Nintendo Switch Brew - User contributions [en]

Product Information

2020-10-30T11:19:55Z

Thomhack50: MKLIVE 047 & 010

This page details miscellaneous Switch product information (serial numbers, product models, etc...).

= Product Models =
{| class="wikitable" border="1"
|-
! Device || Product Code
|-
| Nintendo Switch || HAC
|-
| Nintendo Switch SDEV/EDEV || HAT
|-
| Nintendo Switch Mariko || HAD
|-
| Nintendo Switch Lite || HDH
|}

== Product List ==
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| HAC-001 || Retail Nintendo Switch console
|-
| HAC-002 || AC adapter
|-
| HAC-003 || Nintendo Switch Battery
|-
| HAC-004 ||
|-
| HAC-005 ||
|-
| HAC-006 || Joy-Con battery
|-
| HAC-007 || Dock
|-
| HAC-008 || Gamecard
|-
| HAC-009 || Gamecard case
|-
| HAC-010 || USB charging cable also included in ("Mario Kart Live: Home Circuit")
|-
| HAC-011 || Joy-Con grip
|-
| HAC-012 || Joy-Con charge grip
|-
| HAC-013 || Pro Controller
|-
| HAC-014 || Joy-Con strap
|-
| HAC-015 || Left Joy-Con
|-
| HAC-016 || Right Joy-Con
|-
| HAC-017 || Joy-Con handle
|-
| HAC-018 || Screen protector
|-
| HAC-019 || Left Joy-Con extended battery
|-
| HAC-020 || Right Joy-Con extended battery
|-
| HAC-021 || Carrying case
|-
| HAC-022 || Ring-Con
|-
| HAC-023 || Leg Strap
|-
| HAC-024 || Poké Ball Plus controller
|-
| HAC-025 ||
|-
| HAC-026 ||
|-
| HAC-027 ||
|-
| HAC-028 ||
|-
| HAC-029 || Steelbook Gamecard case
|-
| HAC-030 || Poké Ball Plus battery
|-
| HAC-031 || Charging stand
|-
| HAC-032 ||
|-
| HAC-033 || Left NES controller
|-
| HAC-034 || Right NES controller
|-
| HAC-035 || Left Famicom controller
|-
| HAC-036 || Right Famicom controller
|-
| HAC-037 || Kart ("Mario Kart Live: Home Circuit")
|-
| HAC-038 || Battery for kart ("Mario Kart Live: Home Circuit")
|-
| HAC-039 || Gates ("Mario Kart Live: Home Circuit")
|-
| HAC-040 || Touch Pen ("Super Mario Maker 2")
|-
| HAC-041 || Touch Pen ("Brain Training for Switch")
|-
| HAC-042 || SNES controller
|-
| HAC-043 ||
|-
| HAC-044 || Arrow Markers ("Mario Kart Live: Home Circuit")
|-
| HAC-045 ||
|-
| HAC-046 ||
|-
| HAC-047 || USB charging cable ("Mario Kart Live: Home Circuit") known as HAC-010 not 047
|-
| HAC-048 ||
|-
| HAC-049 ||
|-
| HAC-050 ||
|-
| HAC-051 || Nintendo Labo Toy-Con 1: Variety Kit
|-
| HAC-052 || Nintendo Labo Toy-Con 2: Robot Kit
|-
| HAC-053 || Nintendo Labo Toy-Con 3: Vehicle Kit
|-
| HAC-054 || Nintendo Labo Toy-Con 4: VR Kit
|-
| HAC-055 || Nintendo Labo Storage Box
|}
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| HAT-001 || SDEV Nintendo Switch console
|-
| HAT-002 || EDEV Nintendo Switch console
|-
| HAT-003 || SDEV cradle
|-
| HAT-004 || Relay Box
|}
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| HAC-001-01/HAD-001 || Retail Nintendo Switch Mariko console
|}
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| HDH-001 || Retail Nintendo Switch Lite console
|-
| HDH-002 || HDEV Nintendo Switch console
|-
| HDH-003 || Battery
|-
| HDH-004 || Carrying case
|-
| HDH-005 || Screen protector
|-
| HDH-006 || Flip cover
|}

= Product Serial Numbers =
Serial numbers are composed of at least [[#Prefix|three letters]] followed by ten decimal digits. The tenth digit is a [[#Check_Digit|check digit]], meaning that it is derived from the other digits.

== Prefix ==
Observed prefixes are normally as follows:

* First letter represents the product line:
** "X" (NX)
* Second letter represents the product model:
** "A" (HAC-001; Nintendo Switch console)
** "B" (HAC-015; Left Joy-Con)
** "C" (HAC-016; Right Joy-Con)
** "F" (HAC-007; Dock)
** "H" (HAC-024; Poké Ball Plus controller)
** "J" (HDH-001; Nintendo Switch Lite console)
** "K" (HAC-001-01; Nintendo Switch Mariko console)
** "L" (HAC-033; Left NES controller)
** "M" (HAC-034; Right NES controller)
** "Q" (HAC-037; Kart for "Mario Kart Live: Home Circuit")
** "R" (HAC-042; SNES controller)
** "Z" (HAT-003; SDEV cradle)
* Third letter represents the product region:
** "C" (China)
** "E" (Europe)
** "J" (Japan; and Europe on old models)
** "K" (Korea)
** "L" (All; for development only)
** "W" (Americas)
* Fourth letter is optional:
** "F" (Factory)

== Assembly Line ==
The first two digits immediately after the [[#Prefix|prefix]] represent the assembly line as follows:

{| class="wikitable" border="1"
|-
! Value || Description
|-
| 00 || Unspecified
|-
| 01 || Prototype
|-
| 02 || SDEV
|-
| 03 || EDEV
|-
| 04 || Unknown
|-
| 05 || Unknown
|-
| 06 || HDEV
|-
| 07 || Unknown
|-
| 10 || Retail
|-
| 40 || Retail
|-
| 70 || Retail
|-
| 90 || Refurbished
|}

== Check Digit ==
The check digit is an industry-standard algorithm and is calculated just like it was on the [https://www.3dbrew.org/wiki/Serials#Console_Serial_Numbers 3DS].

To calculate the check digit of a Switch console, separate the non-check digits into "odd" and "even" groups, where the "odd" group is digits in odd-numbered positions, and the "even" group is digits in even-numbered positions. (The first digit is "odd", with "first" representing "1".)

After separating the digits, add the digits in each group together. Multiply the sum of the even digits by 3, then add the sum of the odd digits. To calculate the check digit, take this value modulo 10, and if not 0, subtract from 10.

Example: XAW10075273452

The non-check digits are 1007527345. Separating into odd and even groups, we get the following:

Odds: 1 + 0 + 5 + 7 + 4 = 17 Evens: 0 + 7 + 2 + 3 + 5 = 17

Applying the algorithm, we get ((3 * 17) + 17) % 10 = 8, which is not 0, thus 10 - 8 = 2, matching the example's check digit.

Product Information

2020-10-26T20:09:45Z

Thomhack50: HAC-038

This page details miscellaneous Switch product information (serial numbers, product models, etc...).

= Product Models =
{| class="wikitable" border="1"
|-
! Device || Product Code
|-
| Nintendo Switch || HAC
|-
| Nintendo Switch SDEV/EDEV || HAT
|-
| Nintendo Switch Mariko || HAD
|-
| Nintendo Switch Lite || HDH
|}

== Product List ==
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| HAC-001 || Retail Nintendo Switch console
|-
| HAC-002 || AC adapter
|-
| HAC-003 || Nintendo Switch Battery
|-
| HAC-004 ||
|-
| HAC-005 ||
|-
| HAC-006 || Joy-Con battery
|-
| HAC-007 || Dock
|-
| HAC-008 || Gamecard
|-
| HAC-009 || Gamecard case
|-
| HAC-010 || USB charging cable
|-
| HAC-011 || Joy-Con grip
|-
| HAC-012 || Joy-Con charge grip
|-
| HAC-013 || Pro Controller
|-
| HAC-014 || Joy-Con strap
|-
| HAC-015 || Left Joy-Con
|-
| HAC-016 || Right Joy-Con
|-
| HAC-017 || Joy-Con handle
|-
| HAC-018 || Screen protector
|-
| HAC-019 || Left Joy-Con extended battery
|-
| HAC-020 || Right Joy-Con extended battery
|-
| HAC-021 || Carrying case
|-
| HAC-022 || Ring-Con
|-
| HAC-023 || Leg Strap
|-
| HAC-024 || Poké Ball Plus controller
|-
| HAC-025 ||
|-
| HAC-026 ||
|-
| HAC-027 ||
|-
| HAC-028 ||
|-
| HAC-029 || Steelbook Gamecard case
|-
| HAC-030 || Poké Ball Plus battery
|-
| HAC-031 || Charging stand
|-
| HAC-032 ||
|-
| HAC-033 || Left NES controller
|-
| HAC-034 || Right NES controller
|-
| HAC-035 || Left Famicom controller
|-
| HAC-036 || Right Famicom controller
|-
| HAC-037 || Kart ("Mario Kart Live: Home Circuit")
|-
| HAC-038 || Battery for kart ("Mario Kart Live: Home Circuit")
|-
| HAC-039 || Gates ("Mario Kart Live: Home Circuit")
|-
| HAC-040 || Touch Pen ("Super Mario Maker 2")
|-
| HAC-041 || Touch Pen ("Brain Training for Switch")
|-
| HAC-042 || SNES controller
|-
| HAC-043 ||
|-
| HAC-044 || Arrow Markers ("Mario Kart Live: Home Circuit")
|-
| HAC-045 ||
|-
| HAC-046 ||
|-
| HAC-047 || USB charging cable ("Mario Kart Live: Home Circuit")
|-
| HAC-048 ||
|-
| HAC-049 ||
|-
| HAC-050 ||
|-
| HAC-051 || Nintendo Labo Toy-Con 1: Variety Kit
|-
| HAC-052 || Nintendo Labo Toy-Con 2: Robot Kit
|-
| HAC-053 || Nintendo Labo Toy-Con 3: Vehicle Kit
|-
| HAC-054 || Nintendo Labo Toy-Con 4: VR Kit
|-
| HAC-055 || Nintendo Labo Storage Box
|}
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| HAT-001 || SDEV Nintendo Switch console
|-
| HAT-002 || EDEV Nintendo Switch console
|-
| HAT-003 || SDEV cradle
|-
| HAT-004 || Relay Box
|}
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| HAC-001-01/HAD-001 || Retail Nintendo Switch Mariko console
|}
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| HDH-001 || Retail Nintendo Switch Lite console
|-
| HDH-002 || HDEV Nintendo Switch console
|-
| HDH-003 || Battery
|-
| HDH-004 || Carrying case
|-
| HDH-005 || Screen protector
|-
| HDH-006 || Flip cover
|}

= Product Serial Numbers =
Serial numbers are composed of at least [[#Prefix|three letters]] followed by ten decimal digits. The tenth digit is a [[#Check_Digit|check digit]], meaning that it is derived from the other digits.

== Prefix ==
Observed prefixes are normally as follows:

* First letter represents the product line:
** "X" (NX)
* Second letter represents the product model:
** "A" (HAC-001; Nintendo Switch console)
** "B" (HAC-015; Left Joy-Con)
** "C" (HAC-016; Right Joy-Con)
** "F" (HAC-007; Dock)
** "H" (HAC-024; Poké Ball Plus controller)
** "J" (HDH-001; Nintendo Switch Lite console)
** "K" (HAC-001-01; Nintendo Switch Mariko console)
** "L" (HAC-033; Left NES controller)
** "M" (HAC-034; Right NES controller)
** "Q" (HAC-037; Kart for "Mario Kart Live: Home Circuit")
** "R" (HAC-042; SNES controller)
** "Z" (HAT-003; SDEV cradle)
* Third letter represents the product region:
** "C" (China)
** "E" (Europe)
** "J" (Japan; and Europe on old models)
** "K" (Korea)
** "L" (All; for development only)
** "W" (Americas)
* Fourth letter is optional:
** "F" (Factory)

== Assembly Line ==
The first two digits immediately after the [[#Prefix|prefix]] represent the assembly line as follows:

{| class="wikitable" border="1"
|-
! Value || Description
|-
| 00 || Unspecified
|-
| 01 || Prototype
|-
| 02 || SDEV
|-
| 03 || EDEV
|-
| 04 || Unknown
|-
| 05 || Unknown
|-
| 06 || HDEV
|-
| 07 || Unknown
|-
| 10 || Retail
|-
| 40 || Retail
|-
| 70 || Retail
|-
| 90 || Refurbished
|}

== Check Digit ==
The check digit is an industry-standard algorithm and is calculated just like it was on the [https://www.3dbrew.org/wiki/Serials#Console_Serial_Numbers 3DS].

To calculate the check digit of a Switch console, separate the non-check digits into "odd" and "even" groups, where the "odd" group is digits in odd-numbered positions, and the "even" group is digits in even-numbered positions. (The first digit is "odd", with "first" representing "1".)

After separating the digits, add the digits in each group together. Multiply the sum of the even digits by 3, then add the sum of the odd digits. To calculate the check digit, take this value modulo 10, and if not 0, subtract from 10.

Example: XAW10075273452

The non-check digits are 1007527345. Separating into odd and even groups, we get the following:

Odds: 1 + 0 + 5 + 7 + 4 = 17 Evens: 0 + 7 + 2 + 3 + 5 = 17

Applying the algorithm, we get ((3 * 17) + 17) % 10 = 8, which is not 0, thus 10 - 8 = 2, matching the example's check digit.

Product Information

2020-09-03T17:47:41Z

Thomhack50:

This page details miscellaneous Switch product information (serial numbers, product models, etc...).

= Product Models =
{| class="wikitable" border="1"
|-
! Device || Product Code
|-
| Nintendo Switch || HAC
|-
| Nintendo Switch SDEV/EDEV || HAT
|-
| Nintendo Switch Mariko || HAD
|-
| Nintendo Switch Lite || HDH
|}

== Product List ==
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| HAC-001 || Retail Nintendo Switch console
|-
| HAC-002 || AC adapter
|-
| HAC-003 || Battery
|-
| HAC-004 ||
|-
| HAC-005 ||
|-
| HAC-006 || Joy-Con battery
|-
| HAC-007 || Dock
|-
| HAC-008 || Gamecard
|-
| HAC-009 || Gamecard case
|-
| HAC-010 || USB charging cable
|-
| HAC-011 || Joy-Con grip
|-
| HAC-012 || Joy-Con charge grip
|-
| HAC-013 || Pro Controller
|-
| HAC-014 || Joy-Con strap
|-
| HAC-015 || Left Joy-Con
|-
| HAC-016 || Right Joy-Con
|-
| HAC-017 || Joy-Con handle
|-
| HAC-018 || Screen protector
|-
| HAC-019 || Left Joy-Con extended battery
|-
| HAC-020 || Right Joy-Con extended battery
|-
| HAC-021 || Carrying case
|-
| HAC-022 || Ring-Con
|-
| HAC-023 || Leg Strap
|-
| HAC-024 || Poké Ball Plus controller
|-
| HAC-025 ||
|-
| HAC-026 ||
|-
| HAC-027 ||
|-
| HAC-028 ||
|-
| HAC-029 ||
|-
| HAC-030 || Poké Ball Plus battery
|-
| HAC-031 || Charging stand
|-
| HAC-032 ||
|-
| HAC-033 || Left NES controller
|-
| HAC-034 || Right NES controller
|-
| HAC-035 || Left Famicom controller
|-
| HAC-036 || Right Famicom controller
|-
| HAC-037 || Kart for "Mario Kart Live: Home Circuit"
|-
| HAC-038 ||
|-
| HAC-039 || Gates for "Mario Kart Live: Home Circuit"
|-
| HAC-040 || Touch Pen
|-
| HAC-041 || Touch Pen
|-
| HAC-042 || SNES controller
|-
| HAC-043 ||
|-
| HAC-044 ||
|-
| HAC-045 ||
|-
| HAC-046 ||
|-
| HAC-047 ||
|-
| HAC-048 ||
|-
| HAC-049 ||
|-
| HAC-050 ||
|-
| HAC-051 || Nintendo Labo Toy-Con 1: Variety Kit
|-
| HAC-052 || Nintendo Labo Toy-Con 2: Robot Kit
|-
| HAC-053 || Nintendo Labo Toy-Con 3: Vehicle Kit
|-
| HAC-054 || Nintendo Labo Toy-Con 4: VR Kit
|}
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| HAT-001 || SDEV Nintendo Switch console
|-
| HAT-002 || EDEV Nintendo Switch console
|-
| HAT-003 || SDEV cradle
|-
| HAT-004 || Relay Box
|}
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| HAC-001-01/HAD-001 || Retail Nintendo Switch Mariko console
|}
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| HDH-001 || Retail Nintendo Switch Lite console
|-
| HDH-002 || HDEV Nintendo Switch console
|-
| HDH-003 || Battery
|-
| HDH-004 || Carrying case
|-
| HDH-005 || Screen protector
|-
| HDH-006 || Flip cover
|}

= Product Serial Numbers =
Serial numbers are composed of at least [[#Prefix|three letters]] followed by ten decimal digits. The tenth digit is a [[#Check_Digit|check digit]], meaning that it is derived from the other digits.

== Prefix ==
Observed prefixes are normally as follows:

* First letter represents the product line:
** "X" (NX)
* Second letter represents the product model:
** "A" (HAC-001; Nintendo Switch console)
** "B" (HAC-015; Left Joy-Con)
** "C" (HAC-016; Right Joy-Con)
** "F" (HAC-007; Dock)
** "H" (HAC-024; Poké Ball Plus controller)
** "J" (HDH-001; Nintendo Switch Lite console)
** "K" (HAC-001-01; Nintendo Switch Mariko console)
** "L" (HAC-033; Left NES controller)
** "M" (HAC-034; Right NES controller)
** "R" (HAC-042; SNES controller)
** "Z" (HAT-003; SDEV cradle)
* Third letter represents the product region:
** "C" (China)
** "E" (Europe)
** "J" (Japan; and Europe on old models)
** "K" (Korea)
** "L" (All; for development only)
** "W" (Americas)
* Fourth letter is optional:
** "F" (Factory)

== Assembly Line ==
The first two digits immediately after the [[#Prefix|prefix]] represent the assembly line as follows:

{| class="wikitable" border="1"
|-
! Value || Description
|-
| 00 || Unspecified
|-
| 01 || Prototype
|-
| 02 || SDEV
|-
| 03 || EDEV
|-
| 04 || Unknown
|-
| 05 || Unknown
|-
| 06 || HDEV
|-
| 07 || Unknown
|-
| 10 || Retail
|-
| 40 || Retail
|-
| 70 || Retail
|-
| 90 || Refurbished
|}

== Check Digit ==
The check digit is an industry-standard algorithm and is calculated just like it was on the [https://www.3dbrew.org/wiki/Serials#Console_Serial_Numbers 3DS].

To calculate the check digit of a Switch console, separate the non-check digits into "odd" and "even" groups, where the "odd" group is digits in odd-numbered positions, and the "even" group is digits in even-numbered positions. (The first digit is "odd", with "first" representing "1".)

After separating the digits, add the digits in each group together. Multiply the sum of the even digits by 3, then add the sum of the odd digits. To calculate the check digit, take this value modulo 10, and if not 0, subtract from 10.

Example: XAW10075273452

The non-check digits are 1007527345. Separating into odd and even groups, we get the following:

Odds: 1 + 0 + 5 + 7 + 4 = 17 Evens: 0 + 7 + 2 + 3 + 5 = 17

Applying the algorithm, we get ((3 * 17) + 17) % 10 = 8, which is not 0, thus 10 - 8 = 2, matching the example's check digit.

XCI

2020-08-12T05:32:24Z

Thomhack50: boot is not only Tencent

Known internally as "XCI" (NX Card Image), this is the format used for storing the contents of a Nintendo Switch Gamecard.

= Gamecard Header =
This header is 0x200 bytes and is located at offset 0 in the Gamecard.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x100
| RSA-2048 PKCS #1 signature over the header (data from 0x100 to 0x200)
|-
| 0x100
| 0x4
| Magicnum "HEAD"
|-
| 0x104
| 0x4
| Secure Area Start Address (in Media Units which are 0x200 bytes)
|-
| 0x108
| 0x4
| Backup Area Start Address (always 0xFFFFFFFF)
|-
| 0x10C
| 0x1
| TitleKeyDec Index (high nibble) and KEK Index (low nibble)
|-
| 0x10D
| 0x1
| [[#Gamecard Size|Gamecard Size]]
|-
| 0x10E
| 0x1
| Gamecard Header Version
|-
| 0x10F
| 0x1
| [[#Gamecard Flags|Gamecard Flags]]
|-
| 0x110
| 0x8
| Package ID (used for challenge–response authentication)
|-
| 0x118
| 0x8
| Valid Data End Address (in Media Units which are 0x200 bytes)
|-
| 0x120
| 0x10
| Gamecard Info IV (reversed)
|-
| 0x130
| 0x8
| HFS0 partition offset
|-
| 0x138
| 0x8
| HFS0 header size
|-
| 0x140
| 0x20
| SHA-256 hash of the [[#HFS0 Header|HFS0 Header]]
|-
| 0x160
| 0x20
| SHA-256 hash of the [[#Initial Data|Initial Data]]
|-
| 0x180
| 0x4
| Security Mode (0x01 = T1, 0x02 = T2)
|-
| 0x184
| 0x4
| T1 Key Index (always 2)
|-
| 0x188
| 0x4
| Key Index (always 0)
|-
| 0x18C
| 0x4
| Normal Area End Address (in Media Units which are 0x200 bytes)
|-
| 0x190
| 0x70
| [[#Gamecard Info|Gamecard Info]] (AES-128-CBC encrypted)
|}

== Gamecard Size ==
[[Filesystem_services|FS]] retrieves this data as [[Filesystem_services#GameCardSize|GameCardSize]].

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0xFA
| 1GB
|-
| 0xF8
| 2GB
|-
| 0xF0
| 4GB
|-
| 0xE0
| 8GB
|-
| 0xE1
| 16GB
|-
| 0xE2
| 32GB
|}

== Gamecard Flags ==
[[Filesystem_services|FS]] retrieves this data as [[Filesystem_services#GameCardAttribute|GameCardAttribute]].

{| class="wikitable" border="1"
|-
! Bits
! Description
|-
| 0
| AutoBoot
|-
| 1
| HistoryErase
|-
| 2
| [4.0.0+] RepairTool
|-
| 3
| [9.0.0+] DifferentRegionCupToTerraDevice
|-
| 4
| [9.0.0+] DifferentRegionCupToGlobalDevice
|}

== Gamecard Info ==
When decrypted, this 0x70 byte region is as follows:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| Firmware Version (0x00 = Development, 0x01 = Retail, [4.0.0+] 0x02 = Retail)
|-
| 0x8
| 0x4
| Access Control (0x00A10011 = 25MHz access, 0x00A10010 = 50MHz access)
|-
| 0xC
| 0x4
| Read Time Wait1 (always 0x1388)
|-
| 0x10
| 0x4
| Read Time Wait2 (always 0)
|-
| 0x14
| 0x4
| Write Time Wait1 (always 0)
|-
| 0x18
| 0x4
| Write Time Wait2 (always 0)
|-
| 0x1C
| 0x4
| Firmware Mode
|-
| 0x20
| 0x4
| CUP Version
|-
| 0x24
| 0x1
| [9.0.0+] Compatibility Type (0x00 = Normal, 0x01 = Terra)
|-
| 0x25
| 0x3
| Empty
|-
| 0x28
| 0x8
| Update Partition Hash
|-
| 0x30
| 0x8
| CUP ID (always 0x0100000000000816, which is the title-listing data archive's title ID)
|-
| 0x38
| 0x38
| Empty
|}

= Gamecard Certificate =
This is the Gamecard's unique certificate and is located at offset 0x7000.

[[Filesystem_services|FS]] retrieves this data with [[Filesystem_services#GetGameCardDeviceCertificate|GetGameCardDeviceCertificate]].

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x100
| RSA-2048 PKCS #1 signature over the data from 0x100 to 0x200
|-
| 0x100
| 0x4
| Magicnum "CERT"
|-
| 0x104
| 0x4
| Empty
|-
| 0x108
| 0x1
| KEK Index
|-
| 0x109
| 0x7
| Empty
|-
| 0x110
| 0x10
| Device ID
|-
| 0x120
| 0x10
| Unknown
|-
| 0x130
| 0xD0
| Encrypted data
|}

The data between the Gamecard Certificate and the start of the HFS0 region is all 0xFF, except for one BOTW cart that has been found, inwhich it is 0x00.

= Initial Data =
This data is used for challenge–response authentication when changing to the Gamecard's secure mode.

[[Filesystem_services|FS]] calculates a SHA-256 hash over the whole 0x200 bytes and compares it with the hash stored at offset 0x160 in the [[#Gamecard Header|Gamecard Header]].

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| Package ID from [[#Gamecard Header|Gamecard Header]] at offset 0x110
|-
| 0x8
| 0x8
| Empty
|-
| 0x10
| 0x10
| Challenge–response authentication data
|-
| 0x20
| 0x10
| Challenge–response authentication MAC
|-
| 0x30
| 0xC
| Challenge–response authentication Nonce
|-
| 0x3C
| 0x1C4
| Reserved (must be empty)
|}

= HFS0 =
This is the Gamecard file system which starts with magicnum "HFS0".

== Header ==
The "SHA-256 File System" or "HFS0" starts at offset 0xF000 in the Gamecard. The first 0x200 bytes act as a global header and represent the root partition which points to the other partitions ("normal", "logo", "update" and "secure).

A hash for this header is stored at offset 0x140 in the [[#Gamecard Header|Gamecard Header]].

== File System ==
The actual file system is as follows (also valid for the root partition):

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Magicnum "HFS0"
|-
| 0x4
| 0x4
| Number of files
|-
| 0x8
| 0x4
| Size of the string table
|-
| 0xC
| 0x4
| Zero/Reserved
|-
| 0x10
| X
| File Entry Table
|-
| 0x10 + X
| Y
| String Table
|-
| 0x10 + X + Y
| Z
| Raw File Data
|}

Where File Entry Table consists of Number of Files FileEntries:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| Offset of file in Data
|-
| 0x8
| 0x8
| Size of file in Data
|-
| 0x10
| 0x4
| Offset of filename in String Table
|-
| 0x14
| 0x4
| Size of Hashed region of file (for HFS0s, this is the size of the pre-filedata portion, for NCAs this is usually 0x200)
|-
| 0x18
| 8
| Zero/Reserved
|-
| 0x20
| 0x20
| SHA-256 hash of the first (size of hashed region) bytes of filedata
|}

The string table is 00-padded to align the start of raw filedata with a sector/media unit boundary (usually?).

= Cartridge Layout =
Observed gamecards contain three partitions: "update", "normal", and "secure".

The update partition (Gamecard partition 0 for fsp-srv cmd 31) contains .cnmt.nca + .nca files for the entire system update required to play the game. Launch day carts contain a full copy of 1.0 ncas, newer carts contain newer sysupdate NCAs etc.

The normal partition contains the .cnmt.nca and the game icondata nca. This is presumably for future compatibility so that if a future update changes the cryptographic protocol for the secure partition, Game icon data can still be shown in the home menu on old firmwares.

The secure partition contains an identical copy of the .cnmt.nca and game icondata nca, as well as all other ncas required for the game.

The entire rest of the Gamecard after the secure partition ends is all FF padding.

[4.0.0+] The "normal" partition is now empty and a new partition "logo" was added.
A partition "boot" got added with exact same content than "logo".

XCI

2020-07-11T14:03:21Z

Thomhack50: Tencent card

Known internally as "XCI" (NX Card Image), this is the format used for storing the contents of a Nintendo Switch Gamecard.

= Gamecard Header =
This header is 0x200 bytes and is located at offset 0 in the Gamecard.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x100
| RSA-2048 PKCS #1 signature over the header (data from 0x100 to 0x200)
|-
| 0x100
| 0x4
| Magicnum "HEAD"
|-
| 0x104
| 0x4
| Secure Area Start Address (in Media Units which are 0x200 bytes)
|-
| 0x108
| 0x4
| Backup Area Start Address (always 0xFFFFFFFF)
|-
| 0x10C
| 0x1
| TitleKeyDec Index (high nibble) and KEK Index (low nibble)
|-
| 0x10D
| 0x1
| [[#Gamecard Size|Gamecard Size]]
|-
| 0x10E
| 0x1
| Gamecard Header Version
|-
| 0x10F
| 0x1
| [[#Gamecard Flags|Gamecard Flags]]
|-
| 0x110
| 0x8
| Package ID (used for challenge–response authentication)
|-
| 0x118
| 0x8
| Valid Data End Address (in Media Units which are 0x200 bytes)
|-
| 0x120
| 0x10
| Gamecard Info IV (reversed)
|-
| 0x130
| 0x8
| HFS0 partition offset
|-
| 0x138
| 0x8
| HFS0 header size
|-
| 0x140
| 0x20
| SHA-256 hash of the [[#HFS0 Header|HFS0 Header]]
|-
| 0x160
| 0x20
| SHA-256 hash of the [[#Initial Data|Initial Data]]
|-
| 0x180
| 0x4
| Security Mode (0x01 = T1, 0x02 = T2)
|-
| 0x184
| 0x4
| T1 Key Index (always 2)
|-
| 0x188
| 0x4
| Key Index (always 0)
|-
| 0x18C
| 0x4
| Normal Area End Address (in Media Units which are 0x200 bytes)
|-
| 0x190
| 0x70
| [[#Gamecard Info|Gamecard Info]] (AES-128-CBC encrypted)
|}

== Gamecard Size ==
[[Filesystem_services|FS]] retrieves this data as [[Filesystem_services#GameCardSize|GameCardSize]].

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0xFA
| 1GB
|-
| 0xF8
| 2GB
|-
| 0xF0
| 4GB
|-
| 0xE0
| 8GB
|-
| 0xE1
| 16GB
|-
| 0xE2
| 32GB
|}

== Gamecard Flags ==
[[Filesystem_services|FS]] retrieves this data as [[Filesystem_services#GameCardAttribute|GameCardAttribute]].

{| class="wikitable" border="1"
|-
! Bits
! Description
|-
| 0
| AutoBoot
|-
| 1
| HistoryErase
|-
| 2
| [4.0.0+] RepairTool
|-
| 3
| [9.0.0+] DifferentRegionCupToTerraDevice
|-
| 4
| [9.0.0+] DifferentRegionCupToGlobalDevice
|}

== Gamecard Info ==
When decrypted, this 0x70 byte region is as follows:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| Firmware Version (0x00 = Development, 0x01 = Retail, [4.0.0+] 0x02 = Retail)
|-
| 0x8
| 0x4
| Access Control (0x00A10011 = 25MHz access, 0x00A10010 = 50MHz access)
|-
| 0xC
| 0x4
| Read Time Wait1 (always 0x1388)
|-
| 0x10
| 0x4
| Read Time Wait2 (always 0)
|-
| 0x14
| 0x4
| Write Time Wait1 (always 0)
|-
| 0x18
| 0x4
| Write Time Wait2 (always 0)
|-
| 0x1C
| 0x4
| Firmware Mode
|-
| 0x20
| 0x4
| CUP Version
|-
| 0x24
| 0x1
| [9.0.0+] Compatibility Type (0x00 = Normal, 0x01 = Terra)
|-
| 0x25
| 0x3
| Empty
|-
| 0x28
| 0x8
| Update Partition Hash
|-
| 0x30
| 0x8
| CUP ID (always 0x0100000000000816, which is the title-listing data archive's title ID)
|-
| 0x38
| 0x38
| Empty
|}

= Gamecard Certificate =
This is the Gamecard's unique certificate and is located at offset 0x7000.

[[Filesystem_services|FS]] retrieves this data with [[Filesystem_services#GetGameCardDeviceCertificate|GetGameCardDeviceCertificate]].

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x100
| RSA-2048 PKCS #1 signature over the data from 0x100 to 0x200
|-
| 0x100
| 0x4
| Magicnum "CERT"
|-
| 0x104
| 0x4
| Empty
|-
| 0x108
| 0x1
| KEK Index
|-
| 0x109
| 0x7
| Empty
|-
| 0x110
| 0x10
| Device ID
|-
| 0x120
| 0x10
| Unknown
|-
| 0x130
| 0xD0
| Encrypted data
|}

The data between the Gamecard Certificate and the start of the HFS0 region is all 0xFF, except for one BOTW cart that has been found, inwhich it is 0x00.

= Initial Data =
This data is used for challenge–response authentication when changing to the Gamecard's secure mode.

[[Filesystem_services|FS]] calculates a SHA-256 hash over the whole 0x200 bytes and compares it with the hash stored at offset 0x160 in the [[#Gamecard Header|Gamecard Header]].

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| Package ID from [[#Gamecard Header|Gamecard Header]] at offset 0x110
|-
| 0x8
| 0x8
| Empty
|-
| 0x10
| 0x10
| Challenge–response authentication data
|-
| 0x20
| 0x10
| Challenge–response authentication MAC
|-
| 0x30
| 0xC
| Challenge–response authentication Nonce
|-
| 0x3C
| 0x1C4
| Reserved (must be empty)
|}

= HFS0 =
This is the Gamecard file system which starts with magicnum "HFS0".

== Header ==
The "SHA-256 File System" or "HFS0" starts at offset 0xF000 in the Gamecard. The first 0x200 bytes act as a global header and represent the root partition which points to the other partitions ("normal", "logo", "update" and "secure).

A hash for this header is stored at offset 0x140 in the [[#Gamecard Header|Gamecard Header]].

== File System ==
The actual file system is as follows (also valid for the root partition):

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Magicnum "HFS0"
|-
| 0x4
| 0x4
| Number of files
|-
| 0x8
| 0x4
| Size of the string table
|-
| 0xC
| 0x4
| Zero/Reserved
|-
| 0x10
| X
| File Entry Table
|-
| 0x10 + X
| Y
| String Table
|-
| 0x10 + X + Y
| Z
| Raw File Data
|}

Where File Entry Table consists of Number of Files FileEntries:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| Offset of file in Data
|-
| 0x8
| 0x8
| Size of file in Data
|-
| 0x10
| 0x4
| Offset of filename in String Table
|-
| 0x14
| 0x4
| Size of Hashed region of file (for HFS0s, this is the size of the pre-filedata portion, for NCAs this is usually 0x200)
|-
| 0x18
| 8
| Zero/Reserved
|-
| 0x20
| 0x20
| SHA-256 hash of the first (size of hashed region) bytes of filedata
|}

The string table is 00-padded to align the start of raw filedata with a sector/media unit boundary (usually?).

= Cartridge Layout =
Observed gamecards contain three partitions: "update", "normal", and "secure".

The update partition (Gamecard partition 0 for fsp-srv cmd 31) contains .cnmt.nca + .nca files for the entire system update required to play the game. Launch day carts contain a full copy of 1.0 ncas, newer carts contain newer sysupdate NCAs etc.

The normal partition contains the .cnmt.nca and the game icondata nca. This is presumably for future compatibility so that if a future update changes the cryptographic protocol for the secure partition, Game icon data can still be shown in the home menu on old firmwares.

The secure partition contains an identical copy of the .cnmt.nca and game icondata nca, as well as all other ncas required for the game.

The entire rest of the Gamecard after the secure partition ends is all FF padding.

[4.0.0+] The "normal" partition is now empty and a new partition "logo" was added.
[CHINA -TENCENT] On tencent cartridge for China, A partition "boot" got added with exact same content than "logo".

System Versions

2020-06-05T05:29:41Z

Thomhack50: 10.0.4

{| class="wikitable"
|-
! System version
! Release date
! Package1 build date
! [[NCA_Format|SDK versions]]
|-
| [[1.0.0]]
| Before console release
| 2016-11-21 18:30:08
|
|-
| [[2.0.0]]
| March 2, 2017
| 2017-02-10 15:51:24
| 1.2.2 - 1.3.2
|-
| [[2.1.0]]
| March 27, 2017
| 2017-02-10 15:51:24
|
|-
| [[2.2.0]]
| April 17, 2017
| 2017-02-10 15:51:24
|
|-
| [[2.3.0]]
| May 15, 2017
| 2017-02-10 15:51:24
|
|-
| [[3.0.0]]
| June 19, 2017
| 2017-05-19 10:14:10
|
|-
| [[3.0.1]]
| July 31, 2017
| 2017-07-10 16:17:58
|
|-
| [[3.0.2]]
| September 5, 2017
| 2017-07-10 16:17:58
|
|-
| [[4.0.0]]
| October 18, 2017
| 2017-09-21 17:26:29
| 4.4.0
|-
| [[4.0.1]]
| October 25, 2017
| 2017-09-21 17:26:29
|
|-
| [[4.1.0]]
| December 4, 2017
| 2017-09-21 17:26:29
|
|-
| [[5.0.0]]
| March 12, 2018
| 2018-02-20 16:37:47
|
|-
| [[5.0.1]]
| March 26, 2018
| 2018-02-20 16:37:47
|
|-
| [[5.0.2]]
| April 16, 2018
| 2018-02-20 16:37:47
|
|-
| [[5.1.0]]
| May 30, 2018
| 2018-02-20 16:37:47
|
|-
| [[6.0.0]]
| September 18, 2018
| 2018-08-02 16:27:53
|
|-
| [[6.0.1]]
| October 8, 2018
| 2018-08-02 16:27:53
|
|-
| [[6.1.0]]
| October 29, 2018
| 2018-08-02 16:27:53
|
|-
| [[6.2.0]]
| November 19, 2018
| 2018-11-07 10:57:33
|
|-
| [[7.0.0]]
| January 28, 2019
| 2018-12-18 17:57:30
| 7.2.1 - 7.3.0
|-
| [[7.0.1]]
| February 18, 2019
| 2019-02-08 15:00:37
| 7.3.0
|-
| [[8.0.0]]
| April 15, 2019
| 2019-03-14 17:20:56
| 8.1.0 - 8.2.99
|-
| [[8.0.1]]
| April 23, 2019
| 2019-03-14 17:20:56
| 8.1.0 - 8.2.0
|-
| [[8.1.0]]
| June 17, 2019
| 2019-05-31 15:24:32
| 8.1.0 - 8.2.0
|-
| [[8.1.1]]
|
| 2019-05-31 15:24:32
| 8.1.0 - 8.2.99
|-
| [[9.0.0]]
| September 9, 2019
| 2019-08-09 13:57:09
| 9.2.2 - 9.3.0
|-
| [[9.0.1]]
| September 30, 2019
| 2019-08-09 13:57:09
| 9.2.2 - 9.3.0
|-
| [[9.1.0]]
| December 4, 2019
| 2019-10-21 11:38:48
| 9.2.3 - 9.3.0
|-
| [[9.2.0]]
| March 3, 2020 (UTC)
| 2019-10-21 11:38:48
| 9.3.0
|-
| [[10.0.0]]
| April 14, 2020 (UTC)
| 2020-03-03 10:46:06
| 10.2.0-10.4.0
|-
| [[10.0.1]]
| April 22, 2020 (UTC)
| 2020-03-03 10:46:06
| 10.4.0
|-
| [[10.0.2]]
| April 30, 2020 (UTC)
| 2020-03-03 10:46:06
| 10.4.0
|-
| [[10.0.3]]
| May 26, 2020 (UTC)
| 2020-03-03 10:46:06
| 10.4.0
|-
| [[10.0.4]]
| June 5, 2020 (UTC)
| 2020-03-03 10:46:06?
| 10.4.0
|}

Product Information

2019-07-20T07:17:07Z

Thomhack50: Add Nintendo Labo family

This page details miscellaneous Switch product information (serial numbers, product models, etc...).

= Product Models =
{| class="wikitable" border="1"
|-
! Device || Product Code
|-
| Switch || HAC
|-
| Switch SDEV/EDEV || HAT
|-
| Switch Lite || HDH
|}

== Product List ==
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| HAC-001 || Retail Switch console.
|-
| HAC-001-01 || New retail Switch console.
|-
| HAC-002 || AC adapter.
|-
| HAC-003 || Battery.
|-
| HAC-004 ||
|-
| HAC-005 ||
|-
| HAC-006 || Joy-Con battery.
|-
| HAC-007 || Dock.
|-
| HAC-008 || Gamecard.
|-
| HAC-009 || Gamecard case.
|-
| HAC-010 || USB charging cable.
|-
| HAC-011 || Joy-Con grip.
|-
| HAC-012 || Joy-Con charge grip.
|-
| HAC-013 || Pro Controller.
|-
| HAC-014 || Joy-Con strap.
|-
| HAC-015 || Left Joy-Con.
|-
| HAC-016 || Right Joy-Con.
|-
| HAC-017 || Joy-Con handle.
|-
| HAC-018 || Screen protector.
|-
| HAC-019 || Left Joy-Con extended battery.
|-
| HAC-020 || Right Joy-Con extended battery.
|-
| HAC-021 || Carrying case.
|-
| HAC-022 ||
|-
| HAC-023 ||
|-
| HAC-024 || Poké Ball Plus controller.
|-
| HAC-025 ||
|-
| HAC-026 ||
|-
| HAC-027 ||
|-
| HAC-028 ||
|-
| HAC-029 ||
|-
| HAC-030 || Poké Ball Plus battery.
|-
| HAC-031 || Charging stand.
|-
| HAC-032 ||
|-
| HAC-033 || Left NES controller.
|-
| HAC-034 || Right NES controller.
|-
| HAC-035 || Left Famicom controller.
|-
| HAC-036 || Right Famicom controller.
|-
| HAC-037 ||
|-
| HAC-038 ||
|-
| HAC-039 ||
|-
| HAC-040 || Touch Pen.
|-
| HAC-041 ||
|-
| HAC-042 ||
|-
| HAC-043 ||
|-
| HAC-044 ||
|-
| HAC-045 ||
|-
| HAC-046 ||
|-
| HAC-047 ||
|-
| HAC-048 ||
|-
| HAC-049 ||
|-
| HAC-050 ||
|-
| HAC-051 || Nintendo Labo Toy-Con 1 : Variety Kit.
|-
| HAC-052 || Nintendo Labo Toy-Con 2 : Robot Kit. (To confirm.)
|-
| HAC-053 || Nintendo Labo Toy-Con 3 : Vehicle Kit.
|-
| HAC-054 || Nintendo Labo Toy-Con 4 : VR Kit.
|}
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| HAT-001 || SDEV Switch console.
|-
| HAT-002 || EDEV Switch console.
|-
| HAT-003 || SDEV cradle.
|-
| HAT-004 || Relay Box.
|}
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| HDH-001 || Retail Switch Lite console.
|}

Joy-Con

2018-09-29T13:07:17Z

Thomhack50:

Joy-Con is the name for the Switch's primary game controllers. The controllers communicate to the console through bluetooth and can be disconnected from the main unit.

==Hardware==
The controllers themselves are simple to disassemble and identify.
[[File:JoyconFront.jpg|400px|thumb|The front of the Joy-Con internal[https://www.ifixit.com/Teardown/Nintendo+Switch+Teardown/78263]]]
[[File:JoyconRear.jpg|400px|thumb|The rear of the Joy-Con internal[https://www.ifixit.com/Teardown/Nintendo+Switch+Teardown/78263]]]
{| class="wikitable"
! Color || Item
|-
| Red || Broadcom BCM20734 Bluetooth 4.1/2.4 GHz Transceiver
|-
| Orange || STMicroelectronics NFCBEA 812006 33 (Likely NFC reader IC)
|-
| Yellow|| Macronix International MX25U4033E 4 Mb CMOS Flash
|}

==Firmware==
''See also: [[Joy-Con Firmware]]''

The firmware of the Joy-Cons seems to be generic across all instances. Details such as the handedness of the controller and the color is just indicated in a configuration part of the flash. Judging by quick glance at the firmware, it's probably identical to that used on the Pro Controller as well.
{| class="wikitable"
! Controller || 1.0.0
|-
| Joy-Con Left (Blue) || [[:File:pad.L.bin|flash dump]]
|-
| Joy-Con Right (Red) || [[:File:pad.R.bin|flash dump]]
|}
The flash is in a patch-ram format. Tools for dealing with it are available [https://github.com/shuffle2/nxpad].
A dump of the ROM region (taken while firmware was running) can be found [[:File:bcm20734_rom.bin|here]]. Note this is the same SoC used on the other controller models, as well.

== Left & Right Separate Joy-con ==

When paired directly to a computer over bluetooth, the joy-con both provide identical HID input report descriptor. This does not appear to include motion controls, IR data, or NFC. They both behave as detached single-player controllers.

HID Input Report Descriptor (Hexadecimal):
<pre>
00000000: 05010905 A1010601 FF852109 21750895 ....¡...ÿ…!.!u.•
00000010: 30810285 30093075 08953081 02853109 0..…0.0u.•0..…1.
00000020: 31750896 69018102 85320932 75089669 1u.–i...…2.2u.–i
00000030: 01810285 33093375 08966901 8102853F ...…3.3u.–i...…?
00000040: 05091901 29101500 25017501 95108102 ....)...%.u.•...
00000050: 05010939 15002507 75049501 81420509 ...9..%.u.•..B..
00000060: 75049501 81010501 09300931 09330934 u.•......0.1.3.4
00000070: 16000027 FFFF0000 75109504 81020601 ...'ÿÿ..u.•.....
00000080: FF850109 01750895 30910285 10091075 ÿ…...u.•0‘.…...u
00000090: 08953091 02851109 11750895 30910285 .•0‘.…...u.•0‘.…
000000A0: 12091275 08953091 02C0 ...u.•0‘.À
</pre>

{| class="wikitable"
! Parsed Bytes || Description
|-
|0x05, 0x01, || Usage Page (Generic Desktop Ctrls)
|-
|0x09, 0x05, || Usage (Game Pad)
|-
|0xA1, 0x01, || Collection (Application)
|-
|0x06, 0x01, 0xFF, || Usage Page (Vendor Defined 0xFF01)
|-
|0x85, 0x21, || Report ID (33)
|-
|0x09, 0x21, || Usage (0x21)
|-
|0x75, 0x08, || Report Size (8)
|-
|0x95, 0x30, || Report Count (48)
|-
|0x81, 0x02, || Input (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position)
|-
|0x85, 0x30, || Report ID (48)
|-
|0x09, 0x30, || Usage (0x30)
|-
|0x75, 0x08, || Report Size (8)
|-
|0x95, 0x30, || Report Count (48)
|-
|0x81, 0x02, || Input (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position)
|-
|0x85, 0x31, || Report ID (49)
|-
|0x09, 0x31, || Usage (0x31)
|-
|0x75, 0x08, || Report Size (8)
|-
|0x96, 0x69, 0x01, || Report Count (361)
|-
|0x81, 0x02, || Input (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position)
|-
|0x85, 0x32, || Report ID (50)
|-
|0x09, 0x32, || Usage (0x32)
|-
|0x75, 0x08, || Report Size (8)
|-
|0x96, 0x69, 0x01, || Report Count (361)
|-
|0x81, 0x02, || Input (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position)
|-
|0x85, 0x33, || Report ID (51)
|-
|0x09, 0x33, || Usage (0x33)
|-
|0x75, 0x08, || Report Size (8)
|-
|0x96, 0x69, 0x01, || Report Count (361)
|-
|0x81, 0x02, || Input (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position)
|-
|0x85, 0x3F, || Report ID (63)
|-
|0x05, 0x09, || Usage Page (Button)
|-
|0x19, 0x01, || Usage Minimum (0x01)
|-
|0x29, 0x10, || Usage Maximum (0x10)
|-
|0x15, 0x00, || Logical Minimum (0)
|-
|0x25, 0x01, || Logical Maximum (1)
|-
|0x75, 0x01, || Report Size (1)
|-
|0x95, 0x10, || Report Count (16)
|-
|0x81, 0x02, || Input (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position)
|-
|0x05, 0x01, || Usage Page (Generic Desktop Ctrls)
|-
|0x09, 0x39, || Usage (Hat switch)
|-
|0x15, 0x00, || Logical Minimum (0)
|-
|0x25, 0x07, || Logical Maximum (7)
|-
|0x75, 0x04, || Report Size (4)
|-
|0x95, 0x01, || Report Count (1)
|-
|0x81, 0x42, || Input (Data,Var,Abs,No Wrap,Linear,Preferred State,Null State)
|-
|0x05, 0x09, || Usage Page (Button)
|-
|0x75, 0x04, || Report Size (4)
|-
|0x95, 0x01, || Report Count (1)
|-
|0x81, 0x01, || Input (Const,Array,Abs,No Wrap,Linear,Preferred State,No Null Position)
|-
|0x05, 0x01, || Usage Page (Generic Desktop Ctrls)
|-
|0x09, 0x30, || Usage (X)
|-
|0x09, 0x31, || Usage (Y)
|-
|0x09, 0x33, || Usage (Rx)
|-
|0x09, 0x34, || Usage (Ry)
|-
|0x16, 0x00, 0x00, || Logical Minimum (0)
|-
|0x27, 0xFF, 0xFF, 0x00, 0x00, || Logical Maximum (65534)
|-
|0x75, 0x10, || Report Size (16)
|-
|0x95, 0x04, || Report Count (4)
|-
|0x81, 0x02, || Input (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position)
|-
|0x06, 0x01, 0xFF, || Usage Page (Vendor Defined 0xFF01)
|-
|0x85, 0x01, || Report ID (1)
|-
|0x09, 0x01, || Usage (0x01)
|-
|0x75, 0x08, || Report Size (8)
|-
|0x95, 0x30, || Report Count (48)
|-
|0x91, 0x02, || Output (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
|-
|0x85, 0x10, || Report ID (16)
|-
|0x09, 0x10, || Usage (0x10)
|-
|0x75, 0x08, || Report Size (8)
|-
|0x95, 0x30, || Report Count (48)
|-
|0x91, 0x02, || Output (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
|-
|0x85, 0x11, || Report ID (17)
|-
|0x09, 0x11, || Usage (0x11)
|-
|0x75, 0x08, || Report Size (8)
|-
|0x95, 0x30, || Report Count (48)
|-
|0x91, 0x02, || Output (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
|-
|0x85, 0x12, || Report ID (18)
|-
|0x09, 0x12, || Usage (0x12)
|-
|0x75, 0x08, || Report Size (8)
|-
|0x95, 0x30, || Report Count (48)
|-
|0x91, 0x02, || Output (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
|-
|0xC0, || End Collection
|}

==Colors==
HEX codes for the colors shown in the "Controllers" menu of the Switch UI can be found in a Joy-con SPI dump starting at offset 0x6050. Body color is first followed by button color and each is 3 bytes long. These values are able to be re-written with any HEX color value to make the Joy-cons show up as different colors in the UI. The following is a list of official HEX colors recovered from SPI dumps.
{| class="wikitable"
! Color Name || Body HEX || Button HEX
|-
| Gray || #828282 || #0F0F0F
|-
| Neon Red || #FF3C28 || #1E0A0A
|-
| Neon Blue || #0AB9E6 || #001E1E
|-
| Neon Yellow || #E6FF00 || #142800
|-
| Neon Green || #1EDC00 || #002800
|-
| Neon Pink || #FF3278 || #28001E
|-
| Mario Red || #E10F00 || #280A0A
|-
| Nintendo Labo "creators contest" || #D7AA73 || #1E1914
|-
| Black Pro Controller || #323232 or #323231 || ?
|}

==Additional Links==
[https://github.com/dekuNukem/Nintendo_Switch_Reverse_Engineering Reverse Engineering of the Joy-Con by Github user dekuNukem]

User:Thomhack50

2018-01-01T09:52:14Z

Thomhack50: Blanked the page

User:Thomhack50

2018-01-01T09:51:09Z

Thomhack50: Created page with "Fan of Hack, Thomhack50 is a undiscovered hacker He is french and he is like contribuate to forum like this ."

Fan of Hack,
Thomhack50 is a undiscovered hacker
He is french and he is like contribuate to forum like this .

Internet Browser

2017-12-31T18:51:43Z

Thomhack50: shopn computer

Nintendo Switch does not have a normal Internet Browser for user usage. However, there is multiple browser applets. It is the [https://web.archive.org/web/20170304075230/https://gl.access-company.com/news_event/archives/2017/170303/ NetFront NX] browser, which is based on Webkit.

When linking the Nintendo Account with Facebook, the Facebook Auth website will open, offering a search box that can be used to browse the Internet ("LoginApplet"). Alternatively, it can be accessed with [https://gbatemp.net/threads/web-browser-kind-of-on-the-switch.463094/ custom DNS settings] which simulate a Wi-Fi login page ("WifiWebAuthApplet" for captive-portal).

== Known User Agent Strings ==
{| class='wikitable'
! System Version
! UA String
|-
| [[1.0.0]]
| Mozilla/5.0 (Nintendo Switch; <appletname>) AppleWebKit/601.6 (KHTML, like Gecko) NF/4.0.0.4.25 NintendoBrowser/5.1.0.11682
|-
| [[2.0.0]]
| Mozilla/5.0 (Nintendo Switch; <appletname>) AppleWebKit/601.6 (KHTML, like Gecko) NF/4.0.0.5.9 NintendoBrowser/5.1.0.13341
|-
| [[2.1.0]]-[[2.3.0]]
| Mozilla/5.0 (Nintendo Switch; <appletname>) AppleWebKit/601.6 (KHTML, like Gecko) NF/4.0.0.5.10 NintendoBrowser/5.1.0.13343
|-
| [[3.0.0]]
| Mozilla/5.0 (Nintendo Switch; <appletname>) AppleWebKit/601.6 (KHTML, like Gecko) NF/4.0.0.6.9 NintendoBrowser/5.1.0.14936
|-
| [[4.0.0]]
| Mozilla/5.0 (Nintendo Switch; <appletname>) AppleWebKit/601.6 (KHTML, like Gecko) NF/4.0.0.7.9 NintendoBrowser/5.1.0.15785
|}

The UA is generated with: "Mozilla/5.0 (Nintendo Switch; <appletname>) AppleWebKit/<webkitver> (KHTML, like Gecko) NF/<nfver0>.<nfver1>.<nfver2> NintendoBrowser/5.<ninver0>.<ninver1>.<ninver2>"

== Browser Applets ==
{| class='wikitable'
! appletname (From UA)
! Usage
! Invalid TLS cert handling
! Uses whitelist
! Title ID
! Notes
|-
| WebApplet
| General web-applet for use by applications(online manuals, ...).
| Displays an error dialog without an option to ignore it.
| Yes
| 010000000000100A
|
|-
| ShopN
| Actual eShop client
| Just displays an error-code.
| Yes
| 010000000000100B
|
|-
| WebApplet
| Offline HTML display
|
|
| 010000000000100F
|
|-
| LoginApplet
| Nintendo Account linking
| Just displays an error-code.
| Yes
| 0100000000001010
|
|-
| ShareApplet
| Posting screenshots to social media, and (optionally) linking social media accounts
| Just displays an error-code.
| Yes
| 0100000000001010
|
|-
| LobbyApplet
| Related to online-multiplayer lobbies
| Just displays an error-code.
| Yes
| 0100000000001010
|
|-
| WifiWebAuthApplet
| Captive-portal
| Displays an error dialog with an option to ignore it.
| No
| 0100000000001011
|
|}

When whitelisting is enabled, you can only load page domains included in the whitelist, otherwise an error is displayed. This only applies to page navigation. Videos via the <video> tag are not affected, likewise with network requests with JS.

No known applets can directly access the SD card via mounting it. This includes ShareApplet (which posts screenshots from SD to social media).

== OSS ==
The NROs for the OSS are stored under a separate [[Title_list|title]]. All of the web-applets use the same OSS NROs via this title.

String from v2.0 in oss_wkc.nro: "libcurl/7.50.1".

== Video Playback ==
WifiWebAuthApplet does not fully support playing videos. It will [[Error_codes|assert]] with normal videos. The assert triggers before it even starts MP4 parsing?(For example, selecting a video from a video-tag will assert even though it doesn't send any network request for it) However, in some cases with certain MP4s using vulns it will display an error dialog instead.

With v3.0 WifiWebAuthApplet video-playback was disabled, it now throws the following error when attempting to play a video: "Support Code: 2809-1212" "This feature is not available." On past system-versions it would just trigger a fatal-error(see above). Video-playback which already worked fine under whitelisted-applet, still works fine on v3.0.

== Trusted RootCAs ==
While the rootCA(s) for Let's Encrypt isn't included, Let's Encrypt is indirectly trusted via "Digital Signature Trust Co.". This seems to be only(?) the case for WifiWebAuthApplet, hence non-WifiWebAuthApplet seems to have a different set of trusted rootCAs.

== WifiWebAuthApplet ==
When doing a connection-test in system-settings, it will detect that the captive-portal is required and display an error for it when the response for "http://conntest.nintendowifi.net/" doesn't include the "X-Organization: Nintendo" HTTP header. The web-applet will not load until something else attempts a conntest, for example when launching eShop and prior to LoginApplet launching. The initial page loaded by this applet is the above conntest URL.

This is only available starting with [[2.0.0]].

Prior to version [[3.0.0]], this applet was launched when attempting a system update from recovery mode if needed. This was changed to display a "This feature is not available." popup instead.

==Whitelisted Applets==
The v2.1 main-codebin page-aligned .text size is 0x1000-bytes larger than ShopN.

The file at "data:/whitelist/WhitelistLns.txt" for LoginApplet/ShareApplet/LobbyApplet, which doesn't exist in WifiWebAuthApplet, contains the following:

<nowiki>^https://([0-9A-Za-z\-]+\.)*nintendo\.net(/|$)
^https?://([0-9A-Za-z\-]+\.)*nintendo\.(co\.jp|com|eu|co\.uk|es|pt|ch|at|de|nl|be|ch|ru|fr|it|co\.za|co\.kr|tw|com\.hk|com\.au|ca|co\.nz)(/|$)
^https?://([0-9A-Za-z\-]+\.)*nintendo-europe\.com(/|$)
^https?://([0-9A-Za-z\-]+\.)*nintendoservicecentre\.co\.uk(/|$)
^https?://([0-9A-Za-z\-]+\.)*google\.(com|ad|ae|com\.af|com\.ag|com\.ai|al|am|co\.ao|com\.ar|as|at|com\.au|az|ba|com\.bd|be|bf|bg|com\.bh|bi|bj|com\.bn|com\.bo|com\.br|bs|bt|co\.bw|by|com\.bz|ca|cd|cf|cg|ch|ci|co\.ck|cl|cm|cn|com\.co|co\.cr|com\.cu|cv|com\.cy|cz|de|dj|dk|dm|com\.do|dz|com\.ec|ee|com\.eg|es|com\.et|fi|com\.fj|fm|fr|ga|ge|gg|com\.gh|com\.gi|gl|gm|gp|gr|com\.gt|gy|com\.hk|hn|hr|ht|hu|co\.id|ie|co\.il|im|co\.in|iq|is|it|je|com\.jm|jo|co\.jp|co\.ke|com\.kh|ki|kg|co\.kr|com\.kw|kz|la|com\.lb|li|lk|co\.ls|lt|lu|lv|com\.ly|co\.ma|md|me|mg|mk|ml|com\.mm|mn|ms|com\.mt|mu|mv|mw|com\.mx|com\.my|co\.mz|com\.na|com\.nf|com\.ng|com\.ni|ne|nl|no|com\.np|nr|nu|co\.nz|com\.om|com\.pa|com\.pe|com\.pg|com\.ph|com\.pk|pl|pn|com\.pr|ps|pt|com\.py|com\.qa|ro|ru|rw|com\.sa|com\.sb|sc|se|com\.sg|sh|si|sk|com\.sl|sn|so|sm|sr|st|com\.sv|td|tg|co\.th|com\.tj|tk|tl|tm|tn|to|com\.tr|tt|com\.tw|co\.tz|com\.ua|co\.ug|co\.uk|com\.uy|co\.uz|com\.vc|co\.ve|vg|co\.vi|com\.vn|vu|ws|rs|co\.za|co\.zm|co\.zw|cat)(/|$)
^https://([0-9A-Za-z\-]+\.)*facebook\.com(/|$)
^https://([0-9A-Za-z\-]+\.)*twitter\.com(/|$)</nowiki>

===ShareApplet===
The initial page loaded by this applet depends on a flag. <nowiki>non-val1: "https://web-lp1.share.srv.nintendo.net/" val1: "https://web-lp1.share.srv.nintendo.net/settings/"</nowiki>

The server will return a HTTP 302 redirect to <nowiki>"https://nintendo.com/"</nowiki> when the specified User-Agent isn't the one for ShareApplet.

===LobbyApplet===
The initial page loaded by this applet is: <nowiki>"https://web-lp1.znc.srv.nintendo.net/lobby/"</nowiki>.

The content of the above URL refers to "rooms", "NxView_Img_Google_Play_Icon", etc.

And also:
Your room has been created.

You can invite friends to the room via
the Nintendo Switch Online Lounge app.

== ShopN ==
The initial page loaded by ShopN seems to be the following: <nowiki>"https://bugyo.hac.lp1.eshop.nintendo.net/ashigaru/"</nowiki>.
This can be accessed via computer possesed the certificat ShopN.

The file at "data:/whitelist/WhitelistEc.txt", which doesn't exist in WifiWebAuthApplet, contains the following:

<nowiki>^https://([0-9A-Za-z\-]+\.)*eshop\.nintendo\.net($|/)
^https?://([0-9A-Za-z\-]+\.)*nintendo\.(co\.jp|com|de)($|/)</nowiki>

== WebApplet ==
===010000000000100A===
The initial page loaded by this applet is specified by the title which launched this applet. Plain HTTP is allowed.

The files under "data:/" are identical to WifiWebAuthApplet except that the content of each file differs.

This applet uses a whitelist, but it doesn't come from "data:/" like whitelisted-applet.

==== WebApplet launch with Tetris ====
The Tetris game/demo can be used to launch the online-WebApplet. This ''only'' applies to the JPN region of the game/demo: "ぷよぷよ™テトリス®Ｓ"(aka "Puyo Puyo Tetris"). Note that the gamecard for this can be used to launch the online-WebApplet on system-version >=1.0.0.

First, launch the offline-WebApplet for the manual:
* Game: Main-menu -> press A with the already selected top menu button -> press the R button.
* Demo: Main-menu -> select menu button on the right side -> press A.

Then in the manual:
* Press A -> select the bottom menu entry in the list.
* Select the SEGA icon -> press A.

The offline-WebApplet will then launch the online-WebApplet with the plain-http <nowiki>"http://sega.jp/"</nowiki> URL. Non-JPN regions of Tetris don't have any external link in the manual. For example, with your own DNS-server setup to return your own server address for this domain, you can load your own content for use with online-WebApplet.

As of 12/01/2017 this still works on the latest update for Tetris (version 1.1.2).

=== Offline Applet ===
Minus TIDs, the [[NPDM]] is the same as 010000000000100A except 010000000000100A has access to more/other services.

== Service/FS Access ==
All browser applets have access to the following services: acc:u1, appletAE, audin:u, audren:u, audout:u, bsd:u, fatal:u, fsp-srv, hid, hid:sys, irs, ldn:m, ldr:ro, lm, erpt:c, nifm:s, ns:am, nsd:u, nvdrv:a, mm:u, pl:u, prepo:s, set, set:sys, sfdnsres, ssl, time:u, vi:s

LoginApplet/ShareApplet/LobbyApplet have access to the above + caps:a.

ShopN has access to the above + nim:shp.

Unlike the applets listed above, WebApplet TID 010000000000100A has access to the [[Filesystem_services|FS]] MountContent* commands. This is so that it can load the whitelist from "/accessible-urls/accessible-urls.txt" in the mounted FS, from [[NCA]]-type4 where titleID={application which launched this applet}.

== Heap ==

The size used for [[SVC|svcSetHeapSize]] by the web-applets is 0x15600000. Under ShopN, the largest size that can be passed to this without an error being returned, is 0x1B400000.

== Versions ==

=== [[1.0.0]] ===
"shareddata:/buildinfo/buildinfo.dat" content:
r:11682
p:NX64
v:Pilot
d:2016-11-25 23:30
n:0.4.25

=== [[2.0.0]] ===

"shareddata:/buildinfo/buildinfo.dat" content:
r:13341
p:NX64
v:Release
d:2017-02-13 22:57
n:0.5.9

=== [[2.1.0]] ===
See [[Switch_Userland_Flaws|here]] for vuln-related changes.

The WebKit NRO was updated. For the WebKit NRO, the page-aligned size for the R-X, R--, and RW- pages are the same as v2.0.
* The actual code in the NRO starts differing starting at offset 0xE780. In v2.0 the offset following the last code instruction is text_lastpage+0x3F8(text_end-0xC08), while for v2.1 it's text_lastpage+0xE60(text_end-0x1A0). Compared to the previous version, there's a val0 u32(padding) inserted where the code for the import stubs begin, near the end of .text. Relative to that end offset going backwards, .text differs starting at v2.0 textbase+0xD56530 / v2.1 textbase+0xD56F94.
* The R-- section was updated. Besides the large table(?) which was updated(nothing was added/removed there), the strings containing "D:/for_cruiser/release_182/nx/webkit/" were updated: "182" was changed to "189". 0x10-bytes at offset 0x57292C were removed. 0x8-bytes were inserted at offset 0x14B2B5C in the v2.1 section. 0x8-bytes were inserted at offset 0x14B5C10 in the v2.1 section. ...
* The RW- section was updated, mainly for different addrs. Nothing was added/removed. Most(?)/all(?) main-codebin func import-addrs relative to main-codebin-base are the same as v2.0.

Main-codebin region(titleID 010000000000100B):
* rtld is same as before basically, minus addrs. Likewise for the "nnSdkEmpty" binary following the main-codebin.
* Various byte values were changed in the main .text.
* In the main R-- section:
** The length of a string used with the user-agent changed, due to being changed from "{...}.9" to "{...}.10".
** The version in the following string was changed from "1.2.2" to "1.2.3": "FS_ACCESS: { sdk_versio n: 1.2.3, spec: NX }"
** The datetime strings following "b/23876444" was changed from "Feb 10 2017" "02:24:47" to "Mar 9 201 7" "21:41:27".
** A 0x10-byte block prior to SDK library tag strings was updated. The version in those strings was changed from "1_2_2" to "1_2_3".
* The main RW- section appears to be basically the same minus addrs.

All of the other NROs were updated in FS with only the following changes:
* The R-X section is identical to the previous version except for the 0x10-byte block in the NRO header.
* The R-- section only had version values in "/release_{ver}/" strings updated, see the for_cruiser path mentioned for WebKit NRO above. The only other change was that a 0x10-byte block following a "GNU" string was updated.

==== FS ====
The content of "blacklist:/" and "oceanShared:/" haven't changed. Only the content of "shareddata:/" and "data:/" changed.

===== "shareddata:/" =====
The following files were updated here(nothing added/removed):

* /buildinfo/buildinfo.dat
* /dll/cairo_wkc.nro
* /dll/libfont.nro
* /dll/oss_wkc.nro
* /dll/peer_wkc.nro
* /dll/webkit_wkc.nro

That is, every .nro under the above directory was updated.

"shareddata:/buildinfo/buildinfo.dat" content:
r:13343
p::NX64
v:Release
d:2017-03-14 21:08
n:0.5.10

===== "data:/" =====
The following files were updated here(nothing added/removed):

* /.nrr/netfront.nrr
* /buildinfo/buildinfo.dat

=== [[3.0.1]] ===
While main-codebin .text was updated, no actual code was changed.

The .nss path string in main-codebin was changed from "Q:\work\LibraryApplet\..." to "Q:\work\nup\LibraryApplet\...".

See [[3.0.1|here]] regarding "shareddata:/" buildinfo.