#GetGroupInfo]]
|-
| 296 || [[#Join]]
|-
| 304 || [[#GetGroupOwner]]
|-
| 312 || [[#GetIpConfig]]
|-
| 320 || [[#Leave]]
|-
| 328 || [[#AttachJoinEvent]]
|-
| 336 || [[#GetMembers]]
|}

=== Initialize ===
Returns 0.

Unused by official sw.

=== AttachNetworkInterfaceStateChangeEvent ===
No input, returns an output Event handle with EventClearMode=0.

=== GetNetworkInterfaceLastError ===
No input/output.

=== GetRole ===
No input, returns an output u8.

=== GetAdvertiseData ===
Takes a type-0x22 output buffer, returns 2 output u16s.

Validates that the [[#GetRole|role]] is value 2, then copies data from state into the output buffer. The first output u16 is the size used for the memcpy, the second u16 is the original size from state.

=== GetAdvertiseData2 ===
Takes a type-0x22 output buffer, returns 2 output u16s.

This is identical to [[#GetAdvertiseData]] except this doesn't run the role validation.

=== GetGroupInfo ===
Takes a type-0x32 output buffer containing a [[#GroupInfo]].

Validates that the [[#GetRole|role]] is non-zero, then copies the struct from state into the output buffer.

=== Join ===
Takes a type-0x32 output buffer containing a [[#GroupInfo]] and a type-0x31 input buffer containing a [[#GroupInfo]].

This runs the same code as [[#CreateGroup]] to generate the [[#GroupInfo]] for the input struct (which with [[#CreateGroup]] would be available with [[#GetGroupInfo]]). The input struct is the same as [[#CreateGroup]].

=== GetGroupOwner ===
No input, returns an output 0x80-bytes [[#NodeInfo_2|NodeInfo]].

Validates that the [[#GetRole|role]] is non-zero, then copies the data from state to output.

=== GetIpConfig ===
Takes a type-0x1A output buffer containing a 0x100-byte struct.

Validates that the [[#GetRole|role]] is non-zero, then copies the struct from state into the output buffer.

+0x20 is the <code>struct sockaddr</code> IP address, +0x40 is the <code>struct sockaddr</code> subnet-mask, +0x60 is the <code>struct sockaddr</code> gateway(?). The address for the last one is set to localhost.

=== Leave ===
No input, returns an output u32.

=== AttachJoinEvent ===
No input, returns an output Event handle with EventClearMode=0.

=== GetMembers ===
Takes a type-0x22 output buffer containing an array of [[#NodeInfo_2|NodeInfo]], returns an output s32 total_out.

Validates that the [[#GetRole|role]] is value 1. Then any entries from state which are available are copied into the output array buffer, if there's space available. A maximum of 8 entries can be returned.

A string in [[Mario Kart Live: Home Circuit|mklive]] refers to the array data as "connected members".

= lp2p:m =
This is "nn::lp2p::detail::IMonitorServiceCreator".

This was added with [9.1.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#CreateMonitorService]]
|}

== CreateMonitorService ==
Takes a PID, a total of 0x10-bytes of input, and returns an [[#IMonitorService]].

== IMonitorService ==
This is "nn::lp2p::detail::IMonitorService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Initialize_3|Initialize]]
|-
| 288 || [[#GetGroupInfo]]
|-
| 320 || [[#Leave]]
|}

=== Initialize ===
Returns 0.

= Ipv4Address =
This is "nn::ldn::Ipv4Address". This is a 0x4-byte struct with 4-byte alignment.

This is essentially the same as <code>struct in_addr</code>, except this is little-endian.

This is generally "169.254.XXX.{...}", where XXX is random per created network.

= SubnetMask =
This is "nn::ldn::SubnetMask". This is a 0x4-byte struct with 4-byte alignment.

This is essentially the same as <code>struct in_addr</code>, except this is little-endian.

= Ssid =
This is "nn::ldn::Ssid".

When converting a Ssid to a string, the loaded chars from the string must be in the range of 0x20-0x7F, otherwise the byte written to the string will be 0.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || Length excluding NUL-terminator, must be 0x1-0x20.
|-
| 0x1 || 0x21 || SSID string including NUL-terminator, str[{above length}] must be 0.
|}

= NetworkInfo =
This is "nn::ldn::NetworkInfo". This is a 0x480-byte struct. The data at +0x50 is another struct.

The fields listed as Reserved (besides the fields before +0x10) are cleared during the memset and are not written to again afterwards, with cmds which return NetworkInfo.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || LocalCommunicationId
|-
| 0x8 || 0x2 || Reserved
|-
| 0xA || 0x2 || Arbitrary user data which can be used for filtering with [[#ScanFilter]].
|-
| 0xC || 0x4 || Reserved
|-
| 0x10 || 0x10 || Last 0x10-bytes of [[#SecurityParameter]]. NetworkId which is used to generate/overwrite the [[#Ssid]]. With [[#Scan]]/[[#ScanPrivate]], this is only done after filtering when +0x4B is value 0x2. The converted Ssid is a 0x20-byte lowercase hex string version of the input NetworkId.
|-
| 0x20 || 0x6 || [[#MacAddress|MacAddress]]
|-
| 0x26 || 0x22 || [[#Ssid]]
|-
| 0x48 || 0x2 || s16 NetworkChannel
|-
| 0x4A || 0x1 || s8 LinkLevel
|-
| 0x4B || 0x1 || Set to hard-coded value 0x2 with output structs, except with [[#Scan]]/[[#ScanPrivate]] which can also set value 0x1 in certain cases. 0x1 = normal network without an [[#ActionFrame]], 0x2 = LDN network with a valid [[#ActionFrame]].
|-
| 0x4C || 0x4 || Padding
|-
| 0x50 || 0x10 || First 0x10-bytes of [[#SecurityParameter]].
|-
| 0x60 || 0x2 || Same as [[#SecurityConfig]]+0x0.
|-
| 0x62 || 0x1 || [[#AcceptPolicy]]
|-
| 0x63 || 0x1 || Only set with [[#Scan]]/[[#ScanPrivate]], when +0x4B is value 0x2. See [[#ActionFrame]].
|-
| 0x64 || 0x2 || Padding
|-
| 0x66 || 0x1 || Maximum participants, for the [[#NodeInfo|NodeInfo]] array.
|-
| 0x67 || 0x1 || ParticipantNum, number of set entries in the [[#NodeInfo|NodeInfo]] array. If +0x4B is not 0x2, ParticipantNum should be handled as if it's 0.
|-
| 0x68 || 0x200(0x40*8) || Array of [[#NodeInfo|NodeInfo]] with 8 entries, starting with the AccessPoint node.
|-
| 0x268 || 0x2 || Reserved
|-
| 0x26A || 0x2 || AdvertiseData size
|-
| 0x26C || 0x180 || AdvertiseData
|-
| 0x3EC || 0x8C || Reserved
|-
| 0x478 || 0x8 || [6.0.0+] Random AuthenticationId. Set to the output from [[ETicket_services|es]] cmd1501 during network creation.
|}

= ScanFilter =
This is "nn::ldn::ScanFilter". This is a 0x60-byte struct with 8-byte alignment.

sdknso copies the input ScanFilter to a tmp struct on stack, which is then used with the cmd.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || When enabled, this will be overwritten if it's -1. The data written for this is the first [[NACP_Format|LocalCommunicationId]] for the user-process loaded via [[Glue_services|arp:r]], if loading fails value 0 is written instead. During filtering if enabled, u8 [[#NetworkInfo]]+0x4B must match 0x2, and this ScanFilter field must match [[#NetworkInfo]]+0x0.
|-
| 0x8 || 0x2 || Padding
|-
| 0xA || 0x2 || During filtering if enabled, u8 [[#NetworkInfo]]+0x4B must match 0x2, and this ScanFilter field must match [[#NetworkInfo]]+0xA.
|-
| 0xC || 0x4 || Padding
|-
| 0x10 || 0x10 || During filtering if enabled, u8 [[#NetworkInfo]]+0x4B must match 0x2, and this ScanFilter data must match [[#NetworkInfo]]+0x10.
|-
| 0x20 || 0x4 || When enabled, must be <=0x3, and during filtering must match u8 [[#NetworkInfo]]+0x4B.
|-
| 0x24 || 0x6 || [[#MacAddress|MacAddress]]. Only copied with [[#ScanPrivate]]. During filtering if enabled, this must match [[#NetworkInfo]]+0x20.
|-
| 0x2A || 0x22 || [[#Ssid]]. During filtering if enabled, this must match [[#NetworkInfo]]+0x26 (the [[#Ssid]] there must be valid for this as well). The strings are compared, without verifying the length field in [[#Ssid]] matches.
|-
| 0x4C || 0x10 || Cleared to zero for the tmp struct.
|-
| 0x5C || 0x4 || Flags. Masked with 0x37 for [[#Scan]], with [[#ScanPrivate]] this is masked with 0x3F.
|}

Flags:

{| class="wikitable" border="1"
|-
! Bit
! Description
|-
| 0 || When set, enables using ScanFilter+0.
|-
| 1 || When set, enables using ScanFilter+0x10.
|-
| 2 || When set, enables using ScanFilter+0x20.
|-
| 3 || When set, enables using the ScanFilter [[#MacAddress|MacAddress]].
|-
| 4 || When set, enables using the ScanFilter [[#Ssid]].
|-
| 5 || When set, enables using ScanFilter+0xA.
|}

= NetworkConfig =
This is "nn::ldn::NetworkConfig". This is a 0x20-byte struct with 8-byte alignment.

sdknso copies the input NetworkConfig to a tmp struct on stack, which is then used with the cmd ([[#CreateNetwork]], [[#CreateNetworkPrivate]], [[#ConnectPrivate]]).

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || LocalCommunicationId. Same as [[#NetworkInfo]]+0x0. [[#CreateNetwork]]/[[#CreateNetworkPrivate]]/[[#Connect]]/[[#ConnectPrivate]]: When -1, this is overwritten with the first [[NACP_Format|LocalCommunicationId]] for the user-process loaded via [[Glue_services|arp:r]], if loading fails value 0 is written instead. Otherwise when not -1, if control.nacp loading is successful with [[Glue_services|arp:r]], this field must match one of the LocalCommunicationIds from there otherwise an error is thrown.
|-
| 0x8 || 0x2 || Cleared to zero during the copy.
|-
| 0xA || 0x2 || Same as [[#NetworkInfo]]+0xA.
|-
| 0xC || 0x4 || Cleared to zero during the copy.
|-
| 0x10 || 0x2 || s16 Channel, can be zero. Same as [[#NetworkInfo]]+0x48.
|-
| 0x12 || 0x1 || s8. Same as [[#NetworkInfo]]+0x66. [[#CreateNetwork]]/[[#CreateNetworkPrivate]]: Must be 0x1-0x8.
|-
| 0x13 || 0x1 || Cleared to zero during the copy.
|-
| 0x14 || 0x2 || Same as [[#NetworkInfo]]+0x96 (LocalCommunicationVersion from the first [[#NodeInfo|NodeInfo]]). Must not be negative. [[#Connect]]/[[#ConnectPrivate]]: This must match the value for the AccessPoint LocalCommunicationVersion.
|-
| 0x16 || 0xA || Cleared to zero during the copy.
|}

= NodeLatestUpdate =
This is "nn::ldn::NodeLatestUpdate". This is a 0x8-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || The field in state is reset to zero by [[#GetNetworkInfoLatestUpdate]] after loading it. Official apps checks whether this is non-zero.
|-
| 0x1 || 0x7 || Not initialized with [[#GetNetworkInfoLatestUpdate]].
|}

= WirelessControllerRestriction =
This is "nn::ldn::WirelessControllerRestriction". This is an u32 enum.

This is used to determine the value passed to [[BTM_services|btm]] SetWlanMode.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 ||
|-
| 1 || This is the default.
|}

= SecurityConfig =
This is "nn::ldn::SecurityConfig". This is a 0x44-byte struct with 2-byte alignment.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x2 || Type, a default of value 1 can be used here. Overwritten by [[#CreateNetwork]]/[[#CreateNetworkPrivate]] and [[#Connect]]/[[#ConnectPrivate]]. The value used internally by these cmds must be 1-3.
|-
| 0x2 || 0x2 || Data size. Must be 0x10-0x40.
|-
| 0x4 || 0x40 || Data, used with key derivation.
|}

Type:
* 1-2: Broadcast Action frame data is encrypted and is verified with SHA256.
* 3: Broadcast Action frame data is plaintext and is verified with SHA256.

* 1: Data frames are encrypted.
* 2-3: Data frames for normal data-transfer are plaintext - the network is Open.

= SecurityParameter =
This is "nn::ldn::SecurityParameter". This is a 0x20-byte struct with 1-byte alignment.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x10 || Data, used with the same key derivation as [[#SecurityConfig]].
|-
| 0x10 || 0x10 || NetworkId, see [[#NetworkInfo]].
|}

= UserConfig =
This is "nn::ldn::UserConfig". This is a 0x30-byte struct with 1-byte alignment.

sdknso copies the input UserConfig to a tmp struct on stack, which is then used with the cmd.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x20 || NUL-terminated string for the user nickname.
|-
| 0x20 || 0x10 || Cleared to zero during the copy.
|}

= AddressEntry =
This is "nn::ldn::AddressEntry". This is a 0xC-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || [[#Ipv4Address]]
|-
| 0x4 || 0x6 || [[#MacAddress|MacAddress]]
|-
| 0xA || 0x2 || Padding
|}

= AcceptPolicy =
This is "nn::ldn::AcceptPolicy". This is an u8.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || Allow all.
|-
| 1 || Deny all.
|-
| 2 || Blacklist, addresses in the [[#AddAcceptFilterEntry|list]] are not allowed.
|-
| 3 || Whitelist, only addresses in the [[#AddAcceptFilterEntry|list]] are allowed.
|}

= MacAddress =
This is "nn::ldn::MacAddress". This is a 6-byte struct with 1-byte alignment.

= NodeInfo =
This is "nn::ldn::NodeInfo".

The fields listed as Reserved are cleared during the memset and are not written to again afterwards, with cmds which return [[#NetworkInfo]].

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || [[#Ipv4Address]]
|-
| 0x4 || 0x6 || [[#MacAddress|MacAddress]]
|-
| 0xA || 0x1 || s8 ID / index
|-
| 0xB || 0x1 || IsConnected
|-
| 0xC || 0x20 || First 0x20-bytes of [[#UserConfig]].
|-
| 0x2C || 0x2 || Reserved
|-
| 0x2E || 0x2 || s16 LocalCommunicationVersion
|-
| 0x30 || 0x10 || Reserved
|}

= ConnectOption =
This is "nn::ldn::ConnectOption". This is an u32 bitmask.

There's two versions of the sdknso funcs for [[#Connect]]/[[#ConnectPrivate]]: the version where the ConnectOption isn't user-specified uses a default value of 0x1 for it, with the same ShowError code without the bit0 check.

When bit0 here is set after using the above cmds, the sdknso funcs will use [[Error_Applet|ShowError]] with the returned Result if: (rc & 0x3FE1FF) == 0xE0CB.

This must be <=0x1, besides this validation ConnectOption is ignored by [[#Connect]]/[[#ConnectPrivate]].

= OperationMode =
This is "nn::ldn::OperationMode". This is an u32 enum.

This controls bit1 in the value passed to [[WLAN_services|wlan:lcl]] cmd0/cmd1: bit1 = OperationMode==1.

Value 1 seems to affect power (?) related fields in the beacon tags?

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || This is the default.
|-
| 1 ||
|}

= MacAddress =
This is "nn::lp2p::MacAddress". Same as [[#MacAddress|MacAddress]].

= GroupId =
This is "nn::lp2p::GroupId". This is a 6-byte struct with 1-byte alignment.

This is a WiFi BSSID.

= NodeInfo =
This is "nn::lp2p::NodeInfo". This is a 0x80-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || || <code>struct sockaddr</code> for the IP address.
|-
| 0x24 || 0x6 || [[#MacAddress_2|MacAddress]]
|}

= GroupInfo =
This is "nn::lp2p::GroupInfo". This is a 0x200-byte struct.

[[Mario Kart Live: Home Circuit|mklive]] sets the SSID to a string generated from random data.

[[#Scan_2|Scan]] only uses the following fields for the cmd input struct: SupportedPlatform/Priority, Frequency/Channel, and PresharedKeyBinarySize/PresharedKey.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x10 || Wrapped master key. When zero, set to randomly-generated data. This is decrypted with a "static AES key" and used to derive the 4 encryption keys for the session.
|-
| 0x10 || 0x8 || LocalCommunicationId. When zero, the value from control.nacp is loaded. This is later validated by [[#Join]]/[[#CreateGroup]] the same way as the [[#NetworkConfig]] field. Used during key derivation to derive keys B and D.
|-
| 0x18 || 0x6 || [[#GroupId]] ("GROUP ID (BSSID)"). When zero, the default is used. The default should be used here: an error is thrown if the data here doesn't match the output from [[WLAN_services|wlan:lcl]] cmd2.
|-
| 0x1E || 0x21 || ServiceName ("GROUP NAME (SSID)"). NUL-terminated string. See below.
|-
| 0x3F || 0x1 || s8 Flags count. Must be <=0x3F.
|-
| 0x40 || 0x40 || Array of s8 with the above count. Each entry value must be <=0x3F. Each entry is an array index used to load a set of flags from a global array with the specified index. global_flags are also masked with flags loaded from here. User-processes use entryval=1 as the default, with [11.0.0+] entryval=0 can be used for standard WPA2-PSK (see +0x8A).
|-
| 0x80 || 0x1 || SupportedPlatform. Must match value 1. 0 is PlatformIdNX, 1 is PlatformIdFuji.
|-
| 0x81 || 0x1 || MemberCountMax. s8, Must be <=0x8. During group creation this is passed to [[WLAN_services|wlan:lcl]] cmd40, when this is value 0 a default of value 1 is passed. During group-creation when the below +0x88 field is not value 0x2, the passed [[BTM_services#SetWlanMode|WlanMode]] is <code>x81_field_val > 3</code>.
|-
| 0x82 || 0x1 ||
|-
| 0x84 || 0x2 || Frequency. Wifi frequency: 24 = 2.4GHz, 50 = 5GHz.
|-
| 0x86 || 0x2 || s16 Channel ("CHANNEL"). Wifi channel number. 0 = use default, otherwise this must be one of the following depending on the frequency field:
* 24: 1, 6, 11.
* 50: 36, 40, 44, 48.
|-
| 0x88 || 0x1 || NetworkMode. Used during group-creation to determine the [[BTM_services#SetWlanMode|WlanMode]] to use. When this is value 0x2, mode=3 is used, otherwise it's determined via the +0x81 field.
|-
| 0x89 || 0x1 || PerformanceRequirement.
|-
| 0x8A || 0x1 || Security type, used during key derivation. 0 = use defaults, 1 = plaintext, 2 = encrypted. [11.0.0+] 3: Standard WPA2-PSK.
|-
| 0x8B || 0x1 || StaticAesKeyIndex. s8, used as the array-index for selecting the KeySource used with [[SPL_services#GenerateAesKek|GenerateAesKek]] during key derivation. Should be 1-2, otherwise GenerateAesKek is skipped and zeros are used for the AccessKey instead.
|-
| 0x8D || 0x1 || Priority. Must match one of the following, depending on the used service (doesn't apply to [[#Join]]): 55 = SystemPriority (lp2p:sys), 90 = ApplicationPriority (lp2p:app and lp2p:sys).
|-
| 0x8E || 0x1 || StealthEnabled. Bool flag, controls whether the SSID is hidden.
|-
| 0x8F || 0x1 || If zero, a default value of 0x20 is used.
|-
| 0x1C0 || 0x1 || PresharedKeyBinarySize. Must be 0x20 for PresharedKeyBinary. [11.0.0+] With WPA2-PSK, this must be value 1.
|-
| 0x1C1 || 0x3F ([9.0.0-10.2.0] 0x20) || PresharedKey. Used to derive encryption keys A and C. [11.0.0+] With WPA2-PSK, this is the passphrase string (length must be at least 8).
|}

In order for the ServiceName to be valid without a new one being generated, the following checks must pass:
* It loops through the characters in the string, looking for the first '_' character:
** The loop will exit once a '_' character is found.
** The character must be '-', or alphanumeric (lowercase/uppercase), otherwise the function will immediately return failure.
** The loop will also exit once string_pos is >19, in which case the function will also immediately return failure.
* Then it checks the 11 characters which follow the above:
** The character must be hex: '0'-'9', or 'A-F' / 'a-'f.
* The following character must be a NUL-terminator.
* The last hex character above, then the characters for the whole string prior to the last hex character are summed. return sum % 0x2B == 0. u32 is used for these calculations. (Return success when sum is a multiple of 0x2B, otherwise return failure)

If the above fails, then the following runs, otherwise it just returns 0:
* It loops through the characters in the string.
** The character must be '-', or alphanumeric (lowercase/uppercase), otherwise the function will immediately return failure.
** The loop will exit once string_pos>20 is reached, or when a NUL-terminator is reached.
* Once finished, success is returned if string_pos-1 is <20, otherwise failure is returned (which also immediately occurs if the first character is a NUL-terminator).

If the above fails, an error is returned, otherwise a new ServiceName is generated:
* Up to 20 characters are copied from the original ServiceName to the output ServiceName, stopping once the limit is reached or when a NUL-terminator is reached.
* '_' is appended to the string.
* <code>nn::util::TSNPrintf({strptr following the above character}, {remaining size}, "%02X%02X%02X%02X%02X", [[#GroupId|GroupId_byte3]], [[#GroupId|GroupId_byte4]], [[#GroupId|GroupId_byte5]], ([[SPL_services#IsDevelopment|IsDevelopment]] ? 0x80 : 0) | 0x1, 0);</code>
* Then the last character is set to the output from a calling a function:
** All string characters which were already written are summed same way as above. Then: <code>return character_lookup_table[sum % 0x2B];</code> (If the length passed to this function is 0, this will instead just return character_lookup_table[0])
*** character_lookup_table contains 0x2B entries: [V-A][k-a][5-0][Z-W].

loaded_flags are first loaded from elsewhere, then masked with the above flags when available. loaded_flags are used when +0x8A is 0. global_flags are loaded from global data. These flags are only used with [[#CreateGroup]]/[[#Join]]. Flags (note that the following was updated with [11.0.0+], and differs from below):
* Bit2 clear:
** global_flags must be non-zero, and loaded_flags bit1 must be set.
** u8 +0x8A is set to value 1.
** When the cached [[SPL_services#IsDevelopment|IsDevelopment]] value is false (retail), an error is thrown.
** u8 +0x8B is set to value 0.
* Otherwise, if bit2 is set:
** u8 +0x8A is set to value 2.
** global_flags bit1 set:
*** u8 +0x8B is set to value 1.
** Otherwise, if global_flags bit2 is set:
*** u8 +0x8B is set to value 2.

= ScanResult =
This is "nn::lp2p::ScanResult". This is a 0x300-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x200 || [[#GroupInfo]]
|-
| 0x200 || 0x1 ||
|-
| 0x206 || 0x2 || AdvertiseData size.
|-
| 0x208 || 0x80 || AdvertiseData
|}

= Network protocol =
== ldn ==
A beacon and Action frame are broadcasted. The SSID in the beacon is hidden (32-bytes with value 0). For [[#Scan]]/[[#ScanPrivate]] it doesn't matter if no beacon is available ([[#NetworkInfo]] is the same), as long as the Action frame is broadcasted. However, the Station will not send a probe-request during connection if no beacon is available (and therefore not attempt any communication with the AccessPoint). The beacon doesn't have any custom Nintendo data, that data is in the Acton frame.

During connection, the Station first sends a probe-request using the [[#NetworkInfo|generated]] SSID from the Action frame. If the probe-response contains the expected data for the [[#SecurityConfig]] type, the Station then proceeds to connect to the AccessPoint. The key for data-frames, if [[#SecurityConfig|enabled]], is derived from a buffer containing: {[[#SecurityParameter]]+0x0} followed by {[[#SecurityConfig]] data with the specified data-size}. The [[#ActionFrame]]/data-frame keys are derived with the same func, the only difference is the input passed to this func + the passed constant data. The key derived by ldn is used directly as the static CCMP key for all data-frames (CCMP / MIC is standard).

Then the Station scans for an [[#ActionFrame]] for loading the [[#NetworkInfo]].

Once connected, the AccessPoint sends Epigram-vendor Action frame(s) (same data) to the Station, the Station doesn't require these frames: <code>dd1afeedfacedeadbeef010000000a00000000000000000000000000</code>. Then the Station must Authenticate with the AccessPoint, this is custom. The Station sends a frame (a maximum of 3 times in some cases if errors occur, with the same data), and the AccessPoint sends a response. Once Authenticated, the node is added to the [[#NodeInfo|NodeInfo]] array in [[#NetworkInfo]]. If the Station does not successfully Authenticate X-seconds after connecting, the AccessPoint disconnects the Station. If the Station fails to Authenticate, the Station itself will disconnect as well.

After Authentication the Station will scan for another [[#ActionFrame]], with frame-comparision enabled with the above frame (frame must have been updated since the previous scan). The Station locates the index for a [[#MacAddress|MacAddress]] matching itself in the [[#NetworkInfo]] [[#NodeInfo|NodeInfo]] array (the entry for the AccessPoint is skipped), throwing an error if not found. After validating the LocalCommunicationVersion, it proceeds to handle ARP setup below.

This does not use DHCP, each node on the network has to manually setup ARP (without sending ARP network requests) with the [[#NodeInfo|NodeInfo]] array in [[#NetworkInfo]].

At this point standard sockets can be used over Data frames.

=== EthFrame ===
The custom Ethernet frames have the following structure:
* "Type: IEEE 802a OUI Extended Ethertype (0x88b7)"
* "IEEE802a OUI Extended Ethertype":
** "Organization Code: 00:22:aa (Nintendo Co., Ltd.)"
** "Protocol ID: {...}"
*** Depends on the frame:
*** 0x0102: [[#Authentication]]
*** 0x0103: ?
* The first byte of Data is value 0, then the ProtocolID-specific data follows, see below.
** ProtocolID 0x0103 frames are sent by the AccessPoint to the Station. This is 0x20-bytes of zeros, except for the first byte which is 0x3. This is sent by the AccessPoint prior to destroying the network.

==== Authentication ====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || [[#AuthVersion]]
|-
| 0x1 || 0x1 || Low u8 for the size.
|-
| 0x2 || 0x1 || Status. 0 = success, non-zero = error.
|-
| 0x3 || 0x1 || [2.0.0+] bool flag. The AccessPoint verifies that this is not set. Always set to 1 by the AccessPoint in the response. The Station only uses this when the [[#AuthVersion]] is >=2.
|-
| 0x4 || 0x1 || [6.0.0+] High u8 for the size.
|-
| 0x5 || 0x3 || Unused, zeros.
|-
| 0x8 || 0x20 || [[#NetworkInfo]]+0, must match the corresponding data in [[#NetworkInfo]] when the receiving node verifies this. With the
AccessPoint->Station frame, the Station verifies that this matches the data previously sent to the AccessPoint.
|-
| 0x28 || 0x10 || [[#NetworkInfo]]+0x50, must match the corresponding data in [[#NetworkInfo]] when the receiving node verifies this. With the
AccessPoint->Station frame, the Station verifies that this matches the data previously sent to the AccessPoint.
|-
| 0x38 || 0x10 || See below.
|-
| 0x48 || || Frame-specific data, with the above size. The total frame size - {offset of the start of this data in the frame} must match the above size.
|}

The Station sets the above size to 0x40 ([6.0.0+] if [[#NetworkInfo]]+0x13 is <3). [6.0.0+] The Authentication challenge is only used/enabled if that value is >=3, and [[#IUserLocalCommunicationService]] is being used.

The AccessPoint sets the above size to 0x40 ([6.0.0+] 0x0 if the +0x0 [[#AuthVersion]] is <3). [6.0.0+] The AccessPoint will only use/enable the Authentication challenge when the +0x0 [[#AuthVersion]] is >=3, and [[#IUserLocalCommunicationService]] is being used. This data will not be included in the frame if the status field indicates error.

[6.0.0+] Support for the Authentication challenge with [[ETicket_services|es]] cmds 1501-1504 was added.

Station->AccessPoint frame, relative to +0x0 above (frame size depends on whether +0xAC is enabled):

The AccessPoint will not respond to frames where the source mac-address is unrecognized.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x38 || 0x10 || The Station sets this to random data. Unused by the AccessPoint, except for copying into the response.
|-
| 0x48 || 0x20 || [[#UserConfig]]+0. Copied into state by the AccessPoint.
|-
| 0x68 || 0x2 || Big-endian LocalCommunicationVersion. Byte-swapped by the AccessPoint then copied into state.
|-
| 0x6A || 0x1E || Zeros, unused by the AccessPoint.
|-
| 0x88 || 0x24 || [6.0.0+] Zeros, unused by the AccessPoint.
|-
| 0xAC || 0x300 || [6.0.0+] Authentication challenge data. If enabled, the total frame size must be >= {end offset of this data in the frame}. The frame data does not include this if it's not enabled.
|}

AccessPoint->Station response frame, relative to +0x0 above (frame size depends on whether +0x48/+0xCC are enabled):

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x38 || 0x10 || +0x38 from the data originally sent by the Station. The Station verifies that this matches the previously sent data.
|-
| 0x48 || 0x40 || Zeros. [6.0.0+] Only included in the frame if it's enabled (+0x0 [[#AuthVersion]] >= 3). Unused by the Station.
|-
| 0x88 || 0x44 || [6.0.0+] Only included in the frame if it's enabled (+0x0 [[#AuthVersion]] >= 3). Unused by the Station.
|-
| 0xCC || 0x100 || [6.0.0+] If enabled, Authentication challenge response data. Not included in the frame if it's not enabled.
|}

===== AuthVersion =====
Must be 0x1-0xF.

{| class="wikitable" border="1"
|-
! Value || SystemVersion
|-
| 1 || [1.0.0+]
|-
| 2 || [2.0.0+]
|-
| 3 || [6.0.0+]
|}

=== ActionFrame ===
The Action frames have the following structure:
* "Fixed parameters":
** "Category code: Vendor Specific (127)"
** "OUI: 00:22:aa (Nintendo Co., Ltd.)"
* The Data starts with the following header:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x2 || 04 00 in sent frames.
|-
| 0x2 || 0x2 || Protocol ID, must be 0x0101.
|-
| 0x4 || 0x2 || Must be 0.
|-
| 0x6 || 0x2 || Zeros, unused.
|}

Then the actual data follows:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x20 || [[#NetworkInfo]]+0x0. The u64/u16 are big-endian. Outside of [[#Scan]]/[[#ScanPrivate]], this must match the previously loaded data for this.
|-
| 0x20 || 0x1 || [[#AuthVersion]]. Copied to [[#NetworkInfo]]+0x63. When comparing with a previous frame is enabled, this must match the value from the previous frame.
|-
| 0x21 || 0x1 || Encryption type: 1 = plaintext, 2 = encrypted, {frames with other values are ignored by [[#Scan]]/[[#ScanPrivate]]}. Must match the type which is currently being used: with [[#Scan]]/[[#ScanPrivate]] this is determined via this field, otherwise [[#SecurityConfig]] is used to determine this.
|-
| 0x22 || 0x2 || Big-endian u16 size for the data starting at +0x48, must be <=0x500, and must match {total frame size relative to +0x0 above} + 0x48.
|-
| 0x24 || 0x4 || Big-endian u32 Counter. The initial value is randomly-generated. This is incremented each time the below content is updated (including initial creation). Also used by the Station to determine whether the frame changed compared to a previous one. When comparing against a previous frame, new_counter-prev_counter must be <= 0xFF, and the counters must not match.
|-
| 0x28 || 0x20 || SHA256 hash over the entire frame starting at +0x0, with the above size + 0x48. During hashing, this hash is cleared, with the new hash overwriting the original in memory (the original is copied to stack for comparing).
|}

When encryption is enabled, the encrypted data is +0x28 with size {remaining frame size}. This is encrypted with AES-128-CTR. The key is derived from the raw 0x20-bytes at +0x0. The CTR is {raw Counter above without byte-swap}, with the rest cleared to zeros.

The content data at +0x48 follows, which has the size specified above (which must be >=0x500), where all fields are big-endian:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x10 || [[#NetworkInfo]]+0x50
|-
| 0x10 || 0x2 || [[#NetworkInfo]]+0x60
|-
| 0x12 || 0x1 || [[#NetworkInfo]]+0x62
|-
| 0x13 || 0x3 || Unused
|-
| 0x16 || 0x1 || s8 [[#NetworkInfo]]+0x66, clamped to range 1-8.
|-
| 0x17 || 0x1 || s8 [[#NetworkInfo]]+0x67, clamped to range 1-8.
|-
| 0x18 || 0x1C0(0x38*8) || Array of the below node struct.
|-
| 0x1D8 || 0x2 || Unused
|-
| 0x1DA || 0x2 || [[#NetworkInfo]]+0x26A
|-
| 0x1DC || 0x180 || [[#NetworkInfo]]+0x26C
|-
| 0x35C || 0x19C || Unused
|-
| 0x4F8 || 0x8 || [6.0.0+] [[#NetworkInfo]]+0x478
|}

The data here is copied into [[#NetworkInfo]].

Node data used in the above array (all fields big-endian), which are copied into the [[#NetworkInfo]] [[#NodeInfo|NodeInfo]] array:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || [[#Ipv4Address]]
|-
| 0x4 || 0x6 || [[#MacAddress|MacAddress]]
|-
| 0xA || 0x1 || bool IsConnected
|-
| 0xB || 0x1 || Unused
|-
| 0xC || 0x20 || First 0x20-bytes of [[#UserConfig]].
|-
| 0x2C || 0x2 || s16 LocalCommunicationVersion
|-
| 0x2E || 0xA || Unused
|}

== lp2p ==
This is used for communicating with accessories (external devices on [11.0.0+]) over local wifi. [[Mario Kart Live: Home Circuit]] uses this. [11.0.0+] [[Album_Applet|LibraryAppletPhotoViewer]] uses this.

A beacon is broadcasted.

Action frames are only sent when done so by [[#SendToOtherGroup]] (other than the Epigram one mentioned below).

Communication uses sockets with standard Data frames and the above Action frames. Switch consoles presumably only use the Action frames to communicate with each other?

The key derived by ldn-sysmodule is used directly as the static CCMP key for all data-frames (CCMP / MIC is standard). However, with [[#GroupInfo]]+0x8A value 3, standard WPA2-PSK is used instead.

This uses infrastructure-mode (AccessPoint), and DHCP is used. The group-owner is the AccessPoint. Note that the probe response includes the same Nintendo tags included with the beacon. Once connected, the group-owner sends the same Epigram-vendor Action frame(s) described in [[#ldn]]. At this point socket communication can begin, including DHCP usage.

The DHCP server thread is started by the "nn.lp2p.StateMachine" thread eventually during group [[#CreateGroup|creation]]. The DHCP Offer option values are the following:
* "Subnet Mask: 255.255.255.0"
* "DHCP Server Identifier: {...}"
* "Broadcast Address: {...}"
* "IP Address Lease Time: (5s) 5 seconds"
* "Renewal Time Value: (0s) 0 seconds"
* "Rebinding Time Value: (0s) 0 seconds"
* "Interface MTU: 1500"

Note that the above options doesn't include "Domain Name Server" or "Router", the client device may fail to connect if it doesn't allow those DHCP options to be missing.

=== Beacon ===
The SSID in the beacon can optionally be [[#GroupInfo|hidden]] (all-zero with the same length as the original SSID). The beacon contains two vendor-specific Nintendo information elements with OUI <code>00:22:aa</code>; each IE has a 2-byte ID following the OUI. These Nintendo IEs are not used when standard WPA2-PSK is being used.

The beacon is identical to ldn, except for the following (besides SSID length difference and the lp2p-only Nintendo tags):
* "Tag: Traffic Indication Map (TIM)": "DTIM count" for lp2p is 1, with ldn it's 0.
* "Tag: HT Capabilities (802.11n D1.10)": "HT Short GI for 20MHz" is set to "Not supported", for ldn it's "Supported".
* "Tag: Vendor Specific: Microsoft Corp.: WMM/WME: Parameter Element" "Ac Parameters ACI 0": "CW Min: 15" for lp2p, "CW Min: 63" for ldn.

Note that during group creation the beacon may be missing the Nintendo IEs in some cases, since group creation didn't finish yet.

==== Nintendo IE 0 ====

The first Nintendo IE (ID 0x0600) contains the following fixed parameters:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || Fixed 0x20; perhaps a version or other magic number.
|-
| 0x1 || 0x1 || [[#GroupInfo|SecurityType]]
|-
| 0x2 || 0x1 || [[#GroupInfo|StaticAesKeyIndex]]
|-
| 0x3 || 0x1 || Fixed zero; padding byte.
|-
| 0x4 || 0x8 || Big-endian (i.e. byte-reversed) version of [[#GroupInfo|LocalCommunicationId]]. This is the only context where LocalCommunicationId is reversed.
|-
| 0xC || 0x10 || Wrapped master key. Same as [[#GroupInfo]]+0x0.
|-
| 0x1C || 0x4 || If encryption is enabled, a randomly-generated nonce, else nothing. Appending 8 zero bytes to this yields the AES-GCM IV.
|-
| 0x20 || 0x10 || If encryption is enabled, the AES-GCM MAC tag, else nothing. All bytes prior to this (fixed 0x20 through nonce) are the additional authenticated data. All bytes after this are encrypted with key B.
|}

After this, TLV tagged parameters occur. Each TLV tag is formatted as:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || Tag type
|-
| 0x1 || 0x1 || Length
|-
| 0x2 || {above size} || Data for the tag
|}

Known TLV tags:

{| class="wikitable" border="1"
|-
! Type
! Size
! Description
|-
| 0x1 || 0x2 || Additional network parameters: 0xAB 0xCD. A=[[#GroupInfo]]+0x82, B=[[#GroupInfo|MemberCountMax]], C=[[#GroupInfo|NetworkMode]], D=[[#GroupInfo|PerformanceRequirement]].
|-
| 0x2 || 0x8 || Flags: Bitwise-or of (1<<f) for each entry in [[#GroupInfo]]+0x40
|}

==== Nintendo IE 1 ====

The second Nintendo IE (ID 0x0601) contains only TLVs. If encryption is enabled, a 0x4-byte nonce and 0x10-byte AES-GCM tag are written first, as above, and the TLVs are encrypted. Key C is used.

Known TLV tags:

{| class="wikitable" border="1"
|-
! Type
! Size
! Description
|-
| 0x21 || Varies || AdvertiseData
|}

=== ActionFrame ===
The Action frames have the following structure:
* "Fixed parameters":
** "Category code: Vendor Specific (127)"
** "OUI: 00:22:aa (Nintendo Co., Ltd.)"
* The Data starts with the following:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x2 || Usually 06 00?
|-
| 0x2 || 0x2 || Usually 20 02?(Second byte depends on whether encryption is used?)
|-
| 0x4 || 0x2 || Usually 02 00?(varies)
|-
| 0x6 || 0x8 || Big-endian version of [[#GroupInfo]]+0x10.
|-
| 0xE || 0x10 || Same as [[#GroupInfo]]+0x0.
|}

When encryption is used, the remaining data is:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || Big-endian u32 Counter. The initial value is randomly-generated (?). This is incremented with each sent Action frame.
|-
| 0x4 || {remaining size} || Encrypted user-data. Also includes 0x10-bytes of unknown data.
|}

When plaintext is used, the remaining data is:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || {remaining size} || Plaintext user-data.
|}

[[Category:Services]]

LDN services

2021-01-29T19:22:28Z

CFSworks: /* Beacon */ Fully document the Nintendo IEs. Note: the Action frame is the same, except its encrypted section has app-provided data rather than TLVs -- if anyone wants to edit that in. :)

LDN handles all local network communication.

= ldn:m =
This is "nn::ldn::detail::IMonitorServiceCreator".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#CreateMonitorService]]
|}

== CreateMonitorService ==
Returns an [[#IMonitorService]].

The user-process closes the IMonitorServiceCreator object immediately after using this cmd.

== IMonitorService ==
This is "nn::ldn::detail::IMonitorService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#GetStateForMonitor]]
|-
| 1 || [[#GetNetworkInfoForMonitor]]
|-
| 2 || [[#GetIpv4AddressForMonitor]]
|-
| 3 || [[#GetDisconnectReasonForMonitor]]
|-
| 4 || [[#GetSecurityParameterForMonitor]]
|-
| 5 || [[#GetNetworkConfigForMonitor]]
|-
| 100 || [[#InitializeMonitor]]
|-
| 101 || [[#FinalizeMonitor]]
|}

=== GetStateForMonitor ===
No input, returns an output u32.

sdknso implements this by <code>return</code>ing the u32, with 0 being returned on error.

=== GetNetworkInfoForMonitor ===
Takes a type-0x1A output buffer containing a [[#NetworkInfo]].

=== GetIpv4AddressForMonitor ===
No input, returns an output [[#Ipv4Address]] and a [[#SubnetMask]].

=== GetDisconnectReasonForMonitor ===
No input, returns an output s16.

This is not exposed by sdknso.

This just returns 0.

=== GetSecurityParameterForMonitor ===
No input, returns an output [[#SecurityParameter]].

This is not exposed by sdknso.

=== GetNetworkConfigForMonitor ===
No input, returns an output [[#NetworkConfig]].

This is not exposed by sdknso.

=== InitializeMonitor ===
No input/output.

This is used immediately after object creation. Official sw will Abort if this fails.

This just returns 0.

=== FinalizeMonitor ===
No input/output.

This is used during service exit, prior to closing the object. Official sw will Abort if this fails.

This just returns 0.

= ldn:s =
This is "nn::ldn::detail::ISystemServiceCreator".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#CreateSystemLocalCommunicationService]]
|}

== CreateSystemLocalCommunicationService ==
Returns an [[#ISystemLocalCommunicationService]].

The user-process closes the ISystemServiceCreator object immediately after using this cmd. Official sw ignores errors from this cmd.

== ISystemLocalCommunicationService ==
This is "nn::ldn::detail::ISystemLocalCommunicationService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#GetState]]
|-
| 1 || [[#GetNetworkInfo]]
|-
| 2 || [[#GetIpv4Address]]
|-
| 3 || [[#GetDisconnectReason]]
|-
| 4 || [[#GetSecurityParameter]]
|-
| 5 || [[#GetNetworkConfig]]
|-
| 100 || [[#AttachStateChangeEvent]]
|-
| 101 || [[#GetNetworkInfoLatestUpdate]]
|-
| 102 || [[#Scan]]
|-
| 103 || [[#ScanPrivate]]
|-
| 104 || [5.0.0+] [[#SetWirelessControllerRestriction]]
|-
| 200 || [[#OpenAccessPoint]]
|-
| 201 || [[#CloseAccessPoint]]
|-
| 202 || [[#CreateNetwork]]
|-
| 203 || [[#CreateNetworkPrivate]]
|-
| 204 || [[#DestroyNetwork]]
|-
| 205 || [[#Reject]]
|-
| 206 || [[#SetAdvertiseData]]
|-
| 207 || [[#SetStationAcceptPolicy]]
|-
| 208 || [[#AddAcceptFilterEntry]]
|-
| 209 || [[#ClearAcceptFilter]]
|-
| 300 || [[#OpenStation]]
|-
| 301 || [[#CloseStation]]
|-
| 302 || [[#Connect]]
|-
| 303 || [[#ConnectPrivate]]
|-
| 304 || [[#Disconnect]]
|-
| 400 || [[#InitializeSystem]]
|-
| 401 || [[#FinalizeSystem]]
|-
| 402 || [4.0.0+] [[#SetOperationMode]]
|-
| 403 || [7.0.0+] [[#InitializeSystem2]]
|}

=== GetState ===
No input, returns an output u32.

sdknso implements this by <code>return</code>ing the u32, with 0 being returned on error / when service isn't initialized.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || None
|-
| 1 || Initialized
|-
| 2 || AccessPointOpened
|-
| 3 || AccessPointCreated
|-
| 4 || StationOpened
|-
| 5 || StationConnected
|-
| 6 || Error
|-
|}

=== GetNetworkInfo ===
Takes a type-0x1A output buffer containing a [[#NetworkInfo]].

=== GetIpv4Address ===
No input, returns an output [[#Ipv4Address]] and a [[#SubnetMask]].

=== GetDisconnectReason ===
No input, returns an output s16.

sdknso implements this by <code>return</code>ing the s16 as a s32, with -1 being returned on error.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| -1 || See above.
|-
| 0 || None
|-
| 1 || User
|-
| 2 || SystemRequest
|-
| 3 || DestroyedByAdmin
|-
| 4 || DestroyedBySystemRequest
|-
| 5 || Admin
|-
| 6 || SignalLost
|}

=== GetSecurityParameter ===
No input, returns an output [[#SecurityParameter]].

=== GetNetworkConfig ===
No input, returns an output [[#NetworkConfig]].

=== AttachStateChangeEvent ===
No input, returns an output Event handle.

sdknso uses EventClearMode=1 with this. sdknso will Abort if this cmd fails.

This is signaled when the data returned by [[#GetNetworkInfo]]/[[#GetNetworkInfoLatestUpdate]] is updated.

=== GetNetworkInfoLatestUpdate ===
Takes a type-0x1A output buffer containing a [[#NetworkInfo]] and a type-0xA output buffer containing an array of [[#NodeLatestUpdate]].

The array count must be 8.

=== Scan ===
Takes a type-0x22 output buffer containing an array of [[#NetworkInfo]], a s16 channel, a [[#ScanFilter]], returns an output s16 total_out.

sdknso copies the output s16 to a s32, the value passed for the input s16 is from an user-specified s32 (user-apps generally use value 0 for this).

This is the same as [[#ScanPrivate]], except this also has the same channel-override functionality as [[#CreateNetwork]].

[[#GetState|State]] must be 3-5.

The array count must be at least 1. This is clamped to a maximum of 0x18.

=== ScanPrivate ===
Takes a type-0x22 output buffer containing an array of [[#NetworkInfo]], a s16 channel, a [[#ScanFilter]], returns an output s16 total_out.

sdknso copies the output s16 to a s32, the value passed for the input s16 is from an user-specified s32.

See [[#Scan]].

=== SetWirelessControllerRestriction ===
Takes an input [[#WirelessControllerRestriction]], no output.

[[#GetState|State]] must be 1.

The input value is written into state.

=== OpenAccessPoint ===
No input/output.

[[#GetState|State]] must be 1, this cmd eventually sets the State to value 2.

=== CloseAccessPoint ===
No input/output.

[[#GetState|State]] must be 2-3, this cmd eventually sets the State to value 1.

=== CreateNetwork ===
Takes an input [[#SecurityConfig]], an [[#UserConfig]], a [[#NetworkConfig]], no output.

This is the same as [[#CreateNetworkPrivate]], except the [[#AddressEntry]] params are 0, and the [[#SecurityParameter]] is generated from "nn::util::TinyMt::GenerateRandomBytes".

Unlike CreateNetworkPrivate, this overwrites the channel field in the [[#NetworkConfig]]. When the cached [[SPL_services#IsDevelopment|IsDevelopment]] value is true, the output from [[Settings_services|GetLdnChannel]] will overwrite that field if the s32 setting value is >=0, otherwise the original value is used. Otherwise when the IsDevelopment field is false (retail), the channel is overwritten with value 0.

This overwrites the u16 field at [[#SecurityConfig]]+0. When the cached [[SPL_services#IsDevelopment|IsDevelopment]] value is false (retail), value 1 is used, otherwise the original value is used.

[[#GetState|State]] must be 2, this cmd eventually sets the State to value 3.

=== CreateNetworkPrivate ===
Takes an input [[#SecurityConfig]], a [[#SecurityParameter]], an [[#UserConfig]], a [[#NetworkConfig]], a type-0x9 input buffer containing an array of [[#AddressEntry]], no output.

The buffer/count for [[#AddressEntry]] can be 0, in which case the network will be non-Private like [[#CreateNetwork]]. The count must be <=8.

See [[#CreateNetwork]].

=== DestroyNetwork ===
No input/output.

[[#GetState|State]] must be 3, this cmd eventually sets the State to value 2.

=== Reject ===
Takes an input [[#Ipv4Address]], no output.

[[#GetState|State]] must be 3.

=== SetAdvertiseData ===
Takes a type-0x21 input buffer, no output.

The input buffer contains arbitrary user data.

The buffer size must be <=0x180. An empty buffer (addr=NULL/size=0) can be used to reset the AdvertiseData size in state to zero.

[[#GetState|State]] must be 2-3.

=== SetStationAcceptPolicy ===
Takes an input [[#AcceptPolicy]], no output.

[[#GetState|State]] must be 2-3.

=== AddAcceptFilterEntry ===
Takes an input [[#MacAddress|MacAddress]], no output.

There are two sdknso funcs implementing this: one which takes a [[#MacAddress|MacAddress]] directly, the other loads the [[#MacAddress|MacAddress]] from the input [[#NodeInfo|NodeInfo]].

[[#GetState|State]] must be 2-3.

=== ClearAcceptFilter ===
No input/output.

[[#GetState|State]] must be 2-3.

=== OpenStation ===
No input/output.

[[#GetState|State]] must be 1, this cmd eventually sets the State to value 4.

=== CloseStation ===
No input/output.

[[#GetState|State]] must be 4-5, this cmd eventually sets the State to value 1.

=== Connect ===
Takes a type-0x19 input buffer containing a [[#NetworkInfo]], a [[#SecurityConfig]], an [[#UserConfig]], a s32 LocalCommunicationVersion, a [[#ConnectOption]], no output.

[[#GetState|State]] must be 4, this cmd eventually sets the State to value 5.

This is identical to [[#ConnectPrivate]] (besides the below), except the data internally passed for [[#SecurityParameter]]/[[#NetworkConfig]] are loaded from the input [[#NetworkInfo]].

This overwrites the u16 field at [[#SecurityConfig]]+0. When the cached [[SPL_services#IsDevelopment|IsDevelopment]] value is false (retail), value 1 is used, otherwise the used value is: original_field == 0 ? {u16 [[#NetworkInfo]]+0x60} : original_field.

u32 LocalCommunicationVersion>>15 must be 0.

=== ConnectPrivate ===
Takes a [[#SecurityConfig]], [[#SecurityParameter]], an [[#UserConfig]], a s32 LocalCommunicationVersion, a [[#ConnectOption]], a [[#NetworkConfig]], no output.

See [[#Connect]].

This overwrites the u16 field at [[#SecurityConfig]]+0. When the cached [[SPL_services#IsDevelopment|IsDevelopment]] value is false (retail), value 1 is used, otherwise the original value is used.

=== Disconnect ===
No input/output.

[[#GetState|State]] must be 5, this cmd eventually sets the State to value 4.

=== InitializeSystem ===
Takes an input PID and an u64 pid_placeholder.

This is used immediately after object creation.

With [7.0.0+] [[#InitializeSystem2]] is used instead.

=== FinalizeSystem ===
No input/output.

This is used during service exit, prior to closing the object. Official sw will Abort if this fails.

If State is set for it, this will run the equivalent of [[#CloseAccessPoint]]/[[#CloseStation]] when needed.

[[#GetState|State]] must be non-zero, this cmd eventually sets the State to value 0.

=== SetOperationMode ===
Takes an input [[#OperationMode]], no output.

[[#GetState|State]] must be 1.

The input value is written into state.

=== InitializeSystem2 ===
Takes an input PID, an u32, and an u64 pid_placeholder.

Official sw uses hard-coded value 0x1 for the u32.

The input u32 is ignored, the impl for this cmd is identical to [[#InitializeSystem]].

Internally this calls a func with params: (..., PID, &{u16 value 0x38}). On success, this then calls another func (which sets two state fields to the input) with params: (state, 0) (these state fields are used during [[#Authentication]] to check which service is being used).

The first func uses various [[Network_Interface_services|nifm]] funcs. The input value is used to determine the value for [[Network_Interface_services#CreateRequest|nn::nifm::RequestParameters]]: essentially, value 0x4 is used for ldn:u, and value 0x8 is used for ldn:s. The input value is also copied into state.

[[#GetState|State]] must be 0, this cmd eventually sets the State to value 1.

= ldn:u =
This is "nn::ldn::detail::IUserServiceCreator".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#CreateUserLocalCommunicationService]]
|}

== CreateUserLocalCommunicationService==
Returns an [[#IUserLocalCommunicationService]].

The user-process closes the IUserServiceCreator object immediately after using this cmd. Official sw ignores errors from this cmd.

== IUserLocalCommunicationService ==
This is "nn::ldn::detail::IUserLocalCommunicationService".

This is identical to [[#ISystemLocalCommunicationService]], except for the System-only cmd(s), and [[#Initialize]]/[[#Initialize2]] differ.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#GetState]]
|-
| 1 || [[#GetNetworkInfo]]
|-
| 2 || [[#GetIpv4Address]]
|-
| 3 || [[#GetDisconnectReason]]
|-
| 4 || [[#GetSecurityParameter]]
|-
| 5 || [[#GetNetworkConfig]]
|-
| 100 || [[#AttachStateChangeEvent]]
|-
| 101 || [[#GetNetworkInfoLatestUpdate]]
|-
| 102 || [[#Scan]]
|-
| 103 || [[#ScanPrivate]]
|-
| 104 || [5.0.0+] [[#SetWirelessControllerRestriction]]
|-
| 200 || [[#OpenAccessPoint]]
|-
| 201 || [[#CloseAccessPoint]]
|-
| 202 || [[#CreateNetwork]]
|-
| 203 || [[#CreateNetworkPrivate]]
|-
| 204 || [[#DestroyNetwork]]
|-
| 205 || [[#Reject]]
|-
| 206 || [[#SetAdvertiseData]]
|-
| 207 || [[#SetStationAcceptPolicy]]
|-
| 208 || [[#AddAcceptFilterEntry]]
|-
| 209 || [[#ClearAcceptFilter]]
|-
| 300 || [[#OpenStation]]
|-
| 301 || [[#CloseStation]]
|-
| 302 || [[#Connect]]
|-
| 303 || [[#ConnectPrivate]]
|-
| 304 || [[#Disconnect]]
|-
| 400 || [[#Initialize]]
|-
| 401 || [[#Finalize]]
|-
| 402 || [7.0.0+] [[#Initialize2]]
|}

=== Initialize ===
Takes an input PID and an u64 pid_placeholder.

This is used immediately after object creation.

With [7.0.0+] [[#Initialize2]] is used instead.

This is identical to [[#InitializeSystem]] except different params are used for the funcs called internally.

=== Finalize ===
No input/output.

This is used during service exit, prior to closing the object. Official sw will Abort if this fails.

This is identical to [[#FinalizeSystem]].

=== Initialize2 ===
Takes an input PID, an u32, and an u64 pid_placeholder.

Official sw uses hard-coded value 0x1 for the u32.

The input u32 is ignored, the impl for this cmd is identical to [[#Initialize]].

This is identical to [[#InitializeSystem2]] except different params are used for the funcs called internally: the u16 value is 0x5A, and the value for the second func is 1.

= ndd =
This is "nn::ndd::IService".

This was added with [5.0.0] and removed with [6.0.0].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || EnableAutoCommunication
|-
| 1 || DisableAutoCommunication
|-
| 2 || IsAutoCommunicationEnabled
|-
| 3 || EnablePowerSave
|-
| 4 || DisablePowerSave
|-
| 5 || IsPowerSaveEnabled
|-
| 6 || IsNetworkActive
|-
| 7 || AcquireSendDataUpdateEvent
|-
| 8 || AddSendData
|-
| 9 || ClearSendData
|-
| 10 || GetSendData
|-
| 11 || AcquireReceiveDataEvent
|-
| 12 || GetCurrentReceiveDataCounter
|-
| 13 || GetOldestReceiveDataCounter
|-
| 14 || GetNextReceiveDataCounter
|-
| 15 || GetAvailableReceiveDataCount
|-
| 16 || GetRecentReceiveDataCounter
|-
| 17 || GetReceiveData
|-
| 18 || AddReceiveData
|-
| 19 || ClearReceiveData
|-
| 20 || ClearDataIdFilter
|-
| 21 || AcquireDeviceScanEvent
|-
| 22 || StartDeviceScan
|-
| 23 || CancelDeviceScan
|-
| 24 || GetDeviceScanResult
|}

= lp2p:app, lp2p:sys =
These are "nn::lp2p::detail::INetworkServiceCreator".

These were added with [9.0.0+].

lp2p:app is used by [[Mario Kart Live: Home Circuit]]. lp2p:sys is used by [[Album_Applet|LibraryAppletPhotoViewer]] with [11.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#CreateNetworkService]]
|-
| 8 || [[#CreateNetworkServiceMonitor]]
|}

== CreateNetworkService ==
Takes an input u32, an u64 pid_reserved, a PID, returns an output [[#INetworkService]].

The input u32 must be value 0x1.

== CreateNetworkServiceMonitor ==
Takes an input u64 pid_reserved, a PID, returns an output [[#INetworkServiceMonitor]].

== INetworkService ==
This is "nn::lp2p::detail::INetworkService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Initialize|Initialize]]
|-
| [9.0.0-9.0.1] 256 || [[#AttachNetworkInterfaceStateChangeEvent]]
|-
| [9.0.0-9.0.1] 264 || [[#GetNetworkInterfaceLastError]]
|-
| [9.0.0-9.0.1] 272 || [[#GetRole]]
|-
| [9.0.0-9.0.1] 280 || [[#GetAdvertiseData]]
|-
| [9.0.0-9.0.1] 288 || [[#GetGroupInfo]]
|-
| [9.0.0-9.0.1] 296 || [[#Join]]
|-
| [9.0.0-9.0.1] 304 || [[#GetGroupOwner]]
|-
| [9.0.0-9.0.1] 312 || [[#GetIpConfig]]
|-
| [9.0.0-9.0.1] 320 || [[#Leave]]
|-
| 512 || [[#Scan]]
|-
| 768 || [[#CreateGroup]]
|-
| 776 || [[#DestroyGroup]]
|-
| 784 || [[#SetAdvertiseData]]
|-
| 1536 || [[#SendToOtherGroup]]
|-
| 1544 || [[#RecvFromOtherGroup]]
|-
| 1552 || [[#AddAcceptableGroupId]]
|-
| 1560 || [9.1.0+] [[#RemoveAcceptableGroupId]]
|}

=== Initialize ===
No input/output.

Returns 0.

Unused by official sw.

=== Scan ===
Takes a type-0x19 input buffer containing a [[#GroupInfo]], a type-0x22 output buffer containing an array of [[#ScanResult]], returns an output s32 total_out.

=== CreateGroup ===
Takes a type-0x31 input buffer containing a [[#GroupInfo]], no output.

[[Mario Kart Live: Home Circuit|mklive]] uses the following string with this: "Failed to create a group: %08X".

The [[#GetRole|role]] must be 0. This eventually sets the [[#GetRole|role]] to value 1.

=== DestroyGroup ===
No input/output.

This destroys the previously [[#CreateGroup|created]] group. If no group was previously created ([[#GetRole|role]] is not 1), this just returns 0.

=== SetAdvertiseData ===
Takes a type-0x21 input buffer, no output.

The buffer size must be <=0x80. The [[#GetRole|role]] must be <=1.

A string in [[Mario Kart Live: Home Circuit|mklive]] refers to the buffer data as "scan advertise data".

=== SendToOtherGroup ===
Takes an input [[#MacAddress_2|MacAddress]], a [[#GroupId]], a s16 frequency, a s16 channel, an u32 flags, a type-0x21 input buffer, no output.

The buffer size must be <=0x400.

The MacAddress must be non-zero. The s16s must be >=1.

Only bit0 is used from flags: clear = block until the data can be sent, set = return error when the data can't be sent.

A string in [[Mario Kart Live: Home Circuit|mklive]] refers to the buffer data as "Action frame".

The [[#GetRole|role]] must be non-zero. The error from [[#GetNetworkInterfaceLastError]] will be returned if it's set.

[11.0.0+] [[#GroupInfo]]+0x8A must be value 2, otherwise an error is returned.

This sends an Action frame to the specified [[#GroupId]], with the specified destination [[#MacAddress_2|MacAddress]] (can be a broadcast address).

The frequency param is the same as the [[#GroupInfo]]+0x84 field.

=== RecvFromOtherGroup ===
Takes an input u32 flags, a type-0x22 output buffer, returns a [[#MacAddress_2|MacAddress]], an u16, a s16, an u32 out_size, a s32.

The out_size is the original size used for copying to the output buffer, before it's clamped to the output-buffer size.

Only bit0 is used from flags: clear = block until data is available, set = return error when data is not available.

When data is not available, the error from [[#GetNetworkInterfaceLastError]] will be returned if it's set.

The [[#GetRole|role]] must be non-zero.

This receives an Action frame.

=== AddAcceptableGroupId ===
Takes an input [[#GroupId]], no output.

=== RemoveAcceptableGroupId ===
No input/output.

== INetworkServiceMonitor ==
This is "nn::lp2p::detail::INetworkServiceMonitor".

This interface has no commands, until [9.1.0+] which added actual commands.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Initialize_2|Initialize]]
|-
| 256 || [[#AttachNetworkInterfaceStateChangeEvent]]
|-
| 264 || [[#GetNetworkInterfaceLastError]]
|-
| 272 || [[#GetRole]]
|-
| 280 || [[#GetAdvertiseData]]
|-
| 281 || [[#GetAdvertiseData2]]
|-
| 288 || [[#GetGroupInfo]]
|-
| 296 || [[#Join]]
|-
| 304 || [[#GetGroupOwner]]
|-
| 312 || [[#GetIpConfig]]
|-
| 320 || [[#Leave]]
|-
| 328 || [[#AttachJoinEvent]]
|-
| 336 || [[#GetMembers]]
|}

=== Initialize ===
Returns 0.

Unused by official sw.

=== AttachNetworkInterfaceStateChangeEvent ===
No input, returns an output Event handle with EventClearMode=0.

=== GetNetworkInterfaceLastError ===
No input/output.

=== GetRole ===
No input, returns an output u8.

=== GetAdvertiseData ===
Takes a type-0x22 output buffer, returns 2 output u16s.

Validates that the [[#GetRole|role]] is value 2, then copies data from state into the output buffer. The first output u16 is the size used for the memcpy, the second u16 is the original size from state.

=== GetAdvertiseData2 ===
Takes a type-0x22 output buffer, returns 2 output u16s.

This is identical to [[#GetAdvertiseData]] except this doesn't run the role validation.

=== GetGroupInfo ===
Takes a type-0x32 output buffer containing a [[#GroupInfo]].

Validates that the [[#GetRole|role]] is non-zero, then copies the struct from state into the output buffer.

=== Join ===
Takes a type-0x32 output buffer containing a [[#GroupInfo]] and a type-0x31 input buffer containing a [[#GroupInfo]].

This runs the same code as [[#CreateGroup]] to generate the [[#GroupInfo]] for the input struct (which with [[#CreateGroup]] would be available with [[#GetGroupInfo]]). The input struct is the same as [[#CreateGroup]].

=== GetGroupOwner ===
No input, returns an output 0x80-bytes [[#NodeInfo_2|NodeInfo]].

Validates that the [[#GetRole|role]] is non-zero, then copies the data from state to output.

=== GetIpConfig ===
Takes a type-0x1A output buffer containing a 0x100-byte struct.

Validates that the [[#GetRole|role]] is non-zero, then copies the struct from state into the output buffer.

+0x20 is the <code>struct sockaddr</code> IP address, +0x40 is the <code>struct sockaddr</code> subnet-mask, +0x60 is the <code>struct sockaddr</code> gateway(?). The address for the last one is set to localhost.

=== Leave ===
No input, returns an output u32.

=== AttachJoinEvent ===
No input, returns an output Event handle with EventClearMode=0.

=== GetMembers ===
Takes a type-0x22 output buffer containing an array of [[#NodeInfo_2|NodeInfo]], returns an output s32 total_out.

Validates that the [[#GetRole|role]] is value 1. Then any entries from state which are available are copied into the output array buffer, if there's space available. A maximum of 8 entries can be returned.

A string in [[Mario Kart Live: Home Circuit|mklive]] refers to the array data as "connected members".

= lp2p:m =
This is "nn::lp2p::detail::IMonitorServiceCreator".

This was added with [9.1.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#CreateMonitorService]]
|}

== CreateMonitorService ==
Takes a PID, a total of 0x10-bytes of input, and returns an [[#IMonitorService]].

== IMonitorService ==
This is "nn::lp2p::detail::IMonitorService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Initialize_3|Initialize]]
|-
| 288 || [[#GetGroupInfo]]
|-
| 320 || [[#Leave]]
|}

=== Initialize ===
Returns 0.

= Ipv4Address =
This is "nn::ldn::Ipv4Address". This is a 0x4-byte struct with 4-byte alignment.

This is essentially the same as <code>struct in_addr</code>, except this is little-endian.

This is generally "169.254.XXX.{...}", where XXX is random per created network.

= SubnetMask =
This is "nn::ldn::SubnetMask". This is a 0x4-byte struct with 4-byte alignment.

This is essentially the same as <code>struct in_addr</code>, except this is little-endian.

= Ssid =
This is "nn::ldn::Ssid".

When converting a Ssid to a string, the loaded chars from the string must be in the range of 0x20-0x7F, otherwise the byte written to the string will be 0.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || Length excluding NUL-terminator, must be 0x1-0x20.
|-
| 0x1 || 0x21 || SSID string including NUL-terminator, str[{above length}] must be 0.
|}

= NetworkInfo =
This is "nn::ldn::NetworkInfo". This is a 0x480-byte struct. The data at +0x50 is another struct.

The fields listed as Reserved (besides the fields before +0x10) are cleared during the memset and are not written to again afterwards, with cmds which return NetworkInfo.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || LocalCommunicationId
|-
| 0x8 || 0x2 || Reserved
|-
| 0xA || 0x2 || Arbitrary user data which can be used for filtering with [[#ScanFilter]].
|-
| 0xC || 0x4 || Reserved
|-
| 0x10 || 0x10 || Last 0x10-bytes of [[#SecurityParameter]]. NetworkId which is used to generate/overwrite the [[#Ssid]]. With [[#Scan]]/[[#ScanPrivate]], this is only done after filtering when +0x4B is value 0x2. The converted Ssid is a 0x20-byte lowercase hex string version of the input NetworkId.
|-
| 0x20 || 0x6 || [[#MacAddress|MacAddress]]
|-
| 0x26 || 0x22 || [[#Ssid]]
|-
| 0x48 || 0x2 || s16 NetworkChannel
|-
| 0x4A || 0x1 || s8 LinkLevel
|-
| 0x4B || 0x1 || Set to hard-coded value 0x2 with output structs, except with [[#Scan]]/[[#ScanPrivate]] which can also set value 0x1 in certain cases. 0x1 = normal network without an [[#ActionFrame]], 0x2 = LDN network with a valid [[#ActionFrame]].
|-
| 0x4C || 0x4 || Padding
|-
| 0x50 || 0x10 || First 0x10-bytes of [[#SecurityParameter]].
|-
| 0x60 || 0x2 || Same as [[#SecurityConfig]]+0x0.
|-
| 0x62 || 0x1 || [[#AcceptPolicy]]
|-
| 0x63 || 0x1 || Only set with [[#Scan]]/[[#ScanPrivate]], when +0x4B is value 0x2. See [[#ActionFrame]].
|-
| 0x64 || 0x2 || Padding
|-
| 0x66 || 0x1 || Maximum participants, for the [[#NodeInfo|NodeInfo]] array.
|-
| 0x67 || 0x1 || ParticipantNum, number of set entries in the [[#NodeInfo|NodeInfo]] array. If +0x4B is not 0x2, ParticipantNum should be handled as if it's 0.
|-
| 0x68 || 0x200(0x40*8) || Array of [[#NodeInfo|NodeInfo]] with 8 entries, starting with the AccessPoint node.
|-
| 0x268 || 0x2 || Reserved
|-
| 0x26A || 0x2 || AdvertiseData size
|-
| 0x26C || 0x180 || AdvertiseData
|-
| 0x3EC || 0x8C || Reserved
|-
| 0x478 || 0x8 || [6.0.0+] Random AuthenticationId. Set to the output from [[ETicket_services|es]] cmd1501 during network creation.
|}

= ScanFilter =
This is "nn::ldn::ScanFilter". This is a 0x60-byte struct with 8-byte alignment.

sdknso copies the input ScanFilter to a tmp struct on stack, which is then used with the cmd.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || When enabled, this will be overwritten if it's -1. The data written for this is the first [[NACP_Format|LocalCommunicationId]] for the user-process loaded via [[Glue_services|arp:r]], if loading fails value 0 is written instead. During filtering if enabled, u8 [[#NetworkInfo]]+0x4B must match 0x2, and this ScanFilter field must match [[#NetworkInfo]]+0x0.
|-
| 0x8 || 0x2 || Padding
|-
| 0xA || 0x2 || During filtering if enabled, u8 [[#NetworkInfo]]+0x4B must match 0x2, and this ScanFilter field must match [[#NetworkInfo]]+0xA.
|-
| 0xC || 0x4 || Padding
|-
| 0x10 || 0x10 || During filtering if enabled, u8 [[#NetworkInfo]]+0x4B must match 0x2, and this ScanFilter data must match [[#NetworkInfo]]+0x10.
|-
| 0x20 || 0x4 || When enabled, must be <=0x3, and during filtering must match u8 [[#NetworkInfo]]+0x4B.
|-
| 0x24 || 0x6 || [[#MacAddress|MacAddress]]. Only copied with [[#ScanPrivate]]. During filtering if enabled, this must match [[#NetworkInfo]]+0x20.
|-
| 0x2A || 0x22 || [[#Ssid]]. During filtering if enabled, this must match [[#NetworkInfo]]+0x26 (the [[#Ssid]] there must be valid for this as well). The strings are compared, without verifying the length field in [[#Ssid]] matches.
|-
| 0x4C || 0x10 || Cleared to zero for the tmp struct.
|-
| 0x5C || 0x4 || Flags. Masked with 0x37 for [[#Scan]], with [[#ScanPrivate]] this is masked with 0x3F.
|}

Flags:

{| class="wikitable" border="1"
|-
! Bit
! Description
|-
| 0 || When set, enables using ScanFilter+0.
|-
| 1 || When set, enables using ScanFilter+0x10.
|-
| 2 || When set, enables using ScanFilter+0x20.
|-
| 3 || When set, enables using the ScanFilter [[#MacAddress|MacAddress]].
|-
| 4 || When set, enables using the ScanFilter [[#Ssid]].
|-
| 5 || When set, enables using ScanFilter+0xA.
|}

= NetworkConfig =
This is "nn::ldn::NetworkConfig". This is a 0x20-byte struct with 8-byte alignment.

sdknso copies the input NetworkConfig to a tmp struct on stack, which is then used with the cmd ([[#CreateNetwork]], [[#CreateNetworkPrivate]], [[#ConnectPrivate]]).

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || LocalCommunicationId. Same as [[#NetworkInfo]]+0x0. [[#CreateNetwork]]/[[#CreateNetworkPrivate]]/[[#Connect]]/[[#ConnectPrivate]]: When -1, this is overwritten with the first [[NACP_Format|LocalCommunicationId]] for the user-process loaded via [[Glue_services|arp:r]], if loading fails value 0 is written instead. Otherwise when not -1, if control.nacp loading is successful with [[Glue_services|arp:r]], this field must match one of the LocalCommunicationIds from there otherwise an error is thrown.
|-
| 0x8 || 0x2 || Cleared to zero during the copy.
|-
| 0xA || 0x2 || Same as [[#NetworkInfo]]+0xA.
|-
| 0xC || 0x4 || Cleared to zero during the copy.
|-
| 0x10 || 0x2 || s16 Channel, can be zero. Same as [[#NetworkInfo]]+0x48.
|-
| 0x12 || 0x1 || s8. Same as [[#NetworkInfo]]+0x66. [[#CreateNetwork]]/[[#CreateNetworkPrivate]]: Must be 0x1-0x8.
|-
| 0x13 || 0x1 || Cleared to zero during the copy.
|-
| 0x14 || 0x2 || Same as [[#NetworkInfo]]+0x96 (LocalCommunicationVersion from the first [[#NodeInfo|NodeInfo]]). Must not be negative. [[#Connect]]/[[#ConnectPrivate]]: This must match the value for the AccessPoint LocalCommunicationVersion.
|-
| 0x16 || 0xA || Cleared to zero during the copy.
|}

= NodeLatestUpdate =
This is "nn::ldn::NodeLatestUpdate". This is a 0x8-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || The field in state is reset to zero by [[#GetNetworkInfoLatestUpdate]] after loading it. Official apps checks whether this is non-zero.
|-
| 0x1 || 0x7 || Not initialized with [[#GetNetworkInfoLatestUpdate]].
|}

= WirelessControllerRestriction =
This is "nn::ldn::WirelessControllerRestriction". This is an u32 enum.

This is used to determine the value passed to [[BTM_services|btm]] SetWlanMode.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 ||
|-
| 1 || This is the default.
|}

= SecurityConfig =
This is "nn::ldn::SecurityConfig". This is a 0x44-byte struct with 2-byte alignment.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x2 || Type, a default of value 1 can be used here. Overwritten by [[#CreateNetwork]]/[[#CreateNetworkPrivate]] and [[#Connect]]/[[#ConnectPrivate]]. The value used internally by these cmds must be 1-3.
|-
| 0x2 || 0x2 || Data size. Must be 0x10-0x40.
|-
| 0x4 || 0x40 || Data, used with key derivation.
|}

Type:
* 1-2: Broadcast Action frame data is encrypted and is verified with SHA256.
* 3: Broadcast Action frame data is plaintext and is verified with SHA256.

* 1: Data frames are encrypted.
* 2-3: Data frames for normal data-transfer are plaintext - the network is Open.

= SecurityParameter =
This is "nn::ldn::SecurityParameter". This is a 0x20-byte struct with 1-byte alignment.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x10 || Data, used with the same key derivation as [[#SecurityConfig]].
|-
| 0x10 || 0x10 || NetworkId, see [[#NetworkInfo]].
|}

= UserConfig =
This is "nn::ldn::UserConfig". This is a 0x30-byte struct with 1-byte alignment.

sdknso copies the input UserConfig to a tmp struct on stack, which is then used with the cmd.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x20 || NUL-terminated string for the user nickname.
|-
| 0x20 || 0x10 || Cleared to zero during the copy.
|}

= AddressEntry =
This is "nn::ldn::AddressEntry". This is a 0xC-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || [[#Ipv4Address]]
|-
| 0x4 || 0x6 || [[#MacAddress|MacAddress]]
|-
| 0xA || 0x2 || Padding
|}

= AcceptPolicy =
This is "nn::ldn::AcceptPolicy". This is an u8.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || Allow all.
|-
| 1 || Deny all.
|-
| 2 || Blacklist, addresses in the [[#AddAcceptFilterEntry|list]] are not allowed.
|-
| 3 || Whitelist, only addresses in the [[#AddAcceptFilterEntry|list]] are allowed.
|}

= MacAddress =
This is "nn::ldn::MacAddress". This is a 6-byte struct with 1-byte alignment.

= NodeInfo =
This is "nn::ldn::NodeInfo".

The fields listed as Reserved are cleared during the memset and are not written to again afterwards, with cmds which return [[#NetworkInfo]].

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || [[#Ipv4Address]]
|-
| 0x4 || 0x6 || [[#MacAddress|MacAddress]]
|-
| 0xA || 0x1 || s8 ID / index
|-
| 0xB || 0x1 || IsConnected
|-
| 0xC || 0x20 || First 0x20-bytes of [[#UserConfig]].
|-
| 0x2C || 0x2 || Reserved
|-
| 0x2E || 0x2 || s16 LocalCommunicationVersion
|-
| 0x30 || 0x10 || Reserved
|}

= ConnectOption =
This is "nn::ldn::ConnectOption". This is an u32 bitmask.

There's two versions of the sdknso funcs for [[#Connect]]/[[#ConnectPrivate]]: the version where the ConnectOption isn't user-specified uses a default value of 0x1 for it, with the same ShowError code without the bit0 check.

When bit0 here is set after using the above cmds, the sdknso funcs will use [[Error_Applet|ShowError]] with the returned Result if: (rc & 0x3FE1FF) == 0xE0CB.

This must be <=0x1, besides this validation ConnectOption is ignored by [[#Connect]]/[[#ConnectPrivate]].

= OperationMode =
This is "nn::ldn::OperationMode". This is an u32 enum.

This controls bit1 in the value passed to [[WLAN_services|wlan:lcl]] cmd0/cmd1: bit1 = OperationMode==1.

Value 1 seems to affect power (?) related fields in the beacon tags?

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || This is the default.
|-
| 1 ||
|}

= MacAddress =
This is "nn::lp2p::MacAddress". Same as [[#MacAddress|MacAddress]].

= GroupId =
This is "nn::lp2p::GroupId". This is a 6-byte struct with 1-byte alignment.

This is a WiFi BSSID.

= NodeInfo =
This is "nn::lp2p::NodeInfo". This is a 0x80-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || || <code>struct sockaddr</code> for the IP address.
|-
| 0x24 || 0x6 || [[#MacAddress_2|MacAddress]]
|}

= GroupInfo =
This is "nn::lp2p::GroupInfo". This is a 0x200-byte struct.

[[Mario Kart Live: Home Circuit|mklive]] sets the SSID to a string generated from random data.

[[#Scan_2|Scan]] only uses the following fields for the cmd input struct: SupportedPlatform/Priority, Frequency/Channel, and PresharedKeyBinarySize/PresharedKey.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x10 || When zero, this is set to randomly-generated data. Used during key derivation.
|-
| 0x10 || 0x8 || LocalCommunicationId. When zero, the value from control.nacp is loaded. This is later validated by [[#Join]]/[[#CreateGroup]] the same way as the [[#NetworkConfig]] field. Used during key derivation.
|-
| 0x18 || 0x6 || [[#GroupId]] ("GROUP ID (BSSID)"). When zero, the default is used. The default should be used here: an error is thrown if the data here doesn't match the output from [[WLAN_services|wlan:lcl]] cmd2.
|-
| 0x1E || 0x21 || ServiceName ("GROUP NAME (SSID)"). NUL-terminated string. See below.
|-
| 0x3F || 0x1 || s8 Flags count. Must be <=0x3F.
|-
| 0x40 || 0x40 || Array of s8 with the above count. Each entry value must be <=0x3F. Each entry is an array index used to load a set of flags from a global array with the specified index. global_flags are also masked with flags loaded from here. User-processes use entryval=1 as the default, with [11.0.0+] entryval=0 can be used for standard WPA2-PSK (see +0x8A).
|-
| 0x80 || 0x1 || SupportedPlatform. Must match value 1. 0 is PlatformIdNX, 1 is PlatformIdFuji.
|-
| 0x81 || 0x1 || MemberCountMax. s8, Must be <=0x8. During group creation this is passed to [[WLAN_services|wlan:lcl]] cmd40, when this is value 0 a default of value 1 is passed. During group-creation when the below +0x88 field is not value 0x2, the passed [[BTM_services#SetWlanMode|WlanMode]] is <code>x81_field_val > 3</code>.
|-
| 0x82 || 0x1 ||
|-
| 0x84 || 0x2 || Frequency. Wifi frequency: 24 = 2.4GHz, 50 = 5GHz.
|-
| 0x86 || 0x2 || s16 Channel ("CHANNEL"). Wifi channel number. 0 = use default, otherwise this must be one of the following depending on the frequency field:
* 24: 1, 6, 11.
* 50: 36, 40, 44, 48.
|-
| 0x88 || 0x1 || NetworkMode. Used during group-creation to determine the [[BTM_services#SetWlanMode|WlanMode]] to use. When this is value 0x2, mode=3 is used, otherwise it's determined via the +0x81 field.
|-
| 0x89 || 0x1 || PerformanceRequirement.
|-
| 0x8A || 0x1 || Security type, used during key derivation. 0 = use defaults, 1 = plaintext, 2 = encrypted. [11.0.0+] 3: Standard WPA2-PSK.
|-
| 0x8B || 0x1 || StaticAesKeyIndex. s8, used as the array-index for selecting the KeySource used with [[SPL_services#GenerateAesKek|GenerateAesKek]] during key derivation. Should be 1-2, otherwise GenerateAesKek is skipped and zeros are used for the AccessKey instead.
|-
| 0x8D || 0x1 || Priority. Must match one of the following, depending on the used service (doesn't apply to [[#Join]]): 55 = SystemPriority (lp2p:sys), 90 = ApplicationPriority (lp2p:app and lp2p:sys).
|-
| 0x8E || 0x1 || StealthEnabled. Bool flag, controls whether the SSID is hidden.
|-
| 0x8F || 0x1 || If zero, a default value of 0x20 is used.
|-
| 0x1C0 || 0x1 || PresharedKeyBinarySize. Must be 0x20 for PresharedKeyBinary. [11.0.0+] With WPA2-PSK, this must be value 1.
|-
| 0x1C1 || 0x3F ([9.0.0-10.2.0] 0x20) || PresharedKey. Used during key derivation. [11.0.0+] With WPA2-PSK, this is the passphrase string (length must be at least 8).
|}

In order for the ServiceName to be valid without a new one being generated, the following checks must pass:
* It loops through the characters in the string, looking for the first '_' character:
** The loop will exit once a '_' character is found.
** The character must be '-', or alphanumeric (lowercase/uppercase), otherwise the function will immediately return failure.
** The loop will also exit once string_pos is >19, in which case the function will also immediately return failure.
* Then it checks the 11 characters which follow the above:
** The character must be hex: '0'-'9', or 'A-F' / 'a-'f.
* The following character must be a NUL-terminator.
* The last hex character above, then the characters for the whole string prior to the last hex character are summed. return sum % 0x2B == 0. u32 is used for these calculations. (Return success when sum is a multiple of 0x2B, otherwise return failure)

If the above fails, then the following runs, otherwise it just returns 0:
* It loops through the characters in the string.
** The character must be '-', or alphanumeric (lowercase/uppercase), otherwise the function will immediately return failure.
** The loop will exit once string_pos>20 is reached, or when a NUL-terminator is reached.
* Once finished, success is returned if string_pos-1 is <20, otherwise failure is returned (which also immediately occurs if the first character is a NUL-terminator).

If the above fails, an error is returned, otherwise a new ServiceName is generated:
* Up to 20 characters are copied from the original ServiceName to the output ServiceName, stopping once the limit is reached or when a NUL-terminator is reached.
* '_' is appended to the string.
* <code>nn::util::TSNPrintf({strptr following the above character}, {remaining size}, "%02X%02X%02X%02X%02X", [[#GroupId|GroupId_byte3]], [[#GroupId|GroupId_byte4]], [[#GroupId|GroupId_byte5]], ([[SPL_services#IsDevelopment|IsDevelopment]] ? 0x80 : 0) | 0x1, 0);</code>
* Then the last character is set to the output from a calling a function:
** All string characters which were already written are summed same way as above. Then: <code>return character_lookup_table[sum % 0x2B];</code> (If the length passed to this function is 0, this will instead just return character_lookup_table[0])
*** character_lookup_table contains 0x2B entries: [V-A][k-a][5-0][Z-W].

loaded_flags are first loaded from elsewhere, then masked with the above flags when available. loaded_flags are used when +0x8A is 0. global_flags are loaded from global data. These flags are only used with [[#CreateGroup]]/[[#Join]]. Flags (note that the following was updated with [11.0.0+], and differs from below):
* Bit2 clear:
** global_flags must be non-zero, and loaded_flags bit1 must be set.
** u8 +0x8A is set to value 1.
** When the cached [[SPL_services#IsDevelopment|IsDevelopment]] value is false (retail), an error is thrown.
** u8 +0x8B is set to value 0.
* Otherwise, if bit2 is set:
** u8 +0x8A is set to value 2.
** global_flags bit1 set:
*** u8 +0x8B is set to value 1.
** Otherwise, if global_flags bit2 is set:
*** u8 +0x8B is set to value 2.

= ScanResult =
This is "nn::lp2p::ScanResult". This is a 0x300-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x200 || [[#GroupInfo]]
|-
| 0x200 || 0x1 ||
|-
| 0x206 || 0x2 || AdvertiseData size.
|-
| 0x208 || 0x80 || AdvertiseData
|}

= Network protocol =
== ldn ==
A beacon and Action frame are broadcasted. The SSID in the beacon is hidden (32-bytes with value 0). For [[#Scan]]/[[#ScanPrivate]] it doesn't matter if no beacon is available ([[#NetworkInfo]] is the same), as long as the Action frame is broadcasted. However, the Station will not send a probe-request during connection if no beacon is available (and therefore not attempt any communication with the AccessPoint). The beacon doesn't have any custom Nintendo data, that data is in the Acton frame.

During connection, the Station first sends a probe-request using the [[#NetworkInfo|generated]] SSID from the Action frame. If the probe-response contains the expected data for the [[#SecurityConfig]] type, the Station then proceeds to connect to the AccessPoint. The key for data-frames, if [[#SecurityConfig|enabled]], is derived from a buffer containing: {[[#SecurityParameter]]+0x0} followed by {[[#SecurityConfig]] data with the specified data-size}. The [[#ActionFrame]]/data-frame keys are derived with the same func, the only difference is the input passed to this func + the passed constant data. The key derived by ldn is used directly as the static CCMP key for all data-frames (CCMP / MIC is standard).

Then the Station scans for an [[#ActionFrame]] for loading the [[#NetworkInfo]].

Once connected, the AccessPoint sends Epigram-vendor Action frame(s) (same data) to the Station, the Station doesn't require these frames: <code>dd1afeedfacedeadbeef010000000a00000000000000000000000000</code>. Then the Station must Authenticate with the AccessPoint, this is custom. The Station sends a frame (a maximum of 3 times in some cases if errors occur, with the same data), and the AccessPoint sends a response. Once Authenticated, the node is added to the [[#NodeInfo|NodeInfo]] array in [[#NetworkInfo]]. If the Station does not successfully Authenticate X-seconds after connecting, the AccessPoint disconnects the Station. If the Station fails to Authenticate, the Station itself will disconnect as well.

After Authentication the Station will scan for another [[#ActionFrame]], with frame-comparision enabled with the above frame (frame must have been updated since the previous scan). The Station locates the index for a [[#MacAddress|MacAddress]] matching itself in the [[#NetworkInfo]] [[#NodeInfo|NodeInfo]] array (the entry for the AccessPoint is skipped), throwing an error if not found. After validating the LocalCommunicationVersion, it proceeds to handle ARP setup below.

This does not use DHCP, each node on the network has to manually setup ARP (without sending ARP network requests) with the [[#NodeInfo|NodeInfo]] array in [[#NetworkInfo]].

At this point standard sockets can be used over Data frames.

=== EthFrame ===
The custom Ethernet frames have the following structure:
* "Type: IEEE 802a OUI Extended Ethertype (0x88b7)"
* "IEEE802a OUI Extended Ethertype":
** "Organization Code: 00:22:aa (Nintendo Co., Ltd.)"
** "Protocol ID: {...}"
*** Depends on the frame:
*** 0x0102: [[#Authentication]]
*** 0x0103: ?
* The first byte of Data is value 0, then the ProtocolID-specific data follows, see below.
** ProtocolID 0x0103 frames are sent by the AccessPoint to the Station. This is 0x20-bytes of zeros, except for the first byte which is 0x3. This is sent by the AccessPoint prior to destroying the network.

==== Authentication ====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || [[#AuthVersion]]
|-
| 0x1 || 0x1 || Low u8 for the size.
|-
| 0x2 || 0x1 || Status. 0 = success, non-zero = error.
|-
| 0x3 || 0x1 || [2.0.0+] bool flag. The AccessPoint verifies that this is not set. Always set to 1 by the AccessPoint in the response. The Station only uses this when the [[#AuthVersion]] is >=2.
|-
| 0x4 || 0x1 || [6.0.0+] High u8 for the size.
|-
| 0x5 || 0x3 || Unused, zeros.
|-
| 0x8 || 0x20 || [[#NetworkInfo]]+0, must match the corresponding data in [[#NetworkInfo]] when the receiving node verifies this. With the
AccessPoint->Station frame, the Station verifies that this matches the data previously sent to the AccessPoint.
|-
| 0x28 || 0x10 || [[#NetworkInfo]]+0x50, must match the corresponding data in [[#NetworkInfo]] when the receiving node verifies this. With the
AccessPoint->Station frame, the Station verifies that this matches the data previously sent to the AccessPoint.
|-
| 0x38 || 0x10 || See below.
|-
| 0x48 || || Frame-specific data, with the above size. The total frame size - {offset of the start of this data in the frame} must match the above size.
|}

The Station sets the above size to 0x40 ([6.0.0+] if [[#NetworkInfo]]+0x13 is <3). [6.0.0+] The Authentication challenge is only used/enabled if that value is >=3, and [[#IUserLocalCommunicationService]] is being used.

The AccessPoint sets the above size to 0x40 ([6.0.0+] 0x0 if the +0x0 [[#AuthVersion]] is <3). [6.0.0+] The AccessPoint will only use/enable the Authentication challenge when the +0x0 [[#AuthVersion]] is >=3, and [[#IUserLocalCommunicationService]] is being used. This data will not be included in the frame if the status field indicates error.

[6.0.0+] Support for the Authentication challenge with [[ETicket_services|es]] cmds 1501-1504 was added.

Station->AccessPoint frame, relative to +0x0 above (frame size depends on whether +0xAC is enabled):

The AccessPoint will not respond to frames where the source mac-address is unrecognized.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x38 || 0x10 || The Station sets this to random data. Unused by the AccessPoint, except for copying into the response.
|-
| 0x48 || 0x20 || [[#UserConfig]]+0. Copied into state by the AccessPoint.
|-
| 0x68 || 0x2 || Big-endian LocalCommunicationVersion. Byte-swapped by the AccessPoint then copied into state.
|-
| 0x6A || 0x1E || Zeros, unused by the AccessPoint.
|-
| 0x88 || 0x24 || [6.0.0+] Zeros, unused by the AccessPoint.
|-
| 0xAC || 0x300 || [6.0.0+] Authentication challenge data. If enabled, the total frame size must be >= {end offset of this data in the frame}. The frame data does not include this if it's not enabled.
|}

AccessPoint->Station response frame, relative to +0x0 above (frame size depends on whether +0x48/+0xCC are enabled):

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x38 || 0x10 || +0x38 from the data originally sent by the Station. The Station verifies that this matches the previously sent data.
|-
| 0x48 || 0x40 || Zeros. [6.0.0+] Only included in the frame if it's enabled (+0x0 [[#AuthVersion]] >= 3). Unused by the Station.
|-
| 0x88 || 0x44 || [6.0.0+] Only included in the frame if it's enabled (+0x0 [[#AuthVersion]] >= 3). Unused by the Station.
|-
| 0xCC || 0x100 || [6.0.0+] If enabled, Authentication challenge response data. Not included in the frame if it's not enabled.
|}

===== AuthVersion =====
Must be 0x1-0xF.

{| class="wikitable" border="1"
|-
! Value || SystemVersion
|-
| 1 || [1.0.0+]
|-
| 2 || [2.0.0+]
|-
| 3 || [6.0.0+]
|}

=== ActionFrame ===
The Action frames have the following structure:
* "Fixed parameters":
** "Category code: Vendor Specific (127)"
** "OUI: 00:22:aa (Nintendo Co., Ltd.)"
* The Data starts with the following header:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x2 || 04 00 in sent frames.
|-
| 0x2 || 0x2 || Protocol ID, must be 0x0101.
|-
| 0x4 || 0x2 || Must be 0.
|-
| 0x6 || 0x2 || Zeros, unused.
|}

Then the actual data follows:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x20 || [[#NetworkInfo]]+0x0. The u64/u16 are big-endian. Outside of [[#Scan]]/[[#ScanPrivate]], this must match the previously loaded data for this.
|-
| 0x20 || 0x1 || [[#AuthVersion]]. Copied to [[#NetworkInfo]]+0x63. When comparing with a previous frame is enabled, this must match the value from the previous frame.
|-
| 0x21 || 0x1 || Encryption type: 1 = plaintext, 2 = encrypted, {frames with other values are ignored by [[#Scan]]/[[#ScanPrivate]]}. Must match the type which is currently being used: with [[#Scan]]/[[#ScanPrivate]] this is determined via this field, otherwise [[#SecurityConfig]] is used to determine this.
|-
| 0x22 || 0x2 || Big-endian u16 size for the data starting at +0x48, must be <=0x500, and must match {total frame size relative to +0x0 above} + 0x48.
|-
| 0x24 || 0x4 || Big-endian u32 Counter. The initial value is randomly-generated. This is incremented each time the below content is updated (including initial creation). Also used by the Station to determine whether the frame changed compared to a previous one. When comparing against a previous frame, new_counter-prev_counter must be <= 0xFF, and the counters must not match.
|-
| 0x28 || 0x20 || SHA256 hash over the entire frame starting at +0x0, with the above size + 0x48. During hashing, this hash is cleared, with the new hash overwriting the original in memory (the original is copied to stack for comparing).
|}

When encryption is enabled, the encrypted data is +0x28 with size {remaining frame size}. This is encrypted with AES-128-CTR. The key is derived from the raw 0x20-bytes at +0x0. The CTR is {raw Counter above without byte-swap}, with the rest cleared to zeros.

The content data at +0x48 follows, which has the size specified above (which must be >=0x500), where all fields are big-endian:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x10 || [[#NetworkInfo]]+0x50
|-
| 0x10 || 0x2 || [[#NetworkInfo]]+0x60
|-
| 0x12 || 0x1 || [[#NetworkInfo]]+0x62
|-
| 0x13 || 0x3 || Unused
|-
| 0x16 || 0x1 || s8 [[#NetworkInfo]]+0x66, clamped to range 1-8.
|-
| 0x17 || 0x1 || s8 [[#NetworkInfo]]+0x67, clamped to range 1-8.
|-
| 0x18 || 0x1C0(0x38*8) || Array of the below node struct.
|-
| 0x1D8 || 0x2 || Unused
|-
| 0x1DA || 0x2 || [[#NetworkInfo]]+0x26A
|-
| 0x1DC || 0x180 || [[#NetworkInfo]]+0x26C
|-
| 0x35C || 0x19C || Unused
|-
| 0x4F8 || 0x8 || [6.0.0+] [[#NetworkInfo]]+0x478
|}

The data here is copied into [[#NetworkInfo]].

Node data used in the above array (all fields big-endian), which are copied into the [[#NetworkInfo]] [[#NodeInfo|NodeInfo]] array:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || [[#Ipv4Address]]
|-
| 0x4 || 0x6 || [[#MacAddress|MacAddress]]
|-
| 0xA || 0x1 || bool IsConnected
|-
| 0xB || 0x1 || Unused
|-
| 0xC || 0x20 || First 0x20-bytes of [[#UserConfig]].
|-
| 0x2C || 0x2 || s16 LocalCommunicationVersion
|-
| 0x2E || 0xA || Unused
|}

== lp2p ==
This is used for communicating with accessories (external devices on [11.0.0+]) over local wifi. [[Mario Kart Live: Home Circuit]] uses this. [11.0.0+] [[Album_Applet|LibraryAppletPhotoViewer]] uses this.

A beacon is broadcasted.

Action frames are only sent when done so by [[#SendToOtherGroup]] (other than the Epigram one mentioned below).

Communication uses sockets with standard Data frames and the above Action frames. Switch consoles presumably only use the Action frames to communicate with each other?

The key derived by ldn-sysmodule is used directly as the static CCMP key for all data-frames (CCMP / MIC is standard). However, with [[#GroupInfo]]+0x8A value 3, standard WPA2-PSK is used instead.

This uses infrastructure-mode (AccessPoint), and DHCP is used. The group-owner is the AccessPoint. Note that the probe response includes the same Nintendo tags included with the beacon. Once connected, the group-owner sends the same Epigram-vendor Action frame(s) described in [[#ldn]]. At this point socket communication can begin, including DHCP usage.

The DHCP server thread is started by the "nn.lp2p.StateMachine" thread eventually during group [[#CreateGroup|creation]]. The DHCP Offer option values are the following:
* "Subnet Mask: 255.255.255.0"
* "DHCP Server Identifier: {...}"
* "Broadcast Address: {...}"
* "IP Address Lease Time: (5s) 5 seconds"
* "Renewal Time Value: (0s) 0 seconds"
* "Rebinding Time Value: (0s) 0 seconds"
* "Interface MTU: 1500"

Note that the above options doesn't include "Domain Name Server" or "Router", the client device may fail to connect if it doesn't allow those DHCP options to be missing.

=== Beacon ===
The SSID in the beacon can optionally be [[#GroupInfo|hidden]] (all-zero with the same length as the original SSID). The beacon contains two vendor-specific Nintendo information elements with OUI <code>00:22:aa</code>; each IE has a 2-byte ID following the OUI. These Nintendo IEs are not used when standard WPA2-PSK is being used.

The beacon is identical to ldn, except for the following (besides SSID length difference and the lp2p-only Nintendo tags):
* "Tag: Traffic Indication Map (TIM)": "DTIM count" for lp2p is 1, with ldn it's 0.
* "Tag: HT Capabilities (802.11n D1.10)": "HT Short GI for 20MHz" is set to "Not supported", for ldn it's "Supported".
* "Tag: Vendor Specific: Microsoft Corp.: WMM/WME: Parameter Element" "Ac Parameters ACI 0": "CW Min: 15" for lp2p, "CW Min: 63" for ldn.

Note that during group creation the beacon may be missing the Nintendo IEs in some cases, since group creation didn't finish yet.

==== Nintendo IE 0 ====

The first Nintendo IE (ID 0x0600) contains the following fixed parameters:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || Fixed 0x20; perhaps a version or other magic number.
|-
| 0x1 || 0x1 || [[#GroupInfo|SecurityType]]
|-
| 0x2 || 0x1 || [[#GroupInfo|StaticAesKeyIndex]]
|-
| 0x3 || 0x1 || Fixed zero; padding byte.
|-
| 0x4 || 0x8 || Big-endian (i.e. byte-reversed) version of [[#GroupInfo|LocalCommunicationId]]. This is the only context where LocalCommunicationId is reversed.
|-
| 0xC || 0x10 || Wrapped master key. Same as [[#GroupInfo]]+0x0.
|-
| 0x1C || 0x4 || If encryption is enabled, a randomly-generated nonce, else nothing. Appending 8 zero bytes to this yields the AES-GCM IV.
|-
| 0x20 || 0x10 || If encryption is enabled, the AES-GCM MAC tag, else nothing. All bytes prior to this (fixed 0x20 through nonce) are the additional authenticated data. All bytes after this are encrypted with key B.
|}

After this, TLV tagged parameters occur. Each TLV tag is formatted as:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || Tag type
|-
| 0x1 || 0x1 || Length
|-
| 0x2 || {above size} || Data for the tag
|}

Known TLV tags:

{| class="wikitable" border="1"
|-
! Type
! Size
! Description
|-
| 0x1 || 0x2 || Additional network parameters: 0xAB 0xCD. A=[[#GroupInfo]]+0x82, B=[[#GroupInfo|MemberCountMax]], C=[[#GroupInfo|NetworkMode]], D=[[#GroupInfo|PerformanceRequirement]].
|-
| 0x2 || 0x8 || Flags: Bitwise-or of (1<<f) for each entry in [[#GroupInfo]]+0x40
|}

==== Nintendo IE 1 ====

The second Nintendo IE (ID 0x0601) contains only TLVs. If encryption is enabled, a 0x4-byte nonce and 0x10-byte AES-GCM tag are written first, as above, and the TLVs are encrypted. Key C is used.

Known TLV tags:

{| class="wikitable" border="1"
|-
! Type
! Size
! Description
|-
| 0x21 || Varies || AdvertiseData
|}

=== ActionFrame ===
The Action frames have the following structure:
* "Fixed parameters":
** "Category code: Vendor Specific (127)"
** "OUI: 00:22:aa (Nintendo Co., Ltd.)"
* The Data starts with the following:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x2 || Usually 06 00?
|-
| 0x2 || 0x2 || Usually 20 02?(Second byte depends on whether encryption is used?)
|-
| 0x4 || 0x2 || Usually 02 00?(varies)
|-
| 0x6 || 0x8 || Big-endian version of [[#GroupInfo]]+0x10.
|-
| 0xE || 0x10 || Same as [[#GroupInfo]]+0x0.
|}

When encryption is used, the remaining data is:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || Big-endian u32 Counter. The initial value is randomly-generated (?). This is incremented with each sent Action frame.
|-
| 0x4 || {remaining size} || Encrypted user-data. Also includes 0x10-bytes of unknown data.
|}

When plaintext is used, the remaining data is:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || {remaining size} || Plaintext user-data.
|}

[[Category:Services]]

LDN services

2021-01-29T19:01:49Z

CFSworks: /* Beacon */ 802.11-ify some of the language ("tag" -> "information element")

LDN handles all local network communication.

= ldn:m =
This is "nn::ldn::detail::IMonitorServiceCreator".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#CreateMonitorService]]
|}

== CreateMonitorService ==
Returns an [[#IMonitorService]].

The user-process closes the IMonitorServiceCreator object immediately after using this cmd.

== IMonitorService ==
This is "nn::ldn::detail::IMonitorService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#GetStateForMonitor]]
|-
| 1 || [[#GetNetworkInfoForMonitor]]
|-
| 2 || [[#GetIpv4AddressForMonitor]]
|-
| 3 || [[#GetDisconnectReasonForMonitor]]
|-
| 4 || [[#GetSecurityParameterForMonitor]]
|-
| 5 || [[#GetNetworkConfigForMonitor]]
|-
| 100 || [[#InitializeMonitor]]
|-
| 101 || [[#FinalizeMonitor]]
|}

=== GetStateForMonitor ===
No input, returns an output u32.

sdknso implements this by <code>return</code>ing the u32, with 0 being returned on error.

=== GetNetworkInfoForMonitor ===
Takes a type-0x1A output buffer containing a [[#NetworkInfo]].

=== GetIpv4AddressForMonitor ===
No input, returns an output [[#Ipv4Address]] and a [[#SubnetMask]].

=== GetDisconnectReasonForMonitor ===
No input, returns an output s16.

This is not exposed by sdknso.

This just returns 0.

=== GetSecurityParameterForMonitor ===
No input, returns an output [[#SecurityParameter]].

This is not exposed by sdknso.

=== GetNetworkConfigForMonitor ===
No input, returns an output [[#NetworkConfig]].

This is not exposed by sdknso.

=== InitializeMonitor ===
No input/output.

This is used immediately after object creation. Official sw will Abort if this fails.

This just returns 0.

=== FinalizeMonitor ===
No input/output.

This is used during service exit, prior to closing the object. Official sw will Abort if this fails.

This just returns 0.

= ldn:s =
This is "nn::ldn::detail::ISystemServiceCreator".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#CreateSystemLocalCommunicationService]]
|}

== CreateSystemLocalCommunicationService ==
Returns an [[#ISystemLocalCommunicationService]].

The user-process closes the ISystemServiceCreator object immediately after using this cmd. Official sw ignores errors from this cmd.

== ISystemLocalCommunicationService ==
This is "nn::ldn::detail::ISystemLocalCommunicationService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#GetState]]
|-
| 1 || [[#GetNetworkInfo]]
|-
| 2 || [[#GetIpv4Address]]
|-
| 3 || [[#GetDisconnectReason]]
|-
| 4 || [[#GetSecurityParameter]]
|-
| 5 || [[#GetNetworkConfig]]
|-
| 100 || [[#AttachStateChangeEvent]]
|-
| 101 || [[#GetNetworkInfoLatestUpdate]]
|-
| 102 || [[#Scan]]
|-
| 103 || [[#ScanPrivate]]
|-
| 104 || [5.0.0+] [[#SetWirelessControllerRestriction]]
|-
| 200 || [[#OpenAccessPoint]]
|-
| 201 || [[#CloseAccessPoint]]
|-
| 202 || [[#CreateNetwork]]
|-
| 203 || [[#CreateNetworkPrivate]]
|-
| 204 || [[#DestroyNetwork]]
|-
| 205 || [[#Reject]]
|-
| 206 || [[#SetAdvertiseData]]
|-
| 207 || [[#SetStationAcceptPolicy]]
|-
| 208 || [[#AddAcceptFilterEntry]]
|-
| 209 || [[#ClearAcceptFilter]]
|-
| 300 || [[#OpenStation]]
|-
| 301 || [[#CloseStation]]
|-
| 302 || [[#Connect]]
|-
| 303 || [[#ConnectPrivate]]
|-
| 304 || [[#Disconnect]]
|-
| 400 || [[#InitializeSystem]]
|-
| 401 || [[#FinalizeSystem]]
|-
| 402 || [4.0.0+] [[#SetOperationMode]]
|-
| 403 || [7.0.0+] [[#InitializeSystem2]]
|}

=== GetState ===
No input, returns an output u32.

sdknso implements this by <code>return</code>ing the u32, with 0 being returned on error / when service isn't initialized.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || None
|-
| 1 || Initialized
|-
| 2 || AccessPointOpened
|-
| 3 || AccessPointCreated
|-
| 4 || StationOpened
|-
| 5 || StationConnected
|-
| 6 || Error
|-
|}

=== GetNetworkInfo ===
Takes a type-0x1A output buffer containing a [[#NetworkInfo]].

=== GetIpv4Address ===
No input, returns an output [[#Ipv4Address]] and a [[#SubnetMask]].

=== GetDisconnectReason ===
No input, returns an output s16.

sdknso implements this by <code>return</code>ing the s16 as a s32, with -1 being returned on error.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| -1 || See above.
|-
| 0 || None
|-
| 1 || User
|-
| 2 || SystemRequest
|-
| 3 || DestroyedByAdmin
|-
| 4 || DestroyedBySystemRequest
|-
| 5 || Admin
|-
| 6 || SignalLost
|}

=== GetSecurityParameter ===
No input, returns an output [[#SecurityParameter]].

=== GetNetworkConfig ===
No input, returns an output [[#NetworkConfig]].

=== AttachStateChangeEvent ===
No input, returns an output Event handle.

sdknso uses EventClearMode=1 with this. sdknso will Abort if this cmd fails.

This is signaled when the data returned by [[#GetNetworkInfo]]/[[#GetNetworkInfoLatestUpdate]] is updated.

=== GetNetworkInfoLatestUpdate ===
Takes a type-0x1A output buffer containing a [[#NetworkInfo]] and a type-0xA output buffer containing an array of [[#NodeLatestUpdate]].

The array count must be 8.

=== Scan ===
Takes a type-0x22 output buffer containing an array of [[#NetworkInfo]], a s16 channel, a [[#ScanFilter]], returns an output s16 total_out.

sdknso copies the output s16 to a s32, the value passed for the input s16 is from an user-specified s32 (user-apps generally use value 0 for this).

This is the same as [[#ScanPrivate]], except this also has the same channel-override functionality as [[#CreateNetwork]].

[[#GetState|State]] must be 3-5.

The array count must be at least 1. This is clamped to a maximum of 0x18.

=== ScanPrivate ===
Takes a type-0x22 output buffer containing an array of [[#NetworkInfo]], a s16 channel, a [[#ScanFilter]], returns an output s16 total_out.

sdknso copies the output s16 to a s32, the value passed for the input s16 is from an user-specified s32.

See [[#Scan]].

=== SetWirelessControllerRestriction ===
Takes an input [[#WirelessControllerRestriction]], no output.

[[#GetState|State]] must be 1.

The input value is written into state.

=== OpenAccessPoint ===
No input/output.

[[#GetState|State]] must be 1, this cmd eventually sets the State to value 2.

=== CloseAccessPoint ===
No input/output.

[[#GetState|State]] must be 2-3, this cmd eventually sets the State to value 1.

=== CreateNetwork ===
Takes an input [[#SecurityConfig]], an [[#UserConfig]], a [[#NetworkConfig]], no output.

This is the same as [[#CreateNetworkPrivate]], except the [[#AddressEntry]] params are 0, and the [[#SecurityParameter]] is generated from "nn::util::TinyMt::GenerateRandomBytes".

Unlike CreateNetworkPrivate, this overwrites the channel field in the [[#NetworkConfig]]. When the cached [[SPL_services#IsDevelopment|IsDevelopment]] value is true, the output from [[Settings_services|GetLdnChannel]] will overwrite that field if the s32 setting value is >=0, otherwise the original value is used. Otherwise when the IsDevelopment field is false (retail), the channel is overwritten with value 0.

This overwrites the u16 field at [[#SecurityConfig]]+0. When the cached [[SPL_services#IsDevelopment|IsDevelopment]] value is false (retail), value 1 is used, otherwise the original value is used.

[[#GetState|State]] must be 2, this cmd eventually sets the State to value 3.

=== CreateNetworkPrivate ===
Takes an input [[#SecurityConfig]], a [[#SecurityParameter]], an [[#UserConfig]], a [[#NetworkConfig]], a type-0x9 input buffer containing an array of [[#AddressEntry]], no output.

The buffer/count for [[#AddressEntry]] can be 0, in which case the network will be non-Private like [[#CreateNetwork]]. The count must be <=8.

See [[#CreateNetwork]].

=== DestroyNetwork ===
No input/output.

[[#GetState|State]] must be 3, this cmd eventually sets the State to value 2.

=== Reject ===
Takes an input [[#Ipv4Address]], no output.

[[#GetState|State]] must be 3.

=== SetAdvertiseData ===
Takes a type-0x21 input buffer, no output.

The input buffer contains arbitrary user data.

The buffer size must be <=0x180. An empty buffer (addr=NULL/size=0) can be used to reset the AdvertiseData size in state to zero.

[[#GetState|State]] must be 2-3.

=== SetStationAcceptPolicy ===
Takes an input [[#AcceptPolicy]], no output.

[[#GetState|State]] must be 2-3.

=== AddAcceptFilterEntry ===
Takes an input [[#MacAddress|MacAddress]], no output.

There are two sdknso funcs implementing this: one which takes a [[#MacAddress|MacAddress]] directly, the other loads the [[#MacAddress|MacAddress]] from the input [[#NodeInfo|NodeInfo]].

[[#GetState|State]] must be 2-3.

=== ClearAcceptFilter ===
No input/output.

[[#GetState|State]] must be 2-3.

=== OpenStation ===
No input/output.

[[#GetState|State]] must be 1, this cmd eventually sets the State to value 4.

=== CloseStation ===
No input/output.

[[#GetState|State]] must be 4-5, this cmd eventually sets the State to value 1.

=== Connect ===
Takes a type-0x19 input buffer containing a [[#NetworkInfo]], a [[#SecurityConfig]], an [[#UserConfig]], a s32 LocalCommunicationVersion, a [[#ConnectOption]], no output.

[[#GetState|State]] must be 4, this cmd eventually sets the State to value 5.

This is identical to [[#ConnectPrivate]] (besides the below), except the data internally passed for [[#SecurityParameter]]/[[#NetworkConfig]] are loaded from the input [[#NetworkInfo]].

This overwrites the u16 field at [[#SecurityConfig]]+0. When the cached [[SPL_services#IsDevelopment|IsDevelopment]] value is false (retail), value 1 is used, otherwise the used value is: original_field == 0 ? {u16 [[#NetworkInfo]]+0x60} : original_field.

u32 LocalCommunicationVersion>>15 must be 0.

=== ConnectPrivate ===
Takes a [[#SecurityConfig]], [[#SecurityParameter]], an [[#UserConfig]], a s32 LocalCommunicationVersion, a [[#ConnectOption]], a [[#NetworkConfig]], no output.

See [[#Connect]].

This overwrites the u16 field at [[#SecurityConfig]]+0. When the cached [[SPL_services#IsDevelopment|IsDevelopment]] value is false (retail), value 1 is used, otherwise the original value is used.

=== Disconnect ===
No input/output.

[[#GetState|State]] must be 5, this cmd eventually sets the State to value 4.

=== InitializeSystem ===
Takes an input PID and an u64 pid_placeholder.

This is used immediately after object creation.

With [7.0.0+] [[#InitializeSystem2]] is used instead.

=== FinalizeSystem ===
No input/output.

This is used during service exit, prior to closing the object. Official sw will Abort if this fails.

If State is set for it, this will run the equivalent of [[#CloseAccessPoint]]/[[#CloseStation]] when needed.

[[#GetState|State]] must be non-zero, this cmd eventually sets the State to value 0.

=== SetOperationMode ===
Takes an input [[#OperationMode]], no output.

[[#GetState|State]] must be 1.

The input value is written into state.

=== InitializeSystem2 ===
Takes an input PID, an u32, and an u64 pid_placeholder.

Official sw uses hard-coded value 0x1 for the u32.

The input u32 is ignored, the impl for this cmd is identical to [[#InitializeSystem]].

Internally this calls a func with params: (..., PID, &{u16 value 0x38}). On success, this then calls another func (which sets two state fields to the input) with params: (state, 0) (these state fields are used during [[#Authentication]] to check which service is being used).

The first func uses various [[Network_Interface_services|nifm]] funcs. The input value is used to determine the value for [[Network_Interface_services#CreateRequest|nn::nifm::RequestParameters]]: essentially, value 0x4 is used for ldn:u, and value 0x8 is used for ldn:s. The input value is also copied into state.

[[#GetState|State]] must be 0, this cmd eventually sets the State to value 1.

= ldn:u =
This is "nn::ldn::detail::IUserServiceCreator".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#CreateUserLocalCommunicationService]]
|}

== CreateUserLocalCommunicationService==
Returns an [[#IUserLocalCommunicationService]].

The user-process closes the IUserServiceCreator object immediately after using this cmd. Official sw ignores errors from this cmd.

== IUserLocalCommunicationService ==
This is "nn::ldn::detail::IUserLocalCommunicationService".

This is identical to [[#ISystemLocalCommunicationService]], except for the System-only cmd(s), and [[#Initialize]]/[[#Initialize2]] differ.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#GetState]]
|-
| 1 || [[#GetNetworkInfo]]
|-
| 2 || [[#GetIpv4Address]]
|-
| 3 || [[#GetDisconnectReason]]
|-
| 4 || [[#GetSecurityParameter]]
|-
| 5 || [[#GetNetworkConfig]]
|-
| 100 || [[#AttachStateChangeEvent]]
|-
| 101 || [[#GetNetworkInfoLatestUpdate]]
|-
| 102 || [[#Scan]]
|-
| 103 || [[#ScanPrivate]]
|-
| 104 || [5.0.0+] [[#SetWirelessControllerRestriction]]
|-
| 200 || [[#OpenAccessPoint]]
|-
| 201 || [[#CloseAccessPoint]]
|-
| 202 || [[#CreateNetwork]]
|-
| 203 || [[#CreateNetworkPrivate]]
|-
| 204 || [[#DestroyNetwork]]
|-
| 205 || [[#Reject]]
|-
| 206 || [[#SetAdvertiseData]]
|-
| 207 || [[#SetStationAcceptPolicy]]
|-
| 208 || [[#AddAcceptFilterEntry]]
|-
| 209 || [[#ClearAcceptFilter]]
|-
| 300 || [[#OpenStation]]
|-
| 301 || [[#CloseStation]]
|-
| 302 || [[#Connect]]
|-
| 303 || [[#ConnectPrivate]]
|-
| 304 || [[#Disconnect]]
|-
| 400 || [[#Initialize]]
|-
| 401 || [[#Finalize]]
|-
| 402 || [7.0.0+] [[#Initialize2]]
|}

=== Initialize ===
Takes an input PID and an u64 pid_placeholder.

This is used immediately after object creation.

With [7.0.0+] [[#Initialize2]] is used instead.

This is identical to [[#InitializeSystem]] except different params are used for the funcs called internally.

=== Finalize ===
No input/output.

This is used during service exit, prior to closing the object. Official sw will Abort if this fails.

This is identical to [[#FinalizeSystem]].

=== Initialize2 ===
Takes an input PID, an u32, and an u64 pid_placeholder.

Official sw uses hard-coded value 0x1 for the u32.

The input u32 is ignored, the impl for this cmd is identical to [[#Initialize]].

This is identical to [[#InitializeSystem2]] except different params are used for the funcs called internally: the u16 value is 0x5A, and the value for the second func is 1.

= ndd =
This is "nn::ndd::IService".

This was added with [5.0.0] and removed with [6.0.0].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || EnableAutoCommunication
|-
| 1 || DisableAutoCommunication
|-
| 2 || IsAutoCommunicationEnabled
|-
| 3 || EnablePowerSave
|-
| 4 || DisablePowerSave
|-
| 5 || IsPowerSaveEnabled
|-
| 6 || IsNetworkActive
|-
| 7 || AcquireSendDataUpdateEvent
|-
| 8 || AddSendData
|-
| 9 || ClearSendData
|-
| 10 || GetSendData
|-
| 11 || AcquireReceiveDataEvent
|-
| 12 || GetCurrentReceiveDataCounter
|-
| 13 || GetOldestReceiveDataCounter
|-
| 14 || GetNextReceiveDataCounter
|-
| 15 || GetAvailableReceiveDataCount
|-
| 16 || GetRecentReceiveDataCounter
|-
| 17 || GetReceiveData
|-
| 18 || AddReceiveData
|-
| 19 || ClearReceiveData
|-
| 20 || ClearDataIdFilter
|-
| 21 || AcquireDeviceScanEvent
|-
| 22 || StartDeviceScan
|-
| 23 || CancelDeviceScan
|-
| 24 || GetDeviceScanResult
|}

= lp2p:app, lp2p:sys =
These are "nn::lp2p::detail::INetworkServiceCreator".

These were added with [9.0.0+].

lp2p:app is used by [[Mario Kart Live: Home Circuit]]. lp2p:sys is used by [[Album_Applet|LibraryAppletPhotoViewer]] with [11.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#CreateNetworkService]]
|-
| 8 || [[#CreateNetworkServiceMonitor]]
|}

== CreateNetworkService ==
Takes an input u32, an u64 pid_reserved, a PID, returns an output [[#INetworkService]].

The input u32 must be value 0x1.

== CreateNetworkServiceMonitor ==
Takes an input u64 pid_reserved, a PID, returns an output [[#INetworkServiceMonitor]].

== INetworkService ==
This is "nn::lp2p::detail::INetworkService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Initialize|Initialize]]
|-
| [9.0.0-9.0.1] 256 || [[#AttachNetworkInterfaceStateChangeEvent]]
|-
| [9.0.0-9.0.1] 264 || [[#GetNetworkInterfaceLastError]]
|-
| [9.0.0-9.0.1] 272 || [[#GetRole]]
|-
| [9.0.0-9.0.1] 280 || [[#GetAdvertiseData]]
|-
| [9.0.0-9.0.1] 288 || [[#GetGroupInfo]]
|-
| [9.0.0-9.0.1] 296 || [[#Join]]
|-
| [9.0.0-9.0.1] 304 || [[#GetGroupOwner]]
|-
| [9.0.0-9.0.1] 312 || [[#GetIpConfig]]
|-
| [9.0.0-9.0.1] 320 || [[#Leave]]
|-
| 512 || [[#Scan]]
|-
| 768 || [[#CreateGroup]]
|-
| 776 || [[#DestroyGroup]]
|-
| 784 || [[#SetAdvertiseData]]
|-
| 1536 || [[#SendToOtherGroup]]
|-
| 1544 || [[#RecvFromOtherGroup]]
|-
| 1552 || [[#AddAcceptableGroupId]]
|-
| 1560 || [9.1.0+] [[#RemoveAcceptableGroupId]]
|}

=== Initialize ===
No input/output.

Returns 0.

Unused by official sw.

=== Scan ===
Takes a type-0x19 input buffer containing a [[#GroupInfo]], a type-0x22 output buffer containing an array of [[#ScanResult]], returns an output s32 total_out.

=== CreateGroup ===
Takes a type-0x31 input buffer containing a [[#GroupInfo]], no output.

[[Mario Kart Live: Home Circuit|mklive]] uses the following string with this: "Failed to create a group: %08X".

The [[#GetRole|role]] must be 0. This eventually sets the [[#GetRole|role]] to value 1.

=== DestroyGroup ===
No input/output.

This destroys the previously [[#CreateGroup|created]] group. If no group was previously created ([[#GetRole|role]] is not 1), this just returns 0.

=== SetAdvertiseData ===
Takes a type-0x21 input buffer, no output.

The buffer size must be <=0x80. The [[#GetRole|role]] must be <=1.

A string in [[Mario Kart Live: Home Circuit|mklive]] refers to the buffer data as "scan advertise data".

=== SendToOtherGroup ===
Takes an input [[#MacAddress_2|MacAddress]], a [[#GroupId]], a s16 frequency, a s16 channel, an u32 flags, a type-0x21 input buffer, no output.

The buffer size must be <=0x400.

The MacAddress must be non-zero. The s16s must be >=1.

Only bit0 is used from flags: clear = block until the data can be sent, set = return error when the data can't be sent.

A string in [[Mario Kart Live: Home Circuit|mklive]] refers to the buffer data as "Action frame".

The [[#GetRole|role]] must be non-zero. The error from [[#GetNetworkInterfaceLastError]] will be returned if it's set.

[11.0.0+] [[#GroupInfo]]+0x8A must be value 2, otherwise an error is returned.

This sends an Action frame to the specified [[#GroupId]], with the specified destination [[#MacAddress_2|MacAddress]] (can be a broadcast address).

The frequency param is the same as the [[#GroupInfo]]+0x84 field.

=== RecvFromOtherGroup ===
Takes an input u32 flags, a type-0x22 output buffer, returns a [[#MacAddress_2|MacAddress]], an u16, a s16, an u32 out_size, a s32.

The out_size is the original size used for copying to the output buffer, before it's clamped to the output-buffer size.

Only bit0 is used from flags: clear = block until data is available, set = return error when data is not available.

When data is not available, the error from [[#GetNetworkInterfaceLastError]] will be returned if it's set.

The [[#GetRole|role]] must be non-zero.

This receives an Action frame.

=== AddAcceptableGroupId ===
Takes an input [[#GroupId]], no output.

=== RemoveAcceptableGroupId ===
No input/output.

== INetworkServiceMonitor ==
This is "nn::lp2p::detail::INetworkServiceMonitor".

This interface has no commands, until [9.1.0+] which added actual commands.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Initialize_2|Initialize]]
|-
| 256 || [[#AttachNetworkInterfaceStateChangeEvent]]
|-
| 264 || [[#GetNetworkInterfaceLastError]]
|-
| 272 || [[#GetRole]]
|-
| 280 || [[#GetAdvertiseData]]
|-
| 281 || [[#GetAdvertiseData2]]
|-
| 288 || [[#GetGroupInfo]]
|-
| 296 || [[#Join]]
|-
| 304 || [[#GetGroupOwner]]
|-
| 312 || [[#GetIpConfig]]
|-
| 320 || [[#Leave]]
|-
| 328 || [[#AttachJoinEvent]]
|-
| 336 || [[#GetMembers]]
|}

=== Initialize ===
Returns 0.

Unused by official sw.

=== AttachNetworkInterfaceStateChangeEvent ===
No input, returns an output Event handle with EventClearMode=0.

=== GetNetworkInterfaceLastError ===
No input/output.

=== GetRole ===
No input, returns an output u8.

=== GetAdvertiseData ===
Takes a type-0x22 output buffer, returns 2 output u16s.

Validates that the [[#GetRole|role]] is value 2, then copies data from state into the output buffer. The first output u16 is the size used for the memcpy, the second u16 is the original size from state.

=== GetAdvertiseData2 ===
Takes a type-0x22 output buffer, returns 2 output u16s.

This is identical to [[#GetAdvertiseData]] except this doesn't run the role validation.

=== GetGroupInfo ===
Takes a type-0x32 output buffer containing a [[#GroupInfo]].

Validates that the [[#GetRole|role]] is non-zero, then copies the struct from state into the output buffer.

=== Join ===
Takes a type-0x32 output buffer containing a [[#GroupInfo]] and a type-0x31 input buffer containing a [[#GroupInfo]].

This runs the same code as [[#CreateGroup]] to generate the [[#GroupInfo]] for the input struct (which with [[#CreateGroup]] would be available with [[#GetGroupInfo]]). The input struct is the same as [[#CreateGroup]].

=== GetGroupOwner ===
No input, returns an output 0x80-bytes [[#NodeInfo_2|NodeInfo]].

Validates that the [[#GetRole|role]] is non-zero, then copies the data from state to output.

=== GetIpConfig ===
Takes a type-0x1A output buffer containing a 0x100-byte struct.

Validates that the [[#GetRole|role]] is non-zero, then copies the struct from state into the output buffer.

+0x20 is the <code>struct sockaddr</code> IP address, +0x40 is the <code>struct sockaddr</code> subnet-mask, +0x60 is the <code>struct sockaddr</code> gateway(?). The address for the last one is set to localhost.

=== Leave ===
No input, returns an output u32.

=== AttachJoinEvent ===
No input, returns an output Event handle with EventClearMode=0.

=== GetMembers ===
Takes a type-0x22 output buffer containing an array of [[#NodeInfo_2|NodeInfo]], returns an output s32 total_out.

Validates that the [[#GetRole|role]] is value 1. Then any entries from state which are available are copied into the output array buffer, if there's space available. A maximum of 8 entries can be returned.

A string in [[Mario Kart Live: Home Circuit|mklive]] refers to the array data as "connected members".

= lp2p:m =
This is "nn::lp2p::detail::IMonitorServiceCreator".

This was added with [9.1.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#CreateMonitorService]]
|}

== CreateMonitorService ==
Takes a PID, a total of 0x10-bytes of input, and returns an [[#IMonitorService]].

== IMonitorService ==
This is "nn::lp2p::detail::IMonitorService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Initialize_3|Initialize]]
|-
| 288 || [[#GetGroupInfo]]
|-
| 320 || [[#Leave]]
|}

=== Initialize ===
Returns 0.

= Ipv4Address =
This is "nn::ldn::Ipv4Address". This is a 0x4-byte struct with 4-byte alignment.

This is essentially the same as <code>struct in_addr</code>, except this is little-endian.

This is generally "169.254.XXX.{...}", where XXX is random per created network.

= SubnetMask =
This is "nn::ldn::SubnetMask". This is a 0x4-byte struct with 4-byte alignment.

This is essentially the same as <code>struct in_addr</code>, except this is little-endian.

= Ssid =
This is "nn::ldn::Ssid".

When converting a Ssid to a string, the loaded chars from the string must be in the range of 0x20-0x7F, otherwise the byte written to the string will be 0.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || Length excluding NUL-terminator, must be 0x1-0x20.
|-
| 0x1 || 0x21 || SSID string including NUL-terminator, str[{above length}] must be 0.
|}

= NetworkInfo =
This is "nn::ldn::NetworkInfo". This is a 0x480-byte struct. The data at +0x50 is another struct.

The fields listed as Reserved (besides the fields before +0x10) are cleared during the memset and are not written to again afterwards, with cmds which return NetworkInfo.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || LocalCommunicationId
|-
| 0x8 || 0x2 || Reserved
|-
| 0xA || 0x2 || Arbitrary user data which can be used for filtering with [[#ScanFilter]].
|-
| 0xC || 0x4 || Reserved
|-
| 0x10 || 0x10 || Last 0x10-bytes of [[#SecurityParameter]]. NetworkId which is used to generate/overwrite the [[#Ssid]]. With [[#Scan]]/[[#ScanPrivate]], this is only done after filtering when +0x4B is value 0x2. The converted Ssid is a 0x20-byte lowercase hex string version of the input NetworkId.
|-
| 0x20 || 0x6 || [[#MacAddress|MacAddress]]
|-
| 0x26 || 0x22 || [[#Ssid]]
|-
| 0x48 || 0x2 || s16 NetworkChannel
|-
| 0x4A || 0x1 || s8 LinkLevel
|-
| 0x4B || 0x1 || Set to hard-coded value 0x2 with output structs, except with [[#Scan]]/[[#ScanPrivate]] which can also set value 0x1 in certain cases. 0x1 = normal network without an [[#ActionFrame]], 0x2 = LDN network with a valid [[#ActionFrame]].
|-
| 0x4C || 0x4 || Padding
|-
| 0x50 || 0x10 || First 0x10-bytes of [[#SecurityParameter]].
|-
| 0x60 || 0x2 || Same as [[#SecurityConfig]]+0x0.
|-
| 0x62 || 0x1 || [[#AcceptPolicy]]
|-
| 0x63 || 0x1 || Only set with [[#Scan]]/[[#ScanPrivate]], when +0x4B is value 0x2. See [[#ActionFrame]].
|-
| 0x64 || 0x2 || Padding
|-
| 0x66 || 0x1 || Maximum participants, for the [[#NodeInfo|NodeInfo]] array.
|-
| 0x67 || 0x1 || ParticipantNum, number of set entries in the [[#NodeInfo|NodeInfo]] array. If +0x4B is not 0x2, ParticipantNum should be handled as if it's 0.
|-
| 0x68 || 0x200(0x40*8) || Array of [[#NodeInfo|NodeInfo]] with 8 entries, starting with the AccessPoint node.
|-
| 0x268 || 0x2 || Reserved
|-
| 0x26A || 0x2 || AdvertiseData size
|-
| 0x26C || 0x180 || AdvertiseData
|-
| 0x3EC || 0x8C || Reserved
|-
| 0x478 || 0x8 || [6.0.0+] Random AuthenticationId. Set to the output from [[ETicket_services|es]] cmd1501 during network creation.
|}

= ScanFilter =
This is "nn::ldn::ScanFilter". This is a 0x60-byte struct with 8-byte alignment.

sdknso copies the input ScanFilter to a tmp struct on stack, which is then used with the cmd.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || When enabled, this will be overwritten if it's -1. The data written for this is the first [[NACP_Format|LocalCommunicationId]] for the user-process loaded via [[Glue_services|arp:r]], if loading fails value 0 is written instead. During filtering if enabled, u8 [[#NetworkInfo]]+0x4B must match 0x2, and this ScanFilter field must match [[#NetworkInfo]]+0x0.
|-
| 0x8 || 0x2 || Padding
|-
| 0xA || 0x2 || During filtering if enabled, u8 [[#NetworkInfo]]+0x4B must match 0x2, and this ScanFilter field must match [[#NetworkInfo]]+0xA.
|-
| 0xC || 0x4 || Padding
|-
| 0x10 || 0x10 || During filtering if enabled, u8 [[#NetworkInfo]]+0x4B must match 0x2, and this ScanFilter data must match [[#NetworkInfo]]+0x10.
|-
| 0x20 || 0x4 || When enabled, must be <=0x3, and during filtering must match u8 [[#NetworkInfo]]+0x4B.
|-
| 0x24 || 0x6 || [[#MacAddress|MacAddress]]. Only copied with [[#ScanPrivate]]. During filtering if enabled, this must match [[#NetworkInfo]]+0x20.
|-
| 0x2A || 0x22 || [[#Ssid]]. During filtering if enabled, this must match [[#NetworkInfo]]+0x26 (the [[#Ssid]] there must be valid for this as well). The strings are compared, without verifying the length field in [[#Ssid]] matches.
|-
| 0x4C || 0x10 || Cleared to zero for the tmp struct.
|-
| 0x5C || 0x4 || Flags. Masked with 0x37 for [[#Scan]], with [[#ScanPrivate]] this is masked with 0x3F.
|}

Flags:

{| class="wikitable" border="1"
|-
! Bit
! Description
|-
| 0 || When set, enables using ScanFilter+0.
|-
| 1 || When set, enables using ScanFilter+0x10.
|-
| 2 || When set, enables using ScanFilter+0x20.
|-
| 3 || When set, enables using the ScanFilter [[#MacAddress|MacAddress]].
|-
| 4 || When set, enables using the ScanFilter [[#Ssid]].
|-
| 5 || When set, enables using ScanFilter+0xA.
|}

= NetworkConfig =
This is "nn::ldn::NetworkConfig". This is a 0x20-byte struct with 8-byte alignment.

sdknso copies the input NetworkConfig to a tmp struct on stack, which is then used with the cmd ([[#CreateNetwork]], [[#CreateNetworkPrivate]], [[#ConnectPrivate]]).

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || LocalCommunicationId. Same as [[#NetworkInfo]]+0x0. [[#CreateNetwork]]/[[#CreateNetworkPrivate]]/[[#Connect]]/[[#ConnectPrivate]]: When -1, this is overwritten with the first [[NACP_Format|LocalCommunicationId]] for the user-process loaded via [[Glue_services|arp:r]], if loading fails value 0 is written instead. Otherwise when not -1, if control.nacp loading is successful with [[Glue_services|arp:r]], this field must match one of the LocalCommunicationIds from there otherwise an error is thrown.
|-
| 0x8 || 0x2 || Cleared to zero during the copy.
|-
| 0xA || 0x2 || Same as [[#NetworkInfo]]+0xA.
|-
| 0xC || 0x4 || Cleared to zero during the copy.
|-
| 0x10 || 0x2 || s16 Channel, can be zero. Same as [[#NetworkInfo]]+0x48.
|-
| 0x12 || 0x1 || s8. Same as [[#NetworkInfo]]+0x66. [[#CreateNetwork]]/[[#CreateNetworkPrivate]]: Must be 0x1-0x8.
|-
| 0x13 || 0x1 || Cleared to zero during the copy.
|-
| 0x14 || 0x2 || Same as [[#NetworkInfo]]+0x96 (LocalCommunicationVersion from the first [[#NodeInfo|NodeInfo]]). Must not be negative. [[#Connect]]/[[#ConnectPrivate]]: This must match the value for the AccessPoint LocalCommunicationVersion.
|-
| 0x16 || 0xA || Cleared to zero during the copy.
|}

= NodeLatestUpdate =
This is "nn::ldn::NodeLatestUpdate". This is a 0x8-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || The field in state is reset to zero by [[#GetNetworkInfoLatestUpdate]] after loading it. Official apps checks whether this is non-zero.
|-
| 0x1 || 0x7 || Not initialized with [[#GetNetworkInfoLatestUpdate]].
|}

= WirelessControllerRestriction =
This is "nn::ldn::WirelessControllerRestriction". This is an u32 enum.

This is used to determine the value passed to [[BTM_services|btm]] SetWlanMode.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 ||
|-
| 1 || This is the default.
|}

= SecurityConfig =
This is "nn::ldn::SecurityConfig". This is a 0x44-byte struct with 2-byte alignment.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x2 || Type, a default of value 1 can be used here. Overwritten by [[#CreateNetwork]]/[[#CreateNetworkPrivate]] and [[#Connect]]/[[#ConnectPrivate]]. The value used internally by these cmds must be 1-3.
|-
| 0x2 || 0x2 || Data size. Must be 0x10-0x40.
|-
| 0x4 || 0x40 || Data, used with key derivation.
|}

Type:
* 1-2: Broadcast Action frame data is encrypted and is verified with SHA256.
* 3: Broadcast Action frame data is plaintext and is verified with SHA256.

* 1: Data frames are encrypted.
* 2-3: Data frames for normal data-transfer are plaintext - the network is Open.

= SecurityParameter =
This is "nn::ldn::SecurityParameter". This is a 0x20-byte struct with 1-byte alignment.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x10 || Data, used with the same key derivation as [[#SecurityConfig]].
|-
| 0x10 || 0x10 || NetworkId, see [[#NetworkInfo]].
|}

= UserConfig =
This is "nn::ldn::UserConfig". This is a 0x30-byte struct with 1-byte alignment.

sdknso copies the input UserConfig to a tmp struct on stack, which is then used with the cmd.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x20 || NUL-terminated string for the user nickname.
|-
| 0x20 || 0x10 || Cleared to zero during the copy.
|}

= AddressEntry =
This is "nn::ldn::AddressEntry". This is a 0xC-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || [[#Ipv4Address]]
|-
| 0x4 || 0x6 || [[#MacAddress|MacAddress]]
|-
| 0xA || 0x2 || Padding
|}

= AcceptPolicy =
This is "nn::ldn::AcceptPolicy". This is an u8.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || Allow all.
|-
| 1 || Deny all.
|-
| 2 || Blacklist, addresses in the [[#AddAcceptFilterEntry|list]] are not allowed.
|-
| 3 || Whitelist, only addresses in the [[#AddAcceptFilterEntry|list]] are allowed.
|}

= MacAddress =
This is "nn::ldn::MacAddress". This is a 6-byte struct with 1-byte alignment.

= NodeInfo =
This is "nn::ldn::NodeInfo".

The fields listed as Reserved are cleared during the memset and are not written to again afterwards, with cmds which return [[#NetworkInfo]].

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || [[#Ipv4Address]]
|-
| 0x4 || 0x6 || [[#MacAddress|MacAddress]]
|-
| 0xA || 0x1 || s8 ID / index
|-
| 0xB || 0x1 || IsConnected
|-
| 0xC || 0x20 || First 0x20-bytes of [[#UserConfig]].
|-
| 0x2C || 0x2 || Reserved
|-
| 0x2E || 0x2 || s16 LocalCommunicationVersion
|-
| 0x30 || 0x10 || Reserved
|}

= ConnectOption =
This is "nn::ldn::ConnectOption". This is an u32 bitmask.

There's two versions of the sdknso funcs for [[#Connect]]/[[#ConnectPrivate]]: the version where the ConnectOption isn't user-specified uses a default value of 0x1 for it, with the same ShowError code without the bit0 check.

When bit0 here is set after using the above cmds, the sdknso funcs will use [[Error_Applet|ShowError]] with the returned Result if: (rc & 0x3FE1FF) == 0xE0CB.

This must be <=0x1, besides this validation ConnectOption is ignored by [[#Connect]]/[[#ConnectPrivate]].

= OperationMode =
This is "nn::ldn::OperationMode". This is an u32 enum.

This controls bit1 in the value passed to [[WLAN_services|wlan:lcl]] cmd0/cmd1: bit1 = OperationMode==1.

Value 1 seems to affect power (?) related fields in the beacon tags?

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || This is the default.
|-
| 1 ||
|}

= MacAddress =
This is "nn::lp2p::MacAddress". Same as [[#MacAddress|MacAddress]].

= GroupId =
This is "nn::lp2p::GroupId". This is a 6-byte struct with 1-byte alignment.

This is a WiFi BSSID.

= NodeInfo =
This is "nn::lp2p::NodeInfo". This is a 0x80-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || || <code>struct sockaddr</code> for the IP address.
|-
| 0x24 || 0x6 || [[#MacAddress_2|MacAddress]]
|}

= GroupInfo =
This is "nn::lp2p::GroupInfo". This is a 0x200-byte struct.

[[Mario Kart Live: Home Circuit|mklive]] sets the SSID to a string generated from random data.

[[#Scan_2|Scan]] only uses the following fields for the cmd input struct: SupportedPlatform/Priority, Frequency/Channel, and PresharedKeyBinarySize/PresharedKey.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x10 || When zero, this is set to randomly-generated data. Used during key derivation.
|-
| 0x10 || 0x8 || LocalCommunicationId. When zero, the value from control.nacp is loaded. This is later validated by [[#Join]]/[[#CreateGroup]] the same way as the [[#NetworkConfig]] field. Used during key derivation.
|-
| 0x18 || 0x6 || [[#GroupId]] ("GROUP ID (BSSID)"). When zero, the default is used. The default should be used here: an error is thrown if the data here doesn't match the output from [[WLAN_services|wlan:lcl]] cmd2.
|-
| 0x1E || 0x21 || ServiceName ("GROUP NAME (SSID)"). NUL-terminated string. See below.
|-
| 0x3F || 0x1 || s8 Flags count. Must be <=0x3F.
|-
| 0x40 || 0x40 || Array of s8 with the above count. Each entry value must be <=0x3F. Each entry is an array index used to load a set of flags from a global array with the specified index. global_flags are also masked with flags loaded from here. User-processes use entryval=1 as the default, with [11.0.0+] entryval=0 can be used for standard WPA2-PSK (see +0x8A).
|-
| 0x80 || 0x1 || SupportedPlatform. Must match value 1. 0 is PlatformIdNX, 1 is PlatformIdFuji.
|-
| 0x81 || 0x1 || MemberCountMax. s8, Must be <=0x8. During group creation this is passed to [[WLAN_services|wlan:lcl]] cmd40, when this is value 0 a default of value 1 is passed. During group-creation when the below +0x88 field is not value 0x2, the passed [[BTM_services#SetWlanMode|WlanMode]] is <code>x81_field_val > 3</code>.
|-
| 0x82 || 0x1 ||
|-
| 0x84 || 0x2 || Frequency. Wifi frequency: 24 = 2.4GHz, 50 = 5GHz.
|-
| 0x86 || 0x2 || s16 Channel ("CHANNEL"). Wifi channel number. 0 = use default, otherwise this must be one of the following depending on the frequency field:
* 24: 1, 6, 11.
* 50: 36, 40, 44, 48.
|-
| 0x88 || 0x1 || NetworkMode. Used during group-creation to determine the [[BTM_services#SetWlanMode|WlanMode]] to use. When this is value 0x2, mode=3 is used, otherwise it's determined via the +0x81 field.
|-
| 0x89 || 0x1 || PerformanceRequirement.
|-
| 0x8A || 0x1 || Security type, used during key derivation. 0 = use defaults, 1 = plaintext, 2 = encrypted. [11.0.0+] 3: Standard WPA2-PSK.
|-
| 0x8B || 0x1 || StaticAesKeyIndex. s8, used as the array-index for selecting the KeySource used with [[SPL_services#GenerateAesKek|GenerateAesKek]] during key derivation. Should be 1-2, otherwise GenerateAesKek is skipped and zeros are used for the AccessKey instead.
|-
| 0x8D || 0x1 || Priority. Must match one of the following, depending on the used service (doesn't apply to [[#Join]]): 55 = SystemPriority (lp2p:sys), 90 = ApplicationPriority (lp2p:app and lp2p:sys).
|-
| 0x8E || 0x1 || StealthEnabled. Bool flag, controls whether the SSID is hidden.
|-
| 0x8F || 0x1 || If zero, a default value of 0x20 is used.
|-
| 0x1C0 || 0x1 || PresharedKeyBinarySize. Must be 0x20 for PresharedKeyBinary. [11.0.0+] With WPA2-PSK, this must be value 1.
|-
| 0x1C1 || 0x3F ([9.0.0-10.2.0] 0x20) || PresharedKey. Used during key derivation. [11.0.0+] With WPA2-PSK, this is the passphrase string (length must be at least 8).
|}

In order for the ServiceName to be valid without a new one being generated, the following checks must pass:
* It loops through the characters in the string, looking for the first '_' character:
** The loop will exit once a '_' character is found.
** The character must be '-', or alphanumeric (lowercase/uppercase), otherwise the function will immediately return failure.
** The loop will also exit once string_pos is >19, in which case the function will also immediately return failure.
* Then it checks the 11 characters which follow the above:
** The character must be hex: '0'-'9', or 'A-F' / 'a-'f.
* The following character must be a NUL-terminator.
* The last hex character above, then the characters for the whole string prior to the last hex character are summed. return sum % 0x2B == 0. u32 is used for these calculations. (Return success when sum is a multiple of 0x2B, otherwise return failure)

If the above fails, then the following runs, otherwise it just returns 0:
* It loops through the characters in the string.
** The character must be '-', or alphanumeric (lowercase/uppercase), otherwise the function will immediately return failure.
** The loop will exit once string_pos>20 is reached, or when a NUL-terminator is reached.
* Once finished, success is returned if string_pos-1 is <20, otherwise failure is returned (which also immediately occurs if the first character is a NUL-terminator).

If the above fails, an error is returned, otherwise a new ServiceName is generated:
* Up to 20 characters are copied from the original ServiceName to the output ServiceName, stopping once the limit is reached or when a NUL-terminator is reached.
* '_' is appended to the string.
* <code>nn::util::TSNPrintf({strptr following the above character}, {remaining size}, "%02X%02X%02X%02X%02X", [[#GroupId|GroupId_byte3]], [[#GroupId|GroupId_byte4]], [[#GroupId|GroupId_byte5]], ([[SPL_services#IsDevelopment|IsDevelopment]] ? 0x80 : 0) | 0x1, 0);</code>
* Then the last character is set to the output from a calling a function:
** All string characters which were already written are summed same way as above. Then: <code>return character_lookup_table[sum % 0x2B];</code> (If the length passed to this function is 0, this will instead just return character_lookup_table[0])
*** character_lookup_table contains 0x2B entries: [V-A][k-a][5-0][Z-W].

loaded_flags are first loaded from elsewhere, then masked with the above flags when available. loaded_flags are used when +0x8A is 0. global_flags are loaded from global data. These flags are only used with [[#CreateGroup]]/[[#Join]]. Flags (note that the following was updated with [11.0.0+], and differs from below):
* Bit2 clear:
** global_flags must be non-zero, and loaded_flags bit1 must be set.
** u8 +0x8A is set to value 1.
** When the cached [[SPL_services#IsDevelopment|IsDevelopment]] value is false (retail), an error is thrown.
** u8 +0x8B is set to value 0.
* Otherwise, if bit2 is set:
** u8 +0x8A is set to value 2.
** global_flags bit1 set:
*** u8 +0x8B is set to value 1.
** Otherwise, if global_flags bit2 is set:
*** u8 +0x8B is set to value 2.

= ScanResult =
This is "nn::lp2p::ScanResult". This is a 0x300-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x200 || [[#GroupInfo]]
|-
| 0x200 || 0x1 ||
|-
| 0x206 || 0x2 || AdvertiseData size.
|-
| 0x208 || 0x80 || AdvertiseData
|}

= Network protocol =
== ldn ==
A beacon and Action frame are broadcasted. The SSID in the beacon is hidden (32-bytes with value 0). For [[#Scan]]/[[#ScanPrivate]] it doesn't matter if no beacon is available ([[#NetworkInfo]] is the same), as long as the Action frame is broadcasted. However, the Station will not send a probe-request during connection if no beacon is available (and therefore not attempt any communication with the AccessPoint). The beacon doesn't have any custom Nintendo data, that data is in the Acton frame.

During connection, the Station first sends a probe-request using the [[#NetworkInfo|generated]] SSID from the Action frame. If the probe-response contains the expected data for the [[#SecurityConfig]] type, the Station then proceeds to connect to the AccessPoint. The key for data-frames, if [[#SecurityConfig|enabled]], is derived from a buffer containing: {[[#SecurityParameter]]+0x0} followed by {[[#SecurityConfig]] data with the specified data-size}. The [[#ActionFrame]]/data-frame keys are derived with the same func, the only difference is the input passed to this func + the passed constant data. The key derived by ldn is used directly as the static CCMP key for all data-frames (CCMP / MIC is standard).

Then the Station scans for an [[#ActionFrame]] for loading the [[#NetworkInfo]].

Once connected, the AccessPoint sends Epigram-vendor Action frame(s) (same data) to the Station, the Station doesn't require these frames: <code>dd1afeedfacedeadbeef010000000a00000000000000000000000000</code>. Then the Station must Authenticate with the AccessPoint, this is custom. The Station sends a frame (a maximum of 3 times in some cases if errors occur, with the same data), and the AccessPoint sends a response. Once Authenticated, the node is added to the [[#NodeInfo|NodeInfo]] array in [[#NetworkInfo]]. If the Station does not successfully Authenticate X-seconds after connecting, the AccessPoint disconnects the Station. If the Station fails to Authenticate, the Station itself will disconnect as well.

After Authentication the Station will scan for another [[#ActionFrame]], with frame-comparision enabled with the above frame (frame must have been updated since the previous scan). The Station locates the index for a [[#MacAddress|MacAddress]] matching itself in the [[#NetworkInfo]] [[#NodeInfo|NodeInfo]] array (the entry for the AccessPoint is skipped), throwing an error if not found. After validating the LocalCommunicationVersion, it proceeds to handle ARP setup below.

This does not use DHCP, each node on the network has to manually setup ARP (without sending ARP network requests) with the [[#NodeInfo|NodeInfo]] array in [[#NetworkInfo]].

At this point standard sockets can be used over Data frames.

=== EthFrame ===
The custom Ethernet frames have the following structure:
* "Type: IEEE 802a OUI Extended Ethertype (0x88b7)"
* "IEEE802a OUI Extended Ethertype":
** "Organization Code: 00:22:aa (Nintendo Co., Ltd.)"
** "Protocol ID: {...}"
*** Depends on the frame:
*** 0x0102: [[#Authentication]]
*** 0x0103: ?
* The first byte of Data is value 0, then the ProtocolID-specific data follows, see below.
** ProtocolID 0x0103 frames are sent by the AccessPoint to the Station. This is 0x20-bytes of zeros, except for the first byte which is 0x3. This is sent by the AccessPoint prior to destroying the network.

==== Authentication ====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || [[#AuthVersion]]
|-
| 0x1 || 0x1 || Low u8 for the size.
|-
| 0x2 || 0x1 || Status. 0 = success, non-zero = error.
|-
| 0x3 || 0x1 || [2.0.0+] bool flag. The AccessPoint verifies that this is not set. Always set to 1 by the AccessPoint in the response. The Station only uses this when the [[#AuthVersion]] is >=2.
|-
| 0x4 || 0x1 || [6.0.0+] High u8 for the size.
|-
| 0x5 || 0x3 || Unused, zeros.
|-
| 0x8 || 0x20 || [[#NetworkInfo]]+0, must match the corresponding data in [[#NetworkInfo]] when the receiving node verifies this. With the
AccessPoint->Station frame, the Station verifies that this matches the data previously sent to the AccessPoint.
|-
| 0x28 || 0x10 || [[#NetworkInfo]]+0x50, must match the corresponding data in [[#NetworkInfo]] when the receiving node verifies this. With the
AccessPoint->Station frame, the Station verifies that this matches the data previously sent to the AccessPoint.
|-
| 0x38 || 0x10 || See below.
|-
| 0x48 || || Frame-specific data, with the above size. The total frame size - {offset of the start of this data in the frame} must match the above size.
|}

The Station sets the above size to 0x40 ([6.0.0+] if [[#NetworkInfo]]+0x13 is <3). [6.0.0+] The Authentication challenge is only used/enabled if that value is >=3, and [[#IUserLocalCommunicationService]] is being used.

The AccessPoint sets the above size to 0x40 ([6.0.0+] 0x0 if the +0x0 [[#AuthVersion]] is <3). [6.0.0+] The AccessPoint will only use/enable the Authentication challenge when the +0x0 [[#AuthVersion]] is >=3, and [[#IUserLocalCommunicationService]] is being used. This data will not be included in the frame if the status field indicates error.

[6.0.0+] Support for the Authentication challenge with [[ETicket_services|es]] cmds 1501-1504 was added.

Station->AccessPoint frame, relative to +0x0 above (frame size depends on whether +0xAC is enabled):

The AccessPoint will not respond to frames where the source mac-address is unrecognized.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x38 || 0x10 || The Station sets this to random data. Unused by the AccessPoint, except for copying into the response.
|-
| 0x48 || 0x20 || [[#UserConfig]]+0. Copied into state by the AccessPoint.
|-
| 0x68 || 0x2 || Big-endian LocalCommunicationVersion. Byte-swapped by the AccessPoint then copied into state.
|-
| 0x6A || 0x1E || Zeros, unused by the AccessPoint.
|-
| 0x88 || 0x24 || [6.0.0+] Zeros, unused by the AccessPoint.
|-
| 0xAC || 0x300 || [6.0.0+] Authentication challenge data. If enabled, the total frame size must be >= {end offset of this data in the frame}. The frame data does not include this if it's not enabled.
|}

AccessPoint->Station response frame, relative to +0x0 above (frame size depends on whether +0x48/+0xCC are enabled):

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x38 || 0x10 || +0x38 from the data originally sent by the Station. The Station verifies that this matches the previously sent data.
|-
| 0x48 || 0x40 || Zeros. [6.0.0+] Only included in the frame if it's enabled (+0x0 [[#AuthVersion]] >= 3). Unused by the Station.
|-
| 0x88 || 0x44 || [6.0.0+] Only included in the frame if it's enabled (+0x0 [[#AuthVersion]] >= 3). Unused by the Station.
|-
| 0xCC || 0x100 || [6.0.0+] If enabled, Authentication challenge response data. Not included in the frame if it's not enabled.
|}

===== AuthVersion =====
Must be 0x1-0xF.

{| class="wikitable" border="1"
|-
! Value || SystemVersion
|-
| 1 || [1.0.0+]
|-
| 2 || [2.0.0+]
|-
| 3 || [6.0.0+]
|}

=== ActionFrame ===
The Action frames have the following structure:
* "Fixed parameters":
** "Category code: Vendor Specific (127)"
** "OUI: 00:22:aa (Nintendo Co., Ltd.)"
* The Data starts with the following header:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x2 || 04 00 in sent frames.
|-
| 0x2 || 0x2 || Protocol ID, must be 0x0101.
|-
| 0x4 || 0x2 || Must be 0.
|-
| 0x6 || 0x2 || Zeros, unused.
|}

Then the actual data follows:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x20 || [[#NetworkInfo]]+0x0. The u64/u16 are big-endian. Outside of [[#Scan]]/[[#ScanPrivate]], this must match the previously loaded data for this.
|-
| 0x20 || 0x1 || [[#AuthVersion]]. Copied to [[#NetworkInfo]]+0x63. When comparing with a previous frame is enabled, this must match the value from the previous frame.
|-
| 0x21 || 0x1 || Encryption type: 1 = plaintext, 2 = encrypted, {frames with other values are ignored by [[#Scan]]/[[#ScanPrivate]]}. Must match the type which is currently being used: with [[#Scan]]/[[#ScanPrivate]] this is determined via this field, otherwise [[#SecurityConfig]] is used to determine this.
|-
| 0x22 || 0x2 || Big-endian u16 size for the data starting at +0x48, must be <=0x500, and must match {total frame size relative to +0x0 above} + 0x48.
|-
| 0x24 || 0x4 || Big-endian u32 Counter. The initial value is randomly-generated. This is incremented each time the below content is updated (including initial creation). Also used by the Station to determine whether the frame changed compared to a previous one. When comparing against a previous frame, new_counter-prev_counter must be <= 0xFF, and the counters must not match.
|-
| 0x28 || 0x20 || SHA256 hash over the entire frame starting at +0x0, with the above size + 0x48. During hashing, this hash is cleared, with the new hash overwriting the original in memory (the original is copied to stack for comparing).
|}

When encryption is enabled, the encrypted data is +0x28 with size {remaining frame size}. This is encrypted with AES-128-CTR. The key is derived from the raw 0x20-bytes at +0x0. The CTR is {raw Counter above without byte-swap}, with the rest cleared to zeros.

The content data at +0x48 follows, which has the size specified above (which must be >=0x500), where all fields are big-endian:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x10 || [[#NetworkInfo]]+0x50
|-
| 0x10 || 0x2 || [[#NetworkInfo]]+0x60
|-
| 0x12 || 0x1 || [[#NetworkInfo]]+0x62
|-
| 0x13 || 0x3 || Unused
|-
| 0x16 || 0x1 || s8 [[#NetworkInfo]]+0x66, clamped to range 1-8.
|-
| 0x17 || 0x1 || s8 [[#NetworkInfo]]+0x67, clamped to range 1-8.
|-
| 0x18 || 0x1C0(0x38*8) || Array of the below node struct.
|-
| 0x1D8 || 0x2 || Unused
|-
| 0x1DA || 0x2 || [[#NetworkInfo]]+0x26A
|-
| 0x1DC || 0x180 || [[#NetworkInfo]]+0x26C
|-
| 0x35C || 0x19C || Unused
|-
| 0x4F8 || 0x8 || [6.0.0+] [[#NetworkInfo]]+0x478
|}

The data here is copied into [[#NetworkInfo]].

Node data used in the above array (all fields big-endian), which are copied into the [[#NetworkInfo]] [[#NodeInfo|NodeInfo]] array:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || [[#Ipv4Address]]
|-
| 0x4 || 0x6 || [[#MacAddress|MacAddress]]
|-
| 0xA || 0x1 || bool IsConnected
|-
| 0xB || 0x1 || Unused
|-
| 0xC || 0x20 || First 0x20-bytes of [[#UserConfig]].
|-
| 0x2C || 0x2 || s16 LocalCommunicationVersion
|-
| 0x2E || 0xA || Unused
|}

== lp2p ==
This is used for communicating with accessories (external devices on [11.0.0+]) over local wifi. [[Mario Kart Live: Home Circuit]] uses this. [11.0.0+] [[Album_Applet|LibraryAppletPhotoViewer]] uses this.

A beacon is broadcasted.

Action frames are only sent when done so by [[#SendToOtherGroup]] (other than the Epigram one mentioned below).

Communication uses sockets with standard Data frames and the above Action frames. Switch consoles presumably only use the Action frames to communicate with each other?

The key derived by ldn-sysmodule is used directly as the static CCMP key for all data-frames (CCMP / MIC is standard). However, with [[#GroupInfo]]+0x8A value 3, standard WPA2-PSK is used instead.

This uses infrastructure-mode (AccessPoint), and DHCP is used. The group-owner is the AccessPoint. Note that the probe response includes the same Nintendo tags included with the beacon. Once connected, the group-owner sends the same Epigram-vendor Action frame(s) described in [[#ldn]]. At this point socket communication can begin, including DHCP usage.

The DHCP server thread is started by the "nn.lp2p.StateMachine" thread eventually during group [[#CreateGroup|creation]]. The DHCP Offer option values are the following:
* "Subnet Mask: 255.255.255.0"
* "DHCP Server Identifier: {...}"
* "Broadcast Address: {...}"
* "IP Address Lease Time: (5s) 5 seconds"
* "Renewal Time Value: (0s) 0 seconds"
* "Rebinding Time Value: (0s) 0 seconds"
* "Interface MTU: 1500"

Note that the above options doesn't include "Domain Name Server" or "Router", the client device may fail to connect if it doesn't allow those DHCP options to be missing.

=== Beacon ===
The SSID in the beacon can optionally be [[#GroupInfo|hidden]] (all-zero with the same length as the original SSID). The beacon contains two vendor-specific Nintendo information elements with OUI <code>00:22:aa</code>; each IE has a 2-byte ID following the OUI. These Nintendo IEs are not used when standard WPA2-PSK is being used.

The beacon is identical to ldn, except for the following (besides SSID length difference and the lp2p-only Nintendo tags):
* "Tag: Traffic Indication Map (TIM)": "DTIM count" for lp2p is 1, with ldn it's 0.
* "Tag: HT Capabilities (802.11n D1.10)": "HT Short GI for 20MHz" is set to "Not supported", for ldn it's "Supported".
* "Tag: Vendor Specific: Microsoft Corp.: WMM/WME: Parameter Element" "Ac Parameters ACI 0": "CW Min: 15" for lp2p, "CW Min: 63" for ldn.

Note that during group creation the beacon may be missing the Nintendo IEs in some cases, since group creation didn't finish yet.

The first Nintendo IE (ID 0x0600) contains the following data:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x2 || Usually 20 02?(Second byte depends on whether encryption is used?)
|-
| 0x2 || 0x2 || Usually 01 00 or 02 00?(varies)
|-
| 0x4 || 0x8 || Big-endian version of [[#GroupInfo]]+0x10.
|-
| 0xC || 0x10 || Same as [[#GroupInfo]]+0x0.
|-
| 0x1C || || Start of encrypted (and crypto-related) data if enabled. 0x22-bytes when encrypted, 0xE-bytes when plaintext.
|}

The second Nintendo IE (ID 0x0601) contains the following data (data is encrypted if enabled, there's also an additional 0x14-bytes when encrypted):

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || Plaintext: usually 21?
|-
| 0x1 || 0x1 || Plaintext: AdvertiseData size
|-
| 0x2 || {above size} || Plaintext: AdvertiseData
|}

=== ActionFrame ===
The Action frames have the following structure:
* "Fixed parameters":
** "Category code: Vendor Specific (127)"
** "OUI: 00:22:aa (Nintendo Co., Ltd.)"
* The Data starts with the following:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x2 || Usually 06 00?
|-
| 0x2 || 0x2 || Usually 20 02?(Second byte depends on whether encryption is used?)
|-
| 0x4 || 0x2 || Usually 02 00?(varies)
|-
| 0x6 || 0x8 || Big-endian version of [[#GroupInfo]]+0x10.
|-
| 0xE || 0x10 || Same as [[#GroupInfo]]+0x0.
|}

When encryption is used, the remaining data is:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || Big-endian u32 Counter. The initial value is randomly-generated (?). This is incremented with each sent Action frame.
|-
| 0x4 || {remaining size} || Encrypted user-data. Also includes 0x10-bytes of unknown data.
|}

When plaintext is used, the remaining data is:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || {remaining size} || Plaintext user-data.
|}

[[Category:Services]]

LDN services

2021-01-29T18:59:49Z

CFSworks: /* Beacon */ Restructure the "Nintendo tag" tables to make the ID explicit

LDN handles all local network communication.

= ldn:m =
This is "nn::ldn::detail::IMonitorServiceCreator".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#CreateMonitorService]]
|}

== CreateMonitorService ==
Returns an [[#IMonitorService]].

The user-process closes the IMonitorServiceCreator object immediately after using this cmd.

== IMonitorService ==
This is "nn::ldn::detail::IMonitorService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#GetStateForMonitor]]
|-
| 1 || [[#GetNetworkInfoForMonitor]]
|-
| 2 || [[#GetIpv4AddressForMonitor]]
|-
| 3 || [[#GetDisconnectReasonForMonitor]]
|-
| 4 || [[#GetSecurityParameterForMonitor]]
|-
| 5 || [[#GetNetworkConfigForMonitor]]
|-
| 100 || [[#InitializeMonitor]]
|-
| 101 || [[#FinalizeMonitor]]
|}

=== GetStateForMonitor ===
No input, returns an output u32.

sdknso implements this by <code>return</code>ing the u32, with 0 being returned on error.

=== GetNetworkInfoForMonitor ===
Takes a type-0x1A output buffer containing a [[#NetworkInfo]].

=== GetIpv4AddressForMonitor ===
No input, returns an output [[#Ipv4Address]] and a [[#SubnetMask]].

=== GetDisconnectReasonForMonitor ===
No input, returns an output s16.

This is not exposed by sdknso.

This just returns 0.

=== GetSecurityParameterForMonitor ===
No input, returns an output [[#SecurityParameter]].

This is not exposed by sdknso.

=== GetNetworkConfigForMonitor ===
No input, returns an output [[#NetworkConfig]].

This is not exposed by sdknso.

=== InitializeMonitor ===
No input/output.

This is used immediately after object creation. Official sw will Abort if this fails.

This just returns 0.

=== FinalizeMonitor ===
No input/output.

This is used during service exit, prior to closing the object. Official sw will Abort if this fails.

This just returns 0.

= ldn:s =
This is "nn::ldn::detail::ISystemServiceCreator".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#CreateSystemLocalCommunicationService]]
|}

== CreateSystemLocalCommunicationService ==
Returns an [[#ISystemLocalCommunicationService]].

The user-process closes the ISystemServiceCreator object immediately after using this cmd. Official sw ignores errors from this cmd.

== ISystemLocalCommunicationService ==
This is "nn::ldn::detail::ISystemLocalCommunicationService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#GetState]]
|-
| 1 || [[#GetNetworkInfo]]
|-
| 2 || [[#GetIpv4Address]]
|-
| 3 || [[#GetDisconnectReason]]
|-
| 4 || [[#GetSecurityParameter]]
|-
| 5 || [[#GetNetworkConfig]]
|-
| 100 || [[#AttachStateChangeEvent]]
|-
| 101 || [[#GetNetworkInfoLatestUpdate]]
|-
| 102 || [[#Scan]]
|-
| 103 || [[#ScanPrivate]]
|-
| 104 || [5.0.0+] [[#SetWirelessControllerRestriction]]
|-
| 200 || [[#OpenAccessPoint]]
|-
| 201 || [[#CloseAccessPoint]]
|-
| 202 || [[#CreateNetwork]]
|-
| 203 || [[#CreateNetworkPrivate]]
|-
| 204 || [[#DestroyNetwork]]
|-
| 205 || [[#Reject]]
|-
| 206 || [[#SetAdvertiseData]]
|-
| 207 || [[#SetStationAcceptPolicy]]
|-
| 208 || [[#AddAcceptFilterEntry]]
|-
| 209 || [[#ClearAcceptFilter]]
|-
| 300 || [[#OpenStation]]
|-
| 301 || [[#CloseStation]]
|-
| 302 || [[#Connect]]
|-
| 303 || [[#ConnectPrivate]]
|-
| 304 || [[#Disconnect]]
|-
| 400 || [[#InitializeSystem]]
|-
| 401 || [[#FinalizeSystem]]
|-
| 402 || [4.0.0+] [[#SetOperationMode]]
|-
| 403 || [7.0.0+] [[#InitializeSystem2]]
|}

=== GetState ===
No input, returns an output u32.

sdknso implements this by <code>return</code>ing the u32, with 0 being returned on error / when service isn't initialized.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || None
|-
| 1 || Initialized
|-
| 2 || AccessPointOpened
|-
| 3 || AccessPointCreated
|-
| 4 || StationOpened
|-
| 5 || StationConnected
|-
| 6 || Error
|-
|}

=== GetNetworkInfo ===
Takes a type-0x1A output buffer containing a [[#NetworkInfo]].

=== GetIpv4Address ===
No input, returns an output [[#Ipv4Address]] and a [[#SubnetMask]].

=== GetDisconnectReason ===
No input, returns an output s16.

sdknso implements this by <code>return</code>ing the s16 as a s32, with -1 being returned on error.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| -1 || See above.
|-
| 0 || None
|-
| 1 || User
|-
| 2 || SystemRequest
|-
| 3 || DestroyedByAdmin
|-
| 4 || DestroyedBySystemRequest
|-
| 5 || Admin
|-
| 6 || SignalLost
|}

=== GetSecurityParameter ===
No input, returns an output [[#SecurityParameter]].

=== GetNetworkConfig ===
No input, returns an output [[#NetworkConfig]].

=== AttachStateChangeEvent ===
No input, returns an output Event handle.

sdknso uses EventClearMode=1 with this. sdknso will Abort if this cmd fails.

This is signaled when the data returned by [[#GetNetworkInfo]]/[[#GetNetworkInfoLatestUpdate]] is updated.

=== GetNetworkInfoLatestUpdate ===
Takes a type-0x1A output buffer containing a [[#NetworkInfo]] and a type-0xA output buffer containing an array of [[#NodeLatestUpdate]].

The array count must be 8.

=== Scan ===
Takes a type-0x22 output buffer containing an array of [[#NetworkInfo]], a s16 channel, a [[#ScanFilter]], returns an output s16 total_out.

sdknso copies the output s16 to a s32, the value passed for the input s16 is from an user-specified s32 (user-apps generally use value 0 for this).

This is the same as [[#ScanPrivate]], except this also has the same channel-override functionality as [[#CreateNetwork]].

[[#GetState|State]] must be 3-5.

The array count must be at least 1. This is clamped to a maximum of 0x18.

=== ScanPrivate ===
Takes a type-0x22 output buffer containing an array of [[#NetworkInfo]], a s16 channel, a [[#ScanFilter]], returns an output s16 total_out.

sdknso copies the output s16 to a s32, the value passed for the input s16 is from an user-specified s32.

See [[#Scan]].

=== SetWirelessControllerRestriction ===
Takes an input [[#WirelessControllerRestriction]], no output.

[[#GetState|State]] must be 1.

The input value is written into state.

=== OpenAccessPoint ===
No input/output.

[[#GetState|State]] must be 1, this cmd eventually sets the State to value 2.

=== CloseAccessPoint ===
No input/output.

[[#GetState|State]] must be 2-3, this cmd eventually sets the State to value 1.

=== CreateNetwork ===
Takes an input [[#SecurityConfig]], an [[#UserConfig]], a [[#NetworkConfig]], no output.

This is the same as [[#CreateNetworkPrivate]], except the [[#AddressEntry]] params are 0, and the [[#SecurityParameter]] is generated from "nn::util::TinyMt::GenerateRandomBytes".

Unlike CreateNetworkPrivate, this overwrites the channel field in the [[#NetworkConfig]]. When the cached [[SPL_services#IsDevelopment|IsDevelopment]] value is true, the output from [[Settings_services|GetLdnChannel]] will overwrite that field if the s32 setting value is >=0, otherwise the original value is used. Otherwise when the IsDevelopment field is false (retail), the channel is overwritten with value 0.

This overwrites the u16 field at [[#SecurityConfig]]+0. When the cached [[SPL_services#IsDevelopment|IsDevelopment]] value is false (retail), value 1 is used, otherwise the original value is used.

[[#GetState|State]] must be 2, this cmd eventually sets the State to value 3.

=== CreateNetworkPrivate ===
Takes an input [[#SecurityConfig]], a [[#SecurityParameter]], an [[#UserConfig]], a [[#NetworkConfig]], a type-0x9 input buffer containing an array of [[#AddressEntry]], no output.

The buffer/count for [[#AddressEntry]] can be 0, in which case the network will be non-Private like [[#CreateNetwork]]. The count must be <=8.

See [[#CreateNetwork]].

=== DestroyNetwork ===
No input/output.

[[#GetState|State]] must be 3, this cmd eventually sets the State to value 2.

=== Reject ===
Takes an input [[#Ipv4Address]], no output.

[[#GetState|State]] must be 3.

=== SetAdvertiseData ===
Takes a type-0x21 input buffer, no output.

The input buffer contains arbitrary user data.

The buffer size must be <=0x180. An empty buffer (addr=NULL/size=0) can be used to reset the AdvertiseData size in state to zero.

[[#GetState|State]] must be 2-3.

=== SetStationAcceptPolicy ===
Takes an input [[#AcceptPolicy]], no output.

[[#GetState|State]] must be 2-3.

=== AddAcceptFilterEntry ===
Takes an input [[#MacAddress|MacAddress]], no output.

There are two sdknso funcs implementing this: one which takes a [[#MacAddress|MacAddress]] directly, the other loads the [[#MacAddress|MacAddress]] from the input [[#NodeInfo|NodeInfo]].

[[#GetState|State]] must be 2-3.

=== ClearAcceptFilter ===
No input/output.

[[#GetState|State]] must be 2-3.

=== OpenStation ===
No input/output.

[[#GetState|State]] must be 1, this cmd eventually sets the State to value 4.

=== CloseStation ===
No input/output.

[[#GetState|State]] must be 4-5, this cmd eventually sets the State to value 1.

=== Connect ===
Takes a type-0x19 input buffer containing a [[#NetworkInfo]], a [[#SecurityConfig]], an [[#UserConfig]], a s32 LocalCommunicationVersion, a [[#ConnectOption]], no output.

[[#GetState|State]] must be 4, this cmd eventually sets the State to value 5.

This is identical to [[#ConnectPrivate]] (besides the below), except the data internally passed for [[#SecurityParameter]]/[[#NetworkConfig]] are loaded from the input [[#NetworkInfo]].

This overwrites the u16 field at [[#SecurityConfig]]+0. When the cached [[SPL_services#IsDevelopment|IsDevelopment]] value is false (retail), value 1 is used, otherwise the used value is: original_field == 0 ? {u16 [[#NetworkInfo]]+0x60} : original_field.

u32 LocalCommunicationVersion>>15 must be 0.

=== ConnectPrivate ===
Takes a [[#SecurityConfig]], [[#SecurityParameter]], an [[#UserConfig]], a s32 LocalCommunicationVersion, a [[#ConnectOption]], a [[#NetworkConfig]], no output.

See [[#Connect]].

This overwrites the u16 field at [[#SecurityConfig]]+0. When the cached [[SPL_services#IsDevelopment|IsDevelopment]] value is false (retail), value 1 is used, otherwise the original value is used.

=== Disconnect ===
No input/output.

[[#GetState|State]] must be 5, this cmd eventually sets the State to value 4.

=== InitializeSystem ===
Takes an input PID and an u64 pid_placeholder.

This is used immediately after object creation.

With [7.0.0+] [[#InitializeSystem2]] is used instead.

=== FinalizeSystem ===
No input/output.

This is used during service exit, prior to closing the object. Official sw will Abort if this fails.

If State is set for it, this will run the equivalent of [[#CloseAccessPoint]]/[[#CloseStation]] when needed.

[[#GetState|State]] must be non-zero, this cmd eventually sets the State to value 0.

=== SetOperationMode ===
Takes an input [[#OperationMode]], no output.

[[#GetState|State]] must be 1.

The input value is written into state.

=== InitializeSystem2 ===
Takes an input PID, an u32, and an u64 pid_placeholder.

Official sw uses hard-coded value 0x1 for the u32.

The input u32 is ignored, the impl for this cmd is identical to [[#InitializeSystem]].

Internally this calls a func with params: (..., PID, &{u16 value 0x38}). On success, this then calls another func (which sets two state fields to the input) with params: (state, 0) (these state fields are used during [[#Authentication]] to check which service is being used).

The first func uses various [[Network_Interface_services|nifm]] funcs. The input value is used to determine the value for [[Network_Interface_services#CreateRequest|nn::nifm::RequestParameters]]: essentially, value 0x4 is used for ldn:u, and value 0x8 is used for ldn:s. The input value is also copied into state.

[[#GetState|State]] must be 0, this cmd eventually sets the State to value 1.

= ldn:u =
This is "nn::ldn::detail::IUserServiceCreator".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#CreateUserLocalCommunicationService]]
|}

== CreateUserLocalCommunicationService==
Returns an [[#IUserLocalCommunicationService]].

The user-process closes the IUserServiceCreator object immediately after using this cmd. Official sw ignores errors from this cmd.

== IUserLocalCommunicationService ==
This is "nn::ldn::detail::IUserLocalCommunicationService".

This is identical to [[#ISystemLocalCommunicationService]], except for the System-only cmd(s), and [[#Initialize]]/[[#Initialize2]] differ.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#GetState]]
|-
| 1 || [[#GetNetworkInfo]]
|-
| 2 || [[#GetIpv4Address]]
|-
| 3 || [[#GetDisconnectReason]]
|-
| 4 || [[#GetSecurityParameter]]
|-
| 5 || [[#GetNetworkConfig]]
|-
| 100 || [[#AttachStateChangeEvent]]
|-
| 101 || [[#GetNetworkInfoLatestUpdate]]
|-
| 102 || [[#Scan]]
|-
| 103 || [[#ScanPrivate]]
|-
| 104 || [5.0.0+] [[#SetWirelessControllerRestriction]]
|-
| 200 || [[#OpenAccessPoint]]
|-
| 201 || [[#CloseAccessPoint]]
|-
| 202 || [[#CreateNetwork]]
|-
| 203 || [[#CreateNetworkPrivate]]
|-
| 204 || [[#DestroyNetwork]]
|-
| 205 || [[#Reject]]
|-
| 206 || [[#SetAdvertiseData]]
|-
| 207 || [[#SetStationAcceptPolicy]]
|-
| 208 || [[#AddAcceptFilterEntry]]
|-
| 209 || [[#ClearAcceptFilter]]
|-
| 300 || [[#OpenStation]]
|-
| 301 || [[#CloseStation]]
|-
| 302 || [[#Connect]]
|-
| 303 || [[#ConnectPrivate]]
|-
| 304 || [[#Disconnect]]
|-
| 400 || [[#Initialize]]
|-
| 401 || [[#Finalize]]
|-
| 402 || [7.0.0+] [[#Initialize2]]
|}

=== Initialize ===
Takes an input PID and an u64 pid_placeholder.

This is used immediately after object creation.

With [7.0.0+] [[#Initialize2]] is used instead.

This is identical to [[#InitializeSystem]] except different params are used for the funcs called internally.

=== Finalize ===
No input/output.

This is used during service exit, prior to closing the object. Official sw will Abort if this fails.

This is identical to [[#FinalizeSystem]].

=== Initialize2 ===
Takes an input PID, an u32, and an u64 pid_placeholder.

Official sw uses hard-coded value 0x1 for the u32.

The input u32 is ignored, the impl for this cmd is identical to [[#Initialize]].

This is identical to [[#InitializeSystem2]] except different params are used for the funcs called internally: the u16 value is 0x5A, and the value for the second func is 1.

= ndd =
This is "nn::ndd::IService".

This was added with [5.0.0] and removed with [6.0.0].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || EnableAutoCommunication
|-
| 1 || DisableAutoCommunication
|-
| 2 || IsAutoCommunicationEnabled
|-
| 3 || EnablePowerSave
|-
| 4 || DisablePowerSave
|-
| 5 || IsPowerSaveEnabled
|-
| 6 || IsNetworkActive
|-
| 7 || AcquireSendDataUpdateEvent
|-
| 8 || AddSendData
|-
| 9 || ClearSendData
|-
| 10 || GetSendData
|-
| 11 || AcquireReceiveDataEvent
|-
| 12 || GetCurrentReceiveDataCounter
|-
| 13 || GetOldestReceiveDataCounter
|-
| 14 || GetNextReceiveDataCounter
|-
| 15 || GetAvailableReceiveDataCount
|-
| 16 || GetRecentReceiveDataCounter
|-
| 17 || GetReceiveData
|-
| 18 || AddReceiveData
|-
| 19 || ClearReceiveData
|-
| 20 || ClearDataIdFilter
|-
| 21 || AcquireDeviceScanEvent
|-
| 22 || StartDeviceScan
|-
| 23 || CancelDeviceScan
|-
| 24 || GetDeviceScanResult
|}

= lp2p:app, lp2p:sys =
These are "nn::lp2p::detail::INetworkServiceCreator".

These were added with [9.0.0+].

lp2p:app is used by [[Mario Kart Live: Home Circuit]]. lp2p:sys is used by [[Album_Applet|LibraryAppletPhotoViewer]] with [11.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#CreateNetworkService]]
|-
| 8 || [[#CreateNetworkServiceMonitor]]
|}

== CreateNetworkService ==
Takes an input u32, an u64 pid_reserved, a PID, returns an output [[#INetworkService]].

The input u32 must be value 0x1.

== CreateNetworkServiceMonitor ==
Takes an input u64 pid_reserved, a PID, returns an output [[#INetworkServiceMonitor]].

== INetworkService ==
This is "nn::lp2p::detail::INetworkService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Initialize|Initialize]]
|-
| [9.0.0-9.0.1] 256 || [[#AttachNetworkInterfaceStateChangeEvent]]
|-
| [9.0.0-9.0.1] 264 || [[#GetNetworkInterfaceLastError]]
|-
| [9.0.0-9.0.1] 272 || [[#GetRole]]
|-
| [9.0.0-9.0.1] 280 || [[#GetAdvertiseData]]
|-
| [9.0.0-9.0.1] 288 || [[#GetGroupInfo]]
|-
| [9.0.0-9.0.1] 296 || [[#Join]]
|-
| [9.0.0-9.0.1] 304 || [[#GetGroupOwner]]
|-
| [9.0.0-9.0.1] 312 || [[#GetIpConfig]]
|-
| [9.0.0-9.0.1] 320 || [[#Leave]]
|-
| 512 || [[#Scan]]
|-
| 768 || [[#CreateGroup]]
|-
| 776 || [[#DestroyGroup]]
|-
| 784 || [[#SetAdvertiseData]]
|-
| 1536 || [[#SendToOtherGroup]]
|-
| 1544 || [[#RecvFromOtherGroup]]
|-
| 1552 || [[#AddAcceptableGroupId]]
|-
| 1560 || [9.1.0+] [[#RemoveAcceptableGroupId]]
|}

=== Initialize ===
No input/output.

Returns 0.

Unused by official sw.

=== Scan ===
Takes a type-0x19 input buffer containing a [[#GroupInfo]], a type-0x22 output buffer containing an array of [[#ScanResult]], returns an output s32 total_out.

=== CreateGroup ===
Takes a type-0x31 input buffer containing a [[#GroupInfo]], no output.

[[Mario Kart Live: Home Circuit|mklive]] uses the following string with this: "Failed to create a group: %08X".

The [[#GetRole|role]] must be 0. This eventually sets the [[#GetRole|role]] to value 1.

=== DestroyGroup ===
No input/output.

This destroys the previously [[#CreateGroup|created]] group. If no group was previously created ([[#GetRole|role]] is not 1), this just returns 0.

=== SetAdvertiseData ===
Takes a type-0x21 input buffer, no output.

The buffer size must be <=0x80. The [[#GetRole|role]] must be <=1.

A string in [[Mario Kart Live: Home Circuit|mklive]] refers to the buffer data as "scan advertise data".

=== SendToOtherGroup ===
Takes an input [[#MacAddress_2|MacAddress]], a [[#GroupId]], a s16 frequency, a s16 channel, an u32 flags, a type-0x21 input buffer, no output.

The buffer size must be <=0x400.

The MacAddress must be non-zero. The s16s must be >=1.

Only bit0 is used from flags: clear = block until the data can be sent, set = return error when the data can't be sent.

A string in [[Mario Kart Live: Home Circuit|mklive]] refers to the buffer data as "Action frame".

The [[#GetRole|role]] must be non-zero. The error from [[#GetNetworkInterfaceLastError]] will be returned if it's set.

[11.0.0+] [[#GroupInfo]]+0x8A must be value 2, otherwise an error is returned.

This sends an Action frame to the specified [[#GroupId]], with the specified destination [[#MacAddress_2|MacAddress]] (can be a broadcast address).

The frequency param is the same as the [[#GroupInfo]]+0x84 field.

=== RecvFromOtherGroup ===
Takes an input u32 flags, a type-0x22 output buffer, returns a [[#MacAddress_2|MacAddress]], an u16, a s16, an u32 out_size, a s32.

The out_size is the original size used for copying to the output buffer, before it's clamped to the output-buffer size.

Only bit0 is used from flags: clear = block until data is available, set = return error when data is not available.

When data is not available, the error from [[#GetNetworkInterfaceLastError]] will be returned if it's set.

The [[#GetRole|role]] must be non-zero.

This receives an Action frame.

=== AddAcceptableGroupId ===
Takes an input [[#GroupId]], no output.

=== RemoveAcceptableGroupId ===
No input/output.

== INetworkServiceMonitor ==
This is "nn::lp2p::detail::INetworkServiceMonitor".

This interface has no commands, until [9.1.0+] which added actual commands.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Initialize_2|Initialize]]
|-
| 256 || [[#AttachNetworkInterfaceStateChangeEvent]]
|-
| 264 || [[#GetNetworkInterfaceLastError]]
|-
| 272 || [[#GetRole]]
|-
| 280 || [[#GetAdvertiseData]]
|-
| 281 || [[#GetAdvertiseData2]]
|-
| 288 || [[#GetGroupInfo]]
|-
| 296 || [[#Join]]
|-
| 304 || [[#GetGroupOwner]]
|-
| 312 || [[#GetIpConfig]]
|-
| 320 || [[#Leave]]
|-
| 328 || [[#AttachJoinEvent]]
|-
| 336 || [[#GetMembers]]
|}

=== Initialize ===
Returns 0.

Unused by official sw.

=== AttachNetworkInterfaceStateChangeEvent ===
No input, returns an output Event handle with EventClearMode=0.

=== GetNetworkInterfaceLastError ===
No input/output.

=== GetRole ===
No input, returns an output u8.

=== GetAdvertiseData ===
Takes a type-0x22 output buffer, returns 2 output u16s.

Validates that the [[#GetRole|role]] is value 2, then copies data from state into the output buffer. The first output u16 is the size used for the memcpy, the second u16 is the original size from state.

=== GetAdvertiseData2 ===
Takes a type-0x22 output buffer, returns 2 output u16s.

This is identical to [[#GetAdvertiseData]] except this doesn't run the role validation.

=== GetGroupInfo ===
Takes a type-0x32 output buffer containing a [[#GroupInfo]].

Validates that the [[#GetRole|role]] is non-zero, then copies the struct from state into the output buffer.

=== Join ===
Takes a type-0x32 output buffer containing a [[#GroupInfo]] and a type-0x31 input buffer containing a [[#GroupInfo]].

This runs the same code as [[#CreateGroup]] to generate the [[#GroupInfo]] for the input struct (which with [[#CreateGroup]] would be available with [[#GetGroupInfo]]). The input struct is the same as [[#CreateGroup]].

=== GetGroupOwner ===
No input, returns an output 0x80-bytes [[#NodeInfo_2|NodeInfo]].

Validates that the [[#GetRole|role]] is non-zero, then copies the data from state to output.

=== GetIpConfig ===
Takes a type-0x1A output buffer containing a 0x100-byte struct.

Validates that the [[#GetRole|role]] is non-zero, then copies the struct from state into the output buffer.

+0x20 is the <code>struct sockaddr</code> IP address, +0x40 is the <code>struct sockaddr</code> subnet-mask, +0x60 is the <code>struct sockaddr</code> gateway(?). The address for the last one is set to localhost.

=== Leave ===
No input, returns an output u32.

=== AttachJoinEvent ===
No input, returns an output Event handle with EventClearMode=0.

=== GetMembers ===
Takes a type-0x22 output buffer containing an array of [[#NodeInfo_2|NodeInfo]], returns an output s32 total_out.

Validates that the [[#GetRole|role]] is value 1. Then any entries from state which are available are copied into the output array buffer, if there's space available. A maximum of 8 entries can be returned.

A string in [[Mario Kart Live: Home Circuit|mklive]] refers to the array data as "connected members".

= lp2p:m =
This is "nn::lp2p::detail::IMonitorServiceCreator".

This was added with [9.1.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#CreateMonitorService]]
|}

== CreateMonitorService ==
Takes a PID, a total of 0x10-bytes of input, and returns an [[#IMonitorService]].

== IMonitorService ==
This is "nn::lp2p::detail::IMonitorService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Initialize_3|Initialize]]
|-
| 288 || [[#GetGroupInfo]]
|-
| 320 || [[#Leave]]
|}

=== Initialize ===
Returns 0.

= Ipv4Address =
This is "nn::ldn::Ipv4Address". This is a 0x4-byte struct with 4-byte alignment.

This is essentially the same as <code>struct in_addr</code>, except this is little-endian.

This is generally "169.254.XXX.{...}", where XXX is random per created network.

= SubnetMask =
This is "nn::ldn::SubnetMask". This is a 0x4-byte struct with 4-byte alignment.

This is essentially the same as <code>struct in_addr</code>, except this is little-endian.

= Ssid =
This is "nn::ldn::Ssid".

When converting a Ssid to a string, the loaded chars from the string must be in the range of 0x20-0x7F, otherwise the byte written to the string will be 0.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || Length excluding NUL-terminator, must be 0x1-0x20.
|-
| 0x1 || 0x21 || SSID string including NUL-terminator, str[{above length}] must be 0.
|}

= NetworkInfo =
This is "nn::ldn::NetworkInfo". This is a 0x480-byte struct. The data at +0x50 is another struct.

The fields listed as Reserved (besides the fields before +0x10) are cleared during the memset and are not written to again afterwards, with cmds which return NetworkInfo.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || LocalCommunicationId
|-
| 0x8 || 0x2 || Reserved
|-
| 0xA || 0x2 || Arbitrary user data which can be used for filtering with [[#ScanFilter]].
|-
| 0xC || 0x4 || Reserved
|-
| 0x10 || 0x10 || Last 0x10-bytes of [[#SecurityParameter]]. NetworkId which is used to generate/overwrite the [[#Ssid]]. With [[#Scan]]/[[#ScanPrivate]], this is only done after filtering when +0x4B is value 0x2. The converted Ssid is a 0x20-byte lowercase hex string version of the input NetworkId.
|-
| 0x20 || 0x6 || [[#MacAddress|MacAddress]]
|-
| 0x26 || 0x22 || [[#Ssid]]
|-
| 0x48 || 0x2 || s16 NetworkChannel
|-
| 0x4A || 0x1 || s8 LinkLevel
|-
| 0x4B || 0x1 || Set to hard-coded value 0x2 with output structs, except with [[#Scan]]/[[#ScanPrivate]] which can also set value 0x1 in certain cases. 0x1 = normal network without an [[#ActionFrame]], 0x2 = LDN network with a valid [[#ActionFrame]].
|-
| 0x4C || 0x4 || Padding
|-
| 0x50 || 0x10 || First 0x10-bytes of [[#SecurityParameter]].
|-
| 0x60 || 0x2 || Same as [[#SecurityConfig]]+0x0.
|-
| 0x62 || 0x1 || [[#AcceptPolicy]]
|-
| 0x63 || 0x1 || Only set with [[#Scan]]/[[#ScanPrivate]], when +0x4B is value 0x2. See [[#ActionFrame]].
|-
| 0x64 || 0x2 || Padding
|-
| 0x66 || 0x1 || Maximum participants, for the [[#NodeInfo|NodeInfo]] array.
|-
| 0x67 || 0x1 || ParticipantNum, number of set entries in the [[#NodeInfo|NodeInfo]] array. If +0x4B is not 0x2, ParticipantNum should be handled as if it's 0.
|-
| 0x68 || 0x200(0x40*8) || Array of [[#NodeInfo|NodeInfo]] with 8 entries, starting with the AccessPoint node.
|-
| 0x268 || 0x2 || Reserved
|-
| 0x26A || 0x2 || AdvertiseData size
|-
| 0x26C || 0x180 || AdvertiseData
|-
| 0x3EC || 0x8C || Reserved
|-
| 0x478 || 0x8 || [6.0.0+] Random AuthenticationId. Set to the output from [[ETicket_services|es]] cmd1501 during network creation.
|}

= ScanFilter =
This is "nn::ldn::ScanFilter". This is a 0x60-byte struct with 8-byte alignment.

sdknso copies the input ScanFilter to a tmp struct on stack, which is then used with the cmd.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || When enabled, this will be overwritten if it's -1. The data written for this is the first [[NACP_Format|LocalCommunicationId]] for the user-process loaded via [[Glue_services|arp:r]], if loading fails value 0 is written instead. During filtering if enabled, u8 [[#NetworkInfo]]+0x4B must match 0x2, and this ScanFilter field must match [[#NetworkInfo]]+0x0.
|-
| 0x8 || 0x2 || Padding
|-
| 0xA || 0x2 || During filtering if enabled, u8 [[#NetworkInfo]]+0x4B must match 0x2, and this ScanFilter field must match [[#NetworkInfo]]+0xA.
|-
| 0xC || 0x4 || Padding
|-
| 0x10 || 0x10 || During filtering if enabled, u8 [[#NetworkInfo]]+0x4B must match 0x2, and this ScanFilter data must match [[#NetworkInfo]]+0x10.
|-
| 0x20 || 0x4 || When enabled, must be <=0x3, and during filtering must match u8 [[#NetworkInfo]]+0x4B.
|-
| 0x24 || 0x6 || [[#MacAddress|MacAddress]]. Only copied with [[#ScanPrivate]]. During filtering if enabled, this must match [[#NetworkInfo]]+0x20.
|-
| 0x2A || 0x22 || [[#Ssid]]. During filtering if enabled, this must match [[#NetworkInfo]]+0x26 (the [[#Ssid]] there must be valid for this as well). The strings are compared, without verifying the length field in [[#Ssid]] matches.
|-
| 0x4C || 0x10 || Cleared to zero for the tmp struct.
|-
| 0x5C || 0x4 || Flags. Masked with 0x37 for [[#Scan]], with [[#ScanPrivate]] this is masked with 0x3F.
|}

Flags:

{| class="wikitable" border="1"
|-
! Bit
! Description
|-
| 0 || When set, enables using ScanFilter+0.
|-
| 1 || When set, enables using ScanFilter+0x10.
|-
| 2 || When set, enables using ScanFilter+0x20.
|-
| 3 || When set, enables using the ScanFilter [[#MacAddress|MacAddress]].
|-
| 4 || When set, enables using the ScanFilter [[#Ssid]].
|-
| 5 || When set, enables using ScanFilter+0xA.
|}

= NetworkConfig =
This is "nn::ldn::NetworkConfig". This is a 0x20-byte struct with 8-byte alignment.

sdknso copies the input NetworkConfig to a tmp struct on stack, which is then used with the cmd ([[#CreateNetwork]], [[#CreateNetworkPrivate]], [[#ConnectPrivate]]).

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || LocalCommunicationId. Same as [[#NetworkInfo]]+0x0. [[#CreateNetwork]]/[[#CreateNetworkPrivate]]/[[#Connect]]/[[#ConnectPrivate]]: When -1, this is overwritten with the first [[NACP_Format|LocalCommunicationId]] for the user-process loaded via [[Glue_services|arp:r]], if loading fails value 0 is written instead. Otherwise when not -1, if control.nacp loading is successful with [[Glue_services|arp:r]], this field must match one of the LocalCommunicationIds from there otherwise an error is thrown.
|-
| 0x8 || 0x2 || Cleared to zero during the copy.
|-
| 0xA || 0x2 || Same as [[#NetworkInfo]]+0xA.
|-
| 0xC || 0x4 || Cleared to zero during the copy.
|-
| 0x10 || 0x2 || s16 Channel, can be zero. Same as [[#NetworkInfo]]+0x48.
|-
| 0x12 || 0x1 || s8. Same as [[#NetworkInfo]]+0x66. [[#CreateNetwork]]/[[#CreateNetworkPrivate]]: Must be 0x1-0x8.
|-
| 0x13 || 0x1 || Cleared to zero during the copy.
|-
| 0x14 || 0x2 || Same as [[#NetworkInfo]]+0x96 (LocalCommunicationVersion from the first [[#NodeInfo|NodeInfo]]). Must not be negative. [[#Connect]]/[[#ConnectPrivate]]: This must match the value for the AccessPoint LocalCommunicationVersion.
|-
| 0x16 || 0xA || Cleared to zero during the copy.
|}

= NodeLatestUpdate =
This is "nn::ldn::NodeLatestUpdate". This is a 0x8-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || The field in state is reset to zero by [[#GetNetworkInfoLatestUpdate]] after loading it. Official apps checks whether this is non-zero.
|-
| 0x1 || 0x7 || Not initialized with [[#GetNetworkInfoLatestUpdate]].
|}

= WirelessControllerRestriction =
This is "nn::ldn::WirelessControllerRestriction". This is an u32 enum.

This is used to determine the value passed to [[BTM_services|btm]] SetWlanMode.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 ||
|-
| 1 || This is the default.
|}

= SecurityConfig =
This is "nn::ldn::SecurityConfig". This is a 0x44-byte struct with 2-byte alignment.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x2 || Type, a default of value 1 can be used here. Overwritten by [[#CreateNetwork]]/[[#CreateNetworkPrivate]] and [[#Connect]]/[[#ConnectPrivate]]. The value used internally by these cmds must be 1-3.
|-
| 0x2 || 0x2 || Data size. Must be 0x10-0x40.
|-
| 0x4 || 0x40 || Data, used with key derivation.
|}

Type:
* 1-2: Broadcast Action frame data is encrypted and is verified with SHA256.
* 3: Broadcast Action frame data is plaintext and is verified with SHA256.

* 1: Data frames are encrypted.
* 2-3: Data frames for normal data-transfer are plaintext - the network is Open.

= SecurityParameter =
This is "nn::ldn::SecurityParameter". This is a 0x20-byte struct with 1-byte alignment.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x10 || Data, used with the same key derivation as [[#SecurityConfig]].
|-
| 0x10 || 0x10 || NetworkId, see [[#NetworkInfo]].
|}

= UserConfig =
This is "nn::ldn::UserConfig". This is a 0x30-byte struct with 1-byte alignment.

sdknso copies the input UserConfig to a tmp struct on stack, which is then used with the cmd.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x20 || NUL-terminated string for the user nickname.
|-
| 0x20 || 0x10 || Cleared to zero during the copy.
|}

= AddressEntry =
This is "nn::ldn::AddressEntry". This is a 0xC-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || [[#Ipv4Address]]
|-
| 0x4 || 0x6 || [[#MacAddress|MacAddress]]
|-
| 0xA || 0x2 || Padding
|}

= AcceptPolicy =
This is "nn::ldn::AcceptPolicy". This is an u8.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || Allow all.
|-
| 1 || Deny all.
|-
| 2 || Blacklist, addresses in the [[#AddAcceptFilterEntry|list]] are not allowed.
|-
| 3 || Whitelist, only addresses in the [[#AddAcceptFilterEntry|list]] are allowed.
|}

= MacAddress =
This is "nn::ldn::MacAddress". This is a 6-byte struct with 1-byte alignment.

= NodeInfo =
This is "nn::ldn::NodeInfo".

The fields listed as Reserved are cleared during the memset and are not written to again afterwards, with cmds which return [[#NetworkInfo]].

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || [[#Ipv4Address]]
|-
| 0x4 || 0x6 || [[#MacAddress|MacAddress]]
|-
| 0xA || 0x1 || s8 ID / index
|-
| 0xB || 0x1 || IsConnected
|-
| 0xC || 0x20 || First 0x20-bytes of [[#UserConfig]].
|-
| 0x2C || 0x2 || Reserved
|-
| 0x2E || 0x2 || s16 LocalCommunicationVersion
|-
| 0x30 || 0x10 || Reserved
|}

= ConnectOption =
This is "nn::ldn::ConnectOption". This is an u32 bitmask.

There's two versions of the sdknso funcs for [[#Connect]]/[[#ConnectPrivate]]: the version where the ConnectOption isn't user-specified uses a default value of 0x1 for it, with the same ShowError code without the bit0 check.

When bit0 here is set after using the above cmds, the sdknso funcs will use [[Error_Applet|ShowError]] with the returned Result if: (rc & 0x3FE1FF) == 0xE0CB.

This must be <=0x1, besides this validation ConnectOption is ignored by [[#Connect]]/[[#ConnectPrivate]].

= OperationMode =
This is "nn::ldn::OperationMode". This is an u32 enum.

This controls bit1 in the value passed to [[WLAN_services|wlan:lcl]] cmd0/cmd1: bit1 = OperationMode==1.

Value 1 seems to affect power (?) related fields in the beacon tags?

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || This is the default.
|-
| 1 ||
|}

= MacAddress =
This is "nn::lp2p::MacAddress". Same as [[#MacAddress|MacAddress]].

= GroupId =
This is "nn::lp2p::GroupId". This is a 6-byte struct with 1-byte alignment.

This is a WiFi BSSID.

= NodeInfo =
This is "nn::lp2p::NodeInfo". This is a 0x80-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || || <code>struct sockaddr</code> for the IP address.
|-
| 0x24 || 0x6 || [[#MacAddress_2|MacAddress]]
|}

= GroupInfo =
This is "nn::lp2p::GroupInfo". This is a 0x200-byte struct.

[[Mario Kart Live: Home Circuit|mklive]] sets the SSID to a string generated from random data.

[[#Scan_2|Scan]] only uses the following fields for the cmd input struct: SupportedPlatform/Priority, Frequency/Channel, and PresharedKeyBinarySize/PresharedKey.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x10 || When zero, this is set to randomly-generated data. Used during key derivation.
|-
| 0x10 || 0x8 || LocalCommunicationId. When zero, the value from control.nacp is loaded. This is later validated by [[#Join]]/[[#CreateGroup]] the same way as the [[#NetworkConfig]] field. Used during key derivation.
|-
| 0x18 || 0x6 || [[#GroupId]] ("GROUP ID (BSSID)"). When zero, the default is used. The default should be used here: an error is thrown if the data here doesn't match the output from [[WLAN_services|wlan:lcl]] cmd2.
|-
| 0x1E || 0x21 || ServiceName ("GROUP NAME (SSID)"). NUL-terminated string. See below.
|-
| 0x3F || 0x1 || s8 Flags count. Must be <=0x3F.
|-
| 0x40 || 0x40 || Array of s8 with the above count. Each entry value must be <=0x3F. Each entry is an array index used to load a set of flags from a global array with the specified index. global_flags are also masked with flags loaded from here. User-processes use entryval=1 as the default, with [11.0.0+] entryval=0 can be used for standard WPA2-PSK (see +0x8A).
|-
| 0x80 || 0x1 || SupportedPlatform. Must match value 1. 0 is PlatformIdNX, 1 is PlatformIdFuji.
|-
| 0x81 || 0x1 || MemberCountMax. s8, Must be <=0x8. During group creation this is passed to [[WLAN_services|wlan:lcl]] cmd40, when this is value 0 a default of value 1 is passed. During group-creation when the below +0x88 field is not value 0x2, the passed [[BTM_services#SetWlanMode|WlanMode]] is <code>x81_field_val > 3</code>.
|-
| 0x82 || 0x1 ||
|-
| 0x84 || 0x2 || Frequency. Wifi frequency: 24 = 2.4GHz, 50 = 5GHz.
|-
| 0x86 || 0x2 || s16 Channel ("CHANNEL"). Wifi channel number. 0 = use default, otherwise this must be one of the following depending on the frequency field:
* 24: 1, 6, 11.
* 50: 36, 40, 44, 48.
|-
| 0x88 || 0x1 || NetworkMode. Used during group-creation to determine the [[BTM_services#SetWlanMode|WlanMode]] to use. When this is value 0x2, mode=3 is used, otherwise it's determined via the +0x81 field.
|-
| 0x89 || 0x1 || PerformanceRequirement.
|-
| 0x8A || 0x1 || Security type, used during key derivation. 0 = use defaults, 1 = plaintext, 2 = encrypted. [11.0.0+] 3: Standard WPA2-PSK.
|-
| 0x8B || 0x1 || StaticAesKeyIndex. s8, used as the array-index for selecting the KeySource used with [[SPL_services#GenerateAesKek|GenerateAesKek]] during key derivation. Should be 1-2, otherwise GenerateAesKek is skipped and zeros are used for the AccessKey instead.
|-
| 0x8D || 0x1 || Priority. Must match one of the following, depending on the used service (doesn't apply to [[#Join]]): 55 = SystemPriority (lp2p:sys), 90 = ApplicationPriority (lp2p:app and lp2p:sys).
|-
| 0x8E || 0x1 || StealthEnabled. Bool flag, controls whether the SSID is hidden.
|-
| 0x8F || 0x1 || If zero, a default value of 0x20 is used.
|-
| 0x1C0 || 0x1 || PresharedKeyBinarySize. Must be 0x20 for PresharedKeyBinary. [11.0.0+] With WPA2-PSK, this must be value 1.
|-
| 0x1C1 || 0x3F ([9.0.0-10.2.0] 0x20) || PresharedKey. Used during key derivation. [11.0.0+] With WPA2-PSK, this is the passphrase string (length must be at least 8).
|}

In order for the ServiceName to be valid without a new one being generated, the following checks must pass:
* It loops through the characters in the string, looking for the first '_' character:
** The loop will exit once a '_' character is found.
** The character must be '-', or alphanumeric (lowercase/uppercase), otherwise the function will immediately return failure.
** The loop will also exit once string_pos is >19, in which case the function will also immediately return failure.
* Then it checks the 11 characters which follow the above:
** The character must be hex: '0'-'9', or 'A-F' / 'a-'f.
* The following character must be a NUL-terminator.
* The last hex character above, then the characters for the whole string prior to the last hex character are summed. return sum % 0x2B == 0. u32 is used for these calculations. (Return success when sum is a multiple of 0x2B, otherwise return failure)

If the above fails, then the following runs, otherwise it just returns 0:
* It loops through the characters in the string.
** The character must be '-', or alphanumeric (lowercase/uppercase), otherwise the function will immediately return failure.
** The loop will exit once string_pos>20 is reached, or when a NUL-terminator is reached.
* Once finished, success is returned if string_pos-1 is <20, otherwise failure is returned (which also immediately occurs if the first character is a NUL-terminator).

If the above fails, an error is returned, otherwise a new ServiceName is generated:
* Up to 20 characters are copied from the original ServiceName to the output ServiceName, stopping once the limit is reached or when a NUL-terminator is reached.
* '_' is appended to the string.
* <code>nn::util::TSNPrintf({strptr following the above character}, {remaining size}, "%02X%02X%02X%02X%02X", [[#GroupId|GroupId_byte3]], [[#GroupId|GroupId_byte4]], [[#GroupId|GroupId_byte5]], ([[SPL_services#IsDevelopment|IsDevelopment]] ? 0x80 : 0) | 0x1, 0);</code>
* Then the last character is set to the output from a calling a function:
** All string characters which were already written are summed same way as above. Then: <code>return character_lookup_table[sum % 0x2B];</code> (If the length passed to this function is 0, this will instead just return character_lookup_table[0])
*** character_lookup_table contains 0x2B entries: [V-A][k-a][5-0][Z-W].

loaded_flags are first loaded from elsewhere, then masked with the above flags when available. loaded_flags are used when +0x8A is 0. global_flags are loaded from global data. These flags are only used with [[#CreateGroup]]/[[#Join]]. Flags (note that the following was updated with [11.0.0+], and differs from below):
* Bit2 clear:
** global_flags must be non-zero, and loaded_flags bit1 must be set.
** u8 +0x8A is set to value 1.
** When the cached [[SPL_services#IsDevelopment|IsDevelopment]] value is false (retail), an error is thrown.
** u8 +0x8B is set to value 0.
* Otherwise, if bit2 is set:
** u8 +0x8A is set to value 2.
** global_flags bit1 set:
*** u8 +0x8B is set to value 1.
** Otherwise, if global_flags bit2 is set:
*** u8 +0x8B is set to value 2.

= ScanResult =
This is "nn::lp2p::ScanResult". This is a 0x300-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x200 || [[#GroupInfo]]
|-
| 0x200 || 0x1 ||
|-
| 0x206 || 0x2 || AdvertiseData size.
|-
| 0x208 || 0x80 || AdvertiseData
|}

= Network protocol =
== ldn ==
A beacon and Action frame are broadcasted. The SSID in the beacon is hidden (32-bytes with value 0). For [[#Scan]]/[[#ScanPrivate]] it doesn't matter if no beacon is available ([[#NetworkInfo]] is the same), as long as the Action frame is broadcasted. However, the Station will not send a probe-request during connection if no beacon is available (and therefore not attempt any communication with the AccessPoint). The beacon doesn't have any custom Nintendo data, that data is in the Acton frame.

During connection, the Station first sends a probe-request using the [[#NetworkInfo|generated]] SSID from the Action frame. If the probe-response contains the expected data for the [[#SecurityConfig]] type, the Station then proceeds to connect to the AccessPoint. The key for data-frames, if [[#SecurityConfig|enabled]], is derived from a buffer containing: {[[#SecurityParameter]]+0x0} followed by {[[#SecurityConfig]] data with the specified data-size}. The [[#ActionFrame]]/data-frame keys are derived with the same func, the only difference is the input passed to this func + the passed constant data. The key derived by ldn is used directly as the static CCMP key for all data-frames (CCMP / MIC is standard).

Then the Station scans for an [[#ActionFrame]] for loading the [[#NetworkInfo]].

Once connected, the AccessPoint sends Epigram-vendor Action frame(s) (same data) to the Station, the Station doesn't require these frames: <code>dd1afeedfacedeadbeef010000000a00000000000000000000000000</code>. Then the Station must Authenticate with the AccessPoint, this is custom. The Station sends a frame (a maximum of 3 times in some cases if errors occur, with the same data), and the AccessPoint sends a response. Once Authenticated, the node is added to the [[#NodeInfo|NodeInfo]] array in [[#NetworkInfo]]. If the Station does not successfully Authenticate X-seconds after connecting, the AccessPoint disconnects the Station. If the Station fails to Authenticate, the Station itself will disconnect as well.

After Authentication the Station will scan for another [[#ActionFrame]], with frame-comparision enabled with the above frame (frame must have been updated since the previous scan). The Station locates the index for a [[#MacAddress|MacAddress]] matching itself in the [[#NetworkInfo]] [[#NodeInfo|NodeInfo]] array (the entry for the AccessPoint is skipped), throwing an error if not found. After validating the LocalCommunicationVersion, it proceeds to handle ARP setup below.

This does not use DHCP, each node on the network has to manually setup ARP (without sending ARP network requests) with the [[#NodeInfo|NodeInfo]] array in [[#NetworkInfo]].

At this point standard sockets can be used over Data frames.

=== EthFrame ===
The custom Ethernet frames have the following structure:
* "Type: IEEE 802a OUI Extended Ethertype (0x88b7)"
* "IEEE802a OUI Extended Ethertype":
** "Organization Code: 00:22:aa (Nintendo Co., Ltd.)"
** "Protocol ID: {...}"
*** Depends on the frame:
*** 0x0102: [[#Authentication]]
*** 0x0103: ?
* The first byte of Data is value 0, then the ProtocolID-specific data follows, see below.
** ProtocolID 0x0103 frames are sent by the AccessPoint to the Station. This is 0x20-bytes of zeros, except for the first byte which is 0x3. This is sent by the AccessPoint prior to destroying the network.

==== Authentication ====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || [[#AuthVersion]]
|-
| 0x1 || 0x1 || Low u8 for the size.
|-
| 0x2 || 0x1 || Status. 0 = success, non-zero = error.
|-
| 0x3 || 0x1 || [2.0.0+] bool flag. The AccessPoint verifies that this is not set. Always set to 1 by the AccessPoint in the response. The Station only uses this when the [[#AuthVersion]] is >=2.
|-
| 0x4 || 0x1 || [6.0.0+] High u8 for the size.
|-
| 0x5 || 0x3 || Unused, zeros.
|-
| 0x8 || 0x20 || [[#NetworkInfo]]+0, must match the corresponding data in [[#NetworkInfo]] when the receiving node verifies this. With the
AccessPoint->Station frame, the Station verifies that this matches the data previously sent to the AccessPoint.
|-
| 0x28 || 0x10 || [[#NetworkInfo]]+0x50, must match the corresponding data in [[#NetworkInfo]] when the receiving node verifies this. With the
AccessPoint->Station frame, the Station verifies that this matches the data previously sent to the AccessPoint.
|-
| 0x38 || 0x10 || See below.
|-
| 0x48 || || Frame-specific data, with the above size. The total frame size - {offset of the start of this data in the frame} must match the above size.
|}

The Station sets the above size to 0x40 ([6.0.0+] if [[#NetworkInfo]]+0x13 is <3). [6.0.0+] The Authentication challenge is only used/enabled if that value is >=3, and [[#IUserLocalCommunicationService]] is being used.

The AccessPoint sets the above size to 0x40 ([6.0.0+] 0x0 if the +0x0 [[#AuthVersion]] is <3). [6.0.0+] The AccessPoint will only use/enable the Authentication challenge when the +0x0 [[#AuthVersion]] is >=3, and [[#IUserLocalCommunicationService]] is being used. This data will not be included in the frame if the status field indicates error.

[6.0.0+] Support for the Authentication challenge with [[ETicket_services|es]] cmds 1501-1504 was added.

Station->AccessPoint frame, relative to +0x0 above (frame size depends on whether +0xAC is enabled):

The AccessPoint will not respond to frames where the source mac-address is unrecognized.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x38 || 0x10 || The Station sets this to random data. Unused by the AccessPoint, except for copying into the response.
|-
| 0x48 || 0x20 || [[#UserConfig]]+0. Copied into state by the AccessPoint.
|-
| 0x68 || 0x2 || Big-endian LocalCommunicationVersion. Byte-swapped by the AccessPoint then copied into state.
|-
| 0x6A || 0x1E || Zeros, unused by the AccessPoint.
|-
| 0x88 || 0x24 || [6.0.0+] Zeros, unused by the AccessPoint.
|-
| 0xAC || 0x300 || [6.0.0+] Authentication challenge data. If enabled, the total frame size must be >= {end offset of this data in the frame}. The frame data does not include this if it's not enabled.
|}

AccessPoint->Station response frame, relative to +0x0 above (frame size depends on whether +0x48/+0xCC are enabled):

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x38 || 0x10 || +0x38 from the data originally sent by the Station. The Station verifies that this matches the previously sent data.
|-
| 0x48 || 0x40 || Zeros. [6.0.0+] Only included in the frame if it's enabled (+0x0 [[#AuthVersion]] >= 3). Unused by the Station.
|-
| 0x88 || 0x44 || [6.0.0+] Only included in the frame if it's enabled (+0x0 [[#AuthVersion]] >= 3). Unused by the Station.
|-
| 0xCC || 0x100 || [6.0.0+] If enabled, Authentication challenge response data. Not included in the frame if it's not enabled.
|}

===== AuthVersion =====
Must be 0x1-0xF.

{| class="wikitable" border="1"
|-
! Value || SystemVersion
|-
| 1 || [1.0.0+]
|-
| 2 || [2.0.0+]
|-
| 3 || [6.0.0+]
|}

=== ActionFrame ===
The Action frames have the following structure:
* "Fixed parameters":
** "Category code: Vendor Specific (127)"
** "OUI: 00:22:aa (Nintendo Co., Ltd.)"
* The Data starts with the following header:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x2 || 04 00 in sent frames.
|-
| 0x2 || 0x2 || Protocol ID, must be 0x0101.
|-
| 0x4 || 0x2 || Must be 0.
|-
| 0x6 || 0x2 || Zeros, unused.
|}

Then the actual data follows:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x20 || [[#NetworkInfo]]+0x0. The u64/u16 are big-endian. Outside of [[#Scan]]/[[#ScanPrivate]], this must match the previously loaded data for this.
|-
| 0x20 || 0x1 || [[#AuthVersion]]. Copied to [[#NetworkInfo]]+0x63. When comparing with a previous frame is enabled, this must match the value from the previous frame.
|-
| 0x21 || 0x1 || Encryption type: 1 = plaintext, 2 = encrypted, {frames with other values are ignored by [[#Scan]]/[[#ScanPrivate]]}. Must match the type which is currently being used: with [[#Scan]]/[[#ScanPrivate]] this is determined via this field, otherwise [[#SecurityConfig]] is used to determine this.
|-
| 0x22 || 0x2 || Big-endian u16 size for the data starting at +0x48, must be <=0x500, and must match {total frame size relative to +0x0 above} + 0x48.
|-
| 0x24 || 0x4 || Big-endian u32 Counter. The initial value is randomly-generated. This is incremented each time the below content is updated (including initial creation). Also used by the Station to determine whether the frame changed compared to a previous one. When comparing against a previous frame, new_counter-prev_counter must be <= 0xFF, and the counters must not match.
|-
| 0x28 || 0x20 || SHA256 hash over the entire frame starting at +0x0, with the above size + 0x48. During hashing, this hash is cleared, with the new hash overwriting the original in memory (the original is copied to stack for comparing).
|}

When encryption is enabled, the encrypted data is +0x28 with size {remaining frame size}. This is encrypted with AES-128-CTR. The key is derived from the raw 0x20-bytes at +0x0. The CTR is {raw Counter above without byte-swap}, with the rest cleared to zeros.

The content data at +0x48 follows, which has the size specified above (which must be >=0x500), where all fields are big-endian:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x10 || [[#NetworkInfo]]+0x50
|-
| 0x10 || 0x2 || [[#NetworkInfo]]+0x60
|-
| 0x12 || 0x1 || [[#NetworkInfo]]+0x62
|-
| 0x13 || 0x3 || Unused
|-
| 0x16 || 0x1 || s8 [[#NetworkInfo]]+0x66, clamped to range 1-8.
|-
| 0x17 || 0x1 || s8 [[#NetworkInfo]]+0x67, clamped to range 1-8.
|-
| 0x18 || 0x1C0(0x38*8) || Array of the below node struct.
|-
| 0x1D8 || 0x2 || Unused
|-
| 0x1DA || 0x2 || [[#NetworkInfo]]+0x26A
|-
| 0x1DC || 0x180 || [[#NetworkInfo]]+0x26C
|-
| 0x35C || 0x19C || Unused
|-
| 0x4F8 || 0x8 || [6.0.0+] [[#NetworkInfo]]+0x478
|}

The data here is copied into [[#NetworkInfo]].

Node data used in the above array (all fields big-endian), which are copied into the [[#NetworkInfo]] [[#NodeInfo|NodeInfo]] array:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || [[#Ipv4Address]]
|-
| 0x4 || 0x6 || [[#MacAddress|MacAddress]]
|-
| 0xA || 0x1 || bool IsConnected
|-
| 0xB || 0x1 || Unused
|-
| 0xC || 0x20 || First 0x20-bytes of [[#UserConfig]].
|-
| 0x2C || 0x2 || s16 LocalCommunicationVersion
|-
| 0x2E || 0xA || Unused
|}

== lp2p ==
This is used for communicating with accessories (external devices on [11.0.0+]) over local wifi. [[Mario Kart Live: Home Circuit]] uses this. [11.0.0+] [[Album_Applet|LibraryAppletPhotoViewer]] uses this.

A beacon is broadcasted.

Action frames are only sent when done so by [[#SendToOtherGroup]] (other than the Epigram one mentioned below).

Communication uses sockets with standard Data frames and the above Action frames. Switch consoles presumably only use the Action frames to communicate with each other?

The key derived by ldn-sysmodule is used directly as the static CCMP key for all data-frames (CCMP / MIC is standard). However, with [[#GroupInfo]]+0x8A value 3, standard WPA2-PSK is used instead.

This uses infrastructure-mode (AccessPoint), and DHCP is used. The group-owner is the AccessPoint. Note that the probe response includes the same Nintendo tags included with the beacon. Once connected, the group-owner sends the same Epigram-vendor Action frame(s) described in [[#ldn]]. At this point socket communication can begin, including DHCP usage.

The DHCP server thread is started by the "nn.lp2p.StateMachine" thread eventually during group [[#CreateGroup|creation]]. The DHCP Offer option values are the following:
* "Subnet Mask: 255.255.255.0"
* "DHCP Server Identifier: {...}"
* "Broadcast Address: {...}"
* "IP Address Lease Time: (5s) 5 seconds"
* "Renewal Time Value: (0s) 0 seconds"
* "Rebinding Time Value: (0s) 0 seconds"
* "Interface MTU: 1500"

Note that the above options doesn't include "Domain Name Server" or "Router", the client device may fail to connect if it doesn't allow those DHCP options to be missing.

=== Beacon ===
The SSID in the beacon can optionally be [[#GroupInfo|hidden]] (all-zero with the same length as the original SSID). The beacon contains two custom Nintendo tags with OUI <code>00:22:aa</code>; each tag has a 2-byte ID following the OUI. These Nintendo tags are not used when standard WPA2-PSK is being used. The beacon is identical to ldn, except for the following (besides SSID length difference and the lp2p-only Nintendo tags):
* "Tag: Traffic Indication Map (TIM)": "DTIM count" for lp2p is 1, with ldn it's 0.
* "Tag: HT Capabilities (802.11n D1.10)": "HT Short GI for 20MHz" is set to "Not supported", for ldn it's "Supported".
* "Tag: Vendor Specific: Microsoft Corp.: WMM/WME: Parameter Element" "Ac Parameters ACI 0": "CW Min: 15" for lp2p, "CW Min: 63" for ldn.

Note that during group creation the beacon may be missing the Nintendo tags in some cases, since group creation didn't finish yet.

The first Nintendo tag (ID 0x0600) contains the following data:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x2 || Usually 20 02?(Second byte depends on whether encryption is used?)
|-
| 0x2 || 0x2 || Usually 01 00 or 02 00?(varies)
|-
| 0x4 || 0x8 || Big-endian version of [[#GroupInfo]]+0x10.
|-
| 0xC || 0x10 || Same as [[#GroupInfo]]+0x0.
|-
| 0x1C || || Start of encrypted (and crypto-related) data if enabled. 0x22-bytes when encrypted, 0xE-bytes when plaintext.
|}

The second Nintendo tag (ID 0x0601) contains the following data (data is encrypted if enabled, there's also an additional 0x14-bytes when encrypted):

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || Plaintext: usually 21?
|-
| 0x1 || 0x1 || Plaintext: AdvertiseData size
|-
| 0x2 || {above size} || Plaintext: AdvertiseData
|}

=== ActionFrame ===
The Action frames have the following structure:
* "Fixed parameters":
** "Category code: Vendor Specific (127)"
** "OUI: 00:22:aa (Nintendo Co., Ltd.)"
* The Data starts with the following:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x2 || Usually 06 00?
|-
| 0x2 || 0x2 || Usually 20 02?(Second byte depends on whether encryption is used?)
|-
| 0x4 || 0x2 || Usually 02 00?(varies)
|-
| 0x6 || 0x8 || Big-endian version of [[#GroupInfo]]+0x10.
|-
| 0xE || 0x10 || Same as [[#GroupInfo]]+0x0.
|}

When encryption is used, the remaining data is:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || Big-endian u32 Counter. The initial value is randomly-generated (?). This is incremented with each sent Action frame.
|-
| 0x4 || {remaining size} || Encrypted user-data. Also includes 0x10-bytes of unknown data.
|}

When plaintext is used, the remaining data is:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || {remaining size} || Plaintext user-data.
|}

[[Category:Services]]

Error codes

2021-01-29T18:55:32Z

CFSworks: /* Error codes */ Add a bunch of LP2P error codes I discovered.

= Structure =
These have been redesigned from the 3DS so that they fit within a Aarch64 MOV instruction immediate most of the time (without requiring the additional MOVK).

{| class=wikitable
! Bits || Field
|-
| 8-0 || Module
|-
| 21-9 || Description
|}

When a fatal-error is received the error code is outputted using the following formatter:
%04d-%04d

.. where the first code is <code>2000 + Module</code>, and the other being <code>Description</code>. Bits >=22 from the error-code are unused when displaying fatal-errors, since the Description ends with bit21.

= Result Errors =
General errors used by system modules and applications.

== Modules ==
{| class=wikitable
! Value || Name
|-
| 1 || Kernel
|-
| 2 || Fs
|-
| 3 || OS
|-
| 4 || Htcs
|-
| 5 || Ncm
|-
| 6 || Dd
|-
| 7 || Dmnt
|-
| 8 || Lr
|-
| 9 || Loader
|-
| 10 || Cmif
|-
| 11 || Hipc
|-
| 15 || Pm
|-
| 16 || Ns
|-
| 17 || Bsdsockets
|-
| 18 || Htc
|-
| 19 || Tsc
|-
| 20 || Ncm (content)
|-
| 21 || Sm
|-
| 22 || Ro (userland)
|-
| 23 || Gc
|-
| 24 || Sdmmc
|-
| 25 || Ovln
|-
| 26 || Spl
|-
| 27 || Socket
|-
| 29 || Htclow
|-
| 30 || Ddsf
|-
| 31 || Htcfs
|-
| 32 || Async
|-
| 100 || Ethc
|-
| 101 || I2c
|-
| 102 || Gpio
|-
| 103 || Uart
|-
| 105 || Settings
|-
| 107 || Wlan
|-
| 108 || Xcd
|-
| 110 || Nifm
|-
| 111 || Hwopus
|-
| 112 || Sasbus
|-
| 113 || Bluetooth
|-
| 114 || Vi
|-
| 115 || Nfp
|-
| 116 || Time
|-
| 117 || Fgm
|-
| 118 || Oe
|-
| 120 || Pcie
|-
| 121 || Friends
|-
| 122 || Bcat
|-
| 123 || Ssl
|-
| 124 || Account
|-
| 125 || News
|-
| 126 || Mii
|-
| 127 || Nfc
|-
| 128 || Am
|-
| 129 || Prepo
|-
| 130 || Ahid
|-
| 132 || Qlaunch
|-
| 133 || Pcv
|-
| 134 || Omm
|-
| 135 || Bpc
|-
| 136 || Psm
|-
| 137 || Nim
|-
| 138 || Psc
|-
| 139 || Tc
|-
| 140 || Usb
|-
| 141 || Nsd
|-
| 142 || Pctl
|-
| 143 || Btm
|-
| 144 || La
|-
| 145 || ETicket
|-
| 146 || Ngc
|-
| 147 || Erpt
|-
| 148 || Apm
|-
| 149 || Cec
|-
| 150 || Profiler
|-
| 151 || Eupld
|-
| 153 || Audio
|-
| 154 || Npns
|-
| 155 || Npns XMPP stream
|-
| 157 || Arp
|-
| 158 || Updater
|-
| 159 || Swkbd
|-
| 161 || Mifare
|-
| 162 || Userland (assert)
|-
| 163 || Fatal
|-
| 164 || Ec (shop)
|-
| 165 || Spsm
|-
| 167 || Bgtc
|-
| 168 || Userland (crash)
|-
| 169 || Sasbus periodic receive mode
|-
| 175 || Jit
|-
| 177 || Hdcp
|-
| 178 || Pdm
|-
| 179 || Olsc
|-
| 180 || Srepo
|-
| 181 || Dauth
|-
| 187 || Sasbus
|-
| 189 || Pwm
|-
| 191 || Rtc
|-
| 192 || Regulator
|-
| 193 || Led
|-
| 197 || Clkrst
|-
| 198 || Powctl
|-
| 202 || Hid
|-
| 203 || Ldn
|-
| 204 || Cs
|-
| 205 || Irsensor
|-
| 206 || Capture
|-
| 208 || Manu
|-
| 209 || Atk
|-
| 210 || Web
|-
| 211 || Lcs
|-
| 212 || Grc
|-
| 214 || Album
|-
| 216 || Migration
|-
| 217 || Migration idc server
|-
| 218 || Hidbus
|-
| 223 || Websocket
|-
| 227 || Capmtp
|-
| 228 || Pgl
|-
| 229 || Notification
|-
| 230 || Ins
|-
| 231 || Lp2p
|-
| 244 || Dp2hdmi
|}

== Error codes ==
{| class=wikitable
! Value || Module || Description || Notes
|-
| 0x0E01 || 1 || 7 || Session count exceeded
|-
| 0x1C01 || 1 || 14 || Invalid kernel capability descriptor
|-
| 0x4201 || 1 || 33 || Not Implemented
|-
| 0x7601 || 1 || 59 || Thread terminated/termination requested
|-
| 0x8C01 || 1 || 70 || No more debug events
|-
| 0xCA01 || 1 || 101 || Invalid size
|-
| 0xCC01 || 1 || 102 || Invalid address
|-
| 0xCE01 || 1 || 103 || Resource exhaustion
|-
| 0xD001 || 1 || 104 || Memory exhaustion
|-
| 0xD201 || 1 || 105 || Handle-table exhaustion
|-
| 0xD401 || 1 || 106 || Invalid memory state / invalid memory permissions.
|-
| 0xD801 || 1 || 108 || Invalid memory permissions.
|-
| 0xDC01 || 1 || 110 || Invalid memory range
|-
| 0xE001 || 1 || 112 || Invalid thread priority.
|-
| 0xE201 || 1 || 113 || Invalid processor id.
|-
| 0xE401 || 1 || 114 || Invalid handle.
|-
| 0xE601 || 1 || 115 || Invalid pointer/Syscall copy from user failed.
|-
| 0xE801 || 1 || 116 || Invalid combination
|-
| 0xEA01 || 1 || 117 || Time out. Also when you give 0 handles to svcWaitSynchronizationN.
|-
| 0xEC01 || 1 || 118 || Operation canceled
|-
| 0xEE01 || 1 || 119 || Out of range
|-
| 0xF001 || 1 || 120 || Invalid enum
|-
| 0xF201 || 1 || 121 || No such entry
|-
| 0xF401 || 1 || 122 || Irq/DeviceAddressSpace/{...} already registered
|-
| 0xF601 || 1 || 123 || Port remote dead
|-
| 0xF801 || 1 || 124 || [Usermode] Unhandled interrupt/exception
|-
| 0xFA01 || 1 || 125 || Invalid state
|-
| 0xFC01 || 1 || 126 || Reserved value
|-
| 0xFE01 || 1 || 127 || Invalid hardware breakpoint
|-
| 0x10001 || 1 || 128 || [Usermode] Fatal exception
|-
| 0x10201 || 1 || 129 || Last thread didn't belong to your process
|-
| 0x10601 || 1 || 131 || Port closed
|-
| 0x10801 || 1 || 132 || Resource limit exceeded
|-
| 0x20801 || 1 || 260 || Command buffer too small
|-
| 0x40A01 || 1 || 517 || Invalid process ID.
|-
| 0x40C01 || 1 || 518 || Invalid thread ID.
|-
| 0x40E01 || 1 || 519 || Invalid thread ID (used in svcGetDebugThreadParam).
|-
| 0x41001 || 1 || 520 || Process not being debugged
|-
| 0x202 || 2 || 1 || Path does not exist.
|-
| 0x402 || 2 || 2 || Path already exists.
|-
| 0xE02 || 2 || 7 || Resource already in use (file already opened, savedata filesystem already mounted).
|-
| 0x4602 || 2 || 35 || Not enough free space for BIS Calibration partition.
|-
| 0x4802 || 2 || 36 || Not enough free space for BIS Safe partition.
|-
| 0x4A02 || 2 || 37 || Not enough free space for BIS User partition.
|-
| 0x4C02 || 2 || 38 || Not enough free space for BIS System partition.
|-
| 0x4E02 || 2 || 39 || Not enough free space on SD card.
|-
| 0x6402 || 2 || 50 || NCA is older than version 3, or NCA SDK version is older than 0.11.0.0
|-
| 0x7802 || 2 || 60 || Specified mount name already exists.
|-
| 0x7D202 || 2 || 1001 || Process does not have RomFs
|-
| 0x7D402 || 2 || 1002 || Title-id not found / savedata not found.
|-
| 0xFA202 || 2 || 2001 || SD card not inserted
|-
| 0x13B002 || 2 || 2520 || Gamecard not inserted
|-
| 0x13B402 || 2 || 2522 || Attempted process an AsicHandler command in initial mode
|-
| 0x13D802 || 2 || 2540 || Attempted to read from the secure gamecard partition in normal mode
|-
| 0x13DA02 || 2 || 2541 || Attempted to read from the normal gamecard partition in secure mode
|-
| 0x13DC02 || 2 || 2542 || Attempted a read that spanned both the normal and secure gamecard partitions
|-
| 0x13E002 || 2 || 2544 || Gamecard initial data hash doesn't match the initial data hash in the card header
|-
| 0x13E202 || 2 || 2545 || Gamecard initial data reserved area is not all zeros
|-
| 0x13E402 || 2 || 2546 || Gamecard certificate kek index doesn't match card header kek index
|-
| 0x13EE02 || 2 || 2551 || Unable to read card header on gamecard init
|-
| 0x140A02 || 2 || 2565 || Encountered SDMMC error in write operation
|-
| 0x145002 || 2 || 2600 || Attempted to switch lotus state machine to secure mode from a mode other than normal
|-
| 0x145202 || 2 || 2601 || Attempted to switch lotus state machine to normal mode from a mode other than initial
|-
| 0x145402 || 2 || 2602 || Attempted to switch lotus state machine to write mode from a mode other than normal
|-
| 0x149402 || 2 || 2634 || Error processing lotus command SetUserAsicFirmware
|-
| 0x149A02 || 2 || 2637 || Error processing lotus command GetAsicCert
|-
| 0x14A002 || 2 || 2640 || Error processing lotus command SetEmmcEmbeddedSocCertificate
|-
| 0x14AA02 || 2 || 2645 || Error processing lotus command GetAsicEncryptedMessage
|-
| 0x14AC02 || 2 || 2646 || Error processing lotus command SetLibraryEncryptedMessage
|-
| 0x14B602 || 2 || 2651 || Error processing lotus command GetAsicAuthenticationData
|-
| 0x14B802 || 2 || 2652 || Error processing lotus command SetAsicAuthenticationDataHash
|-
| 0x14BA02 || 2 || 2653 || Error processing lotus command SetLibraryAuthenticationData
|-
| 0x14BC02 || 2 || 2654 || Error processing lotus command GetLibraryAuthenticationDataHash
|-
| 0x14C202 || 2 || 2657 || Error processing lotus command ExchangeRandomValuesInSecureMode
|-
| 0x14D802 || 2 || 2668 || Error calling nn::gc::detail::GcCrypto::GenerateRandomBytes
|-
| 0x14DE02 || 2 || 2671 || Error processing lotus command ReadAsicRegister
|-
| 0x14E002 || 2 || 2672 || Error processing lotus command GetGameCardIdSet
|-
| 0x14E402 || 2 || 2674 || Error processing lotus command GetCardHeader
|-
| 0x14E802 || 2 || 2676 || Error processing lotus command GetCardKeyArea
|-
| 0x14EA02 || 2 || 2677 || Error processing lotus command ChangeDebugMode
|-
| 0x14EC02 || 2 || 2678 || Error processing lotus command GetRmaInformation
|-
| 0x150802 || 2 || 2692 || Tried sending lotus card command Refresh when not in secure mode
|-
| 0x150A02 || 2 || 2693 || Tried sending lotus card command when not in correct mode
|-
| 0x155602 || 2 || 2731 || Error processing lotus card command ReadId1
|-
| 0x155802 || 2 || 2732 || Error processing lotus card command ReadId2
|-
| 0x155A02 || 2 || 2733 || Error processing lotus card command ReadId3
|-
| 0x155E02 || 2 || 2735 || Error processing lotus card command ReadPage
|-
| 0x156202 || 2 || 2737 || Error processing lotus card command WritePage
|-
| 0x156402 || 2 || 2738 || Error processing lotus card command Refresh
|-
| 0x156C02 || 2 || 2742 || Error processing lotus card command ReadCrc
|-
| 0x156E02 || 2 || 2743 || Error processing lotus card command Erase or UnlockForceErase
|-
| 0x157002 || 2 || 2744 || Error processing lotus card command ReadDevParam
|-
| 0x157202 || 2 || 2745 || Error processing lotus card command WriteDevParam
|-
| 0x16B002 || 2 || 2904 || Id2Normal did not match the value in the buffer returned by ChangeDebugMode
|-
| 0x16B202 || 2 || 2905 || Id1Normal did not match Id1Writer when switching gamecard to write mode
|-
| 0x16B402 || 2 || 2906 || Id2Normal did not match Id2Writer when switching gamecard to write mode
|-
| 0x171402 || 2 || 2954 || Invalid gamecard handle.
|-
| 0x172002 || 2 || 2960 || Invalid gamecard handle when opening normal gamecard partition
|-
| 0x172202 || 2 || 2961 || Invalid gamecard handle when opening secure gamecard partition
|-
| 0x177202 || 2 || 3001 || Unimplemented behavior
|-
| 0x177602 || 2 || 3003 || File/Directory already exists.
|-
| 0x190202 || 2 || 3201 || Memory allocation failure related to FAT filesystem code
|-
| 0x190602 || 2 || 3203 || Memory allocation failure related to FAT filesystem code
|-
| 0x190802 || 2 || 3204 || Memory allocation failure related to FAT filesystem code
|-
| 0x190A02 || 2 || 3205 || Memory allocation failure related to FAT filesystem code
|-
| 0x190C02 || 2 || 3206 || Memory allocation failure related to FAT filesystem code
|-
| 0x191002 || 2 || 3208 || Memory allocation failure related to FAT filesystem code
|-
| 0x195802 || 2 || 3244 || Allocation failure related to SD cards
|-
| 0x196002 || 2 || 3248 || Out of memory
|-
| 0x196202 || 2 || 3249 || Out of memory
|-
| 0x1A3E02 || 2 || 3359 || Out of memory
|-
| 0x1A4002 || 2 || 3360 || Out of memory
|-
| 0x1A4A02 || 2 || 3365 || Out of memory
|-
| 0x21BC02 || 2 || 4318 || Invalid save data filesystem magic (valid magic is SAVE in ASCII)
|-
| 0x234202 || 2 || 4513 || Error reading ACID section in NPDM
|-
| 0x234402 || 2 || 4514 || Invalid NPDM ACID section size
|-
| 0x234602 || 2 || 4515 || Last byte of the ACID modulus is zero
|-
| 0x234802 || 2 || 4516 || Invalid ACID fixed key signature
|-
| 0x234A02 || 2 || 4517 || Invalid NCA magic
|-
| 0x234C02 || 2 || 4518 || Invalid NCA header fixed key signature
|-
| 0x234E02 || 2 || 4519 || Invalid NCA header ACID signature
|-
| 0x235002 || 2 || 4520 || Invalid NCA header section hash
|-
| 0x235202 || 2 || 4521 || Invalid NCA Key index
|-
| 0x235602 || 2 || 4523 || Invalid encryption type
|-
| 0x235802 || 2 || 4524 || Redirection BKTR table size is negative
|-
| 0x235A02 || 2 || 4525 || Encryption BKTR table size is negative
|-
| 0x235C02 || 2 || 4526 || Redirection BKTR table end offset is past the Encryption BKTR table start offset
|-
| 0x235E02 || 2 || 4527 || NCA-path used with the wrong titleID.
|-
| 0x236002 || 2 || 4528 || NCA header value is out of range
|-
| 0x236202 || 2 || 4529 || NCA FS header value is out of range
|-
| 0x236802 || 2 || 4532 || PartitionFS hash block size is not a power of 2
|-
| 0x236A02 || 2 || 4533 || PartitionFS hash "always_2" field is not 2
|-
| 0x236C02 || 2 || 4534 || PartitionFS hash table is too small for main data
|-
| 0x236E02 || 2 || 4535 || Invalid PartitionFS block hash
|-
| 0x244402 || 2 || 4642 || Invalid Partition file hashed region bounds
|-
| 0x244602 || 2 || 4643 || Invalid Partition FS hash
|-
| 0x244802 || 2 || 4644 || Invalid PFS0 magic
|-
| 0x244A02 || 2 || 4645 || Invalid HFS0 magic
|-
| 0x244C02 || 2 || 4646 || Invalid name offset for Partition FS file entry
|-
| 0x244E02 || 2 || 4647 || Calculated Partition FS header size changed between 2 consecutive reads
|-
| 0x249802 || 2 || 4684 || Invalid FAT file number.
|-
| 0x249C02 || 2 || 4686 || Invalid FAT format for BIS User partition.
|-
| 0x249E02 || 2 || 4687 || Invalid FAT format for BIS System partition.
|-
| 0x24A002 || 2 || 4688 || Invalid FAT format for BIS Safe partition.
|-
| 0x24A202 || 2 || 4689 || Invalid FAT format for BIS Calibration partition.
|-
| 0x250E02 || 2 || 4743 || [[NAX0|Corrupted]] NAX0 header.
|-
| 0x251002 || 2 || 4744 || Invalid [[NAX0]] magicnum.
|-
| 0x280202 || 2 || 5121 || Invalid FAT size
|-
| 0x280402 || 2 || 5122 || Invalid FAT BPB (BIOS Parameter Block)
|-
| 0x280602 || 2 || 5123 || Invalid FAT parameter
|-
| 0x280802 || 2 || 5124 || Invalid FAT sector
|-
| 0x280A02 || 2 || 5125 || Invalid FAT sector
|-
| 0x280C02 || 2 || 5126 || Invalid FAT sector
|-
| 0x280E02 || 2 || 5127 || Invalid FAT sector
|-
| 0x296A02 || 2 || 5301 || Mountpoint not found
|-
| 0x2EE202 || 2 || 6001 || Invalid input
|-
| 0x2EE602 || 2 || 6003 || Path too long
|-
| 0x2EE802 || 2 || 6004 || Invalid character.
|-
| 0x2EEA02 || 2 || 6005 || Invalid directory path.
|-
| 0x2EEC02 || 2 || 6006 || Unable to retrieve directory from path
|-
| 0x2F5A02 || 2 || 6061 || Offset outside storage
|-
| 0x313802 || 2 || 6300 || Operation not supported
|-
| 0x313A02 || 2 || 6301 || A specified filesystem has no MultiCommitTarget when doing a multi-filesystem commit
|-
| 0x313C02 || 2 || 6302 || Attempted to resize a nn::fs::SubStorage or BufferedStorage that is marked as non-resizable
|-
| 0x313E02 || 2 || 6303 || Attempted to resize a nn::fs::SubStorage or BufferedStorage when the SubStorage ends before the base storage
|-
| 0x314002 || 2 || 6304 || Attempted to call nn::fs::MemoryStorage::SetSize
|-
| 0x314202 || 2 || 6305 || Invalid Operation ID in nn::fs::MemoryStorage::OperateRange
|-
| 0x314402 || 2 || 6306 || Invalid Operation ID in nn::fs::FileStorage::OperateRange
|-
| 0x314602 || 2 || 6307 || Invalid Operation ID in nn::fs::FileHandleStorage::OperateRange
|-
| 0x314802 || 2 || 6308 || Invalid Operation ID in nn::fssystem::SwitchStorage::OperateRange
|-
| 0x314A02 || 2 || 6309 || Invalid Operation ID in nn::fs::detail::StorageServiceObjectAdapter::OperateRange
|-
| 0x314C02 || 2 || 6310 || Attempted to call nn::fssystem::AesCtrCounterExtendedStorage::Write
|-
| 0x314E02 || 2 || 6311 || Attempted to call nn::fssystem::AesCtrCounterExtendedStorage::SetSize
|-
| 0x315002 || 2 || 6312 || Invalid Operation ID in nn::fssystem::AesCtrCounterExtendedStorage::OperateRange
|-
| 0x315202 || 2 || 6313 || Attempted to call nn::fssystem::AesCtrStorageExternal::Write
|-
| 0x315402 || 2 || 6314 || Attempted to call nn::fssystem::AesCtrStorageExternal::SetSize
|-
| 0x315602 || 2 || 6315 || Attempted to call nn::fssystem::AesCtrStorage::SetSize
|-
| 0x315802 || 2 || 6316 || Attempted to call nn::fssystem::save::HierarchicalIntegrityVerificationStorage::SetSize
|-
| 0x315A02 || 2 || 6317 || Attempted to call nn::fssystem::save::HierarchicalIntegrityVerificationStorage::OperateRange
|-
| 0x315C02 || 2 || 6318 || Attempted to call nn::fssystem::save::IntegrityVerificationStorage::SetSize
|-
| 0x315E02 || 2 || 6319 || Attempted to invalidate the cache of a RomFs IVFC storage in nn::fssystem::save::IntegrityVerificationStorage::OperateRange
|-
| 0x316002 || 2 || 6320 || Invalid Operation ID in nn::fssystem::save::IntegrityVerificationStorage::OperateRange
|-
| 0x316202 || 2 || 6321 || Attempted to call nn::fssystem::save::BlockCacheBufferedStorage::SetSize
|-
| 0x316402 || 2 || 6322 || Attempted to invalidate the cache of something other than a savedata IVFC storage in nn::fssystem::save::BlockCacheBufferedStorage::OperateRange
|-
| 0x316602 || 2 || 6323 || Invalid Operation ID in nn::fssystem::save::BlockCacheBufferedStorage::OperateRange
|-
| 0x316802 || 2 || 6324 || Attempted to call nn::fssystem::IndirectStorage::Write
|-
| 0x316A02 || 2 || 6325 || Attempted to call nn::fssystem::IndirectStorage::SetSize
|-
| 0x316C02 || 2 || 6326 || Invalid Operation ID in nn::fssystem::IndirectStorage::OperateRange
|-
| 0x316E02 || 2 || 6327 || Attempted to call nn::fssystem::SparseStorage::ZeroStorage::Write
|-
| 0x317002 || 2 || 6328 || Attempted to call nn::fssystem::SparseStorage::ZeroStorage::SetSize
|-
| 0x317202 || 2 || 6329 || Attempted to call nn::fssystem::HierarchicalSha256Storage::SetSize
|-
| 0x317402 || 2 || 6330 || Attempted to call nn::fssystem::ReadOnlyBlockCacheStorage::Write
|-
| 0x317602 || 2 || 6331 || Attempted to call nn::fssystem::ReadOnlyBlockCacheStorage::SetSize
|-
| 0x317802 || 2 || 6332 || Attempted to call nn::fssystem::IntegrityRomFsStorage::SetSize
|-
| 0x317A02 || 2 || 6333 || Attempted to call nn::fssystem::save::DuplexStorage::SetSize
|-
| 0x317C02 || 2 || 6334 || Invalid Operation ID in nn::fssystem::save::DuplexStorage::OperateRange
|-
| 0x317E02 || 2 || 6335 || Attempted to call nn::fssystem::save::HierarchicalDuplexStorage::SetSize
|-
| 0x318002 || 2 || 6336 || Attempted to call nn::fssystem::save::RemapStorage::GetSize
|-
| 0x318202 || 2 || 6337 || Attempted to call nn::fssystem::save::RemapStorage::SetSize
|-
| 0x318402 || 2 || 6338 || Invalid Operation ID in nn::fssystem::save::RemapStorage::OperateRange
|-
| 0x318602 || 2 || 6339 || Attempted to call nn::fssystem::save::IntegritySaveDataStorage::SetSize
|-
| 0x318802 || 2 || 6340 || Invalid Operation ID in nn::fssystem::save::IntegritySaveDataStorage::OperateRange
|-
| 0x318A02 || 2 || 6341 || Attempted to call nn::fssystem::save::JournalIntegritySaveDataStorage::SetSize
|-
| 0x318C02 || 2 || 6342 || Invalid Operation ID in nn::fssystem::save::JournalIntegritySaveDataStorage::OperateRange
|-
| 0x318E02 || 2 || 6343 || Attempted to call nn::fssystem::save::JournalStorage::GetSize
|-
| 0x319002 || 2 || 6344 || Attempted to call nn::fssystem::save::JournalStorage::SetSize
|-
| 0x319202 || 2 || 6345 || Invalid Operation ID in nn::fssystem::save::JournalStorage::OperateRange
|-
| 0x319402 || 2 || 6346 || Attempted to call nn::fssystem::save::UnionStorage::SetSize
|-
| 0x319602 || 2 || 6347 || Attempted to call nn::fssystem::dbm::AllocationTableStorage::SetSize
|-
| 0x319802 || 2 || 6348 || Attempted to call nn::fssrv::fscreator::WriteOnlyGameCardStorage::Read
|-
| 0x319A02 || 2 || 6349 || Attempted to call nn::fssrv::fscreator::WriteOnlyGameCardStorage::SetSize
|-
| 0x319C02 || 2 || 6350 || Attempted to call nn::fssrv::fscreator::ReadOnlyGameCardStorage::Write
|-
| 0x319E02 || 2 || 6351 || Attempted to call nn::fssrv::fscreator::ReadOnlyGameCardStorage::SetSize
|-
| 0x31A002 || 2 || 6352 || Invalid Operation ID in nn::fssrv::fscreator::ReadOnlyGameCardStorage::OperateRange
|-
| 0x31A202 || 2 || 6353 || Attempted to call SdStorage::SetSize
|-
| 0x31A402 || 2 || 6354 || Invalid Operation ID in SdStorage::OperateRange
|-
| 0x31A602 || 2 || 6355 || Invalid Operation ID in nn::fat::FatFile::DoOperateRange
|-
| 0x31A802 || 2 || 6356 || Invalid Operation ID in nn::fssystem::StorageFile::DoOperateRange
|-
| 0x31AA02 || 2 || 6357 || Attempted to call nn::fssystem::ConcatenationFile::SetSize
|-
| 0x31AC02 || 2 || 6358 || Attempted to call nn::fssystem::ConcatenationFile::OperateRange
|-
| 0x31AE02 || 2 || 6359 || Invalid Query ID in nn::fssystem::ConcatenationFileSystem::DoQueryEntry
|-
| 0x31B002 || 2 || 6360 || Invalid Operation ID in nn::fssystem::ConcatenationFile::DoOperateRange
|-
| 0x31B202 || 2 || 6361 || Attempted to call nn::fssystem::ZeroBitmapFile::SetSize
|-
| 0x31B402 || 2 || 6362 || Invalid Operation ID in nn::fs::detail::FileServiceObjectAdapter::DoOperateRange
|-
| 0x31B602 || 2 || 6363 || Invalid Operation ID in nn::fssystem::AesXtsFile::DoOperateRange
|-
| 0x31B802 || 2 || 6364 || Attempted to modify a nn::fs::RomFsFileSystem
|-
| 0x31BA02 || 2 || 6365 || Attempted to call nn::fs::RomFsFileSystem::DoCommitProvisionally
|-
| 0x31BC02 || 2 || 6366 || Attempted to query the space in a nn::fs::RomFsFileSystem
|-
| 0x31BE02 || 2 || 6367 || Attempted to modify a nn::fssystem::RomFsFile
|-
| 0x31C002 || 2 || 6368 || Invalid Operation ID in nn::fssystem::RomFsFile::DoOperateRange
|-
| 0x31C202 || 2 || 6369 || Attempted to modify a nn::fs::ReadOnlyFileSystemTemplate
|-
| 0x31C402 || 2 || 6370 || Attempted to call nn::fs::ReadOnlyFileSystemTemplate::DoCommitProvisionally
|-
| 0x31C602 || 2 || 6371 || Attempted to query the space in a nn::fs::ReadOnlyFileSystemTemplate
|-
| 0x31C802 || 2 || 6372 || Attempted to modify a nn::fs::ReadOnlyFileSystemFile
|-
| 0x31CA02 || 2 || 6373 || Invalid Operation ID in nn::fs::ReadOnlyFileSystemFile::DoOperateRange
|-
| 0x31CC02 || 2 || 6374 || Attempted to modify a nn::fssystem::PartitionFileSystemCore
|-
| 0x31CE02 || 2 || 6375 || Attempted to call nn::fssystem::PartitionFileSystemCore::DoCommitProvisionally
|-
| 0x31D002 || 2 || 6376 || Attempted to call nn::fssystem::PartitionFileSystemCore::PartitionFile::DoSetSize
|-
| 0x31D202 || 2 || 6377 || Invalid Operation ID in nn::fssystem::PartitionFileSystemCore::PartitionFile::DoOperateRange
|-
| 0x31D402 || 2 || 6378 || Invalid Operation ID in nn::fssystem::TmFileSystemFile::DoOperateRange
|-
| 0x31D602 || 2 || 6379 || Attempted to call unsupported functions in nn::fssrv::fscreator::SaveDataInternalStorageFileSystem, nn::fssrv::detail::SaveDataInternalStorageAccessor::PaddingFile or nn::fssystem::save::detail::SaveDataExtraDataInternalStorageFile
|-
| 0x31DC02 || 2 || 6382 || Attempted to call nn::fssystem::ApplicationTemporaryFileSystem::DoCommitProvisionally
|-
| 0x31DE02 || 2 || 6383 || Attempted to call nn::fssystem::SaveDataFileSystem::DoCommitProvisionally
|-
| 0x31E002 || 2 || 6384 || Attempted to call nn::fssystem::DirectorySaveDataFileSystem::DoCommitProvisionally
|-
| 0x31E202 || 2 || 6385 || Attempted to call nn::fssystem::ZeroBitmapHashStorageFile::Write
|-
| 0x31E402 || 2 || 6386 || Attempted to call nn::fssystem::ZeroBitmapHashStorageFile::SetSize
|-
| 0x320002 || 2 || 6400 || Permission denied
|-
| 0x326602 || 2 || 6451 || Missing titlekey(?) required to mount content
|-
| 0x326E02 || 2 || 6455 || File not closed
|-
| 0x327002 || 2 || 6456 || Directory not closed
|-
| 0x327202 || 2 || 6457 || Writable file not closed when committing
|-
| 0x327402 || 2 || 6458 || FS allocators already registered
|-
| 0x327602 || 2 || 6459 || FS allocators already used
|-
| 0x327A02 || 2 || 6461 || FS allocator alignment violation
|-
| 0x339402 || 2 || 6602 || File not found.
|-
| 0x339602 || 2 || 6603 || Directory not found.
|-
| 0x346C02 || 2 || 6710 || Multi-commit limit reached
|-
| 0x35F202 || 2 || 6905 || Mount name not found in table.
|-
| 0x3DBC02 || 2 || 7902 || RomFs table: Entry not found in dictionary
|-
| 0x3DBE02 || 2 || 7903 || RomFs table: File not found
|-
| 0x3DC002 || 2 || 7904 || RomFs table: Directory not found
|-
| 0x3DC402 || 2 || 7906 || RomFs table: Entry already exists when trying to add a new entry
|-
| 0x3DC602 || 2 || 7907 || RomFs table: Insufficient space to add new entry
|-
| 0x3DC802 || 2 || 7908 || RomFs table: Unable to add new directory
|-
| 0x3DCA02 || 2 || 7909 || RomFs table: Unable to add new file
|-
| 0x3DCC02 || 2 || 7910 || RomFs directory has no more child directories/files when iterating
|-
| 0x3DD402 || 2 || 7914 || RomFs table: Path is file, not directory
|-
| 0x803 || 3 || 4 || OS busy
|-
| 0xE03 || 3 || 7 || Invalid parameter
|-
| 0x1003 || 3 || 8 || Out of memory
|-
| 0x1203 || 3 || 9 || Out of resources
|-
| 0x3EA03 || 3 || 501 || Invalid handle
|-
| 0x3EE03 || 3 || 503 || Invalid memory mirror
|-
| 0x7FE03 || 3 || 1023 || TLS slot is not allocated
|-
| 0xA05 || 5 || 5 || [[Content_Manager_services|NcaID]] not found. Returned when attempting to mount titles which exist that aren't *8XX titles, the same way *8XX titles are mounted.
|-
| 0xE05 || 5 || 7 || TitleId not found
|-
| 0x1805 || 5 || 12 || Invalid StorageId
|-
| 0xDC05 || 5 || 110 || Gamecard not inserted
|-
| 0x17C05 || 5 || 190 || Gamecard not initialized
|-
| 0x1F405 || 5 || 250 || Sdcard not inserted
|-
| 0x20805 || 5 || 260 || Storage not mounted
|-
| 0x806 || 6 || 4 || Converted from error 0xD401
|-
| 0x1006 || 6 || 8 || Converted from error 0xE401
|-
| 0x408 || 8 || 2 || Program location entry not found
|-
| 0x608 || 8 || 3 || Invalid context for control location
|-
| 0x808 || 8 || 4 || Storage not found
|-
| 0xA08 || 8 || 5 || Access denied
|-
| 0xC08 || 8 || 6 || Offline manual HTML location entry not found
|-
| 0xE08 || 8 || 7 || Title is not registered
|-
| 0x1008 || 8 || 8 || Control location entry for host not found
|-
| 0x1208 || 8 || 9 || Legal info HTML location entry not found
|-
| 0x1408 || 8 || 10 || Program location for debug entry not found
|-
| 0x209 || 9 || 1 || Args too long.
|-
| 0x409 || 9 || 2 || Maximum processes loaded.
|-
| 0x609 || 9 || 3 || NPDM too big.
|-
| 0x809 || 9 || 4 || Invalid NPDM.
|-
| 0xA09 || 9 || 5 || Invalid NSO.
|-
| 0xC09 || 9 || 6 || Invalid Path.
|-
| 0xE09 || 9 || 7 || Already registered.
|-
| 0x1009 || 9 || 8 || Title not found.
|-
| 0x1209 || 9 || 9 || Title-id in ACI0 doesn't match range in ACID.
|-
| 0x1409 || 9 || 10 || Invalid version in NPDM.
|-
| 0x6609 || 9 || 51 || Insufficient address space.
|-
| 0x6809 || 9 || 52 || Insufficient NRO.
|-
| 0x6A09 || 9 || 53 || Invalid NRR
|-
| 0x6C09 || 9 || 54 || Invalid signature
|-
| 0x6E09 || 9 || 55 || Insufficient NRO registrations.
|-
| 0x7009 || 9 || 56 || Insufficient NRR registrations.
|-
| 0x7209 || 9 || 57 || NRO Already loaded.
|-
| 0xA209 || 9 || 81 || Unaligned NRR address
|-
| 0xA409 || 9 || 82 || Bad NRR size
|-
| 0xA809 || 9 || 84 || NRR Not Loaded.
|-
| 0xAA09 || 9 || 85 || Bad NRR address
|-
| 0xAE09 || 9 || 87 || Bad initialization
|-
| 0xC809 || 9 || 100 || Unknown ACI0 descriptor
|-
| 0xCE09 || 9 || 103 || ACID/ACI0 don't match for descriptor "KernelFlags"
|-
| 0xD009 || 9 || 104 || ACID/ACI0 don't match for descriptor "SyscallMask"
|-
| 0xD409 || 9 || 106 || ACID/ACI0 don't match for descriptor "MapIoOrNormalRange"
|-
| 0xD609 || 9 || 107 || ACID/ACI0 don't match for descriptor "MapNormalPage"
|-
| 0xDE09 || 9 || 111 || ACID/ACI0 don't match for descriptor "InterruptPair"
|-
| 0xE209 || 9 || 113 || ACID/ACI0 don't match for descriptor "ApplicationType"
|-
| 0xE409 || 9 || 114 || ACID/ACI0 don't match for descriptor "KernelReleaseVersion"
|-
| 0xE609 || 9 || 115 || ACID/ACI0 don't match for descriptor "HandleTableSize"
|-
| 0xE809 || 9 || 116 || ACID/ACI0 don't match for descriptor "DebugFlags"
|-
| 0x1940A || 10 || 202 || Invalid CMIF header size.
|-
| 0x1A60A || 10 || 211 || Invalid CMIF input header.
|-
| 0x1A80A || 10 || 212 || Invalid CMIF output header.
|-
| 0x1BA0A || 10 || 221 || Invalid method dispatch ID.
|-
| 0x1D60A || 10 || 235 || Invalid in object count.
|-
| 0x1D80A || 10 || 236 || Invalid out object count.
|-
| 0x25A0A || 10 || 301 || Out of domain entries.
|-
| 0x20B || 11 || 1 || Unsupported operation
|-
| 0xCC0B || 11 || 102 || Out of server session memory
|-
| 0x11A0B || 11 || 141 || Went past maximum during marshalling.
|-
| 0x1900B || 11 || 200 || Session doesn't support domains.
|-
| 0x25A0B || 11 || 301 || Remote process is dead.
|-
| 0x3240B || 11 || 402 || Data/buffer length(s) too large for IPC buffer.
|-
| 0x3260B || 11 || 403 || Unknown request type
|-
| 0x3480B || 11 || 420 || Number(s) of buffers/handles/PIDs passed differ from what method expects.
|-
| 0x3D60B || 11 || 491 || IPC Query 1 failed.
|-
| 0x20F || 15 || 1 || Pid not found
|-
| 0x60F || 15 || 3 || Process has no pending events
|-
| 0xA0F || 15 || 5 || Application already running
|-
| 0x410 || 16 || 2 || Title-id not found
|-
| 0xF010 || 16 || 120 || Sysupdate not required
|-
| 0x1F610 || 16 || 251 || Unexpected StorageId
|-
| 0x2A810 || 16 || 340 || [[Network_Interface_services#IsAnyInternetRequestAccepted|IsAnyInternetRequestAccepted]] with the output from [[#Network_Interface_services#GetClientId|GetClientId]] returned false.
|-
| 0x64210 || 16 || 801 || [[NS_Services#SystemDeliveryInfo|SystemDeliveryInfo]] system_delivery_protocol_version is less than the system-setting.
|-
| 0x64410 || 16 || 802 || [[NS_Services#SystemDeliveryInfo|SystemDeliveryInfo]] system_delivery_protocol_version is larger than the system-setting.
|-
| 0x74610 || 16 || 931 || Invalid [[NS_Services#SystemDeliveryInfo|SystemDeliveryInfo]] HMAC / invalid Meta Id.
|-
| 0x6F810 || 16 || 892 || Unknown state ref-count is zero.
|-
| 0x215 || 21 || 1 || Out of processes
|-
| 0x415 || 21 || 2 || Not initialized.
|-
| 0x615 || 21 || 3 || Max sessions
|-
| 0x815 || 21 || 4 || Service already registered
|-
| 0xA15 || 21 || 5 || Out of services
|-
| 0xC15 || 21 || 6 || Invalid name (all zeroes)
|-
| 0xE15 || 21 || 7 || Service not registered
|-
| 0x1015 || 21 || 8 || Permission denied
|-
| 0x1215 || 21 || 9 || Service Access Control too big.
|-
| 0x416 || 22 || 2 || Address space is full
|-
| 0x616 || 22 || 3 || NRO already loaded
|-
| 0x816 || 22 || 4 || Invalid NRO header values
|-
| 0xC16 || 22 || 6 || Bad NRR magic
|-
| 0x1016 || 22 || 8 || Reached max NRR count
|-
| 0x1216 || 22 || 9 || Unable to verify NRO hash or NRR signature
|-
| 0x80216 || 22 || 1025 || Address not page-aligned
|-
| 0x80416 || 22 || 1026 || Incorrect NRO size
|-
| 0x80816 || 22 || 1028 || NRO not loaded
|-
| 0x80A16 || 22 || 1029 || NRR not loaded
|-
| 0x80C16 || 22 || 1030 || Already initialized
|-
| 0x80E16 || 22 || 1031 || Not initialized
|-
| 0x21A || 26 || 1 || SMC is not implemented
|-
| 0x41A || 26 || 2 || SMC argument is invalid
|-
| 0x61A || 26 || 3 || SMC is currently in progress/secmon is busy
|-
| 0x81A || 26 || 4 || Secmon not currently performing async operation
|-
| 0xA1A || 26 || 5 || Invalid SMC async callback key
|-
| 0xC1A || 26 || 6 || SMC is blacklisted during current boot
|-
| 0xC81A || 26 || 100 || Invalid (buffer) size
|-
| 0xCA1A || 26 || 101 || Unknown SMC error
|-
| 0xCA1A || 26 || 101 || Decryption failure
|-
| 0xD01A || 26 || 104 || No AES keyslots available
|-
| 0xD21A || 26 || 105 || Invalid AES keyslot
|-
| 0xD41A || 26 || 106 || BootReason already set
|-
| 0xD61A || 26 || 107 || BootReason not set
|-
| 0xD81A || 26 || 108 || Invalid argument
|-
| 0x35B || 347 || 1 || Failed to init SM.
|-
| 0x55B || 347 || 2 || Failed to init FS.
|-
| 0x75B || 347 || 3 || Failed to open NRO file. May also happen when SD card isn't inserted / SD mounting failed earlier.
|-
| 0x95B || 347 || 4 || Failed to read NRO header.
|-
| 0xB5B || 347 || 5 || Invalid NRO magic.
|-
| 0xD5B || 347 || 6 || Invalid NRO segments.
|-
| 0xF5B || 347 || 7 || Failed to read NRO.
|-
| 0x135B || 347 || 9 || Failed to allocate heap.
|-
| 0x255B || 347 || 18 || Failed to map code-binary memory.
|-
| 0x275B || 347 || 19 || Failed to map code memory (.text).
|-
| 0x295B || 347 || 20 || Failed to map code memory (.rodata).
|-
| 0x2B5B || 347 || 21 || Failed to map code memory (.data+.bss).
|-
| 0x315B || 347 || 24 || Failed to unmap code memory (.text).
|-
| 0x335B || 347 || 25 || Failed to unmap code memory (.rodata).
|-
| 0x355B || 347 || 26 || Failed to unmap code memory (.data+.bss).
|-
| 0x19269 || 105 || 201 || Null settings name
|-
| 0x19469 || 105 || 202 || Null settings key
|-
| 0x19669 || 105 || 203 || Null settings value
|-
| 0x19A69 || 105 || 205 || Null settings value buffer
|-
| 0x1A069 || 105 || 208 || Null setting value size buffer
|-
| 0x1A269 || 105 || 209 || Null debug mode flag buffer
|-
| 0x1BA69 || 105 || 221 || Setting group name has zero length
|-
| 0x1BC69 || 105 || 222 || Empty settings item key
|-
| 0x1E269 || 105 || 241 || Setting group name is too long (64 character limit?)
|-
| 0x1E469 || 105 || 242 || Setting name is too long (64 character limit?)
|-
| 0x20A69 || 105 || 261 || Setting group name ends with '.' or contains invalid characters (allowed: [a-z0-9_\-.])
|-
| 0x20C69 || 105 || 262 || Setting name ends with '.' or contains invalid characters (allowed: [a-z0-9_\-.])
|-
| 0x4DA69 || 105 || 621 || Null language code buffer
|-
| 0x4E269 || 105 || 625 || Language out of valid range
|-
| 0x4EE69 || 105 || 631 || Null network settings buffer
|-
| 0x4F069 || 105 || 632 || Null network settings output count buffer
|-
| 0x50269 || 105 || 641 || Null backlight settings buffer
|-
| 0x51669 || 105 || 651 || Null Bluetooth device setting buffer
|-
| 0x51869 || 105 || 652 || Null Bluetooth device setting output count buffer
|-
| 0x51A69 || 105 || 653 || Null Bluetooth enable flag buffer
|-
| 0x51C69 || 105 || 654 || Null Bluetooth AFH enable flag buffer
|-
| 0x51E69 || 105 || 655 || Null Bluetooth boost enable flag buffer
|-
| 0x52069 || 105 || 656 || Null BLE pairing settings buffer
|-
| 0x52269 || 105 || 657 || Null BLE pairing settings entry count buffer
|-
| 0x52A69 || 105 || 661 || Null external steady clock source ID buffer
|-
| 0x52C69 || 105 || 662 || Null user system clock context buffer
|-
| 0x52E69 || 105 || 663 || Null network system clock context buffer
|-
| 0x53069 || 105 || 664 || Null user system clock automatic correction enabled flag buffer
|-
| 0x53269 || 105 || 665 || Null shutdown RTC value buffer
|-
| 0x53469 || 105 || 666 || Null external steady clock internal offset buffer
|-
| 0x53E69 || 105 || 671 || Null account settings buffer
|-
| 0x55269 || 105 || 681 || Null audio volume buffer
|-
| 0x55669 || 105 || 683 || Null ForceMuteOnHeadphoneRemoved buffer
|-
| 0x55869 || 105 || 684 || Null headphone volume warning count buffer
|-
| 0x55E69 || 105 || 687 || Invalid audio output mode
|-
| 0x56069 || 105 || 688 || Null headphone volume update flag buffer
|-
| 0x56669 || 105 || 691 || Null console information upload flag buffer
|-
| 0x57A69 || 105 || 701 || Null automatic application download flag buffer
|-
| 0x57C69 || 105 || 702 || Null notification settings buffer
|-
| 0x57E69 || 105 || 703 || Null account notification settings entry count buffer
|-
| 0x58069 || 105 || 704 || Null account notification settings buffer
|-
| 0x58E69 || 105 || 711 || Null vibration master volume buffer
|-
| 0x59069 || 105 || 712 || Null NX controller settings buffer
|-
| 0x59269 || 105 || 713 || Null NX controller settings entry count buffer
|-
| 0x59469 || 105 || 714 || Null USB full key enable flag buffer
|-
| 0x5A269 || 105 || 721 || Null TV settings buffer
|-
| 0x5A469 || 105 || 722 || Null EDID buffer
|-
| 0x5B669 || 105 || 731 || Null data deletion settings buffer
|-
| 0x5CA69 || 105 || 741 || Null initial system applet program ID buffer
|-
| 0x5CC69 || 105 || 742 || Null overlay disp program ID buffer
|-
| 0x5CE69 || 105 || 743 || Null IsInRepairProcess buffer
|-
| 0x5D069 || 105 || 744 || Null RequiresRunRepairTimeReviser buffer
|-
| 0x5DE69 || 105 || 751 || Null device timezone location name buffer
|-
| 0x5F269 || 105 || 761 || Null primary album storage buffer
|-
| 0x60669 || 105 || 771 || Null USB 3.0 enable flag buffer
|-
| 0x60869 || 105 || 772 || Null USB Type-C power source circuit version buffer
|-
| 0x61A69 || 105 || 781 || Null battery lot buffer
|-
| 0x62E69 || 105 || 791 || Null serial number buffer
|-
| 0x64269 || 105 || 801 || Null lock screen flag buffer
|-
| 0x64669 || 105 || 803 || Null color set ID buffer
|-
| 0x64869 || 105 || 804 || Null quest flag buffer
|-
| 0x64A69 || 105 || 805 || Null wireless certification file size buffer
|-
| 0x64C69 || 105 || 806 || Null wireless certification file buffer
|-
| 0x64E69 || 105 || 807 || Null initial launch settings buffer
|-
| 0x65069 || 105 || 808 || Null device nickname buffer
|-
| 0x65269 || 105 || 809 || Null battery percentage flag buffer
|-
| 0x65469 || 105 || 810 || Null applet launch flags buffer
|-
| 0x7E869 || 105 || 1012 || Null wireless LAN enable flag buffer
|-
| 0x7FA69 || 105 || 1021 || Null product model buffer
|-
| 0x80E69 || 105 || 1031 || Null NFC enable flag buffer
|-
| 0x82269 || 105 || 1041 || Null ECI device certificate buffer
|-
| 0x82469 || 105 || 1042 || Null E-Ticket device certificate buffer
|-
| 0x83669 || 105 || 1051 || Null sleep settings buffer
|-
| 0x84A69 || 105 || 1061 || Null EULA version buffer
|-
| 0x84C69 || 105 || 1062 || Null EULA version entry count buffer
|-
| 0x85E69 || 105 || 1071 || Null LDN channel buffer
|-
| 0x87269 || 105 || 1081 || Null SSL key buffer
|-
| 0x87469 || 105 || 1082 || Null SSL certificate buffer
|-
| 0x88669 || 105 || 1091 || Null telemetry flags buffer
|-
| 0x89A69 || 105 || 1101 || Null Gamecard key buffer
|-
| 0x89C69 || 105 || 1102 || Null Gamecard certificate buffer
|-
| 0x8AE69 || 105 || 1111 || Null PTM battery lot buffer
|-
| 0x8B069 || 105 || 1112 || Null PTM fuel gauge parameter buffer
|-
| 0x8C269 || 105 || 1121 || Null ECI device key buffer
|-
| 0x8C469 || 105 || 1122 || Null E-Ticket device key buffer
|-
| 0x8D669 || 105 || 1131 || Null speaker parameter buffer
|-
| 0x8EA69 || 105 || 1141 || Null firmware version buffer
|-
| 0x8EC69 || 105 || 1142 || Null firmware version digest buffer
|-
| 0x8EE69 || 105 || 1143 || Null rebootless system update version buffer
|-
| 0x8FE69 || 105 || 1151 || Null Mii author ID buffer
|-
| 0x91269 || 105 || 1161 || Null fatal flags buffer
|-
| 0x92669 || 105 || 1171 || Null auto update enable flag buffer
|-
| 0x93A69 || 105 || 1181 || Null external RTC reset flag buffer
|-
| 0x94E69 || 105 || 1191 || Null push notification activity mode buffer
|-
| 0x96269 || 105 || 1201 || Null service discovery control setting buffer
|-
| 0x97669 || 105 || 1211 || Null error report share permission buffer
|-
| 0x98A69 || 105 || 1221 || Null LCD vendor ID buffer
|-
| 0x99E69 || 105 || 1231 || Null console SixAxis sensor acceleration bias buffer
|-
| 0x9A069 || 105 || 1232 || Null console SixAxis sensor angular velocity bias buffer
|-
| 0x9A269 || 105 || 1233 || Null console SixAxis sensor acceleration gain buffer
|-
| 0x9A469 || 105 || 1234 || Null console SixAxis sensor angular velocity gain buffer
|-
| 0x9A669 || 105 || 1235 || Null console SixAxis sensor angular velocity time bias buffer
|-
| 0x9A869 || 105 || 1236 || Null console SixAxis sensor angular acceleration buffer
|-
| 0x9B269 || 105 || 1241 || Null keyboard layout buffer
|-
| 0x9BA69 || 105 || 1245 || Invalid keyboard layout
|-
| 0x9C669 || 105 || 1251 || Null web inspector flag buffer
|-
| 0x9C869 || 105 || 1252 || Null allowed SSL hosts buffer
|-
| 0x9CA69 || 105 || 1253 || Null allowed SSL hosts entry count buffer
|-
| 0x9CC69 || 105 || 1254 || Null host FS mount point buffer
|-
| 0x9EE69 || 105 || 1271 || Null Amiibo key buffer
|-
| 0x9F069 || 105 || 1272 || Null Amiibo ECQV certificate buffer
|-
| 0x9F269 || 105 || 1273 || Null Amiibo ECDSA certificate buffer
|-
| 0x9F469 || 105 || 1274 || Null Amiibo ECQV BLS key buffer
|-
| 0x9F669 || 105 || 1275 || Null Amiibo ECQV BLS certificate buffer
|-
| 0x9F869 || 105 || 1276 || Null Amiibo ECQV BLS root certificate buffer
|-
| 0x272 || 114 || 1 || Generic error
|-
| 0xC72 || 114 || 6 || Unsupported operation
|-
| 0x74 || 116 || 0 || Time service not initialized
|-
| 0x274 || 116 || 1 || Permission denied
|-
| 0xCC74 || 116 || 102 || Time not set / Clock Source Id mismatch
|-
| 0x19074 || 116 || 200 || Invalid time comparison
|-
| 0x19274 || 116 || 201 || Signed overflow/underflow
|-
| 0x64274 || 116 || 801 || Memory allocation failure
|-
| 0x70A74 || 116 || 901 || Null pointer
|-
| 0x70C74 || 116 || 902 || Value out of valid range
|-
| 0x70E74 || 116 || 903 || TimeZoneRule conversion failed
|-
| 0x7BA74 || 116 || 989 || TimeZone location name not found
|-
| 0x7BC74 || 116 || 990 || Unimplemented functionality
|-
| 0xC79 || 121 || 6 || [[Network_Interface_services#IsAnyInternetRequestAccepted|IsAnyInternetRequestAccepted]] with the output from [[#Network_Interface_services#GetClientId|GetClientId]] returned false.
|-
| 0x27A || 122 || 1 || Invalid argument
|-
| 0x47A || 122 || 2 || Object not found
|-
| 0x67A || 122 || 3 || Object locked/in used
|-
| 0x87A || 122 || 4 || Target already mounted
|-
| 0xA7A || 122 || 5 || Target not mounted
|-
| 0xC7A || 122 || 6 || Object already opened
|-
| 0xE7A || 122 || 7 || Object not opened
|-
| 0x107A || 122 || 8 || [[Network_Interface_services#IsAnyInternetRequestAccepted|IsAnyInternetRequestAccepted]] with the output from [[#Network_Interface_services#GetClientId|GetClientId]] returned false.
|-
| 0xA07A || 122 || 80 || Passphrase not found
|-
| 0xA27A || 122 || 81 || Data verification failed
|-
| 0xB47A || 122 || 90 || Invalid API call
|-
| 0xC47A || 122 || 98 || Invalid operation
|-
| 0x167B || 123 || 11 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SEC errors: -8192 (SEC_ERROR_IO), -8191 (SEC_ERROR_LIBRARY_FAILURE), -8190 (SEC_ERROR_BAD_DATA), -8189 (SEC_ERROR_OUTPUT_LEN), -8188 (SEC_ERROR_INPUT_LEN), -8187 (SEC_ERROR_INVALID_ARGS), -8186 (SEC_ERROR_INVALID_ALGORITHM), -8184 (SEC_ERROR_INVALID_TIME), -8152 (SEC_ERROR_INVALID_KEY).

Also converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSPR/Reference/NSPR_Error_Handling NSPR] errors: -5991 (PR_IO_ERROR), -5962 (PR_BUFFER_OVERFLOW_ERROR), -5950 (PR_FILE_NOT_FOUND_ERROR), -5949 (PR_NOT_DIRECTORY_ERROR), -5946 (PR_FILESYSTEM_MOUNTED_ERROR), -5938 (PR_END_OF_FILE_ERROR).

Also converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL errors: -12223 (SSL_ERROR_GENERATE_RANDOM_FAILURE), -12222 (SSL_ERROR_SIGN_HASHES_FAILURE), -12221 (SSL_ERROR_EXTRACT_PUBLIC_KEY_FAILURE), -12219 (SSL_ERROR_CLIENT_KEY_EXCHANGE_FAILURE), -12218 (SSL_ERROR_ENCRYPTION_FAILURE), -12217 (SSL_ERROR_DECRYPTION_FAILURE), -12216 (SSL_ERROR_SOCKET_WRITE_FAILURE), -12212 (SSL_ERROR_SYM_KEY_CONTEXT_FAILURE), -12209 (SSL_ERROR_IV_PARAM_FAILURE), -12207 (SSL_ERROR_SESSION_KEY_GEN_FAILURE), -12203 (SSL_ERROR_NO_COMPRESSION_OVERLAP), -12202 (SSL_ERROR_HANDSHAKE_NOT_COMPLETED), -12201 (SSL_ERROR_BAD_HANDSHAKE_HASH_VALUE), -12172 (SSL_ERROR_NEXT_PROTOCOL_DATA_INVALID).
|-
| 0x1A7B || 123 || 13 || Unrecognized error.
|-
| 0xCC7B || 123 || 102 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SEC error -8173 (SEC_ERROR_NO_MEMORY).

Also converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSPR/Reference/NSPR_Error_Handling NSPR] errors: -6000 (PR_OUT_OF_MEMORY_ERROR), -5974 (PR_INSUFFICIENT_RESOURCES_ERROR, -5971 (PR_PROC_DESC_TABLE_FULL_ERROR).
|-
| 0xE87B || 123 || 116 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSPR/Reference/NSPR_Error_Handling NSPR] error -5999 (PR_BAD_DESCRIPTOR_ERROR).
|-
| 0x1027B || 123 || 129 || DER CRL decoding failed.
|-
| 0x1987B || 123 || 204 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSPR/Reference/NSPR_Error_Handling NSPR] error -5998 (PR_WOULD_BLOCK_ERROR).
|-
| 0x19A7B || 123 || 205 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSPR/Reference/NSPR_Error_Handling NSPR] error -5990 (PR_IO_TIMEOUT_ERROR).
|-
| 0x19C7B || 123 || 206 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSPR/Reference/NSPR_Error_Handling NSPR] error -5935 (PR_OPERATION_ABORTED_ERROR).
|-
| 0x1A07B || 123 || 208 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSPR/Reference/NSPR_Error_Handling NSPR] error -5978 (PR_NOT_CONNECTED_ERROR).
|-
| 0x1A27B || 123 || 209 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSPR/Reference/NSPR_Error_Handling NSPR] error -5961 (PR_CONNECT_RESET_ERROR).
|-
| 0x1A47B || 123 || 210 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSPR/Reference/NSPR_Error_Handling NSPR] error -5928 (PR_CONNECT_ABORTED_ERROR).
|-
| 0x1A67B || 123 || 211 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSPR/Reference/NSPR_Error_Handling NSPR] error -5929 (PR_SOCKET_SHUTDOWN_ERROR).
|-
| 0x1A87B || 123 || 212 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSPR/Reference/NSPR_Error_Handling NSPR] error -5930 (PR_NETWORK_DOWN_ERROR).
|-
| 0x1AE7B || 123 || 215 || ClientPki/InternalPki was already previously imported/registered.
|-
| 0x1B47B || 123 || 218 || Maximum number of ServerPki objects were already imported.
|-
| 0x25A7B || 123 || 301 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12276 (SSL_ERROR_BAD_CERT_DOMAIN).
|-
| 0x25C7B || 123 || 302 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12285 (SSL_ERROR_NO_CERTIFICATE).
|-
| 0x25E7B || 123 || 303 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SEC errors: -8181 (SEC_ERROR_EXPIRED_CERTIFICATE), -8162 (SEC_ERROR_EXPIRED_ISSUER_CERTIFICATE).
|-
| 0x2607B || 123 || 304 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SEC error -8180 (SEC_ERROR_REVOKED_CERTIFICATE).
|-
| 0x2627B || 123 || 305 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SEC error -8183 (SEC_ERROR_BAD_DER).
|-
| 0x2647B || 123 || 306 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SEC errors: -8102 (SEC_ERROR_INADEQUATE_KEY_USAGE), -8101 (SEC_ERROR_INADEQUATE_CERT_TYPE).
|-
| 0x2667B || 123 || 307 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SEC errors: -8185 (SEC_ERROR_INVALID_AVA), -8182 (SEC_ERROR_BAD_SIGNATURE), -8158 (SEC_ERROR_EXTENSION_VALUE_INVALID), -8156 (SEC_ERROR_CA_CERT_INVALID), -8151 (SEC_ERROR_UNKNOWN_CRITICAL_EXTENSION), -8080 (SEC_ERROR_CERT_NOT_IN_NAME_SPACE).
|-
| 0x2687B || 123 || 308 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SEC errors: -8179 (SEC_ERROR_UNKNOWN_ISSUER), -8172 (SEC_ERROR_UNTRUSTED_ISSUER), -8014 (SEC_ERROR_APPLICATION_CALLBACK_ERROR).
|-
| 0x26A7B || 123 || 309 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SEC error -8171 (SEC_ERROR_UNTRUSTED_CERT).
|-
| 0x26C7B || 123 || 310 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL errors: -12233 (SSL_ERROR_RX_UNKNOWN_RECORD_TYPE), -12232 (SSL_ERROR_RX_UNKNOWN_HANDSHAKE), -12231 (SSL_ERROR_RX_UNKNOWN_ALERT). This is also returned by ImportClientPki when import fails.
|-
| 0x26E7B || 123 || 311 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL errors: -12261 (SSL_ERROR_RX_MALFORMED_HELLO_REQUEST), -12260 (SSL_ERROR_RX_MALFORMED_CLIENT_HELLO), -12259 (SSL_ERROR_RX_MALFORMED_SERVER_HELLO), -12258 (SSL_ERROR_RX_MALFORMED_CERTIFICATE), -12257 (SSL_ERROR_RX_MALFORMED_SERVER_KEY_EXCH), -12256 (SSL_ERROR_RX_MALFORMED_CERT_REQUEST), -12255 (SSL_ERROR_RX_MALFORMED_HELLO_DONE), -12254 (SSL_ERROR_RX_MALFORMED_CERT_VERIFY), -12253 (SSL_ERROR_RX_MALFORMED_CLIENT_KEY_EXCH), -12252 (SSL_ERROR_RX_MALFORMED_FINISHED), -12251 (SSL_ERROR_RX_MALFORMED_CHANGE_CIPHER), -12250 (SSL_ERROR_RX_MALFORMED_ALERT), -12249 (SSL_ERROR_RX_MALFORMED_HANDSHAKE), -12248 (SSL_ERROR_RX_MALFORMED_APPLICATION_DATA), -12166 (SSL_ERROR_RX_MALFORMED_HELLO_VERIFY_REQUEST).
|-
| 0x2707B || 123 || 312 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SEC error -8144 (SEC_ERROR_UNSUPPORTED_KEYALG).

Also converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL errors: -12274 (SSL_ERROR_SSL2_DISABLED), -12247 (SSL_ERROR_RX_UNEXPECTED_HELLO_REQUEST), -12246 (SSL_ERROR_RX_UNEXPECTED_CLIENT_HELLO), -12245 (SSL_ERROR_RX_UNEXPECTED_SERVER_HELLO), -12244 (SSL_ERROR_RX_UNEXPECTED_CERTIFICATE), -12243 (SSL_ERROR_RX_UNEXPECTED_SERVER_KEY_EXCH), -12242 (SSL_ERROR_RX_UNEXPECTED_CERT_REQUEST), -12241 (SSL_ERROR_RX_UNEXPECTED_HELLO_DONE), -12240 (SSL_ERROR_RX_UNEXPECTED_CERT_VERIFY), -12239 (SSL_ERROR_RX_UNEXPECTED_CLIENT_KEY_EXCH), -12238 (SSL_ERROR_RX_UNEXPECTED_FINISHED).
|-
| 0x2727B || 123 || 313 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL errors: -12237 (SSL_ERROR_RX_UNEXPECTED_CHANGE_CIPHER), -12236 (SSL_ERROR_RX_UNEXPECTED_ALERT), -12235 (SSL_ERROR_RX_UNEXPECTED_HANDSHAKE), -12234 (SSL_ERROR_RX_UNEXPECTED_APPLICATION_DATA).
|-
| 0x2747B || 123 || 314 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12263 (SSL_ERROR_RX_RECORD_TOO_LONG).
|-
| 0x2767B || 123 || 315 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12165 (SSL_ERROR_RX_UNEXPECTED_HELLO_VERIFY_REQUEST).
|-
| 0x2787B || 123 || 316 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12163 (SSL_ERROR_RX_UNEXPECTED_CERT_STATUS).
|-
| 0x27A7B || 123 || 317 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12160 (SSL_ERROR_INCORRECT_SIGNATURE_ALGORITHM).
|-
| 0x27C7B || 123 || 318 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL errors: -12173 (SSL_ERROR_WEAK_SERVER_EPHEMERAL_DH_KEY), -12156 (SSL_ERROR_WEAK_SERVER_CERT_KEY).
|-
| 0x27E7B || 123 || 319 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12273 (SSL_ERROR_BAD_MAC_READ).
|-
| 0x2827B || 123 || 321 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL errors: -12215 (SSL_ERROR_MD5_DIGEST_FAILURE), -12214 (SSL_ERROR_SHA_DIGEST_FAILURE), -12161 (SSL_ERROR_DIGEST_FAILURE).
|-
| 0x2847B || 123 || 322 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12213 (SSL_ERROR_MAC_COMPUTATION_FAILURE).
|-
| 0x2887B || 123 || 324 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SEC error -8157 (SEC_ERROR_EXTENSION_NOT_FOUND).
|-
| 0x28A7B || 123 || 325 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SEC error -8049 (SEC_ERROR_UNRECOGNIZED_OID).
|-
| 0x28C7B || 123 || 326 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SEC error -8032 (SEC_ERROR_POLICY_VALIDATION_FAILED).
|-
| 0x2947B || 123 || 330 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12177 (SSL_ERROR_DECOMPRESSION_FAILURE).
|-
| 0xBBA7B || 123 || 1501 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12230 (SSL_ERROR_CLOSE_NOTIFY_ALERT).
|-
| 0xBBC7B || 123 || 1502 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12229 (SSL_ERROR_HANDSHAKE_UNEXPECTED_ALERT).
|-
| 0xBBE7B || 123 || 1503 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12272 (SSL_ERROR_BAD_MAC_ALERT).
|-
| 0xBC07B || 123 || 1504 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12197 (SSL_ERROR_DECRYPTION_FAILED_ALERT).
|-
| 0xBC27B || 123 || 1505 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12196 (SSL_ERROR_RECORD_OVERFLOW_ALERT).
|-
| 0xBC47B || 123 || 1506 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12228 (SSL_ERROR_DECOMPRESSION_FAILURE_ALERT).
|-
| 0xBC67B || 123 || 1507 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12227 (SSL_ERROR_HANDSHAKE_FAILURE_ALERT).
|-
| 0xBCA7B || 123 || 1509 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12271 (SSL_ERROR_BAD_CERT_ALERT).
|-
| 0xBCC7B || 123 || 1510 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12225 (SSL_ERROR_UNSUPPORTED_CERT_ALERT).
|-
| 0xBCE7B || 123 || 1511 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12270 (SSL_ERROR_REVOKED_CERT_ALERT).
|-
| 0xBD07B || 123 || 1512 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12269 (SSL_ERROR_EXPIRED_CERT_ALERT).
|-
| 0xBD27B || 123 || 1513 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12224 (SSL_ERROR_CERTIFICATE_UNKNOWN_ALERT).
|-
| 0xBD47B || 123 || 1514 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12226 (SSL_ERROR_ILLEGAL_PARAMETER_ALERT).
|-
| 0xBD67B || 123 || 1515 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12195 (SSL_ERROR_UNKNOWN_CA_ALERT).
|-
| 0xBD87B || 123 || 1516 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12194 (SSL_ERROR_ACCESS_DENIED_ALERT).
|-
| 0xBDA7B || 123 || 1517 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12193 (SSL_ERROR_DECODE_ERROR_ALERT).
|-
| 0xBDC7B || 123 || 1518 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12192 (SSL_ERROR_DECRYPT_ERROR_ALERT).
|-
| 0xBDE7B || 123 || 1519 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12191 (SSL_ERROR_EXPORT_RESTRICTION_ALERT).
|-
| 0xBE07B || 123 || 1520 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12190 (SSL_ERROR_PROTOCOL_VERSION_ALERT).
|-
| 0xBE27B || 123 || 1521 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12189 (SSL_ERROR_INSUFFICIENT_SECURITY_ALERT).
|-
| 0xBE47B || 123 || 1522 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12188 (SSL_ERROR_INTERNAL_ERROR_ALERT).
|-
| 0xBE67B || 123 || 1523 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12157 (SSL_ERROR_INAPPROPRIATE_FALLBACK_ALERT).
|-
| 0xBE87B || 123 || 1524 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12187 (SSL_ERROR_USER_CANCELED_ALERT).
|-
| 0xBEA7B || 123 || 1525 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12186 (SSL_ERROR_NO_RENEGOTIATION_ALERT).
|-
| 0xBEC7B || 123 || 1526 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12184 (SSL_ERROR_UNSUPPORTED_EXTENSION_ALERT).
|-
| 0xBEE7B || 123 || 1527 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12183 (SSL_ERROR_CERTIFICATE_UNOBTAINABLE_ALERT).
|-
| 0xBF07B || 123 || 1528 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12182 (SSL_ERROR_UNRECOGNIZED_NAME_ALERT).
|-
| 0xBF27B || 123 || 1529 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12181 (SSL_ERROR_BAD_CERT_STATUS_RESPONSE_ALERT).
|-
| 0xBF47B || 123 || 1530 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12180 (SSL_ERROR_BAD_CERT_HASH_VALUE_ALERT).
|-
| 0x27127B || 123 || 5001 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12155 (SSL_ERROR_RX_SHORT_DTLS_READ).
|-
| 0x271E7B || 123 || 5007 || Out-of-bounds error during error conversion.
|-
| 0x287C || 124 || 20 || Argument is NULL
|-
| 0x2C7C || 124 || 22 || Argument is invalid
|-
| 0x3C7C || 124 || 30 || Bad input buffer size
|-
| 0x407C || 124 || 32 || Invalid input buffer
|-
| 0x767C || 124 || 59 || [[Network_Interface_services#IsAnyInternetRequestAccepted|IsAnyInternetRequestAccepted]] with the output from [[#Network_Interface_services#GetClientId|GetClientId]] returned false.
|-
| || 124 || 3000 || [https://en-americas-support.nintendo.com/app/answers/detail/a_id/27166/ System Update Required]
|-
| || 124 || 3001 || [https://en-americas-support.nintendo.com/app/answers/detail/a_id/28969/ Game Update Required]
|-
| || 124 || 4007 || [https://en-americas-support.nintendo.com/app/answers/detail/a_id/28046/ Account Permanent Ban]
|-
| || 124 || 4508 || [https://en-americas-support.nintendo.com/app/answers/detail/a_id/28046/ Account Permanent Ban]
|-
| || 124 || 4517 || [https://en-americas-support.nintendo.com/app/answers/detail/a_id/43652/ Account Ban]
|-
| || 124 || 4609 || [https://en-americas-support.nintendo.com/app/answers/detail/a_id/46482/ Service Discontinued]
|-
| 0x27E || 126 || 1 || Invalid argument
|-
| 0x87E || 126 || 4 || Entry not found
|-
| 0xCE7E || 126 || 67 || Invalid database signature value (should be "NFDB")
|-
| 0xD27E || 126 || 69 || Invalid database entry count
|-
| 0x1987E || 126 || 204 || Development/debug-only behavior
|-
| 0x480 || 128 || 2 || IStorage not available.
|-
| 0x680 || 128 || 3 || No messages
|-
| 0x4680 || 128 || 35 || Error while launching applet.
|-
| 0x4A80 || 128 || 37 || Title-ID not found. Caused by code 0x410 when applet launch fails
|-
| 0x3E880 || 128 || 500 || Invalid input
|-
| 0x3EC80 || 128 || 502 || IStorage has already been opened by another accessor
|-
| 0x3EE80 || 128 || 503 || IStorage Read/Write out-of-bounds
|-
| 0x3F480 || 128 || 506 || Invalid parameters
|-
| 0x3FE80 || 128 || 511 || IStorage opened as wrong type (data opened as transfermem, transfermem opened as data)
|-
| 0x40080 || 128 || 512 || Unbalanced fatal section leave (returned when executing LeaveFatalSection without a preceding EnterFatalSection call)
|-
| 0x40C80 || 128 || 518 || Null object
|-
| 0x4B080 || 128 || 600 || Failed to allocate memory for IStorage
|-
| 0x59080 || 128 || 712 || Thread stack pool exhausted (out of memory)
|-
| 0x79C80 || 128 || 974 || DebugMode not enabled
|-
| 0x7A880 || 128 || 980 || <code>am.debug!dev_function</code> setting needs to be set / DebugMode not enabled
|-
| 0x7CC80 || 128 || 998 || Not implemented
|-
| 0xCC81 || 129 || 102 || Transmission not agreed
|-
| 0xD281 || 129 || 105 || Network unavailable
|-
| 0x7DA81 || 129 || 1005 || HTTP error: Couldnt resolve proxy
|-
| 0x7DC81 || 129 || 1006 || HTTP error: Couldnt resolve host
|-
| 0x7DE81 || 129 || 1007 || HTTP error: Couldnt connect
|-
| 0x7FE81 || 129 || 1023 || HTTP error: Write error
|-
| 0x80481 || 129 || 1026 || HTTP error: Read error
|-
| 0x80681 || 129 || 1027 || HTTP error: Out of memory
|-
| 0x80881 || 129 || 1028 || HTTP error: Operation timedout
|-
| 0x81681 || 129 || 1035 || HTTP error: SSL connect error
|-
| 0x83681 || 129 || 1051 || HTTP error: Peer failed verification
|-
| 0x83881 || 129 || 1052 || HTTP error: Got nothing
|-
| 0x83E81 || 129 || 1055 || HTTP error: Send error
|-
| 0x84081 || 129 || 1056 || HTTP error: Recv error
|-
| 0x84481 || 129 || 1058 || HTTP error: SSL cert problem
|-
| 0x84681 || 129 || 1059 || HTTP error: SSL cipher
|-
| 0x84881 || 129 || 1060 || HTTP error: SSL CA cert
|-
| 0x12C081 || 129 || 2400 || Server error: Status 400
|-
| 0x12C281 || 129 || 2401 || Server error: Status 401
|-
| 0x12C681 || 129 || 2403 || Server error: Status 403
|-
| 0x138881 || 129 || 2500 || Server error: Status 500
|-
| 0x138E81 || 129 || 2503 || Server error: Status 503
|-
| 0x139081 || 129 || 2504 || Server error: Status 504
|-
| 0xA83 || 131 || 5 || Unrecognized applet ID
|-
| 0x485 || 133 || 2 || Invalid DVFS table ID
|-
| 0x685 || 133 || 3 || DVFS table ID for debug only, see [[PCV_services#Module|DVFS Table]] notes.
|-
| 0x885 || 133 || 4 || Invalid parameter
|-
| 0x1489 || 137 || 10 || Already initialized.
|-
| 0x3C89 || 137 || 30 || Task not found.
|-
| 0x5089 || 137 || 40 || Memory allocation failed / bad input.
|-
| 0x29489 || 137 || 330 || [[NCM_services#ContentMetaType|ContentMetaType]] doesn't match SystemUpdate.
|-
| 0x271289 || 137 || 5001 || One of the following socket errors occurred: ENETDOWN, ECONNRESET, EHOSTDOWN, EHOSTUNREACH, or EPIPE. Also occurs when the received size doesn't match the expected size (recvfrom() ret with [[NIM_services#Contents_Delivery|meta_size]] data receiving).
|-
| 0x272489 || 137 || 5010 || Socket was [[Sockets_services|shutdown()]] due to the async operation being cancelled.
|-
| 0x273889 || 137 || 5020 || Too many internal output entries with [[NIM_services|nim]] cmd42, system is [[NIM_services#Contents_Delivery|Internet-connected]], or an unrecognized socket error occured.
|-
| 0x27D889 || 137 || 5100 || Connection timeout.
|-
| 0x2A4489 || 137 || 5410 || Invalid [[NIM_services#Contents_Delivery|ID]].
|-
| 0x2A5889 || 137 || 5420 || Invalid [[NIM_services#Contents_Delivery|magicnum]]. Can also be caused by the connection being closed by the peer, since non-negative return values from recv() are ignored in this case.
|-
| 0x2A6C89 || 137 || 5430 || Invalid [[NIM_services#Contents_Delivery|data_size]].
|-
| 0x2A8089 || 137 || 5440 || The input [[NCM_services#ContentMetaKey|ContentMetaKey]] doesn't match the ContentMetaKey in state.
|-
| 0x2A9489 || 137 || 5450 || Invalid [[NIM_services#Contents_Delivery|meta_size]].
|-
| 0x36B289 || 137 || 7001 || HTTP invalid response code (>=600).
|-
| 0x36B489 || 137 || 7002 || HTTP invalid client response code (4xx).
|-
| 0x36B689 || 137 || 7003 || HTTP invalid server response code (5xx).
|-
| 0x36B889 || 137 || 7004 || HTTP invalid redirect response code (3xx).
|-
| 0x390889-0x391889 || 137 || 7300-7308 || HTTP response code 300-308.
|-
| 0x39D089-0x39F289 || 137 || 7400-7417 || HTTP response code 400-417.
|-
| 0x3A9889-0x3AAA89 || 137 || 7500-7509 || HTTP response code 500-509.
|-
| 0x3CF089 || 137 || 7800 || Unknown/invalid libcurl error.
|-
| 0x3E8289-0x3F4089 || 137 || 8001-8096 || libcurl error 1-96. Some of the libcurl errors in the error-table map to the above unknown-libcurl-error however.
|-
| 0x68A || 138 || 3 || Not initialized.
|-
| 0x668C || 140 || 51 || USB data-transfer in progress
|-
| 0xD48C || 140 || 106 || Invalid descriptor
|-
| 0x1928C || 140 || 201 || USB device not bound / interface already enabled
|-
| 0x1BE8E || 142 || 223 || [[Network_Interface_services#IsAnyInternetRequestAccepted|IsAnyInternetRequestAccepted]] with the output from [[#Network_Interface_services#GetClientId|GetClientId]] returned false.
|-
| 0x290 || 144 || 1 || Exited Abnormally ([[Applet_Manager_services#LibraryAppletExitReason|ExitReason]] == Abormal)
|-
| 0x690 || 144 || 3 || Canceled ([[Applet_Manager_services#LibraryAppletExitReason|ExitReason]] == Canceled)
|-
| 0x890 || 144 || 4 || Rejected
|-
| 0xA90 || 144 || 5 || Exited Unexpectedly ([[Applet_Manager_services#LibraryAppletExitReason|ExitReason]] == Unexpected)
|-
| 0x299 || 153 || 1 || Invalid audio device
|-
| 0x499 || 153 || 2 || Operation couldn't complete successfully
|-
| 0x699 || 153 || 3 || Invalid sample rate
|-
| 0x899 || 153 || 4 || Buffer size too small
|-
| 0x1099 || 153 || 8 || Too many buffers are still unreleased
|-
| 0x1499 || 153 || 10 || Invalid channel count
|-
| 0x40299 || 153 || 513 || Invalid/Unsupported operation
|-
| 0xC0099 || 153 || 1536 || Invalid handle
|-
| 0xC0899 || 153 || 1540 || Audio output was already started
|-
| 0x3C9D || 157 || 30 || Address is NULL
|-
| 0x3E9D || 157 || 31 || PID is NULL
|-
| 0x549D || 157 || 42 || Already bound
|-
| 0xCC9D || 157 || 102 || Invalid PID
|-
| 0x49E || 158 || 2 || BootImagePackage not found
|-
| 0x69E || 158 || 3 || Invalid BootImagePackage
|-
| 0x89E || 158 || 4 || Work buffer too small
|-
| 0xA9E || 158 || 5 || Work buffer not aligned
|-
| 0xC9E || 158 || 6 || BootImages need repair
|-
| 0x29F || 159 || 1 || Cancel was selected
|-
| 0xAA3 || 163 || 5 || System is booting up repair process without VOL+ held down.
|-
| 0xCA3 || 163 || 6 || System is booting up repair process that requires RepairTimeReviser but does not have special cartridge inserted.
|-
| 0x70A4 || 164 || 56 || [[Network_Interface_services#IsAnyInternetRequestAccepted|IsAnyInternetRequestAccepted]] with the output from [[#Network_Interface_services#GetClientId|GetClientId]] returned false.
|-
| 0x4AF || 175 || 2 || Bad version returned from calling the "nnjitpluginGetVersion" symbol.
|-
| 0xCAAF || 175 || 101 || Input NRO/NRR are too large for the storage buffer.
|-
| 0x4B0AF || 175 || 600 || Symbol funcptr used by this cmd is not initialized (Control/GenerateCode).
|-
| 0x4B2AF || 175 || 601 || DllPlugin Not initialized, or plugin NRO has already been loaded.
|-
| 0x4B4AF || 175 || 602 || An error was returned from calling the symbol funcptr with the Control cmd.
|-
| 0xC8B2 || 178 || 100 || Invalid user ID
|-
| 0xCAB2 || 178 || 101 || User does not exist
|-
| 0x12CB2 || 178 || 150 || Service unavailable
|-
| 0x190B2 || 178 || 200 || File storage failure
|-
| 0xAB4 || 180 || 5 || Invalid event ID
|-
| 0x1F4EB5 || 181 || 4007 || Device authentication error: System update required
|-
| 0x1F50B5 || 181 || 4008 || Device authentication error: [https://en-americas-support.nintendo.com/app/answers/detail/a_id/42061/ Permanant Ban]
|-
| 0x1F52B5 || 181 || 4009 || Device authentication error: Internal server error
|-
| 0x1F54B5 || 181 || 4007 || Device authentication error: Under maintenance
|-
| || 181 || 4017 || Device authentication error: [https://en-americas-support.nintendo.com/app/answers/detail/a_id/43653/ Ban]
|-
| 0x58ACA || 202 || 709 || Npad ID is out of range.
|-
| 0x2032CA || 202 || 4121 || [[Settings_services#ButtonConfigSettings|ButtonConfigSettings]] IsFull flag is clear.
|-
| 0x28CB || 203 || 20 || The [6.0.0+] Authentication challenge failed.
|-
| 0x40CB || 203 || 32 || Bad State / bad state ptr.
|-
| 0x82CB || 203 || 65 || Failed to connect to the AccessPoint.
|-
| 0x84CB || 203 || 66 || Timeout occured during Authentication / while attempting to find a valid ActionFrame.
|-
| 0x86CB || 203 || 67 || Maximum participants reached, Station not allowed to connect, ...
|-
| 0xC0CB || 203 || 96 || Bad input, or not initialized.
|-
| 0xC2CB || 203 || 97 || Matching LocalCommunicationId not found in the user-process [[NACP_Format|control.nacp]].
|-
| 0xE2CB || 203 || 113 || The specified LocalCommunicationVersion is less than the AccessPoint LocalCommunicationVersion.
|-
| 0xE4CB || 203 || 114 || The specified LocalCommunicationVersion is larger than the AccessPoint LocalCommunicationVersion.
|-
| 0xF0CD || 205 || 120 || IR image data not available/ready.
|-
| 0x1A8CD || 205 || 212 || IR camera handle pointer is null.
|-
| 0x198CD || 205 || 204 || IR camera invalid handle value.
|-
| 0x4CE || 206 || 2 || Invalid argument.
|-
| 0x6CE || 206 || 3 || Out of memory.
|-
| 0x10CE || 206 || 8 || Out of range. Buffer needs to be aligned.
|-
| 0x18CE || 206 || 12 || Invalid FileId.
|-
| 0x1ACE || 206 || 13 || Invalid storage ID.
|-
| 0x1CCE || 206 || 14 || Invalid content type.
|-
| 0x2ACE || 206 || 21 || Failed to mount Image Directory.
|-
| 0x2CCE || 206 || 23 || File too big.
|-
| 0x30CE || 206 || 24 || Invalid file size.
|-
| 0x3CCE || 206 || 30 || Buffer insufficient.
|-
| 0xAF2CE || 206 || 1401 || Too many files already saved.
|-
| 0x4DA || 218 || 2 || StatusManager entry IsValid flag not set, or controller-update currently in-progress.
|-
| 0x6DA || 218 || 3 || Controller-update failed via the LibraryApplet.
|-
| 0x8DA || 218 || 4 || Invalid BusHandle.
|-
| 0xADA || 218 || 5 || StatusManager entry flag +0x0 not set, or device not connected.
|-
| 0xEDA || 218 || 7 || PollingReceivedData not available.
|-
| 0x10DA || 218 || 8 || StatusManager entry DeviceEnabled flag not set, or flag +0x0 not set.
|-
| 0x12DA || 218 || 9 || ExternalDeviceId mismatch.
|-
| 0x14DA || 218 || 10 || BusHandle already initialized.
|-
| 0x104E7 || 231 || 130 || Nullptr passed to the LocalCommunicationId [[NACP_Format|control.nacp]] validation func.
|-
| 0x140E7 || 231 || 160 || GroupInfo field out of range.
|-
| 0x142E7 || 231 || 161 || SupportedPlatform not appropriate for this operation.
|-
| 0x146E7 || 231 || 163 || Invalid ServiceName.
|-
| 0x148E7 || 231 || 164 || Must provide PresharedBinaryKey.
|-
| 0x1C0E7 || 231 || 224 || Requested Priority value not allowed.
|-
| 0x1C2E7 || 231 || 225 || Matching LocalCommunicationId not found in the user-process [[NACP_Format|control.nacp]].
|-
| 0x200E7 || 231 || 256 || Invalid flag.
|-
| 0x204E7 || 231 || 258 || Invalid SupportedPlatform.
|-
| 0x208E7 || 231 || 260 || Invalid StaticAesKeyIndex.
|-
| 0x20AE7 || 231 || 261 || MemberCountMax cannot be greater than 8.
|-
| 0x210E7 || 231 || 264 || GroupInfo+8F must be 0x20.
|}

=== FS Error codes ===
The following are the error codes recognized by nn::fs::detail::LogErrorMessage found in some [[Factory Setup|factory]] titles:

{| class=wikitable
! Value || Description || Message
|-
| 0xD401 || 106 || nn::svc::ResultInvalidCurrentMemory: Error: Passed buffer is not usable for fs library. See a manual of fs library for more information.
|-
| 0x7802 || 60 || nn::fs::ResultMountNameAlreadyExists: Error: Specified mount name already exists.
|-
| 0x7D202 || 1001 || nn::fs::ResultPartitionNotFound: Error: Specified partition is not found.
|-
| 0x7D402 || 1002 || nn::fs::ResultTargetNotFound: Error: Specified target is not found.
|-
| 0xFA002 - 0x138602 || 2000 - 2499 || nn::fs::ResultSdCardAccessFailed: Error: Failed to access SD card.
|-
| 0x136802 - 0x176E02 || 2500 - 2999 || nn::fs::ResultGameCardAccessFailed: Error: Failed to access game card.
|-
| 0x177202 || 3001 || nn::fs::ResultNotImplemented: Error: Specified operation is not implemented.
|-
| 0x177A02 || 3005 || nn::fs::ResultOutOfRange: Error: Specified value is out of range.
|-
| 0x190002 - 0x1B5602 || 3200 - 3499 || nn::fs::ResultAllocationMemoryFailed: Error: Failed to allocate memory.
|-
| 0x1B5802 - 0x1F3E02 || 3500 - 3999 || nn::fs::ResultMmcAccessFailed: Error: Failed to access MMC.
|-
| 0x1F4202 - 0x219602 || 4001 - 4299 || nn::fs::ResultRomCorrupted: Error: ROM is corrupted.
|-
| 0x219A02 - 0x232602 || 4301 - 4499 || nn::fs::ResultSaveDataCorrupted: Error: Save data is corrupted.
|-
| 0x232A02 - 0x23EE02 || 4501 - 4599 || nn::fs::ResultNcaCorrupted: Error: NCA is corrupted.
|-
| 0x23F202 - 0x243E02 || 4601 - 4639 || nn::fs::ResultIntegrityVerificationStorageCorrupted: Error: Integrity verification failed.
|-
| 0x244202 - 0x246602 || 4641 - 4659 || nn::fs::ResultPartitionFileSystemCorrupted: Error: Partition FS is corrupted.
|-
| 0x246A02 - 0x248E02 || 4661 - 4679 || nn::fs::ResultBuiltInStorageCorrupted: Error: Built-in-storage is corrupted.
|-
| 0x249202 - 0x24B602 || 4681 - 4699 || nn::fs::ResultFatFileSystemCorrupted: Error: FAT FS is corrupted.
|-
| 0x24BA02 - 0x24DE02 || 4701 - 4719 || nn::fs::ResultHostFileSystemCorrupted: Error: HOST FS is corrupted.
|-
| 0x1F4002 - 0x270E02 || 4000, 4300, 4500, 4600, 4640, 4660, 4680, 4700, 4720-4999 || nn::fs::ResultDataCorrupted: Error: Data is corrupted.
|-
| 0x271002 - 0x2EDE02 || 5000-5999 || nn::fs::ResultUnexpected: Error: Unexpected failure occurred.
|-
| 0x2EE002 - 0x32C602 || 6000-6499 || nn::fs::ResultPreconditionViolation: Error: Precondition violation.
|-
| 0x2EE202 - 0x306E02 || 6001-6199 || nn::fs::ResultInvalidArgument: Error: Invalid argument was specified.
|-
| 0x2EE402 - 0x2F1A02 || 6002-6029 || nn::fs::ResultInvalidPath: Error: Invalid path was specified.
|-
| 0x2EE602 || 6003 || nn::fs::ResultTooLongPath: Error: Too long path was specified.
|-
| 0x2EE802 || 6004 || nn::fs::ResultInvalidCharacter: Error: Invalid path character was specified.
|-
| 0x2EEA02 || 6005 || nn::fs::ResultInvalidPathFormat: Error: Invalid path format was specified.
|-
| 0x2F5A02 || 6061 || nn::fs::ResultInvalidOffset: Error: Invalid offset was specified.
|-
| 0x2F5C02 || 6062 || nn::fs::ResultInvalidSize: Error: Invalid size was specified.
|-
| 0x2F5E02 || 6063 || nn::fs::ResultNullptrArgument: Error: Null pointer argument was specified.
|-
| 0x2F6202 || 6065 || nn::fs::ResultInvalidMountName: Error: Invalid mount name was specified.
|-
| 0x2F6402 || 6066 || nn::fs::ResultExtensionSizeTooLarge: Error: Extension size exceeds max value set in nmeta file.
|-
| 0x2F6602 || 6067 || nn::fs::ResultExtensionSizeInvalid: Error: Extension size is not a multiple of nn::fs::SaveDataExtensionUnitSize.
|-
| 0x307202 || 6201 || nn::fs::ResultFileExtensionWithoutOpenModeAllowAppend: Error: OpenMode_AllowAppend is required for implicit extension of file size by WriteFile().
|-
| 0x307002 - 0x313602 || 6200, 6202 - 6299 || nn::fs::ResultInvalidOperationForOpenMode: Error: Invalid operation for the open mode.
|-
| 0x313802 - 0x31FE02 || 6300-6399 || nn::fs::ResultUnsupportedOperation: Error: Unsupported operation.
|-
| 0x320002 - 0x326202 || 6400-6449 || nn::fs::ResultPermissionDenied: Error: Permission denied.
|-
| 0x327202 || 6457 || nn::fs::ResultWriteModeFileNotClosed: Error: Close files opened in write mode before committing.
|-
| 0x328202 || 6465 || nn::fs::ResultUserNotExist: Error: Specified user doesn't exist.
|-
| 0x346402 || 6706 || nn::fs::ResultMappingTableFull: Error: Enough journal space is not left.
|-
| 0x346A02 || 6709 || nn::fs::ResultOpenCountLimit: Error: The open count of files and directories reached the limitation.
|-
| 0x353602 || 6811 || nn::fs::ResultMapFull: Error: Save data extension count reached the limitation.
|-
| 0x35F202 || 6905 || nn::fs::ResultNotMounted: Error: Specified mount name is not found.
|}

= Fatal Errors =
{| class=wikitable
! Error || Description
|-
| 2162-0002
| Can be triggered by running [[SVC|svcBreak]]. The svcBreak params have no effect on the value of the thrown error-code.
|-
| 2168-0000
| Userland ARM undefined instruction exception
|-
| 2168-0001
| Userland ARM prefetch-abort due to PC set to non-executable region
|-
| 2168-0002
| Userland ARM data abort. Also caused by abnormal process termination via [[SVC|svcExitProcess]]. Note: directly jumping to nnMain()-retaddr from non-main-thread has the same result.
|-
| 2168-0003
| Userland PC address not aligned to 4 bytes
|-
| 2168-0008
| Can occur when attempting to call an svc outside the whitelist
|}

= Support Errors =
This section is for Support Errors displayed by the error-applet, separate from the normal Result Errors.

== Modules ==
{| class=wikitable
! Value || Name
|-
| 520 || Nverpt
|-
| 800 || [[Internet_Browser|General web-applet]]
|-
| 809 || [[Internet_Browser|WifiWebAuthApplet]]
|-
| 810 || [[Internet_Browser|Whitelisted-applet]]
|-
| 811 || [[Internet_Browser|ShopN]]
|}

8XX is for/includes system applets.

== Error codes ==
{| class=wikitable
! Value || Module || Description || Notes
|-
|
| {web-applets listed above}
| 2750
| MP4 parsing failed.
|}

Normal error-codes displayed by the system also use the same format as fatal-errors.

= Homebrew Errors =
Custom errors used by homebrew libraries and applications.

== Modules ==
{| class=wikitable
! Value || Name
|-
| 345 || libnx
|-
| 346 || [[Homebrew ABI]]
|-
| 347 || Homebrew Loader
|-
| 348 || libnx NVIDIA errors
|-
| 349 || libnx Binder errors
|}

Error codes

2021-01-29T18:45:48Z

CFSworks: /* Error codes */ Add a couple of HIPC server error codes I discovered

= Structure =
These have been redesigned from the 3DS so that they fit within a Aarch64 MOV instruction immediate most of the time (without requiring the additional MOVK).

{| class=wikitable
! Bits || Field
|-
| 8-0 || Module
|-
| 21-9 || Description
|}

When a fatal-error is received the error code is outputted using the following formatter:
%04d-%04d

.. where the first code is <code>2000 + Module</code>, and the other being <code>Description</code>. Bits >=22 from the error-code are unused when displaying fatal-errors, since the Description ends with bit21.

= Result Errors =
General errors used by system modules and applications.

== Modules ==
{| class=wikitable
! Value || Name
|-
| 1 || Kernel
|-
| 2 || Fs
|-
| 3 || OS
|-
| 4 || Htcs
|-
| 5 || Ncm
|-
| 6 || Dd
|-
| 7 || Dmnt
|-
| 8 || Lr
|-
| 9 || Loader
|-
| 10 || Cmif
|-
| 11 || Hipc
|-
| 15 || Pm
|-
| 16 || Ns
|-
| 17 || Bsdsockets
|-
| 18 || Htc
|-
| 19 || Tsc
|-
| 20 || Ncm (content)
|-
| 21 || Sm
|-
| 22 || Ro (userland)
|-
| 23 || Gc
|-
| 24 || Sdmmc
|-
| 25 || Ovln
|-
| 26 || Spl
|-
| 27 || Socket
|-
| 29 || Htclow
|-
| 30 || Ddsf
|-
| 31 || Htcfs
|-
| 32 || Async
|-
| 100 || Ethc
|-
| 101 || I2c
|-
| 102 || Gpio
|-
| 103 || Uart
|-
| 105 || Settings
|-
| 107 || Wlan
|-
| 108 || Xcd
|-
| 110 || Nifm
|-
| 111 || Hwopus
|-
| 112 || Sasbus
|-
| 113 || Bluetooth
|-
| 114 || Vi
|-
| 115 || Nfp
|-
| 116 || Time
|-
| 117 || Fgm
|-
| 118 || Oe
|-
| 120 || Pcie
|-
| 121 || Friends
|-
| 122 || Bcat
|-
| 123 || Ssl
|-
| 124 || Account
|-
| 125 || News
|-
| 126 || Mii
|-
| 127 || Nfc
|-
| 128 || Am
|-
| 129 || Prepo
|-
| 130 || Ahid
|-
| 132 || Qlaunch
|-
| 133 || Pcv
|-
| 134 || Omm
|-
| 135 || Bpc
|-
| 136 || Psm
|-
| 137 || Nim
|-
| 138 || Psc
|-
| 139 || Tc
|-
| 140 || Usb
|-
| 141 || Nsd
|-
| 142 || Pctl
|-
| 143 || Btm
|-
| 144 || La
|-
| 145 || ETicket
|-
| 146 || Ngc
|-
| 147 || Erpt
|-
| 148 || Apm
|-
| 149 || Cec
|-
| 150 || Profiler
|-
| 151 || Eupld
|-
| 153 || Audio
|-
| 154 || Npns
|-
| 155 || Npns XMPP stream
|-
| 157 || Arp
|-
| 158 || Updater
|-
| 159 || Swkbd
|-
| 161 || Mifare
|-
| 162 || Userland (assert)
|-
| 163 || Fatal
|-
| 164 || Ec (shop)
|-
| 165 || Spsm
|-
| 167 || Bgtc
|-
| 168 || Userland (crash)
|-
| 169 || Sasbus periodic receive mode
|-
| 175 || Jit
|-
| 177 || Hdcp
|-
| 178 || Pdm
|-
| 179 || Olsc
|-
| 180 || Srepo
|-
| 181 || Dauth
|-
| 187 || Sasbus
|-
| 189 || Pwm
|-
| 191 || Rtc
|-
| 192 || Regulator
|-
| 193 || Led
|-
| 197 || Clkrst
|-
| 198 || Powctl
|-
| 202 || Hid
|-
| 203 || Ldn
|-
| 204 || Cs
|-
| 205 || Irsensor
|-
| 206 || Capture
|-
| 208 || Manu
|-
| 209 || Atk
|-
| 210 || Web
|-
| 211 || Lcs
|-
| 212 || Grc
|-
| 214 || Album
|-
| 216 || Migration
|-
| 217 || Migration idc server
|-
| 218 || Hidbus
|-
| 223 || Websocket
|-
| 227 || Capmtp
|-
| 228 || Pgl
|-
| 229 || Notification
|-
| 230 || Ins
|-
| 231 || Lp2p
|-
| 244 || Dp2hdmi
|}

== Error codes ==
{| class=wikitable
! Value || Module || Description || Notes
|-
| 0x0E01 || 1 || 7 || Session count exceeded
|-
| 0x1C01 || 1 || 14 || Invalid kernel capability descriptor
|-
| 0x4201 || 1 || 33 || Not Implemented
|-
| 0x7601 || 1 || 59 || Thread terminated/termination requested
|-
| 0x8C01 || 1 || 70 || No more debug events
|-
| 0xCA01 || 1 || 101 || Invalid size
|-
| 0xCC01 || 1 || 102 || Invalid address
|-
| 0xCE01 || 1 || 103 || Resource exhaustion
|-
| 0xD001 || 1 || 104 || Memory exhaustion
|-
| 0xD201 || 1 || 105 || Handle-table exhaustion
|-
| 0xD401 || 1 || 106 || Invalid memory state / invalid memory permissions.
|-
| 0xD801 || 1 || 108 || Invalid memory permissions.
|-
| 0xDC01 || 1 || 110 || Invalid memory range
|-
| 0xE001 || 1 || 112 || Invalid thread priority.
|-
| 0xE201 || 1 || 113 || Invalid processor id.
|-
| 0xE401 || 1 || 114 || Invalid handle.
|-
| 0xE601 || 1 || 115 || Invalid pointer/Syscall copy from user failed.
|-
| 0xE801 || 1 || 116 || Invalid combination
|-
| 0xEA01 || 1 || 117 || Time out. Also when you give 0 handles to svcWaitSynchronizationN.
|-
| 0xEC01 || 1 || 118 || Operation canceled
|-
| 0xEE01 || 1 || 119 || Out of range
|-
| 0xF001 || 1 || 120 || Invalid enum
|-
| 0xF201 || 1 || 121 || No such entry
|-
| 0xF401 || 1 || 122 || Irq/DeviceAddressSpace/{...} already registered
|-
| 0xF601 || 1 || 123 || Port remote dead
|-
| 0xF801 || 1 || 124 || [Usermode] Unhandled interrupt/exception
|-
| 0xFA01 || 1 || 125 || Invalid state
|-
| 0xFC01 || 1 || 126 || Reserved value
|-
| 0xFE01 || 1 || 127 || Invalid hardware breakpoint
|-
| 0x10001 || 1 || 128 || [Usermode] Fatal exception
|-
| 0x10201 || 1 || 129 || Last thread didn't belong to your process
|-
| 0x10601 || 1 || 131 || Port closed
|-
| 0x10801 || 1 || 132 || Resource limit exceeded
|-
| 0x20801 || 1 || 260 || Command buffer too small
|-
| 0x40A01 || 1 || 517 || Invalid process ID.
|-
| 0x40C01 || 1 || 518 || Invalid thread ID.
|-
| 0x40E01 || 1 || 519 || Invalid thread ID (used in svcGetDebugThreadParam).
|-
| 0x41001 || 1 || 520 || Process not being debugged
|-
| 0x202 || 2 || 1 || Path does not exist.
|-
| 0x402 || 2 || 2 || Path already exists.
|-
| 0xE02 || 2 || 7 || Resource already in use (file already opened, savedata filesystem already mounted).
|-
| 0x4602 || 2 || 35 || Not enough free space for BIS Calibration partition.
|-
| 0x4802 || 2 || 36 || Not enough free space for BIS Safe partition.
|-
| 0x4A02 || 2 || 37 || Not enough free space for BIS User partition.
|-
| 0x4C02 || 2 || 38 || Not enough free space for BIS System partition.
|-
| 0x4E02 || 2 || 39 || Not enough free space on SD card.
|-
| 0x6402 || 2 || 50 || NCA is older than version 3, or NCA SDK version is older than 0.11.0.0
|-
| 0x7802 || 2 || 60 || Specified mount name already exists.
|-
| 0x7D202 || 2 || 1001 || Process does not have RomFs
|-
| 0x7D402 || 2 || 1002 || Title-id not found / savedata not found.
|-
| 0xFA202 || 2 || 2001 || SD card not inserted
|-
| 0x13B002 || 2 || 2520 || Gamecard not inserted
|-
| 0x13B402 || 2 || 2522 || Attempted process an AsicHandler command in initial mode
|-
| 0x13D802 || 2 || 2540 || Attempted to read from the secure gamecard partition in normal mode
|-
| 0x13DA02 || 2 || 2541 || Attempted to read from the normal gamecard partition in secure mode
|-
| 0x13DC02 || 2 || 2542 || Attempted a read that spanned both the normal and secure gamecard partitions
|-
| 0x13E002 || 2 || 2544 || Gamecard initial data hash doesn't match the initial data hash in the card header
|-
| 0x13E202 || 2 || 2545 || Gamecard initial data reserved area is not all zeros
|-
| 0x13E402 || 2 || 2546 || Gamecard certificate kek index doesn't match card header kek index
|-
| 0x13EE02 || 2 || 2551 || Unable to read card header on gamecard init
|-
| 0x140A02 || 2 || 2565 || Encountered SDMMC error in write operation
|-
| 0x145002 || 2 || 2600 || Attempted to switch lotus state machine to secure mode from a mode other than normal
|-
| 0x145202 || 2 || 2601 || Attempted to switch lotus state machine to normal mode from a mode other than initial
|-
| 0x145402 || 2 || 2602 || Attempted to switch lotus state machine to write mode from a mode other than normal
|-
| 0x149402 || 2 || 2634 || Error processing lotus command SetUserAsicFirmware
|-
| 0x149A02 || 2 || 2637 || Error processing lotus command GetAsicCert
|-
| 0x14A002 || 2 || 2640 || Error processing lotus command SetEmmcEmbeddedSocCertificate
|-
| 0x14AA02 || 2 || 2645 || Error processing lotus command GetAsicEncryptedMessage
|-
| 0x14AC02 || 2 || 2646 || Error processing lotus command SetLibraryEncryptedMessage
|-
| 0x14B602 || 2 || 2651 || Error processing lotus command GetAsicAuthenticationData
|-
| 0x14B802 || 2 || 2652 || Error processing lotus command SetAsicAuthenticationDataHash
|-
| 0x14BA02 || 2 || 2653 || Error processing lotus command SetLibraryAuthenticationData
|-
| 0x14BC02 || 2 || 2654 || Error processing lotus command GetLibraryAuthenticationDataHash
|-
| 0x14C202 || 2 || 2657 || Error processing lotus command ExchangeRandomValuesInSecureMode
|-
| 0x14D802 || 2 || 2668 || Error calling nn::gc::detail::GcCrypto::GenerateRandomBytes
|-
| 0x14DE02 || 2 || 2671 || Error processing lotus command ReadAsicRegister
|-
| 0x14E002 || 2 || 2672 || Error processing lotus command GetGameCardIdSet
|-
| 0x14E402 || 2 || 2674 || Error processing lotus command GetCardHeader
|-
| 0x14E802 || 2 || 2676 || Error processing lotus command GetCardKeyArea
|-
| 0x14EA02 || 2 || 2677 || Error processing lotus command ChangeDebugMode
|-
| 0x14EC02 || 2 || 2678 || Error processing lotus command GetRmaInformation
|-
| 0x150802 || 2 || 2692 || Tried sending lotus card command Refresh when not in secure mode
|-
| 0x150A02 || 2 || 2693 || Tried sending lotus card command when not in correct mode
|-
| 0x155602 || 2 || 2731 || Error processing lotus card command ReadId1
|-
| 0x155802 || 2 || 2732 || Error processing lotus card command ReadId2
|-
| 0x155A02 || 2 || 2733 || Error processing lotus card command ReadId3
|-
| 0x155E02 || 2 || 2735 || Error processing lotus card command ReadPage
|-
| 0x156202 || 2 || 2737 || Error processing lotus card command WritePage
|-
| 0x156402 || 2 || 2738 || Error processing lotus card command Refresh
|-
| 0x156C02 || 2 || 2742 || Error processing lotus card command ReadCrc
|-
| 0x156E02 || 2 || 2743 || Error processing lotus card command Erase or UnlockForceErase
|-
| 0x157002 || 2 || 2744 || Error processing lotus card command ReadDevParam
|-
| 0x157202 || 2 || 2745 || Error processing lotus card command WriteDevParam
|-
| 0x16B002 || 2 || 2904 || Id2Normal did not match the value in the buffer returned by ChangeDebugMode
|-
| 0x16B202 || 2 || 2905 || Id1Normal did not match Id1Writer when switching gamecard to write mode
|-
| 0x16B402 || 2 || 2906 || Id2Normal did not match Id2Writer when switching gamecard to write mode
|-
| 0x171402 || 2 || 2954 || Invalid gamecard handle.
|-
| 0x172002 || 2 || 2960 || Invalid gamecard handle when opening normal gamecard partition
|-
| 0x172202 || 2 || 2961 || Invalid gamecard handle when opening secure gamecard partition
|-
| 0x177202 || 2 || 3001 || Unimplemented behavior
|-
| 0x177602 || 2 || 3003 || File/Directory already exists.
|-
| 0x190202 || 2 || 3201 || Memory allocation failure related to FAT filesystem code
|-
| 0x190602 || 2 || 3203 || Memory allocation failure related to FAT filesystem code
|-
| 0x190802 || 2 || 3204 || Memory allocation failure related to FAT filesystem code
|-
| 0x190A02 || 2 || 3205 || Memory allocation failure related to FAT filesystem code
|-
| 0x190C02 || 2 || 3206 || Memory allocation failure related to FAT filesystem code
|-
| 0x191002 || 2 || 3208 || Memory allocation failure related to FAT filesystem code
|-
| 0x195802 || 2 || 3244 || Allocation failure related to SD cards
|-
| 0x196002 || 2 || 3248 || Out of memory
|-
| 0x196202 || 2 || 3249 || Out of memory
|-
| 0x1A3E02 || 2 || 3359 || Out of memory
|-
| 0x1A4002 || 2 || 3360 || Out of memory
|-
| 0x1A4A02 || 2 || 3365 || Out of memory
|-
| 0x21BC02 || 2 || 4318 || Invalid save data filesystem magic (valid magic is SAVE in ASCII)
|-
| 0x234202 || 2 || 4513 || Error reading ACID section in NPDM
|-
| 0x234402 || 2 || 4514 || Invalid NPDM ACID section size
|-
| 0x234602 || 2 || 4515 || Last byte of the ACID modulus is zero
|-
| 0x234802 || 2 || 4516 || Invalid ACID fixed key signature
|-
| 0x234A02 || 2 || 4517 || Invalid NCA magic
|-
| 0x234C02 || 2 || 4518 || Invalid NCA header fixed key signature
|-
| 0x234E02 || 2 || 4519 || Invalid NCA header ACID signature
|-
| 0x235002 || 2 || 4520 || Invalid NCA header section hash
|-
| 0x235202 || 2 || 4521 || Invalid NCA Key index
|-
| 0x235602 || 2 || 4523 || Invalid encryption type
|-
| 0x235802 || 2 || 4524 || Redirection BKTR table size is negative
|-
| 0x235A02 || 2 || 4525 || Encryption BKTR table size is negative
|-
| 0x235C02 || 2 || 4526 || Redirection BKTR table end offset is past the Encryption BKTR table start offset
|-
| 0x235E02 || 2 || 4527 || NCA-path used with the wrong titleID.
|-
| 0x236002 || 2 || 4528 || NCA header value is out of range
|-
| 0x236202 || 2 || 4529 || NCA FS header value is out of range
|-
| 0x236802 || 2 || 4532 || PartitionFS hash block size is not a power of 2
|-
| 0x236A02 || 2 || 4533 || PartitionFS hash "always_2" field is not 2
|-
| 0x236C02 || 2 || 4534 || PartitionFS hash table is too small for main data
|-
| 0x236E02 || 2 || 4535 || Invalid PartitionFS block hash
|-
| 0x244402 || 2 || 4642 || Invalid Partition file hashed region bounds
|-
| 0x244602 || 2 || 4643 || Invalid Partition FS hash
|-
| 0x244802 || 2 || 4644 || Invalid PFS0 magic
|-
| 0x244A02 || 2 || 4645 || Invalid HFS0 magic
|-
| 0x244C02 || 2 || 4646 || Invalid name offset for Partition FS file entry
|-
| 0x244E02 || 2 || 4647 || Calculated Partition FS header size changed between 2 consecutive reads
|-
| 0x249802 || 2 || 4684 || Invalid FAT file number.
|-
| 0x249C02 || 2 || 4686 || Invalid FAT format for BIS User partition.
|-
| 0x249E02 || 2 || 4687 || Invalid FAT format for BIS System partition.
|-
| 0x24A002 || 2 || 4688 || Invalid FAT format for BIS Safe partition.
|-
| 0x24A202 || 2 || 4689 || Invalid FAT format for BIS Calibration partition.
|-
| 0x250E02 || 2 || 4743 || [[NAX0|Corrupted]] NAX0 header.
|-
| 0x251002 || 2 || 4744 || Invalid [[NAX0]] magicnum.
|-
| 0x280202 || 2 || 5121 || Invalid FAT size
|-
| 0x280402 || 2 || 5122 || Invalid FAT BPB (BIOS Parameter Block)
|-
| 0x280602 || 2 || 5123 || Invalid FAT parameter
|-
| 0x280802 || 2 || 5124 || Invalid FAT sector
|-
| 0x280A02 || 2 || 5125 || Invalid FAT sector
|-
| 0x280C02 || 2 || 5126 || Invalid FAT sector
|-
| 0x280E02 || 2 || 5127 || Invalid FAT sector
|-
| 0x296A02 || 2 || 5301 || Mountpoint not found
|-
| 0x2EE202 || 2 || 6001 || Invalid input
|-
| 0x2EE602 || 2 || 6003 || Path too long
|-
| 0x2EE802 || 2 || 6004 || Invalid character.
|-
| 0x2EEA02 || 2 || 6005 || Invalid directory path.
|-
| 0x2EEC02 || 2 || 6006 || Unable to retrieve directory from path
|-
| 0x2F5A02 || 2 || 6061 || Offset outside storage
|-
| 0x313802 || 2 || 6300 || Operation not supported
|-
| 0x313A02 || 2 || 6301 || A specified filesystem has no MultiCommitTarget when doing a multi-filesystem commit
|-
| 0x313C02 || 2 || 6302 || Attempted to resize a nn::fs::SubStorage or BufferedStorage that is marked as non-resizable
|-
| 0x313E02 || 2 || 6303 || Attempted to resize a nn::fs::SubStorage or BufferedStorage when the SubStorage ends before the base storage
|-
| 0x314002 || 2 || 6304 || Attempted to call nn::fs::MemoryStorage::SetSize
|-
| 0x314202 || 2 || 6305 || Invalid Operation ID in nn::fs::MemoryStorage::OperateRange
|-
| 0x314402 || 2 || 6306 || Invalid Operation ID in nn::fs::FileStorage::OperateRange
|-
| 0x314602 || 2 || 6307 || Invalid Operation ID in nn::fs::FileHandleStorage::OperateRange
|-
| 0x314802 || 2 || 6308 || Invalid Operation ID in nn::fssystem::SwitchStorage::OperateRange
|-
| 0x314A02 || 2 || 6309 || Invalid Operation ID in nn::fs::detail::StorageServiceObjectAdapter::OperateRange
|-
| 0x314C02 || 2 || 6310 || Attempted to call nn::fssystem::AesCtrCounterExtendedStorage::Write
|-
| 0x314E02 || 2 || 6311 || Attempted to call nn::fssystem::AesCtrCounterExtendedStorage::SetSize
|-
| 0x315002 || 2 || 6312 || Invalid Operation ID in nn::fssystem::AesCtrCounterExtendedStorage::OperateRange
|-
| 0x315202 || 2 || 6313 || Attempted to call nn::fssystem::AesCtrStorageExternal::Write
|-
| 0x315402 || 2 || 6314 || Attempted to call nn::fssystem::AesCtrStorageExternal::SetSize
|-
| 0x315602 || 2 || 6315 || Attempted to call nn::fssystem::AesCtrStorage::SetSize
|-
| 0x315802 || 2 || 6316 || Attempted to call nn::fssystem::save::HierarchicalIntegrityVerificationStorage::SetSize
|-
| 0x315A02 || 2 || 6317 || Attempted to call nn::fssystem::save::HierarchicalIntegrityVerificationStorage::OperateRange
|-
| 0x315C02 || 2 || 6318 || Attempted to call nn::fssystem::save::IntegrityVerificationStorage::SetSize
|-
| 0x315E02 || 2 || 6319 || Attempted to invalidate the cache of a RomFs IVFC storage in nn::fssystem::save::IntegrityVerificationStorage::OperateRange
|-
| 0x316002 || 2 || 6320 || Invalid Operation ID in nn::fssystem::save::IntegrityVerificationStorage::OperateRange
|-
| 0x316202 || 2 || 6321 || Attempted to call nn::fssystem::save::BlockCacheBufferedStorage::SetSize
|-
| 0x316402 || 2 || 6322 || Attempted to invalidate the cache of something other than a savedata IVFC storage in nn::fssystem::save::BlockCacheBufferedStorage::OperateRange
|-
| 0x316602 || 2 || 6323 || Invalid Operation ID in nn::fssystem::save::BlockCacheBufferedStorage::OperateRange
|-
| 0x316802 || 2 || 6324 || Attempted to call nn::fssystem::IndirectStorage::Write
|-
| 0x316A02 || 2 || 6325 || Attempted to call nn::fssystem::IndirectStorage::SetSize
|-
| 0x316C02 || 2 || 6326 || Invalid Operation ID in nn::fssystem::IndirectStorage::OperateRange
|-
| 0x316E02 || 2 || 6327 || Attempted to call nn::fssystem::SparseStorage::ZeroStorage::Write
|-
| 0x317002 || 2 || 6328 || Attempted to call nn::fssystem::SparseStorage::ZeroStorage::SetSize
|-
| 0x317202 || 2 || 6329 || Attempted to call nn::fssystem::HierarchicalSha256Storage::SetSize
|-
| 0x317402 || 2 || 6330 || Attempted to call nn::fssystem::ReadOnlyBlockCacheStorage::Write
|-
| 0x317602 || 2 || 6331 || Attempted to call nn::fssystem::ReadOnlyBlockCacheStorage::SetSize
|-
| 0x317802 || 2 || 6332 || Attempted to call nn::fssystem::IntegrityRomFsStorage::SetSize
|-
| 0x317A02 || 2 || 6333 || Attempted to call nn::fssystem::save::DuplexStorage::SetSize
|-
| 0x317C02 || 2 || 6334 || Invalid Operation ID in nn::fssystem::save::DuplexStorage::OperateRange
|-
| 0x317E02 || 2 || 6335 || Attempted to call nn::fssystem::save::HierarchicalDuplexStorage::SetSize
|-
| 0x318002 || 2 || 6336 || Attempted to call nn::fssystem::save::RemapStorage::GetSize
|-
| 0x318202 || 2 || 6337 || Attempted to call nn::fssystem::save::RemapStorage::SetSize
|-
| 0x318402 || 2 || 6338 || Invalid Operation ID in nn::fssystem::save::RemapStorage::OperateRange
|-
| 0x318602 || 2 || 6339 || Attempted to call nn::fssystem::save::IntegritySaveDataStorage::SetSize
|-
| 0x318802 || 2 || 6340 || Invalid Operation ID in nn::fssystem::save::IntegritySaveDataStorage::OperateRange
|-
| 0x318A02 || 2 || 6341 || Attempted to call nn::fssystem::save::JournalIntegritySaveDataStorage::SetSize
|-
| 0x318C02 || 2 || 6342 || Invalid Operation ID in nn::fssystem::save::JournalIntegritySaveDataStorage::OperateRange
|-
| 0x318E02 || 2 || 6343 || Attempted to call nn::fssystem::save::JournalStorage::GetSize
|-
| 0x319002 || 2 || 6344 || Attempted to call nn::fssystem::save::JournalStorage::SetSize
|-
| 0x319202 || 2 || 6345 || Invalid Operation ID in nn::fssystem::save::JournalStorage::OperateRange
|-
| 0x319402 || 2 || 6346 || Attempted to call nn::fssystem::save::UnionStorage::SetSize
|-
| 0x319602 || 2 || 6347 || Attempted to call nn::fssystem::dbm::AllocationTableStorage::SetSize
|-
| 0x319802 || 2 || 6348 || Attempted to call nn::fssrv::fscreator::WriteOnlyGameCardStorage::Read
|-
| 0x319A02 || 2 || 6349 || Attempted to call nn::fssrv::fscreator::WriteOnlyGameCardStorage::SetSize
|-
| 0x319C02 || 2 || 6350 || Attempted to call nn::fssrv::fscreator::ReadOnlyGameCardStorage::Write
|-
| 0x319E02 || 2 || 6351 || Attempted to call nn::fssrv::fscreator::ReadOnlyGameCardStorage::SetSize
|-
| 0x31A002 || 2 || 6352 || Invalid Operation ID in nn::fssrv::fscreator::ReadOnlyGameCardStorage::OperateRange
|-
| 0x31A202 || 2 || 6353 || Attempted to call SdStorage::SetSize
|-
| 0x31A402 || 2 || 6354 || Invalid Operation ID in SdStorage::OperateRange
|-
| 0x31A602 || 2 || 6355 || Invalid Operation ID in nn::fat::FatFile::DoOperateRange
|-
| 0x31A802 || 2 || 6356 || Invalid Operation ID in nn::fssystem::StorageFile::DoOperateRange
|-
| 0x31AA02 || 2 || 6357 || Attempted to call nn::fssystem::ConcatenationFile::SetSize
|-
| 0x31AC02 || 2 || 6358 || Attempted to call nn::fssystem::ConcatenationFile::OperateRange
|-
| 0x31AE02 || 2 || 6359 || Invalid Query ID in nn::fssystem::ConcatenationFileSystem::DoQueryEntry
|-
| 0x31B002 || 2 || 6360 || Invalid Operation ID in nn::fssystem::ConcatenationFile::DoOperateRange
|-
| 0x31B202 || 2 || 6361 || Attempted to call nn::fssystem::ZeroBitmapFile::SetSize
|-
| 0x31B402 || 2 || 6362 || Invalid Operation ID in nn::fs::detail::FileServiceObjectAdapter::DoOperateRange
|-
| 0x31B602 || 2 || 6363 || Invalid Operation ID in nn::fssystem::AesXtsFile::DoOperateRange
|-
| 0x31B802 || 2 || 6364 || Attempted to modify a nn::fs::RomFsFileSystem
|-
| 0x31BA02 || 2 || 6365 || Attempted to call nn::fs::RomFsFileSystem::DoCommitProvisionally
|-
| 0x31BC02 || 2 || 6366 || Attempted to query the space in a nn::fs::RomFsFileSystem
|-
| 0x31BE02 || 2 || 6367 || Attempted to modify a nn::fssystem::RomFsFile
|-
| 0x31C002 || 2 || 6368 || Invalid Operation ID in nn::fssystem::RomFsFile::DoOperateRange
|-
| 0x31C202 || 2 || 6369 || Attempted to modify a nn::fs::ReadOnlyFileSystemTemplate
|-
| 0x31C402 || 2 || 6370 || Attempted to call nn::fs::ReadOnlyFileSystemTemplate::DoCommitProvisionally
|-
| 0x31C602 || 2 || 6371 || Attempted to query the space in a nn::fs::ReadOnlyFileSystemTemplate
|-
| 0x31C802 || 2 || 6372 || Attempted to modify a nn::fs::ReadOnlyFileSystemFile
|-
| 0x31CA02 || 2 || 6373 || Invalid Operation ID in nn::fs::ReadOnlyFileSystemFile::DoOperateRange
|-
| 0x31CC02 || 2 || 6374 || Attempted to modify a nn::fssystem::PartitionFileSystemCore
|-
| 0x31CE02 || 2 || 6375 || Attempted to call nn::fssystem::PartitionFileSystemCore::DoCommitProvisionally
|-
| 0x31D002 || 2 || 6376 || Attempted to call nn::fssystem::PartitionFileSystemCore::PartitionFile::DoSetSize
|-
| 0x31D202 || 2 || 6377 || Invalid Operation ID in nn::fssystem::PartitionFileSystemCore::PartitionFile::DoOperateRange
|-
| 0x31D402 || 2 || 6378 || Invalid Operation ID in nn::fssystem::TmFileSystemFile::DoOperateRange
|-
| 0x31D602 || 2 || 6379 || Attempted to call unsupported functions in nn::fssrv::fscreator::SaveDataInternalStorageFileSystem, nn::fssrv::detail::SaveDataInternalStorageAccessor::PaddingFile or nn::fssystem::save::detail::SaveDataExtraDataInternalStorageFile
|-
| 0x31DC02 || 2 || 6382 || Attempted to call nn::fssystem::ApplicationTemporaryFileSystem::DoCommitProvisionally
|-
| 0x31DE02 || 2 || 6383 || Attempted to call nn::fssystem::SaveDataFileSystem::DoCommitProvisionally
|-
| 0x31E002 || 2 || 6384 || Attempted to call nn::fssystem::DirectorySaveDataFileSystem::DoCommitProvisionally
|-
| 0x31E202 || 2 || 6385 || Attempted to call nn::fssystem::ZeroBitmapHashStorageFile::Write
|-
| 0x31E402 || 2 || 6386 || Attempted to call nn::fssystem::ZeroBitmapHashStorageFile::SetSize
|-
| 0x320002 || 2 || 6400 || Permission denied
|-
| 0x326602 || 2 || 6451 || Missing titlekey(?) required to mount content
|-
| 0x326E02 || 2 || 6455 || File not closed
|-
| 0x327002 || 2 || 6456 || Directory not closed
|-
| 0x327202 || 2 || 6457 || Writable file not closed when committing
|-
| 0x327402 || 2 || 6458 || FS allocators already registered
|-
| 0x327602 || 2 || 6459 || FS allocators already used
|-
| 0x327A02 || 2 || 6461 || FS allocator alignment violation
|-
| 0x339402 || 2 || 6602 || File not found.
|-
| 0x339602 || 2 || 6603 || Directory not found.
|-
| 0x346C02 || 2 || 6710 || Multi-commit limit reached
|-
| 0x35F202 || 2 || 6905 || Mount name not found in table.
|-
| 0x3DBC02 || 2 || 7902 || RomFs table: Entry not found in dictionary
|-
| 0x3DBE02 || 2 || 7903 || RomFs table: File not found
|-
| 0x3DC002 || 2 || 7904 || RomFs table: Directory not found
|-
| 0x3DC402 || 2 || 7906 || RomFs table: Entry already exists when trying to add a new entry
|-
| 0x3DC602 || 2 || 7907 || RomFs table: Insufficient space to add new entry
|-
| 0x3DC802 || 2 || 7908 || RomFs table: Unable to add new directory
|-
| 0x3DCA02 || 2 || 7909 || RomFs table: Unable to add new file
|-
| 0x3DCC02 || 2 || 7910 || RomFs directory has no more child directories/files when iterating
|-
| 0x3DD402 || 2 || 7914 || RomFs table: Path is file, not directory
|-
| 0x803 || 3 || 4 || OS busy
|-
| 0xE03 || 3 || 7 || Invalid parameter
|-
| 0x1003 || 3 || 8 || Out of memory
|-
| 0x1203 || 3 || 9 || Out of resources
|-
| 0x3EA03 || 3 || 501 || Invalid handle
|-
| 0x3EE03 || 3 || 503 || Invalid memory mirror
|-
| 0x7FE03 || 3 || 1023 || TLS slot is not allocated
|-
| 0xA05 || 5 || 5 || [[Content_Manager_services|NcaID]] not found. Returned when attempting to mount titles which exist that aren't *8XX titles, the same way *8XX titles are mounted.
|-
| 0xE05 || 5 || 7 || TitleId not found
|-
| 0x1805 || 5 || 12 || Invalid StorageId
|-
| 0xDC05 || 5 || 110 || Gamecard not inserted
|-
| 0x17C05 || 5 || 190 || Gamecard not initialized
|-
| 0x1F405 || 5 || 250 || Sdcard not inserted
|-
| 0x20805 || 5 || 260 || Storage not mounted
|-
| 0x806 || 6 || 4 || Converted from error 0xD401
|-
| 0x1006 || 6 || 8 || Converted from error 0xE401
|-
| 0x408 || 8 || 2 || Program location entry not found
|-
| 0x608 || 8 || 3 || Invalid context for control location
|-
| 0x808 || 8 || 4 || Storage not found
|-
| 0xA08 || 8 || 5 || Access denied
|-
| 0xC08 || 8 || 6 || Offline manual HTML location entry not found
|-
| 0xE08 || 8 || 7 || Title is not registered
|-
| 0x1008 || 8 || 8 || Control location entry for host not found
|-
| 0x1208 || 8 || 9 || Legal info HTML location entry not found
|-
| 0x1408 || 8 || 10 || Program location for debug entry not found
|-
| 0x209 || 9 || 1 || Args too long.
|-
| 0x409 || 9 || 2 || Maximum processes loaded.
|-
| 0x609 || 9 || 3 || NPDM too big.
|-
| 0x809 || 9 || 4 || Invalid NPDM.
|-
| 0xA09 || 9 || 5 || Invalid NSO.
|-
| 0xC09 || 9 || 6 || Invalid Path.
|-
| 0xE09 || 9 || 7 || Already registered.
|-
| 0x1009 || 9 || 8 || Title not found.
|-
| 0x1209 || 9 || 9 || Title-id in ACI0 doesn't match range in ACID.
|-
| 0x1409 || 9 || 10 || Invalid version in NPDM.
|-
| 0x6609 || 9 || 51 || Insufficient address space.
|-
| 0x6809 || 9 || 52 || Insufficient NRO.
|-
| 0x6A09 || 9 || 53 || Invalid NRR
|-
| 0x6C09 || 9 || 54 || Invalid signature
|-
| 0x6E09 || 9 || 55 || Insufficient NRO registrations.
|-
| 0x7009 || 9 || 56 || Insufficient NRR registrations.
|-
| 0x7209 || 9 || 57 || NRO Already loaded.
|-
| 0xA209 || 9 || 81 || Unaligned NRR address
|-
| 0xA409 || 9 || 82 || Bad NRR size
|-
| 0xA809 || 9 || 84 || NRR Not Loaded.
|-
| 0xAA09 || 9 || 85 || Bad NRR address
|-
| 0xAE09 || 9 || 87 || Bad initialization
|-
| 0xC809 || 9 || 100 || Unknown ACI0 descriptor
|-
| 0xCE09 || 9 || 103 || ACID/ACI0 don't match for descriptor "KernelFlags"
|-
| 0xD009 || 9 || 104 || ACID/ACI0 don't match for descriptor "SyscallMask"
|-
| 0xD409 || 9 || 106 || ACID/ACI0 don't match for descriptor "MapIoOrNormalRange"
|-
| 0xD609 || 9 || 107 || ACID/ACI0 don't match for descriptor "MapNormalPage"
|-
| 0xDE09 || 9 || 111 || ACID/ACI0 don't match for descriptor "InterruptPair"
|-
| 0xE209 || 9 || 113 || ACID/ACI0 don't match for descriptor "ApplicationType"
|-
| 0xE409 || 9 || 114 || ACID/ACI0 don't match for descriptor "KernelReleaseVersion"
|-
| 0xE609 || 9 || 115 || ACID/ACI0 don't match for descriptor "HandleTableSize"
|-
| 0xE809 || 9 || 116 || ACID/ACI0 don't match for descriptor "DebugFlags"
|-
| 0x1940A || 10 || 202 || Invalid CMIF header size.
|-
| 0x1A60A || 10 || 211 || Invalid CMIF input header.
|-
| 0x1A80A || 10 || 212 || Invalid CMIF output header.
|-
| 0x1BA0A || 10 || 221 || Invalid method dispatch ID.
|-
| 0x1D60A || 10 || 235 || Invalid in object count.
|-
| 0x1D80A || 10 || 236 || Invalid out object count.
|-
| 0x25A0A || 10 || 301 || Out of domain entries.
|-
| 0x20B || 11 || 1 || Unsupported operation
|-
| 0xCC0B || 11 || 102 || Out of server session memory
|-
| 0x11A0B || 11 || 141 || Went past maximum during marshalling.
|-
| 0x1900B || 11 || 200 || Session doesn't support domains.
|-
| 0x25A0B || 11 || 301 || Remote process is dead.
|-
| 0x3240B || 11 || 402 || Data/buffer length(s) too large for IPC buffer.
|-
| 0x3260B || 11 || 403 || Unknown request type
|-
| 0x3480B || 11 || 420 || Number(s) of buffers/handles/PIDs passed differ from what method expects.
|-
| 0x3D60B || 11 || 491 || IPC Query 1 failed.
|-
| 0x20F || 15 || 1 || Pid not found
|-
| 0x60F || 15 || 3 || Process has no pending events
|-
| 0xA0F || 15 || 5 || Application already running
|-
| 0x410 || 16 || 2 || Title-id not found
|-
| 0xF010 || 16 || 120 || Sysupdate not required
|-
| 0x1F610 || 16 || 251 || Unexpected StorageId
|-
| 0x2A810 || 16 || 340 || [[Network_Interface_services#IsAnyInternetRequestAccepted|IsAnyInternetRequestAccepted]] with the output from [[#Network_Interface_services#GetClientId|GetClientId]] returned false.
|-
| 0x64210 || 16 || 801 || [[NS_Services#SystemDeliveryInfo|SystemDeliveryInfo]] system_delivery_protocol_version is less than the system-setting.
|-
| 0x64410 || 16 || 802 || [[NS_Services#SystemDeliveryInfo|SystemDeliveryInfo]] system_delivery_protocol_version is larger than the system-setting.
|-
| 0x74610 || 16 || 931 || Invalid [[NS_Services#SystemDeliveryInfo|SystemDeliveryInfo]] HMAC / invalid Meta Id.
|-
| 0x6F810 || 16 || 892 || Unknown state ref-count is zero.
|-
| 0x215 || 21 || 1 || Out of processes
|-
| 0x415 || 21 || 2 || Not initialized.
|-
| 0x615 || 21 || 3 || Max sessions
|-
| 0x815 || 21 || 4 || Service already registered
|-
| 0xA15 || 21 || 5 || Out of services
|-
| 0xC15 || 21 || 6 || Invalid name (all zeroes)
|-
| 0xE15 || 21 || 7 || Service not registered
|-
| 0x1015 || 21 || 8 || Permission denied
|-
| 0x1215 || 21 || 9 || Service Access Control too big.
|-
| 0x416 || 22 || 2 || Address space is full
|-
| 0x616 || 22 || 3 || NRO already loaded
|-
| 0x816 || 22 || 4 || Invalid NRO header values
|-
| 0xC16 || 22 || 6 || Bad NRR magic
|-
| 0x1016 || 22 || 8 || Reached max NRR count
|-
| 0x1216 || 22 || 9 || Unable to verify NRO hash or NRR signature
|-
| 0x80216 || 22 || 1025 || Address not page-aligned
|-
| 0x80416 || 22 || 1026 || Incorrect NRO size
|-
| 0x80816 || 22 || 1028 || NRO not loaded
|-
| 0x80A16 || 22 || 1029 || NRR not loaded
|-
| 0x80C16 || 22 || 1030 || Already initialized
|-
| 0x80E16 || 22 || 1031 || Not initialized
|-
| 0x21A || 26 || 1 || SMC is not implemented
|-
| 0x41A || 26 || 2 || SMC argument is invalid
|-
| 0x61A || 26 || 3 || SMC is currently in progress/secmon is busy
|-
| 0x81A || 26 || 4 || Secmon not currently performing async operation
|-
| 0xA1A || 26 || 5 || Invalid SMC async callback key
|-
| 0xC1A || 26 || 6 || SMC is blacklisted during current boot
|-
| 0xC81A || 26 || 100 || Invalid (buffer) size
|-
| 0xCA1A || 26 || 101 || Unknown SMC error
|-
| 0xCA1A || 26 || 101 || Decryption failure
|-
| 0xD01A || 26 || 104 || No AES keyslots available
|-
| 0xD21A || 26 || 105 || Invalid AES keyslot
|-
| 0xD41A || 26 || 106 || BootReason already set
|-
| 0xD61A || 26 || 107 || BootReason not set
|-
| 0xD81A || 26 || 108 || Invalid argument
|-
| 0x35B || 347 || 1 || Failed to init SM.
|-
| 0x55B || 347 || 2 || Failed to init FS.
|-
| 0x75B || 347 || 3 || Failed to open NRO file. May also happen when SD card isn't inserted / SD mounting failed earlier.
|-
| 0x95B || 347 || 4 || Failed to read NRO header.
|-
| 0xB5B || 347 || 5 || Invalid NRO magic.
|-
| 0xD5B || 347 || 6 || Invalid NRO segments.
|-
| 0xF5B || 347 || 7 || Failed to read NRO.
|-
| 0x135B || 347 || 9 || Failed to allocate heap.
|-
| 0x255B || 347 || 18 || Failed to map code-binary memory.
|-
| 0x275B || 347 || 19 || Failed to map code memory (.text).
|-
| 0x295B || 347 || 20 || Failed to map code memory (.rodata).
|-
| 0x2B5B || 347 || 21 || Failed to map code memory (.data+.bss).
|-
| 0x315B || 347 || 24 || Failed to unmap code memory (.text).
|-
| 0x335B || 347 || 25 || Failed to unmap code memory (.rodata).
|-
| 0x355B || 347 || 26 || Failed to unmap code memory (.data+.bss).
|-
| 0x19269 || 105 || 201 || Null settings name
|-
| 0x19469 || 105 || 202 || Null settings key
|-
| 0x19669 || 105 || 203 || Null settings value
|-
| 0x19A69 || 105 || 205 || Null settings value buffer
|-
| 0x1A069 || 105 || 208 || Null setting value size buffer
|-
| 0x1A269 || 105 || 209 || Null debug mode flag buffer
|-
| 0x1BA69 || 105 || 221 || Setting group name has zero length
|-
| 0x1BC69 || 105 || 222 || Empty settings item key
|-
| 0x1E269 || 105 || 241 || Setting group name is too long (64 character limit?)
|-
| 0x1E469 || 105 || 242 || Setting name is too long (64 character limit?)
|-
| 0x20A69 || 105 || 261 || Setting group name ends with '.' or contains invalid characters (allowed: [a-z0-9_\-.])
|-
| 0x20C69 || 105 || 262 || Setting name ends with '.' or contains invalid characters (allowed: [a-z0-9_\-.])
|-
| 0x4DA69 || 105 || 621 || Null language code buffer
|-
| 0x4E269 || 105 || 625 || Language out of valid range
|-
| 0x4EE69 || 105 || 631 || Null network settings buffer
|-
| 0x4F069 || 105 || 632 || Null network settings output count buffer
|-
| 0x50269 || 105 || 641 || Null backlight settings buffer
|-
| 0x51669 || 105 || 651 || Null Bluetooth device setting buffer
|-
| 0x51869 || 105 || 652 || Null Bluetooth device setting output count buffer
|-
| 0x51A69 || 105 || 653 || Null Bluetooth enable flag buffer
|-
| 0x51C69 || 105 || 654 || Null Bluetooth AFH enable flag buffer
|-
| 0x51E69 || 105 || 655 || Null Bluetooth boost enable flag buffer
|-
| 0x52069 || 105 || 656 || Null BLE pairing settings buffer
|-
| 0x52269 || 105 || 657 || Null BLE pairing settings entry count buffer
|-
| 0x52A69 || 105 || 661 || Null external steady clock source ID buffer
|-
| 0x52C69 || 105 || 662 || Null user system clock context buffer
|-
| 0x52E69 || 105 || 663 || Null network system clock context buffer
|-
| 0x53069 || 105 || 664 || Null user system clock automatic correction enabled flag buffer
|-
| 0x53269 || 105 || 665 || Null shutdown RTC value buffer
|-
| 0x53469 || 105 || 666 || Null external steady clock internal offset buffer
|-
| 0x53E69 || 105 || 671 || Null account settings buffer
|-
| 0x55269 || 105 || 681 || Null audio volume buffer
|-
| 0x55669 || 105 || 683 || Null ForceMuteOnHeadphoneRemoved buffer
|-
| 0x55869 || 105 || 684 || Null headphone volume warning count buffer
|-
| 0x55E69 || 105 || 687 || Invalid audio output mode
|-
| 0x56069 || 105 || 688 || Null headphone volume update flag buffer
|-
| 0x56669 || 105 || 691 || Null console information upload flag buffer
|-
| 0x57A69 || 105 || 701 || Null automatic application download flag buffer
|-
| 0x57C69 || 105 || 702 || Null notification settings buffer
|-
| 0x57E69 || 105 || 703 || Null account notification settings entry count buffer
|-
| 0x58069 || 105 || 704 || Null account notification settings buffer
|-
| 0x58E69 || 105 || 711 || Null vibration master volume buffer
|-
| 0x59069 || 105 || 712 || Null NX controller settings buffer
|-
| 0x59269 || 105 || 713 || Null NX controller settings entry count buffer
|-
| 0x59469 || 105 || 714 || Null USB full key enable flag buffer
|-
| 0x5A269 || 105 || 721 || Null TV settings buffer
|-
| 0x5A469 || 105 || 722 || Null EDID buffer
|-
| 0x5B669 || 105 || 731 || Null data deletion settings buffer
|-
| 0x5CA69 || 105 || 741 || Null initial system applet program ID buffer
|-
| 0x5CC69 || 105 || 742 || Null overlay disp program ID buffer
|-
| 0x5CE69 || 105 || 743 || Null IsInRepairProcess buffer
|-
| 0x5D069 || 105 || 744 || Null RequiresRunRepairTimeReviser buffer
|-
| 0x5DE69 || 105 || 751 || Null device timezone location name buffer
|-
| 0x5F269 || 105 || 761 || Null primary album storage buffer
|-
| 0x60669 || 105 || 771 || Null USB 3.0 enable flag buffer
|-
| 0x60869 || 105 || 772 || Null USB Type-C power source circuit version buffer
|-
| 0x61A69 || 105 || 781 || Null battery lot buffer
|-
| 0x62E69 || 105 || 791 || Null serial number buffer
|-
| 0x64269 || 105 || 801 || Null lock screen flag buffer
|-
| 0x64669 || 105 || 803 || Null color set ID buffer
|-
| 0x64869 || 105 || 804 || Null quest flag buffer
|-
| 0x64A69 || 105 || 805 || Null wireless certification file size buffer
|-
| 0x64C69 || 105 || 806 || Null wireless certification file buffer
|-
| 0x64E69 || 105 || 807 || Null initial launch settings buffer
|-
| 0x65069 || 105 || 808 || Null device nickname buffer
|-
| 0x65269 || 105 || 809 || Null battery percentage flag buffer
|-
| 0x65469 || 105 || 810 || Null applet launch flags buffer
|-
| 0x7E869 || 105 || 1012 || Null wireless LAN enable flag buffer
|-
| 0x7FA69 || 105 || 1021 || Null product model buffer
|-
| 0x80E69 || 105 || 1031 || Null NFC enable flag buffer
|-
| 0x82269 || 105 || 1041 || Null ECI device certificate buffer
|-
| 0x82469 || 105 || 1042 || Null E-Ticket device certificate buffer
|-
| 0x83669 || 105 || 1051 || Null sleep settings buffer
|-
| 0x84A69 || 105 || 1061 || Null EULA version buffer
|-
| 0x84C69 || 105 || 1062 || Null EULA version entry count buffer
|-
| 0x85E69 || 105 || 1071 || Null LDN channel buffer
|-
| 0x87269 || 105 || 1081 || Null SSL key buffer
|-
| 0x87469 || 105 || 1082 || Null SSL certificate buffer
|-
| 0x88669 || 105 || 1091 || Null telemetry flags buffer
|-
| 0x89A69 || 105 || 1101 || Null Gamecard key buffer
|-
| 0x89C69 || 105 || 1102 || Null Gamecard certificate buffer
|-
| 0x8AE69 || 105 || 1111 || Null PTM battery lot buffer
|-
| 0x8B069 || 105 || 1112 || Null PTM fuel gauge parameter buffer
|-
| 0x8C269 || 105 || 1121 || Null ECI device key buffer
|-
| 0x8C469 || 105 || 1122 || Null E-Ticket device key buffer
|-
| 0x8D669 || 105 || 1131 || Null speaker parameter buffer
|-
| 0x8EA69 || 105 || 1141 || Null firmware version buffer
|-
| 0x8EC69 || 105 || 1142 || Null firmware version digest buffer
|-
| 0x8EE69 || 105 || 1143 || Null rebootless system update version buffer
|-
| 0x8FE69 || 105 || 1151 || Null Mii author ID buffer
|-
| 0x91269 || 105 || 1161 || Null fatal flags buffer
|-
| 0x92669 || 105 || 1171 || Null auto update enable flag buffer
|-
| 0x93A69 || 105 || 1181 || Null external RTC reset flag buffer
|-
| 0x94E69 || 105 || 1191 || Null push notification activity mode buffer
|-
| 0x96269 || 105 || 1201 || Null service discovery control setting buffer
|-
| 0x97669 || 105 || 1211 || Null error report share permission buffer
|-
| 0x98A69 || 105 || 1221 || Null LCD vendor ID buffer
|-
| 0x99E69 || 105 || 1231 || Null console SixAxis sensor acceleration bias buffer
|-
| 0x9A069 || 105 || 1232 || Null console SixAxis sensor angular velocity bias buffer
|-
| 0x9A269 || 105 || 1233 || Null console SixAxis sensor acceleration gain buffer
|-
| 0x9A469 || 105 || 1234 || Null console SixAxis sensor angular velocity gain buffer
|-
| 0x9A669 || 105 || 1235 || Null console SixAxis sensor angular velocity time bias buffer
|-
| 0x9A869 || 105 || 1236 || Null console SixAxis sensor angular acceleration buffer
|-
| 0x9B269 || 105 || 1241 || Null keyboard layout buffer
|-
| 0x9BA69 || 105 || 1245 || Invalid keyboard layout
|-
| 0x9C669 || 105 || 1251 || Null web inspector flag buffer
|-
| 0x9C869 || 105 || 1252 || Null allowed SSL hosts buffer
|-
| 0x9CA69 || 105 || 1253 || Null allowed SSL hosts entry count buffer
|-
| 0x9CC69 || 105 || 1254 || Null host FS mount point buffer
|-
| 0x9EE69 || 105 || 1271 || Null Amiibo key buffer
|-
| 0x9F069 || 105 || 1272 || Null Amiibo ECQV certificate buffer
|-
| 0x9F269 || 105 || 1273 || Null Amiibo ECDSA certificate buffer
|-
| 0x9F469 || 105 || 1274 || Null Amiibo ECQV BLS key buffer
|-
| 0x9F669 || 105 || 1275 || Null Amiibo ECQV BLS certificate buffer
|-
| 0x9F869 || 105 || 1276 || Null Amiibo ECQV BLS root certificate buffer
|-
| 0x272 || 114 || 1 || Generic error
|-
| 0xC72 || 114 || 6 || Unsupported operation
|-
| 0x74 || 116 || 0 || Time service not initialized
|-
| 0x274 || 116 || 1 || Permission denied
|-
| 0xCC74 || 116 || 102 || Time not set / Clock Source Id mismatch
|-
| 0x19074 || 116 || 200 || Invalid time comparison
|-
| 0x19274 || 116 || 201 || Signed overflow/underflow
|-
| 0x64274 || 116 || 801 || Memory allocation failure
|-
| 0x70A74 || 116 || 901 || Null pointer
|-
| 0x70C74 || 116 || 902 || Value out of valid range
|-
| 0x70E74 || 116 || 903 || TimeZoneRule conversion failed
|-
| 0x7BA74 || 116 || 989 || TimeZone location name not found
|-
| 0x7BC74 || 116 || 990 || Unimplemented functionality
|-
| 0xC79 || 121 || 6 || [[Network_Interface_services#IsAnyInternetRequestAccepted|IsAnyInternetRequestAccepted]] with the output from [[#Network_Interface_services#GetClientId|GetClientId]] returned false.
|-
| 0x27A || 122 || 1 || Invalid argument
|-
| 0x47A || 122 || 2 || Object not found
|-
| 0x67A || 122 || 3 || Object locked/in used
|-
| 0x87A || 122 || 4 || Target already mounted
|-
| 0xA7A || 122 || 5 || Target not mounted
|-
| 0xC7A || 122 || 6 || Object already opened
|-
| 0xE7A || 122 || 7 || Object not opened
|-
| 0x107A || 122 || 8 || [[Network_Interface_services#IsAnyInternetRequestAccepted|IsAnyInternetRequestAccepted]] with the output from [[#Network_Interface_services#GetClientId|GetClientId]] returned false.
|-
| 0xA07A || 122 || 80 || Passphrase not found
|-
| 0xA27A || 122 || 81 || Data verification failed
|-
| 0xB47A || 122 || 90 || Invalid API call
|-
| 0xC47A || 122 || 98 || Invalid operation
|-
| 0x167B || 123 || 11 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SEC errors: -8192 (SEC_ERROR_IO), -8191 (SEC_ERROR_LIBRARY_FAILURE), -8190 (SEC_ERROR_BAD_DATA), -8189 (SEC_ERROR_OUTPUT_LEN), -8188 (SEC_ERROR_INPUT_LEN), -8187 (SEC_ERROR_INVALID_ARGS), -8186 (SEC_ERROR_INVALID_ALGORITHM), -8184 (SEC_ERROR_INVALID_TIME), -8152 (SEC_ERROR_INVALID_KEY).

Also converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSPR/Reference/NSPR_Error_Handling NSPR] errors: -5991 (PR_IO_ERROR), -5962 (PR_BUFFER_OVERFLOW_ERROR), -5950 (PR_FILE_NOT_FOUND_ERROR), -5949 (PR_NOT_DIRECTORY_ERROR), -5946 (PR_FILESYSTEM_MOUNTED_ERROR), -5938 (PR_END_OF_FILE_ERROR).

Also converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL errors: -12223 (SSL_ERROR_GENERATE_RANDOM_FAILURE), -12222 (SSL_ERROR_SIGN_HASHES_FAILURE), -12221 (SSL_ERROR_EXTRACT_PUBLIC_KEY_FAILURE), -12219 (SSL_ERROR_CLIENT_KEY_EXCHANGE_FAILURE), -12218 (SSL_ERROR_ENCRYPTION_FAILURE), -12217 (SSL_ERROR_DECRYPTION_FAILURE), -12216 (SSL_ERROR_SOCKET_WRITE_FAILURE), -12212 (SSL_ERROR_SYM_KEY_CONTEXT_FAILURE), -12209 (SSL_ERROR_IV_PARAM_FAILURE), -12207 (SSL_ERROR_SESSION_KEY_GEN_FAILURE), -12203 (SSL_ERROR_NO_COMPRESSION_OVERLAP), -12202 (SSL_ERROR_HANDSHAKE_NOT_COMPLETED), -12201 (SSL_ERROR_BAD_HANDSHAKE_HASH_VALUE), -12172 (SSL_ERROR_NEXT_PROTOCOL_DATA_INVALID).
|-
| 0x1A7B || 123 || 13 || Unrecognized error.
|-
| 0xCC7B || 123 || 102 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SEC error -8173 (SEC_ERROR_NO_MEMORY).

Also converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSPR/Reference/NSPR_Error_Handling NSPR] errors: -6000 (PR_OUT_OF_MEMORY_ERROR), -5974 (PR_INSUFFICIENT_RESOURCES_ERROR, -5971 (PR_PROC_DESC_TABLE_FULL_ERROR).
|-
| 0xE87B || 123 || 116 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSPR/Reference/NSPR_Error_Handling NSPR] error -5999 (PR_BAD_DESCRIPTOR_ERROR).
|-
| 0x1027B || 123 || 129 || DER CRL decoding failed.
|-
| 0x1987B || 123 || 204 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSPR/Reference/NSPR_Error_Handling NSPR] error -5998 (PR_WOULD_BLOCK_ERROR).
|-
| 0x19A7B || 123 || 205 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSPR/Reference/NSPR_Error_Handling NSPR] error -5990 (PR_IO_TIMEOUT_ERROR).
|-
| 0x19C7B || 123 || 206 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSPR/Reference/NSPR_Error_Handling NSPR] error -5935 (PR_OPERATION_ABORTED_ERROR).
|-
| 0x1A07B || 123 || 208 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSPR/Reference/NSPR_Error_Handling NSPR] error -5978 (PR_NOT_CONNECTED_ERROR).
|-
| 0x1A27B || 123 || 209 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSPR/Reference/NSPR_Error_Handling NSPR] error -5961 (PR_CONNECT_RESET_ERROR).
|-
| 0x1A47B || 123 || 210 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSPR/Reference/NSPR_Error_Handling NSPR] error -5928 (PR_CONNECT_ABORTED_ERROR).
|-
| 0x1A67B || 123 || 211 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSPR/Reference/NSPR_Error_Handling NSPR] error -5929 (PR_SOCKET_SHUTDOWN_ERROR).
|-
| 0x1A87B || 123 || 212 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSPR/Reference/NSPR_Error_Handling NSPR] error -5930 (PR_NETWORK_DOWN_ERROR).
|-
| 0x1AE7B || 123 || 215 || ClientPki/InternalPki was already previously imported/registered.
|-
| 0x1B47B || 123 || 218 || Maximum number of ServerPki objects were already imported.
|-
| 0x25A7B || 123 || 301 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12276 (SSL_ERROR_BAD_CERT_DOMAIN).
|-
| 0x25C7B || 123 || 302 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12285 (SSL_ERROR_NO_CERTIFICATE).
|-
| 0x25E7B || 123 || 303 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SEC errors: -8181 (SEC_ERROR_EXPIRED_CERTIFICATE), -8162 (SEC_ERROR_EXPIRED_ISSUER_CERTIFICATE).
|-
| 0x2607B || 123 || 304 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SEC error -8180 (SEC_ERROR_REVOKED_CERTIFICATE).
|-
| 0x2627B || 123 || 305 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SEC error -8183 (SEC_ERROR_BAD_DER).
|-
| 0x2647B || 123 || 306 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SEC errors: -8102 (SEC_ERROR_INADEQUATE_KEY_USAGE), -8101 (SEC_ERROR_INADEQUATE_CERT_TYPE).
|-
| 0x2667B || 123 || 307 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SEC errors: -8185 (SEC_ERROR_INVALID_AVA), -8182 (SEC_ERROR_BAD_SIGNATURE), -8158 (SEC_ERROR_EXTENSION_VALUE_INVALID), -8156 (SEC_ERROR_CA_CERT_INVALID), -8151 (SEC_ERROR_UNKNOWN_CRITICAL_EXTENSION), -8080 (SEC_ERROR_CERT_NOT_IN_NAME_SPACE).
|-
| 0x2687B || 123 || 308 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SEC errors: -8179 (SEC_ERROR_UNKNOWN_ISSUER), -8172 (SEC_ERROR_UNTRUSTED_ISSUER), -8014 (SEC_ERROR_APPLICATION_CALLBACK_ERROR).
|-
| 0x26A7B || 123 || 309 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SEC error -8171 (SEC_ERROR_UNTRUSTED_CERT).
|-
| 0x26C7B || 123 || 310 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL errors: -12233 (SSL_ERROR_RX_UNKNOWN_RECORD_TYPE), -12232 (SSL_ERROR_RX_UNKNOWN_HANDSHAKE), -12231 (SSL_ERROR_RX_UNKNOWN_ALERT). This is also returned by ImportClientPki when import fails.
|-
| 0x26E7B || 123 || 311 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL errors: -12261 (SSL_ERROR_RX_MALFORMED_HELLO_REQUEST), -12260 (SSL_ERROR_RX_MALFORMED_CLIENT_HELLO), -12259 (SSL_ERROR_RX_MALFORMED_SERVER_HELLO), -12258 (SSL_ERROR_RX_MALFORMED_CERTIFICATE), -12257 (SSL_ERROR_RX_MALFORMED_SERVER_KEY_EXCH), -12256 (SSL_ERROR_RX_MALFORMED_CERT_REQUEST), -12255 (SSL_ERROR_RX_MALFORMED_HELLO_DONE), -12254 (SSL_ERROR_RX_MALFORMED_CERT_VERIFY), -12253 (SSL_ERROR_RX_MALFORMED_CLIENT_KEY_EXCH), -12252 (SSL_ERROR_RX_MALFORMED_FINISHED), -12251 (SSL_ERROR_RX_MALFORMED_CHANGE_CIPHER), -12250 (SSL_ERROR_RX_MALFORMED_ALERT), -12249 (SSL_ERROR_RX_MALFORMED_HANDSHAKE), -12248 (SSL_ERROR_RX_MALFORMED_APPLICATION_DATA), -12166 (SSL_ERROR_RX_MALFORMED_HELLO_VERIFY_REQUEST).
|-
| 0x2707B || 123 || 312 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SEC error -8144 (SEC_ERROR_UNSUPPORTED_KEYALG).

Also converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL errors: -12274 (SSL_ERROR_SSL2_DISABLED), -12247 (SSL_ERROR_RX_UNEXPECTED_HELLO_REQUEST), -12246 (SSL_ERROR_RX_UNEXPECTED_CLIENT_HELLO), -12245 (SSL_ERROR_RX_UNEXPECTED_SERVER_HELLO), -12244 (SSL_ERROR_RX_UNEXPECTED_CERTIFICATE), -12243 (SSL_ERROR_RX_UNEXPECTED_SERVER_KEY_EXCH), -12242 (SSL_ERROR_RX_UNEXPECTED_CERT_REQUEST), -12241 (SSL_ERROR_RX_UNEXPECTED_HELLO_DONE), -12240 (SSL_ERROR_RX_UNEXPECTED_CERT_VERIFY), -12239 (SSL_ERROR_RX_UNEXPECTED_CLIENT_KEY_EXCH), -12238 (SSL_ERROR_RX_UNEXPECTED_FINISHED).
|-
| 0x2727B || 123 || 313 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL errors: -12237 (SSL_ERROR_RX_UNEXPECTED_CHANGE_CIPHER), -12236 (SSL_ERROR_RX_UNEXPECTED_ALERT), -12235 (SSL_ERROR_RX_UNEXPECTED_HANDSHAKE), -12234 (SSL_ERROR_RX_UNEXPECTED_APPLICATION_DATA).
|-
| 0x2747B || 123 || 314 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12263 (SSL_ERROR_RX_RECORD_TOO_LONG).
|-
| 0x2767B || 123 || 315 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12165 (SSL_ERROR_RX_UNEXPECTED_HELLO_VERIFY_REQUEST).
|-
| 0x2787B || 123 || 316 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12163 (SSL_ERROR_RX_UNEXPECTED_CERT_STATUS).
|-
| 0x27A7B || 123 || 317 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12160 (SSL_ERROR_INCORRECT_SIGNATURE_ALGORITHM).
|-
| 0x27C7B || 123 || 318 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL errors: -12173 (SSL_ERROR_WEAK_SERVER_EPHEMERAL_DH_KEY), -12156 (SSL_ERROR_WEAK_SERVER_CERT_KEY).
|-
| 0x27E7B || 123 || 319 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12273 (SSL_ERROR_BAD_MAC_READ).
|-
| 0x2827B || 123 || 321 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL errors: -12215 (SSL_ERROR_MD5_DIGEST_FAILURE), -12214 (SSL_ERROR_SHA_DIGEST_FAILURE), -12161 (SSL_ERROR_DIGEST_FAILURE).
|-
| 0x2847B || 123 || 322 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12213 (SSL_ERROR_MAC_COMPUTATION_FAILURE).
|-
| 0x2887B || 123 || 324 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SEC error -8157 (SEC_ERROR_EXTENSION_NOT_FOUND).
|-
| 0x28A7B || 123 || 325 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SEC error -8049 (SEC_ERROR_UNRECOGNIZED_OID).
|-
| 0x28C7B || 123 || 326 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SEC error -8032 (SEC_ERROR_POLICY_VALIDATION_FAILED).
|-
| 0x2947B || 123 || 330 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12177 (SSL_ERROR_DECOMPRESSION_FAILURE).
|-
| 0xBBA7B || 123 || 1501 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12230 (SSL_ERROR_CLOSE_NOTIFY_ALERT).
|-
| 0xBBC7B || 123 || 1502 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12229 (SSL_ERROR_HANDSHAKE_UNEXPECTED_ALERT).
|-
| 0xBBE7B || 123 || 1503 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12272 (SSL_ERROR_BAD_MAC_ALERT).
|-
| 0xBC07B || 123 || 1504 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12197 (SSL_ERROR_DECRYPTION_FAILED_ALERT).
|-
| 0xBC27B || 123 || 1505 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12196 (SSL_ERROR_RECORD_OVERFLOW_ALERT).
|-
| 0xBC47B || 123 || 1506 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12228 (SSL_ERROR_DECOMPRESSION_FAILURE_ALERT).
|-
| 0xBC67B || 123 || 1507 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12227 (SSL_ERROR_HANDSHAKE_FAILURE_ALERT).
|-
| 0xBCA7B || 123 || 1509 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12271 (SSL_ERROR_BAD_CERT_ALERT).
|-
| 0xBCC7B || 123 || 1510 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12225 (SSL_ERROR_UNSUPPORTED_CERT_ALERT).
|-
| 0xBCE7B || 123 || 1511 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12270 (SSL_ERROR_REVOKED_CERT_ALERT).
|-
| 0xBD07B || 123 || 1512 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12269 (SSL_ERROR_EXPIRED_CERT_ALERT).
|-
| 0xBD27B || 123 || 1513 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12224 (SSL_ERROR_CERTIFICATE_UNKNOWN_ALERT).
|-
| 0xBD47B || 123 || 1514 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12226 (SSL_ERROR_ILLEGAL_PARAMETER_ALERT).
|-
| 0xBD67B || 123 || 1515 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12195 (SSL_ERROR_UNKNOWN_CA_ALERT).
|-
| 0xBD87B || 123 || 1516 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12194 (SSL_ERROR_ACCESS_DENIED_ALERT).
|-
| 0xBDA7B || 123 || 1517 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12193 (SSL_ERROR_DECODE_ERROR_ALERT).
|-
| 0xBDC7B || 123 || 1518 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12192 (SSL_ERROR_DECRYPT_ERROR_ALERT).
|-
| 0xBDE7B || 123 || 1519 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12191 (SSL_ERROR_EXPORT_RESTRICTION_ALERT).
|-
| 0xBE07B || 123 || 1520 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12190 (SSL_ERROR_PROTOCOL_VERSION_ALERT).
|-
| 0xBE27B || 123 || 1521 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12189 (SSL_ERROR_INSUFFICIENT_SECURITY_ALERT).
|-
| 0xBE47B || 123 || 1522 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12188 (SSL_ERROR_INTERNAL_ERROR_ALERT).
|-
| 0xBE67B || 123 || 1523 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12157 (SSL_ERROR_INAPPROPRIATE_FALLBACK_ALERT).
|-
| 0xBE87B || 123 || 1524 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12187 (SSL_ERROR_USER_CANCELED_ALERT).
|-
| 0xBEA7B || 123 || 1525 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12186 (SSL_ERROR_NO_RENEGOTIATION_ALERT).
|-
| 0xBEC7B || 123 || 1526 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12184 (SSL_ERROR_UNSUPPORTED_EXTENSION_ALERT).
|-
| 0xBEE7B || 123 || 1527 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12183 (SSL_ERROR_CERTIFICATE_UNOBTAINABLE_ALERT).
|-
| 0xBF07B || 123 || 1528 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12182 (SSL_ERROR_UNRECOGNIZED_NAME_ALERT).
|-
| 0xBF27B || 123 || 1529 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12181 (SSL_ERROR_BAD_CERT_STATUS_RESPONSE_ALERT).
|-
| 0xBF47B || 123 || 1530 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12180 (SSL_ERROR_BAD_CERT_HASH_VALUE_ALERT).
|-
| 0x27127B || 123 || 5001 || Converted from [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/SSL_functions/sslerr.html NSS] SSL error -12155 (SSL_ERROR_RX_SHORT_DTLS_READ).
|-
| 0x271E7B || 123 || 5007 || Out-of-bounds error during error conversion.
|-
| 0x287C || 124 || 20 || Argument is NULL
|-
| 0x2C7C || 124 || 22 || Argument is invalid
|-
| 0x3C7C || 124 || 30 || Bad input buffer size
|-
| 0x407C || 124 || 32 || Invalid input buffer
|-
| 0x767C || 124 || 59 || [[Network_Interface_services#IsAnyInternetRequestAccepted|IsAnyInternetRequestAccepted]] with the output from [[#Network_Interface_services#GetClientId|GetClientId]] returned false.
|-
| || 124 || 3000 || [https://en-americas-support.nintendo.com/app/answers/detail/a_id/27166/ System Update Required]
|-
| || 124 || 3001 || [https://en-americas-support.nintendo.com/app/answers/detail/a_id/28969/ Game Update Required]
|-
| || 124 || 4007 || [https://en-americas-support.nintendo.com/app/answers/detail/a_id/28046/ Account Permanent Ban]
|-
| || 124 || 4508 || [https://en-americas-support.nintendo.com/app/answers/detail/a_id/28046/ Account Permanent Ban]
|-
| || 124 || 4517 || [https://en-americas-support.nintendo.com/app/answers/detail/a_id/43652/ Account Ban]
|-
| || 124 || 4609 || [https://en-americas-support.nintendo.com/app/answers/detail/a_id/46482/ Service Discontinued]
|-
| 0x27E || 126 || 1 || Invalid argument
|-
| 0x87E || 126 || 4 || Entry not found
|-
| 0xCE7E || 126 || 67 || Invalid database signature value (should be "NFDB")
|-
| 0xD27E || 126 || 69 || Invalid database entry count
|-
| 0x1987E || 126 || 204 || Development/debug-only behavior
|-
| 0x480 || 128 || 2 || IStorage not available.
|-
| 0x680 || 128 || 3 || No messages
|-
| 0x4680 || 128 || 35 || Error while launching applet.
|-
| 0x4A80 || 128 || 37 || Title-ID not found. Caused by code 0x410 when applet launch fails
|-
| 0x3E880 || 128 || 500 || Invalid input
|-
| 0x3EC80 || 128 || 502 || IStorage has already been opened by another accessor
|-
| 0x3EE80 || 128 || 503 || IStorage Read/Write out-of-bounds
|-
| 0x3F480 || 128 || 506 || Invalid parameters
|-
| 0x3FE80 || 128 || 511 || IStorage opened as wrong type (data opened as transfermem, transfermem opened as data)
|-
| 0x40080 || 128 || 512 || Unbalanced fatal section leave (returned when executing LeaveFatalSection without a preceding EnterFatalSection call)
|-
| 0x40C80 || 128 || 518 || Null object
|-
| 0x4B080 || 128 || 600 || Failed to allocate memory for IStorage
|-
| 0x59080 || 128 || 712 || Thread stack pool exhausted (out of memory)
|-
| 0x79C80 || 128 || 974 || DebugMode not enabled
|-
| 0x7A880 || 128 || 980 || <code>am.debug!dev_function</code> setting needs to be set / DebugMode not enabled
|-
| 0x7CC80 || 128 || 998 || Not implemented
|-
| 0xCC81 || 129 || 102 || Transmission not agreed
|-
| 0xD281 || 129 || 105 || Network unavailable
|-
| 0x7DA81 || 129 || 1005 || HTTP error: Couldnt resolve proxy
|-
| 0x7DC81 || 129 || 1006 || HTTP error: Couldnt resolve host
|-
| 0x7DE81 || 129 || 1007 || HTTP error: Couldnt connect
|-
| 0x7FE81 || 129 || 1023 || HTTP error: Write error
|-
| 0x80481 || 129 || 1026 || HTTP error: Read error
|-
| 0x80681 || 129 || 1027 || HTTP error: Out of memory
|-
| 0x80881 || 129 || 1028 || HTTP error: Operation timedout
|-
| 0x81681 || 129 || 1035 || HTTP error: SSL connect error
|-
| 0x83681 || 129 || 1051 || HTTP error: Peer failed verification
|-
| 0x83881 || 129 || 1052 || HTTP error: Got nothing
|-
| 0x83E81 || 129 || 1055 || HTTP error: Send error
|-
| 0x84081 || 129 || 1056 || HTTP error: Recv error
|-
| 0x84481 || 129 || 1058 || HTTP error: SSL cert problem
|-
| 0x84681 || 129 || 1059 || HTTP error: SSL cipher
|-
| 0x84881 || 129 || 1060 || HTTP error: SSL CA cert
|-
| 0x12C081 || 129 || 2400 || Server error: Status 400
|-
| 0x12C281 || 129 || 2401 || Server error: Status 401
|-
| 0x12C681 || 129 || 2403 || Server error: Status 403
|-
| 0x138881 || 129 || 2500 || Server error: Status 500
|-
| 0x138E81 || 129 || 2503 || Server error: Status 503
|-
| 0x139081 || 129 || 2504 || Server error: Status 504
|-
| 0xA83 || 131 || 5 || Unrecognized applet ID
|-
| 0x485 || 133 || 2 || Invalid DVFS table ID
|-
| 0x685 || 133 || 3 || DVFS table ID for debug only, see [[PCV_services#Module|DVFS Table]] notes.
|-
| 0x885 || 133 || 4 || Invalid parameter
|-
| 0x1489 || 137 || 10 || Already initialized.
|-
| 0x3C89 || 137 || 30 || Task not found.
|-
| 0x5089 || 137 || 40 || Memory allocation failed / bad input.
|-
| 0x29489 || 137 || 330 || [[NCM_services#ContentMetaType|ContentMetaType]] doesn't match SystemUpdate.
|-
| 0x271289 || 137 || 5001 || One of the following socket errors occurred: ENETDOWN, ECONNRESET, EHOSTDOWN, EHOSTUNREACH, or EPIPE. Also occurs when the received size doesn't match the expected size (recvfrom() ret with [[NIM_services#Contents_Delivery|meta_size]] data receiving).
|-
| 0x272489 || 137 || 5010 || Socket was [[Sockets_services|shutdown()]] due to the async operation being cancelled.
|-
| 0x273889 || 137 || 5020 || Too many internal output entries with [[NIM_services|nim]] cmd42, system is [[NIM_services#Contents_Delivery|Internet-connected]], or an unrecognized socket error occured.
|-
| 0x27D889 || 137 || 5100 || Connection timeout.
|-
| 0x2A4489 || 137 || 5410 || Invalid [[NIM_services#Contents_Delivery|ID]].
|-
| 0x2A5889 || 137 || 5420 || Invalid [[NIM_services#Contents_Delivery|magicnum]]. Can also be caused by the connection being closed by the peer, since non-negative return values from recv() are ignored in this case.
|-
| 0x2A6C89 || 137 || 5430 || Invalid [[NIM_services#Contents_Delivery|data_size]].
|-
| 0x2A8089 || 137 || 5440 || The input [[NCM_services#ContentMetaKey|ContentMetaKey]] doesn't match the ContentMetaKey in state.
|-
| 0x2A9489 || 137 || 5450 || Invalid [[NIM_services#Contents_Delivery|meta_size]].
|-
| 0x36B289 || 137 || 7001 || HTTP invalid response code (>=600).
|-
| 0x36B489 || 137 || 7002 || HTTP invalid client response code (4xx).
|-
| 0x36B689 || 137 || 7003 || HTTP invalid server response code (5xx).
|-
| 0x36B889 || 137 || 7004 || HTTP invalid redirect response code (3xx).
|-
| 0x390889-0x391889 || 137 || 7300-7308 || HTTP response code 300-308.
|-
| 0x39D089-0x39F289 || 137 || 7400-7417 || HTTP response code 400-417.
|-
| 0x3A9889-0x3AAA89 || 137 || 7500-7509 || HTTP response code 500-509.
|-
| 0x3CF089 || 137 || 7800 || Unknown/invalid libcurl error.
|-
| 0x3E8289-0x3F4089 || 137 || 8001-8096 || libcurl error 1-96. Some of the libcurl errors in the error-table map to the above unknown-libcurl-error however.
|-
| 0x68A || 138 || 3 || Not initialized.
|-
| 0x668C || 140 || 51 || USB data-transfer in progress
|-
| 0xD48C || 140 || 106 || Invalid descriptor
|-
| 0x1928C || 140 || 201 || USB device not bound / interface already enabled
|-
| 0x1BE8E || 142 || 223 || [[Network_Interface_services#IsAnyInternetRequestAccepted|IsAnyInternetRequestAccepted]] with the output from [[#Network_Interface_services#GetClientId|GetClientId]] returned false.
|-
| 0x290 || 144 || 1 || Exited Abnormally ([[Applet_Manager_services#LibraryAppletExitReason|ExitReason]] == Abormal)
|-
| 0x690 || 144 || 3 || Canceled ([[Applet_Manager_services#LibraryAppletExitReason|ExitReason]] == Canceled)
|-
| 0x890 || 144 || 4 || Rejected
|-
| 0xA90 || 144 || 5 || Exited Unexpectedly ([[Applet_Manager_services#LibraryAppletExitReason|ExitReason]] == Unexpected)
|-
| 0x299 || 153 || 1 || Invalid audio device
|-
| 0x499 || 153 || 2 || Operation couldn't complete successfully
|-
| 0x699 || 153 || 3 || Invalid sample rate
|-
| 0x899 || 153 || 4 || Buffer size too small
|-
| 0x1099 || 153 || 8 || Too many buffers are still unreleased
|-
| 0x1499 || 153 || 10 || Invalid channel count
|-
| 0x40299 || 153 || 513 || Invalid/Unsupported operation
|-
| 0xC0099 || 153 || 1536 || Invalid handle
|-
| 0xC0899 || 153 || 1540 || Audio output was already started
|-
| 0x3C9D || 157 || 30 || Address is NULL
|-
| 0x3E9D || 157 || 31 || PID is NULL
|-
| 0x549D || 157 || 42 || Already bound
|-
| 0xCC9D || 157 || 102 || Invalid PID
|-
| 0x49E || 158 || 2 || BootImagePackage not found
|-
| 0x69E || 158 || 3 || Invalid BootImagePackage
|-
| 0x89E || 158 || 4 || Work buffer too small
|-
| 0xA9E || 158 || 5 || Work buffer not aligned
|-
| 0xC9E || 158 || 6 || BootImages need repair
|-
| 0x29F || 159 || 1 || Cancel was selected
|-
| 0xAA3 || 163 || 5 || System is booting up repair process without VOL+ held down.
|-
| 0xCA3 || 163 || 6 || System is booting up repair process that requires RepairTimeReviser but does not have special cartridge inserted.
|-
| 0x70A4 || 164 || 56 || [[Network_Interface_services#IsAnyInternetRequestAccepted|IsAnyInternetRequestAccepted]] with the output from [[#Network_Interface_services#GetClientId|GetClientId]] returned false.
|-
| 0x4AF || 175 || 2 || Bad version returned from calling the "nnjitpluginGetVersion" symbol.
|-
| 0xCAAF || 175 || 101 || Input NRO/NRR are too large for the storage buffer.
|-
| 0x4B0AF || 175 || 600 || Symbol funcptr used by this cmd is not initialized (Control/GenerateCode).
|-
| 0x4B2AF || 175 || 601 || DllPlugin Not initialized, or plugin NRO has already been loaded.
|-
| 0x4B4AF || 175 || 602 || An error was returned from calling the symbol funcptr with the Control cmd.
|-
| 0xC8B2 || 178 || 100 || Invalid user ID
|-
| 0xCAB2 || 178 || 101 || User does not exist
|-
| 0x12CB2 || 178 || 150 || Service unavailable
|-
| 0x190B2 || 178 || 200 || File storage failure
|-
| 0xAB4 || 180 || 5 || Invalid event ID
|-
| 0x1F4EB5 || 181 || 4007 || Device authentication error: System update required
|-
| 0x1F50B5 || 181 || 4008 || Device authentication error: [https://en-americas-support.nintendo.com/app/answers/detail/a_id/42061/ Permanant Ban]
|-
| 0x1F52B5 || 181 || 4009 || Device authentication error: Internal server error
|-
| 0x1F54B5 || 181 || 4007 || Device authentication error: Under maintenance
|-
| || 181 || 4017 || Device authentication error: [https://en-americas-support.nintendo.com/app/answers/detail/a_id/43653/ Ban]
|-
| 0x58ACA || 202 || 709 || Npad ID is out of range.
|-
| 0x2032CA || 202 || 4121 || [[Settings_services#ButtonConfigSettings|ButtonConfigSettings]] IsFull flag is clear.
|-
| 0x28CB || 203 || 20 || The [6.0.0+] Authentication challenge failed.
|-
| 0x40CB || 203 || 32 || Bad State / bad state ptr.
|-
| 0x82CB || 203 || 65 || Failed to connect to the AccessPoint.
|-
| 0x84CB || 203 || 66 || Timeout occured during Authentication / while attempting to find a valid ActionFrame.
|-
| 0x86CB || 203 || 67 || Maximum participants reached, Station not allowed to connect, ...
|-
| 0xC0CB || 203 || 96 || Bad input, or not initialized.
|-
| 0xC2CB || 203 || 97 || Matching LocalCommunicationId not found in the user-process [[NACP_Format|control.nacp]].
|-
| 0xE2CB || 203 || 113 || The specified LocalCommunicationVersion is less than the AccessPoint LocalCommunicationVersion.
|-
| 0xE4CB || 203 || 114 || The specified LocalCommunicationVersion is larger than the AccessPoint LocalCommunicationVersion.
|-
| 0xF0CD || 205 || 120 || IR image data not available/ready.
|-
| 0x1A8CD || 205 || 212 || IR camera handle pointer is null.
|-
| 0x198CD || 205 || 204 || IR camera invalid handle value.
|-
| 0x4CE || 206 || 2 || Invalid argument.
|-
| 0x6CE || 206 || 3 || Out of memory.
|-
| 0x10CE || 206 || 8 || Out of range. Buffer needs to be aligned.
|-
| 0x18CE || 206 || 12 || Invalid FileId.
|-
| 0x1ACE || 206 || 13 || Invalid storage ID.
|-
| 0x1CCE || 206 || 14 || Invalid content type.
|-
| 0x2ACE || 206 || 21 || Failed to mount Image Directory.
|-
| 0x2CCE || 206 || 23 || File too big.
|-
| 0x30CE || 206 || 24 || Invalid file size.
|-
| 0x3CCE || 206 || 30 || Buffer insufficient.
|-
| 0xAF2CE || 206 || 1401 || Too many files already saved.
|-
| 0x4DA || 218 || 2 || StatusManager entry IsValid flag not set, or controller-update currently in-progress.
|-
| 0x6DA || 218 || 3 || Controller-update failed via the LibraryApplet.
|-
| 0x8DA || 218 || 4 || Invalid BusHandle.
|-
| 0xADA || 218 || 5 || StatusManager entry flag +0x0 not set, or device not connected.
|-
| 0xEDA || 218 || 7 || PollingReceivedData not available.
|-
| 0x10DA || 218 || 8 || StatusManager entry DeviceEnabled flag not set, or flag +0x0 not set.
|-
| 0x12DA || 218 || 9 || ExternalDeviceId mismatch.
|-
| 0x14DA || 218 || 10 || BusHandle already initialized.
|-
| 0x104E7 || 231 || 130 || Nullptr passed to the LocalCommunicationId [[NACP_Format|control.nacp]] validation func.
|-
| 0x146E7 || 231 || 163 || Invalid ServiceName.
|-
| 0x1C2E7 || 231 || 225 || Matching LocalCommunicationId not found in the user-process [[NACP_Format|control.nacp]].
|}

=== FS Error codes ===
The following are the error codes recognized by nn::fs::detail::LogErrorMessage found in some [[Factory Setup|factory]] titles:

{| class=wikitable
! Value || Description || Message
|-
| 0xD401 || 106 || nn::svc::ResultInvalidCurrentMemory: Error: Passed buffer is not usable for fs library. See a manual of fs library for more information.
|-
| 0x7802 || 60 || nn::fs::ResultMountNameAlreadyExists: Error: Specified mount name already exists.
|-
| 0x7D202 || 1001 || nn::fs::ResultPartitionNotFound: Error: Specified partition is not found.
|-
| 0x7D402 || 1002 || nn::fs::ResultTargetNotFound: Error: Specified target is not found.
|-
| 0xFA002 - 0x138602 || 2000 - 2499 || nn::fs::ResultSdCardAccessFailed: Error: Failed to access SD card.
|-
| 0x136802 - 0x176E02 || 2500 - 2999 || nn::fs::ResultGameCardAccessFailed: Error: Failed to access game card.
|-
| 0x177202 || 3001 || nn::fs::ResultNotImplemented: Error: Specified operation is not implemented.
|-
| 0x177A02 || 3005 || nn::fs::ResultOutOfRange: Error: Specified value is out of range.
|-
| 0x190002 - 0x1B5602 || 3200 - 3499 || nn::fs::ResultAllocationMemoryFailed: Error: Failed to allocate memory.
|-
| 0x1B5802 - 0x1F3E02 || 3500 - 3999 || nn::fs::ResultMmcAccessFailed: Error: Failed to access MMC.
|-
| 0x1F4202 - 0x219602 || 4001 - 4299 || nn::fs::ResultRomCorrupted: Error: ROM is corrupted.
|-
| 0x219A02 - 0x232602 || 4301 - 4499 || nn::fs::ResultSaveDataCorrupted: Error: Save data is corrupted.
|-
| 0x232A02 - 0x23EE02 || 4501 - 4599 || nn::fs::ResultNcaCorrupted: Error: NCA is corrupted.
|-
| 0x23F202 - 0x243E02 || 4601 - 4639 || nn::fs::ResultIntegrityVerificationStorageCorrupted: Error: Integrity verification failed.
|-
| 0x244202 - 0x246602 || 4641 - 4659 || nn::fs::ResultPartitionFileSystemCorrupted: Error: Partition FS is corrupted.
|-
| 0x246A02 - 0x248E02 || 4661 - 4679 || nn::fs::ResultBuiltInStorageCorrupted: Error: Built-in-storage is corrupted.
|-
| 0x249202 - 0x24B602 || 4681 - 4699 || nn::fs::ResultFatFileSystemCorrupted: Error: FAT FS is corrupted.
|-
| 0x24BA02 - 0x24DE02 || 4701 - 4719 || nn::fs::ResultHostFileSystemCorrupted: Error: HOST FS is corrupted.
|-
| 0x1F4002 - 0x270E02 || 4000, 4300, 4500, 4600, 4640, 4660, 4680, 4700, 4720-4999 || nn::fs::ResultDataCorrupted: Error: Data is corrupted.
|-
| 0x271002 - 0x2EDE02 || 5000-5999 || nn::fs::ResultUnexpected: Error: Unexpected failure occurred.
|-
| 0x2EE002 - 0x32C602 || 6000-6499 || nn::fs::ResultPreconditionViolation: Error: Precondition violation.
|-
| 0x2EE202 - 0x306E02 || 6001-6199 || nn::fs::ResultInvalidArgument: Error: Invalid argument was specified.
|-
| 0x2EE402 - 0x2F1A02 || 6002-6029 || nn::fs::ResultInvalidPath: Error: Invalid path was specified.
|-
| 0x2EE602 || 6003 || nn::fs::ResultTooLongPath: Error: Too long path was specified.
|-
| 0x2EE802 || 6004 || nn::fs::ResultInvalidCharacter: Error: Invalid path character was specified.
|-
| 0x2EEA02 || 6005 || nn::fs::ResultInvalidPathFormat: Error: Invalid path format was specified.
|-
| 0x2F5A02 || 6061 || nn::fs::ResultInvalidOffset: Error: Invalid offset was specified.
|-
| 0x2F5C02 || 6062 || nn::fs::ResultInvalidSize: Error: Invalid size was specified.
|-
| 0x2F5E02 || 6063 || nn::fs::ResultNullptrArgument: Error: Null pointer argument was specified.
|-
| 0x2F6202 || 6065 || nn::fs::ResultInvalidMountName: Error: Invalid mount name was specified.
|-
| 0x2F6402 || 6066 || nn::fs::ResultExtensionSizeTooLarge: Error: Extension size exceeds max value set in nmeta file.
|-
| 0x2F6602 || 6067 || nn::fs::ResultExtensionSizeInvalid: Error: Extension size is not a multiple of nn::fs::SaveDataExtensionUnitSize.
|-
| 0x307202 || 6201 || nn::fs::ResultFileExtensionWithoutOpenModeAllowAppend: Error: OpenMode_AllowAppend is required for implicit extension of file size by WriteFile().
|-
| 0x307002 - 0x313602 || 6200, 6202 - 6299 || nn::fs::ResultInvalidOperationForOpenMode: Error: Invalid operation for the open mode.
|-
| 0x313802 - 0x31FE02 || 6300-6399 || nn::fs::ResultUnsupportedOperation: Error: Unsupported operation.
|-
| 0x320002 - 0x326202 || 6400-6449 || nn::fs::ResultPermissionDenied: Error: Permission denied.
|-
| 0x327202 || 6457 || nn::fs::ResultWriteModeFileNotClosed: Error: Close files opened in write mode before committing.
|-
| 0x328202 || 6465 || nn::fs::ResultUserNotExist: Error: Specified user doesn't exist.
|-
| 0x346402 || 6706 || nn::fs::ResultMappingTableFull: Error: Enough journal space is not left.
|-
| 0x346A02 || 6709 || nn::fs::ResultOpenCountLimit: Error: The open count of files and directories reached the limitation.
|-
| 0x353602 || 6811 || nn::fs::ResultMapFull: Error: Save data extension count reached the limitation.
|-
| 0x35F202 || 6905 || nn::fs::ResultNotMounted: Error: Specified mount name is not found.
|}

= Fatal Errors =
{| class=wikitable
! Error || Description
|-
| 2162-0002
| Can be triggered by running [[SVC|svcBreak]]. The svcBreak params have no effect on the value of the thrown error-code.
|-
| 2168-0000
| Userland ARM undefined instruction exception
|-
| 2168-0001
| Userland ARM prefetch-abort due to PC set to non-executable region
|-
| 2168-0002
| Userland ARM data abort. Also caused by abnormal process termination via [[SVC|svcExitProcess]]. Note: directly jumping to nnMain()-retaddr from non-main-thread has the same result.
|-
| 2168-0003
| Userland PC address not aligned to 4 bytes
|-
| 2168-0008
| Can occur when attempting to call an svc outside the whitelist
|}

= Support Errors =
This section is for Support Errors displayed by the error-applet, separate from the normal Result Errors.

== Modules ==
{| class=wikitable
! Value || Name
|-
| 520 || Nverpt
|-
| 800 || [[Internet_Browser|General web-applet]]
|-
| 809 || [[Internet_Browser|WifiWebAuthApplet]]
|-
| 810 || [[Internet_Browser|Whitelisted-applet]]
|-
| 811 || [[Internet_Browser|ShopN]]
|}

8XX is for/includes system applets.

== Error codes ==
{| class=wikitable
! Value || Module || Description || Notes
|-
|
| {web-applets listed above}
| 2750
| MP4 parsing failed.
|}

Normal error-codes displayed by the system also use the same format as fatal-errors.

= Homebrew Errors =
Custom errors used by homebrew libraries and applications.

== Modules ==
{| class=wikitable
! Value || Name
|-
| 345 || libnx
|-
| 346 || [[Homebrew ABI]]
|-
| 347 || Homebrew Loader
|-
| 348 || libnx NVIDIA errors
|-
| 349 || libnx Binder errors
|}