Nintendo Switch Brew - User contributions [en]

NPDM

2018-06-02T18:38:08Z

FrasierCrane: Got most of the file access information. Needs real world testing and better formatting, the amount of variable width fields make things funky. This feature also seems to be unused by any title so far.

This is the Switch equivalent of 3DS [https://www.3dbrew.org/wiki/NCCH/Extended_Header exheader]. This is the file with extension ".npdm" in {Switch ExeFS}. The size of this file varies.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x80
| META
|-
| 0x80
| <Varies>
| ACID
|-
| <See META>
| <See META>
| ACI0
|}

= META =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Magic "META".
|-
| 0x4
| 0x8
| Reserved (Padding / Unused)
|-
| 0xC
| 0x1
| MmuFlags, bit0: 64-bit instructions, bits1-3: address space width (1=64-bit, 2=32-bit). Needs to be <= 0xF
|-
| 0xE
| 0x1
| Main thread priority (0-63)
|-
| 0xF
| 0x1
| DefaultCpuId
|-
| 0x10
| 0x4
| Reserved
|-
| 0x14
| 0x4
| System resource size (max size as of 5.x: 534773760). Unknown usage.
|-
| 0x18
| 0x4
| ProcessCategory (0: regular title, 1: kernel built-in). Should be 0 here.
|-
| 0x1C
| 0x4
| Main entrypoint stack size (Should(?) be page-aligned. In non-nspwn scenarios, values of 0 can also rarely break in Horizon. This might be something auto-adapting or a security feature of some sort?)
|-
| 0x20
| 0x10
| Title name
|-
| 0x30
| 0x10
| Product code
|-
| 0x70
| 0x4
| [[#ACI0]] offset
|-
| 0x74
| 0x4
| [[#ACI0]] size
|-
| 0x78
| 0x4
| [[#ACID]] offset
|-
| 0x7C
| 0x4
| [[#ACID]] size
|}

= ACID =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x100
| RSA-2048 signature, seems to verify the data starting at 0x100 with the size field from 0x204.
|-
| 0x100
| 0x100
| RSA-2048 public key, seems to be used for the second [[NCA_Format|NCA]] signature.
|-
| 0x200
| 0x4
| Magic "ACID".
|-
| 0x204
| 0x4
| s32 Size field used with the above signature(?).
|-
| 0x208
| 0x4
| Zeroes
|-
| 0x20C
| 0x4
| Flags. Bit0 must be 1 on retail, on devunit 0 is also allowed. Bit1 is unknown, set to 1 for ARMS? [5.0.0+] Bit3-2: PoolPartition? For applets set to 0b01, for sysmodules set to 0b10. Exceptions: "starter" is set to 0, "nvservices" is set to 3.
|-
| 0x210
| 0x8
| TitleIdRange_Min
|-
| 0x218
| 0x8
| TitleIdRange_Max
|-
| 0x220
| 0x4
| [[#FS Access Control]] offset
|-
| 0x224
| 0x4
| [[#FS Access Control]] size
|-
| 0x228
| 0x4
| [[#Service Access Control]] offset
|-
| 0x22C
| 0x4
| [[#Service Access Control]] size
|-
| 0x230
| 0x4
| [[#Kernel Access Control]] offset
|-
| 0x234
| 0x4
| [[#Kernel Access Control]] size
|-
| 0x238
| 0x8
| Padding
|}

= ACI0 =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Magic "ACI0".
|-
| 0x4
| 0xC
| Zeroes
|-
| 0x10
| 0x8
| Title id
|-
| 0x18
| 0x8
| Reserved (Not currently used, potentially to be used for lowest title ID in future.)
|-
| 0x20
| 0x4
| [[#FS Access Header]] offset
|-
| 0x24
| 0x4
| [[#FS Access Header]] size
|-
| 0x28
| 0x4
| [[#Service Access Control]] offset
|-
| 0x2C
| 0x4
| [[#Service Access Control]] size
|-
| 0x30
| 0x4
| [[#Kernel Access Control]] offset
|-
| 0x34
| 0x4
| [[#Kernel Access Control]] size
|-
| 0x38
| 0x8
| Padding
|}

= FS Access Header =

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| Version? Always 1. Must be non-zero.
|-
| 0x1
| 0x3
| Padding
|-
| 0x4
| 0x8
| Permissions bitmask
|-
| 0xC
| 0x4
| Data Size (Always 0x1C)
|-
| 0x10
| 0x4
| Size of Content Owner ID section.
|-
| 0x14
| 0x4
| Data size (0x1C) plus Content Owner size
|-
| 0x18
| 0x4
| Size of Save Data owners section (for applications that wish to share save data?)
|-
| 0x1C
| 0x4
| (OPTIONAL) Amount of content owner id's
|-
| 0x1C
| 0x8 * Content Owner ID's
| Content owner ID's as uint64's.
|-
| VARIABLE
| 0x4
| Amount of save owner id's
|-
| VARIABLE
| 0x1 * Save data owner accessibilities (?)
| Sets flags for what save data owners can do with other applications save data (?)
|-
| VARIABLE (Pad to nearest 4 bytes)
| 0x8 * Amount of save owner ID's
| Save data owner ID's
|}

= FS Access Control =

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| Version? Always 1. Must be non-zero.
|-
| 0x1
| 0x3
| Padding
|-
| 0x4
| 0x8
| Permissions bitmask
|-
| 0xC
| 0x20
| Usually all zeroes for applications
|}

[[Filesystem_services#Permissions|Permissions]] bitmask:
{| class="wikitable" border="1"
|-
! Bit
! Description
|-
| 0
| MountContent* is accessible when set.
|-
| 34
| Enables access to [[Filesystem_services|Bis]] partitionID 27 and 28?
|-
| 63
| Enables access to everything: all [[Filesystem_services#Permissions|permission-types]] which check a bitmask have this bit set.
|}

For bit62 in permissions, see [[SPL_services#GetConfig|here]].

Web-applets permissions:
* "LibAppletWeb" and "LibAppletOff" have same access control: bit0 and bit3 set, and bit62 set.
* Rest of the web-applets: Same as above except bit0 isn't set.

= Service Access Control =
This is a list of [[Services_API|service]]-name strings which the title has access to, with the following structure:
+0: control_byte
+1: {service-name without nul-terminator}

Bitmask 0x07 in control_byte is the {length of the service-name without nul-terminator} - 1.

Bitmask 0x80 in control_byte means service is allowed to be registered.

The service string can contain a wildcard <code>*</code> character.

= Kernel Access Control =
On Switch, descriptors are identified by pattern 01..11 in low bits.

{| class="wikitable" border="1"
|-
! Pattern of lower bits
! Lowest clear bitmask/bit
! Type
! Fields
|-
| <code>0bxxxxxxxxxxxx0111</code>
| Bit3
| KernelFlags
| Bit31-24: Highest allowed cpu id, bit23-16: Lowest allowed cpu id, bit15-10: Highest allowed thread prio, bit9-4: Lowest allowed thread prio
|-
| <code>0bxxxxxxxxxxx01111</code>
| Bit4
| SyscallMask
| Bits 29-31: Syscall mask table index; Bits 5-28: Mask
|-
| <code>0bxxxxxxxxx0111111</code>
| Bit6
| MapIoOrNormalRange
| Bits 7-30: Alternating start page and number of pages, bit31: Alternating read-only flag then MemoryAttribute 0x2001/0x42002 selector flag
|-
| <code>0bxxxxxxxx01111111</code>
| Bit7
| MapNormalPage (RW)
| Bits 8-31: Page
|-
| <code>0bxxxx011111111111</code>
| Bit11
| InterruptPair
| Bits 12-21: Irq0, bits 20-31: Irq1, 0x3FF means empty.
|-
| <code>0bxx01111111111111</code>
| Bit13
| ApplicationType
| Bit16-14: ApplicationType (0=sysmodule, 1=application, 2=applet), bit16 ignored. Parsed by [[Process Manager services]]. Defaults to 0 if descriptor doesn't exist. Can only run 1 application at a time.
|-
| <code>0bx011111111111111</code>
| Bit14
| KernelReleaseVersion
| Bits 15-X: Version. The raw descriptor is compared with 0x80000, when less than an error is returned. This is equivalent to comparing the bits starting at bit15 with 0x10. This enforces a minimum required version, not a maximum.
|-
| <code>0b0111111111111111</code>
| Bit15
| HandleTableSize
| Bit25-16: Number of handles the table shall fit.
|-
| <code>0b1111111111111111</code>
| Bit16
| DebugFlags
| Bit17: can be debugged, bit18: can debug others
|-
| All ones
|
| Ignored
|
|}

== Mapping restrictions ==
The physaddr range 0x80060000-0x2000000000 is not allowed to be mapped as IO.
The physaddr range 0x80000000-0x2000000000 is not allowed to be mapped as Normal.

[2.0.0-4.1.0] The range for IO was changed into 0x80060000-0x81D3FFFF.

[2.0.0-4.1.0] A blacklist was added for IO and Normal mappings:
* 0x50040000-0x50060000 (ARM, Interrupt Controller)
* 0x6000F000 (Exception Vectors)
* 0x6001DC00-0x6001E000 (IPATCH)
* 0x7000E000 (RTC/PMC)
* 0x70019000 (MC)
* 0x7001C000 (MC0)
* 0x7001D000 (MC1)

[5.0.0+] For IO, this blacklist was abandoned and instead two range checks were added. For Normal mappings it is still applied

== Kernel versions ==
{| class="wikitable" border="1"
|-
! Firmware || Kernel Version || Minimum Allowed
|-
| 1.0.0 || 5.0.0 || 3.0.0
|-
| 2.0.0 || 6.1.0 || 3.0.0
|-
| 3.0.0 || 7.4.0 || 3.0.0
|-
| 3.0.2 || 7.4.0 || 3.0.0
|}

Bit31-19: Major version
Bit18-15: Minor version
Bit14-0: Zeroes

Talk:Network

2018-05-10T20:15:44Z

FrasierCrane:

lp1 refers to what environment is to be used, lp1 being retail (?). Using the following code we can perform a DNS enumeration to see what environments there are:
<pre>
#!/usr/bin/python
# -*- coding: utf-8 -*-
import socket
import string
import itertools
from multiprocessing import Pool

def check_env(env):
try:
socket.gethostbyname('sun.hac.{0}1.d4c.nintendo.net'.format(env[0]
+ env[1]))
return '{0}{1}1'.format(env[0], env[1])
except:
pass

def main():
pool = Pool()
potential_environments = itertools.product(string.lowercase,
string.lowercase)

results = pool.map(check_env, potential_environments)
pool.close()
pool.join()
print set(results)

if __name__ == '__main__':
main()
</pre>

Which in turn gives us the following:
dp1, sp1, lp1, td1, jd1. At some point we should try and see if we can find any references anywhere as to what each of these environments are. --[[User:FrasierCrane|FrasierCrane]] ([[User talk:FrasierCrane|talk]]) 15:53, 10 May 2018 (CDT)

:Just added some of these to the Network page. Is "dp1" accurate or did you mean "dd1"? Code mentions "dd1" only. --[[User:Hexkyz|Hexkyz]] ([[User talk:Hexkyz|talk]]) 16:07, 10 May 2018 (CDT)

: dp1 is correct. My theory is that the second character refers to either (p)roduction (retail unit) or (d)evelopment (SDEV units?). dp1 might be an internal retail unit testing backend for Nintendo. I can't work out the first characters meaning though, SciresM did a big post on reddit that explains some of it and gives other potential domains but, the first character is still a mystery. Here's all I can think for the first character:

d = Development (Third party developers?)
t = Testing (Nintendo Internal rather than third party?)
s = Lotcheck (How s = lotcheck, I don't know, SciresM reddit post does mention an s domain for lotcheck though.
l = Live (Retail)
--[[User:FrasierCrane|FrasierCrane]] ([[User talk:FrasierCrane|talk]]) 17:12, 10 May 2018 (CDT)

: Small second note, if the code mentions dd1, by the previous running theory, that would mean it's third-party dev using developer unit.

Talk:Network

2018-05-10T20:12:54Z

FrasierCrane:

Talk:Network

2018-05-10T18:54:22Z

FrasierCrane: DNS enumeration discussion.

User talk:FrasierCrane

2018-05-10T18:00:26Z

FrasierCrane:

Where did that info come from? --[[User:Yellows8|Yellows8]] ([[User talk:Yellows8|talk]]) 01:29, 10 May 2018 (CDT)

A lot of fuzzing and time spent in IDA. Or are you asking for where to look for yourself?
:So ".api_info" / NPDM info isn't from official SDK, right? --[[User:Yellows8|Yellows8]] ([[User talk:Yellows8|talk]]) 12:12, 10 May 2018 (CDT)

:.api_info is found in older non-nintendo (games) applications when unpacked from an NSO back to an ELF. I'm not really sure what it is, static compilation of the SDK? Wouldn't the be stripped for published games? Nothing post-6 months of NX release appears to have it. NPDM info has been determined very lazily, a lot of modifying the hbmenu generated one and poking at where Horizon breaks or where any odd behavior happens, as well as comparison to some official NPDM files. If I have gotten anything wrong and someone knows better, well, that's what the collaborative process of a wiki is for. Are reversing officially released titles are fair game? If not, I'll remove my changes. --[[User:FrasierCrane|FrasierCrane]] ([[User talk:FrasierCrane|talk]]) 12:26, 10 May 2018 (CDT)
::"Are reversing officially released titles are fair game?" Yeah that's fine. --[[User:Yellows8|Yellows8]] ([[User talk:Yellows8|talk]]) 12:33, 10 May 2018 (CDT)
:: Good to know. Working out those last pieces were very difficult so that might be the last of my contributions. I hope it saves you all some time with your future work. Thank you for everything you've contributed and paving the way for third parties like myself to assist where possible. --[[User:FrasierCrane|FrasierCrane]] ([[User talk:FrasierCrane|talk]]) 15:00, 10 May 2018 (CDT)

User talk:FrasierCrane

2018-05-10T15:26:45Z

FrasierCrane:

NPDM

2018-05-10T15:13:21Z

FrasierCrane: Notes on stack size.

This is the Switch equivalent of 3DS [https://www.3dbrew.org/wiki/NCCH/Extended_Header exheader]. This is the file with extension ".npdm" in {Switch ExeFS}. The size of this file varies.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x80
| META
|-
| 0x80
| <Varies>
| ACID
|-
| <See META>
| <See META>
| ACI0
|}

= META =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Magic "META".
|-
| 0x4
| 0x8
| Reserved (Padding / Unused)
|-
| 0xC
| 0x1
| MmuFlags, bit0: 64-bit instructions, bits1-3: address space width (1=64-bit, 2=32-bit). Needs to be <= 0xF
|-
| 0xE
| 0x1
| Main thread priority (0-63)
|-
| 0xF
| 0x1
| DefaultCpuId
|-
| 0x10
| 0x4
| Reserved
|-
| 0x14
| 0x4
| System resource size (max size as of 5.x: 534773760). Unknown usage.
|-
| 0x18
| 0x4
| ProcessCategory (0: regular title, 1: kernel built-in). Should be 0 here.
|-
| 0x1C
| 0x4
| Main entrypoint stack size (This is ignored by the OS so far, not sure what purpose this serves. Values over 4095 can break the OS. In non-nspwn scenarios, values of 0 can also rarely break in Horizon. This might be something auto-adapting or a security feature of some sort?)
|-
| 0x20
| 0x10
| Title name
|-
| 0x30
| 0x10
| Product code
|-
| 0x70
| 0x4
| [[#ACI0]] offset
|-
| 0x74
| 0x4
| [[#ACI0]] size
|-
| 0x78
| 0x4
| [[#ACID]] offset
|-
| 0x7C
| 0x4
| [[#ACID]] size
|}

= ACID =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x100
| RSA-2048 signature, seems to verify the data starting at 0x100 with the size field from 0x204.
|-
| 0x100
| 0x100
| RSA-2048 public key, seems to be used for the second [[NCA_Format|NCA]] signature.
|-
| 0x200
| 0x4
| Magic "ACID".
|-
| 0x204
| 0x4
| s32 Size field used with the above signature(?).
|-
| 0x208
| 0x4
| Zeroes
|-
| 0x20C
| 0x4
| Flags. Bit0 must be 1 on retail, on devunit 0 is also allowed. Bit1 is unknown, set to 1 for ARMS? [5.0.0+] Bit3-2: PoolPartition? For applets set to 0b01, for sysmodules set to 0b10. Exceptions: "starter" is set to 0, "nvservices" is set to 3.
|-
| 0x210
| 0x8
| TitleIdRange_Min
|-
| 0x218
| 0x8
| TitleIdRange_Max
|-
| 0x220
| 0x4
| [[#FS Access Control]] offset
|-
| 0x224
| 0x4
| [[#FS Access Control]] size
|-
| 0x228
| 0x4
| [[#Service Access Control]] offset
|-
| 0x22C
| 0x4
| [[#Service Access Control]] size
|-
| 0x230
| 0x4
| [[#Kernel Access Control]] offset
|-
| 0x234
| 0x4
| [[#Kernel Access Control]] size
|-
| 0x238
| 0x8
| Padding
|}

= ACI0 =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Magic "ACI0".
|-
| 0x4
| 0xC
| Zeroes
|-
| 0x10
| 0x8
| Title id
|-
| 0x18
| 0x8
| Reserved (Not currently used, potentially to be used for lowest title ID in future.)
|-
| 0x20
| 0x4
| [[#FS Access Header]] offset
|-
| 0x24
| 0x4
| [[#FS Access Header]] size
|-
| 0x28
| 0x4
| [[#Service Access Control]] offset
|-
| 0x2C
| 0x4
| [[#Service Access Control]] size
|-
| 0x30
| 0x4
| [[#Kernel Access Control]] offset
|-
| 0x34
| 0x4
| [[#Kernel Access Control]] size
|-
| 0x38
| 0x8
| Padding
|}

= FS Access Header =

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| Version? Always 1. Must be non-zero.
|-
| 0x1
| 0x3
| Padding
|-
| 0x4
| 0x8
| Permissions bitmask
|-
| 0xC
| 0x4
| Usually 0x1C
|-
| 0x10
| 0x4
| Usually 0x0
|-
| 0x14
| 0x4
| Usually 0x1C
|-
| 0x18
| 0x4
| Usually 0x0
|-
|}

= FS Access Control =

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| Version? Always 1. Must be non-zero.
|-
| 0x1
| 0x3
| Padding
|-
| 0x4
| 0x8
| Permissions bitmask
|-
| 0xC
| 0x20
| Usually all zeroes for applications
|}

[[Filesystem_services#Permissions|Permissions]] bitmask:
{| class="wikitable" border="1"
|-
! Bit
! Description
|-
| 0
| MountContent* is accessible when set.
|-
| 34
| Enables access to [[Filesystem_services|Bis]] partitionID 27 and 28?
|-
| 63
| Enables access to everything: all [[Filesystem_services#Permissions|permission-types]] which check a bitmask have this bit set.
|}

For bit62 in permissions, see [[SPL_services#GetConfig|here]].

Web-applets permissions:
* "LibAppletWeb" and "LibAppletOff" have same access control: bit0 and bit3 set, and bit62 set.
* Rest of the web-applets: Same as above except bit0 isn't set.

= Service Access Control =
This is a list of [[Services_API|service]]-name strings which the title has access to, with the following structure:
+0: control_byte
+1: {service-name without nul-terminator}

Bitmask 0x07 in control_byte is the {length of the service-name without nul-terminator} - 1.

Bitmask 0x80 in control_byte means service is allowed to be registered.

The service string can contain a wildcard <code>*</code> character.

= Kernel Access Control =
On Switch, descriptors are identified by pattern 01..11 in low bits.

{| class="wikitable" border="1"
|-
! Pattern of lower bits
! Lowest clear bitmask/bit
! Type
! Fields
|-
| <code>0bxxxxxxxxxxxx0111</code>
| Bit3
| KernelFlags
| Bit31-24: Highest allowed cpu id, bit23-16: Lowest allowed cpu id, bit15-10: Highest allowed thread prio, bit9-4: Lowest allowed thread prio
|-
| <code>0bxxxxxxxxxxx01111</code>
| Bit4
| SyscallMask
| Bits 29-31: Syscall mask table index; Bits 5-28: Mask
|-
| <code>0bxxxxxxxxx0111111</code>
| Bit6
| MapIoOrNormalRange
| Bits 7-30: Alternating start page and number of pages, bit31: Alternating read-only flag then MemoryAttribute 0x2001/0x42002 selector flag
|-
| <code>0bxxxxxxxx01111111</code>
| Bit7
| MapNormalPage (RW)
| Bits 8-31: Page
|-
| <code>0bxxxx011111111111</code>
| Bit11
| InterruptPair
| Bits 12-21: Irq0, bits 20-31: Irq1, 0x3FF means empty.
|-
| <code>0bxx01111111111111</code>
| Bit13
| ApplicationType
| Bit16-14: ApplicationType (0=sysmodule, 1=application, 2=applet), bit16 ignored. Parsed by [[Process Manager services]]. Defaults to 0 if descriptor doesn't exist. Can only run 1 application at a time.
|-
| <code>0bx011111111111111</code>
| Bit14
| KernelReleaseVersion
| Bits 15-X: Version. The raw descriptor is compared with 0x80000, when less than an error is returned. This is equivalent to comparing the bits starting at bit15 with 0x10. This enforces a minimum required version, not a maximum.
|-
| <code>0b0111111111111111</code>
| Bit15
| HandleTableSize
| Bit25-16: Number of handles the table shall fit.
|-
| <code>0b1111111111111111</code>
| Bit16
| DebugFlags
| Bit17: can be debugged, bit18: can debug others
|-
| All ones
|
| Ignored
|
|}

== Mapping restrictions ==
The physaddr range 0x80060000-0x2000000000 is not allowed to be mapped as IO.
The physaddr range 0x80000000-0x2000000000 is not allowed to be mapped as Normal.

[2.0.0-4.1.0] The range for IO was changed into 0x80060000-0x81D3FFFF.

[2.0.0-4.1.0] A blacklist was added for IO and Normal mappings:
* 0x50040000-0x50060000 (ARM, Interrupt Controller)
* 0x6000F000 (Exception Vectors)
* 0x6001DC00-0x6001E000 (IPATCH)
* 0x7000E000 (RTC/PMC)
* 0x70019000 (MC)
* 0x7001C000 (MC0)
* 0x7001D000 (MC1)

[5.0.0+] For IO, this blacklist was abandoned and instead two range checks were added. For Normal mappings it is still applied

== Kernel versions ==
{| class="wikitable" border="1"
|-
! Firmware || Kernel Version || Minimum Allowed
|-
| 1.0.0 || 5.0.0 || 3.0.0
|-
| 2.0.0 || 6.1.0 || 3.0.0
|-
| 3.0.0 || 7.4.0 || 3.0.0
|-
| 3.0.2 || 7.4.0 || 3.0.0
|}

Bit31-19: Major version
Bit18-15: Minor version
Bit14-0: Zeroes

Talk:NPDM

2018-05-10T15:08:51Z

FrasierCrane: Small notes.

Notes from an outside-of-the-scene developer:

FS Access Control is all one giant ulong flag. Byte 1 says the application is allowed to access its own data, set it to zero to watch everything break. The last byte means full file permission. The byte before that means it can access debug devices, this would allow (in theory) access to debug gamecards/hardware from retail units. System updates have the 17th and 21st bit set, this may mean that's providing full control for modifying system related files. Some updates just use the full permission bit (last bit).

For the sake of homebrew, we should just ignore this and flag the first bit and the last two bits of the flag. I don't think anything else could possibly matter. Maybe even flagging the first is pointless but I haven't fuzzed this enough to check what breaks. --[[User:FrasierCrane|FrasierCrane]] ([[User talk:FrasierCrane|talk]]) 12:08, 10 May 2018 (CDT)

NPDM

2018-05-10T14:53:29Z

FrasierCrane: Clarify main entrypoint stack size.

This is the Switch equivalent of 3DS [https://www.3dbrew.org/wiki/NCCH/Extended_Header exheader]. This is the file with extension ".npdm" in {Switch ExeFS}. The size of this file varies.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x80
| META
|-
| 0x80
| <Varies>
| ACID
|-
| <See META>
| <See META>
| ACI0
|}

= META =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Magic "META".
|-
| 0x4
| 0x8
| Reserved (Padding / Unused)
|-
| 0xC
| 0x1
| MmuFlags, bit0: 64-bit instructions, bits1-3: address space width (1=64-bit, 2=32-bit). Needs to be <= 0xF
|-
| 0xE
| 0x1
| Main thread priority (0-63)
|-
| 0xF
| 0x1
| DefaultCpuId
|-
| 0x10
| 0x4
| Reserved
|-
| 0x14
| 0x4
| System resource size (max size as of 5.x: 534773760). Unknown usage.
|-
| 0x18
| 0x4
| ProcessCategory (0: regular title, 1: kernel built-in). Should be 0 here.
|-
| 0x1C
| 0x4
| Main entrypoint stack size (This is ignored by the OS so far, not sure what purpose this serves.)
|-
| 0x20
| 0x10
| Title name
|-
| 0x30
| 0x10
| Product code
|-
| 0x70
| 0x4
| [[#ACI0]] offset
|-
| 0x74
| 0x4
| [[#ACI0]] size
|-
| 0x78
| 0x4
| [[#ACID]] offset
|-
| 0x7C
| 0x4
| [[#ACID]] size
|}

= ACID =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x100
| RSA-2048 signature, seems to verify the data starting at 0x100 with the size field from 0x204.
|-
| 0x100
| 0x100
| RSA-2048 public key, seems to be used for the second [[NCA_Format|NCA]] signature.
|-
| 0x200
| 0x4
| Magic "ACID".
|-
| 0x204
| 0x4
| s32 Size field used with the above signature(?).
|-
| 0x208
| 0x4
| Zeroes
|-
| 0x20C
| 0x4
| Flags. Bit0 must be 1 on retail, on devunit 0 is also allowed. Bit1 is unknown, set to 1 for ARMS? [5.0.0+] Bit3-2: PoolPartition? For applets set to 0b01, for sysmodules set to 0b10. Exceptions: "starter" is set to 0, "nvservices" is set to 3.
|-
| 0x210
| 0x8
| TitleIdRange_Min
|-
| 0x218
| 0x8
| TitleIdRange_Max
|-
| 0x220
| 0x4
| [[#FS Access Control]] offset
|-
| 0x224
| 0x4
| [[#FS Access Control]] size
|-
| 0x228
| 0x4
| [[#Service Access Control]] offset
|-
| 0x22C
| 0x4
| [[#Service Access Control]] size
|-
| 0x230
| 0x4
| [[#Kernel Access Control]] offset
|-
| 0x234
| 0x4
| [[#Kernel Access Control]] size
|-
| 0x238
| 0x8
| Padding
|}

= ACI0 =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Magic "ACI0".
|-
| 0x4
| 0xC
| Zeroes
|-
| 0x10
| 0x8
| Title id
|-
| 0x18
| 0x8
| Reserved (Not currently used, potentially to be used for lowest title ID in future.)
|-
| 0x20
| 0x4
| [[#FS Access Header]] offset
|-
| 0x24
| 0x4
| [[#FS Access Header]] size
|-
| 0x28
| 0x4
| [[#Service Access Control]] offset
|-
| 0x2C
| 0x4
| [[#Service Access Control]] size
|-
| 0x30
| 0x4
| [[#Kernel Access Control]] offset
|-
| 0x34
| 0x4
| [[#Kernel Access Control]] size
|-
| 0x38
| 0x8
| Padding
|}

= FS Access Header =

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| Version? Always 1. Must be non-zero.
|-
| 0x1
| 0x3
| Padding
|-
| 0x4
| 0x8
| Permissions bitmask
|-
| 0xC
| 0x4
| Usually 0x1C
|-
| 0x10
| 0x4
| Usually 0x0
|-
| 0x14
| 0x4
| Usually 0x1C
|-
| 0x18
| 0x4
| Usually 0x0
|-
|}

= FS Access Control =

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| Version? Always 1. Must be non-zero.
|-
| 0x1
| 0x3
| Padding
|-
| 0x4
| 0x8
| Permissions bitmask
|-
| 0xC
| 0x20
| Usually all zeroes for applications
|}

[[Filesystem_services#Permissions|Permissions]] bitmask:
{| class="wikitable" border="1"
|-
! Bit
! Description
|-
| 0
| MountContent* is accessible when set.
|-
| 34
| Enables access to [[Filesystem_services|Bis]] partitionID 27 and 28?
|-
| 63
| Enables access to everything: all [[Filesystem_services#Permissions|permission-types]] which check a bitmask have this bit set.
|}

For bit62 in permissions, see [[SPL_services#GetConfig|here]].

Web-applets permissions:
* "LibAppletWeb" and "LibAppletOff" have same access control: bit0 and bit3 set, and bit62 set.
* Rest of the web-applets: Same as above except bit0 isn't set.

= Service Access Control =
This is a list of [[Services_API|service]]-name strings which the title has access to, with the following structure:
+0: control_byte
+1: {service-name without nul-terminator}

Bitmask 0x07 in control_byte is the {length of the service-name without nul-terminator} - 1.

Bitmask 0x80 in control_byte means service is allowed to be registered.

The service string can contain a wildcard <code>*</code> character.

= Kernel Access Control =
On Switch, descriptors are identified by pattern 01..11 in low bits.

{| class="wikitable" border="1"
|-
! Pattern of lower bits
! Lowest clear bitmask/bit
! Type
! Fields
|-
| <code>0bxxxxxxxxxxxx0111</code>
| Bit3
| KernelFlags
| Bit31-24: Highest allowed cpu id, bit23-16: Lowest allowed cpu id, bit15-10: Highest allowed thread prio, bit9-4: Lowest allowed thread prio
|-
| <code>0bxxxxxxxxxxx01111</code>
| Bit4
| SyscallMask
| Bits 29-31: Syscall mask table index; Bits 5-28: Mask
|-
| <code>0bxxxxxxxxx0111111</code>
| Bit6
| MapIoOrNormalRange
| Bits 7-30: Alternating start page and number of pages, bit31: Alternating read-only flag then MemoryAttribute 0x2001/0x42002 selector flag
|-
| <code>0bxxxxxxxx01111111</code>
| Bit7
| MapNormalPage (RW)
| Bits 8-31: Page
|-
| <code>0bxxxx011111111111</code>
| Bit11
| InterruptPair
| Bits 12-21: Irq0, bits 20-31: Irq1, 0x3FF means empty.
|-
| <code>0bxx01111111111111</code>
| Bit13
| ApplicationType
| Bit16-14: ApplicationType (0=sysmodule, 1=application, 2=applet), bit16 ignored. Parsed by [[Process Manager services]]. Defaults to 0 if descriptor doesn't exist. Can only run 1 application at a time.
|-
| <code>0bx011111111111111</code>
| Bit14
| KernelReleaseVersion
| Bits 15-X: Version. The raw descriptor is compared with 0x80000, when less than an error is returned. This is equivalent to comparing the bits starting at bit15 with 0x10. This enforces a minimum required version, not a maximum.
|-
| <code>0b0111111111111111</code>
| Bit15
| HandleTableSize
| Bit25-16: Number of handles the table shall fit.
|-
| <code>0b1111111111111111</code>
| Bit16
| DebugFlags
| Bit17: can be debugged, bit18: can debug others
|-
| All ones
|
| Ignored
|
|}

== Mapping restrictions ==
The physaddr range 0x80060000-0x2000000000 is not allowed to be mapped as IO.
The physaddr range 0x80000000-0x2000000000 is not allowed to be mapped as Normal.

[2.0.0-4.1.0] The range for IO was changed into 0x80060000-0x81D3FFFF.

[2.0.0-4.1.0] A blacklist was added for IO and Normal mappings:
* 0x50040000-0x50060000 (ARM, Interrupt Controller)
* 0x6000F000 (Exception Vectors)
* 0x6001DC00-0x6001E000 (IPATCH)
* 0x7000E000 (RTC/PMC)
* 0x70019000 (MC)
* 0x7001C000 (MC0)
* 0x7001D000 (MC1)

[5.0.0+] For IO, this blacklist was abandoned and instead two range checks were added. For Normal mappings it is still applied

== Kernel versions ==
{| class="wikitable" border="1"
|-
! Firmware || Kernel Version || Minimum Allowed
|-
| 1.0.0 || 5.0.0 || 3.0.0
|-
| 2.0.0 || 6.1.0 || 3.0.0
|-
| 3.0.0 || 7.4.0 || 3.0.0
|-
| 3.0.2 || 7.4.0 || 3.0.0
|}

Bit31-19: Major version
Bit18-15: Minor version
Bit14-0: Zeroes

User talk:FrasierCrane

2018-05-10T14:51:38Z

FrasierCrane:

User talk:FrasierCrane

2018-05-10T14:51:29Z

FrasierCrane:

NPDM

2018-05-10T03:07:20Z

FrasierCrane: Update missing NPDM format values.

This is the Switch equivalent of 3DS [https://www.3dbrew.org/wiki/NCCH/Extended_Header exheader]. This is the file with extension ".npdm" in {Switch ExeFS}. The size of this file varies.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x80
| META
|-
| 0x80
| <Varies>
| ACID
|-
| <See META>
| <See META>
| ACI0
|}

= META =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Magic "META".
|-
| 0x4
| 0x8
| Reserved (Padding / Unused)
|-
| 0xC
| 0x1
| MmuFlags, bit0: 64-bit instructions, bits1-3: address space width (1=64-bit, 2=32-bit). Needs to be <= 0xF
|-
| 0xE
| 0x1
| Main thread priority (0-63)
|-
| 0xF
| 0x1
| DefaultCpuId
|-
| 0x10
| 0x4
| Reserved
|-
| 0x14
| 0x4
| System resource size (max size as of 5.x: 534773760). Unknown usage.
|-
| 0x18
| 0x4
| ProcessCategory (0: regular title, 1: kernel built-in). Should be 0 here.
|-
| 0x1C
| 0x4
| MainStackSize
|-
| 0x20
| 0x10
| Title name
|-
| 0x30
| 0x10
| Product code
|-
| 0x70
| 0x4
| [[#ACI0]] offset
|-
| 0x74
| 0x4
| [[#ACI0]] size
|-
| 0x78
| 0x4
| [[#ACID]] offset
|-
| 0x7C
| 0x4
| [[#ACID]] size
|}

= ACID =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x100
| RSA-2048 signature, seems to verify the data starting at 0x100 with the size field from 0x204.
|-
| 0x100
| 0x100
| RSA-2048 public key, seems to be used for the second [[NCA_Format|NCA]] signature.
|-
| 0x200
| 0x4
| Magic "ACID".
|-
| 0x204
| 0x4
| s32 Size field used with the above signature(?).
|-
| 0x208
| 0x4
| Zeroes
|-
| 0x20C
| 0x4
| Flags. Bit0 must be 1 on retail, on devunit 0 is also allowed. Bit1 is unknown, set to 1 for ARMS? [5.0.0+] Bit3-2: PoolPartition? For applets set to 0b01, for sysmodules set to 0b10. Exceptions: "starter" is set to 0, "nvservices" is set to 3.
|-
| 0x210
| 0x8
| TitleIdRange_Min
|-
| 0x218
| 0x8
| TitleIdRange_Max
|-
| 0x220
| 0x4
| [[#FS Access Control]] offset
|-
| 0x224
| 0x4
| [[#FS Access Control]] size
|-
| 0x228
| 0x4
| [[#Service Access Control]] offset
|-
| 0x22C
| 0x4
| [[#Service Access Control]] size
|-
| 0x230
| 0x4
| [[#Kernel Access Control]] offset
|-
| 0x234
| 0x4
| [[#Kernel Access Control]] size
|-
| 0x238
| 0x8
| Padding
|}

= ACI0 =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Magic "ACI0".
|-
| 0x4
| 0xC
| Zeroes
|-
| 0x10
| 0x8
| Title id
|-
| 0x18
| 0x8
| Reserved (Not currently used, potentially to be used for lowest title ID in future.)
|-
| 0x20
| 0x4
| [[#FS Access Header]] offset
|-
| 0x24
| 0x4
| [[#FS Access Header]] size
|-
| 0x28
| 0x4
| [[#Service Access Control]] offset
|-
| 0x2C
| 0x4
| [[#Service Access Control]] size
|-
| 0x30
| 0x4
| [[#Kernel Access Control]] offset
|-
| 0x34
| 0x4
| [[#Kernel Access Control]] size
|-
| 0x38
| 0x8
| Padding
|}

= FS Access Header =

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| Version? Always 1. Must be non-zero.
|-
| 0x1
| 0x3
| Padding
|-
| 0x4
| 0x8
| Permissions bitmask
|-
| 0xC
| 0x4
| Usually 0x1C
|-
| 0x10
| 0x4
| Usually 0x0
|-
| 0x14
| 0x4
| Usually 0x1C
|-
| 0x18
| 0x4
| Usually 0x0
|-
|}

= FS Access Control =

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| Version? Always 1. Must be non-zero.
|-
| 0x1
| 0x3
| Padding
|-
| 0x4
| 0x8
| Permissions bitmask
|-
| 0xC
| 0x20
| Usually all zeroes for applications
|}

[[Filesystem_services#Permissions|Permissions]] bitmask:
{| class="wikitable" border="1"
|-
! Bit
! Description
|-
| 0
| MountContent* is accessible when set.
|-
| 34
| Enables access to [[Filesystem_services|Bis]] partitionID 27 and 28?
|-
| 63
| Enables access to everything: all [[Filesystem_services#Permissions|permission-types]] which check a bitmask have this bit set.
|}

For bit62 in permissions, see [[SPL_services#GetConfig|here]].

Web-applets permissions:
* "LibAppletWeb" and "LibAppletOff" have same access control: bit0 and bit3 set, and bit62 set.
* Rest of the web-applets: Same as above except bit0 isn't set.

= Service Access Control =
This is a list of [[Services_API|service]]-name strings which the title has access to, with the following structure:
+0: control_byte
+1: {service-name without nul-terminator}

Bitmask 0x07 in control_byte is the {length of the service-name without nul-terminator} - 1.

Bitmask 0x80 in control_byte means service is allowed to be registered.

The service string can contain a wildcard <code>*</code> character.

= Kernel Access Control =
On Switch, descriptors are identified by pattern 01..11 in low bits.

{| class="wikitable" border="1"
|-
! Pattern of lower bits
! Lowest clear bitmask/bit
! Type
! Fields
|-
| <code>0bxxxxxxxxxxxx0111</code>
| Bit3
| KernelFlags
| Bit31-24: Highest allowed cpu id, bit23-16: Lowest allowed cpu id, bit15-10: Highest allowed thread prio, bit9-4: Lowest allowed thread prio
|-
| <code>0bxxxxxxxxxxx01111</code>
| Bit4
| SyscallMask
| Bits 29-31: Syscall mask table index; Bits 5-28: Mask
|-
| <code>0bxxxxxxxxx0111111</code>
| Bit6
| MapIoOrNormalRange
| Bits 7-30: Alternating start page and number of pages, bit31: Alternating read-only flag then MemoryAttribute 0x2001/0x42002 selector flag
|-
| <code>0bxxxxxxxx01111111</code>
| Bit7
| MapNormalPage (RW)
| Bits 8-31: Page
|-
| <code>0bxxxx011111111111</code>
| Bit11
| InterruptPair
| Bits 12-21: Irq0, bits 20-31: Irq1, 0x3FF means empty.
|-
| <code>0bxx01111111111111</code>
| Bit13
| ApplicationType
| Bit16-14: ApplicationType (0=sysmodule, 1=application, 2=applet), bit16 ignored. Parsed by [[Process Manager services]]. Defaults to 0 if descriptor doesn't exist. Can only run 1 application at a time.
|-
| <code>0bx011111111111111</code>
| Bit14
| KernelReleaseVersion
| Bits 15-X: Version. The raw descriptor is compared with 0x80000, when less than an error is returned. This is equivalent to comparing the bits starting at bit15 with 0x10. This enforces a minimum required version, not a maximum.
|-
| <code>0b0111111111111111</code>
| Bit15
| HandleTableSize
| Bit25-16: Number of handles the table shall fit.
|-
| <code>0b1111111111111111</code>
| Bit16
| DebugFlags
| Bit17: can be debugged, bit18: can debug others
|-
| All ones
|
| Ignored
|
|}

== Mapping restrictions ==
The physaddr range 0x80060000-0x2000000000 is not allowed to be mapped as IO.
The physaddr range 0x80000000-0x2000000000 is not allowed to be mapped as Normal.

[2.0.0-4.1.0] The range for IO was changed into 0x80060000-0x81D3FFFF.

[2.0.0-4.1.0] A blacklist was added for IO and Normal mappings:
* 0x50040000-0x50060000 (ARM, Interrupt Controller)
* 0x6000F000 (Exception Vectors)
* 0x6001DC00-0x6001E000 (IPATCH)
* 0x7000E000 (RTC/PMC)
* 0x70019000 (MC)
* 0x7001C000 (MC0)
* 0x7001D000 (MC1)

[5.0.0+] For IO, this blacklist was abandoned and instead two range checks were added. For Normal mappings it is still applied

== Kernel versions ==
{| class="wikitable" border="1"
|-
! Firmware || Kernel Version || Minimum Allowed
|-
| 1.0.0 || 5.0.0 || 3.0.0
|-
| 2.0.0 || 6.1.0 || 3.0.0
|-
| 3.0.0 || 7.4.0 || 3.0.0
|-
| 3.0.2 || 7.4.0 || 3.0.0
|}

Bit31-19: Major version
Bit18-15: Minor version
Bit14-0: Zeroes

NSO0

2018-05-10T01:29:58Z

FrasierCrane: Expand compressed size to show order of sections.

[[Category:File formats]]
NSO is the main executable format.

It starts with the "NSO" header and mainly describes .text, .rodata, and .data segments (like a short-form of ELF program headers):

= NSO Header =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 4
| Magic "NSO0"
|-
| 0x4
| 4
| NSO Version (Always 0)
|-
| 0x8
| 4
| Reserved (Unused)
|-
| 0xC
| 4
| Flags, bit 0-2: (.text, .rodata and .data) section is compressed, bit 3-5: check section hash when loading
|-
| 0x10
| 0xC
| .text SegmentHeader
|-
| 0x1C
| 0x4
| Module offset (calculated by sizeof(header))
|-
| 0x20
| 0xC
| .rodata SegmentHeader
|-
| 0x2C
| 0x4
| Module file size
|-
| 0x30
| 0xC
| .data SegmentHeader
|-
| 0x3C
| 0x4
| bssSize
|-
| 0x40
| 0x20
| Value of "build id" from ELF's GNU .note section. Contains variable sized digest, up to 32bytes.
|-
| 0x60
| 0x4
| .text compressed size
|-
| 0x64
| 0x4
| .rodata compressed size
|-
| 0x68
| 0x4
| .data compressed size
|-
| 0x6C
| 0x1C
| Reserved (Padding)
|-
| 0x88
| 0x8
| .rodata-relative extents of .api_info
|-
| 0x90
| 0x8
| .rodata-relative extents of .dynstr
|-
| 0x98
| 0x8
| .rodata-relative extents of .dynsym
|-
| 0xA0
| 0x20 * 3
| SHA256 hashes over the decompressed sections using the above byte-sizes: .text, .rodata, and .data.
|-
| 0x100
|
| Compressed sections
|}

Most data in Switch binaries are standard ELF structures, however some are custom.
For example, the MOD header is essentially a replacement for a PT_DYNAMIC program header.

== SegmentHeader ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| FileOffset
|-
| 0x4
| 0x4
| MemoryOffset
|-
| 0x8
| 0x4
| DecompressedSize
|}

== .rodata-relative extent ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 4
| RegionRoDataOffset
|-
| 0x4
| 4
| RegionSize
|}

== MOD ==
All offsets are signed 32bit values relative to the magic field.
The 32bits at image base + 4 must point to the magic field.
The MOD structure is designed such that it can be placed at image base and point to itself.
The 2 fields preceding the magic field get copied around with the structure, even if it is relocated to somewhere besides the image base. If MOD is not located at image base, the value at offset 4 must still point to the MOD magic. In the case of .text being at image base, this implies that the first instruction can only be an unconditional branch over the offset literal.
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x00
| 4
| ZeroPadding
|-
| 0x04
| 4
| MagicOffset. Always 8 (so it works when MOD is at image_base + 0).
|-
| 0x08
| 4
| Magic "MOD0"
|-
| 0x0C
| 4
| .dynamic offset
|-
| 0x10
| 4
| .bss start offset
|-
| 0x14
| 4
| .bss end offset
|-
| 0x18
| 4
| .eh_frame_hdr start offset
|-
| 0x1C
| 4
| .eh_frame_hdr end offset
|-
| 0x20
| 4
| offset to runtime-generated module object. typically equal to .bss base.
|}

=Arguments=
Loader maps memory and writes the [[Loader_services#AddProcessToLaunchQueue|arguments]] to {end of rwdata section specified by last SegmentHeader}. Official processes use argdata_addr = {page-aligned _end}. svcQueryMemory is used by official sw to verify that argdata_addr is mapped RW, since this memory is only mapped when arguments are specified via that command. Afterwards, official sw aligns the argdata_addr to 4-bytes. Structure located at argdata_addr:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || This is the total allocated space relative to argdata_addr, used for calculating the max size of the argv ptr array. Normally 0x9000?
|-
| 0x4 || 0x4 || This is the total_bytesize of the actual argdata string.
|-
| 0x8 || 0x18 || Unused by official sw.
|-
| 0x20 || See above || Actual argdata string.
|}

* The copy of the args used with the argv array is written by official processes to actual_argdata_string+actual_argdata_size.
* argv_ptrarray written by official processes is at (args_copy+actual_argdata_size) + 0x9 & ~0x7.

User:FrasierCrane

2018-05-10T01:23:54Z

FrasierCrane: Created page with "I pull apart file formats."

I pull apart file formats.

NSO0

2018-05-10T01:21:20Z

FrasierCrane: Keep consistency of .ro = .rodata.

[[Category:File formats]]
NSO is the main executable format.

It starts with the "NSO" header and mainly describes .text, .rodata, and .data segments (like a short-form of ELF program headers):

= NSO Header =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 4
| Magic "NSO0"
|-
| 0x4
| 4
| NSO Version (Always 0)
|-
| 0x8
| 4
| Reserved (Unused)
|-
| 0xC
| 4
| Flags, bit 0-2: (.text, .rodata and .data) section is compressed, bit 3-5: check section hash when loading
|-
| 0x10
| 0xC
| .text SegmentHeader
|-
| 0x1C
| 0x4
| Module offset (calculated by sizeof(header))
|-
| 0x20
| 0xC
| .rodata SegmentHeader
|-
| 0x2C
| 0x4
| Module file size
|-
| 0x30
| 0xC
| .data SegmentHeader
|-
| 0x3C
| 0x4
| bssSize
|-
| 0x40
| 0x20
| Value of "build id" from ELF's GNU .note section. Contains variable sized digest, up to 32bytes.
|-
| 0x60
| 0x4 * 3
| CompressedSize[3]
|-
| 0x6C
| 0x1C
| Reserved (Padding)
|-
| 0x88
| 0x8
| .rodata-relative extents of .api_info
|-
| 0x90
| 0x8
| .rodata-relative extents of .dynstr
|-
| 0x98
| 0x8
| .rodata-relative extents of .dynsym
|-
| 0xA0
| 0x20 * 3
| SHA256 hashes over the decompressed sections using the above byte-sizes: .text, .rodata, and .data.
|-
| 0x100
|
| Compressed sections
|}

Most data in Switch binaries are standard ELF structures, however some are custom.
For example, the MOD header is essentially a replacement for a PT_DYNAMIC program header.

== SegmentHeader ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| FileOffset
|-
| 0x4
| 0x4
| MemoryOffset
|-
| 0x8
| 0x4
| DecompressedSize
|}

== .rodata-relative extent ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 4
| RegionRoDataOffset
|-
| 0x4
| 4
| RegionSize
|}

== MOD ==
All offsets are signed 32bit values relative to the magic field.
The 32bits at image base + 4 must point to the magic field.
The MOD structure is designed such that it can be placed at image base and point to itself.
The 2 fields preceding the magic field get copied around with the structure, even if it is relocated to somewhere besides the image base. If MOD is not located at image base, the value at offset 4 must still point to the MOD magic. In the case of .text being at image base, this implies that the first instruction can only be an unconditional branch over the offset literal.
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x00
| 4
| ZeroPadding
|-
| 0x04
| 4
| MagicOffset. Always 8 (so it works when MOD is at image_base + 0).
|-
| 0x08
| 4
| Magic "MOD0"
|-
| 0x0C
| 4
| .dynamic offset
|-
| 0x10
| 4
| .bss start offset
|-
| 0x14
| 4
| .bss end offset
|-
| 0x18
| 4
| .eh_frame_hdr start offset
|-
| 0x1C
| 4
| .eh_frame_hdr end offset
|-
| 0x20
| 4
| offset to runtime-generated module object. typically equal to .bss base.
|}

=Arguments=
Loader maps memory and writes the [[Loader_services#AddProcessToLaunchQueue|arguments]] to {end of rwdata section specified by last SegmentHeader}. Official processes use argdata_addr = {page-aligned _end}. svcQueryMemory is used by official sw to verify that argdata_addr is mapped RW, since this memory is only mapped when arguments are specified via that command. Afterwards, official sw aligns the argdata_addr to 4-bytes. Structure located at argdata_addr:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || This is the total allocated space relative to argdata_addr, used for calculating the max size of the argv ptr array. Normally 0x9000?
|-
| 0x4 || 0x4 || This is the total_bytesize of the actual argdata string.
|-
| 0x8 || 0x18 || Unused by official sw.
|-
| 0x20 || See above || Actual argdata string.
|}

* The copy of the args used with the argv array is written by official processes to actual_argdata_string+actual_argdata_size.
* argv_ptrarray written by official processes is at (args_copy+actual_argdata_size) + 0x9 & ~0x7.

NSO0

2018-05-10T01:20:34Z

FrasierCrane: Fixed incorrect flag order.

[[Category:File formats]]
NSO is the main executable format.

It starts with the "NSO" header and mainly describes .text, .rodata, and .data segments (like a short-form of ELF program headers):

= NSO Header =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 4
| Magic "NSO0"
|-
| 0x4
| 4
| NSO Version (Always 0)
|-
| 0x8
| 4
| Reserved (Unused)
|-
| 0xC
| 4
| Flags, bit 0-2: (.text, .rodata and .data) section is compressed, bit 3-5: check section hash when loading
|-
| 0x10
| 0xC
| .text SegmentHeader
|-
| 0x1C
| 0x4
| Module offset (calculated by sizeof(header))
|-
| 0x20
| 0xC
| .ro SegmentHeader
|-
| 0x2C
| 0x4
| Module file size
|-
| 0x30
| 0xC
| .data SegmentHeader
|-
| 0x3C
| 0x4
| bssSize
|-
| 0x40
| 0x20
| Value of "build id" from ELF's GNU .note section. Contains variable sized digest, up to 32bytes.
|-
| 0x60
| 0x4 * 3
| CompressedSize[3]
|-
| 0x6C
| 0x1C
| Reserved (Padding)
|-
| 0x88
| 0x8
| .rodata-relative extents of .api_info
|-
| 0x90
| 0x8
| .rodata-relative extents of .dynstr
|-
| 0x98
| 0x8
| .rodata-relative extents of .dynsym
|-
| 0xA0
| 0x20 * 3
| SHA256 hashes over the decompressed sections using the above byte-sizes: .text, .rodata, and .data.
|-
| 0x100
|
| Compressed sections
|}

Most data in Switch binaries are standard ELF structures, however some are custom.
For example, the MOD header is essentially a replacement for a PT_DYNAMIC program header.

== SegmentHeader ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| FileOffset
|-
| 0x4
| 0x4
| MemoryOffset
|-
| 0x8
| 0x4
| DecompressedSize
|}

== .rodata-relative extent ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 4
| RegionRoDataOffset
|-
| 0x4
| 4
| RegionSize
|}

== MOD ==
All offsets are signed 32bit values relative to the magic field.
The 32bits at image base + 4 must point to the magic field.
The MOD structure is designed such that it can be placed at image base and point to itself.
The 2 fields preceding the magic field get copied around with the structure, even if it is relocated to somewhere besides the image base. If MOD is not located at image base, the value at offset 4 must still point to the MOD magic. In the case of .text being at image base, this implies that the first instruction can only be an unconditional branch over the offset literal.
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x00
| 4
| ZeroPadding
|-
| 0x04
| 4
| MagicOffset. Always 8 (so it works when MOD is at image_base + 0).
|-
| 0x08
| 4
| Magic "MOD0"
|-
| 0x0C
| 4
| .dynamic offset
|-
| 0x10
| 4
| .bss start offset
|-
| 0x14
| 4
| .bss end offset
|-
| 0x18
| 4
| .eh_frame_hdr start offset
|-
| 0x1C
| 4
| .eh_frame_hdr end offset
|-
| 0x20
| 4
| offset to runtime-generated module object. typically equal to .bss base.
|}

=Arguments=
Loader maps memory and writes the [[Loader_services#AddProcessToLaunchQueue|arguments]] to {end of rwdata section specified by last SegmentHeader}. Official processes use argdata_addr = {page-aligned _end}. svcQueryMemory is used by official sw to verify that argdata_addr is mapped RW, since this memory is only mapped when arguments are specified via that command. Afterwards, official sw aligns the argdata_addr to 4-bytes. Structure located at argdata_addr:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || This is the total allocated space relative to argdata_addr, used for calculating the max size of the argv ptr array. Normally 0x9000?
|-
| 0x4 || 0x4 || This is the total_bytesize of the actual argdata string.
|-
| 0x8 || 0x18 || Unused by official sw.
|-
| 0x20 || See above || Actual argdata string.
|}

* The copy of the args used with the argv array is written by official processes to actual_argdata_string+actual_argdata_size.
* argv_ptrarray written by official processes is at (args_copy+actual_argdata_size) + 0x9 & ~0x7.

NSO0

2018-05-10T01:17:00Z

FrasierCrane: Finalized most of NSO file format.

[[Category:File formats]]
NSO is the main executable format.

It starts with the "NSO" header and mainly describes .text, .rodata, and .data segments (like a short-form of ELF program headers):

= NSO Header =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 4
| Magic "NSO0"
|-
| 0x4
| 4
| NSO Version (Always 0)
|-
| 0x8
| 4
| Reserved (Unused)
|-
| 0xC
| 4
| Flags, bit 0-2: (.data, .text, .ro) section is compressed, bit 3-5: check section hash when loading
|-
| 0x10
| 0xC
| .text SegmentHeader
|-
| 0x1C
| 0x4
| Module offset (calculated by sizeof(header))
|-
| 0x20
| 0xC
| .ro SegmentHeader
|-
| 0x2C
| 0x4
| Module file size
|-
| 0x30
| 0xC
| .data SegmentHeader
|-
| 0x3C
| 0x4
| bssSize
|-
| 0x40
| 0x20
| Value of "build id" from ELF's GNU .note section. Contains variable sized digest, up to 32bytes.
|-
| 0x60
| 0x4 * 3
| CompressedSize[3]
|-
| 0x6C
| 0x1C
| Reserved (Padding)
|-
| 0x88
| 0x8
| .rodata-relative extents of .api_info
|-
| 0x90
| 0x8
| .rodata-relative extents of .dynstr
|-
| 0x98
| 0x8
| .rodata-relative extents of .dynsym
|-
| 0xA0
| 0x20 * 3
| SHA256 hashes over the decompressed sections using the above byte-sizes: .text, .rodata, and .data.
|-
| 0x100
|
| Compressed sections
|}

Most data in Switch binaries are standard ELF structures, however some are custom.
For example, the MOD header is essentially a replacement for a PT_DYNAMIC program header.

== SegmentHeader ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| FileOffset
|-
| 0x4
| 0x4
| MemoryOffset
|-
| 0x8
| 0x4
| DecompressedSize
|}

== .rodata-relative extent ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 4
| RegionRoDataOffset
|-
| 0x4
| 4
| RegionSize
|}

== MOD ==
All offsets are signed 32bit values relative to the magic field.
The 32bits at image base + 4 must point to the magic field.
The MOD structure is designed such that it can be placed at image base and point to itself.
The 2 fields preceding the magic field get copied around with the structure, even if it is relocated to somewhere besides the image base. If MOD is not located at image base, the value at offset 4 must still point to the MOD magic. In the case of .text being at image base, this implies that the first instruction can only be an unconditional branch over the offset literal.
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x00
| 4
| ZeroPadding
|-
| 0x04
| 4
| MagicOffset. Always 8 (so it works when MOD is at image_base + 0).
|-
| 0x08
| 4
| Magic "MOD0"
|-
| 0x0C
| 4
| .dynamic offset
|-
| 0x10
| 4
| .bss start offset
|-
| 0x14
| 4
| .bss end offset
|-
| 0x18
| 4
| .eh_frame_hdr start offset
|-
| 0x1C
| 4
| .eh_frame_hdr end offset
|-
| 0x20
| 4
| offset to runtime-generated module object. typically equal to .bss base.
|}

=Arguments=
Loader maps memory and writes the [[Loader_services#AddProcessToLaunchQueue|arguments]] to {end of rwdata section specified by last SegmentHeader}. Official processes use argdata_addr = {page-aligned _end}. svcQueryMemory is used by official sw to verify that argdata_addr is mapped RW, since this memory is only mapped when arguments are specified via that command. Afterwards, official sw aligns the argdata_addr to 4-bytes. Structure located at argdata_addr:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || This is the total allocated space relative to argdata_addr, used for calculating the max size of the argv ptr array. Normally 0x9000?
|-
| 0x4 || 0x4 || This is the total_bytesize of the actual argdata string.
|-
| 0x8 || 0x18 || Unused by official sw.
|-
| 0x20 || See above || Actual argdata string.
|}

* The copy of the args used with the argv array is written by official processes to actual_argdata_string+actual_argdata_size.
* argv_ptrarray written by official processes is at (args_copy+actual_argdata_size) + 0x9 & ~0x7.

NRO0

2018-05-10T00:35:36Z

FrasierCrane: Finalized NRO format. (Except the NRO start, can't seem to find where this is touched at all. Hope this helps!)

[[Category:File formats]]
NRO is the executable format for non-[[ExeFS]] binaries.

It starts with the NRO-start structure then the "NRO" header and mainly describes .text, .rodata, and .data segments (like a short-form of ELF program headers):

= NRO Start =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Unused
|-
| 0x4
| 0x4
| [[NSO|MOD0]] offset
|-
| 0x8
| 0x8
| Padding
|}

= NRO Header =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Magic "NRO0"
|-
| 0x4
| 0x4
| NRO Format Version (Always 0)
|-
| 0x8
| 4
| size (Total NRO filesize)
|-
| 0xC
| 0x4
| Flags (Unused)
|-
| 0x10
| 0x8 * 3
| SegmentHeader[3] {.text, .ro, .data}
|-
| 0x28
| 0x4
| bssSize
|-
| 0x2C
| 0x4
| Reserved (Unused)
|-
| 0x30
| 0x20
| Value of "build id" from ELF's GNU .note section. Contains variable sized digest, up to 32bytes.
|-
| 0x50
| 0x08
| Reserved (Unused)
|-
| 0x58
| 0x8 * 3
| SegmentHeader[3] {.apiInfo, .dynstr, .dynsym}
|-
|}

== SegmentHeader ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| FileOffset
|-
| 0x4
| 0x4
| Size
|}

=Assets=
This is an optional custom assets section for homebrew, this is located at file offset {NroHeader.size}. See also [https://github.com/switchbrew/switch-tools switch-tools] for implementation.

The below offsets are relative to the beginning of the assets section (AssetHeader).

== AssetHeader ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Magic "ASET"
|-
| 0x4
| 0x4
| Format version, currently 0.
|-
| 0x8
| 0x10
| AssetSection icon. Used by the Homebrew Launcher. Like official icons, this is a 256x256 JPEG.
|-
| 0x18
| 0x10
| AssetSection [[Control.nacp|nacp]]. Used by the Homebrew Launcher.
|-
| 0x28
| 0x10
| AssetSection romfs. Can be used by the application.
|-
|}

== AssetSection ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| Offset
|-
| 0x8
| 0x8
| Size, 0 indicates this section is empty.
|}

NRO0

2018-05-09T17:24:22Z

FrasierCrane: Update some missing NRO headers.

[[Category:File formats]]
NRO is the executable format for non-[[ExeFS]] binaries.

It starts with the NRO-start structure then the "NRO" header and mainly describes .text, .rodata, and .data segments (like a short-form of ELF program headers):

= NRO Start =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Unused
|-
| 0x4
| 0x4
| [[NSO|MOD0]] offset
|-
| 0x8
| 0x8
| Padding
|}

= NRO Header =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Magic "NRO0"
|-
| 0x4
| 0x4
| NRO Format Version (Always 0)
|-
| 0x8
| 4
| size (Total NRO filesize)
|-
| 0xC
| 0x4
| Flags (Unused)
|-
| 0x10
| 0x8 * 3
| SegmentHeader[3]
|-
| 0x28
| 0x4
| bssSize
|-
| 0x2C
| 0x4
| Reserved (Unused)
|-
| 0x30
| 0x20
| Value of "build id" from ELF's GNU .note section. Contains variable sized digest, up to 32bytes.
|-
| 0x50
| 0x10
| Padding
|-
| 0x60
| 0x10
| ?
|}

== SegmentHeader ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| FileOffset
|-
| 0x4
| 0x4
| Size
|}

=Assets=
This is an optional custom assets section for homebrew, this is located at file offset {NroHeader.size}. See also [https://github.com/switchbrew/switch-tools switch-tools] for implementation.

The below offsets are relative to the beginning of the assets section (AssetHeader).

== AssetHeader ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Magic "ASET"
|-
| 0x4
| 0x4
| Format version, currently 0.
|-
| 0x8
| 0x10
| AssetSection icon. Used by the Homebrew Launcher. Like official icons, this is a 256x256 JPEG.
|-
| 0x18
| 0x10
| AssetSection [[Control.nacp|nacp]]. Used by the Homebrew Launcher.
|-
| 0x28
| 0x10
| AssetSection romfs. Can be used by the application.
|-
|}

== AssetSection ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| Offset
|-
| 0x8
| 0x8
| Size, 0 indicates this section is empty.
|}

NSO0

2018-05-09T17:19:54Z

FrasierCrane: Update missing NSO header information.

[[Category:File formats]]
NSO is the main executable format.

It starts with the "NSO" header and mainly describes .text, .rodata, and .data segments (like a short-form of ELF program headers):

= NSO Header =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 4
| Magic "NSO0"
|-
| 0x4
| 4
| NSO Version (Always 0)
|-
| 0x8
| 4
| Reserved (Unused)
|-
| 0xC
| 4
| Flags, bit 0-2: section is compressed, bit 3-5: check section hash when loading
|-
| 0x10
| 0x10 * 3
| SegmentHeader[3]
|-
| 0x40
| 0x20
| Value of "build id" from ELF's GNU .note section. Contains variable sized digest, up to 32bytes.
|-
| 0x60
| 0x4 * 3
| CompressedSize[3]
|-
| 0x6c
| 0x24
| Padding
|-
| 0x90
| 8
| .rodata-relative extents of .dynstr
|-
| 0x98
| 8
| .rodata-relative extents of .dynsym
|-
| 0xA0
| 0x20 * 3
| SHA256 hashes over the decompressed sections using the above byte-sizes: .text, .rodata, and .data.
|-
| 0x100
|
| Compressed sections
|}

Most data in Switch binaries are standard ELF structures, however some are custom.
For example, the MOD header is essentially a replacement for a PT_DYNAMIC program header.

== SegmentHeader ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 4
| FileOffset
|-
| 0x4
| 4
| MemoryOffset
|-
| 0x8
| 4
| DecompressedSize
|-
| 0xC
| 4
| UnkOffset/UnkSize/BssSize
|}

== .rodata-relative extent ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 4
| RegionRoDataOffset
|-
| 0x4
| 4
| RegionSize
|}

== MOD ==
All offsets are signed 32bit values relative to the magic field.
The 32bits at image base + 4 must point to the magic field.
The MOD structure is designed such that it can be placed at image base and point to itself.
The 2 fields preceding the magic field get copied around with the structure, even if it is relocated to somewhere besides the image base. If MOD is not located at image base, the value at offset 4 must still point to the MOD magic. In the case of .text being at image base, this implies that the first instruction can only be an unconditional branch over the offset literal.
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x00
| 4
| ZeroPadding
|-
| 0x04
| 4
| MagicOffset. Always 8 (so it works when MOD is at image_base + 0).
|-
| 0x08
| 4
| Magic "MOD0"
|-
| 0x0C
| 4
| .dynamic offset
|-
| 0x10
| 4
| .bss start offset
|-
| 0x14
| 4
| .bss end offset
|-
| 0x18
| 4
| .eh_frame_hdr start offset
|-
| 0x1C
| 4
| .eh_frame_hdr end offset
|-
| 0x20
| 4
| offset to runtime-generated module object. typically equal to .bss base.
|}

=Arguments=
Loader maps memory and writes the [[Loader_services#AddProcessToLaunchQueue|arguments]] to {end of rwdata section specified by last SegmentHeader}. Official processes use argdata_addr = {page-aligned _end}. svcQueryMemory is used by official sw to verify that argdata_addr is mapped RW, since this memory is only mapped when arguments are specified via that command. Afterwards, official sw aligns the argdata_addr to 4-bytes. Structure located at argdata_addr:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || This is the total allocated space relative to argdata_addr, used for calculating the max size of the argv ptr array. Normally 0x9000?
|-
| 0x4 || 0x4 || This is the total_bytesize of the actual argdata string.
|-
| 0x8 || 0x18 || Unused by official sw.
|-
| 0x20 || See above || Actual argdata string.
|}

* The copy of the args used with the argv array is written by official processes to actual_argdata_string+actual_argdata_size.
* argv_ptrarray written by official processes is at (args_copy+actual_argdata_size) + 0x9 & ~0x7.