Nintendo Switch Brew - User contributions [en]

NCA

2020-03-30T15:53:57Z

TotalJustice: /* HierarchicalIntegrity */

The entire raw NCAs are encrypted.

The only known area which is not encrypted in the raw NCA is the logo section, when the NCA includes that section. Everything else documented on this page is for the plaintext version of that data.

= Encryption =
The first 0xC00 bytes are encrypted with AES-XTS with sector size 0x200 with a non-standard "tweak" (endianness is reversed, see [https://gist.github.com/SciresM/fe8a631d13c069bd66e9c656ab5b3f7f here]), this encrypted data is an 0x400 NCA header + an 0x200 header for each section in the section table.

For pre-1.0.0 "NCA2" NCAs, the first 0x400 byte are encrypted the same way as in NCA3. However, each section header is individually encrypted as though it were sector 0, instead of the appropriate sector as in NCA3.

= Header =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x100
| RSA-2048 signature over the header (data from 0x200 to 0x400) using a fixed key
|-
| 0x100
| 0x100
| RSA-2048 signature over the header (data from 0x200 to 0x400) using a key from [[NPDM]] (or zeroes if not a program)
|-
| 0x200
| 0x4
| Magicnum "NCA3" ("NCA2", "NCA1" or "NCA0" for pre-1.0.0 NCAs)
|-
| 0x204
| 0x1
| DistributionType (0x00 = System NCA, 0x01 = Gamecard NCA)
|-
| 0x205
| 0x1
| ContentType (0x00 = Program, 0x01 = Meta, 0x02 = Control, 0x03 = Manual, 0x04 = Data, 0x05 = PublicData)
|-
| 0x206
| 0x1
| KeyGenerationOld (0x00 = [[1.0.0]], 0x01 = Unused, 0x02 = [[3.0.0]])
|-
| 0x207
| 0x1
| KeyAreaEncryptionKeyIndex (0x00 = Application, 0x01 = Ocean, 0x02 = System)
|-
| 0x208
| 0x8
| ContentSize
|-
| 0x210
| 0x8
| ProgramId
|-
| 0x218
| 0x4
| ContentIndex
|-
| 0x21C
| 0x4
| SdkAddonVersion (used in "FS_ACCESS: { sdk_version: {byte3}.{byte2}.{byte1}, ..." with byte0 set to 0 and compared with a required minimum value: 0x000B0000)
|-
| 0x220
| 0x1
| KeyGeneration (0x03 = [[3.0.1]], 0x04 = [[4.0.0]], 0x05 = [[5.0.0]], 0x06 = [[6.0.0]], 0x07 = [[6.2.0]], 0x08 = [[7.0.0]], 0x09 = [[8.1.0]], 0x0A = [[9.0.0]], 0x0B = [[9.1.0]], 0xFF = Invalid)
|-
| 0x221
| 0x1
| [9.0.0+] Header1SignatureKeyGeneration (0 or 1)
|-
| 0x222
| 0xE
| Reserved
|-
| 0x230
| 0x10
| RightsId
|-
| 0x240
| 0x10 * 4
| Array of [[#FsEntry|FsEntry]]
|-
| 0x280
| 0x20 * 4
| Array of SHA256 hashes (over each [[#FsHeader|FsHeader]])
|-
| 0x300
| 0x10 * 4
| EncryptedKeyArea
|}

When the above '''KeyGenerationOld''' field is 0x2 on >= v3.0, different {crypto/keydata} is used for the sections' data. With system content, this is used with every ncatype except ncatype0. The only other exception is {data-content} for the firm titles: this is required in order for older-system-versions to install it.

'''KeyGeneration''' 0x3 (with '''KeyGenerationOld''' set to 0x2) is used for all [[3.0.1]] sysmodules and the [[System_Version_Title]]. With [[3.0.2]], all updated titles use the crypto from [[3.0.1]] for non-ncatype0, except for firm {data-content}. In some cases various game content uses the above newer crypto as well.

'''KeyGeneration''' is always '''MasterKeyVersion''' + 1, except for generations 0 and 1 which are both version 0.

The keyindex passed to <key-generation-related code> is determined as follows:
* Pre-[[3.0.0]]: The '''KeyAreaEncryptionKeyIndex''' field (0x207) is passed directly.
* [[3.0.0]]+: It's determined using the '''KeyAreaEncryptionKeyIndex''' field (0x207) and the '''KeyGenerationOld''' field (0x206). The latter field must be 0, 1 or 2. In each ncahdr_keyindex block, it executes "if(ncahdr_x206>=3)<panic>", but that won't trigger due to the earlier check. The end result is basically the same as pre-[[3.0.0]], except when ncahdr_x206 == 0x2, final_index is new_base_index+ncahdr_keyindex. Actual implementation loads index from u32_array[ncahdr_crypto_type], where the address of u32_array is different for each ncahdr_keyindex.
* [[3.0.1]]+: The dedicated range check for the '''KeyGenerationOld''' field (0x206) was removed, since the updated code no longer needs it. The output from a function masked with 0xFF is now used instead of ncahdr_x206. The range check for that field was changed from {ncahdr_x206 check with panic described above}, to "if(index>=4)final_index=10;"(skips accessing the array and uses 10 directly). The arrays were updated with an additional entry: final_index=v301_base_index+ncahdr_keyindex.
** The keydata for the above index10 is not(?) known to be initialized.
** The new function called by the code described above does:
** <code>if(ncahdr_x206 < ncahdr_x220){ret = ncahdr_x220; } else { ret = ncahdr_x206; } return ret;</code>

== FsEntry ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| StartOffset (in Media Units which are 0x200 bytes)
|-
| 0x4
| 0x4
| EndOffset (in Media Units which are 0x200 bytes)
|-
| 0x8
| 0x4
| Reserved
|-
| 0xC
| 0x4
| Reserved
|}

= FsHeader =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x2
| Version (always 2)
|-
| 0x2
| 0x1
| FsType (0 = RomFs, 1 = PartitionFs)
|-
| 0x3
| 0x1
| HashType (0 = Auto, 2 = HierarchicalSha256, 3 = HierarchicalIntegrity)
|-
| 0x4
| 0x1
| EncryptionType (0 = Auto, 1 = None, 2 = AesCtrOld, 3 = AesCtr, 4 = AesCtrEx)
|-
| 0x5
| 0x1
| Padding
|-
| 0x8
| 0xF8
| [[#HashInfo|HashInfo]]
|-
| 0x100
| 0x40
| [[#PatchInfo|PatchInfo]] (only used with game updates RomFs)
|-
| 0x140
| 0x4
| Generation
|-
| 0x144
| 0x4
| SecureValue
|-
| 0x148
| 0x30
| SparseInfo (only used in sections with sparse storage)
|-
| 0x178
| 0x88
| Reserved
|}

The FsHeader for each section is at absoluteoffset+0x400+(sectionid*0x200), where sectionid corresponds to the index used with the entry/hash tables.

== HashInfo ==
This contains information specific to the hash type in use.

=== HierarchicalSha256 ===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x20
| SHA256 hash over the hash-table at section-start+0 with the below hash-table size
|-
| 0x20
| 0x4
| Block size in bytes
|-
| 0x24
| 0x4
| Must be 0x2
|-
| 0x28
| 0x8
| Offset of hash-table (normally zero)
|-
| 0x30
| 0x8
| Size of hash-table
|-
| 0x38
| 0x8
| Offset relative to section-start where the PFS0 header is located
|-
| 0x40
| 0x8
| Actual byte-size of the PFS0 filesystem relative to the PFS0 header
|-
| 0x48
| 0xB0
| Reserved
|}

=== HierarchicalIntegrity ===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Magicnum "IVFC"
|-
| 0x4
| 0x4
| Magic Number (0x20000)
|-
| 0xC
| 0x4
| Master hash size?
|-
| 0x10
| 0x4
| Usually 7? Unknown, could be related to total number of levels maybe?
|-
| 0x14
| 0x8
| Level 1 offset
|-
| 0x1C
| 0x8
| Level 1 size
|-
| 0x20
| 0x4
| Level 1 block size (in log2)
|-
| 0x24
| 0x4
| Reserved
|-
| 0x28
| 0x8
| Level 2 offset
|-
| 0x30
| 0x8
| Level 2 size
|-
| 0x38
| 0x4
| Level 2 block size (in log2)
|-
| 0x3C
| 0x4
| Reserved
|-
| 0x40
| 0x8
| Level 3 offset
|-
| 0x48
| 0x8
| Level 3 size
|-
| 0x50
| 0x4
| Level 3 block size (in log2)
|-
| 0x54
| 0x4
| Reserved
|-
| 0x58
| 0x8
| Level 4 offset
|-
| 0x60
| 0x8
| Level 4 size
|-
| 0x68
| 0x4
| Level 4 block size (in log2)
|-
| 0x6C
| 0x4
| Reserved
|-
| 0x70
| 0x8
| Level 5 offset
|-
| 0x78
| 0x8
| Level 5 size
|-
| 0x80
| 0x4
| Level 5 block size (in log2)
|-
| 0x84
| 0x4
| Reserved
|-
| 0x88
| 0x8
| Level 6 offset
|-
| 0x90
| 0x8
| Level 6 size
|-
| 0x98
| 0x4
| Level 6 block size (in log2)
|-
| 0x9C
| 0x4
| Reserved
|-
| 0xA0
| 0x20
| Reserved
|-
| 0xC0
| 0x20
| Hash
|}

== PatchInfo ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| Offset
|-
| 0x8
| 0x8
| Size
|-
| 0x10
| 0x4
| Magicnum "BKTR"
|-
| 0x14
| 0x4
| u32, must be <=1.
|-
| 0x18
| 0x4
| s32, must be >=1.
|-
| 0x1C
| 0x4
|
|-
| 0x20
| 0x20
| Same as the above 0x20-bytes except with different data.
|}

The above byte-offsets are relative to the start of the section-data.

The two sections specified by the two BKTR entries are usually(?) at the very end of the section data(section_endoffset-{size of BKTR sections}).

=== RomFs Patching ===
The [[#PatchInfo|PatchInfo]] section enables combining data from an update NCA with the RomFs from a base NCA to create a single patched RomFS image.

The first BKTR entry describes how to map regions of the two RomFs images to create the patched RomFs. It has the following format:
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Padding/Unused?
|-
| 0x4
| 0x4
| Number of Buckets
|-
| 0x8
| 0x8
| Total Size of the Virtual RomFS Image
|-
| 0x10
| 0x3FF0
| Base Virtual Offset for each Bucket (u64s, padded with 0s until end)
|-
| 0x4000
| 0x4000*X
| Relocation Buckets
|}

Where relocation buckets are as follows:
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Padding/Unused?
|-
| 0x4
| 0x4
| Number of Entries
|-
| 0x8
| 0x8
| End offset for this Bucket
|-
| 0x10
| 0x3FF0
| Relocation Entries
|}

Where relocation entries are as follows:
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| Address in Patched RomFs
|-
| 0x8
| 0x8
| Address in Source RomFs
|-
| 0x10
| 0x4
| 1=Is from Patch RomFS, 0=Is from Base RomFS
|}

The second BKTR entry describes the subsections within the Patch RomFs. It has the following format:
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Padding/Unused?
|-
| 0x4
| 0x4
| Number of Buckets
|-
| 0x8
| 0x8
| Total Size of the Physical Patch Image
|-
| 0x10
| 0x3FF0
| Base Physical Offset for each Bucket (u64s, padded with 0s until end)
|-
| 0x4000
| 0x4000*X
| Subsection Buckets
|}

Where subsection buckets are as follows:
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Padding/Unused?
|-
| 0x4
| 0x4
| Number of Entries
|-
| 0x8
| 0x8
| End offset for this Bucket
|-
| 0x10
| 0x3FF0
| Subsection Entries
|}

Where subsection entries are as follows:
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| Address in Patch RomFs
|-
| 0x8
| 0x4
| Padding/Unused?
|-
| 0xC
| 0x4
| Value for subsection AES-CTR
|}

Official code assumes the relocation entries are sorted, and performs a binary search when determining where to read from. Each subsection in the Patch RomFs has its CTR calculated separately from the others based on the value in its entry (the BKTR entries use normal crypto). Thus decrypting a Patch RomFS requires decrypting and parsing the BKTR entries before anything else.

= Logo Section =
This is a PFS0.

See [[NCA_Content_FS|here]] for the mounted-FS logo contents.

= ExeFS Section =
This is a PFS0.

See [[ExeFS|here]] for mounted-FS ExeFS contents.

= Game Updates =
The section-data for ncatype1 RomFS section(section1) uses section-crypto-type 0x4.

Game updates also contain multiple ncatype6 content, which contain "section0_pfs0/fragment". Some of these are just NCAs, unknown for the rest(presumably NCAs with additional crypto?). The first ncatype6 content fragment file has a NDV0 header, with the NCA starting at offset 0x44.

= PFS0 =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| {Hash-table offset from superblock}
| {Hash-table size from superblock}
| Table of SHA256 hashes.
|-
| {Hash-table <offset+size> from superblock}
|
| Zeros for alignment to {alignment size}.
|-
| {PFS0 offset from superblock}
| {PFS0 size from superblock}
| The actual PFS0.
|}

This is the FS which has magicnum "PFS0" at header+0. This is very similar to [[Gamecard_Format|HFS0]]. A tool for extracting this FS is available [https://gist.github.com/yellows8/1a96c2b846f4ebc4bb45d7f7fa1eb7db here].

The hash table is hashes for every {Block size from superblock} starting at the PFS0 header. The size used for the last hash is {PFS0 filesystem size from superblock} - offset_relativeto_header.

See also the PFS0 superblock above.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Magicnum "PFS0"
|-
| 0x4
| 0x4
| Number of files
|-
| 0x8
| 0x4
| Size of the string table
|-
| 0xC
| 0x4
| Zero/Reserved
|-
| 0x10
| X
| File Entry Table
|-
| 0x10 + X
| Y
| String Table
|-
| 0x10 + X + Y
| Z
| Raw File Data
|}

Where File Entry Table consists of Number of Files FileEntries:
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| Offset of file in Data
|-
| 0x8
| 0x8
| Size of file in Data
|-
| 0x10
| 0x4
| Offset of filename in String Table
|-
| 0x14
| 0x4
| Normally zero?
|}

NCA

2020-03-30T15:33:02Z

TotalJustice: /* Header */

The entire raw NCAs are encrypted.

The only known area which is not encrypted in the raw NCA is the logo section, when the NCA includes that section. Everything else documented on this page is for the plaintext version of that data.

= Encryption =
The first 0xC00 bytes are encrypted with AES-XTS with sector size 0x200 with a non-standard "tweak" (endianness is reversed, see [https://gist.github.com/SciresM/fe8a631d13c069bd66e9c656ab5b3f7f here]), this encrypted data is an 0x400 NCA header + an 0x200 header for each section in the section table.

For pre-1.0.0 "NCA2" NCAs, the first 0x400 byte are encrypted the same way as in NCA3. However, each section header is individually encrypted as though it were sector 0, instead of the appropriate sector as in NCA3.

= Header =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x100
| RSA-2048 signature over the header (data from 0x200 to 0x400) using a fixed key
|-
| 0x100
| 0x100
| RSA-2048 signature over the header (data from 0x200 to 0x400) using a key from [[NPDM]] (or zeroes if not a program)
|-
| 0x200
| 0x4
| Magicnum "NCA3" ("NCA2", "NCA1" or "NCA0" for pre-1.0.0 NCAs)
|-
| 0x204
| 0x1
| DistributionType (0x00 = System NCA, 0x01 = Gamecard NCA)
|-
| 0x205
| 0x1
| ContentType (0x00 = Program, 0x01 = Meta, 0x02 = Control, 0x03 = Manual, 0x04 = Data, 0x05 = PublicData)
|-
| 0x206
| 0x1
| KeyGenerationOld (0x00 = [[1.0.0]], 0x01 = Unused, 0x02 = [[3.0.0]])
|-
| 0x207
| 0x1
| KeyAreaEncryptionKeyIndex (0x00 = Application, 0x01 = Ocean, 0x02 = System)
|-
| 0x208
| 0x8
| ContentSize
|-
| 0x210
| 0x8
| ProgramId
|-
| 0x218
| 0x4
| ContentIndex
|-
| 0x21C
| 0x4
| SdkAddonVersion (used in "FS_ACCESS: { sdk_version: {byte3}.{byte2}.{byte1}, ..." with byte0 set to 0 and compared with a required minimum value: 0x000B0000)
|-
| 0x220
| 0x1
| KeyGeneration (0x03 = [[3.0.1]], 0x04 = [[4.0.0]], 0x05 = [[5.0.0]], 0x06 = [[6.0.0]], 0x07 = [[6.2.0]], 0x08 = [[7.0.0]], 0x09 = [[8.1.0]], 0x0A = [[9.0.0]], 0x0B = [[9.1.0]], 0xFF = Invalid)
|-
| 0x221
| 0x1
| [9.0.0+] Header1SignatureKeyGeneration (0 or 1)
|-
| 0x222
| 0xE
| Reserved
|-
| 0x230
| 0x10
| RightsId
|-
| 0x240
| 0x10 * 4
| Array of [[#FsEntry|FsEntry]]
|-
| 0x280
| 0x20 * 4
| Array of SHA256 hashes (over each [[#FsHeader|FsHeader]])
|-
| 0x300
| 0x10 * 4
| EncryptedKeyArea
|}

When the above '''KeyGenerationOld''' field is 0x2 on >= v3.0, different {crypto/keydata} is used for the sections' data. With system content, this is used with every ncatype except ncatype0. The only other exception is {data-content} for the firm titles: this is required in order for older-system-versions to install it.

'''KeyGeneration''' 0x3 (with '''KeyGenerationOld''' set to 0x2) is used for all [[3.0.1]] sysmodules and the [[System_Version_Title]]. With [[3.0.2]], all updated titles use the crypto from [[3.0.1]] for non-ncatype0, except for firm {data-content}. In some cases various game content uses the above newer crypto as well.

'''KeyGeneration''' is always '''MasterKeyVersion''' + 1, except for generations 0 and 1 which are both version 0.

The keyindex passed to <key-generation-related code> is determined as follows:
* Pre-[[3.0.0]]: The '''KeyAreaEncryptionKeyIndex''' field (0x207) is passed directly.
* [[3.0.0]]+: It's determined using the '''KeyAreaEncryptionKeyIndex''' field (0x207) and the '''KeyGenerationOld''' field (0x206). The latter field must be 0, 1 or 2. In each ncahdr_keyindex block, it executes "if(ncahdr_x206>=3)<panic>", but that won't trigger due to the earlier check. The end result is basically the same as pre-[[3.0.0]], except when ncahdr_x206 == 0x2, final_index is new_base_index+ncahdr_keyindex. Actual implementation loads index from u32_array[ncahdr_crypto_type], where the address of u32_array is different for each ncahdr_keyindex.
* [[3.0.1]]+: The dedicated range check for the '''KeyGenerationOld''' field (0x206) was removed, since the updated code no longer needs it. The output from a function masked with 0xFF is now used instead of ncahdr_x206. The range check for that field was changed from {ncahdr_x206 check with panic described above}, to "if(index>=4)final_index=10;"(skips accessing the array and uses 10 directly). The arrays were updated with an additional entry: final_index=v301_base_index+ncahdr_keyindex.
** The keydata for the above index10 is not(?) known to be initialized.
** The new function called by the code described above does:
** <code>if(ncahdr_x206 < ncahdr_x220){ret = ncahdr_x220; } else { ret = ncahdr_x206; } return ret;</code>

== FsEntry ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| StartOffset (in Media Units which are 0x200 bytes)
|-
| 0x4
| 0x4
| EndOffset (in Media Units which are 0x200 bytes)
|-
| 0x8
| 0x4
| Reserved
|-
| 0xC
| 0x4
| Reserved
|}

= FsHeader =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x2
| Version (always 2)
|-
| 0x2
| 0x1
| FsType (0 = RomFs, 1 = PartitionFs)
|-
| 0x3
| 0x1
| HashType (0 = Auto, 2 = HierarchicalSha256, 3 = HierarchicalIntegrity)
|-
| 0x4
| 0x1
| EncryptionType (0 = Auto, 1 = None, 2 = AesCtrOld, 3 = AesCtr, 4 = AesCtrEx)
|-
| 0x5
| 0x1
| Padding
|-
| 0x8
| 0xF8
| [[#HashInfo|HashInfo]]
|-
| 0x100
| 0x40
| [[#PatchInfo|PatchInfo]] (only used with game updates RomFs)
|-
| 0x140
| 0x4
| Generation
|-
| 0x144
| 0x4
| SecureValue
|-
| 0x148
| 0x30
| SparseInfo (only used in sections with sparse storage)
|-
| 0x178
| 0x88
| Reserved
|}

The FsHeader for each section is at absoluteoffset+0x400+(sectionid*0x200), where sectionid corresponds to the index used with the entry/hash tables.

== HashInfo ==
This contains information specific to the hash type in use.

=== HierarchicalSha256 ===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x20
| SHA256 hash over the hash-table at section-start+0 with the below hash-table size
|-
| 0x20
| 0x4
| Block size in bytes
|-
| 0x24
| 0x4
| Must be 0x2
|-
| 0x28
| 0x8
| Offset of hash-table (normally zero)
|-
| 0x30
| 0x8
| Size of hash-table
|-
| 0x38
| 0x8
| Offset relative to section-start where the PFS0 header is located
|-
| 0x40
| 0x8
| Actual byte-size of the PFS0 filesystem relative to the PFS0 header
|-
| 0x48
| 0xB0
| Reserved
|}

=== HierarchicalIntegrity ===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| Reserved
|-
| 0x8
| 0x4
| Magicnum "IVFC"
|-
| 0xC
| 0x4
| Magic Number (0x20000)
|-
| 0x10
| 0x4
| Master hash size?
|-
| 0x14
| 0x4
| Usually 7? Unknown, could be related to total number of levels maybe?
|-
| 0x18
| 0x8
| Level 1 offset
|-
| 0x20
| 0x8
| Level 1 size
|-
| 0x28
| 0x4
| Level 1 block size (in log2)
|-
| 0x2C
| 0x4
| Reserved
|-
| 0x30
| 0x8
| Level 2 offset
|-
| 0x38
| 0x8
| Level 2 size
|-
| 0x40
| 0x4
| Level 2 block size (in log2)
|-
| 0x44
| 0x4
| Reserved
|-
| 0x48
| 0x8
| Level 3 offset
|-
| 0x50
| 0x8
| Level 3 size
|-
| 0x58
| 0x4
| Level 3 block size (in log2)
|-
| 0x5C
| 0x4
| Reserved
|-
| 0x60
| 0x8
| Level 4 offset
|-
| 0x68
| 0x8
| Level 4 size
|-
| 0x70
| 0x4
| Level 4 block size (in log2)
|-
| 0x74
| 0x4
| Reserved
|-
| 0x78
| 0x8
| Level 5 offset
|-
| 0x80
| 0x8
| Level 5 size
|-
| 0x88
| 0x4
| Level 5 block size (in log2)
|-
| 0x8C
| 0x4
| Reserved
|-
| 0x90
| 0x8
| Level 6 offset
|-
| 0x98
| 0x8
| Level 6 size
|-
| 0xA0
| 0x4
| Level 6 block size (in log2)
|-
| 0xA4
| 0x4
| Reserved
|-
| 0xA8
| 0x20
| Reserved
|-
| 0xC8
| 0x20
| Hash
|-
| 0xE8
| 0x10
| Reserved
|}

== PatchInfo ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| Offset
|-
| 0x8
| 0x8
| Size
|-
| 0x10
| 0x4
| Magicnum "BKTR"
|-
| 0x14
| 0x4
| u32, must be <=1.
|-
| 0x18
| 0x4
| s32, must be >=1.
|-
| 0x1C
| 0x4
|
|-
| 0x20
| 0x20
| Same as the above 0x20-bytes except with different data.
|}

The above byte-offsets are relative to the start of the section-data.

The two sections specified by the two BKTR entries are usually(?) at the very end of the section data(section_endoffset-{size of BKTR sections}).

=== RomFs Patching ===
The [[#PatchInfo|PatchInfo]] section enables combining data from an update NCA with the RomFs from a base NCA to create a single patched RomFS image.

The first BKTR entry describes how to map regions of the two RomFs images to create the patched RomFs. It has the following format:
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Padding/Unused?
|-
| 0x4
| 0x4
| Number of Buckets
|-
| 0x8
| 0x8
| Total Size of the Virtual RomFS Image
|-
| 0x10
| 0x3FF0
| Base Virtual Offset for each Bucket (u64s, padded with 0s until end)
|-
| 0x4000
| 0x4000*X
| Relocation Buckets
|}

Where relocation buckets are as follows:
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Padding/Unused?
|-
| 0x4
| 0x4
| Number of Entries
|-
| 0x8
| 0x8
| End offset for this Bucket
|-
| 0x10
| 0x3FF0
| Relocation Entries
|}

Where relocation entries are as follows:
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| Address in Patched RomFs
|-
| 0x8
| 0x8
| Address in Source RomFs
|-
| 0x10
| 0x4
| 1=Is from Patch RomFS, 0=Is from Base RomFS
|}

The second BKTR entry describes the subsections within the Patch RomFs. It has the following format:
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Padding/Unused?
|-
| 0x4
| 0x4
| Number of Buckets
|-
| 0x8
| 0x8
| Total Size of the Physical Patch Image
|-
| 0x10
| 0x3FF0
| Base Physical Offset for each Bucket (u64s, padded with 0s until end)
|-
| 0x4000
| 0x4000*X
| Subsection Buckets
|}

Where subsection buckets are as follows:
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Padding/Unused?
|-
| 0x4
| 0x4
| Number of Entries
|-
| 0x8
| 0x8
| End offset for this Bucket
|-
| 0x10
| 0x3FF0
| Subsection Entries
|}

Where subsection entries are as follows:
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| Address in Patch RomFs
|-
| 0x8
| 0x4
| Padding/Unused?
|-
| 0xC
| 0x4
| Value for subsection AES-CTR
|}

Official code assumes the relocation entries are sorted, and performs a binary search when determining where to read from. Each subsection in the Patch RomFs has its CTR calculated separately from the others based on the value in its entry (the BKTR entries use normal crypto). Thus decrypting a Patch RomFS requires decrypting and parsing the BKTR entries before anything else.

= Logo Section =
This is a PFS0.

See [[NCA_Content_FS|here]] for the mounted-FS logo contents.

= ExeFS Section =
This is a PFS0.

See [[ExeFS|here]] for mounted-FS ExeFS contents.

= Game Updates =
The section-data for ncatype1 RomFS section(section1) uses section-crypto-type 0x4.

Game updates also contain multiple ncatype6 content, which contain "section0_pfs0/fragment". Some of these are just NCAs, unknown for the rest(presumably NCAs with additional crypto?). The first ncatype6 content fragment file has a NDV0 header, with the NCA starting at offset 0x44.

= PFS0 =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| {Hash-table offset from superblock}
| {Hash-table size from superblock}
| Table of SHA256 hashes.
|-
| {Hash-table <offset+size> from superblock}
|
| Zeros for alignment to {alignment size}.
|-
| {PFS0 offset from superblock}
| {PFS0 size from superblock}
| The actual PFS0.
|}

This is the FS which has magicnum "PFS0" at header+0. This is very similar to [[Gamecard_Format|HFS0]]. A tool for extracting this FS is available [https://gist.github.com/yellows8/1a96c2b846f4ebc4bb45d7f7fa1eb7db here].

The hash table is hashes for every {Block size from superblock} starting at the PFS0 header. The size used for the last hash is {PFS0 filesystem size from superblock} - offset_relativeto_header.

See also the PFS0 superblock above.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Magicnum "PFS0"
|-
| 0x4
| 0x4
| Number of files
|-
| 0x8
| 0x4
| Size of the string table
|-
| 0xC
| 0x4
| Zero/Reserved
|-
| 0x10
| X
| File Entry Table
|-
| 0x10 + X
| Y
| String Table
|-
| 0x10 + X + Y
| Z
| Raw File Data
|}

Where File Entry Table consists of Number of Files FileEntries:
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| Offset of file in Data
|-
| 0x8
| 0x8
| Size of file in Data
|-
| 0x10
| 0x4
| Offset of filename in String Table
|-
| 0x14
| 0x4
| Normally zero?
|}

NS services

2020-01-01T01:59:09Z

TotalJustice: Added Type values for Application Record Format.

= aoc:u =
This is "nn::aocsrv::detail::IAddOnContentManager".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [1.0.0-6.2.0] CountAddOnContentByApplicationId
|-
| 1 || [1.0.0-6.2.0] ListAddOnContentByApplicationId
|-
| 2 || CountAddOnContent
|-
| 3 || ListAddOnContent
|-
| 4 || [1.0.0-6.2.0] GetAddOnContentBaseIdByApplicationId
|-
| 5 || GetAddOnContentBaseId
|-
| 6 || [1.0.0-6.2.0] PrepareAddOnContentByApplicationId
|-
| 7 || PrepareAddOnContent
|-
| 8 || [4.0.0+] GetAddOnContentListChangedEvent
|-
| 100 || [7.0.0+] [[#IPurchaseEventManager|CreateEcPurchasedEventManager]]
|-
| 101 || [9.0.0+] [[#IPurchaseEventManager|CreatePermanentEcPurchasedEventManager]]
|}

== IPurchaseEventManager ==
This is "nn::ec::IPurchaseEventManager".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || SetDefaultDeliveryTarget
|-
| 1 || SetDeliveryTarget
|-
| 2 || GetPurchasedEventReadableHandle
|-
| 3 || PopPurchasedProductInfo
|-
| 4 || [9.0.0+] PopPurchasedProductInfoWithUid
|}

= ns:am =
This is "nn::ns::detail::IApplicationManagerInterface".

[3.0.0+] This service was replaced by [[#ns:am2, ns:ec, ns:rid, ns:rt, ns:web|ns:am2]].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#ListApplicationRecord]]
|-
| 1 || GenerateApplicationRecordCount
|-
| 2 || GetApplicationRecordUpdateSystemEvent
|-
| 3 || GetApplicationViewDeprecated
|-
| 4 || DeleteApplicationEntity
|-
| 5 || DeleteApplicationCompletely
|-
| 6 || IsAnyApplicationEntityRedundant
|-
| 7 || DeleteRedundantApplicationEntity
|-
| 8 || IsApplicationEntityMovable
|-
| 9 || MoveApplicationEntity
|-
| 11 || CalculateApplicationOccupiedSize
|-
| 16 || PushApplicationRecord
|-
| 17 || ListApplicationRecordContentMeta
|-
| 18 ||
|-
| 19 || [[#LaunchApplication]]
|-
| 21 || [[#GetApplicationContentPath]]
|-
| 22 || TerminateApplication
|-
| 23 || [2.0.0+] ResolveApplicationContentPath
|-
| 26 || BeginInstallApplication
|-
| 27 || DeleteApplicationRecord
|-
| 30 || RequestApplicationUpdateInfo
|-
| 31 || RequestUpdateApplication
|-
| 32 || CancelApplicationDownload
|-
| 33 || ResumeApplicationDownload
|-
| 34 ||
|-
| 35 || UpdateVersionList
|-
| 36 || PushLaunchVersion
|-
| 37 || ListRequiredVersion
|-
| 38 || CheckApplicationLaunchVersion
|-
| 39 || CheckApplicationLaunchRights
|-
| 40 || GetApplicationLogoData
|-
| 41 || CalculateApplicationDownloadRequiredSize
|-
| 42 || CleanupSdCard
|-
| 43 || CheckSdCardMountStatus
|-
| 44 || GetSdCardMountStatusChangedEvent
|-
| 45 || GetGameCardAttachmentEvent
|-
| 46 || GetGameCardAttachmentInfo
|-
| 47 || [[#GetTotalSpaceSize]]
|-
| 48 || [[#GetFreeSpaceSize]]
|-
| 49 || GetSdCardRemovedEvent
|-
| 52 || GetGameCardUpdateDetectionEvent
|-
| 53 || DisableApplicationAutoDelete
|-
| 54 || EnableApplicationAutoDelete
|-
| 55 || [[#GetApplicationDesiredLanguage]]
|-
| 56 || SetApplicationTerminateResult
|-
| 57 || ClearApplicationTerminateResult
|-
| 58 || GetLastSdCardMountUnexpectedResult
|-
| 59 || ConvertApplicationLanguageToLanguageCode
|-
| 60 || [[#ConvertLanguageCodeToApplicationLanguage]]
|-
| 61 || GetBackgroundDownloadStressTaskInfo
|-
| 62 || GetGameCardStopper
|-
| 63 || IsSystemProgramInstalled
|-
| 64 || [2.0.0+] StartApplyDeltaTask
|-
| 65 || [2.0.0+] GetRequestServerStopper
|-
| 100 || ResetToFactorySettings
|-
| 101 || ResetToFactorySettingsWithoutUserSaveData
|-
| 102 || [2.0.0+] ResetToFactorySettingsForRefurbishment
|-
| 200 || CalculateUserSaveDataStatistics
|-
| 201 || DeleteUserSaveDataAll
|-
| 210 || DeleteUserSystemSaveData
|-
| 220 || UnregisterNetworkServiceAccount
|-
| 300 || GetApplicationShellEvent
|-
| 301 || PopApplicationShellEventInfo
|-
| 302 || LaunchLibraryApplet
|-
| 303 || TerminateLibraryApplet
|-
| 304 || LaunchSystemApplet
|-
| 305 || TerminateSystemApplet
|-
| 306 || LaunchOverlayApplet
|-
| 307 || TerminateOverlayApplet
|-
| 400 || [[#GetApplicationControlData]]
|-
| 401 || InvalidateAllApplicationControlCache
|-
| 402 || RequestDownloadApplicationControlData
|-
| 403 || GetMaxApplicationControlCacheCount
|-
| 404 || [2.0.0+] InvalidateApplicationControlCache
|-
| 405 || [2.0.0+] ListApplicationControlCacheEntryInfo
|-
| 502 || [2.0.0+] RequestCheckGameCardRegistration
|-
| 503 || [2.0.0+] RequestGameCardRegistrationGoldPoint
|-
| 504 || [2.0.0+] RequestRegisterGameCard
|-
| 600 || [2.0.0+] CountApplicationContentMeta
|-
| 601 || [2.0.0+] [[#ListApplicationContentMetaStatus]]
|-
| 602 || [2.0.0+] ListAvailableAddOnContent
|-
| 603 || [2.0.0+] GetOwnedApplicationContentMetaStatus
|-
| 604 || [2.0.0+] RegisterContentsExternalKey
|-
| 605 || [2.0.0+] ListApplicationContentMetaStatusWithRightsCheck
|-
| 700 || [2.0.0+] PushDownloadTaskList
|-
| 701 || [2.0.0+] ClearTaskStatusList
|-
| 702 || [2.0.0+] RequestDownloadTaskList
|-
| 703 || [2.0.0+] RequestEnsureDownloadTask
|-
| 704 || [2.0.0+] ListDownloadTaskStatus
|-
| 705 || [2.0.0+] RequestDownloadTaskListData
|-
| 800 || [2.0.0+] RequestVersionList
|-
| 801 || [2.0.0+] ListVersionList
|-
| 900 || [2.0.0+] GetApplicationRecord
|-
| 901 || [2.0.0+] GetApplicationRecordProperty
|-
| 902 || [2.0.0+] EnableApplicationAutoUpdate
|-
| 903 || [2.0.0+] DisableApplicationAutoUpdate
|-
| 904 || [2.0.0+] TouchApplication
|-
| 905 || [2.0.0+] RequestApplicationUpdate
|-
| 906 || [2.0.0+] IsApplicationUpdateRequested
|-
| 907 || [2.0.0+] WithdrawApplicationUpdateRequest
|-
| 908 || [2.0.0+] ListApplicationRecordInstalledContentMeta
|-
| 1000 || [2.0.0+] RequestVerifyApplicationDeprecated
|-
| 1001 || [2.0.0+] CorruptApplicationForDebug
|-
| 1200 || [2.0.0+] [[#NeedsUpdateVulnerability]]
|-
| 1300 || [2.0.0+] IsAnyApplicationEntityInstalled
|-
| 1301 || [2.0.0+] DeleteApplicationContentEntities
|-
| 1302 || [2.0.0+] CleanupUnrecordedApplicationEntity
|-
| 1400 || [2.0.0+] PrepareShutdown
|-
| 1500 || [2.0.0+] FormatSdCard
|-
| 1501 || [2.0.0+] NeedsSystemUpdateToFormatSdCard
|-
| 1502 || [2.0.0+] GetLastSdCardFormatUnexpectedResult
|-
| 1503 || [2.0.0+]
|-
| 1600 || [2.0.0+] GetSystemSeedForPseudoDeviceId
|-
| 1700 || [2.0.0+] ListApplicationDownloadingContentMeta
|-
| 1800 || [2.0.0+] IsNotificationSetupCompleted
|-
| 1801 || [2.0.0+] GetLastNotificationInfoCount
|-
| 1802 || [2.0.0+] ListLastNotificationInfo
|}

== ListApplicationRecord ==
Takes a type-0x6 output buffer containing an array of the below record and an s32 entry_offset, returns an output s32 out_entrycount.

Returns an array of entries with the below format using the specified offset and count.

=== Application Record Format ===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| [[NCM_services#ApplicationId|ApplicationId]]
|-
| 0x8
| 0x1
| Type? (Known values: 0x2=Installing?, 0x3=Installed / Gamecard inserted, 0x5=Gamecard not inserted, 0xB=Archived)
|-
| 0x9
| 0x1
| Unknown, usually 0x02
|-
| 0xA
| 0x6
| Unknown, usually zeros?
|-
| 0x10
| 0x1
| Unknown, seems to change between reboots and removing/reinserting gamecards
|-
| 0x11
| 0x7
| Unknown, usually zeros?
|}

== LaunchApplication ==
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output u64 PID.

Launches an application title which is registered with NS.

== GetApplicationContentPath ==
Takes a 0x16-type output buffer, an u8 [[NCM_services#ContentMetaType|ContentMetaType]], and an [[NCM_services#ApplicationId|ApplicationId]].

The input [[NCM_services#ApplicationId|ApplicationId]] is used with the application-title table like various other cmds, anything not in that table can't be used with this.

Returns a string path for the specified type of patch content with this [[NCM_services#ApplicationId|ApplicationId]], otherwise returns regular-application paths when update-title not installed. Returns an error when the specified type of content doesn't exist for this title. Starts with "@{SdCardContent,UserContent}://" and ends in ".nca".

For gamecard content, the output path is: "@GcSXXXXXXXX:/<NcaId>.nca". NCA-type0 with gamecard returns 0 with an empty output string.

The output string is then used by the user-process with [[Filesystem_services|FS]] to mount the content.

== GetTotalSpaceSize ==
Takes an input media-id that must be 5.

Returns the u64 from [[Content_Manager_services#IContentStorage]] cmd22.

== GetFreeSpaceSize ==
Takes an input media-id that must be 5.

Returns the u64 from [[Content_Manager_services#IContentStorage]] cmd23.

== GetApplicationDesiredLanguage ==
Takes an input u8 language-bitmask, returns an output u8 [[control.nacp]] langentry index.

User-processes generate the language-bitmask with the following for all 16 lang-entries: <code>if(<either string in langentry[i] is non-empty>)bitmask |= 1<<i</code>

== ConvertLanguageCodeToApplicationLanguage ==
Takes an input u8 pointer for the resulting Id to be written to and a string represented as a u64 (i.e 0x53552D6E65 for 'en-US').

Returns 0 if an ID was successfully found, otherwise returns 0x25810.

== GetApplicationControlData ==
Takes an input u8 [[#ApplicationControlSource]], an [[NCM_services#ApplicationId|ApplicationId]], and a type-0x6 output buffer. Returns an output u32 for actual_size. Official user-processes use buffer size 0x24000. [[qlaunch]] only uses flag value 0x1 (Storage if not in cache).

Loads cached [[control.nacp]] to buf+0 and the cached icon to buf+0x4000. Returns an error if the buffer is too small.

===ApplicationControlSource===
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0x0
| CacheOnly (Returns data from cache)
|-
| 0x1
| Storage (Returns data from storage if not present in cache)
|-
| 0x2
| StorageOnly (Returns data from storage without using cache)
|}

== ListApplicationContentMetaStatus ==
Takes a type-0x6 output buffer containing an array of the below entries, an input s32 index and [[NCM_services#ApplicationId|ApplicationId]], returns an output s32 out_entrycount.

Returns 0x10-byte entries using the specified [[NCM_services#ApplicationId|ApplicationId]] starting at the specified index. Can only return game titles. The second entry if any is the update-title usually. When the input entryindex is >= totalentries, this will return 0 with out_entrycount=0.

Entry structure:
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| [[NCM_services#ContentMetaType|ContentMetaType]] ("type")
|-
| 0x1
| 0x1
| [[NCM_services#StorageId|StorageId]] ("installedStorage")
|-
| 0x2
| 0x1
| Unknown. Non-zero with output from cmd 605, differs for app/update titles.
|-
| 0x3
| 0x1
| Padding
|-
| 0x4
| 0x4
| Version
|-
| 0x8
| 0x8
| [[NCM_services#ApplicationId|ApplicationId]]
|}

= ns:am2, ns:ec, ns:rid, ns:rt, ns:web =
These services are all, at the top level, "nn::ns::detail::IServiceGetterInterface". These commands check a state field for a command-specific bit and returns an error if not set, this is likely a permissions check for service+command.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 7988 || [6.0.0+] [[#IDynamicRightsInterface|GetDynamicRightsInterface]].
|-
| 7989 || [5.1.0+] [[#IReadOnlyApplicationControlDataInterface|GetReadOnlyApplicationControlDataInterface]].
|-
| 7991 || [5.0.0+] [[#IReadOnlyApplicationRecordInterface|GetReadOnlyApplicationRecordInterface]].
|-
| 7992 || [4.0.0+] [[#IECommerceInterface|GetECommerceInterface]]
|-
| 7993 || [4.0.0+] [[#IApplicationVersionInterface|GetApplicationVersionInterface]]
|-
| 7994 || [[#IFactoryResetInterface|GetFactoryResetInterface]]
|-
| 7995 || [[#IAccountProxyInterface|GetAccountProxyInterface]]
|-
| 7996 || [[#IApplicationManagerInterface|GetApplicationManagerInterface]]
|-
| 7997 || [[#IDownloadTaskInterface|GetDownloadTaskInterface]]
|-
| 7998 || [[#IContentManagementInterface|GetContentManagementInterface]]
|-
| 7999 || [[#IDocumentInterface|GetDocumentInterface]]
|}

=== IAccountProxyInterface ===
This is "nn::ns::detail::IAccountProxyInterface".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || CreateUserAccount
|}

=== IApplicationManagerInterface ===
This is "nn::ns::detail::IApplicationManagerInterface".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#ListApplicationRecord]]
|-
| 1 || GenerateApplicationRecordCount
|-
| 2 || GetApplicationRecordUpdateSystemEvent
|-
| 3 || GetApplicationViewDeprecated
|-
| 4 || DeleteApplicationEntity
|-
| 5 || DeleteApplicationCompletely
|-
| 6 || IsAnyApplicationEntityRedundant
|-
| 7 || DeleteRedundantApplicationEntity
|-
| 8 || IsApplicationEntityMovable
|-
| 9 || MoveApplicationEntity
|-
| 11 || CalculateApplicationOccupiedSize
|-
| 16 || PushApplicationRecord
|-
| 17 || ListApplicationRecordContentMeta
|-
| 19 || [1.0.0-5.1.0] LaunchApplicationOld
|-
| 21 || [[#GetApplicationContentPath]]
|-
| 22 || TerminateApplication
|-
| 23 || ResolveApplicationContentPath
|-
| 26 || BeginInstallApplication
|-
| 27 || DeleteApplicationRecord
|-
| 30 || [[#RequestApplicationUpdateInfo]]
|-
| 31 || [1.0.0-3.0.2]
|-
| 32 || CancelApplicationDownload
|-
| 33 || ResumeApplicationDownload
|-
| 35 || UpdateVersionList
|-
| 36 || PushLaunchVersion
|-
| 37 || ListRequiredVersion
|-
| 38 || CheckApplicationLaunchVersion
|-
| 39 || [1.0.0-6.2.0] CheckApplicationLaunchRights
|-
| 40 || GetApplicationLogoData
|-
| 41 || CalculateApplicationDownloadRequiredSize
|-
| 42 || CleanupSdCard
|-
| 43 || CheckSdCardMountStatus
|-
| 44 || GetSdCardMountStatusChangedEvent
|-
| 45 || GetGameCardAttachmentEvent
|-
| 46 || GetGameCardAttachmentInfo
|-
| 47 || [[#GetTotalSpaceSize]]
|-
| 48 || [[#GetFreeSpaceSize]]
|-
| 49 || GetSdCardRemovedEvent
|-
| 52 || GetGameCardUpdateDetectionEvent
|-
| 53 || DisableApplicationAutoDelete
|-
| 54 || EnableApplicationAutoDelete
|-
| 55 || GetApplicationDesiredLanguage
|-
| 56 || SetApplicationTerminateResult
|-
| 57 || ClearApplicationTerminateResult
|-
| 58 || GetLastSdCardMountUnexpectedResult
|-
| 59 || ConvertApplicationLanguageToLanguageCode
|-
| 60 || [[#ConvertLanguageCodeToApplicationLanguage]]
|-
| 61 || GetBackgroundDownloadStressTaskInfo
|-
| 62 || GetGameCardStopper
|-
| 63 || IsSystemProgramInstalled
|-
| 64 || StartApplyDeltaTask
|-
| 65 || GetRequestServerStopper
|-
| 66 || [3.0.0+] GetBackgroundApplyDeltaStressTaskInfo
|-
| 67 || [3.0.0+] CancelApplicationApplyDelta
|-
| 68 || [3.0.0+] ResumeApplicationApplyDelta
|-
| 69 || [3.0.0+] CalculateApplicationApplyDeltaRequiredSize
|-
| 70 || [3.0.0+] ResumeAll
|-
| 71 || [3.0.0+] GetStorageSize
|-
| 80 || [3.0.0+] RequestDownloadApplication
|-
| 81 || [3.0.0+] RequestDownloadAddOnContent
|-
| 82 || [3.0.0+] DownloadApplication
|-
| 83 || [4.0.0-6.2.0] CheckApplicationResumeRights
|-
| 84 || [4.0.0+] GetDynamicCommitEvent
|-
| 85 || [4.0.0+] RequestUpdateApplication2
|-
| 86 || [4.0.0+] EnableApplicationCrashReport
|-
| 87 || [4.0.0+] IsApplicationCrashReportEnabled
|-
| 90 || [4.0.0-8.1.0] BoostSystemMemoryResourceLimit
|-
| 91 || [5.0.0+] DeprecatedLaunchApplication
|-
| 92 || [5.0.0+] GetRunningApplicationProgramId
|-
| 93 || [5.0.0+] GetMainApplicationProgramIndex
|-
| 94 || [6.0.0+] LaunchApplication
|-
| 95 || [6.0.0+] GetApplicationLaunchInfo
|-
| 96 || [6.0.0+] AcquireApplicationLaunchInfo
|-
| 97 || [6.0.0+] GetMainApplicationProgramIndexByApplicationLaunchInfo
|-
| 98 || [6.0.0+] EnableApplicationAllThreadDumpOnCrash
|-
| 99 || [8.0.0+] [[#LaunchDevMenu]]
|-
| 100 || ResetToFactorySettings
|-
| 101 || ResetToFactorySettingsWithoutUserSaveData
|-
| 102 || ResetToFactorySettingsForRefurbishment
|-
| 103 || [9.1.0+] ResetToFactorySettingsWithPlatformRegion
|-
| 104 || [9.1.0+] ResetToFactorySettingsWithPlatformRegionAuthentication
|-
| 200 || CalculateUserSaveDataStatistics
|-
| 201 || DeleteUserSaveDataAll
|-
| 210 || DeleteUserSystemSaveData
|-
| 211 || [6.0.0+] DeleteSaveData
|-
| 220 || UnregisterNetworkServiceAccount
|-
| 221 || [6.0.0+] UnregisterNetworkServiceAccountWithUserSaveDataDeletion
|-
| 300 || GetApplicationShellEvent
|-
| 301 || PopApplicationShellEventInfo
|-
| 302 || LaunchLibraryApplet
|-
| 303 || TerminateLibraryApplet
|-
| 304 || LaunchSystemApplet
|-
| 305 || TerminateSystemApplet
|-
| 306 || LaunchOverlayApplet
|-
| 307 || TerminateOverlayApplet
|-
| 400 || GetApplicationControlData
|-
| 401 || InvalidateAllApplicationControlCache
|-
| 402 || RequestDownloadApplicationControlData
|-
| 403 || GetMaxApplicationControlCacheCount
|-
| 404 || InvalidateApplicationControlCache
|-
| 405 || ListApplicationControlCacheEntryInfo
|-
| 406 || [6.0.0+] GetApplicationControlProperty
|-
| 407 || [8.0.0+] [[#ListApplicationTitle]]
|-
| 408 || [8.0.0+] [[#ListApplicationIcon]]
|-
| 502 || RequestCheckGameCardRegistration
|-
| 503 || [[#RequestGameCardRegistrationGoldPoint]]
|-
| 504 || RequestRegisterGameCard
|-
| 505 || [3.0.0+] GetGameCardMountFailureEvent
|-
| 506 || [3.0.0+] IsGameCardInserted
|-
| 507 || [3.0.0+] EnsureGameCardAccess
|-
| 508 || [3.0.0+] GetLastGameCardMountFailureResult
|-
| 509 || [5.0.0+] ListApplicationIdOnGameCard
|-
| 510 || [9.0.0+] [[#GetGameCardPlatformRegion]]
|-
| 600 || CountApplicationContentMeta
|-
| 601 || [[#ListApplicationContentMetaStatus]]
|-
| 602 || [2.0.0-5.1.0] ListAvailableAddOnContent
|-
| 603 || GetOwnedApplicationContentMetaStatus
|-
| 604 || RegisterContentsExternalKey
|-
| 605 || ListApplicationContentMetaStatusWithRightsCheck
|-
| 606 || [3.0.0+] GetContentMetaStorage
|-
| 607 || [6.0.0+] ListAvailableAddOnContent
|-
| 700 || PushDownloadTaskList
|-
| 701 || ClearTaskStatusList
|-
| 702 || RequestDownloadTaskList
|-
| 703 || RequestEnsureDownloadTask
|-
| 704 || ListDownloadTaskStatus
|-
| 705 || [[#RequestDownloadTaskListData]]
|-
| 800 || RequestVersionList
|-
| 801 || ListVersionList
|-
| 802 || [3.0.0+] [[#RequestVersionListData]]
|-
| 900 || GetApplicationRecord
|-
| 901 || GetApplicationRecordProperty
|-
| 902 || EnableApplicationAutoUpdate
|-
| 903 || DisableApplicationAutoUpdate
|-
| 904 || TouchApplication
|-
| 905 || RequestApplicationUpdate
|-
| 906 || IsApplicationUpdateRequested
|-
| 907 || WithdrawApplicationUpdateRequest
|-
| 908 || ListApplicationRecordInstalledContentMeta
|-
| 909 || [3.0.0+] WithdrawCleanupAddOnContentsWithNoRightsRecommendation
|-
| 910 || [5.0.0+] HasApplicationRecord
|-
| 911 || [5.1.0+] SetPreInstalledApplication
|-
| 912 || [5.1.0+] ClearPreInstalledApplicationFlag
|-
| 913 || [9.0.0+] ListAllApplicationRecord
|-
| 914 || [9.0.0+] HideApplicationRecord
|-
| 915 || [9.0.0+] ShowApplicationRecord
|-
| 1000 || RequestVerifyApplicationDeprecated
|-
| 1001 || CorruptApplicationForDebug
|-
| 1002 || [3.0.0+] RequestVerifyAddOnContentsRights
|-
| 1003 || [5.0.0+] RequestVerifyApplication
|-
| 1004 || [5.0.0+] CorruptContentForDebug
|-
| 1200 || [[#NeedsUpdateVulnerability]]
|-
| 1300 || IsAnyApplicationEntityInstalled
|-
| 1301 || DeleteApplicationContentEntities
|-
| 1302 || CleanupUnrecordedApplicationEntity
|-
| 1303 || [3.0.0+] CleanupAddOnContentsWithNoRights
|-
| 1304 || [3.0.0+] DeleteApplicationContentEntity
|-
| 1308 || [5.0.0+] DeleteApplicationCompletelyForDebug
|-
| 1309 || [6.0.0+] CleanupUnavailableAddOnContents
|-
| 1400 || PrepareShutdown
|-
| 1500 || FormatSdCard
|-
| 1501 || NeedsSystemUpdateToFormatSdCard
|-
| 1502 || GetLastSdCardFormatUnexpectedResult
|-
| 1504 || [3.0.0+] InsertSdCard
|-
| 1505 || [3.0.0+] RemoveSdCard
|-
| 1506 || [9.0.0+] GetSdCardStartupStatus
|-
| 1600 || GetSystemSeedForPseudoDeviceId
|-
| 1601 || [3.0.0+] ResetSystemSeedForPseudoDeviceId
|-
| 1700 || ListApplicationDownloadingContentMeta
|-
| 1701 || [3.0.0+] GetApplicationView
|-
| 1702 || [3.0.0+] GetApplicationDownloadTaskStatus
|-
| 1703 || [4.0.0+] GetApplicationViewDownloadErrorContext
|-
| 1704 || [8.0.0+] GetApplicationViewWithPromotionInfo
|-
| 1800 || IsNotificationSetupCompleted
|-
| 1801 || GetLastNotificationInfoCount
|-
| 1802 || ListLastNotificationInfo
|-
| 1803 || [3.0.0+] ListNotificationTask
|-
| 1900 || [3.0.0+] IsActiveAccount
|-
| 1901 || [4.0.0+] RequestDownloadApplicationPrepurchasedRights
|-
| 1902 || [5.0.0+] GetApplicationTicketInfo
|-
| 2000 || [4.0.0+] [[#GetSystemDeliveryInfo]]
|-
| 2001 || [4.0.0+] [[#SelectLatestSystemDeliveryInfo]]
|-
| 2002 || [4.0.0+] [[#VerifyDeliveryProtocolVersion]]
|-
| 2003 || [4.0.0+] [[#GetApplicationDeliveryInfo]]
|-
| 2004 || [4.0.0+] [[#HasAllContentsToDeliver]]
|-
| 2005 || [4.0.0+] [[#CompareApplicationDeliveryInfo]]
|-
| 2006 || [4.0.0+] [[#CanDeliverApplication]]
|-
| 2007 || [4.0.0+] [[#ListContentMetaKeyToDeliverApplication]]
|-
| 2008 || [4.0.0+] [[#NeedsSystemUpdateToDeliverApplication]]
|-
| 2009 || [4.0.0+] [[#EstimateRequiredSize]]
|-
| 2010 || [4.0.0+] [[#RequestReceiveApplication]]
|-
| 2011 || [4.0.0+] [[#CommitReceiveApplication]]
|-
| 2012 || [4.0.0+] [[#GetReceiveApplicationProgress]]
|-
| 2013 || [4.0.0+] [[#RequestSendApplication]]
|-
| 2014 || [4.0.0+] [[#GetSendApplicationProgress]]
|-
| 2015 || [4.0.0+] [[#CompareSystemDeliveryInfo]]
|-
| 2016 || [4.0.0+] [[#ListNotCommittedContentMeta]]
|-
| 2017 || [4.0.0+] [[#RecoverDownloadTask]]
|-
| 2018 || [5.0.0+] [[#GetApplicationDeliveryInfoHash]]
|-
| 2050 || [6.0.0+] GetApplicationRightsOnClient
|-
| 2051 || [9.0.0+] InvalidateRightsIdCache
|-
| 2100 || [6.0.0+] GetApplicationTerminateResult
|-
| 2101 || [6.0.0+] GetRawApplicationTerminateResult
|-
| 2150 || [6.0.0+] CreateRightsEnvironment
|-
| 2151 || [6.0.0+] DestroyRightsEnvironment
|-
| 2152 || [6.0.0+] ActivateRightsEnvironment
|-
| 2153 || [6.0.0+] DeactivateRightsEnvironment
|-
| 2154 || [6.0.0+] ForceActivateRightsContextForExit
|-
| 2155 || [7.0.0+] UpdateRightsEnvironmentStatus
|-
| 2156 || [9.0.0+] CreateRightsEnvironmentForPreomia
|-
| 2160 || [6.0.0+] AddTargetApplicationToRightsEnvironment
|-
| 2161 || [6.0.0+] SetUsersToRightsEnvironment
|-
| 2170 || [6.0.0+] GetRightsEnvironmentStatus
|-
| 2171 || [6.0.0+] GetRightsEnvironmentStatusChangedEvent
|-
| 2180 || [6.0.0+] RequestExtendExpirationInRightsEnvironment
|-
| 2181 || [6.0.0+] GetResultOfExtendExpirationInRightsEnvironment
|-
| 2182 || [6.0.0+] SetActiveRightsContextUsingStateToRightsEnvironment
|-
| 2190 || [6.0.0+] [[#GetRightsEnvironmentHandleForApplication]]
|-
| 2199 || [6.0.0+] GetRightsEnvironmentCountForDebug
|-
| 2200 || [6.0.0+] GetGameCardApplicationCopyIdentifier
|-
| 2201 || [6.0.0+] GetInstalledApplicationCopyIdentifier
|-
| 2250 || [6.0.0-6.2.0] RequestReportActiveELicence
|-
| 2300 || [6.0.0-8.1.0] ListEventLog
|-
| 2350 || [7.0.0+] PerformAutoUpdateByApplicationId
|-
| 2351 || [9.0.0+] [[#RequestNoDownloadRightsErrorResolution]]
|-
| 2352 || [9.0.0+] [[#RequestResolveNoDownloadRightsError]]
|-
| 2400 || [8.0.0+] GetPromotionInfo
|-
| 2401 || [8.0.0+] CountPromotionInfo
|-
| 2402 || [8.0.0+] ListPromotionInfo
|-
| 2403 || [8.0.0+] ImportPromotionJsonForDebug
|-
| 2404 || [8.0.0+] ClearPromotionInfoForDebug
|-
| 2500 || [8.0.0+] ConfirmAvailableTime
|-
| 2510 || [9.0.0+] [[#CreateApplicationResource]]
|-
| 2511 || [9.0.0+] [[#GetApplicationResource]]
|-
| 2513 || [9.0.0+] LaunchPreomia
|-
| 2514 || [9.0.0+] ClearTaskOfAsyncTaskManager
|-
| 2800 || [9.0.0+] GetApplicationIdOfPreomia
|}

[4.0.0+] RequestDownloadAddOnContent now takes an additional 8-bytes of input.

==== RequestApplicationUpdateInfo ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IAsyncValue]].

The data that can be read from the [[#IAsyncValue]] is [[#ApplicationUpdateInfo]].

==== LaunchDevMenu ====
No input/output.

This is used by AM cmd [[Applet_Manager_services#LaunchDevMenu|LaunchDevMenu]].

This loads ProgramIds from [[System_Settings|system-settings]] <code>ns.applet!devmenu_id</code> and <code>ns.applet!devoverlaydisp_id</code>, which only exists on devunits. An error is thrown if loading these fail.

[[NCM_services#ncm|OpenContentMetaDatabase]] is used with StorageId = NandSystem, then IContentMetaDatabase GetLatestContentMetaKey is used with both of the above ProgramIds to verify that the cmd is successful.

Then if the above succeeds, the above titles are launched with the above StorageId via [[Process_Manager_services|pmshell]] LaunchProgram, with a 0.5s sleep-thread afterwards on success.

==== ListApplicationTitle ====
Takes a total of 0x10-bytes of input, a type-0x5 input buffer, an input handle, returns an output Event handle and an [[#IAsyncValue]].

==== ListApplicationIcon ====
Takes a total of 0x10-bytes of input, a type-0x5 input buffer, an input handle, returns an output Event handle and an [[#IAsyncValue]].

==== RequestGameCardRegistrationGoldPoint ====
Takes a total of 0x18-bytes of input, returns an output Event handle and an [[#IAsyncValue]].

==== GetGameCardPlatformRegion ====
No input, returns an u8 '''GameCardPlatformRegion''' (0x00 = Global, 0x01 = China).

This calls [[Filesystem_services#IDeviceOperator|fsp-srv IDeviceOperator]] GetGameCardCompatibilityType and returns the result.

==== RequestDownloadTaskListData ====
No input, returns an output Event handle and an [[#IAsyncValue]].

==== GetRightsEnvironmentHandleForApplication ====
No input, returns a total of 8-bytes of output.

[9.0.0+] Now takes a total of 8-bytes of input, returns a total of 8-bytes of output.

==== RequestNoDownloadRightsErrorResolution ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IAsyncValue]].

The data that can be read from the [[#IAsyncValue]] is [[#NoDownloadRightsErrorResolution]].

==== RequestResolveNoDownloadRightsError ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IAsyncValue]].

The data that can be read from the [[#IAsyncValue]] is [[#NoDownloadRightsErrorResolution]].

==== CreateApplicationResource ====
Returns an [[#IApplicationResource]].

==== GetApplicationResource ====
Returns an [[#IApplicationResource]].

==== GetSystemDeliveryInfo ====
Takes a type-0x16 output buffer containing a [[#SystemDeliveryInfo]], no output.

This generates a [[#SystemDeliveryInfo]] using the currently installed SystemUpdate meta title.

==== SelectLatestSystemDeliveryInfo ====
Takes a type-0x15 input buffer containing a [[#SystemDeliveryInfo]], a type-0x5 input buffer containing an array of [[#SystemDeliveryInfo]], a type-0x5 input buffer containing an array of [[#ApplicationDeliveryInfo]], and returns an output s32.

This determines the latest version from the input [[#ApplicationDeliveryInfo]] array, using value 0 if the array is empty. If this value is less than a state field, the state field value is used instead. Then this selects a [[#SystemDeliveryInfo]] with the latest version from the input array, where the minimum version is the previously mentioned value. The version must also be also be at least the version value from the type-0x15 [[#SystemDeliveryInfo]] buffer. This also does various validation, etc. The output s32 is an index in that array for the selected entry, -1 if none found.

==== VerifyDeliveryProtocolVersion ====
Takes a type-0x15 input buffer containing a [[#SystemDeliveryInfo]], no output.

This validates the [[#SystemDeliveryInfo]] HMAC and the protocol-version fields. Then the meta version is compared with a state field, an error is returned on match otherwise 0 is returned.

==== GetApplicationDeliveryInfo ====
Takes a type-0x6 output buffer containing an array of [[#ApplicationDeliveryInfo]], an input u32 bitmask <code>nn::ns::ApplicationDeliveryAttributeTag</code>, an [[NCM_services#ApplicationId|ApplicationId]], and returns an output s32 total_out.

An error is thrown if any bit is set in ApplicationDeliveryAttributeTag besides bit1. The output array-count must be at least 1: only 1 entry will be written to this array (hence on success total_out will also only be 1 on success).

==== HasAllContentsToDeliver ====
Takes a type-0x5 input buffer containing an array of [[#ApplicationDeliveryInfo]], returns an output u8 bool.

The array-count must match 1. After validating the [[#ApplicationDeliveryInfo]], the output bool is set to u32 [[#ApplicationDeliveryInfo]]+0x1C & 0x10000002 != 0x2, then this returns 0.

==== CompareApplicationDeliveryInfo ====
Takes two type-0x5 input buffers containing an array of [[#ApplicationDeliveryInfo]], returns an output s32.

The array-count for both buffers must be 1, otherwise an error is returned.

Both [[#ApplicationDeliveryInfo]] are validated, then the application-version in the first/second buffer are compared. The output s32 is set to the comparison result: -1 for less than, 0 for equal, and 1 for higher than.

==== CanDeliverApplication ====
Takes two type-0x5 input buffers containing an array of [[#ApplicationDeliveryInfo]], returns an output u8 bool.

The array-count for the second buffer must be 1 and the array-count for the first buffer must be <=1, otherwise an error is returned. If the array-count for the first buffer is 0, this will return 0 with the output bool set to 0.

==== ListContentMetaKeyToDeliverApplication ====
Takes a type-0x6 output buffer containing an array of [[NCM_services#ContentMetaKey|ContentMetaKey]], a type-0x5 input buffer containing an array of [[#ApplicationDeliveryInfo]], a s32, and returns an output s32 total_out.

The array-count for ContentMetaKey must be at least 1, and for ApplicationDeliveryInfo it must match 1.

This will only return 1 ContentMetaKey entry. This will not output the entry when the input s32 is larger than 0. This also does other validation, etc.

==== NeedsSystemUpdateToDeliverApplication ====
Takes a type-0x15 input buffer containing a [[#SystemDeliveryInfo]], a type-0x5 input buffer containing an array of [[#ApplicationDeliveryInfo]], and returns an output u8 bool.

The array-count must match 1.

After validation etc, this sets the output bool by comparing system-version fields in the [[#SystemDeliveryInfo]]/[[#ApplicationDeliveryInfo]] and with a state field.

==== EstimateRequiredSize ====
Takes a type-0x5 input buffer containing an array of [[NCM_services#ContentMetaKey|ContentMetaKey]], returns an output s64.

When the array-count is less than 1, this will return 0 with the s64 set to 0.

==== RequestReceiveApplication ====
Takes a type-0x5 input buffer containing an array of [[NCM_services#ContentMetaKey|ContentMetaKey]], a [[NCM_services#StorageId|StorageId]], an u16 port, an u32 Ipv4Address, an [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IAsyncResult]].

[[qlaunch]] uses value Any for the StorageId, and value 55556 for the port.

An error is thrown if a state ref-count is zero. An error is thrown if [[NIM_services|nim]] ListApplicationApplyDeltaTask returns a task.

This loops through the input [[NCM_services#ContentMetaKey|ContentMetaKey]] array, throwing an error if the [[NCM_services#ContentMetaType|ContentMetaType]] doesn't match Patch. The input array is copied into state which is used later by the thread for [[NIM_services|nim]] cmd53, max entries is 0x12.

This does various setup then creates the [[#IAsyncResult]] + the async thread which handles the [[#IAsyncResult]] operation. Then the thread does:

* Calls a func which does:
** Throws an error if a state flag is set.
** Uses [[NIM_services|nim]] cmd53, returning the Result on failure.
** Uses [[NIM_services|nim]] cmd56, returning the Result on failure. Waits for the IAsyncResult operation from this to finish, then uses the Get cmd to get the output Result.
** Handles cleanup and returns.
* On success, this loads various data which is then used for saving a SystemPlayReport when a state flag is set.
** The EventId is "receive_app_contents" with ApplicationId <NS ProgramId>.

==== CommitReceiveApplication ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], no output.

==== GetReceiveApplicationProgress ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output [[#ReceiveApplicationProgress]].

An error is thrown if a state ref-count is zero. An error is thrown if [[NIM_services|nim]] ListApplicationApplyDeltaTask returns a task.

Uses [[NIM_services|nim]] cmd67, throwing an error if no task is returned. Then [[NIM_services|nim]] cmd57 is used, returning the error from there on failure. Lastly, this writes the 0x10-bytes from output+8 from the latter cmd to the output [[#ReceiveApplicationProgress]], and returns 0.

==== RequestSendApplication ====
Takes a type-0x5 input buffer containing an array of [[NCM_services#ContentMetaKey|ContentMetaKey]], an u16 port, an u32 Ipv4Address, an [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IAsyncResult]].

[[qlaunch]] uses value 55556 for the port.

An error is thrown if a state ref-count is zero. An error is thrown if [[NIM_services|nim]] ListApplicationApplyDeltaTask returns a task.

The [[NCM_services#ContentMetaType|ContentMetaType]] must match Patch.

This does various setup and selects a ContentMetaKey to use from the input, then creates the [[#IAsyncResult]] + the async thread which handles the [[#IAsyncResult]] operation. Then the thread does:

* Calls a func which does:
** Throws an error if a state flag is set.
** Uses [[NIM_services|nim]] cmd60, returning the Result on failure.
** Uses [[NIM_services|nim]] cmd61, returning the Result on failure. Waits for the IAsyncResult operation from this to finish, then uses the Get cmd to get the output Result.
** Handles cleanup and returns.
* On success, this loads various data which is then used for saving a SystemPlayReport when a state flag is set.
** The EventId is "send_app_contents" with ApplicationId <NS ProgramId>.

==== GetSendApplicationProgress ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output [[#SendApplicationProgress]].

Same as [[#GetReceiveApplicationProgress]] except this is the Send version, and uses [[NIM_services|nim]] cmd68/cmd63 instead.

==== CompareSystemDeliveryInfo ====
Takes two type-0x15 input buffers containing a [[#SystemDeliveryInfo]], returns an output s32.

This is essentially the same as [[#CompareApplicationDeliveryInfo]], except this compares the [[#SystemDeliveryInfo]] SystemUpdate version.

==== ListNotCommittedContentMeta ====
Takes a type-0x6 output buffer containing an array of [[NCM_services#ContentMetaKey|ContentMetaKey]], a s32, an [[NCM_services#ApplicationId|ApplicationId]], returns an output s32 total_out.

==== RecoverDownloadTask ====
Takes a type-0x5 input buffer containing an array of {unknown} and an input u64, no output.

==== GetApplicationDeliveryInfoHash ====
Takes a type-0x5 input buffer containing an array of [[#ApplicationDeliveryInfo]], returns an output 0x20-byte SHA256 hash.

This extracts data from the input array for hashing with SHA256, with validation being done when handling each entry.

=== IApplicationVersionInterface ===
This is "nn::ns::detail::IApplicationVersionInterface".

This was added with [4.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetLaunchRequiredVersion
|-
| 1 || UpgradeLaunchRequiredVersion
|-
| 35 || UpdateVersionList
|-
| 36 || PushLaunchVersion
|-
| 37 || ListRequiredVersion
|-
| 800 || RequestVersionList
|-
| 801 || ListVersionList
|-
| 802 || [[#RequestVersionListData]]
|-
| 1000 || PerformAutoUpdate
|}

==== RequestVersionListData ====
No input, returns an output Event handle and an [[#IAsyncValue]].

The data that can be read from the [[#IAsyncValue]] is [[#VersionListData]].

=== IContentManagerInterface ===
This is "nn::ns::detail::IContentManagementInterface".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 11 || CalculateApplicationOccupiedSize
|-
| 43 || CheckSdCardMountStatus
|-
| 47 || GetTotalSpaceSize
|-
| 48 || GetFreeSpaceSize
|-
| 600 || CountApplicationContentMeta
|-
| 601 || ListApplicationContentMetaStatus
|-
| 605 || ListApplicationContentMetaStatusWithRightsCheck
|-
| 607 || IsAnyApplicationRunning
|}

=== IDocumentInterface ===
This is "nn::ns::detail::IDocumentInterface".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 21 || GetApplicationContentPath
|-
| 23 || ResolveApplicationContentPath
|-
| 92 || [5.0.0+] GetRunningApplicationProgramId
|}

=== IDownloadTaskInterface ===
This is "nn::ns::detail::IDownloadTaskInterface".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 701 || ClearTaskStatusList
|-
| 702 || RequestDownloadTaskList
|-
| 703 || RequestEnsureDownloadTask
|-
| 704 || ListDownloadTaskStatus
|-
| 705 || [[#RequestDownloadTaskListData]]
|-
| 706 || [4.0.0+] TryCommitCurrentApplicationDownloadTask
|-
| 707 || [4.0.0+] EnableAutoCommit
|-
| 708 || [4.0.0+] DisableAutoCommit
|-
| 709 || [4.0.0+] TriggerDynamicCommitEvent
|}

=== IReadOnlyApplicationRecordInterface ===
This is "nn::ns::detail::IReadOnlyApplicationRecordInterface".

This was added with [5.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || HasApplicationRecord || Same as [[#IApplicationManagerInterface]] cmd 910
|}

=== IReadOnlyApplicationControlDataInterface ===
This is "nn::ns::detail::IReadOnlyApplicationControlDataInterface".

This was added with [5.1.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || [[#GetApplicationControlData]] || Same as [[#IApplicationManagerInterface]] cmd 400
|-
| 1 || [[#GetApplicationDesiredLanguage]] || Same as [[#IApplicationManagerInterface]] cmd 55
|-
| 2 || ConvertApplicationLanguageToLanguageCode || Same as [[#IApplicationManagerInterface]] cmd 59
|-
| 3 || [[#ConvertLanguageCodeToApplicationLanguage]] || Same as [[#IApplicationManagerInterface]] cmd 60
|-
| 4 || [9.0.0+] SelectApplicationDesiredLanguage ||
|}

=== IDynamicRightsInterface ===
This is "nn::ns::detail::IDynamicRightsInterface".

This was added with [6.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || [[#RequestApplicationRightsOnServer]] ||
|-
| 1 || RequestAssignRights ||
|-
| 4 || DeprecatedRequestAssignRightsToResume ||
|-
| 5 || VerifyActivatedRightsOwners ||
|-
| 6 || DeprecatedGetApplicationRightsStatus ||
|-
| 7 || RequestPrefetchForDynamicRights ||
|-
| 8 || GetDynamicRightsState ||
|-
| 9 || [7.0.0+] [[#RequestApplicationRightsOnServerToResume]] ||
|-
| 10 || [7.0.0+] RequestAssignRightsToResume ||
|-
| 11 || [7.0.0+] GetActivatedRightsUsers ||
|-
| 12 || [8.0.0+] GetApplicationRightsStatus ||
|-
| 13 || [8.0.0+] GetRunningApplicationStatus ||
|}

==== RequestApplicationRightsOnServer ====
Takes a total of 0x20-bytes of input, returns an output Event handle and an [[#IAsyncValue]].

==== RequestApplicationRightsOnServerToResume ====
Takes a total of 8-bytes of input, returns an output Event handle and an [[#IAsyncValue]].

=== IECommerceInterface===
This is "nn::ns::detail::IECommerceInterface".

This was added with [4.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || RequestLinkDevice || Takes a total of 0x10-bytes of input, returns an [[#IAsyncResult]].
|-
| 1 || [6.0.0+] RequestCleanupAllPreInstalledApplications || No input, returns an [[#IAsyncResult]].
|-
| 2 || [6.0.0+] RequestCleanupPreInstalledApplication || Takes a total of 0x8-bytes of input, returns an [[#IAsyncResult]].
|-
| 3 || [6.0.0+] RequestSyncRights || No input, returns an [[#IAsyncResult]].
|-
| 4 || [6.0.0+] RequestUnlinkDevice || Takes a total of 0x10-bytes of input, returns an [[#IAsyncResult]].
|-
| 5 || [6.1.0+] RequestRevokeAllELicense || Takes a total of 0x10-bytes of input, returns an [[#IAsyncResult]].
|-
| 6 || [9.0.0+] RequestSyncRightsBasedOnAssignedELicenses ||
|}

=== IFactoryResetInterface ===
This is "nn::ns::detail::IFactoryResetInterface".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 100 || ResetToFactorySettings
|-
| 101 || ResetToFactorySettingsWithoutUserSaveData
|-
| 102 || ResetToFactorySettingsForRefurbishment
|-
| 103 || [9.1.0+] ResetToFactorySettingsWithPlatformRegion
|-
| 104 || [9.1.0+] ResetToFactorySettingsWithPlatformRegionAuthentication
|}

=== IApplicationResource ===
This is "nn::ns::detail::IApplicationResource".

This was added with [9.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Attach
|-
| 1 || BoostSystemMemoryResourceLimit
|}

= ns:vm =
This is "nn::ns::detail::IVulnerabilityManagerInterface".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 1200 || [3.0.0+] [[#NeedsUpdateVulnerability]]
|-
| 1201 || [4.0.0+] [[#UpdateSafeSystemVersionForDebug]]
|-
| 1202 || [4.0.0+] [[#GetSafeSystemVersion]]
|}

== NeedsUpdateVulnerability ==
No input, returns an output u8 bool flag.

Web-applets use this command to check if the system needs an update.

== UpdateSafeSystemVersionForDebug ==
Takes an input [[NCM_services#ApplicationId|ApplicationId]] and an u32 '''version'''.

This command is not available for retail units. On a debug unit, if the [[System_Settings|system setting]] <code>vulnerability!enable_debug</code> is set, this mounts the system savegame [[Flash_Filesystem#System_Savegames|0x8000000000000049]] as "ns_ssversion:/", opens the file "ns_ssversion:/entry" and writes the supplied [[NCM_services#ApplicationId|ApplicationId]] and '''version''' in it.

Finally, it calls [[NCM_services#ncm|OpenContentMetaDatabase]] with [[NCM_services#StorageId|StorageId]] 3, then calls [[NCM_services#IContentMetaDatabase|GetLatestContentMetaKey]] with the supplied [[NCM_services#ApplicationId|ApplicationId]] and compares the version field from the returned [[CNMT#Content_Meta_Records|Content Meta Record]] with the supplied '''version'''.

If the supplied '''version''' is higher than the one in NCM's database, the value returned by [[NS_Services#NeedsUpdateVulnerability|NeedsUpdateVulnerability]] is set to "true".

== GetSafeSystemVersion ==
No input, returns an output [[NCM_services#ContentMetaKey|ContentMetaKey]] with the cached contents of "ns_ssversion:/entry" ([[NCM_services#ApplicationId|ApplicationId]], u32 '''version''' and u32 '''policy''' from <code>vulnerability!needs_update_vulnerability_policy</code>).

= ns:su =
This is "nn::ns::detail::ISystemUpdateInterface".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#GetBackgroundNetworkUpdateState]]
|-
| 1 || [[#OpenSystemUpdateControl]]
|-
| 2 || [[#NotifyExFatDriverRequired]]
|-
| 3 || [[#ClearExFatDriverStatusForDebug]]
|-
| 4 || [[#RequestBackgroundNetworkUpdate]]
|-
| 5 || [[#NotifyBackgroundNetworkUpdate]]
|-
| 6 || [[#NotifyExFatDriverDownloadedForDebug]]
|-
| 9 || [[#GetSystemUpdateNotificationEventForContentDelivery]]
|-
| 10 || [[#NotifySystemUpdateForContentDelivery]]
|-
| 11 || [3.0.0+] [[#PrepareShutdown]]
|-
| 12 || [3.0.0-3.0.2]
|-
| 13 || [3.0.0-3.0.2]
|-
| 14 || [3.0.0-3.0.2]
|-
| 15 || [3.0.0-3.0.2]
|-
| 16 || [4.0.0+] [[#DestroySystemUpdateTask]]
|-
| 17 || [4.0.0+] [[#RequestSendSystemUpdate]]
|-
| 18 || [4.0.0+] [[#GetSendSystemUpdateProgress]]
|}

== GetBackgroundNetworkUpdateState ==
No input, returns an output [[#BackgroundNetworkUpdateState]].

This is similar to [[#HasDownloaded]], see [[#BackgroundNetworkUpdateState]].

== OpenSystemUpdateControl ==
No input, returns an [[#ISystemUpdateControl]].

== NotifyExFatDriverRequired ==
No input/output.

Only usable when an [[#ISystemUpdateControl]] isn't open.

This uses [[NIM_services|nim]] ListSystemUpdateTask, then when a task is returned uses it with DestroySystemUpdateTask.

Then this runs ExFat handling, updates state, and sets the same state flag as [[#RequestBackgroundNetworkUpdate]].

== ClearExFatDriverStatusForDebug ==
No input/output.

== RequestBackgroundNetworkUpdate ==
No input/output.

Only usable when an [[#ISystemUpdateControl]] isn't open.

This sets a state flag to value 1.

== NotifyBackgroundNetworkUpdate ==
Takes an input [[NCM_services#ContentMetaKey|ContentMetaKey]], no output.

This checks whether a sysupdate is needed with the input ContentMetaKey using [[NCM_services|NCM]] commands, if not this will just return 0. Otherwise, this will then run code which is identical to [[#RequestBackgroundNetworkUpdate]].

== NotifyExFatDriverDownloadedForDebug ==
No input/output.

== GetSystemUpdateNotificationEventForContentDelivery ==
No input, returns an output Event handle with EventClearMode=0.

== NotifySystemUpdateForContentDelivery ==
No input/output.

Signals the Event returned by [[#GetSystemUpdateNotificationEventForContentDelivery]].

== PrepareShutdown ==
No input/output.

This is used by [[AM_services|AM]].

Just returns 0 when an [[#ISystemUpdateControl]] is open.

This does various cleanup / uses various service-cmds etc for shutdown preparation.

== DestroySystemUpdateTask ==
No input/output.

Only usable when an [[#ISystemUpdateControl]] isn't open.

This uses [[NIM_services|nim]] ListSystemUpdateTask, then when a task is returned uses it with DestroySystemUpdateTask.

== RequestSendSystemUpdate ==
Takes a type-0x15 input buffer containing a [[#SystemDeliveryInfo]], an u16 port, an u32 Ipv4Address, returns an output Event handle and an [[#IAsyncResult]].

[[qlaunch]] uses value 55556 for the port. IP is normally a local-WLAN address, however this can be any address. port/addr are little-endian.

[[NIM_services|NIM]] will use the input addr/port with [[Sockets_services|bind()]]. During [[Sockets_services|accept()]] handling the addr from there must match the input addr. Hence, addr must be the client addr. [[NIM_services|NIM]] will also eventually verify that the system is not Internet-connected.

This validates the [[#SystemDeliveryInfo]] and generates a [[NCM_services#ContentMetaKey|ContentMetaKey]] from that, and creates the [[#IAsyncResult]] + the async thread which handles the [[#IAsyncResult]] operation. Then the thread does:
* Calls a func which does:
** Uses [[NIM_services|nim]] cmd76, returning the Result on failure.
** Uses [[NIM_services|nim]] cmd77, returning the Result on failure. Waits for the IAsyncResult operation from this to finish, then uses the Get cmd to get the output Result.
** Handles cleanup and returns.
* Unlike [[#RequestReceiveSystemUpdate]], this doesn't save a SystemPlayReport.

== GetSendSystemUpdateProgress ==
No input, returns an output [[#SystemUpdateProgress]].

Same as [[#GetReceiveProgress]] except this uses nim cmd81 and cmd78.

== ISystemUpdateControl ==
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#HasDownloaded]]
|-
| 1 || [[#RequestCheckLatestUpdate]]
|-
| 2 || [[#RequestDownloadLatestUpdate]]
|-
| 3 || [[#GetDownloadProgress]]
|-
| 4 || [[#ApplyDownloadedUpdate]]
|-
| 5 || [[#RequestPrepareCardUpdate]]
|-
| 6 || [[#GetPrepareCardUpdateProgress]]
|-
| 7 || [[#HasPreparedCardUpdate]]
|-
| 8 || [[#ApplyCardUpdate]]
|-
| 9 || [[#GetDownloadedEulaDataSize]]
|-
| 10 || [[#GetDownloadedEulaData]]
|-
| 11 || [[#SetupCardUpdate]]
|-
| 12 || [[#GetPreparedCardUpdateEulaDataSize]]
|-
| 13 || [[#GetPreparedCardUpdateEulaData]]
|-
| 14 || [4.0.0+] [[#SetupCardUpdateViaSystemUpdater]]
|-
| 15 || [4.0.0+] [[#HasReceived]]
|-
| 16 || [4.0.0+] [[#RequestReceiveSystemUpdate]]
|-
| 17 || [4.0.0+] [[#GetReceiveProgress]]
|-
| 18 || [4.0.0+] [[#ApplyReceivedUpdate]]
|-
| 19 || [4.0.0+] [[#GetReceivedEulaDataSize]]
|-
| 20 || [4.0.0+] [[#GetReceivedEulaData]]
|-
| 21 || [4.0.0+] [[#SetupToReceiveSystemUpdate]]
|-
| 22 || [6.0.0+] [[#RequestCheckLatestUpdateIncludesRebootlessUpdate]]
|}

Only 1 ISystemUpdateControl can be open at a time.

All Card cmds except SetupCardUpdate* require [[#SetupCardUpdate]]/[[#SetupCardUpdateViaSystemUpdater]] to be used previously. [[#GetPreparedCardUpdateEulaDataSize]]/[[#GetPreparedCardUpdateEulaData]] checks a different state flag.

=== HasDownloaded ===
No input, returns an output u8 bool flag.

Gets whether a network sysupdate was downloaded, with install pending.

Uses [[NIM_services|nim]] ListSystemUpdateTask and [[NIM_services|nim]] GetSystemUpdateTaskInfo. When ListSystemUpdateTask successfully returns a task and GetSystemUpdateTaskInfo is successful, the output flag is set to: <code>*((u8*)(taskinfo+0) == 0x3</code>. Otherwise, flag=0.

This always returns 0, however this will assert if GetSystemUpdateTaskInfo fails with ret!=0x3C89.

=== RequestCheckLatestUpdate ===
No input, returns an output Event handle and an [[#IAsyncValue]].

The data that can be read from the [[#IAsyncValue]] is [[#LatestSystemUpdate]].

=== RequestDownloadLatestUpdate ===
No input, returns an output Event handle and an [[#IAsyncResult]].

=== GetDownloadProgress ===
No input, returns an output [[#SystemUpdateProgress]].

Similar to [[#HasDownloaded]] except instead of a flag, this returns the 0x10-bytes from taskinfo+8. The output struct is cleared when the task(info) isn't available.

=== ApplyDownloadedUpdate ===
No input/output.

Runs code similar to [[#HasDownloaded]], throwing an error if a network sysupdate isn't ready for install. Then the sysupdate is installed:

* Uses ListSystemUpdateTask again, then [[NIM_services|nim]] IsExFatDriverIncluded. Runs ExFat handling when the output flag is set.
* On newer system-versions, this uses [[NIM_services|nim]] GetSystemUpdateTaskInfo then on success uses data from there to save a SystemPlayReport when a state flag is set (by default it's not set).
** The EventId is "systemupdate_dl_throughput" with ApplicationId 0100000000001018.
** The following fields are added to the report, see [[NIM_services#SystemUpdateTaskInfo|nim SystemUpdateTaskInfo]]: "ContentMetaId", "Version", "DownloadSize", and "ThroughputKBps",
* On newer system-versions, this saves another SystemPlayReport when a state flag is set (same flag mentioned above).
** The EventId is "systemupdate_pass" with ApplicationId 0100000000001021.
** This report has the following fields:
*** "Type"
*** "SourceSystemUpdateMetaId"
*** "SourceSystemUpdateMetaVersion"
*** "SourceExFatStatus"
*** "DestinationSystemUpdateMetaId"
*** "DestinationSystemUpdateMetaVersion"
*** "DestinationExFatStatus"
*** "Rebootless"
* Since FIRM will be installed later, the two flags in [[Flash_Filesystem#System_Update_Control]] are set to 1.
* Uses [[NIM_services|nim]] CommitSystemUpdateTask and [[NIM_services|nim]] DestroySystemUpdateTask.
* Installs FIRM. After installing each FIRM, the associated flag in [[Flash_Filesystem#System_Update_Control]] is set to 0.
* On newer system versions when an input flag is set, this uses [[Filesystem_services|NotifySystemDataUpdateEvent]], however this doesn't happen with ApplyDownloadedUpdate since that input flag is 0.

=== RequestPrepareCardUpdate ===
No input, returns an output Event handle and an [[#IAsyncResult]].

=== GetPrepareCardUpdateProgress ===
No input, returns an output [[#SystemUpdateProgress]].

=== HasPreparedCardUpdate ===
No input, returns an output u8 bool flag.

=== ApplyCardUpdate ===
No input/output.

=== GetDownloadedEulaDataSize ===
Takes a type-0x15 input buffer [[#EulaDataPath]], returns an output u64 '''filesize'''.

Runs code similar to [[#HasDownloaded]], throwing an error if a network sysupdate isn't ready for install.

Uses ListSystemUpdateTask again. Then [[NIM_services|nim]] GetDownloadedSystemDataPath, with the output ContentPath being used to mount the EULA title with FS.

Then "<mountname>:/<[[#EulaDataPath]]>" is opened, gets the '''filesize''', then runs cleanup.

=== GetDownloadedEulaData ===
Takes a type-0x15 input buffer [[#EulaDataPath]] and a type-0x6 output buffer, returns an output u64 '''filesize'''.

Similar to [[#GetDownloadedEulaDataSize]] except this reads the file instead, using the specified output buffer with size=filesize. This will throw an error if the filesize is larger than the buffer size.

=== SetupCardUpdate ===
Takes an input u64 size and a TransferMemory handle, no output.

Official sw creates the TransferMemory with an user-specified buffer, with permissions=None.

[[qlaunch]] uses size 0x100000 for the TransferMemory buffer.

=== GetPreparedCardUpdateEulaDataSize ===
Takes a type-0x15 input buffer [[#EulaDataPath]], returns an output u64 '''filesize'''.

This is similar to [[#GetDownloadedEulaDataSize]].

=== GetPreparedCardUpdateEulaData ===
Takes a type-0x15 input buffer [[#EulaDataPath]] and a type-0x6 output buffer, returns an output u64 '''filesize'''.

This is similar to [[#GetDownloadedEulaData]].

=== SetupCardUpdateViaSystemUpdater ===
Takes an input u64 size and a TransferMemory handle, no output.

The permissions for the TransferMemory is None.

Same as [[#SetupCardUpdate]], except this doesn't have the code for [[Filesystem_services|GetGameCardHandle/GetGameCardUpdatePartitionInfo]], and uses [[Filesystem_services|OpenRegisteredUpdatePartition]] instead of [[Filesystem_services|OpenGameCardFileSystem]]. This uses the same is_initialized bool state flag.

=== HasReceived ===
No input, returns an output u8 bool.

Same as [[#HasDownloaded]] except this uses [[NIM_services|nim]] cmd71 and cmd73.

=== RequestReceiveSystemUpdate ===
Takes a type-0x15 input buffer containing a [[#SystemDeliveryInfo]], an u16 port, an u32 Ipv4Address, returns an output Event handle and an [[#IAsyncResult]].

[[qlaunch]] uses the same value for the port as [[#RequestSendSystemUpdate]] (see [[#RequestSendSystemUpdate]] for addr as well).

[[NIM_services|NIM]] will use the input addr/port with [[Sockets_services|connect()]].

This validates the [[#SystemDeliveryInfo]] and generates a [[NCM_services#ContentMetaKey|ContentMetaKey]] from that, and creates the [[#IAsyncResult]] + the async thread which handles the [[#IAsyncResult]] operation. Then the thread does:

* Calls a func which does:
** Throws an error if [[NIM_services#ListSystemUpdateTask|ListSystemUpdateTask]] returns any task.
** Checks whether a sysupdate is actually required using the previously generated [[NCM_services#ContentMetaKey|ContentMetaKey]], throwing an error if not.
** Uses [[NIM_services|nim]] cmd69, returning the Result on failure.
** Uses [[NIM_services|nim]] cmd72, returning the Result on failure. Waits for the IAsyncResult operation from this to finish, then uses the Get cmd to get the output Result.
** Handles cleanup and returns.
* On success, this loads various data which is then used for saving a SystemPlayReport when a state flag is set.
** The EventId is "receive_system_update" with ApplicationId <NS ProgramId>.

=== GetReceiveProgress ===
No input, returns an output [[#SystemUpdateProgress]].

Same as [[#GetDownloadProgress]] except this uses [[NIM_services|nim]] cmd71 and cmd73.

=== ApplyReceivedUpdate ===
No input/output.

=== GetReceivedEulaDataSize ===
Takes a type-0x15 input buffer [[#EulaDataPath]], returns an output u64 '''filesize'''.

This is similar to [[#GetDownloadedEulaDataSize]].

=== GetReceivedEulaData ===
Takes a type-0x15 input buffer [[#EulaDataPath]] and a type-0x6 output buffer, returns an output u64 '''filesize'''.

This is similar to [[#GetDownloadedEulaData]].

=== SetupToReceiveSystemUpdate ===
No input/output.

This just uses [[NIM_services|nim]] ListSystemUpdateTask, then when a task is returned uses it with DestroySystemUpdateTask.

[[qlaunch]] uses this before [[#RequestReceiveSystemUpdate]].

=== RequestCheckLatestUpdateIncludesRebootlessUpdate ===
No input, returns an output Event handle and an [[#IAsyncValue]].

= IAsyncValue =
This is "nn::ns::detail::IAsyncValue".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetSize
|-
| 1 || Get
|-
| 2 || Cancel
|-
| 3 || [4.0.0+] GetErrorContext
|}

Official sw creates a container object for this using the output from the service commands, which contains the IAsyncValue object, and the Event with EventClearMode=0.

* GetSize: No input, returns an output u64.
* Get: Takes a type-0x6 output buffer, no output. Official sw waits on the Event prior to using this cmd.
* Cancel: No input/output. Used by official sw when closing the object, when the serv-obj is initialized (after using the cmd, official sw will also wait on the Event). This cmd is also used in other official sw funcs.
* GetErrorContext: No input/output, takes a type-0x16 output buffer containing an [[Error_Applet#ErrorContext|ErrorContext]].

= IAsyncResult =
This is "nn::ns::detail::IAsyncResult".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Get
|-
| 1 || Cancel
|-
| 2 || [4.0.0+] GetErrorContext
|}

Official sw creates a container object for this using the output from the service commands, which contains the IAsyncResult object, and the Event with EventClearMode=0.

* Get: No input/output. Official sw waits on the Event prior to using this cmd.
* Cancel: No input/output. Used by official sw when closing the object, when the serv-obj is initialized (after using the cmd, official sw will also wait on the Event). This cmd is also used in other official sw funcs.
* GetErrorContext: No input/output, takes a type-0x16 output buffer containing an [[Error_Applet#ErrorContext|ErrorContext]].

= ns:dev =
This is "nn::ns::detail::IDevelopInterface".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#LaunchProgram]]
|-
| 1 || [[#TerminateProcess]]
|-
| 2 || [[#TerminateProgram]]
|-
| 4 || [[#GetShellEvent]]
|-
| 5 || [[#GetShellEventInfo]]
|-
| 6 || [[#TerminateApplication]]
|-
| 7 || [[#PrepareLaunchProgramFromHost]]
|-
| 8 || [[#LaunchApplicationForDevelop]]
|-
| 9 || [[#LaunchApplicationWithStorageIdForDevelop]]
|-
| 10 || [6.0.0-8.1.0] IsSystemMemoryResourceLimitBoosted
|-
| 11 || [6.0.0+] GetRunningApplicationProcessIdForDevelop
|-
| 12 || [6.0.0+] SetCurrentApplicationRightsEnvironmentCanBeActiveForDevelop
|-
| 13 || [9.0.0+] [[#CreateApplicationResourceForDevelop]]
|-
| 14 || [9.0.0+] [[#IsPreomiaForDevelop]]
|}

== LaunchProgram ==
Wrapper for "pm:shell" [[Process_Manager_services#pm:shell|LaunchProcess]].

== TerminateProcess ==
Wrapper for "pm:shell" [[Process_Manager_services#pm:shell|TerminateProcess]].

== TerminateProgram ==
Wrapper for "pm:shell" [[Process_Manager_services#pm:shell|TerminateProgram]].

== GetShellEvent ==
Wrapper for "pm:shell" [[Process_Manager_services#pm:shell|GetProcessEventHandle]].

== GetShellEventInfo ==
Wrapper for "pm:shell" [[Process_Manager_services#pm:shell|GetProcessEventInfo]].

== TerminateApplication ==
Calls "pm:shell" [[Process_Manager_services#pm:shell|GetApplicationProcessIdForShell]] and sends PID to [[Process_Manager_services#pm:shell|TerminateProcess]].

== PrepareLaunchProgramFromHost ==
Takes a type-0x5 input buffer containing the [[Filesystem_services|ContentPath]], returns an output 0x10-byte struct.

Calls [[NCM_services#IPathResolverForStorage|IPathResolverForStorage]] Set...NcaPath functions.

== LaunchApplicationForDevelop ==
Takes an input u32 [[Process_Manager_services#LaunchFlags|LaunchFlags]] and [[NCM_services#ApplicationId|ApplicationId]], returns an output u64 PID.

Same as LaunchApplicationWithStorageId except the last two params passed to the internal vtable funcptr call are value 0x6, instead of from the command input.

== LaunchApplicationWithStorageIdForDevelop ==
Takes 2 input u8s, an u32 [[Process_Manager_services#LaunchFlags|LaunchFlags]], and an [[NCM_services#ApplicationId|ApplicationId]]. Returns an output u64 PID.

Launches an application title which is registered with NS.

== CreateApplicationResourceForDevelop ==
Takes an input u32 (1 = Preomia). Returns an [[#IApplicationResource]].

== IsPreomiaForDevelop ==
Takes an u64 [[NCM_services#ProgramId|ProgramId]]. Returns a bool.

= VersionListData =
This is "nn::ns::VersionListData".

= ApplicationUpdateInfo =
This is "nn::ns::ApplicationUpdateInfo".

= NoDownloadRightsErrorResolution =
This is "nn::ns::NoDownloadRightsErrorResolution".

= BackgroundNetworkUpdateState =
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || No sysupdate task exists.
|-
| 1 || Sysupdate download in progress.
|-
| 2 || Sysupdate ready, pending install.
|}

This is "nn::ns::BackgroundNetworkUpdateState". This is an u8.

Similar to [[#HasDownloaded]], [[#GetBackgroundNetworkUpdateState]] uses [[NIM_services|nim]] ListSystemUpdateTask and [[NIM_services|nim]] GetSystemUpdateTaskInfo. When ListSystemUpdateTask successfully returns a task and GetSystemUpdateTaskInfo is successful, the output value is set to: <code>1 + *((u8*)(taskinfo+0) == 0x3</code>. Otherwise, value=0.

[[#GetBackgroundNetworkUpdateState]] always returns Result 0, however this will assert if GetSystemUpdateTaskInfo fails with ret!=0x3C89.

= SystemUpdateProgress =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || s64 Current size. This value can be larger than total_size when the async operation is finishing. When total_size is <=0, this current_size field may contain a progress value for when the total_size is not yet determined.
|-
| 0x8 || 0x8 || s64 Total size, this field is only valid when >0.
|}

This is "nn::ns::SystemUpdateProgress". This is a 0x10-byte struct.

Commands which have this as output will return 0 with the output cleared, when no task is available.

= EulaDataPath =
This is "nn::ns::detail::EulaDataPath". This is a 0x100-byte struct.

This contains a file path.

= SystemDeliveryInfo =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || SystemDeliveryProtocolVersion. Must be <= to and match [[System_Settings|system-setting]] <code>contents_delivery!system_delivery_protocol_version</code>.
|-
| 0x4 || 0x4 || ApplicationDeliveryProtocolVersion. Loaded from [[System_Settings|system-setting]] <code>contents_delivery!application_delivery_protocol_version</code>. Unused by [[#RequestSendSystemUpdate]]/[[#RequestReceiveSystemUpdate]], besides HMAC validation.
|-
| 0x8 || 0x1 || HasExFat. Unused by [[#RequestSendSystemUpdate]]/[[#RequestReceiveSystemUpdate]], besides HMAC validation.
|-
| 0x9 || 0x3 || Reserved.
|-
| 0xC || 0x4 || SystemUpdateMetaVersion.
|-
| 0x10 || 0x8 || SystemUpdateMetaId.
|-
| 0x18 || 0x1 || FirmwareVariationId. Used by [[#RequestSendSystemUpdate]].
|-
| 0x19 || 0x1 || UpdatableFirmwareGroupId. Unused by [[#RequestSendSystemUpdate]]/[[#RequestReceiveSystemUpdate]], besides HMAC validation.
|-
| 0x1A || 0x1 || PlatformRegion (0x00 = Unknown, 0x01 = Global, 0x02 = China).
|-
| 0x1B || 0xC5 || Unused by [[#RequestSendSystemUpdate]]/[[#RequestReceiveSystemUpdate]], besides HMAC validation.
|-
| 0xE0 || 0x20 || HMAC-SHA256 over the previous 0xE0-bytes.
|}

This is "nn::ns::SystemDeliveryInfo". This is a 0x100-byte struct.

= ApplicationDeliveryInfo =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || ?
|-
| 0x8 || 0x8 || ApplicationId.
|-
| 0x10 || 0x4 || ApplicationVersion.
|-
| 0x14 || 0x4 || ?
|-
| 0x18 || 0x4 || RequiredSystemVersion.
|-
| 0x1C || 0x4 || ?
|-
| 0x20 || 0xC0 || ?
|-
| 0xE0 || 0x20 || HMAC-SHA256 over the previous 0xE0-bytes. Uses a different key than [[#SystemDeliveryInfo]].
|}

This is "nn::ns::ApplicationDeliveryInfo". This is a 0x100-byte struct.

= LatestSystemUpdate =
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 1 || Unknown.
|-
| 2 || Unknown.
|-
| Other values || Unknown.
|}

This is "nn::ns::LatestSystemUpdate". This is an u8.

= ReceiveApplicationProgress =
This is "nn::ns::ReceiveApplicationProgress". This is a 0x10-byte struct.

= SendApplicationProgress =
This is "nn::ns::SendApplicationProgress". This is a 0x10-byte struct.

[[Category:Services]]