Nintendo Switch Brew - User contributions [en]

NS services

2026-08-09T17:53:08Z

Yellows8:

= aoc:u =
This is "nn::aocsrv::detail::IAddOnContentManager".

This is only available when [[Process_Manager_services|pm:bm]] GetBootMode returns output 0 (Normal).

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [1.0.0-6.2.0] CountAddOnContentByApplicationId
|-
| 1 || [1.0.0-6.2.0] ListAddOnContentByApplicationId
|-
| 2 || CountAddOnContent
|-
| 3 || ListAddOnContent
|-
| 4 || [1.0.0-6.2.0] GetAddOnContentBaseIdByApplicationId
|-
| 5 || GetAddOnContentBaseId
|-
| 6 || [1.0.0-6.2.0] PrepareAddOnContentByApplicationId
|-
| 7 || PrepareAddOnContent
|-
| 8 || [4.0.0+] GetAddOnContentListChangedEvent
|-
| 9 || [10.0.0+] GetAddOnContentLostErrorCode
|-
| 10 || [11.0.0+] GetAddOnContentListChangedEventWithProcessId
|-
| 11 || [13.0.0+] NotifyMountAddOnContent
|-
| 12 || [13.0.0+] NotifyUnmountAddOnContent
|-
| 13 || [13.0.0+] IsAddOnContentMountedForDebug
|-
| 50 || [13.0.0+] CheckAddOnContentMountStatus
|-
| 100 || [7.0.0+] [[#IPurchaseEventManager|CreateEcPurchasedEventManager]]
|-
| 101 || [9.0.0+] [[#IPurchaseEventManager|CreatePermanentEcPurchasedEventManager]]
|-
| 110 || [12.0.0+] [[#IContentsServiceManager|CreateContentsServiceManager]]
|-
| 200 || [13.1.0+] SetRequiredAddOnContentsOnContentsAvailabilityTransition
|-
| 300 || [16.0.0+] SetupHostAddOnContent
|-
| 301 || [16.0.0+] GetRegisteredAddOnContentPath
|-
| 302 || [16.0.0+] UpdateCachedList
|}

== IPurchaseEventManager ==
This is "nn::ec::IPurchaseEventManager".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || SetDefaultDeliveryTarget
|-
| 1 || SetDeliveryTarget
|-
| 2 || GetPurchasedEventReadableHandle
|-
| 3 || PopPurchasedProductInfo
|-
| 4 || [9.0.0+] PopPurchasedProductInfoWithUid
|}

== IContentsServiceManager ==
This is "nn::ec::IContentsServiceManager".

This was added with [12.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [16.0.0+] RequestContentsAuthorizationTokenDeprecated ([12.0.0-15.0.1] [[#RequestContentsAuthorizationToken]])
|-
| 1 || [16.0.0+] RequestContentsAuthorizationToken
|}

=== RequestContentsAuthorizationToken ===
Takes a total of 0x50-bytes of input, a PID, a type-0x5 input buffer. Returns an [[#IAsyncData|IAsyncData]] and an output handle.

== IAsyncData ==
This is "nn::ec::detail::IAsyncData".

This was added with [12.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetSize
|-
| 1 || Get
|-
| 2 || Cancel
|}

= ns:am =
This is "nn::ns::detail::IApplicationManagerInterface".

[3.0.0+] This service was replaced by [[#ns:am2, ns:ec, ns:rid, ns:rt, ns:web, ns:ro, ns:sweb|ns:am2]].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#ListApplicationRecord]]
|-
| 1 || GenerateApplicationRecordCount
|-
| 2 || GetApplicationRecordUpdateSystemEvent
|-
| 3 || GetApplicationView
|-
| 4 || DeleteApplicationEntity
|-
| 5 || DeleteApplicationCompletely
|-
| 6 || IsAnyApplicationEntityRedundant
|-
| 7 || DeleteRedundantApplicationEntity
|-
| 8 || IsApplicationEntityMovable
|-
| 9 || MoveApplicationEntity
|-
| 11 || [[#CalculateApplicationOccupiedSize]]
|-
| 16 || PushApplicationRecord
|-
| 17 || ListApplicationRecordContentMeta
|-
| 18 || CheckLaunchRights
|-
| 19 || [[#LaunchApplication]]
|-
| 21 || [[#GetApplicationContentPath]]
|-
| 22 || TerminateApplication
|-
| 23 || [2.0.0+] ResolveApplicationContentPath
|-
| 26 || BeginInstallApplication
|-
| 27 || DeleteApplicationRecord
|-
| 30 || RequestApplicationUpdateInfo
|-
| 31 || RequestUpdateApplication
|-
| 32 || CancelApplicationDownload
|-
| 33 || ResumeApplicationDownload
|-
| 34 || ClearTaskStatusList
|-
| 35 || UpdateVersionList
|-
| 36 || PushLaunchVersion
|-
| 37 || ListRequiredVersion
|-
| 38 || CheckApplicationLaunchVersion
|-
| 39 || CheckApplicationLaunchRights
|-
| 40 || GetApplicationLogoData
|-
| 41 || CalculateApplicationDownloadRequiredSize
|-
| 42 || CleanupSdCard
|-
| 43 || [[#CheckSdCardMountStatus]]
|-
| 44 || GetSdCardMountStatusChangedEvent
|-
| 45 || GetGameCardAttachmentEvent
|-
| 46 || GetGameCardAttachmentInfo
|-
| 47 || [[#GetTotalSpaceSize]]
|-
| 48 || [[#GetFreeSpaceSize]]
|-
| 49 || GetSdCardRemovedEvent
|-
| 52 || GetGameCardUpdateDetectionEvent
|-
| 53 || DisableApplicationAutoDelete
|-
| 54 || EnableApplicationAutoDelete
|-
| 55 || [[#GetApplicationDesiredLanguage]]
|-
| 56 || SetApplicationTerminateResult
|-
| 57 || ClearApplicationTerminateResult
|-
| 58 || GetLastSdCardMountUnexpectedResult
|-
| 59 || ConvertApplicationLanguageToLanguageCode
|-
| 60 || [[#ConvertLanguageCodeToApplicationLanguage]]
|-
| 61 || GetBackgroundDownloadStressTaskInfo
|-
| 62 || GetGameCardStopper
|-
| 63 || IsSystemProgramInstalled
|-
| 64 || [2.0.0+] StartApplyDeltaTask
|-
| 65 || [2.0.0+] GetRequestServerStopper
|-
| 100 || ResetToFactorySettings
|-
| 101 || ResetToFactorySettingsWithoutUserSaveData
|-
| 102 || [2.0.0+] ResetToFactorySettingsForRefurbishment
|-
| 200 || CalculateUserSaveDataStatistics
|-
| 201 || DeleteUserSaveDataAll
|-
| 210 || DeleteUserSystemSaveData
|-
| 220 || UnregisterNetworkServiceAccount
|-
| 300 || GetApplicationShellEvent
|-
| 301 || PopApplicationShellEventInfo
|-
| 302 || LaunchLibraryApplet
|-
| 303 || TerminateLibraryApplet
|-
| 304 || LaunchSystemApplet
|-
| 305 || TerminateSystemApplet
|-
| 306 || LaunchOverlayApplet
|-
| 307 || TerminateOverlayApplet
|-
| 400 || [[#GetApplicationControlData]]
|-
| 401 || InvalidateAllApplicationControlCache
|-
| 402 || RequestDownloadApplicationControlData
|-
| 403 || GetMaxApplicationControlCacheCount
|-
| 404 || [2.0.0+] InvalidateApplicationControlCache
|-
| 405 || [2.0.0+] ListApplicationControlCacheEntryInfo
|-
| 502 || [2.0.0+] RequestCheckGameCardRegistration
|-
| 503 || [2.0.0+] RequestGameCardRegistrationGoldPoint
|-
| 504 || [2.0.0+] RequestRegisterGameCard
|-
| 600 || [2.0.0+] [[#CountApplicationContentMeta]]
|-
| 601 || [2.0.0+] [[#ListApplicationContentMetaStatus]]
|-
| 602 || [2.0.0+] ListOwnedAndInstalledAddOnContent
|-
| 603 || [2.0.0+] GetOwnedApplicationContentMetaStatus
|-
| 604 || [2.0.0+] RegisterContentsExternalKey
|-
| 605 || [2.0.0+] ListApplicationContentMetaStatusWithRightsCheck
|-
| 700 || [2.0.0+] PushDownloadTaskList
|-
| 701 || [2.0.0+] [[#ClearTaskStatusList]]
|-
| 702 || [2.0.0+] [[#RequestDownloadTaskList]]
|-
| 703 || [2.0.0+] [[#RequestEnsureDownloadTask]]
|-
| 704 || [2.0.0+] [[#ListDownloadTaskStatus]]
|-
| 705 || [2.0.0+] RequestDownloadTaskListData
|-
| 800 || [2.0.0+] RequestVersionList
|-
| 801 || [2.0.0+] ListVersionList
|-
| 900 || [2.0.0+] GetApplicationRecord
|-
| 901 || [2.0.0+] GetApplicationRecordProperty
|-
| 902 || [2.0.0+] EnableApplicationAutoUpdate
|-
| 903 || [2.0.0+] DisableApplicationAutoUpdate
|-
| 904 || [2.0.0+] TouchApplication
|-
| 905 || [2.0.0+] RequestApplicationUpdate
|-
| 906 || [2.0.0+] IsApplicationUpdateRequested
|-
| 907 || [2.0.0+] WithdrawApplicationUpdateRequest
|-
| 908 || [2.0.0+] ListApplicationRecordInstalledContentMeta
|-
| 1000 || [2.0.0+] RequestVerifyApplication
|-
| 1001 || [2.0.0+] CorruptApplicationForDebug
|-
| 1200 || [2.0.0+] [[#NeedsUpdateVulnerability]]
|-
| 1300 || [2.0.0+] IsAnyApplicationEntityInstalled
|-
| 1301 || [2.0.0+] DeleteApplicationContentEntities
|-
| 1302 || [2.0.0+] CleanupUnrecordedApplicationEntity
|-
| 1400 || [2.0.0+] PrepareShutdown
|-
| 1500 || [2.0.0+] FormatSdCard
|-
| 1501 || [2.0.0+] NeedsSystemUpdateToFormatSdCard
|-
| 1502 || [2.0.0+] GetLastSdCardFormatUnexpectedResult
|-
| 1503 || [2.0.0+] DetachSdCard
|-
| 1600 || [2.0.0+] GetSystemSeedForPseudoDeviceId
|-
| 1700 || [2.0.0+] ListApplicationDownloadingContentMeta
|-
| 1800 || [2.0.0+] IsNotificationSetupCompleted
|-
| 1801 || [2.0.0+] GetLastNotificationInfoCount
|-
| 1802 || [2.0.0+] ListLastNotificationInfo
|}

== ListApplicationRecord ==
Takes a type-0x6 output buffer containing an array of [[#ApplicationRecord]] and an s32 entry_offset, returns an output s32 out_entrycount.

Returns an array of entries with the below format using the specified offset and count.

== LaunchApplication ==
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output u64 PID.

Launches an application title which is registered with NS.

== GetApplicationContentPath ==
Takes a 0x16-type output buffer, an u8 [[NCM_services#ContentType|ContentType]], and an [[NCM_services#ApplicationId|ApplicationId]].

The input [[NCM_services#ApplicationId|ApplicationId]] is used with the application-title table like various other cmds, anything not in that table can't be used with this.

Returns a string path for the specified type of patch content with this [[NCM_services#ApplicationId|ApplicationId]], otherwise returns regular-application paths when update-title not installed. Returns an error when the specified type of content doesn't exist for this title. Starts with "@{SdCardContent,UserContent}://" and ends in ".nca".

For gamecard content, the output path is: "@GcSXXXXXXXX:/<NcaId>.nca". NCA-type0 with gamecard returns 0 with an empty output string.

The output string is then used by the user-process with [[Filesystem_services|FS]] to mount the content.

== GetTotalSpaceSize ==
Takes an input u8 [[NCM_services#StorageId|StorageId]], no output.

The StorageId must be SdCard.

Returns the s64 from [[NCM_services#IContentStorage]] GetFreeSpaceSize.

== GetFreeSpaceSize ==
Takes an input u8 [[NCM_services#StorageId|StorageId]], no output.

The StorageId must be SdCard.

Returns the s64 from [[NCM_services#IContentStorage]] GetTotalSpaceSize.

== GetApplicationDesiredLanguage ==
Takes an input u8 language-bitmask, returns an output u8 [[control.nacp]] langentry index.

User-processes generate the language-bitmask with the following for all 16 lang-entries: <code>if(<either string in langentry[i] is non-empty>)bitmask |= 1<<i</code>

== ConvertLanguageCodeToApplicationLanguage ==
Takes an input u8 pointer for the resulting Id to be written to and a string represented as a u64 (i.e 0x53552D6E65 for 'en-US').

Returns 0 if an ID was successfully found, otherwise returns 0x25810.

== GetApplicationControlData ==
Takes an input u8 [[#ApplicationControlSource]], an [[NCM_services#ApplicationId|ApplicationId]], and a type-0x6 output buffer. Returns an output u32 for actual_size. Official user-processes use buffer size 0x24000. [[qlaunch]] only uses source value 0x1 (Storage if not in cache).

Loads cached [[control.nacp]] to buf+0 and the cached icon to buf+0x4000. Returns an error if the buffer is too small.

== ListApplicationContentMetaStatus ==
Takes a type-0x6 output buffer containing an array of [[#ApplicationContentMetaStatus]], an input s32 index and [[NCM_services#ApplicationId|ApplicationId]], returns an output s32 out_entrycount.

Returns 0x10-byte entries using the specified [[NCM_services#ApplicationId|ApplicationId]] starting at the specified index. Can only return game titles. The second entry if any is the update-title usually. When the input entryindex is >= totalentries, this will return 0 with out_entrycount=0.

= ns:am2, ns:ec, ns:rid, ns:rt, ns:web, ns:ro, ns:sweb =
These are "nn::ns::detail::IServiceGetterInterface".

These commands check a state field for a command-specific bit and returns an error if not set, this is a permissions check for service+command.

[11.0.0+] ns:ro was added.

[15.0.0+] ns:sweb was added.

{| class="wikitable" border="1"
|-
! Cmd || Name || Permission bit
|-
| 7988 || [6.0.0+] [[#IDynamicRightsInterface|GetDynamicRightsInterface]] || 10
|-
| 7989 || [5.1.0+] [[#IReadOnlyApplicationControlDataInterface|GetReadOnlyApplicationControlDataInterface]] || 9
|-
| 7991 || [5.0.0+] [[#IReadOnlyApplicationRecordInterface|GetReadOnlyApplicationRecordInterface]] || 8
|-
| 7992 || [4.0.0+] [[#IECommerceInterface|GetECommerceInterface]] || 7
|-
| 7993 || [4.0.0+] [[#IApplicationVersionInterface|GetApplicationVersionInterface]] || 6
|-
| 7994 || [[#IFactoryResetInterface|GetFactoryResetInterface]] || 5
|-
| 7995 || [[#IAccountProxyInterface|GetAccountProxyInterface]] || 4
|-
| 7996 || [[#IApplicationManagerInterface|GetApplicationManagerInterface]] || 3
|-
| 7997 || [[#IDownloadTaskInterface|GetDownloadTaskInterface]] || 1
|-
| 7998 || [[#IContentManagementInterface|GetContentManagementInterface]] || 0
|-
| 7999 || [[#IDocumentInterface|GetDocumentInterface]] || 2
|}

Permissions state field with each service:

{| class="wikitable" border="1"
|-
! Service || Permissions
|-
| ns:web || 0x304
|-
| ns:ec || 0x83
|-
| ns:sweb || 0x387
|-
| ns:rid || 0x10
|-
| ns:rt || 0x20
|-
| ns:ro || 0x301
|-
| ns:am2 || 0x7FF
|}

=== IAccountProxyInterface ===
This is "nn::ns::detail::IAccountProxyInterface".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || CreateUserAccount
|}

=== IApplicationManagerInterface ===
This is "nn::ns::detail::IApplicationManagerInterface".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#ListApplicationRecord]]
|-
| 1 || GenerateApplicationRecordCount
|-
| 2 || [[#GetApplicationRecordUpdateSystemEvent]]
|-
| 3 || [[#GetApplicationViewDeprecated]]
|-
| 4 || [[#DeleteApplicationEntity]]
|-
| 5 || [[#DeleteApplicationCompletely]]
|-
| 6 || IsAnyApplicationEntityRedundant
|-
| 7 || [[#DeleteRedundantApplicationEntity]]
|-
| 8 || [[#IsApplicationEntityMovable]]
|-
| 9 || [1.0.0-9.2.0] [[#MoveApplicationEntity]]
|-
| 11 || [[#CalculateApplicationOccupiedSize]]
|-
| 16 || PushApplicationRecord
|-
| 17 || ListApplicationRecordContentMeta
|-
| 19 || [1.0.0-5.1.0] LaunchApplicationOld
|-
| 21 || [[#GetApplicationContentPath]]
|-
| 22 || TerminateApplication
|-
| 23 || ResolveApplicationContentPath
|-
| 26 || BeginInstallApplication
|-
| 27 || DeleteApplicationRecord
|-
| 30 || [[#RequestApplicationUpdateInfo]]
|-
| 31 || [1.0.0-3.0.2] RequestUpdateApplication
|-
| 32 || [[#CancelApplicationDownload]]
|-
| 33 || [[#ResumeApplicationDownload]]
|-
| 35 || UpdateVersionList
|-
| 36 || PushLaunchVersion
|-
| 37 || ListRequiredVersion
|-
| 38 || [[#CheckApplicationLaunchVersion]]
|-
| 39 || [1.0.0-6.2.0] CheckApplicationLaunchRights
|-
| 40 || GetApplicationLogoData
|-
| 41 || CalculateApplicationDownloadRequiredSize
|-
| 42 || [[#CleanupSdCard]]
|-
| 43 || [[#CheckSdCardMountStatus]]
|-
| 44 || [[#GetSdCardMountStatusChangedEvent]]
|-
| 45 || GetGameCardAttachmentEvent
|-
| 46 || GetGameCardAttachmentInfo
|-
| 47 || [[#GetTotalSpaceSize]]
|-
| 48 || [[#GetFreeSpaceSize]]
|-
| 49 || GetSdCardRemovedEvent
|-
| 52 || [[#GetGameCardUpdateDetectionEvent]]
|-
| 53 || [[#DisableApplicationAutoDelete]]
|-
| 54 || [[#EnableApplicationAutoDelete]]
|-
| 55 || GetApplicationDesiredLanguage
|-
| 56 || [[#SetApplicationTerminateResult]]
|-
| 57 || [[#ClearApplicationTerminateResult]]
|-
| 58 || [[#GetLastSdCardMountUnexpectedResult]]
|-
| 59 || ConvertApplicationLanguageToLanguageCode
|-
| 60 || [[#ConvertLanguageCodeToApplicationLanguage]]
|-
| 61 || GetBackgroundDownloadStressTaskInfo
|-
| 62 || GetGameCardStopper
|-
| 63 || IsSystemProgramInstalled
|-
| 64 || StartApplyDeltaTask
|-
| 65 || [[#GetRequestServerStopper]]
|-
| 66 || [3.0.0+] GetBackgroundApplyDeltaStressTaskInfo
|-
| 67 || [3.0.0+] [[#CancelApplicationApplyDelta]]
|-
| 68 || [3.0.0+] [[#ResumeApplicationApplyDelta]]
|-
| 69 || [3.0.0+] [[#CalculateApplicationApplyDeltaRequiredSize]]
|-
| 70 || [3.0.0+] [[#ResumeAll]]
|-
| 71 || [3.0.0+] [[#GetStorageSize]]
|-
| 80 || [3.0.0+] RequestDownloadApplication
|-
| 81 || [3.0.0+] RequestDownloadAddOnContent
|-
| 82 || [3.0.0+] DownloadApplication
|-
| 83 || [4.0.0-6.2.0] CheckApplicationResumeRights
|-
| 84 || [4.0.0-16.1.0] GetDynamicCommitEvent
|-
| 85 || [4.0.0+] [[#RequestUpdateApplication2]]
|-
| 86 || [4.0.0+] EnableApplicationCrashReport
|-
| 87 || [4.0.0+] IsApplicationCrashReportEnabled
|-
| 90 || [15.0.0+] BoostSystemMemoryResourceLimit ([4.0.0-8.1.0] BoostSystemMemoryResourceLimit)
|-
| 91 || [5.0.0+] DeprecatedLaunchApplication
|-
| 92 || [5.0.0+] GetRunningApplicationProgramId
|-
| 93 || [5.0.0+] GetMainApplicationProgramIndex
|-
| 94 || [6.0.0+] [[#LaunchApplication_2|LaunchApplication]]
|-
| 95 || [6.0.0+] [[#GetApplicationLaunchInfo]]
|-
| 96 || [6.0.0+] [[#AcquireApplicationLaunchInfo]]
|-
| 97 || [6.0.0+] [[#GetMainApplicationProgramIndexByApplicationLaunchInfo]]
|-
| 98 || [6.0.0+] EnableApplicationAllThreadDumpOnCrash
|-
| 99 || [8.0.0+] [[#LaunchDevMenu]]
|-
| 100 || [[#ResetToFactorySettings]]
|-
| 101 || [[#ResetToFactorySettingsWithoutUserSaveData]]
|-
| 102 || [[#ResetToFactorySettingsForRefurbishment]]
|-
| 103 || [9.1.0+] [[#ResetToFactorySettingsWithPlatformRegion]]
|-
| 104 || [9.1.0+] [[#ResetToFactorySettingsWithPlatformRegionAuthentication]]
|-
| 105 || [10.0.0+] [[#RequestResetToFactorySettingsSecurely]]
|-
| 106 || [10.0.0+] [[#RequestResetToFactorySettingsWithPlatformRegionAuthenticationSecurely]]
|-
| 200 || CalculateUserSaveDataStatistics
|-
| 201 || [[#DeleteUserSaveDataAll]]
|-
| 210 || [[#DeleteUserSystemSaveData]]
|-
| 211 || [6.0.0+] [[#DeleteSaveData]]
|-
| 220 || [[#UnregisterNetworkServiceAccount]]
|-
| 221 || [6.0.0+] [[#UnregisterNetworkServiceAccountWithUserSaveDataDeletion]]
|-
| 300 || GetApplicationShellEvent
|-
| 301 || PopApplicationShellEventInfo
|-
| 302 || [[#LaunchLibraryApplet]]
|-
| 303 || TerminateLibraryApplet
|-
| 304 || [[#LaunchSystemApplet]]
|-
| 305 || TerminateSystemApplet
|-
| 306 || [[#LaunchOverlayApplet]]
|-
| 307 || TerminateOverlayApplet
|-
| 308 || [S2]
|-
| 309 || [S2]
|-
| 400 || [[#GetApplicationControlData]]
|-
| 401 || InvalidateAllApplicationControlCache
|-
| 402 || [[#RequestDownloadApplicationControlData]]
|-
| 403 || GetMaxApplicationControlCacheCount
|-
| 404 || InvalidateApplicationControlCache
|-
| 405 || ListApplicationControlCacheEntryInfo
|-
| 406 || [6.0.0-18.1.0] [[#GetApplicationControlProperty]]
|-
| 407 || [8.0.0+] [[#ListApplicationTitle]]
|-
| 408 || [8.0.0+] [[#ListApplicationIcon]]
|-
| 409 || [S2]
|-
| 410 || [S2]
|-
| 411 || [19.0.0+]
|-
| 412 || [19.0.0+]
|-
| 413 || [19.0.0+]
|-
| 414 || [19.0.0+]
|-
| 415 || [19.0.0+]
|-
| 416 || [19.0.0+]
|-
| 417 || [19.0.0+] InvalidateAllApplicationControlCacheOfTheStage
|-
| 418 || [19.0.0+] InvalidateApplicationControlCacheOfTheStage
|-
| 419 || [19.0.0+] RequestDownloadApplicationControlDataInBackground
|-
| 420 || [19.0.0+] CloneApplicationControlDataCacheForDebug
|-
| 421 || [20.0.0+]
|-
| 422 || [20.0.0+]
|-
| 423 || [20.0.0+]
|-
| 424 || [20.0.0+]
|-
| 425 || [20.0.0+]
|-
| 426 || [20.0.0+]
|-
| 427 || [20.0.0+]
|-
| 428 || [21.0.0+]
|-
| 429 || [21.0.0+]
|-
| 430 || [21.0.0+]
|-
| 502 || [[#RequestCheckGameCardRegistration]]
|-
| 503 || [[#RequestGameCardRegistrationGoldPoint]]
|-
| 504 || [[#RequestRegisterGameCard]]
|-
| 505 || [3.0.0+] [[#GetGameCardMountFailureEvent]]
|-
| 506 || [3.0.0+] [[#IsGameCardInserted]]
|-
| 507 || [3.0.0+] [[#EnsureGameCardAccess]]
|-
| 508 || [3.0.0+] [[#GetLastGameCardMountFailureResult]]
|-
| 509 || [5.0.0+] [[#ListApplicationIdOnGameCard]]
|-
| 510 || [9.0.0+] [[#GetGameCardPlatformRegion]]
|-
| 511 || [19.0.0+] GetGameCardWakenReadyEvent
|-
| 512 || [19.0.0+] IsGameCardApplicationRunning
|-
| 513 || [20.0.0+]
|-
| 514 || [20.0.0+]
|-
| 515 || [20.0.0+]
|-
| 516 || [21.0.0+]
|-
| 517 || [21.0.0+]
|-
| 518 || [21.0.0+]
|-
| 519 || [21.0.0+]
|-
| 600 || [[#CountApplicationContentMeta]]
|-
| 601 || [[#ListApplicationContentMetaStatus]]
|-
| 602 || [2.0.0-5.1.0] ListAvailableAddOnContent
|-
| 603 || GetOwnedApplicationContentMetaStatus
|-
| 604 || [1.0.0-15.0.1] RegisterContentsExternalKey
|-
| 605 || ListApplicationContentMetaStatusWithRightsCheck
|-
| 606 || [3.0.0+] GetContentMetaStorage
|-
| 607 || [6.0.0+] [[#ListAvailableAddOnContent]]
|-
| 609 || [13.0.0+] ListAvailabilityAssuredAddOnContent
|-
| 610 || [14.0.0+] GetInstalledContentMetaStorage
|-
| 611 || [16.0.0+] PrepareAddOnContent
|-
| 700 || PushDownloadTaskList
|-
| 701 || [[#ClearTaskStatusList]]
|-
| 702 || [[#RequestDownloadTaskList]]
|-
| 703 || [[#RequestEnsureDownloadTask]]
|-
| 704 || [[#ListDownloadTaskStatus]]
|-
| 705 || [[#RequestDownloadTaskListData]]
|-
| 800 || RequestVersionList
|-
| 801 || ListVersionList
|-
| 802 || [3.0.0+] [[#RequestVersionListData]]
|-
| 900 || GetApplicationRecord
|-
| 901 || GetApplicationRecordProperty
|-
| 902 || EnableApplicationAutoUpdate
|-
| 903 || DisableApplicationAutoUpdate
|-
| 904 || [[#TouchApplication]]
|-
| 905 || RequestApplicationUpdate
|-
| 906 || [[#IsApplicationUpdateRequested]]
|-
| 907 || [[#WithdrawApplicationUpdateRequest]]
|-
| 908 || ListApplicationRecordInstalledContentMeta
|-
| 909 || [3.0.0-14.1.2] WithdrawCleanupAddOnContentsWithNoRightsRecommendation
|-
| 910 || [5.0.0+] HasApplicationRecord
|-
| 911 || [5.1.0+] SetPreInstalledApplication
|-
| 912 || [5.1.0+] ClearPreInstalledApplicationFlag
|-
| 913 || [9.0.0+] ListAllApplicationRecord
|-
| 914 || [9.0.0+] HideApplicationRecord
|-
| 915 || [9.0.0+] ShowApplicationRecord
|-
| 916 || [11.0.0+] IsApplicationAutoDeleteDisabled
|-
| 917 || [20.0.0+]
|-
| 918 || [20.0.0+]
|-
| 919 || [20.0.0+]
|-
| 920 || [20.0.0+]
|-
| 921 || [20.0.0+]
|-
| 922 || [20.0.0+]
|-
| 923 || [20.0.0+]
|-
| 924 || [S2]
|-
| 925 || [S2]
|-
| 926 || [S2]
|-
| 927 || [S2]
|-
| 928 || [20.0.0+]
|-
| 929 || [20.0.0+]
|-
| 930 || [20.0.0+]
|-
| 931 || [20.0.0+]
|-
| 933 || [20.1.0+]
|-
| 934 || [21.0.0+]
|-
| 935 || [21.0.0+]
|-
| 936 || [21.0.0+]
|-
| 1000 || [[#RequestVerifyApplicationDeprecated]]
|-
| 1001 || CorruptApplicationForDebug
|-
| 1002 || [3.0.0-9.2.0] [[#RequestVerifyAddOnContentsRights]]
|-
| 1003 || [5.0.0+] [[#RequestVerifyApplication]]
|-
| 1004 || [5.0.0+] CorruptContentForDebug
|-
| 1200 || [[#NeedsUpdateVulnerability]]
|-
| 1300 || [[#IsAnyApplicationEntityInstalled]]
|-
| 1301 || DeleteApplicationContentEntities
|-
| 1302 || CleanupUnrecordedApplicationEntity
|-
| 1303 || [3.0.0-9.2.0] CleanupAddOnContentsWithNoRights
|-
| 1304 || [3.0.0+] DeleteApplicationContentEntity
|-
| 1308 || [5.0.0+] DeleteApplicationCompletelyForDebug
|-
| 1309 || [6.0.0+] [[#CleanupUnavailableAddOnContents]]
|-
| 1310 || [10.0.0+] [[#RequestMoveApplicationEntity]]
|-
| 1311 || [10.0.0+] [[#EstimateSizeToMove]]
|-
| 1312 || [10.0.0+] HasMovableEntity
|-
| 1313 || [11.0.0+] CleanupOrphanContents
|-
| 1314 || [11.0.0+] CheckPreconditionSatisfiedToMove
|-
| 1400 || PrepareShutdown
|-
| 1500 || [[#FormatSdCard]]
|-
| 1501 || [[#NeedsSystemUpdateToFormatSdCard]]
|-
| 1502 || [[#GetLastSdCardFormatUnexpectedResult]]
|-
| 1504 || [3.0.0+] InsertSdCard
|-
| 1505 || [3.0.0+] RemoveSdCard
|-
| 1506 || [9.0.0+] GetSdCardStartupStatus
|-
| 1508 || [20.0.0+]
|-
| 1509 || [20.0.0+]
|-
| 1510 || [20.0.0+]
|-
| 1511 || [20.0.0+]
|-
| 1512 || [20.0.0+]
|-
| 1600 || GetSystemSeedForPseudoDeviceId
|-
| 1601 || [3.0.0+] ResetSystemSeedForPseudoDeviceId
|-
| 1700 || ListApplicationDownloadingContentMeta
|-
| 1701 || [3.0.0+] [[#GetApplicationView]]
|-
| 1702 || [3.0.0+] GetApplicationDownloadTaskStatus
|-
| 1703 || [4.0.0+] [[#GetApplicationViewDownloadErrorContext]]
|-
| 1704 || [8.0.0+] [[#GetApplicationViewWithPromotionInfo]]
|-
| 1705 || [11.0.0+] [[#IsPatchAutoDeletableApplication]]
|-
| 1706 || [20.0.0+]
|-
| 1800 || IsNotificationSetupCompleted
|-
| 1801 || GetLastNotificationInfoCount
|-
| 1802 || [[#ListLastNotificationInfo]]
|-
| 1803 || [3.0.0+] [[#ListNotificationTask]]
|-
| 1900 || [3.0.0-12.1.0] IsActiveAccount
|-
| 1901 || [4.0.0+] [[#RequestDownloadApplicationPrepurchasedRights]]
|-
| 1902 || [5.0.0+] GetApplicationTicketInfo
|-
| 1903 || [13.1.0+] RequestDownloadApplicationPrepurchasedRightsForAccount
|-
| 1904 || [22.0.0+]
|-
| 2000 || [4.0.0+] [[#GetSystemDeliveryInfo]]
|-
| 2001 || [4.0.0+] [[#SelectLatestSystemDeliveryInfo]]
|-
| 2002 || [4.0.0+] [[#VerifyDeliveryProtocolVersion]]
|-
| 2003 || [4.0.0+] [[#GetApplicationDeliveryInfo]]
|-
| 2004 || [4.0.0+] [[#HasAllContentsToDeliver]]
|-
| 2005 || [4.0.0+] [[#CompareApplicationDeliveryInfo]]
|-
| 2006 || [4.0.0+] [[#CanDeliverApplication]]
|-
| 2007 || [4.0.0+] [[#ListContentMetaKeyToDeliverApplication]]
|-
| 2008 || [4.0.0+] [[#NeedsSystemUpdateToDeliverApplication]]
|-
| 2009 || [4.0.0+] [[#EstimateRequiredSize]]
|-
| 2010 || [4.0.0+] [[#RequestReceiveApplication]]
|-
| 2011 || [4.0.0+] [[#CommitReceiveApplication]]
|-
| 2012 || [4.0.0+] [[#GetReceiveApplicationProgress]]
|-
| 2013 || [4.0.0+] [[#RequestSendApplication]]
|-
| 2014 || [4.0.0+] [[#GetSendApplicationProgress]]
|-
| 2015 || [4.0.0+] [[#CompareSystemDeliveryInfo]]
|-
| 2016 || [4.0.0+] [[#ListNotCommittedContentMeta]]
|-
| 2017 || [4.0.0+] [[#RecoverDownloadTask]]
|-
| 2018 || [5.0.0+] [[#GetApplicationDeliveryInfoHash]]
|-
| 2019 || [20.0.0+]
|-
| 2050 || [6.0.0+] [[#GetApplicationRightsOnClient]]
|-
| 2051 || [9.0.0+] InvalidateRightsIdCache
|-
| 2052 || [20.0.0+]
|-
| 2053 || [20.0.0+]
|-
| 2100 || [6.0.0+] [[#GetApplicationTerminateResult]]
|-
| 2101 || [6.0.0+] GetRawApplicationTerminateResult
|-
| 2150 || [6.0.0+] CreateRightsEnvironment
|-
| 2151 || [6.0.0+] DestroyRightsEnvironment
|-
| 2152 || [6.0.0+] ActivateRightsEnvironment
|-
| 2153 || [6.0.0+] DeactivateRightsEnvironment
|-
| 2154 || [6.0.0+] ForceActivateRightsContextForExit
|-
| 2155 || [7.0.0+] UpdateRightsEnvironmentStatus
|-
| 2156 || [10.0.0-12.1.0] CreateRightsEnvironmentForMicroApplication ([9.0.0-9.2.0] CreateRightsEnvironmentForPreomia)
|-
| 2160 || [6.0.0+] AddTargetApplicationToRightsEnvironment
|-
| 2161 || [6.0.0+] SetUsersToRightsEnvironment
|-
| 2170 || [6.0.0+] GetRightsEnvironmentStatus
|-
| 2171 || [6.0.0+] GetRightsEnvironmentStatusChangedEvent
|-
| 2180 || [6.0.0+] RequestExtendExpirationInRightsEnvironment
|-
| 2181 || [6.0.0+] GetResultOfExtendExpirationInRightsEnvironment
|-
| 2182 || [6.0.0+] SetActiveRightsContextUsingStateToRightsEnvironment
|-
| 2183 || [20.1.0+]
|-
| 2190 || [6.0.0+] [[#GetRightsEnvironmentHandleForApplication]]
|-
| 2199 || [6.0.0+] GetRightsEnvironmentCountForDebug
|-
| 2200 || [6.0.0-9.2.0] GetGameCardApplicationCopyIdentifier
|-
| 2201 || [6.0.0-9.2.0] GetInstalledApplicationCopyIdentifier
|-
| 2250 || [6.0.0-6.2.0] RequestReportActiveELicence
|-
| 2300 || [6.0.0-8.1.0] ListEventLog
|-
| 2350 || [7.0.0+] PerformAutoUpdateByApplicationId
|-
| 2351 || [9.0.0+] [[#RequestNoDownloadRightsErrorResolution]]
|-
| 2352 || [9.0.0+] [[#RequestResolveNoDownloadRightsError]]
|-
| 2353 || [10.0.0+] GetApplicationDownloadTaskInfo
|-
| 2354 || [11.0.0+] PrioritizeApplicationBackgroundTask
|-
| 2355 || [12.0.0+] PreferStorageEfficientUpdate
|-
| 2356 || [12.0.0+] RequestStorageEfficientUpdatePreferable
|-
| 2357 || [15.0.0+] EnableMultiCoreDownload
|-
| 2358 || [15.0.0+] DisableMultiCoreDownload
|-
| 2359 || [15.0.0+] IsMultiCoreDownloadEnabled
|-
| 2360 || [19.0.0+] GetApplicationDownloadTaskCount
|-
| 2361 || [19.0.0+] GetMaxApplicationDownloadTaskCount
|-
| 2362 || [20.0.0+]
|-
| 2363 || [20.0.0+]
|-
| 2364 || [20.0.0+]
|-
| 2365 || [20.0.0+]
|-
| 2366 || [20.0.0+]
|-
| 2367 || [20.0.0+]
|-
| 2368 || [20.0.0+]
|-
| 2369 || [21.0.0+]
|-
| 2400 || [8.0.0+] [[#GetPromotionInfo]]
|-
| 2401 || [8.0.0+] CountPromotionInfo
|-
| 2402 || [8.0.0+] [[#ListPromotionInfo|ListPromotionInfo]]
|-
| 2403 || [8.0.0+] [[#ImportPromotionJsonForDebug]]
|-
| 2404 || [8.0.0+] [[#ClearPromotionInfoForDebug]]
|-
| 2500 || [8.0.0+] ConfirmAvailableTime
|-
| 2510 || [9.0.0+] [[#CreateApplicationResource]]
|-
| 2511 || [9.0.0+] [[#GetApplicationResource]]
|-
| 2513 || [10.0.0+] [[#LaunchMicroApplication]] ([9.0.0-9.2.0] LaunchPreomia)
|-
| 2514 || [9.0.0+] ClearTaskOfAsyncTaskManager
|-
| 2515 || [10.0.0+] CleanupAllPlaceHolderAndFragmentsIfNoTask
|-
| 2516 || [10.0.0-14.1.2] EnsureApplicationCertificate
|-
| 2517 || [13.0.0+] [[#CreateApplicationInstance]]
|-
| 2518 || [13.0.0+] UpdateQualificationForDebug
|-
| 2519 || [13.0.0+] IsQualificationTransitionSupported
|-
| 2520 || [13.0.0+] IsQualificationTransitionSupportedByProcessId
|-
| 2521 || [13.0.0-16.1.0] GetRightsUserChangedEvent
|-
| 2522 || [14.0.0+] IsRomRedirectionAvailable
|-
| 2523 || [17.0.0+] GetProgramId
|-
| 2524 || [19.0.0+]
|-
| 2525 || [20.0.0+]
|-
| 2526 || [22.0.0+]
|-
| 2800 || [9.0.0+] GetApplicationIdOfPreomia
|-
| 3000 || [11.0.0+] [[#RegisterDeviceLockKey]]
|-
| 3001 || [11.0.0+] [[#UnregisterDeviceLockKey]]
|-
| 3002 || [11.0.0+] [[#VerifyDeviceLockKey]]
|-
| 3003 || [11.0.0+] [[#HideApplicationIcon]]
|-
| 3004 || [11.0.0+] [[#ShowApplicationIcon]]
|-
| 3005 || [11.0.0+] [[#HideApplicationTitle]]
|-
| 3006 || [11.0.0+] [[#ShowApplicationTitle]]
|-
| 3007 || [11.0.0+] [[#EnableGameCard]]
|-
| 3008 || [11.0.0+] [[#DisableGameCard]]
|-
| 3009 || [11.0.0+] [[#EnableLocalContentShare]]
|-
| 3010 || [11.0.0+] [[#DisableLocalContentShare]]
|-
| 3011 || [11.0.0+] [[#IsApplicationIconHidden]]
|-
| 3012 || [11.0.0+] [[#IsApplicationTitleHidden]]
|-
| 3013 || [11.0.0+] [[#IsGameCardEnabled]]
|-
| 3014 || [11.0.0+] [[#IsLocalContentShareEnabled]]
|-
| 3015 || [18.0.0+] GetNetworkUpdateRequiredByGameCardDetectionEvent
|-
| 3050 || [14.0.0+] ListAssignELicenseTaskResult
|-
| 3100 || [17.0.0+] [[#GetSafeSystemVersionCheckInfoOld|GetSafeSystemVersionCheckInfoOld]] ([17.0.0-21.2.0] [[#GetSafeSystemVersionCheckInfo|GetSafeSystemVersionCheckInfo]])
|-
| 3101 || [17.0.0+] [[#RequestUpdateSafeSystemVersionCheckInfo|RequestUpdateSafeSystemVersionCheckInfo]]
|-
| 3102 || [17.0.0+] [[#ResetSafeSystemVersionCheckInfo|ResetSafeSystemVersionCheckInfo]]
|-
| 3104 || [18.0.0+] GetApplicationNintendoLogo
|-
| 3105 || [18.0.0+] GetApplicationStartupMovie
|-
| 3106 || [22.0.0+] [[#GetSafeSystemVersionCheckInfo|GetSafeSystemVersionCheckInfo]]
|-
| 3150 || [S2]
|-
| 4000 || [20.0.0+]
|-
| 4004 || [20.0.0+]
|-
| 4006 || [20.0.0+]
|-
| 4007 || [20.0.0+]
|-
| 4008 || [20.0.0+]
|-
| 4009 || [20.0.0+]
|-
| 4010 || [20.0.0+]
|-
| 4011 || [20.0.0+]
|-
| 4012 || [20.0.0+]
|-
| 4013 || [20.0.0+]
|-
| 4015 || [20.0.0+]
|-
| 4017 || [20.0.0+]
|-
| 4019 || [20.0.0+]
|-
| 4020 || [20.0.0+]
|-
| 4021 || [20.0.0+]
|-
| 4022 || [20.0.0+]
|-
| 4023 || [20.0.0+]
|-
| 4024 || [20.0.0+]
|-
| 4025 || [20.0.0+]
|-
| 4026 || [20.0.0+]
|-
| 4027 || [20.0.0+]
|-
| 4028 || [20.0.0+]
|-
| 4029 || [20.0.0+]
|-
| 4030 || [20.0.0+]
|-
| 4031 || [20.0.0+]
|-
| 4032 || [20.0.0+]
|-
| 4033 || [20.0.0+]
|-
| 4034 || [20.0.0+]
|-
| 4035 || [20.0.0+]
|-
| 4037 || [20.0.0+]
|-
| 4038 || [20.0.0+]
|-
| 4039 || [20.0.0+]
|-
| 4040 || [20.0.0+]
|-
| 4041 || [20.0.0+]
|-
| 4042 || [20.0.0+]
|-
| 4043 || [20.0.0+]
|-
| 4044 || [20.0.0+]
|-
| 4045 || [20.0.0+]
|-
| 4046 || [20.0.0+]
|-
| 4049 || [20.0.0+]
|-
| 4050 || [20.0.0+]
|-
| 4051 || [20.0.0+]
|-
| 4052 || [20.0.0+]
|-
| 4053 || [20.0.0+]
|-
| 4054 || [20.0.0+]
|-
| 4055 || [20.0.0+]
|-
| 4056 || [20.0.0+]
|-
| 4057 || [20.0.0+]
|-
| 4058 || [20.0.0+]
|-
| 4059 || [20.0.0+]
|-
| 4060 || [20.0.0+]
|-
| 4061 || [20.0.0+]
|-
| 4062 || [20.0.0+]
|-
| 4063 || [20.0.0+]
|-
| 4064 || [20.0.0+]
|-
| 4065 || [20.0.0+]
|-
| 4066 || [20.0.0+]
|-
| 4067 || [20.0.0+]
|-
| 4068 || [20.0.0+]
|-
| 4069 || [20.0.0+]
|-
| 4070 || [20.0.0+]
|-
| 4071 || [20.0.0+]
|-
| 4072 || [20.0.0+]
|-
| 4073 || [20.0.0+]
|-
| 4074 || [20.0.0+]
|-
| 4075 || [20.0.0+]
|-
| 4076 || [20.0.0+]
|-
| 4077 || [20.0.0+]
|-
| 4078 || [20.0.0+]
|-
| 4079 || [20.0.0+]
|-
| 4080 || [20.0.0+]
|-
| 4081 || [20.0.0+]
|-
| 4083 || [20.0.0+]
|-
| 4084 || [20.0.0+]
|-
| 4085 || [20.0.0+]
|-
| 4086 || [20.0.0+]
|-
| 4087 || [20.0.0+]
|-
| 4088 || [20.0.0+]
|-
| 4089 || [20.0.0+]
|-
| 4090 || [20.0.0+]
|-
| 4091 || [20.0.0+]
|-
| 4092 || [20.0.0+]
|-
| 4093 || [20.0.0+]
|-
| 4094 || [20.0.0+]
|-
| 4095 || [20.0.0+]
|-
| 4096 || [20.0.0+]
|-
| 4097 || [20.0.0+]
|-
| 4099 || [21.0.0+]
|-
| 5000 || [18.0.0+]
|-
| 5001 || [18.0.0+]
|-
| 9999 || [10.0.0-10.2.0] GetApplicationCertificate
|}

[4.0.0+] RequestDownloadAddOnContent now takes an additional 8-bytes of input.

==== GetApplicationRecordUpdateSystemEvent ====
No input, returns an output Event handle with EventClearMode=1.

==== GetApplicationViewDeprecated ====
Takes a type-0x6 output buffer containing an array of [[#ApplicationViewDeprecated]], a type-0x5 input buffer containing an array of u64 [[NCM_services#ApplicationId|ApplicationIds]], no output.

On newer system-versions this is the same as [[#GetApplicationView]], except this converts the output from the func called in the loop from [[#ApplicationView]] to [[#ApplicationViewDeprecated]].

==== DeleteApplicationEntity ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], no output.

==== DeleteApplicationCompletely ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], no output.

==== DeleteRedundantApplicationEntity ====
No input/output.

==== IsApplicationEntityMovable ====
Takes an input u8 [[NCM_services#StorageId|StorageId]], an [[NCM_services#ApplicationId|ApplicationId]], returns an output u8 bool.

==== MoveApplicationEntity ====
Takes an input u8 [[NCM_services#StorageId|StorageId]], an [[NCM_services#ApplicationId|ApplicationId]], no output.

==== RequestApplicationUpdateInfo ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IAsyncValue]].

The data that can be read from the [[#IAsyncValue]] is [[#ApplicationUpdateInfo]].

Before using the cmd, official sw uses [[Network_Interface_services#IsAnyInternetRequestAccepted|IsAnyInternetRequestAccepted]] with the output from [[Network_Interface_services#GetClientId|GetClientId]], throwing an error when the returned bool is false.

==== CancelApplicationDownload ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], no output.

==== ResumeApplicationDownload ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], no output.

==== CheckApplicationLaunchVersion ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], no output.

==== CalculateApplicationDownloadRequiredSize ====
Takes an input u8 [[NCM_services#StorageId|StorageId]], an [[NCM_services#ApplicationId|ApplicationId]], returns an output s64.

==== CleanupSdCard ====
No input/output.

==== GetSdCardMountStatusChangedEvent ====
No input, returns an output Event handle with EventClearMode=0.

==== GetGameCardUpdateDetectionEvent ====
No input, returns an output Event handle with EventClearMode=0.

This Event is used by [[qlaunch]] to check whether a card-sysupdate is required.

==== DisableApplicationAutoDelete ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], no output.

==== EnableApplicationAutoDelete ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], no output.

==== SetApplicationTerminateResult ====
Takes an input u32 Result, an [[NCM_services#ApplicationId|ApplicationId]], no output.

==== ClearApplicationTerminateResult ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], no output.

==== GetLastSdCardMountUnexpectedResult ====
No input/output.

==== GetRequestServerStopper ====
No input, returns an output [[#IRequestServerStopper]].

This increfs a state ref-count, with decref being handled when the object is closed. This ref-count is checked by [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]] and related cmds.

==== CancelApplicationApplyDelta ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], no output.

==== ResumeApplicationApplyDelta ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], no output.

==== CalculateApplicationApplyDeltaRequiredSize ====
Takes an input u8 [[NCM_services#StorageId|StorageId]], an [[NCM_services#ApplicationId|ApplicationId]], returns an output s64.

==== ResumeAll ====
No input/output.

==== GetStorageSize ====
Takes an input u8 [[NCM_services#StorageId|StorageId]], returns two output s64s.

This temporarily mounts the [[Filesystem_services#OpenContentStorageFileSystem|ContentStorage]] specified by the StorageId (must be BuiltInUser or SdCard). The two output s64s are the output from [[Filesystem_services#GetTotalSpaceSize|GetTotalSpaceSize]] and [[Filesystem_services#GetFreeSpaceSize|GetFreeSpaceSize]] with this ContentStorage, with it this being unmounted afterwards.

==== RequestUpdateApplication2 ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IAsyncResult]].

See [[#RequestApplicationUpdateInfo]] regarding nifm.

==== LaunchApplication ====
Takes an input u8 ProgramIndex, an input [[#ApplicationLaunchInfo]], returns an output u64.

[18.0.0+] Now takes a total of 0x58 bytes of input.

[19.0.0+] Now takes a total of 0x88 bytes of input.

==== GetApplicationLaunchInfo ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output [[#ApplicationLaunchInfo]].

[18.0.0+] Now returns a total of 0x50 bytes of output.

[19.0.0+] Now returns a total of 0x80 bytes of output.

==== AcquireApplicationLaunchInfo ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output [[#ApplicationLaunchInfo]].

This verifies that a state flag is set and that a state field matches the input ApplicationId, throwing an error otherwise. The [[#ApplicationLaunchInfo]] from state is copied to output, then the state flag is cleared.

[18.0.0+] Now returns a total of 0x50 bytes of output.

[19.0.0+] Now returns a total of 0x80 bytes of output.

==== GetMainApplicationProgramIndexByApplicationLaunchInfo ====
[18.0.0+] Now takes a total of 0x50 bytes of input.

[19.0.0+] Now returns a total of 0x80 bytes of output.

==== LaunchDevMenu ====
No input/output.

This is used by AM cmd [[Applet_Manager_services#LaunchDevMenu|LaunchDevMenu]].

This loads ProgramIds from [[System_Settings|system-settings]] <code>ns.applet!devmenu_id</code> and <code>ns.applet!devoverlaydisp_id</code>, which only exists on devunits. An error is thrown if loading these fail.

[[NCM_services#ncm|OpenContentMetaDatabase]] is used with StorageId = NandSystem, then IContentMetaDatabase GetLatestContentMetaKey is used with both of the above ProgramIds to verify that the cmd is successful.

Then if the above succeeds, the above titles are launched with the above StorageId via [[Process_Manager_services|pmshell]] LaunchProgram ([10.0.0+] [[PGL_services#LaunchProgram|pgl]] with pgl_launch_flags=0), with a 0.5s sleep-thread afterwards on success. [[Process_Manager_services#LaunchFlags|LaunchFlags]] value 0xB is used here.

==== DeleteUserSaveDataAll ====
Takes an input [[Account_services#Uid|Uid]], returns an output [[#IProgressMonitorForDeleteUserSaveDataAll]].

On success, [[#IProgressMonitorForDeleteUserSaveDataAll]] GetProgress is used with the output being copied into object state.

==== DeleteUserSystemSaveData ====
Takes an input [[Account_services#Uid|Uid]], an u64 SystemSaveDataId, no output.

==== DeleteSaveData ====
Takes an input u8 [[Filesystem_services#SaveDataSpaceId|SaveDataSpaceId]], an u64 SaveDataId, no output.

==== UnregisterNetworkServiceAccount ====
Takes an input [[Account_services#Uid|Uid]], no output.

==== UnregisterNetworkServiceAccountWithUserSaveDataDeletion ====
Takes an input [[Account_services#Uid|Uid]], no output.

==== LaunchLibraryApplet ====
Takes an input u64 [[NCM_services#ProgramId|ProgramId]], returns an output u64.

The specified program is launched with StorageId=BuiltInSystem via [[Process_Manager_services|pmshell]] LaunchProgram ([10.0.0+] [[PGL_services#LaunchProgram|pgl]] with pgl_launch_flags=0). [[Process_Manager_services#LaunchFlags|LaunchFlags]] value 0x9 is used here. The output u64 from here is written to the output for this cmd, on success.

This is used by [[Applet_Manager_services|AM]].

==== LaunchSystemApplet ====
No input, returns an output u64.

A state flag must be non-zero, otherwise an error is thrown. When a state field is value 1, a hard-coded ProgramId for MaintenanceMenu is used. Otherwise, the ProgramId is loaded from [[System_Settings|system-setting]] <code>ns.applet!system_applet_id</code> ([20.0.0+] <code>ns.applet!system_applet_id_gen2</code>).

The SystemApplet is launched with StorageId=BuiltInSystem via [[Process_Manager_services|pmshell]] LaunchProgram ([10.0.0+] [[PGL_services#LaunchProgram|pgl]] with pgl_launch_flags=0). [[Process_Manager_services#LaunchFlags|LaunchFlags]] value 0x9 is used here. The output u64 from here is written to the output for this cmd, on success.

This is used by [[Applet_Manager_services|AM]].

==== LaunchOverlayApplet ====
No input, returns an output u64.

A state flag must be non-zero, otherwise an error is thrown. The ProgramId is loaded from [[System_Settings|system-setting]] <code>ns.applet!overlay_applet_id</code>.

The OverlayApplet is launched with StorageId=BuiltInSystem via [[Process_Manager_services|pmshell]] LaunchProgram ([10.0.0+] [[PGL_services#LaunchProgram|pgl]] with pgl_launch_flags=0). [[Process_Manager_services#LaunchFlags|LaunchFlags]] value 0x9 is used here. The output u64 from here is written to the output for this cmd, on success.

This is used by [[Applet_Manager_services|AM]].

==== RequestDownloadApplicationControlData ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IAsyncResult]].

See [[#RequestApplicationUpdateInfo]] regarding nifm.

==== GetApplicationControlProperty ====
[18.0.0+] Now takes a total of 0x58 bytes of input.

==== ListApplicationTitle ====
Takes an input TransferMemory handle, a type-0x5 input buffer containing an array of u64 [[NCM_services#ApplicationId|ApplicationIds]], an u8 [[#ApplicationControlSource]], an u64 size, returns an output Event handle and an [[#IAsyncValue]].

[[qlaunch]] uses value 0x1 for the u8.

The user-process creates the TransferMemory with permissions=R--.

The data available with [[#IAsyncValue]] Get is a s32 for the offset within the TransferMemory where the output data is located, GetSize returns the total byte-size of the data located here. The data located here is the [[NACP_Format|NACP]] title-entry for each specified ApplicationId.

The TransferMemory size must be at least: count*sizeof([[NACP_Format|title-entry]]) + count*sizeof(u64) + count*[[#GetApplicationControlData|0x24000]].

This is essentially an async wrapper for [[#GetApplicationControlData]], with support for multiple ApplicationIds.

==== ListApplicationIcon ====
Takes an input TransferMemory handle, a type-0x5 input buffer containing an array of u64 [[NCM_services#ApplicationId|ApplicationIds]], an u8 [[#ApplicationControlSource]], an u64 size, returns an output Event handle and an [[#IAsyncValue]].

The user-process creates the TransferMemory with permissions=R--.

The data available with [[#IAsyncValue]] Get is a s32 for the offset within the TransferMemory where the output data is located, GetSize returns the total byte-size of the data located here. This data is: an u64 for total entries, an array of u64s for each icon size, then the icon JPEGs for the specified ApplicationIds.

The TransferMemory size must be at least: 0x4 + count*sizeof(u64) + count*[[#GetApplicationControlData|0x20000]] + count*sizeof(u64) + [[#GetApplicationControlData|0x24000]].

This is essentially an async wrapper for [[#GetApplicationControlData]], with support for multiple ApplicationIds.

==== Cmd421 ====
Takes an input TransferMemory handle, a type-0x5 input buffer containing an array of u64 [[NCM_services#ApplicationId|ApplicationIds]], an u8 [[#ApplicationControlSource]], an u64 size, returns an output Event handle and an [[#IAsyncValue]].

This is essentially the same as [[#ListApplicationTitle|ListApplicationTitle]] except the ApplicationControlSource is used here (ListApplicationTitle ignores it and uses 0xF0 instead).

The TransferMemory size must be at least: count*sizeof(u64) + count*[[NACP#ApplicationTitle|0x300]] + [[#GetApplicationControlData|0x1d000]].

The async task impl code eventually compares ApplicationControlSource with 0xF0, with a separate code-path being used when it doesn't match (which also handles [[NACP|compression]] when needed).

==== RequestCheckGameCardRegistration ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IAsyncResult]].

See [[#RequestApplicationUpdateInfo]] regarding nifm.

==== RequestGameCardRegistrationGoldPoint ====
Takes an input [[Account_services#Uid|Uid]], an [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IAsyncValue]].

The data that can be read from the [[#IAsyncValue]] is 4-bytes.

See [[#RequestApplicationUpdateInfo]] regarding nifm.

==== RequestRegisterGameCard ====
Takes an input s32, an [[Account_services#Uid|Uid]], an [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IAsyncResult]].

See [[#RequestApplicationUpdateInfo]] regarding nifm.

==== GetGameCardMountFailureEvent ====
No input, returns an output Event handle with EventClearMode=0.

==== IsGameCardInserted ====
No input, returns an output u8 bool.

==== EnsureGameCardAccess ====
No input/output.

==== GetLastGameCardMountFailureResult ====
No input/output.

==== ListApplicationIdOnGameCard ====
Takes a type-0x6 output buffer containing an array of u64 [[NCM_services#ApplicationId|ApplicationIds]], returns an output s32 for total output entries.

==== GetGameCardPlatformRegion ====
No input, returns an u8 '''GameCardPlatformRegion''' (0x00 = Global, 0x01 = China).

This calls [[Filesystem_services#IDeviceOperator|fsp-srv IDeviceOperator]] GetGameCardCompatibilityType and returns the result.

==== ListAvailableAddOnContent ====
[10.0.0+] This now takes a total of 0x10-bytes of input instead of a total of 0x18-bytes of input.

[15.0.0+] This now takes a total of 0x8-bytes of input instead of a total of 0x10-bytes of input.

==== RequestDownloadTaskListData ====
No input, returns an output Event handle and an [[#IAsyncValue]].

==== TouchApplication ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], no output.

==== IsApplicationUpdateRequested ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output u8 bool and an u32.

The output u32 is only valid when the output bool is set.

==== WithdrawApplicationUpdateRequest ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], no output.

==== RequestVerifyApplicationDeprecated ====
Takes an input TransferMemory handle, an [[NCM_services#ApplicationId|ApplicationId]], an u64 size, returns an output Event handle and an [[#IProgressAsyncResult]].

On newer system-versions this calls the same func as [[#RequestVerifyApplication]], with the u32 value set to 0x7.

==== RequestVerifyAddOnContentsRights ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IProgressAsyncResult]].

==== RequestVerifyApplication ====
Takes an input TransferMemory handle, an u32, an [[NCM_services#ApplicationId|ApplicationId]], an u64 size, returns an output Event handle and an [[#IProgressAsyncResult]].

Official sw creates the TransferMemory with an user-specified buffer with permissions=0. [[qlaunch]] uses buffer size 0x100000.

Official sw has an additional wrapper func which calls the original wrapper func, this uses value 0x7 for the u32. This is the same func used by [[qlaunch]].

==== IsAnyApplicationEntityInstalled ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output u8 bool.

==== CleanupUnavailableAddOnContents ====
Takes an input u64 [[NCM_services#ApplicationId|ApplicationId]], an [[Account_services#Uid|Uid]], no output.

==== RequestMoveApplicationEntity ====
Takes an input TransferMemory handle, a type-0x5 input buffer containing an array of [[NCM_services#StorageId|StorageId]], a [[NCM_services#StorageId|StorageId]], an u32 bitfield of "nn::ns::KeepApplicationEntityFlagTag", an [[NCM_services#ApplicationId|ApplicationId]], an u64 tmem_size, returns an output Event handle and an [[#IProgressAsyncResult]].

The TransferMemory uses permissions=0.

==== EstimateSizeToMove ====
Takes a type-0x5 input buffer containing an array of [[NCM_services#StorageId|StorageId]], a [[NCM_services#StorageId|StorageId]], an u32 bitfield of "nn::ns::KeepApplicationEntityFlagTag", an [[NCM_services#ApplicationId|ApplicationId]], returns an output s64.

This calls a func also used by [[#RequestMoveApplicationEntity]], then calls another func.

==== FormatSdCard ====
No input/output.

==== NeedsSystemUpdateToFormatSdCard ====
No input, returns an output u8 bool.

==== GetLastSdCardFormatUnexpectedResult ====
No input/output.

==== GetApplicationView ====
Takes a type-0x6 output buffer containing an array of [[#ApplicationView]], a type-0x5 input buffer containing an array of u64 [[NCM_services#ApplicationId|ApplicationIds]], no output.

==== GetApplicationViewDownloadErrorContext ====
Takes a type-0x16 output buffer containg an [[Error_Applet#ErrorContext|ErrorContext]], an u64 [[NCM_services#ApplicationId|ApplicationId]], no output.

==== GetApplicationViewWithPromotionInfo ====
Takes a type-0x6 output buffer containing an array of [[#ApplicationViewWithPromotionInfo]], a type-0x5 input buffer containing an array of u64 [[NCM_services#ApplicationId|ApplicationIds]], no output.

==== IsPatchAutoDeletableApplication ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output bool.

Compares the input ApplicationId with the value of [[System_Settings|system-setting]] <code>ns.application!auto_deletable_application_id_on_not_enough_space</code>, with the bool being set to the comparsion result.

==== ListLastNotificationInfo ====
Takes a type-0x6 buffer containing an array with struct entry size 0x90-bytes. Returns 4-bytes of output.

[19.0.0+] The struct size is now 0x98-bytes.

==== ListNotificationTask ====
Takes a type-0x6 buffer containing an array with struct entry size 0xB0-bytes. Returns 4-bytes of output.

[19.0.0+] The struct size is now 0xB8-bytes.

==== RequestDownloadApplicationPrepurchasedRights ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IAsyncResult]].

See [[#RequestApplicationUpdateInfo]] regarding nifm.

==== GetSystemDeliveryInfo ====
Takes a type-0x16 output buffer containing a [[#SystemDeliveryInfo]], no output.

This generates a [[#SystemDeliveryInfo]] using the currently installed SystemUpdate meta title.

==== SelectLatestSystemDeliveryInfo ====
Takes a type-0x15 input buffer containing a [[#SystemDeliveryInfo]], a type-0x5 input buffer containing an array of [[#SystemDeliveryInfo]], a type-0x5 input buffer containing an array of [[#ApplicationDeliveryInfo]], and returns an output s32.

This determines the latest version (RequiredSystemVersion) from the input [[#ApplicationDeliveryInfo]] array (ApplicationDeliveryProtocolVersion and the HMAC are also validated), using value 0 if the array is empty.

* [20.0.0+] The following code block now only runs when the SystemDeliveryInfoPlatform from the type-0x15 [[#SystemDeliveryInfo]] buffer matches the [[System_Settings|sys-setting]].
** It then loops through the [[#ApplicationDeliveryInfo]] array again:
** This uses functionality which essentially uses [[Shared_Database_services|pl:s]] GetFunctionBlackListSystemVersionToAuthorize with the [[#ApplicationDeliveryInfo]] ApplicationId and ApplicationFunctionAuthorizationId=0x5 then parses the output, using cached data if available. The error is returned on failure.
** tmp_version = out_u8 == 0 ? 0 : out_u32 + 0x10000;
** Then the current latest-version value is updated with tmp_version, if tmp_version is higher.

If this version value is less than a state field, the state field value is used instead (state field originates from [[System_Settings|system-setting]] <code>contents_delivery!required_system_version_to_deliver_application</code>).

Then this selects the [[#SystemDeliveryInfo]] with the latest version from the input array. The output s32 is an index in that array for the selected entry, -1 if none found.

During the above loop it first calls the [[#SystemDeliveryInfo]] validation func, returning the Result on failure. Then it runs additional validation, with the [[#SystemDeliveryInfo]] entry being ignored on failure:
* The above latest-version value must be at least the version value from the type-0x15 [[#SystemDeliveryInfo]] buffer and the [[#SystemDeliveryInfo]] array entry.
* When HasExFat is set in the type-0x15 [[#SystemDeliveryInfo]] buffer, it must be set in the [[#SystemDeliveryInfo]] array entry.
* FirmwareVariationId in the type-0x15 [[#SystemDeliveryInfo]] buffer must not be 0xFF.
* UpdatableFirmwareGroupId in the [[#SystemDeliveryInfo]] array entry must not be 0xFF. The value must be within bounds of the settings array ([[System_Settings|sys-settings]] <code>contents_delivery!updatable_firmware_group_string</code>).
* PlatformRegion in the [[#SystemDeliveryInfo]] array entry and the type-0x15 [[#SystemDeliveryInfo]] buffer must match.
* Lastly when the following is true, this indicates success: (settings_array[UpdatableFirmwareGroupId] >> {above FirmwareVariationId}) & 1.

==== VerifyDeliveryProtocolVersion ====
Takes a type-0x15 input buffer containing a [[#SystemDeliveryInfo]], no output.

This validates the [[#SystemDeliveryInfo]] HMAC and the protocol-version fields. Then an error is returned when SystemUpdateVersion is less than a state field, otherwise 0 is returned (state field originates from [[System_Settings|system-setting]] <code>contents_delivery!required_system_version_to_deliver_application</code>).

==== GetApplicationDeliveryInfo ====
Takes a type-0x6 output buffer containing an array of [[#ApplicationDeliveryInfo|ApplicationDeliveryInfo]], an input u32 bitmask <code>nn::ns::ApplicationDeliveryAttributeTag</code>, an [[NCM_services#ApplicationId|ApplicationId]], and returns an output s32 total_out.

[11.0.0+] An error is thrown if LocalContentShare is not [[#IsLocalContentShareEnabled|enabled]].

An error is thrown if any bit is set in ApplicationDeliveryAttributeTag besides bit1, this must also be <=0x3. The output array-count must be at least 1: only 1 entry will be written to this array (hence on success total_out will also only be 1 on success).

[7.0.0+] An error is thrown if the state ref-count for [[#GetRequestServerStopper|RequestServerStopper]] is zero. [7.0.0-7.0.1] The func which checks this would also return success when a field prior to the previously mentioned field is 0 (checked before the ref-count).

An error is thrown if [[NIM_services|nim]] ListApplicationApplyDeltaTask returns a task.

HasApplicationRecord is called with the input [[NCM_services#ApplicationId|ApplicationId]], an error is returned if the record isn't found.

[[#ApplicationDeliveryInfo|RequiredApplicationVersion]] is initially set to the output version from [[Shared_Database_services|avm]] GetLaunchRequiredVersion. Later when ContentMetaType == Application etc, it calls a func. This func uses [[NCM_services|ncm]] IContentMetaDatabase GetRequiredApplicationVersion. If the output version is higher than the [[#ApplicationDeliveryInfo|RequiredApplicationVersion]] field then the output version is written here. Immediately aferwards, it also checks whether the bit for Compacted is set from [[NCM_services|ncm]] IContentMetaDatabase GetAttributes, clearing [[#ApplicationDeliveryInfo|ApplicationVersion]] if the attribute is set.

[20.0.0+] [[#ApplicationDeliveryInfo|ApplicationDeliveryInfo]] ContentMetaPlatform and ProperProgramExists are now set using data from [[NCM_services|ncm]].

[20.0.0+] [[Shared_Database_services|pl:s]] GetFunctionBlackListSystemVersionToAuthorize with ApplicationFunctionAuthorizationId=0x5 is now used, the output version is written to [[#ApplicationDeliveryInfo|RequiredSystemVersion]] when it's higher than the value previously written here.

[20.0.0+] [[Shared_Database_services|pl:s]] GetRequiredApplicationVersion with ApplicationFunctionAuthorizationId=0x5 is now used, the output version is written to [[#ApplicationDeliveryInfo|RequiredApplicationVersion]] when it's higher than the value previously written here.

==== HasAllContentsToDeliver ====
Takes a type-0x5 input buffer containing an array of [[#ApplicationDeliveryInfo]], returns an output u8 bool.

The array-count must match 1.

This uses the same LocalContentShare check as [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]].

After validating the [[#ApplicationDeliveryInfo]], the output bool is set to [[#ApplicationDeliveryInfo|ApplicationDeliveryAttributeTag]] & 0x10000002 != 0x2, then this returns 0.

==== CompareApplicationDeliveryInfo ====
Takes two type-0x5 input buffers containing an array of [[#ApplicationDeliveryInfo]], returns an output s32.

This uses the same LocalContentShare check as [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]].

The array-count for both buffers must be 1, otherwise an error is returned.

Both [[#ApplicationDeliveryInfo]] are validated, then the application-version in the first/second buffer are compared. The output s32 is set to the comparison result: -1 for less than, 0 for equal, and 1 for higher than.

==== CanDeliverApplication ====
Takes two type-0x5 input buffers containing an array of [[#ApplicationDeliveryInfo]], returns an output u8 bool.

The array-count for the second buffer must be 1, otherwise an error is returned.

This uses the same LocalContentShare check as [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]].

The second [[#ApplicationDeliveryInfo]] buffer is validated. An error is thrown when [[#ApplicationDeliveryInfo|ApplicationDeliveryAttributeTag]] (second buffer) & 0x3 != 0x2, likewise when bit28 is clear in this field (bitmask 0x10000000).

The array-count for the first buffer must be <=1, otherwise an error is returned. If the array-count for the first buffer is 0, this will return 0 with the output bool set to 0. The first [[#ApplicationDeliveryInfo]] buffer is validated. An error is thrown when [[#ApplicationDeliveryInfo|ApplicationDeliveryAttributeTag]] (first buffer) bit1 is clear or bit0 set. An error is thrown when [[#ApplicationDeliveryInfo|ApplicationDeliveryAttributeTag]] (second buffer) bit1 is clear.

When [[#ApplicationDeliveryInfo|RequiredApplicationVersion]] (first or second buffer) is higher than [[#ApplicationDeliveryInfo|ApplicationVersion]] (second buffer), this will return 0 with the output bool set to 0.

When [[#ApplicationDeliveryInfo|ApplicationDeliveryAttributeTag]] (first buffer) bit28 is set (bitmask 0x10000000):
* When [[#ApplicationDeliveryInfo|ApplicationVersion]] (first buffer) >= [[#ApplicationDeliveryInfo|ApplicationVersion]] (second buffer), write 0 to the output bool, otherwise write 1. Then return 0.
Otherwise when the above bit28 is clear:
* When [[#ApplicationDeliveryInfo|ApplicationVersion]] (first buffer) > [[#ApplicationDeliveryInfo|ApplicationVersion]] (second buffer), write 0 to the output bool, otherwise write 1. Then return 0.

==== ListContentMetaKeyToDeliverApplication ====
Takes a type-0x6 output buffer containing an array of [[NCM_services#ContentMetaKey|ContentMetaKey]], a type-0x5 input buffer containing an array of [[#ApplicationDeliveryInfo]], a s32, and returns an output s32 total_out.

This uses the same LocalContentShare check as [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]].

The array-count for ContentMetaKey must be at least 1, and for ApplicationDeliveryInfo it must match 1.

The [[#ApplicationDeliveryInfo|ApplicationDeliveryInfo]] is validated (ApplicationDeliveryProtocolVersion/HMAC). An error is thrown when [[#ApplicationDeliveryInfo|ApplicationDeliveryAttributeTag]] bit0 is set.

This uses the same ref-count check as [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]].

An error is thrown if [[NIM_services|nim]] ListApplicationApplyDeltaTask returns a task.

This will only return 1 ContentMetaKey entry. This will not output the entry when the input s32 is larger than 0, or when [[#ApplicationDeliveryInfo|ApplicationDeliveryAttributeTag]] bit1 is clear.

==== NeedsSystemUpdateToDeliverApplication ====
Takes a type-0x15 input buffer containing a [[#SystemDeliveryInfo]], a type-0x5 input buffer containing an array of [[#ApplicationDeliveryInfo]], and returns an output u8 bool.

This uses the same LocalContentShare check as [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]].

The [[#SystemDeliveryInfo]] is validated (validation for ApplicationDeliveryProtocolVersion is enabled).

The array-count must match 1.

The [[#ApplicationDeliveryInfo]] is validated (ApplicationDeliveryProtocolVersion/HMAC).

This then runs functionality similar to [[#SelectLatestSystemDeliveryInfo]]:
* [20.0.0+] The following code block now only runs when the SystemDeliveryInfoPlatform from the input [[#SystemDeliveryInfo]] matches the [[System_Settings|sys-setting]].
* Uses the same functionality as [[#SelectLatestSystemDeliveryInfo]] for GetFunctionBlackListSystemVersionToAuthorize, returning the Result on failure.
* The output bool is set to: out_u8!=0 && out_u32 >= [[#SystemDeliveryInfo]] SystemUpdateVersion (only the upper 16bits are used from the SystemUpdateVersion).

Otherwise when the output bool is still false, this sets the output bool by comparing system-version fields in the [[#SystemDeliveryInfo]]/[[#ApplicationDeliveryInfo]] and with a state field (state field originates from [[System_Settings|system-setting]] <code>contents_delivery!required_system_version_to_deliver_application</code>).

==== EstimateRequiredSize ====
Takes a type-0x5 input buffer containing an array of [[NCM_services#ContentMetaKey|ContentMetaKey]], returns an output s64.

When the array-count is less than 1, this will return 0 with the s64 set to 0.

==== RequestReceiveApplication ====
Takes a type-0x5 input buffer containing an array of [[NCM_services#ContentMetaKey|ContentMetaKey]], a [[NCM_services#StorageId|StorageId]], an u16 port, an u32 Ipv4Address, an [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IAsyncResult]].

[[qlaunch]] uses value Any for the StorageId, and value 55556 for the port.

This uses the same LocalContentShare and ref-count checks as [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]].

An error is thrown if [[NIM_services|nim]] ListApplicationApplyDeltaTask returns a task.

HasApplicationRecord is called with the input [[NCM_services#ApplicationId|ApplicationId]], an error is returned if the record isn't found.

This loops through the input [[NCM_services#ContentMetaKey|ContentMetaKey]] array, throwing an error if the [[NCM_services#ContentMetaType|ContentMetaType]] doesn't match Patch. The input array is copied into state which is used later by the thread for [[NIM_services|nim]] CreateLocalCommunicationReceiveApplicationTask, max entries is 0x12.

This does various setup then creates the [[#IAsyncResult]] + the async thread which handles the [[#IAsyncResult]] operation. Then the thread does:

* Calls a func which does:
** Throws an error if a state flag is set.
** Uses [[NIM_services|nim]] CreateLocalCommunicationReceiveApplicationTask, returning the Result on failure.
** Uses [[NIM_services|nim]] RequestLocalCommunicationReceiveApplicationTaskRun, returning the Result on failure. Waits for the IAsyncResult operation from this to finish, then uses the Get cmd to get the output Result.
*** When the Result from Get is an error, a func is called for filling in the [[#IAsyncResult|IAsyncResult]] ErrorContext with Type4.
** Handles cleanup and returns.
* On success, this loads various data which is then used for saving a SystemPlayReport when the cached [[System_Settings|system-setting]] "systemreport!enabled" is set.
** The EventId is "receive_app_contents" with ApplicationId <NS ProgramId>.
** This report has the following fields:
*** "ApplicationId"
*** "DestinationVersion"
*** "SourceVersion"
*** "HasApplicationEntity"
*** "HasPatchEntity"
*** "ApplicationStorageId"
*** "PatchStorageId"
*** "Size"
*** "ThroughputKBps"

==== CommitReceiveApplication ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], no output.

This uses the same LocalContentShare and ref-count checks as [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]].

An error is thrown if [[NIM_services|nim]] ListApplicationApplyDeltaTask returns a task.

==== GetReceiveApplicationProgress ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output [[#ReceiveApplicationProgress]].

This uses the same ref-count check as [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]].

An error is thrown if [[NIM_services|nim]] ListApplicationApplyDeltaTask returns a task.

Uses [[NIM_services|nim]] ListApplicationLocalCommunicationReceiveApplicationTask, throwing an error if no task is returned. Then [[NIM_services|nim]] GetLocalCommunicationReceiveApplicationTaskInfo is used, returning the error from there on failure. Lastly, this writes the 0x10-bytes from output+8 from the latter cmd to the output [[#ReceiveApplicationProgress]], and returns 0.

==== RequestSendApplication ====
Takes a type-0x5 input buffer containing an array of [[NCM_services#ContentMetaKey|ContentMetaKey]], an u16 port, an u32 Ipv4Address, an [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IAsyncResult]].

[[qlaunch]] uses value 55556 for the port.

This uses the same LocalContentShare and ref-count checks as [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]].

An error is thrown if [[NIM_services|nim]] ListApplicationApplyDeltaTask returns a task.

This does various setup and loops through the input ContentMetaKey array for initializing the array passed to the nim cmd during the async task. This loop does the following:
* Throws an error if the [[NCM_services#ContentMetaType|ContentMetaType]] in the ContentMetaKey doesn't match Patch.
* Calls a func with the ContentMetaKey and the ApplicationId, throwing an error if the output value is 0.
* Calls a func with the ContentMetaKey for getting the StorageId. This essentially loops through each valid ncm [[NCM_services|IContentMetaDatabase]] using cmd [[NCM_services|Has]] with the input ContentMetaKey, returning the relevant StorageId when found.
* The ContentMetaKey and the StorageId are copied into a tmp struct.
* if (ContentMetaType==Patch && StorageId==GameCard) { <call a func etc> }
* Copies the above tmp struct into the async task state array.

This then creates the [[#IAsyncResult]] + the async thread which handles the [[#IAsyncResult]] operation. Then the thread does:

* Calls a func which does:
** Throws an error if a state flag is set.
** Uses [[NIM_services|nim]] CreateLocalCommunicationSendApplicationTask, returning the Result on failure.
** Uses [[NIM_services|nim]] RequestLocalCommunicationSendApplicationTaskRun, returning the Result on failure. Waits for the IAsyncResult operation from this to finish, then uses the Get cmd to get the output Result.
*** When the Result from Get is an error, a func is called for filling in the [[#IAsyncResult|IAsyncResult]] ErrorContext with Type4.
** Handles cleanup and returns.
* On success, this loads various data which is then used for saving a SystemPlayReport when the cached [[System_Settings|system-setting]] "systemreport!enabled" is set.
** The EventId is "send_app_contents" with ApplicationId <NS ProgramId>.
** This report has the following fields:
*** "ApplicationId"
*** "Version"
*** "ApplicationStorageId"
*** "PatchStorageId"

==== GetSendApplicationProgress ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output [[#SendApplicationProgress]].

Same as [[#GetReceiveApplicationProgress]] except this is the Send version, and uses [[NIM_services|nim]] ListApplicationLocalCommunicationSendApplicationTask/GetLocalCommunicationSendApplicationTaskInfo instead. The data copied to output is also swapped: u64 nim_out+0x8 is copied to out+0x8, and u64 nim_out+0x10 is copied to out+0x0.

==== CompareSystemDeliveryInfo ====
Takes two type-0x15 input buffers containing a [[#SystemDeliveryInfo]], returns an output s32.

This is essentially the same as [[#CompareApplicationDeliveryInfo]], except this compares the [[#SystemDeliveryInfo]] SystemUpdate version.

==== ListNotCommittedContentMeta ====
Takes a type-0x6 output buffer containing an array of [[NCM_services#ContentMetaKey|ContentMetaKey]], a s32, an [[NCM_services#ApplicationId|ApplicationId]], returns an output s32 total_out.

This uses the same ref-count check as [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]].

An error is thrown if [[NIM_services|nim]] ListApplicationApplyDeltaTask returns a task.

==== RecoverDownloadTask ====
Takes a type-0x5 input buffer containing an array of {unknown} and an input u64, no output.

This uses the same LocalContentShare and ref-count checks as [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]].

==== GetApplicationDeliveryInfoHash ====
Takes a type-0x5 input buffer containing an array of [[#ApplicationDeliveryInfo]], returns an output 0x20-byte SHA256 hash.

This uses the same LocalContentShare check as [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]].

This extracts data from the input array for hashing with SHA256, with validation being done when handling each entry (ApplicationDeliveryProtocolVersion/HMAC).

The 0x14-bytes from [[#ApplicationDeliveryInfo|ApplicationDeliveryInfo]]+0x8 are copied into a 0x18-byte struct entry in an array buffer, with the last 4-bytes being cleared. Then each 0x18-byte struct entry is hashed.

==== Cmd2019 ====
Takes a type-0x15 input buffer containing a [[#SystemDeliveryInfo]], a type-0x5 input buffer containing an array of [[#ApplicationDeliveryInfo]], a type-0x5 input buffer containing an array of [[#ApplicationDeliveryInfo]], returns an output u8 bool.

This is essentially an extended version of [[#CanDeliverApplication|CanDeliverApplication]], with additional functionality for determining platform compatibility.

This calls a func for validating the [[#SystemDeliveryInfo]] from the type-0x15 buffer, returning the Result on failure.

Then [[#CanDeliverApplication|CanDeliverApplication]] is called with the output bool and the input arrays, returning the Result on failure.

If the output bool is set after calling the above, it then calls a func with the output bool, the second [[#ApplicationDeliveryInfo]] buffer, and the [[#SystemDeliveryInfo]] from the type-0x15 buffer. This func does the following:
* When the SystemDeliveryInfoPlatform from the input [[#SystemDeliveryInfo]] matches the [[System_Settings|sys-setting]], it does the following:
** Uses [[Shared_Database_services|pl:s]] RequestApplicationFunctionAuthorizationByApplicationId with the [[#ApplicationDeliveryInfo]] ApplicationId/ApplicationVersion and ApplicationFunctionAuthorizationId=0x5, handling the Result on failure.
* When the platform fields from the input [[#SystemDeliveryInfo]]/[[#ApplicationDeliveryInfo]] match, write 1 to the output bool and return 0. Otherwise:
** When the [[#SystemDeliveryInfo]] SystemDeliveryInfoPlatform is 0x1 (Ounce): *output = [[#ApplicationDeliveryInfo|ContentMetaPlatform]] == 0 && [[#ApplicationDeliveryInfo|ProperProgramExists]] == 0;
** When the [[#SystemDeliveryInfo]] SystemDeliveryInfoPlatform is 0x0 (NX): write 0 to the output bool and return 0.
** Otherwise, Abort.

==== GetApplicationRightsOnClient ====
Takes a type-0x6 output buffer containing an array of [[#ApplicationRightsOnClient]], an input u32 flags, an [[NCM_services#ApplicationId|ApplicationId]], an [[Account_services#Uid|Uid]], returns 4-bytes of output for total output entries.

Official sw has at least two wrappers which use this cmd: one with an all-zero Uid, one with an user-specified Uid. With both of these, the passed flags are hard-coded to value 0x3.

For the output array count, [[qlaunch]] uses value 3.

==== GetApplicationTerminateResult ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output u32 Result.

==== GetRightsEnvironmentHandleForApplication ====
No input, returns a total of 8-bytes of output.

[9.0.0+] Now takes a total of 8-bytes of input, returns a total of 8-bytes of output.

==== RequestNoDownloadRightsErrorResolution ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IAsyncValue]].

The data that can be read from the [[#IAsyncValue]] is [[#NoDownloadRightsErrorResolution]].

See [[#RequestApplicationUpdateInfo]] regarding nifm.

==== RequestResolveNoDownloadRightsError ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IAsyncValue]].

The data that can be read from the [[#IAsyncValue]] is [[#NoDownloadRightsErrorResolution]].

See [[#RequestApplicationUpdateInfo]] regarding nifm.

==== GetPromotionInfo ====
Takes a type-0x6 output buffer containing an array of [[#PromotionInfo]], a type-0x5 input buffer containing an array of u64 [[NCM_services#ApplicationId|ApplicationIds]], a type-0x5 input buffer containing an array of [[Account_services#Uid|Uids]], no output.

Official sw uses hard-coded value 1 for the count with each of these arrays.

==== ListPromotionInfo ====
[20.0.0+] The struct size for the output buffer array is now 0x28-bytes instead of 0x20-bytes.

==== ImportPromotionJsonForDebug ====
Takes a type-0x5 input buffer, no output.

The output from [[Settings_services#GetDebugModeFlag]] must be 1, otherwise an error is returned.

==== ClearPromotionInfoForDebug ====
No input/output.

The output from [[Settings_services#GetDebugModeFlag]] must be 1, otherwise an error is returned.

This just clears 0xC-bytes in state.

==== CreateApplicationResource ====
Takes an input [[#ApplicationResourceType]]. Returns an [[#IApplicationResource]].

==== GetApplicationResource ====
Takes an input u64 ProcessId and an input [[#ApplicationResourceType]]. Returns an [[#IApplicationResource]].

==== LaunchMicroApplication ====
[18.0.0+] Now takes a total of 0x50 bytes of input.

[19.0.0+] Now takes a total of 0x80 bytes of input.

==== CreateApplicationInstance ====
[18.0.0+] Now takes a total of 0x50 bytes of input.

[19.0.0+] Now takes a total of 0x80 bytes of input.

==== RegisterDeviceLockKey ====
Takes a type-0x5 input buffer containing an InArray of u8, no output.

User-processes expose this with two funcs: one which uses an user-specified u8 array directly, while the other uses [[HID_services#NpadButtonSet|NpadButton]].

This does SHA256 hashing, etc.

==== UnregisterDeviceLockKey ====
No input/output.

Runs code identical to [[#RegisterDeviceLockKey]], except the passed buffer/size are 0.

==== VerifyDeviceLockKey ====
Takes a type-0x5 input buffer containing an InArray of u8, no output.

User-processes expose this with two funcs: one which uses an user-specified u8 array directly, while the other uses [[HID_services#NpadButtonSet|NpadButton]].

This runs hashing similar to [[#RegisterDeviceLockKey]], with the calculated hash being verified with the one from state.

==== HideApplicationIcon ====
No input/output.

==== ShowApplicationIcon ====
No input/output.

==== HideApplicationTitle ====
No input/output.

==== ShowApplicationTitle ====
No input/output.

==== EnableGameCard ====
No input/output.

==== DisableGameCard ====
No input/output.

==== EnableLocalContentShare ====
No input/output.

==== DisableLocalContentShare ====
No input/output.

==== IsApplicationIconHidden ====
No input, returns an output bool.

==== IsApplicationTitleHidden ====
No input, returns an output bool.

==== IsGameCardEnabled ====
No input, returns an output bool.

==== IsLocalContentShareEnabled ====
No input, returns an output bool.

Various Deliver cmds now run essentially the same code as IsLocalContentShareEnabled, with an error being returned when it's not enabled.

==== GetSafeSystemVersionCheckInfoOld ====
Unofficial name.

No input, returns 0x10-bytes of output.

[22.0.0+] Wraps [[#GetSafeSystemVersionCheckInfo|GetSafeSystemVersionCheckInfo]].

==== Cmd4026 ====
Takes an input u64, returns an [[#IHostSession|IHostSession]].

The input u64 must match a state field.

This initializes [[LDN_services|ldn]] etc, and creates a network.

==== Cmd4027 ====
Takes an input u64, returns an [[#IClientSession|IClientSession]].

The input u64 must match a state field.

This initializes [[LDN_services|ldn]] etc.

=== IGameCardStopper ===
This is "nn::ns::detail::IGameCardStopper".

This interface has no commands.

=== IRequestServerStopper ===
This is "nn::ns::detail::IRequestServerStopper".

This interface has no commands.

=== IProgressMonitorForDeleteUserSaveDataAll ===
This is "nn::ns::detail::IProgressMonitorForDeleteUserSaveDataAll".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetSystemEvent
|-
| 1 || IsFinished
|-
| 2 || GetResult
|-
| 10 || GetProgress
|}

When closing the object, official sw uses IsFinished first, asserting when the output bool is false.

* GetSystemEvent: No input, returns an output Event handle. [[qlaunch]] doesn't use this.

* IsFinished: No input, returns an output u8 bool.

* GetResult: No input/output.

* GetProgress: No input, returns an output [[#ProgressForDeleteUserSaveDataAll]]. Official sw writes this struct directly to object state.

=== IProgressAsyncResult ===
This is "nn::ns::detail::IProgressAsyncResult".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Get
|-
| 1 || Cancel
|-
| 2 || GetProgress
|-
| 3 || GetDetailResult
|-
| 4 || [4.0.0+] GetErrorContext
|}

=== IHostSession ===
This is "nn::ns::vphym::detail::IHostSession".

This was added with [20.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 ||
|-
| 1 ||
|-
| 2 ||
|}

==== Cmd0 ====
No input, returns an output Event handle and an [[#IAsyncValue]].

The async task does the following:
* This waits for a client to connect.
* The [[LDN_services|NodeInfo]] UserName is converted into two u64s, which are used to locate a state entry with matching values.
* The client [[LDN_services|NodeInfo]] Ipv4Address is copied into state.
* Then a ptr to the above located state entry is also written into state.

==== Cmd1 ====
No input, returns an output Event handle and an [[#IAsyncResult]].

The async task uses [[NIM_services|nim]] cmd2018 or cmd2027, depending on a state field. Once finished when a state flag is set, [[LDN_services|ldn]] is finalized and that state flag is cleared.

==== Cmd2 ====
No input, returns an output Event handle and an [[#IAsyncResult]].

The async task uses [[NIM_sevices|nim]] cmd2024.

=== IClientSession ===
This is "nn::ns::vphym::detail::IClientSession".

This was added with [20.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 ||
|-
| 1 ||
|-
| 2 ||
|}

==== Cmd0 ====
No input, returns an output Event handle and an [[#IAsyncValue]].

The async task does the following:
* Uses [[LDN_services|ldn]] Scan.
* After a [[LDN_services|NodeInfo]] is found with a matching UserName, the Ipv4Address for it is copied into state.
* If a timeout didn't occur and a valid NodeInfo was found, it proceeds with connecting to the network.

==== Cmd1 ====
No input, returns an output Event handle and an [[#IAsyncResult]].

The async task uses [[NIM_services|nim]] cmd2019 or cmd2028, depending on a state field. Once finished when a state flag is set, [[LDN_services|ldn]] is finalized and that state flag is cleared.

==== Cmd2 ====
No input, returns an output Event handle and an [[#IAsyncResult]].

This is identical to [[#IHostSession|IHostSession]] Cmd2.

=== IApplicationVersionInterface ===
This is "nn::ns::detail::IApplicationVersionInterface".

This was added with [4.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetLaunchRequiredVersion
|-
| 1 || UpgradeLaunchRequiredVersion
|-
| 35 || UpdateVersionList
|-
| 36 || PushLaunchVersion
|-
| 37 || ListRequiredVersion
|-
| 38 || [22.0.0+]
|-
| 800 || RequestVersionList
|-
| 801 || ListVersionList
|-
| 802 || [[#RequestVersionListData]]
|-
| 900 || [12.0.0+] ImportAutoUpdatePolicyJsonForDebug
|-
| 901 || [12.0.0+] ListDefaultAutoUpdatePolicy
|-
| 902 || [12.0.0+] ListAutoUpdatePolicyForSpecificApplication
|-
| 1000 || PerformAutoUpdate
|-
| 1001 || [11.0.0+] ListAutoUpdateSchedule
|}

==== RequestVersionListData ====
No input, returns an output Event handle and an [[#IAsyncValue]].

The data that can be read from the [[#IAsyncValue]] is [[#VersionListData]].

=== IContentManagementInterface ===
This is "nn::ns::detail::IContentManagementInterface".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 11 || [[#CalculateApplicationOccupiedSize]]
|-
| 43 || [[#CheckSdCardMountStatus]]
|-
| 47 || [[#GetTotalSpaceSize]]
|-
| 48 || [[#GetFreeSpaceSize]]
|-
| 58 || [20.1.0+]
|-
| 71 || [20.1.0+]
|-
| 600 || [[#CountApplicationContentMeta]]
|-
| 601 || [[#ListApplicationContentMetaStatus]]
|-
| 605 || [[#ListApplicationContentMetaStatusWithRightsCheck]]
|-
| 607 || [[#IsAnyApplicationRunning]]
|-
| 608 || [21.0.0+]
|}

==== CalculateApplicationOccupiedSize ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output [[#ApplicationOccupiedSize]].

==== CheckSdCardMountStatus ====
No input/output.

==== CountApplicationContentMeta ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output s32.

==== ListApplicationContentMetaStatusWithRightsCheck ====
Same input/output as [[#ListApplicationContentMetaStatus]].

==== IsAnyApplicationRunning ====
No input, returns an output u8 bool.

=== IDocumentInterface ===
This is "nn::ns::detail::IDocumentInterface".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 21 || GetApplicationContentPath
|-
| 23 || ResolveApplicationContentPath
|-
| 92 || [5.0.0+] GetRunningApplicationProgramId
|-
| 100 || [S2]
|-
| 101 || [S2]
|-
| 2524 || [19.0.0+]
|}

==== Cmd100 ====
Takes a type-0x16 output buffer containing a 0x300-byte struct, an input u8, an u64. Returns two output u8s.

==== Cmd101 ====
Takes a type-0x16 output buffer containing a 0x300-byte struct, an input u8, an u64. Returns an output u8, an u8 [[Filesystem_services|ContentAttributes]], and a [[NCM_services#ProgramId|ProgramId]].

This is similar to Cmd2524. On [S2] this is used instead of Cmd2524.

==== Cmd2524 ====
Takes a type-0x16 output buffer containing a 0x300-byte struct, an input u8, an u64. Returns an output u8 [[Filesystem_services|ContentAttributes]] and a [[NCM_services#ProgramId|ProgramId]].

The user-process uses the output from this as the input for [[Filesystem_services|OpenFileSystemWithId]] (out-buffer is used as the [[Filesystem_services|FspPath]]).

=== IDownloadTaskInterface ===
This is "nn::ns::detail::IDownloadTaskInterface".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 701 || [[#ClearTaskStatusList]]
|-
| 702 || [[#RequestDownloadTaskList]]
|-
| 703 || [[#RequestEnsureDownloadTask]]
|-
| 704 || [[#ListDownloadTaskStatus]]
|-
| 705 || [[#RequestDownloadTaskListData]]
|-
| 706 || [4.0.0+] [[#TryCommitCurrentApplicationDownloadTask]]
|-
| 707 || [4.0.0+] [[#EnableAutoCommit]]
|-
| 708 || [4.0.0+] [[#DisableAutoCommit]]
|-
| 709 || [4.0.0+] [[#TriggerDynamicCommitEvent]]
|-
| 710 || [20.0.0+]
|}

==== ClearTaskStatusList ====
No input/output.

==== RequestDownloadTaskList ====
No input/output.

==== RequestEnsureDownloadTask ====
No input, returns an output Event handle and an [[#IAsyncResult]].

==== ListDownloadTaskStatus ====
Takes a type-0x6 output buffer containing an array of [[#DownloadTaskStatus]], returns an output s32 total_out.

A maximum of 0x100 tasks can be stored in state.

==== TryCommitCurrentApplicationDownloadTask ====
No input/output.

==== EnableAutoCommit ====
No input/output.

==== DisableAutoCommit ====
No input/output.

==== TriggerDynamicCommitEvent ====
No input/output.

=== IReadOnlyApplicationRecordInterface ===
This is "nn::ns::detail::IReadOnlyApplicationRecordInterface".

This was added with [5.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || HasApplicationRecord || Same as [[#IApplicationManagerInterface]] cmd 910
|-
| 1 || [10.0.0+] NotifyApplicationFailure ||
|-
| 2 || [10.0.0+] IsDataCorruptedResult ||
|-
| 3 || [20.0.0+] [[#ListApplicationRecord|ListApplicationRecord]] ||
|}

=== IReadOnlyApplicationControlDataInterface ===
This is "nn::ns::detail::IReadOnlyApplicationControlDataInterface".

This was added with [5.1.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || [[#GetApplicationControlData]] || Same as [[#IApplicationManagerInterface]] cmd 400
|-
| 1 || [[#GetApplicationDesiredLanguage]] || Same as [[#IApplicationManagerInterface]] cmd 55
|-
| 2 || ConvertApplicationLanguageToLanguageCode || Same as [[#IApplicationManagerInterface]] cmd 59
|-
| 3 || [[#ConvertLanguageCodeToApplicationLanguage]] || Same as [[#IApplicationManagerInterface]] cmd 60
|-
| 4 || [9.0.0+] SelectApplicationDesiredLanguage ||
|-
| 5 || [19.0.0+] || Same as [[#IApplicationManagerInterface]] cmd 411
|-
| 6 || [19.0.0+] || Same as [[#IApplicationManagerInterface]] cmd 416
|-
| 7 || [20.0.0+] || Same as [[#IApplicationManagerInterface]] cmd 921
|-
| 8 || [20.0.0+] || Same as [[#IApplicationManagerInterface]] cmd 922
|-
| 9 || [20.0.0+] || Same as [[#IApplicationManagerInterface]] cmd 923
|-
| 10 || [20.0.0+] || Same as [[#IApplicationManagerInterface]] cmd 421
|-
| 11 || [20.0.0+] || Same as [[#IApplicationManagerInterface]] cmd 422
|-
| 12 || [20.0.0+] || Same as [[#IApplicationManagerInterface]] cmd 423
|-
| 13 || [20.0.0+] || Same as [[#IApplicationManagerInterface]] cmd 407
|-
| 14 || [20.0.0+] || Same as [[#IApplicationManagerInterface]] cmd 408
|-
| 15 || [20.0.0+] || Same as [[#IApplicationManagerInterface]] cmd 415
|-
| 16 || [20.0.0+] ||
|-
| 17 || [20.1.0+] || Same as [[#IApplicationManagerInterface]] cmd 933
|-
| 18 || [21.0.0+] ||
|-
| 19 || [21.0.0+] ||
|-
| 20 || [21.0.0+] ||
|-
| 21 || [21.0.0+] ||
|-
| 22 || [21.0.0+] ||
|}

=== IDynamicRightsInterface ===
This is "nn::ns::detail::IDynamicRightsInterface".

This was added with [6.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#RequestApplicationRightsOnServer]]
|-
| 1 || [[#RequestAssignRights]]
|-
| 4 || [[#DeprecatedRequestAssignRightsToResume]]
|-
| 5 || [[#VerifyActivatedRightsOwners]]
|-
| 6 || [[#DeprecatedGetApplicationRightsStatus]]
|-
| 7 || [[#RequestPrefetchForDynamicRights]]
|-
| 8 || [[#GetDynamicRightsState]]
|-
| 9 || [7.0.0+] [[#RequestApplicationRightsOnServerToResume]]
|-
| 10 || [7.0.0+] [[#RequestAssignRightsToResume]]
|-
| 11 || [7.0.0+] [[#GetActivatedRightsUsers]]
|-
| 12 || [8.0.0+] [[#GetApplicationRightsStatus]]
|-
| 13 || [8.0.0+] [[#GetRunningApplicationStatus]]
|-
| 14 || [10.0.0-15.0.1] SelectApplicationLicense
|-
| 15 || [12.0.0+] [[#RequestContentsAuthorizationToken]]
|-
| 16 || [13.0.0+] QualifyUser
|-
| 17 || [13.0.0+] QualifyUserWithProcessId
|-
| 18 || [13.0.0+] NotifyApplicationRightsCheckStart
|-
| 19 || [13.0.0+] UpdateUserList
|-
| 20 || [13.0.0+] IsRightsLostUser
|-
| 21 || [13.1.0+] SetRequiredAddOnContentsOnContentsAvailabilityTransition
|-
| 22 || [14.0.0+] GetLimitedApplicationLicense
|-
| 23 || [14.0.0+] GetLimitedApplicationLicenseUpgradableEvent
|-
| 24 || [14.0.0+] NotifyLimitedApplicationLicenseUpgradableEventForDebug
|-
| 25 || [14.0.0+] RequestProceedDynamicRightsState
|-
| 26 || [18.0.0+] HasAccountRestrictedRightsInRunningApplications
|-
| 27 || [20.0.0+]
|-
| 28 || [20.0.0+]
|-
| 29 || [21.0.0+]
|-
| 30 || [21.0.0+]
|}

==== RequestApplicationRightsOnServer ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], an [[Account_services#Uid|Uid]] and an u32. Returns an output Event handle and an [[#IAsyncValue]].

==== RequestAssignRights ====
Takes a type-0x5 input buffer containing an array of "nn::ns::ApplicationRightsOnServer". Returns an output Event handle and an [[#IAsyncResult]].

==== DeprecatedRequestAssignRightsToResume ====
Takes an input u64 "nn::ns::RightsEnvironmentHandle" and an [[Account_services#Uid|Uid]]. Returns an output Event handle and an [[#IAsyncResult]].

==== VerifyActivatedRightsOwners ====
Takes an input u64 "nn::ns::RightsEnvironmentHandle". No output.

==== DeprecatedGetApplicationRightsStatus ====
Takes an input u64 "nn::ns::RightsEnvironmentHandle". Returns a bool "nn::ns::ApplicationRightsStatus".

==== RequestPrefetchForDynamicRights ====
Takes an input [[Account_services#Uid|Uid]]. Returns an output Event handle and an [[#IAsyncResult]].

==== GetDynamicRightsState ====
No input. Returns a bool "nn::ns::DynamicRightsState".

==== RequestApplicationRightsOnServerToResume ====
Takes an input u64 "nn::ns::RightsEnvironmentHandle". Returns an output Event handle and an [[#IAsyncValue]].

==== RequestAssignRightsToResume ====
Takes an input u64 "nn::ns::RightsEnvironmentHandle". Returns an output Event handle and an [[#IAsyncResult]].

==== GetActivatedRightsUsers ====
Takes an input u64 "nn::ns::RightsEnvironmentHandle". Returns a bool, an u32 and a type-0x6 output buffer containing an array of [[Account_services#Uid|Uid]].

==== GetApplicationRightsStatus ====
Takes an input "nn::ns::RightsEnvironmentHandle". Returns 2 bools "nn::ns::ApplicationRightsStatus" and "nn::ns::ApplicationLicenseType".

==== GetRunningApplicationStatus ====
Takes an input u64 "nn::ns::RightsEnvironmentHandle". Returns an u32 "nn::ns::RunningApplicationStatus".

==== RequestContentsAuthorizationToken ====
Takes a total of 0x50-bytes of input, a type-0x5 input buffer. Returns an [[#IAsyncData_2|IAsyncData]] and an output handle.

==== IAsyncData ====
This is "nn::ns::detail::IAsyncData".

This was added with [12.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetSize
|-
| 1 || Get
|-
| 2 || Cancel
|-
| 3 || GetErrorContext
|}

=== IECommerceInterface===
This is "nn::ns::detail::IECommerceInterface".

This was added with [4.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#RequestLinkDevice]]
|-
| 1 || [6.0.0+] [[#RequestCleanupAllPreInstalledApplications]]
|-
| 2 || [6.0.0+] [[#RequestCleanupPreInstalledApplication]]
|-
| 3 || [6.0.0+] [[#RequestSyncRights]]
|-
| 4 || [6.0.0+] [[#RequestUnlinkDevice]]
|-
| 5 || [6.1.0+] [[#RequestRevokeAllELicense]]
|-
| 6 || [9.0.0+] [[#RequestSyncRightsBasedOnAssignedELicenses]]
|-
| 7 || [14.0.0+] RequestOnlineSubscriptionFreeTrialAvailability
|-
| 8 || [20.0.0+]
|-
| 9 || [20.0.0+]
|-
| 10 || [20.0.0+]
|-
| 11 || [20.0.0+]
|-
| 12 || [20.0.0+]
|-
| 13 || [20.0.0+]
|-
| 14 || [21.0.0+]
|}

==== RequestLinkDevice ====
Takes an input [[Account_services#Uid|Uid]], returns an output Event handle and an [[#IAsyncResult]].

See [[#RequestApplicationUpdateInfo]] regarding nifm.

==== RequestCleanupAllPreInstalledApplications ====
No input, returns an output Event handle and an [[#IAsyncResult]].

==== RequestCleanupPreInstalledApplication ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IAsyncResult]].

==== RequestSyncRights ====
No input, returns an output Event handle and an [[#IAsyncResult]].

==== RequestUnlinkDevice ====
Takes an input [[Account_services#Uid|Uid]], returns an output Event handle and an [[#IAsyncResult]].

See [[#RequestApplicationUpdateInfo]] regarding nifm.

==== RequestRevokeAllELicense ====
Takes an input [[Account_services#Uid|Uid]], returns an output Event handle and an [[#IAsyncResult]].

==== RequestSyncRightsBasedOnAssignedELicenses ====
No input, returns an output Event handle and an [[#IAsyncResult]].

=== IFactoryResetInterface ===
This is "nn::ns::detail::IFactoryResetInterface".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 100 || [[#ResetToFactorySettings]]
|-
| 101 || [[#ResetToFactorySettingsWithoutUserSaveData]]
|-
| 102 || [[#ResetToFactorySettingsForRefurbishment]]
|-
| 103 || [9.1.0+] [[#ResetToFactorySettingsWithPlatformRegion]]
|-
| 104 || [9.1.0+] [[#ResetToFactorySettingsWithPlatformRegionAuthentication]]
|-
| 105 || [10.0.0+] [[#RequestResetToFactorySettingsSecurely]]
|-
| 106 || [10.0.0+] [[#RequestResetToFactorySettingsWithPlatformRegionAuthenticationSecurely]]
|-
| 107 || [20.0.0+]
|-
| 108 || [20.0.0+]
|}

==== ResetToFactorySettings ====
No input/output.

As of [9.1.0] this is the only [[#IFactoryResetInterface]] cmd used by [[qlaunch]].

==== ResetToFactorySettingsWithoutUserSaveData ====
No input/output.

==== ResetToFactorySettingsForRefurbishment ====
No input/output.

==== ResetToFactorySettingsWithPlatformRegion ====
No input/output.

==== ResetToFactorySettingsWithPlatformRegionAuthentication ====
No input/output.

==== RequestResetToFactorySettingsSecurely ====
Takes an input u64 tmem_size, a TransferMemory handle, returns an output [[#IAsyncValueAndProgress]] and an Event handle.

The TransferMemory uses permissions=0.

==== RequestResetToFactorySettingsWithPlatformRegionAuthenticationSecurely ====
Takes an input u32 "nn::ae::PlatformRegion", an u64 tmem_size, a TransferMemory handle, returns an output [[#IAsyncValueAndProgress]] and an Event handle.

The TransferMemory uses permissions=0.

===== IAsyncValueAndProgress =====
This is "nn::ns::detail::IAsyncValueAndProgress".

This was added with [10.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetSize
|-
| 1 || Get
|-
| 2 || Cancel
|-
| 3 || GetErrorContext
|-
| 4 || GetProgress
|}

=== IApplicationResource ===
This is "nn::ns::detail::IApplicationResource".

This was added with [9.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Attach
|-
| 1 || BoostSystemMemoryResourceLimit
|}

= ns:vm =
This is "nn::ns::detail::IVulnerabilityManagerInterface".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 1200 || [3.0.0+] [[#NeedsUpdateVulnerability]]
|-
| 1201 || [4.0.0+] [[#UpdateSafeSystemVersionForDebug]]
|-
| 1202 || [4.0.0+] [[#GetSafeSystemVersion]]
|-
| 3100 || [18.0.0+] [[#GetSafeSystemVersionCheckInfo|GetSafeSystemVersionCheckInfo]]
|-
| 3101 || [18.0.0+] [[#RequestUpdateSafeSystemVersionCheckInfo|RequestUpdateSafeSystemVersionCheckInfo]]
|-
| 3102 || [18.0.0+] [[#ResetSafeSystemVersionCheckInfo|ResetSafeSystemVersionCheckInfo]]
|}

== NeedsUpdateVulnerability ==
No input, returns an output u8 bool flag.

[S1] Web-applets use this command to check if the system needs an update.

== UpdateSafeSystemVersionForDebug ==
Takes an input u32 '''version''' and an [[NCM_services#ApplicationId|ApplicationId]].

This command is not available for retail units. On a debug unit, if the [[System_Settings|system setting]] <code>vulnerability!enable_debug</code> is set, this mounts the system savegame [[Flash_Filesystem#System_Savegames|0x8000000000000049]] as "ns_ssversion:/", opens the file "ns_ssversion:/entry" and writes the supplied [[NCM_services#ApplicationId|ApplicationId]] and '''version''' in it.

Finally, it calls [[NCM_services#ncm|OpenContentMetaDatabase]] with [[NCM_services#StorageId|StorageId]] 3, then calls [[NCM_services#IContentMetaDatabase|GetLatestContentMetaKey]] with the supplied [[NCM_services#ApplicationId|ApplicationId]] and compares the version field from the returned [[CNMT#Content_Meta_Records|Content Meta Record]] with the supplied '''version'''.

If the supplied '''version''' is higher than the one in NCM's database, the value returned by [[NS_Services#NeedsUpdateVulnerability|NeedsUpdateVulnerability]] is set to "true".

== GetSafeSystemVersion ==
No input, returns an output [[NCM_services#ContentMetaKey|ContentMetaKey]] with the cached contents of "ns_ssversion:/entry" ([[NCM_services#ApplicationId|ApplicationId]], u32 '''version''' and u32 '''policy''' from <code>vulnerability!needs_update_vulnerability_policy</code>).

== GetSafeSystemVersionCheckInfo ==
No input, returns 0x10-bytes of output.

[22.0.0+] Now returns 0x20-bytes of output.

[S2] Used by web-applets via ns:vm.

== RequestUpdateSafeSystemVersionCheckInfo ==
No input, returns an output Event handle and an [[#IAsyncResult|IAsyncResult]].

[S2] Used by web-applets via ns:vm.

The async task thread uses [[NIM_services|nim]] RequestCheckSafeSystemVersion, etc.

== ResetSafeSystemVersionCheckInfo ==
No input/output.

This throws an error if [[Settings_services|GetDebugModeFlag]] returns false.

= ns:su =
This is "nn::ns::detail::ISystemUpdateInterface".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#GetBackgroundNetworkUpdateState]]
|-
| 1 || [[#OpenSystemUpdateControl]]
|-
| 2 || [[#NotifyExFatDriverRequired]]
|-
| 3 || [[#ClearExFatDriverStatusForDebug]]
|-
| 4 || [[#RequestBackgroundNetworkUpdate]]
|-
| 5 || [[#NotifyBackgroundNetworkUpdate]]
|-
| 6 || [[#NotifyExFatDriverDownloadedForDebug]]
|-
| 9 || [[#GetSystemUpdateNotificationEventForContentDelivery]]
|-
| 10 || [[#NotifySystemUpdateForContentDelivery]]
|-
| 11 || [3.0.0+] [[#PrepareShutdown]]
|-
| 12 || [3.0.0-3.0.2]
|-
| 13 || [3.0.0-3.0.2]
|-
| 14 || [3.0.0-3.0.2]
|-
| 15 || [3.0.0-3.0.2]
|-
| 16 || [4.0.0+] [[#DestroySystemUpdateTask]]
|-
| 17 || [4.0.0+] [[#RequestSendSystemUpdate]]
|-
| 18 || [4.0.0+] [[#GetSendSystemUpdateProgress]]
|-
| 19 || [S2]
|-
| 20 || [S2]
|}

== GetBackgroundNetworkUpdateState ==
No input, returns an output [[#BackgroundNetworkUpdateState]].

This is similar to [[#HasDownloaded]], see [[#BackgroundNetworkUpdateState]].

== OpenSystemUpdateControl ==
No input, returns an [[#ISystemUpdateControl]].

Only 1 ISystemUpdateControl can be open at a time.

== NotifyExFatDriverRequired ==
No input/output.

Only usable when an [[#ISystemUpdateControl]] isn't open.

This uses [[NIM_services|nim]] ListSystemUpdateTask, then when a task is returned uses it with DestroySystemUpdateTask.

Then this runs ExFat handling, updates state, and sets the same state flag as [[#RequestBackgroundNetworkUpdate]].

== ClearExFatDriverStatusForDebug ==
No input/output.

== RequestBackgroundNetworkUpdate ==
No input/output.

Only usable when an [[#ISystemUpdateControl]] isn't open.

This sets a state flag to value 1.

== NotifyBackgroundNetworkUpdate ==
Takes an input [[NCM_services#ContentMetaKey|ContentMetaKey]], no output.

This checks whether a sysupdate is needed with the input ContentMetaKey using [[NCM_services|NCM]] commands, if not this will just return 0. Otherwise, this will then run code which is identical to [[#RequestBackgroundNetworkUpdate]].

== NotifyExFatDriverDownloadedForDebug ==
No input/output.

== GetSystemUpdateNotificationEventForContentDelivery ==
No input, returns an output Event handle with EventClearMode=0.

== NotifySystemUpdateForContentDelivery ==
No input/output.

Signals the Event returned by [[#GetSystemUpdateNotificationEventForContentDelivery]].

== PrepareShutdown ==
No input/output.

This is used by [[AM_services|AM]].

Just returns 0 when an [[#ISystemUpdateControl]] is open.

This does various cleanup / uses various service-cmds etc for shutdown preparation.

== DestroySystemUpdateTask ==
No input/output.

Only usable when an [[#ISystemUpdateControl]] isn't open.

This uses [[NIM_services|nim]] ListSystemUpdateTask, then when a task is returned uses it with DestroySystemUpdateTask.

== RequestSendSystemUpdate ==
Takes a type-0x15 input buffer containing a [[#SystemDeliveryInfo]], an u16 port, an u32 Ipv4Address, returns an output Event handle and an [[#IAsyncResult]].

[[qlaunch]] uses value 55556 for the port. IP is normally a local-WLAN address, however this can be any address. port/addr are little-endian.

See [[NIM_services|nim]] regarding the input addr/port usage, etc.

[11.0.0+] An error is thrown if LocalContentShare is not [[#IsLocalContentShareEnabled|enabled]].

This validates the [[#SystemDeliveryInfo]] and generates a [[NCM_services#ContentMetaKey|ContentMetaKey]] from that, and creates the [[#IAsyncResult]] + the async thread which handles the [[#IAsyncResult]] operation.

The above validation verifies that the HMAC and SystemDeliveryProtocolVersion are valid. The OldSystemUpdateId ([20.0.0+] SystemUpdateId, SystemUpdateIdFlag ignored) must match the Id for the installed SystemUpdate as returned by [[NCM_services|ncm]].

Then the thread does:
* Calls a func which does:
** Uses [[NIM_services|nim]] CreateLocalCommunicationSendSystemUpdateTask, returning the Result on failure.
*** The input firmware_variation is from the [[#SystemDeliveryInfo|FirmwareVariationId]].
** Uses [[NIM_services|nim]] RequestLocalCommunicationSendSystemUpdateTaskRun, returning the Result on failure. Waits for the IAsyncResult operation from this to finish, then uses the Get cmd to get the output Result.
*** When the Result from Get is an error, a func is called for filling in the [[#IAsyncResult|IAsyncResult]] ErrorContext with Type4.
** Handles cleanup and returns.
* Unlike [[#RequestReceiveSystemUpdate]], this doesn't save a SystemPlayReport.

== GetSendSystemUpdateProgress ==
No input, returns an output [[#SystemUpdateProgress]].

Same as [[#GetReceiveProgress]] except this uses nim ListLocalCommunicationSendSystemUpdateTask and GetLocalCommunicationSendSystemUpdateTaskInfo. The data copied to output is also swapped: u64 nim_out+0x8 is copied to out+0x8, and u64 nim_out+0x10 is copied to out+0x0.

== Cmd19 ==
This is exclusive to S2.

No input/output.

== Cmd20 ==
This is exclusive to S2.

No input, returns an output u8.

== ISystemUpdateControl ==
This is "nn::ns::detail::ISystemUpdateControl".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#HasDownloaded]]
|-
| 1 || [[#RequestCheckLatestUpdate]]
|-
| 2 || [[#RequestDownloadLatestUpdate]]
|-
| 3 || [[#GetDownloadProgress]]
|-
| 4 || [[#ApplyDownloadedUpdate]]
|-
| 5 || [[#RequestPrepareCardUpdate]]
|-
| 6 || [[#GetPrepareCardUpdateProgress]]
|-
| 7 || [[#HasPreparedCardUpdate]]
|-
| 8 || [[#ApplyCardUpdate]]
|-
| 9 || [[#GetDownloadedEulaDataSize]]
|-
| 10 || [[#GetDownloadedEulaData]]
|-
| 11 || [[#SetupCardUpdate]]
|-
| 12 || [[#GetPreparedCardUpdateEulaDataSize]]
|-
| 13 || [[#GetPreparedCardUpdateEulaData]]
|-
| 14 || [4.0.0+] [[#SetupCardUpdateViaSystemUpdater]]
|-
| 15 || [4.0.0+] [[#HasReceived]]
|-
| 16 || [4.0.0+] [[#RequestReceiveSystemUpdate]]
|-
| 17 || [4.0.0+] [[#GetReceiveProgress]]
|-
| 18 || [4.0.0+] [[#ApplyReceivedUpdate]]
|-
| 19 || [4.0.0+] [[#GetReceivedEulaDataSize]]
|-
| 20 || [4.0.0+] [[#GetReceivedEulaData]]
|-
| 21 || [4.0.0+] [[#SetupToReceiveSystemUpdate]]
|-
| 22 || [6.0.0+] [[#RequestCheckLatestUpdateIncludesRebootlessUpdate]]
|}

All Card cmds except SetupCardUpdate* require [[#SetupCardUpdate]]/[[#SetupCardUpdateViaSystemUpdater]] to be used previously. [[#GetPreparedCardUpdateEulaDataSize]]/[[#GetPreparedCardUpdateEulaData]] checks a different state flag.

=== HasDownloaded ===
No input, returns an output u8 bool flag.

Gets whether a network sysupdate was downloaded, with install pending.

Uses [[NIM_services|nim]] ListSystemUpdateTask and [[NIM_services|nim]] GetSystemUpdateTaskInfo. When ListSystemUpdateTask successfully returns a task and GetSystemUpdateTaskInfo is successful, the output flag is set to: <code>*((u8*)(taskinfo+0) == 0x3</code>. Otherwise, flag=0.

This always returns 0, however this will assert if GetSystemUpdateTaskInfo fails with ret!=0x3C89.

=== RequestCheckLatestUpdate ===
No input, returns an output Event handle and an [[#IAsyncValue]].

The data that can be read from the [[#IAsyncValue]] is [[#LatestSystemUpdate]].

=== RequestDownloadLatestUpdate ===
No input, returns an output Event handle and an [[#IAsyncResult]].

=== GetDownloadProgress ===
No input, returns an output [[#SystemUpdateProgress]].

Similar to [[#HasDownloaded]] except instead of a flag, this returns the 0x10-bytes from taskinfo+8. The output struct is cleared when the task(info) isn't available.

=== ApplyDownloadedUpdate ===
No input/output.

Runs code similar to [[#HasDownloaded]], throwing an error if a network sysupdate isn't ready for install. Then the sysupdate is installed:

* Uses ListSystemUpdateTask again, then [[NIM_services|nim]] IsExFatDriverIncluded. Runs ExFat handling when the output flag is set.
* On newer system-versions, this uses [[NIM_services|nim]] GetSystemUpdateTaskInfo then on success uses data from there to save a SystemPlayReport when the cached [[System_Settings|system-setting]] "systemreport!enabled" is set.
** The EventId is "systemupdate_dl_throughput" with ApplicationId 0100000000001018.
** The following fields are added to the report, see [[NIM_services#SystemUpdateTaskInfo|nim SystemUpdateTaskInfo]]: "ContentMetaId", "Version", "DownloadSize", and "ThroughputKBps".
* On newer system-versions, this saves another SystemPlayReport when a state flag is set (same flag mentioned above).
** The EventId is "systemupdate_pass" with ApplicationId 0100000000001021.
** This report has the following fields:
*** "Type"
*** "SourceSystemUpdateMetaId"
*** "SourceSystemUpdateMetaVersion"
*** "SourceExFatStatus"
*** "DestinationSystemUpdateMetaId"
*** "DestinationSystemUpdateMetaVersion"
*** "DestinationExFatStatus"
*** "Rebootless"
* Since BootImagePackage will be installed later, the two flags in [[Flash_Filesystem#System_Update_Control]] are set to 1.
* Uses [[NIM_services|nim]] CommitSystemUpdateTask and [[NIM_services|nim]] DestroySystemUpdateTask.
* Installs BootImagePackage. After installing each BootImagePackage, the associated flag in [[Flash_Filesystem#System_Update_Control]] is set to 0.
* On newer system versions when an input flag is set, this uses [[Filesystem_services|NotifySystemDataUpdateEvent]], however this doesn't happen with ApplyDownloadedUpdate since that input flag is 0.

=== RequestPrepareCardUpdate ===
No input, returns an output Event handle and an [[#IAsyncResult]].

=== GetPrepareCardUpdateProgress ===
No input, returns an output [[#SystemUpdateProgress]].

=== HasPreparedCardUpdate ===
No input, returns an output u8 bool flag.

=== ApplyCardUpdate ===
No input/output.

=== GetDownloadedEulaDataSize ===
Takes a type-0x15 input buffer [[#EulaDataPath]], returns an output u64 '''filesize'''.

Runs code similar to [[#HasDownloaded]], throwing an error if a network sysupdate isn't ready for install.

Uses ListSystemUpdateTask again. Then [[NIM_services|nim]] GetDownloadedSystemDataPath, with the output ContentPath being used to mount the EULA title with FS.

Then "<mountname>:/<[[#EulaDataPath]]>" is opened, gets the '''filesize''', then runs cleanup.

=== GetDownloadedEulaData ===
Takes a type-0x15 input buffer [[#EulaDataPath]] and a type-0x6 output buffer, returns an output u64 '''filesize'''.

Similar to [[#GetDownloadedEulaDataSize]] except this reads the file instead, using the specified output buffer with size=filesize. This will throw an error if the filesize is larger than the buffer size.

=== SetupCardUpdate ===
Takes an input u64 size and a TransferMemory handle, no output.

Official sw creates the TransferMemory with an user-specified buffer, with permissions=None.

[[qlaunch]] uses size 0x100000 for the TransferMemory buffer.

=== GetPreparedCardUpdateEulaDataSize ===
Takes a type-0x15 input buffer [[#EulaDataPath]], returns an output u64 '''filesize'''.

This is similar to [[#GetDownloadedEulaDataSize]].

=== GetPreparedCardUpdateEulaData ===
Takes a type-0x15 input buffer [[#EulaDataPath]] and a type-0x6 output buffer, returns an output u64 '''filesize'''.

This is similar to [[#GetDownloadedEulaData]].

=== SetupCardUpdateViaSystemUpdater ===
Takes an input u64 size and a TransferMemory handle, no output.

The permissions for the TransferMemory is None.

Same as [[#SetupCardUpdate]], except this doesn't have the code for [[Filesystem_services|GetGameCardHandle/GetGameCardUpdatePartitionInfo]], and uses [[Filesystem_services|OpenRegisteredUpdatePartition]] instead of [[Filesystem_services|OpenGameCardFileSystem]]. This uses the same is_initialized bool state flag.

=== HasReceived ===
No input, returns an output u8 bool.

Same as [[#HasDownloaded]] except this uses [[NIM_services|nim]] ListLocalCommunicationReceiveSystemUpdateTask and GetLocalCommunicationReceiveSystemUpdateTaskInfo.

=== RequestReceiveSystemUpdate ===
Takes a type-0x15 input buffer containing a [[#SystemDeliveryInfo]], an u16 port, an u32 Ipv4Address, returns an output Event handle and an [[#IAsyncResult]].

[[qlaunch]] uses the same value for the port as [[#RequestSendSystemUpdate]] (see [[#RequestSendSystemUpdate]] for addr as well).

See [[NIM_services|nim]] regarding the input addr/port usage, etc.

This uses the same LocalContentShare check as [[#RequestSendSystemUpdate|RequestSendSystemUpdate]].

An error is thrown if a state flag is clear.

This validates the [[#SystemDeliveryInfo]] (same as [[#RequestSendSystemUpdate|RequestSendSystemUpdate]]) and generates a [[NCM_services#ContentMetaKey|ContentMetaKey]] from that, and creates the [[#IAsyncResult]] + the async thread which handles the [[#IAsyncResult]] operation.

Then the thread does:

* Calls a func which does:
** Throws an error if [[NIM_services#ListSystemUpdateTask|ListSystemUpdateTask]] returns any task.
** Checks whether a sysupdate is actually required using the previously generated [[NCM_services#ContentMetaKey|ContentMetaKey]] (this func is also passed the below statefield as the last param), throwing an error if not.
*** [20.0.0+] The above check-sysupdate func was updated (which is also used elsewhere), flag handling during the loop was updated (which uses the last input param).
** Uses [[NIM_services|nim]] CreateLocalCommunicationReceiveSystemUpdateTask, returning the Result on failure.
*** The input firmware_variation is from [[System_Settings|system-setting]] <code>ns.systemupdate!firmware_variation</code> or <code>ns.systemupdate!t_firmware_variation</code>, depending on the [[Settings_services|PlatformRegion]] (value 0xFF is used when the output setting-size is invalid).
*** The input '''unk''' is set to: <code>unk = statefield == 0 ? 0x4 : 0xC</code> ([20.0.0+] uses statefield & 1 == 0). [20.0.0+] Additional data is now ORRed with unk afterwards: <code>unk |= ((statefield>>1) & 0x3) << 8;</code> (same statefield as before)
** Uses [[NIM_services|nim]] RequestLocalCommunicationReceiveSystemUpdateTaskRun, returning the Result on failure. Waits for the IAsyncResult operation from this to finish, then uses the Get cmd to get the output Result.
*** When the Result from Get is an error, a func is called for filling in the [[#IAsyncResult|IAsyncResult]] ErrorContext with Type4.
** Handles cleanup and returns.
* On success, this loads various data which is then used for saving a SystemPlayReport when the cached [[System_Settings|system-setting]] "systemreport!enabled" is set.
** The EventId is "receive_system_update" with ApplicationId <NS ProgramId>.
** This report has the following fields:
*** "SourceSystemUpdateId"
*** "DestinationSystemUpdateId"
*** "SourceSystemUpdateVersion"
*** "DestinationSystemUpdateVersion"
*** "SenderFirmwareVariationId"
*** "ReceiverFirmwareVariationId"
*** "SenderPlatformRegion"
*** "ReceiverPlatformRegion"
*** "SenderHasExFat"
*** "ReceiverHasExFat"
*** "Size"
*** "ThroughputKBps"

=== GetReceiveProgress ===
No input, returns an output [[#SystemUpdateProgress]].

Same as [[#GetDownloadProgress]] except this uses [[NIM_services|nim]] ListLocalCommunicationReceiveSystemUpdateTask and GetLocalCommunicationReceiveSystemUpdateTaskInfo.

=== ApplyReceivedUpdate ===
No input/output.

This uses the same LocalContentShare check as [[#RequestSendSystemUpdate|RequestSendSystemUpdate]].

=== GetReceivedEulaDataSize ===
Takes a type-0x15 input buffer [[#EulaDataPath]], returns an output u64 '''filesize'''.

This is similar to [[#GetDownloadedEulaDataSize]].

=== GetReceivedEulaData ===
Takes a type-0x15 input buffer [[#EulaDataPath]] and a type-0x6 output buffer, returns an output u64 '''filesize'''.

This is similar to [[#GetDownloadedEulaData]].

=== SetupToReceiveSystemUpdate ===
No input/output.

This just uses [[NIM_services|nim]] ListSystemUpdateTask, then when a task is returned uses it with DestroySystemUpdateTask.

[[qlaunch]] uses this before [[#RequestReceiveSystemUpdate]].

=== RequestCheckLatestUpdateIncludesRebootlessUpdate ===
No input, returns an output Event handle and an [[#IAsyncValue]].

= IAsyncValue =
This is "nn::ns::detail::IAsyncValue".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetSize
|-
| 1 || Get
|-
| 2 || Cancel
|-
| 3 || [4.0.0+] GetErrorContext
|}

Official sw creates a container object for this using the output from the service commands, which contains the IAsyncValue object, and the Event with EventClearMode=0.

* GetSize: No input, returns an output u64.
* Get: Takes a type-0x6 output buffer, no output. Official sw waits on the Event prior to using this cmd.
* Cancel: No input/output. Used by official sw when closing the object, when the serv-obj is initialized (after using the cmd, official sw will also wait on the Event). This cmd is also used in other official sw funcs.
* GetErrorContext: No input/output, takes a type-0x16 output buffer containing an [[Error_Applet#ErrorContext|ErrorContext]].

= IAsyncResult =
This is "nn::ns::detail::IAsyncResult".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Get
|-
| 1 || Cancel
|-
| 2 || [4.0.0+] GetErrorContext
|}

Official sw creates a container object for this using the output from the service commands, which contains the IAsyncResult object, and the Event with EventClearMode=0.

* Get: No input/output. Official sw waits on the Event prior to using this cmd.
* Cancel: No input/output. Used by official sw when closing the object, when the serv-obj is initialized (after using the cmd, official sw will also wait on the Event). This cmd is also used in other official sw funcs.
* GetErrorContext: No input/output, takes a type-0x16 output buffer containing an [[Error_Applet#ErrorContext|ErrorContext]].

= ns:dev =
This is "nn::ns::detail::IDevelopInterface".

[10.0.0+] Some of these cmds were replaced by the [[PGL_services|pgl]] system module.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [1.0.0-9.2.0] [[#LaunchProgram]]
|-
| 1 || [[#TerminateProcess]]
|-
| 2 || [1.0.0-9.2.0] [[#TerminateProgram]]
|-
| 4 || [1.0.0-9.2.0] [[#GetShellEvent]]
|-
| 5 || [1.0.0-9.2.0] [[#GetShellEventInfo]]
|-
| 6 || [[#TerminateApplication]]
|-
| 7 || [1.0.0-9.2.0] [[#PrepareLaunchProgramFromHost]]
|-
| 8 || [10.0.0-17.0.1] [[#LaunchApplicationFromHost]] ([1.0.0-9.2.0] LaunchApplication)
|-
| 9 || [1.0.0-17.0.1] [[#LaunchApplicationWithStorageId]]
|-
| 10 || [6.0.0-8.1.0] [[#IsSystemMemoryResourceLimitBoosted]]
|-
| 11 || [6.0.0+] [[#GetRunningApplicationProcessId]]
|-
| 12 || [6.0.0+] [[#SetCurrentApplicationRightsEnvironmentCanBeActive]]
|-
| 13 || [9.0.0+] [[#CreateApplicationResource]]
|-
| 14 || [9.0.0+] [[#IsPreomia]]
|-
| 15 || [10.0.0-17.0.1] [[#GetApplicationProgramIdFromHost]]
|-
| 16 || [12.0.0+] RefreshCachedDebugValues
|-
| 17 || [12.0.0+] [[#PrepareLaunchApplicationFromHost]]
|-
| 18 || [12.0.0+] [[#GetLaunchEvent]]
|-
| 19 || [12.0.0+] [[#GetLaunchResult]]
|-
| 20 || [14.0.0+] GetProgramId
|-
| 21 || [18.0.0+] [[#PrepareLaunchApplication]]
|-
| 22 || [18.0.0+] [[#LaunchApplication]]
|-
| 23 || [18.0.0+] [[#GetProgramIdByApplicationLaunchInfo]]
|-
| 24 || [18.0.0+] DestroyApplicationLaunchPreparation
|}

== LaunchProgram ==
Wrapper for "pm:shell" [[Process_Manager_services#pm:shell|LaunchProcess]].

== TerminateProcess ==
Wrapper for "pm:shell" [[Process_Manager_services#pm:shell|TerminateProcess]].

== TerminateProgram ==
Wrapper for "pm:shell" [[Process_Manager_services#pm:shell|TerminateProgram]].

== GetShellEvent ==
Wrapper for "pm:shell" [[Process_Manager_services#pm:shell|GetProcessEventHandle]].

== GetShellEventInfo ==
Wrapper for "pm:shell" [[Process_Manager_services#pm:shell|GetProcessEventInfo]].

== TerminateApplication ==
Calls "pm:shell" [[Process_Manager_services#pm:shell|GetApplicationProcessIdForShell]] and sends the ProcessId to [[Process_Manager_services#pm:shell|TerminateProcess]].

== PrepareLaunchProgramFromHost ==
Takes a type-0x5 input buffer containing the [[Filesystem_services#FspPath|FspPath]], returns an output 0x10-byte struct.

Calls [[NCM_services#IPathResolverForStorage|IPathResolverForStorage]] Set...NcaPath functions.

== LaunchApplicationFromHost ==
Takes an input u32 [[Process_Manager_services#LaunchFlags|LaunchFlags]] and a type-0x5 input buffer containing the [[Filesystem_services#FspPath|FspPath]]. Returns an output u64 ProcessId.

== LaunchApplicationWithStorageId ==
Takes 2 input u8 [[NCM_services#StorageId|StorageIds]], an u32 [[Process_Manager_services#LaunchFlags|LaunchFlags]], and an [[NCM_services#ApplicationId|ApplicationId]]. Returns an output u64 ProcessId.

Launches an application title which is registered with NS.

== IsSystemMemoryResourceLimitBoosted ==
No input. Returns a bool.

== GetRunningApplicationProcessId ==
Returns an output u64 ProcessId.

== SetCurrentApplicationRightsEnvironmentCanBeActive ==
Takes an input bool. No output.

== CreateApplicationResource ==
Takes an input u32 (1 = Preomia/MicroApplication). Returns an [[#IApplicationResource]].

== IsPreomia ==
Takes an input u64 [[NCM_services#ProgramId|ProgramId]]. Returns a bool.

== GetApplicationProgramIdFromHost ==
Takes a type-0x5 input buffer containing the [[Filesystem_services#FspPath|FspPath]]. Returns an u64 [[NCM_services#ProgramId|ProgramId]].

== PrepareLaunchApplicationFromHost ==
[18.0.0+] Now returns a total of 0x50 bytes of output.

[19.0.0+] Now returns a total of 0x80 bytes of output.

== GetLaunchEvent ==
[18.0.0+] Now takes a total of 0x50 bytes of input.

[19.0.0+] Now takes a total of 0x80 bytes of input.

== GetLaunchResult ==
[18.0.0+] Now takes a total of 0x50 bytes of input.

[19.0.0+] Now takes a total of 0x80 bytes of input.

== PrepareLaunchApplication ==
Takes a total of 0x10-bytes of input. Returns a total of 0x50-bytes of output.

[19.0.0+] Now returns a total of 0x80-bytes of output.

== LaunchApplication ==
Takes a total of 0x50-bytes of input. Returns a total of 8-bytes of output.

[19.0.0+] Now takes a total of 0x80 bytes of input.

== GetProgramIdByApplicationLaunchInfo ==
Takes a total of 0x50-bytes of input. Returns a total of 8-bytes of output.

[19.0.0+] Now takes a total of 0x80 bytes of input.

= acc:su =
This is "nn::account::IAccountServiceForAdministrator".

[13.0.0+] This was moved from [[Account_services|account]].

This is only available when the output from [[Process_Manager_services|pm:bm]] GetBootMode is Normal/Maintenance.

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || GetUserCount ||
|-
| 1 || GetUserExistence ||
|-
| 2 || ListAllUsers ||
|-
| 3 || ListOpenUsers ||
|-
| 4 || GetLastOpenedUser ||
|-
| 5 || GetProfile || Returns an [[#IProfile]].
|-
| 6 || [3.0.0+] GetProfileDigest ||
|-
| 50 || [[#IsUserRegistrationRequestPermitted]] ||
|-
| 51 || TrySelectUserWithoutInteractionDeprecated ([1.0.0-18.1.0] [[#TrySelectUserWithoutInteraction]]) ||
|-
| 52 || [19.0.0+] TrySelectUserWithoutInteraction ||
|-
| 60 || [5.0.0-5.1.0] ListOpenContextStoredUsers ||
|-
| 99 || [6.0.0+] DebugActivateOpenContextRetention || No input, returns an [[#ISessionObject]].
|-
| 100 || GetUserRegistrationNotifier || Returns an [[#INotifier]].
|-
| 101 || GetUserStateChangeNotifier || Returns an [[#INotifier]].
|-
| 102 || GetBaasAccountManagerForSystemService || Returns an [[#IManagerForSystemService]].
|-
| 103 || GetBaasUserAvailabilityChangeNotifier || Returns an [[#INotifier]].
|-
| 104 || GetProfileUpdateNotifier || Returns an [[#INotifier]].
|-
| 105 || [4.0.0+] CheckNetworkServiceAvailabilityAsync || Returns an [[#IAsyncContext]].
|-
| 106 || [9.0.0+] GetProfileSyncNotifier ||
|-
| 110 || StoreSaveDataThumbnail ||
|-
| 111 || ClearSaveDataThumbnail ||
|-
| 112 || LoadSaveDataThumbnail ||
|-
| 113 || [5.0.0+] GetSaveDataThumbnailExistence ||
|-
| 120 || [10.0.0+] ListOpenUsersInApplication ||
|-
| 130 || [6.0.0+] ActivateOpenContextRetention || Takes a total of 0x8-bytes of input, returns an [[#ISessionObject]].
|-
| 140 || [6.0.0+] ListQualifiedUsers ||
|-
| 150 || [10.0.0-10.2.0] AuthenticateApplicationAsync ||
|-
| 151 || [12.0.0+] EnsureSignedDeviceIdentifierCacheForNintendoAccountAsync ||
|-
| 152 || [12.0.0+] LoadSignedDeviceIdentifierCacheForNintendoAccount ||
|-
| 170 || [13.0.0+] GetNasOp2MembershipStateChangeNotifier ||
|-
| 190 || [1.0.0-9.2.0] GetUserLastOpenedApplication ||
|-
| 191 || [7.0.0-19.0.1] UpdateNotificationReceiverInfo ([5.0.0-5.1.0] ActivateOpenContextHolder) ||
|-
| 200 || BeginUserRegistration ||
|-
| 201 || CompleteUserRegistration ||
|-
| 202 || CancelUserRegistration ||
|-
| 203 || DeleteUser ||
|-
| 204 || SetUserPosition ||
|-
| 205 || GetProfileEditor || Takes an input userID and returns an [[#IProfileEditor]].
|-
| 206 || CompleteUserRegistrationForcibly ||
|-
| 210 || [3.0.0+] CreateFloatingRegistrationRequest || Returns an [[#IFloatingRegistrationRequest]].
|-
| 211 || [8.0.0+] CreateProcedureToRegisterUserWithNintendoAccount || Takes a total of 0x4-bytes of input and a handle, returns an [[#IOAuthProcedureForUserRegistration]].
|-
| 212 || [8.0.0+] ResumeProcedureToRegisterUserWithNintendoAccount || Takes a total of 0x14-bytes of input and a handle, returns an [[#IOAuthProcedureForUserRegistration]].
|-
| 213 || [17.0.0+] CreateProcedureToCreateUserWithNintendoAccount ||
|-
| 214 || [17.0.0+] ResumeProcedureToCreateUserWithNintendoAccount ||
|-
| 215 || [17.0.0+] ResumeProcedureToCreateUserWithNintendoAccountAfterApplyResponse ||
|-
| 230 || AuthenticateServiceAsync || Returns an [[#IAsyncContext]].
|-
| 250 || GetBaasAccountAdministrator || Returns an [[#IAdministrator]].
|-
| 251 || [20.0.0+] SynchronizeNetworkServiceAccountsSnapshotAsync ||
|-
| 290 || ProxyProcedureForGuestLoginWithNintendoAccount || Returns an [[#IOAuthProcedureForExternalNsa]] (formerly [[#IOAuthProcedureForGuestLogin]] with [1.0.0-2.3.0]).
|-
| 291 || [3.0.0+] ProxyProcedureForFloatingRegistrationWithNintendoAccount || Returns an [[#IOAuthProcedureForExternalNsa]].
|-
| 292 || [20.0.0+] ProxyProcedureForDeviceMigrationAuthenticatingOperatingUser ||
|-
| 293 || [20.0.0+] ProxyProcedureForDeviceMigrationDownload ||
|-
| 299 || SuspendBackgroundDaemon || Returns an [[#ISessionObject]].
|-
| 350 || [20.0.0+] CreateDeviceMigrationUserExportRequest ||
|-
| 351 || [20.0.0+] UploadNasCredential ||
|-
| 352 || [20.0.0+] CreateDeviceMigrationUserImportRequest ||
|-
| 353 || [20.0.0+] DeleteUserMigrationSaveData ||
|-
| 400 || [18.0.0+] SetPinCode ||
|-
| 401 || [18.0.0+] GetPinCodeLength ||
|-
| 402 || [18.0.0-19.0.1] GetPinCode ||
|-
| 403 || [20.0.0+] GetPinCodeParity ||
|-
| 404 || [20.0.0+] VerifyPinCode ||
|-
| 405 || [20.0.0+] IsPinCodeVerificationForbidden ||
|-
| 410 || [18.0.0+] GetPinCodeErrorCount ||
|-
| 411 || [18.0.0-19.0.1] ResetPinCodeErrorCount ||
|-
| 412 || [18.0.0-19.0.1] IncrementPinCodeErrorCount ||
|-
| 413 || [20.0.0+] SetPinCodeErrorCount ||
|-
| 420 || [19.0.0+] SetStartPenaltyTime ||
|-
| 421 || [19.0.0+] GetStartPenaltyTime ||
|-
| 900 || [13.0.0+] SetUserUnqualifiedForDebug ||
|-
| 901 || [13.0.0+] UnsetUserUnqualifiedForDebug ||
|-
| 902 || [13.0.0+] ListUsersUnqualifiedForDebug ||
|-
| 910 || [16.0.0+] RefreshFirmwareSettingsForDebug ||
|-
| 997 || [3.0.0+] DebugInvalidateTokenCacheForUser ||
|-
| 998 || DebugSetUserStateClose ||
|-
| 999 || DebugSetUserStateOpen ||
|}

[10.0.0+] DebugSetUserStateClose/DebugSetUserStateOpen now takes an additional 8-bytes of input.

== IsUserRegistrationRequestPermitted ==
Takes a PID, an input u64 pid_reserved, and returns an output u8 bool.

== TrySelectUserWithoutInteraction ==
Takes an input u8 bool isNetworkServiceAccountRequired, returns an output Uid.

== IManagerForSystemService ==
This is "nn::account::baas::IManagerForSystemService".

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || CheckAvailability ||
|-
| 1 || GetAccountId ||
|-
| 2 || EnsureIdTokenCacheAsync || Returns an [[#IAsyncContext]].
|-
| 3 || [19.0.0+] LoadIdTokenCacheDeprecated ([1.0.0-18.1.0] LoadIdTokenCache) ||
|-
| 4 || [19.0.0+] LoadIdTokenCache ||
|-
| 100 || SetSystemProgramIdentification ||
|-
| 101 || RefreshNotificationTokenAsync ||
|-
| 110 || GetServiceEntryRequirementCacheForLogin ||
|-
| 111 || InvalidateServiceEntryRequirementCache ||
|-
| 113 || GetServiceEntryRequirementCacheForOnlinePlay || Takes a total of 0x8-bytes of input, returns a total of 0x4-bytes of output.
|-
| 120 || GetNintendoAccountId ||
|-
| 121 || CalculateNintendoAccountAuthenticationFingerprint ||
|-
| 130 || GetNintendoAccountUserResourceCache ||
|-
| 131 || RefreshNintendoAccountUserResourceCacheAsync || Returns an [[#IAsyncContext]].
|-
| 132 || RefreshNintendoAccountUserResourceCacheAsyncIfSecondsElapsed || Returns an [[#IAsyncContext]].
|-
| 133 || GetNintendoAccountVerificationUrlCache ||
|-
| 134 || RefreshNintendoAccountVerificationUrlCacheAsync ||
|-
| 135 || RefreshNintendoAccountVerificationUrlCacheAsyncIfSecondsElapsed ||
|-
| 136 || [19.0.0+] GetNintendoAccountUserResourceCache ||
|-
| 140 || GetNetworkServiceLicenseCache ||
|-
| 141 || RefreshNetworkServiceLicenseCacheAsync || Returns an [[#IAsyncContext]].
|-
| 142 || RefreshNetworkServiceLicenseCacheAsyncIfSecondsElapsed || Returns an [[#IAsyncContext]].
|-
| 143 || [15.0.0+] GetNetworkServiceLicenseCacheEx ||
|-
| 150 || CreateAuthorizationRequest || Returns an [[#IAuthorizationRequest]].
|-
| 151 || [22.5.0+] ||
|-
| 152 || [22.5.0+] ||
|-
| 153 || [22.5.0+] ||
|-
| 160 || [15.0.0+] RequiresUpdateNetworkServiceAccountIdTokenCache ||
|-
| 161 || [16.0.0+] RequireReauthenticationOfNetworkServiceAccount ||
|-
| 180 || [18.0.0-19.0.1] GetRequestForNintendoAccountReauthentication ||
|-
| 181 || [20.0.0+] CreateProcedureToReauthenticateNintendoAccount ||
|-
| 182 || [20.0.0+] ResumeProcedureToReauthenticateNintendoAccount ||
|}

== IFloatingRegistrationRequest ==
This is "nn::account::baas::IFloatingRegistrationRequest".

Added with [3.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || GetSessionId ||
|-
| 12 || GetAccountId ||
|-
| 13 || GetLinkedNintendoAccountId ||
|-
| 14 || GetNickname ||
|-
| 15 || GetProfileImage ||
|-
| 16 || [18.0.0+] GetProfileLargeImage ||
|-
| 21 || LoadIdTokenCache ||
|-
| 100 || RegisterUser ([1.0.0-3.0.2] RegisterAsync) || [1.0.0-3.0.2] Used to return an [[#IAsyncContext]].
|-
| 101 || RegisterUserWithUid ([1.0.0-3.0.2] RegisterWithUidAsync) || [1.0.0-3.0.2] Used to return an [[#IAsyncContext]].
|-
| 102 || [4.0.0+] RegisterNetworkServiceAccountAsync || Returns an [[#IAsyncContext]].
|-
| 103 || [4.0.0+] RegisterNetworkServiceAccountWithUidAsync || Returns an [[#IAsyncContext]].
|-
| 110 || SetSystemProgramIdentification ||
|-
| 111 || EnsureIdTokenCacheAsync || Returns an [[#IAsyncContext]].
|}

== IAdministrator ==
This is "nn::account::baas::IAdministrator".

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || CheckAvailability ||
|-
| 1 || GetAccountId ||
|-
| 2 || EnsureIdTokenCacheAsync || Returns an [[#IAsyncContext]].
|-
| 3 || [19.0.0+] LoadIdTokenCacheDeprecated ([1.0.0-18.1.0] LoadIdTokenCache) ||
|-
| 4 || [19.0.0+] LoadIdTokenCache ||
|-
| 100 || SetSystemProgramIdentification ||
|-
| 101 || [7.0.0+] RefreshNotificationTokenAsync
|-
| 110 || [4.0.0+] GetServiceEntryRequirementCache ||
|-
| 111 || [4.0.0+] InvalidateServiceEntryRequirementCache ||
|-
| 112 || [4.0.0-6.2.0] InvalidateTokenCache ||
|-
| 113 || [6.1.0+] GetServiceEntryRequirementCacheForOnlinePlay || Takes a total of 0x8-bytes of input, returns a total of 0x4-bytes of output.
|-
| 120 || GetNintendoAccountId ||
|-
| 121 || [9.0.0+] CalculateNintendoAccountAuthenticationFingerprint ||
|-
| 130 || GetNintendoAccountUserResourceCache ||
|-
| 131 || RefreshNintendoAccountUserResourceCacheAsync || Returns an [[#IAsyncContext]].
|-
| 132 || RefreshNintendoAccountUserResourceCacheAsyncIfSecondsElapsed || Returns an [[#IAsyncContext]].
|-
| 133 || [9.0.0+] GetNintendoAccountVerificationUrlCache ||
|-
| 134 || [9.0.0+] RefreshNintendoAccountVerificationUrlCacheAsync ||
|-
| 135 || [9.0.0+] RefreshNintendoAccountVerificationUrlCacheAsyncIfSecondsElapsed ||
|-
| 136 || [19.0.0+] GetNintendoAccountUserResourceCache ||
|-
| 140 || [5.0.0+] GetNetworkServiceLicenseCache ||
|-
| 141 || [5.0.0+] RefreshNetworkServiceLicenseCacheAsync ||
|-
| 142 || [5.0.0+] RefreshNetworkServiceLicenseCacheAsyncIfSecondsElapsed ||
|-
| 143 || [15.0.0+] GetNetworkServiceLicenseCacheEx ||
|-
| 150 || CreateAuthorizationRequest || Returns an [[#IAuthorizationRequest]].
|-
| 151 || [22.5.0+] ||
|-
| 152 || [22.5.0+] ||
|-
| 153 || [22.5.0+] ||
|-
| 160 || [15.0.0+] RequiresUpdateNetworkServiceAccountIdTokenCache ||
|-
| 161 || [16.0.0+] RequireReauthenticationOfNetworkServiceAccount ||
|-
| 180 || [18.0.0-19.0.1] GetRequestForNintendoAccountReauthentication ||
|-
| 181 || [20.0.0+] CreateProcedureToReauthenticateNintendoAccount ||
|-
| 182 || [20.0.0+] ResumeProcedureToReauthenticateNintendoAccount ||
|-
| 200 || IsRegistered ||
|-
| 201 || RegisterAsync || Returns an [[#IAsyncContext]].
|-
| 202 || UnregisterAsync || Returns an [[#IAsyncContext]].
|-
| 203 || DeleteRegistrationInfoLocally ||
|-
| 204 || [19.0.0-19.0.1] UnregisterDeviceAsync ||
|-
| 220 || SynchronizeProfileAsync || Returns an [[#IAsyncContext]].
|-
| 221 || UploadProfileAsync || Returns an [[#IAsyncContext]].
|-
| 222 || SynchronizeProfileAsyncIfSecondsElapsed || Returns an [[#IAsyncContext]].
|-
| 223 || [19.0.0+] DownloadProfileAsync ||
|-
| 250 || IsLinkedWithNintendoAccount ||
|-
| 251 || CreateProcedureToLinkWithNintendoAccount || Returns an [[#IOAuthProcedureForNintendoAccountLinkage]].
|-
| 252 || ResumeProcedureToLinkWithNintendoAccount || Returns an [[#IOAuthProcedureForNintendoAccountLinkage]].
|-
| 255 || CreateProcedureToUpdateLinkageStateOfNintendoAccount || Returns an [[#IOAuthProcedure]].
|-
| 256 || ResumeProcedureToUpdateLinkageStateOfNintendoAccount || Returns an [[#IOAuthProcedure]].
|-
| 260 || [3.0.0+] CreateProcedureToLinkNnidWithNintendoAccount || Returns an [[#IOAuthProcedure]].
|-
| 261 || [3.0.0+] ResumeProcedureToLinkNnidWithNintendoAccount || Returns an [[#IOAuthProcedure]].
|-
| 280 || ProxyProcedureToAcquireApplicationAuthorizationForNintendoAccount || Returns an [[#IOAuthProcedure]].
|-
| 290 || [8.0.0+] GetRequestForNintendoAccountUserResourceView ||
|-
| 300 || [6.0.0+] TryRecoverNintendoAccountUserStateAsync || Returns an [[#IAsyncContext]].
|-
| 400 || [6.1.0+] IsServiceEntryRequirementCacheRefreshRequiredForOnlinePlay || Takes a total of 0x8-bytes of input, returns an output u8.
|-
| 401 || [6.1.0+] RefreshServiceEntryRequirementCacheForOnlinePlayAsync || Takes a total of 0x8-bytes of input, returns an [[#IAsyncContext]].
|-
| 900 || [9.0.0+] GetAuthenticationInfoForWin ||
|-
| 901 || [9.0.0+] ImportAsyncForWin ||
|-
| 997 || DebugUnlinkNintendoAccountAsync || Returns an [[#IAsyncContext]].
|-
| 998 || DebugSetAvailabilityErrorDetail ||
|}

== IAuthorizationRequest ==
This is "nn::account::nas::IAuthorizationRequest".

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || GetSessionId ||
|-
| 10 || InvokeWithoutInteractionAsync || Returns an [[#IAsyncContext]].
|-
| 19 || IsAuthorized ||
|-
| 20 || GetAuthorizationCode ||
|-
| 21 || GetIdToken ||
|-
| 22 || GetState ||
|}

== IOAuthProcedure ==
This is "nn::account::http::IOAuthProcedure".

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || PrepareAsync || Returns an [[#IAsyncContext]].
|-
| 1 || GetRequest ||
|-
| 2 || ApplyResponse ||
|-
| 3 || ApplyResponseAsync || Returns an [[#IAsyncContext]].
|-
| 10 || Suspend ||
|}

== IOAuthProcedureForExternalNsa ==
This is "nn::account::nas::IOAuthProcedureForExternalNsa".

Added with [3.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || PrepareAsync || Returns an [[#IAsyncContext]].
|-
| 1 || GetRequest ||
|-
| 2 || ApplyResponse ||
|-
| 3 || ApplyResponseAsync || Returns an [[#IAsyncContext]].
|-
| 10 || Suspend ||
|-
| 100 || GetAccountId ||
|-
| 101 || GetLinkedNintendoAccountId ||
|-
| 102 || GetNickname ||
|-
| 103 || GetProfileImage ||
|-
| 104 || [18.0.0+] GetProfileLargeImage ||
|}

== IOAuthProcedureForNintendoAccountLinkage ==
This is "nn::account::nas::IOAuthProcedureForNintendoAccountLinkage".

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || PrepareAsync || Returns an [[#IAsyncContext]].
|-
| 1 || GetRequest ||
|-
| 2 || ApplyResponse ||
|-
| 3 || ApplyResponseAsync || Returns an [[#IAsyncContext]].
|-
| 10 || Suspend ||
|-
| 100 || GetRequestWithTheme ||
|-
| 101 || IsNetworkServiceAccountReplaced ||
|-
| 199 || [2.0.0-5.1.0] GetUrlForIntroductionOfExtraMembership ||
|-
| 200 || [16.0.0+] ApplyAsyncWithAuthorizedToken ||
|}

== INotifier ==
This is "nn::account::detail::INotifier".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetSystemEvent
|}

== IProfile ==
This is "nn::account::profile::IProfile".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Get]]
|-
| 1 || [[#GetBase]]
|-
| 10 || [[#GetImageSize]]
|-
| 11 || [[#LoadImage]]
|-
| 20 || [18.0.0+] GetLargeImageSize
|-
| 21 || [18.0.0+] LoadLargeImage
|-
| 30 || [18.0.0+] GetImageId
|}

=== Get ===
Takes an output type-0x1A buffer for [[#UserData]], returns an output [[#ProfileBase]].

=== GetBase ===
No input, returns an output [[#ProfileBase]].

=== GetImageSize ===
No input, returns an output u32 for the size of the image buffer.

=== LoadImage ===
Takes an output type-0x6 buffer, returns the same output u32 as [[#GetImageSize]].

The output buffer contains the JPEG profile image icon. This is valid for both Miis and character icons.

== IProfileEditor ==
This is "nn::account::profile::IProfileEditor".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Get]]
|-
| 1 || [[#GetBase]]
|-
| 10 || [[#GetImageSize]]
|-
| 11 || [[#LoadImage]]
|-
| 20 || [18.0.0+] GetLargeImageSize
|-
| 21 || [18.0.0+] LoadLargeImage
|-
| 30 || [18.0.0+] GetImageId
|-
| 100 || [[#Store]]
|-
| 101 || [[#StoreWithImage]]
|-
| 110 || [18.0.0+] StoreWithLargeImage
|}

=== Store ===
Takes a [[#ProfileBase]] and an input type-0x19 buffer for [[#UserData]].

=== StoreWithImage ===
Takes a [[#ProfileBase]], an input type-0x19 buffer for [[#UserData]], and an input type-0x5 buffer.

== IAsyncContext ==
This is "nn::account::detail::IAsyncContext".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetSystemEvent
|-
| 1 || Cancel
|-
| 2 || HasDone
|-
| 3 || GetResult
|}

== ISessionObject ==
This is "nn::account::detail::ISessionObject".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 999 || Dummy
|}

= acc:u0 =
This is "nn::account::IAccountServiceForApplication".

[13.0.0+] This was moved from [[Account_services|account]].

This is only available when the output from [[Process_Manager_services|pm:bm]] GetBootMode is Normal/Maintenance.

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || GetUserCount ||
|-
| 1 || GetUserExistence ||
|-
| 2 || ListAllUsers ||
|-
| 3 || ListOpenUsers ||
|-
| 4 || GetLastOpenedUser ||
|-
| 5 || GetProfile || Takes an input userID, returns an [[#IProfile]].
|-
| 6 || [3.0.0+] GetProfileDigest ||
|-
| 50 || [[#IsUserRegistrationRequestPermitted]] ||
|-
| 51 || TrySelectUserWithoutInteractionDeprecated ([1.0.0-18.1.0] [[#TrySelectUserWithoutInteraction]]) ||
|-
| 52 || [19.0.0+] TrySelectUserWithoutInteraction ||
|-
| 60 || [5.0.0-5.1.0] ListOpenContextStoredUsers ||
|-
| 99 || [6.0.0+] DebugActivateOpenContextRetention || No input, returns an [[#ISessionObject]].
|-
| 100 || [[#InitializeApplicationInfoV0]] ||
|-
| 101 || GetBaasAccountManagerForApplication || Takes an input userID, returns an [[#IManagerForApplication]].
|-
| 102 || AuthenticateApplicationAsync || Returns an [[#IAsyncContext]].
|-
| 103 || [4.0.0+] CheckNetworkServiceAvailabilityAsync || Returns an [[#IAsyncContext]].
|-
| 110 || StoreSaveDataThumbnail ||
|-
| 111 || ClearSaveDataThumbnail ||
|-
| 120 || CreateGuestLoginRequest || Returns an [[#IGuestLoginRequest]].
|-
| 130 || [5.0.0+] LoadOpenContext ||
|-
| 131 || [6.0.0+] ListOpenContextStoredUsers ||
|-
| 140 || [6.0.0+] [[#InitializeApplicationInfoV1]] ||
|-
| 141 || [6.0.0+] ListQualifiedUsers ||
|-
| 150 || [6.0.0+] IsUserAccountSwitchLocked ||
|-
| 160 || [13.0.0+] InitializeApplicationInfoV2 ||
|}

InitializeApplicationInfo* is used by the user-process during service init.

== InitializeApplicationInfoV0 ==
Takes a PID and an input u64 pid_placeholder, no output.

== InitializeApplicationInfoV1 ==
Takes a PID and an input u64 pid_placeholder, no output.

== IGuestLoginRequest ==
This is "nn::account::baas::IGuestLoginRequest".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetSessionId
|-
| 11 || [1.0.0-2.3.0]
|-
| 12 || GetAccountId
|-
| 13 || GetLinkedNintendoAccountId
|-
| 14 || GetNickname
|-
| 15 || GetProfileImage
|-
| 16 || [18.0.0+] GetProfileLargeImage
|-
| 21 || [3.0.0+] LoadIdTokenCache
|}

== IManagerForApplication ==
This is "nn::account::baas::IManagerForApplication".

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || CheckAvailability ||
|-
| 1 || GetAccountId ||
|-
| 2 || EnsureIdTokenCacheAsync || Returns an [[#IAsyncContext]].
|-
| 3 || LoadIdTokenCache ||
|-
| 130 || GetNintendoAccountUserResourceCacheForApplication ||
|-
| 150 || CreateAuthorizationRequest || Returns an [[#IAuthorizationRequest]].
|-
| 160 || [5.0.0+] StoreOpenContext ||
|-
| 170 || [13.0.0+] EnsureIdTokenCacheForOnlinePlayAsync ([6.0.0-12.1.0] LoadNetworkServiceLicenseKindAsync) || No input, returns an [[#IAsyncContextForLoginForOnlinePlay]] ([6.0.0-12.1.0] [[#IAsyncNetworkServiceLicenseKindContext]]).
|}

== IAsyncNetworkServiceLicenseKindContext ==
This is "nn::account::detail::IAsyncNetworkServiceLicenseKindContext".

This was added with [6.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || GetSystemEvent ||
|-
| 1 || Cancel ||
|-
| 2 || HasDone ||
|-
| 3 || GetResult ||
|-
| 100 || GetNetworkServiceLicenseKind ||
|}

== IAsyncContextForLoginForOnlinePlay ==
This is "nn::account::baas::IAsyncContextForLoginForOnlinePlay".

This was added with [13.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || GetSystemEvent ||
|-
| 1 || Cancel ||
|-
| 2 || HasDone ||
|-
| 3 || GetResult ||
|-
| 100 || GetNetworkServiceLicenseInfoForOnlinePlay ||
|}

= acc:u1 =
This is "nn::account::IAccountServiceForSystemService".

[13.0.0+] This was moved from [[Account_services|account]].

This is only available when the output from [[Process_Manager_services|pm:bm]] GetBootMode is Normal/Maintenance.

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || GetUserCount ||
|-
| 1 || GetUserExistence ||
|-
| 2 || ListAllUsers ||
|-
| 3 || ListOpenUsers ||
|-
| 4 || GetLastOpenedUser ||
|-
| 5 || GetProfile || Returns an [[#IProfile]].
|-
| 6 || [3.0.0+] GetProfileDigest ||
|-
| 50 || [[#IsUserRegistrationRequestPermitted]] ||
|-
| 51 || TrySelectUserWithoutInteractionDeprecated ([1.0.0-18.1.0] [[#TrySelectUserWithoutInteraction]]) ||
|-
| 52 || [19.0.0+] TrySelectUserWithoutInteraction ||
|-
| 60 || [5.0.0-5.1.0] ListOpenContextStoredUsers ||
|-
| 99 || [6.0.0+] DebugActivateOpenContextRetention || No input, returns an [[#ISessionObject]].
|-
| 100 || GetUserRegistrationNotifier || Returns an [[#INotifier]].
|-
| 101 || GetUserStateChangeNotifier || Returns an [[#INotifier]].
|-
| 102 || GetBaasAccountManagerForSystemService || Returns an [[#IManagerForSystemService]].
|-
| 103 || GetBaasUserAvailabilityChangeNotifier || Returns an [[#INotifier]].
|-
| 104 || GetProfileUpdateNotifier || Returns an [[#INotifier]].
|-
| 105 || [4.0.0+] CheckNetworkServiceAvailabilityAsync || Returns an [[#IAsyncContext]].
|-
| 106 || [9.0.0+] GetProfileSyncNotifier ||
|-
| 110 || StoreSaveDataThumbnail ||
|-
| 111 || ClearSaveDataThumbnail ||
|-
| 112 || LoadSaveDataThumbnail ||
|-
| 113 || [5.0.0+] GetSaveDataThumbnailExistence ||
|-
| 120 || [10.0.0+] ListOpenUsersInApplication ||
|-
| 130 || [6.0.0+] ActivateOpenContextRetention || Takes a total of 0x8-bytes of input, returns an [[#ISessionObject]].
|-
| 140 || [6.0.0+] ListQualifiedUsers ||
|-
| 150 || [10.0.0-10.2.0] AuthenticateApplicationAsync ||
|-
| 151 || [12.0.0+] EnsureSignedDeviceIdentifierCacheForNintendoAccountAsync ||
|-
| 152 || [12.0.0+] LoadSignedDeviceIdentifierCacheForNintendoAccount ||
|-
| 170 || [13.0.0+] GetNasOp2MembershipStateChangeNotifier ||
|-
| 190 || [1.0.0-9.2.0] GetUserLastOpenedApplication ||
|-
| 191 || [7.0.0-19.0.1] UpdateNotificationReceiverInfo ([5.0.0-5.1.0] ActivateOpenContextHolder) ||
|-
| 401 || [18.0.0+] GetPinCodeLength ||
|-
| 402 || [18.0.0-19.0.1] GetPinCode ||
|-
| 403 || [20.0.0+] GetPinCodeParity ||
|-
| 404 || [20.0.0+] VerifyPinCode ||
|-
| 405 || [20.0.0+] IsPinCodeVerificationForbidden ||
|-
| 997 || [3.0.0+] DebugInvalidateTokenCacheForUser ||
|-
| 998 || DebugSetUserStateClose ||
|-
| 999 || DebugSetUserStateOpen ||
|}

[10.0.0+] DebugSetUserStateClose/DebugSetUserStateOpen now takes an additional 8-bytes of input.

== IOAuthProcedureForUserRegistration ==
This is "nn::account::nas::IOAuthProcedureForUserRegistration".

This was added with [8.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || PrepareAsync || No input, returns an [[#IAsyncContext]].
|-
| 1 || GetRequest ||
|-
| 2 || ApplyResponse ||
|-
| 3 || ApplyResponseAsync || Takes a type-0x9 input buffer, returns an [[#IAsyncContext]].
|-
| 10 || Suspend ||
|-
| 100 || GetAccountId ||
|-
| 101 || GetLinkedNintendoAccountId ||
|-
| 102 || GetNickname ||
|-
| 103 || GetProfileImage ||
|-
| 104 || [18.0.0+] GetProfileLargeImage ||
|-
| 110 || RegisterUserAsync || No input, returns an [[#IAsyncContext]].
|-
| 111 || GetUid ||
|-
| 200 || [17.0.0+] ApplyResponseForUserCreationAsync ||
|-
| 205 || [17.0.0+] SuspendAfterApplyResponse ||
|-
| 210 || [17.0.0+] IsProfileAvailable ||
|-
| 220 || [17.0.0+] RegisterUserAsyncWithoutProfile ||
|-
| 221 || [17.0.0+] RegisterUserWithProfileAsync ||
|-
| 230 || [18.0.0+] RegisterUserWithLargeImageProfileAsync ||
|}

= ApplicationRecord =
This is "nn::ns::ApplicationRecord".

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| [[NCM_services#ApplicationId|Id]]
|-
| 0x8
| 0x1
| [[#ApplicationEvent|LastEvent]]
|-
| 0x9
| 0x1
| Attributes
|-
| 0xA
| 0x6
| Reserved
|-
| 0x10
| 0x8
| LastUpdated
|}

= ApplicationEvent =
This is "nn::ns::ApplicationEvent".

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || Launched
|-
| 1 || LocalInstalled
|-
| 2 || DownloadStarted
|-
| 3 || GameCardInserted
|-
| 4 || Touched
|-
| 5 ||
|-
| 6 ||
|-
| 7 ||
|-
| 8 ||
|-
| 9 ||
|-
| 10 ||
|-
| 11 ||
|-
| 12 ||
|-
| 13 ||
|-
| 14 ||
|-
| 15 ||
|-
| 16 ||
|}

= ApplicationControlSource =
This is "nn::ns::ApplicationControlSource".

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| CacheOnly
|-
| 1
| Storage
|-
| 2
| StorageOnly
|}

= ApplicationContentMetaStatus =
This is "nn::ns::ApplicationContentMetaStatus".

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| [[NCM_services#ContentMetaType|Type]]
|-
| 0x1
| 0x1
| [[NCM_services#StorageId|InstalledStorage]]
|-
| 0x2
| 0x1
| [[#ContentMetaRightsCheck|RightsCheck]]
|-
| 0x3
| 0x1
| Reserved
|-
| 0x4
| 0x4
| Version
|-
| 0x8
| 0x8
| [[NCM_services#ApplicationId|Id]]
|}

= ContentMetaRightsCheck =
This is "nn::ns::ContentMetaRightsCheck".

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| NotChecked
|-
| 1
| NotNeeded
|-
| 2
| CommonRights
|-
| 3
| PersonalizedRights
|-
| 4
| NoRights
|}

= VersionListData =
This is "nn::ns::VersionListData".

= ApplicationUpdateInfo =
This is "nn::ns::ApplicationUpdateInfo".

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || UpToDate
|-
| 1 || Updatable
|}

= ApplicationOccupiedSize =
This is "nn::ns::ApplicationOccupiedSize". This is a 0x80-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x20 * 4 || Array of [[#ApplicationOccupiedSizeEntity]]
|}

= ApplicationOccupiedSizeEntity =
This is "nn::ns::ApplicationOccupiedSizeEntity". This is a 0x20-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || [[NCM_services#StorageId|StorageId]]
|-
| 0x1 || 0x7 || Reserved
|-
| 0x8 || 0x8 || AppSize
|-
| 0x10 || 0x8 || PatchSize
|-
| 0x18 || 0x8 || AocSize
|}

= ProgressForDeleteUserSaveDataAll =
This is "nn::ns::detail::ProgressForDeleteUserSaveDataAll". This is a 0x28-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || StartedAt
|-
| 0x8 || 0x4 || Count
|-
| 0xC || 0x4 || Reserved
|-
| 0x10 || 0x8 || SizeInBytes
|-
| 0x18 || 0x1 || IsSystem
|-
| 0x19 || 0x7 || Reserved
|-
| 0x20 || 0x8 || ApplicationId
|}

= ApplicationViewDeprecated =
This is "nn::ns::ApplicationViewDeprecated". This is a 0x40-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || [[NCM_services#ApplicationId|ApplicationId]]
|-
| 0x8 || 0x4 || Version
|-
| 0xC || 0x4 || [[#ApplicationViewFlag|Flag]]
|-
| 0x10 || 0x18 || [[#ApplicationDownloadProgress|Progress]]
|-
| 0x28 || 0x18 || [[#ApplicationApplyDeltaProgress|ApplyProgress]]
|}

This is converted from [[#ApplicationView]] by [[#GetApplicationViewDeprecated]] on newer system-versions as follows:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x20 || Same as [[#ApplicationView]] +0x0.
|-
| 0x20 || 0x4 || Same as [[#ApplicationView]] +0x20.
|-
| 0x24 || 0x2 || Same as [[#ApplicationView]] +0x24.
|-
| 0x26 || 0x2 || Cleared to 0.
|-
| 0x28 || 0x10 || Same as [[#ApplicationView]] +0x30.
|-
| 0x38 || 0x4 || Same as [[#ApplicationView]] +0x40.
|-
| 0x3C || 0x1 || Same as [[#ApplicationView]] +0x44.
|-
| 0x3D || 0x2 || Cleared to 0.
|-
| 0x3F || 0x1 || Cleared to 0.
|}

= ApplicationViewFlag =
This is "nn::ns::ApplicationViewFlag". This is a 32-bit flag.

{| class="wikitable" border="1"
|-
! Bit
! Description
|-
| 0
|
|-
| 1
|
|-
| 2
|
|-
| 3
|
|-
| 4
|
|-
| 5
|
|-
| 6
|
|-
| 7
|
|-
| 8
|
|-
| 9
|
|-
| 10
|
|-
| 11
|
|-
| 12
|
|-
| 13
|
|-
| 14
|
|-
| 15
|
|-
| 16
|
|-
| 17
|
|}

= ApplicationDownloadProgress =
This is "nn::ns::ApplicationDownloadProgress". This is a 0x18-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || Downloaded
|-
| 0x8 || 0x8 || Total
|-
| 0x10 || 0x4 || LastResult
|-
| 0x14 || 0x1 || [[#ApplicationDownloadState|State]]
|-
| 0x15 || 0x3 || Reserved
|}

= ApplicationApplyDeltaProgress =
This is "nn::ns::ApplicationApplyDeltaProgress". This is a 0x18-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || Applied
|-
| 0x8 || 0x8 || Total
|-
| 0x10 || 0x4 || LastResult
|-
| 0x14 || 0x1 || [[#ApplicationApplyDeltaState|State]]
|-
| 0x15 || 0x3 || Reserved
|}

= ApplicationDownloadState =
This is "nn::ns::ApplicationDownloadState". This is an u8.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || Runnable
|-
| 1 || Suspended
|-
| 2 || NotEnoughSpace
|-
| 3 || Fatal
|-
| 4 || Finished
|}

= ApplicationApplyDeltaState =
This is "nn::ns::ApplicationApplyDeltaState". This is an u8.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || Applying
|-
| 1 || Suspended
|-
| 2 || NotEnoughSpace
|-
| 3 || Fatal
|-
| 4 || NoTask
|-
| 5 || WaitApply
|-
| 6 || Applied
|}

= ApplicationView =
This is "nn::ns::ApplicationView". This is a 0x50-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || [[NCM_services#ApplicationId|ApplicationId]]
|-
| 0x8 || 0x4 || ?
|-
| 0xC || 0x4 || Flags
|-
| 0x10 || 0x40 || ?
|}

= ApplicationViewWithPromotionInfo =
This is a 0x70-byte struct.

[20.0.0+] This is a 0x78-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x50 || [[#ApplicationView]]
|-
| 0x50 || 0x20 || [[#PromotionInfo]]
|}

= PromotionInfo =
This is a 0x20-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || PosixTime start_timestamp.
|-
| 0x8 || 0x8 || PosixTime end_timestamp.
|-
| 0x10 || 0x8 || Remaining time until the promotion ends, in nanoseconds ({end_timestamp - current_time} converted to nanoseconds).
|-
| 0x18 || 0x4 || Not set, left at zero.
|-
| 0x1C || 0x1 || Flags. Bit0: whether the PromotionInfo is valid (including bit1). Bit1 clear: u64 +0x10 is set.
|-
| 0x1D || 0x3 || Padding
|}

= ApplicationResourceType =
This is "nn::ns::ApplicationResourceType". This is an u8.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || ApplicationResource
|-
| 1 || MicroApplicationResource
|}

= ApplicationErrorCodeCategory =
This is "nn::ns::ApplicationErrorCodeCategory". This is an u64.

= NoDownloadRightsErrorResolution =
This is "nn::ns::NoDownloadRightsErrorResolution".

= BackgroundNetworkUpdateState =
This is "nn::ns::BackgroundNetworkUpdateState". This is an u8.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || None
|-
| 1 || InProgress
|-
| 2 || Ready
|}

Similar to [[#HasDownloaded]], [[#GetBackgroundNetworkUpdateState]] uses [[NIM_services|nim]] ListSystemUpdateTask and [[NIM_services|nim]] GetSystemUpdateTaskInfo. When ListSystemUpdateTask successfully returns a task and GetSystemUpdateTaskInfo is successful, the output value is set to: <code>1 + *((u8*)(taskinfo+0) == 0x3</code>. Otherwise, value=0.

[[#GetBackgroundNetworkUpdateState]] always returns Result 0, however this will assert if GetSystemUpdateTaskInfo fails with ret!=0x3C89.

= SystemUpdateProgress =
This is "nn::ns::SystemUpdateProgress". This is a 0x10-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || Loaded (this value can be larger than total_size when the async operation is finishing and when total_size is <=0, this current_size field may contain a progress value for when the total_size is not yet determined)
|-
| 0x8 || 0x8 || Total (this field is only valid when >0)
|}

Commands which have this as output will return 0 with the output cleared, when no task is available.

= EulaDataPath =
This is "nn::ns::detail::EulaDataPath". This is a 0x100-byte struct.

This contains a file path.

= SystemDeliveryInfo =
This is "nn::ns::SystemDeliveryInfo". This is a 0x100-byte struct.

Originally the SystemDeliveryInfo validation func verified that OldSystemUpdateId matched the installed SystemUpdate Id. [20.0.0+] The used (Old)SystemUpdateId as selected by SystemUpdateIdFlag must now match one of the Ids in [[System_Settings|system-setting]] <code>contents_delivery!acceptable_system_update_ids_string</code> (replaces the previously mentioned installed-SystemUpdate check).

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || SystemDeliveryProtocolVersion. Must be <= to and match [[System_Settings|system-setting]] <code>contents_delivery!system_delivery_protocol_version</code>.
|-
| 0x4 || 0x4 || ApplicationDeliveryProtocolVersion. Loaded from [[System_Settings|system-setting]] <code>contents_delivery!application_delivery_protocol_version</code>. Unused by [[#RequestSendSystemUpdate]]/[[#RequestReceiveSystemUpdate]], besides HMAC validation.
|-
| 0x8 || 0x1 || HasExFat. Unused by [[#RequestSendSystemUpdate]]/[[#RequestReceiveSystemUpdate]], besides HMAC validation.
|-
| 0x9 || 0x3 || Reserved.
|-
| 0xC || 0x4 || SystemUpdateVersion.
|-
| 0x10 || 0x8 || OldSystemUpdateId. [20.0.0+] Always the NX Id: this is loaded from [[System_Settings|system-setting]] <code>contents_delivery!old_system_update_id</code>.
|-
| 0x18 || 0x1 || FirmwareVariationId. Used by [[#RequestSendSystemUpdate]]. Loaded from [[System_Settings|system-setting]] <code>ns.systemupdate!firmware_variation</code> or <code>ns.systemupdate!t_firmware_variation</code>, depending on the [[Settings_services|PlatformRegion]].
|-
| 0x19 || 0x1 || UpdatableFirmwareGroupId. Unused by [[#RequestSendSystemUpdate]]/[[#RequestReceiveSystemUpdate]], besides HMAC validation. Loaded from [[System_Settings|system-setting]] <code>ns.systemupdate!updatable_firmware_group_id</code> or <code>ns.systemupdate!t_updatable_firmware_group_id</code>, depending on the [[Settings_services|PlatformRegion]].
|-
| 0x1A || 0x1 || PlatformRegion (0x00 = Unknown/Global, 0x01 = China).
|-
| 0x1B || 0x1 || [20.0.0+] SystemDeliveryInfoPlatform. Loaded from [[System_Settings|system-setting]] <code>ns.systemupdate!system_delivery_info_platform</code>. Elsewhere this is compared against the sys-setting, etc.
|-
| 0x1C || 0x1 || [20.0.0+] SystemUpdateIdFlag. When non-zero, SystemUpdateId is used instead of OldSystemUpdateId. Always set to 0x1 by [[#GetSystemDeliveryInfo]] with [20.0.0+].
|-
| 0x1D || 0x3 || Padding
|-
| 0x20 || 0x8 || [20.0.0+] SystemUpdateId. See above. With [20.0.0+] [[#GetSystemDeliveryInfo]] now writes the Id here instead of OldSystemUpdateId (for the installed SystemUpdate). On S2 this is set to the Ounce Id.
|-
| 0x28 || 0xB8 || Reserved
|-
| 0xE0 || 0x20 || HMAC-SHA256 over the previous 0xE0-bytes.
|}

= ApplicationDeliveryInfo =
This is "nn::ns::ApplicationDeliveryInfo". This is a 0x100-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || ApplicationDeliveryProtocolVersion. Loaded from [[System_Settings|system-setting]] <code>contents_delivery!application_delivery_protocol_version</code>. An error is thrown when [[System_Settings|system-setting]] <code>contents_delivery!application_delivery_protocol_version</code> < version, or when [[System_Settings|system-setting]] <code>contents_delivery!acceptable_application_delivery_protocol_version</code> > version.
|-
| 0x4 || 0x4 || Padding
|-
| 0x8 || 0x8 || ApplicationId.
|-
| 0x10 || 0x4 || ApplicationVersion.
|-
| 0x14 || 0x4 || RequiredApplicationVersion.
|-
| 0x18 || 0x4 || RequiredSystemVersion.
|-
| 0x1C || 0x4 || u32 bitmask <code>nn::ns::ApplicationDeliveryAttributeTag</code>. [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]] sets this to the input u32. Bit30 and bit28 are additionally set, depending on [[NCM_services|ContentMetaType]] == Patch, etc.
|-
| 0x20 || 0x1 || [20.0.0+] [[NCM_services|ContentMetaPlatform]]. Loaded from [[NCM_services|ncm]] IContentMetaDatabase GetPlatform.
|-
| 0x21 || 0x1 || [20.0.0+] ProperProgramExists. Set to whether the bit for ProperProgramExists is set from [[NCM_services|ncm]] IContentMetaDatabase GetAttributes.
|-
| 0x22 || 0x1 || [S2]
|-
| 0x23 || 0xBD || Reserved
|-
| 0xE0 || 0x20 || HMAC-SHA256 over the previous 0xE0-bytes. Uses a different key than [[#SystemDeliveryInfo]].
|}

= LatestSystemUpdate =
This is "nn::ns::LatestSystemUpdate". This is an u8.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || UpToDate
|-
| 1 || Downloaded
|-
| 2 || NeedsDownload
|}

= ReceiveApplicationProgress =
This is "nn::ns::ReceiveApplicationProgress". This is a 0x10-byte struct.

= SendApplicationProgress =
This is "nn::ns::SendApplicationProgress". This is a 0x10-byte struct.

= ApplicationRightsOnClient =
This is a 0x20-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || [[NCM_services#ApplicationId|ApplicationId]]
|-
| 0x8 || 0x10 || [[Account_services#Uid|Uid]]
|-
| 0x18 || 0x1 || Flags, [[qlaunch]] only uses bit0-bit4 and bit7.
|-
| 0x19 || 0x1 || Flags, [[qlaunch]] only uses bit0.
|-
| 0x1A || 0x6 || Unknown
|}

[[qlaunch]] only uses +0x18/+0x19 in this struct.

= DownloadTaskStatus =
This is "nn::ns::DownloadTaskStatus". This is a 0x20-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x10 || Uuid
|-
| 0x10 || 0x8 || [[NCM_services#ApplicationId|ApplicationId]]
|-
| 0x18 || 0x1 || [[#DownloadTaskStatusDetail|Detail]]
|-
| 0x19 || 0x1 || NeedsCleanup
|-
| 0x1A || 0x2 || Reserved
|-
| 0x1C || 0x4 || Result
|}

= DownloadTaskStatusDetail =
This is "nn::ns::DownloadTaskStatusDetail". This is an u8.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || Created
|-
| 1 || Added
|-
| 2 || AlreadyExists
|-
| 3 || Failed
|}

= ApplicationLaunchInfo =
This is a 0x40-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || [[NCM_services#ApplicationId|ApplicationId]]
|-
| 0x8 || 0x4 || Application version
|-
| 0xC || 0x4 || [[Process_Manager_services#LaunchFlags|LaunchFlags]], set to hard-coded value 0xB by [[#GetApplicationLaunchInfo]].
|-
| 0x10 || 0x1 || Application [[NCM_services#StorageId|StorageId]]
|-
| 0x11 || 0x1 || Update [[NCM_services#StorageId|StorageId]]
|-
| 0x12 || 0x2E ||
|}

= UserData =
This is a 0x80-byte struct.

{| class="wikitable" border="1"
|-
! Offset || Size || Description
|-
| 0x0 || 0x4? || ?
|-
| 0x4 || 0x4? || Icon ID. 0 = Mii, the rest are character icon IDs.
|-
| 0x8 || 0x1? || Profile icon background color ID
|-
| 0x9 || 0x7 || ?
|-
| 0x10 || 0x10 || Some ID related to the Mii? All zeros when a character icon is used.
|-
| 0x20 || 0x60 || Usually zeros?
|}

= ProfileBase =
This is a 0x38-byte struct.

{| class="wikitable" border="1"
|-
! Offset || Size || Description
|-
| 0x0 || 0x10 || userID
|-
| 0x10 || 0x8 || POSIX UTC timestamp, for last account edit.
|-
| 0x18 || 0x20 || UTF-8 Nickname. Official sw uses strncpy to copy this into another struct (<code>nn::account::Nickname</code>), with a NUL-byte written after the copied data.
|}

= Uid =
This is "nn::account::Uid". This is a 0x10-byte struct. This contains 2 u64s for the UserId.

= Notes =
[[Process_Manager_services|pm:bm]] GetBootMode is used to determine whether aoc:u is available (see above). This value is also passed to thread "nn.ns.DelayedInitialization", which calls various funcs depending on the BootMode in various cases.

The "nn.ns.DelayedInitialization" thread uses BootMode as follows (this also handles various other initialization):
* Initializes [[NPNS_services|npns:s]] only for BootMode Normal/Maintenance.
* Initializes the hosted acc:* services and service [[Account_services|acc:su]] only for BootMode Normal/Maintenance.
* Calls a func only for BootMode Normal.
* Initializes [[ETicket_services|es]] and [[Shared_Database_services|avm]] only for BootMode Normal/Maintenance.

The output of GetBootMode is also written into state. This same func later enters a code block when BootMode is Maintenance/SafeMode: various [[NCM_services|ncm]] cmds are used with input StorageId=BuiltInUser (VerifyContentMetaDatabase, VerifyContentStorage, ActivateContentMetaDatabase, ActivateContentStorage, InactivateContentMetaDatabase, InactivateContentStorage) and state fields are written. Then if the BootMode is Maintenance the savedata for [[Flash_Filesystem|ns_rightsid]] (0x800000000000004A) is deleted. Then 0 is returned. Otherwise for BootMode Normal it continues with various initialization, including gamecard handling which handles launching the gamecard title in certain conditions (this is the only time ns launches anything with pgl outside of service cmds).

In the above block, InactivateContentMetaDatabase/InactivateContentStorage are only used if using ActivateContentMetaDatabase/ActivateContentStorage failed (error is only checked after using both cmds). If any of the ncm cmds prior to this fail, it will skip using the rest of the ncm cmds.

[[Category:Services]]

NS services

2026-08-09T16:19:04Z

Yellows8:

= aoc:u =
This is "nn::aocsrv::detail::IAddOnContentManager".

This is only available when [[Process_Manager_services|pm:bm]] GetBootMode returns output 0 (Normal).

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [1.0.0-6.2.0] CountAddOnContentByApplicationId
|-
| 1 || [1.0.0-6.2.0] ListAddOnContentByApplicationId
|-
| 2 || CountAddOnContent
|-
| 3 || ListAddOnContent
|-
| 4 || [1.0.0-6.2.0] GetAddOnContentBaseIdByApplicationId
|-
| 5 || GetAddOnContentBaseId
|-
| 6 || [1.0.0-6.2.0] PrepareAddOnContentByApplicationId
|-
| 7 || PrepareAddOnContent
|-
| 8 || [4.0.0+] GetAddOnContentListChangedEvent
|-
| 9 || [10.0.0+] GetAddOnContentLostErrorCode
|-
| 10 || [11.0.0+] GetAddOnContentListChangedEventWithProcessId
|-
| 11 || [13.0.0+] NotifyMountAddOnContent
|-
| 12 || [13.0.0+] NotifyUnmountAddOnContent
|-
| 13 || [13.0.0+] IsAddOnContentMountedForDebug
|-
| 50 || [13.0.0+] CheckAddOnContentMountStatus
|-
| 100 || [7.0.0+] [[#IPurchaseEventManager|CreateEcPurchasedEventManager]]
|-
| 101 || [9.0.0+] [[#IPurchaseEventManager|CreatePermanentEcPurchasedEventManager]]
|-
| 110 || [12.0.0+] [[#IContentsServiceManager|CreateContentsServiceManager]]
|-
| 200 || [13.1.0+] SetRequiredAddOnContentsOnContentsAvailabilityTransition
|-
| 300 || [16.0.0+] SetupHostAddOnContent
|-
| 301 || [16.0.0+] GetRegisteredAddOnContentPath
|-
| 302 || [16.0.0+] UpdateCachedList
|}

== IPurchaseEventManager ==
This is "nn::ec::IPurchaseEventManager".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || SetDefaultDeliveryTarget
|-
| 1 || SetDeliveryTarget
|-
| 2 || GetPurchasedEventReadableHandle
|-
| 3 || PopPurchasedProductInfo
|-
| 4 || [9.0.0+] PopPurchasedProductInfoWithUid
|}

== IContentsServiceManager ==
This is "nn::ec::IContentsServiceManager".

This was added with [12.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [16.0.0+] RequestContentsAuthorizationTokenDeprecated ([12.0.0-15.0.1] [[#RequestContentsAuthorizationToken]])
|-
| 1 || [16.0.0+] RequestContentsAuthorizationToken
|}

=== RequestContentsAuthorizationToken ===
Takes a total of 0x50-bytes of input, a PID, a type-0x5 input buffer. Returns an [[#IAsyncData|IAsyncData]] and an output handle.

== IAsyncData ==
This is "nn::ec::detail::IAsyncData".

This was added with [12.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetSize
|-
| 1 || Get
|-
| 2 || Cancel
|}

= ns:am =
This is "nn::ns::detail::IApplicationManagerInterface".

[3.0.0+] This service was replaced by [[#ns:am2, ns:ec, ns:rid, ns:rt, ns:web, ns:ro, ns:sweb|ns:am2]].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#ListApplicationRecord]]
|-
| 1 || GenerateApplicationRecordCount
|-
| 2 || GetApplicationRecordUpdateSystemEvent
|-
| 3 || GetApplicationView
|-
| 4 || DeleteApplicationEntity
|-
| 5 || DeleteApplicationCompletely
|-
| 6 || IsAnyApplicationEntityRedundant
|-
| 7 || DeleteRedundantApplicationEntity
|-
| 8 || IsApplicationEntityMovable
|-
| 9 || MoveApplicationEntity
|-
| 11 || [[#CalculateApplicationOccupiedSize]]
|-
| 16 || PushApplicationRecord
|-
| 17 || ListApplicationRecordContentMeta
|-
| 18 || CheckLaunchRights
|-
| 19 || [[#LaunchApplication]]
|-
| 21 || [[#GetApplicationContentPath]]
|-
| 22 || TerminateApplication
|-
| 23 || [2.0.0+] ResolveApplicationContentPath
|-
| 26 || BeginInstallApplication
|-
| 27 || DeleteApplicationRecord
|-
| 30 || RequestApplicationUpdateInfo
|-
| 31 || RequestUpdateApplication
|-
| 32 || CancelApplicationDownload
|-
| 33 || ResumeApplicationDownload
|-
| 34 || ClearTaskStatusList
|-
| 35 || UpdateVersionList
|-
| 36 || PushLaunchVersion
|-
| 37 || ListRequiredVersion
|-
| 38 || CheckApplicationLaunchVersion
|-
| 39 || CheckApplicationLaunchRights
|-
| 40 || GetApplicationLogoData
|-
| 41 || CalculateApplicationDownloadRequiredSize
|-
| 42 || CleanupSdCard
|-
| 43 || [[#CheckSdCardMountStatus]]
|-
| 44 || GetSdCardMountStatusChangedEvent
|-
| 45 || GetGameCardAttachmentEvent
|-
| 46 || GetGameCardAttachmentInfo
|-
| 47 || [[#GetTotalSpaceSize]]
|-
| 48 || [[#GetFreeSpaceSize]]
|-
| 49 || GetSdCardRemovedEvent
|-
| 52 || GetGameCardUpdateDetectionEvent
|-
| 53 || DisableApplicationAutoDelete
|-
| 54 || EnableApplicationAutoDelete
|-
| 55 || [[#GetApplicationDesiredLanguage]]
|-
| 56 || SetApplicationTerminateResult
|-
| 57 || ClearApplicationTerminateResult
|-
| 58 || GetLastSdCardMountUnexpectedResult
|-
| 59 || ConvertApplicationLanguageToLanguageCode
|-
| 60 || [[#ConvertLanguageCodeToApplicationLanguage]]
|-
| 61 || GetBackgroundDownloadStressTaskInfo
|-
| 62 || GetGameCardStopper
|-
| 63 || IsSystemProgramInstalled
|-
| 64 || [2.0.0+] StartApplyDeltaTask
|-
| 65 || [2.0.0+] GetRequestServerStopper
|-
| 100 || ResetToFactorySettings
|-
| 101 || ResetToFactorySettingsWithoutUserSaveData
|-
| 102 || [2.0.0+] ResetToFactorySettingsForRefurbishment
|-
| 200 || CalculateUserSaveDataStatistics
|-
| 201 || DeleteUserSaveDataAll
|-
| 210 || DeleteUserSystemSaveData
|-
| 220 || UnregisterNetworkServiceAccount
|-
| 300 || GetApplicationShellEvent
|-
| 301 || PopApplicationShellEventInfo
|-
| 302 || LaunchLibraryApplet
|-
| 303 || TerminateLibraryApplet
|-
| 304 || LaunchSystemApplet
|-
| 305 || TerminateSystemApplet
|-
| 306 || LaunchOverlayApplet
|-
| 307 || TerminateOverlayApplet
|-
| 400 || [[#GetApplicationControlData]]
|-
| 401 || InvalidateAllApplicationControlCache
|-
| 402 || RequestDownloadApplicationControlData
|-
| 403 || GetMaxApplicationControlCacheCount
|-
| 404 || [2.0.0+] InvalidateApplicationControlCache
|-
| 405 || [2.0.0+] ListApplicationControlCacheEntryInfo
|-
| 502 || [2.0.0+] RequestCheckGameCardRegistration
|-
| 503 || [2.0.0+] RequestGameCardRegistrationGoldPoint
|-
| 504 || [2.0.0+] RequestRegisterGameCard
|-
| 600 || [2.0.0+] [[#CountApplicationContentMeta]]
|-
| 601 || [2.0.0+] [[#ListApplicationContentMetaStatus]]
|-
| 602 || [2.0.0+] ListOwnedAndInstalledAddOnContent
|-
| 603 || [2.0.0+] GetOwnedApplicationContentMetaStatus
|-
| 604 || [2.0.0+] RegisterContentsExternalKey
|-
| 605 || [2.0.0+] ListApplicationContentMetaStatusWithRightsCheck
|-
| 700 || [2.0.0+] PushDownloadTaskList
|-
| 701 || [2.0.0+] [[#ClearTaskStatusList]]
|-
| 702 || [2.0.0+] [[#RequestDownloadTaskList]]
|-
| 703 || [2.0.0+] [[#RequestEnsureDownloadTask]]
|-
| 704 || [2.0.0+] [[#ListDownloadTaskStatus]]
|-
| 705 || [2.0.0+] RequestDownloadTaskListData
|-
| 800 || [2.0.0+] RequestVersionList
|-
| 801 || [2.0.0+] ListVersionList
|-
| 900 || [2.0.0+] GetApplicationRecord
|-
| 901 || [2.0.0+] GetApplicationRecordProperty
|-
| 902 || [2.0.0+] EnableApplicationAutoUpdate
|-
| 903 || [2.0.0+] DisableApplicationAutoUpdate
|-
| 904 || [2.0.0+] TouchApplication
|-
| 905 || [2.0.0+] RequestApplicationUpdate
|-
| 906 || [2.0.0+] IsApplicationUpdateRequested
|-
| 907 || [2.0.0+] WithdrawApplicationUpdateRequest
|-
| 908 || [2.0.0+] ListApplicationRecordInstalledContentMeta
|-
| 1000 || [2.0.0+] RequestVerifyApplication
|-
| 1001 || [2.0.0+] CorruptApplicationForDebug
|-
| 1200 || [2.0.0+] [[#NeedsUpdateVulnerability]]
|-
| 1300 || [2.0.0+] IsAnyApplicationEntityInstalled
|-
| 1301 || [2.0.0+] DeleteApplicationContentEntities
|-
| 1302 || [2.0.0+] CleanupUnrecordedApplicationEntity
|-
| 1400 || [2.0.0+] PrepareShutdown
|-
| 1500 || [2.0.0+] FormatSdCard
|-
| 1501 || [2.0.0+] NeedsSystemUpdateToFormatSdCard
|-
| 1502 || [2.0.0+] GetLastSdCardFormatUnexpectedResult
|-
| 1503 || [2.0.0+] DetachSdCard
|-
| 1600 || [2.0.0+] GetSystemSeedForPseudoDeviceId
|-
| 1700 || [2.0.0+] ListApplicationDownloadingContentMeta
|-
| 1800 || [2.0.0+] IsNotificationSetupCompleted
|-
| 1801 || [2.0.0+] GetLastNotificationInfoCount
|-
| 1802 || [2.0.0+] ListLastNotificationInfo
|}

== ListApplicationRecord ==
Takes a type-0x6 output buffer containing an array of [[#ApplicationRecord]] and an s32 entry_offset, returns an output s32 out_entrycount.

Returns an array of entries with the below format using the specified offset and count.

== LaunchApplication ==
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output u64 PID.

Launches an application title which is registered with NS.

== GetApplicationContentPath ==
Takes a 0x16-type output buffer, an u8 [[NCM_services#ContentType|ContentType]], and an [[NCM_services#ApplicationId|ApplicationId]].

The input [[NCM_services#ApplicationId|ApplicationId]] is used with the application-title table like various other cmds, anything not in that table can't be used with this.

Returns a string path for the specified type of patch content with this [[NCM_services#ApplicationId|ApplicationId]], otherwise returns regular-application paths when update-title not installed. Returns an error when the specified type of content doesn't exist for this title. Starts with "@{SdCardContent,UserContent}://" and ends in ".nca".

For gamecard content, the output path is: "@GcSXXXXXXXX:/<NcaId>.nca". NCA-type0 with gamecard returns 0 with an empty output string.

The output string is then used by the user-process with [[Filesystem_services|FS]] to mount the content.

== GetTotalSpaceSize ==
Takes an input u8 [[NCM_services#StorageId|StorageId]], no output.

The StorageId must be SdCard.

Returns the s64 from [[NCM_services#IContentStorage]] GetFreeSpaceSize.

== GetFreeSpaceSize ==
Takes an input u8 [[NCM_services#StorageId|StorageId]], no output.

The StorageId must be SdCard.

Returns the s64 from [[NCM_services#IContentStorage]] GetTotalSpaceSize.

== GetApplicationDesiredLanguage ==
Takes an input u8 language-bitmask, returns an output u8 [[control.nacp]] langentry index.

User-processes generate the language-bitmask with the following for all 16 lang-entries: <code>if(<either string in langentry[i] is non-empty>)bitmask |= 1<<i</code>

== ConvertLanguageCodeToApplicationLanguage ==
Takes an input u8 pointer for the resulting Id to be written to and a string represented as a u64 (i.e 0x53552D6E65 for 'en-US').

Returns 0 if an ID was successfully found, otherwise returns 0x25810.

== GetApplicationControlData ==
Takes an input u8 [[#ApplicationControlSource]], an [[NCM_services#ApplicationId|ApplicationId]], and a type-0x6 output buffer. Returns an output u32 for actual_size. Official user-processes use buffer size 0x24000. [[qlaunch]] only uses source value 0x1 (Storage if not in cache).

Loads cached [[control.nacp]] to buf+0 and the cached icon to buf+0x4000. Returns an error if the buffer is too small.

== ListApplicationContentMetaStatus ==
Takes a type-0x6 output buffer containing an array of [[#ApplicationContentMetaStatus]], an input s32 index and [[NCM_services#ApplicationId|ApplicationId]], returns an output s32 out_entrycount.

Returns 0x10-byte entries using the specified [[NCM_services#ApplicationId|ApplicationId]] starting at the specified index. Can only return game titles. The second entry if any is the update-title usually. When the input entryindex is >= totalentries, this will return 0 with out_entrycount=0.

= ns:am2, ns:ec, ns:rid, ns:rt, ns:web, ns:ro, ns:sweb =
These are "nn::ns::detail::IServiceGetterInterface".

These commands check a state field for a command-specific bit and returns an error if not set, this is a permissions check for service+command.

[11.0.0+] ns:ro was added.

[15.0.0+] ns:sweb was added.

{| class="wikitable" border="1"
|-
! Cmd || Name || Permission bit
|-
| 7988 || [6.0.0+] [[#IDynamicRightsInterface|GetDynamicRightsInterface]] || 10
|-
| 7989 || [5.1.0+] [[#IReadOnlyApplicationControlDataInterface|GetReadOnlyApplicationControlDataInterface]] || 9
|-
| 7991 || [5.0.0+] [[#IReadOnlyApplicationRecordInterface|GetReadOnlyApplicationRecordInterface]] || 8
|-
| 7992 || [4.0.0+] [[#IECommerceInterface|GetECommerceInterface]] || 7
|-
| 7993 || [4.0.0+] [[#IApplicationVersionInterface|GetApplicationVersionInterface]] || 6
|-
| 7994 || [[#IFactoryResetInterface|GetFactoryResetInterface]] || 5
|-
| 7995 || [[#IAccountProxyInterface|GetAccountProxyInterface]] || 4
|-
| 7996 || [[#IApplicationManagerInterface|GetApplicationManagerInterface]] || 3
|-
| 7997 || [[#IDownloadTaskInterface|GetDownloadTaskInterface]] || 1
|-
| 7998 || [[#IContentManagementInterface|GetContentManagementInterface]] || 0
|-
| 7999 || [[#IDocumentInterface|GetDocumentInterface]] || 2
|}

Permissions state field with each service:

{| class="wikitable" border="1"
|-
! Service || Permissions
|-
| ns:web || 0x304
|-
| ns:ec || 0x83
|-
| ns:sweb || 0x387
|-
| ns:rid || 0x10
|-
| ns:rt || 0x20
|-
| ns:ro || 0x301
|-
| ns:am2 || 0x7FF
|}

=== IAccountProxyInterface ===
This is "nn::ns::detail::IAccountProxyInterface".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || CreateUserAccount
|}

=== IApplicationManagerInterface ===
This is "nn::ns::detail::IApplicationManagerInterface".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#ListApplicationRecord]]
|-
| 1 || GenerateApplicationRecordCount
|-
| 2 || [[#GetApplicationRecordUpdateSystemEvent]]
|-
| 3 || [[#GetApplicationViewDeprecated]]
|-
| 4 || [[#DeleteApplicationEntity]]
|-
| 5 || [[#DeleteApplicationCompletely]]
|-
| 6 || IsAnyApplicationEntityRedundant
|-
| 7 || [[#DeleteRedundantApplicationEntity]]
|-
| 8 || [[#IsApplicationEntityMovable]]
|-
| 9 || [1.0.0-9.2.0] [[#MoveApplicationEntity]]
|-
| 11 || [[#CalculateApplicationOccupiedSize]]
|-
| 16 || PushApplicationRecord
|-
| 17 || ListApplicationRecordContentMeta
|-
| 19 || [1.0.0-5.1.0] LaunchApplicationOld
|-
| 21 || [[#GetApplicationContentPath]]
|-
| 22 || TerminateApplication
|-
| 23 || ResolveApplicationContentPath
|-
| 26 || BeginInstallApplication
|-
| 27 || DeleteApplicationRecord
|-
| 30 || [[#RequestApplicationUpdateInfo]]
|-
| 31 || [1.0.0-3.0.2] RequestUpdateApplication
|-
| 32 || [[#CancelApplicationDownload]]
|-
| 33 || [[#ResumeApplicationDownload]]
|-
| 35 || UpdateVersionList
|-
| 36 || PushLaunchVersion
|-
| 37 || ListRequiredVersion
|-
| 38 || [[#CheckApplicationLaunchVersion]]
|-
| 39 || [1.0.0-6.2.0] CheckApplicationLaunchRights
|-
| 40 || GetApplicationLogoData
|-
| 41 || CalculateApplicationDownloadRequiredSize
|-
| 42 || [[#CleanupSdCard]]
|-
| 43 || [[#CheckSdCardMountStatus]]
|-
| 44 || [[#GetSdCardMountStatusChangedEvent]]
|-
| 45 || GetGameCardAttachmentEvent
|-
| 46 || GetGameCardAttachmentInfo
|-
| 47 || [[#GetTotalSpaceSize]]
|-
| 48 || [[#GetFreeSpaceSize]]
|-
| 49 || GetSdCardRemovedEvent
|-
| 52 || [[#GetGameCardUpdateDetectionEvent]]
|-
| 53 || [[#DisableApplicationAutoDelete]]
|-
| 54 || [[#EnableApplicationAutoDelete]]
|-
| 55 || GetApplicationDesiredLanguage
|-
| 56 || [[#SetApplicationTerminateResult]]
|-
| 57 || [[#ClearApplicationTerminateResult]]
|-
| 58 || [[#GetLastSdCardMountUnexpectedResult]]
|-
| 59 || ConvertApplicationLanguageToLanguageCode
|-
| 60 || [[#ConvertLanguageCodeToApplicationLanguage]]
|-
| 61 || GetBackgroundDownloadStressTaskInfo
|-
| 62 || GetGameCardStopper
|-
| 63 || IsSystemProgramInstalled
|-
| 64 || StartApplyDeltaTask
|-
| 65 || [[#GetRequestServerStopper]]
|-
| 66 || [3.0.0+] GetBackgroundApplyDeltaStressTaskInfo
|-
| 67 || [3.0.0+] [[#CancelApplicationApplyDelta]]
|-
| 68 || [3.0.0+] [[#ResumeApplicationApplyDelta]]
|-
| 69 || [3.0.0+] [[#CalculateApplicationApplyDeltaRequiredSize]]
|-
| 70 || [3.0.0+] [[#ResumeAll]]
|-
| 71 || [3.0.0+] [[#GetStorageSize]]
|-
| 80 || [3.0.0+] RequestDownloadApplication
|-
| 81 || [3.0.0+] RequestDownloadAddOnContent
|-
| 82 || [3.0.0+] DownloadApplication
|-
| 83 || [4.0.0-6.2.0] CheckApplicationResumeRights
|-
| 84 || [4.0.0-16.1.0] GetDynamicCommitEvent
|-
| 85 || [4.0.0+] [[#RequestUpdateApplication2]]
|-
| 86 || [4.0.0+] EnableApplicationCrashReport
|-
| 87 || [4.0.0+] IsApplicationCrashReportEnabled
|-
| 90 || [15.0.0+] BoostSystemMemoryResourceLimit ([4.0.0-8.1.0] BoostSystemMemoryResourceLimit)
|-
| 91 || [5.0.0+] DeprecatedLaunchApplication
|-
| 92 || [5.0.0+] GetRunningApplicationProgramId
|-
| 93 || [5.0.0+] GetMainApplicationProgramIndex
|-
| 94 || [6.0.0+] [[#LaunchApplication_2|LaunchApplication]]
|-
| 95 || [6.0.0+] [[#GetApplicationLaunchInfo]]
|-
| 96 || [6.0.0+] [[#AcquireApplicationLaunchInfo]]
|-
| 97 || [6.0.0+] [[#GetMainApplicationProgramIndexByApplicationLaunchInfo]]
|-
| 98 || [6.0.0+] EnableApplicationAllThreadDumpOnCrash
|-
| 99 || [8.0.0+] [[#LaunchDevMenu]]
|-
| 100 || [[#ResetToFactorySettings]]
|-
| 101 || [[#ResetToFactorySettingsWithoutUserSaveData]]
|-
| 102 || [[#ResetToFactorySettingsForRefurbishment]]
|-
| 103 || [9.1.0+] [[#ResetToFactorySettingsWithPlatformRegion]]
|-
| 104 || [9.1.0+] [[#ResetToFactorySettingsWithPlatformRegionAuthentication]]
|-
| 105 || [10.0.0+] [[#RequestResetToFactorySettingsSecurely]]
|-
| 106 || [10.0.0+] [[#RequestResetToFactorySettingsWithPlatformRegionAuthenticationSecurely]]
|-
| 200 || CalculateUserSaveDataStatistics
|-
| 201 || [[#DeleteUserSaveDataAll]]
|-
| 210 || [[#DeleteUserSystemSaveData]]
|-
| 211 || [6.0.0+] [[#DeleteSaveData]]
|-
| 220 || [[#UnregisterNetworkServiceAccount]]
|-
| 221 || [6.0.0+] [[#UnregisterNetworkServiceAccountWithUserSaveDataDeletion]]
|-
| 300 || GetApplicationShellEvent
|-
| 301 || PopApplicationShellEventInfo
|-
| 302 || [[#LaunchLibraryApplet]]
|-
| 303 || TerminateLibraryApplet
|-
| 304 || [[#LaunchSystemApplet]]
|-
| 305 || TerminateSystemApplet
|-
| 306 || [[#LaunchOverlayApplet]]
|-
| 307 || TerminateOverlayApplet
|-
| 308 || [S2]
|-
| 309 || [S2]
|-
| 400 || [[#GetApplicationControlData]]
|-
| 401 || InvalidateAllApplicationControlCache
|-
| 402 || [[#RequestDownloadApplicationControlData]]
|-
| 403 || GetMaxApplicationControlCacheCount
|-
| 404 || InvalidateApplicationControlCache
|-
| 405 || ListApplicationControlCacheEntryInfo
|-
| 406 || [6.0.0-18.1.0] [[#GetApplicationControlProperty]]
|-
| 407 || [8.0.0+] [[#ListApplicationTitle]]
|-
| 408 || [8.0.0+] [[#ListApplicationIcon]]
|-
| 409 || [S2]
|-
| 410 || [S2]
|-
| 411 || [19.0.0+]
|-
| 412 || [19.0.0+]
|-
| 413 || [19.0.0+]
|-
| 414 || [19.0.0+]
|-
| 415 || [19.0.0+]
|-
| 416 || [19.0.0+]
|-
| 417 || [19.0.0+] InvalidateAllApplicationControlCacheOfTheStage
|-
| 418 || [19.0.0+] InvalidateApplicationControlCacheOfTheStage
|-
| 419 || [19.0.0+] RequestDownloadApplicationControlDataInBackground
|-
| 420 || [19.0.0+] CloneApplicationControlDataCacheForDebug
|-
| 421 || [20.0.0+]
|-
| 422 || [20.0.0+]
|-
| 423 || [20.0.0+]
|-
| 424 || [20.0.0+]
|-
| 425 || [20.0.0+]
|-
| 426 || [20.0.0+]
|-
| 427 || [20.0.0+]
|-
| 428 || [21.0.0+]
|-
| 429 || [21.0.0+]
|-
| 430 || [21.0.0+]
|-
| 502 || [[#RequestCheckGameCardRegistration]]
|-
| 503 || [[#RequestGameCardRegistrationGoldPoint]]
|-
| 504 || [[#RequestRegisterGameCard]]
|-
| 505 || [3.0.0+] [[#GetGameCardMountFailureEvent]]
|-
| 506 || [3.0.0+] [[#IsGameCardInserted]]
|-
| 507 || [3.0.0+] [[#EnsureGameCardAccess]]
|-
| 508 || [3.0.0+] [[#GetLastGameCardMountFailureResult]]
|-
| 509 || [5.0.0+] [[#ListApplicationIdOnGameCard]]
|-
| 510 || [9.0.0+] [[#GetGameCardPlatformRegion]]
|-
| 511 || [19.0.0+] GetGameCardWakenReadyEvent
|-
| 512 || [19.0.0+] IsGameCardApplicationRunning
|-
| 513 || [20.0.0+]
|-
| 514 || [20.0.0+]
|-
| 515 || [20.0.0+]
|-
| 516 || [21.0.0+]
|-
| 517 || [21.0.0+]
|-
| 518 || [21.0.0+]
|-
| 519 || [21.0.0+]
|-
| 600 || [[#CountApplicationContentMeta]]
|-
| 601 || [[#ListApplicationContentMetaStatus]]
|-
| 602 || [2.0.0-5.1.0] ListAvailableAddOnContent
|-
| 603 || GetOwnedApplicationContentMetaStatus
|-
| 604 || [1.0.0-15.0.1] RegisterContentsExternalKey
|-
| 605 || ListApplicationContentMetaStatusWithRightsCheck
|-
| 606 || [3.0.0+] GetContentMetaStorage
|-
| 607 || [6.0.0+] [[#ListAvailableAddOnContent]]
|-
| 609 || [13.0.0+] ListAvailabilityAssuredAddOnContent
|-
| 610 || [14.0.0+] GetInstalledContentMetaStorage
|-
| 611 || [16.0.0+] PrepareAddOnContent
|-
| 700 || PushDownloadTaskList
|-
| 701 || [[#ClearTaskStatusList]]
|-
| 702 || [[#RequestDownloadTaskList]]
|-
| 703 || [[#RequestEnsureDownloadTask]]
|-
| 704 || [[#ListDownloadTaskStatus]]
|-
| 705 || [[#RequestDownloadTaskListData]]
|-
| 800 || RequestVersionList
|-
| 801 || ListVersionList
|-
| 802 || [3.0.0+] [[#RequestVersionListData]]
|-
| 900 || GetApplicationRecord
|-
| 901 || GetApplicationRecordProperty
|-
| 902 || EnableApplicationAutoUpdate
|-
| 903 || DisableApplicationAutoUpdate
|-
| 904 || [[#TouchApplication]]
|-
| 905 || RequestApplicationUpdate
|-
| 906 || [[#IsApplicationUpdateRequested]]
|-
| 907 || [[#WithdrawApplicationUpdateRequest]]
|-
| 908 || ListApplicationRecordInstalledContentMeta
|-
| 909 || [3.0.0-14.1.2] WithdrawCleanupAddOnContentsWithNoRightsRecommendation
|-
| 910 || [5.0.0+] HasApplicationRecord
|-
| 911 || [5.1.0+] SetPreInstalledApplication
|-
| 912 || [5.1.0+] ClearPreInstalledApplicationFlag
|-
| 913 || [9.0.0+] ListAllApplicationRecord
|-
| 914 || [9.0.0+] HideApplicationRecord
|-
| 915 || [9.0.0+] ShowApplicationRecord
|-
| 916 || [11.0.0+] IsApplicationAutoDeleteDisabled
|-
| 917 || [20.0.0+]
|-
| 918 || [20.0.0+]
|-
| 919 || [20.0.0+]
|-
| 920 || [20.0.0+]
|-
| 921 || [20.0.0+]
|-
| 922 || [20.0.0+]
|-
| 923 || [20.0.0+]
|-
| 924 || [S2]
|-
| 925 || [S2]
|-
| 926 || [S2]
|-
| 927 || [S2]
|-
| 928 || [20.0.0+]
|-
| 929 || [20.0.0+]
|-
| 930 || [20.0.0+]
|-
| 931 || [20.0.0+]
|-
| 933 || [20.1.0+]
|-
| 934 || [21.0.0+]
|-
| 935 || [21.0.0+]
|-
| 936 || [21.0.0+]
|-
| 1000 || [[#RequestVerifyApplicationDeprecated]]
|-
| 1001 || CorruptApplicationForDebug
|-
| 1002 || [3.0.0-9.2.0] [[#RequestVerifyAddOnContentsRights]]
|-
| 1003 || [5.0.0+] [[#RequestVerifyApplication]]
|-
| 1004 || [5.0.0+] CorruptContentForDebug
|-
| 1200 || [[#NeedsUpdateVulnerability]]
|-
| 1300 || [[#IsAnyApplicationEntityInstalled]]
|-
| 1301 || DeleteApplicationContentEntities
|-
| 1302 || CleanupUnrecordedApplicationEntity
|-
| 1303 || [3.0.0-9.2.0] CleanupAddOnContentsWithNoRights
|-
| 1304 || [3.0.0+] DeleteApplicationContentEntity
|-
| 1308 || [5.0.0+] DeleteApplicationCompletelyForDebug
|-
| 1309 || [6.0.0+] [[#CleanupUnavailableAddOnContents]]
|-
| 1310 || [10.0.0+] [[#RequestMoveApplicationEntity]]
|-
| 1311 || [10.0.0+] [[#EstimateSizeToMove]]
|-
| 1312 || [10.0.0+] HasMovableEntity
|-
| 1313 || [11.0.0+] CleanupOrphanContents
|-
| 1314 || [11.0.0+] CheckPreconditionSatisfiedToMove
|-
| 1400 || PrepareShutdown
|-
| 1500 || [[#FormatSdCard]]
|-
| 1501 || [[#NeedsSystemUpdateToFormatSdCard]]
|-
| 1502 || [[#GetLastSdCardFormatUnexpectedResult]]
|-
| 1504 || [3.0.0+] InsertSdCard
|-
| 1505 || [3.0.0+] RemoveSdCard
|-
| 1506 || [9.0.0+] GetSdCardStartupStatus
|-
| 1508 || [20.0.0+]
|-
| 1509 || [20.0.0+]
|-
| 1510 || [20.0.0+]
|-
| 1511 || [20.0.0+]
|-
| 1512 || [20.0.0+]
|-
| 1600 || GetSystemSeedForPseudoDeviceId
|-
| 1601 || [3.0.0+] ResetSystemSeedForPseudoDeviceId
|-
| 1700 || ListApplicationDownloadingContentMeta
|-
| 1701 || [3.0.0+] [[#GetApplicationView]]
|-
| 1702 || [3.0.0+] GetApplicationDownloadTaskStatus
|-
| 1703 || [4.0.0+] [[#GetApplicationViewDownloadErrorContext]]
|-
| 1704 || [8.0.0+] [[#GetApplicationViewWithPromotionInfo]]
|-
| 1705 || [11.0.0+] [[#IsPatchAutoDeletableApplication]]
|-
| 1706 || [20.0.0+]
|-
| 1800 || IsNotificationSetupCompleted
|-
| 1801 || GetLastNotificationInfoCount
|-
| 1802 || [[#ListLastNotificationInfo]]
|-
| 1803 || [3.0.0+] [[#ListNotificationTask]]
|-
| 1900 || [3.0.0-12.1.0] IsActiveAccount
|-
| 1901 || [4.0.0+] [[#RequestDownloadApplicationPrepurchasedRights]]
|-
| 1902 || [5.0.0+] GetApplicationTicketInfo
|-
| 1903 || [13.1.0+] RequestDownloadApplicationPrepurchasedRightsForAccount
|-
| 1904 || [22.0.0+]
|-
| 2000 || [4.0.0+] [[#GetSystemDeliveryInfo]]
|-
| 2001 || [4.0.0+] [[#SelectLatestSystemDeliveryInfo]]
|-
| 2002 || [4.0.0+] [[#VerifyDeliveryProtocolVersion]]
|-
| 2003 || [4.0.0+] [[#GetApplicationDeliveryInfo]]
|-
| 2004 || [4.0.0+] [[#HasAllContentsToDeliver]]
|-
| 2005 || [4.0.0+] [[#CompareApplicationDeliveryInfo]]
|-
| 2006 || [4.0.0+] [[#CanDeliverApplication]]
|-
| 2007 || [4.0.0+] [[#ListContentMetaKeyToDeliverApplication]]
|-
| 2008 || [4.0.0+] [[#NeedsSystemUpdateToDeliverApplication]]
|-
| 2009 || [4.0.0+] [[#EstimateRequiredSize]]
|-
| 2010 || [4.0.0+] [[#RequestReceiveApplication]]
|-
| 2011 || [4.0.0+] [[#CommitReceiveApplication]]
|-
| 2012 || [4.0.0+] [[#GetReceiveApplicationProgress]]
|-
| 2013 || [4.0.0+] [[#RequestSendApplication]]
|-
| 2014 || [4.0.0+] [[#GetSendApplicationProgress]]
|-
| 2015 || [4.0.0+] [[#CompareSystemDeliveryInfo]]
|-
| 2016 || [4.0.0+] [[#ListNotCommittedContentMeta]]
|-
| 2017 || [4.0.0+] [[#RecoverDownloadTask]]
|-
| 2018 || [5.0.0+] [[#GetApplicationDeliveryInfoHash]]
|-
| 2019 || [20.0.0+]
|-
| 2050 || [6.0.0+] [[#GetApplicationRightsOnClient]]
|-
| 2051 || [9.0.0+] InvalidateRightsIdCache
|-
| 2052 || [20.0.0+]
|-
| 2053 || [20.0.0+]
|-
| 2100 || [6.0.0+] [[#GetApplicationTerminateResult]]
|-
| 2101 || [6.0.0+] GetRawApplicationTerminateResult
|-
| 2150 || [6.0.0+] CreateRightsEnvironment
|-
| 2151 || [6.0.0+] DestroyRightsEnvironment
|-
| 2152 || [6.0.0+] ActivateRightsEnvironment
|-
| 2153 || [6.0.0+] DeactivateRightsEnvironment
|-
| 2154 || [6.0.0+] ForceActivateRightsContextForExit
|-
| 2155 || [7.0.0+] UpdateRightsEnvironmentStatus
|-
| 2156 || [10.0.0-12.1.0] CreateRightsEnvironmentForMicroApplication ([9.0.0-9.2.0] CreateRightsEnvironmentForPreomia)
|-
| 2160 || [6.0.0+] AddTargetApplicationToRightsEnvironment
|-
| 2161 || [6.0.0+] SetUsersToRightsEnvironment
|-
| 2170 || [6.0.0+] GetRightsEnvironmentStatus
|-
| 2171 || [6.0.0+] GetRightsEnvironmentStatusChangedEvent
|-
| 2180 || [6.0.0+] RequestExtendExpirationInRightsEnvironment
|-
| 2181 || [6.0.0+] GetResultOfExtendExpirationInRightsEnvironment
|-
| 2182 || [6.0.0+] SetActiveRightsContextUsingStateToRightsEnvironment
|-
| 2183 || [20.1.0+]
|-
| 2190 || [6.0.0+] [[#GetRightsEnvironmentHandleForApplication]]
|-
| 2199 || [6.0.0+] GetRightsEnvironmentCountForDebug
|-
| 2200 || [6.0.0-9.2.0] GetGameCardApplicationCopyIdentifier
|-
| 2201 || [6.0.0-9.2.0] GetInstalledApplicationCopyIdentifier
|-
| 2250 || [6.0.0-6.2.0] RequestReportActiveELicence
|-
| 2300 || [6.0.0-8.1.0] ListEventLog
|-
| 2350 || [7.0.0+] PerformAutoUpdateByApplicationId
|-
| 2351 || [9.0.0+] [[#RequestNoDownloadRightsErrorResolution]]
|-
| 2352 || [9.0.0+] [[#RequestResolveNoDownloadRightsError]]
|-
| 2353 || [10.0.0+] GetApplicationDownloadTaskInfo
|-
| 2354 || [11.0.0+] PrioritizeApplicationBackgroundTask
|-
| 2355 || [12.0.0+] PreferStorageEfficientUpdate
|-
| 2356 || [12.0.0+] RequestStorageEfficientUpdatePreferable
|-
| 2357 || [15.0.0+] EnableMultiCoreDownload
|-
| 2358 || [15.0.0+] DisableMultiCoreDownload
|-
| 2359 || [15.0.0+] IsMultiCoreDownloadEnabled
|-
| 2360 || [19.0.0+] GetApplicationDownloadTaskCount
|-
| 2361 || [19.0.0+] GetMaxApplicationDownloadTaskCount
|-
| 2362 || [20.0.0+]
|-
| 2363 || [20.0.0+]
|-
| 2364 || [20.0.0+]
|-
| 2365 || [20.0.0+]
|-
| 2366 || [20.0.0+]
|-
| 2367 || [20.0.0+]
|-
| 2368 || [20.0.0+]
|-
| 2369 || [21.0.0+]
|-
| 2400 || [8.0.0+] [[#GetPromotionInfo]]
|-
| 2401 || [8.0.0+] CountPromotionInfo
|-
| 2402 || [8.0.0+] [[#ListPromotionInfo|ListPromotionInfo]]
|-
| 2403 || [8.0.0+] [[#ImportPromotionJsonForDebug]]
|-
| 2404 || [8.0.0+] [[#ClearPromotionInfoForDebug]]
|-
| 2500 || [8.0.0+] ConfirmAvailableTime
|-
| 2510 || [9.0.0+] [[#CreateApplicationResource]]
|-
| 2511 || [9.0.0+] [[#GetApplicationResource]]
|-
| 2513 || [10.0.0+] [[#LaunchMicroApplication]] ([9.0.0-9.2.0] LaunchPreomia)
|-
| 2514 || [9.0.0+] ClearTaskOfAsyncTaskManager
|-
| 2515 || [10.0.0+] CleanupAllPlaceHolderAndFragmentsIfNoTask
|-
| 2516 || [10.0.0-14.1.2] EnsureApplicationCertificate
|-
| 2517 || [13.0.0+] [[#CreateApplicationInstance]]
|-
| 2518 || [13.0.0+] UpdateQualificationForDebug
|-
| 2519 || [13.0.0+] IsQualificationTransitionSupported
|-
| 2520 || [13.0.0+] IsQualificationTransitionSupportedByProcessId
|-
| 2521 || [13.0.0-16.1.0] GetRightsUserChangedEvent
|-
| 2522 || [14.0.0+] IsRomRedirectionAvailable
|-
| 2523 || [17.0.0+] GetProgramId
|-
| 2524 || [19.0.0+]
|-
| 2525 || [20.0.0+]
|-
| 2526 || [22.0.0+]
|-
| 2800 || [9.0.0+] GetApplicationIdOfPreomia
|-
| 3000 || [11.0.0+] [[#RegisterDeviceLockKey]]
|-
| 3001 || [11.0.0+] [[#UnregisterDeviceLockKey]]
|-
| 3002 || [11.0.0+] [[#VerifyDeviceLockKey]]
|-
| 3003 || [11.0.0+] [[#HideApplicationIcon]]
|-
| 3004 || [11.0.0+] [[#ShowApplicationIcon]]
|-
| 3005 || [11.0.0+] [[#HideApplicationTitle]]
|-
| 3006 || [11.0.0+] [[#ShowApplicationTitle]]
|-
| 3007 || [11.0.0+] [[#EnableGameCard]]
|-
| 3008 || [11.0.0+] [[#DisableGameCard]]
|-
| 3009 || [11.0.0+] [[#EnableLocalContentShare]]
|-
| 3010 || [11.0.0+] [[#DisableLocalContentShare]]
|-
| 3011 || [11.0.0+] [[#IsApplicationIconHidden]]
|-
| 3012 || [11.0.0+] [[#IsApplicationTitleHidden]]
|-
| 3013 || [11.0.0+] [[#IsGameCardEnabled]]
|-
| 3014 || [11.0.0+] [[#IsLocalContentShareEnabled]]
|-
| 3015 || [18.0.0+] GetNetworkUpdateRequiredByGameCardDetectionEvent
|-
| 3050 || [14.0.0+] ListAssignELicenseTaskResult
|-
| 3100 || [17.0.0+] [[#GetSafeSystemVersionCheckInfo|GetSafeSystemVersionCheckInfo]]
|-
| 3101 || [17.0.0+] [[#RequestUpdateSafeSystemVersionCheckInfo|RequestUpdateSafeSystemVersionCheckInfo]]
|-
| 3102 || [17.0.0+] [[#ResetSafeSystemVersionCheckInfo|ResetSafeSystemVersionCheckInfo]]
|-
| 3104 || [18.0.0+] GetApplicationNintendoLogo
|-
| 3105 || [18.0.0+] GetApplicationStartupMovie
|-
| 3106 || [22.0.0+]
|-
| 3150 || [S2]
|-
| 4000 || [20.0.0+]
|-
| 4004 || [20.0.0+]
|-
| 4006 || [20.0.0+]
|-
| 4007 || [20.0.0+]
|-
| 4008 || [20.0.0+]
|-
| 4009 || [20.0.0+]
|-
| 4010 || [20.0.0+]
|-
| 4011 || [20.0.0+]
|-
| 4012 || [20.0.0+]
|-
| 4013 || [20.0.0+]
|-
| 4015 || [20.0.0+]
|-
| 4017 || [20.0.0+]
|-
| 4019 || [20.0.0+]
|-
| 4020 || [20.0.0+]
|-
| 4021 || [20.0.0+]
|-
| 4022 || [20.0.0+]
|-
| 4023 || [20.0.0+]
|-
| 4024 || [20.0.0+]
|-
| 4025 || [20.0.0+]
|-
| 4026 || [20.0.0+]
|-
| 4027 || [20.0.0+]
|-
| 4028 || [20.0.0+]
|-
| 4029 || [20.0.0+]
|-
| 4030 || [20.0.0+]
|-
| 4031 || [20.0.0+]
|-
| 4032 || [20.0.0+]
|-
| 4033 || [20.0.0+]
|-
| 4034 || [20.0.0+]
|-
| 4035 || [20.0.0+]
|-
| 4037 || [20.0.0+]
|-
| 4038 || [20.0.0+]
|-
| 4039 || [20.0.0+]
|-
| 4040 || [20.0.0+]
|-
| 4041 || [20.0.0+]
|-
| 4042 || [20.0.0+]
|-
| 4043 || [20.0.0+]
|-
| 4044 || [20.0.0+]
|-
| 4045 || [20.0.0+]
|-
| 4046 || [20.0.0+]
|-
| 4049 || [20.0.0+]
|-
| 4050 || [20.0.0+]
|-
| 4051 || [20.0.0+]
|-
| 4052 || [20.0.0+]
|-
| 4053 || [20.0.0+]
|-
| 4054 || [20.0.0+]
|-
| 4055 || [20.0.0+]
|-
| 4056 || [20.0.0+]
|-
| 4057 || [20.0.0+]
|-
| 4058 || [20.0.0+]
|-
| 4059 || [20.0.0+]
|-
| 4060 || [20.0.0+]
|-
| 4061 || [20.0.0+]
|-
| 4062 || [20.0.0+]
|-
| 4063 || [20.0.0+]
|-
| 4064 || [20.0.0+]
|-
| 4065 || [20.0.0+]
|-
| 4066 || [20.0.0+]
|-
| 4067 || [20.0.0+]
|-
| 4068 || [20.0.0+]
|-
| 4069 || [20.0.0+]
|-
| 4070 || [20.0.0+]
|-
| 4071 || [20.0.0+]
|-
| 4072 || [20.0.0+]
|-
| 4073 || [20.0.0+]
|-
| 4074 || [20.0.0+]
|-
| 4075 || [20.0.0+]
|-
| 4076 || [20.0.0+]
|-
| 4077 || [20.0.0+]
|-
| 4078 || [20.0.0+]
|-
| 4079 || [20.0.0+]
|-
| 4080 || [20.0.0+]
|-
| 4081 || [20.0.0+]
|-
| 4083 || [20.0.0+]
|-
| 4084 || [20.0.0+]
|-
| 4085 || [20.0.0+]
|-
| 4086 || [20.0.0+]
|-
| 4087 || [20.0.0+]
|-
| 4088 || [20.0.0+]
|-
| 4089 || [20.0.0+]
|-
| 4090 || [20.0.0+]
|-
| 4091 || [20.0.0+]
|-
| 4092 || [20.0.0+]
|-
| 4093 || [20.0.0+]
|-
| 4094 || [20.0.0+]
|-
| 4095 || [20.0.0+]
|-
| 4096 || [20.0.0+]
|-
| 4097 || [20.0.0+]
|-
| 4099 || [21.0.0+]
|-
| 5000 || [18.0.0+]
|-
| 5001 || [18.0.0+]
|-
| 9999 || [10.0.0-10.2.0] GetApplicationCertificate
|}

[4.0.0+] RequestDownloadAddOnContent now takes an additional 8-bytes of input.

==== GetApplicationRecordUpdateSystemEvent ====
No input, returns an output Event handle with EventClearMode=1.

==== GetApplicationViewDeprecated ====
Takes a type-0x6 output buffer containing an array of [[#ApplicationViewDeprecated]], a type-0x5 input buffer containing an array of u64 [[NCM_services#ApplicationId|ApplicationIds]], no output.

On newer system-versions this is the same as [[#GetApplicationView]], except this converts the output from the func called in the loop from [[#ApplicationView]] to [[#ApplicationViewDeprecated]].

==== DeleteApplicationEntity ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], no output.

==== DeleteApplicationCompletely ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], no output.

==== DeleteRedundantApplicationEntity ====
No input/output.

==== IsApplicationEntityMovable ====
Takes an input u8 [[NCM_services#StorageId|StorageId]], an [[NCM_services#ApplicationId|ApplicationId]], returns an output u8 bool.

==== MoveApplicationEntity ====
Takes an input u8 [[NCM_services#StorageId|StorageId]], an [[NCM_services#ApplicationId|ApplicationId]], no output.

==== RequestApplicationUpdateInfo ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IAsyncValue]].

The data that can be read from the [[#IAsyncValue]] is [[#ApplicationUpdateInfo]].

Before using the cmd, official sw uses [[Network_Interface_services#IsAnyInternetRequestAccepted|IsAnyInternetRequestAccepted]] with the output from [[Network_Interface_services#GetClientId|GetClientId]], throwing an error when the returned bool is false.

==== CancelApplicationDownload ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], no output.

==== ResumeApplicationDownload ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], no output.

==== CheckApplicationLaunchVersion ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], no output.

==== CalculateApplicationDownloadRequiredSize ====
Takes an input u8 [[NCM_services#StorageId|StorageId]], an [[NCM_services#ApplicationId|ApplicationId]], returns an output s64.

==== CleanupSdCard ====
No input/output.

==== GetSdCardMountStatusChangedEvent ====
No input, returns an output Event handle with EventClearMode=0.

==== GetGameCardUpdateDetectionEvent ====
No input, returns an output Event handle with EventClearMode=0.

This Event is used by [[qlaunch]] to check whether a card-sysupdate is required.

==== DisableApplicationAutoDelete ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], no output.

==== EnableApplicationAutoDelete ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], no output.

==== SetApplicationTerminateResult ====
Takes an input u32 Result, an [[NCM_services#ApplicationId|ApplicationId]], no output.

==== ClearApplicationTerminateResult ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], no output.

==== GetLastSdCardMountUnexpectedResult ====
No input/output.

==== GetRequestServerStopper ====
No input, returns an output [[#IRequestServerStopper]].

This increfs a state ref-count, with decref being handled when the object is closed. This ref-count is checked by [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]] and related cmds.

==== CancelApplicationApplyDelta ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], no output.

==== ResumeApplicationApplyDelta ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], no output.

==== CalculateApplicationApplyDeltaRequiredSize ====
Takes an input u8 [[NCM_services#StorageId|StorageId]], an [[NCM_services#ApplicationId|ApplicationId]], returns an output s64.

==== ResumeAll ====
No input/output.

==== GetStorageSize ====
Takes an input u8 [[NCM_services#StorageId|StorageId]], returns two output s64s.

This temporarily mounts the [[Filesystem_services#OpenContentStorageFileSystem|ContentStorage]] specified by the StorageId (must be BuiltInUser or SdCard). The two output s64s are the output from [[Filesystem_services#GetTotalSpaceSize|GetTotalSpaceSize]] and [[Filesystem_services#GetFreeSpaceSize|GetFreeSpaceSize]] with this ContentStorage, with it this being unmounted afterwards.

==== RequestUpdateApplication2 ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IAsyncResult]].

See [[#RequestApplicationUpdateInfo]] regarding nifm.

==== LaunchApplication ====
Takes an input u8 ProgramIndex, an input [[#ApplicationLaunchInfo]], returns an output u64.

[18.0.0+] Now takes a total of 0x58 bytes of input.

[19.0.0+] Now takes a total of 0x88 bytes of input.

==== GetApplicationLaunchInfo ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output [[#ApplicationLaunchInfo]].

[18.0.0+] Now returns a total of 0x50 bytes of output.

[19.0.0+] Now returns a total of 0x80 bytes of output.

==== AcquireApplicationLaunchInfo ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output [[#ApplicationLaunchInfo]].

This verifies that a state flag is set and that a state field matches the input ApplicationId, throwing an error otherwise. The [[#ApplicationLaunchInfo]] from state is copied to output, then the state flag is cleared.

[18.0.0+] Now returns a total of 0x50 bytes of output.

[19.0.0+] Now returns a total of 0x80 bytes of output.

==== GetMainApplicationProgramIndexByApplicationLaunchInfo ====
[18.0.0+] Now takes a total of 0x50 bytes of input.

[19.0.0+] Now returns a total of 0x80 bytes of output.

==== LaunchDevMenu ====
No input/output.

This is used by AM cmd [[Applet_Manager_services#LaunchDevMenu|LaunchDevMenu]].

This loads ProgramIds from [[System_Settings|system-settings]] <code>ns.applet!devmenu_id</code> and <code>ns.applet!devoverlaydisp_id</code>, which only exists on devunits. An error is thrown if loading these fail.

[[NCM_services#ncm|OpenContentMetaDatabase]] is used with StorageId = NandSystem, then IContentMetaDatabase GetLatestContentMetaKey is used with both of the above ProgramIds to verify that the cmd is successful.

Then if the above succeeds, the above titles are launched with the above StorageId via [[Process_Manager_services|pmshell]] LaunchProgram ([10.0.0+] [[PGL_services#LaunchProgram|pgl]] with pgl_launch_flags=0), with a 0.5s sleep-thread afterwards on success. [[Process_Manager_services#LaunchFlags|LaunchFlags]] value 0xB is used here.

==== DeleteUserSaveDataAll ====
Takes an input [[Account_services#Uid|Uid]], returns an output [[#IProgressMonitorForDeleteUserSaveDataAll]].

On success, [[#IProgressMonitorForDeleteUserSaveDataAll]] GetProgress is used with the output being copied into object state.

==== DeleteUserSystemSaveData ====
Takes an input [[Account_services#Uid|Uid]], an u64 SystemSaveDataId, no output.

==== DeleteSaveData ====
Takes an input u8 [[Filesystem_services#SaveDataSpaceId|SaveDataSpaceId]], an u64 SaveDataId, no output.

==== UnregisterNetworkServiceAccount ====
Takes an input [[Account_services#Uid|Uid]], no output.

==== UnregisterNetworkServiceAccountWithUserSaveDataDeletion ====
Takes an input [[Account_services#Uid|Uid]], no output.

==== LaunchLibraryApplet ====
Takes an input u64 [[NCM_services#ProgramId|ProgramId]], returns an output u64.

The specified program is launched with StorageId=BuiltInSystem via [[Process_Manager_services|pmshell]] LaunchProgram ([10.0.0+] [[PGL_services#LaunchProgram|pgl]] with pgl_launch_flags=0). [[Process_Manager_services#LaunchFlags|LaunchFlags]] value 0x9 is used here. The output u64 from here is written to the output for this cmd, on success.

This is used by [[Applet_Manager_services|AM]].

==== LaunchSystemApplet ====
No input, returns an output u64.

A state flag must be non-zero, otherwise an error is thrown. When a state field is value 1, a hard-coded ProgramId for MaintenanceMenu is used. Otherwise, the ProgramId is loaded from [[System_Settings|system-setting]] <code>ns.applet!system_applet_id</code> ([20.0.0+] <code>ns.applet!system_applet_id_gen2</code>).

The SystemApplet is launched with StorageId=BuiltInSystem via [[Process_Manager_services|pmshell]] LaunchProgram ([10.0.0+] [[PGL_services#LaunchProgram|pgl]] with pgl_launch_flags=0). [[Process_Manager_services#LaunchFlags|LaunchFlags]] value 0x9 is used here. The output u64 from here is written to the output for this cmd, on success.

This is used by [[Applet_Manager_services|AM]].

==== LaunchOverlayApplet ====
No input, returns an output u64.

A state flag must be non-zero, otherwise an error is thrown. The ProgramId is loaded from [[System_Settings|system-setting]] <code>ns.applet!overlay_applet_id</code>.

The OverlayApplet is launched with StorageId=BuiltInSystem via [[Process_Manager_services|pmshell]] LaunchProgram ([10.0.0+] [[PGL_services#LaunchProgram|pgl]] with pgl_launch_flags=0). [[Process_Manager_services#LaunchFlags|LaunchFlags]] value 0x9 is used here. The output u64 from here is written to the output for this cmd, on success.

This is used by [[Applet_Manager_services|AM]].

==== RequestDownloadApplicationControlData ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IAsyncResult]].

See [[#RequestApplicationUpdateInfo]] regarding nifm.

==== GetApplicationControlProperty ====
[18.0.0+] Now takes a total of 0x58 bytes of input.

==== ListApplicationTitle ====
Takes an input TransferMemory handle, a type-0x5 input buffer containing an array of u64 [[NCM_services#ApplicationId|ApplicationIds]], an u8 [[#ApplicationControlSource]], an u64 size, returns an output Event handle and an [[#IAsyncValue]].

[[qlaunch]] uses value 0x1 for the u8.

The user-process creates the TransferMemory with permissions=R--.

The data available with [[#IAsyncValue]] Get is a s32 for the offset within the TransferMemory where the output data is located, GetSize returns the total byte-size of the data located here. The data located here is the [[NACP_Format|NACP]] title-entry for each specified ApplicationId.

The TransferMemory size must be at least: count*sizeof([[NACP_Format|title-entry]]) + count*sizeof(u64) + count*[[#GetApplicationControlData|0x24000]].

This is essentially an async wrapper for [[#GetApplicationControlData]], with support for multiple ApplicationIds.

==== ListApplicationIcon ====
Takes an input TransferMemory handle, a type-0x5 input buffer containing an array of u64 [[NCM_services#ApplicationId|ApplicationIds]], an u8 [[#ApplicationControlSource]], an u64 size, returns an output Event handle and an [[#IAsyncValue]].

The user-process creates the TransferMemory with permissions=R--.

The data available with [[#IAsyncValue]] Get is a s32 for the offset within the TransferMemory where the output data is located, GetSize returns the total byte-size of the data located here. This data is: an u64 for total entries, an array of u64s for each icon size, then the icon JPEGs for the specified ApplicationIds.

The TransferMemory size must be at least: 0x4 + count*sizeof(u64) + count*[[#GetApplicationControlData|0x20000]] + count*sizeof(u64) + [[#GetApplicationControlData|0x24000]].

This is essentially an async wrapper for [[#GetApplicationControlData]], with support for multiple ApplicationIds.

==== Cmd421 ====
Takes an input TransferMemory handle, a type-0x5 input buffer containing an array of u64 [[NCM_services#ApplicationId|ApplicationIds]], an u8 [[#ApplicationControlSource]], an u64 size, returns an output Event handle and an [[#IAsyncValue]].

This is essentially the same as [[#ListApplicationTitle|ListApplicationTitle]] except the ApplicationControlSource is used here (ListApplicationTitle ignores it and uses 0xF0 instead).

The TransferMemory size must be at least: count*sizeof(u64) + count*[[NACP#ApplicationTitle|0x300]] + [[#GetApplicationControlData|0x1d000]].

The async task impl code eventually compares ApplicationControlSource with 0xF0, with a separate code-path being used when it doesn't match (which also handles [[NACP|compression]] when needed).

==== RequestCheckGameCardRegistration ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IAsyncResult]].

See [[#RequestApplicationUpdateInfo]] regarding nifm.

==== RequestGameCardRegistrationGoldPoint ====
Takes an input [[Account_services#Uid|Uid]], an [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IAsyncValue]].

The data that can be read from the [[#IAsyncValue]] is 4-bytes.

See [[#RequestApplicationUpdateInfo]] regarding nifm.

==== RequestRegisterGameCard ====
Takes an input s32, an [[Account_services#Uid|Uid]], an [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IAsyncResult]].

See [[#RequestApplicationUpdateInfo]] regarding nifm.

==== GetGameCardMountFailureEvent ====
No input, returns an output Event handle with EventClearMode=0.

==== IsGameCardInserted ====
No input, returns an output u8 bool.

==== EnsureGameCardAccess ====
No input/output.

==== GetLastGameCardMountFailureResult ====
No input/output.

==== ListApplicationIdOnGameCard ====
Takes a type-0x6 output buffer containing an array of u64 [[NCM_services#ApplicationId|ApplicationIds]], returns an output s32 for total output entries.

==== GetGameCardPlatformRegion ====
No input, returns an u8 '''GameCardPlatformRegion''' (0x00 = Global, 0x01 = China).

This calls [[Filesystem_services#IDeviceOperator|fsp-srv IDeviceOperator]] GetGameCardCompatibilityType and returns the result.

==== ListAvailableAddOnContent ====
[10.0.0+] This now takes a total of 0x10-bytes of input instead of a total of 0x18-bytes of input.

[15.0.0+] This now takes a total of 0x8-bytes of input instead of a total of 0x10-bytes of input.

==== RequestDownloadTaskListData ====
No input, returns an output Event handle and an [[#IAsyncValue]].

==== TouchApplication ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], no output.

==== IsApplicationUpdateRequested ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output u8 bool and an u32.

The output u32 is only valid when the output bool is set.

==== WithdrawApplicationUpdateRequest ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], no output.

==== RequestVerifyApplicationDeprecated ====
Takes an input TransferMemory handle, an [[NCM_services#ApplicationId|ApplicationId]], an u64 size, returns an output Event handle and an [[#IProgressAsyncResult]].

On newer system-versions this calls the same func as [[#RequestVerifyApplication]], with the u32 value set to 0x7.

==== RequestVerifyAddOnContentsRights ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IProgressAsyncResult]].

==== RequestVerifyApplication ====
Takes an input TransferMemory handle, an u32, an [[NCM_services#ApplicationId|ApplicationId]], an u64 size, returns an output Event handle and an [[#IProgressAsyncResult]].

Official sw creates the TransferMemory with an user-specified buffer with permissions=0. [[qlaunch]] uses buffer size 0x100000.

Official sw has an additional wrapper func which calls the original wrapper func, this uses value 0x7 for the u32. This is the same func used by [[qlaunch]].

==== IsAnyApplicationEntityInstalled ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output u8 bool.

==== CleanupUnavailableAddOnContents ====
Takes an input u64 [[NCM_services#ApplicationId|ApplicationId]], an [[Account_services#Uid|Uid]], no output.

==== RequestMoveApplicationEntity ====
Takes an input TransferMemory handle, a type-0x5 input buffer containing an array of [[NCM_services#StorageId|StorageId]], a [[NCM_services#StorageId|StorageId]], an u32 bitfield of "nn::ns::KeepApplicationEntityFlagTag", an [[NCM_services#ApplicationId|ApplicationId]], an u64 tmem_size, returns an output Event handle and an [[#IProgressAsyncResult]].

The TransferMemory uses permissions=0.

==== EstimateSizeToMove ====
Takes a type-0x5 input buffer containing an array of [[NCM_services#StorageId|StorageId]], a [[NCM_services#StorageId|StorageId]], an u32 bitfield of "nn::ns::KeepApplicationEntityFlagTag", an [[NCM_services#ApplicationId|ApplicationId]], returns an output s64.

This calls a func also used by [[#RequestMoveApplicationEntity]], then calls another func.

==== FormatSdCard ====
No input/output.

==== NeedsSystemUpdateToFormatSdCard ====
No input, returns an output u8 bool.

==== GetLastSdCardFormatUnexpectedResult ====
No input/output.

==== GetApplicationView ====
Takes a type-0x6 output buffer containing an array of [[#ApplicationView]], a type-0x5 input buffer containing an array of u64 [[NCM_services#ApplicationId|ApplicationIds]], no output.

==== GetApplicationViewDownloadErrorContext ====
Takes a type-0x16 output buffer containg an [[Error_Applet#ErrorContext|ErrorContext]], an u64 [[NCM_services#ApplicationId|ApplicationId]], no output.

==== GetApplicationViewWithPromotionInfo ====
Takes a type-0x6 output buffer containing an array of [[#ApplicationViewWithPromotionInfo]], a type-0x5 input buffer containing an array of u64 [[NCM_services#ApplicationId|ApplicationIds]], no output.

==== IsPatchAutoDeletableApplication ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output bool.

Compares the input ApplicationId with the value of [[System_Settings|system-setting]] <code>ns.application!auto_deletable_application_id_on_not_enough_space</code>, with the bool being set to the comparsion result.

==== ListLastNotificationInfo ====
Takes a type-0x6 buffer containing an array with struct entry size 0x90-bytes. Returns 4-bytes of output.

[19.0.0+] The struct size is now 0x98-bytes.

==== ListNotificationTask ====
Takes a type-0x6 buffer containing an array with struct entry size 0xB0-bytes. Returns 4-bytes of output.

[19.0.0+] The struct size is now 0xB8-bytes.

==== RequestDownloadApplicationPrepurchasedRights ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IAsyncResult]].

See [[#RequestApplicationUpdateInfo]] regarding nifm.

==== GetSystemDeliveryInfo ====
Takes a type-0x16 output buffer containing a [[#SystemDeliveryInfo]], no output.

This generates a [[#SystemDeliveryInfo]] using the currently installed SystemUpdate meta title.

==== SelectLatestSystemDeliveryInfo ====
Takes a type-0x15 input buffer containing a [[#SystemDeliveryInfo]], a type-0x5 input buffer containing an array of [[#SystemDeliveryInfo]], a type-0x5 input buffer containing an array of [[#ApplicationDeliveryInfo]], and returns an output s32.

This determines the latest version (RequiredSystemVersion) from the input [[#ApplicationDeliveryInfo]] array (ApplicationDeliveryProtocolVersion and the HMAC are also validated), using value 0 if the array is empty.

* [20.0.0+] The following code block now only runs when the SystemDeliveryInfoPlatform from the type-0x15 [[#SystemDeliveryInfo]] buffer matches the [[System_Settings|sys-setting]].
** It then loops through the [[#ApplicationDeliveryInfo]] array again:
** This uses functionality which essentially uses [[Shared_Database_services|pl:s]] GetFunctionBlackListSystemVersionToAuthorize with the [[#ApplicationDeliveryInfo]] ApplicationId and ApplicationFunctionAuthorizationId=0x5 then parses the output, using cached data if available. The error is returned on failure.
** tmp_version = out_u8 == 0 ? 0 : out_u32 + 0x10000;
** Then the current latest-version value is updated with tmp_version, if tmp_version is higher.

If this version value is less than a state field, the state field value is used instead (state field originates from [[System_Settings|system-setting]] <code>contents_delivery!required_system_version_to_deliver_application</code>).

Then this selects the [[#SystemDeliveryInfo]] with the latest version from the input array. The output s32 is an index in that array for the selected entry, -1 if none found.

During the above loop it first calls the [[#SystemDeliveryInfo]] validation func, returning the Result on failure. Then it runs additional validation, with the [[#SystemDeliveryInfo]] entry being ignored on failure:
* The above latest-version value must be at least the version value from the type-0x15 [[#SystemDeliveryInfo]] buffer and the [[#SystemDeliveryInfo]] array entry.
* When HasExFat is set in the type-0x15 [[#SystemDeliveryInfo]] buffer, it must be set in the [[#SystemDeliveryInfo]] array entry.
* FirmwareVariationId in the type-0x15 [[#SystemDeliveryInfo]] buffer must not be 0xFF.
* UpdatableFirmwareGroupId in the [[#SystemDeliveryInfo]] array entry must not be 0xFF. The value must be within bounds of the settings array ([[System_Settings|sys-settings]] <code>contents_delivery!updatable_firmware_group_string</code>).
* PlatformRegion in the [[#SystemDeliveryInfo]] array entry and the type-0x15 [[#SystemDeliveryInfo]] buffer must match.
* Lastly when the following is true, this indicates success: (settings_array[UpdatableFirmwareGroupId] >> {above FirmwareVariationId}) & 1.

==== VerifyDeliveryProtocolVersion ====
Takes a type-0x15 input buffer containing a [[#SystemDeliveryInfo]], no output.

This validates the [[#SystemDeliveryInfo]] HMAC and the protocol-version fields. Then an error is returned when SystemUpdateVersion is less than a state field, otherwise 0 is returned (state field originates from [[System_Settings|system-setting]] <code>contents_delivery!required_system_version_to_deliver_application</code>).

==== GetApplicationDeliveryInfo ====
Takes a type-0x6 output buffer containing an array of [[#ApplicationDeliveryInfo|ApplicationDeliveryInfo]], an input u32 bitmask <code>nn::ns::ApplicationDeliveryAttributeTag</code>, an [[NCM_services#ApplicationId|ApplicationId]], and returns an output s32 total_out.

[11.0.0+] An error is thrown if LocalContentShare is not [[#IsLocalContentShareEnabled|enabled]].

An error is thrown if any bit is set in ApplicationDeliveryAttributeTag besides bit1, this must also be <=0x3. The output array-count must be at least 1: only 1 entry will be written to this array (hence on success total_out will also only be 1 on success).

[7.0.0+] An error is thrown if the state ref-count for [[#GetRequestServerStopper|RequestServerStopper]] is zero. [7.0.0-7.0.1] The func which checks this would also return success when a field prior to the previously mentioned field is 0 (checked before the ref-count).

An error is thrown if [[NIM_services|nim]] ListApplicationApplyDeltaTask returns a task.

HasApplicationRecord is called with the input [[NCM_services#ApplicationId|ApplicationId]], an error is returned if the record isn't found.

[[#ApplicationDeliveryInfo|RequiredApplicationVersion]] is initially set to the output version from [[Shared_Database_services|avm]] GetLaunchRequiredVersion. Later when ContentMetaType == Application etc, it calls a func. This func uses [[NCM_services|ncm]] IContentMetaDatabase GetRequiredApplicationVersion. If the output version is higher than the [[#ApplicationDeliveryInfo|RequiredApplicationVersion]] field then the output version is written here. Immediately aferwards, it also checks whether the bit for Compacted is set from [[NCM_services|ncm]] IContentMetaDatabase GetAttributes, clearing [[#ApplicationDeliveryInfo|ApplicationVersion]] if the attribute is set.

[20.0.0+] [[#ApplicationDeliveryInfo|ApplicationDeliveryInfo]] ContentMetaPlatform and ProperProgramExists are now set using data from [[NCM_services|ncm]].

[20.0.0+] [[Shared_Database_services|pl:s]] GetFunctionBlackListSystemVersionToAuthorize with ApplicationFunctionAuthorizationId=0x5 is now used, the output version is written to [[#ApplicationDeliveryInfo|RequiredSystemVersion]] when it's higher than the value previously written here.

[20.0.0+] [[Shared_Database_services|pl:s]] GetRequiredApplicationVersion with ApplicationFunctionAuthorizationId=0x5 is now used, the output version is written to [[#ApplicationDeliveryInfo|RequiredApplicationVersion]] when it's higher than the value previously written here.

==== HasAllContentsToDeliver ====
Takes a type-0x5 input buffer containing an array of [[#ApplicationDeliveryInfo]], returns an output u8 bool.

The array-count must match 1.

This uses the same LocalContentShare check as [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]].

After validating the [[#ApplicationDeliveryInfo]], the output bool is set to [[#ApplicationDeliveryInfo|ApplicationDeliveryAttributeTag]] & 0x10000002 != 0x2, then this returns 0.

==== CompareApplicationDeliveryInfo ====
Takes two type-0x5 input buffers containing an array of [[#ApplicationDeliveryInfo]], returns an output s32.

This uses the same LocalContentShare check as [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]].

The array-count for both buffers must be 1, otherwise an error is returned.

Both [[#ApplicationDeliveryInfo]] are validated, then the application-version in the first/second buffer are compared. The output s32 is set to the comparison result: -1 for less than, 0 for equal, and 1 for higher than.

==== CanDeliverApplication ====
Takes two type-0x5 input buffers containing an array of [[#ApplicationDeliveryInfo]], returns an output u8 bool.

The array-count for the second buffer must be 1, otherwise an error is returned.

This uses the same LocalContentShare check as [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]].

The second [[#ApplicationDeliveryInfo]] buffer is validated. An error is thrown when [[#ApplicationDeliveryInfo|ApplicationDeliveryAttributeTag]] (second buffer) & 0x3 != 0x2, likewise when bit28 is clear in this field (bitmask 0x10000000).

The array-count for the first buffer must be <=1, otherwise an error is returned. If the array-count for the first buffer is 0, this will return 0 with the output bool set to 0. The first [[#ApplicationDeliveryInfo]] buffer is validated. An error is thrown when [[#ApplicationDeliveryInfo|ApplicationDeliveryAttributeTag]] (first buffer) bit1 is clear or bit0 set. An error is thrown when [[#ApplicationDeliveryInfo|ApplicationDeliveryAttributeTag]] (second buffer) bit1 is clear.

When [[#ApplicationDeliveryInfo|RequiredApplicationVersion]] (first or second buffer) is higher than [[#ApplicationDeliveryInfo|ApplicationVersion]] (second buffer), this will return 0 with the output bool set to 0.

When [[#ApplicationDeliveryInfo|ApplicationDeliveryAttributeTag]] (first buffer) bit28 is set (bitmask 0x10000000):
* When [[#ApplicationDeliveryInfo|ApplicationVersion]] (first buffer) >= [[#ApplicationDeliveryInfo|ApplicationVersion]] (second buffer), write 0 to the output bool, otherwise write 1. Then return 0.
Otherwise when the above bit28 is clear:
* When [[#ApplicationDeliveryInfo|ApplicationVersion]] (first buffer) > [[#ApplicationDeliveryInfo|ApplicationVersion]] (second buffer), write 0 to the output bool, otherwise write 1. Then return 0.

==== ListContentMetaKeyToDeliverApplication ====
Takes a type-0x6 output buffer containing an array of [[NCM_services#ContentMetaKey|ContentMetaKey]], a type-0x5 input buffer containing an array of [[#ApplicationDeliveryInfo]], a s32, and returns an output s32 total_out.

This uses the same LocalContentShare check as [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]].

The array-count for ContentMetaKey must be at least 1, and for ApplicationDeliveryInfo it must match 1.

The [[#ApplicationDeliveryInfo|ApplicationDeliveryInfo]] is validated (ApplicationDeliveryProtocolVersion/HMAC). An error is thrown when [[#ApplicationDeliveryInfo|ApplicationDeliveryAttributeTag]] bit0 is set.

This uses the same ref-count check as [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]].

An error is thrown if [[NIM_services|nim]] ListApplicationApplyDeltaTask returns a task.

This will only return 1 ContentMetaKey entry. This will not output the entry when the input s32 is larger than 0, or when [[#ApplicationDeliveryInfo|ApplicationDeliveryAttributeTag]] bit1 is clear.

==== NeedsSystemUpdateToDeliverApplication ====
Takes a type-0x15 input buffer containing a [[#SystemDeliveryInfo]], a type-0x5 input buffer containing an array of [[#ApplicationDeliveryInfo]], and returns an output u8 bool.

This uses the same LocalContentShare check as [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]].

The [[#SystemDeliveryInfo]] is validated (validation for ApplicationDeliveryProtocolVersion is enabled).

The array-count must match 1.

The [[#ApplicationDeliveryInfo]] is validated (ApplicationDeliveryProtocolVersion/HMAC).

This then runs functionality similar to [[#SelectLatestSystemDeliveryInfo]]:
* [20.0.0+] The following code block now only runs when the SystemDeliveryInfoPlatform from the input [[#SystemDeliveryInfo]] matches the [[System_Settings|sys-setting]].
* Uses the same functionality as [[#SelectLatestSystemDeliveryInfo]] for GetFunctionBlackListSystemVersionToAuthorize, returning the Result on failure.
* The output bool is set to: out_u8!=0 && out_u32 >= [[#SystemDeliveryInfo]] SystemUpdateVersion (only the upper 16bits are used from the SystemUpdateVersion).

Otherwise when the output bool is still false, this sets the output bool by comparing system-version fields in the [[#SystemDeliveryInfo]]/[[#ApplicationDeliveryInfo]] and with a state field (state field originates from [[System_Settings|system-setting]] <code>contents_delivery!required_system_version_to_deliver_application</code>).

==== EstimateRequiredSize ====
Takes a type-0x5 input buffer containing an array of [[NCM_services#ContentMetaKey|ContentMetaKey]], returns an output s64.

When the array-count is less than 1, this will return 0 with the s64 set to 0.

==== RequestReceiveApplication ====
Takes a type-0x5 input buffer containing an array of [[NCM_services#ContentMetaKey|ContentMetaKey]], a [[NCM_services#StorageId|StorageId]], an u16 port, an u32 Ipv4Address, an [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IAsyncResult]].

[[qlaunch]] uses value Any for the StorageId, and value 55556 for the port.

This uses the same LocalContentShare and ref-count checks as [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]].

An error is thrown if [[NIM_services|nim]] ListApplicationApplyDeltaTask returns a task.

HasApplicationRecord is called with the input [[NCM_services#ApplicationId|ApplicationId]], an error is returned if the record isn't found.

This loops through the input [[NCM_services#ContentMetaKey|ContentMetaKey]] array, throwing an error if the [[NCM_services#ContentMetaType|ContentMetaType]] doesn't match Patch. The input array is copied into state which is used later by the thread for [[NIM_services|nim]] CreateLocalCommunicationReceiveApplicationTask, max entries is 0x12.

This does various setup then creates the [[#IAsyncResult]] + the async thread which handles the [[#IAsyncResult]] operation. Then the thread does:

* Calls a func which does:
** Throws an error if a state flag is set.
** Uses [[NIM_services|nim]] CreateLocalCommunicationReceiveApplicationTask, returning the Result on failure.
** Uses [[NIM_services|nim]] RequestLocalCommunicationReceiveApplicationTaskRun, returning the Result on failure. Waits for the IAsyncResult operation from this to finish, then uses the Get cmd to get the output Result.
*** When the Result from Get is an error, a func is called for filling in the [[#IAsyncResult|IAsyncResult]] ErrorContext with Type4.
** Handles cleanup and returns.
* On success, this loads various data which is then used for saving a SystemPlayReport when the cached [[System_Settings|system-setting]] "systemreport!enabled" is set.
** The EventId is "receive_app_contents" with ApplicationId <NS ProgramId>.
** This report has the following fields:
*** "ApplicationId"
*** "DestinationVersion"
*** "SourceVersion"
*** "HasApplicationEntity"
*** "HasPatchEntity"
*** "ApplicationStorageId"
*** "PatchStorageId"
*** "Size"
*** "ThroughputKBps"

==== CommitReceiveApplication ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], no output.

This uses the same LocalContentShare and ref-count checks as [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]].

An error is thrown if [[NIM_services|nim]] ListApplicationApplyDeltaTask returns a task.

==== GetReceiveApplicationProgress ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output [[#ReceiveApplicationProgress]].

This uses the same ref-count check as [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]].

An error is thrown if [[NIM_services|nim]] ListApplicationApplyDeltaTask returns a task.

Uses [[NIM_services|nim]] ListApplicationLocalCommunicationReceiveApplicationTask, throwing an error if no task is returned. Then [[NIM_services|nim]] GetLocalCommunicationReceiveApplicationTaskInfo is used, returning the error from there on failure. Lastly, this writes the 0x10-bytes from output+8 from the latter cmd to the output [[#ReceiveApplicationProgress]], and returns 0.

==== RequestSendApplication ====
Takes a type-0x5 input buffer containing an array of [[NCM_services#ContentMetaKey|ContentMetaKey]], an u16 port, an u32 Ipv4Address, an [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IAsyncResult]].

[[qlaunch]] uses value 55556 for the port.

This uses the same LocalContentShare and ref-count checks as [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]].

An error is thrown if [[NIM_services|nim]] ListApplicationApplyDeltaTask returns a task.

This does various setup and loops through the input ContentMetaKey array for initializing the array passed to the nim cmd during the async task. This loop does the following:
* Throws an error if the [[NCM_services#ContentMetaType|ContentMetaType]] in the ContentMetaKey doesn't match Patch.
* Calls a func with the ContentMetaKey and the ApplicationId, throwing an error if the output value is 0.
* Calls a func with the ContentMetaKey for getting the StorageId. This essentially loops through each valid ncm [[NCM_services|IContentMetaDatabase]] using cmd [[NCM_services|Has]] with the input ContentMetaKey, returning the relevant StorageId when found.
* The ContentMetaKey and the StorageId are copied into a tmp struct.
* if (ContentMetaType==Patch && StorageId==GameCard) { <call a func etc> }
* Copies the above tmp struct into the async task state array.

This then creates the [[#IAsyncResult]] + the async thread which handles the [[#IAsyncResult]] operation. Then the thread does:

* Calls a func which does:
** Throws an error if a state flag is set.
** Uses [[NIM_services|nim]] CreateLocalCommunicationSendApplicationTask, returning the Result on failure.
** Uses [[NIM_services|nim]] RequestLocalCommunicationSendApplicationTaskRun, returning the Result on failure. Waits for the IAsyncResult operation from this to finish, then uses the Get cmd to get the output Result.
*** When the Result from Get is an error, a func is called for filling in the [[#IAsyncResult|IAsyncResult]] ErrorContext with Type4.
** Handles cleanup and returns.
* On success, this loads various data which is then used for saving a SystemPlayReport when the cached [[System_Settings|system-setting]] "systemreport!enabled" is set.
** The EventId is "send_app_contents" with ApplicationId <NS ProgramId>.
** This report has the following fields:
*** "ApplicationId"
*** "Version"
*** "ApplicationStorageId"
*** "PatchStorageId"

==== GetSendApplicationProgress ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output [[#SendApplicationProgress]].

Same as [[#GetReceiveApplicationProgress]] except this is the Send version, and uses [[NIM_services|nim]] ListApplicationLocalCommunicationSendApplicationTask/GetLocalCommunicationSendApplicationTaskInfo instead. The data copied to output is also swapped: u64 nim_out+0x8 is copied to out+0x8, and u64 nim_out+0x10 is copied to out+0x0.

==== CompareSystemDeliveryInfo ====
Takes two type-0x15 input buffers containing a [[#SystemDeliveryInfo]], returns an output s32.

This is essentially the same as [[#CompareApplicationDeliveryInfo]], except this compares the [[#SystemDeliveryInfo]] SystemUpdate version.

==== ListNotCommittedContentMeta ====
Takes a type-0x6 output buffer containing an array of [[NCM_services#ContentMetaKey|ContentMetaKey]], a s32, an [[NCM_services#ApplicationId|ApplicationId]], returns an output s32 total_out.

This uses the same ref-count check as [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]].

An error is thrown if [[NIM_services|nim]] ListApplicationApplyDeltaTask returns a task.

==== RecoverDownloadTask ====
Takes a type-0x5 input buffer containing an array of {unknown} and an input u64, no output.

This uses the same LocalContentShare and ref-count checks as [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]].

==== GetApplicationDeliveryInfoHash ====
Takes a type-0x5 input buffer containing an array of [[#ApplicationDeliveryInfo]], returns an output 0x20-byte SHA256 hash.

This uses the same LocalContentShare check as [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]].

This extracts data from the input array for hashing with SHA256, with validation being done when handling each entry (ApplicationDeliveryProtocolVersion/HMAC).

The 0x14-bytes from [[#ApplicationDeliveryInfo|ApplicationDeliveryInfo]]+0x8 are copied into a 0x18-byte struct entry in an array buffer, with the last 4-bytes being cleared. Then each 0x18-byte struct entry is hashed.

==== Cmd2019 ====
Takes a type-0x15 input buffer containing a [[#SystemDeliveryInfo]], a type-0x5 input buffer containing an array of [[#ApplicationDeliveryInfo]], a type-0x5 input buffer containing an array of [[#ApplicationDeliveryInfo]], returns an output u8 bool.

This is essentially an extended version of [[#CanDeliverApplication|CanDeliverApplication]], with additional functionality for determining platform compatibility.

This calls a func for validating the [[#SystemDeliveryInfo]] from the type-0x15 buffer, returning the Result on failure.

Then [[#CanDeliverApplication|CanDeliverApplication]] is called with the output bool and the input arrays, returning the Result on failure.

If the output bool is set after calling the above, it then calls a func with the output bool, the second [[#ApplicationDeliveryInfo]] buffer, and the [[#SystemDeliveryInfo]] from the type-0x15 buffer. This func does the following:
* When the SystemDeliveryInfoPlatform from the input [[#SystemDeliveryInfo]] matches the [[System_Settings|sys-setting]], it does the following:
** Uses [[Shared_Database_services|pl:s]] RequestApplicationFunctionAuthorizationByApplicationId with the [[#ApplicationDeliveryInfo]] ApplicationId/ApplicationVersion and ApplicationFunctionAuthorizationId=0x5, handling the Result on failure.
* When the platform fields from the input [[#SystemDeliveryInfo]]/[[#ApplicationDeliveryInfo]] match, write 1 to the output bool and return 0. Otherwise:
** When the [[#SystemDeliveryInfo]] SystemDeliveryInfoPlatform is 0x1 (Ounce): *output = [[#ApplicationDeliveryInfo|ContentMetaPlatform]] == 0 && [[#ApplicationDeliveryInfo|ProperProgramExists]] == 0;
** When the [[#SystemDeliveryInfo]] SystemDeliveryInfoPlatform is 0x0 (NX): write 0 to the output bool and return 0.
** Otherwise, Abort.

==== GetApplicationRightsOnClient ====
Takes a type-0x6 output buffer containing an array of [[#ApplicationRightsOnClient]], an input u32 flags, an [[NCM_services#ApplicationId|ApplicationId]], an [[Account_services#Uid|Uid]], returns 4-bytes of output for total output entries.

Official sw has at least two wrappers which use this cmd: one with an all-zero Uid, one with an user-specified Uid. With both of these, the passed flags are hard-coded to value 0x3.

For the output array count, [[qlaunch]] uses value 3.

==== GetApplicationTerminateResult ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output u32 Result.

==== GetRightsEnvironmentHandleForApplication ====
No input, returns a total of 8-bytes of output.

[9.0.0+] Now takes a total of 8-bytes of input, returns a total of 8-bytes of output.

==== RequestNoDownloadRightsErrorResolution ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IAsyncValue]].

The data that can be read from the [[#IAsyncValue]] is [[#NoDownloadRightsErrorResolution]].

See [[#RequestApplicationUpdateInfo]] regarding nifm.

==== RequestResolveNoDownloadRightsError ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IAsyncValue]].

The data that can be read from the [[#IAsyncValue]] is [[#NoDownloadRightsErrorResolution]].

See [[#RequestApplicationUpdateInfo]] regarding nifm.

==== GetPromotionInfo ====
Takes a type-0x6 output buffer containing an array of [[#PromotionInfo]], a type-0x5 input buffer containing an array of u64 [[NCM_services#ApplicationId|ApplicationIds]], a type-0x5 input buffer containing an array of [[Account_services#Uid|Uids]], no output.

Official sw uses hard-coded value 1 for the count with each of these arrays.

==== ListPromotionInfo ====
[20.0.0+] The struct size for the output buffer array is now 0x28-bytes instead of 0x20-bytes.

==== ImportPromotionJsonForDebug ====
Takes a type-0x5 input buffer, no output.

The output from [[Settings_services#GetDebugModeFlag]] must be 1, otherwise an error is returned.

==== ClearPromotionInfoForDebug ====
No input/output.

The output from [[Settings_services#GetDebugModeFlag]] must be 1, otherwise an error is returned.

This just clears 0xC-bytes in state.

==== CreateApplicationResource ====
Takes an input [[#ApplicationResourceType]]. Returns an [[#IApplicationResource]].

==== GetApplicationResource ====
Takes an input u64 ProcessId and an input [[#ApplicationResourceType]]. Returns an [[#IApplicationResource]].

==== LaunchMicroApplication ====
[18.0.0+] Now takes a total of 0x50 bytes of input.

[19.0.0+] Now takes a total of 0x80 bytes of input.

==== CreateApplicationInstance ====
[18.0.0+] Now takes a total of 0x50 bytes of input.

[19.0.0+] Now takes a total of 0x80 bytes of input.

==== RegisterDeviceLockKey ====
Takes a type-0x5 input buffer containing an InArray of u8, no output.

User-processes expose this with two funcs: one which uses an user-specified u8 array directly, while the other uses [[HID_services#NpadButtonSet|NpadButton]].

This does SHA256 hashing, etc.

==== UnregisterDeviceLockKey ====
No input/output.

Runs code identical to [[#RegisterDeviceLockKey]], except the passed buffer/size are 0.

==== VerifyDeviceLockKey ====
Takes a type-0x5 input buffer containing an InArray of u8, no output.

User-processes expose this with two funcs: one which uses an user-specified u8 array directly, while the other uses [[HID_services#NpadButtonSet|NpadButton]].

This runs hashing similar to [[#RegisterDeviceLockKey]], with the calculated hash being verified with the one from state.

==== HideApplicationIcon ====
No input/output.

==== ShowApplicationIcon ====
No input/output.

==== HideApplicationTitle ====
No input/output.

==== ShowApplicationTitle ====
No input/output.

==== EnableGameCard ====
No input/output.

==== DisableGameCard ====
No input/output.

==== EnableLocalContentShare ====
No input/output.

==== DisableLocalContentShare ====
No input/output.

==== IsApplicationIconHidden ====
No input, returns an output bool.

==== IsApplicationTitleHidden ====
No input, returns an output bool.

==== IsGameCardEnabled ====
No input, returns an output bool.

==== IsLocalContentShareEnabled ====
No input, returns an output bool.

Various Deliver cmds now run essentially the same code as IsLocalContentShareEnabled, with an error being returned when it's not enabled.

==== Cmd4026 ====
Takes an input u64, returns an [[#IHostSession|IHostSession]].

The input u64 must match a state field.

This initializes [[LDN_services|ldn]] etc, and creates a network.

==== Cmd4027 ====
Takes an input u64, returns an [[#IClientSession|IClientSession]].

The input u64 must match a state field.

This initializes [[LDN_services|ldn]] etc.

=== IGameCardStopper ===
This is "nn::ns::detail::IGameCardStopper".

This interface has no commands.

=== IRequestServerStopper ===
This is "nn::ns::detail::IRequestServerStopper".

This interface has no commands.

=== IProgressMonitorForDeleteUserSaveDataAll ===
This is "nn::ns::detail::IProgressMonitorForDeleteUserSaveDataAll".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetSystemEvent
|-
| 1 || IsFinished
|-
| 2 || GetResult
|-
| 10 || GetProgress
|}

When closing the object, official sw uses IsFinished first, asserting when the output bool is false.

* GetSystemEvent: No input, returns an output Event handle. [[qlaunch]] doesn't use this.

* IsFinished: No input, returns an output u8 bool.

* GetResult: No input/output.

* GetProgress: No input, returns an output [[#ProgressForDeleteUserSaveDataAll]]. Official sw writes this struct directly to object state.

=== IProgressAsyncResult ===
This is "nn::ns::detail::IProgressAsyncResult".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Get
|-
| 1 || Cancel
|-
| 2 || GetProgress
|-
| 3 || GetDetailResult
|-
| 4 || [4.0.0+] GetErrorContext
|}

=== IHostSession ===
This is "nn::ns::vphym::detail::IHostSession".

This was added with [20.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 ||
|-
| 1 ||
|-
| 2 ||
|}

==== Cmd0 ====
No input, returns an output Event handle and an [[#IAsyncValue]].

The async task does the following:
* This waits for a client to connect.
* The [[LDN_services|NodeInfo]] UserName is converted into two u64s, which are used to locate a state entry with matching values.
* The client [[LDN_services|NodeInfo]] Ipv4Address is copied into state.
* Then a ptr to the above located state entry is also written into state.

==== Cmd1 ====
No input, returns an output Event handle and an [[#IAsyncResult]].

The async task uses [[NIM_services|nim]] cmd2018 or cmd2027, depending on a state field. Once finished when a state flag is set, [[LDN_services|ldn]] is finalized and that state flag is cleared.

==== Cmd2 ====
No input, returns an output Event handle and an [[#IAsyncResult]].

The async task uses [[NIM_sevices|nim]] cmd2024.

=== IClientSession ===
This is "nn::ns::vphym::detail::IClientSession".

This was added with [20.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 ||
|-
| 1 ||
|-
| 2 ||
|}

==== Cmd0 ====
No input, returns an output Event handle and an [[#IAsyncValue]].

The async task does the following:
* Uses [[LDN_services|ldn]] Scan.
* After a [[LDN_services|NodeInfo]] is found with a matching UserName, the Ipv4Address for it is copied into state.
* If a timeout didn't occur and a valid NodeInfo was found, it proceeds with connecting to the network.

==== Cmd1 ====
No input, returns an output Event handle and an [[#IAsyncResult]].

The async task uses [[NIM_services|nim]] cmd2019 or cmd2028, depending on a state field. Once finished when a state flag is set, [[LDN_services|ldn]] is finalized and that state flag is cleared.

==== Cmd2 ====
No input, returns an output Event handle and an [[#IAsyncResult]].

This is identical to [[#IHostSession|IHostSession]] Cmd2.

=== IApplicationVersionInterface ===
This is "nn::ns::detail::IApplicationVersionInterface".

This was added with [4.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetLaunchRequiredVersion
|-
| 1 || UpgradeLaunchRequiredVersion
|-
| 35 || UpdateVersionList
|-
| 36 || PushLaunchVersion
|-
| 37 || ListRequiredVersion
|-
| 38 || [22.0.0+]
|-
| 800 || RequestVersionList
|-
| 801 || ListVersionList
|-
| 802 || [[#RequestVersionListData]]
|-
| 900 || [12.0.0+] ImportAutoUpdatePolicyJsonForDebug
|-
| 901 || [12.0.0+] ListDefaultAutoUpdatePolicy
|-
| 902 || [12.0.0+] ListAutoUpdatePolicyForSpecificApplication
|-
| 1000 || PerformAutoUpdate
|-
| 1001 || [11.0.0+] ListAutoUpdateSchedule
|}

==== RequestVersionListData ====
No input, returns an output Event handle and an [[#IAsyncValue]].

The data that can be read from the [[#IAsyncValue]] is [[#VersionListData]].

=== IContentManagementInterface ===
This is "nn::ns::detail::IContentManagementInterface".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 11 || [[#CalculateApplicationOccupiedSize]]
|-
| 43 || [[#CheckSdCardMountStatus]]
|-
| 47 || [[#GetTotalSpaceSize]]
|-
| 48 || [[#GetFreeSpaceSize]]
|-
| 58 || [20.1.0+]
|-
| 71 || [20.1.0+]
|-
| 600 || [[#CountApplicationContentMeta]]
|-
| 601 || [[#ListApplicationContentMetaStatus]]
|-
| 605 || [[#ListApplicationContentMetaStatusWithRightsCheck]]
|-
| 607 || [[#IsAnyApplicationRunning]]
|-
| 608 || [21.0.0+]
|}

==== CalculateApplicationOccupiedSize ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output [[#ApplicationOccupiedSize]].

==== CheckSdCardMountStatus ====
No input/output.

==== CountApplicationContentMeta ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output s32.

==== ListApplicationContentMetaStatusWithRightsCheck ====
Same input/output as [[#ListApplicationContentMetaStatus]].

==== IsAnyApplicationRunning ====
No input, returns an output u8 bool.

=== IDocumentInterface ===
This is "nn::ns::detail::IDocumentInterface".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 21 || GetApplicationContentPath
|-
| 23 || ResolveApplicationContentPath
|-
| 92 || [5.0.0+] GetRunningApplicationProgramId
|-
| 100 || [S2]
|-
| 101 || [S2]
|-
| 2524 || [19.0.0+]
|}

==== Cmd100 ====
Takes a type-0x16 output buffer containing a 0x300-byte struct, an input u8, an u64. Returns two output u8s.

==== Cmd101 ====
Takes a type-0x16 output buffer containing a 0x300-byte struct, an input u8, an u64. Returns an output u8, an u8 [[Filesystem_services|ContentAttributes]], and a [[NCM_services#ProgramId|ProgramId]].

This is similar to Cmd2524. On [S2] this is used instead of Cmd2524.

==== Cmd2524 ====
Takes a type-0x16 output buffer containing a 0x300-byte struct, an input u8, an u64. Returns an output u8 [[Filesystem_services|ContentAttributes]] and a [[NCM_services#ProgramId|ProgramId]].

The user-process uses the output from this as the input for [[Filesystem_services|OpenFileSystemWithId]] (out-buffer is used as the [[Filesystem_services|FspPath]]).

=== IDownloadTaskInterface ===
This is "nn::ns::detail::IDownloadTaskInterface".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 701 || [[#ClearTaskStatusList]]
|-
| 702 || [[#RequestDownloadTaskList]]
|-
| 703 || [[#RequestEnsureDownloadTask]]
|-
| 704 || [[#ListDownloadTaskStatus]]
|-
| 705 || [[#RequestDownloadTaskListData]]
|-
| 706 || [4.0.0+] [[#TryCommitCurrentApplicationDownloadTask]]
|-
| 707 || [4.0.0+] [[#EnableAutoCommit]]
|-
| 708 || [4.0.0+] [[#DisableAutoCommit]]
|-
| 709 || [4.0.0+] [[#TriggerDynamicCommitEvent]]
|-
| 710 || [20.0.0+]
|}

==== ClearTaskStatusList ====
No input/output.

==== RequestDownloadTaskList ====
No input/output.

==== RequestEnsureDownloadTask ====
No input, returns an output Event handle and an [[#IAsyncResult]].

==== ListDownloadTaskStatus ====
Takes a type-0x6 output buffer containing an array of [[#DownloadTaskStatus]], returns an output s32 total_out.

A maximum of 0x100 tasks can be stored in state.

==== TryCommitCurrentApplicationDownloadTask ====
No input/output.

==== EnableAutoCommit ====
No input/output.

==== DisableAutoCommit ====
No input/output.

==== TriggerDynamicCommitEvent ====
No input/output.

=== IReadOnlyApplicationRecordInterface ===
This is "nn::ns::detail::IReadOnlyApplicationRecordInterface".

This was added with [5.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || HasApplicationRecord || Same as [[#IApplicationManagerInterface]] cmd 910
|-
| 1 || [10.0.0+] NotifyApplicationFailure ||
|-
| 2 || [10.0.0+] IsDataCorruptedResult ||
|-
| 3 || [20.0.0+] [[#ListApplicationRecord|ListApplicationRecord]] ||
|}

=== IReadOnlyApplicationControlDataInterface ===
This is "nn::ns::detail::IReadOnlyApplicationControlDataInterface".

This was added with [5.1.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || [[#GetApplicationControlData]] || Same as [[#IApplicationManagerInterface]] cmd 400
|-
| 1 || [[#GetApplicationDesiredLanguage]] || Same as [[#IApplicationManagerInterface]] cmd 55
|-
| 2 || ConvertApplicationLanguageToLanguageCode || Same as [[#IApplicationManagerInterface]] cmd 59
|-
| 3 || [[#ConvertLanguageCodeToApplicationLanguage]] || Same as [[#IApplicationManagerInterface]] cmd 60
|-
| 4 || [9.0.0+] SelectApplicationDesiredLanguage ||
|-
| 5 || [19.0.0+] || Same as [[#IApplicationManagerInterface]] cmd 411
|-
| 6 || [19.0.0+] || Same as [[#IApplicationManagerInterface]] cmd 416
|-
| 7 || [20.0.0+] || Same as [[#IApplicationManagerInterface]] cmd 921
|-
| 8 || [20.0.0+] || Same as [[#IApplicationManagerInterface]] cmd 922
|-
| 9 || [20.0.0+] || Same as [[#IApplicationManagerInterface]] cmd 923
|-
| 10 || [20.0.0+] || Same as [[#IApplicationManagerInterface]] cmd 421
|-
| 11 || [20.0.0+] || Same as [[#IApplicationManagerInterface]] cmd 422
|-
| 12 || [20.0.0+] || Same as [[#IApplicationManagerInterface]] cmd 423
|-
| 13 || [20.0.0+] || Same as [[#IApplicationManagerInterface]] cmd 407
|-
| 14 || [20.0.0+] || Same as [[#IApplicationManagerInterface]] cmd 408
|-
| 15 || [20.0.0+] || Same as [[#IApplicationManagerInterface]] cmd 415
|-
| 16 || [20.0.0+] ||
|-
| 17 || [20.1.0+] || Same as [[#IApplicationManagerInterface]] cmd 933
|-
| 18 || [21.0.0+] ||
|-
| 19 || [21.0.0+] ||
|-
| 20 || [21.0.0+] ||
|-
| 21 || [21.0.0+] ||
|-
| 22 || [21.0.0+] ||
|}

=== IDynamicRightsInterface ===
This is "nn::ns::detail::IDynamicRightsInterface".

This was added with [6.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#RequestApplicationRightsOnServer]]
|-
| 1 || [[#RequestAssignRights]]
|-
| 4 || [[#DeprecatedRequestAssignRightsToResume]]
|-
| 5 || [[#VerifyActivatedRightsOwners]]
|-
| 6 || [[#DeprecatedGetApplicationRightsStatus]]
|-
| 7 || [[#RequestPrefetchForDynamicRights]]
|-
| 8 || [[#GetDynamicRightsState]]
|-
| 9 || [7.0.0+] [[#RequestApplicationRightsOnServerToResume]]
|-
| 10 || [7.0.0+] [[#RequestAssignRightsToResume]]
|-
| 11 || [7.0.0+] [[#GetActivatedRightsUsers]]
|-
| 12 || [8.0.0+] [[#GetApplicationRightsStatus]]
|-
| 13 || [8.0.0+] [[#GetRunningApplicationStatus]]
|-
| 14 || [10.0.0-15.0.1] SelectApplicationLicense
|-
| 15 || [12.0.0+] [[#RequestContentsAuthorizationToken]]
|-
| 16 || [13.0.0+] QualifyUser
|-
| 17 || [13.0.0+] QualifyUserWithProcessId
|-
| 18 || [13.0.0+] NotifyApplicationRightsCheckStart
|-
| 19 || [13.0.0+] UpdateUserList
|-
| 20 || [13.0.0+] IsRightsLostUser
|-
| 21 || [13.1.0+] SetRequiredAddOnContentsOnContentsAvailabilityTransition
|-
| 22 || [14.0.0+] GetLimitedApplicationLicense
|-
| 23 || [14.0.0+] GetLimitedApplicationLicenseUpgradableEvent
|-
| 24 || [14.0.0+] NotifyLimitedApplicationLicenseUpgradableEventForDebug
|-
| 25 || [14.0.0+] RequestProceedDynamicRightsState
|-
| 26 || [18.0.0+] HasAccountRestrictedRightsInRunningApplications
|-
| 27 || [20.0.0+]
|-
| 28 || [20.0.0+]
|-
| 29 || [21.0.0+]
|-
| 30 || [21.0.0+]
|}

==== RequestApplicationRightsOnServer ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], an [[Account_services#Uid|Uid]] and an u32. Returns an output Event handle and an [[#IAsyncValue]].

==== RequestAssignRights ====
Takes a type-0x5 input buffer containing an array of "nn::ns::ApplicationRightsOnServer". Returns an output Event handle and an [[#IAsyncResult]].

==== DeprecatedRequestAssignRightsToResume ====
Takes an input u64 "nn::ns::RightsEnvironmentHandle" and an [[Account_services#Uid|Uid]]. Returns an output Event handle and an [[#IAsyncResult]].

==== VerifyActivatedRightsOwners ====
Takes an input u64 "nn::ns::RightsEnvironmentHandle". No output.

==== DeprecatedGetApplicationRightsStatus ====
Takes an input u64 "nn::ns::RightsEnvironmentHandle". Returns a bool "nn::ns::ApplicationRightsStatus".

==== RequestPrefetchForDynamicRights ====
Takes an input [[Account_services#Uid|Uid]]. Returns an output Event handle and an [[#IAsyncResult]].

==== GetDynamicRightsState ====
No input. Returns a bool "nn::ns::DynamicRightsState".

==== RequestApplicationRightsOnServerToResume ====
Takes an input u64 "nn::ns::RightsEnvironmentHandle". Returns an output Event handle and an [[#IAsyncValue]].

==== RequestAssignRightsToResume ====
Takes an input u64 "nn::ns::RightsEnvironmentHandle". Returns an output Event handle and an [[#IAsyncResult]].

==== GetActivatedRightsUsers ====
Takes an input u64 "nn::ns::RightsEnvironmentHandle". Returns a bool, an u32 and a type-0x6 output buffer containing an array of [[Account_services#Uid|Uid]].

==== GetApplicationRightsStatus ====
Takes an input "nn::ns::RightsEnvironmentHandle". Returns 2 bools "nn::ns::ApplicationRightsStatus" and "nn::ns::ApplicationLicenseType".

==== GetRunningApplicationStatus ====
Takes an input u64 "nn::ns::RightsEnvironmentHandle". Returns an u32 "nn::ns::RunningApplicationStatus".

==== RequestContentsAuthorizationToken ====
Takes a total of 0x50-bytes of input, a type-0x5 input buffer. Returns an [[#IAsyncData_2|IAsyncData]] and an output handle.

==== IAsyncData ====
This is "nn::ns::detail::IAsyncData".

This was added with [12.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetSize
|-
| 1 || Get
|-
| 2 || Cancel
|-
| 3 || GetErrorContext
|}

=== IECommerceInterface===
This is "nn::ns::detail::IECommerceInterface".

This was added with [4.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#RequestLinkDevice]]
|-
| 1 || [6.0.0+] [[#RequestCleanupAllPreInstalledApplications]]
|-
| 2 || [6.0.0+] [[#RequestCleanupPreInstalledApplication]]
|-
| 3 || [6.0.0+] [[#RequestSyncRights]]
|-
| 4 || [6.0.0+] [[#RequestUnlinkDevice]]
|-
| 5 || [6.1.0+] [[#RequestRevokeAllELicense]]
|-
| 6 || [9.0.0+] [[#RequestSyncRightsBasedOnAssignedELicenses]]
|-
| 7 || [14.0.0+] RequestOnlineSubscriptionFreeTrialAvailability
|-
| 8 || [20.0.0+]
|-
| 9 || [20.0.0+]
|-
| 10 || [20.0.0+]
|-
| 11 || [20.0.0+]
|-
| 12 || [20.0.0+]
|-
| 13 || [20.0.0+]
|-
| 14 || [21.0.0+]
|}

==== RequestLinkDevice ====
Takes an input [[Account_services#Uid|Uid]], returns an output Event handle and an [[#IAsyncResult]].

See [[#RequestApplicationUpdateInfo]] regarding nifm.

==== RequestCleanupAllPreInstalledApplications ====
No input, returns an output Event handle and an [[#IAsyncResult]].

==== RequestCleanupPreInstalledApplication ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IAsyncResult]].

==== RequestSyncRights ====
No input, returns an output Event handle and an [[#IAsyncResult]].

==== RequestUnlinkDevice ====
Takes an input [[Account_services#Uid|Uid]], returns an output Event handle and an [[#IAsyncResult]].

See [[#RequestApplicationUpdateInfo]] regarding nifm.

==== RequestRevokeAllELicense ====
Takes an input [[Account_services#Uid|Uid]], returns an output Event handle and an [[#IAsyncResult]].

==== RequestSyncRightsBasedOnAssignedELicenses ====
No input, returns an output Event handle and an [[#IAsyncResult]].

=== IFactoryResetInterface ===
This is "nn::ns::detail::IFactoryResetInterface".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 100 || [[#ResetToFactorySettings]]
|-
| 101 || [[#ResetToFactorySettingsWithoutUserSaveData]]
|-
| 102 || [[#ResetToFactorySettingsForRefurbishment]]
|-
| 103 || [9.1.0+] [[#ResetToFactorySettingsWithPlatformRegion]]
|-
| 104 || [9.1.0+] [[#ResetToFactorySettingsWithPlatformRegionAuthentication]]
|-
| 105 || [10.0.0+] [[#RequestResetToFactorySettingsSecurely]]
|-
| 106 || [10.0.0+] [[#RequestResetToFactorySettingsWithPlatformRegionAuthenticationSecurely]]
|-
| 107 || [20.0.0+]
|-
| 108 || [20.0.0+]
|}

==== ResetToFactorySettings ====
No input/output.

As of [9.1.0] this is the only [[#IFactoryResetInterface]] cmd used by [[qlaunch]].

==== ResetToFactorySettingsWithoutUserSaveData ====
No input/output.

==== ResetToFactorySettingsForRefurbishment ====
No input/output.

==== ResetToFactorySettingsWithPlatformRegion ====
No input/output.

==== ResetToFactorySettingsWithPlatformRegionAuthentication ====
No input/output.

==== RequestResetToFactorySettingsSecurely ====
Takes an input u64 tmem_size, a TransferMemory handle, returns an output [[#IAsyncValueAndProgress]] and an Event handle.

The TransferMemory uses permissions=0.

==== RequestResetToFactorySettingsWithPlatformRegionAuthenticationSecurely ====
Takes an input u32 "nn::ae::PlatformRegion", an u64 tmem_size, a TransferMemory handle, returns an output [[#IAsyncValueAndProgress]] and an Event handle.

The TransferMemory uses permissions=0.

===== IAsyncValueAndProgress =====
This is "nn::ns::detail::IAsyncValueAndProgress".

This was added with [10.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetSize
|-
| 1 || Get
|-
| 2 || Cancel
|-
| 3 || GetErrorContext
|-
| 4 || GetProgress
|}

=== IApplicationResource ===
This is "nn::ns::detail::IApplicationResource".

This was added with [9.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Attach
|-
| 1 || BoostSystemMemoryResourceLimit
|}

= ns:vm =
This is "nn::ns::detail::IVulnerabilityManagerInterface".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 1200 || [3.0.0+] [[#NeedsUpdateVulnerability]]
|-
| 1201 || [4.0.0+] [[#UpdateSafeSystemVersionForDebug]]
|-
| 1202 || [4.0.0+] [[#GetSafeSystemVersion]]
|-
| 3100 || [18.0.0+] [[#GetSafeSystemVersionCheckInfo|GetSafeSystemVersionCheckInfo]]
|-
| 3101 || [18.0.0+] [[#RequestUpdateSafeSystemVersionCheckInfo|RequestUpdateSafeSystemVersionCheckInfo]]
|-
| 3102 || [18.0.0+] [[#ResetSafeSystemVersionCheckInfo|ResetSafeSystemVersionCheckInfo]]
|}

== NeedsUpdateVulnerability ==
No input, returns an output u8 bool flag.

[S1] Web-applets use this command to check if the system needs an update.

== UpdateSafeSystemVersionForDebug ==
Takes an input u32 '''version''' and an [[NCM_services#ApplicationId|ApplicationId]].

This command is not available for retail units. On a debug unit, if the [[System_Settings|system setting]] <code>vulnerability!enable_debug</code> is set, this mounts the system savegame [[Flash_Filesystem#System_Savegames|0x8000000000000049]] as "ns_ssversion:/", opens the file "ns_ssversion:/entry" and writes the supplied [[NCM_services#ApplicationId|ApplicationId]] and '''version''' in it.

Finally, it calls [[NCM_services#ncm|OpenContentMetaDatabase]] with [[NCM_services#StorageId|StorageId]] 3, then calls [[NCM_services#IContentMetaDatabase|GetLatestContentMetaKey]] with the supplied [[NCM_services#ApplicationId|ApplicationId]] and compares the version field from the returned [[CNMT#Content_Meta_Records|Content Meta Record]] with the supplied '''version'''.

If the supplied '''version''' is higher than the one in NCM's database, the value returned by [[NS_Services#NeedsUpdateVulnerability|NeedsUpdateVulnerability]] is set to "true".

== GetSafeSystemVersion ==
No input, returns an output [[NCM_services#ContentMetaKey|ContentMetaKey]] with the cached contents of "ns_ssversion:/entry" ([[NCM_services#ApplicationId|ApplicationId]], u32 '''version''' and u32 '''policy''' from <code>vulnerability!needs_update_vulnerability_policy</code>).

== GetSafeSystemVersionCheckInfo ==
No input, returns 0x10-bytes of output.

[22.0.0+] Now returns 0x20-bytes of output.

[S2] Used by web-applets via ns:vm.

== RequestUpdateSafeSystemVersionCheckInfo ==
No input, returns an output Event handle and an [[#IAsyncResult|IAsyncResult]].

[S2] Used by web-applets via ns:vm.

The async task thread uses [[NIM_services|nim]] RequestCheckSafeSystemVersion, etc.

== ResetSafeSystemVersionCheckInfo ==
No input/output.

This throws an error if [[Settings_services|GetDebugModeFlag]] returns false.

= ns:su =
This is "nn::ns::detail::ISystemUpdateInterface".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#GetBackgroundNetworkUpdateState]]
|-
| 1 || [[#OpenSystemUpdateControl]]
|-
| 2 || [[#NotifyExFatDriverRequired]]
|-
| 3 || [[#ClearExFatDriverStatusForDebug]]
|-
| 4 || [[#RequestBackgroundNetworkUpdate]]
|-
| 5 || [[#NotifyBackgroundNetworkUpdate]]
|-
| 6 || [[#NotifyExFatDriverDownloadedForDebug]]
|-
| 9 || [[#GetSystemUpdateNotificationEventForContentDelivery]]
|-
| 10 || [[#NotifySystemUpdateForContentDelivery]]
|-
| 11 || [3.0.0+] [[#PrepareShutdown]]
|-
| 12 || [3.0.0-3.0.2]
|-
| 13 || [3.0.0-3.0.2]
|-
| 14 || [3.0.0-3.0.2]
|-
| 15 || [3.0.0-3.0.2]
|-
| 16 || [4.0.0+] [[#DestroySystemUpdateTask]]
|-
| 17 || [4.0.0+] [[#RequestSendSystemUpdate]]
|-
| 18 || [4.0.0+] [[#GetSendSystemUpdateProgress]]
|-
| 19 || [S2]
|-
| 20 || [S2]
|}

== GetBackgroundNetworkUpdateState ==
No input, returns an output [[#BackgroundNetworkUpdateState]].

This is similar to [[#HasDownloaded]], see [[#BackgroundNetworkUpdateState]].

== OpenSystemUpdateControl ==
No input, returns an [[#ISystemUpdateControl]].

Only 1 ISystemUpdateControl can be open at a time.

== NotifyExFatDriverRequired ==
No input/output.

Only usable when an [[#ISystemUpdateControl]] isn't open.

This uses [[NIM_services|nim]] ListSystemUpdateTask, then when a task is returned uses it with DestroySystemUpdateTask.

Then this runs ExFat handling, updates state, and sets the same state flag as [[#RequestBackgroundNetworkUpdate]].

== ClearExFatDriverStatusForDebug ==
No input/output.

== RequestBackgroundNetworkUpdate ==
No input/output.

Only usable when an [[#ISystemUpdateControl]] isn't open.

This sets a state flag to value 1.

== NotifyBackgroundNetworkUpdate ==
Takes an input [[NCM_services#ContentMetaKey|ContentMetaKey]], no output.

This checks whether a sysupdate is needed with the input ContentMetaKey using [[NCM_services|NCM]] commands, if not this will just return 0. Otherwise, this will then run code which is identical to [[#RequestBackgroundNetworkUpdate]].

== NotifyExFatDriverDownloadedForDebug ==
No input/output.

== GetSystemUpdateNotificationEventForContentDelivery ==
No input, returns an output Event handle with EventClearMode=0.

== NotifySystemUpdateForContentDelivery ==
No input/output.

Signals the Event returned by [[#GetSystemUpdateNotificationEventForContentDelivery]].

== PrepareShutdown ==
No input/output.

This is used by [[AM_services|AM]].

Just returns 0 when an [[#ISystemUpdateControl]] is open.

This does various cleanup / uses various service-cmds etc for shutdown preparation.

== DestroySystemUpdateTask ==
No input/output.

Only usable when an [[#ISystemUpdateControl]] isn't open.

This uses [[NIM_services|nim]] ListSystemUpdateTask, then when a task is returned uses it with DestroySystemUpdateTask.

== RequestSendSystemUpdate ==
Takes a type-0x15 input buffer containing a [[#SystemDeliveryInfo]], an u16 port, an u32 Ipv4Address, returns an output Event handle and an [[#IAsyncResult]].

[[qlaunch]] uses value 55556 for the port. IP is normally a local-WLAN address, however this can be any address. port/addr are little-endian.

See [[NIM_services|nim]] regarding the input addr/port usage, etc.

[11.0.0+] An error is thrown if LocalContentShare is not [[#IsLocalContentShareEnabled|enabled]].

This validates the [[#SystemDeliveryInfo]] and generates a [[NCM_services#ContentMetaKey|ContentMetaKey]] from that, and creates the [[#IAsyncResult]] + the async thread which handles the [[#IAsyncResult]] operation.

The above validation verifies that the HMAC and SystemDeliveryProtocolVersion are valid. The OldSystemUpdateId ([20.0.0+] SystemUpdateId, SystemUpdateIdFlag ignored) must match the Id for the installed SystemUpdate as returned by [[NCM_services|ncm]].

Then the thread does:
* Calls a func which does:
** Uses [[NIM_services|nim]] CreateLocalCommunicationSendSystemUpdateTask, returning the Result on failure.
*** The input firmware_variation is from the [[#SystemDeliveryInfo|FirmwareVariationId]].
** Uses [[NIM_services|nim]] RequestLocalCommunicationSendSystemUpdateTaskRun, returning the Result on failure. Waits for the IAsyncResult operation from this to finish, then uses the Get cmd to get the output Result.
*** When the Result from Get is an error, a func is called for filling in the [[#IAsyncResult|IAsyncResult]] ErrorContext with Type4.
** Handles cleanup and returns.
* Unlike [[#RequestReceiveSystemUpdate]], this doesn't save a SystemPlayReport.

== GetSendSystemUpdateProgress ==
No input, returns an output [[#SystemUpdateProgress]].

Same as [[#GetReceiveProgress]] except this uses nim ListLocalCommunicationSendSystemUpdateTask and GetLocalCommunicationSendSystemUpdateTaskInfo. The data copied to output is also swapped: u64 nim_out+0x8 is copied to out+0x8, and u64 nim_out+0x10 is copied to out+0x0.

== Cmd19 ==
This is exclusive to S2.

No input/output.

== Cmd20 ==
This is exclusive to S2.

No input, returns an output u8.

== ISystemUpdateControl ==
This is "nn::ns::detail::ISystemUpdateControl".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#HasDownloaded]]
|-
| 1 || [[#RequestCheckLatestUpdate]]
|-
| 2 || [[#RequestDownloadLatestUpdate]]
|-
| 3 || [[#GetDownloadProgress]]
|-
| 4 || [[#ApplyDownloadedUpdate]]
|-
| 5 || [[#RequestPrepareCardUpdate]]
|-
| 6 || [[#GetPrepareCardUpdateProgress]]
|-
| 7 || [[#HasPreparedCardUpdate]]
|-
| 8 || [[#ApplyCardUpdate]]
|-
| 9 || [[#GetDownloadedEulaDataSize]]
|-
| 10 || [[#GetDownloadedEulaData]]
|-
| 11 || [[#SetupCardUpdate]]
|-
| 12 || [[#GetPreparedCardUpdateEulaDataSize]]
|-
| 13 || [[#GetPreparedCardUpdateEulaData]]
|-
| 14 || [4.0.0+] [[#SetupCardUpdateViaSystemUpdater]]
|-
| 15 || [4.0.0+] [[#HasReceived]]
|-
| 16 || [4.0.0+] [[#RequestReceiveSystemUpdate]]
|-
| 17 || [4.0.0+] [[#GetReceiveProgress]]
|-
| 18 || [4.0.0+] [[#ApplyReceivedUpdate]]
|-
| 19 || [4.0.0+] [[#GetReceivedEulaDataSize]]
|-
| 20 || [4.0.0+] [[#GetReceivedEulaData]]
|-
| 21 || [4.0.0+] [[#SetupToReceiveSystemUpdate]]
|-
| 22 || [6.0.0+] [[#RequestCheckLatestUpdateIncludesRebootlessUpdate]]
|}

All Card cmds except SetupCardUpdate* require [[#SetupCardUpdate]]/[[#SetupCardUpdateViaSystemUpdater]] to be used previously. [[#GetPreparedCardUpdateEulaDataSize]]/[[#GetPreparedCardUpdateEulaData]] checks a different state flag.

=== HasDownloaded ===
No input, returns an output u8 bool flag.

Gets whether a network sysupdate was downloaded, with install pending.

Uses [[NIM_services|nim]] ListSystemUpdateTask and [[NIM_services|nim]] GetSystemUpdateTaskInfo. When ListSystemUpdateTask successfully returns a task and GetSystemUpdateTaskInfo is successful, the output flag is set to: <code>*((u8*)(taskinfo+0) == 0x3</code>. Otherwise, flag=0.

This always returns 0, however this will assert if GetSystemUpdateTaskInfo fails with ret!=0x3C89.

=== RequestCheckLatestUpdate ===
No input, returns an output Event handle and an [[#IAsyncValue]].

The data that can be read from the [[#IAsyncValue]] is [[#LatestSystemUpdate]].

=== RequestDownloadLatestUpdate ===
No input, returns an output Event handle and an [[#IAsyncResult]].

=== GetDownloadProgress ===
No input, returns an output [[#SystemUpdateProgress]].

Similar to [[#HasDownloaded]] except instead of a flag, this returns the 0x10-bytes from taskinfo+8. The output struct is cleared when the task(info) isn't available.

=== ApplyDownloadedUpdate ===
No input/output.

Runs code similar to [[#HasDownloaded]], throwing an error if a network sysupdate isn't ready for install. Then the sysupdate is installed:

* Uses ListSystemUpdateTask again, then [[NIM_services|nim]] IsExFatDriverIncluded. Runs ExFat handling when the output flag is set.
* On newer system-versions, this uses [[NIM_services|nim]] GetSystemUpdateTaskInfo then on success uses data from there to save a SystemPlayReport when the cached [[System_Settings|system-setting]] "systemreport!enabled" is set.
** The EventId is "systemupdate_dl_throughput" with ApplicationId 0100000000001018.
** The following fields are added to the report, see [[NIM_services#SystemUpdateTaskInfo|nim SystemUpdateTaskInfo]]: "ContentMetaId", "Version", "DownloadSize", and "ThroughputKBps".
* On newer system-versions, this saves another SystemPlayReport when a state flag is set (same flag mentioned above).
** The EventId is "systemupdate_pass" with ApplicationId 0100000000001021.
** This report has the following fields:
*** "Type"
*** "SourceSystemUpdateMetaId"
*** "SourceSystemUpdateMetaVersion"
*** "SourceExFatStatus"
*** "DestinationSystemUpdateMetaId"
*** "DestinationSystemUpdateMetaVersion"
*** "DestinationExFatStatus"
*** "Rebootless"
* Since BootImagePackage will be installed later, the two flags in [[Flash_Filesystem#System_Update_Control]] are set to 1.
* Uses [[NIM_services|nim]] CommitSystemUpdateTask and [[NIM_services|nim]] DestroySystemUpdateTask.
* Installs BootImagePackage. After installing each BootImagePackage, the associated flag in [[Flash_Filesystem#System_Update_Control]] is set to 0.
* On newer system versions when an input flag is set, this uses [[Filesystem_services|NotifySystemDataUpdateEvent]], however this doesn't happen with ApplyDownloadedUpdate since that input flag is 0.

=== RequestPrepareCardUpdate ===
No input, returns an output Event handle and an [[#IAsyncResult]].

=== GetPrepareCardUpdateProgress ===
No input, returns an output [[#SystemUpdateProgress]].

=== HasPreparedCardUpdate ===
No input, returns an output u8 bool flag.

=== ApplyCardUpdate ===
No input/output.

=== GetDownloadedEulaDataSize ===
Takes a type-0x15 input buffer [[#EulaDataPath]], returns an output u64 '''filesize'''.

Runs code similar to [[#HasDownloaded]], throwing an error if a network sysupdate isn't ready for install.

Uses ListSystemUpdateTask again. Then [[NIM_services|nim]] GetDownloadedSystemDataPath, with the output ContentPath being used to mount the EULA title with FS.

Then "<mountname>:/<[[#EulaDataPath]]>" is opened, gets the '''filesize''', then runs cleanup.

=== GetDownloadedEulaData ===
Takes a type-0x15 input buffer [[#EulaDataPath]] and a type-0x6 output buffer, returns an output u64 '''filesize'''.

Similar to [[#GetDownloadedEulaDataSize]] except this reads the file instead, using the specified output buffer with size=filesize. This will throw an error if the filesize is larger than the buffer size.

=== SetupCardUpdate ===
Takes an input u64 size and a TransferMemory handle, no output.

Official sw creates the TransferMemory with an user-specified buffer, with permissions=None.

[[qlaunch]] uses size 0x100000 for the TransferMemory buffer.

=== GetPreparedCardUpdateEulaDataSize ===
Takes a type-0x15 input buffer [[#EulaDataPath]], returns an output u64 '''filesize'''.

This is similar to [[#GetDownloadedEulaDataSize]].

=== GetPreparedCardUpdateEulaData ===
Takes a type-0x15 input buffer [[#EulaDataPath]] and a type-0x6 output buffer, returns an output u64 '''filesize'''.

This is similar to [[#GetDownloadedEulaData]].

=== SetupCardUpdateViaSystemUpdater ===
Takes an input u64 size and a TransferMemory handle, no output.

The permissions for the TransferMemory is None.

Same as [[#SetupCardUpdate]], except this doesn't have the code for [[Filesystem_services|GetGameCardHandle/GetGameCardUpdatePartitionInfo]], and uses [[Filesystem_services|OpenRegisteredUpdatePartition]] instead of [[Filesystem_services|OpenGameCardFileSystem]]. This uses the same is_initialized bool state flag.

=== HasReceived ===
No input, returns an output u8 bool.

Same as [[#HasDownloaded]] except this uses [[NIM_services|nim]] ListLocalCommunicationReceiveSystemUpdateTask and GetLocalCommunicationReceiveSystemUpdateTaskInfo.

=== RequestReceiveSystemUpdate ===
Takes a type-0x15 input buffer containing a [[#SystemDeliveryInfo]], an u16 port, an u32 Ipv4Address, returns an output Event handle and an [[#IAsyncResult]].

[[qlaunch]] uses the same value for the port as [[#RequestSendSystemUpdate]] (see [[#RequestSendSystemUpdate]] for addr as well).

See [[NIM_services|nim]] regarding the input addr/port usage, etc.

This uses the same LocalContentShare check as [[#RequestSendSystemUpdate|RequestSendSystemUpdate]].

An error is thrown if a state flag is clear.

This validates the [[#SystemDeliveryInfo]] (same as [[#RequestSendSystemUpdate|RequestSendSystemUpdate]]) and generates a [[NCM_services#ContentMetaKey|ContentMetaKey]] from that, and creates the [[#IAsyncResult]] + the async thread which handles the [[#IAsyncResult]] operation.

Then the thread does:

* Calls a func which does:
** Throws an error if [[NIM_services#ListSystemUpdateTask|ListSystemUpdateTask]] returns any task.
** Checks whether a sysupdate is actually required using the previously generated [[NCM_services#ContentMetaKey|ContentMetaKey]] (this func is also passed the below statefield as the last param), throwing an error if not.
*** [20.0.0+] The above check-sysupdate func was updated (which is also used elsewhere), flag handling during the loop was updated (which uses the last input param).
** Uses [[NIM_services|nim]] CreateLocalCommunicationReceiveSystemUpdateTask, returning the Result on failure.
*** The input firmware_variation is from [[System_Settings|system-setting]] <code>ns.systemupdate!firmware_variation</code> or <code>ns.systemupdate!t_firmware_variation</code>, depending on the [[Settings_services|PlatformRegion]] (value 0xFF is used when the output setting-size is invalid).
*** The input '''unk''' is set to: <code>unk = statefield == 0 ? 0x4 : 0xC</code> ([20.0.0+] uses statefield & 1 == 0). [20.0.0+] Additional data is now ORRed with unk afterwards: <code>unk |= ((statefield>>1) & 0x3) << 8;</code> (same statefield as before)
** Uses [[NIM_services|nim]] RequestLocalCommunicationReceiveSystemUpdateTaskRun, returning the Result on failure. Waits for the IAsyncResult operation from this to finish, then uses the Get cmd to get the output Result.
*** When the Result from Get is an error, a func is called for filling in the [[#IAsyncResult|IAsyncResult]] ErrorContext with Type4.
** Handles cleanup and returns.
* On success, this loads various data which is then used for saving a SystemPlayReport when the cached [[System_Settings|system-setting]] "systemreport!enabled" is set.
** The EventId is "receive_system_update" with ApplicationId <NS ProgramId>.
** This report has the following fields:
*** "SourceSystemUpdateId"
*** "DestinationSystemUpdateId"
*** "SourceSystemUpdateVersion"
*** "DestinationSystemUpdateVersion"
*** "SenderFirmwareVariationId"
*** "ReceiverFirmwareVariationId"
*** "SenderPlatformRegion"
*** "ReceiverPlatformRegion"
*** "SenderHasExFat"
*** "ReceiverHasExFat"
*** "Size"
*** "ThroughputKBps"

=== GetReceiveProgress ===
No input, returns an output [[#SystemUpdateProgress]].

Same as [[#GetDownloadProgress]] except this uses [[NIM_services|nim]] ListLocalCommunicationReceiveSystemUpdateTask and GetLocalCommunicationReceiveSystemUpdateTaskInfo.

=== ApplyReceivedUpdate ===
No input/output.

This uses the same LocalContentShare check as [[#RequestSendSystemUpdate|RequestSendSystemUpdate]].

=== GetReceivedEulaDataSize ===
Takes a type-0x15 input buffer [[#EulaDataPath]], returns an output u64 '''filesize'''.

This is similar to [[#GetDownloadedEulaDataSize]].

=== GetReceivedEulaData ===
Takes a type-0x15 input buffer [[#EulaDataPath]] and a type-0x6 output buffer, returns an output u64 '''filesize'''.

This is similar to [[#GetDownloadedEulaData]].

=== SetupToReceiveSystemUpdate ===
No input/output.

This just uses [[NIM_services|nim]] ListSystemUpdateTask, then when a task is returned uses it with DestroySystemUpdateTask.

[[qlaunch]] uses this before [[#RequestReceiveSystemUpdate]].

=== RequestCheckLatestUpdateIncludesRebootlessUpdate ===
No input, returns an output Event handle and an [[#IAsyncValue]].

= IAsyncValue =
This is "nn::ns::detail::IAsyncValue".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetSize
|-
| 1 || Get
|-
| 2 || Cancel
|-
| 3 || [4.0.0+] GetErrorContext
|}

Official sw creates a container object for this using the output from the service commands, which contains the IAsyncValue object, and the Event with EventClearMode=0.

* GetSize: No input, returns an output u64.
* Get: Takes a type-0x6 output buffer, no output. Official sw waits on the Event prior to using this cmd.
* Cancel: No input/output. Used by official sw when closing the object, when the serv-obj is initialized (after using the cmd, official sw will also wait on the Event). This cmd is also used in other official sw funcs.
* GetErrorContext: No input/output, takes a type-0x16 output buffer containing an [[Error_Applet#ErrorContext|ErrorContext]].

= IAsyncResult =
This is "nn::ns::detail::IAsyncResult".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Get
|-
| 1 || Cancel
|-
| 2 || [4.0.0+] GetErrorContext
|}

Official sw creates a container object for this using the output from the service commands, which contains the IAsyncResult object, and the Event with EventClearMode=0.

* Get: No input/output. Official sw waits on the Event prior to using this cmd.
* Cancel: No input/output. Used by official sw when closing the object, when the serv-obj is initialized (after using the cmd, official sw will also wait on the Event). This cmd is also used in other official sw funcs.
* GetErrorContext: No input/output, takes a type-0x16 output buffer containing an [[Error_Applet#ErrorContext|ErrorContext]].

= ns:dev =
This is "nn::ns::detail::IDevelopInterface".

[10.0.0+] Some of these cmds were replaced by the [[PGL_services|pgl]] system module.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [1.0.0-9.2.0] [[#LaunchProgram]]
|-
| 1 || [[#TerminateProcess]]
|-
| 2 || [1.0.0-9.2.0] [[#TerminateProgram]]
|-
| 4 || [1.0.0-9.2.0] [[#GetShellEvent]]
|-
| 5 || [1.0.0-9.2.0] [[#GetShellEventInfo]]
|-
| 6 || [[#TerminateApplication]]
|-
| 7 || [1.0.0-9.2.0] [[#PrepareLaunchProgramFromHost]]
|-
| 8 || [10.0.0-17.0.1] [[#LaunchApplicationFromHost]] ([1.0.0-9.2.0] LaunchApplication)
|-
| 9 || [1.0.0-17.0.1] [[#LaunchApplicationWithStorageId]]
|-
| 10 || [6.0.0-8.1.0] [[#IsSystemMemoryResourceLimitBoosted]]
|-
| 11 || [6.0.0+] [[#GetRunningApplicationProcessId]]
|-
| 12 || [6.0.0+] [[#SetCurrentApplicationRightsEnvironmentCanBeActive]]
|-
| 13 || [9.0.0+] [[#CreateApplicationResource]]
|-
| 14 || [9.0.0+] [[#IsPreomia]]
|-
| 15 || [10.0.0-17.0.1] [[#GetApplicationProgramIdFromHost]]
|-
| 16 || [12.0.0+] RefreshCachedDebugValues
|-
| 17 || [12.0.0+] [[#PrepareLaunchApplicationFromHost]]
|-
| 18 || [12.0.0+] [[#GetLaunchEvent]]
|-
| 19 || [12.0.0+] [[#GetLaunchResult]]
|-
| 20 || [14.0.0+] GetProgramId
|-
| 21 || [18.0.0+] [[#PrepareLaunchApplication]]
|-
| 22 || [18.0.0+] [[#LaunchApplication]]
|-
| 23 || [18.0.0+] [[#GetProgramIdByApplicationLaunchInfo]]
|-
| 24 || [18.0.0+] DestroyApplicationLaunchPreparation
|}

== LaunchProgram ==
Wrapper for "pm:shell" [[Process_Manager_services#pm:shell|LaunchProcess]].

== TerminateProcess ==
Wrapper for "pm:shell" [[Process_Manager_services#pm:shell|TerminateProcess]].

== TerminateProgram ==
Wrapper for "pm:shell" [[Process_Manager_services#pm:shell|TerminateProgram]].

== GetShellEvent ==
Wrapper for "pm:shell" [[Process_Manager_services#pm:shell|GetProcessEventHandle]].

== GetShellEventInfo ==
Wrapper for "pm:shell" [[Process_Manager_services#pm:shell|GetProcessEventInfo]].

== TerminateApplication ==
Calls "pm:shell" [[Process_Manager_services#pm:shell|GetApplicationProcessIdForShell]] and sends the ProcessId to [[Process_Manager_services#pm:shell|TerminateProcess]].

== PrepareLaunchProgramFromHost ==
Takes a type-0x5 input buffer containing the [[Filesystem_services#FspPath|FspPath]], returns an output 0x10-byte struct.

Calls [[NCM_services#IPathResolverForStorage|IPathResolverForStorage]] Set...NcaPath functions.

== LaunchApplicationFromHost ==
Takes an input u32 [[Process_Manager_services#LaunchFlags|LaunchFlags]] and a type-0x5 input buffer containing the [[Filesystem_services#FspPath|FspPath]]. Returns an output u64 ProcessId.

== LaunchApplicationWithStorageId ==
Takes 2 input u8 [[NCM_services#StorageId|StorageIds]], an u32 [[Process_Manager_services#LaunchFlags|LaunchFlags]], and an [[NCM_services#ApplicationId|ApplicationId]]. Returns an output u64 ProcessId.

Launches an application title which is registered with NS.

== IsSystemMemoryResourceLimitBoosted ==
No input. Returns a bool.

== GetRunningApplicationProcessId ==
Returns an output u64 ProcessId.

== SetCurrentApplicationRightsEnvironmentCanBeActive ==
Takes an input bool. No output.

== CreateApplicationResource ==
Takes an input u32 (1 = Preomia/MicroApplication). Returns an [[#IApplicationResource]].

== IsPreomia ==
Takes an input u64 [[NCM_services#ProgramId|ProgramId]]. Returns a bool.

== GetApplicationProgramIdFromHost ==
Takes a type-0x5 input buffer containing the [[Filesystem_services#FspPath|FspPath]]. Returns an u64 [[NCM_services#ProgramId|ProgramId]].

== PrepareLaunchApplicationFromHost ==
[18.0.0+] Now returns a total of 0x50 bytes of output.

[19.0.0+] Now returns a total of 0x80 bytes of output.

== GetLaunchEvent ==
[18.0.0+] Now takes a total of 0x50 bytes of input.

[19.0.0+] Now takes a total of 0x80 bytes of input.

== GetLaunchResult ==
[18.0.0+] Now takes a total of 0x50 bytes of input.

[19.0.0+] Now takes a total of 0x80 bytes of input.

== PrepareLaunchApplication ==
Takes a total of 0x10-bytes of input. Returns a total of 0x50-bytes of output.

[19.0.0+] Now returns a total of 0x80-bytes of output.

== LaunchApplication ==
Takes a total of 0x50-bytes of input. Returns a total of 8-bytes of output.

[19.0.0+] Now takes a total of 0x80 bytes of input.

== GetProgramIdByApplicationLaunchInfo ==
Takes a total of 0x50-bytes of input. Returns a total of 8-bytes of output.

[19.0.0+] Now takes a total of 0x80 bytes of input.

= acc:su =
This is "nn::account::IAccountServiceForAdministrator".

[13.0.0+] This was moved from [[Account_services|account]].

This is only available when the output from [[Process_Manager_services|pm:bm]] GetBootMode is Normal/Maintenance.

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || GetUserCount ||
|-
| 1 || GetUserExistence ||
|-
| 2 || ListAllUsers ||
|-
| 3 || ListOpenUsers ||
|-
| 4 || GetLastOpenedUser ||
|-
| 5 || GetProfile || Returns an [[#IProfile]].
|-
| 6 || [3.0.0+] GetProfileDigest ||
|-
| 50 || [[#IsUserRegistrationRequestPermitted]] ||
|-
| 51 || TrySelectUserWithoutInteractionDeprecated ([1.0.0-18.1.0] [[#TrySelectUserWithoutInteraction]]) ||
|-
| 52 || [19.0.0+] TrySelectUserWithoutInteraction ||
|-
| 60 || [5.0.0-5.1.0] ListOpenContextStoredUsers ||
|-
| 99 || [6.0.0+] DebugActivateOpenContextRetention || No input, returns an [[#ISessionObject]].
|-
| 100 || GetUserRegistrationNotifier || Returns an [[#INotifier]].
|-
| 101 || GetUserStateChangeNotifier || Returns an [[#INotifier]].
|-
| 102 || GetBaasAccountManagerForSystemService || Returns an [[#IManagerForSystemService]].
|-
| 103 || GetBaasUserAvailabilityChangeNotifier || Returns an [[#INotifier]].
|-
| 104 || GetProfileUpdateNotifier || Returns an [[#INotifier]].
|-
| 105 || [4.0.0+] CheckNetworkServiceAvailabilityAsync || Returns an [[#IAsyncContext]].
|-
| 106 || [9.0.0+] GetProfileSyncNotifier ||
|-
| 110 || StoreSaveDataThumbnail ||
|-
| 111 || ClearSaveDataThumbnail ||
|-
| 112 || LoadSaveDataThumbnail ||
|-
| 113 || [5.0.0+] GetSaveDataThumbnailExistence ||
|-
| 120 || [10.0.0+] ListOpenUsersInApplication ||
|-
| 130 || [6.0.0+] ActivateOpenContextRetention || Takes a total of 0x8-bytes of input, returns an [[#ISessionObject]].
|-
| 140 || [6.0.0+] ListQualifiedUsers ||
|-
| 150 || [10.0.0-10.2.0] AuthenticateApplicationAsync ||
|-
| 151 || [12.0.0+] EnsureSignedDeviceIdentifierCacheForNintendoAccountAsync ||
|-
| 152 || [12.0.0+] LoadSignedDeviceIdentifierCacheForNintendoAccount ||
|-
| 170 || [13.0.0+] GetNasOp2MembershipStateChangeNotifier ||
|-
| 190 || [1.0.0-9.2.0] GetUserLastOpenedApplication ||
|-
| 191 || [7.0.0-19.0.1] UpdateNotificationReceiverInfo ([5.0.0-5.1.0] ActivateOpenContextHolder) ||
|-
| 200 || BeginUserRegistration ||
|-
| 201 || CompleteUserRegistration ||
|-
| 202 || CancelUserRegistration ||
|-
| 203 || DeleteUser ||
|-
| 204 || SetUserPosition ||
|-
| 205 || GetProfileEditor || Takes an input userID and returns an [[#IProfileEditor]].
|-
| 206 || CompleteUserRegistrationForcibly ||
|-
| 210 || [3.0.0+] CreateFloatingRegistrationRequest || Returns an [[#IFloatingRegistrationRequest]].
|-
| 211 || [8.0.0+] CreateProcedureToRegisterUserWithNintendoAccount || Takes a total of 0x4-bytes of input and a handle, returns an [[#IOAuthProcedureForUserRegistration]].
|-
| 212 || [8.0.0+] ResumeProcedureToRegisterUserWithNintendoAccount || Takes a total of 0x14-bytes of input and a handle, returns an [[#IOAuthProcedureForUserRegistration]].
|-
| 213 || [17.0.0+] CreateProcedureToCreateUserWithNintendoAccount ||
|-
| 214 || [17.0.0+] ResumeProcedureToCreateUserWithNintendoAccount ||
|-
| 215 || [17.0.0+] ResumeProcedureToCreateUserWithNintendoAccountAfterApplyResponse ||
|-
| 230 || AuthenticateServiceAsync || Returns an [[#IAsyncContext]].
|-
| 250 || GetBaasAccountAdministrator || Returns an [[#IAdministrator]].
|-
| 251 || [20.0.0+] SynchronizeNetworkServiceAccountsSnapshotAsync ||
|-
| 290 || ProxyProcedureForGuestLoginWithNintendoAccount || Returns an [[#IOAuthProcedureForExternalNsa]] (formerly [[#IOAuthProcedureForGuestLogin]] with [1.0.0-2.3.0]).
|-
| 291 || [3.0.0+] ProxyProcedureForFloatingRegistrationWithNintendoAccount || Returns an [[#IOAuthProcedureForExternalNsa]].
|-
| 292 || [20.0.0+] ProxyProcedureForDeviceMigrationAuthenticatingOperatingUser ||
|-
| 293 || [20.0.0+] ProxyProcedureForDeviceMigrationDownload ||
|-
| 299 || SuspendBackgroundDaemon || Returns an [[#ISessionObject]].
|-
| 350 || [20.0.0+] CreateDeviceMigrationUserExportRequest ||
|-
| 351 || [20.0.0+] UploadNasCredential ||
|-
| 352 || [20.0.0+] CreateDeviceMigrationUserImportRequest ||
|-
| 353 || [20.0.0+] DeleteUserMigrationSaveData ||
|-
| 400 || [18.0.0+] SetPinCode ||
|-
| 401 || [18.0.0+] GetPinCodeLength ||
|-
| 402 || [18.0.0-19.0.1] GetPinCode ||
|-
| 403 || [20.0.0+] GetPinCodeParity ||
|-
| 404 || [20.0.0+] VerifyPinCode ||
|-
| 405 || [20.0.0+] IsPinCodeVerificationForbidden ||
|-
| 410 || [18.0.0+] GetPinCodeErrorCount ||
|-
| 411 || [18.0.0-19.0.1] ResetPinCodeErrorCount ||
|-
| 412 || [18.0.0-19.0.1] IncrementPinCodeErrorCount ||
|-
| 413 || [20.0.0+] SetPinCodeErrorCount ||
|-
| 420 || [19.0.0+] SetStartPenaltyTime ||
|-
| 421 || [19.0.0+] GetStartPenaltyTime ||
|-
| 900 || [13.0.0+] SetUserUnqualifiedForDebug ||
|-
| 901 || [13.0.0+] UnsetUserUnqualifiedForDebug ||
|-
| 902 || [13.0.0+] ListUsersUnqualifiedForDebug ||
|-
| 910 || [16.0.0+] RefreshFirmwareSettingsForDebug ||
|-
| 997 || [3.0.0+] DebugInvalidateTokenCacheForUser ||
|-
| 998 || DebugSetUserStateClose ||
|-
| 999 || DebugSetUserStateOpen ||
|}

[10.0.0+] DebugSetUserStateClose/DebugSetUserStateOpen now takes an additional 8-bytes of input.

== IsUserRegistrationRequestPermitted ==
Takes a PID, an input u64 pid_reserved, and returns an output u8 bool.

== TrySelectUserWithoutInteraction ==
Takes an input u8 bool isNetworkServiceAccountRequired, returns an output Uid.

== IManagerForSystemService ==
This is "nn::account::baas::IManagerForSystemService".

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || CheckAvailability ||
|-
| 1 || GetAccountId ||
|-
| 2 || EnsureIdTokenCacheAsync || Returns an [[#IAsyncContext]].
|-
| 3 || [19.0.0+] LoadIdTokenCacheDeprecated ([1.0.0-18.1.0] LoadIdTokenCache) ||
|-
| 4 || [19.0.0+] LoadIdTokenCache ||
|-
| 100 || SetSystemProgramIdentification ||
|-
| 101 || RefreshNotificationTokenAsync ||
|-
| 110 || GetServiceEntryRequirementCacheForLogin ||
|-
| 111 || InvalidateServiceEntryRequirementCache ||
|-
| 113 || GetServiceEntryRequirementCacheForOnlinePlay || Takes a total of 0x8-bytes of input, returns a total of 0x4-bytes of output.
|-
| 120 || GetNintendoAccountId ||
|-
| 121 || CalculateNintendoAccountAuthenticationFingerprint ||
|-
| 130 || GetNintendoAccountUserResourceCache ||
|-
| 131 || RefreshNintendoAccountUserResourceCacheAsync || Returns an [[#IAsyncContext]].
|-
| 132 || RefreshNintendoAccountUserResourceCacheAsyncIfSecondsElapsed || Returns an [[#IAsyncContext]].
|-
| 133 || GetNintendoAccountVerificationUrlCache ||
|-
| 134 || RefreshNintendoAccountVerificationUrlCacheAsync ||
|-
| 135 || RefreshNintendoAccountVerificationUrlCacheAsyncIfSecondsElapsed ||
|-
| 136 || [19.0.0+] GetNintendoAccountUserResourceCache ||
|-
| 140 || GetNetworkServiceLicenseCache ||
|-
| 141 || RefreshNetworkServiceLicenseCacheAsync || Returns an [[#IAsyncContext]].
|-
| 142 || RefreshNetworkServiceLicenseCacheAsyncIfSecondsElapsed || Returns an [[#IAsyncContext]].
|-
| 143 || [15.0.0+] GetNetworkServiceLicenseCacheEx ||
|-
| 150 || CreateAuthorizationRequest || Returns an [[#IAuthorizationRequest]].
|-
| 151 || [22.5.0+] ||
|-
| 152 || [22.5.0+] ||
|-
| 153 || [22.5.0+] ||
|-
| 160 || [15.0.0+] RequiresUpdateNetworkServiceAccountIdTokenCache ||
|-
| 161 || [16.0.0+] RequireReauthenticationOfNetworkServiceAccount ||
|-
| 180 || [18.0.0-19.0.1] GetRequestForNintendoAccountReauthentication ||
|-
| 181 || [20.0.0+] CreateProcedureToReauthenticateNintendoAccount ||
|-
| 182 || [20.0.0+] ResumeProcedureToReauthenticateNintendoAccount ||
|}

== IFloatingRegistrationRequest ==
This is "nn::account::baas::IFloatingRegistrationRequest".

Added with [3.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || GetSessionId ||
|-
| 12 || GetAccountId ||
|-
| 13 || GetLinkedNintendoAccountId ||
|-
| 14 || GetNickname ||
|-
| 15 || GetProfileImage ||
|-
| 16 || [18.0.0+] GetProfileLargeImage ||
|-
| 21 || LoadIdTokenCache ||
|-
| 100 || RegisterUser ([1.0.0-3.0.2] RegisterAsync) || [1.0.0-3.0.2] Used to return an [[#IAsyncContext]].
|-
| 101 || RegisterUserWithUid ([1.0.0-3.0.2] RegisterWithUidAsync) || [1.0.0-3.0.2] Used to return an [[#IAsyncContext]].
|-
| 102 || [4.0.0+] RegisterNetworkServiceAccountAsync || Returns an [[#IAsyncContext]].
|-
| 103 || [4.0.0+] RegisterNetworkServiceAccountWithUidAsync || Returns an [[#IAsyncContext]].
|-
| 110 || SetSystemProgramIdentification ||
|-
| 111 || EnsureIdTokenCacheAsync || Returns an [[#IAsyncContext]].
|}

== IAdministrator ==
This is "nn::account::baas::IAdministrator".

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || CheckAvailability ||
|-
| 1 || GetAccountId ||
|-
| 2 || EnsureIdTokenCacheAsync || Returns an [[#IAsyncContext]].
|-
| 3 || [19.0.0+] LoadIdTokenCacheDeprecated ([1.0.0-18.1.0] LoadIdTokenCache) ||
|-
| 4 || [19.0.0+] LoadIdTokenCache ||
|-
| 100 || SetSystemProgramIdentification ||
|-
| 101 || [7.0.0+] RefreshNotificationTokenAsync
|-
| 110 || [4.0.0+] GetServiceEntryRequirementCache ||
|-
| 111 || [4.0.0+] InvalidateServiceEntryRequirementCache ||
|-
| 112 || [4.0.0-6.2.0] InvalidateTokenCache ||
|-
| 113 || [6.1.0+] GetServiceEntryRequirementCacheForOnlinePlay || Takes a total of 0x8-bytes of input, returns a total of 0x4-bytes of output.
|-
| 120 || GetNintendoAccountId ||
|-
| 121 || [9.0.0+] CalculateNintendoAccountAuthenticationFingerprint ||
|-
| 130 || GetNintendoAccountUserResourceCache ||
|-
| 131 || RefreshNintendoAccountUserResourceCacheAsync || Returns an [[#IAsyncContext]].
|-
| 132 || RefreshNintendoAccountUserResourceCacheAsyncIfSecondsElapsed || Returns an [[#IAsyncContext]].
|-
| 133 || [9.0.0+] GetNintendoAccountVerificationUrlCache ||
|-
| 134 || [9.0.0+] RefreshNintendoAccountVerificationUrlCacheAsync ||
|-
| 135 || [9.0.0+] RefreshNintendoAccountVerificationUrlCacheAsyncIfSecondsElapsed ||
|-
| 136 || [19.0.0+] GetNintendoAccountUserResourceCache ||
|-
| 140 || [5.0.0+] GetNetworkServiceLicenseCache ||
|-
| 141 || [5.0.0+] RefreshNetworkServiceLicenseCacheAsync ||
|-
| 142 || [5.0.0+] RefreshNetworkServiceLicenseCacheAsyncIfSecondsElapsed ||
|-
| 143 || [15.0.0+] GetNetworkServiceLicenseCacheEx ||
|-
| 150 || CreateAuthorizationRequest || Returns an [[#IAuthorizationRequest]].
|-
| 151 || [22.5.0+] ||
|-
| 152 || [22.5.0+] ||
|-
| 153 || [22.5.0+] ||
|-
| 160 || [15.0.0+] RequiresUpdateNetworkServiceAccountIdTokenCache ||
|-
| 161 || [16.0.0+] RequireReauthenticationOfNetworkServiceAccount ||
|-
| 180 || [18.0.0-19.0.1] GetRequestForNintendoAccountReauthentication ||
|-
| 181 || [20.0.0+] CreateProcedureToReauthenticateNintendoAccount ||
|-
| 182 || [20.0.0+] ResumeProcedureToReauthenticateNintendoAccount ||
|-
| 200 || IsRegistered ||
|-
| 201 || RegisterAsync || Returns an [[#IAsyncContext]].
|-
| 202 || UnregisterAsync || Returns an [[#IAsyncContext]].
|-
| 203 || DeleteRegistrationInfoLocally ||
|-
| 204 || [19.0.0-19.0.1] UnregisterDeviceAsync ||
|-
| 220 || SynchronizeProfileAsync || Returns an [[#IAsyncContext]].
|-
| 221 || UploadProfileAsync || Returns an [[#IAsyncContext]].
|-
| 222 || SynchronizeProfileAsyncIfSecondsElapsed || Returns an [[#IAsyncContext]].
|-
| 223 || [19.0.0+] DownloadProfileAsync ||
|-
| 250 || IsLinkedWithNintendoAccount ||
|-
| 251 || CreateProcedureToLinkWithNintendoAccount || Returns an [[#IOAuthProcedureForNintendoAccountLinkage]].
|-
| 252 || ResumeProcedureToLinkWithNintendoAccount || Returns an [[#IOAuthProcedureForNintendoAccountLinkage]].
|-
| 255 || CreateProcedureToUpdateLinkageStateOfNintendoAccount || Returns an [[#IOAuthProcedure]].
|-
| 256 || ResumeProcedureToUpdateLinkageStateOfNintendoAccount || Returns an [[#IOAuthProcedure]].
|-
| 260 || [3.0.0+] CreateProcedureToLinkNnidWithNintendoAccount || Returns an [[#IOAuthProcedure]].
|-
| 261 || [3.0.0+] ResumeProcedureToLinkNnidWithNintendoAccount || Returns an [[#IOAuthProcedure]].
|-
| 280 || ProxyProcedureToAcquireApplicationAuthorizationForNintendoAccount || Returns an [[#IOAuthProcedure]].
|-
| 290 || [8.0.0+] GetRequestForNintendoAccountUserResourceView ||
|-
| 300 || [6.0.0+] TryRecoverNintendoAccountUserStateAsync || Returns an [[#IAsyncContext]].
|-
| 400 || [6.1.0+] IsServiceEntryRequirementCacheRefreshRequiredForOnlinePlay || Takes a total of 0x8-bytes of input, returns an output u8.
|-
| 401 || [6.1.0+] RefreshServiceEntryRequirementCacheForOnlinePlayAsync || Takes a total of 0x8-bytes of input, returns an [[#IAsyncContext]].
|-
| 900 || [9.0.0+] GetAuthenticationInfoForWin ||
|-
| 901 || [9.0.0+] ImportAsyncForWin ||
|-
| 997 || DebugUnlinkNintendoAccountAsync || Returns an [[#IAsyncContext]].
|-
| 998 || DebugSetAvailabilityErrorDetail ||
|}

== IAuthorizationRequest ==
This is "nn::account::nas::IAuthorizationRequest".

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || GetSessionId ||
|-
| 10 || InvokeWithoutInteractionAsync || Returns an [[#IAsyncContext]].
|-
| 19 || IsAuthorized ||
|-
| 20 || GetAuthorizationCode ||
|-
| 21 || GetIdToken ||
|-
| 22 || GetState ||
|}

== IOAuthProcedure ==
This is "nn::account::http::IOAuthProcedure".

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || PrepareAsync || Returns an [[#IAsyncContext]].
|-
| 1 || GetRequest ||
|-
| 2 || ApplyResponse ||
|-
| 3 || ApplyResponseAsync || Returns an [[#IAsyncContext]].
|-
| 10 || Suspend ||
|}

== IOAuthProcedureForExternalNsa ==
This is "nn::account::nas::IOAuthProcedureForExternalNsa".

Added with [3.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || PrepareAsync || Returns an [[#IAsyncContext]].
|-
| 1 || GetRequest ||
|-
| 2 || ApplyResponse ||
|-
| 3 || ApplyResponseAsync || Returns an [[#IAsyncContext]].
|-
| 10 || Suspend ||
|-
| 100 || GetAccountId ||
|-
| 101 || GetLinkedNintendoAccountId ||
|-
| 102 || GetNickname ||
|-
| 103 || GetProfileImage ||
|-
| 104 || [18.0.0+] GetProfileLargeImage ||
|}

== IOAuthProcedureForNintendoAccountLinkage ==
This is "nn::account::nas::IOAuthProcedureForNintendoAccountLinkage".

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || PrepareAsync || Returns an [[#IAsyncContext]].
|-
| 1 || GetRequest ||
|-
| 2 || ApplyResponse ||
|-
| 3 || ApplyResponseAsync || Returns an [[#IAsyncContext]].
|-
| 10 || Suspend ||
|-
| 100 || GetRequestWithTheme ||
|-
| 101 || IsNetworkServiceAccountReplaced ||
|-
| 199 || [2.0.0-5.1.0] GetUrlForIntroductionOfExtraMembership ||
|-
| 200 || [16.0.0+] ApplyAsyncWithAuthorizedToken ||
|}

== INotifier ==
This is "nn::account::detail::INotifier".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetSystemEvent
|}

== IProfile ==
This is "nn::account::profile::IProfile".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Get]]
|-
| 1 || [[#GetBase]]
|-
| 10 || [[#GetImageSize]]
|-
| 11 || [[#LoadImage]]
|-
| 20 || [18.0.0+] GetLargeImageSize
|-
| 21 || [18.0.0+] LoadLargeImage
|-
| 30 || [18.0.0+] GetImageId
|}

=== Get ===
Takes an output type-0x1A buffer for [[#UserData]], returns an output [[#ProfileBase]].

=== GetBase ===
No input, returns an output [[#ProfileBase]].

=== GetImageSize ===
No input, returns an output u32 for the size of the image buffer.

=== LoadImage ===
Takes an output type-0x6 buffer, returns the same output u32 as [[#GetImageSize]].

The output buffer contains the JPEG profile image icon. This is valid for both Miis and character icons.

== IProfileEditor ==
This is "nn::account::profile::IProfileEditor".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Get]]
|-
| 1 || [[#GetBase]]
|-
| 10 || [[#GetImageSize]]
|-
| 11 || [[#LoadImage]]
|-
| 20 || [18.0.0+] GetLargeImageSize
|-
| 21 || [18.0.0+] LoadLargeImage
|-
| 30 || [18.0.0+] GetImageId
|-
| 100 || [[#Store]]
|-
| 101 || [[#StoreWithImage]]
|-
| 110 || [18.0.0+] StoreWithLargeImage
|}

=== Store ===
Takes a [[#ProfileBase]] and an input type-0x19 buffer for [[#UserData]].

=== StoreWithImage ===
Takes a [[#ProfileBase]], an input type-0x19 buffer for [[#UserData]], and an input type-0x5 buffer.

== IAsyncContext ==
This is "nn::account::detail::IAsyncContext".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetSystemEvent
|-
| 1 || Cancel
|-
| 2 || HasDone
|-
| 3 || GetResult
|}

== ISessionObject ==
This is "nn::account::detail::ISessionObject".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 999 || Dummy
|}

= acc:u0 =
This is "nn::account::IAccountServiceForApplication".

[13.0.0+] This was moved from [[Account_services|account]].

This is only available when the output from [[Process_Manager_services|pm:bm]] GetBootMode is Normal/Maintenance.

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || GetUserCount ||
|-
| 1 || GetUserExistence ||
|-
| 2 || ListAllUsers ||
|-
| 3 || ListOpenUsers ||
|-
| 4 || GetLastOpenedUser ||
|-
| 5 || GetProfile || Takes an input userID, returns an [[#IProfile]].
|-
| 6 || [3.0.0+] GetProfileDigest ||
|-
| 50 || [[#IsUserRegistrationRequestPermitted]] ||
|-
| 51 || TrySelectUserWithoutInteractionDeprecated ([1.0.0-18.1.0] [[#TrySelectUserWithoutInteraction]]) ||
|-
| 52 || [19.0.0+] TrySelectUserWithoutInteraction ||
|-
| 60 || [5.0.0-5.1.0] ListOpenContextStoredUsers ||
|-
| 99 || [6.0.0+] DebugActivateOpenContextRetention || No input, returns an [[#ISessionObject]].
|-
| 100 || [[#InitializeApplicationInfoV0]] ||
|-
| 101 || GetBaasAccountManagerForApplication || Takes an input userID, returns an [[#IManagerForApplication]].
|-
| 102 || AuthenticateApplicationAsync || Returns an [[#IAsyncContext]].
|-
| 103 || [4.0.0+] CheckNetworkServiceAvailabilityAsync || Returns an [[#IAsyncContext]].
|-
| 110 || StoreSaveDataThumbnail ||
|-
| 111 || ClearSaveDataThumbnail ||
|-
| 120 || CreateGuestLoginRequest || Returns an [[#IGuestLoginRequest]].
|-
| 130 || [5.0.0+] LoadOpenContext ||
|-
| 131 || [6.0.0+] ListOpenContextStoredUsers ||
|-
| 140 || [6.0.0+] [[#InitializeApplicationInfoV1]] ||
|-
| 141 || [6.0.0+] ListQualifiedUsers ||
|-
| 150 || [6.0.0+] IsUserAccountSwitchLocked ||
|-
| 160 || [13.0.0+] InitializeApplicationInfoV2 ||
|}

InitializeApplicationInfo* is used by the user-process during service init.

== InitializeApplicationInfoV0 ==
Takes a PID and an input u64 pid_placeholder, no output.

== InitializeApplicationInfoV1 ==
Takes a PID and an input u64 pid_placeholder, no output.

== IGuestLoginRequest ==
This is "nn::account::baas::IGuestLoginRequest".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetSessionId
|-
| 11 || [1.0.0-2.3.0]
|-
| 12 || GetAccountId
|-
| 13 || GetLinkedNintendoAccountId
|-
| 14 || GetNickname
|-
| 15 || GetProfileImage
|-
| 16 || [18.0.0+] GetProfileLargeImage
|-
| 21 || [3.0.0+] LoadIdTokenCache
|}

== IManagerForApplication ==
This is "nn::account::baas::IManagerForApplication".

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || CheckAvailability ||
|-
| 1 || GetAccountId ||
|-
| 2 || EnsureIdTokenCacheAsync || Returns an [[#IAsyncContext]].
|-
| 3 || LoadIdTokenCache ||
|-
| 130 || GetNintendoAccountUserResourceCacheForApplication ||
|-
| 150 || CreateAuthorizationRequest || Returns an [[#IAuthorizationRequest]].
|-
| 160 || [5.0.0+] StoreOpenContext ||
|-
| 170 || [13.0.0+] EnsureIdTokenCacheForOnlinePlayAsync ([6.0.0-12.1.0] LoadNetworkServiceLicenseKindAsync) || No input, returns an [[#IAsyncContextForLoginForOnlinePlay]] ([6.0.0-12.1.0] [[#IAsyncNetworkServiceLicenseKindContext]]).
|}

== IAsyncNetworkServiceLicenseKindContext ==
This is "nn::account::detail::IAsyncNetworkServiceLicenseKindContext".

This was added with [6.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || GetSystemEvent ||
|-
| 1 || Cancel ||
|-
| 2 || HasDone ||
|-
| 3 || GetResult ||
|-
| 100 || GetNetworkServiceLicenseKind ||
|}

== IAsyncContextForLoginForOnlinePlay ==
This is "nn::account::baas::IAsyncContextForLoginForOnlinePlay".

This was added with [13.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || GetSystemEvent ||
|-
| 1 || Cancel ||
|-
| 2 || HasDone ||
|-
| 3 || GetResult ||
|-
| 100 || GetNetworkServiceLicenseInfoForOnlinePlay ||
|}

= acc:u1 =
This is "nn::account::IAccountServiceForSystemService".

[13.0.0+] This was moved from [[Account_services|account]].

This is only available when the output from [[Process_Manager_services|pm:bm]] GetBootMode is Normal/Maintenance.

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || GetUserCount ||
|-
| 1 || GetUserExistence ||
|-
| 2 || ListAllUsers ||
|-
| 3 || ListOpenUsers ||
|-
| 4 || GetLastOpenedUser ||
|-
| 5 || GetProfile || Returns an [[#IProfile]].
|-
| 6 || [3.0.0+] GetProfileDigest ||
|-
| 50 || [[#IsUserRegistrationRequestPermitted]] ||
|-
| 51 || TrySelectUserWithoutInteractionDeprecated ([1.0.0-18.1.0] [[#TrySelectUserWithoutInteraction]]) ||
|-
| 52 || [19.0.0+] TrySelectUserWithoutInteraction ||
|-
| 60 || [5.0.0-5.1.0] ListOpenContextStoredUsers ||
|-
| 99 || [6.0.0+] DebugActivateOpenContextRetention || No input, returns an [[#ISessionObject]].
|-
| 100 || GetUserRegistrationNotifier || Returns an [[#INotifier]].
|-
| 101 || GetUserStateChangeNotifier || Returns an [[#INotifier]].
|-
| 102 || GetBaasAccountManagerForSystemService || Returns an [[#IManagerForSystemService]].
|-
| 103 || GetBaasUserAvailabilityChangeNotifier || Returns an [[#INotifier]].
|-
| 104 || GetProfileUpdateNotifier || Returns an [[#INotifier]].
|-
| 105 || [4.0.0+] CheckNetworkServiceAvailabilityAsync || Returns an [[#IAsyncContext]].
|-
| 106 || [9.0.0+] GetProfileSyncNotifier ||
|-
| 110 || StoreSaveDataThumbnail ||
|-
| 111 || ClearSaveDataThumbnail ||
|-
| 112 || LoadSaveDataThumbnail ||
|-
| 113 || [5.0.0+] GetSaveDataThumbnailExistence ||
|-
| 120 || [10.0.0+] ListOpenUsersInApplication ||
|-
| 130 || [6.0.0+] ActivateOpenContextRetention || Takes a total of 0x8-bytes of input, returns an [[#ISessionObject]].
|-
| 140 || [6.0.0+] ListQualifiedUsers ||
|-
| 150 || [10.0.0-10.2.0] AuthenticateApplicationAsync ||
|-
| 151 || [12.0.0+] EnsureSignedDeviceIdentifierCacheForNintendoAccountAsync ||
|-
| 152 || [12.0.0+] LoadSignedDeviceIdentifierCacheForNintendoAccount ||
|-
| 170 || [13.0.0+] GetNasOp2MembershipStateChangeNotifier ||
|-
| 190 || [1.0.0-9.2.0] GetUserLastOpenedApplication ||
|-
| 191 || [7.0.0-19.0.1] UpdateNotificationReceiverInfo ([5.0.0-5.1.0] ActivateOpenContextHolder) ||
|-
| 401 || [18.0.0+] GetPinCodeLength ||
|-
| 402 || [18.0.0-19.0.1] GetPinCode ||
|-
| 403 || [20.0.0+] GetPinCodeParity ||
|-
| 404 || [20.0.0+] VerifyPinCode ||
|-
| 405 || [20.0.0+] IsPinCodeVerificationForbidden ||
|-
| 997 || [3.0.0+] DebugInvalidateTokenCacheForUser ||
|-
| 998 || DebugSetUserStateClose ||
|-
| 999 || DebugSetUserStateOpen ||
|}

[10.0.0+] DebugSetUserStateClose/DebugSetUserStateOpen now takes an additional 8-bytes of input.

== IOAuthProcedureForUserRegistration ==
This is "nn::account::nas::IOAuthProcedureForUserRegistration".

This was added with [8.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || PrepareAsync || No input, returns an [[#IAsyncContext]].
|-
| 1 || GetRequest ||
|-
| 2 || ApplyResponse ||
|-
| 3 || ApplyResponseAsync || Takes a type-0x9 input buffer, returns an [[#IAsyncContext]].
|-
| 10 || Suspend ||
|-
| 100 || GetAccountId ||
|-
| 101 || GetLinkedNintendoAccountId ||
|-
| 102 || GetNickname ||
|-
| 103 || GetProfileImage ||
|-
| 104 || [18.0.0+] GetProfileLargeImage ||
|-
| 110 || RegisterUserAsync || No input, returns an [[#IAsyncContext]].
|-
| 111 || GetUid ||
|-
| 200 || [17.0.0+] ApplyResponseForUserCreationAsync ||
|-
| 205 || [17.0.0+] SuspendAfterApplyResponse ||
|-
| 210 || [17.0.0+] IsProfileAvailable ||
|-
| 220 || [17.0.0+] RegisterUserAsyncWithoutProfile ||
|-
| 221 || [17.0.0+] RegisterUserWithProfileAsync ||
|-
| 230 || [18.0.0+] RegisterUserWithLargeImageProfileAsync ||
|}

= ApplicationRecord =
This is "nn::ns::ApplicationRecord".

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| [[NCM_services#ApplicationId|Id]]
|-
| 0x8
| 0x1
| [[#ApplicationEvent|LastEvent]]
|-
| 0x9
| 0x1
| Attributes
|-
| 0xA
| 0x6
| Reserved
|-
| 0x10
| 0x8
| LastUpdated
|}

= ApplicationEvent =
This is "nn::ns::ApplicationEvent".

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || Launched
|-
| 1 || LocalInstalled
|-
| 2 || DownloadStarted
|-
| 3 || GameCardInserted
|-
| 4 || Touched
|-
| 5 ||
|-
| 6 ||
|-
| 7 ||
|-
| 8 ||
|-
| 9 ||
|-
| 10 ||
|-
| 11 ||
|-
| 12 ||
|-
| 13 ||
|-
| 14 ||
|-
| 15 ||
|-
| 16 ||
|}

= ApplicationControlSource =
This is "nn::ns::ApplicationControlSource".

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| CacheOnly
|-
| 1
| Storage
|-
| 2
| StorageOnly
|}

= ApplicationContentMetaStatus =
This is "nn::ns::ApplicationContentMetaStatus".

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| [[NCM_services#ContentMetaType|Type]]
|-
| 0x1
| 0x1
| [[NCM_services#StorageId|InstalledStorage]]
|-
| 0x2
| 0x1
| [[#ContentMetaRightsCheck|RightsCheck]]
|-
| 0x3
| 0x1
| Reserved
|-
| 0x4
| 0x4
| Version
|-
| 0x8
| 0x8
| [[NCM_services#ApplicationId|Id]]
|}

= ContentMetaRightsCheck =
This is "nn::ns::ContentMetaRightsCheck".

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| NotChecked
|-
| 1
| NotNeeded
|-
| 2
| CommonRights
|-
| 3
| PersonalizedRights
|-
| 4
| NoRights
|}

= VersionListData =
This is "nn::ns::VersionListData".

= ApplicationUpdateInfo =
This is "nn::ns::ApplicationUpdateInfo".

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || UpToDate
|-
| 1 || Updatable
|}

= ApplicationOccupiedSize =
This is "nn::ns::ApplicationOccupiedSize". This is a 0x80-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x20 * 4 || Array of [[#ApplicationOccupiedSizeEntity]]
|}

= ApplicationOccupiedSizeEntity =
This is "nn::ns::ApplicationOccupiedSizeEntity". This is a 0x20-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || [[NCM_services#StorageId|StorageId]]
|-
| 0x1 || 0x7 || Reserved
|-
| 0x8 || 0x8 || AppSize
|-
| 0x10 || 0x8 || PatchSize
|-
| 0x18 || 0x8 || AocSize
|}

= ProgressForDeleteUserSaveDataAll =
This is "nn::ns::detail::ProgressForDeleteUserSaveDataAll". This is a 0x28-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || StartedAt
|-
| 0x8 || 0x4 || Count
|-
| 0xC || 0x4 || Reserved
|-
| 0x10 || 0x8 || SizeInBytes
|-
| 0x18 || 0x1 || IsSystem
|-
| 0x19 || 0x7 || Reserved
|-
| 0x20 || 0x8 || ApplicationId
|}

= ApplicationViewDeprecated =
This is "nn::ns::ApplicationViewDeprecated". This is a 0x40-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || [[NCM_services#ApplicationId|ApplicationId]]
|-
| 0x8 || 0x4 || Version
|-
| 0xC || 0x4 || [[#ApplicationViewFlag|Flag]]
|-
| 0x10 || 0x18 || [[#ApplicationDownloadProgress|Progress]]
|-
| 0x28 || 0x18 || [[#ApplicationApplyDeltaProgress|ApplyProgress]]
|}

This is converted from [[#ApplicationView]] by [[#GetApplicationViewDeprecated]] on newer system-versions as follows:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x20 || Same as [[#ApplicationView]] +0x0.
|-
| 0x20 || 0x4 || Same as [[#ApplicationView]] +0x20.
|-
| 0x24 || 0x2 || Same as [[#ApplicationView]] +0x24.
|-
| 0x26 || 0x2 || Cleared to 0.
|-
| 0x28 || 0x10 || Same as [[#ApplicationView]] +0x30.
|-
| 0x38 || 0x4 || Same as [[#ApplicationView]] +0x40.
|-
| 0x3C || 0x1 || Same as [[#ApplicationView]] +0x44.
|-
| 0x3D || 0x2 || Cleared to 0.
|-
| 0x3F || 0x1 || Cleared to 0.
|}

= ApplicationViewFlag =
This is "nn::ns::ApplicationViewFlag". This is a 32-bit flag.

{| class="wikitable" border="1"
|-
! Bit
! Description
|-
| 0
|
|-
| 1
|
|-
| 2
|
|-
| 3
|
|-
| 4
|
|-
| 5
|
|-
| 6
|
|-
| 7
|
|-
| 8
|
|-
| 9
|
|-
| 10
|
|-
| 11
|
|-
| 12
|
|-
| 13
|
|-
| 14
|
|-
| 15
|
|-
| 16
|
|-
| 17
|
|}

= ApplicationDownloadProgress =
This is "nn::ns::ApplicationDownloadProgress". This is a 0x18-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || Downloaded
|-
| 0x8 || 0x8 || Total
|-
| 0x10 || 0x4 || LastResult
|-
| 0x14 || 0x1 || [[#ApplicationDownloadState|State]]
|-
| 0x15 || 0x3 || Reserved
|}

= ApplicationApplyDeltaProgress =
This is "nn::ns::ApplicationApplyDeltaProgress". This is a 0x18-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || Applied
|-
| 0x8 || 0x8 || Total
|-
| 0x10 || 0x4 || LastResult
|-
| 0x14 || 0x1 || [[#ApplicationApplyDeltaState|State]]
|-
| 0x15 || 0x3 || Reserved
|}

= ApplicationDownloadState =
This is "nn::ns::ApplicationDownloadState". This is an u8.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || Runnable
|-
| 1 || Suspended
|-
| 2 || NotEnoughSpace
|-
| 3 || Fatal
|-
| 4 || Finished
|}

= ApplicationApplyDeltaState =
This is "nn::ns::ApplicationApplyDeltaState". This is an u8.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || Applying
|-
| 1 || Suspended
|-
| 2 || NotEnoughSpace
|-
| 3 || Fatal
|-
| 4 || NoTask
|-
| 5 || WaitApply
|-
| 6 || Applied
|}

= ApplicationView =
This is "nn::ns::ApplicationView". This is a 0x50-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || [[NCM_services#ApplicationId|ApplicationId]]
|-
| 0x8 || 0x4 || ?
|-
| 0xC || 0x4 || Flags
|-
| 0x10 || 0x40 || ?
|}

= ApplicationViewWithPromotionInfo =
This is a 0x70-byte struct.

[20.0.0+] This is a 0x78-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x50 || [[#ApplicationView]]
|-
| 0x50 || 0x20 || [[#PromotionInfo]]
|}

= PromotionInfo =
This is a 0x20-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || PosixTime start_timestamp.
|-
| 0x8 || 0x8 || PosixTime end_timestamp.
|-
| 0x10 || 0x8 || Remaining time until the promotion ends, in nanoseconds ({end_timestamp - current_time} converted to nanoseconds).
|-
| 0x18 || 0x4 || Not set, left at zero.
|-
| 0x1C || 0x1 || Flags. Bit0: whether the PromotionInfo is valid (including bit1). Bit1 clear: u64 +0x10 is set.
|-
| 0x1D || 0x3 || Padding
|}

= ApplicationResourceType =
This is "nn::ns::ApplicationResourceType". This is an u8.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || ApplicationResource
|-
| 1 || MicroApplicationResource
|}

= ApplicationErrorCodeCategory =
This is "nn::ns::ApplicationErrorCodeCategory". This is an u64.

= NoDownloadRightsErrorResolution =
This is "nn::ns::NoDownloadRightsErrorResolution".

= BackgroundNetworkUpdateState =
This is "nn::ns::BackgroundNetworkUpdateState". This is an u8.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || None
|-
| 1 || InProgress
|-
| 2 || Ready
|}

Similar to [[#HasDownloaded]], [[#GetBackgroundNetworkUpdateState]] uses [[NIM_services|nim]] ListSystemUpdateTask and [[NIM_services|nim]] GetSystemUpdateTaskInfo. When ListSystemUpdateTask successfully returns a task and GetSystemUpdateTaskInfo is successful, the output value is set to: <code>1 + *((u8*)(taskinfo+0) == 0x3</code>. Otherwise, value=0.

[[#GetBackgroundNetworkUpdateState]] always returns Result 0, however this will assert if GetSystemUpdateTaskInfo fails with ret!=0x3C89.

= SystemUpdateProgress =
This is "nn::ns::SystemUpdateProgress". This is a 0x10-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || Loaded (this value can be larger than total_size when the async operation is finishing and when total_size is <=0, this current_size field may contain a progress value for when the total_size is not yet determined)
|-
| 0x8 || 0x8 || Total (this field is only valid when >0)
|}

Commands which have this as output will return 0 with the output cleared, when no task is available.

= EulaDataPath =
This is "nn::ns::detail::EulaDataPath". This is a 0x100-byte struct.

This contains a file path.

= SystemDeliveryInfo =
This is "nn::ns::SystemDeliveryInfo". This is a 0x100-byte struct.

Originally the SystemDeliveryInfo validation func verified that OldSystemUpdateId matched the installed SystemUpdate Id. [20.0.0+] The used (Old)SystemUpdateId as selected by SystemUpdateIdFlag must now match one of the Ids in [[System_Settings|system-setting]] <code>contents_delivery!acceptable_system_update_ids_string</code> (replaces the previously mentioned installed-SystemUpdate check).

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || SystemDeliveryProtocolVersion. Must be <= to and match [[System_Settings|system-setting]] <code>contents_delivery!system_delivery_protocol_version</code>.
|-
| 0x4 || 0x4 || ApplicationDeliveryProtocolVersion. Loaded from [[System_Settings|system-setting]] <code>contents_delivery!application_delivery_protocol_version</code>. Unused by [[#RequestSendSystemUpdate]]/[[#RequestReceiveSystemUpdate]], besides HMAC validation.
|-
| 0x8 || 0x1 || HasExFat. Unused by [[#RequestSendSystemUpdate]]/[[#RequestReceiveSystemUpdate]], besides HMAC validation.
|-
| 0x9 || 0x3 || Reserved.
|-
| 0xC || 0x4 || SystemUpdateVersion.
|-
| 0x10 || 0x8 || OldSystemUpdateId. [20.0.0+] Always the NX Id: this is loaded from [[System_Settings|system-setting]] <code>contents_delivery!old_system_update_id</code>.
|-
| 0x18 || 0x1 || FirmwareVariationId. Used by [[#RequestSendSystemUpdate]]. Loaded from [[System_Settings|system-setting]] <code>ns.systemupdate!firmware_variation</code> or <code>ns.systemupdate!t_firmware_variation</code>, depending on the [[Settings_services|PlatformRegion]].
|-
| 0x19 || 0x1 || UpdatableFirmwareGroupId. Unused by [[#RequestSendSystemUpdate]]/[[#RequestReceiveSystemUpdate]], besides HMAC validation. Loaded from [[System_Settings|system-setting]] <code>ns.systemupdate!updatable_firmware_group_id</code> or <code>ns.systemupdate!t_updatable_firmware_group_id</code>, depending on the [[Settings_services|PlatformRegion]].
|-
| 0x1A || 0x1 || PlatformRegion (0x00 = Unknown/Global, 0x01 = China).
|-
| 0x1B || 0x1 || [20.0.0+] SystemDeliveryInfoPlatform. Loaded from [[System_Settings|system-setting]] <code>ns.systemupdate!system_delivery_info_platform</code>. Elsewhere this is compared against the sys-setting, etc.
|-
| 0x1C || 0x1 || [20.0.0+] SystemUpdateIdFlag. When non-zero, SystemUpdateId is used instead of OldSystemUpdateId. Always set to 0x1 by [[#GetSystemDeliveryInfo]] with [20.0.0+].
|-
| 0x1D || 0x3 || Padding
|-
| 0x20 || 0x8 || [20.0.0+] SystemUpdateId. See above. With [20.0.0+] [[#GetSystemDeliveryInfo]] now writes the Id here instead of OldSystemUpdateId (for the installed SystemUpdate). On S2 this is set to the Ounce Id.
|-
| 0x28 || 0xB8 || Reserved
|-
| 0xE0 || 0x20 || HMAC-SHA256 over the previous 0xE0-bytes.
|}

= ApplicationDeliveryInfo =
This is "nn::ns::ApplicationDeliveryInfo". This is a 0x100-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || ApplicationDeliveryProtocolVersion. Loaded from [[System_Settings|system-setting]] <code>contents_delivery!application_delivery_protocol_version</code>. An error is thrown when [[System_Settings|system-setting]] <code>contents_delivery!application_delivery_protocol_version</code> < version, or when [[System_Settings|system-setting]] <code>contents_delivery!acceptable_application_delivery_protocol_version</code> > version.
|-
| 0x4 || 0x4 || Padding
|-
| 0x8 || 0x8 || ApplicationId.
|-
| 0x10 || 0x4 || ApplicationVersion.
|-
| 0x14 || 0x4 || RequiredApplicationVersion.
|-
| 0x18 || 0x4 || RequiredSystemVersion.
|-
| 0x1C || 0x4 || u32 bitmask <code>nn::ns::ApplicationDeliveryAttributeTag</code>. [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]] sets this to the input u32. Bit30 and bit28 are additionally set, depending on [[NCM_services|ContentMetaType]] == Patch, etc.
|-
| 0x20 || 0x1 || [20.0.0+] [[NCM_services|ContentMetaPlatform]]. Loaded from [[NCM_services|ncm]] IContentMetaDatabase GetPlatform.
|-
| 0x21 || 0x1 || [20.0.0+] ProperProgramExists. Set to whether the bit for ProperProgramExists is set from [[NCM_services|ncm]] IContentMetaDatabase GetAttributes.
|-
| 0x22 || 0x1 || [S2]
|-
| 0x23 || 0xBD || Reserved
|-
| 0xE0 || 0x20 || HMAC-SHA256 over the previous 0xE0-bytes. Uses a different key than [[#SystemDeliveryInfo]].
|}

= LatestSystemUpdate =
This is "nn::ns::LatestSystemUpdate". This is an u8.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || UpToDate
|-
| 1 || Downloaded
|-
| 2 || NeedsDownload
|}

= ReceiveApplicationProgress =
This is "nn::ns::ReceiveApplicationProgress". This is a 0x10-byte struct.

= SendApplicationProgress =
This is "nn::ns::SendApplicationProgress". This is a 0x10-byte struct.

= ApplicationRightsOnClient =
This is a 0x20-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || [[NCM_services#ApplicationId|ApplicationId]]
|-
| 0x8 || 0x10 || [[Account_services#Uid|Uid]]
|-
| 0x18 || 0x1 || Flags, [[qlaunch]] only uses bit0-bit4 and bit7.
|-
| 0x19 || 0x1 || Flags, [[qlaunch]] only uses bit0.
|-
| 0x1A || 0x6 || Unknown
|}

[[qlaunch]] only uses +0x18/+0x19 in this struct.

= DownloadTaskStatus =
This is "nn::ns::DownloadTaskStatus". This is a 0x20-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x10 || Uuid
|-
| 0x10 || 0x8 || [[NCM_services#ApplicationId|ApplicationId]]
|-
| 0x18 || 0x1 || [[#DownloadTaskStatusDetail|Detail]]
|-
| 0x19 || 0x1 || NeedsCleanup
|-
| 0x1A || 0x2 || Reserved
|-
| 0x1C || 0x4 || Result
|}

= DownloadTaskStatusDetail =
This is "nn::ns::DownloadTaskStatusDetail". This is an u8.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || Created
|-
| 1 || Added
|-
| 2 || AlreadyExists
|-
| 3 || Failed
|}

= ApplicationLaunchInfo =
This is a 0x40-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || [[NCM_services#ApplicationId|ApplicationId]]
|-
| 0x8 || 0x4 || Application version
|-
| 0xC || 0x4 || [[Process_Manager_services#LaunchFlags|LaunchFlags]], set to hard-coded value 0xB by [[#GetApplicationLaunchInfo]].
|-
| 0x10 || 0x1 || Application [[NCM_services#StorageId|StorageId]]
|-
| 0x11 || 0x1 || Update [[NCM_services#StorageId|StorageId]]
|-
| 0x12 || 0x2E ||
|}

= UserData =
This is a 0x80-byte struct.

{| class="wikitable" border="1"
|-
! Offset || Size || Description
|-
| 0x0 || 0x4? || ?
|-
| 0x4 || 0x4? || Icon ID. 0 = Mii, the rest are character icon IDs.
|-
| 0x8 || 0x1? || Profile icon background color ID
|-
| 0x9 || 0x7 || ?
|-
| 0x10 || 0x10 || Some ID related to the Mii? All zeros when a character icon is used.
|-
| 0x20 || 0x60 || Usually zeros?
|}

= ProfileBase =
This is a 0x38-byte struct.

{| class="wikitable" border="1"
|-
! Offset || Size || Description
|-
| 0x0 || 0x10 || userID
|-
| 0x10 || 0x8 || POSIX UTC timestamp, for last account edit.
|-
| 0x18 || 0x20 || UTF-8 Nickname. Official sw uses strncpy to copy this into another struct (<code>nn::account::Nickname</code>), with a NUL-byte written after the copied data.
|}

= Uid =
This is "nn::account::Uid". This is a 0x10-byte struct. This contains 2 u64s for the UserId.

= Notes =
[[Process_Manager_services|pm:bm]] GetBootMode is used to determine whether aoc:u is available (see above). This value is also passed to thread "nn.ns.DelayedInitialization", which calls various funcs depending on the BootMode in various cases.

The "nn.ns.DelayedInitialization" thread uses BootMode as follows (this also handles various other initialization):
* Initializes [[NPNS_services|npns:s]] only for BootMode Normal/Maintenance.
* Initializes the hosted acc:* services and service [[Account_services|acc:su]] only for BootMode Normal/Maintenance.
* Calls a func only for BootMode Normal.
* Initializes [[ETicket_services|es]] and [[Shared_Database_services|avm]] only for BootMode Normal/Maintenance.

The output of GetBootMode is also written into state. This same func later enters a code block when BootMode is Maintenance/SafeMode: various [[NCM_services|ncm]] cmds are used with input StorageId=BuiltInUser (VerifyContentMetaDatabase, VerifyContentStorage, ActivateContentMetaDatabase, ActivateContentStorage, InactivateContentMetaDatabase, InactivateContentStorage) and state fields are written. Then if the BootMode is Maintenance the savedata for [[Flash_Filesystem|ns_rightsid]] (0x800000000000004A) is deleted. Then 0 is returned. Otherwise for BootMode Normal it continues with various initialization, including gamecard handling which handles launching the gamecard title in certain conditions (this is the only time ns launches anything with pgl outside of service cmds).

In the above block, InactivateContentMetaDatabase/InactivateContentStorage are only used if using ActivateContentMetaDatabase/ActivateContentStorage failed (error is only checked after using both cmds). If any of the ncm cmds prior to this fail, it will skip using the rest of the ncm cmds.

[[Category:Services]]

NS services

2026-08-09T16:11:39Z

Yellows8:

= aoc:u =
This is "nn::aocsrv::detail::IAddOnContentManager".

This is only available when [[Process_Manager_services|pm:bm]] GetBootMode returns output 0 (Normal).

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [1.0.0-6.2.0] CountAddOnContentByApplicationId
|-
| 1 || [1.0.0-6.2.0] ListAddOnContentByApplicationId
|-
| 2 || CountAddOnContent
|-
| 3 || ListAddOnContent
|-
| 4 || [1.0.0-6.2.0] GetAddOnContentBaseIdByApplicationId
|-
| 5 || GetAddOnContentBaseId
|-
| 6 || [1.0.0-6.2.0] PrepareAddOnContentByApplicationId
|-
| 7 || PrepareAddOnContent
|-
| 8 || [4.0.0+] GetAddOnContentListChangedEvent
|-
| 9 || [10.0.0+] GetAddOnContentLostErrorCode
|-
| 10 || [11.0.0+] GetAddOnContentListChangedEventWithProcessId
|-
| 11 || [13.0.0+] NotifyMountAddOnContent
|-
| 12 || [13.0.0+] NotifyUnmountAddOnContent
|-
| 13 || [13.0.0+] IsAddOnContentMountedForDebug
|-
| 50 || [13.0.0+] CheckAddOnContentMountStatus
|-
| 100 || [7.0.0+] [[#IPurchaseEventManager|CreateEcPurchasedEventManager]]
|-
| 101 || [9.0.0+] [[#IPurchaseEventManager|CreatePermanentEcPurchasedEventManager]]
|-
| 110 || [12.0.0+] [[#IContentsServiceManager|CreateContentsServiceManager]]
|-
| 200 || [13.1.0+] SetRequiredAddOnContentsOnContentsAvailabilityTransition
|-
| 300 || [16.0.0+] SetupHostAddOnContent
|-
| 301 || [16.0.0+] GetRegisteredAddOnContentPath
|-
| 302 || [16.0.0+] UpdateCachedList
|}

== IPurchaseEventManager ==
This is "nn::ec::IPurchaseEventManager".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || SetDefaultDeliveryTarget
|-
| 1 || SetDeliveryTarget
|-
| 2 || GetPurchasedEventReadableHandle
|-
| 3 || PopPurchasedProductInfo
|-
| 4 || [9.0.0+] PopPurchasedProductInfoWithUid
|}

== IContentsServiceManager ==
This is "nn::ec::IContentsServiceManager".

This was added with [12.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [16.0.0+] RequestContentsAuthorizationTokenDeprecated ([12.0.0-15.0.1] [[#RequestContentsAuthorizationToken]])
|-
| 1 || [16.0.0+] RequestContentsAuthorizationToken
|}

=== RequestContentsAuthorizationToken ===
Takes a total of 0x50-bytes of input, a PID, a type-0x5 input buffer. Returns an [[#IAsyncData|IAsyncData]] and an output handle.

== IAsyncData ==
This is "nn::ec::detail::IAsyncData".

This was added with [12.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetSize
|-
| 1 || Get
|-
| 2 || Cancel
|}

= ns:am =
This is "nn::ns::detail::IApplicationManagerInterface".

[3.0.0+] This service was replaced by [[#ns:am2, ns:ec, ns:rid, ns:rt, ns:web, ns:ro, ns:sweb|ns:am2]].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#ListApplicationRecord]]
|-
| 1 || GenerateApplicationRecordCount
|-
| 2 || GetApplicationRecordUpdateSystemEvent
|-
| 3 || GetApplicationView
|-
| 4 || DeleteApplicationEntity
|-
| 5 || DeleteApplicationCompletely
|-
| 6 || IsAnyApplicationEntityRedundant
|-
| 7 || DeleteRedundantApplicationEntity
|-
| 8 || IsApplicationEntityMovable
|-
| 9 || MoveApplicationEntity
|-
| 11 || [[#CalculateApplicationOccupiedSize]]
|-
| 16 || PushApplicationRecord
|-
| 17 || ListApplicationRecordContentMeta
|-
| 18 || CheckLaunchRights
|-
| 19 || [[#LaunchApplication]]
|-
| 21 || [[#GetApplicationContentPath]]
|-
| 22 || TerminateApplication
|-
| 23 || [2.0.0+] ResolveApplicationContentPath
|-
| 26 || BeginInstallApplication
|-
| 27 || DeleteApplicationRecord
|-
| 30 || RequestApplicationUpdateInfo
|-
| 31 || RequestUpdateApplication
|-
| 32 || CancelApplicationDownload
|-
| 33 || ResumeApplicationDownload
|-
| 34 || ClearTaskStatusList
|-
| 35 || UpdateVersionList
|-
| 36 || PushLaunchVersion
|-
| 37 || ListRequiredVersion
|-
| 38 || CheckApplicationLaunchVersion
|-
| 39 || CheckApplicationLaunchRights
|-
| 40 || GetApplicationLogoData
|-
| 41 || CalculateApplicationDownloadRequiredSize
|-
| 42 || CleanupSdCard
|-
| 43 || [[#CheckSdCardMountStatus]]
|-
| 44 || GetSdCardMountStatusChangedEvent
|-
| 45 || GetGameCardAttachmentEvent
|-
| 46 || GetGameCardAttachmentInfo
|-
| 47 || [[#GetTotalSpaceSize]]
|-
| 48 || [[#GetFreeSpaceSize]]
|-
| 49 || GetSdCardRemovedEvent
|-
| 52 || GetGameCardUpdateDetectionEvent
|-
| 53 || DisableApplicationAutoDelete
|-
| 54 || EnableApplicationAutoDelete
|-
| 55 || [[#GetApplicationDesiredLanguage]]
|-
| 56 || SetApplicationTerminateResult
|-
| 57 || ClearApplicationTerminateResult
|-
| 58 || GetLastSdCardMountUnexpectedResult
|-
| 59 || ConvertApplicationLanguageToLanguageCode
|-
| 60 || [[#ConvertLanguageCodeToApplicationLanguage]]
|-
| 61 || GetBackgroundDownloadStressTaskInfo
|-
| 62 || GetGameCardStopper
|-
| 63 || IsSystemProgramInstalled
|-
| 64 || [2.0.0+] StartApplyDeltaTask
|-
| 65 || [2.0.0+] GetRequestServerStopper
|-
| 100 || ResetToFactorySettings
|-
| 101 || ResetToFactorySettingsWithoutUserSaveData
|-
| 102 || [2.0.0+] ResetToFactorySettingsForRefurbishment
|-
| 200 || CalculateUserSaveDataStatistics
|-
| 201 || DeleteUserSaveDataAll
|-
| 210 || DeleteUserSystemSaveData
|-
| 220 || UnregisterNetworkServiceAccount
|-
| 300 || GetApplicationShellEvent
|-
| 301 || PopApplicationShellEventInfo
|-
| 302 || LaunchLibraryApplet
|-
| 303 || TerminateLibraryApplet
|-
| 304 || LaunchSystemApplet
|-
| 305 || TerminateSystemApplet
|-
| 306 || LaunchOverlayApplet
|-
| 307 || TerminateOverlayApplet
|-
| 400 || [[#GetApplicationControlData]]
|-
| 401 || InvalidateAllApplicationControlCache
|-
| 402 || RequestDownloadApplicationControlData
|-
| 403 || GetMaxApplicationControlCacheCount
|-
| 404 || [2.0.0+] InvalidateApplicationControlCache
|-
| 405 || [2.0.0+] ListApplicationControlCacheEntryInfo
|-
| 502 || [2.0.0+] RequestCheckGameCardRegistration
|-
| 503 || [2.0.0+] RequestGameCardRegistrationGoldPoint
|-
| 504 || [2.0.0+] RequestRegisterGameCard
|-
| 600 || [2.0.0+] [[#CountApplicationContentMeta]]
|-
| 601 || [2.0.0+] [[#ListApplicationContentMetaStatus]]
|-
| 602 || [2.0.0+] ListOwnedAndInstalledAddOnContent
|-
| 603 || [2.0.0+] GetOwnedApplicationContentMetaStatus
|-
| 604 || [2.0.0+] RegisterContentsExternalKey
|-
| 605 || [2.0.0+] ListApplicationContentMetaStatusWithRightsCheck
|-
| 700 || [2.0.0+] PushDownloadTaskList
|-
| 701 || [2.0.0+] [[#ClearTaskStatusList]]
|-
| 702 || [2.0.0+] [[#RequestDownloadTaskList]]
|-
| 703 || [2.0.0+] [[#RequestEnsureDownloadTask]]
|-
| 704 || [2.0.0+] [[#ListDownloadTaskStatus]]
|-
| 705 || [2.0.0+] RequestDownloadTaskListData
|-
| 800 || [2.0.0+] RequestVersionList
|-
| 801 || [2.0.0+] ListVersionList
|-
| 900 || [2.0.0+] GetApplicationRecord
|-
| 901 || [2.0.0+] GetApplicationRecordProperty
|-
| 902 || [2.0.0+] EnableApplicationAutoUpdate
|-
| 903 || [2.0.0+] DisableApplicationAutoUpdate
|-
| 904 || [2.0.0+] TouchApplication
|-
| 905 || [2.0.0+] RequestApplicationUpdate
|-
| 906 || [2.0.0+] IsApplicationUpdateRequested
|-
| 907 || [2.0.0+] WithdrawApplicationUpdateRequest
|-
| 908 || [2.0.0+] ListApplicationRecordInstalledContentMeta
|-
| 1000 || [2.0.0+] RequestVerifyApplication
|-
| 1001 || [2.0.0+] CorruptApplicationForDebug
|-
| 1200 || [2.0.0+] [[#NeedsUpdateVulnerability]]
|-
| 1300 || [2.0.0+] IsAnyApplicationEntityInstalled
|-
| 1301 || [2.0.0+] DeleteApplicationContentEntities
|-
| 1302 || [2.0.0+] CleanupUnrecordedApplicationEntity
|-
| 1400 || [2.0.0+] PrepareShutdown
|-
| 1500 || [2.0.0+] FormatSdCard
|-
| 1501 || [2.0.0+] NeedsSystemUpdateToFormatSdCard
|-
| 1502 || [2.0.0+] GetLastSdCardFormatUnexpectedResult
|-
| 1503 || [2.0.0+] DetachSdCard
|-
| 1600 || [2.0.0+] GetSystemSeedForPseudoDeviceId
|-
| 1700 || [2.0.0+] ListApplicationDownloadingContentMeta
|-
| 1800 || [2.0.0+] IsNotificationSetupCompleted
|-
| 1801 || [2.0.0+] GetLastNotificationInfoCount
|-
| 1802 || [2.0.0+] ListLastNotificationInfo
|}

== ListApplicationRecord ==
Takes a type-0x6 output buffer containing an array of [[#ApplicationRecord]] and an s32 entry_offset, returns an output s32 out_entrycount.

Returns an array of entries with the below format using the specified offset and count.

== LaunchApplication ==
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output u64 PID.

Launches an application title which is registered with NS.

== GetApplicationContentPath ==
Takes a 0x16-type output buffer, an u8 [[NCM_services#ContentType|ContentType]], and an [[NCM_services#ApplicationId|ApplicationId]].

The input [[NCM_services#ApplicationId|ApplicationId]] is used with the application-title table like various other cmds, anything not in that table can't be used with this.

Returns a string path for the specified type of patch content with this [[NCM_services#ApplicationId|ApplicationId]], otherwise returns regular-application paths when update-title not installed. Returns an error when the specified type of content doesn't exist for this title. Starts with "@{SdCardContent,UserContent}://" and ends in ".nca".

For gamecard content, the output path is: "@GcSXXXXXXXX:/<NcaId>.nca". NCA-type0 with gamecard returns 0 with an empty output string.

The output string is then used by the user-process with [[Filesystem_services|FS]] to mount the content.

== GetTotalSpaceSize ==
Takes an input u8 [[NCM_services#StorageId|StorageId]], no output.

The StorageId must be SdCard.

Returns the s64 from [[NCM_services#IContentStorage]] GetFreeSpaceSize.

== GetFreeSpaceSize ==
Takes an input u8 [[NCM_services#StorageId|StorageId]], no output.

The StorageId must be SdCard.

Returns the s64 from [[NCM_services#IContentStorage]] GetTotalSpaceSize.

== GetApplicationDesiredLanguage ==
Takes an input u8 language-bitmask, returns an output u8 [[control.nacp]] langentry index.

User-processes generate the language-bitmask with the following for all 16 lang-entries: <code>if(<either string in langentry[i] is non-empty>)bitmask |= 1<<i</code>

== ConvertLanguageCodeToApplicationLanguage ==
Takes an input u8 pointer for the resulting Id to be written to and a string represented as a u64 (i.e 0x53552D6E65 for 'en-US').

Returns 0 if an ID was successfully found, otherwise returns 0x25810.

== GetApplicationControlData ==
Takes an input u8 [[#ApplicationControlSource]], an [[NCM_services#ApplicationId|ApplicationId]], and a type-0x6 output buffer. Returns an output u32 for actual_size. Official user-processes use buffer size 0x24000. [[qlaunch]] only uses source value 0x1 (Storage if not in cache).

Loads cached [[control.nacp]] to buf+0 and the cached icon to buf+0x4000. Returns an error if the buffer is too small.

== ListApplicationContentMetaStatus ==
Takes a type-0x6 output buffer containing an array of [[#ApplicationContentMetaStatus]], an input s32 index and [[NCM_services#ApplicationId|ApplicationId]], returns an output s32 out_entrycount.

Returns 0x10-byte entries using the specified [[NCM_services#ApplicationId|ApplicationId]] starting at the specified index. Can only return game titles. The second entry if any is the update-title usually. When the input entryindex is >= totalentries, this will return 0 with out_entrycount=0.

= ns:am2, ns:ec, ns:rid, ns:rt, ns:web, ns:ro, ns:sweb =
These are "nn::ns::detail::IServiceGetterInterface".

These commands check a state field for a command-specific bit and returns an error if not set, this is a permissions check for service+command.

[11.0.0+] ns:ro was added.

[15.0.0+] ns:sweb was added.

{| class="wikitable" border="1"
|-
! Cmd || Name || Permission bit
|-
| 7988 || [6.0.0+] [[#IDynamicRightsInterface|GetDynamicRightsInterface]] || 10
|-
| 7989 || [5.1.0+] [[#IReadOnlyApplicationControlDataInterface|GetReadOnlyApplicationControlDataInterface]] || 9
|-
| 7991 || [5.0.0+] [[#IReadOnlyApplicationRecordInterface|GetReadOnlyApplicationRecordInterface]] || 8
|-
| 7992 || [4.0.0+] [[#IECommerceInterface|GetECommerceInterface]] || 7
|-
| 7993 || [4.0.0+] [[#IApplicationVersionInterface|GetApplicationVersionInterface]] || 6
|-
| 7994 || [[#IFactoryResetInterface|GetFactoryResetInterface]] || 5
|-
| 7995 || [[#IAccountProxyInterface|GetAccountProxyInterface]] || 4
|-
| 7996 || [[#IApplicationManagerInterface|GetApplicationManagerInterface]] || 3
|-
| 7997 || [[#IDownloadTaskInterface|GetDownloadTaskInterface]] || 1
|-
| 7998 || [[#IContentManagementInterface|GetContentManagementInterface]] || 0
|-
| 7999 || [[#IDocumentInterface|GetDocumentInterface]] || 2
|}

Permissions state field with each service:

{| class="wikitable" border="1"
|-
! Service || Permissions
|-
| ns:web || 0x304
|-
| ns:ec || 0x83
|-
| ns:sweb || 0x387
|-
| ns:rid || 0x10
|-
| ns:rt || 0x20
|-
| ns:ro || 0x301
|-
| ns:am2 || 0x7FF
|}

=== IAccountProxyInterface ===
This is "nn::ns::detail::IAccountProxyInterface".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || CreateUserAccount
|}

=== IApplicationManagerInterface ===
This is "nn::ns::detail::IApplicationManagerInterface".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#ListApplicationRecord]]
|-
| 1 || GenerateApplicationRecordCount
|-
| 2 || [[#GetApplicationRecordUpdateSystemEvent]]
|-
| 3 || [[#GetApplicationViewDeprecated]]
|-
| 4 || [[#DeleteApplicationEntity]]
|-
| 5 || [[#DeleteApplicationCompletely]]
|-
| 6 || IsAnyApplicationEntityRedundant
|-
| 7 || [[#DeleteRedundantApplicationEntity]]
|-
| 8 || [[#IsApplicationEntityMovable]]
|-
| 9 || [1.0.0-9.2.0] [[#MoveApplicationEntity]]
|-
| 11 || [[#CalculateApplicationOccupiedSize]]
|-
| 16 || PushApplicationRecord
|-
| 17 || ListApplicationRecordContentMeta
|-
| 19 || [1.0.0-5.1.0] LaunchApplicationOld
|-
| 21 || [[#GetApplicationContentPath]]
|-
| 22 || TerminateApplication
|-
| 23 || ResolveApplicationContentPath
|-
| 26 || BeginInstallApplication
|-
| 27 || DeleteApplicationRecord
|-
| 30 || [[#RequestApplicationUpdateInfo]]
|-
| 31 || [1.0.0-3.0.2] RequestUpdateApplication
|-
| 32 || [[#CancelApplicationDownload]]
|-
| 33 || [[#ResumeApplicationDownload]]
|-
| 35 || UpdateVersionList
|-
| 36 || PushLaunchVersion
|-
| 37 || ListRequiredVersion
|-
| 38 || [[#CheckApplicationLaunchVersion]]
|-
| 39 || [1.0.0-6.2.0] CheckApplicationLaunchRights
|-
| 40 || GetApplicationLogoData
|-
| 41 || CalculateApplicationDownloadRequiredSize
|-
| 42 || [[#CleanupSdCard]]
|-
| 43 || [[#CheckSdCardMountStatus]]
|-
| 44 || [[#GetSdCardMountStatusChangedEvent]]
|-
| 45 || GetGameCardAttachmentEvent
|-
| 46 || GetGameCardAttachmentInfo
|-
| 47 || [[#GetTotalSpaceSize]]
|-
| 48 || [[#GetFreeSpaceSize]]
|-
| 49 || GetSdCardRemovedEvent
|-
| 52 || [[#GetGameCardUpdateDetectionEvent]]
|-
| 53 || [[#DisableApplicationAutoDelete]]
|-
| 54 || [[#EnableApplicationAutoDelete]]
|-
| 55 || GetApplicationDesiredLanguage
|-
| 56 || [[#SetApplicationTerminateResult]]
|-
| 57 || [[#ClearApplicationTerminateResult]]
|-
| 58 || [[#GetLastSdCardMountUnexpectedResult]]
|-
| 59 || ConvertApplicationLanguageToLanguageCode
|-
| 60 || [[#ConvertLanguageCodeToApplicationLanguage]]
|-
| 61 || GetBackgroundDownloadStressTaskInfo
|-
| 62 || GetGameCardStopper
|-
| 63 || IsSystemProgramInstalled
|-
| 64 || StartApplyDeltaTask
|-
| 65 || [[#GetRequestServerStopper]]
|-
| 66 || [3.0.0+] GetBackgroundApplyDeltaStressTaskInfo
|-
| 67 || [3.0.0+] [[#CancelApplicationApplyDelta]]
|-
| 68 || [3.0.0+] [[#ResumeApplicationApplyDelta]]
|-
| 69 || [3.0.0+] [[#CalculateApplicationApplyDeltaRequiredSize]]
|-
| 70 || [3.0.0+] [[#ResumeAll]]
|-
| 71 || [3.0.0+] [[#GetStorageSize]]
|-
| 80 || [3.0.0+] RequestDownloadApplication
|-
| 81 || [3.0.0+] RequestDownloadAddOnContent
|-
| 82 || [3.0.0+] DownloadApplication
|-
| 83 || [4.0.0-6.2.0] CheckApplicationResumeRights
|-
| 84 || [4.0.0-16.1.0] GetDynamicCommitEvent
|-
| 85 || [4.0.0+] [[#RequestUpdateApplication2]]
|-
| 86 || [4.0.0+] EnableApplicationCrashReport
|-
| 87 || [4.0.0+] IsApplicationCrashReportEnabled
|-
| 90 || [15.0.0+] BoostSystemMemoryResourceLimit ([4.0.0-8.1.0] BoostSystemMemoryResourceLimit)
|-
| 91 || [5.0.0+] DeprecatedLaunchApplication
|-
| 92 || [5.0.0+] GetRunningApplicationProgramId
|-
| 93 || [5.0.0+] GetMainApplicationProgramIndex
|-
| 94 || [6.0.0+] [[#LaunchApplication_2|LaunchApplication]]
|-
| 95 || [6.0.0+] [[#GetApplicationLaunchInfo]]
|-
| 96 || [6.0.0+] [[#AcquireApplicationLaunchInfo]]
|-
| 97 || [6.0.0+] [[#GetMainApplicationProgramIndexByApplicationLaunchInfo]]
|-
| 98 || [6.0.0+] EnableApplicationAllThreadDumpOnCrash
|-
| 99 || [8.0.0+] [[#LaunchDevMenu]]
|-
| 100 || [[#ResetToFactorySettings]]
|-
| 101 || [[#ResetToFactorySettingsWithoutUserSaveData]]
|-
| 102 || [[#ResetToFactorySettingsForRefurbishment]]
|-
| 103 || [9.1.0+] [[#ResetToFactorySettingsWithPlatformRegion]]
|-
| 104 || [9.1.0+] [[#ResetToFactorySettingsWithPlatformRegionAuthentication]]
|-
| 105 || [10.0.0+] [[#RequestResetToFactorySettingsSecurely]]
|-
| 106 || [10.0.0+] [[#RequestResetToFactorySettingsWithPlatformRegionAuthenticationSecurely]]
|-
| 200 || CalculateUserSaveDataStatistics
|-
| 201 || [[#DeleteUserSaveDataAll]]
|-
| 210 || [[#DeleteUserSystemSaveData]]
|-
| 211 || [6.0.0+] [[#DeleteSaveData]]
|-
| 220 || [[#UnregisterNetworkServiceAccount]]
|-
| 221 || [6.0.0+] [[#UnregisterNetworkServiceAccountWithUserSaveDataDeletion]]
|-
| 300 || GetApplicationShellEvent
|-
| 301 || PopApplicationShellEventInfo
|-
| 302 || [[#LaunchLibraryApplet]]
|-
| 303 || TerminateLibraryApplet
|-
| 304 || [[#LaunchSystemApplet]]
|-
| 305 || TerminateSystemApplet
|-
| 306 || [[#LaunchOverlayApplet]]
|-
| 307 || TerminateOverlayApplet
|-
| 308 || [S2]
|-
| 309 || [S2]
|-
| 400 || [[#GetApplicationControlData]]
|-
| 401 || InvalidateAllApplicationControlCache
|-
| 402 || [[#RequestDownloadApplicationControlData]]
|-
| 403 || GetMaxApplicationControlCacheCount
|-
| 404 || InvalidateApplicationControlCache
|-
| 405 || ListApplicationControlCacheEntryInfo
|-
| 406 || [6.0.0-18.1.0] [[#GetApplicationControlProperty]]
|-
| 407 || [8.0.0+] [[#ListApplicationTitle]]
|-
| 408 || [8.0.0+] [[#ListApplicationIcon]]
|-
| 409 || [S2]
|-
| 410 || [S2]
|-
| 411 || [19.0.0+]
|-
| 412 || [19.0.0+]
|-
| 413 || [19.0.0+]
|-
| 414 || [19.0.0+]
|-
| 415 || [19.0.0+]
|-
| 416 || [19.0.0+]
|-
| 417 || [19.0.0+] InvalidateAllApplicationControlCacheOfTheStage
|-
| 418 || [19.0.0+] InvalidateApplicationControlCacheOfTheStage
|-
| 419 || [19.0.0+] RequestDownloadApplicationControlDataInBackground
|-
| 420 || [19.0.0+] CloneApplicationControlDataCacheForDebug
|-
| 421 || [20.0.0+]
|-
| 422 || [20.0.0+]
|-
| 423 || [20.0.0+]
|-
| 424 || [20.0.0+]
|-
| 425 || [20.0.0+]
|-
| 426 || [20.0.0+]
|-
| 427 || [20.0.0+]
|-
| 428 || [21.0.0+]
|-
| 429 || [21.0.0+]
|-
| 430 || [21.0.0+]
|-
| 502 || [[#RequestCheckGameCardRegistration]]
|-
| 503 || [[#RequestGameCardRegistrationGoldPoint]]
|-
| 504 || [[#RequestRegisterGameCard]]
|-
| 505 || [3.0.0+] [[#GetGameCardMountFailureEvent]]
|-
| 506 || [3.0.0+] [[#IsGameCardInserted]]
|-
| 507 || [3.0.0+] [[#EnsureGameCardAccess]]
|-
| 508 || [3.0.0+] [[#GetLastGameCardMountFailureResult]]
|-
| 509 || [5.0.0+] [[#ListApplicationIdOnGameCard]]
|-
| 510 || [9.0.0+] [[#GetGameCardPlatformRegion]]
|-
| 511 || [19.0.0+] GetGameCardWakenReadyEvent
|-
| 512 || [19.0.0+] IsGameCardApplicationRunning
|-
| 513 || [20.0.0+]
|-
| 514 || [20.0.0+]
|-
| 515 || [20.0.0+]
|-
| 516 || [21.0.0+]
|-
| 517 || [21.0.0+]
|-
| 518 || [21.0.0+]
|-
| 519 || [21.0.0+]
|-
| 600 || [[#CountApplicationContentMeta]]
|-
| 601 || [[#ListApplicationContentMetaStatus]]
|-
| 602 || [2.0.0-5.1.0] ListAvailableAddOnContent
|-
| 603 || GetOwnedApplicationContentMetaStatus
|-
| 604 || [1.0.0-15.0.1] RegisterContentsExternalKey
|-
| 605 || ListApplicationContentMetaStatusWithRightsCheck
|-
| 606 || [3.0.0+] GetContentMetaStorage
|-
| 607 || [6.0.0+] [[#ListAvailableAddOnContent]]
|-
| 609 || [13.0.0+] ListAvailabilityAssuredAddOnContent
|-
| 610 || [14.0.0+] GetInstalledContentMetaStorage
|-
| 611 || [16.0.0+] PrepareAddOnContent
|-
| 700 || PushDownloadTaskList
|-
| 701 || [[#ClearTaskStatusList]]
|-
| 702 || [[#RequestDownloadTaskList]]
|-
| 703 || [[#RequestEnsureDownloadTask]]
|-
| 704 || [[#ListDownloadTaskStatus]]
|-
| 705 || [[#RequestDownloadTaskListData]]
|-
| 800 || RequestVersionList
|-
| 801 || ListVersionList
|-
| 802 || [3.0.0+] [[#RequestVersionListData]]
|-
| 900 || GetApplicationRecord
|-
| 901 || GetApplicationRecordProperty
|-
| 902 || EnableApplicationAutoUpdate
|-
| 903 || DisableApplicationAutoUpdate
|-
| 904 || [[#TouchApplication]]
|-
| 905 || RequestApplicationUpdate
|-
| 906 || [[#IsApplicationUpdateRequested]]
|-
| 907 || [[#WithdrawApplicationUpdateRequest]]
|-
| 908 || ListApplicationRecordInstalledContentMeta
|-
| 909 || [3.0.0-14.1.2] WithdrawCleanupAddOnContentsWithNoRightsRecommendation
|-
| 910 || [5.0.0+] HasApplicationRecord
|-
| 911 || [5.1.0+] SetPreInstalledApplication
|-
| 912 || [5.1.0+] ClearPreInstalledApplicationFlag
|-
| 913 || [9.0.0+] ListAllApplicationRecord
|-
| 914 || [9.0.0+] HideApplicationRecord
|-
| 915 || [9.0.0+] ShowApplicationRecord
|-
| 916 || [11.0.0+] IsApplicationAutoDeleteDisabled
|-
| 917 || [20.0.0+]
|-
| 918 || [20.0.0+]
|-
| 919 || [20.0.0+]
|-
| 920 || [20.0.0+]
|-
| 921 || [20.0.0+]
|-
| 922 || [20.0.0+]
|-
| 923 || [20.0.0+]
|-
| 924 || [S2]
|-
| 925 || [S2]
|-
| 926 || [S2]
|-
| 927 || [S2]
|-
| 928 || [20.0.0+]
|-
| 929 || [20.0.0+]
|-
| 930 || [20.0.0+]
|-
| 931 || [20.0.0+]
|-
| 933 || [20.1.0+]
|-
| 934 || [21.0.0+]
|-
| 935 || [21.0.0+]
|-
| 936 || [21.0.0+]
|-
| 1000 || [[#RequestVerifyApplicationDeprecated]]
|-
| 1001 || CorruptApplicationForDebug
|-
| 1002 || [3.0.0-9.2.0] [[#RequestVerifyAddOnContentsRights]]
|-
| 1003 || [5.0.0+] [[#RequestVerifyApplication]]
|-
| 1004 || [5.0.0+] CorruptContentForDebug
|-
| 1200 || [[#NeedsUpdateVulnerability]]
|-
| 1300 || [[#IsAnyApplicationEntityInstalled]]
|-
| 1301 || DeleteApplicationContentEntities
|-
| 1302 || CleanupUnrecordedApplicationEntity
|-
| 1303 || [3.0.0-9.2.0] CleanupAddOnContentsWithNoRights
|-
| 1304 || [3.0.0+] DeleteApplicationContentEntity
|-
| 1308 || [5.0.0+] DeleteApplicationCompletelyForDebug
|-
| 1309 || [6.0.0+] [[#CleanupUnavailableAddOnContents]]
|-
| 1310 || [10.0.0+] [[#RequestMoveApplicationEntity]]
|-
| 1311 || [10.0.0+] [[#EstimateSizeToMove]]
|-
| 1312 || [10.0.0+] HasMovableEntity
|-
| 1313 || [11.0.0+] CleanupOrphanContents
|-
| 1314 || [11.0.0+] CheckPreconditionSatisfiedToMove
|-
| 1400 || PrepareShutdown
|-
| 1500 || [[#FormatSdCard]]
|-
| 1501 || [[#NeedsSystemUpdateToFormatSdCard]]
|-
| 1502 || [[#GetLastSdCardFormatUnexpectedResult]]
|-
| 1504 || [3.0.0+] InsertSdCard
|-
| 1505 || [3.0.0+] RemoveSdCard
|-
| 1506 || [9.0.0+] GetSdCardStartupStatus
|-
| 1508 || [20.0.0+]
|-
| 1509 || [20.0.0+]
|-
| 1510 || [20.0.0+]
|-
| 1511 || [20.0.0+]
|-
| 1512 || [20.0.0+]
|-
| 1600 || GetSystemSeedForPseudoDeviceId
|-
| 1601 || [3.0.0+] ResetSystemSeedForPseudoDeviceId
|-
| 1700 || ListApplicationDownloadingContentMeta
|-
| 1701 || [3.0.0+] [[#GetApplicationView]]
|-
| 1702 || [3.0.0+] GetApplicationDownloadTaskStatus
|-
| 1703 || [4.0.0+] [[#GetApplicationViewDownloadErrorContext]]
|-
| 1704 || [8.0.0+] [[#GetApplicationViewWithPromotionInfo]]
|-
| 1705 || [11.0.0+] [[#IsPatchAutoDeletableApplication]]
|-
| 1706 || [20.0.0+]
|-
| 1800 || IsNotificationSetupCompleted
|-
| 1801 || GetLastNotificationInfoCount
|-
| 1802 || [[#ListLastNotificationInfo]]
|-
| 1803 || [3.0.0+] [[#ListNotificationTask]]
|-
| 1900 || [3.0.0-12.1.0] IsActiveAccount
|-
| 1901 || [4.0.0+] [[#RequestDownloadApplicationPrepurchasedRights]]
|-
| 1902 || [5.0.0+] GetApplicationTicketInfo
|-
| 1903 || [13.1.0+] RequestDownloadApplicationPrepurchasedRightsForAccount
|-
| 2000 || [4.0.0+] [[#GetSystemDeliveryInfo]]
|-
| 2001 || [4.0.0+] [[#SelectLatestSystemDeliveryInfo]]
|-
| 2002 || [4.0.0+] [[#VerifyDeliveryProtocolVersion]]
|-
| 2003 || [4.0.0+] [[#GetApplicationDeliveryInfo]]
|-
| 2004 || [4.0.0+] [[#HasAllContentsToDeliver]]
|-
| 2005 || [4.0.0+] [[#CompareApplicationDeliveryInfo]]
|-
| 2006 || [4.0.0+] [[#CanDeliverApplication]]
|-
| 2007 || [4.0.0+] [[#ListContentMetaKeyToDeliverApplication]]
|-
| 2008 || [4.0.0+] [[#NeedsSystemUpdateToDeliverApplication]]
|-
| 2009 || [4.0.0+] [[#EstimateRequiredSize]]
|-
| 2010 || [4.0.0+] [[#RequestReceiveApplication]]
|-
| 2011 || [4.0.0+] [[#CommitReceiveApplication]]
|-
| 2012 || [4.0.0+] [[#GetReceiveApplicationProgress]]
|-
| 2013 || [4.0.0+] [[#RequestSendApplication]]
|-
| 2014 || [4.0.0+] [[#GetSendApplicationProgress]]
|-
| 2015 || [4.0.0+] [[#CompareSystemDeliveryInfo]]
|-
| 2016 || [4.0.0+] [[#ListNotCommittedContentMeta]]
|-
| 2017 || [4.0.0+] [[#RecoverDownloadTask]]
|-
| 2018 || [5.0.0+] [[#GetApplicationDeliveryInfoHash]]
|-
| 2019 || [20.0.0+]
|-
| 2050 || [6.0.0+] [[#GetApplicationRightsOnClient]]
|-
| 2051 || [9.0.0+] InvalidateRightsIdCache
|-
| 2052 || [20.0.0+]
|-
| 2053 || [20.0.0+]
|-
| 2100 || [6.0.0+] [[#GetApplicationTerminateResult]]
|-
| 2101 || [6.0.0+] GetRawApplicationTerminateResult
|-
| 2150 || [6.0.0+] CreateRightsEnvironment
|-
| 2151 || [6.0.0+] DestroyRightsEnvironment
|-
| 2152 || [6.0.0+] ActivateRightsEnvironment
|-
| 2153 || [6.0.0+] DeactivateRightsEnvironment
|-
| 2154 || [6.0.0+] ForceActivateRightsContextForExit
|-
| 2155 || [7.0.0+] UpdateRightsEnvironmentStatus
|-
| 2156 || [10.0.0-12.1.0] CreateRightsEnvironmentForMicroApplication ([9.0.0-9.2.0] CreateRightsEnvironmentForPreomia)
|-
| 2160 || [6.0.0+] AddTargetApplicationToRightsEnvironment
|-
| 2161 || [6.0.0+] SetUsersToRightsEnvironment
|-
| 2170 || [6.0.0+] GetRightsEnvironmentStatus
|-
| 2171 || [6.0.0+] GetRightsEnvironmentStatusChangedEvent
|-
| 2180 || [6.0.0+] RequestExtendExpirationInRightsEnvironment
|-
| 2181 || [6.0.0+] GetResultOfExtendExpirationInRightsEnvironment
|-
| 2182 || [6.0.0+] SetActiveRightsContextUsingStateToRightsEnvironment
|-
| 2183 || [20.1.0+]
|-
| 2190 || [6.0.0+] [[#GetRightsEnvironmentHandleForApplication]]
|-
| 2199 || [6.0.0+] GetRightsEnvironmentCountForDebug
|-
| 2200 || [6.0.0-9.2.0] GetGameCardApplicationCopyIdentifier
|-
| 2201 || [6.0.0-9.2.0] GetInstalledApplicationCopyIdentifier
|-
| 2250 || [6.0.0-6.2.0] RequestReportActiveELicence
|-
| 2300 || [6.0.0-8.1.0] ListEventLog
|-
| 2350 || [7.0.0+] PerformAutoUpdateByApplicationId
|-
| 2351 || [9.0.0+] [[#RequestNoDownloadRightsErrorResolution]]
|-
| 2352 || [9.0.0+] [[#RequestResolveNoDownloadRightsError]]
|-
| 2353 || [10.0.0+] GetApplicationDownloadTaskInfo
|-
| 2354 || [11.0.0+] PrioritizeApplicationBackgroundTask
|-
| 2355 || [12.0.0+] PreferStorageEfficientUpdate
|-
| 2356 || [12.0.0+] RequestStorageEfficientUpdatePreferable
|-
| 2357 || [15.0.0+] EnableMultiCoreDownload
|-
| 2358 || [15.0.0+] DisableMultiCoreDownload
|-
| 2359 || [15.0.0+] IsMultiCoreDownloadEnabled
|-
| 2360 || [19.0.0+] GetApplicationDownloadTaskCount
|-
| 2361 || [19.0.0+] GetMaxApplicationDownloadTaskCount
|-
| 2362 || [20.0.0+]
|-
| 2363 || [20.0.0+]
|-
| 2364 || [20.0.0+]
|-
| 2365 || [20.0.0+]
|-
| 2366 || [20.0.0+]
|-
| 2367 || [20.0.0+]
|-
| 2368 || [20.0.0+]
|-
| 2369 || [21.0.0+]
|-
| 2400 || [8.0.0+] [[#GetPromotionInfo]]
|-
| 2401 || [8.0.0+] CountPromotionInfo
|-
| 2402 || [8.0.0+] [[#ListPromotionInfo|ListPromotionInfo]]
|-
| 2403 || [8.0.0+] [[#ImportPromotionJsonForDebug]]
|-
| 2404 || [8.0.0+] [[#ClearPromotionInfoForDebug]]
|-
| 2500 || [8.0.0+] ConfirmAvailableTime
|-
| 2510 || [9.0.0+] [[#CreateApplicationResource]]
|-
| 2511 || [9.0.0+] [[#GetApplicationResource]]
|-
| 2513 || [10.0.0+] [[#LaunchMicroApplication]] ([9.0.0-9.2.0] LaunchPreomia)
|-
| 2514 || [9.0.0+] ClearTaskOfAsyncTaskManager
|-
| 2515 || [10.0.0+] CleanupAllPlaceHolderAndFragmentsIfNoTask
|-
| 2516 || [10.0.0-14.1.2] EnsureApplicationCertificate
|-
| 2517 || [13.0.0+] [[#CreateApplicationInstance]]
|-
| 2518 || [13.0.0+] UpdateQualificationForDebug
|-
| 2519 || [13.0.0+] IsQualificationTransitionSupported
|-
| 2520 || [13.0.0+] IsQualificationTransitionSupportedByProcessId
|-
| 2521 || [13.0.0-16.1.0] GetRightsUserChangedEvent
|-
| 2522 || [14.0.0+] IsRomRedirectionAvailable
|-
| 2523 || [17.0.0+] GetProgramId
|-
| 2524 || [19.0.0+]
|-
| 2525 || [20.0.0+]
|-
| 2800 || [9.0.0+] GetApplicationIdOfPreomia
|-
| 3000 || [11.0.0+] [[#RegisterDeviceLockKey]]
|-
| 3001 || [11.0.0+] [[#UnregisterDeviceLockKey]]
|-
| 3002 || [11.0.0+] [[#VerifyDeviceLockKey]]
|-
| 3003 || [11.0.0+] [[#HideApplicationIcon]]
|-
| 3004 || [11.0.0+] [[#ShowApplicationIcon]]
|-
| 3005 || [11.0.0+] [[#HideApplicationTitle]]
|-
| 3006 || [11.0.0+] [[#ShowApplicationTitle]]
|-
| 3007 || [11.0.0+] [[#EnableGameCard]]
|-
| 3008 || [11.0.0+] [[#DisableGameCard]]
|-
| 3009 || [11.0.0+] [[#EnableLocalContentShare]]
|-
| 3010 || [11.0.0+] [[#DisableLocalContentShare]]
|-
| 3011 || [11.0.0+] [[#IsApplicationIconHidden]]
|-
| 3012 || [11.0.0+] [[#IsApplicationTitleHidden]]
|-
| 3013 || [11.0.0+] [[#IsGameCardEnabled]]
|-
| 3014 || [11.0.0+] [[#IsLocalContentShareEnabled]]
|-
| 3015 || [18.0.0+] GetNetworkUpdateRequiredByGameCardDetectionEvent
|-
| 3050 || [14.0.0+] ListAssignELicenseTaskResult
|-
| 3100 || [17.0.0+] [[#GetSafeSystemVersionCheckInfo|GetSafeSystemVersionCheckInfo]]
|-
| 3101 || [17.0.0+] [[#RequestUpdateSafeSystemVersionCheckInfo|RequestUpdateSafeSystemVersionCheckInfo]]
|-
| 3102 || [17.0.0+] [[#ResetSafeSystemVersionCheckInfo|ResetSafeSystemVersionCheckInfo]]
|-
| 3104 || [18.0.0+] GetApplicationNintendoLogo
|-
| 3105 || [18.0.0+] GetApplicationStartupMovie
|-
| 3150 || [S2]
|-
| 4000 || [20.0.0+]
|-
| 4004 || [20.0.0+]
|-
| 4006 || [20.0.0+]
|-
| 4007 || [20.0.0+]
|-
| 4008 || [20.0.0+]
|-
| 4009 || [20.0.0+]
|-
| 4010 || [20.0.0+]
|-
| 4011 || [20.0.0+]
|-
| 4012 || [20.0.0+]
|-
| 4013 || [20.0.0+]
|-
| 4015 || [20.0.0+]
|-
| 4017 || [20.0.0+]
|-
| 4019 || [20.0.0+]
|-
| 4020 || [20.0.0+]
|-
| 4021 || [20.0.0+]
|-
| 4022 || [20.0.0+]
|-
| 4023 || [20.0.0+]
|-
| 4024 || [20.0.0+]
|-
| 4025 || [20.0.0+]
|-
| 4026 || [20.0.0+]
|-
| 4027 || [20.0.0+]
|-
| 4028 || [20.0.0+]
|-
| 4029 || [20.0.0+]
|-
| 4030 || [20.0.0+]
|-
| 4031 || [20.0.0+]
|-
| 4032 || [20.0.0+]
|-
| 4033 || [20.0.0+]
|-
| 4034 || [20.0.0+]
|-
| 4035 || [20.0.0+]
|-
| 4037 || [20.0.0+]
|-
| 4038 || [20.0.0+]
|-
| 4039 || [20.0.0+]
|-
| 4040 || [20.0.0+]
|-
| 4041 || [20.0.0+]
|-
| 4042 || [20.0.0+]
|-
| 4043 || [20.0.0+]
|-
| 4044 || [20.0.0+]
|-
| 4045 || [20.0.0+]
|-
| 4046 || [20.0.0+]
|-
| 4049 || [20.0.0+]
|-
| 4050 || [20.0.0+]
|-
| 4051 || [20.0.0+]
|-
| 4052 || [20.0.0+]
|-
| 4053 || [20.0.0+]
|-
| 4054 || [20.0.0+]
|-
| 4055 || [20.0.0+]
|-
| 4056 || [20.0.0+]
|-
| 4057 || [20.0.0+]
|-
| 4058 || [20.0.0+]
|-
| 4059 || [20.0.0+]
|-
| 4060 || [20.0.0+]
|-
| 4061 || [20.0.0+]
|-
| 4062 || [20.0.0+]
|-
| 4063 || [20.0.0+]
|-
| 4064 || [20.0.0+]
|-
| 4065 || [20.0.0+]
|-
| 4066 || [20.0.0+]
|-
| 4067 || [20.0.0+]
|-
| 4068 || [20.0.0+]
|-
| 4069 || [20.0.0+]
|-
| 4070 || [20.0.0+]
|-
| 4071 || [20.0.0+]
|-
| 4072 || [20.0.0+]
|-
| 4073 || [20.0.0+]
|-
| 4074 || [20.0.0+]
|-
| 4075 || [20.0.0+]
|-
| 4076 || [20.0.0+]
|-
| 4077 || [20.0.0+]
|-
| 4078 || [20.0.0+]
|-
| 4079 || [20.0.0+]
|-
| 4080 || [20.0.0+]
|-
| 4081 || [20.0.0+]
|-
| 4083 || [20.0.0+]
|-
| 4084 || [20.0.0+]
|-
| 4085 || [20.0.0+]
|-
| 4086 || [20.0.0+]
|-
| 4087 || [20.0.0+]
|-
| 4088 || [20.0.0+]
|-
| 4089 || [20.0.0+]
|-
| 4090 || [20.0.0+]
|-
| 4091 || [20.0.0+]
|-
| 4092 || [20.0.0+]
|-
| 4093 || [20.0.0+]
|-
| 4094 || [20.0.0+]
|-
| 4095 || [20.0.0+]
|-
| 4096 || [20.0.0+]
|-
| 4097 || [20.0.0+]
|-
| 4099 || [21.0.0+]
|-
| 5000 || [18.0.0+]
|-
| 5001 || [18.0.0+]
|-
| 9999 || [10.0.0-10.2.0] GetApplicationCertificate
|}

[4.0.0+] RequestDownloadAddOnContent now takes an additional 8-bytes of input.

==== GetApplicationRecordUpdateSystemEvent ====
No input, returns an output Event handle with EventClearMode=1.

==== GetApplicationViewDeprecated ====
Takes a type-0x6 output buffer containing an array of [[#ApplicationViewDeprecated]], a type-0x5 input buffer containing an array of u64 [[NCM_services#ApplicationId|ApplicationIds]], no output.

On newer system-versions this is the same as [[#GetApplicationView]], except this converts the output from the func called in the loop from [[#ApplicationView]] to [[#ApplicationViewDeprecated]].

==== DeleteApplicationEntity ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], no output.

==== DeleteApplicationCompletely ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], no output.

==== DeleteRedundantApplicationEntity ====
No input/output.

==== IsApplicationEntityMovable ====
Takes an input u8 [[NCM_services#StorageId|StorageId]], an [[NCM_services#ApplicationId|ApplicationId]], returns an output u8 bool.

==== MoveApplicationEntity ====
Takes an input u8 [[NCM_services#StorageId|StorageId]], an [[NCM_services#ApplicationId|ApplicationId]], no output.

==== RequestApplicationUpdateInfo ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IAsyncValue]].

The data that can be read from the [[#IAsyncValue]] is [[#ApplicationUpdateInfo]].

Before using the cmd, official sw uses [[Network_Interface_services#IsAnyInternetRequestAccepted|IsAnyInternetRequestAccepted]] with the output from [[Network_Interface_services#GetClientId|GetClientId]], throwing an error when the returned bool is false.

==== CancelApplicationDownload ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], no output.

==== ResumeApplicationDownload ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], no output.

==== CheckApplicationLaunchVersion ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], no output.

==== CalculateApplicationDownloadRequiredSize ====
Takes an input u8 [[NCM_services#StorageId|StorageId]], an [[NCM_services#ApplicationId|ApplicationId]], returns an output s64.

==== CleanupSdCard ====
No input/output.

==== GetSdCardMountStatusChangedEvent ====
No input, returns an output Event handle with EventClearMode=0.

==== GetGameCardUpdateDetectionEvent ====
No input, returns an output Event handle with EventClearMode=0.

This Event is used by [[qlaunch]] to check whether a card-sysupdate is required.

==== DisableApplicationAutoDelete ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], no output.

==== EnableApplicationAutoDelete ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], no output.

==== SetApplicationTerminateResult ====
Takes an input u32 Result, an [[NCM_services#ApplicationId|ApplicationId]], no output.

==== ClearApplicationTerminateResult ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], no output.

==== GetLastSdCardMountUnexpectedResult ====
No input/output.

==== GetRequestServerStopper ====
No input, returns an output [[#IRequestServerStopper]].

This increfs a state ref-count, with decref being handled when the object is closed. This ref-count is checked by [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]] and related cmds.

==== CancelApplicationApplyDelta ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], no output.

==== ResumeApplicationApplyDelta ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], no output.

==== CalculateApplicationApplyDeltaRequiredSize ====
Takes an input u8 [[NCM_services#StorageId|StorageId]], an [[NCM_services#ApplicationId|ApplicationId]], returns an output s64.

==== ResumeAll ====
No input/output.

==== GetStorageSize ====
Takes an input u8 [[NCM_services#StorageId|StorageId]], returns two output s64s.

This temporarily mounts the [[Filesystem_services#OpenContentStorageFileSystem|ContentStorage]] specified by the StorageId (must be BuiltInUser or SdCard). The two output s64s are the output from [[Filesystem_services#GetTotalSpaceSize|GetTotalSpaceSize]] and [[Filesystem_services#GetFreeSpaceSize|GetFreeSpaceSize]] with this ContentStorage, with it this being unmounted afterwards.

==== RequestUpdateApplication2 ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IAsyncResult]].

See [[#RequestApplicationUpdateInfo]] regarding nifm.

==== LaunchApplication ====
Takes an input u8 ProgramIndex, an input [[#ApplicationLaunchInfo]], returns an output u64.

[18.0.0+] Now takes a total of 0x58 bytes of input.

[19.0.0+] Now takes a total of 0x88 bytes of input.

==== GetApplicationLaunchInfo ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output [[#ApplicationLaunchInfo]].

[18.0.0+] Now returns a total of 0x50 bytes of output.

[19.0.0+] Now returns a total of 0x80 bytes of output.

==== AcquireApplicationLaunchInfo ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output [[#ApplicationLaunchInfo]].

This verifies that a state flag is set and that a state field matches the input ApplicationId, throwing an error otherwise. The [[#ApplicationLaunchInfo]] from state is copied to output, then the state flag is cleared.

[18.0.0+] Now returns a total of 0x50 bytes of output.

[19.0.0+] Now returns a total of 0x80 bytes of output.

==== GetMainApplicationProgramIndexByApplicationLaunchInfo ====
[18.0.0+] Now takes a total of 0x50 bytes of input.

[19.0.0+] Now returns a total of 0x80 bytes of output.

==== LaunchDevMenu ====
No input/output.

This is used by AM cmd [[Applet_Manager_services#LaunchDevMenu|LaunchDevMenu]].

This loads ProgramIds from [[System_Settings|system-settings]] <code>ns.applet!devmenu_id</code> and <code>ns.applet!devoverlaydisp_id</code>, which only exists on devunits. An error is thrown if loading these fail.

[[NCM_services#ncm|OpenContentMetaDatabase]] is used with StorageId = NandSystem, then IContentMetaDatabase GetLatestContentMetaKey is used with both of the above ProgramIds to verify that the cmd is successful.

Then if the above succeeds, the above titles are launched with the above StorageId via [[Process_Manager_services|pmshell]] LaunchProgram ([10.0.0+] [[PGL_services#LaunchProgram|pgl]] with pgl_launch_flags=0), with a 0.5s sleep-thread afterwards on success. [[Process_Manager_services#LaunchFlags|LaunchFlags]] value 0xB is used here.

==== DeleteUserSaveDataAll ====
Takes an input [[Account_services#Uid|Uid]], returns an output [[#IProgressMonitorForDeleteUserSaveDataAll]].

On success, [[#IProgressMonitorForDeleteUserSaveDataAll]] GetProgress is used with the output being copied into object state.

==== DeleteUserSystemSaveData ====
Takes an input [[Account_services#Uid|Uid]], an u64 SystemSaveDataId, no output.

==== DeleteSaveData ====
Takes an input u8 [[Filesystem_services#SaveDataSpaceId|SaveDataSpaceId]], an u64 SaveDataId, no output.

==== UnregisterNetworkServiceAccount ====
Takes an input [[Account_services#Uid|Uid]], no output.

==== UnregisterNetworkServiceAccountWithUserSaveDataDeletion ====
Takes an input [[Account_services#Uid|Uid]], no output.

==== LaunchLibraryApplet ====
Takes an input u64 [[NCM_services#ProgramId|ProgramId]], returns an output u64.

The specified program is launched with StorageId=BuiltInSystem via [[Process_Manager_services|pmshell]] LaunchProgram ([10.0.0+] [[PGL_services#LaunchProgram|pgl]] with pgl_launch_flags=0). [[Process_Manager_services#LaunchFlags|LaunchFlags]] value 0x9 is used here. The output u64 from here is written to the output for this cmd, on success.

This is used by [[Applet_Manager_services|AM]].

==== LaunchSystemApplet ====
No input, returns an output u64.

A state flag must be non-zero, otherwise an error is thrown. When a state field is value 1, a hard-coded ProgramId for MaintenanceMenu is used. Otherwise, the ProgramId is loaded from [[System_Settings|system-setting]] <code>ns.applet!system_applet_id</code> ([20.0.0+] <code>ns.applet!system_applet_id_gen2</code>).

The SystemApplet is launched with StorageId=BuiltInSystem via [[Process_Manager_services|pmshell]] LaunchProgram ([10.0.0+] [[PGL_services#LaunchProgram|pgl]] with pgl_launch_flags=0). [[Process_Manager_services#LaunchFlags|LaunchFlags]] value 0x9 is used here. The output u64 from here is written to the output for this cmd, on success.

This is used by [[Applet_Manager_services|AM]].

==== LaunchOverlayApplet ====
No input, returns an output u64.

A state flag must be non-zero, otherwise an error is thrown. The ProgramId is loaded from [[System_Settings|system-setting]] <code>ns.applet!overlay_applet_id</code>.

The OverlayApplet is launched with StorageId=BuiltInSystem via [[Process_Manager_services|pmshell]] LaunchProgram ([10.0.0+] [[PGL_services#LaunchProgram|pgl]] with pgl_launch_flags=0). [[Process_Manager_services#LaunchFlags|LaunchFlags]] value 0x9 is used here. The output u64 from here is written to the output for this cmd, on success.

This is used by [[Applet_Manager_services|AM]].

==== RequestDownloadApplicationControlData ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IAsyncResult]].

See [[#RequestApplicationUpdateInfo]] regarding nifm.

==== GetApplicationControlProperty ====
[18.0.0+] Now takes a total of 0x58 bytes of input.

==== ListApplicationTitle ====
Takes an input TransferMemory handle, a type-0x5 input buffer containing an array of u64 [[NCM_services#ApplicationId|ApplicationIds]], an u8 [[#ApplicationControlSource]], an u64 size, returns an output Event handle and an [[#IAsyncValue]].

[[qlaunch]] uses value 0x1 for the u8.

The user-process creates the TransferMemory with permissions=R--.

The data available with [[#IAsyncValue]] Get is a s32 for the offset within the TransferMemory where the output data is located, GetSize returns the total byte-size of the data located here. The data located here is the [[NACP_Format|NACP]] title-entry for each specified ApplicationId.

The TransferMemory size must be at least: count*sizeof([[NACP_Format|title-entry]]) + count*sizeof(u64) + count*[[#GetApplicationControlData|0x24000]].

This is essentially an async wrapper for [[#GetApplicationControlData]], with support for multiple ApplicationIds.

==== ListApplicationIcon ====
Takes an input TransferMemory handle, a type-0x5 input buffer containing an array of u64 [[NCM_services#ApplicationId|ApplicationIds]], an u8 [[#ApplicationControlSource]], an u64 size, returns an output Event handle and an [[#IAsyncValue]].

The user-process creates the TransferMemory with permissions=R--.

The data available with [[#IAsyncValue]] Get is a s32 for the offset within the TransferMemory where the output data is located, GetSize returns the total byte-size of the data located here. This data is: an u64 for total entries, an array of u64s for each icon size, then the icon JPEGs for the specified ApplicationIds.

The TransferMemory size must be at least: 0x4 + count*sizeof(u64) + count*[[#GetApplicationControlData|0x20000]] + count*sizeof(u64) + [[#GetApplicationControlData|0x24000]].

This is essentially an async wrapper for [[#GetApplicationControlData]], with support for multiple ApplicationIds.

==== Cmd421 ====
Takes an input TransferMemory handle, a type-0x5 input buffer containing an array of u64 [[NCM_services#ApplicationId|ApplicationIds]], an u8 [[#ApplicationControlSource]], an u64 size, returns an output Event handle and an [[#IAsyncValue]].

This is essentially the same as [[#ListApplicationTitle|ListApplicationTitle]] except the ApplicationControlSource is used here (ListApplicationTitle ignores it and uses 0xF0 instead).

The TransferMemory size must be at least: count*sizeof(u64) + count*[[NACP#ApplicationTitle|0x300]] + [[#GetApplicationControlData|0x1d000]].

The async task impl code eventually compares ApplicationControlSource with 0xF0, with a separate code-path being used when it doesn't match (which also handles [[NACP|compression]] when needed).

==== RequestCheckGameCardRegistration ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IAsyncResult]].

See [[#RequestApplicationUpdateInfo]] regarding nifm.

==== RequestGameCardRegistrationGoldPoint ====
Takes an input [[Account_services#Uid|Uid]], an [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IAsyncValue]].

The data that can be read from the [[#IAsyncValue]] is 4-bytes.

See [[#RequestApplicationUpdateInfo]] regarding nifm.

==== RequestRegisterGameCard ====
Takes an input s32, an [[Account_services#Uid|Uid]], an [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IAsyncResult]].

See [[#RequestApplicationUpdateInfo]] regarding nifm.

==== GetGameCardMountFailureEvent ====
No input, returns an output Event handle with EventClearMode=0.

==== IsGameCardInserted ====
No input, returns an output u8 bool.

==== EnsureGameCardAccess ====
No input/output.

==== GetLastGameCardMountFailureResult ====
No input/output.

==== ListApplicationIdOnGameCard ====
Takes a type-0x6 output buffer containing an array of u64 [[NCM_services#ApplicationId|ApplicationIds]], returns an output s32 for total output entries.

==== GetGameCardPlatformRegion ====
No input, returns an u8 '''GameCardPlatformRegion''' (0x00 = Global, 0x01 = China).

This calls [[Filesystem_services#IDeviceOperator|fsp-srv IDeviceOperator]] GetGameCardCompatibilityType and returns the result.

==== ListAvailableAddOnContent ====
[10.0.0+] This now takes a total of 0x10-bytes of input instead of a total of 0x18-bytes of input.

[15.0.0+] This now takes a total of 0x8-bytes of input instead of a total of 0x10-bytes of input.

==== RequestDownloadTaskListData ====
No input, returns an output Event handle and an [[#IAsyncValue]].

==== TouchApplication ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], no output.

==== IsApplicationUpdateRequested ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output u8 bool and an u32.

The output u32 is only valid when the output bool is set.

==== WithdrawApplicationUpdateRequest ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], no output.

==== RequestVerifyApplicationDeprecated ====
Takes an input TransferMemory handle, an [[NCM_services#ApplicationId|ApplicationId]], an u64 size, returns an output Event handle and an [[#IProgressAsyncResult]].

On newer system-versions this calls the same func as [[#RequestVerifyApplication]], with the u32 value set to 0x7.

==== RequestVerifyAddOnContentsRights ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IProgressAsyncResult]].

==== RequestVerifyApplication ====
Takes an input TransferMemory handle, an u32, an [[NCM_services#ApplicationId|ApplicationId]], an u64 size, returns an output Event handle and an [[#IProgressAsyncResult]].

Official sw creates the TransferMemory with an user-specified buffer with permissions=0. [[qlaunch]] uses buffer size 0x100000.

Official sw has an additional wrapper func which calls the original wrapper func, this uses value 0x7 for the u32. This is the same func used by [[qlaunch]].

==== IsAnyApplicationEntityInstalled ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output u8 bool.

==== CleanupUnavailableAddOnContents ====
Takes an input u64 [[NCM_services#ApplicationId|ApplicationId]], an [[Account_services#Uid|Uid]], no output.

==== RequestMoveApplicationEntity ====
Takes an input TransferMemory handle, a type-0x5 input buffer containing an array of [[NCM_services#StorageId|StorageId]], a [[NCM_services#StorageId|StorageId]], an u32 bitfield of "nn::ns::KeepApplicationEntityFlagTag", an [[NCM_services#ApplicationId|ApplicationId]], an u64 tmem_size, returns an output Event handle and an [[#IProgressAsyncResult]].

The TransferMemory uses permissions=0.

==== EstimateSizeToMove ====
Takes a type-0x5 input buffer containing an array of [[NCM_services#StorageId|StorageId]], a [[NCM_services#StorageId|StorageId]], an u32 bitfield of "nn::ns::KeepApplicationEntityFlagTag", an [[NCM_services#ApplicationId|ApplicationId]], returns an output s64.

This calls a func also used by [[#RequestMoveApplicationEntity]], then calls another func.

==== FormatSdCard ====
No input/output.

==== NeedsSystemUpdateToFormatSdCard ====
No input, returns an output u8 bool.

==== GetLastSdCardFormatUnexpectedResult ====
No input/output.

==== GetApplicationView ====
Takes a type-0x6 output buffer containing an array of [[#ApplicationView]], a type-0x5 input buffer containing an array of u64 [[NCM_services#ApplicationId|ApplicationIds]], no output.

==== GetApplicationViewDownloadErrorContext ====
Takes a type-0x16 output buffer containg an [[Error_Applet#ErrorContext|ErrorContext]], an u64 [[NCM_services#ApplicationId|ApplicationId]], no output.

==== GetApplicationViewWithPromotionInfo ====
Takes a type-0x6 output buffer containing an array of [[#ApplicationViewWithPromotionInfo]], a type-0x5 input buffer containing an array of u64 [[NCM_services#ApplicationId|ApplicationIds]], no output.

==== IsPatchAutoDeletableApplication ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output bool.

Compares the input ApplicationId with the value of [[System_Settings|system-setting]] <code>ns.application!auto_deletable_application_id_on_not_enough_space</code>, with the bool being set to the comparsion result.

==== ListLastNotificationInfo ====
Takes a type-0x6 buffer containing an array with struct entry size 0x90-bytes. Returns 4-bytes of output.

[19.0.0+] The struct size is now 0x98-bytes.

==== ListNotificationTask ====
Takes a type-0x6 buffer containing an array with struct entry size 0xB0-bytes. Returns 4-bytes of output.

[19.0.0+] The struct size is now 0xB8-bytes.

==== RequestDownloadApplicationPrepurchasedRights ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IAsyncResult]].

See [[#RequestApplicationUpdateInfo]] regarding nifm.

==== GetSystemDeliveryInfo ====
Takes a type-0x16 output buffer containing a [[#SystemDeliveryInfo]], no output.

This generates a [[#SystemDeliveryInfo]] using the currently installed SystemUpdate meta title.

==== SelectLatestSystemDeliveryInfo ====
Takes a type-0x15 input buffer containing a [[#SystemDeliveryInfo]], a type-0x5 input buffer containing an array of [[#SystemDeliveryInfo]], a type-0x5 input buffer containing an array of [[#ApplicationDeliveryInfo]], and returns an output s32.

This determines the latest version (RequiredSystemVersion) from the input [[#ApplicationDeliveryInfo]] array (ApplicationDeliveryProtocolVersion and the HMAC are also validated), using value 0 if the array is empty.

* [20.0.0+] The following code block now only runs when the SystemDeliveryInfoPlatform from the type-0x15 [[#SystemDeliveryInfo]] buffer matches the [[System_Settings|sys-setting]].
** It then loops through the [[#ApplicationDeliveryInfo]] array again:
** This uses functionality which essentially uses [[Shared_Database_services|pl:s]] GetFunctionBlackListSystemVersionToAuthorize with the [[#ApplicationDeliveryInfo]] ApplicationId and ApplicationFunctionAuthorizationId=0x5 then parses the output, using cached data if available. The error is returned on failure.
** tmp_version = out_u8 == 0 ? 0 : out_u32 + 0x10000;
** Then the current latest-version value is updated with tmp_version, if tmp_version is higher.

If this version value is less than a state field, the state field value is used instead (state field originates from [[System_Settings|system-setting]] <code>contents_delivery!required_system_version_to_deliver_application</code>).

Then this selects the [[#SystemDeliveryInfo]] with the latest version from the input array. The output s32 is an index in that array for the selected entry, -1 if none found.

During the above loop it first calls the [[#SystemDeliveryInfo]] validation func, returning the Result on failure. Then it runs additional validation, with the [[#SystemDeliveryInfo]] entry being ignored on failure:
* The above latest-version value must be at least the version value from the type-0x15 [[#SystemDeliveryInfo]] buffer and the [[#SystemDeliveryInfo]] array entry.
* When HasExFat is set in the type-0x15 [[#SystemDeliveryInfo]] buffer, it must be set in the [[#SystemDeliveryInfo]] array entry.
* FirmwareVariationId in the type-0x15 [[#SystemDeliveryInfo]] buffer must not be 0xFF.
* UpdatableFirmwareGroupId in the [[#SystemDeliveryInfo]] array entry must not be 0xFF. The value must be within bounds of the settings array ([[System_Settings|sys-settings]] <code>contents_delivery!updatable_firmware_group_string</code>).
* PlatformRegion in the [[#SystemDeliveryInfo]] array entry and the type-0x15 [[#SystemDeliveryInfo]] buffer must match.
* Lastly when the following is true, this indicates success: (settings_array[UpdatableFirmwareGroupId] >> {above FirmwareVariationId}) & 1.

==== VerifyDeliveryProtocolVersion ====
Takes a type-0x15 input buffer containing a [[#SystemDeliveryInfo]], no output.

This validates the [[#SystemDeliveryInfo]] HMAC and the protocol-version fields. Then an error is returned when SystemUpdateVersion is less than a state field, otherwise 0 is returned (state field originates from [[System_Settings|system-setting]] <code>contents_delivery!required_system_version_to_deliver_application</code>).

==== GetApplicationDeliveryInfo ====
Takes a type-0x6 output buffer containing an array of [[#ApplicationDeliveryInfo|ApplicationDeliveryInfo]], an input u32 bitmask <code>nn::ns::ApplicationDeliveryAttributeTag</code>, an [[NCM_services#ApplicationId|ApplicationId]], and returns an output s32 total_out.

[11.0.0+] An error is thrown if LocalContentShare is not [[#IsLocalContentShareEnabled|enabled]].

An error is thrown if any bit is set in ApplicationDeliveryAttributeTag besides bit1, this must also be <=0x3. The output array-count must be at least 1: only 1 entry will be written to this array (hence on success total_out will also only be 1 on success).

[7.0.0+] An error is thrown if the state ref-count for [[#GetRequestServerStopper|RequestServerStopper]] is zero. [7.0.0-7.0.1] The func which checks this would also return success when a field prior to the previously mentioned field is 0 (checked before the ref-count).

An error is thrown if [[NIM_services|nim]] ListApplicationApplyDeltaTask returns a task.

HasApplicationRecord is called with the input [[NCM_services#ApplicationId|ApplicationId]], an error is returned if the record isn't found.

[[#ApplicationDeliveryInfo|RequiredApplicationVersion]] is initially set to the output version from [[Shared_Database_services|avm]] GetLaunchRequiredVersion. Later when ContentMetaType == Application etc, it calls a func. This func uses [[NCM_services|ncm]] IContentMetaDatabase GetRequiredApplicationVersion. If the output version is higher than the [[#ApplicationDeliveryInfo|RequiredApplicationVersion]] field then the output version is written here. Immediately aferwards, it also checks whether the bit for Compacted is set from [[NCM_services|ncm]] IContentMetaDatabase GetAttributes, clearing [[#ApplicationDeliveryInfo|ApplicationVersion]] if the attribute is set.

[20.0.0+] [[#ApplicationDeliveryInfo|ApplicationDeliveryInfo]] ContentMetaPlatform and ProperProgramExists are now set using data from [[NCM_services|ncm]].

[20.0.0+] [[Shared_Database_services|pl:s]] GetFunctionBlackListSystemVersionToAuthorize with ApplicationFunctionAuthorizationId=0x5 is now used, the output version is written to [[#ApplicationDeliveryInfo|RequiredSystemVersion]] when it's higher than the value previously written here.

[20.0.0+] [[Shared_Database_services|pl:s]] GetRequiredApplicationVersion with ApplicationFunctionAuthorizationId=0x5 is now used, the output version is written to [[#ApplicationDeliveryInfo|RequiredApplicationVersion]] when it's higher than the value previously written here.

==== HasAllContentsToDeliver ====
Takes a type-0x5 input buffer containing an array of [[#ApplicationDeliveryInfo]], returns an output u8 bool.

The array-count must match 1.

This uses the same LocalContentShare check as [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]].

After validating the [[#ApplicationDeliveryInfo]], the output bool is set to [[#ApplicationDeliveryInfo|ApplicationDeliveryAttributeTag]] & 0x10000002 != 0x2, then this returns 0.

==== CompareApplicationDeliveryInfo ====
Takes two type-0x5 input buffers containing an array of [[#ApplicationDeliveryInfo]], returns an output s32.

This uses the same LocalContentShare check as [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]].

The array-count for both buffers must be 1, otherwise an error is returned.

Both [[#ApplicationDeliveryInfo]] are validated, then the application-version in the first/second buffer are compared. The output s32 is set to the comparison result: -1 for less than, 0 for equal, and 1 for higher than.

==== CanDeliverApplication ====
Takes two type-0x5 input buffers containing an array of [[#ApplicationDeliveryInfo]], returns an output u8 bool.

The array-count for the second buffer must be 1, otherwise an error is returned.

This uses the same LocalContentShare check as [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]].

The second [[#ApplicationDeliveryInfo]] buffer is validated. An error is thrown when [[#ApplicationDeliveryInfo|ApplicationDeliveryAttributeTag]] (second buffer) & 0x3 != 0x2, likewise when bit28 is clear in this field (bitmask 0x10000000).

The array-count for the first buffer must be <=1, otherwise an error is returned. If the array-count for the first buffer is 0, this will return 0 with the output bool set to 0. The first [[#ApplicationDeliveryInfo]] buffer is validated. An error is thrown when [[#ApplicationDeliveryInfo|ApplicationDeliveryAttributeTag]] (first buffer) bit1 is clear or bit0 set. An error is thrown when [[#ApplicationDeliveryInfo|ApplicationDeliveryAttributeTag]] (second buffer) bit1 is clear.

When [[#ApplicationDeliveryInfo|RequiredApplicationVersion]] (first or second buffer) is higher than [[#ApplicationDeliveryInfo|ApplicationVersion]] (second buffer), this will return 0 with the output bool set to 0.

When [[#ApplicationDeliveryInfo|ApplicationDeliveryAttributeTag]] (first buffer) bit28 is set (bitmask 0x10000000):
* When [[#ApplicationDeliveryInfo|ApplicationVersion]] (first buffer) >= [[#ApplicationDeliveryInfo|ApplicationVersion]] (second buffer), write 0 to the output bool, otherwise write 1. Then return 0.
Otherwise when the above bit28 is clear:
* When [[#ApplicationDeliveryInfo|ApplicationVersion]] (first buffer) > [[#ApplicationDeliveryInfo|ApplicationVersion]] (second buffer), write 0 to the output bool, otherwise write 1. Then return 0.

==== ListContentMetaKeyToDeliverApplication ====
Takes a type-0x6 output buffer containing an array of [[NCM_services#ContentMetaKey|ContentMetaKey]], a type-0x5 input buffer containing an array of [[#ApplicationDeliveryInfo]], a s32, and returns an output s32 total_out.

This uses the same LocalContentShare check as [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]].

The array-count for ContentMetaKey must be at least 1, and for ApplicationDeliveryInfo it must match 1.

The [[#ApplicationDeliveryInfo|ApplicationDeliveryInfo]] is validated (ApplicationDeliveryProtocolVersion/HMAC). An error is thrown when [[#ApplicationDeliveryInfo|ApplicationDeliveryAttributeTag]] bit0 is set.

This uses the same ref-count check as [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]].

An error is thrown if [[NIM_services|nim]] ListApplicationApplyDeltaTask returns a task.

This will only return 1 ContentMetaKey entry. This will not output the entry when the input s32 is larger than 0, or when [[#ApplicationDeliveryInfo|ApplicationDeliveryAttributeTag]] bit1 is clear.

==== NeedsSystemUpdateToDeliverApplication ====
Takes a type-0x15 input buffer containing a [[#SystemDeliveryInfo]], a type-0x5 input buffer containing an array of [[#ApplicationDeliveryInfo]], and returns an output u8 bool.

This uses the same LocalContentShare check as [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]].

The [[#SystemDeliveryInfo]] is validated (validation for ApplicationDeliveryProtocolVersion is enabled).

The array-count must match 1.

The [[#ApplicationDeliveryInfo]] is validated (ApplicationDeliveryProtocolVersion/HMAC).

This then runs functionality similar to [[#SelectLatestSystemDeliveryInfo]]:
* [20.0.0+] The following code block now only runs when the SystemDeliveryInfoPlatform from the input [[#SystemDeliveryInfo]] matches the [[System_Settings|sys-setting]].
* Uses the same functionality as [[#SelectLatestSystemDeliveryInfo]] for GetFunctionBlackListSystemVersionToAuthorize, returning the Result on failure.
* The output bool is set to: out_u8!=0 && out_u32 >= [[#SystemDeliveryInfo]] SystemUpdateVersion (only the upper 16bits are used from the SystemUpdateVersion).

Otherwise when the output bool is still false, this sets the output bool by comparing system-version fields in the [[#SystemDeliveryInfo]]/[[#ApplicationDeliveryInfo]] and with a state field (state field originates from [[System_Settings|system-setting]] <code>contents_delivery!required_system_version_to_deliver_application</code>).

==== EstimateRequiredSize ====
Takes a type-0x5 input buffer containing an array of [[NCM_services#ContentMetaKey|ContentMetaKey]], returns an output s64.

When the array-count is less than 1, this will return 0 with the s64 set to 0.

==== RequestReceiveApplication ====
Takes a type-0x5 input buffer containing an array of [[NCM_services#ContentMetaKey|ContentMetaKey]], a [[NCM_services#StorageId|StorageId]], an u16 port, an u32 Ipv4Address, an [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IAsyncResult]].

[[qlaunch]] uses value Any for the StorageId, and value 55556 for the port.

This uses the same LocalContentShare and ref-count checks as [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]].

An error is thrown if [[NIM_services|nim]] ListApplicationApplyDeltaTask returns a task.

HasApplicationRecord is called with the input [[NCM_services#ApplicationId|ApplicationId]], an error is returned if the record isn't found.

This loops through the input [[NCM_services#ContentMetaKey|ContentMetaKey]] array, throwing an error if the [[NCM_services#ContentMetaType|ContentMetaType]] doesn't match Patch. The input array is copied into state which is used later by the thread for [[NIM_services|nim]] CreateLocalCommunicationReceiveApplicationTask, max entries is 0x12.

This does various setup then creates the [[#IAsyncResult]] + the async thread which handles the [[#IAsyncResult]] operation. Then the thread does:

* Calls a func which does:
** Throws an error if a state flag is set.
** Uses [[NIM_services|nim]] CreateLocalCommunicationReceiveApplicationTask, returning the Result on failure.
** Uses [[NIM_services|nim]] RequestLocalCommunicationReceiveApplicationTaskRun, returning the Result on failure. Waits for the IAsyncResult operation from this to finish, then uses the Get cmd to get the output Result.
*** When the Result from Get is an error, a func is called for filling in the [[#IAsyncResult|IAsyncResult]] ErrorContext with Type4.
** Handles cleanup and returns.
* On success, this loads various data which is then used for saving a SystemPlayReport when the cached [[System_Settings|system-setting]] "systemreport!enabled" is set.
** The EventId is "receive_app_contents" with ApplicationId <NS ProgramId>.
** This report has the following fields:
*** "ApplicationId"
*** "DestinationVersion"
*** "SourceVersion"
*** "HasApplicationEntity"
*** "HasPatchEntity"
*** "ApplicationStorageId"
*** "PatchStorageId"
*** "Size"
*** "ThroughputKBps"

==== CommitReceiveApplication ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], no output.

This uses the same LocalContentShare and ref-count checks as [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]].

An error is thrown if [[NIM_services|nim]] ListApplicationApplyDeltaTask returns a task.

==== GetReceiveApplicationProgress ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output [[#ReceiveApplicationProgress]].

This uses the same ref-count check as [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]].

An error is thrown if [[NIM_services|nim]] ListApplicationApplyDeltaTask returns a task.

Uses [[NIM_services|nim]] ListApplicationLocalCommunicationReceiveApplicationTask, throwing an error if no task is returned. Then [[NIM_services|nim]] GetLocalCommunicationReceiveApplicationTaskInfo is used, returning the error from there on failure. Lastly, this writes the 0x10-bytes from output+8 from the latter cmd to the output [[#ReceiveApplicationProgress]], and returns 0.

==== RequestSendApplication ====
Takes a type-0x5 input buffer containing an array of [[NCM_services#ContentMetaKey|ContentMetaKey]], an u16 port, an u32 Ipv4Address, an [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IAsyncResult]].

[[qlaunch]] uses value 55556 for the port.

This uses the same LocalContentShare and ref-count checks as [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]].

An error is thrown if [[NIM_services|nim]] ListApplicationApplyDeltaTask returns a task.

This does various setup and loops through the input ContentMetaKey array for initializing the array passed to the nim cmd during the async task. This loop does the following:
* Throws an error if the [[NCM_services#ContentMetaType|ContentMetaType]] in the ContentMetaKey doesn't match Patch.
* Calls a func with the ContentMetaKey and the ApplicationId, throwing an error if the output value is 0.
* Calls a func with the ContentMetaKey for getting the StorageId. This essentially loops through each valid ncm [[NCM_services|IContentMetaDatabase]] using cmd [[NCM_services|Has]] with the input ContentMetaKey, returning the relevant StorageId when found.
* The ContentMetaKey and the StorageId are copied into a tmp struct.
* if (ContentMetaType==Patch && StorageId==GameCard) { <call a func etc> }
* Copies the above tmp struct into the async task state array.

This then creates the [[#IAsyncResult]] + the async thread which handles the [[#IAsyncResult]] operation. Then the thread does:

* Calls a func which does:
** Throws an error if a state flag is set.
** Uses [[NIM_services|nim]] CreateLocalCommunicationSendApplicationTask, returning the Result on failure.
** Uses [[NIM_services|nim]] RequestLocalCommunicationSendApplicationTaskRun, returning the Result on failure. Waits for the IAsyncResult operation from this to finish, then uses the Get cmd to get the output Result.
*** When the Result from Get is an error, a func is called for filling in the [[#IAsyncResult|IAsyncResult]] ErrorContext with Type4.
** Handles cleanup and returns.
* On success, this loads various data which is then used for saving a SystemPlayReport when the cached [[System_Settings|system-setting]] "systemreport!enabled" is set.
** The EventId is "send_app_contents" with ApplicationId <NS ProgramId>.
** This report has the following fields:
*** "ApplicationId"
*** "Version"
*** "ApplicationStorageId"
*** "PatchStorageId"

==== GetSendApplicationProgress ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output [[#SendApplicationProgress]].

Same as [[#GetReceiveApplicationProgress]] except this is the Send version, and uses [[NIM_services|nim]] ListApplicationLocalCommunicationSendApplicationTask/GetLocalCommunicationSendApplicationTaskInfo instead. The data copied to output is also swapped: u64 nim_out+0x8 is copied to out+0x8, and u64 nim_out+0x10 is copied to out+0x0.

==== CompareSystemDeliveryInfo ====
Takes two type-0x15 input buffers containing a [[#SystemDeliveryInfo]], returns an output s32.

This is essentially the same as [[#CompareApplicationDeliveryInfo]], except this compares the [[#SystemDeliveryInfo]] SystemUpdate version.

==== ListNotCommittedContentMeta ====
Takes a type-0x6 output buffer containing an array of [[NCM_services#ContentMetaKey|ContentMetaKey]], a s32, an [[NCM_services#ApplicationId|ApplicationId]], returns an output s32 total_out.

This uses the same ref-count check as [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]].

An error is thrown if [[NIM_services|nim]] ListApplicationApplyDeltaTask returns a task.

==== RecoverDownloadTask ====
Takes a type-0x5 input buffer containing an array of {unknown} and an input u64, no output.

This uses the same LocalContentShare and ref-count checks as [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]].

==== GetApplicationDeliveryInfoHash ====
Takes a type-0x5 input buffer containing an array of [[#ApplicationDeliveryInfo]], returns an output 0x20-byte SHA256 hash.

This uses the same LocalContentShare check as [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]].

This extracts data from the input array for hashing with SHA256, with validation being done when handling each entry (ApplicationDeliveryProtocolVersion/HMAC).

The 0x14-bytes from [[#ApplicationDeliveryInfo|ApplicationDeliveryInfo]]+0x8 are copied into a 0x18-byte struct entry in an array buffer, with the last 4-bytes being cleared. Then each 0x18-byte struct entry is hashed.

==== Cmd2019 ====
Takes a type-0x15 input buffer containing a [[#SystemDeliveryInfo]], a type-0x5 input buffer containing an array of [[#ApplicationDeliveryInfo]], a type-0x5 input buffer containing an array of [[#ApplicationDeliveryInfo]], returns an output u8 bool.

This is essentially an extended version of [[#CanDeliverApplication|CanDeliverApplication]], with additional functionality for determining platform compatibility.

This calls a func for validating the [[#SystemDeliveryInfo]] from the type-0x15 buffer, returning the Result on failure.

Then [[#CanDeliverApplication|CanDeliverApplication]] is called with the output bool and the input arrays, returning the Result on failure.

If the output bool is set after calling the above, it then calls a func with the output bool, the second [[#ApplicationDeliveryInfo]] buffer, and the [[#SystemDeliveryInfo]] from the type-0x15 buffer. This func does the following:
* When the SystemDeliveryInfoPlatform from the input [[#SystemDeliveryInfo]] matches the [[System_Settings|sys-setting]], it does the following:
** Uses [[Shared_Database_services|pl:s]] RequestApplicationFunctionAuthorizationByApplicationId with the [[#ApplicationDeliveryInfo]] ApplicationId/ApplicationVersion and ApplicationFunctionAuthorizationId=0x5, handling the Result on failure.
* When the platform fields from the input [[#SystemDeliveryInfo]]/[[#ApplicationDeliveryInfo]] match, write 1 to the output bool and return 0. Otherwise:
** When the [[#SystemDeliveryInfo]] SystemDeliveryInfoPlatform is 0x1 (Ounce): *output = [[#ApplicationDeliveryInfo|ContentMetaPlatform]] == 0 && [[#ApplicationDeliveryInfo|ProperProgramExists]] == 0;
** When the [[#SystemDeliveryInfo]] SystemDeliveryInfoPlatform is 0x0 (NX): write 0 to the output bool and return 0.
** Otherwise, Abort.

==== GetApplicationRightsOnClient ====
Takes a type-0x6 output buffer containing an array of [[#ApplicationRightsOnClient]], an input u32 flags, an [[NCM_services#ApplicationId|ApplicationId]], an [[Account_services#Uid|Uid]], returns 4-bytes of output for total output entries.

Official sw has at least two wrappers which use this cmd: one with an all-zero Uid, one with an user-specified Uid. With both of these, the passed flags are hard-coded to value 0x3.

For the output array count, [[qlaunch]] uses value 3.

==== GetApplicationTerminateResult ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output u32 Result.

==== GetRightsEnvironmentHandleForApplication ====
No input, returns a total of 8-bytes of output.

[9.0.0+] Now takes a total of 8-bytes of input, returns a total of 8-bytes of output.

==== RequestNoDownloadRightsErrorResolution ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IAsyncValue]].

The data that can be read from the [[#IAsyncValue]] is [[#NoDownloadRightsErrorResolution]].

See [[#RequestApplicationUpdateInfo]] regarding nifm.

==== RequestResolveNoDownloadRightsError ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IAsyncValue]].

The data that can be read from the [[#IAsyncValue]] is [[#NoDownloadRightsErrorResolution]].

See [[#RequestApplicationUpdateInfo]] regarding nifm.

==== GetPromotionInfo ====
Takes a type-0x6 output buffer containing an array of [[#PromotionInfo]], a type-0x5 input buffer containing an array of u64 [[NCM_services#ApplicationId|ApplicationIds]], a type-0x5 input buffer containing an array of [[Account_services#Uid|Uids]], no output.

Official sw uses hard-coded value 1 for the count with each of these arrays.

==== ListPromotionInfo ====
[20.0.0+] The struct size for the output buffer array is now 0x28-bytes instead of 0x20-bytes.

==== ImportPromotionJsonForDebug ====
Takes a type-0x5 input buffer, no output.

The output from [[Settings_services#GetDebugModeFlag]] must be 1, otherwise an error is returned.

==== ClearPromotionInfoForDebug ====
No input/output.

The output from [[Settings_services#GetDebugModeFlag]] must be 1, otherwise an error is returned.

This just clears 0xC-bytes in state.

==== CreateApplicationResource ====
Takes an input [[#ApplicationResourceType]]. Returns an [[#IApplicationResource]].

==== GetApplicationResource ====
Takes an input u64 ProcessId and an input [[#ApplicationResourceType]]. Returns an [[#IApplicationResource]].

==== LaunchMicroApplication ====
[18.0.0+] Now takes a total of 0x50 bytes of input.

[19.0.0+] Now takes a total of 0x80 bytes of input.

==== CreateApplicationInstance ====
[18.0.0+] Now takes a total of 0x50 bytes of input.

[19.0.0+] Now takes a total of 0x80 bytes of input.

==== RegisterDeviceLockKey ====
Takes a type-0x5 input buffer containing an InArray of u8, no output.

User-processes expose this with two funcs: one which uses an user-specified u8 array directly, while the other uses [[HID_services#NpadButtonSet|NpadButton]].

This does SHA256 hashing, etc.

==== UnregisterDeviceLockKey ====
No input/output.

Runs code identical to [[#RegisterDeviceLockKey]], except the passed buffer/size are 0.

==== VerifyDeviceLockKey ====
Takes a type-0x5 input buffer containing an InArray of u8, no output.

User-processes expose this with two funcs: one which uses an user-specified u8 array directly, while the other uses [[HID_services#NpadButtonSet|NpadButton]].

This runs hashing similar to [[#RegisterDeviceLockKey]], with the calculated hash being verified with the one from state.

==== HideApplicationIcon ====
No input/output.

==== ShowApplicationIcon ====
No input/output.

==== HideApplicationTitle ====
No input/output.

==== ShowApplicationTitle ====
No input/output.

==== EnableGameCard ====
No input/output.

==== DisableGameCard ====
No input/output.

==== EnableLocalContentShare ====
No input/output.

==== DisableLocalContentShare ====
No input/output.

==== IsApplicationIconHidden ====
No input, returns an output bool.

==== IsApplicationTitleHidden ====
No input, returns an output bool.

==== IsGameCardEnabled ====
No input, returns an output bool.

==== IsLocalContentShareEnabled ====
No input, returns an output bool.

Various Deliver cmds now run essentially the same code as IsLocalContentShareEnabled, with an error being returned when it's not enabled.

==== Cmd4026 ====
Takes an input u64, returns an [[#IHostSession|IHostSession]].

The input u64 must match a state field.

This initializes [[LDN_services|ldn]] etc, and creates a network.

==== Cmd4027 ====
Takes an input u64, returns an [[#IClientSession|IClientSession]].

The input u64 must match a state field.

This initializes [[LDN_services|ldn]] etc.

=== IGameCardStopper ===
This is "nn::ns::detail::IGameCardStopper".

This interface has no commands.

=== IRequestServerStopper ===
This is "nn::ns::detail::IRequestServerStopper".

This interface has no commands.

=== IProgressMonitorForDeleteUserSaveDataAll ===
This is "nn::ns::detail::IProgressMonitorForDeleteUserSaveDataAll".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetSystemEvent
|-
| 1 || IsFinished
|-
| 2 || GetResult
|-
| 10 || GetProgress
|}

When closing the object, official sw uses IsFinished first, asserting when the output bool is false.

* GetSystemEvent: No input, returns an output Event handle. [[qlaunch]] doesn't use this.

* IsFinished: No input, returns an output u8 bool.

* GetResult: No input/output.

* GetProgress: No input, returns an output [[#ProgressForDeleteUserSaveDataAll]]. Official sw writes this struct directly to object state.

=== IProgressAsyncResult ===
This is "nn::ns::detail::IProgressAsyncResult".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Get
|-
| 1 || Cancel
|-
| 2 || GetProgress
|-
| 3 || GetDetailResult
|-
| 4 || [4.0.0+] GetErrorContext
|}

=== IHostSession ===
This is "nn::ns::vphym::detail::IHostSession".

This was added with [20.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 ||
|-
| 1 ||
|-
| 2 ||
|}

==== Cmd0 ====
No input, returns an output Event handle and an [[#IAsyncValue]].

The async task does the following:
* This waits for a client to connect.
* The [[LDN_services|NodeInfo]] UserName is converted into two u64s, which are used to locate a state entry with matching values.
* The client [[LDN_services|NodeInfo]] Ipv4Address is copied into state.
* Then a ptr to the above located state entry is also written into state.

==== Cmd1 ====
No input, returns an output Event handle and an [[#IAsyncResult]].

The async task uses [[NIM_services|nim]] cmd2018 or cmd2027, depending on a state field. Once finished when a state flag is set, [[LDN_services|ldn]] is finalized and that state flag is cleared.

==== Cmd2 ====
No input, returns an output Event handle and an [[#IAsyncResult]].

The async task uses [[NIM_sevices|nim]] cmd2024.

=== IClientSession ===
This is "nn::ns::vphym::detail::IClientSession".

This was added with [20.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 ||
|-
| 1 ||
|-
| 2 ||
|}

==== Cmd0 ====
No input, returns an output Event handle and an [[#IAsyncValue]].

The async task does the following:
* Uses [[LDN_services|ldn]] Scan.
* After a [[LDN_services|NodeInfo]] is found with a matching UserName, the Ipv4Address for it is copied into state.
* If a timeout didn't occur and a valid NodeInfo was found, it proceeds with connecting to the network.

==== Cmd1 ====
No input, returns an output Event handle and an [[#IAsyncResult]].

The async task uses [[NIM_services|nim]] cmd2019 or cmd2028, depending on a state field. Once finished when a state flag is set, [[LDN_services|ldn]] is finalized and that state flag is cleared.

==== Cmd2 ====
No input, returns an output Event handle and an [[#IAsyncResult]].

This is identical to [[#IHostSession|IHostSession]] Cmd2.

=== IApplicationVersionInterface ===
This is "nn::ns::detail::IApplicationVersionInterface".

This was added with [4.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetLaunchRequiredVersion
|-
| 1 || UpgradeLaunchRequiredVersion
|-
| 35 || UpdateVersionList
|-
| 36 || PushLaunchVersion
|-
| 37 || ListRequiredVersion
|-
| 800 || RequestVersionList
|-
| 801 || ListVersionList
|-
| 802 || [[#RequestVersionListData]]
|-
| 900 || [12.0.0+] ImportAutoUpdatePolicyJsonForDebug
|-
| 901 || [12.0.0+] ListDefaultAutoUpdatePolicy
|-
| 902 || [12.0.0+] ListAutoUpdatePolicyForSpecificApplication
|-
| 1000 || PerformAutoUpdate
|-
| 1001 || [11.0.0+] ListAutoUpdateSchedule
|}

==== RequestVersionListData ====
No input, returns an output Event handle and an [[#IAsyncValue]].

The data that can be read from the [[#IAsyncValue]] is [[#VersionListData]].

=== IContentManagementInterface ===
This is "nn::ns::detail::IContentManagementInterface".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 11 || [[#CalculateApplicationOccupiedSize]]
|-
| 43 || [[#CheckSdCardMountStatus]]
|-
| 47 || [[#GetTotalSpaceSize]]
|-
| 48 || [[#GetFreeSpaceSize]]
|-
| 58 || [20.1.0+]
|-
| 71 || [20.1.0+]
|-
| 600 || [[#CountApplicationContentMeta]]
|-
| 601 || [[#ListApplicationContentMetaStatus]]
|-
| 605 || [[#ListApplicationContentMetaStatusWithRightsCheck]]
|-
| 607 || [[#IsAnyApplicationRunning]]
|-
| 608 || [21.0.0+]
|}

==== CalculateApplicationOccupiedSize ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output [[#ApplicationOccupiedSize]].

==== CheckSdCardMountStatus ====
No input/output.

==== CountApplicationContentMeta ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output s32.

==== ListApplicationContentMetaStatusWithRightsCheck ====
Same input/output as [[#ListApplicationContentMetaStatus]].

==== IsAnyApplicationRunning ====
No input, returns an output u8 bool.

=== IDocumentInterface ===
This is "nn::ns::detail::IDocumentInterface".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 21 || GetApplicationContentPath
|-
| 23 || ResolveApplicationContentPath
|-
| 92 || [5.0.0+] GetRunningApplicationProgramId
|-
| 100 || [S2]
|-
| 101 || [S2]
|-
| 2524 || [19.0.0+]
|}

==== Cmd100 ====
Takes a type-0x16 output buffer containing a 0x300-byte struct, an input u8, an u64. Returns two output u8s.

==== Cmd101 ====
Takes a type-0x16 output buffer containing a 0x300-byte struct, an input u8, an u64. Returns an output u8, an u8 [[Filesystem_services|ContentAttributes]], and a [[NCM_services#ProgramId|ProgramId]].

This is similar to Cmd2524. On [S2] this is used instead of Cmd2524.

==== Cmd2524 ====
Takes a type-0x16 output buffer containing a 0x300-byte struct, an input u8, an u64. Returns an output u8 [[Filesystem_services|ContentAttributes]] and a [[NCM_services#ProgramId|ProgramId]].

The user-process uses the output from this as the input for [[Filesystem_services|OpenFileSystemWithId]] (out-buffer is used as the [[Filesystem_services|FspPath]]).

=== IDownloadTaskInterface ===
This is "nn::ns::detail::IDownloadTaskInterface".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 701 || [[#ClearTaskStatusList]]
|-
| 702 || [[#RequestDownloadTaskList]]
|-
| 703 || [[#RequestEnsureDownloadTask]]
|-
| 704 || [[#ListDownloadTaskStatus]]
|-
| 705 || [[#RequestDownloadTaskListData]]
|-
| 706 || [4.0.0+] [[#TryCommitCurrentApplicationDownloadTask]]
|-
| 707 || [4.0.0+] [[#EnableAutoCommit]]
|-
| 708 || [4.0.0+] [[#DisableAutoCommit]]
|-
| 709 || [4.0.0+] [[#TriggerDynamicCommitEvent]]
|-
| 710 || [20.0.0+]
|}

==== ClearTaskStatusList ====
No input/output.

==== RequestDownloadTaskList ====
No input/output.

==== RequestEnsureDownloadTask ====
No input, returns an output Event handle and an [[#IAsyncResult]].

==== ListDownloadTaskStatus ====
Takes a type-0x6 output buffer containing an array of [[#DownloadTaskStatus]], returns an output s32 total_out.

A maximum of 0x100 tasks can be stored in state.

==== TryCommitCurrentApplicationDownloadTask ====
No input/output.

==== EnableAutoCommit ====
No input/output.

==== DisableAutoCommit ====
No input/output.

==== TriggerDynamicCommitEvent ====
No input/output.

=== IReadOnlyApplicationRecordInterface ===
This is "nn::ns::detail::IReadOnlyApplicationRecordInterface".

This was added with [5.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || HasApplicationRecord || Same as [[#IApplicationManagerInterface]] cmd 910
|-
| 1 || [10.0.0+] NotifyApplicationFailure ||
|-
| 2 || [10.0.0+] IsDataCorruptedResult ||
|-
| 3 || [20.0.0+] [[#ListApplicationRecord|ListApplicationRecord]] ||
|}

=== IReadOnlyApplicationControlDataInterface ===
This is "nn::ns::detail::IReadOnlyApplicationControlDataInterface".

This was added with [5.1.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || [[#GetApplicationControlData]] || Same as [[#IApplicationManagerInterface]] cmd 400
|-
| 1 || [[#GetApplicationDesiredLanguage]] || Same as [[#IApplicationManagerInterface]] cmd 55
|-
| 2 || ConvertApplicationLanguageToLanguageCode || Same as [[#IApplicationManagerInterface]] cmd 59
|-
| 3 || [[#ConvertLanguageCodeToApplicationLanguage]] || Same as [[#IApplicationManagerInterface]] cmd 60
|-
| 4 || [9.0.0+] SelectApplicationDesiredLanguage ||
|-
| 5 || [19.0.0+] || Same as [[#IApplicationManagerInterface]] cmd 411
|-
| 6 || [19.0.0+] || Same as [[#IApplicationManagerInterface]] cmd 416
|-
| 7 || [20.0.0+] || Same as [[#IApplicationManagerInterface]] cmd 921
|-
| 8 || [20.0.0+] || Same as [[#IApplicationManagerInterface]] cmd 922
|-
| 9 || [20.0.0+] || Same as [[#IApplicationManagerInterface]] cmd 923
|-
| 10 || [20.0.0+] || Same as [[#IApplicationManagerInterface]] cmd 421
|-
| 11 || [20.0.0+] || Same as [[#IApplicationManagerInterface]] cmd 422
|-
| 12 || [20.0.0+] || Same as [[#IApplicationManagerInterface]] cmd 423
|-
| 13 || [20.0.0+] || Same as [[#IApplicationManagerInterface]] cmd 407
|-
| 14 || [20.0.0+] || Same as [[#IApplicationManagerInterface]] cmd 408
|-
| 15 || [20.0.0+] || Same as [[#IApplicationManagerInterface]] cmd 415
|-
| 16 || [20.0.0+] ||
|-
| 17 || [20.1.0+] || Same as [[#IApplicationManagerInterface]] cmd 933
|-
| 18 || [21.0.0+] ||
|-
| 19 || [21.0.0+] ||
|-
| 20 || [21.0.0+] ||
|-
| 21 || [21.0.0+] ||
|-
| 22 || [21.0.0+] ||
|}

=== IDynamicRightsInterface ===
This is "nn::ns::detail::IDynamicRightsInterface".

This was added with [6.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#RequestApplicationRightsOnServer]]
|-
| 1 || [[#RequestAssignRights]]
|-
| 4 || [[#DeprecatedRequestAssignRightsToResume]]
|-
| 5 || [[#VerifyActivatedRightsOwners]]
|-
| 6 || [[#DeprecatedGetApplicationRightsStatus]]
|-
| 7 || [[#RequestPrefetchForDynamicRights]]
|-
| 8 || [[#GetDynamicRightsState]]
|-
| 9 || [7.0.0+] [[#RequestApplicationRightsOnServerToResume]]
|-
| 10 || [7.0.0+] [[#RequestAssignRightsToResume]]
|-
| 11 || [7.0.0+] [[#GetActivatedRightsUsers]]
|-
| 12 || [8.0.0+] [[#GetApplicationRightsStatus]]
|-
| 13 || [8.0.0+] [[#GetRunningApplicationStatus]]
|-
| 14 || [10.0.0-15.0.1] SelectApplicationLicense
|-
| 15 || [12.0.0+] [[#RequestContentsAuthorizationToken]]
|-
| 16 || [13.0.0+] QualifyUser
|-
| 17 || [13.0.0+] QualifyUserWithProcessId
|-
| 18 || [13.0.0+] NotifyApplicationRightsCheckStart
|-
| 19 || [13.0.0+] UpdateUserList
|-
| 20 || [13.0.0+] IsRightsLostUser
|-
| 21 || [13.1.0+] SetRequiredAddOnContentsOnContentsAvailabilityTransition
|-
| 22 || [14.0.0+] GetLimitedApplicationLicense
|-
| 23 || [14.0.0+] GetLimitedApplicationLicenseUpgradableEvent
|-
| 24 || [14.0.0+] NotifyLimitedApplicationLicenseUpgradableEventForDebug
|-
| 25 || [14.0.0+] RequestProceedDynamicRightsState
|-
| 26 || [18.0.0+] HasAccountRestrictedRightsInRunningApplications
|-
| 27 || [20.0.0+]
|-
| 28 || [20.0.0+]
|-
| 29 || [21.0.0+]
|-
| 30 || [21.0.0+]
|}

==== RequestApplicationRightsOnServer ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], an [[Account_services#Uid|Uid]] and an u32. Returns an output Event handle and an [[#IAsyncValue]].

==== RequestAssignRights ====
Takes a type-0x5 input buffer containing an array of "nn::ns::ApplicationRightsOnServer". Returns an output Event handle and an [[#IAsyncResult]].

==== DeprecatedRequestAssignRightsToResume ====
Takes an input u64 "nn::ns::RightsEnvironmentHandle" and an [[Account_services#Uid|Uid]]. Returns an output Event handle and an [[#IAsyncResult]].

==== VerifyActivatedRightsOwners ====
Takes an input u64 "nn::ns::RightsEnvironmentHandle". No output.

==== DeprecatedGetApplicationRightsStatus ====
Takes an input u64 "nn::ns::RightsEnvironmentHandle". Returns a bool "nn::ns::ApplicationRightsStatus".

==== RequestPrefetchForDynamicRights ====
Takes an input [[Account_services#Uid|Uid]]. Returns an output Event handle and an [[#IAsyncResult]].

==== GetDynamicRightsState ====
No input. Returns a bool "nn::ns::DynamicRightsState".

==== RequestApplicationRightsOnServerToResume ====
Takes an input u64 "nn::ns::RightsEnvironmentHandle". Returns an output Event handle and an [[#IAsyncValue]].

==== RequestAssignRightsToResume ====
Takes an input u64 "nn::ns::RightsEnvironmentHandle". Returns an output Event handle and an [[#IAsyncResult]].

==== GetActivatedRightsUsers ====
Takes an input u64 "nn::ns::RightsEnvironmentHandle". Returns a bool, an u32 and a type-0x6 output buffer containing an array of [[Account_services#Uid|Uid]].

==== GetApplicationRightsStatus ====
Takes an input "nn::ns::RightsEnvironmentHandle". Returns 2 bools "nn::ns::ApplicationRightsStatus" and "nn::ns::ApplicationLicenseType".

==== GetRunningApplicationStatus ====
Takes an input u64 "nn::ns::RightsEnvironmentHandle". Returns an u32 "nn::ns::RunningApplicationStatus".

==== RequestContentsAuthorizationToken ====
Takes a total of 0x50-bytes of input, a type-0x5 input buffer. Returns an [[#IAsyncData_2|IAsyncData]] and an output handle.

==== IAsyncData ====
This is "nn::ns::detail::IAsyncData".

This was added with [12.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetSize
|-
| 1 || Get
|-
| 2 || Cancel
|-
| 3 || GetErrorContext
|}

=== IECommerceInterface===
This is "nn::ns::detail::IECommerceInterface".

This was added with [4.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#RequestLinkDevice]]
|-
| 1 || [6.0.0+] [[#RequestCleanupAllPreInstalledApplications]]
|-
| 2 || [6.0.0+] [[#RequestCleanupPreInstalledApplication]]
|-
| 3 || [6.0.0+] [[#RequestSyncRights]]
|-
| 4 || [6.0.0+] [[#RequestUnlinkDevice]]
|-
| 5 || [6.1.0+] [[#RequestRevokeAllELicense]]
|-
| 6 || [9.0.0+] [[#RequestSyncRightsBasedOnAssignedELicenses]]
|-
| 7 || [14.0.0+] RequestOnlineSubscriptionFreeTrialAvailability
|-
| 8 || [20.0.0+]
|-
| 9 || [20.0.0+]
|-
| 10 || [20.0.0+]
|-
| 11 || [20.0.0+]
|-
| 12 || [20.0.0+]
|-
| 13 || [20.0.0+]
|-
| 14 || [21.0.0+]
|}

==== RequestLinkDevice ====
Takes an input [[Account_services#Uid|Uid]], returns an output Event handle and an [[#IAsyncResult]].

See [[#RequestApplicationUpdateInfo]] regarding nifm.

==== RequestCleanupAllPreInstalledApplications ====
No input, returns an output Event handle and an [[#IAsyncResult]].

==== RequestCleanupPreInstalledApplication ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IAsyncResult]].

==== RequestSyncRights ====
No input, returns an output Event handle and an [[#IAsyncResult]].

==== RequestUnlinkDevice ====
Takes an input [[Account_services#Uid|Uid]], returns an output Event handle and an [[#IAsyncResult]].

See [[#RequestApplicationUpdateInfo]] regarding nifm.

==== RequestRevokeAllELicense ====
Takes an input [[Account_services#Uid|Uid]], returns an output Event handle and an [[#IAsyncResult]].

==== RequestSyncRightsBasedOnAssignedELicenses ====
No input, returns an output Event handle and an [[#IAsyncResult]].

=== IFactoryResetInterface ===
This is "nn::ns::detail::IFactoryResetInterface".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 100 || [[#ResetToFactorySettings]]
|-
| 101 || [[#ResetToFactorySettingsWithoutUserSaveData]]
|-
| 102 || [[#ResetToFactorySettingsForRefurbishment]]
|-
| 103 || [9.1.0+] [[#ResetToFactorySettingsWithPlatformRegion]]
|-
| 104 || [9.1.0+] [[#ResetToFactorySettingsWithPlatformRegionAuthentication]]
|-
| 105 || [10.0.0+] [[#RequestResetToFactorySettingsSecurely]]
|-
| 106 || [10.0.0+] [[#RequestResetToFactorySettingsWithPlatformRegionAuthenticationSecurely]]
|-
| 107 || [20.0.0+]
|-
| 108 || [20.0.0+]
|}

==== ResetToFactorySettings ====
No input/output.

As of [9.1.0] this is the only [[#IFactoryResetInterface]] cmd used by [[qlaunch]].

==== ResetToFactorySettingsWithoutUserSaveData ====
No input/output.

==== ResetToFactorySettingsForRefurbishment ====
No input/output.

==== ResetToFactorySettingsWithPlatformRegion ====
No input/output.

==== ResetToFactorySettingsWithPlatformRegionAuthentication ====
No input/output.

==== RequestResetToFactorySettingsSecurely ====
Takes an input u64 tmem_size, a TransferMemory handle, returns an output [[#IAsyncValueAndProgress]] and an Event handle.

The TransferMemory uses permissions=0.

==== RequestResetToFactorySettingsWithPlatformRegionAuthenticationSecurely ====
Takes an input u32 "nn::ae::PlatformRegion", an u64 tmem_size, a TransferMemory handle, returns an output [[#IAsyncValueAndProgress]] and an Event handle.

The TransferMemory uses permissions=0.

===== IAsyncValueAndProgress =====
This is "nn::ns::detail::IAsyncValueAndProgress".

This was added with [10.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetSize
|-
| 1 || Get
|-
| 2 || Cancel
|-
| 3 || GetErrorContext
|-
| 4 || GetProgress
|}

=== IApplicationResource ===
This is "nn::ns::detail::IApplicationResource".

This was added with [9.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Attach
|-
| 1 || BoostSystemMemoryResourceLimit
|}

= ns:vm =
This is "nn::ns::detail::IVulnerabilityManagerInterface".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 1200 || [3.0.0+] [[#NeedsUpdateVulnerability]]
|-
| 1201 || [4.0.0+] [[#UpdateSafeSystemVersionForDebug]]
|-
| 1202 || [4.0.0+] [[#GetSafeSystemVersion]]
|-
| 3100 || [18.0.0+] [[#GetSafeSystemVersionCheckInfo|GetSafeSystemVersionCheckInfo]]
|-
| 3101 || [18.0.0+] [[#RequestUpdateSafeSystemVersionCheckInfo|RequestUpdateSafeSystemVersionCheckInfo]]
|-
| 3102 || [18.0.0+] [[#ResetSafeSystemVersionCheckInfo|ResetSafeSystemVersionCheckInfo]]
|}

== NeedsUpdateVulnerability ==
No input, returns an output u8 bool flag.

[S1] Web-applets use this command to check if the system needs an update.

== UpdateSafeSystemVersionForDebug ==
Takes an input u32 '''version''' and an [[NCM_services#ApplicationId|ApplicationId]].

This command is not available for retail units. On a debug unit, if the [[System_Settings|system setting]] <code>vulnerability!enable_debug</code> is set, this mounts the system savegame [[Flash_Filesystem#System_Savegames|0x8000000000000049]] as "ns_ssversion:/", opens the file "ns_ssversion:/entry" and writes the supplied [[NCM_services#ApplicationId|ApplicationId]] and '''version''' in it.

Finally, it calls [[NCM_services#ncm|OpenContentMetaDatabase]] with [[NCM_services#StorageId|StorageId]] 3, then calls [[NCM_services#IContentMetaDatabase|GetLatestContentMetaKey]] with the supplied [[NCM_services#ApplicationId|ApplicationId]] and compares the version field from the returned [[CNMT#Content_Meta_Records|Content Meta Record]] with the supplied '''version'''.

If the supplied '''version''' is higher than the one in NCM's database, the value returned by [[NS_Services#NeedsUpdateVulnerability|NeedsUpdateVulnerability]] is set to "true".

== GetSafeSystemVersion ==
No input, returns an output [[NCM_services#ContentMetaKey|ContentMetaKey]] with the cached contents of "ns_ssversion:/entry" ([[NCM_services#ApplicationId|ApplicationId]], u32 '''version''' and u32 '''policy''' from <code>vulnerability!needs_update_vulnerability_policy</code>).

== GetSafeSystemVersionCheckInfo ==
No input, returns 0x10-bytes of output.

[S2] Used by web-applets via ns:vm.

== RequestUpdateSafeSystemVersionCheckInfo ==
No input, returns an output Event handle and an [[#IAsyncResult|IAsyncResult]].

[S2] Used by web-applets via ns:vm.

The async task thread uses [[NIM_services|nim]] RequestCheckSafeSystemVersion, etc.

== ResetSafeSystemVersionCheckInfo ==
No input/output.

This throws an error if [[Settings_services|GetDebugModeFlag]] returns false.

= ns:su =
This is "nn::ns::detail::ISystemUpdateInterface".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#GetBackgroundNetworkUpdateState]]
|-
| 1 || [[#OpenSystemUpdateControl]]
|-
| 2 || [[#NotifyExFatDriverRequired]]
|-
| 3 || [[#ClearExFatDriverStatusForDebug]]
|-
| 4 || [[#RequestBackgroundNetworkUpdate]]
|-
| 5 || [[#NotifyBackgroundNetworkUpdate]]
|-
| 6 || [[#NotifyExFatDriverDownloadedForDebug]]
|-
| 9 || [[#GetSystemUpdateNotificationEventForContentDelivery]]
|-
| 10 || [[#NotifySystemUpdateForContentDelivery]]
|-
| 11 || [3.0.0+] [[#PrepareShutdown]]
|-
| 12 || [3.0.0-3.0.2]
|-
| 13 || [3.0.0-3.0.2]
|-
| 14 || [3.0.0-3.0.2]
|-
| 15 || [3.0.0-3.0.2]
|-
| 16 || [4.0.0+] [[#DestroySystemUpdateTask]]
|-
| 17 || [4.0.0+] [[#RequestSendSystemUpdate]]
|-
| 18 || [4.0.0+] [[#GetSendSystemUpdateProgress]]
|-
| 19 || [S2]
|-
| 20 || [S2]
|}

== GetBackgroundNetworkUpdateState ==
No input, returns an output [[#BackgroundNetworkUpdateState]].

This is similar to [[#HasDownloaded]], see [[#BackgroundNetworkUpdateState]].

== OpenSystemUpdateControl ==
No input, returns an [[#ISystemUpdateControl]].

Only 1 ISystemUpdateControl can be open at a time.

== NotifyExFatDriverRequired ==
No input/output.

Only usable when an [[#ISystemUpdateControl]] isn't open.

This uses [[NIM_services|nim]] ListSystemUpdateTask, then when a task is returned uses it with DestroySystemUpdateTask.

Then this runs ExFat handling, updates state, and sets the same state flag as [[#RequestBackgroundNetworkUpdate]].

== ClearExFatDriverStatusForDebug ==
No input/output.

== RequestBackgroundNetworkUpdate ==
No input/output.

Only usable when an [[#ISystemUpdateControl]] isn't open.

This sets a state flag to value 1.

== NotifyBackgroundNetworkUpdate ==
Takes an input [[NCM_services#ContentMetaKey|ContentMetaKey]], no output.

This checks whether a sysupdate is needed with the input ContentMetaKey using [[NCM_services|NCM]] commands, if not this will just return 0. Otherwise, this will then run code which is identical to [[#RequestBackgroundNetworkUpdate]].

== NotifyExFatDriverDownloadedForDebug ==
No input/output.

== GetSystemUpdateNotificationEventForContentDelivery ==
No input, returns an output Event handle with EventClearMode=0.

== NotifySystemUpdateForContentDelivery ==
No input/output.

Signals the Event returned by [[#GetSystemUpdateNotificationEventForContentDelivery]].

== PrepareShutdown ==
No input/output.

This is used by [[AM_services|AM]].

Just returns 0 when an [[#ISystemUpdateControl]] is open.

This does various cleanup / uses various service-cmds etc for shutdown preparation.

== DestroySystemUpdateTask ==
No input/output.

Only usable when an [[#ISystemUpdateControl]] isn't open.

This uses [[NIM_services|nim]] ListSystemUpdateTask, then when a task is returned uses it with DestroySystemUpdateTask.

== RequestSendSystemUpdate ==
Takes a type-0x15 input buffer containing a [[#SystemDeliveryInfo]], an u16 port, an u32 Ipv4Address, returns an output Event handle and an [[#IAsyncResult]].

[[qlaunch]] uses value 55556 for the port. IP is normally a local-WLAN address, however this can be any address. port/addr are little-endian.

See [[NIM_services|nim]] regarding the input addr/port usage, etc.

[11.0.0+] An error is thrown if LocalContentShare is not [[#IsLocalContentShareEnabled|enabled]].

This validates the [[#SystemDeliveryInfo]] and generates a [[NCM_services#ContentMetaKey|ContentMetaKey]] from that, and creates the [[#IAsyncResult]] + the async thread which handles the [[#IAsyncResult]] operation.

The above validation verifies that the HMAC and SystemDeliveryProtocolVersion are valid. The OldSystemUpdateId ([20.0.0+] SystemUpdateId, SystemUpdateIdFlag ignored) must match the Id for the installed SystemUpdate as returned by [[NCM_services|ncm]].

Then the thread does:
* Calls a func which does:
** Uses [[NIM_services|nim]] CreateLocalCommunicationSendSystemUpdateTask, returning the Result on failure.
*** The input firmware_variation is from the [[#SystemDeliveryInfo|FirmwareVariationId]].
** Uses [[NIM_services|nim]] RequestLocalCommunicationSendSystemUpdateTaskRun, returning the Result on failure. Waits for the IAsyncResult operation from this to finish, then uses the Get cmd to get the output Result.
*** When the Result from Get is an error, a func is called for filling in the [[#IAsyncResult|IAsyncResult]] ErrorContext with Type4.
** Handles cleanup and returns.
* Unlike [[#RequestReceiveSystemUpdate]], this doesn't save a SystemPlayReport.

== GetSendSystemUpdateProgress ==
No input, returns an output [[#SystemUpdateProgress]].

Same as [[#GetReceiveProgress]] except this uses nim ListLocalCommunicationSendSystemUpdateTask and GetLocalCommunicationSendSystemUpdateTaskInfo. The data copied to output is also swapped: u64 nim_out+0x8 is copied to out+0x8, and u64 nim_out+0x10 is copied to out+0x0.

== Cmd19 ==
This is exclusive to S2.

No input/output.

== Cmd20 ==
This is exclusive to S2.

No input, returns an output u8.

== ISystemUpdateControl ==
This is "nn::ns::detail::ISystemUpdateControl".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#HasDownloaded]]
|-
| 1 || [[#RequestCheckLatestUpdate]]
|-
| 2 || [[#RequestDownloadLatestUpdate]]
|-
| 3 || [[#GetDownloadProgress]]
|-
| 4 || [[#ApplyDownloadedUpdate]]
|-
| 5 || [[#RequestPrepareCardUpdate]]
|-
| 6 || [[#GetPrepareCardUpdateProgress]]
|-
| 7 || [[#HasPreparedCardUpdate]]
|-
| 8 || [[#ApplyCardUpdate]]
|-
| 9 || [[#GetDownloadedEulaDataSize]]
|-
| 10 || [[#GetDownloadedEulaData]]
|-
| 11 || [[#SetupCardUpdate]]
|-
| 12 || [[#GetPreparedCardUpdateEulaDataSize]]
|-
| 13 || [[#GetPreparedCardUpdateEulaData]]
|-
| 14 || [4.0.0+] [[#SetupCardUpdateViaSystemUpdater]]
|-
| 15 || [4.0.0+] [[#HasReceived]]
|-
| 16 || [4.0.0+] [[#RequestReceiveSystemUpdate]]
|-
| 17 || [4.0.0+] [[#GetReceiveProgress]]
|-
| 18 || [4.0.0+] [[#ApplyReceivedUpdate]]
|-
| 19 || [4.0.0+] [[#GetReceivedEulaDataSize]]
|-
| 20 || [4.0.0+] [[#GetReceivedEulaData]]
|-
| 21 || [4.0.0+] [[#SetupToReceiveSystemUpdate]]
|-
| 22 || [6.0.0+] [[#RequestCheckLatestUpdateIncludesRebootlessUpdate]]
|}

All Card cmds except SetupCardUpdate* require [[#SetupCardUpdate]]/[[#SetupCardUpdateViaSystemUpdater]] to be used previously. [[#GetPreparedCardUpdateEulaDataSize]]/[[#GetPreparedCardUpdateEulaData]] checks a different state flag.

=== HasDownloaded ===
No input, returns an output u8 bool flag.

Gets whether a network sysupdate was downloaded, with install pending.

Uses [[NIM_services|nim]] ListSystemUpdateTask and [[NIM_services|nim]] GetSystemUpdateTaskInfo. When ListSystemUpdateTask successfully returns a task and GetSystemUpdateTaskInfo is successful, the output flag is set to: <code>*((u8*)(taskinfo+0) == 0x3</code>. Otherwise, flag=0.

This always returns 0, however this will assert if GetSystemUpdateTaskInfo fails with ret!=0x3C89.

=== RequestCheckLatestUpdate ===
No input, returns an output Event handle and an [[#IAsyncValue]].

The data that can be read from the [[#IAsyncValue]] is [[#LatestSystemUpdate]].

=== RequestDownloadLatestUpdate ===
No input, returns an output Event handle and an [[#IAsyncResult]].

=== GetDownloadProgress ===
No input, returns an output [[#SystemUpdateProgress]].

Similar to [[#HasDownloaded]] except instead of a flag, this returns the 0x10-bytes from taskinfo+8. The output struct is cleared when the task(info) isn't available.

=== ApplyDownloadedUpdate ===
No input/output.

Runs code similar to [[#HasDownloaded]], throwing an error if a network sysupdate isn't ready for install. Then the sysupdate is installed:

* Uses ListSystemUpdateTask again, then [[NIM_services|nim]] IsExFatDriverIncluded. Runs ExFat handling when the output flag is set.
* On newer system-versions, this uses [[NIM_services|nim]] GetSystemUpdateTaskInfo then on success uses data from there to save a SystemPlayReport when the cached [[System_Settings|system-setting]] "systemreport!enabled" is set.
** The EventId is "systemupdate_dl_throughput" with ApplicationId 0100000000001018.
** The following fields are added to the report, see [[NIM_services#SystemUpdateTaskInfo|nim SystemUpdateTaskInfo]]: "ContentMetaId", "Version", "DownloadSize", and "ThroughputKBps".
* On newer system-versions, this saves another SystemPlayReport when a state flag is set (same flag mentioned above).
** The EventId is "systemupdate_pass" with ApplicationId 0100000000001021.
** This report has the following fields:
*** "Type"
*** "SourceSystemUpdateMetaId"
*** "SourceSystemUpdateMetaVersion"
*** "SourceExFatStatus"
*** "DestinationSystemUpdateMetaId"
*** "DestinationSystemUpdateMetaVersion"
*** "DestinationExFatStatus"
*** "Rebootless"
* Since BootImagePackage will be installed later, the two flags in [[Flash_Filesystem#System_Update_Control]] are set to 1.
* Uses [[NIM_services|nim]] CommitSystemUpdateTask and [[NIM_services|nim]] DestroySystemUpdateTask.
* Installs BootImagePackage. After installing each BootImagePackage, the associated flag in [[Flash_Filesystem#System_Update_Control]] is set to 0.
* On newer system versions when an input flag is set, this uses [[Filesystem_services|NotifySystemDataUpdateEvent]], however this doesn't happen with ApplyDownloadedUpdate since that input flag is 0.

=== RequestPrepareCardUpdate ===
No input, returns an output Event handle and an [[#IAsyncResult]].

=== GetPrepareCardUpdateProgress ===
No input, returns an output [[#SystemUpdateProgress]].

=== HasPreparedCardUpdate ===
No input, returns an output u8 bool flag.

=== ApplyCardUpdate ===
No input/output.

=== GetDownloadedEulaDataSize ===
Takes a type-0x15 input buffer [[#EulaDataPath]], returns an output u64 '''filesize'''.

Runs code similar to [[#HasDownloaded]], throwing an error if a network sysupdate isn't ready for install.

Uses ListSystemUpdateTask again. Then [[NIM_services|nim]] GetDownloadedSystemDataPath, with the output ContentPath being used to mount the EULA title with FS.

Then "<mountname>:/<[[#EulaDataPath]]>" is opened, gets the '''filesize''', then runs cleanup.

=== GetDownloadedEulaData ===
Takes a type-0x15 input buffer [[#EulaDataPath]] and a type-0x6 output buffer, returns an output u64 '''filesize'''.

Similar to [[#GetDownloadedEulaDataSize]] except this reads the file instead, using the specified output buffer with size=filesize. This will throw an error if the filesize is larger than the buffer size.

=== SetupCardUpdate ===
Takes an input u64 size and a TransferMemory handle, no output.

Official sw creates the TransferMemory with an user-specified buffer, with permissions=None.

[[qlaunch]] uses size 0x100000 for the TransferMemory buffer.

=== GetPreparedCardUpdateEulaDataSize ===
Takes a type-0x15 input buffer [[#EulaDataPath]], returns an output u64 '''filesize'''.

This is similar to [[#GetDownloadedEulaDataSize]].

=== GetPreparedCardUpdateEulaData ===
Takes a type-0x15 input buffer [[#EulaDataPath]] and a type-0x6 output buffer, returns an output u64 '''filesize'''.

This is similar to [[#GetDownloadedEulaData]].

=== SetupCardUpdateViaSystemUpdater ===
Takes an input u64 size and a TransferMemory handle, no output.

The permissions for the TransferMemory is None.

Same as [[#SetupCardUpdate]], except this doesn't have the code for [[Filesystem_services|GetGameCardHandle/GetGameCardUpdatePartitionInfo]], and uses [[Filesystem_services|OpenRegisteredUpdatePartition]] instead of [[Filesystem_services|OpenGameCardFileSystem]]. This uses the same is_initialized bool state flag.

=== HasReceived ===
No input, returns an output u8 bool.

Same as [[#HasDownloaded]] except this uses [[NIM_services|nim]] ListLocalCommunicationReceiveSystemUpdateTask and GetLocalCommunicationReceiveSystemUpdateTaskInfo.

=== RequestReceiveSystemUpdate ===
Takes a type-0x15 input buffer containing a [[#SystemDeliveryInfo]], an u16 port, an u32 Ipv4Address, returns an output Event handle and an [[#IAsyncResult]].

[[qlaunch]] uses the same value for the port as [[#RequestSendSystemUpdate]] (see [[#RequestSendSystemUpdate]] for addr as well).

See [[NIM_services|nim]] regarding the input addr/port usage, etc.

This uses the same LocalContentShare check as [[#RequestSendSystemUpdate|RequestSendSystemUpdate]].

An error is thrown if a state flag is clear.

This validates the [[#SystemDeliveryInfo]] (same as [[#RequestSendSystemUpdate|RequestSendSystemUpdate]]) and generates a [[NCM_services#ContentMetaKey|ContentMetaKey]] from that, and creates the [[#IAsyncResult]] + the async thread which handles the [[#IAsyncResult]] operation.

Then the thread does:

* Calls a func which does:
** Throws an error if [[NIM_services#ListSystemUpdateTask|ListSystemUpdateTask]] returns any task.
** Checks whether a sysupdate is actually required using the previously generated [[NCM_services#ContentMetaKey|ContentMetaKey]] (this func is also passed the below statefield as the last param), throwing an error if not.
*** [20.0.0+] The above check-sysupdate func was updated (which is also used elsewhere), flag handling during the loop was updated (which uses the last input param).
** Uses [[NIM_services|nim]] CreateLocalCommunicationReceiveSystemUpdateTask, returning the Result on failure.
*** The input firmware_variation is from [[System_Settings|system-setting]] <code>ns.systemupdate!firmware_variation</code> or <code>ns.systemupdate!t_firmware_variation</code>, depending on the [[Settings_services|PlatformRegion]] (value 0xFF is used when the output setting-size is invalid).
*** The input '''unk''' is set to: <code>unk = statefield == 0 ? 0x4 : 0xC</code> ([20.0.0+] uses statefield & 1 == 0). [20.0.0+] Additional data is now ORRed with unk afterwards: <code>unk |= ((statefield>>1) & 0x3) << 8;</code> (same statefield as before)
** Uses [[NIM_services|nim]] RequestLocalCommunicationReceiveSystemUpdateTaskRun, returning the Result on failure. Waits for the IAsyncResult operation from this to finish, then uses the Get cmd to get the output Result.
*** When the Result from Get is an error, a func is called for filling in the [[#IAsyncResult|IAsyncResult]] ErrorContext with Type4.
** Handles cleanup and returns.
* On success, this loads various data which is then used for saving a SystemPlayReport when the cached [[System_Settings|system-setting]] "systemreport!enabled" is set.
** The EventId is "receive_system_update" with ApplicationId <NS ProgramId>.
** This report has the following fields:
*** "SourceSystemUpdateId"
*** "DestinationSystemUpdateId"
*** "SourceSystemUpdateVersion"
*** "DestinationSystemUpdateVersion"
*** "SenderFirmwareVariationId"
*** "ReceiverFirmwareVariationId"
*** "SenderPlatformRegion"
*** "ReceiverPlatformRegion"
*** "SenderHasExFat"
*** "ReceiverHasExFat"
*** "Size"
*** "ThroughputKBps"

=== GetReceiveProgress ===
No input, returns an output [[#SystemUpdateProgress]].

Same as [[#GetDownloadProgress]] except this uses [[NIM_services|nim]] ListLocalCommunicationReceiveSystemUpdateTask and GetLocalCommunicationReceiveSystemUpdateTaskInfo.

=== ApplyReceivedUpdate ===
No input/output.

This uses the same LocalContentShare check as [[#RequestSendSystemUpdate|RequestSendSystemUpdate]].

=== GetReceivedEulaDataSize ===
Takes a type-0x15 input buffer [[#EulaDataPath]], returns an output u64 '''filesize'''.

This is similar to [[#GetDownloadedEulaDataSize]].

=== GetReceivedEulaData ===
Takes a type-0x15 input buffer [[#EulaDataPath]] and a type-0x6 output buffer, returns an output u64 '''filesize'''.

This is similar to [[#GetDownloadedEulaData]].

=== SetupToReceiveSystemUpdate ===
No input/output.

This just uses [[NIM_services|nim]] ListSystemUpdateTask, then when a task is returned uses it with DestroySystemUpdateTask.

[[qlaunch]] uses this before [[#RequestReceiveSystemUpdate]].

=== RequestCheckLatestUpdateIncludesRebootlessUpdate ===
No input, returns an output Event handle and an [[#IAsyncValue]].

= IAsyncValue =
This is "nn::ns::detail::IAsyncValue".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetSize
|-
| 1 || Get
|-
| 2 || Cancel
|-
| 3 || [4.0.0+] GetErrorContext
|}

Official sw creates a container object for this using the output from the service commands, which contains the IAsyncValue object, and the Event with EventClearMode=0.

* GetSize: No input, returns an output u64.
* Get: Takes a type-0x6 output buffer, no output. Official sw waits on the Event prior to using this cmd.
* Cancel: No input/output. Used by official sw when closing the object, when the serv-obj is initialized (after using the cmd, official sw will also wait on the Event). This cmd is also used in other official sw funcs.
* GetErrorContext: No input/output, takes a type-0x16 output buffer containing an [[Error_Applet#ErrorContext|ErrorContext]].

= IAsyncResult =
This is "nn::ns::detail::IAsyncResult".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Get
|-
| 1 || Cancel
|-
| 2 || [4.0.0+] GetErrorContext
|}

Official sw creates a container object for this using the output from the service commands, which contains the IAsyncResult object, and the Event with EventClearMode=0.

* Get: No input/output. Official sw waits on the Event prior to using this cmd.
* Cancel: No input/output. Used by official sw when closing the object, when the serv-obj is initialized (after using the cmd, official sw will also wait on the Event). This cmd is also used in other official sw funcs.
* GetErrorContext: No input/output, takes a type-0x16 output buffer containing an [[Error_Applet#ErrorContext|ErrorContext]].

= ns:dev =
This is "nn::ns::detail::IDevelopInterface".

[10.0.0+] Some of these cmds were replaced by the [[PGL_services|pgl]] system module.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [1.0.0-9.2.0] [[#LaunchProgram]]
|-
| 1 || [[#TerminateProcess]]
|-
| 2 || [1.0.0-9.2.0] [[#TerminateProgram]]
|-
| 4 || [1.0.0-9.2.0] [[#GetShellEvent]]
|-
| 5 || [1.0.0-9.2.0] [[#GetShellEventInfo]]
|-
| 6 || [[#TerminateApplication]]
|-
| 7 || [1.0.0-9.2.0] [[#PrepareLaunchProgramFromHost]]
|-
| 8 || [10.0.0-17.0.1] [[#LaunchApplicationFromHost]] ([1.0.0-9.2.0] LaunchApplication)
|-
| 9 || [1.0.0-17.0.1] [[#LaunchApplicationWithStorageId]]
|-
| 10 || [6.0.0-8.1.0] [[#IsSystemMemoryResourceLimitBoosted]]
|-
| 11 || [6.0.0+] [[#GetRunningApplicationProcessId]]
|-
| 12 || [6.0.0+] [[#SetCurrentApplicationRightsEnvironmentCanBeActive]]
|-
| 13 || [9.0.0+] [[#CreateApplicationResource]]
|-
| 14 || [9.0.0+] [[#IsPreomia]]
|-
| 15 || [10.0.0-17.0.1] [[#GetApplicationProgramIdFromHost]]
|-
| 16 || [12.0.0+] RefreshCachedDebugValues
|-
| 17 || [12.0.0+] [[#PrepareLaunchApplicationFromHost]]
|-
| 18 || [12.0.0+] [[#GetLaunchEvent]]
|-
| 19 || [12.0.0+] [[#GetLaunchResult]]
|-
| 20 || [14.0.0+] GetProgramId
|-
| 21 || [18.0.0+] [[#PrepareLaunchApplication]]
|-
| 22 || [18.0.0+] [[#LaunchApplication]]
|-
| 23 || [18.0.0+] [[#GetProgramIdByApplicationLaunchInfo]]
|-
| 24 || [18.0.0+] DestroyApplicationLaunchPreparation
|}

== LaunchProgram ==
Wrapper for "pm:shell" [[Process_Manager_services#pm:shell|LaunchProcess]].

== TerminateProcess ==
Wrapper for "pm:shell" [[Process_Manager_services#pm:shell|TerminateProcess]].

== TerminateProgram ==
Wrapper for "pm:shell" [[Process_Manager_services#pm:shell|TerminateProgram]].

== GetShellEvent ==
Wrapper for "pm:shell" [[Process_Manager_services#pm:shell|GetProcessEventHandle]].

== GetShellEventInfo ==
Wrapper for "pm:shell" [[Process_Manager_services#pm:shell|GetProcessEventInfo]].

== TerminateApplication ==
Calls "pm:shell" [[Process_Manager_services#pm:shell|GetApplicationProcessIdForShell]] and sends the ProcessId to [[Process_Manager_services#pm:shell|TerminateProcess]].

== PrepareLaunchProgramFromHost ==
Takes a type-0x5 input buffer containing the [[Filesystem_services#FspPath|FspPath]], returns an output 0x10-byte struct.

Calls [[NCM_services#IPathResolverForStorage|IPathResolverForStorage]] Set...NcaPath functions.

== LaunchApplicationFromHost ==
Takes an input u32 [[Process_Manager_services#LaunchFlags|LaunchFlags]] and a type-0x5 input buffer containing the [[Filesystem_services#FspPath|FspPath]]. Returns an output u64 ProcessId.

== LaunchApplicationWithStorageId ==
Takes 2 input u8 [[NCM_services#StorageId|StorageIds]], an u32 [[Process_Manager_services#LaunchFlags|LaunchFlags]], and an [[NCM_services#ApplicationId|ApplicationId]]. Returns an output u64 ProcessId.

Launches an application title which is registered with NS.

== IsSystemMemoryResourceLimitBoosted ==
No input. Returns a bool.

== GetRunningApplicationProcessId ==
Returns an output u64 ProcessId.

== SetCurrentApplicationRightsEnvironmentCanBeActive ==
Takes an input bool. No output.

== CreateApplicationResource ==
Takes an input u32 (1 = Preomia/MicroApplication). Returns an [[#IApplicationResource]].

== IsPreomia ==
Takes an input u64 [[NCM_services#ProgramId|ProgramId]]. Returns a bool.

== GetApplicationProgramIdFromHost ==
Takes a type-0x5 input buffer containing the [[Filesystem_services#FspPath|FspPath]]. Returns an u64 [[NCM_services#ProgramId|ProgramId]].

== PrepareLaunchApplicationFromHost ==
[18.0.0+] Now returns a total of 0x50 bytes of output.

[19.0.0+] Now returns a total of 0x80 bytes of output.

== GetLaunchEvent ==
[18.0.0+] Now takes a total of 0x50 bytes of input.

[19.0.0+] Now takes a total of 0x80 bytes of input.

== GetLaunchResult ==
[18.0.0+] Now takes a total of 0x50 bytes of input.

[19.0.0+] Now takes a total of 0x80 bytes of input.

== PrepareLaunchApplication ==
Takes a total of 0x10-bytes of input. Returns a total of 0x50-bytes of output.

[19.0.0+] Now returns a total of 0x80-bytes of output.

== LaunchApplication ==
Takes a total of 0x50-bytes of input. Returns a total of 8-bytes of output.

[19.0.0+] Now takes a total of 0x80 bytes of input.

== GetProgramIdByApplicationLaunchInfo ==
Takes a total of 0x50-bytes of input. Returns a total of 8-bytes of output.

[19.0.0+] Now takes a total of 0x80 bytes of input.

= acc:su =
This is "nn::account::IAccountServiceForAdministrator".

[13.0.0+] This was moved from [[Account_services|account]].

This is only available when the output from [[Process_Manager_services|pm:bm]] GetBootMode is Normal/Maintenance.

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || GetUserCount ||
|-
| 1 || GetUserExistence ||
|-
| 2 || ListAllUsers ||
|-
| 3 || ListOpenUsers ||
|-
| 4 || GetLastOpenedUser ||
|-
| 5 || GetProfile || Returns an [[#IProfile]].
|-
| 6 || [3.0.0+] GetProfileDigest ||
|-
| 50 || [[#IsUserRegistrationRequestPermitted]] ||
|-
| 51 || TrySelectUserWithoutInteractionDeprecated ([1.0.0-18.1.0] [[#TrySelectUserWithoutInteraction]]) ||
|-
| 52 || [19.0.0+] TrySelectUserWithoutInteraction ||
|-
| 60 || [5.0.0-5.1.0] ListOpenContextStoredUsers ||
|-
| 99 || [6.0.0+] DebugActivateOpenContextRetention || No input, returns an [[#ISessionObject]].
|-
| 100 || GetUserRegistrationNotifier || Returns an [[#INotifier]].
|-
| 101 || GetUserStateChangeNotifier || Returns an [[#INotifier]].
|-
| 102 || GetBaasAccountManagerForSystemService || Returns an [[#IManagerForSystemService]].
|-
| 103 || GetBaasUserAvailabilityChangeNotifier || Returns an [[#INotifier]].
|-
| 104 || GetProfileUpdateNotifier || Returns an [[#INotifier]].
|-
| 105 || [4.0.0+] CheckNetworkServiceAvailabilityAsync || Returns an [[#IAsyncContext]].
|-
| 106 || [9.0.0+] GetProfileSyncNotifier ||
|-
| 110 || StoreSaveDataThumbnail ||
|-
| 111 || ClearSaveDataThumbnail ||
|-
| 112 || LoadSaveDataThumbnail ||
|-
| 113 || [5.0.0+] GetSaveDataThumbnailExistence ||
|-
| 120 || [10.0.0+] ListOpenUsersInApplication ||
|-
| 130 || [6.0.0+] ActivateOpenContextRetention || Takes a total of 0x8-bytes of input, returns an [[#ISessionObject]].
|-
| 140 || [6.0.0+] ListQualifiedUsers ||
|-
| 150 || [10.0.0-10.2.0] AuthenticateApplicationAsync ||
|-
| 151 || [12.0.0+] EnsureSignedDeviceIdentifierCacheForNintendoAccountAsync ||
|-
| 152 || [12.0.0+] LoadSignedDeviceIdentifierCacheForNintendoAccount ||
|-
| 170 || [13.0.0+] GetNasOp2MembershipStateChangeNotifier ||
|-
| 190 || [1.0.0-9.2.0] GetUserLastOpenedApplication ||
|-
| 191 || [7.0.0-19.0.1] UpdateNotificationReceiverInfo ([5.0.0-5.1.0] ActivateOpenContextHolder) ||
|-
| 200 || BeginUserRegistration ||
|-
| 201 || CompleteUserRegistration ||
|-
| 202 || CancelUserRegistration ||
|-
| 203 || DeleteUser ||
|-
| 204 || SetUserPosition ||
|-
| 205 || GetProfileEditor || Takes an input userID and returns an [[#IProfileEditor]].
|-
| 206 || CompleteUserRegistrationForcibly ||
|-
| 210 || [3.0.0+] CreateFloatingRegistrationRequest || Returns an [[#IFloatingRegistrationRequest]].
|-
| 211 || [8.0.0+] CreateProcedureToRegisterUserWithNintendoAccount || Takes a total of 0x4-bytes of input and a handle, returns an [[#IOAuthProcedureForUserRegistration]].
|-
| 212 || [8.0.0+] ResumeProcedureToRegisterUserWithNintendoAccount || Takes a total of 0x14-bytes of input and a handle, returns an [[#IOAuthProcedureForUserRegistration]].
|-
| 213 || [17.0.0+] CreateProcedureToCreateUserWithNintendoAccount ||
|-
| 214 || [17.0.0+] ResumeProcedureToCreateUserWithNintendoAccount ||
|-
| 215 || [17.0.0+] ResumeProcedureToCreateUserWithNintendoAccountAfterApplyResponse ||
|-
| 230 || AuthenticateServiceAsync || Returns an [[#IAsyncContext]].
|-
| 250 || GetBaasAccountAdministrator || Returns an [[#IAdministrator]].
|-
| 251 || [20.0.0+] SynchronizeNetworkServiceAccountsSnapshotAsync ||
|-
| 290 || ProxyProcedureForGuestLoginWithNintendoAccount || Returns an [[#IOAuthProcedureForExternalNsa]] (formerly [[#IOAuthProcedureForGuestLogin]] with [1.0.0-2.3.0]).
|-
| 291 || [3.0.0+] ProxyProcedureForFloatingRegistrationWithNintendoAccount || Returns an [[#IOAuthProcedureForExternalNsa]].
|-
| 292 || [20.0.0+] ProxyProcedureForDeviceMigrationAuthenticatingOperatingUser ||
|-
| 293 || [20.0.0+] ProxyProcedureForDeviceMigrationDownload ||
|-
| 299 || SuspendBackgroundDaemon || Returns an [[#ISessionObject]].
|-
| 350 || [20.0.0+] CreateDeviceMigrationUserExportRequest ||
|-
| 351 || [20.0.0+] UploadNasCredential ||
|-
| 352 || [20.0.0+] CreateDeviceMigrationUserImportRequest ||
|-
| 353 || [20.0.0+] DeleteUserMigrationSaveData ||
|-
| 400 || [18.0.0+] SetPinCode ||
|-
| 401 || [18.0.0+] GetPinCodeLength ||
|-
| 402 || [18.0.0-19.0.1] GetPinCode ||
|-
| 403 || [20.0.0+] GetPinCodeParity ||
|-
| 404 || [20.0.0+] VerifyPinCode ||
|-
| 405 || [20.0.0+] IsPinCodeVerificationForbidden ||
|-
| 410 || [18.0.0+] GetPinCodeErrorCount ||
|-
| 411 || [18.0.0-19.0.1] ResetPinCodeErrorCount ||
|-
| 412 || [18.0.0-19.0.1] IncrementPinCodeErrorCount ||
|-
| 413 || [20.0.0+] SetPinCodeErrorCount ||
|-
| 420 || [19.0.0+] SetStartPenaltyTime ||
|-
| 421 || [19.0.0+] GetStartPenaltyTime ||
|-
| 900 || [13.0.0+] SetUserUnqualifiedForDebug ||
|-
| 901 || [13.0.0+] UnsetUserUnqualifiedForDebug ||
|-
| 902 || [13.0.0+] ListUsersUnqualifiedForDebug ||
|-
| 910 || [16.0.0+] RefreshFirmwareSettingsForDebug ||
|-
| 997 || [3.0.0+] DebugInvalidateTokenCacheForUser ||
|-
| 998 || DebugSetUserStateClose ||
|-
| 999 || DebugSetUserStateOpen ||
|}

[10.0.0+] DebugSetUserStateClose/DebugSetUserStateOpen now takes an additional 8-bytes of input.

== IsUserRegistrationRequestPermitted ==
Takes a PID, an input u64 pid_reserved, and returns an output u8 bool.

== TrySelectUserWithoutInteraction ==
Takes an input u8 bool isNetworkServiceAccountRequired, returns an output Uid.

== IManagerForSystemService ==
This is "nn::account::baas::IManagerForSystemService".

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || CheckAvailability ||
|-
| 1 || GetAccountId ||
|-
| 2 || EnsureIdTokenCacheAsync || Returns an [[#IAsyncContext]].
|-
| 3 || [19.0.0+] LoadIdTokenCacheDeprecated ([1.0.0-18.1.0] LoadIdTokenCache) ||
|-
| 4 || [19.0.0+] LoadIdTokenCache ||
|-
| 100 || SetSystemProgramIdentification ||
|-
| 101 || RefreshNotificationTokenAsync ||
|-
| 110 || GetServiceEntryRequirementCacheForLogin ||
|-
| 111 || InvalidateServiceEntryRequirementCache ||
|-
| 113 || GetServiceEntryRequirementCacheForOnlinePlay || Takes a total of 0x8-bytes of input, returns a total of 0x4-bytes of output.
|-
| 120 || GetNintendoAccountId ||
|-
| 121 || CalculateNintendoAccountAuthenticationFingerprint ||
|-
| 130 || GetNintendoAccountUserResourceCache ||
|-
| 131 || RefreshNintendoAccountUserResourceCacheAsync || Returns an [[#IAsyncContext]].
|-
| 132 || RefreshNintendoAccountUserResourceCacheAsyncIfSecondsElapsed || Returns an [[#IAsyncContext]].
|-
| 133 || GetNintendoAccountVerificationUrlCache ||
|-
| 134 || RefreshNintendoAccountVerificationUrlCacheAsync ||
|-
| 135 || RefreshNintendoAccountVerificationUrlCacheAsyncIfSecondsElapsed ||
|-
| 136 || [19.0.0+] GetNintendoAccountUserResourceCache ||
|-
| 140 || GetNetworkServiceLicenseCache ||
|-
| 141 || RefreshNetworkServiceLicenseCacheAsync || Returns an [[#IAsyncContext]].
|-
| 142 || RefreshNetworkServiceLicenseCacheAsyncIfSecondsElapsed || Returns an [[#IAsyncContext]].
|-
| 143 || [15.0.0+] GetNetworkServiceLicenseCacheEx ||
|-
| 150 || CreateAuthorizationRequest || Returns an [[#IAuthorizationRequest]].
|-
| 151 || [22.5.0+] ||
|-
| 152 || [22.5.0+] ||
|-
| 153 || [22.5.0+] ||
|-
| 160 || [15.0.0+] RequiresUpdateNetworkServiceAccountIdTokenCache ||
|-
| 161 || [16.0.0+] RequireReauthenticationOfNetworkServiceAccount ||
|-
| 180 || [18.0.0-19.0.1] GetRequestForNintendoAccountReauthentication ||
|-
| 181 || [20.0.0+] CreateProcedureToReauthenticateNintendoAccount ||
|-
| 182 || [20.0.0+] ResumeProcedureToReauthenticateNintendoAccount ||
|}

== IFloatingRegistrationRequest ==
This is "nn::account::baas::IFloatingRegistrationRequest".

Added with [3.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || GetSessionId ||
|-
| 12 || GetAccountId ||
|-
| 13 || GetLinkedNintendoAccountId ||
|-
| 14 || GetNickname ||
|-
| 15 || GetProfileImage ||
|-
| 16 || [18.0.0+] GetProfileLargeImage ||
|-
| 21 || LoadIdTokenCache ||
|-
| 100 || RegisterUser ([1.0.0-3.0.2] RegisterAsync) || [1.0.0-3.0.2] Used to return an [[#IAsyncContext]].
|-
| 101 || RegisterUserWithUid ([1.0.0-3.0.2] RegisterWithUidAsync) || [1.0.0-3.0.2] Used to return an [[#IAsyncContext]].
|-
| 102 || [4.0.0+] RegisterNetworkServiceAccountAsync || Returns an [[#IAsyncContext]].
|-
| 103 || [4.0.0+] RegisterNetworkServiceAccountWithUidAsync || Returns an [[#IAsyncContext]].
|-
| 110 || SetSystemProgramIdentification ||
|-
| 111 || EnsureIdTokenCacheAsync || Returns an [[#IAsyncContext]].
|}

== IAdministrator ==
This is "nn::account::baas::IAdministrator".

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || CheckAvailability ||
|-
| 1 || GetAccountId ||
|-
| 2 || EnsureIdTokenCacheAsync || Returns an [[#IAsyncContext]].
|-
| 3 || [19.0.0+] LoadIdTokenCacheDeprecated ([1.0.0-18.1.0] LoadIdTokenCache) ||
|-
| 4 || [19.0.0+] LoadIdTokenCache ||
|-
| 100 || SetSystemProgramIdentification ||
|-
| 101 || [7.0.0+] RefreshNotificationTokenAsync
|-
| 110 || [4.0.0+] GetServiceEntryRequirementCache ||
|-
| 111 || [4.0.0+] InvalidateServiceEntryRequirementCache ||
|-
| 112 || [4.0.0-6.2.0] InvalidateTokenCache ||
|-
| 113 || [6.1.0+] GetServiceEntryRequirementCacheForOnlinePlay || Takes a total of 0x8-bytes of input, returns a total of 0x4-bytes of output.
|-
| 120 || GetNintendoAccountId ||
|-
| 121 || [9.0.0+] CalculateNintendoAccountAuthenticationFingerprint ||
|-
| 130 || GetNintendoAccountUserResourceCache ||
|-
| 131 || RefreshNintendoAccountUserResourceCacheAsync || Returns an [[#IAsyncContext]].
|-
| 132 || RefreshNintendoAccountUserResourceCacheAsyncIfSecondsElapsed || Returns an [[#IAsyncContext]].
|-
| 133 || [9.0.0+] GetNintendoAccountVerificationUrlCache ||
|-
| 134 || [9.0.0+] RefreshNintendoAccountVerificationUrlCacheAsync ||
|-
| 135 || [9.0.0+] RefreshNintendoAccountVerificationUrlCacheAsyncIfSecondsElapsed ||
|-
| 136 || [19.0.0+] GetNintendoAccountUserResourceCache ||
|-
| 140 || [5.0.0+] GetNetworkServiceLicenseCache ||
|-
| 141 || [5.0.0+] RefreshNetworkServiceLicenseCacheAsync ||
|-
| 142 || [5.0.0+] RefreshNetworkServiceLicenseCacheAsyncIfSecondsElapsed ||
|-
| 143 || [15.0.0+] GetNetworkServiceLicenseCacheEx ||
|-
| 150 || CreateAuthorizationRequest || Returns an [[#IAuthorizationRequest]].
|-
| 151 || [22.5.0+] ||
|-
| 152 || [22.5.0+] ||
|-
| 153 || [22.5.0+] ||
|-
| 160 || [15.0.0+] RequiresUpdateNetworkServiceAccountIdTokenCache ||
|-
| 161 || [16.0.0+] RequireReauthenticationOfNetworkServiceAccount ||
|-
| 180 || [18.0.0-19.0.1] GetRequestForNintendoAccountReauthentication ||
|-
| 181 || [20.0.0+] CreateProcedureToReauthenticateNintendoAccount ||
|-
| 182 || [20.0.0+] ResumeProcedureToReauthenticateNintendoAccount ||
|-
| 200 || IsRegistered ||
|-
| 201 || RegisterAsync || Returns an [[#IAsyncContext]].
|-
| 202 || UnregisterAsync || Returns an [[#IAsyncContext]].
|-
| 203 || DeleteRegistrationInfoLocally ||
|-
| 204 || [19.0.0-19.0.1] UnregisterDeviceAsync ||
|-
| 220 || SynchronizeProfileAsync || Returns an [[#IAsyncContext]].
|-
| 221 || UploadProfileAsync || Returns an [[#IAsyncContext]].
|-
| 222 || SynchronizeProfileAsyncIfSecondsElapsed || Returns an [[#IAsyncContext]].
|-
| 223 || [19.0.0+] DownloadProfileAsync ||
|-
| 250 || IsLinkedWithNintendoAccount ||
|-
| 251 || CreateProcedureToLinkWithNintendoAccount || Returns an [[#IOAuthProcedureForNintendoAccountLinkage]].
|-
| 252 || ResumeProcedureToLinkWithNintendoAccount || Returns an [[#IOAuthProcedureForNintendoAccountLinkage]].
|-
| 255 || CreateProcedureToUpdateLinkageStateOfNintendoAccount || Returns an [[#IOAuthProcedure]].
|-
| 256 || ResumeProcedureToUpdateLinkageStateOfNintendoAccount || Returns an [[#IOAuthProcedure]].
|-
| 260 || [3.0.0+] CreateProcedureToLinkNnidWithNintendoAccount || Returns an [[#IOAuthProcedure]].
|-
| 261 || [3.0.0+] ResumeProcedureToLinkNnidWithNintendoAccount || Returns an [[#IOAuthProcedure]].
|-
| 280 || ProxyProcedureToAcquireApplicationAuthorizationForNintendoAccount || Returns an [[#IOAuthProcedure]].
|-
| 290 || [8.0.0+] GetRequestForNintendoAccountUserResourceView ||
|-
| 300 || [6.0.0+] TryRecoverNintendoAccountUserStateAsync || Returns an [[#IAsyncContext]].
|-
| 400 || [6.1.0+] IsServiceEntryRequirementCacheRefreshRequiredForOnlinePlay || Takes a total of 0x8-bytes of input, returns an output u8.
|-
| 401 || [6.1.0+] RefreshServiceEntryRequirementCacheForOnlinePlayAsync || Takes a total of 0x8-bytes of input, returns an [[#IAsyncContext]].
|-
| 900 || [9.0.0+] GetAuthenticationInfoForWin ||
|-
| 901 || [9.0.0+] ImportAsyncForWin ||
|-
| 997 || DebugUnlinkNintendoAccountAsync || Returns an [[#IAsyncContext]].
|-
| 998 || DebugSetAvailabilityErrorDetail ||
|}

== IAuthorizationRequest ==
This is "nn::account::nas::IAuthorizationRequest".

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || GetSessionId ||
|-
| 10 || InvokeWithoutInteractionAsync || Returns an [[#IAsyncContext]].
|-
| 19 || IsAuthorized ||
|-
| 20 || GetAuthorizationCode ||
|-
| 21 || GetIdToken ||
|-
| 22 || GetState ||
|}

== IOAuthProcedure ==
This is "nn::account::http::IOAuthProcedure".

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || PrepareAsync || Returns an [[#IAsyncContext]].
|-
| 1 || GetRequest ||
|-
| 2 || ApplyResponse ||
|-
| 3 || ApplyResponseAsync || Returns an [[#IAsyncContext]].
|-
| 10 || Suspend ||
|}

== IOAuthProcedureForExternalNsa ==
This is "nn::account::nas::IOAuthProcedureForExternalNsa".

Added with [3.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || PrepareAsync || Returns an [[#IAsyncContext]].
|-
| 1 || GetRequest ||
|-
| 2 || ApplyResponse ||
|-
| 3 || ApplyResponseAsync || Returns an [[#IAsyncContext]].
|-
| 10 || Suspend ||
|-
| 100 || GetAccountId ||
|-
| 101 || GetLinkedNintendoAccountId ||
|-
| 102 || GetNickname ||
|-
| 103 || GetProfileImage ||
|-
| 104 || [18.0.0+] GetProfileLargeImage ||
|}

== IOAuthProcedureForNintendoAccountLinkage ==
This is "nn::account::nas::IOAuthProcedureForNintendoAccountLinkage".

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || PrepareAsync || Returns an [[#IAsyncContext]].
|-
| 1 || GetRequest ||
|-
| 2 || ApplyResponse ||
|-
| 3 || ApplyResponseAsync || Returns an [[#IAsyncContext]].
|-
| 10 || Suspend ||
|-
| 100 || GetRequestWithTheme ||
|-
| 101 || IsNetworkServiceAccountReplaced ||
|-
| 199 || [2.0.0-5.1.0] GetUrlForIntroductionOfExtraMembership ||
|-
| 200 || [16.0.0+] ApplyAsyncWithAuthorizedToken ||
|}

== INotifier ==
This is "nn::account::detail::INotifier".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetSystemEvent
|}

== IProfile ==
This is "nn::account::profile::IProfile".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Get]]
|-
| 1 || [[#GetBase]]
|-
| 10 || [[#GetImageSize]]
|-
| 11 || [[#LoadImage]]
|-
| 20 || [18.0.0+] GetLargeImageSize
|-
| 21 || [18.0.0+] LoadLargeImage
|-
| 30 || [18.0.0+] GetImageId
|}

=== Get ===
Takes an output type-0x1A buffer for [[#UserData]], returns an output [[#ProfileBase]].

=== GetBase ===
No input, returns an output [[#ProfileBase]].

=== GetImageSize ===
No input, returns an output u32 for the size of the image buffer.

=== LoadImage ===
Takes an output type-0x6 buffer, returns the same output u32 as [[#GetImageSize]].

The output buffer contains the JPEG profile image icon. This is valid for both Miis and character icons.

== IProfileEditor ==
This is "nn::account::profile::IProfileEditor".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Get]]
|-
| 1 || [[#GetBase]]
|-
| 10 || [[#GetImageSize]]
|-
| 11 || [[#LoadImage]]
|-
| 20 || [18.0.0+] GetLargeImageSize
|-
| 21 || [18.0.0+] LoadLargeImage
|-
| 30 || [18.0.0+] GetImageId
|-
| 100 || [[#Store]]
|-
| 101 || [[#StoreWithImage]]
|-
| 110 || [18.0.0+] StoreWithLargeImage
|}

=== Store ===
Takes a [[#ProfileBase]] and an input type-0x19 buffer for [[#UserData]].

=== StoreWithImage ===
Takes a [[#ProfileBase]], an input type-0x19 buffer for [[#UserData]], and an input type-0x5 buffer.

== IAsyncContext ==
This is "nn::account::detail::IAsyncContext".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetSystemEvent
|-
| 1 || Cancel
|-
| 2 || HasDone
|-
| 3 || GetResult
|}

== ISessionObject ==
This is "nn::account::detail::ISessionObject".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 999 || Dummy
|}

= acc:u0 =
This is "nn::account::IAccountServiceForApplication".

[13.0.0+] This was moved from [[Account_services|account]].

This is only available when the output from [[Process_Manager_services|pm:bm]] GetBootMode is Normal/Maintenance.

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || GetUserCount ||
|-
| 1 || GetUserExistence ||
|-
| 2 || ListAllUsers ||
|-
| 3 || ListOpenUsers ||
|-
| 4 || GetLastOpenedUser ||
|-
| 5 || GetProfile || Takes an input userID, returns an [[#IProfile]].
|-
| 6 || [3.0.0+] GetProfileDigest ||
|-
| 50 || [[#IsUserRegistrationRequestPermitted]] ||
|-
| 51 || TrySelectUserWithoutInteractionDeprecated ([1.0.0-18.1.0] [[#TrySelectUserWithoutInteraction]]) ||
|-
| 52 || [19.0.0+] TrySelectUserWithoutInteraction ||
|-
| 60 || [5.0.0-5.1.0] ListOpenContextStoredUsers ||
|-
| 99 || [6.0.0+] DebugActivateOpenContextRetention || No input, returns an [[#ISessionObject]].
|-
| 100 || [[#InitializeApplicationInfoV0]] ||
|-
| 101 || GetBaasAccountManagerForApplication || Takes an input userID, returns an [[#IManagerForApplication]].
|-
| 102 || AuthenticateApplicationAsync || Returns an [[#IAsyncContext]].
|-
| 103 || [4.0.0+] CheckNetworkServiceAvailabilityAsync || Returns an [[#IAsyncContext]].
|-
| 110 || StoreSaveDataThumbnail ||
|-
| 111 || ClearSaveDataThumbnail ||
|-
| 120 || CreateGuestLoginRequest || Returns an [[#IGuestLoginRequest]].
|-
| 130 || [5.0.0+] LoadOpenContext ||
|-
| 131 || [6.0.0+] ListOpenContextStoredUsers ||
|-
| 140 || [6.0.0+] [[#InitializeApplicationInfoV1]] ||
|-
| 141 || [6.0.0+] ListQualifiedUsers ||
|-
| 150 || [6.0.0+] IsUserAccountSwitchLocked ||
|-
| 160 || [13.0.0+] InitializeApplicationInfoV2 ||
|}

InitializeApplicationInfo* is used by the user-process during service init.

== InitializeApplicationInfoV0 ==
Takes a PID and an input u64 pid_placeholder, no output.

== InitializeApplicationInfoV1 ==
Takes a PID and an input u64 pid_placeholder, no output.

== IGuestLoginRequest ==
This is "nn::account::baas::IGuestLoginRequest".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetSessionId
|-
| 11 || [1.0.0-2.3.0]
|-
| 12 || GetAccountId
|-
| 13 || GetLinkedNintendoAccountId
|-
| 14 || GetNickname
|-
| 15 || GetProfileImage
|-
| 16 || [18.0.0+] GetProfileLargeImage
|-
| 21 || [3.0.0+] LoadIdTokenCache
|}

== IManagerForApplication ==
This is "nn::account::baas::IManagerForApplication".

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || CheckAvailability ||
|-
| 1 || GetAccountId ||
|-
| 2 || EnsureIdTokenCacheAsync || Returns an [[#IAsyncContext]].
|-
| 3 || LoadIdTokenCache ||
|-
| 130 || GetNintendoAccountUserResourceCacheForApplication ||
|-
| 150 || CreateAuthorizationRequest || Returns an [[#IAuthorizationRequest]].
|-
| 160 || [5.0.0+] StoreOpenContext ||
|-
| 170 || [13.0.0+] EnsureIdTokenCacheForOnlinePlayAsync ([6.0.0-12.1.0] LoadNetworkServiceLicenseKindAsync) || No input, returns an [[#IAsyncContextForLoginForOnlinePlay]] ([6.0.0-12.1.0] [[#IAsyncNetworkServiceLicenseKindContext]]).
|}

== IAsyncNetworkServiceLicenseKindContext ==
This is "nn::account::detail::IAsyncNetworkServiceLicenseKindContext".

This was added with [6.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || GetSystemEvent ||
|-
| 1 || Cancel ||
|-
| 2 || HasDone ||
|-
| 3 || GetResult ||
|-
| 100 || GetNetworkServiceLicenseKind ||
|}

== IAsyncContextForLoginForOnlinePlay ==
This is "nn::account::baas::IAsyncContextForLoginForOnlinePlay".

This was added with [13.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || GetSystemEvent ||
|-
| 1 || Cancel ||
|-
| 2 || HasDone ||
|-
| 3 || GetResult ||
|-
| 100 || GetNetworkServiceLicenseInfoForOnlinePlay ||
|}

= acc:u1 =
This is "nn::account::IAccountServiceForSystemService".

[13.0.0+] This was moved from [[Account_services|account]].

This is only available when the output from [[Process_Manager_services|pm:bm]] GetBootMode is Normal/Maintenance.

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || GetUserCount ||
|-
| 1 || GetUserExistence ||
|-
| 2 || ListAllUsers ||
|-
| 3 || ListOpenUsers ||
|-
| 4 || GetLastOpenedUser ||
|-
| 5 || GetProfile || Returns an [[#IProfile]].
|-
| 6 || [3.0.0+] GetProfileDigest ||
|-
| 50 || [[#IsUserRegistrationRequestPermitted]] ||
|-
| 51 || TrySelectUserWithoutInteractionDeprecated ([1.0.0-18.1.0] [[#TrySelectUserWithoutInteraction]]) ||
|-
| 52 || [19.0.0+] TrySelectUserWithoutInteraction ||
|-
| 60 || [5.0.0-5.1.0] ListOpenContextStoredUsers ||
|-
| 99 || [6.0.0+] DebugActivateOpenContextRetention || No input, returns an [[#ISessionObject]].
|-
| 100 || GetUserRegistrationNotifier || Returns an [[#INotifier]].
|-
| 101 || GetUserStateChangeNotifier || Returns an [[#INotifier]].
|-
| 102 || GetBaasAccountManagerForSystemService || Returns an [[#IManagerForSystemService]].
|-
| 103 || GetBaasUserAvailabilityChangeNotifier || Returns an [[#INotifier]].
|-
| 104 || GetProfileUpdateNotifier || Returns an [[#INotifier]].
|-
| 105 || [4.0.0+] CheckNetworkServiceAvailabilityAsync || Returns an [[#IAsyncContext]].
|-
| 106 || [9.0.0+] GetProfileSyncNotifier ||
|-
| 110 || StoreSaveDataThumbnail ||
|-
| 111 || ClearSaveDataThumbnail ||
|-
| 112 || LoadSaveDataThumbnail ||
|-
| 113 || [5.0.0+] GetSaveDataThumbnailExistence ||
|-
| 120 || [10.0.0+] ListOpenUsersInApplication ||
|-
| 130 || [6.0.0+] ActivateOpenContextRetention || Takes a total of 0x8-bytes of input, returns an [[#ISessionObject]].
|-
| 140 || [6.0.0+] ListQualifiedUsers ||
|-
| 150 || [10.0.0-10.2.0] AuthenticateApplicationAsync ||
|-
| 151 || [12.0.0+] EnsureSignedDeviceIdentifierCacheForNintendoAccountAsync ||
|-
| 152 || [12.0.0+] LoadSignedDeviceIdentifierCacheForNintendoAccount ||
|-
| 170 || [13.0.0+] GetNasOp2MembershipStateChangeNotifier ||
|-
| 190 || [1.0.0-9.2.0] GetUserLastOpenedApplication ||
|-
| 191 || [7.0.0-19.0.1] UpdateNotificationReceiverInfo ([5.0.0-5.1.0] ActivateOpenContextHolder) ||
|-
| 401 || [18.0.0+] GetPinCodeLength ||
|-
| 402 || [18.0.0-19.0.1] GetPinCode ||
|-
| 403 || [20.0.0+] GetPinCodeParity ||
|-
| 404 || [20.0.0+] VerifyPinCode ||
|-
| 405 || [20.0.0+] IsPinCodeVerificationForbidden ||
|-
| 997 || [3.0.0+] DebugInvalidateTokenCacheForUser ||
|-
| 998 || DebugSetUserStateClose ||
|-
| 999 || DebugSetUserStateOpen ||
|}

[10.0.0+] DebugSetUserStateClose/DebugSetUserStateOpen now takes an additional 8-bytes of input.

== IOAuthProcedureForUserRegistration ==
This is "nn::account::nas::IOAuthProcedureForUserRegistration".

This was added with [8.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || PrepareAsync || No input, returns an [[#IAsyncContext]].
|-
| 1 || GetRequest ||
|-
| 2 || ApplyResponse ||
|-
| 3 || ApplyResponseAsync || Takes a type-0x9 input buffer, returns an [[#IAsyncContext]].
|-
| 10 || Suspend ||
|-
| 100 || GetAccountId ||
|-
| 101 || GetLinkedNintendoAccountId ||
|-
| 102 || GetNickname ||
|-
| 103 || GetProfileImage ||
|-
| 104 || [18.0.0+] GetProfileLargeImage ||
|-
| 110 || RegisterUserAsync || No input, returns an [[#IAsyncContext]].
|-
| 111 || GetUid ||
|-
| 200 || [17.0.0+] ApplyResponseForUserCreationAsync ||
|-
| 205 || [17.0.0+] SuspendAfterApplyResponse ||
|-
| 210 || [17.0.0+] IsProfileAvailable ||
|-
| 220 || [17.0.0+] RegisterUserAsyncWithoutProfile ||
|-
| 221 || [17.0.0+] RegisterUserWithProfileAsync ||
|-
| 230 || [18.0.0+] RegisterUserWithLargeImageProfileAsync ||
|}

= ApplicationRecord =
This is "nn::ns::ApplicationRecord".

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| [[NCM_services#ApplicationId|Id]]
|-
| 0x8
| 0x1
| [[#ApplicationEvent|LastEvent]]
|-
| 0x9
| 0x1
| Attributes
|-
| 0xA
| 0x6
| Reserved
|-
| 0x10
| 0x8
| LastUpdated
|}

= ApplicationEvent =
This is "nn::ns::ApplicationEvent".

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || Launched
|-
| 1 || LocalInstalled
|-
| 2 || DownloadStarted
|-
| 3 || GameCardInserted
|-
| 4 || Touched
|-
| 5 ||
|-
| 6 ||
|-
| 7 ||
|-
| 8 ||
|-
| 9 ||
|-
| 10 ||
|-
| 11 ||
|-
| 12 ||
|-
| 13 ||
|-
| 14 ||
|-
| 15 ||
|-
| 16 ||
|}

= ApplicationControlSource =
This is "nn::ns::ApplicationControlSource".

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| CacheOnly
|-
| 1
| Storage
|-
| 2
| StorageOnly
|}

= ApplicationContentMetaStatus =
This is "nn::ns::ApplicationContentMetaStatus".

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| [[NCM_services#ContentMetaType|Type]]
|-
| 0x1
| 0x1
| [[NCM_services#StorageId|InstalledStorage]]
|-
| 0x2
| 0x1
| [[#ContentMetaRightsCheck|RightsCheck]]
|-
| 0x3
| 0x1
| Reserved
|-
| 0x4
| 0x4
| Version
|-
| 0x8
| 0x8
| [[NCM_services#ApplicationId|Id]]
|}

= ContentMetaRightsCheck =
This is "nn::ns::ContentMetaRightsCheck".

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| NotChecked
|-
| 1
| NotNeeded
|-
| 2
| CommonRights
|-
| 3
| PersonalizedRights
|-
| 4
| NoRights
|}

= VersionListData =
This is "nn::ns::VersionListData".

= ApplicationUpdateInfo =
This is "nn::ns::ApplicationUpdateInfo".

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || UpToDate
|-
| 1 || Updatable
|}

= ApplicationOccupiedSize =
This is "nn::ns::ApplicationOccupiedSize". This is a 0x80-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x20 * 4 || Array of [[#ApplicationOccupiedSizeEntity]]
|}

= ApplicationOccupiedSizeEntity =
This is "nn::ns::ApplicationOccupiedSizeEntity". This is a 0x20-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || [[NCM_services#StorageId|StorageId]]
|-
| 0x1 || 0x7 || Reserved
|-
| 0x8 || 0x8 || AppSize
|-
| 0x10 || 0x8 || PatchSize
|-
| 0x18 || 0x8 || AocSize
|}

= ProgressForDeleteUserSaveDataAll =
This is "nn::ns::detail::ProgressForDeleteUserSaveDataAll". This is a 0x28-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || StartedAt
|-
| 0x8 || 0x4 || Count
|-
| 0xC || 0x4 || Reserved
|-
| 0x10 || 0x8 || SizeInBytes
|-
| 0x18 || 0x1 || IsSystem
|-
| 0x19 || 0x7 || Reserved
|-
| 0x20 || 0x8 || ApplicationId
|}

= ApplicationViewDeprecated =
This is "nn::ns::ApplicationViewDeprecated". This is a 0x40-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || [[NCM_services#ApplicationId|ApplicationId]]
|-
| 0x8 || 0x4 || Version
|-
| 0xC || 0x4 || [[#ApplicationViewFlag|Flag]]
|-
| 0x10 || 0x18 || [[#ApplicationDownloadProgress|Progress]]
|-
| 0x28 || 0x18 || [[#ApplicationApplyDeltaProgress|ApplyProgress]]
|}

This is converted from [[#ApplicationView]] by [[#GetApplicationViewDeprecated]] on newer system-versions as follows:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x20 || Same as [[#ApplicationView]] +0x0.
|-
| 0x20 || 0x4 || Same as [[#ApplicationView]] +0x20.
|-
| 0x24 || 0x2 || Same as [[#ApplicationView]] +0x24.
|-
| 0x26 || 0x2 || Cleared to 0.
|-
| 0x28 || 0x10 || Same as [[#ApplicationView]] +0x30.
|-
| 0x38 || 0x4 || Same as [[#ApplicationView]] +0x40.
|-
| 0x3C || 0x1 || Same as [[#ApplicationView]] +0x44.
|-
| 0x3D || 0x2 || Cleared to 0.
|-
| 0x3F || 0x1 || Cleared to 0.
|}

= ApplicationViewFlag =
This is "nn::ns::ApplicationViewFlag". This is a 32-bit flag.

{| class="wikitable" border="1"
|-
! Bit
! Description
|-
| 0
|
|-
| 1
|
|-
| 2
|
|-
| 3
|
|-
| 4
|
|-
| 5
|
|-
| 6
|
|-
| 7
|
|-
| 8
|
|-
| 9
|
|-
| 10
|
|-
| 11
|
|-
| 12
|
|-
| 13
|
|-
| 14
|
|-
| 15
|
|-
| 16
|
|-
| 17
|
|}

= ApplicationDownloadProgress =
This is "nn::ns::ApplicationDownloadProgress". This is a 0x18-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || Downloaded
|-
| 0x8 || 0x8 || Total
|-
| 0x10 || 0x4 || LastResult
|-
| 0x14 || 0x1 || [[#ApplicationDownloadState|State]]
|-
| 0x15 || 0x3 || Reserved
|}

= ApplicationApplyDeltaProgress =
This is "nn::ns::ApplicationApplyDeltaProgress". This is a 0x18-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || Applied
|-
| 0x8 || 0x8 || Total
|-
| 0x10 || 0x4 || LastResult
|-
| 0x14 || 0x1 || [[#ApplicationApplyDeltaState|State]]
|-
| 0x15 || 0x3 || Reserved
|}

= ApplicationDownloadState =
This is "nn::ns::ApplicationDownloadState". This is an u8.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || Runnable
|-
| 1 || Suspended
|-
| 2 || NotEnoughSpace
|-
| 3 || Fatal
|-
| 4 || Finished
|}

= ApplicationApplyDeltaState =
This is "nn::ns::ApplicationApplyDeltaState". This is an u8.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || Applying
|-
| 1 || Suspended
|-
| 2 || NotEnoughSpace
|-
| 3 || Fatal
|-
| 4 || NoTask
|-
| 5 || WaitApply
|-
| 6 || Applied
|}

= ApplicationView =
This is "nn::ns::ApplicationView". This is a 0x50-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || [[NCM_services#ApplicationId|ApplicationId]]
|-
| 0x8 || 0x4 || ?
|-
| 0xC || 0x4 || Flags
|-
| 0x10 || 0x40 || ?
|}

= ApplicationViewWithPromotionInfo =
This is a 0x70-byte struct.

[20.0.0+] This is a 0x78-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x50 || [[#ApplicationView]]
|-
| 0x50 || 0x20 || [[#PromotionInfo]]
|}

= PromotionInfo =
This is a 0x20-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || PosixTime start_timestamp.
|-
| 0x8 || 0x8 || PosixTime end_timestamp.
|-
| 0x10 || 0x8 || Remaining time until the promotion ends, in nanoseconds ({end_timestamp - current_time} converted to nanoseconds).
|-
| 0x18 || 0x4 || Not set, left at zero.
|-
| 0x1C || 0x1 || Flags. Bit0: whether the PromotionInfo is valid (including bit1). Bit1 clear: u64 +0x10 is set.
|-
| 0x1D || 0x3 || Padding
|}

= ApplicationResourceType =
This is "nn::ns::ApplicationResourceType". This is an u8.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || ApplicationResource
|-
| 1 || MicroApplicationResource
|}

= ApplicationErrorCodeCategory =
This is "nn::ns::ApplicationErrorCodeCategory". This is an u64.

= NoDownloadRightsErrorResolution =
This is "nn::ns::NoDownloadRightsErrorResolution".

= BackgroundNetworkUpdateState =
This is "nn::ns::BackgroundNetworkUpdateState". This is an u8.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || None
|-
| 1 || InProgress
|-
| 2 || Ready
|}

Similar to [[#HasDownloaded]], [[#GetBackgroundNetworkUpdateState]] uses [[NIM_services|nim]] ListSystemUpdateTask and [[NIM_services|nim]] GetSystemUpdateTaskInfo. When ListSystemUpdateTask successfully returns a task and GetSystemUpdateTaskInfo is successful, the output value is set to: <code>1 + *((u8*)(taskinfo+0) == 0x3</code>. Otherwise, value=0.

[[#GetBackgroundNetworkUpdateState]] always returns Result 0, however this will assert if GetSystemUpdateTaskInfo fails with ret!=0x3C89.

= SystemUpdateProgress =
This is "nn::ns::SystemUpdateProgress". This is a 0x10-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || Loaded (this value can be larger than total_size when the async operation is finishing and when total_size is <=0, this current_size field may contain a progress value for when the total_size is not yet determined)
|-
| 0x8 || 0x8 || Total (this field is only valid when >0)
|}

Commands which have this as output will return 0 with the output cleared, when no task is available.

= EulaDataPath =
This is "nn::ns::detail::EulaDataPath". This is a 0x100-byte struct.

This contains a file path.

= SystemDeliveryInfo =
This is "nn::ns::SystemDeliveryInfo". This is a 0x100-byte struct.

Originally the SystemDeliveryInfo validation func verified that OldSystemUpdateId matched the installed SystemUpdate Id. [20.0.0+] The used (Old)SystemUpdateId as selected by SystemUpdateIdFlag must now match one of the Ids in [[System_Settings|system-setting]] <code>contents_delivery!acceptable_system_update_ids_string</code> (replaces the previously mentioned installed-SystemUpdate check).

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || SystemDeliveryProtocolVersion. Must be <= to and match [[System_Settings|system-setting]] <code>contents_delivery!system_delivery_protocol_version</code>.
|-
| 0x4 || 0x4 || ApplicationDeliveryProtocolVersion. Loaded from [[System_Settings|system-setting]] <code>contents_delivery!application_delivery_protocol_version</code>. Unused by [[#RequestSendSystemUpdate]]/[[#RequestReceiveSystemUpdate]], besides HMAC validation.
|-
| 0x8 || 0x1 || HasExFat. Unused by [[#RequestSendSystemUpdate]]/[[#RequestReceiveSystemUpdate]], besides HMAC validation.
|-
| 0x9 || 0x3 || Reserved.
|-
| 0xC || 0x4 || SystemUpdateVersion.
|-
| 0x10 || 0x8 || OldSystemUpdateId. [20.0.0+] Always the NX Id: this is loaded from [[System_Settings|system-setting]] <code>contents_delivery!old_system_update_id</code>.
|-
| 0x18 || 0x1 || FirmwareVariationId. Used by [[#RequestSendSystemUpdate]]. Loaded from [[System_Settings|system-setting]] <code>ns.systemupdate!firmware_variation</code> or <code>ns.systemupdate!t_firmware_variation</code>, depending on the [[Settings_services|PlatformRegion]].
|-
| 0x19 || 0x1 || UpdatableFirmwareGroupId. Unused by [[#RequestSendSystemUpdate]]/[[#RequestReceiveSystemUpdate]], besides HMAC validation. Loaded from [[System_Settings|system-setting]] <code>ns.systemupdate!updatable_firmware_group_id</code> or <code>ns.systemupdate!t_updatable_firmware_group_id</code>, depending on the [[Settings_services|PlatformRegion]].
|-
| 0x1A || 0x1 || PlatformRegion (0x00 = Unknown/Global, 0x01 = China).
|-
| 0x1B || 0x1 || [20.0.0+] SystemDeliveryInfoPlatform. Loaded from [[System_Settings|system-setting]] <code>ns.systemupdate!system_delivery_info_platform</code>. Elsewhere this is compared against the sys-setting, etc.
|-
| 0x1C || 0x1 || [20.0.0+] SystemUpdateIdFlag. When non-zero, SystemUpdateId is used instead of OldSystemUpdateId. Always set to 0x1 by [[#GetSystemDeliveryInfo]] with [20.0.0+].
|-
| 0x1D || 0x3 || Padding
|-
| 0x20 || 0x8 || [20.0.0+] SystemUpdateId. See above. With [20.0.0+] [[#GetSystemDeliveryInfo]] now writes the Id here instead of OldSystemUpdateId (for the installed SystemUpdate). On S2 this is set to the Ounce Id.
|-
| 0x28 || 0xB8 || Reserved
|-
| 0xE0 || 0x20 || HMAC-SHA256 over the previous 0xE0-bytes.
|}

= ApplicationDeliveryInfo =
This is "nn::ns::ApplicationDeliveryInfo". This is a 0x100-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || ApplicationDeliveryProtocolVersion. Loaded from [[System_Settings|system-setting]] <code>contents_delivery!application_delivery_protocol_version</code>. An error is thrown when [[System_Settings|system-setting]] <code>contents_delivery!application_delivery_protocol_version</code> < version, or when [[System_Settings|system-setting]] <code>contents_delivery!acceptable_application_delivery_protocol_version</code> > version.
|-
| 0x4 || 0x4 || Padding
|-
| 0x8 || 0x8 || ApplicationId.
|-
| 0x10 || 0x4 || ApplicationVersion.
|-
| 0x14 || 0x4 || RequiredApplicationVersion.
|-
| 0x18 || 0x4 || RequiredSystemVersion.
|-
| 0x1C || 0x4 || u32 bitmask <code>nn::ns::ApplicationDeliveryAttributeTag</code>. [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]] sets this to the input u32. Bit30 and bit28 are additionally set, depending on [[NCM_services|ContentMetaType]] == Patch, etc.
|-
| 0x20 || 0x1 || [20.0.0+] [[NCM_services|ContentMetaPlatform]]. Loaded from [[NCM_services|ncm]] IContentMetaDatabase GetPlatform.
|-
| 0x21 || 0x1 || [20.0.0+] ProperProgramExists. Set to whether the bit for ProperProgramExists is set from [[NCM_services|ncm]] IContentMetaDatabase GetAttributes.
|-
| 0x22 || 0x1 || [S2]
|-
| 0x23 || 0xBD || Reserved
|-
| 0xE0 || 0x20 || HMAC-SHA256 over the previous 0xE0-bytes. Uses a different key than [[#SystemDeliveryInfo]].
|}

= LatestSystemUpdate =
This is "nn::ns::LatestSystemUpdate". This is an u8.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || UpToDate
|-
| 1 || Downloaded
|-
| 2 || NeedsDownload
|}

= ReceiveApplicationProgress =
This is "nn::ns::ReceiveApplicationProgress". This is a 0x10-byte struct.

= SendApplicationProgress =
This is "nn::ns::SendApplicationProgress". This is a 0x10-byte struct.

= ApplicationRightsOnClient =
This is a 0x20-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || [[NCM_services#ApplicationId|ApplicationId]]
|-
| 0x8 || 0x10 || [[Account_services#Uid|Uid]]
|-
| 0x18 || 0x1 || Flags, [[qlaunch]] only uses bit0-bit4 and bit7.
|-
| 0x19 || 0x1 || Flags, [[qlaunch]] only uses bit0.
|-
| 0x1A || 0x6 || Unknown
|}

[[qlaunch]] only uses +0x18/+0x19 in this struct.

= DownloadTaskStatus =
This is "nn::ns::DownloadTaskStatus". This is a 0x20-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x10 || Uuid
|-
| 0x10 || 0x8 || [[NCM_services#ApplicationId|ApplicationId]]
|-
| 0x18 || 0x1 || [[#DownloadTaskStatusDetail|Detail]]
|-
| 0x19 || 0x1 || NeedsCleanup
|-
| 0x1A || 0x2 || Reserved
|-
| 0x1C || 0x4 || Result
|}

= DownloadTaskStatusDetail =
This is "nn::ns::DownloadTaskStatusDetail". This is an u8.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || Created
|-
| 1 || Added
|-
| 2 || AlreadyExists
|-
| 3 || Failed
|}

= ApplicationLaunchInfo =
This is a 0x40-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || [[NCM_services#ApplicationId|ApplicationId]]
|-
| 0x8 || 0x4 || Application version
|-
| 0xC || 0x4 || [[Process_Manager_services#LaunchFlags|LaunchFlags]], set to hard-coded value 0xB by [[#GetApplicationLaunchInfo]].
|-
| 0x10 || 0x1 || Application [[NCM_services#StorageId|StorageId]]
|-
| 0x11 || 0x1 || Update [[NCM_services#StorageId|StorageId]]
|-
| 0x12 || 0x2E ||
|}

= UserData =
This is a 0x80-byte struct.

{| class="wikitable" border="1"
|-
! Offset || Size || Description
|-
| 0x0 || 0x4? || ?
|-
| 0x4 || 0x4? || Icon ID. 0 = Mii, the rest are character icon IDs.
|-
| 0x8 || 0x1? || Profile icon background color ID
|-
| 0x9 || 0x7 || ?
|-
| 0x10 || 0x10 || Some ID related to the Mii? All zeros when a character icon is used.
|-
| 0x20 || 0x60 || Usually zeros?
|}

= ProfileBase =
This is a 0x38-byte struct.

{| class="wikitable" border="1"
|-
! Offset || Size || Description
|-
| 0x0 || 0x10 || userID
|-
| 0x10 || 0x8 || POSIX UTC timestamp, for last account edit.
|-
| 0x18 || 0x20 || UTF-8 Nickname. Official sw uses strncpy to copy this into another struct (<code>nn::account::Nickname</code>), with a NUL-byte written after the copied data.
|}

= Uid =
This is "nn::account::Uid". This is a 0x10-byte struct. This contains 2 u64s for the UserId.

= Notes =
[[Process_Manager_services|pm:bm]] GetBootMode is used to determine whether aoc:u is available (see above). This value is also passed to thread "nn.ns.DelayedInitialization", which calls various funcs depending on the BootMode in various cases.

The "nn.ns.DelayedInitialization" thread uses BootMode as follows (this also handles various other initialization):
* Initializes [[NPNS_services|npns:s]] only for BootMode Normal/Maintenance.
* Initializes the hosted acc:* services and service [[Account_services|acc:su]] only for BootMode Normal/Maintenance.
* Calls a func only for BootMode Normal.
* Initializes [[ETicket_services|es]] and [[Shared_Database_services|avm]] only for BootMode Normal/Maintenance.

The output of GetBootMode is also written into state. This same func later enters a code block when BootMode is Maintenance/SafeMode: various [[NCM_services|ncm]] cmds are used with input StorageId=BuiltInUser (VerifyContentMetaDatabase, VerifyContentStorage, ActivateContentMetaDatabase, ActivateContentStorage, InactivateContentMetaDatabase, InactivateContentStorage) and state fields are written. Then if the BootMode is Maintenance the savedata for [[Flash_Filesystem|ns_rightsid]] (0x800000000000004A) is deleted. Then 0 is returned. Otherwise for BootMode Normal it continues with various initialization, including gamecard handling which handles launching the gamecard title in certain conditions (this is the only time ns launches anything with pgl outside of service cmds).

In the above block, InactivateContentMetaDatabase/InactivateContentStorage are only used if using ActivateContentMetaDatabase/ActivateContentStorage failed (error is only checked after using both cmds). If any of the ncm cmds prior to this fail, it will skip using the rest of the ncm cmds.

[[Category:Services]]

Switch System Flaws

2026-08-07T02:51:39Z

Yellows8: /* Games */

This page is a list of publicly known Switch / Switch 2 (S2) flaws.

= Hardware =
Flaws in this category pertain to the underlying hardware that powers the Switch.

This includes components shared across Tegra based devices such as the [[TSEC]], the [[Security_Engine|Security Engine]], the [[GPU]] and so on.

{| class="wikitable" border="1"
! Summary
! Description
! Fixed with hardware model/revision
! Newest hardware model/revision this flaw was checked for
! Timeframe this was discovered
! Public disclosure timeframe
! Discovered by
|-
| GMMU DMA attack
| The Switch's GPU includes a separate MMU (GMMU) that is allowed to bypass the system's IOMMU (SMMU). By accessing the GPU's MMIO region and manipulating the page table entries in the GMMU, an attacker can read/write any portion of the DRAM (except memory carveouts).

[5.0.0+] Works around this hardware flaw by using memory pool partitioning. You can no longer escalate into sysmodules with GPU DMA because all their memory is allocated using heap that's carved out.

HAC-001-01 (Mariko/Tegra214/Tegra210b01): Fixes this by adding a new register which restricts what memory untranslated DMA requests may access. Untranslated GPU DMA may now only access the GPU carveout (physmem 0x80002000-0x80006000), which the GPU already has legitimate and exclusive access to.
| HAC-001-01 (Mariko/Tegra214/Tegra210b01)
| HAC-001 (Tegra210)
| Summer 2017
| December 28, 2017
| [[User:hexkyz|hexkyz]], [[User:SciresM|SciresM]] and [[User:qlutoo|qlutoo]]
|-
| Weak Security Engine context validation
| The Tegra X1 supports a "deep sleep" feature, where everything but DRAM and the PMC registers lose their content (and the SoC loses power). Upon awaking, the bootrom re-executes, restoring system state. Among these stored states is the Security Engine's saved state, which uses AES-128-CBC with a random key and all-zeroes IV. However, the bootrom doesn't perform a MAC on this data, and only validates the last block. This allows one to control most of security engine's state upon wakeup, if one has a way to modify the encrypted state buffer.

With a way to modify the encrypted state buffer, one can thus dump keys from "write-only" keyslots, etc.

This also bypasses the SBK protection of the bootROM: indeed, at warmboot, bootROM will always clear keyslot 0xE to prevent malicious code from saving the SBK. Moving the SBK to another keyslot in the saved context renders this protection moot.

HAC-001-01 (Mariko/Tegra214/Tegra210b01): Fixes this by streamlining the context save process; security engine contexts are now saved to protected memory which the CPU cannot access or modify.
| HAC-001-01 (Mariko/Tegra214/Tegra210b01)
| HAC-001 (Tegra210)
| December 2017
| January 20, 2018
| [[User:SciresM|SciresM]] and [[User:motezazer|motezazer]]
|-
| Security Engine keyslots vulnerable to partial overwrite attack
|
The Tegra X1 security engine supports writing keyslot data to the engine with syntax as follows:

SECURITY_ENGINE->AES_KEYTABLE_ADDR = (keyslot << 4) | (dword_index_in_keyslot);

SECURITY_ENGINE->AES_KEYTABLE_DATA = readle32(key, dword_index_in_keyslot * 4);

However, the Security Engine flushes writes to the internal key tables immediately when AES_KEYTABLE_DATA is written -- this allows one to overwrite a single dword of a key at a time, and thus brute force the contents of keyslots in time (2^32 * 8) = 2^35 instead of 2^256.
| None
| HAC-001 (Tegra210)
| Theorized Summer 2017 due to suggestive syntax, confirmed April 9, 2018
| April 9, 2018
| [[User:SciresM|SciresM]], almost surely others (independently).
|-
| CVE-2018-6242 (leveraged by the ShofEL2 and Fusée Gelée exploits)
| The USB software stack provided inside the boot instruction rom (IROM/bootROM) contains a copy operation whose length can be controlled by an attacker. By carefully constructing a USB control request, an attacker can leverage this vulnerability to copy the contents of an attacker-controlled buffer over the active execution stack, gaining control of the Boot and Power Management processor (BPMP) before any lock-outs or privilege reductions occur. This execution can then be used to exfiltrate secrets and to load arbitrary code onto the main CPU Complex (CCPLEX) "application processors" at the highest possible level of privilege (typically as the TrustZone Secure Monitor at PL3/EL3).
| HAC-001-01 (Mariko/Tegra214/Tegra210b01) (also fixed independently on Tegra186).
| HAC-001 (Tegra210)
| January 2018
| April 23, 2018
| [[User:Shuffle2|shuffle2]] and fail0verflow (originally), [[User:Ktemkin|ktemkin]] and ReSwitched Team (independently), [[User:Naehrwert|naehrwert]] (independently), [[User:Hexkyz|hexkyz]] (independently), st4rk with [[User:Shinyquagsire23|Shiny Quagsire]] and Dazzozo (independently), and many others (independently).
|-
| Poor validation of bootrom SDRAM configuration parameters leads to arbitrary writes in bootrom
|
The Tegra X1 bootrom supports saving SDRAM parameters to scratch registers, and using the saved configuration to enable DRAM during warmboot.

The code that parses these parameters does if (params->EmcBctSpareN) *params->EmcBctSpareN = params->EmcBctSpareNPlusOne for most N, without validating either the address or value written to it.
There are other arbitrary writes in this code, as well (e.g. BootromPatch parameters intended for patching MISC registers do not check a relative offset to 0x7000000, etc).

This allows a user with access to the PMC registers (via pre-sleep bpmp execution, or otherwise) to gain arbitrary bootrom code execution.

HAC-001-01 (Mariko/Tegra214/Tegra210b01): Fixes this by validating that the spare writes/bootrom patch before performing them.
| HAC-001-01 (Mariko/Tegra214/Tegra210b01)
| HAC-001 (Tegra210)
| 2017
| December 16, 2018
| Everyone (independently).
|-
| TSEC ROM does not clear crypto registers after signature verification
|
TSEC supports executing signed-microcode at a greater privilege level than normal payloads.

When jumping to signed microcode, the caller is expected to load hardware crypto register $c6 = <signature>, $c7 = <seed (zero for all officially-signed microcode)>.

TSEC ROM then calculates the expected signature and compares it to the user-supplied one in $c6. On match, the secure payload is executed, and on failure an exception is raised.

However, TSEC ROM fails to clear the crypto registers used to calculate the expected signature in either of the success/failure cases.

Thus, with some way of obtaining the contents of crypto registers (e.g. ROP under some secure payload), an attacker can dump intermediary values from signature calculation.

With enough data/trial/error, this is enough to reconstruct the signature algorithm:
* mac = <davies meyer hash of (page || address of page) for each 0x100 page in the payload>
* key = AES-ENCRYPT(hardware csecret 0x1, seed)
* signature = AES-ENCRYPT(key, mac)

| None
| HAC-001 (Tegra210)
| Late 2018/Early 2019
| August 2020
| [[User:qlutoo|qlutoo]]/[[User:Hexkyz|hexkyz]]/[[User:Shuffle2|shuffle2]], [[User:SciresM|SciresM]]/[[User:motezazer|motezazer]] (independently).
|-
| TSEC signature validation design flaw leads to fake-signing
|
As mentioned above, when jumping to signed microcode the caller is expected to load hardware crypto register $c6 = <signature>, $c7 = <seed (zero for all officially-signed microcode)>.

However, TSEC ROM performs no validation on the input seed used to generate the signing key.

This leads to the following attack:
* Attacker gains rop under any secure microcode payload with signature = S.
* Attacker uses the "csigenc" instruction to obtain K = AES-ENCRYPT(hardware csecret 0x1, S).
* Attacker jumps to their own microcode with $c6 = <signature calculated on pc using K>, $c7 = S
* TSEC ROM calculates key = AES-ENCRYPT(hardware csecret 0x1, S) = K, and the signature check passes.
* Attackers microcode is executed in secure mode as though it were signed by NVidia.

Thus an attacker who has exploited *any* secure payload may use this to obtain a "fake signature key", which can be used to sign and execute arbitrary microcode in secure mode.

Note: this does not break the TSEC cryptosystem, as the csigenc mechanism relies on the signature of the executing microcode, and fakesigning produces different signatures from NVidia that cannot be controlled.
| None
| HAC-001 (Tegra210)
| Late 2018/Early 2019
| August 2020
| [[User:qlutoo|qlutoo]]/[[User:Hexkyz|hexkyz]]/[[User:Shuffle2|shuffle2]], [[User:SciresM|SciresM]]/[[User:motezazer|motezazer]] (independently).
|-
| ROP under TSEC secure bootrom via DMA engine stack overwrite (--xploit)
| TSEC DMA engine does not stop when entering TSEC secure bootrom. By pointing TSEC DMA to current stack before secure bootrom entry, stack can be controlled.

One can then use blind ROP against the TSEC secure bootrom (which is execute only, and cannot be dumped).

With sufficient effort, an attacker can construct a ROP chain that leads to csigcmp being executed with fully controlled arguments.

This allows for arbitrary heavy secure mode code execution with the current signature set to an arbitrary value.

This completely breaks the TSEC cryptosystem, by allowing one to obtain the result of csigenc with signature = <any desired value>.

This has many uses/results, notably including dumping the "true" signature key (set signature = zeroes, perform csigenc using csecret 0x1).
| None
| TSEC for all Tegra devices
| Late 2018
| January 2021
| [[User:Hexkyz|hexkyz]]/[[User:SciresM|SciresM]], [[User:Vale|Vale]]/[[User:Thog|Thog]] (independently), [[User:Tatsuko|Tatsuko]] (independently), possibly others (independently).
|-
| Boot straps are not relatched on watchdog resets (strapwn)
| On boot, the BOOTSELECT, RCM and RAM_CODE straps are latched from external GPIO to determine which boot medium to use and verify from in bootrom. However, APB_MISC_PP_STRAPPING_OPT_A can be overwritten with arbitrary values following bootrom. Write access to PP_STRAPPING_OPT_A would otherwise be mundane, however these straps are not relatched during a watchdog reset (despite being latched during other software resets), allowing for arbitrary straps to be selected and executed in bootrom.

This allows setting NVPROD_UART on some hardware configurations where it would normally be unavailable (ie on Jetson Nano boards), but is otherwise mostly useless and/or useful for testing unintended boot options (such as USB Mass Storage boot) without having to move boot strap resistors.
| Unknown
| HAC-001 (Tegra210)
| May 2020
| April 30, 2021
| [[User:Shinyquagsire23|Shiny Quagsire]]
|}

= Firmware =
Flaws in this category pertain to the firmware running on hardware devices, such as wifi/bluetooth, etc. Firmware is generally uploaded by sysmodules.

{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in system version
! Last system version this flaw was checked for
! Timeframe this was discovered
! Public disclosure timeframe
! Discovered by
|-
| Broadpwn (CVE-2017-9417)
| See [https://blog.exodusintel.com/2017/07/26/broadpwn/ here] and [https://www.blackhat.com/docs/us-17/thursday/us-17-Artenstein-Broadpwn-Remotely-Compromising-Android-And-iOS-Via-A-Bug-In-Broadcoms-Wifi-Chipsets.pdf here].
| Code execution on the wifi controller (untested on Switch).
| [[4.0.0]]
| [[4.0.0]]
| Switch: July 2022
| Switch: July 30, 2022
| Switch: [[User:Yellows8|yellows8]]
|}

= Software =
== Bootloader ==
Flaws in this category pertain to any bootloader component such as the [[Package1#Package1ldr|package1ldr]], the [[Package1#Section_1|NX bootloader]] or the [[Package1#Section_0|warmboot binary]].

{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in system version
! Last system version this flaw was checked for
! Timeframe this was discovered
! Public disclosure timeframe
! Discovered by
|-
| Null-dereference in panic()
| The Switch's stage 1 bootloader, on panic(), clears the stack and then attempts to clear the Security Engine. However, it does so by dereferencing a pointer to the SE in .bss (initially NULL), and this pointer doesn't get initialized until partway into the bootloader's main() after several functions that might panic() are called. Thus, a panic() caused prior to SE initialization would result in the SE pointer still being NULL when dereferenced.
The BPMP doesn't have an active MPU and the bus won't data abort on an invalid address, so no exception will be entered: it'll end up overwriting some exception vectors with NULL before halting.

In 3.0.0, this was fixed by moving the security engine initialization earlier in main(), before the first function that could potentially panic().
| Some exception vectors overwritten with NULL, before SBK/other keyslots are cleared. Probably useless for anything more interesting.
| [[3.0.0]]
| [[3.0.0]]
| Early July, 2017
| July 30, 2017
| Everyone who diff'd 2.3.0 and 3.0.0 Package1
|-
| FUSE_DIS_PGM not written by package1
| The switch's hardware fuse driver contains a write-once bit in a register called "FUSE_DIS_PGM", which disables burning fuses until the next reboot. While Nintendo's bootloader code for waking up from sleep writes this on all firmware, the actual package1 initial bootloader forgets to write to it on cold reboot.

This isn't too big of a problem because another fuse is burnt on retail devices (production mode), which prevents burning *all* fuses other than ODM_RESERVED ones in hardware.

This was fixed in 3.0.0 by writing to the register on cold boot (although the write happens in TZ instead of package1 where it should take place, possibly to obfuscate the fact that they made this mistake).
| Burning arbitrary ODM reserved fuses with TZ code execution, which should never be possible for non-bootloader code.

Warning: one could irreparably brick one's console by playing with this.
| [[3.0.0]]
| [[3.0.0]]
| Late summer/early fall 2017
| December 31, 2017
| [[User:SciresM|SciresM]], [[User:motezazer|motezazer]]
|-
| maconstack (TSEC firmware leaves MAC on the stack)
| Package1ldr loads a firmware blob into TSEC early on boot. This piece of code runs on the TSEC in Authenticated Mode and has the sole purpose of generating the per-console TSEC key (see [[Cryptosystem]]).

As a way to mitigate attacks, the TSEC firmware blob is split into 3 stages: [[TSEC_Firmware#Boot|Boot]] which is unencrypted and unsigned, [[TSEC_Firmware#KeygenLdr|KeygenLdr]] which is unencrypted but signed and [[TSEC_Firmware#Keygen|Keygen]] which is encrypted and signed.
Boot loads a static pre-generated signature into the Falcon's CPU crypto registers, loads KeygenLdr into the Falcon's CODE region and jumps to it. Execution will proceed into KeygenLdr in Heavy Secure Mode if, and only if, the loaded signature matches the one Falcon calculates internally for KeygenLdr.

Among various things, KeygenLdr will attempt to do a "backwards" security check by calculating a CMAC over Boot and comparing it with a known hash stored in the TSEC firmware's key data (a small buffer stored after Boot's code). If the hashes don't match, execution aborts.

KeygenLdr stores the calculated Boot's CMAC in the stack, but forgets to clear it. Since the stack is located in Falcon's DATA region, loading the TSEC firmware blob and dumping the DATA region afterwards (via MMIO) will reveal the calculated hash.
This allows using KeygenLdr as an oracle to generate a valid CMAC for arbitrary Boot code. Replacing the CMAC in the TSEC firmware's key data region results in KeygenLdr accepting any Boot code, thus rendering this security measure useless.

Additionally, since signed Falcon code can't be revoked without an hardware revision, an attacker can always reuse the flawed KeygenLdr code even if a fix is issued.
| Running TSEC firmware's KeygenLdr in a user controlled environment.
| None
| [[5.0.2]]
| January 2018
| April 29, 2018
| [[User:Hexkyz|hexkyz]], [[User:Rei|Reisyukaku]] (independently), probably others (independently).
|-
| pk1ldrhax
| Package1ldr decrypts and verifies the keyblob inside of the current BCT in order to get the package1 key, and then uses the package1 key to decrypt package1. It then validates package1 before jumping to it by checking the PK11 magic number, and that the section sizes sum to the expected size (and are individually less than the expected size).

However, package1ldr does not actually validate the package1 key against a fixed vector (much like kernel9loader forgot to do so on the 3ds). This would normally not matter, as keyblobs are validated -- however, with bootrom code execution one can dump SBK and forge keyblobs, and thus control the package1 key.

Thus ('''in theory, but not in practice due to the size of the brute force required''') one can replace the package1 key with garbage, causing package1 to decrypt into garbage, and hope that this garbage passes validation checks and that package1ldr jumping into the garbage will do something useful.

This was fixed incidentally in [[6.2.0]], as pk1ldr does not use keyblob data to decrypt package1 any more.

| With a large enough brute force: arbitrary package1 code execution from coldboot.

However, a usable brute force is on the order of >= ~2^80, so '''this is almost certainly not actually usable in any meaningful context'''.
| [[6.2.0]]
| [[6.2.0]]
| Early 2017 (as soon as plaintext package1ldr was first dumped)
| November 20, 2018
| Everyone
|-
| Stack smash in TSEC firmware's KeygenLdr
| Given that we can control the [[TSEC_Firmware#Key_data|key data]] (which is not authenticated) and the [[TSEC_Firmware#Boot|Boot]] blob (see "maconstack"), as well as the fact Non-secure and Heavy Secure code share the same stack, we can use this to attack KeygenLdr. KeygenLdr uses memcpy to copy over a payload to DMEM to verify it, which can be abused to smash the stack (in DMEM) and write over the return address of said function.
| ROP under KeygenLdr in Heavy Secure mode.
| None
| [[8.0.1]]
| Early 2018
| May 21, 2019
| Everyone (independently).
|}

== TrustZone ==
Flaws in this category pertain exclusively to the [[Package1#Section_2|Secure Monitor]].

{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in system version
! Last system version this flaw was checked for
! Timeframe this was discovered
! Public disclosure timeframe
! Discovered by
|-
| Non-atomic mutexes
| When an [[SMC]] is called, TrustZone sets a global variable to mark that an SMC is in progress, so that two SMCs using shared resources (like the security engine) do not trample on one another. On 1.0.0, this global variable was written using non-atomic writes, and thus a race condition is possible.

However, the SMC handler enforces that all SMCs must be called from core #3, unless the top-level handler ID is 1 (SMCs internal to the kernel). Thus, the only SMCs that can be run side-by-side are [any userland smc] and smcGetRandomBytesForKernel, and this turns out to not really be abusable.
| Mostly useless. Maybe some oob-write into unused (and thus useless) memory if running smcGetRandomBytesForKernel and smcGetRandomBytesForUser at the same time.
| [[2.0.0]]
| [[2.0.0]]
| December 2017 (Probably earlier by others)
| January 18, 2018
| [[User:SciresM|SciresM]], probably others (independently).
|-
| jamais vu (non-secure world access to PMC MMIO and pre-deep sleep firmware)
| On [[1.0.0]], one could map in the PMC registers in userland. In addition, [[AM_services|am]] ran a little-kernel based firmware on the BPMP at runtime. With code execution under am, one could modify the BPMP's little-kernel firmware to hook deep sleep entry, and modify TrustZone/Security engine state.

This was fixed in [[2.0.0]] by making the PMC secure-world only, blacklisting the BPMP's exception vectors from being mapped, and thoroughly checking for malicious behavior on deep sleep entry.
| Arbitrary TrustZone code execution.
| [[2.0.0]]
| [[2.0.0]]
| December, 2017
| January 20, 2018
| [[User:SciresM|SciresM]] and [[User:motezazer|motezazer]]
|-
| Missed BPMP Exception Vector Writes
| Starting in [[2.0.0]], the BPMP is asleep at runtime, and is turned on by TrustZone during [[SMC|smcCpuSuspend]] in order to initiate the deep sleep process. When it does so, it is held in RESET, and TrustZone attempts to write to the BPMP exception vectors at 0x6000F200 to register EVP_RESET = lp0_entry_fw_crt0, and all other EVPs to a function that simply reboots. However, while they successfully write EVP_RESET, they miss all the other vectors, accidentally writing to the 0x6000F004-0x6000F020 region instead of the 0x6000F204-0x6000F220 region they want to write to. This results in all the exception vectors for the BPMP other than RESET being "undefined" (attacker controlled).

With some way of causing an exception vector to be taken at the right time, this would give pre-sleep code execution (and thus arbitrary TrustZone code execution, via the security engine flaw). However, none of the abort vectors are really triggerable, and interrupts are disabled for the BPMP when it is taken out of reset. Thus, this is useless in practice.

This was fixed in [[4.0.0]] by writing to the correct registers.
| Theoretically: Arbitrary TrustZone code execution. In practice: Useless.
| [[4.0.0]]
| [[4.0.0]]
| January, 2018
| February 23, 2018
| [[User:SciresM|SciresM]] and [[User:motezazer|motezazer]], [[User:Naehrwert|naehrwert]], [[User:Hexkyz|hexkyz]], probably others (independently).
|-
| TSEC has access to the secure kernel carveout
| TrustZone is responsible for managing security carveouts to prevent DMA controllers from accessing the carveout which contains the kernel, sysmodules, and other critical operating system data.

Until [[8.0.0]], the list of devices that could access the carveout included the TSEC. However, the TSEC can bypass the SMMU when in authenticated mode by writing to a certain register. Thus, pwning nvservices would allow one to take over the TSEC, and use it to write to normally protected mmio/memory.

In [[8.0.0]], this was fixed by removing TSEC access, and adding TSECB access (TSECB cannot bypass the SMMU).
| With access to the TSEC mmio (nvservices ROP) and code execution in TSEC Heavy Secure mode, kernel code execution, probably.
| [[8.0.0]]
| [[8.0.0]]
| 2017 (when TrustZone code plaintext was first obtained).
| April 15, 2019
| Everyone
|-
| deja vu (insufficient system state validation on suspend leads to pre-sleep BPMP code execution)
| Jamais Vu was fixed in [[2.0.0]] by making the PMC secure-world only, blacklisting the BPMP's exception vectors from being mapped, and thoroughly checking for malicious behavior on deep sleep entry, since gaining pre-sleep code execution on the BPMP compromises the system.

However, the state validation performed by Nintendo's Secure Monitor was insufficient to prevent pre-sleep execution from being obtained.

Prior to [[6.0.0]], one could use a DMA controller that had access to IRAM and was not held in reset (there were multiple) to race TrustZone's writes to the BPMP firmware in IRAM, and thus overwrite Nintendo's firmware with an attacker's to gain pre-sleep code execution.

[[6.0.0]] addressed this by performing TrustZone state MAC writes and locking PMC scratch *before* turning on the BPMP, fixing the original Jamais Vu exploit entirely. In addition, the BPMP firmware in TrustZone's .rodata is now memcmp'd to the actual data after it is written to IRAM. This mitigates race attacks that modify the firmware.

However, Nintendo both forgot to validate the BPMP exception vectors after writing them, and forgot to hold in reset a DMA controller that can write to the BPMP's exception vectors.

AHB-DMA is not blacklisted by kernel mapping whitelist (Nintendo probably forgot it, because the TX1 TRM does not really document that it's present, although the MMIO works as documented in older (Tegra 3 and before) TRMs).

Thus, with kernel code execution (or some other way of accessing AHB-DMA, e.g. nspwn on <= 4.1.0, TSEC hax, or other arbitrary mmio access flaws), one can DMA to the BPMP's exception vectors as they are written, causing TrustZone to start the BPMP executing an attacker's firmware at a different location than TrustZone intends/validates.

This was fixed in [[8.0.0]] by blocking AHB-DMA arbitration and verifying it is held in reset during suspend, and thus there are no more devices that can write to the relevant MMIO at the right time.

| Arbitrary TrustZone/BootROM code execution, by using either the original Jamais Vu flaw (prior to [[6.0.0]] or a warmboot bootrom exploit (any firmware where pre-sleep execution can be gained).
| [[8.0.0]]
| [[8.0.0]]
| December 2017
| April 15, 2019
| [[User:SciresM|SciresM]], [[User:motezazer|motezazer]] and ktemkin, [[User:Naehrwert|naehrwert]] (independently), almost certainly others (independently)
|-
| TrustZone allows using imported RSA exponents with arbitrary modulus
| TrustZone supports "importing" RSA private exponents for use by userland -- these are stored encrypted with TrustZone only keydata in NAND, and decrypted only to TZRAM. This prevents a console that has compromised userland from learning the private exponents of these keys and doing calculations with them offline. In practice, this is used for FS (gamecard communications), ES (drm), and SSL (console client cert communications).

However, the actual SMC API only imports the RSA exponent, and not the modulus, which is passed separately by userland in each call. There is no validation done on the modulus passed in -- this means that userland can pass in any message and modulus it chooses, and obtain the result of (message ^ private exponent) % modulus back from the secure monitor.

By choosing a prime number modulus P such that P has "smooth" order (totient(P) == P-1 is divisible only by "small" primes), one can efficiently use the [[wikipedia:Pohlig-Hellman algorithm|Pohlig-Hellman algorithm]] to calculate the discrete logarithm of such a result directly, and thus obtain the private exponent.

This is mostly useless in practice, given the general availability of other exploits to obtain these decrypted exponents.

This was fixed in 10.0.0 by importing the modulus in addition to the exponent for the ES device key and ES client cert key. For backwards compatibility reasons the SSL key and Lotus key still only import the exponent.

StorageExpMod also now validates that the exponentiation of "DDDDD..." about the provided modulus by the imported exponent and then the fixed public exponent returns "DDDDD...", and returns invalid argument if validation fails.
| With userland privileges sufficient to use an imported RSA key: obtaining that RSA key's private exponent.
| [[10.0.0]]
| [[10.0.0]]
| August 14, 2019
| August 14, 2019
| [[User:SciresM|SciresM]]
|}

== Kernel ==
Flaws in this category pertain exclusively to the [[Package2#Section_0|HorizonOS Kernel]].

{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in system version
! Last system version this flaw was checked for
! Timeframe this was discovered
! Public disclosure timeframe
! Discovered by
|-
| Syscall Infoleaks
| Many syscalls leaked kernel pointers on sad paths (for example svcSetHeapSize and svcQueryMemory), until they landed a bunch of fixes in 2.0.0.
| Nothing really.
| [[2.0.0]]
| [[2.0.0]]
|
| 2017
| Everyone
|-
| svcWaitSynchronization/svcReplyAndReceive bad cleanup on error
| If there is a page fault when fetching handles from the userspace array, it cleans up by dereferencing all objects despite having only loaded first N. Allows the attacker to make arbitrary decrefs on any kernel synchronization object, and thus can be used to get UAF. Haven't actually been tried on real HW though, but should work (tm).
| Kernel code execution
| [[2.0.0]]
| [[2.0.0]]
|
| April 24, 2017
| [[User:qlutoo|qlutoo]]
|-
| Bad irq_id check in CreateInterruptEvent
| CreateInterruptEvent syscall is designed to work only for irq_id >= 32. All irq_ids < 32 are "per-core" and reserved for kernel use (watchdog/scheduling/core communications).
On 1.0.0 you could supply irq_id < 32 and it would write outside the SharedIrqs table.
| You can register irq's in the Core3Irqs table, and thus register per-core irqs for core3, that are normally reserved for kernel. Useless.
| [[2.0.0]]
| [[2.0.0]]
| October 2017
| October 17, 2017
| [[User:qlutoo|qlutoo]]
|-
| Kernel .text mapped executable in usermode
| Prior to [[3.0.2]] the kernel .text was [[Memory_layout|mapped]] in usermode as executable. This can be used for usermode ROP for bypassing ASLR, but SVCs/IPC are not usable by running kernel .text in usermode.
| Executing kernel .text in usermode
| [[3.0.2]]
| [[3.0.2]]
|
| December 28, 2017 (34c3)
| [[User:qlutoo|qlutoo]]
|-
| Memory Controller not properly secured
| The Switch OS originally had the memory controller not set to be accessible only by the secure-world, which was problematic because insecure access can compromise the kernel.

This was fixed partially in [[2.0.0]] by blacklisting the memory controller from being mapped by user-processes, and was fixed entirely in [[4.0.0]] by making the memory controller TZ-only and making all kernel accesses go through [[SMC|smcReadWriteRegister]].
| With some way to access the memory controller MMIO, arbitrary kernel code execution.
| [[4.0.0]]
| [[4.0.0]]
| January 2018
| January 2018
| [[User:SciresM|SciresM]], [[User:Yellows8|yellows8]]
|-
| Potential [[SVC|svcWaitForAddress]] thread use-after-free
| Between [[4.0.0]], where svcWaitForAddress was introduced, and [[7.0.0]], there was a second intrusive rbtree node in KThread for the WaitForAddress tree (the key being (address, priority), sorted lexicographically). Unlike the WaitProcessWideKeyAtomic tree, the kernel forgot to reinsert the WaitForAddress node when the thread's priority changed (priority inheritance and/or SetPriority), breaking the rbtree invariants; and since the kernel walks through the entire tree to remove intrusive nodes, you could cause threads to stay in the tree even after their deletion.

[[7.0.0]] fixed the issue by using the same intrusive node for both trees. The thread/node knows which tree it is in, and the latter is correctly updated when thread priority changes.
| It unluckily didn't look exploitable
| [[7.0.0]]
| [[7.0.0]]
| July 2018
| February 2019
| [[User:TuxSH|TuxSH]]
|-
| Kernel RWX identity mapping never unmapped
| During init, the kernel binary is identity-mapped as RWX at 0x80060000; this is necessary to facilitate the transitionary period while the MMU is being enabled but mappings for e.g. KASLR are not yet determined, and also to enable smooth MMU enable transition during wake-from-sleep.

However, the identity mapping was never unmapped, and thus the whole kernel code bin remained permanently mapped as RWX for all kernel threads (any thread which does not have an owner process and thus uses the KSupervisorPageTable TTBR0).

Thus, any theoretical exploit which would give kernel memory corruption or ROP under a kernel thread would allow making use of this mapping to modify kernel text + bypass KASLR.

This was fixed in [[16.0.0]] by unmapping the identity-mapping during init, and re identity-mapping only the very first page of kernel .text as R-X (for use by wake-from-sleep), which fixes the shellcode problem and mostly fixes the ROP problem, since this page mostly lacks interesting gadgets.
| In theory, with another exploitable kernel memory corruption (or ROP under kernel thread) bug: bypassing KASLR + modifying kernel .text.

However, no such bugs are known.
| [[16.0.0]]
| [[16.0.0]]
| Summer 2018
| February 2023
| Everyone
|}

== BootImagePackage System Modules ==
Flaws in this category pertain to any of the [[Package2#Section_1|built-in system modules]].

{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in system version
! Last system version this flaw was checked for
! Timeframe this was discovered
! Public disclosure timeframe
! Discovered by
|-
| Service access control bypass (sm:h, smhax, probably other names)
| Prior to [[3.0.1]], the ''service manager'' (sm) built-in system module treats a user as though it has full permissions if the user creates a new "sm:" port session but bypasses [[Services_API#Initialize|initialization]]. This is due to the other sm commands skipping the service ACL check for Pids <= 7 (i.e. all kernel bundled modules) and that skipping the initialization command leaves the Pid field uninitialized.
In [[3.0.1]], sm returns error code 0x415 if [[Services_API#Initialize|Initialize]] has not been called yet.
| Acquiring, registering, and unregistering arbitrary services
| [[3.0.1]]
| [[3.0.1]]
| May 2017
| August 17, 2017
| Everyone
|-
| Overly permissive SPL service
| The concept behind the switch's [[SMC|Secure Monitor]] is that all cryptographic keydata is located in userspace, but stored as "access keys" encrypted with "keks" that never leave TrustZone. The [[SPL services|spl]] ("security processor liaison"?) service serves as an interface between the rest of the system and the secure monitor. Prior to [[4.0.0]], spl exposed only a single service "spl:", which provided all TrustZone wrapper functions to all sysmodules with access to it. Thus anyone with access to the spl: service (via smhax or by pwning a sysmodule with access) could do crypto with any access keys they knew.

This was fixed in [[4.0.0]] by splitting spl: into spl:, spl:mig, spl:ssl, spl:es, and spl:fs.
| Arbitrary spl: crypto with any access keys one knows. For example, one could use the SSL module's access keys to decrypt their console's SSL certificate private key without having to pwn the SSL sysmodule.
| [[4.0.0]]
| [[4.0.0]]
| Summer 2017 (after smhax was discovered).
| December 23, 2017
| Everyone
|-
| Single session services not really single session
| Several "critical" services (like fsp-ldr, fsp-pr, sm:m, etc) are meant to only ever hold a single session with a specific sysmodule. However, when a sysmodule dies, all its service session handles are released -- and thus killing the holder of a single session handle would allow one (via sm:hax etc) to get access to that service.

This was fixed in [[4.0.0]] by adding a semaphore to these critical single-session services, so that even if one gets access to them an error code will be returned when attempting to use any of their commands.
| With some way to access these services and kill their session holders (like expLDR): dumping sysmodule code, arbitrary service access, elevated filesystem permissions, etc.
| [[4.0.0]]
| [[4.0.0]]
| May/June 2017 (basically immediately after smhax was discovered)
| December 30, 2017
| Everyone
|-
| nspwn
| fsp-ldr command 0 "MountCode" takes in a Content Path (retrieved from NCM by Loader), and returns an IFileSystem for the resulting ExeFS. These content paths, are normally NCAs, but MountCode also supports a number of other formats, including ".nsp" -- which is just a PFS0.

When a path ending in ".nsp" is parsed by MountCode, the PFS0 is treated as a raw ExeFS. Because there is no NCA header, the ACID signatures are not validated -- and because there are no other signatures in a PFS0, this results in no signature checking happening at all.

The actual .nsp handling is eventually done by {content mounting function} called by MountCode and other FS commands.

Thus, by placing an ExeFS (NSOs + "main.npdm") and setting one's desired title ID to "@Sdcard:/some_title.nsp" or "@User:/some_title.nsp" etc one can launch arbitrary unsigned code, with arbitrary unsigned NPDMs.

This appears to have been fixed by only allowing .nsp when the input fstype==7 for the internal content-mounting function, returning 0x2EE202 otherwise.
| With access to "lr": Arbitrary code execution with full system privileges.
| [[5.0.0]]
| [[5.0.0]]
| Late 2017
| April 23, 2018
| Everyone
|-
| Single null-byte stack overflow in Loader ContentPath parsing
| Previously, loader content path parsing looked like this, where path_from_lr was up to 0x300 bytes and not necessarily null-terminated:

char nca_path[0x300] = {0};
strcat(nca_path, path_from_lr);
for (int i = 0; nca_path[i]; i++) {
if (nca_path[i] == '\\') { nca_path[i] = '/'); }
}

Thus, a content path of the maximum length (0x300 bytes) would result in strcat writing a NULL terminator past the end of the nca_path buffer.

This was fixed in [[6.0.0]], the new code looks like this:

char nca_path[0x300];
strncpy(nca_path, path_from_lr, sizeof(nca_path));
for (int i = 0; i < sizeof(nca_path) && nca_path[i]; i++) {
if (nca_path[i] == '\\') { nca_path[i] = '/'); }
}

| With access to "lr": single null-byte stack overflow in Loader. Maybe (but probably not) loader code execution.
| [[6.0.0]]
| [[6.0.0]]
| September 2, 2018
| September 19, 2018
| [[User:SciresM|SciresM]]
|-
| System modules vulnerable to selective downgrade attacks
| Horizon has no mechanism for specifying the specific title version to Loader on process creation.

Observing this, one can note that after a system update one could install a downgraded version of a specific system module (e.g. nvservices) while leaving the rest of the OS at the same version.

Unless there was some breaking API change, this allows one to make a console vulnerable once more to an exploit in a sysmodule by downgrading it and nothing else.

This was fixed in [[8.1.0]] by incrementing a version field in NPDM, and checking it against a hardcoded list for certain titles in Loader's process creation func.
| With access to content installation commands (or a vulnerable lower version to selectively install newer titles), reintroducing bugs in vulnerable system modules on newer firmware versions.
| [[8.1.0]]
| [[8.1.0]]
| When FIRM was first dumped in 2017.
| June 17, 2019
| Everyone
|-
| Broken RNG for [[Loader_services|Loader]] ASLR
| The RNG used for generating the ASLR slide is only seeded with 32bits, with the data from [[SVC|svcGetInfo]]. Hence, one could bruteforce the seed if one has infoleaks from any programs. This can be successfully bruteforced with at least 2 sample codebin addrs from different programs (with only 1 sample a lot of invalid seeds are found), however in some cases more than 1 seed might be found.

With [15.0.0+] Loader now uses csrng_GenerateRandomBytes for determining the ASLR slide.

See also [https://github.com/switchbrew/loader-aslr-solver loader-aslr-solver].
| Breaking ASLR for all non-KIP processes, allowing predicting the main-codebin base addr for all non-KIP processes until the next reboot.
| [[15.0.0]]
| [[15.0.0]]
| January 30, 2022 (presumably found much earlier?)
| October 11, 2022
| Everyone
|}

== System Modules ==
Flaws in this category pertain to any non-built-in system module.

{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in system version
! Last system version this flaw was checked for
! Timeframe this was discovered
! Public disclosure timeframe
! Discovered by
|-
| OOB Read in NS system module (pl:utoohax, pl:utonium, maybe other names)
| Prior to [[3.0.0]], pl:u (Shared Font services implemented in the NS sysmodule) service commands 1,2,3 took in a signed 32-bit index and returned that index of an array but did not check that index at all. This allowed for an arbitrary read within a 34-bit range (33-bit signed) from NS .bss. In [[3.0.0]], sending out of range indexes causes error code 0x60A to be returned.
| Dumping full NS .text, .rodata and .data, infoleak, etc
| [[3.0.0]]
| [[3.0.0]]
| April 2017
| June 19, 2017
| [[User:qlutoo|qlutoo]], ReSwitched Team (independently)
|-
| Unchecked domain ID in common IPC code
| Prior to [[2.0.0]], object IDs in [[IPC_Marshalling#Domain_message|domain messages]] are not bounds checked. This out-of-bounds read could be exploited to brute-force ASLR and get PC control in some services that support domain messages.
|
| [[2.0.0]]
| [[2.0.0]]
| July 2017
| July 20, 2017‎
| [[User:hthh|hthh]]
|-
| Out-of-bounds array read for [[BCAT_Content_Container]] secret-data index
| The [[BCAT_Content_Container]] secret-data index is not validated at all. This is handled before the RSA-signature(?) is ever used. Since the field is an u8, a total of 0x800-bytes relative to the array start can be accessed.
This is not useful since the string loaded from this array is only involved with key-generation.
|
| Unknown
| [[2.0.0]]
| August 4, 2017
| August 6, 2017
| [[User: shinyquagsire23|Shiny Quagsire]], [[User:Yellows8|yellows8]] (independently)
|-
| expLDR (sysmodule handle table exhaustion)
| Most sysmodules share common template code to handle IPC control messages. The command DuplicateSession (type 5 command 2)'s template code will abort() if it fails to duplicate a session's handle for the requester. Because many sysmodules have limited handle table size (smaller than the browser/other entrypoints), repeatedly requesting to duplicate one's session will cause the sysmodule to run out of handle table space and abort, causing the service to release all its handles cleanly.
| Sysmodule crashes. Most usefully, crashing ldr allows access to fsp-ldr and crashing pm allows access to fsp-pr. Useless after [[4.0.0]], which mitigated a number of single-session service access issues.
| Unfixed
| [[4.1.0]]
| June 24, 2017
| March 8, 2018
| [[User:daeken|daeken]]
|-
| Transfer Memory leak in nvservices system module
| The nvservices sysmodule does not clear most of its transfer memory prior to release.
| The calling process can read key bits of memory, including breaking ASLR (by revealing the image base) and exposing the address of other transfer memory to set up attacks. More details here: [https://daeken.svbtle.com/nintendo-switch-nvservices-info-leak transfermeme (nvservices info leak)] by [[User:daeken|daeken]]
| [[6.0.0]]
| [[6.0.0]]
| June 2017
| October 16, 2018
| [[User:qlutoo|qlutoo]] and [[User:hexkyz|hexkyz]],
[[User:daeken|daeken]] (independently)
|-
| OOB write in audio system module
| Prior to [[2.0.0]], the [[Audio_services#audout:u|AppendAudioOutBuffer]] and [[Audio_services#audin:u|AppendAudioInBuffer]] IPC commands would blindly increment the appended buffers' count while using said count value as an index to where the user data should be copied into. This resulted in an 0x28 bytes, user controlled, out-of-bounds memory write into the [[Audio_services|audio]] sysmodule's memory space.
Combined with the [[Audio_services#audout:u|GetReleasedAudioOutBuffer]] or [[Audio_services#audin:u|GetReleasedAudioInBuffer]] commands, this could also be used as an 8 byte infoleak.

In [[2.0.0]], the commands now return error code 0x1099 if the number of unreleased buffers exceeds 0x1F.
| Code execution under audio sysmodule
| [[2.0.0]]
| [[2.0.0]]
|
| November 2, 2018
| [[User:hexkyz|hexkyz]], probably others (independently).
|-
| Infoleak in nvservices system module
| The [[NV_services|nvservices]] ioctl [[NV_services#NVMAP_IOC_ALLOC|NVMAP_IOC_ALLOC]] takes an optional argument "addr" which allows the calling process to pass a pointer to user allocated memory for backing a nvmap object. If "addr" is left as 0, nvservices uses the transfer memory region (donated by the user during initialization) instead, when allocating memory for the nvmap object.
By design, freeing the nvmap object by calling the ioctl [[NV_services#NVMAP_IOC_FREE|NVMAP_IOC_FREE]] returns, in its "refcount" argument, the user address previously supplied if the reference count reaches 0.
However, prior to [[6.2.0]], the case where the transfer memory region is used to allocate the nvmap object was not taken into account, thus resulting in [[NV_services#NVMAP_IOC_FREE|NVMAP_IOC_FREE]] leaking back an address from within the transfer memory region mapped in nvservices' memory space.

In [[6.2.0]], [[NV_services#NVMAP_IOC_FREE|NVMAP_IOC_FREE]] no longer returns the address when the transfer memory region is used instead of user supplied memory.
| Combined with other vulnerabilities: Defeating ASLR in nvservices sysmodule.
| [[6.2.0]]
| [[6.2.0]]
| April 2017
| November 24, 2018
| Everyone
|-
| nvhax (memory corruption in nvservices system module)
| Prior to [[6.2.0]], the [[NV_services|nvservices]] ioctl [[NV_services#.2Fdev.2Fnvhost-ctrl-gpu|NVGPU_GPU_IOCTL_WAIT_FOR_PAUSE]] would take a single "pwarpstate" argument which would be interpreted by nvservices as a memory pointer for writing 2 "warpstate" structs (one for each Streaming Multiprocessor).
This resulted in nvservices attempting to blindly memcpy into this user supplied address and trigger a crash. However, if paired with an infoleak, this could be used to arbitrarily write 0x30 bytes anywhere in nvservices' memory space.
Additionally, the "warpstate" struct itself was never initialized, which means nvservices would leak the 0x30 bytes from the stack. By invoking other ioctls it was also possible to partially control the stack contents and achieve a usable arbitrary memory write primitive.

In [[6.2.0]], [[NV_services#.2Fdev.2Fnvhost-ctrl-gpu|NVGPU_GPU_IOCTL_WAIT_FOR_PAUSE]] now takes 2 inline "warpstate" structs instead of a "pwarpstate" pointer, thus effectively avoiding the bad memcpy.
| Code execution under nvservices sysmodule
| [[6.2.0]]
| [[6.2.0]]
| April 5, 2017
| November 24, 2018
| [[User:hexkyz|hexkyz]]
|-
| [[Applet_Manager_services#IStorage|AM IStorage]] infoleak
| Originally the buffer allocated by [[Applet_Manager_services#CreateStorage|CreateStorage]] using the specified input size was not cleared. With [8.0.0+] this was fixed by adding a memset() for the buffer after successful allocation.

Hence, IStorage->IStorageAccessor->Read will return uninitialized memory when the Write cmd was not previously used with the specified region.
| Infoleak from the main [[Applet_Manager_services#IStorage|AM]] heap, allowing defeating ASLR by reading addresses from previously allocated objects.
| [[8.0.0]]
| [[8.1.0]]
| December 2018
| August 9, 2019
| [[User:Yellows8|yellows8]]
|-
| [[HID_services#hid:sys|hid:sys]] ButtonConfig s32 array-index not validated
| The input s32 array-index for [[HID_services#hid:sys|hid:sys]] ButtonConfig cmds 1255-1270 was originally not validated. Using a negative or >=5 index results in accessing out-of-bounds data, with an array stored on stack.
[10.1.0-10.2.0] Each of these cmds will now Abort if the s32 is negative or >=5. [11.0.0+] Now an unsigned compare is used, with 0 or an error being immediately returned when the value is invalid.
| hid infoleak, out-of-bounds mem-write anywhere in hid address-space relative to the stack array (with constraints on the data).
| [[10.1.0]]
| [[11.0.1]]
| April 18, 2020
| July 14, 2020
| [[User:Yellows8|yellows8]]
|-
| [[Bluetooth_Driver_services|Bluetooth]] sdp_server.cc process_service_search() continuation request p_req validation
| With [5.0.0+], the following was added to the if-block prior to loading cont_offset from p_req: <code>(p_req + sizeof(cont_offset) > p_req_end)</code> (which verifies that cont_offset is within message bounds).
| Bluetooth-sysmodule out-of-bounds read from heap, probably not useful since the read value must match a state field, etc.
| [[5.0.0]]
| [[11.0.0]]
| Switch: December 2020
| Switch: December 25, 2020
| Switch: [[User:Yellows8|yellows8]]
|-
| [[Bluetooth_Driver_services|Bluetooth]] A-63146698
| [https://android.googlesource.com/platform/system/bt/+/226ea26684d4cd609a5b456d3d2cc762453c2d75 A-63146698] / CVE-2017-0785. See also [https://info.armis.com/rs/645-PDC-047/images/BlueBorne%20Technical%20White%20Paper_20171130.pdf here].
| Bluetooth-sysmodule stack infoleak, which allows defeating ASLR (note: not tested on hw).
| [[5.0.0]]
| [[11.0.0]]
| Switch: December 2020
| Switch: December 25, 2020
| Switch: [[User:Yellows8|yellows8]]
|-
| [[Bluetooth_Driver_services|bluetooth]] GetAdapterProperty/SetAdapterProperty unchecked memcpy size
| GetAdapterProperty copies data from stack to the output buffer using the buffer size, without checking the size (when not handling the Name type). SetAdapterProperty copies data to stack from the input buffer using the buffer size, without checking the size.
This requires access to the btdrv service, only hid and btm have access.

This was fixed with [[12.0.0]] by replacing the buffer data with a fixed-size-struct.
| Stack infoleak with GetAdapterProperty, stack buffer overflow (and hence ROP) with SetAdapterProperty.
| [[12.0.0]]
| [[12.0.0]]
| July 17, 2020
| April 7, 2021
| [[User:Yellows8|yellows8]]
|-
| [[Bluetooth_Driver_services|bluetooth]] stack buffer overflow with HID DATA packets
| The BSA (bt-stack) func bta_hh_co_data copies data from a HID DATA packet to stack without checking the size, then sends it over Uipc. [7.0.0+] The user Uipc callback also copies the input data to stack without checking the size, then sends it to the sharedmem CircularBuffer.
With [12.0.2+] this was fixed in bta_hh_co_data by clamping the size to a maximum of 0x2BB. The aforementioned buffer overflow in the Uipc callback can't be triggered since at that point the size was already clamped.

Before this bta_hh_co_data func is reached, there is no validation of the size (such as comparing against the L2CAP MTU) when Basic Mode is being used.

Actually triggering this requires using a data-size larger than the normal L2CAP MTU. This can be done by for example, using raw HCI to send the packet from the remote bluetooth device.

Note that when the remote device is configured as an audio device for [12.0.0+] where [[Settings_services#BluetoothDevicesSettings|BluetoothDevicesSettings]].TrustedServices was only ever set for audio since system-boot, it is not possible for the remote device to connect to the Switch for HID.
| ROP under [[Bluetooth_Driver_services|bluetooth]] via HID DATA packet sent by a paired HID bluetooth device. This can be triggered at any time while not in sleep-mode, when not in airplane-mode. The earliest is while the Nintendo Switch logo screen is displayed during system boot.
| [[12.0.2]]
| [[12.0.2]]
| July-August 2020
| May 11, 2021
| [[User:Yellows8|yellows8]]
|-
| [[Bluetooth_Driver_services|bluetooth]] WriteHidData/WriteHidData2/SetHidReport unchecked memcpy size
| WriteHidData/SetHidReport copies the input struct to stack, then passes it to the funcptr/vfunc call. WriteHidData2 passes the input buffer addr directly to the funcptr/vfunc call. The called func eventually copies the input data to the stack struct using the specified size without validating it.
This requires access to the btdrv service, only hid and btm have access.

This was fixed with [[12.1.0]] in WriteHidData/SetHidReport by doing a fixed-size copy into another tmp struct, with the size field being clamped to a maximum of 0x2BB afterwards. This struct is then used when calling the vfunc. The vfuncs called by WriteHidData/WriteHidData2/SetHidReport were also updated to clamp the size to the required maximum value.
| Stack buffer overflow
| [[12.1.0]]
| [[12.1.0]]
| July 16, 2020
| July 6, 2021
| [[User:Yellows8|yellows8]]
|-
| Infoleak with [[HID_services|hid:sys]] SetButtonConfigStorage{name}Deprecated
| These cmds pass a stack ptr for the StorageName when calling the internal func. Nothing is written to this StorageName. Hence, stack infoleak (data is copied as a NUL-terminated string), which can be later read by the GetButtonConfigStorage{name} cmds.

This was fixed by removing the Deprecated cmds in [[13.0.0]].
| Infoleak of hid stack from a StorageName readable via GetButtonConfigStorage{name}, up to the NUL-terminator.
| [[13.0.0]]
| [[13.0.0]]
| December 11, 2020
| September 27, 2021
| [[User:Yellows8|yellows8]]
|-
| [[Bluetooth_Driver_services|bluetooth]] EventInfo infoleak
| The various funcs which send messages to the thread which handles writing to EventInfo, didn't clear the stack msgbuf. Hence, the various get-EventInfo cmds could return leaked stack data. This likely affected most (?) get-EventInfo cmds, besides CircularBuffer-GetHidReportEventInfo.

This only matters for events where there's uninitialized regions of the EventInfo, such as events with variable-size data without a memset.

This was fixed by clearing the msgbuf in a number of funcs.
| Bluetooth-sysmodule stack infoleak, which allows defeating ASLR
| [[13.0.0]]
| [[13.1.0]]
|
| During initial [[13.0.0|diff]]. Added to this page on: December 12, 2021
| [[User:Yellows8|yellows8]]
|-
| [[SSL_services|ssl]] CVE-2021-43527
| CVE-2021-43527, see also [https://bugs.chromium.org/p/project-zero/issues/detail?id=2237 here] and [https://googleprojectzero.blogspot.com/2021/12/this-shouldnt-have-happened.html here].
Using BigSig where the server cert sig is RSA-PSS results in the remote server throwing {no shared cipher} error when Switch connects. If however one creates a rootCA using BigSig (RSA-PSS), which then signs a server cert where the server key is RSA (not PSS), the vuln can be triggered (if the rootCA is trusted, via using the import service-cmd). It's unknown whether there's other ways to trigger the vuln.

The crash occurs in VFY_Begin when using the previously overwritten data. A bitsize of <code>$((16384 + 32 + 64 + 64 + 64))</code> is only enough to overwrite cx->hashcx, to fully overwrite cx->hashobj an additional 0xC-bytes (additional 96 bits) is needed.
Note that partial overwrite isn't an option: this is the func that initializes those fields to begin with, it just does deinit first before initializing hashcx/hashobj (prior to that these fields would be all-zero when not overwritten by the buf-overflow).
| Heap buffer overflow in [[SSL_services|ssl]], overwriting data including a ptr to an object which is later used to load a funcptr.
| [[13.2.1]]
| [[13.2.1]]
| Switch: December 1-2, 2021
| Switch: January 19, 2022
|
|-
| [[Bluetooth_Driver_services|bluetooth]] BSA gatt_process_notification stack buffer overflow
| gatt_process_notification is the GATT handler for processing notification/indication messages. gatt_process_notification does memcpy to stack from the input bt msg data, without size validation. The input len param isn't validated in this func either - if the remaining len following op_code is less than 2, a negative value will be used for the data copy to stack.
These were fixed by adding a bounds check for the size, size==0 is also checked for now.
| Bluetooth-sysmodule stack buffer overflow, with data received from a bluetooth message
| [[13.2.1]]
| [[13.2.1]]
| November 2021
| January 19, 2022
| [[User:Yellows8|yellows8]]
|-
| [[Applet_Manager_services#IDisplayController|AM IDisplayController]] TakeScreenShotOfOwnLayer OOB
| The captureBuf is used as an array index without validation. Data used from this array includes calling a funcptr from the array entry, if set. Eventually this is also used to write bools into this array, one of which is from the command input.
With [5.0.0+] a func is eventually called to get a ptr determined by the input captureBuf, with nullptr being returned for captureBuf>=0x10. The caller will Abort if nullptr was returned.
| OOB array access
| [[5.0.0]]
| [[13.1.0]]
| ~July 31, 2019
| January 26, 2022
| [[User:Yellows8|yellows8]]
|-
| [[Applet_Manager_services#IDisplayController|AM IDisplayController]] ClearCaptureBuffer OOB
| The captureBuf is used as an array index without proper validation. There is code validating it, but on failure it just skips over a code-block, with code using captureBuf still being used afterwards. Then this is used to write bools into a global array, one of which is from the command input.
This was fixed with [9.1.0+] by requiring captureBuf = 0-1.
| OOB bool writes into an array
| [[9.1.0]]
| [[13.1.0]]
| ~July 31, 2019
| January 26, 2022
| [[User:Yellows8|yellows8]]
|-
| [[Sockets_services|bsdsockets]] ioctl SIOCGIFCONF infoleak
| Originally bsd ioctl SIOCGIFCONF was handled by setting the data in IPC outbuf0 to the size/addr of IPC outbuf1. These buffers are HipcAutoSelect, so if buf1 is small enough for HipcPointer (otherwise it would be HipcMapAlias) the IPC-buf-ptr leaked into outbuf0 would be located in the codebin-region. Since this is done before the actual ioctl-handling, it doesn't matter whether the fd is valid.
This was fixed in [5.0.0+] by using a tmp struct on stack instead of buf0.
| bsdsockets-sysmodule codebin-region addr infoleak, which allows defeating ASLR.
| [[5.0.0]]
| [[13.1.0]]
| February 14, 2022 (probably earlier)
| February 14, 2022
| [[User:Yellows8|yellows8]], probably others
|-
| [[Sockets_services|bsdsockets]] ioctl SIOCGIFMEDIA input can contain ptr
| Originally bsd ioctl SIOCGIFMEDIA used the user-specified ifmediareq structure directly from the input buffer. This includes a ptr. This ptr probably isn't actually used?
With [5.0.0+] the structure used as input for the ioctl was changed to using <code>int ifm_ulist[1]</code> instead of <code>int *ifm_ulist</code> (which is unused). The input structure is copied to a tmp struct which is used as the original ifmediareq structure, with ifm_ulist always NULL. The user can still specify a non-zero ifm_count value, however that's not useful with ifm_ulist being always NULL.
| Useless?
| [[5.0.0]]
| [[13.1.0]]
| February 14, 2022
| February 14, 2022
| [[User:Yellows8|yellows8]], probably others
|-
| Infoleak with [[Joy-Con]] HidCommand PairingIn
| The joycon protocol handler for PairingIn copies data from stack to the response cmd-buf for sending PairingOut. Only the first byte is set to a type value, the rest is uninitialized stack data.

This was fixed with [15.0.0+] by directly writing to the response data without using stack data.
| Infoleak of hid stack via a bluetooth/uart message+response with a connected hid controller. This returns addrs for the main-codebin/stack, which allows defeating ASLR.
| [[15.0.0]]
| [[15.0.0]]
| September 4, 2020
| October 10, 2022
| [[User:Yellows8|yellows8]]
|-
| Broken RNG for [[RO_services|ro]] ASLR
| The RNG used to determine where to randomly map NROs in the target process was TinyMT (nn::os::detail::RngManager output, seeded by 128 bits of entropy). However, TinyMT is not cryptographically secure (and can in fact be analytically solved).

Thus, with a few NRO mapping addresses, one could learn the TinyMT state and derive all previous/future RNG outputs, breaking NRO aslr for all processes.

With [15.0.0+] ro now uses csrng_GenerateRandomBytes to determine the random map address for NROs.
| Breaking ASLR for all NROs loaded in all processes, allowing predicting all NRO mappings for all processes until the next reboot.
| [[15.0.0]]
| [[15.0.0]]
| Late 2021/Early 2022
| October 11, 2022
| Everyone
|-
| Broken RNG used by [[NS_Services|ns]]
| The code generating the sd seed and the data for the [[SD_Filesystem|sd]] private/private1 file, all use nn::os::GenerateRandomBytes, not csrng. The sd-seed is generated first, then private, then private1. This allows deriving sd-seed from private since this uses TinyMT, as long as the system shipped from factory on [2.0.0+]. private1 is only useful if the system shipped with [4.0.0+].

There's various other code in ns using nn::os::GenerateRandomBytes as well. This includes the code generating ns_systemseed when it doesn't exist. ns_systemseed is generated at some point after the various sd-seed-related code (both are called from the same func). Hence, ns_systemseed can be recovered with the above method as well, if it wasn't recreated at some point without regenerating the above nand-save used with the above.

With [15.0.0+] ns now uses csrng_GenerateRandomBytes for sd-seed/private and ns_systemseed, etc. This only matters when the file is newly generated, which is usually only for factory-fresh systems which ship with this version. This would also apply after being deleted during {System Settings -> Formatting Options -> Initialize Console}, and also with a refurbished console.
| Generation of a system's sd-seed allowing decryption of the NAX0 layer of data on [[SD_Filesystem|SD]], derived using the private file from SD. Applies to systems which factory-shipped with a system-version prior to [[15.0.0]] (that is, [2.0.0-14.1.2]).
| [[15.0.0]], for newly generated files
| [[15.0.0]]
| December ~12, 2021
| October 11, 2022
| [[User:Yellows8|yellows8]]
|-
| [[Bluetooth_Driver_services|bluetooth]] BSA bsa_sv_av_cback stack buffer overflow
| bsa_sv_av_cback checks for two input type values (0xC/0xD), on match it copies the input data to stack without size validation. Then it sends an internal request with this data (likewise when the type values don't match, except the input data is passed directly with a small size), then it returns.
This requires the AV functionality added with [13.0.0+], however this func is only reachable with [14.0.0+] where the required functionality was enabled.

This requires message data that's larger than the MTU, so fragmentation must be used, or manually send the ACL data to bypass the MTU.

This can be triggered via an AVRC message with opcode=0x0 (vendor). The above type 0xC is reached via AVRC ctype 0..4, while 0xD is reached with ctype>=0x9.

With [15.0.0+] the size value for the memcpy (which is also written to the request struct) is clamped to a max value.
| Bluetooth-sysmodule stack buffer overflow on [14.0.0-14.1.2], with data received from an AVRC bluetooth message with a bluetooth-audio device.
| [[15.0.0]]
| [[15.0.0]]
| November 2021
| October 11, 2022
| [[User:Yellows8|yellows8]]
|-
| [[WLAN_services|wlan]] SetMulticastList heap buffer overflow
| The [[WLAN_services#SetMulticastList|SetMulticastList]] command allocates a 0x31-bytes sized buffer and copies to it as much [[WLAN_services#MacAddress|MacAddress]] values from the input [[WLAN_services#MulticastList|MulticastList]] as specified by the "Count" field, but this field is never validated.

With [15.0.0+] error code 0x1906B is now returned if "Count" is larger than 8.
| wlan-sysmodule heap buffer overflow.
| [[15.0.0]]
| [[15.0.0]]
| June 6, 2022
| November 9, 2022
| [[User:Hexkyz|hexkyz]]
|-
| [[Bluetooth_Driver_services|bluetooth]] WriteGattCharacteristic/WriteGattDescriptor stack buffer overflow regression
| Originally btdrv WriteGattCharacteristic/WriteGattDescriptor (bt service LeClientWriteCharacteristic/LeClientWriteDescriptor are the same) validated the input buffer size. However the size check was removed with [12.0.0+] (which was also when bluetooth was refactored), hence stack buffer overflow. Anything with btdrv/bt services access can trigger it. While this is intended to require a BLE connection, it seems to be possible to trigger the buffer overflow without any BLE connection by passing ConnectionHandle=0xFFFFFFFF (handle not tested on hardware).
| Bluetooth-sysmodule stack buffer overflow on [12.0.0-15.0.1], with data from BLE IPC cmds.
| [[16.0.0]]
| [[16.0.0]]
| December 10, 2021
| February 23, 2023
| [[User:Yellows8|yellows8]]
|-
| [[JIT_services|JIT]] usability issues
| CreateJitEnvironment will enter infinite-loops using nn::jitsrv::detail::AslrAllocator::GetAslrRegion when either of the input CodeMemory sizes are zero. Also the second CodeMemory is useless for the user-process since the second addr returned by GetCodeAddress is a dup of the first one, set during state init by CreateJitEnvironment.
With [14.0.0+] size=0 is now properly handled, and also the state for the second addr from GetCodeAddress is now properly initialized.
| Minor usability issues, not useful for exploitation (size=0 will cause jit-sysmodule to hang in a loop).
| [[14.0.0]]
| [[14.0.0]]
| October 1, 2020
| February 26, 2023
| [[User:Yellows8|yellows8]]
|-
| [[USB_services|usbhs]] uninitialized IClientEpSession
| usbhs IClientIfSession OpenUsbEp creates an IClientEpSession object. The allocated object from ExpHeap is not memset, only select fields are cleared. The rest of initialization is done by PopulateRing - however the user-process could skip using that if wanted (official sw always uses it).

ShareReportRing maps tmem and writes the ring buffer/count field into object state. PopulateRing also eventually initializes these fields, with the buffer being allocated from ExpHeap instead of tmem. These fields are not cleared during object creation from OpenUsbEp.

GetXferReport after validating the cmd input, just uses object state assuming it was initialized. This runs code which is the same as the user-process code handling the tmem ringbuf.

Therefore, by skipping using PopulateRing and then using GetXferReport the sysmodule will use an uninitialized ringbuf ptr, and an uninitialized count field. If one could control these fields by doing ExpHeap allocations prior to OpenUsbEp so that {target fields} would be located at {IClientEpSession ring fields}, then one could read usb-sysmodule memory at the target buffer address.

See [[USB_services#ShareReportRing|here]] for ringbuf format. The sysmodule will Abort if read_index is >= {ring count field from object state}. Otherwise it copies an entry from that index to output, and updates read_index.

This is probably tricky to abuse as the ringbuf ptr has to be valid, and {see above} (likewise for write_index when the report-ringbuf-writing func runs).

PostBufferAsync/BatchBufferAsync also use seperate object ring fields which are left uninitialized from OpenUsbEp. Targeting this would be tricky with the ring restrictions - this would allow writing data to a ring addr however.

Pre-4.0.0 (only 2.0.0 checked) is not affected by these. The ring fields in the object are cleared during object creation (no memset of the entire object however). GetXferReport would null-deref if PopulateRing was skipped. PostBufferAsync/BatchBufferAsync will throw an error if PopulateRing was skipped. Pre-4.0.0 also has different ring handling as well.

[16.0.0+] The IClientEpSession init func now clears the remaining previously uninitialized fields. The cmds using the ring fields still don't check for NULL, so using GetXferReport/PostBufferAsync/BatchBufferAsync without PopulateRing will just trigger null-deref. Even if the ptr were somehow valid but ring-count field was left at 0, this would then Abort due to: <code>if (ring_count <= index_loaded_from_ringptr) <Abort></code>
| [4.0.0-15.0.1] If one can trigger using {target values} as the unintialized fields: memory reads from the target addr with GetXferReport, and memory R/W with PostBufferAsync/BatchBufferAsync. This requires access to usb:hs, and an usb device must be connected which is not being used by {other sessions}. If successful, this might (?) result in usb-sysmodule compromise.
| [[16.0.0]]
| [[16.0.0]]
| January 30, 2023
| February 26, 2023
| [[User:Yellows8|yellows8]]
|-
| [[NS_services|ns]] RequestMoveApplicationEntity/EstimateSizeToMove buffer overflow
| ns RequestMoveApplicationEntity eventually calls a func which: Loops through the input buffer. If any entry has value 6, it will call another func to copy data from state to output safely (uses the max_count param). Otherwise, it copies the input buffer to an outbuf (located on caller's stack) without any size validation (inlined memcpy), even though there is a max_count param.

Additional memwrites are also done to the above outbuf following the initial memcopy. This can be avoided if the buffer doesn't contain bytes with values 3-6 (if using values in that range is really needed, the cmd input StorageId param can be set to the required value so that the specified value doesn't trigger the memwrite). Value 6 shouldn't be used anyway (see above).

ns EstimateSizeToMove first calls the same func which does the copy above (outbuf is also located on stack), then it calls another func. Hence, same vuln here.

By corrupting just the first byte of x29 with EstimateSizeToMove, one can obtain infoleaks. This method with x29 essentially only works with [15.0.0+]. Pre-15.0.0 would require a different method with partial overwrite of retaddr, however it's unknown whether this would actually work for infoleak (would require [12.0.0+] for the stack layout change).
With EstimateSizeToMove where x29 is overwritten, the output u64 is the leaked ptr (can be codebin-region). Note that the cmd has to return Result=0 for this to work. x29 is used to load the value which is copied to the cmdreply rawdata.

As of [17.0.0+] an error is thrown if the input array count is larger than 8 (size of the stack dst-array).
| ns-sysmodule stack buffer overflow, allowing ns infoleak+ROP.
| [[17.0.0]]
| [[17.0.0]]
| January 2, 2023
| October 17, 2023
| [[User:Yellows8|yellows8]]
|-
| [[PSC_services|ovln:snd]] OpenSender unvalidated count
| ovln:snd OpenSender has a count param. This count is used to allocate the specified number of objects in a linked-list for storing the data from Send. If count is 0, the linked-list is left empty, with ptrs to itself within the ISender object.

ISender Send when the above linked-list is empty, runs a switch-statement with <code>(inval>>8)&0xFF</code>. This uses another linked-list where the ptrs are initially {within ISender obj}.
No space is allocated in the ISender obj for the linked-list object-data. Therefore using Send with val 1<<8 or 2<<8 (other values throw error) results in the specified input struct being copied into the ISender obj, which then overwrites heap data OOB.
If for example one used OpenSender again right after the first OpenSender usage, then used Send as described above, this would corrupt the second ISender which includes overwriting the vtable.
If one would use Send twice in a row like this, the second one would use a corrupted linked-list (written from the first Send). If the linked-list ptrs would be valid (no crash triggered) this would allow one to copy the input data to a controlled addr, though it's restricted with the linked-list usage.

Using GetUnreceivedMessageCount afterwards is of no interest.

Besides ovln, the only other allocs on this heap is from IPmModule Initialize. This heap is also used for psc:* services (object allocs).

In theory (untested) it may be possible to also use this to obtain infoleaks, however it would only return the high-u32 of ptrs not the low u32. Essentially, one would trigger object allocations so that ExpHeap has layout: {ISender} -> {RF chunk from freeing an object} -> {module object from IPmModule Initialize}. Then one would use the Send vuln to corrupt the RF chunk, changing the size to a larger value. Then one would trigger an object allocation (probably same object which was previously freed), then another object for overwriting the module object (ISender would work) with ptrs at the target offsets in the module object. Then once IPmModule GetRequest is used, the returned u32s would be the high-u32 from ptrs. Due to alignment requirements with each allocation, it isn't possible to shift the allocations in order to leak ptr low-u32.

[17.0.0+] Now throws an error if the input count for OpenSender is 0.
| [[PSC_services|psc]]-sysmodule heap memory corruption ([[NS_services|ns]]-sysmodule on pre-8.0.0).
| [[17.0.0]]
| [[17.0.0]]
| January 13, 2023
| October 20, 2023
| [[User:Yellows8|yellows8]]
|-
| [[NV_services|nv]] NVGPU_GPU_IOCTL_GET_CHARACTERISTICS Ioctl3 infoleak
| The handler code for NVGPU_GPU_IOCTL_GET_CHARACTERISTICS for Ioctl/Ioctl3 are essentially the same, except for the value used for the max-size clamp: Ioctl uses constant 0xA0, while Ioctl3 uses the outbuf1_size. So if one uses this with Ioctl3 and a large outbuf1, this will memcpy data OOB from the source buffer, hence infoleak.
With [17.0.0+] the second block of csel code which previouly essentially used the clamped size from above, was replaced with code which properly clamps to the max-size constant.
| nvservices-sysmodule infoleak, which allows defeating ASLR.
| [[17.0.0]]
| [[17.0.0]]
| February 25, 2022
| October 24, 2023
| [[User:Yellows8|yellows8]]
|-
| [[Audio_services|audctl]] GetTargetDeviceInfo infoleak
| audctl GetTargetDeviceInfo calls an impl func with a ptr to a stackbuf, then if successful memcpys the 0x100-bytes from that buffer to output. This stackbuf is not memset. This func (after doing various state checks) copies a string to output, other than always writing a NUL-terminator there's no clearing of the buffer.

This will leak audio-sysmodule stack into the output buffer as long as the state/input checks pass (for the remainder of the buffer following the string NUL-terminator).

With [18.0.0+] data is written directly to the outbuf instead of the stack tmpbuf.
| audio-sysmodule infoleak, which allows defeating ASLR.
| [[18.0.0]]
| [[18.0.0]]
| December 24, 2022
| March 26, 2024
| [[User:Yellows8|yellows8]]
|-
| [[Audio_services|audctl]] GetSystemInformationForDebug infoleak / buffer overflow
| audctl GetSystemInformationForDebug calls a func with a 0x1000-byte stack tmpbuf, then afterwards that buffer is memcpy'd into the cmd outbuf. This called func doesn't clear the buffer. This func eventually uses [[BTM_services|btm]] cmd75 with outarray={global ptr} and count=10. Then if the outcount is s32 >=1, it loops through the output using the outcount, without validating it besides the <1 check. Data from that outarray is copied into the array in the func output buffer (tmpbuf above).

With btm comprimised, one could return a large output count and trigger a stack buffer overflow with data following that global array, however exploiting this would be difficult since that data would be uncontrolled (can't directly control it from this cmd at least).

A stack infoleak can be obtained with this as well (assuming the above output array isn't full).

Even though the name has "ForDebug", there's no checks which would trigger an error / return early (this also always returns 0).

[18.0.0+] now clears the output buffer, and also now prints strings into the buffer instead of writing binary data (overflow no longer possible).
| audio-sysmodule infoleak, which allows defeating ASLR. Also audio-sysmodule memory corruption, likely not useful unless there's a way to control the data.
| [[18.0.0]]
| [[18.0.0]]
| December 7, 2022
| March 27, 2024
| [[User:Yellows8|yellows8]]
|-
| [[Migration_services|migration]] nn::migration::savedata::IServer cmd1 buffer overflow
| nn::migration::savedata::IServer cmd1 with [18.0.0-18.0.1] copies data from an array to the output ptr. As the output is an u64 field for the IPC cmd output, this is a field on stack. Hence, if more than 1 entry (8-bytes) are copied a stack buffer overflow will occur. Note that cmd3 loads the same data, except this has a proper output array.
It's unknown whether there's a way to actually control this data with a large enough enough size.

See [[18.1.0]] for the diff/fix.
| [[Migration_services|migration]] stack buffer overflow, only on [18.0.0-18.0.1].
| [[18.1.0]]
| [[18.1.0]]
| June 11, 2024
| June 11, 2024
| [[User:Yellows8|yellows8]] (sysupdate diff)
|-
| [[SSL_services|ssl]] broken RNG
| [[SSL_services|ssl]] uses nn::os::GenerateRandomBytes, but not [[SPL_services|spl]] GenerateRandomBytes. See the RNG entries elsewhere. This is used to seed the NSS global RNG (drbg.c, RNG_GenerateGlobalRandomBytes etc).

If one could somehow determine the data which was returned by nn::os::GenerateRandomBytes during seeding (which is likely difficult), the global RNG would be broken.

With [19.0.0+] nn::os::GenerateRandomBytes usage was replaced with [[SPL_services|spl]] GenerateRandomBytes.
| Breaking [[SSL_services|ssl]] global RNG -> potentially predict RNG data (keys(?)) during TLS comms.
| [[19.0.0]]
| [[19.0.0]]
| December 14, 2021
| October 8, 2024
| [[User:Yellows8|yellows8]]
|-
| [[Audio_services|audren]] uncleared TransferMemory
| audren OpenAudioRenderer uses the input tmem as workmem. The IAudioRenderer dtor doesn't clear the workmem properly. Depending on input params, certain objects stored here have vtables - hence infoleak.
The exact location in the workmem will vary depending on the input params - these objects are dynamically allocated in the workmem.
The following will leak vtables: Sink, Effect.

If the initialization func fails, the tmem is unmapped without clearing it first. It's unknown whether there's a way to actually trigger an infoleak with this however. With [19.0.0+] it's now cleared on failure.

With [19.0.0+] the dtor now clears the workmem when needed.
| Reading leaked data/ptrs from TransferMemory -> defeating ASLR in [[Audio_services|audio]]-sysmodule.
| [[19.0.0]]
| [[19.0.0]]
| December 17, 2022
| October 13, 2024
| [[User:Yellows8|yellows8]]
|-
| [[Audio_services|audren]] UpdateMixes OOB mem-copy
| With nn::audio::server::InfoUpdater::UpdateMixes when nn::audio::server::BehaviorInfo::IsMixInParameterDirtyOnlyUpdateSupported() returns true (requires REV7, which is [7.0.0+]), the mix_id from user input is used without validation as input to <code><nn::audio::server::MixContext::GetInfo(int) const></code>, instead of the counter from the for-loop. This allows one to control the destination MixInfo index which the user-input data is written into. If too large, this will trigger OOB data-copy. Note that the u8 at dest_MixInfo+12 must be non-zero.
Also note that a field is loaded from dest_MixInfo which is used as a splitter_id, so splitters need to be initialized where count is large enough for that id.

With [19.0.0+] after getting the mix_id (loop-index/input) it now does: <code>if (mix_id < 0 || mix_id >= nn::audio::server::MixContext::GetCount()) continue;</code>
| OOB mem-copy in [[Audio_services|audio]]-sysmodule, which for example can be used to overwrite a vtable used immediately after UpdateMixes.
| [[19.0.0]]
| [[19.0.0]]
| December 19, 2022
| October 13, 2024
| [[User:Yellows8|yellows8]]
|-
| [[Bus_services|sasbus]] StartPeriodicReceiveMode infoleak
| StartPeriodicReceiveMode writes a vtable ptr into the mapped tmem at +0. The tmem is mapped RW in the user-process. There is no clearing of tmem during tmem cleanup. Hence, the user-process can read the tmem to obtain a Bus-sysmodule codebin-region infoleak. This vtable-ptr seems to be unused - it's also empty after the first two entries (stubbed incref/decref).
[20.0.0+] Removed the vtable ptr, with data intended for the user-process being moved from tmem+0x8 to +0x0. Also, instead of calling memset, funcs are called for manually clearing tmem.
| Bus-sysmodule infoleak, which allows defeating ASLR.
| [[20.0.0]]
| [[20.0.0]]
| February 22, 2022
| May 3, 2025
| [[User:Yellows8|yellows8]]
|-
| [[NFC_services|nfc]] SendCommandByPassThrough buffer overflow
| SendCommandByPassThrough eventually copies the input buffer into a fixed-size heap buffer, without size validation.
This was fixed with [20.0.0+] by clamping the size.
| nfc-sysmodule heap buffer overflow.
| [[20.0.0]]
| [[20.0.0]]
| Late November 2021
| May 3, 2025
| [[User:Yellows8|yellows8]] (maybe others?)
|-
| [[HID_services|hidbus]] EnableJoyPollingReceiveMode infoleak
| The tmem initialized by hidbus EnableJoyPollingReceiveMode contains a vtable ptr (tmem+0x10), hence infoleak. With [20.0.0+] the vtable ptr write was removed, and tmem is now memset starting at tmem+0x10 instead of +0x20.
| hid-sysmodule infoleak, which allows defeating ASLR.
| [[20.0.0]]
| [[20.0.0]]
| March 2020
| May 4, 2025
| [[User:Yellows8|yellows8]]
|-
| [[SSL_services|ssl]] Certificate verification bypass
| The ssl sysmodule keeps a list of trusted certificates, that are imported by an app with ImportServerPki. During certificate verification, if the certificate that is provided by the server has the same subject key id as a trusted certificate, the certificate is accepted, even if self-signed. A blog post about this vulnerability can be found [https://reversing.live/sslbypass.html here].
| Man-in-the-middle for any connection that uses ImportServerPki.
| [[20.2.0]]
| [[20.2.0]]
| June 6, 2025
| August 8, 2025
| [https://github.com/kinnay Yannik]
|-
| [[LDN_services|ldn]] AdvertiseData OOB-memcpy with EncryptionType3 (AES-128-GCM) actionframes (ldnhax)
| The ldn action-frame parser object for AES-128-GCM (used with [[LDN_services|EncryptionType3]]), when it does validation once finished, only verifies that the sizes are within bounds of the input buffer. There's no validation against constants, which the other EncryptionType objects have. The caller code doesn't validate the size either.

[21.0.0+] Now validates the advert-size with sizeof(NetworkInfo.AdvertiseData).

For more details see [https://gist.github.com/yellows8/16bb56343d085d2db2ab0adc5d4cef99 here].
| Compromise of ldn starting from OOB-memcpy, even on S2: stack infoleak (ASLR defeat), arbitrary memory read/write (which also allows handle-leak), vfunc-calls with arbitrary [[Security_Mitigations|vtable]].
| [[21.0.0]]
| [[21.0.0]]
| June ~13, 2025
| November 11, 2025
| [[User:Yellows8|yellows8]]
|-
| [[HID_services|hid:dbg]] AttachHdlsVirtualDevice unvalidated DeviceTypeInternal
| hid:dbg AttachHdlsVirtualDevice eventually passes the input from HdlsDeviceInfo into a func without any validation. The DeviceTypeInternal field is used as the index for loading a ptr from a global array. The only validation occurs when the loaded ptr is NULL - this is just for initializing the ptr in the array when it's not already set.

Since the highest DeviceTypeInternal is value 30, using >=31 will load an OOB ptr. This ptr is written to state, and also immediately passed to a called func. As long as ptr is valid it should be fine with this func.

This functionality is also used eventually by ApplyHdlsNpadAssignmentState and ApplyHdlsStateList.

It's unknown whether there's a way to exploit this. Also note that hid:dbg is not normally accessible to retail titles.

[21.0.0+] Arrayindex=0 is now used when the input is invalid.
| Likely useless, even if reachable?
| [[21.0.0]]
| [[21.0.0]]
| June 3, 2024 (possibly eariler(?))
| November 14, 2025
| [[User:Yellows8|yellows8]]
|-
| [[Bluetooth_Driver_services|bluetooth]] BSA allowed ATT MTU is too large
| GATT-handler stack buffer overflows with a large input size are only possible if the payload_size (MTU) field in state is large enough. gatt_client_handle_server_rsp/gatt_server_handle_client_req will drop messages where the size is >= payload_size (though unless the request opcode matches certain values it will also send an error-response for invalid-PDU). Both of these handle updating this field when needed, however that's handled properly.

With bluetooth-classic via L2CAP, a hard-coded MTU of 0x205 is sent in the configure request. However the code handling received configure requests will set payload_size to 0x2A0 if no MTU is specified, or the input MTU if it's within range 0x30..0x2A0. Hence, sending data large enough for buffer overflows requires bluetooth-classic via L2CAP + manually sending large ACL data.

[15.0.0+] gatt_l2cif_config_ind_cback which handles the received configure-requests with bluetooth-classic mentioned above, now uses MTU range 0x30..0x205 with the default MTU being 0x205. It is therefore no longer possible to trigger the previously mentioned buffer-overflows with bluetooth-classic.
| Stack buffer overflows in bluetooth-sysmodule due to the allowed MTU for ATT being larger than the stack data.
| [[15.0.0]]
| [[20.0.0]]
| November 2021?
| November 26, 2025
| [[User:Yellows8|yellows8]]
|-
| [[Bluetooth_Driver_services|bluetooth]] BSA gatt_process_prep_write_rsp stack buffer overflow
| BSA gatt_process_prep_write_rsp memcpys to stack without size validation (the input len param which is subtracted to determine the copy-size is also unvalidated). Triggering this is only possible if the system sent ATT_PREPARE_WRITE_REQ, and then received ATT_PREPARE_WRITE_RSP with a large size.

The size used with memcpy is (u16)(insize-4), so when insize is less than 4 the copy size will be {negative value masked to u16}. This will therefore eventually crash when the stacktop is reached during memcpy.

[15.0.0+] Paritially fixed due to corrected MTU handling (doesn't apply to negative-copysize). [21.0.0+] Fully fixed with proper size validation.
| Stack buffer overflow in bluetooth-sysmodule when the required ATT messages are sent/received.
| [[21.0.0]]
| [[21.0.0]]
| November 2021?
| January 19, 2026
| [[User:Yellows8|yellows8]]
|-
| [[NFC_services|nfc]] Initialize buffer overflow
| All Initialize* cmds for nn::nfc::detail::IUser (nfc:user), nn::nfc::detail::ISystem (nfc:sys), nn::nfp::detail::IUser (nfp:user), nn::nfp::detail::ISystem (nfp:sys), nn::nfp::detail::IDebug (nfp:dbg), nn::nfc::mifare::detail::IUser (nfc:mf:u): these copy the input array into _this, without validating the array count.
The data is copied to obj_impl+0x8+0x28, with each entry being 0x20-bytes. The event handle returned by AttachAvailabilityChangeEvent is at obj_impl+0x8+0xB8+0x14 (Same with nfc/nfp interfaces). This therefore means +0xA4 in the input buffer will overwrite the handle returned by that cmd, allowing one to leak any handle with the specified value. This can be done with count=0x6. The object is large enough that this count will only overwrite data within the current object. However during the dtor it will use ptrs which were corrupted with this (located before the event), so one must avoid closing the session unless the input data included valid ptrs.

This can be exploited by just using a 0xC0-byte (array_count=0x6) input buffer with Initialize where each u32 is the target nfc handle value, then using cmd GetAvailabilityChangeEventHandle to leak the handle.

[22.0.0+] This was fixed by clamping the count to a maximum of 0x4.
| OOB datacopy into object state. Allows leaking arbitary [[NFC_services|handles]], including on [S2] (such as process-handle, sm, fsp-srv (remaining services can also be used via sm)).
| [[22.0.0]]
| [[22.0.0]]
| November 2021
| March 17, 2026
| [[User:Yellows8|yellows8]]
|}

== Internet Browser ==
{| class="wikitable" border="1"
! Summary
! Description
! Successful exploitation result
! Fixed in system version
! Last system version this flaw was checked for
! Timeframe this was discovered
! Public disclosure timeframe
! Discovered by
|-
| CVE-2016-4657
| WebKit vuln discovered around August 2016. Most notably used in the iOS 9.3.X exploit. A simple PoC can be found [https://github.com/LiveOverflow/lo_nintendoswitch/blob/master/poc1.html here]. This was later exploited by [https://twitter.com/qwertyoruiopz Qwertyoruiop] using an adjusted version of his iOS 9.3 webkit exploit (others exploited this prior to then).
|
| [[2.1.0]]
| [[2.0.0]]
| Original: August 2016
Switch: March 3rd-4th 2017
|
| Everyone
|-
| CVE-2017-7005
| WebKit type confusion.
|
| [[3.0.1]]
| [[3.0.1]]
|
|
| Everyone
|-
| CVE-2016-4622
| WebKit memory corruption bug. This bug was incorrectly re-introduced in [[4.0.0]]. See [http://www.phrack.org/papers/attacking_javascript_engines.html here] for a detailed write-up from the author.
|
| [[6.1.0]]
| [[6.1.0]]
|
|
| Everyone
|-
| CVE-2018-4441
| WebKit memory corruption bug. See [https://bugs.chromium.org/p/project-zero/issues/detail?id=1685&desc=2 here].
|
| [[7.0.0]]
| [[7.0.0]]
|
|
| Everyone
|-
| Web-applets OpenSSL broken RNG
| [[SPL_services|csrng]] access was added to web-applets with [12.1.0+]. Prior to that, csrng and nn::os::GenerateRandomBytes were not used (besides sdk heap code).
nn::os::GetSystemTick is used to seed the OpenSSL RNG, among other data. Hence, it's probably (?) possible to bruteforce the RNG initial state, allowing predicting RNG output.

The RNG code is wkcRandomNumbersPeer (peer_wkc nro), with the initialization code using GetSystemTick located in the func immediately before wkcGetTickCountPeer. The former is called from wkcOsslRandFilefReadPeer. wkcOsslRandFilefReadPeer is called for seeding the OpenSSL RNG.

With [12.1.0+], wkcRandomNumberPeer/wkcRandomNumbersPeer wrap nn::os::GenerateRandomBytes. wkcCryptographicallyRandomValuesPeer was added which wraps nn::crypto::GenerateCryptographicallyRandomBytes. wkcOsslRandFilefReadPeer now calls nn::crypto::GenerateCryptographicallyRandomBytes instead of wkcRandomNumbersPeer.
| Breaking web-applets OpenSSL RNG -> potentially predict RNG data (keys(?)) during TLS comms.
| [[12.1.0]]
| [[12.1.0]]
| January 28, 2022
| October 8, 2024
| [[User:Yellows8|yellows8]], likely (?) others
|}

=== Whitelist ===
This section documents [[Internet_Browser|WebApplet]] whitelist issues in applications. These can be used to load your own browser content over plain HTTP, which then for example could be used for web-applet exploitation.

{| class="wikitable" border="1"
! Application
! Description
! Fixed with app version
! Newest app version this flaw was checked for
! Timeframe this was discovered
! Public disclosure timeframe
! Discovered by
|-
| Sonic Mania
| Originally this game launched web-applet with a plain-http URL for displaying the manual, this was later changed to https. Originally the whitelist only had 1 entry for a http URL, this was later replaced with various https-only URLs.
| 1.04, unknown if fixed with an earlier update
| 1.04
| January (?) 2022
| February 23, 2022
| [[User:Yellows8|yellows8]]
|-
| ぷよぷよ™テトリス®Ｓ (JPN Puyo Puyo Tetris)
| The JPN Tetris game/demo can be used to launch the online-WebApplet.

First, launch the offline-WebApplet for the manual:
* Game: Main-menu -> press A with the already selected top menu button -> press the R button.
* Demo: Main-menu -> select menu button on the right side -> press A.

Then in the manual:
* Press A -> select the bottom menu entry in the list.
* Select the SEGA icon -> press A.

This will then trigger launching the online-WebApplet with the plain-http <nowiki>"http://sega.jp/"</nowiki> URL.

With game-update v1.1.3 the whitelist no longer allows plain-http. The plain-http links appear to have been changed to https.
| 1.1.3
| 1.1.3
| 2017
| 2017
| [[User:Yellows8|yellows8]]
|}

== NintendoSDK ==
This section documents vulnerabilities for NSOs in NintendoSDK.

=== nnSdk ===
This section documents vulnerabilities for nnSdk (sdknso).

{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in SDK [[System_Versions|version]]
! Last SDK version this flaw was checked for
! Timeframe this was discovered
! Public disclosure timeframe
! Discovered by
|-
| [[HID_services|hidbus]] GetJoyPollingReceivedData buffer overflow
| hidbus GetJoyPollingReceivedData doesn't validate the u8 size used for memcpy, when copying the data to the output JoyPollingReceivedData. With 11.x, the size is now clamped to a maximum of 0x2C (regardless of polling-mode). Note that 0x2C is the data-size for JoyButtonOnlyPollingDataAccessor, the other polling-modes have a smaller size.

The hid-sysmodule code which writes data here does handle it properly: size is clamped to a max size, and the data-read uses a fixed-size anyway (hence there's no way to trigger this sdknso vuln with the hid-sysmodule tmem writing code).

This could only be exploited if one directly writes to the tmem when one has previously compromised hid-sysmodule, without using the normal tmem-writing func for this.

There are only a few [[HID_services#ExternalDevices|apps]] which use hidbus.
| Triggering a buffer overflow in an application which uses hidbus GetJoyPollingReceivedData, from a previously compromised hid-sysmodule.
| 11.x.0
| 11.4.0
| March 2020
| December 3, 2020
| [[User:Yellows8|yellows8]]
|-
| [[Profile_Selector|Profile Selector]] uninitialized input data
| Originally unused regions of [[Profile_Selector]] UiSettings/UserSelectionSettings were not cleared prior to being sent to the applet. With 1.x.x these are now properly memset().
| Stack infoleak from user-process, sent to the applet.
| 1.x.x
| 11.4.0
| November-December 2019
| December 31, 2020
| [[User:Yellows8|yellows8]]
|}

=== NEX ===
This section documents client-side vulnerabilities for [https://github.com/Kinnay/NintendoClients/wiki/NEX-Overview-(Game-Servers) NEX].

{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in version
! Timeframe this was discovered
! Public disclosure timeframe
! Discovered by
|-
| Buffer overflow in StringConversion::T2Char8
| StringConversion::T2Char8 is used to convert IP addresses from a platform-specific encoding to UTF-8. On the 3DS and Switch, the implementation is simply a strcpy. By sending a long IP address string, a buffer overflow can be triggered on the stack. The vulnerability can be triggered through the NAT traversal protocol. A blog post about this vulnerable can be found [https://reversing.live/hacking-hundreds-of-wii-us-at-once.html here].
| Stack overflow in any game that uses NEX for matchmaking
| Fixed server-side
| December, 2022
| May, 2024
| [https://github.com/kinnay Yannik]
|}

=== Pia ===
This section documents vulnerabilities for [https://github.com/Kinnay/NintendoClients/wiki/Pia-Overview Pia].

In v5.11.3 (exact starting version unknown) the fixes aren't present for the below vulns which were fixed in v5.9.3, while in v5.18.98 these are present (exact starting version unknown). This probably indicates that the vuln fixes were backported from a newer Pia version to v5.9.3.

The Pia packet handlers are only active when the game is using multiplayer. LanProtocol is only active in the games which are actively using the LAN-mode option (not Ldn) - only certain games support LAN-mode. The LanProtocol Pia packet handler can be reached while in a lobby or searching for one.

Most Pia packets require an active StationProtocol connection to be active with {InetAddr which the packet was received from}, otherwise the packet is filtered out. The only protocols which don't use filtering are the following: NatTraversalProtocol, LanProtocol, StationProtocol, LocalProtocol.

Note that broadcast IP-dest Pia packets are accepted - this can be used to target every device on the network which is using Pia (which is really only useful with {above protocols} due to the filtering mentioned above, unless one also handles StationProtocol).

{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in Pia version
! Last Pia version this flaw was checked for
! Timeframe this was discovered
! Public disclosure timeframe
! Discovered by
|-
| nn::pia::session::RelayRouteManageJob::UpdateConnectionReport buffer overflow
| nn::pia::session::RelayRouteManageJob::UpdateConnectionReport() checks that the input size is at least {value}, but there's no max size check. This is used to memcpy from the input to elsewhere - hence buf-overflow if size is too large. The dst buffer is allocated on the pead heap - this buffer is probably small.
Note that there's various requirements before it would actually reach the memcpy, such as <code><nn::pia::session::Mesh::IsHost() const></code> must return true.

This is called from nn::pia::session::MeshProtocol::ParseConnectionReport().

ParseConnectionReport uses a state ptr for object nn::pia::session::RelayRouteManageJob, it will return if not set. nn::pia::session::Mesh::Initialize handles setup for this, depending on an input field from nn::pia::session::Mesh::Setting. These settings originate from <code><nn::pia::session::Session::CreateInstance(nn::pia::session::Session::Setting const&)></code>, which is called by user-code with the needed settings.
ParseConnectionReport is therefore only usable if the game explicitly enables the Relay functionality.

In fixed versions immediately after the StationIndex validation it now does: <code>if(statefield+0x10<input_size) return;</code>
| Heap buffer overflow triggered by a Pia MeshProtocol message sent to a host device.
| v5.9.3, see above.
| v5.9.1/v5.9.2/v5.9.3
| November 11, 2022
| November 15, 2022
| [[User:Yellows8|yellows8]]
|-
| nn::pia::lan::LanProtocol::ParseSessionMessage buffer overflow
| nn::pia::lan::LanProtocol::ParseSessionMessage() calls nn::pia::lan::LanSessionMessage::Deserialize() to deserialize the message payload data buffer into the LanSessionMessage object on stack. LanSessionMessage::Deserialize (among other things) memcpys data from the input buffer to the object, using an u32 from the input buffer - there is no size validation in Deserialize itself.
There is a size check immediately after calling Deserialize() to verify <code>payloadsize=={u32val}+{constant}</code>, returning on fail - but this doesn't matter for too-large-size.

In fixed versions Deserialize now does bounds checking, both for the minimum message size and clamping the memcpy size to a constant. An error is thrown if the clamped memcpy size is larger than the message size. The caller now checks the ret properly, previously it was ignored.

Following the size check in ParseSessionMessage() it calls <code><nn::pia::session::Mesh::IsProcessingLeaveMesh() const></code>, returning if ret is false.

Then it calls nn::pia::lan::LanProtocol::ReceivedFragmentData::Receive(), with the memcpy'd buffer/size from the above LanSessionMessage, and other fields from LanSessionMessage. This eventually memcpys the input buffer to object+{offset}+{chunksize_field}*inputu8, there is no validation for size or inputu8 (except for the above size check). Hence, if the u8 is large enough, this would result in a heap buffer overflow.

In fixed versions ReceivedFragmentData::Receive added a bunch of validation before the memcpy.
| Stack/heap buffer overflow triggered by a Pia LanProtocol message.
| v5.9.3, see above.
| v5.9.1/v5.9.2/v5.9.3
| November 14, 2022
| November 15, 2022
| [[User:Yellows8|yellows8]]
|-
| nn::pia::session::SessionProtocol::ParseLeaveMeshInvitation buffer overflow
| <code><nn::pia::session::SessionProtocol::ParseLeaveMeshInvitation(nn::pia::transport::ReceivedMessageAccessor const&)></code> This immediately returns if *(ReceivedMessageAccessor+16) is 0. Then the input data is deserialized. The input u64 array is deserialized to stack, the u8 arraycount field from input is not validated.

Hence, stack buffer overflow. Note that there's similar loop code in nearby funcs, which do validate the count properly.

In fixed versions the arraycount field is now validated.

SessionProtocol uses ReliableSlidingWindow MessageHeader, with a maximum message size of 0x100. The allocated size used for the above u64 array is also 0x100-bytes. Hence, when triggering a buf overflow the data after the buffer is uncontrolled data from the SessionProtocol object.
| Stack buffer overflow triggered by a Pia SessionProtocol message.
| v5.9.3, see above.
| v5.9.1/v5.9.2/v5.9.3
| November 14, 2022
| November 15, 2022
| [[User:Yellows8|yellows8]]
|-
| Optional Pia packet encryption
| Pia packet encryption is optional. If the encryption flag is disabled, the packet handler will accept it and skip crypto.
In fixed versions immediately after grabbing a packet, it now checks the crypto flag. If it's plaintext the packet is dropped.

This can be used to send a plaintext Pia packet without needing to handle encryption, especially useful if the session-key can't be obtained (online-play matchmaking). This could be combined with other vulns if wanted.
| Sending a plaintext Pia packet without needing to handle encryption.
| v5.9.3, see above.
| v5.9.3 (and later versions)
|
| November 19, 2022
|
|-
| nn::pia::session::{JoinMeshJob/ProcessUpdateMeshJob}::SetStationDataList OOB read/write/vfunc-call
| <code>nn::pia::session::JoinMeshJob::SetStationDataList</code>is called by <code>nn::pia::session::MeshProtocol::ParseJoinResponse(nn::pia::transport::ReceivedMessageAccessor const&)></code> with the ReceivedMessageAccessor buffer.
SetStationDataList will update state and immediately return if the join was denied. It will also validate the num_mesh_stations field against state. ParseJoinResponse also essentially verifies that the message was received from the host device.

The input buffer size is ignored.

The num_fragments field must be value 1 or <=3 otherwise it will return, there's two seperate code blocks handling these.

Other than the checks at the start, there's no validation for the index fields. So large enough values could result in OOB-reads.

When handling multiple fragments, it will loop through the stationinfo list. There is no validation for the u8 count field or the baseindex field. It calls a vfunc from obj baseptr+index*{entrysize} with data from the buffer, where index starts with the above baseindex field. Afterwards, an u8 is copied into an u32 array (with certain versions an u16 is deserialized into an u16 array).

<code>nn::pia::session::ProcessUpdateMeshJob::UpdateStationDataList</code> is (eventually) called from <code>nn::pia::session::MeshProtocol::ParseUpdateMesh</code>, which has similar issues to the above.

Note that ParseJoinResponse/ParseUpdateMesh essentially require the message to be received from the host device.

With fixed versions (v5.18.98, exact version unknown) various validation was added. Additional/updated validation was added in a later version (v5.31.0, exact version unknown).
| OOB read/write / vfunc call where the object is selected by an OOB index, triggered by a Pia MeshProtocol message.
| v5.18.98 and v5.31.0 (exact versions unknown).
| v5.31.0
| November 18, 2022
| November 21, 2022
| [[User:Yellows8|yellows8]]
|-
| Insecure encryption
| Originally Pia packets used AES-ECB encryption. As documented [https://github.com/Kinnay/NintendoClients/wiki/Pia-Overview here] it was later changed with v5.7.0 to AES-GCM. Each 0x10-byte block would have the same encrypted block output where the plaintext 0x10-byte data is the same.
The mechanism for generating the Pia SessionKey for LAN has also changed over time.

The [https://github.com/Kinnay/NintendoClients/wiki/LAN-Protocol LAN] non-Pia-encapsulated packets were also originally sent in plaintext, however at some point it was changed to mostly encrypted.
|
| AES-GCM fix: v5.7.0
|
|
|
|
|-
| nn::pia::transport::UnreliableProtocol::Dispatch buffer overflow
| <code>nn::pia::transport::UnreliableProtocol::Dispatch</code> memcpys data from the message into a list entry, without size validation. If the pia packet is the max size, it will only overwrite the 0xC-bytes which were written to immediately before the memcpy: the u32 size and the 8-byte StationAddress (depending on the version there can also be 4-byte padding after the size for alignment).
However, nn::pia::transport::UnreliableProtocol::Receive will clamp the size from the list entry to the outbuf size when doing the memcpy. So this is probably useless.

It's unknown whether there's a version where more data could be overwritten, and whether that would be useful.

This is fixed in v5.31.0, exact version unknown. The message is dropped if too large in Dispatch.
| Small buffer overflow triggered by a Pia UnreliableProtocol message.
| v5.31.0, exact version unknown.
| v5.18.98/v5.31.0
| November 2022
| November 29, 2022
| [[User:Yellows8|yellows8]]
|-
| Uncleared input structs for [[LDN_services|LDN]]
| The Pia code using ldn CreateNetwork*/ConnectNetwork*/Scan doesn't properly memset the input data for SecurityConfig/ScanFilter (when keysize is less than 0x40 for the former). Hence, infoleak from games is sent to ldn (structs are located on stack, so stack data is leaked). This requires ldn compromise/mitm to obtain the leaked data - these are not sent over the network.
With v6.20.1 (exact version unknown - fix isn't present in v5.32.0), the code using Scan* now clears the input ScanFilter properly. With v6.25.1 (exact version unknown - fix isn't present in v6.23.3), the code using CreateNetwork*/ConnectNetwork* now clears the input SecurityConfig properly.
| Infoleak from games with LDN cmds, requires compromised sysmodule/mitm.
| v6.20.1 and v6.25.1, exact versions unknown.
| v5.32.0/v6.20.1/v6.23.3/v6.25.1
|
| December 7, 2022
|
|}

=== ENL ===
This section documents vulnerabilities for [https://github.com/kinnay/NintendoClients/wiki/ENL-Protocol ENL].
A framework used by Nintendo games including Mario Kart 8 Deluxe, Splatoon 2 / 3, Mario Maker 2, and more.

Fun fact, this library appears to re-use network code and concepts from older Nintendo titles such as Mario Kart 7 and some Wii multiplayer games.

{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in Enl version
! Last Enl version this flaw was checked for
! Timeframe this was discovered
! Public disclosure timeframe
! Discovered by
|-
| enl::TransportManager::updateReceiveBuffer_() nullptr deref
| enl::TransportManager::updateReceiveBuffer_() is called when the ENL framework receives a PIA packet from a client, it will fully trust the ENL header which includes a "ContentTransporter" type (ID) and a length.
The function will try to fetch the content transporter by ID using <code>enl::TransportManager::getContentTransporter(unsigned char const &)</code>, it returns NULL if there's no content transporter with the same ID

*NOTE: The function may be inlined

Then it will try to call a virtual method: <code>virtual size_t readyReceiveStream(enl::RamReadStream&, enl::Buffer*, size_t)</code>, dereferencing the pointer to fetch the vtable ptr

[https://gist.github.com/Rambo6Glaz/c088e2ed7a12db08f6322e9f7a3c4911 Pseudocode of the function before it was fixed]

| nullptr dereference triggered by an invalid content transporter type in the ENL header (it will crash the game/process)
| Unknown
| Depends on the game
| Early April 2022
| November 16, 2022
| [[User:Rambo6Glaz|Rambo6Glaz]], [https://github.com/kinnay Yannik] (massive RE help)
|}

There's another one more interesting but it will have to wait a bit :)

== Games ==
{| class="wikitable" border="1"
|-
! Game
! Summary
! Description
! Impact
! Fixed in version
! Timeframe this was discovered
! Public disclosure timeframe
! Discovered by
|-
| Mario Kart World
| ASLR leak in application data
| A memory address can be leaked by changing your username to something short, and hosting a network session in LAN mode (press L + R + Left Stick on the main menu to enable this). The memory address can be found in bytes 12 - 19 of the application data that is transmitted in response to a browse request.

'''Note:''' there is more uninitialized data in the packet, but the memory address is probably the most interesting part. The vulnerability was fixed by clearing the application data with zeros, before filling in the information.

[https://hackerone.com/reports/3463719 HackerOne report]

This stack infoleak was also present in the [[LDN_services|ldn]] AdvertiseData.
| A memory address can leaked (this is a requirement for many types of attacks).
| 1.5.0
| December 12, 2025
| February 19, 2026
| [https://github.com/kinnay Yannik], yellows8 (ldn)
|-
| Splatoon 3
| Anticheat Seed Randomization Weakness
| This oversight of seed generation would allow an attacker to quickly compute all code hashes, and modify game code, while still producing a valid ch1 hash.

[https://hackerone.com/reports/3042475 HackerOne report]
| Allows an attacker to bypass the ch1 anti-cheat hashing mechanism.
| 10.0.0
| March 17, 2025
| February 19, 2026
| hana2736
|-
| Splatoon Raiders
| Infoleak in application data
| A ptr can be leaked by hosting a network session in local (at least ldn) mode. The uninitialized data follows the last username in the appdata ([[LDN_services|ldn]] AdvertiseData). With account username short even more data/ptrs are leaked.
With v1.1.1 that data is now cleared.
| Game infoleak, which allows defeating ASLR.
| 1.1.1
| July 25, 2026
| August 6, 2026
| [[User:Yellows8|yellows8]] (ldn)
|}

Switch System Flaws

2026-08-07T02:48:13Z

Yellows8: /* Games */

This page is a list of publicly known Switch / Switch 2 (S2) flaws.

= Hardware =
Flaws in this category pertain to the underlying hardware that powers the Switch.

This includes components shared across Tegra based devices such as the [[TSEC]], the [[Security_Engine|Security Engine]], the [[GPU]] and so on.

{| class="wikitable" border="1"
! Summary
! Description
! Fixed with hardware model/revision
! Newest hardware model/revision this flaw was checked for
! Timeframe this was discovered
! Public disclosure timeframe
! Discovered by
|-
| GMMU DMA attack
| The Switch's GPU includes a separate MMU (GMMU) that is allowed to bypass the system's IOMMU (SMMU). By accessing the GPU's MMIO region and manipulating the page table entries in the GMMU, an attacker can read/write any portion of the DRAM (except memory carveouts).

[5.0.0+] Works around this hardware flaw by using memory pool partitioning. You can no longer escalate into sysmodules with GPU DMA because all their memory is allocated using heap that's carved out.

HAC-001-01 (Mariko/Tegra214/Tegra210b01): Fixes this by adding a new register which restricts what memory untranslated DMA requests may access. Untranslated GPU DMA may now only access the GPU carveout (physmem 0x80002000-0x80006000), which the GPU already has legitimate and exclusive access to.
| HAC-001-01 (Mariko/Tegra214/Tegra210b01)
| HAC-001 (Tegra210)
| Summer 2017
| December 28, 2017
| [[User:hexkyz|hexkyz]], [[User:SciresM|SciresM]] and [[User:qlutoo|qlutoo]]
|-
| Weak Security Engine context validation
| The Tegra X1 supports a "deep sleep" feature, where everything but DRAM and the PMC registers lose their content (and the SoC loses power). Upon awaking, the bootrom re-executes, restoring system state. Among these stored states is the Security Engine's saved state, which uses AES-128-CBC with a random key and all-zeroes IV. However, the bootrom doesn't perform a MAC on this data, and only validates the last block. This allows one to control most of security engine's state upon wakeup, if one has a way to modify the encrypted state buffer.

With a way to modify the encrypted state buffer, one can thus dump keys from "write-only" keyslots, etc.

This also bypasses the SBK protection of the bootROM: indeed, at warmboot, bootROM will always clear keyslot 0xE to prevent malicious code from saving the SBK. Moving the SBK to another keyslot in the saved context renders this protection moot.

HAC-001-01 (Mariko/Tegra214/Tegra210b01): Fixes this by streamlining the context save process; security engine contexts are now saved to protected memory which the CPU cannot access or modify.
| HAC-001-01 (Mariko/Tegra214/Tegra210b01)
| HAC-001 (Tegra210)
| December 2017
| January 20, 2018
| [[User:SciresM|SciresM]] and [[User:motezazer|motezazer]]
|-
| Security Engine keyslots vulnerable to partial overwrite attack
|
The Tegra X1 security engine supports writing keyslot data to the engine with syntax as follows:

SECURITY_ENGINE->AES_KEYTABLE_ADDR = (keyslot << 4) | (dword_index_in_keyslot);

SECURITY_ENGINE->AES_KEYTABLE_DATA = readle32(key, dword_index_in_keyslot * 4);

However, the Security Engine flushes writes to the internal key tables immediately when AES_KEYTABLE_DATA is written -- this allows one to overwrite a single dword of a key at a time, and thus brute force the contents of keyslots in time (2^32 * 8) = 2^35 instead of 2^256.
| None
| HAC-001 (Tegra210)
| Theorized Summer 2017 due to suggestive syntax, confirmed April 9, 2018
| April 9, 2018
| [[User:SciresM|SciresM]], almost surely others (independently).
|-
| CVE-2018-6242 (leveraged by the ShofEL2 and Fusée Gelée exploits)
| The USB software stack provided inside the boot instruction rom (IROM/bootROM) contains a copy operation whose length can be controlled by an attacker. By carefully constructing a USB control request, an attacker can leverage this vulnerability to copy the contents of an attacker-controlled buffer over the active execution stack, gaining control of the Boot and Power Management processor (BPMP) before any lock-outs or privilege reductions occur. This execution can then be used to exfiltrate secrets and to load arbitrary code onto the main CPU Complex (CCPLEX) "application processors" at the highest possible level of privilege (typically as the TrustZone Secure Monitor at PL3/EL3).
| HAC-001-01 (Mariko/Tegra214/Tegra210b01) (also fixed independently on Tegra186).
| HAC-001 (Tegra210)
| January 2018
| April 23, 2018
| [[User:Shuffle2|shuffle2]] and fail0verflow (originally), [[User:Ktemkin|ktemkin]] and ReSwitched Team (independently), [[User:Naehrwert|naehrwert]] (independently), [[User:Hexkyz|hexkyz]] (independently), st4rk with [[User:Shinyquagsire23|Shiny Quagsire]] and Dazzozo (independently), and many others (independently).
|-
| Poor validation of bootrom SDRAM configuration parameters leads to arbitrary writes in bootrom
|
The Tegra X1 bootrom supports saving SDRAM parameters to scratch registers, and using the saved configuration to enable DRAM during warmboot.

The code that parses these parameters does if (params->EmcBctSpareN) *params->EmcBctSpareN = params->EmcBctSpareNPlusOne for most N, without validating either the address or value written to it.
There are other arbitrary writes in this code, as well (e.g. BootromPatch parameters intended for patching MISC registers do not check a relative offset to 0x7000000, etc).

This allows a user with access to the PMC registers (via pre-sleep bpmp execution, or otherwise) to gain arbitrary bootrom code execution.

HAC-001-01 (Mariko/Tegra214/Tegra210b01): Fixes this by validating that the spare writes/bootrom patch before performing them.
| HAC-001-01 (Mariko/Tegra214/Tegra210b01)
| HAC-001 (Tegra210)
| 2017
| December 16, 2018
| Everyone (independently).
|-
| TSEC ROM does not clear crypto registers after signature verification
|
TSEC supports executing signed-microcode at a greater privilege level than normal payloads.

When jumping to signed microcode, the caller is expected to load hardware crypto register $c6 = <signature>, $c7 = <seed (zero for all officially-signed microcode)>.

TSEC ROM then calculates the expected signature and compares it to the user-supplied one in $c6. On match, the secure payload is executed, and on failure an exception is raised.

However, TSEC ROM fails to clear the crypto registers used to calculate the expected signature in either of the success/failure cases.

Thus, with some way of obtaining the contents of crypto registers (e.g. ROP under some secure payload), an attacker can dump intermediary values from signature calculation.

With enough data/trial/error, this is enough to reconstruct the signature algorithm:
* mac = <davies meyer hash of (page || address of page) for each 0x100 page in the payload>
* key = AES-ENCRYPT(hardware csecret 0x1, seed)
* signature = AES-ENCRYPT(key, mac)

| None
| HAC-001 (Tegra210)
| Late 2018/Early 2019
| August 2020
| [[User:qlutoo|qlutoo]]/[[User:Hexkyz|hexkyz]]/[[User:Shuffle2|shuffle2]], [[User:SciresM|SciresM]]/[[User:motezazer|motezazer]] (independently).
|-
| TSEC signature validation design flaw leads to fake-signing
|
As mentioned above, when jumping to signed microcode the caller is expected to load hardware crypto register $c6 = <signature>, $c7 = <seed (zero for all officially-signed microcode)>.

However, TSEC ROM performs no validation on the input seed used to generate the signing key.

This leads to the following attack:
* Attacker gains rop under any secure microcode payload with signature = S.
* Attacker uses the "csigenc" instruction to obtain K = AES-ENCRYPT(hardware csecret 0x1, S).
* Attacker jumps to their own microcode with $c6 = <signature calculated on pc using K>, $c7 = S
* TSEC ROM calculates key = AES-ENCRYPT(hardware csecret 0x1, S) = K, and the signature check passes.
* Attackers microcode is executed in secure mode as though it were signed by NVidia.

Thus an attacker who has exploited *any* secure payload may use this to obtain a "fake signature key", which can be used to sign and execute arbitrary microcode in secure mode.

Note: this does not break the TSEC cryptosystem, as the csigenc mechanism relies on the signature of the executing microcode, and fakesigning produces different signatures from NVidia that cannot be controlled.
| None
| HAC-001 (Tegra210)
| Late 2018/Early 2019
| August 2020
| [[User:qlutoo|qlutoo]]/[[User:Hexkyz|hexkyz]]/[[User:Shuffle2|shuffle2]], [[User:SciresM|SciresM]]/[[User:motezazer|motezazer]] (independently).
|-
| ROP under TSEC secure bootrom via DMA engine stack overwrite (--xploit)
| TSEC DMA engine does not stop when entering TSEC secure bootrom. By pointing TSEC DMA to current stack before secure bootrom entry, stack can be controlled.

One can then use blind ROP against the TSEC secure bootrom (which is execute only, and cannot be dumped).

With sufficient effort, an attacker can construct a ROP chain that leads to csigcmp being executed with fully controlled arguments.

This allows for arbitrary heavy secure mode code execution with the current signature set to an arbitrary value.

This completely breaks the TSEC cryptosystem, by allowing one to obtain the result of csigenc with signature = <any desired value>.

This has many uses/results, notably including dumping the "true" signature key (set signature = zeroes, perform csigenc using csecret 0x1).
| None
| TSEC for all Tegra devices
| Late 2018
| January 2021
| [[User:Hexkyz|hexkyz]]/[[User:SciresM|SciresM]], [[User:Vale|Vale]]/[[User:Thog|Thog]] (independently), [[User:Tatsuko|Tatsuko]] (independently), possibly others (independently).
|-
| Boot straps are not relatched on watchdog resets (strapwn)
| On boot, the BOOTSELECT, RCM and RAM_CODE straps are latched from external GPIO to determine which boot medium to use and verify from in bootrom. However, APB_MISC_PP_STRAPPING_OPT_A can be overwritten with arbitrary values following bootrom. Write access to PP_STRAPPING_OPT_A would otherwise be mundane, however these straps are not relatched during a watchdog reset (despite being latched during other software resets), allowing for arbitrary straps to be selected and executed in bootrom.

This allows setting NVPROD_UART on some hardware configurations where it would normally be unavailable (ie on Jetson Nano boards), but is otherwise mostly useless and/or useful for testing unintended boot options (such as USB Mass Storage boot) without having to move boot strap resistors.
| Unknown
| HAC-001 (Tegra210)
| May 2020
| April 30, 2021
| [[User:Shinyquagsire23|Shiny Quagsire]]
|}

= Firmware =
Flaws in this category pertain to the firmware running on hardware devices, such as wifi/bluetooth, etc. Firmware is generally uploaded by sysmodules.

{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in system version
! Last system version this flaw was checked for
! Timeframe this was discovered
! Public disclosure timeframe
! Discovered by
|-
| Broadpwn (CVE-2017-9417)
| See [https://blog.exodusintel.com/2017/07/26/broadpwn/ here] and [https://www.blackhat.com/docs/us-17/thursday/us-17-Artenstein-Broadpwn-Remotely-Compromising-Android-And-iOS-Via-A-Bug-In-Broadcoms-Wifi-Chipsets.pdf here].
| Code execution on the wifi controller (untested on Switch).
| [[4.0.0]]
| [[4.0.0]]
| Switch: July 2022
| Switch: July 30, 2022
| Switch: [[User:Yellows8|yellows8]]
|}

= Software =
== Bootloader ==
Flaws in this category pertain to any bootloader component such as the [[Package1#Package1ldr|package1ldr]], the [[Package1#Section_1|NX bootloader]] or the [[Package1#Section_0|warmboot binary]].

{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in system version
! Last system version this flaw was checked for
! Timeframe this was discovered
! Public disclosure timeframe
! Discovered by
|-
| Null-dereference in panic()
| The Switch's stage 1 bootloader, on panic(), clears the stack and then attempts to clear the Security Engine. However, it does so by dereferencing a pointer to the SE in .bss (initially NULL), and this pointer doesn't get initialized until partway into the bootloader's main() after several functions that might panic() are called. Thus, a panic() caused prior to SE initialization would result in the SE pointer still being NULL when dereferenced.
The BPMP doesn't have an active MPU and the bus won't data abort on an invalid address, so no exception will be entered: it'll end up overwriting some exception vectors with NULL before halting.

In 3.0.0, this was fixed by moving the security engine initialization earlier in main(), before the first function that could potentially panic().
| Some exception vectors overwritten with NULL, before SBK/other keyslots are cleared. Probably useless for anything more interesting.
| [[3.0.0]]
| [[3.0.0]]
| Early July, 2017
| July 30, 2017
| Everyone who diff'd 2.3.0 and 3.0.0 Package1
|-
| FUSE_DIS_PGM not written by package1
| The switch's hardware fuse driver contains a write-once bit in a register called "FUSE_DIS_PGM", which disables burning fuses until the next reboot. While Nintendo's bootloader code for waking up from sleep writes this on all firmware, the actual package1 initial bootloader forgets to write to it on cold reboot.

This isn't too big of a problem because another fuse is burnt on retail devices (production mode), which prevents burning *all* fuses other than ODM_RESERVED ones in hardware.

This was fixed in 3.0.0 by writing to the register on cold boot (although the write happens in TZ instead of package1 where it should take place, possibly to obfuscate the fact that they made this mistake).
| Burning arbitrary ODM reserved fuses with TZ code execution, which should never be possible for non-bootloader code.

Warning: one could irreparably brick one's console by playing with this.
| [[3.0.0]]
| [[3.0.0]]
| Late summer/early fall 2017
| December 31, 2017
| [[User:SciresM|SciresM]], [[User:motezazer|motezazer]]
|-
| maconstack (TSEC firmware leaves MAC on the stack)
| Package1ldr loads a firmware blob into TSEC early on boot. This piece of code runs on the TSEC in Authenticated Mode and has the sole purpose of generating the per-console TSEC key (see [[Cryptosystem]]).

As a way to mitigate attacks, the TSEC firmware blob is split into 3 stages: [[TSEC_Firmware#Boot|Boot]] which is unencrypted and unsigned, [[TSEC_Firmware#KeygenLdr|KeygenLdr]] which is unencrypted but signed and [[TSEC_Firmware#Keygen|Keygen]] which is encrypted and signed.
Boot loads a static pre-generated signature into the Falcon's CPU crypto registers, loads KeygenLdr into the Falcon's CODE region and jumps to it. Execution will proceed into KeygenLdr in Heavy Secure Mode if, and only if, the loaded signature matches the one Falcon calculates internally for KeygenLdr.

Among various things, KeygenLdr will attempt to do a "backwards" security check by calculating a CMAC over Boot and comparing it with a known hash stored in the TSEC firmware's key data (a small buffer stored after Boot's code). If the hashes don't match, execution aborts.

KeygenLdr stores the calculated Boot's CMAC in the stack, but forgets to clear it. Since the stack is located in Falcon's DATA region, loading the TSEC firmware blob and dumping the DATA region afterwards (via MMIO) will reveal the calculated hash.
This allows using KeygenLdr as an oracle to generate a valid CMAC for arbitrary Boot code. Replacing the CMAC in the TSEC firmware's key data region results in KeygenLdr accepting any Boot code, thus rendering this security measure useless.

Additionally, since signed Falcon code can't be revoked without an hardware revision, an attacker can always reuse the flawed KeygenLdr code even if a fix is issued.
| Running TSEC firmware's KeygenLdr in a user controlled environment.
| None
| [[5.0.2]]
| January 2018
| April 29, 2018
| [[User:Hexkyz|hexkyz]], [[User:Rei|Reisyukaku]] (independently), probably others (independently).
|-
| pk1ldrhax
| Package1ldr decrypts and verifies the keyblob inside of the current BCT in order to get the package1 key, and then uses the package1 key to decrypt package1. It then validates package1 before jumping to it by checking the PK11 magic number, and that the section sizes sum to the expected size (and are individually less than the expected size).

However, package1ldr does not actually validate the package1 key against a fixed vector (much like kernel9loader forgot to do so on the 3ds). This would normally not matter, as keyblobs are validated -- however, with bootrom code execution one can dump SBK and forge keyblobs, and thus control the package1 key.

Thus ('''in theory, but not in practice due to the size of the brute force required''') one can replace the package1 key with garbage, causing package1 to decrypt into garbage, and hope that this garbage passes validation checks and that package1ldr jumping into the garbage will do something useful.

This was fixed incidentally in [[6.2.0]], as pk1ldr does not use keyblob data to decrypt package1 any more.

| With a large enough brute force: arbitrary package1 code execution from coldboot.

However, a usable brute force is on the order of >= ~2^80, so '''this is almost certainly not actually usable in any meaningful context'''.
| [[6.2.0]]
| [[6.2.0]]
| Early 2017 (as soon as plaintext package1ldr was first dumped)
| November 20, 2018
| Everyone
|-
| Stack smash in TSEC firmware's KeygenLdr
| Given that we can control the [[TSEC_Firmware#Key_data|key data]] (which is not authenticated) and the [[TSEC_Firmware#Boot|Boot]] blob (see "maconstack"), as well as the fact Non-secure and Heavy Secure code share the same stack, we can use this to attack KeygenLdr. KeygenLdr uses memcpy to copy over a payload to DMEM to verify it, which can be abused to smash the stack (in DMEM) and write over the return address of said function.
| ROP under KeygenLdr in Heavy Secure mode.
| None
| [[8.0.1]]
| Early 2018
| May 21, 2019
| Everyone (independently).
|}

== TrustZone ==
Flaws in this category pertain exclusively to the [[Package1#Section_2|Secure Monitor]].

{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in system version
! Last system version this flaw was checked for
! Timeframe this was discovered
! Public disclosure timeframe
! Discovered by
|-
| Non-atomic mutexes
| When an [[SMC]] is called, TrustZone sets a global variable to mark that an SMC is in progress, so that two SMCs using shared resources (like the security engine) do not trample on one another. On 1.0.0, this global variable was written using non-atomic writes, and thus a race condition is possible.

However, the SMC handler enforces that all SMCs must be called from core #3, unless the top-level handler ID is 1 (SMCs internal to the kernel). Thus, the only SMCs that can be run side-by-side are [any userland smc] and smcGetRandomBytesForKernel, and this turns out to not really be abusable.
| Mostly useless. Maybe some oob-write into unused (and thus useless) memory if running smcGetRandomBytesForKernel and smcGetRandomBytesForUser at the same time.
| [[2.0.0]]
| [[2.0.0]]
| December 2017 (Probably earlier by others)
| January 18, 2018
| [[User:SciresM|SciresM]], probably others (independently).
|-
| jamais vu (non-secure world access to PMC MMIO and pre-deep sleep firmware)
| On [[1.0.0]], one could map in the PMC registers in userland. In addition, [[AM_services|am]] ran a little-kernel based firmware on the BPMP at runtime. With code execution under am, one could modify the BPMP's little-kernel firmware to hook deep sleep entry, and modify TrustZone/Security engine state.

This was fixed in [[2.0.0]] by making the PMC secure-world only, blacklisting the BPMP's exception vectors from being mapped, and thoroughly checking for malicious behavior on deep sleep entry.
| Arbitrary TrustZone code execution.
| [[2.0.0]]
| [[2.0.0]]
| December, 2017
| January 20, 2018
| [[User:SciresM|SciresM]] and [[User:motezazer|motezazer]]
|-
| Missed BPMP Exception Vector Writes
| Starting in [[2.0.0]], the BPMP is asleep at runtime, and is turned on by TrustZone during [[SMC|smcCpuSuspend]] in order to initiate the deep sleep process. When it does so, it is held in RESET, and TrustZone attempts to write to the BPMP exception vectors at 0x6000F200 to register EVP_RESET = lp0_entry_fw_crt0, and all other EVPs to a function that simply reboots. However, while they successfully write EVP_RESET, they miss all the other vectors, accidentally writing to the 0x6000F004-0x6000F020 region instead of the 0x6000F204-0x6000F220 region they want to write to. This results in all the exception vectors for the BPMP other than RESET being "undefined" (attacker controlled).

With some way of causing an exception vector to be taken at the right time, this would give pre-sleep code execution (and thus arbitrary TrustZone code execution, via the security engine flaw). However, none of the abort vectors are really triggerable, and interrupts are disabled for the BPMP when it is taken out of reset. Thus, this is useless in practice.

This was fixed in [[4.0.0]] by writing to the correct registers.
| Theoretically: Arbitrary TrustZone code execution. In practice: Useless.
| [[4.0.0]]
| [[4.0.0]]
| January, 2018
| February 23, 2018
| [[User:SciresM|SciresM]] and [[User:motezazer|motezazer]], [[User:Naehrwert|naehrwert]], [[User:Hexkyz|hexkyz]], probably others (independently).
|-
| TSEC has access to the secure kernel carveout
| TrustZone is responsible for managing security carveouts to prevent DMA controllers from accessing the carveout which contains the kernel, sysmodules, and other critical operating system data.

Until [[8.0.0]], the list of devices that could access the carveout included the TSEC. However, the TSEC can bypass the SMMU when in authenticated mode by writing to a certain register. Thus, pwning nvservices would allow one to take over the TSEC, and use it to write to normally protected mmio/memory.

In [[8.0.0]], this was fixed by removing TSEC access, and adding TSECB access (TSECB cannot bypass the SMMU).
| With access to the TSEC mmio (nvservices ROP) and code execution in TSEC Heavy Secure mode, kernel code execution, probably.
| [[8.0.0]]
| [[8.0.0]]
| 2017 (when TrustZone code plaintext was first obtained).
| April 15, 2019
| Everyone
|-
| deja vu (insufficient system state validation on suspend leads to pre-sleep BPMP code execution)
| Jamais Vu was fixed in [[2.0.0]] by making the PMC secure-world only, blacklisting the BPMP's exception vectors from being mapped, and thoroughly checking for malicious behavior on deep sleep entry, since gaining pre-sleep code execution on the BPMP compromises the system.

However, the state validation performed by Nintendo's Secure Monitor was insufficient to prevent pre-sleep execution from being obtained.

Prior to [[6.0.0]], one could use a DMA controller that had access to IRAM and was not held in reset (there were multiple) to race TrustZone's writes to the BPMP firmware in IRAM, and thus overwrite Nintendo's firmware with an attacker's to gain pre-sleep code execution.

[[6.0.0]] addressed this by performing TrustZone state MAC writes and locking PMC scratch *before* turning on the BPMP, fixing the original Jamais Vu exploit entirely. In addition, the BPMP firmware in TrustZone's .rodata is now memcmp'd to the actual data after it is written to IRAM. This mitigates race attacks that modify the firmware.

However, Nintendo both forgot to validate the BPMP exception vectors after writing them, and forgot to hold in reset a DMA controller that can write to the BPMP's exception vectors.

AHB-DMA is not blacklisted by kernel mapping whitelist (Nintendo probably forgot it, because the TX1 TRM does not really document that it's present, although the MMIO works as documented in older (Tegra 3 and before) TRMs).

Thus, with kernel code execution (or some other way of accessing AHB-DMA, e.g. nspwn on <= 4.1.0, TSEC hax, or other arbitrary mmio access flaws), one can DMA to the BPMP's exception vectors as they are written, causing TrustZone to start the BPMP executing an attacker's firmware at a different location than TrustZone intends/validates.

This was fixed in [[8.0.0]] by blocking AHB-DMA arbitration and verifying it is held in reset during suspend, and thus there are no more devices that can write to the relevant MMIO at the right time.

| Arbitrary TrustZone/BootROM code execution, by using either the original Jamais Vu flaw (prior to [[6.0.0]] or a warmboot bootrom exploit (any firmware where pre-sleep execution can be gained).
| [[8.0.0]]
| [[8.0.0]]
| December 2017
| April 15, 2019
| [[User:SciresM|SciresM]], [[User:motezazer|motezazer]] and ktemkin, [[User:Naehrwert|naehrwert]] (independently), almost certainly others (independently)
|-
| TrustZone allows using imported RSA exponents with arbitrary modulus
| TrustZone supports "importing" RSA private exponents for use by userland -- these are stored encrypted with TrustZone only keydata in NAND, and decrypted only to TZRAM. This prevents a console that has compromised userland from learning the private exponents of these keys and doing calculations with them offline. In practice, this is used for FS (gamecard communications), ES (drm), and SSL (console client cert communications).

However, the actual SMC API only imports the RSA exponent, and not the modulus, which is passed separately by userland in each call. There is no validation done on the modulus passed in -- this means that userland can pass in any message and modulus it chooses, and obtain the result of (message ^ private exponent) % modulus back from the secure monitor.

By choosing a prime number modulus P such that P has "smooth" order (totient(P) == P-1 is divisible only by "small" primes), one can efficiently use the [[wikipedia:Pohlig-Hellman algorithm|Pohlig-Hellman algorithm]] to calculate the discrete logarithm of such a result directly, and thus obtain the private exponent.

This is mostly useless in practice, given the general availability of other exploits to obtain these decrypted exponents.

This was fixed in 10.0.0 by importing the modulus in addition to the exponent for the ES device key and ES client cert key. For backwards compatibility reasons the SSL key and Lotus key still only import the exponent.

StorageExpMod also now validates that the exponentiation of "DDDDD..." about the provided modulus by the imported exponent and then the fixed public exponent returns "DDDDD...", and returns invalid argument if validation fails.
| With userland privileges sufficient to use an imported RSA key: obtaining that RSA key's private exponent.
| [[10.0.0]]
| [[10.0.0]]
| August 14, 2019
| August 14, 2019
| [[User:SciresM|SciresM]]
|}

== Kernel ==
Flaws in this category pertain exclusively to the [[Package2#Section_0|HorizonOS Kernel]].

{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in system version
! Last system version this flaw was checked for
! Timeframe this was discovered
! Public disclosure timeframe
! Discovered by
|-
| Syscall Infoleaks
| Many syscalls leaked kernel pointers on sad paths (for example svcSetHeapSize and svcQueryMemory), until they landed a bunch of fixes in 2.0.0.
| Nothing really.
| [[2.0.0]]
| [[2.0.0]]
|
| 2017
| Everyone
|-
| svcWaitSynchronization/svcReplyAndReceive bad cleanup on error
| If there is a page fault when fetching handles from the userspace array, it cleans up by dereferencing all objects despite having only loaded first N. Allows the attacker to make arbitrary decrefs on any kernel synchronization object, and thus can be used to get UAF. Haven't actually been tried on real HW though, but should work (tm).
| Kernel code execution
| [[2.0.0]]
| [[2.0.0]]
|
| April 24, 2017
| [[User:qlutoo|qlutoo]]
|-
| Bad irq_id check in CreateInterruptEvent
| CreateInterruptEvent syscall is designed to work only for irq_id >= 32. All irq_ids < 32 are "per-core" and reserved for kernel use (watchdog/scheduling/core communications).
On 1.0.0 you could supply irq_id < 32 and it would write outside the SharedIrqs table.
| You can register irq's in the Core3Irqs table, and thus register per-core irqs for core3, that are normally reserved for kernel. Useless.
| [[2.0.0]]
| [[2.0.0]]
| October 2017
| October 17, 2017
| [[User:qlutoo|qlutoo]]
|-
| Kernel .text mapped executable in usermode
| Prior to [[3.0.2]] the kernel .text was [[Memory_layout|mapped]] in usermode as executable. This can be used for usermode ROP for bypassing ASLR, but SVCs/IPC are not usable by running kernel .text in usermode.
| Executing kernel .text in usermode
| [[3.0.2]]
| [[3.0.2]]
|
| December 28, 2017 (34c3)
| [[User:qlutoo|qlutoo]]
|-
| Memory Controller not properly secured
| The Switch OS originally had the memory controller not set to be accessible only by the secure-world, which was problematic because insecure access can compromise the kernel.

This was fixed partially in [[2.0.0]] by blacklisting the memory controller from being mapped by user-processes, and was fixed entirely in [[4.0.0]] by making the memory controller TZ-only and making all kernel accesses go through [[SMC|smcReadWriteRegister]].
| With some way to access the memory controller MMIO, arbitrary kernel code execution.
| [[4.0.0]]
| [[4.0.0]]
| January 2018
| January 2018
| [[User:SciresM|SciresM]], [[User:Yellows8|yellows8]]
|-
| Potential [[SVC|svcWaitForAddress]] thread use-after-free
| Between [[4.0.0]], where svcWaitForAddress was introduced, and [[7.0.0]], there was a second intrusive rbtree node in KThread for the WaitForAddress tree (the key being (address, priority), sorted lexicographically). Unlike the WaitProcessWideKeyAtomic tree, the kernel forgot to reinsert the WaitForAddress node when the thread's priority changed (priority inheritance and/or SetPriority), breaking the rbtree invariants; and since the kernel walks through the entire tree to remove intrusive nodes, you could cause threads to stay in the tree even after their deletion.

[[7.0.0]] fixed the issue by using the same intrusive node for both trees. The thread/node knows which tree it is in, and the latter is correctly updated when thread priority changes.
| It unluckily didn't look exploitable
| [[7.0.0]]
| [[7.0.0]]
| July 2018
| February 2019
| [[User:TuxSH|TuxSH]]
|-
| Kernel RWX identity mapping never unmapped
| During init, the kernel binary is identity-mapped as RWX at 0x80060000; this is necessary to facilitate the transitionary period while the MMU is being enabled but mappings for e.g. KASLR are not yet determined, and also to enable smooth MMU enable transition during wake-from-sleep.

However, the identity mapping was never unmapped, and thus the whole kernel code bin remained permanently mapped as RWX for all kernel threads (any thread which does not have an owner process and thus uses the KSupervisorPageTable TTBR0).

Thus, any theoretical exploit which would give kernel memory corruption or ROP under a kernel thread would allow making use of this mapping to modify kernel text + bypass KASLR.

This was fixed in [[16.0.0]] by unmapping the identity-mapping during init, and re identity-mapping only the very first page of kernel .text as R-X (for use by wake-from-sleep), which fixes the shellcode problem and mostly fixes the ROP problem, since this page mostly lacks interesting gadgets.
| In theory, with another exploitable kernel memory corruption (or ROP under kernel thread) bug: bypassing KASLR + modifying kernel .text.

However, no such bugs are known.
| [[16.0.0]]
| [[16.0.0]]
| Summer 2018
| February 2023
| Everyone
|}

== BootImagePackage System Modules ==
Flaws in this category pertain to any of the [[Package2#Section_1|built-in system modules]].

{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in system version
! Last system version this flaw was checked for
! Timeframe this was discovered
! Public disclosure timeframe
! Discovered by
|-
| Service access control bypass (sm:h, smhax, probably other names)
| Prior to [[3.0.1]], the ''service manager'' (sm) built-in system module treats a user as though it has full permissions if the user creates a new "sm:" port session but bypasses [[Services_API#Initialize|initialization]]. This is due to the other sm commands skipping the service ACL check for Pids <= 7 (i.e. all kernel bundled modules) and that skipping the initialization command leaves the Pid field uninitialized.
In [[3.0.1]], sm returns error code 0x415 if [[Services_API#Initialize|Initialize]] has not been called yet.
| Acquiring, registering, and unregistering arbitrary services
| [[3.0.1]]
| [[3.0.1]]
| May 2017
| August 17, 2017
| Everyone
|-
| Overly permissive SPL service
| The concept behind the switch's [[SMC|Secure Monitor]] is that all cryptographic keydata is located in userspace, but stored as "access keys" encrypted with "keks" that never leave TrustZone. The [[SPL services|spl]] ("security processor liaison"?) service serves as an interface between the rest of the system and the secure monitor. Prior to [[4.0.0]], spl exposed only a single service "spl:", which provided all TrustZone wrapper functions to all sysmodules with access to it. Thus anyone with access to the spl: service (via smhax or by pwning a sysmodule with access) could do crypto with any access keys they knew.

This was fixed in [[4.0.0]] by splitting spl: into spl:, spl:mig, spl:ssl, spl:es, and spl:fs.
| Arbitrary spl: crypto with any access keys one knows. For example, one could use the SSL module's access keys to decrypt their console's SSL certificate private key without having to pwn the SSL sysmodule.
| [[4.0.0]]
| [[4.0.0]]
| Summer 2017 (after smhax was discovered).
| December 23, 2017
| Everyone
|-
| Single session services not really single session
| Several "critical" services (like fsp-ldr, fsp-pr, sm:m, etc) are meant to only ever hold a single session with a specific sysmodule. However, when a sysmodule dies, all its service session handles are released -- and thus killing the holder of a single session handle would allow one (via sm:hax etc) to get access to that service.

This was fixed in [[4.0.0]] by adding a semaphore to these critical single-session services, so that even if one gets access to them an error code will be returned when attempting to use any of their commands.
| With some way to access these services and kill their session holders (like expLDR): dumping sysmodule code, arbitrary service access, elevated filesystem permissions, etc.
| [[4.0.0]]
| [[4.0.0]]
| May/June 2017 (basically immediately after smhax was discovered)
| December 30, 2017
| Everyone
|-
| nspwn
| fsp-ldr command 0 "MountCode" takes in a Content Path (retrieved from NCM by Loader), and returns an IFileSystem for the resulting ExeFS. These content paths, are normally NCAs, but MountCode also supports a number of other formats, including ".nsp" -- which is just a PFS0.

When a path ending in ".nsp" is parsed by MountCode, the PFS0 is treated as a raw ExeFS. Because there is no NCA header, the ACID signatures are not validated -- and because there are no other signatures in a PFS0, this results in no signature checking happening at all.

The actual .nsp handling is eventually done by {content mounting function} called by MountCode and other FS commands.

Thus, by placing an ExeFS (NSOs + "main.npdm") and setting one's desired title ID to "@Sdcard:/some_title.nsp" or "@User:/some_title.nsp" etc one can launch arbitrary unsigned code, with arbitrary unsigned NPDMs.

This appears to have been fixed by only allowing .nsp when the input fstype==7 for the internal content-mounting function, returning 0x2EE202 otherwise.
| With access to "lr": Arbitrary code execution with full system privileges.
| [[5.0.0]]
| [[5.0.0]]
| Late 2017
| April 23, 2018
| Everyone
|-
| Single null-byte stack overflow in Loader ContentPath parsing
| Previously, loader content path parsing looked like this, where path_from_lr was up to 0x300 bytes and not necessarily null-terminated:

char nca_path[0x300] = {0};
strcat(nca_path, path_from_lr);
for (int i = 0; nca_path[i]; i++) {
if (nca_path[i] == '\\') { nca_path[i] = '/'); }
}

Thus, a content path of the maximum length (0x300 bytes) would result in strcat writing a NULL terminator past the end of the nca_path buffer.

This was fixed in [[6.0.0]], the new code looks like this:

char nca_path[0x300];
strncpy(nca_path, path_from_lr, sizeof(nca_path));
for (int i = 0; i < sizeof(nca_path) && nca_path[i]; i++) {
if (nca_path[i] == '\\') { nca_path[i] = '/'); }
}

| With access to "lr": single null-byte stack overflow in Loader. Maybe (but probably not) loader code execution.
| [[6.0.0]]
| [[6.0.0]]
| September 2, 2018
| September 19, 2018
| [[User:SciresM|SciresM]]
|-
| System modules vulnerable to selective downgrade attacks
| Horizon has no mechanism for specifying the specific title version to Loader on process creation.

Observing this, one can note that after a system update one could install a downgraded version of a specific system module (e.g. nvservices) while leaving the rest of the OS at the same version.

Unless there was some breaking API change, this allows one to make a console vulnerable once more to an exploit in a sysmodule by downgrading it and nothing else.

This was fixed in [[8.1.0]] by incrementing a version field in NPDM, and checking it against a hardcoded list for certain titles in Loader's process creation func.
| With access to content installation commands (or a vulnerable lower version to selectively install newer titles), reintroducing bugs in vulnerable system modules on newer firmware versions.
| [[8.1.0]]
| [[8.1.0]]
| When FIRM was first dumped in 2017.
| June 17, 2019
| Everyone
|-
| Broken RNG for [[Loader_services|Loader]] ASLR
| The RNG used for generating the ASLR slide is only seeded with 32bits, with the data from [[SVC|svcGetInfo]]. Hence, one could bruteforce the seed if one has infoleaks from any programs. This can be successfully bruteforced with at least 2 sample codebin addrs from different programs (with only 1 sample a lot of invalid seeds are found), however in some cases more than 1 seed might be found.

With [15.0.0+] Loader now uses csrng_GenerateRandomBytes for determining the ASLR slide.

See also [https://github.com/switchbrew/loader-aslr-solver loader-aslr-solver].
| Breaking ASLR for all non-KIP processes, allowing predicting the main-codebin base addr for all non-KIP processes until the next reboot.
| [[15.0.0]]
| [[15.0.0]]
| January 30, 2022 (presumably found much earlier?)
| October 11, 2022
| Everyone
|}

== System Modules ==
Flaws in this category pertain to any non-built-in system module.

{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in system version
! Last system version this flaw was checked for
! Timeframe this was discovered
! Public disclosure timeframe
! Discovered by
|-
| OOB Read in NS system module (pl:utoohax, pl:utonium, maybe other names)
| Prior to [[3.0.0]], pl:u (Shared Font services implemented in the NS sysmodule) service commands 1,2,3 took in a signed 32-bit index and returned that index of an array but did not check that index at all. This allowed for an arbitrary read within a 34-bit range (33-bit signed) from NS .bss. In [[3.0.0]], sending out of range indexes causes error code 0x60A to be returned.
| Dumping full NS .text, .rodata and .data, infoleak, etc
| [[3.0.0]]
| [[3.0.0]]
| April 2017
| June 19, 2017
| [[User:qlutoo|qlutoo]], ReSwitched Team (independently)
|-
| Unchecked domain ID in common IPC code
| Prior to [[2.0.0]], object IDs in [[IPC_Marshalling#Domain_message|domain messages]] are not bounds checked. This out-of-bounds read could be exploited to brute-force ASLR and get PC control in some services that support domain messages.
|
| [[2.0.0]]
| [[2.0.0]]
| July 2017
| July 20, 2017‎
| [[User:hthh|hthh]]
|-
| Out-of-bounds array read for [[BCAT_Content_Container]] secret-data index
| The [[BCAT_Content_Container]] secret-data index is not validated at all. This is handled before the RSA-signature(?) is ever used. Since the field is an u8, a total of 0x800-bytes relative to the array start can be accessed.
This is not useful since the string loaded from this array is only involved with key-generation.
|
| Unknown
| [[2.0.0]]
| August 4, 2017
| August 6, 2017
| [[User: shinyquagsire23|Shiny Quagsire]], [[User:Yellows8|yellows8]] (independently)
|-
| expLDR (sysmodule handle table exhaustion)
| Most sysmodules share common template code to handle IPC control messages. The command DuplicateSession (type 5 command 2)'s template code will abort() if it fails to duplicate a session's handle for the requester. Because many sysmodules have limited handle table size (smaller than the browser/other entrypoints), repeatedly requesting to duplicate one's session will cause the sysmodule to run out of handle table space and abort, causing the service to release all its handles cleanly.
| Sysmodule crashes. Most usefully, crashing ldr allows access to fsp-ldr and crashing pm allows access to fsp-pr. Useless after [[4.0.0]], which mitigated a number of single-session service access issues.
| Unfixed
| [[4.1.0]]
| June 24, 2017
| March 8, 2018
| [[User:daeken|daeken]]
|-
| Transfer Memory leak in nvservices system module
| The nvservices sysmodule does not clear most of its transfer memory prior to release.
| The calling process can read key bits of memory, including breaking ASLR (by revealing the image base) and exposing the address of other transfer memory to set up attacks. More details here: [https://daeken.svbtle.com/nintendo-switch-nvservices-info-leak transfermeme (nvservices info leak)] by [[User:daeken|daeken]]
| [[6.0.0]]
| [[6.0.0]]
| June 2017
| October 16, 2018
| [[User:qlutoo|qlutoo]] and [[User:hexkyz|hexkyz]],
[[User:daeken|daeken]] (independently)
|-
| OOB write in audio system module
| Prior to [[2.0.0]], the [[Audio_services#audout:u|AppendAudioOutBuffer]] and [[Audio_services#audin:u|AppendAudioInBuffer]] IPC commands would blindly increment the appended buffers' count while using said count value as an index to where the user data should be copied into. This resulted in an 0x28 bytes, user controlled, out-of-bounds memory write into the [[Audio_services|audio]] sysmodule's memory space.
Combined with the [[Audio_services#audout:u|GetReleasedAudioOutBuffer]] or [[Audio_services#audin:u|GetReleasedAudioInBuffer]] commands, this could also be used as an 8 byte infoleak.

In [[2.0.0]], the commands now return error code 0x1099 if the number of unreleased buffers exceeds 0x1F.
| Code execution under audio sysmodule
| [[2.0.0]]
| [[2.0.0]]
|
| November 2, 2018
| [[User:hexkyz|hexkyz]], probably others (independently).
|-
| Infoleak in nvservices system module
| The [[NV_services|nvservices]] ioctl [[NV_services#NVMAP_IOC_ALLOC|NVMAP_IOC_ALLOC]] takes an optional argument "addr" which allows the calling process to pass a pointer to user allocated memory for backing a nvmap object. If "addr" is left as 0, nvservices uses the transfer memory region (donated by the user during initialization) instead, when allocating memory for the nvmap object.
By design, freeing the nvmap object by calling the ioctl [[NV_services#NVMAP_IOC_FREE|NVMAP_IOC_FREE]] returns, in its "refcount" argument, the user address previously supplied if the reference count reaches 0.
However, prior to [[6.2.0]], the case where the transfer memory region is used to allocate the nvmap object was not taken into account, thus resulting in [[NV_services#NVMAP_IOC_FREE|NVMAP_IOC_FREE]] leaking back an address from within the transfer memory region mapped in nvservices' memory space.

In [[6.2.0]], [[NV_services#NVMAP_IOC_FREE|NVMAP_IOC_FREE]] no longer returns the address when the transfer memory region is used instead of user supplied memory.
| Combined with other vulnerabilities: Defeating ASLR in nvservices sysmodule.
| [[6.2.0]]
| [[6.2.0]]
| April 2017
| November 24, 2018
| Everyone
|-
| nvhax (memory corruption in nvservices system module)
| Prior to [[6.2.0]], the [[NV_services|nvservices]] ioctl [[NV_services#.2Fdev.2Fnvhost-ctrl-gpu|NVGPU_GPU_IOCTL_WAIT_FOR_PAUSE]] would take a single "pwarpstate" argument which would be interpreted by nvservices as a memory pointer for writing 2 "warpstate" structs (one for each Streaming Multiprocessor).
This resulted in nvservices attempting to blindly memcpy into this user supplied address and trigger a crash. However, if paired with an infoleak, this could be used to arbitrarily write 0x30 bytes anywhere in nvservices' memory space.
Additionally, the "warpstate" struct itself was never initialized, which means nvservices would leak the 0x30 bytes from the stack. By invoking other ioctls it was also possible to partially control the stack contents and achieve a usable arbitrary memory write primitive.

In [[6.2.0]], [[NV_services#.2Fdev.2Fnvhost-ctrl-gpu|NVGPU_GPU_IOCTL_WAIT_FOR_PAUSE]] now takes 2 inline "warpstate" structs instead of a "pwarpstate" pointer, thus effectively avoiding the bad memcpy.
| Code execution under nvservices sysmodule
| [[6.2.0]]
| [[6.2.0]]
| April 5, 2017
| November 24, 2018
| [[User:hexkyz|hexkyz]]
|-
| [[Applet_Manager_services#IStorage|AM IStorage]] infoleak
| Originally the buffer allocated by [[Applet_Manager_services#CreateStorage|CreateStorage]] using the specified input size was not cleared. With [8.0.0+] this was fixed by adding a memset() for the buffer after successful allocation.

Hence, IStorage->IStorageAccessor->Read will return uninitialized memory when the Write cmd was not previously used with the specified region.
| Infoleak from the main [[Applet_Manager_services#IStorage|AM]] heap, allowing defeating ASLR by reading addresses from previously allocated objects.
| [[8.0.0]]
| [[8.1.0]]
| December 2018
| August 9, 2019
| [[User:Yellows8|yellows8]]
|-
| [[HID_services#hid:sys|hid:sys]] ButtonConfig s32 array-index not validated
| The input s32 array-index for [[HID_services#hid:sys|hid:sys]] ButtonConfig cmds 1255-1270 was originally not validated. Using a negative or >=5 index results in accessing out-of-bounds data, with an array stored on stack.
[10.1.0-10.2.0] Each of these cmds will now Abort if the s32 is negative or >=5. [11.0.0+] Now an unsigned compare is used, with 0 or an error being immediately returned when the value is invalid.
| hid infoleak, out-of-bounds mem-write anywhere in hid address-space relative to the stack array (with constraints on the data).
| [[10.1.0]]
| [[11.0.1]]
| April 18, 2020
| July 14, 2020
| [[User:Yellows8|yellows8]]
|-
| [[Bluetooth_Driver_services|Bluetooth]] sdp_server.cc process_service_search() continuation request p_req validation
| With [5.0.0+], the following was added to the if-block prior to loading cont_offset from p_req: <code>(p_req + sizeof(cont_offset) > p_req_end)</code> (which verifies that cont_offset is within message bounds).
| Bluetooth-sysmodule out-of-bounds read from heap, probably not useful since the read value must match a state field, etc.
| [[5.0.0]]
| [[11.0.0]]
| Switch: December 2020
| Switch: December 25, 2020
| Switch: [[User:Yellows8|yellows8]]
|-
| [[Bluetooth_Driver_services|Bluetooth]] A-63146698
| [https://android.googlesource.com/platform/system/bt/+/226ea26684d4cd609a5b456d3d2cc762453c2d75 A-63146698] / CVE-2017-0785. See also [https://info.armis.com/rs/645-PDC-047/images/BlueBorne%20Technical%20White%20Paper_20171130.pdf here].
| Bluetooth-sysmodule stack infoleak, which allows defeating ASLR (note: not tested on hw).
| [[5.0.0]]
| [[11.0.0]]
| Switch: December 2020
| Switch: December 25, 2020
| Switch: [[User:Yellows8|yellows8]]
|-
| [[Bluetooth_Driver_services|bluetooth]] GetAdapterProperty/SetAdapterProperty unchecked memcpy size
| GetAdapterProperty copies data from stack to the output buffer using the buffer size, without checking the size (when not handling the Name type). SetAdapterProperty copies data to stack from the input buffer using the buffer size, without checking the size.
This requires access to the btdrv service, only hid and btm have access.

This was fixed with [[12.0.0]] by replacing the buffer data with a fixed-size-struct.
| Stack infoleak with GetAdapterProperty, stack buffer overflow (and hence ROP) with SetAdapterProperty.
| [[12.0.0]]
| [[12.0.0]]
| July 17, 2020
| April 7, 2021
| [[User:Yellows8|yellows8]]
|-
| [[Bluetooth_Driver_services|bluetooth]] stack buffer overflow with HID DATA packets
| The BSA (bt-stack) func bta_hh_co_data copies data from a HID DATA packet to stack without checking the size, then sends it over Uipc. [7.0.0+] The user Uipc callback also copies the input data to stack without checking the size, then sends it to the sharedmem CircularBuffer.
With [12.0.2+] this was fixed in bta_hh_co_data by clamping the size to a maximum of 0x2BB. The aforementioned buffer overflow in the Uipc callback can't be triggered since at that point the size was already clamped.

Before this bta_hh_co_data func is reached, there is no validation of the size (such as comparing against the L2CAP MTU) when Basic Mode is being used.

Actually triggering this requires using a data-size larger than the normal L2CAP MTU. This can be done by for example, using raw HCI to send the packet from the remote bluetooth device.

Note that when the remote device is configured as an audio device for [12.0.0+] where [[Settings_services#BluetoothDevicesSettings|BluetoothDevicesSettings]].TrustedServices was only ever set for audio since system-boot, it is not possible for the remote device to connect to the Switch for HID.
| ROP under [[Bluetooth_Driver_services|bluetooth]] via HID DATA packet sent by a paired HID bluetooth device. This can be triggered at any time while not in sleep-mode, when not in airplane-mode. The earliest is while the Nintendo Switch logo screen is displayed during system boot.
| [[12.0.2]]
| [[12.0.2]]
| July-August 2020
| May 11, 2021
| [[User:Yellows8|yellows8]]
|-
| [[Bluetooth_Driver_services|bluetooth]] WriteHidData/WriteHidData2/SetHidReport unchecked memcpy size
| WriteHidData/SetHidReport copies the input struct to stack, then passes it to the funcptr/vfunc call. WriteHidData2 passes the input buffer addr directly to the funcptr/vfunc call. The called func eventually copies the input data to the stack struct using the specified size without validating it.
This requires access to the btdrv service, only hid and btm have access.

This was fixed with [[12.1.0]] in WriteHidData/SetHidReport by doing a fixed-size copy into another tmp struct, with the size field being clamped to a maximum of 0x2BB afterwards. This struct is then used when calling the vfunc. The vfuncs called by WriteHidData/WriteHidData2/SetHidReport were also updated to clamp the size to the required maximum value.
| Stack buffer overflow
| [[12.1.0]]
| [[12.1.0]]
| July 16, 2020
| July 6, 2021
| [[User:Yellows8|yellows8]]
|-
| Infoleak with [[HID_services|hid:sys]] SetButtonConfigStorage{name}Deprecated
| These cmds pass a stack ptr for the StorageName when calling the internal func. Nothing is written to this StorageName. Hence, stack infoleak (data is copied as a NUL-terminated string), which can be later read by the GetButtonConfigStorage{name} cmds.

This was fixed by removing the Deprecated cmds in [[13.0.0]].
| Infoleak of hid stack from a StorageName readable via GetButtonConfigStorage{name}, up to the NUL-terminator.
| [[13.0.0]]
| [[13.0.0]]
| December 11, 2020
| September 27, 2021
| [[User:Yellows8|yellows8]]
|-
| [[Bluetooth_Driver_services|bluetooth]] EventInfo infoleak
| The various funcs which send messages to the thread which handles writing to EventInfo, didn't clear the stack msgbuf. Hence, the various get-EventInfo cmds could return leaked stack data. This likely affected most (?) get-EventInfo cmds, besides CircularBuffer-GetHidReportEventInfo.

This only matters for events where there's uninitialized regions of the EventInfo, such as events with variable-size data without a memset.

This was fixed by clearing the msgbuf in a number of funcs.
| Bluetooth-sysmodule stack infoleak, which allows defeating ASLR
| [[13.0.0]]
| [[13.1.0]]
|
| During initial [[13.0.0|diff]]. Added to this page on: December 12, 2021
| [[User:Yellows8|yellows8]]
|-
| [[SSL_services|ssl]] CVE-2021-43527
| CVE-2021-43527, see also [https://bugs.chromium.org/p/project-zero/issues/detail?id=2237 here] and [https://googleprojectzero.blogspot.com/2021/12/this-shouldnt-have-happened.html here].
Using BigSig where the server cert sig is RSA-PSS results in the remote server throwing {no shared cipher} error when Switch connects. If however one creates a rootCA using BigSig (RSA-PSS), which then signs a server cert where the server key is RSA (not PSS), the vuln can be triggered (if the rootCA is trusted, via using the import service-cmd). It's unknown whether there's other ways to trigger the vuln.

The crash occurs in VFY_Begin when using the previously overwritten data. A bitsize of <code>$((16384 + 32 + 64 + 64 + 64))</code> is only enough to overwrite cx->hashcx, to fully overwrite cx->hashobj an additional 0xC-bytes (additional 96 bits) is needed.
Note that partial overwrite isn't an option: this is the func that initializes those fields to begin with, it just does deinit first before initializing hashcx/hashobj (prior to that these fields would be all-zero when not overwritten by the buf-overflow).
| Heap buffer overflow in [[SSL_services|ssl]], overwriting data including a ptr to an object which is later used to load a funcptr.
| [[13.2.1]]
| [[13.2.1]]
| Switch: December 1-2, 2021
| Switch: January 19, 2022
|
|-
| [[Bluetooth_Driver_services|bluetooth]] BSA gatt_process_notification stack buffer overflow
| gatt_process_notification is the GATT handler for processing notification/indication messages. gatt_process_notification does memcpy to stack from the input bt msg data, without size validation. The input len param isn't validated in this func either - if the remaining len following op_code is less than 2, a negative value will be used for the data copy to stack.
These were fixed by adding a bounds check for the size, size==0 is also checked for now.
| Bluetooth-sysmodule stack buffer overflow, with data received from a bluetooth message
| [[13.2.1]]
| [[13.2.1]]
| November 2021
| January 19, 2022
| [[User:Yellows8|yellows8]]
|-
| [[Applet_Manager_services#IDisplayController|AM IDisplayController]] TakeScreenShotOfOwnLayer OOB
| The captureBuf is used as an array index without validation. Data used from this array includes calling a funcptr from the array entry, if set. Eventually this is also used to write bools into this array, one of which is from the command input.
With [5.0.0+] a func is eventually called to get a ptr determined by the input captureBuf, with nullptr being returned for captureBuf>=0x10. The caller will Abort if nullptr was returned.
| OOB array access
| [[5.0.0]]
| [[13.1.0]]
| ~July 31, 2019
| January 26, 2022
| [[User:Yellows8|yellows8]]
|-
| [[Applet_Manager_services#IDisplayController|AM IDisplayController]] ClearCaptureBuffer OOB
| The captureBuf is used as an array index without proper validation. There is code validating it, but on failure it just skips over a code-block, with code using captureBuf still being used afterwards. Then this is used to write bools into a global array, one of which is from the command input.
This was fixed with [9.1.0+] by requiring captureBuf = 0-1.
| OOB bool writes into an array
| [[9.1.0]]
| [[13.1.0]]
| ~July 31, 2019
| January 26, 2022
| [[User:Yellows8|yellows8]]
|-
| [[Sockets_services|bsdsockets]] ioctl SIOCGIFCONF infoleak
| Originally bsd ioctl SIOCGIFCONF was handled by setting the data in IPC outbuf0 to the size/addr of IPC outbuf1. These buffers are HipcAutoSelect, so if buf1 is small enough for HipcPointer (otherwise it would be HipcMapAlias) the IPC-buf-ptr leaked into outbuf0 would be located in the codebin-region. Since this is done before the actual ioctl-handling, it doesn't matter whether the fd is valid.
This was fixed in [5.0.0+] by using a tmp struct on stack instead of buf0.
| bsdsockets-sysmodule codebin-region addr infoleak, which allows defeating ASLR.
| [[5.0.0]]
| [[13.1.0]]
| February 14, 2022 (probably earlier)
| February 14, 2022
| [[User:Yellows8|yellows8]], probably others
|-
| [[Sockets_services|bsdsockets]] ioctl SIOCGIFMEDIA input can contain ptr
| Originally bsd ioctl SIOCGIFMEDIA used the user-specified ifmediareq structure directly from the input buffer. This includes a ptr. This ptr probably isn't actually used?
With [5.0.0+] the structure used as input for the ioctl was changed to using <code>int ifm_ulist[1]</code> instead of <code>int *ifm_ulist</code> (which is unused). The input structure is copied to a tmp struct which is used as the original ifmediareq structure, with ifm_ulist always NULL. The user can still specify a non-zero ifm_count value, however that's not useful with ifm_ulist being always NULL.
| Useless?
| [[5.0.0]]
| [[13.1.0]]
| February 14, 2022
| February 14, 2022
| [[User:Yellows8|yellows8]], probably others
|-
| Infoleak with [[Joy-Con]] HidCommand PairingIn
| The joycon protocol handler for PairingIn copies data from stack to the response cmd-buf for sending PairingOut. Only the first byte is set to a type value, the rest is uninitialized stack data.

This was fixed with [15.0.0+] by directly writing to the response data without using stack data.
| Infoleak of hid stack via a bluetooth/uart message+response with a connected hid controller. This returns addrs for the main-codebin/stack, which allows defeating ASLR.
| [[15.0.0]]
| [[15.0.0]]
| September 4, 2020
| October 10, 2022
| [[User:Yellows8|yellows8]]
|-
| Broken RNG for [[RO_services|ro]] ASLR
| The RNG used to determine where to randomly map NROs in the target process was TinyMT (nn::os::detail::RngManager output, seeded by 128 bits of entropy). However, TinyMT is not cryptographically secure (and can in fact be analytically solved).

Thus, with a few NRO mapping addresses, one could learn the TinyMT state and derive all previous/future RNG outputs, breaking NRO aslr for all processes.

With [15.0.0+] ro now uses csrng_GenerateRandomBytes to determine the random map address for NROs.
| Breaking ASLR for all NROs loaded in all processes, allowing predicting all NRO mappings for all processes until the next reboot.
| [[15.0.0]]
| [[15.0.0]]
| Late 2021/Early 2022
| October 11, 2022
| Everyone
|-
| Broken RNG used by [[NS_Services|ns]]
| The code generating the sd seed and the data for the [[SD_Filesystem|sd]] private/private1 file, all use nn::os::GenerateRandomBytes, not csrng. The sd-seed is generated first, then private, then private1. This allows deriving sd-seed from private since this uses TinyMT, as long as the system shipped from factory on [2.0.0+]. private1 is only useful if the system shipped with [4.0.0+].

There's various other code in ns using nn::os::GenerateRandomBytes as well. This includes the code generating ns_systemseed when it doesn't exist. ns_systemseed is generated at some point after the various sd-seed-related code (both are called from the same func). Hence, ns_systemseed can be recovered with the above method as well, if it wasn't recreated at some point without regenerating the above nand-save used with the above.

With [15.0.0+] ns now uses csrng_GenerateRandomBytes for sd-seed/private and ns_systemseed, etc. This only matters when the file is newly generated, which is usually only for factory-fresh systems which ship with this version. This would also apply after being deleted during {System Settings -> Formatting Options -> Initialize Console}, and also with a refurbished console.
| Generation of a system's sd-seed allowing decryption of the NAX0 layer of data on [[SD_Filesystem|SD]], derived using the private file from SD. Applies to systems which factory-shipped with a system-version prior to [[15.0.0]] (that is, [2.0.0-14.1.2]).
| [[15.0.0]], for newly generated files
| [[15.0.0]]
| December ~12, 2021
| October 11, 2022
| [[User:Yellows8|yellows8]]
|-
| [[Bluetooth_Driver_services|bluetooth]] BSA bsa_sv_av_cback stack buffer overflow
| bsa_sv_av_cback checks for two input type values (0xC/0xD), on match it copies the input data to stack without size validation. Then it sends an internal request with this data (likewise when the type values don't match, except the input data is passed directly with a small size), then it returns.
This requires the AV functionality added with [13.0.0+], however this func is only reachable with [14.0.0+] where the required functionality was enabled.

This requires message data that's larger than the MTU, so fragmentation must be used, or manually send the ACL data to bypass the MTU.

This can be triggered via an AVRC message with opcode=0x0 (vendor). The above type 0xC is reached via AVRC ctype 0..4, while 0xD is reached with ctype>=0x9.

With [15.0.0+] the size value for the memcpy (which is also written to the request struct) is clamped to a max value.
| Bluetooth-sysmodule stack buffer overflow on [14.0.0-14.1.2], with data received from an AVRC bluetooth message with a bluetooth-audio device.
| [[15.0.0]]
| [[15.0.0]]
| November 2021
| October 11, 2022
| [[User:Yellows8|yellows8]]
|-
| [[WLAN_services|wlan]] SetMulticastList heap buffer overflow
| The [[WLAN_services#SetMulticastList|SetMulticastList]] command allocates a 0x31-bytes sized buffer and copies to it as much [[WLAN_services#MacAddress|MacAddress]] values from the input [[WLAN_services#MulticastList|MulticastList]] as specified by the "Count" field, but this field is never validated.

With [15.0.0+] error code 0x1906B is now returned if "Count" is larger than 8.
| wlan-sysmodule heap buffer overflow.
| [[15.0.0]]
| [[15.0.0]]
| June 6, 2022
| November 9, 2022
| [[User:Hexkyz|hexkyz]]
|-
| [[Bluetooth_Driver_services|bluetooth]] WriteGattCharacteristic/WriteGattDescriptor stack buffer overflow regression
| Originally btdrv WriteGattCharacteristic/WriteGattDescriptor (bt service LeClientWriteCharacteristic/LeClientWriteDescriptor are the same) validated the input buffer size. However the size check was removed with [12.0.0+] (which was also when bluetooth was refactored), hence stack buffer overflow. Anything with btdrv/bt services access can trigger it. While this is intended to require a BLE connection, it seems to be possible to trigger the buffer overflow without any BLE connection by passing ConnectionHandle=0xFFFFFFFF (handle not tested on hardware).
| Bluetooth-sysmodule stack buffer overflow on [12.0.0-15.0.1], with data from BLE IPC cmds.
| [[16.0.0]]
| [[16.0.0]]
| December 10, 2021
| February 23, 2023
| [[User:Yellows8|yellows8]]
|-
| [[JIT_services|JIT]] usability issues
| CreateJitEnvironment will enter infinite-loops using nn::jitsrv::detail::AslrAllocator::GetAslrRegion when either of the input CodeMemory sizes are zero. Also the second CodeMemory is useless for the user-process since the second addr returned by GetCodeAddress is a dup of the first one, set during state init by CreateJitEnvironment.
With [14.0.0+] size=0 is now properly handled, and also the state for the second addr from GetCodeAddress is now properly initialized.
| Minor usability issues, not useful for exploitation (size=0 will cause jit-sysmodule to hang in a loop).
| [[14.0.0]]
| [[14.0.0]]
| October 1, 2020
| February 26, 2023
| [[User:Yellows8|yellows8]]
|-
| [[USB_services|usbhs]] uninitialized IClientEpSession
| usbhs IClientIfSession OpenUsbEp creates an IClientEpSession object. The allocated object from ExpHeap is not memset, only select fields are cleared. The rest of initialization is done by PopulateRing - however the user-process could skip using that if wanted (official sw always uses it).

ShareReportRing maps tmem and writes the ring buffer/count field into object state. PopulateRing also eventually initializes these fields, with the buffer being allocated from ExpHeap instead of tmem. These fields are not cleared during object creation from OpenUsbEp.

GetXferReport after validating the cmd input, just uses object state assuming it was initialized. This runs code which is the same as the user-process code handling the tmem ringbuf.

Therefore, by skipping using PopulateRing and then using GetXferReport the sysmodule will use an uninitialized ringbuf ptr, and an uninitialized count field. If one could control these fields by doing ExpHeap allocations prior to OpenUsbEp so that {target fields} would be located at {IClientEpSession ring fields}, then one could read usb-sysmodule memory at the target buffer address.

See [[USB_services#ShareReportRing|here]] for ringbuf format. The sysmodule will Abort if read_index is >= {ring count field from object state}. Otherwise it copies an entry from that index to output, and updates read_index.

This is probably tricky to abuse as the ringbuf ptr has to be valid, and {see above} (likewise for write_index when the report-ringbuf-writing func runs).

PostBufferAsync/BatchBufferAsync also use seperate object ring fields which are left uninitialized from OpenUsbEp. Targeting this would be tricky with the ring restrictions - this would allow writing data to a ring addr however.

Pre-4.0.0 (only 2.0.0 checked) is not affected by these. The ring fields in the object are cleared during object creation (no memset of the entire object however). GetXferReport would null-deref if PopulateRing was skipped. PostBufferAsync/BatchBufferAsync will throw an error if PopulateRing was skipped. Pre-4.0.0 also has different ring handling as well.

[16.0.0+] The IClientEpSession init func now clears the remaining previously uninitialized fields. The cmds using the ring fields still don't check for NULL, so using GetXferReport/PostBufferAsync/BatchBufferAsync without PopulateRing will just trigger null-deref. Even if the ptr were somehow valid but ring-count field was left at 0, this would then Abort due to: <code>if (ring_count <= index_loaded_from_ringptr) <Abort></code>
| [4.0.0-15.0.1] If one can trigger using {target values} as the unintialized fields: memory reads from the target addr with GetXferReport, and memory R/W with PostBufferAsync/BatchBufferAsync. This requires access to usb:hs, and an usb device must be connected which is not being used by {other sessions}. If successful, this might (?) result in usb-sysmodule compromise.
| [[16.0.0]]
| [[16.0.0]]
| January 30, 2023
| February 26, 2023
| [[User:Yellows8|yellows8]]
|-
| [[NS_services|ns]] RequestMoveApplicationEntity/EstimateSizeToMove buffer overflow
| ns RequestMoveApplicationEntity eventually calls a func which: Loops through the input buffer. If any entry has value 6, it will call another func to copy data from state to output safely (uses the max_count param). Otherwise, it copies the input buffer to an outbuf (located on caller's stack) without any size validation (inlined memcpy), even though there is a max_count param.

Additional memwrites are also done to the above outbuf following the initial memcopy. This can be avoided if the buffer doesn't contain bytes with values 3-6 (if using values in that range is really needed, the cmd input StorageId param can be set to the required value so that the specified value doesn't trigger the memwrite). Value 6 shouldn't be used anyway (see above).

ns EstimateSizeToMove first calls the same func which does the copy above (outbuf is also located on stack), then it calls another func. Hence, same vuln here.

By corrupting just the first byte of x29 with EstimateSizeToMove, one can obtain infoleaks. This method with x29 essentially only works with [15.0.0+]. Pre-15.0.0 would require a different method with partial overwrite of retaddr, however it's unknown whether this would actually work for infoleak (would require [12.0.0+] for the stack layout change).
With EstimateSizeToMove where x29 is overwritten, the output u64 is the leaked ptr (can be codebin-region). Note that the cmd has to return Result=0 for this to work. x29 is used to load the value which is copied to the cmdreply rawdata.

As of [17.0.0+] an error is thrown if the input array count is larger than 8 (size of the stack dst-array).
| ns-sysmodule stack buffer overflow, allowing ns infoleak+ROP.
| [[17.0.0]]
| [[17.0.0]]
| January 2, 2023
| October 17, 2023
| [[User:Yellows8|yellows8]]
|-
| [[PSC_services|ovln:snd]] OpenSender unvalidated count
| ovln:snd OpenSender has a count param. This count is used to allocate the specified number of objects in a linked-list for storing the data from Send. If count is 0, the linked-list is left empty, with ptrs to itself within the ISender object.

ISender Send when the above linked-list is empty, runs a switch-statement with <code>(inval>>8)&0xFF</code>. This uses another linked-list where the ptrs are initially {within ISender obj}.
No space is allocated in the ISender obj for the linked-list object-data. Therefore using Send with val 1<<8 or 2<<8 (other values throw error) results in the specified input struct being copied into the ISender obj, which then overwrites heap data OOB.
If for example one used OpenSender again right after the first OpenSender usage, then used Send as described above, this would corrupt the second ISender which includes overwriting the vtable.
If one would use Send twice in a row like this, the second one would use a corrupted linked-list (written from the first Send). If the linked-list ptrs would be valid (no crash triggered) this would allow one to copy the input data to a controlled addr, though it's restricted with the linked-list usage.

Using GetUnreceivedMessageCount afterwards is of no interest.

Besides ovln, the only other allocs on this heap is from IPmModule Initialize. This heap is also used for psc:* services (object allocs).

In theory (untested) it may be possible to also use this to obtain infoleaks, however it would only return the high-u32 of ptrs not the low u32. Essentially, one would trigger object allocations so that ExpHeap has layout: {ISender} -> {RF chunk from freeing an object} -> {module object from IPmModule Initialize}. Then one would use the Send vuln to corrupt the RF chunk, changing the size to a larger value. Then one would trigger an object allocation (probably same object which was previously freed), then another object for overwriting the module object (ISender would work) with ptrs at the target offsets in the module object. Then once IPmModule GetRequest is used, the returned u32s would be the high-u32 from ptrs. Due to alignment requirements with each allocation, it isn't possible to shift the allocations in order to leak ptr low-u32.

[17.0.0+] Now throws an error if the input count for OpenSender is 0.
| [[PSC_services|psc]]-sysmodule heap memory corruption ([[NS_services|ns]]-sysmodule on pre-8.0.0).
| [[17.0.0]]
| [[17.0.0]]
| January 13, 2023
| October 20, 2023
| [[User:Yellows8|yellows8]]
|-
| [[NV_services|nv]] NVGPU_GPU_IOCTL_GET_CHARACTERISTICS Ioctl3 infoleak
| The handler code for NVGPU_GPU_IOCTL_GET_CHARACTERISTICS for Ioctl/Ioctl3 are essentially the same, except for the value used for the max-size clamp: Ioctl uses constant 0xA0, while Ioctl3 uses the outbuf1_size. So if one uses this with Ioctl3 and a large outbuf1, this will memcpy data OOB from the source buffer, hence infoleak.
With [17.0.0+] the second block of csel code which previouly essentially used the clamped size from above, was replaced with code which properly clamps to the max-size constant.
| nvservices-sysmodule infoleak, which allows defeating ASLR.
| [[17.0.0]]
| [[17.0.0]]
| February 25, 2022
| October 24, 2023
| [[User:Yellows8|yellows8]]
|-
| [[Audio_services|audctl]] GetTargetDeviceInfo infoleak
| audctl GetTargetDeviceInfo calls an impl func with a ptr to a stackbuf, then if successful memcpys the 0x100-bytes from that buffer to output. This stackbuf is not memset. This func (after doing various state checks) copies a string to output, other than always writing a NUL-terminator there's no clearing of the buffer.

This will leak audio-sysmodule stack into the output buffer as long as the state/input checks pass (for the remainder of the buffer following the string NUL-terminator).

With [18.0.0+] data is written directly to the outbuf instead of the stack tmpbuf.
| audio-sysmodule infoleak, which allows defeating ASLR.
| [[18.0.0]]
| [[18.0.0]]
| December 24, 2022
| March 26, 2024
| [[User:Yellows8|yellows8]]
|-
| [[Audio_services|audctl]] GetSystemInformationForDebug infoleak / buffer overflow
| audctl GetSystemInformationForDebug calls a func with a 0x1000-byte stack tmpbuf, then afterwards that buffer is memcpy'd into the cmd outbuf. This called func doesn't clear the buffer. This func eventually uses [[BTM_services|btm]] cmd75 with outarray={global ptr} and count=10. Then if the outcount is s32 >=1, it loops through the output using the outcount, without validating it besides the <1 check. Data from that outarray is copied into the array in the func output buffer (tmpbuf above).

With btm comprimised, one could return a large output count and trigger a stack buffer overflow with data following that global array, however exploiting this would be difficult since that data would be uncontrolled (can't directly control it from this cmd at least).

A stack infoleak can be obtained with this as well (assuming the above output array isn't full).

Even though the name has "ForDebug", there's no checks which would trigger an error / return early (this also always returns 0).

[18.0.0+] now clears the output buffer, and also now prints strings into the buffer instead of writing binary data (overflow no longer possible).
| audio-sysmodule infoleak, which allows defeating ASLR. Also audio-sysmodule memory corruption, likely not useful unless there's a way to control the data.
| [[18.0.0]]
| [[18.0.0]]
| December 7, 2022
| March 27, 2024
| [[User:Yellows8|yellows8]]
|-
| [[Migration_services|migration]] nn::migration::savedata::IServer cmd1 buffer overflow
| nn::migration::savedata::IServer cmd1 with [18.0.0-18.0.1] copies data from an array to the output ptr. As the output is an u64 field for the IPC cmd output, this is a field on stack. Hence, if more than 1 entry (8-bytes) are copied a stack buffer overflow will occur. Note that cmd3 loads the same data, except this has a proper output array.
It's unknown whether there's a way to actually control this data with a large enough enough size.

See [[18.1.0]] for the diff/fix.
| [[Migration_services|migration]] stack buffer overflow, only on [18.0.0-18.0.1].
| [[18.1.0]]
| [[18.1.0]]
| June 11, 2024
| June 11, 2024
| [[User:Yellows8|yellows8]] (sysupdate diff)
|-
| [[SSL_services|ssl]] broken RNG
| [[SSL_services|ssl]] uses nn::os::GenerateRandomBytes, but not [[SPL_services|spl]] GenerateRandomBytes. See the RNG entries elsewhere. This is used to seed the NSS global RNG (drbg.c, RNG_GenerateGlobalRandomBytes etc).

If one could somehow determine the data which was returned by nn::os::GenerateRandomBytes during seeding (which is likely difficult), the global RNG would be broken.

With [19.0.0+] nn::os::GenerateRandomBytes usage was replaced with [[SPL_services|spl]] GenerateRandomBytes.
| Breaking [[SSL_services|ssl]] global RNG -> potentially predict RNG data (keys(?)) during TLS comms.
| [[19.0.0]]
| [[19.0.0]]
| December 14, 2021
| October 8, 2024
| [[User:Yellows8|yellows8]]
|-
| [[Audio_services|audren]] uncleared TransferMemory
| audren OpenAudioRenderer uses the input tmem as workmem. The IAudioRenderer dtor doesn't clear the workmem properly. Depending on input params, certain objects stored here have vtables - hence infoleak.
The exact location in the workmem will vary depending on the input params - these objects are dynamically allocated in the workmem.
The following will leak vtables: Sink, Effect.

If the initialization func fails, the tmem is unmapped without clearing it first. It's unknown whether there's a way to actually trigger an infoleak with this however. With [19.0.0+] it's now cleared on failure.

With [19.0.0+] the dtor now clears the workmem when needed.
| Reading leaked data/ptrs from TransferMemory -> defeating ASLR in [[Audio_services|audio]]-sysmodule.
| [[19.0.0]]
| [[19.0.0]]
| December 17, 2022
| October 13, 2024
| [[User:Yellows8|yellows8]]
|-
| [[Audio_services|audren]] UpdateMixes OOB mem-copy
| With nn::audio::server::InfoUpdater::UpdateMixes when nn::audio::server::BehaviorInfo::IsMixInParameterDirtyOnlyUpdateSupported() returns true (requires REV7, which is [7.0.0+]), the mix_id from user input is used without validation as input to <code><nn::audio::server::MixContext::GetInfo(int) const></code>, instead of the counter from the for-loop. This allows one to control the destination MixInfo index which the user-input data is written into. If too large, this will trigger OOB data-copy. Note that the u8 at dest_MixInfo+12 must be non-zero.
Also note that a field is loaded from dest_MixInfo which is used as a splitter_id, so splitters need to be initialized where count is large enough for that id.

With [19.0.0+] after getting the mix_id (loop-index/input) it now does: <code>if (mix_id < 0 || mix_id >= nn::audio::server::MixContext::GetCount()) continue;</code>
| OOB mem-copy in [[Audio_services|audio]]-sysmodule, which for example can be used to overwrite a vtable used immediately after UpdateMixes.
| [[19.0.0]]
| [[19.0.0]]
| December 19, 2022
| October 13, 2024
| [[User:Yellows8|yellows8]]
|-
| [[Bus_services|sasbus]] StartPeriodicReceiveMode infoleak
| StartPeriodicReceiveMode writes a vtable ptr into the mapped tmem at +0. The tmem is mapped RW in the user-process. There is no clearing of tmem during tmem cleanup. Hence, the user-process can read the tmem to obtain a Bus-sysmodule codebin-region infoleak. This vtable-ptr seems to be unused - it's also empty after the first two entries (stubbed incref/decref).
[20.0.0+] Removed the vtable ptr, with data intended for the user-process being moved from tmem+0x8 to +0x0. Also, instead of calling memset, funcs are called for manually clearing tmem.
| Bus-sysmodule infoleak, which allows defeating ASLR.
| [[20.0.0]]
| [[20.0.0]]
| February 22, 2022
| May 3, 2025
| [[User:Yellows8|yellows8]]
|-
| [[NFC_services|nfc]] SendCommandByPassThrough buffer overflow
| SendCommandByPassThrough eventually copies the input buffer into a fixed-size heap buffer, without size validation.
This was fixed with [20.0.0+] by clamping the size.
| nfc-sysmodule heap buffer overflow.
| [[20.0.0]]
| [[20.0.0]]
| Late November 2021
| May 3, 2025
| [[User:Yellows8|yellows8]] (maybe others?)
|-
| [[HID_services|hidbus]] EnableJoyPollingReceiveMode infoleak
| The tmem initialized by hidbus EnableJoyPollingReceiveMode contains a vtable ptr (tmem+0x10), hence infoleak. With [20.0.0+] the vtable ptr write was removed, and tmem is now memset starting at tmem+0x10 instead of +0x20.
| hid-sysmodule infoleak, which allows defeating ASLR.
| [[20.0.0]]
| [[20.0.0]]
| March 2020
| May 4, 2025
| [[User:Yellows8|yellows8]]
|-
| [[SSL_services|ssl]] Certificate verification bypass
| The ssl sysmodule keeps a list of trusted certificates, that are imported by an app with ImportServerPki. During certificate verification, if the certificate that is provided by the server has the same subject key id as a trusted certificate, the certificate is accepted, even if self-signed. A blog post about this vulnerability can be found [https://reversing.live/sslbypass.html here].
| Man-in-the-middle for any connection that uses ImportServerPki.
| [[20.2.0]]
| [[20.2.0]]
| June 6, 2025
| August 8, 2025
| [https://github.com/kinnay Yannik]
|-
| [[LDN_services|ldn]] AdvertiseData OOB-memcpy with EncryptionType3 (AES-128-GCM) actionframes (ldnhax)
| The ldn action-frame parser object for AES-128-GCM (used with [[LDN_services|EncryptionType3]]), when it does validation once finished, only verifies that the sizes are within bounds of the input buffer. There's no validation against constants, which the other EncryptionType objects have. The caller code doesn't validate the size either.

[21.0.0+] Now validates the advert-size with sizeof(NetworkInfo.AdvertiseData).

For more details see [https://gist.github.com/yellows8/16bb56343d085d2db2ab0adc5d4cef99 here].
| Compromise of ldn starting from OOB-memcpy, even on S2: stack infoleak (ASLR defeat), arbitrary memory read/write (which also allows handle-leak), vfunc-calls with arbitrary [[Security_Mitigations|vtable]].
| [[21.0.0]]
| [[21.0.0]]
| June ~13, 2025
| November 11, 2025
| [[User:Yellows8|yellows8]]
|-
| [[HID_services|hid:dbg]] AttachHdlsVirtualDevice unvalidated DeviceTypeInternal
| hid:dbg AttachHdlsVirtualDevice eventually passes the input from HdlsDeviceInfo into a func without any validation. The DeviceTypeInternal field is used as the index for loading a ptr from a global array. The only validation occurs when the loaded ptr is NULL - this is just for initializing the ptr in the array when it's not already set.

Since the highest DeviceTypeInternal is value 30, using >=31 will load an OOB ptr. This ptr is written to state, and also immediately passed to a called func. As long as ptr is valid it should be fine with this func.

This functionality is also used eventually by ApplyHdlsNpadAssignmentState and ApplyHdlsStateList.

It's unknown whether there's a way to exploit this. Also note that hid:dbg is not normally accessible to retail titles.

[21.0.0+] Arrayindex=0 is now used when the input is invalid.
| Likely useless, even if reachable?
| [[21.0.0]]
| [[21.0.0]]
| June 3, 2024 (possibly eariler(?))
| November 14, 2025
| [[User:Yellows8|yellows8]]
|-
| [[Bluetooth_Driver_services|bluetooth]] BSA allowed ATT MTU is too large
| GATT-handler stack buffer overflows with a large input size are only possible if the payload_size (MTU) field in state is large enough. gatt_client_handle_server_rsp/gatt_server_handle_client_req will drop messages where the size is >= payload_size (though unless the request opcode matches certain values it will also send an error-response for invalid-PDU). Both of these handle updating this field when needed, however that's handled properly.

With bluetooth-classic via L2CAP, a hard-coded MTU of 0x205 is sent in the configure request. However the code handling received configure requests will set payload_size to 0x2A0 if no MTU is specified, or the input MTU if it's within range 0x30..0x2A0. Hence, sending data large enough for buffer overflows requires bluetooth-classic via L2CAP + manually sending large ACL data.

[15.0.0+] gatt_l2cif_config_ind_cback which handles the received configure-requests with bluetooth-classic mentioned above, now uses MTU range 0x30..0x205 with the default MTU being 0x205. It is therefore no longer possible to trigger the previously mentioned buffer-overflows with bluetooth-classic.
| Stack buffer overflows in bluetooth-sysmodule due to the allowed MTU for ATT being larger than the stack data.
| [[15.0.0]]
| [[20.0.0]]
| November 2021?
| November 26, 2025
| [[User:Yellows8|yellows8]]
|-
| [[Bluetooth_Driver_services|bluetooth]] BSA gatt_process_prep_write_rsp stack buffer overflow
| BSA gatt_process_prep_write_rsp memcpys to stack without size validation (the input len param which is subtracted to determine the copy-size is also unvalidated). Triggering this is only possible if the system sent ATT_PREPARE_WRITE_REQ, and then received ATT_PREPARE_WRITE_RSP with a large size.

The size used with memcpy is (u16)(insize-4), so when insize is less than 4 the copy size will be {negative value masked to u16}. This will therefore eventually crash when the stacktop is reached during memcpy.

[15.0.0+] Paritially fixed due to corrected MTU handling (doesn't apply to negative-copysize). [21.0.0+] Fully fixed with proper size validation.
| Stack buffer overflow in bluetooth-sysmodule when the required ATT messages are sent/received.
| [[21.0.0]]
| [[21.0.0]]
| November 2021?
| January 19, 2026
| [[User:Yellows8|yellows8]]
|-
| [[NFC_services|nfc]] Initialize buffer overflow
| All Initialize* cmds for nn::nfc::detail::IUser (nfc:user), nn::nfc::detail::ISystem (nfc:sys), nn::nfp::detail::IUser (nfp:user), nn::nfp::detail::ISystem (nfp:sys), nn::nfp::detail::IDebug (nfp:dbg), nn::nfc::mifare::detail::IUser (nfc:mf:u): these copy the input array into _this, without validating the array count.
The data is copied to obj_impl+0x8+0x28, with each entry being 0x20-bytes. The event handle returned by AttachAvailabilityChangeEvent is at obj_impl+0x8+0xB8+0x14 (Same with nfc/nfp interfaces). This therefore means +0xA4 in the input buffer will overwrite the handle returned by that cmd, allowing one to leak any handle with the specified value. This can be done with count=0x6. The object is large enough that this count will only overwrite data within the current object. However during the dtor it will use ptrs which were corrupted with this (located before the event), so one must avoid closing the session unless the input data included valid ptrs.

This can be exploited by just using a 0xC0-byte (array_count=0x6) input buffer with Initialize where each u32 is the target nfc handle value, then using cmd GetAvailabilityChangeEventHandle to leak the handle.

[22.0.0+] This was fixed by clamping the count to a maximum of 0x4.
| OOB datacopy into object state. Allows leaking arbitary [[NFC_services|handles]], including on [S2] (such as process-handle, sm, fsp-srv (remaining services can also be used via sm)).
| [[22.0.0]]
| [[22.0.0]]
| November 2021
| March 17, 2026
| [[User:Yellows8|yellows8]]
|}

== Internet Browser ==
{| class="wikitable" border="1"
! Summary
! Description
! Successful exploitation result
! Fixed in system version
! Last system version this flaw was checked for
! Timeframe this was discovered
! Public disclosure timeframe
! Discovered by
|-
| CVE-2016-4657
| WebKit vuln discovered around August 2016. Most notably used in the iOS 9.3.X exploit. A simple PoC can be found [https://github.com/LiveOverflow/lo_nintendoswitch/blob/master/poc1.html here]. This was later exploited by [https://twitter.com/qwertyoruiopz Qwertyoruiop] using an adjusted version of his iOS 9.3 webkit exploit (others exploited this prior to then).
|
| [[2.1.0]]
| [[2.0.0]]
| Original: August 2016
Switch: March 3rd-4th 2017
|
| Everyone
|-
| CVE-2017-7005
| WebKit type confusion.
|
| [[3.0.1]]
| [[3.0.1]]
|
|
| Everyone
|-
| CVE-2016-4622
| WebKit memory corruption bug. This bug was incorrectly re-introduced in [[4.0.0]]. See [http://www.phrack.org/papers/attacking_javascript_engines.html here] for a detailed write-up from the author.
|
| [[6.1.0]]
| [[6.1.0]]
|
|
| Everyone
|-
| CVE-2018-4441
| WebKit memory corruption bug. See [https://bugs.chromium.org/p/project-zero/issues/detail?id=1685&desc=2 here].
|
| [[7.0.0]]
| [[7.0.0]]
|
|
| Everyone
|-
| Web-applets OpenSSL broken RNG
| [[SPL_services|csrng]] access was added to web-applets with [12.1.0+]. Prior to that, csrng and nn::os::GenerateRandomBytes were not used (besides sdk heap code).
nn::os::GetSystemTick is used to seed the OpenSSL RNG, among other data. Hence, it's probably (?) possible to bruteforce the RNG initial state, allowing predicting RNG output.

The RNG code is wkcRandomNumbersPeer (peer_wkc nro), with the initialization code using GetSystemTick located in the func immediately before wkcGetTickCountPeer. The former is called from wkcOsslRandFilefReadPeer. wkcOsslRandFilefReadPeer is called for seeding the OpenSSL RNG.

With [12.1.0+], wkcRandomNumberPeer/wkcRandomNumbersPeer wrap nn::os::GenerateRandomBytes. wkcCryptographicallyRandomValuesPeer was added which wraps nn::crypto::GenerateCryptographicallyRandomBytes. wkcOsslRandFilefReadPeer now calls nn::crypto::GenerateCryptographicallyRandomBytes instead of wkcRandomNumbersPeer.
| Breaking web-applets OpenSSL RNG -> potentially predict RNG data (keys(?)) during TLS comms.
| [[12.1.0]]
| [[12.1.0]]
| January 28, 2022
| October 8, 2024
| [[User:Yellows8|yellows8]], likely (?) others
|}

=== Whitelist ===
This section documents [[Internet_Browser|WebApplet]] whitelist issues in applications. These can be used to load your own browser content over plain HTTP, which then for example could be used for web-applet exploitation.

{| class="wikitable" border="1"
! Application
! Description
! Fixed with app version
! Newest app version this flaw was checked for
! Timeframe this was discovered
! Public disclosure timeframe
! Discovered by
|-
| Sonic Mania
| Originally this game launched web-applet with a plain-http URL for displaying the manual, this was later changed to https. Originally the whitelist only had 1 entry for a http URL, this was later replaced with various https-only URLs.
| 1.04, unknown if fixed with an earlier update
| 1.04
| January (?) 2022
| February 23, 2022
| [[User:Yellows8|yellows8]]
|-
| ぷよぷよ™テトリス®Ｓ (JPN Puyo Puyo Tetris)
| The JPN Tetris game/demo can be used to launch the online-WebApplet.

First, launch the offline-WebApplet for the manual:
* Game: Main-menu -> press A with the already selected top menu button -> press the R button.
* Demo: Main-menu -> select menu button on the right side -> press A.

Then in the manual:
* Press A -> select the bottom menu entry in the list.
* Select the SEGA icon -> press A.

This will then trigger launching the online-WebApplet with the plain-http <nowiki>"http://sega.jp/"</nowiki> URL.

With game-update v1.1.3 the whitelist no longer allows plain-http. The plain-http links appear to have been changed to https.
| 1.1.3
| 1.1.3
| 2017
| 2017
| [[User:Yellows8|yellows8]]
|}

== NintendoSDK ==
This section documents vulnerabilities for NSOs in NintendoSDK.

=== nnSdk ===
This section documents vulnerabilities for nnSdk (sdknso).

{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in SDK [[System_Versions|version]]
! Last SDK version this flaw was checked for
! Timeframe this was discovered
! Public disclosure timeframe
! Discovered by
|-
| [[HID_services|hidbus]] GetJoyPollingReceivedData buffer overflow
| hidbus GetJoyPollingReceivedData doesn't validate the u8 size used for memcpy, when copying the data to the output JoyPollingReceivedData. With 11.x, the size is now clamped to a maximum of 0x2C (regardless of polling-mode). Note that 0x2C is the data-size for JoyButtonOnlyPollingDataAccessor, the other polling-modes have a smaller size.

The hid-sysmodule code which writes data here does handle it properly: size is clamped to a max size, and the data-read uses a fixed-size anyway (hence there's no way to trigger this sdknso vuln with the hid-sysmodule tmem writing code).

This could only be exploited if one directly writes to the tmem when one has previously compromised hid-sysmodule, without using the normal tmem-writing func for this.

There are only a few [[HID_services#ExternalDevices|apps]] which use hidbus.
| Triggering a buffer overflow in an application which uses hidbus GetJoyPollingReceivedData, from a previously compromised hid-sysmodule.
| 11.x.0
| 11.4.0
| March 2020
| December 3, 2020
| [[User:Yellows8|yellows8]]
|-
| [[Profile_Selector|Profile Selector]] uninitialized input data
| Originally unused regions of [[Profile_Selector]] UiSettings/UserSelectionSettings were not cleared prior to being sent to the applet. With 1.x.x these are now properly memset().
| Stack infoleak from user-process, sent to the applet.
| 1.x.x
| 11.4.0
| November-December 2019
| December 31, 2020
| [[User:Yellows8|yellows8]]
|}

=== NEX ===
This section documents client-side vulnerabilities for [https://github.com/Kinnay/NintendoClients/wiki/NEX-Overview-(Game-Servers) NEX].

{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in version
! Timeframe this was discovered
! Public disclosure timeframe
! Discovered by
|-
| Buffer overflow in StringConversion::T2Char8
| StringConversion::T2Char8 is used to convert IP addresses from a platform-specific encoding to UTF-8. On the 3DS and Switch, the implementation is simply a strcpy. By sending a long IP address string, a buffer overflow can be triggered on the stack. The vulnerability can be triggered through the NAT traversal protocol. A blog post about this vulnerable can be found [https://reversing.live/hacking-hundreds-of-wii-us-at-once.html here].
| Stack overflow in any game that uses NEX for matchmaking
| Fixed server-side
| December, 2022
| May, 2024
| [https://github.com/kinnay Yannik]
|}

=== Pia ===
This section documents vulnerabilities for [https://github.com/Kinnay/NintendoClients/wiki/Pia-Overview Pia].

In v5.11.3 (exact starting version unknown) the fixes aren't present for the below vulns which were fixed in v5.9.3, while in v5.18.98 these are present (exact starting version unknown). This probably indicates that the vuln fixes were backported from a newer Pia version to v5.9.3.

The Pia packet handlers are only active when the game is using multiplayer. LanProtocol is only active in the games which are actively using the LAN-mode option (not Ldn) - only certain games support LAN-mode. The LanProtocol Pia packet handler can be reached while in a lobby or searching for one.

Most Pia packets require an active StationProtocol connection to be active with {InetAddr which the packet was received from}, otherwise the packet is filtered out. The only protocols which don't use filtering are the following: NatTraversalProtocol, LanProtocol, StationProtocol, LocalProtocol.

Note that broadcast IP-dest Pia packets are accepted - this can be used to target every device on the network which is using Pia (which is really only useful with {above protocols} due to the filtering mentioned above, unless one also handles StationProtocol).

{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in Pia version
! Last Pia version this flaw was checked for
! Timeframe this was discovered
! Public disclosure timeframe
! Discovered by
|-
| nn::pia::session::RelayRouteManageJob::UpdateConnectionReport buffer overflow
| nn::pia::session::RelayRouteManageJob::UpdateConnectionReport() checks that the input size is at least {value}, but there's no max size check. This is used to memcpy from the input to elsewhere - hence buf-overflow if size is too large. The dst buffer is allocated on the pead heap - this buffer is probably small.
Note that there's various requirements before it would actually reach the memcpy, such as <code><nn::pia::session::Mesh::IsHost() const></code> must return true.

This is called from nn::pia::session::MeshProtocol::ParseConnectionReport().

ParseConnectionReport uses a state ptr for object nn::pia::session::RelayRouteManageJob, it will return if not set. nn::pia::session::Mesh::Initialize handles setup for this, depending on an input field from nn::pia::session::Mesh::Setting. These settings originate from <code><nn::pia::session::Session::CreateInstance(nn::pia::session::Session::Setting const&)></code>, which is called by user-code with the needed settings.
ParseConnectionReport is therefore only usable if the game explicitly enables the Relay functionality.

In fixed versions immediately after the StationIndex validation it now does: <code>if(statefield+0x10<input_size) return;</code>
| Heap buffer overflow triggered by a Pia MeshProtocol message sent to a host device.
| v5.9.3, see above.
| v5.9.1/v5.9.2/v5.9.3
| November 11, 2022
| November 15, 2022
| [[User:Yellows8|yellows8]]
|-
| nn::pia::lan::LanProtocol::ParseSessionMessage buffer overflow
| nn::pia::lan::LanProtocol::ParseSessionMessage() calls nn::pia::lan::LanSessionMessage::Deserialize() to deserialize the message payload data buffer into the LanSessionMessage object on stack. LanSessionMessage::Deserialize (among other things) memcpys data from the input buffer to the object, using an u32 from the input buffer - there is no size validation in Deserialize itself.
There is a size check immediately after calling Deserialize() to verify <code>payloadsize=={u32val}+{constant}</code>, returning on fail - but this doesn't matter for too-large-size.

In fixed versions Deserialize now does bounds checking, both for the minimum message size and clamping the memcpy size to a constant. An error is thrown if the clamped memcpy size is larger than the message size. The caller now checks the ret properly, previously it was ignored.

Following the size check in ParseSessionMessage() it calls <code><nn::pia::session::Mesh::IsProcessingLeaveMesh() const></code>, returning if ret is false.

Then it calls nn::pia::lan::LanProtocol::ReceivedFragmentData::Receive(), with the memcpy'd buffer/size from the above LanSessionMessage, and other fields from LanSessionMessage. This eventually memcpys the input buffer to object+{offset}+{chunksize_field}*inputu8, there is no validation for size or inputu8 (except for the above size check). Hence, if the u8 is large enough, this would result in a heap buffer overflow.

In fixed versions ReceivedFragmentData::Receive added a bunch of validation before the memcpy.
| Stack/heap buffer overflow triggered by a Pia LanProtocol message.
| v5.9.3, see above.
| v5.9.1/v5.9.2/v5.9.3
| November 14, 2022
| November 15, 2022
| [[User:Yellows8|yellows8]]
|-
| nn::pia::session::SessionProtocol::ParseLeaveMeshInvitation buffer overflow
| <code><nn::pia::session::SessionProtocol::ParseLeaveMeshInvitation(nn::pia::transport::ReceivedMessageAccessor const&)></code> This immediately returns if *(ReceivedMessageAccessor+16) is 0. Then the input data is deserialized. The input u64 array is deserialized to stack, the u8 arraycount field from input is not validated.

Hence, stack buffer overflow. Note that there's similar loop code in nearby funcs, which do validate the count properly.

In fixed versions the arraycount field is now validated.

SessionProtocol uses ReliableSlidingWindow MessageHeader, with a maximum message size of 0x100. The allocated size used for the above u64 array is also 0x100-bytes. Hence, when triggering a buf overflow the data after the buffer is uncontrolled data from the SessionProtocol object.
| Stack buffer overflow triggered by a Pia SessionProtocol message.
| v5.9.3, see above.
| v5.9.1/v5.9.2/v5.9.3
| November 14, 2022
| November 15, 2022
| [[User:Yellows8|yellows8]]
|-
| Optional Pia packet encryption
| Pia packet encryption is optional. If the encryption flag is disabled, the packet handler will accept it and skip crypto.
In fixed versions immediately after grabbing a packet, it now checks the crypto flag. If it's plaintext the packet is dropped.

This can be used to send a plaintext Pia packet without needing to handle encryption, especially useful if the session-key can't be obtained (online-play matchmaking). This could be combined with other vulns if wanted.
| Sending a plaintext Pia packet without needing to handle encryption.
| v5.9.3, see above.
| v5.9.3 (and later versions)
|
| November 19, 2022
|
|-
| nn::pia::session::{JoinMeshJob/ProcessUpdateMeshJob}::SetStationDataList OOB read/write/vfunc-call
| <code>nn::pia::session::JoinMeshJob::SetStationDataList</code>is called by <code>nn::pia::session::MeshProtocol::ParseJoinResponse(nn::pia::transport::ReceivedMessageAccessor const&)></code> with the ReceivedMessageAccessor buffer.
SetStationDataList will update state and immediately return if the join was denied. It will also validate the num_mesh_stations field against state. ParseJoinResponse also essentially verifies that the message was received from the host device.

The input buffer size is ignored.

The num_fragments field must be value 1 or <=3 otherwise it will return, there's two seperate code blocks handling these.

Other than the checks at the start, there's no validation for the index fields. So large enough values could result in OOB-reads.

When handling multiple fragments, it will loop through the stationinfo list. There is no validation for the u8 count field or the baseindex field. It calls a vfunc from obj baseptr+index*{entrysize} with data from the buffer, where index starts with the above baseindex field. Afterwards, an u8 is copied into an u32 array (with certain versions an u16 is deserialized into an u16 array).

<code>nn::pia::session::ProcessUpdateMeshJob::UpdateStationDataList</code> is (eventually) called from <code>nn::pia::session::MeshProtocol::ParseUpdateMesh</code>, which has similar issues to the above.

Note that ParseJoinResponse/ParseUpdateMesh essentially require the message to be received from the host device.

With fixed versions (v5.18.98, exact version unknown) various validation was added. Additional/updated validation was added in a later version (v5.31.0, exact version unknown).
| OOB read/write / vfunc call where the object is selected by an OOB index, triggered by a Pia MeshProtocol message.
| v5.18.98 and v5.31.0 (exact versions unknown).
| v5.31.0
| November 18, 2022
| November 21, 2022
| [[User:Yellows8|yellows8]]
|-
| Insecure encryption
| Originally Pia packets used AES-ECB encryption. As documented [https://github.com/Kinnay/NintendoClients/wiki/Pia-Overview here] it was later changed with v5.7.0 to AES-GCM. Each 0x10-byte block would have the same encrypted block output where the plaintext 0x10-byte data is the same.
The mechanism for generating the Pia SessionKey for LAN has also changed over time.

The [https://github.com/Kinnay/NintendoClients/wiki/LAN-Protocol LAN] non-Pia-encapsulated packets were also originally sent in plaintext, however at some point it was changed to mostly encrypted.
|
| AES-GCM fix: v5.7.0
|
|
|
|
|-
| nn::pia::transport::UnreliableProtocol::Dispatch buffer overflow
| <code>nn::pia::transport::UnreliableProtocol::Dispatch</code> memcpys data from the message into a list entry, without size validation. If the pia packet is the max size, it will only overwrite the 0xC-bytes which were written to immediately before the memcpy: the u32 size and the 8-byte StationAddress (depending on the version there can also be 4-byte padding after the size for alignment).
However, nn::pia::transport::UnreliableProtocol::Receive will clamp the size from the list entry to the outbuf size when doing the memcpy. So this is probably useless.

It's unknown whether there's a version where more data could be overwritten, and whether that would be useful.

This is fixed in v5.31.0, exact version unknown. The message is dropped if too large in Dispatch.
| Small buffer overflow triggered by a Pia UnreliableProtocol message.
| v5.31.0, exact version unknown.
| v5.18.98/v5.31.0
| November 2022
| November 29, 2022
| [[User:Yellows8|yellows8]]
|-
| Uncleared input structs for [[LDN_services|LDN]]
| The Pia code using ldn CreateNetwork*/ConnectNetwork*/Scan doesn't properly memset the input data for SecurityConfig/ScanFilter (when keysize is less than 0x40 for the former). Hence, infoleak from games is sent to ldn (structs are located on stack, so stack data is leaked). This requires ldn compromise/mitm to obtain the leaked data - these are not sent over the network.
With v6.20.1 (exact version unknown - fix isn't present in v5.32.0), the code using Scan* now clears the input ScanFilter properly. With v6.25.1 (exact version unknown - fix isn't present in v6.23.3), the code using CreateNetwork*/ConnectNetwork* now clears the input SecurityConfig properly.
| Infoleak from games with LDN cmds, requires compromised sysmodule/mitm.
| v6.20.1 and v6.25.1, exact versions unknown.
| v5.32.0/v6.20.1/v6.23.3/v6.25.1
|
| December 7, 2022
|
|}

=== ENL ===
This section documents vulnerabilities for [https://github.com/kinnay/NintendoClients/wiki/ENL-Protocol ENL].
A framework used by Nintendo games including Mario Kart 8 Deluxe, Splatoon 2 / 3, Mario Maker 2, and more.

Fun fact, this library appears to re-use network code and concepts from older Nintendo titles such as Mario Kart 7 and some Wii multiplayer games.

{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in Enl version
! Last Enl version this flaw was checked for
! Timeframe this was discovered
! Public disclosure timeframe
! Discovered by
|-
| enl::TransportManager::updateReceiveBuffer_() nullptr deref
| enl::TransportManager::updateReceiveBuffer_() is called when the ENL framework receives a PIA packet from a client, it will fully trust the ENL header which includes a "ContentTransporter" type (ID) and a length.
The function will try to fetch the content transporter by ID using <code>enl::TransportManager::getContentTransporter(unsigned char const &)</code>, it returns NULL if there's no content transporter with the same ID

*NOTE: The function may be inlined

Then it will try to call a virtual method: <code>virtual size_t readyReceiveStream(enl::RamReadStream&, enl::Buffer*, size_t)</code>, dereferencing the pointer to fetch the vtable ptr

[https://gist.github.com/Rambo6Glaz/c088e2ed7a12db08f6322e9f7a3c4911 Pseudocode of the function before it was fixed]

| nullptr dereference triggered by an invalid content transporter type in the ENL header (it will crash the game/process)
| Unknown
| Depends on the game
| Early April 2022
| November 16, 2022
| [[User:Rambo6Glaz|Rambo6Glaz]], [https://github.com/kinnay Yannik] (massive RE help)
|}

There's another one more interesting but it will have to wait a bit :)

== Games ==
{| class="wikitable" border="1"
|-
! Game
! Summary
! Description
! Impact
! Fixed in version
! Timeframe this was discovered
! Public disclosure timeframe
! Discovered by
|-
| Mario Kart World
| ASLR leak in application data
| A memory address can be leaked by changing your username to something short, and hosting a network session in LAN mode (press L + R + Left Stick on the main menu to enable this). The memory address can be found in bytes 12 - 19 of the application data that is transmitted in response to a browse request.

'''Note:''' there is more uninitialized data in the packet, but the memory address is probably the most interesting part. The vulnerability was fixed by clearing the application data with zeros, before filling in the information.

[https://hackerone.com/reports/3463719 HackerOne report]

This stack infoleak was also present in the [[LDN_services|ldn]] AdvertiseData.
| A memory address can leaked (this is a requirement for many types of attacks).
| 1.5.0
| December 12, 2025
| February 19, 2026
| [https://github.com/kinnay Yannik], yellows8 (ldn)
|-
| Splatoon 3
| Anticheat Seed Randomization Weakness
| This oversight of seed generation would allow an attacker to quickly compute all code hashes, and modify game code, while still producing a valid ch1 hash.

[https://hackerone.com/reports/3042475 HackerOne report]
| Allows an attacker to bypass the ch1 anti-cheat hashing mechanism.
| 10.0.0
| March 17, 2025
| February 19, 2026
| hana2736
|-
| Splatoon Raiders
| Infoleak in application data
| A ptr can be leaked by hosting a network session in local (at least ldn) mode. The uninitialized data follows the last username in the appdata ([[LDN_services|ldn]] AdvertiseData). With account/game username short even more data/ptrs are leaked.
With v1.1.1 that data is now cleared.
| Game infoleak, which allows defeating ASLR.
| 1.1.1
| July 25, 2026
| August 6, 2026
| [[User:Yellows8|yellows8]] (ldn)
|}

Title list

2026-08-06T15:31:00Z

Yellows8: /* System Applets */

= System Modules =
Note: Unlike 3DS, Switch doesn't have a dedicated HTTP-sysmodule. Instead, processes using HTTP(S) just use libcurl + socket/ssl services.

From [[2.0.0]] to [[9.2.0]], [[HID_services|hid-sysmodule]] was the only sysmodule with a RomFS.
As of [[10.0.0]], no sysmodules have a RomFS.

Decimal versions use the format:
* Bit31-Bit26: Major
* Bit25-Bit20: Minor
* Bit19-Bit16: Micro
* Bit15-Bit0: Relstep

{| class=wikitable
! ProgramId || Versions || Description || Notes
|-
| 0100000000000000 || [bundled with kernel] || [[Filesystem_services|fs]] ||
|-
| 0100000000000001 || [bundled with kernel] || [[Loader_services|ldr (Loader)]] ||
|-
| 0100000000000002 || [bundled with kernel] || [[NCM_services|ncm]] ||
|-
| 0100000000000003 || [bundled with kernel] || [[Process_Manager_services|pm (ProcessMana)]] ||
|-
| 0100000000000004 || [bundled with kernel] || [[Services_API|sm]] ||
|-
| 0100000000000005 || [bundled with kernel] || [[boot]] ||
|-
| 0100000000000006 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.1.0|v403701850]] (6.1.0.90) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[9.0.0|v603980216]] (9.0.0.440) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) [[22.5.0|v1481638368]] (22.5.0.480) || [[USB_services|usb]] ||
|-
| 0100000000000007 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[9.0.0|v603980216]] (9.0.0.440) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || [[TMA_services|tma]] (debug) [1.0.0-10.2.0] [[TMA_services|tma.stub]] (retail) [11.0.0+] [[TMA_services|htc.stub]] (retail) ||
|-
| 0100000000000008 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[9.0.0|v603980216]] (9.0.0.440) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || [[Boot2|boot2]] (debug) [[Boot2|boot2.SafeMode]] (safe) [[Boot2|boot2.FromHost]] (develop) [[Boot2|boot2.prodBoot]] (retail) [[Boot2|boot2.manuBoot]] (factory) [[Boot2|boot2.Manu1st]] (factory) ||
|-
| 0100000000000009 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[8.1.0|v537919608]] (8.1.0.120) [[8.1.1|v537919608]] (8.1.0.122) [[9.0.0|v603980216]] (9.0.0.440) [[10.0.0|v671088940]] (10.0.0.300) [[10.1.0|v672137336]] (10.1.0.120) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) [[22.5.0|v1481638368]] (22.5.0.480) || [[Settings_services|settings]] [[Settings_services|settings_hoag]] ([[8.1.1]]) ||
|-
| 010000000000000A || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[8.1.0|v537919608]] (8.1.0.120) [[8.1.1|v537919608]] (8.1.0.122) [[9.0.0|v603980216]] (9.0.0.440) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[14.1.2|v940703804]] (14.1.2.60) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || [[Bus_services|Bus]] [[Bus_services|Bus_hoag]] ([[8.1.1]]) ||
|-
| 010000000000000B || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[9.0.0|v603980216]] (9.0.0.440) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.0.1|v805371944]] (12.0.1.40) [[12.0.2|v805437460]] (12.0.2.20) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[13.1.0|v873463948]] (13.1.0.140) [[13.2.1|v874578000]] (13.2.1.80) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[16.1.0|v1074790880]] (16.1.0.480) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[19.0.2|v1275199548]] (19.0.2.60) [[22.0.0|v1476396108]] (22.0.0.1100) || [1.0.0-19.0.1] [[Bluetooth_Driver_services|bluetooth]] [20.0.0+] [[Bluetooth_Driver_services|bluetooth.autog]] ||
|-
| 010000000000000C || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[3.0.2|v201457684]] (3.0.2.20) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[7.0.1|v469827614]] (7.0.1.30) [[8.0.0|v536871442]] (8.0.0.530) [[8.1.0|v537919608]] (8.1.0.120) [[9.0.0|v603980216]] (9.0.0.440) [[9.1.0|v605028512]] (9.1.0.160) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220)) [[13.1.0|v873463948]] (13.1.0.140) [[14.0.0|v939525336]] (14.0.0.1240) [[14.1.0|v940572692]] (14.1.0.20) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[16.0.1|v1073807420]] (16.0.1.60) [[16.1.0|v1074790880]] (16.1.0.480) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[21.1.0|v1410335000]] (21.1.0.280) [[19.0.2|v1275199548]] (19.0.2.60) [[22.0.0|v1476396108]] (22.0.0.1100) || [[BCAT_services|bcat]] ||
|-
| 010000000000000D || || dmnt (currently not present on retail devices) ||
|-
| 010000000000000E || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[9.0.0|v603980216]] (9.0.0.440) [[9.1.0|v605028512]] (9.1.0.160) [[10.0.0|v671088940]] (10.0.0.300) [[10.1.0|v672137336]] (10.1.0.120) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || [[Friend_services|friends]] ||
|-
| 010000000000000F || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.1.0|v131082]] (0.0.2.10) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.1.0|v403701850]] (6.1.0.90) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[9.0.0|v603980216]] (9.0.0.440) [[9.1.0|v605028512]] (9.1.0.160) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220)) [[13.1.0|v873463948]] (13.1.0.140) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634160]] (15.0.0.1200) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[18.0.1|v1208025188]] (18.0.1.100) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[21.1.0|v1410335000]] (21.1.0.280) [[22.0.0|v1476396108]] (22.0.0.1100) || [[Network_Interface_services|nifm]] ||
|-
| 0100000000000010 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.1.0|v131132]] (0.0.2.60) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.0.2|v335675432]] (5.0.2.40) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[8.1.1|v536936550]] (8.0.1.102) [[9.0.0|v603980216]] (9.0.0.440) [[10.0.0|v671088940]] (10.0.0.300) [[10.0.2|v671219752]] (10.0.2.40) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || [[PTM_services|ptm]] ||
|-
| 0100000000000011 || || shell (currently not present on retail devices) ||
|-
| 0100000000000012 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.3.0|v131092]] (0.0.2.20) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[3.0.2|v201457684]] (3.0.2.20) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.0.2|v335675432]] (5.0.2.40) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[8.0.1|v536936528]] (8.0.1.80) [[9.0.0|v603980216]] (9.0.0.440) [[9.1.0|v605028512]] (9.1.0.160) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.0.1|v805371944]] (12.0.1.40) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220)) [[13.1.0|v873463948]] (13.1.0.140) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[15.0.1|v1006698596]] (15.0.1.100) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[19.0.2|v1275199548]] (19.0.2.60) [[22.0.0|v1476396108]] (22.0.0.1100) [[22.5.0|v1481638368]] (22.5.0.480) || [[Sockets_services|bsdsocket]] ||
|-
| 0100000000000013 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.1.0|v131132]] (0.0.2.60) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) [[4.1.0|v269484082]] (4.1.0.50) [[5.0.0|v335544750]] (5.0.0.430) [[5.0.2|v335675432]] (5.0.2.40) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.0.1|v402718730]] (6.0.1.10) [[6.1.0|v403701850]] (6.1.0.90) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[8.0.1|v536936528]] (8.0.1.80) [[8.1.0|v537919608]] (8.1.0.120) [[8.1.1|v537919608]] (8.1.0.122) [[9.0.0|v603980216]] (9.0.0.440) [[9.0.1|v604045372]] (9.0.1.60) [[9.1.0|v605028512]] (9.1.0.160) [[10.0.0|v671088980]] (10.0.0.340) [[10.0.1|v671154196]] (10.0.1.20) [[10.0.2|v671219752]] (10.0.2.40) [[10.1.0|v672137336]] (10.1.0.120) [[11.0.0|v738197904]] (11.0.0.400) [[11.0.1|v738263060]] (11.0.1.20) [[12.0.0|v805308888]] (12.0.0.2520) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220)) [[13.1.0|v873463948]] (13.1.0.140) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[17.0.1|v1140916284]] (17.0.1.60) [[18.0.0|v1207960692]] (18.0.0.1140) [[18.1.0|v1209008288]] (18.1.0.160) [[19.0.0|v1275069496]] (19.0.0.1080) [[19.0.1|v1275133992]] (19.0.1.40) [[20.0.0|v1342178960]] (20.0.0.1680) [[20.1.0|v1343226216]] (20.1.0.360) [[20.4.0|v1346371784]] (20.4.0.200) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) [[22.5.0|v1481638368]] (22.5.0.480) || [[HID_services|hid]] [[HID_services|hid_EdevLogEnab]] (factory) [[HID_services|hid_hoag]] ([[8.1.1]]) ||
|-
| 0100000000000014 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.0.1|v402718730]] (6.0.1.10) [[6.1.0|v403701850]] (6.1.0.90) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[8.1.1|v537919608]] (8.1.0.122) [[8.1.0|v537919608]] (8.1.0.120) [[9.0.0|v603980216]] (9.0.0.440) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[16.1.0|v1074790880]] (16.1.0.480) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || [[Audio_services|audio]] [[Audio_services|audio_hoag]] ([[8.1.1]]) ||
|-
| 0100000000000015 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[9.0.0|v603980216]] (9.0.0.440) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || [[Log_services|LogManager]] (debug) [[Log_services|LogManager.Prod]] (retail) ||
|-
| 0100000000000016 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.1.0|v131082]] (0.0.2.10) [[2.2.0|v196608]] (0.0.3.0) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[3.0.2|v201457684]] (3.0.2.20) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[8.1.0|v537919608]] (8.1.0.120) [[8.1.1|v537985046]] (8.1.1.22) [[9.0.0|v603980216]] (9.0.0.440) [[9.1.0|v605028512]] (9.1.0.160) [[10.0.0|v671089000]] (10.0.0.360) [[10.1.0|v672137336]] (10.1.0.120) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[20.2.0|v1344274732]] (20.2.0.300) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) [[22.5.0|v1481638368]] (22.5.0.480) || [[WLAN_services|wlan]] ||
|-
| 0100000000000017 || || cs (currently not present on retail devices) ||
|-
| 0100000000000018 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[9.0.0|v603980216]] (9.0.0.440) [[9.1.0|v605028512]] (9.1.0.160) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197944]] (11.0.0.440) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220)) [[13.1.0|v873463948]] (13.1.0.140) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[17.0.1|v1140916284]] (17.0.1.60) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[20.2.0|v1344274732]] (20.2.0.300) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || [[LDN_services|ldn]] ||
|-
| 0100000000000019 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.1.0|v131082]] (0.0.2.10) [[2.3.0|v196628]] (0.0.3.20) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[3.0.2|v201457684]] (3.0.2.20) [[4.0.0|v268435656]] (4.0.0.200) [[4.0.1|v268501002]] (4.0.1.10) [[4.1.0|v269484082]] (4.1.0.50) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[8.1.0|v537919608]] (8.1.0.120) [[9.0.0|v603980216]] (9.0.0.440) [[10.0.0|v671088940]] (10.0.0.300) [[10.1.0|v672137336]] (10.1.0.120) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220)) [[13.1.0|v873463948]] (13.1.0.140) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || [[NV_services|nvservices]] ||
|-
| 010000000000001A || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[9.0.0|v603980216]] (9.0.0.440) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || [[PCV_services|pcv]] ||
|-
| 010000000000001B || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.0.2|v335675432]] (5.0.2.40) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[9.0.0|v603980216]] (9.0.0.440) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || [1.0.0-7.0.1] [[PPC_services|ppc]] [11.0.0+] [[Capmtp_services|capmtp]] ||
|-
| 010000000000001C || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.1.0|v131082]] (0.0.2.10) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) [[4.1.0|v269484082]] (4.1.0.50) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[8.1.0|v537919608]] (8.1.0.120) [[9.0.0|v603980216]] (9.0.0.440) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || [[Nvnflinger_services|nvnflinger]] ||
|-
| 010000000000001D || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.1.0|v403701850]] (6.1.0.90) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[9.0.0|v603980216]] (9.0.0.440) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || [1.0.0-9.2.0] [[PCIe_services|pcie.withoutHb]] (retail) [10.0.0+] [[PCIe_services|pcie]] ||
|-
| 010000000000001E || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[3.0.2|v201457684]] (3.0.2.20) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.1.0|v403701850]] (6.1.0.90) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[7.0.1|v469827614]] (7.0.1.30) [[8.0.0|v536871442]] (8.0.0.530) [[8.0.1|v536936528]] (8.0.1.80) [[8.1.0|v537919608]] (8.1.0.120) [[9.0.0|v603980216]] (9.0.0.440) [[9.1.0|v605028512]] (9.1.0.160) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220)) [[13.1.0|v873463948]] (13.1.0.140) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178960]] (20.0.0.1680) [[20.1.0|v1343226216]] (20.1.0.360) [[20.1.5|v1343553696]] (20.1.5.160) [[20.2.0|v1344274732]] (20.2.0.300) [[20.5.0|v1347420260]] (20.5.0.100) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) [[22.5.0|v1481638368]] (22.5.0.480) || [[Account_services|account]] ||
|-
| 010000000000001F || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.1.0|v131132]] (0.0.2.60) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.1.0|v403701850]] (6.1.0.90) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[7.0.1|v469827614]] (7.0.1.30) [[8.0.0|v536871442]] (8.0.0.530) [[8.1.0|v537919608]] (8.1.0.120) [[9.0.0|v603980216]] (9.0.0.440) [[9.0.1|v604045372]] (9.0.1.60) [[9.1.0|v605028512]] (9.1.0.160) [[10.0.0|v671088940]] (10.0.0.300) [[10.1.0|v672137336]] (10.1.0.120) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220)) [[13.1.0|v873463968]] (13.1.0.160) [[14.0.0|v939525336]] (14.0.0.1240) [[14.1.1|v940638228]] (14.1.1.20) [[15.0.0|v1006634080]] (15.0.0.1120) [[15.0.1|v1006698596]] (15.0.1.100) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[18.0.1|v1208025188]] (18.0.1.100) [[19.0.0|v1275069496]] (19.0.0.1080) [[19.0.1|v1275134052]] (19.0.1.100) [[20.0.0|v1342179000]] (20.0.0.1720) [[20.0.1|v1342242836]] (20.0.1.20) [[20.1.0|v1343226216]] (20.1.0.360) [[20.1.1|v1343291412]] (20.1.1.20) [[20.1.5|v1343553696]] (20.1.5.160) [[20.2.0|v1344274732]] (20.2.0.300) [[21.0.0|v1409287084]] (21.0.0.940) [[21.1.0|v1410335000]] (21.1.0.280) [[22.0.0|v1476396108]] (22.0.0.1100) [[22.5.0|v1481638368]] (22.5.0.480) || [[NS_Services|ns]] ||
|-
| 0100000000000020 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.2.0|v131072]] (0.0.2.0) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[8.1.1|v536871444]] (8.0.0.532) [[9.0.0|v603980216]] (9.0.0.440) [[9.1.0|v605028512]] (9.1.0.160) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || [[NFC_services|nfc]] [[NFC_services|nfc_Hoag]] ([[8.1.1]]) ||
|-
| 0100000000000021 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[9.0.0|v603980216]] (9.0.0.440) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[21.1.0|v1410335000]] (21.1.0.280) [[22.0.0|v1476396108]] (22.0.0.1100) || [[PSC_services|psc]] ||
|-
| 0100000000000022 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[9.0.0|v603980216]] (9.0.0.440) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || [[Capture_services|capsrv]] ||
|-
| 0100000000000023 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.1.0|v131132]] (0.0.2.60) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.1.0|v403701850]] (6.1.0.90) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[8.1.0|v537919608]] (8.1.0.120) [[9.0.0|v603980216]] (9.0.0.440) [[9.1.0|v605028512]] (9.1.0.160) [[10.0.0|v671088940]] (10.0.0.300) [[10.1.0|v672137336]] (10.1.0.120) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220)) [[13.1.0|v873463948]] (13.1.0.140) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[15.0.1|v1006698596]] (15.0.1.100) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[19.0.1|v1275133992]] (19.0.1.40) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[20.2.0|v1344274732]] (20.2.0.300) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) [[22.5.0|v1481638368]] (22.5.0.480) || [[AM_services|am]] [[AM_services|am.withoutPscWa]] (factory) ||
|-
| 0100000000000024 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[8.1.0|v537919608]] (8.1.0.120) [[9.0.0|v603980216]] (9.0.0.440) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.0.3|v805502996]] (12.0.3.20) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[13.2.1|v874578000]] (13.2.1.80) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[16.0.2|v1073872936]] (16.0.2.40) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[20.2.0|v1344274732]] (20.2.0.300) [[21.0.0|v1409287084]] (21.0.0.940) [[19.0.2|v1275199548]] (19.0.2.60) [[22.0.0|v1476396108]] (22.0.0.1100) [[22.5.0|v1481638368]] (22.5.0.480) || [[SSL_services|ssl]] ||
|-
| 0100000000000025 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.1.0|v131082]] (0.0.2.10) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) [[4.1.0|v269484082]] (4.1.0.50) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.1.0|v403701850]] (6.1.0.90) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[8.0.1|v536936528]] (8.0.1.80) [[9.0.0|v603980216]] (9.0.0.440) [[9.1.0|v605028512]] (9.1.0.160) [[10.0.0|v671088940]] (10.0.0.300) [[10.1.0|v672137336]] (10.1.0.120) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220)) [[13.1.0|v873463948]] (13.1.0.140)) [[13.1.0|v873463948]] (13.1.0.140) [[13.2.0|v874512404]] (13.2.0.20) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[15.0.1|v1006698596]] (15.0.1.100) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[20.2.0|v1344274732]] (20.2.0.300) [[21.0.0|v1409287084]] (21.0.0.940) [[21.1.0|v1410335000]] (21.1.0.280) [[22.0.0|v1476396108]] (22.0.0.1100) || [[NIM_services|nim]] ||
|-
| 0100000000000026 || || cec (currently not present on retail devices) ||
|-
| 0100000000000027 || || tspm (currently not present on retail devices) ||
|-
| 0100000000000028 || [bundled with kernel] || [[SPL_services|spl]] ||
|-
| 0100000000000029 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[9.0.0|v603980216]] (9.0.0.440) [[10.0.0|v671088940]] (10.0.0.300) || [1.0.0-9.2.0] [[Backlight_services|lbl]] ||
|-
| 010000000000002A || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.1.0|v403701850]] (6.1.0.90) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[7.0.1|v469827614]] (7.0.1.30) [[8.0.0|v536871442]] (8.0.0.530) [[9.0.0|v603980216]] (9.0.0.440) [[10.0.0|v671088940]] (10.0.0.300) [[10.1.0|v672137336]] (10.1.0.120) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220)) [[13.1.0|v873463948]] (13.1.0.140) [[14.0.0|v939525336]] (14.0.0.1240) [[14.1.2|v940703804]] (14.1.2.60) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[16.1.0|v1074790880]] (16.1.0.480) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || [[BTM_services|btm]] ||
|-
| 010000000000002B || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.1.0|v131132]] (0.0.2.60) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[9.0.0|v603980216]] (9.0.0.440) [[9.1.0|v605028512]] (9.1.0.160) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220)) [[13.1.0|v873463948]] (13.1.0.140) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[19.0.1|v1275133992]] (19.0.1.40) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[20.1.5|v1343553696]] (20.1.5.160) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) [[22.5.0|v1481638368]] (22.5.0.480) || [[Error_Report_services|erpt]] ||
|-
| 010000000000002C || || time (currently not present on retail devices) ||
|-
| 010000000000002D || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[8.1.0|v537919608]] (8.1.0.120) [[9.0.0|v603980216]] (9.0.0.440) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197904]] (11.0.0.400) [[11.0.1|v738263060]] (11.0.1.20) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || [[Display_services|vi]] ||
|-
| 010000000000002E || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.1.0|v131082]] (0.0.2.10) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[9.0.0|v603980216]] (9.0.0.440) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[16.1.0|v1074790880]] (16.1.0.480) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[20.1.5|v1343553696]] (20.1.5.160) [[21.0.0|v1409287084]] (21.0.0.940) [[21.0.1|v1409351720]] (21.0.1.40) [[21.1.0|v1410335000]] (21.1.0.280) [[21.2.0|v1411383436]] (21.2.0.140) [[22.0.0|v1476396108]] (22.0.0.1100) || [[Parental_Control_services|pctl]] ||
|-
| 010000000000002F || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[8.0.1|v536936528]] (8.0.1.80) [[9.0.0|v603980216]] (9.0.0.440) [[10.0.0|v671088940]] (10.0.0.300) [[10.1.0|v672137336]] (10.1.0.120) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960692]] (18.0.0.1140) [[18.1.0|v1209008288]] (18.1.0.160) [[19.0.0|v1275069496]] (19.0.0.1080) [[19.0.1|v1275133992]] (19.0.1.40) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[20.2.0|v1344274732]] (20.2.0.300) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || [[NPNS_services|npns]] ||
|-
| 0100000000000030 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.1.0|v131132]] (0.0.2.60) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[9.0.0|v603980216]] (9.0.0.440) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[19.0.1|v1275133992]] (19.0.1.40) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || [[Error_Upload_services|eupld]] ||
|-
| 0100000000000031 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[9.0.0|v603980216]] (9.0.0.440) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[20.5.0|v1347420260]] (20.5.0.100) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || [1.0.0] arp [2.0.0+] [[Glue_services|glue]] ||
|-
| 0100000000000032 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[9.0.0|v603980216]] (9.0.0.440) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || eclct ||
|-
| 0100000000000033 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.1.0|v403701850]] (6.1.0.90) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[7.0.1|v469827614]] (7.0.1.30) [[8.0.0|v536871442]] (8.0.0.530) [[8.1.0|v537919608]] (8.1.0.120) [[9.0.0|v603980216]] (9.0.0.440) [[10.0.0|v671088940]] (10.0.0.300) [[10.1.0|v672137336]] (10.1.0.120) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220)) [[13.1.0|v873463948]] (13.1.0.140) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) [[22.1.0|v1477443784]] (22.1.0.200) [[22.5.0|v1481638368]] (22.5.0.480) || [[ETicket_services|es]] ||
|-
| 0100000000000034 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.1.0|v131132]] (0.0.2.60) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) [[4.1.0|v269484082]] (4.1.0.50) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[8.1.0|v537919608]] (8.1.0.120) [[9.0.0|v603980216]] (9.0.0.440) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || [[Fatal_services|fatal]] ||
|-
| 0100000000000035 || [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[8.1.0|v537919608]] (8.1.0.120) [[9.0.0|v603980216]] (9.0.0.440) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[20.2.0|v1344274732]] (20.2.0.300) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || [4.0.0+] [[GRC_services|grc]] ||
|-
| 0100000000000036 || [[2.0.0|v260]] (0.0.0.260) [[2.1.0|v65596]] (0.0.1.60) [[2.3.0|v131092]] (0.0.2.20) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[3.0.2|v201457684]] (3.0.2.20) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.1.0|v403701850]] (6.1.0.90) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[8.1.0|v537919608]] (8.1.0.120) [[9.0.0|v603980216]] (9.0.0.440) [[9.0.1|v604045372]] (9.0.1.60) [[9.1.0|v605028512]] (9.1.0.160) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197944]] (11.0.0.440) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[17.0.1|v1140916284]] (17.0.1.60) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[21.1.0|v1410335000]] (21.1.0.280) [[22.0.0|v1476396108]] (22.0.0.1100) || [[creport]] ||
|-
| 0100000000000037 || [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[8.1.0|v537919608]] (8.1.0.120) [[9.0.0|v603980216]] (9.0.0.440) [[9.1.0|v605028512]] (9.1.0.160) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || [3.0.0+] [[RO_services|ro]] ||
|-
| 0100000000000038 || || [[Profiler services|profiler]] (currently not present on retail devices) ||
|-
| 0100000000000039 || [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[9.0.0|v603980216]] (9.0.0.440) [[10.0.0|v671088940]] (10.0.0.300) [[10.2.0|v673185832]] (10.2.0.40) [[11.0.0|v738197904]] (11.0.0.400) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[20.2.0|v1344274732]] (20.2.0.300) [[21.0.0|v1409287084]] (21.0.0.940) [[21.2.0|v1411383436]] (21.2.0.140) [[22.0.0|v1476396108]] (22.0.0.1100) [[22.1.0|v1477443784]] (22.1.0.200) || [3.0.0+] [[Shared_Database_services|sdb]] ||
|-
| 010000000000003A || [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[9.0.0|v603980216]] (9.0.0.440) [[9.1.0|v605028512]] (9.1.0.160) [[10.0.0|v671088940]] (10.0.0.300) [[10.1.0|v672137336]] (10.1.0.120) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[18.1.0|v1209008288]] (18.1.0.160) [[19.0.0|v1275069496]] (19.0.0.1080) [[19.0.1|v1275134052]] (19.0.1.100) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[20.1.5|v1343553696]] (20.1.5.160) [[20.2.0|v1344274732]] (20.2.0.300) [[21.0.0|v1409287084]] (21.0.0.940) [[21.0.1|v1409351720]] (21.0.1.40) [[21.1.0|v1410335000]] (21.1.0.280) [[22.0.0|v1476396108]] (22.0.0.1100) [[22.1.0|v1477443784]] (22.1.0.200) [[22.5.0|v1481638368]] (22.5.0.480) || [4.0.0+] [[Migration_services|migration]] ||
|-
| 010000000000003B || [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || [10.0.0+] [[JIT_services|jit]] (retail) ||
|-
| 010000000000003C || [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[9.0.0|v603980216]] (9.0.0.440) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || [4.0.0+] [[Jpegdec_services|jpegdec]] ||
|-
| 010000000000003D || [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[9.0.0|v603980216]] (9.0.0.440) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || [4.0.0+] [[safemode]] ||
|-
| 010000000000003E || [[6.0.0|v402653544]] (6.0.0.360) [[6.1.0|v403701850]] (6.1.0.90) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[9.0.0|v603980216]] (9.0.0.440) [[9.1.0|v605028512]] (9.1.0.160) [[10.0.0|v671088940]] (10.0.0.300) [[10.1.0|v672137336]] (10.1.0.120) [[10.2.0|v673185832]] (10.2.0.40) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220)) [[13.1.0|v873463948]] (13.1.0.140) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[16.1.0|v1074790880]] (16.1.0.480) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[20.2.0|v1344274732]] (20.2.0.300) [[21.0.0|v1409287084]] (21.0.0.940) [[21.1.0|v1410335000]] (21.1.0.280) [[22.0.0|v1476396108]] (22.0.0.1100) || [6.0.0+] [[OLSC_services|olsc]] ||
|-
| 010000000000003F || || dt (currently not present on retail devices) ||
|-
| 0100000000000040 || || nd (currently not present on retail devices) ||
|-
| 0100000000000041 || [[9.0.0|v603980216]] (9.0.0.440) [[9.1.0|v605028512]] (9.1.0.160) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[16.1.0|v1074790880]] (16.1.0.480) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) || [9.0.0-20.5.0] [[NGCT_services|ngct]] ||
|-
| 0100000000000042 || [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.0.2|v805437460]] (12.0.2.20) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || [10.0.0+] [[PGL_services|pgl]] ||
|-
| 0100000000000043 || || (currently not present on retail devices) ||
|-
| 0100000000000044 || || (currently not present on retail devices) ||
|-
| 0100000000000045 || [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[17.0.1|v1140916284]] (17.0.1.60) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[19.0.1|v1275134052]] (19.0.1.100) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || [14.0.0+] [[OMM_services|omm]] ||
|-
| 0100000000000046 || [[15.0.0|v1006634160]] (15.0.0.1200) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || [15.0.0+] [[Ethernet_services|eth]] ||
|-
| 0100000000000047 || || (currently not present on retail devices) ||
|-
| 0100000000000048 || || (currently not present on retail devices) ||
|-
| 0100000000000049 || || (currently not present on retail devices) ||
|-
| 010000000000004A || || (currently not present on retail devices) ||
|-
| 010000000000004B || || (currently not present on retail devices) ||
|-
| 010000000000004C || || netTc (currently not present on retail devices) ||
|-
| 010000000000004D || || (currently not present on retail devices) ||
|-
| 010000000000004E || || (currently not present on retail devices) ||
|-
| 010000000000004F || || (currently not present on retail devices) ||
|-
| 0100000000000050 || [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || [16.0.0+] [[NGC_services|ngc]] ||
|-
| 0100000000000051 || || dmgr (currently not present on retail devices) ||
|}

= System Data Archives =
{| class=wikitable
! ProgramId || Versions || Description || Notes
|-
| 0100000000000800 || [[1.0.0|v260]] (0.0.0.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[9.0.0|v603980216]] (9.0.0.440) [[10.0.0|v671088940]] (10.0.0.300) [[10.0.3|v671285268]] (10.0.3.20) [[10.1.0|v672137336]] (10.1.0.120) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || [[SSL_services#CertStore|CertStore]] || SSL trusted certificates.
|-
| 0100000000000801 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.2.0|v196628]] (0.0.3.20) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.2|v201457684]] (3.0.2.20) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.1.0|v403701850]] (6.1.0.90) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[8.1.0|v537919608]] (8.1.0.120) [[8.1.1|v537919608]] (8.1.0.122) [[9.0.0|v603980216]] (9.0.0.440) [[9.1.0|v605028512]] (9.1.0.160) [[10.0.0|v671088940]] (10.0.0.300) [[10.1.0|v672137336]] (10.1.0.120) [[11.0.0|v738197804]] (11.0.0.300) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[13.1.0|v873463908]] (13.1.0.100) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851668]] (17.0.0.980) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || ErrorMessage || Stores the message strings for Support Error Codes. There's "/DatabaseInfo" at FS root, then the rest is stored at "/{first 4 error digits}/{last 4 error digits}/".
|-
| 0100000000000802 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[9.0.0|v603980216]] (9.0.0.440) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || MiiModel ||
|-
| 0100000000000803 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.1.0|v196628]] (0.0.3.20) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.1.0|v403701850]] (6.1.0.90) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[8.1.0|v537919608]] (8.1.0.120) [[9.0.0|v603980216]] (9.0.0.440) [[9.0.1|v604045412]] (9.0.1.100) [[9.1.0|v605028592]] (9.1.0.240) [[10.0.0|v671088960]] (10.0.0.320) [[10.0.4|v671350804]] (10.0.4.20) [[11.0.0|v738197864]] (11.0.0.360) [[12.0.0|v805307608]] (12.0.0.1240) [[12.1.0|v806355064]] (12.1.0.120) [[13.1.0|v873463908]] (13.1.0.100) [[14.0.0|v939525336]] (14.0.0.1240) [[14.1.1|v940638228]] (14.1.1.20) [[15.0.0|v1006634080]] (15.0.0.1120) [[15.0.1|v1006698596]] (15.0.1.100) [[16.0.0|v1073742904]] (16.0.0.1080) [[16.1.0|v1074790880]] (16.1.0.480) [[17.0.0|v1140851708]] (17.0.0.1020) [[18.1.0|v1209008288]] (18.1.0.160) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[20.2.0|v1344274732]] (20.2.0.300) [[20.3.0|v1345323088]] (20.3.0.80) [[20.4.0|v1346371784]] (20.4.0.200) [[21.0.0|v1409287084]] (21.0.0.940) [[21.1.0|v1410335000]] (21.1.0.280) [[21.2.0|v1411383436]] (21.2.0.140) [[22.0.0|v1476396108]] (22.0.0.1100) [[22.5.0|v1481638368]] (22.5.0.480) || BrowserDll || Mounted as "shareddata:/". Contains various browser data: emojis, OSS NROs, "buildinfo/buildinfo.dat", ...
|-
| 0100000000000804 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[8.1.1|v536871444]] (8.0.0.532) [[9.0.0|v603980216]] (9.0.0.440) [[9.1.0|v605028512]] (9.1.0.160) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197804]] (11.0.0.300) [[12.0.0|v805307608]] (12.0.0.1240) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[13.1.0|v873463908]] (13.1.0.100) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851668]] (17.0.0.980) [[18.0.0|v1207960612]] (18.0.0.1060) [[18.1.0|v1209008288]] (18.1.0.160) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.4.0|v1346371784]] (20.4.0.200) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) [[22.5.0|v1481638368]] (22.5.0.480) || Help || HTML resources: Open-source licenses ("Intellectual Property Notices") and seizure warnings("Health & Safety Information"). The former is stored at FS "/legallines.htdocs/" while the latter is at "/safe.htdocs/".
|-
| 0100000000000805 || [[1.0.0|v450]] (0.0.0.450) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[9.0.0|v603980216]] (9.0.0.440) [[9.1.0|v605028512]] (9.1.0.160) [[16.1.0|v1074790880]] (16.1.0.480) || SharedFont || Chinese and Korean dictionaries.
|-
| 0100000000000806 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.2|v201457684]] (3.0.2.20) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[9.0.0|v603980216]] (9.0.0.440) [[10.0.0|v671088940]] (10.0.0.300) [[10.2.0|v673185832]] (10.2.0.40) [[11.0.0|v738197904]] (11.0.0.400) [[11.0.1|v738264040]] (11.0.1.1000) [[12.0.0|v805308868]] (12.0.0.2500) [[12.0.1|v805371944]] (12.0.1.40) [[12.0.3|v805502996]] (12.0.3.20) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[14.1.1|v940638228]] (14.1.1.20) [[14.1.2|v940703804]] (14.1.2.60) [[14.1.2|v940708804]] (14.1.2.5060) [[14.1.2|v940709764]] (14.1.2.6020) [[14.1.2|v940711764]] (14.1.2.8020) [[15.0.0|v1006634080]] (15.0.0.1120) [[15.0.1|v1006698596]] (15.0.1.100) [[16.0.0|v1073742864]] (16.0.0.1040) [[16.0.1|v1073807420]] (16.0.1.60) [[16.0.2|v1073872936]] (16.0.2.40) [[16.0.3|v1073943452]] (16.0.3.5020) [[16.0.3|v1073944452]] (16.0.3.6020) [[16.1.0|v1074790880]] (16.1.0.480) [[17.0.0|v1140851648]] (17.0.0.960) [[17.0.0|v1140855708]] (17.0.0.5020) [[18.0.0|v1207960612]] (18.0.0.1060) [[18.1.0|v1209008288]] (18.1.0.160) [[18.1.0|v1209013148]] (18.1.0.5020) [[19.0.0|v1275069496]] (19.0.0.1080) [[19.0.1|v1275133992]] (19.0.1.40) [[19.0.1|v1275138972]] (19.0.1.5020) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[19.0.2|v1275199548]] (19.0.2.60) [[22.0.0|v1476396108]] (22.0.0.1100) || NgWord || Bad words.
|-
| 0100000000000807 || [[1.0.0|v260]] (0.0.0.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[9.0.0|v603980216]] (9.0.0.440) [[10.0.0|v671088940]] (10.0.0.300) [[10.1.0|v672137336]] (10.1.0.120) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || SsidList || [[Hotspot List]].
|-
| 0100000000000808 || [[1.0.0|v450]] (0.0.0.450) [[6.2.0|v404750376]] (6.2.0.40) || Dictionary || European, English, and Japanese dictionaries.
|-
| 0100000000000809 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.1.0|v196628]] (0.0.3.20) [[2.2.0|v196628]] (0.0.3.20) [[2.3.0|v262164]] (0.0.4.20) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[3.0.2|v201457684]] (3.0.2.20) [[4.0.0|v268435656]] (4.0.0.200) [[4.0.1|v268501002]] (4.0.1.10) [[4.1.0|v269484082]] (4.1.0.50) [[5.0.0|v335544750]] (5.0.0.430) [[5.0.1|v335609886]] (5.0.1.30) [[5.0.2|v335675432]] (5.0.2.40) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.0.1|v402718730]] (6.0.1.10) [[6.1.0|v403701850]] (6.1.0.90) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[7.0.1|v469827614]] (7.0.1.30) [[8.0.0|v536871442]] (8.0.0.530) [[8.0.1|v536936528]] (8.0.1.80) [[8.1.0|v537919608]] (8.1.0.120) [[8.1.1|v537985054]] (8.1.1.30) [[9.0.0|v603980216]] (9.0.0.440) [[9.0.1|v604045412]] (9.0.1.100) [[9.1.0|v6050285192]] (9.1.0.240) [[9.2.0|v606076948]] (9.2.0.20) [[10.0.0|v671089000]] (10.0.0.360) [[10.0.1|v671154196]] (10.0.1.20) [[10.0.2|v671219752]] (10.0.2.40) [[10.0.3|v671285268]] (10.0.3.20) [[10.0.4|v671350804]] (10.0.4.20) [[10.1.0|v672137336]] (10.1.0.120) [[10.1.1|v672202772]] (10.1.1.20) [[10.2.0|v673185852]] (10.2.0.60) [[11.0.0|v738197944]] (11.0.0.440) [[11.0.1|v738263060]] (11.0.1.20) [[12.0.0|v805308888]] (12.0.0.2520) [[12.0.1|v805371944]] (12.0.1.40) [[12.0.2|v805437460]] (12.0.2.20) [[12.0.3|v805502996]] (12.0.3.20) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[13.1.0|v873463968]] (13.1.0.160) [[13.2.0|v874512404]] (13.2.0.20) [[13.2.1|v874578000]] (13.2.1.80) [[14.0.0|v939525336]] (14.0.0.1240) [[14.1.0|v940572692]] (14.1.0.20) [[14.1.1|v940638228]] (14.1.1.20) [[14.1.2|v940703804]] (14.1.2.60) [[15.0.0|v1006634160]] (15.0.0.1200) [[15.0.1|v1006698596]] (15.0.1.100) [[16.0.0|v1073742904]] (16.0.0.1080) [[16.0.1|v1073807420]] (16.0.1.60) [[16.0.2|v1073872936]] (16.0.2.40) [[16.0.3|v1073938452]] (16.0.3.20) [[16.1.0|v1074790880]] (16.1.0.480) [[17.0.0|v1140851708]] (17.0.0.1020) [[17.0.1|v1140916284]] (17.0.1.60) [[18.0.0|v1207960692]] (18.0.0.1140) [[18.0.1|v1208025188]] (18.0.1.100) [[18.1.0|v1209008288]] (18.1.0.160) [[19.0.0|v1275069496]] (19.0.0.1080) [[19.0.1|v1275134052]] (19.0.1.100) [[20.0.0|v1342179000]] (20.0.0.1720) [[20.0.1|v1342242836]] (20.0.1.20) [[20.1.0|v1343226216]] (20.1.0.360) [[20.1.1|v1343291412]] (20.1.1.20) [[20.1.5|v1343553696]] (20.1.5.160) [[20.2.0|v1344274732]] (20.2.0.300) [[20.3.0|v1345323088]] (20.3.0.80) [[20.4.0|v1346371784]] (20.4.0.200) [[20.5.0|v1347420260]] (20.5.0.100) [[21.0.0|v1409287084]] (21.0.0.940) [[21.0.1|v1409351720]] (21.0.1.40) [[21.1.0|v1410335000]] (21.1.0.280) [[21.2.0|v1411383436]] (21.2.0.140) [[19.0.2|v1275199548]] (19.0.2.60) [[22.0.0|v1476396108]] (22.0.0.1100) [[22.1.0|v1477443784]] (22.1.0.200) [[22.5.0|v1481638368]] (22.5.0.480) || SystemVersion || [[System Version Title]].
|-
| 010000000000080A || [[1.0.0|v450]] (0.0.0.450) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[8.1.1|v536871444]] (8.0.0.532) [[9.0.0|v603980216]] (9.0.0.440) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197804]] (11.0.0.300) [[20.0.0|v1342178920]] (20.0.0.1640) [[22.0.0|v1476396108]] (22.0.0.1100) || AvatarImage || Background and Character images for user avatars (RGBA format & Yaz0 compression).
|-
| 010000000000080B || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[6.0.0|v402653544]] (6.0.0.360) [[6.1.0|v403701850]] (6.1.0.90) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[8.1.1|v536871444]] (8.0.0.532) [[9.0.0|v603980216]] (9.0.0.440) [[9.1.0|v605028512]] (9.1.0.160) [[11.0.0|v738197804]] (11.0.0.300) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[13.1.0|v873463908]] (13.1.0.100) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[18.0.0|v1207960612]] (18.0.0.1060) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) || LocalNews || Tutorial images and strings. Used for the offline news by the News applet.
|-
| 010000000000080C || [[1.0.0|v450]] (0.0.0.450) [[8.0.0|v536871442]] (8.0.0.530) [[8.1.1|v536871444]] (8.0.0.532) [[9.0.0|v603980216]] (9.0.0.440) [[9.1.0|v605028512]] (9.1.0.160) [[11.0.0|v738197804]] (11.0.0.300) [[16.0.0|v1073742864]] (16.0.0.1040) || Eula (Eura) || Accessed by [[NS_Services|NS]].
|-
| 010000000000080D || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[6.2.0|v404750376]] (6.2.0.40) [[10.0.0|v671088940]] (10.0.0.300) [[10.2.0|v673185852]] (10.2.0.60) [[12.1.0|v806355064]] (12.1.0.120) [[15.0.0|v1006634080]] (15.0.0.1120) [[20.0.0|v1342178920]] (20.0.0.1640) || UrlBlackList ||
|-
| 010000000000080E || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[9.0.0|v603980216]] (9.0.0.440) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || TimeZoneBinary ||
|-
| 010000000000080F || || CertStoreCruiser (BrowserCertStore) || Currently not present on retail devices.
|-
| 0100000000000810 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[9.0.0|v603980216]] (9.0.0.440) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[16.1.0|v1074790880]] (16.1.0.480) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || FontNintendoExtension ||
|-
| 0100000000000811 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[9.0.0|v603980216]] (9.0.0.440) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || FontStandard ||
|-
| 0100000000000812 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[9.0.0|v603980216]] (9.0.0.440) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || FontKorean ||
|-
| 0100000000000813 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[9.0.0|v603980216]] (9.0.0.440) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || FontChineseTraditional ||
|-
| 0100000000000814 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[9.0.0|v603980216]] (9.0.0.440) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[16.1.0|v1074790880]] (16.1.0.480) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || FontChineseSimple ||
|-
| 0100000000000815 || || FontBfcpx || Currently not present on retail devices.
|-
| 0100000000000816 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.1.0|v131162]] (0.0.2.90) [[2.2.0|v196628]] (0.0.3.20) [[2.3.0|v262164]] (0.0.4.20) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[3.0.2|v201457684]] (3.0.2.20) [[4.0.0|v268435656]] (4.0.0.200) [[4.0.1|v268501002]] (4.0.1.10) [[4.1.0|v269484082]] (4.1.0.50) [[5.0.0|v335544750]] (5.0.0.430) [[5.0.1|v335609886]] (5.0.1.30) [[5.0.2|v335675432]] (5.0.2.40) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.0.1|v402718730]] (6.0.1.10) [[6.1.0|v403701850]] (6.1.0.90) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[7.0.1|v469827614]] (7.0.1.30) [[8.0.0|v536871442]] (8.0.0.530) [[8.0.1|v536936528]] (8.0.1.80) [[8.1.0|v537919608]] (8.1.0.120) [[8.1.1|v537985054]] (8.1.1.30) [[9.0.0|v603980216]] (9.0.0.440) [[9.0.1|v604045412]] (9.0.1.100) [[9.1.0|v605028592]] (9.1.0.240) [[9.2.0|v606076948]] (9.2.0.20) [[10.0.0|v671089000]] (10.0.0.360) [[10.0.1|v671154196]] (10.0.1.20) [[10.0.2|v671219752]] (10.0.2.40) [[10.0.3|v671285268]] (10.0.3.20) [[10.0.4|v671350804]] (10.0.4.20) [[10.1.0|v672137336]] (10.1.0.120) [[10.1.1|v672202772]] (10.1.1.20) [[10.2.0|v673185852]] (10.2.0.60) [[11.0.0|v738197944]] (11.0.0.440) [[11.0.1|v738263060]] (11.0.1.20) [[11.0.1|v738264040]] (11.0.1.1000) [[12.0.0|v805308888]] (12.0.0.2520) [[12.0.1|v805371944]] (12.0.1.40) [[12.0.2|v805437460]] (12.0.2.20) [[12.0.3|v805502996]] (12.0.3.20) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[13.1.0|v873463968]] (13.1.0.160) [[13.2.0|v874512404]] (13.2.0.20) [[13.2.1|v874578000]] (13.2.1.80) [[14.0.0|v939525336]] (14.0.0.1240) [[14.1.0|v940572692]] (14.1.0.20) [[14.1.1|v940638228]] (14.1.1.20) [[14.1.2|v940703804]] (14.1.2.60) [[14.1.2|v940708804]] (14.1.2.5060) [[14.1.2|v940709764]] (14.1.2.6020) [[14.1.2|v940711764]] (14.1.2.8020) [[15.0.0|v1006634160]] (15.0.0.1200) [[15.0.1|v1006698596]] (15.0.1.100) [[16.0.0|v1073742904]] (16.0.0.1080) [[16.0.1|v1073807420]] (16.0.1.60) [[16.0.2|v1073872936]] (16.0.2.40) [[16.0.3|v1073938452]] (16.0.3.20) [[16.0.3|v1073943452]] (16.0.3.5020) [[16.0.3|v1073944452]] (16.0.3.6020) [[16.1.0|v1074790880]] (16.1.0.480) [[17.0.0|v1140851708]] (17.0.0.1020) [[17.0.0|v1140855708]] (17.0.0.5020) [[17.0.1|v1140916284]] (17.0.1.60) [[18.0.0|v1207960692]] (18.0.0.1140) [[18.0.1|v1208025188]] (18.0.1.100) [[18.1.0|v1209008288]] (18.1.0.160) [[18.1.0|v1209013148]] (18.1.0.5020) [[19.0.0|v1275069496]] (19.0.0.1080) [[19.0.1|v1275134052]] (19.0.1.100) [[19.0.1|v1275138972]] (19.0.1.5020) [[20.0.0|v1342179000]] (20.0.0.1720) [[20.0.1|v1342242836]] (20.0.1.20) [[20.1.0|v1343226216]] (20.1.0.360) [[20.1.1|v1343291412]] (20.1.1.20) [[20.1.5|v1343553696]] (20.1.5.160) [[20.2.0|v1344274732]] (20.2.0.300) [[20.3.0|v1345323088]] (20.3.0.80) [[20.4.0|v1346371784]] (20.4.0.200) [[20.5.0|v1347420260]] (20.5.0.100) [[21.0.0|v1409287084]] (21.0.0.940) [[21.0.1|v1409351720]] (21.0.1.40) [[21.1.0|v1410335000]] (21.1.0.280) [[21.2.0|v1411383436]] (21.2.0.140) [[19.0.2|v1275199548]] (19.0.2.60) [[22.0.0|v1476396108]] (22.0.0.1100) [[22.1.0|v1477443784]] (22.1.0.200) [[22.5.0|v1481638368]] (22.5.0.480) || SystemUpdate || Contains the title-listing for the associated sysupdate in the [[NCA]]-type0 .cnmt.
|-
| 0100000000000818 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.3.0|v131082]] (0.0.2.10) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) [[4.1.0|v269484082]] (4.1.0.50) [[5.0.0|v335544750]] (5.0.0.430) [[5.0.1|v335609886]] (5.0.1.30) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.1.0|v403701850]] (6.1.0.90) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[9.0.0|v603980216]] (9.0.0.440) [[9.1.0|v605028512]] (9.1.0.160) [[10.0.0|v671088940]] (10.0.0.300) [[10.1.0|v672137336]] (10.1.0.120) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220)) [[13.1.0|v873463948]] (13.1.0.140) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) [[22.5.0|v1481638368]] (22.5.0.480) || FirmwareDebugSettings || [[System Settings|System config]].
|-
| 0100000000000819 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.1.0|v131082]] (0.0.2.10) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[3.0.2|v201457684]] (3.0.2.20) [[4.0.0|v268435656]] (4.0.0.200) [[4.1.0|v269484082]] (4.1.0.50) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[7.0.1|v469827614]] (7.0.1.30) [[8.0.0|v536871442]] (8.0.0.530) [[8.1.0|v537919608]] (8.1.0.120) [[8.1.1|v537919608]] (8.1.0.122) [[9.0.0|v603980216]] (9.0.0.440) [[9.1.0|v605028512]] (9.1.0.160) [[9.2.0|v606076948]] (9.2.0.20) [[10.0.0|v671088940]] (10.0.0.300) [[10.1.0|v672137336]] (10.1.0.120) [[10.2.0|v673185832]] (10.2.0.40) [[11.0.0|v738197904]] (11.0.0.400) [[11.0.1|v738263060]] (11.0.1.20) [[12.0.0|v805308868]] (12.0.0.2500) [[12.0.2|v805437460]] (12.0.2.20) [[12.0.3|v805502996]] (12.0.3.20) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220)) [[13.1.0|v873463948]] (13.1.0.140) [[13.2.1|v874578000]] (13.2.1.80) [[14.0.0|v939525336]] (14.0.0.1240) [[14.1.2|v940703804]] (14.1.2.60) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[16.0.3|v1073938452]] (16.0.3.20) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[18.1.0|v1209008288]] (18.1.0.160) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342179000]] (20.0.0.1720) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[21.2.0|v1411383436]] (21.2.0.140) [[22.0.0|v1476396108]] (22.0.0.1100) [[22.5.0|v1481638368]] (22.5.0.480) || BootImagePackage || Firmware Package A: Normal Firmware.
|-
| 010000000000081A || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.1.0|v131082]] (0.0.2.10) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[3.0.2|v201457684]] (3.0.2.20) [[4.0.0|v268435656]] (4.0.0.200) [[4.1.0|v269484082]] (4.1.0.50) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[7.0.1|v469827614]] (7.0.1.30) [[8.0.0|v536871442]] (8.0.0.530) [[8.1.0|v537919608]] (8.1.0.120) [[8.1.1|v537919608]] (8.1.0.122) [[9.0.0|v603980216]] (9.0.0.440) [[9.1.0|v605028512]] (9.1.0.160) [[9.2.0|v606076948]] (9.2.0.20) [[10.0.0|v671088940]] (10.0.0.300) [[10.1.0|v672137336]] (10.1.0.120) [[10.2.0|v673185832]] (10.2.0.40) [[11.0.0|v738197904]] (11.0.0.400) [[11.0.1|v738263060]] (11.0.1.20) [[12.0.0|v805308868]] (12.0.0.2500) [[12.0.2|v805437460]] (12.0.2.20) [[12.0.3|v805502996]] (12.0.3.20) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220)) [[13.1.0|v873463948]] (13.1.0.140) [[13.2.1|v874578000]] (13.2.1.80) [[14.0.0|v939525336]] (14.0.0.1240) [[14.1.2|v940703804]] (14.1.2.60) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[16.0.3|v1073938452]] (16.0.3.20) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[18.1.0|v1209008288]] (18.1.0.160) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342179000]] (20.0.0.1720) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[21.2.0|v1411383436]] (21.2.0.140) [[22.0.0|v1476396108]] (22.0.0.1100) [[22.5.0|v1481638368]] (22.5.0.480) || BootImagePackageSafe || Firmware Package B: SafeMode Firmware. See [[Boot_Modes#Safe_Mode|Safe Mode]].
|-
| 010000000000081B || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.1.0|v131082]] (0.0.2.10) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[3.0.2|v201457684]] (3.0.2.20) [[4.0.0|v268435656]] (4.0.0.200) [[4.1.0|v269484082]] (4.1.0.50) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[7.0.1|v469827614]] (7.0.1.30) [[8.0.0|v536871442]] (8.0.0.530) [[8.1.0|v537919608]] (8.1.0.120) [[8.1.1|v537919608]] (8.1.0.122) [[9.0.0|v603980216]] (9.0.0.440) [[9.1.0|v605028512]] (9.1.0.160) [[9.2.0|v606076948]] (9.2.0.20) [[10.0.0|v671088940]] (10.0.0.300) [[10.1.0|v672137336]] (10.1.0.120) [[10.2.0|v673185832]] (10.2.0.40) [[11.0.0|v738197904]] (11.0.0.400) [[11.0.1|v738263060]] (11.0.1.20) [[12.0.0|v805308868]] (12.0.0.2500) [[12.0.2|v805437460]] (12.0.2.20) [[12.0.3|v805502996]] (12.0.3.20) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220)) [[13.1.0|v873463948]] (13.1.0.140) [[13.2.1|v874578000]] (13.2.1.80) [[14.0.0|v939525336]] (14.0.0.1240) [[14.1.2|v940703804]] (14.1.2.60) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[16.0.3|v1073938452]] (16.0.3.20) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[18.1.0|v1209008288]] (18.1.0.160) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342179000]] (20.0.0.1720) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[21.2.0|v1411383436]] (21.2.0.140) [[22.0.0|v1476396108]] (22.0.0.1100) [[22.5.0|v1481638368]] (22.5.0.480) || BootImagePackageExFat || Firmware Package C: Normal Firmware (exFAT variant). Identical to 0100000000000819 with different FS sysmodule. Requires a device ID to download from CDN.
|-
| 010000000000081C || [[4.0.0|v268435656]] (4.0.0.200) [[4.1.0|v269484082]] (4.1.0.50) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[7.0.1|v469827614]] (7.0.1.30) [[8.0.0|v536871442]] (8.0.0.530) [[8.1.0|v537919608]] (8.1.0.120) [[8.1.1|v537919608]] (8.1.0.122) [[9.0.0|v603980216]] (9.0.0.440) [[9.1.0|v605028512]] (9.1.0.160) [[9.2.0|v606076948]] (9.2.0.20) [[10.0.0|v671088940]] (10.0.0.300) [[10.1.0|v672137336]] (10.1.0.120) [[10.2.0|v673185832]] (10.2.0.40) [[11.0.0|v738197904]] (11.0.0.400) [[11.0.1|v738263060]] (11.0.1.20) [[12.0.0|v805308868]] (12.0.0.2500) [[12.0.2|v805437460]] (12.0.2.20) [[12.0.3|v805502996]] (12.0.3.20) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220)) [[13.1.0|v873463948]] (13.1.0.140) [[13.2.1|v874578000]] (13.2.1.80) [[14.0.0|v939525336]] (14.0.0.1240) [[14.1.2|v940703804]] (14.1.2.60) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[16.0.3|v1073938452]] (16.0.3.20) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[18.1.0|v1209008288]] (18.1.0.160) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342179000]] (20.0.0.1720) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[21.2.0|v1411383436]] (21.2.0.140) [[22.0.0|v1476396108]] (22.0.0.1100) [[22.5.0|v1481638368]] (22.5.0.480) || [4.0.0+] BootImagePackageExFatSafe || Firmware Package D: SafeMode Firmware (exFAT variant). Identical to 010000000000081A with different FS sysmodule. Requires a device ID to download from CDN.
|-
| 010000000000081D || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[9.0.0|v603980216]] (9.0.0.440) [[10.0.0|v671088940]] (10.0.0.300) [[10.1.0|v672137336]] (10.1.0.120) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || FatalMessage || Errdisp strings.
|-
| 010000000000081E || [[2.0.0|v260]] (0.0.0.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[8.0.0|v536871442]] (8.0.0.530) [[8.1.1|v536871444]] (8.0.0.532) [[9.0.0|v603980216]] (9.0.0.440) [[11.0.0|v738197804]] (11.0.0.300) [[13.1.0|v873463908]] (13.1.0.100) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) || [2.0.0+] ControllerIcon || Controller gfx/icon data + dummy file.
|-
| 010000000000081F || [[2.0.0|v260]] (0.0.0.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[9.0.0|v603980216]] (9.0.0.440) [[9.1.0|v605028512]] (9.1.0.160) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || [2.0.0+] PlatformConfigIcosa || Icosa system config.
|-
| 0100000000000820 || [[2.0.0|v260]] (0.0.0.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[9.0.0|v603980216]] (9.0.0.440) [[9.1.0|v605028512]] (9.1.0.160) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || [2.0.0+] PlatformConfigCopper || Copper system config.
|-
| 0100000000000821 || [[2.0.0|v260]] (0.0.0.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.2.0|v404750376]] (6.2.0.40) [[8.1.1|v536871444]] (8.0.0.532) [[9.0.0|v603980216]] (9.0.0.440) [[9.1.0|v605028512]] (9.1.0.160) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || [2.0.0+] PlatformConfigHoag || Hoag system config.
|-
| 0100000000000822 || [[3.0.0|v201327002]] (3.0.0.410) [[3.0.2|v201457684]] (3.0.2.20) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[8.1.1|v536871444]] (8.0.0.532) [[9.0.0|v603980216]] (9.0.0.440) [[10.0.0|v671088940]] (10.0.0.300) [[10.0.2|v671219752]] (10.0.2.40) [[10.1.0|v672137336]] (10.1.0.120) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220)) [[13.1.0|v873463948]] (13.1.0.140) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || [3.0.0+] ControllerFirmware || Firmware binaries for peripherals (hardware within Joy-Cons/etc).
|-
| 0100000000000823 || [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[9.0.0|v603980216]] (9.0.0.440) [[10.0.0|v671088940]] (10.0.0.300) [[10.2.0|v673185832]] (10.2.0.40) [[11.0.0|v738197904]] (11.0.0.400) [[11.0.1|v738264040]] (11.0.1.1000) [[12.0.0|v805308868]] (12.0.0.2500) [[12.0.1|v805371944]] (12.0.1.40) [[12.0.3|v805502996]] (12.0.3.20) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[14.1.1|v940638228]] (14.1.1.20) [[14.1.2|v940703804]] (14.1.2.60) [[14.1.2|v940708804]] (14.1.2.5060) [[14.1.2|v940709764]] (14.1.2.6020) [[14.1.2|v940711764]] (14.1.2.8020) [[15.0.0|v1006634080]] (15.0.0.1120) [[15.0.1|v1006698596]] (15.0.1.100) [[16.0.0|v1073742864]] (16.0.0.1040) [[16.0.1|v1073807420]] (16.0.1.60) [[16.0.2|v1073872936]] (16.0.2.40) [[16.0.3|v1073943452]] (16.0.3.5020) [[16.0.3|v1073944452]] (16.0.3.6020) [[16.1.0|v1074790880]] (16.1.0.480) [[17.0.0|v1140851648]] (17.0.0.960) [[17.0.0|v1140855708]] (17.0.0.5020) [[18.0.0|v1207960612]] (18.0.0.1060) [[18.1.0|v1209008288]] (18.1.0.160) [[18.1.0|v1209013148]] (18.1.0.5020) [[19.0.0|v1275069496]] (19.0.0.1080) [[19.0.1|v1275133992]] (19.0.1.40) [[19.0.1|v1275138972]] (19.0.1.5020) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[19.0.2|v1275199548]] (19.0.2.60) [[22.0.0|v1476396108]] (22.0.0.1100) || [3.0.0+] NgWord2 || Contains version.dat and ac_*_nx files. All of the *_nx files stored under here are compressed with gzip.
|-
| 0100000000000824 || [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[9.0.0|v603980216]] (9.0.0.440) [[9.1.0|v605028512]] (9.1.0.160) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || [5.0.0+] PlatformConfigIcosaMariko || IcosaMariko system config.
|-
| 0100000000000825 || [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[9.0.0|v603980216]] (9.0.0.440) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197804]] (11.0.0.300) || [5.0.0+] ApplicationBlackList || Used by [[NS_Services|NS]] for restricting application installation and updates.
|-
| 0100000000000826 || [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.1.0|v403701850]] (6.1.0.90) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[8.1.0|v537919608]] (8.1.0.120) [[9.0.0|v603980216]] (9.0.0.440) [[9.1.0|v605028512]] (9.1.0.160) [[10.0.0|v671088940]] (10.0.0.300) [[10.1.0|v672137336]] (10.1.0.120) [[11.0.0|v738197904]] (11.0.0.400) [[11.0.1|v738264040]] (11.0.1.1000) [[12.0.0|v805308868]] (12.0.0.2500) [[12.0.1|v805371944]] (12.0.1.40) [[12.0.3|v805502996]] (12.0.3.20) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[13.1.0|v873463908]] (13.1.0.100) [[14.0.0|v939525336]] (14.0.0.1240) [[14.1.1|v940638228]] (14.1.1.20) [[14.1.2|v940703804]] (14.1.2.60) [[14.1.2|v940708804]] (14.1.2.5060) [[14.1.2|v940709764]] (14.1.2.6020) [[14.1.2|v940711764]] (14.1.2.8020) [[15.0.0|v1006634080]] (15.0.0.1120) [[15.0.1|v1006698596]] (15.0.1.100) [[16.0.0|v1073742864]] (16.0.0.1040) [[16.0.1|v1073807420]] (16.0.1.60) [[16.0.2|v1073872936]] (16.0.2.40) [[16.0.3|v1073943452]] (16.0.3.5020) [[16.0.3|v1073944452]] (16.0.3.6020) [[16.1.0|v1074790880]] (16.1.0.480) [[17.0.0|v1140851668]] (17.0.0.980) [[17.0.0|v1140855708]] (17.0.0.5020) [[18.0.0|v1207960612]] (18.0.0.1060) [[18.1.0|v1209008288]] (18.1.0.160) [[18.1.0|v1209013148]] (18.1.0.5020) [[19.0.0|v1275069496]] (19.0.0.1080) [[19.0.1|v1275133992]] (19.0.1.40) [[19.0.1|v1275138972]] (19.0.1.5020) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[19.0.2|v1275199548]] (19.0.2.60) [[22.0.0|v1476396108]] (22.0.0.1100) || [5.0.0+] RebootlessSystemUpdateVersion || Rebootless system update version file.
|-
| 0100000000000827 || [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[9.0.0|v603980216]] (9.0.0.440) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || [5.1.0+] ContentActionTable || Used by [[AM_services|AM]].
|-
| 0100000000000828 || [[8.0.0|v536871442]] (8.0.0.530) [[9.0.0|v603980216]] (9.0.0.440) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197804]] (11.0.0.300) || [8.0.0+] FunctionBlackList || Used for restricting specific features in applications.
|-
| 0100000000000829 || || PlatformConfigCalcio || Calcio system config. Currently not present on retail devices.
|-
| 0100000000000830 || [[9.0.0|v603980216]] (9.0.0.440) [[9.1.0|v605028512]] (9.1.0.160) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197904]] (11.0.0.400) [[12.0.0|v805308868]] (12.0.0.2500) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || [9.0.0+] NgWordT || Bad words for China region (Tencent).
|-
| 0100000000000831 || [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || [13.0.0+] PlatformConfigAula || Aula system config.
|-
| 0100000000000832 || [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851648]] (17.0.0.960) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || [13.0.0+] CradleFirmware || Firmware binaries for Aula's dock.
|-
| 0100000000000835 || || [16.0.0+] ErrorMessageUtf8 || Currently not present on NX retail devices. Used by <code>nn::err::detail::MountErrorMessageSystemData</code> when the input <code>nn::err::ErrorMessageDatabaseType</code> is non-zero (retail NX [[Error_Applet|LibraryAppletError]] passes hard-coded value 0).
|-
| 0100000000000859 || [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[20.2.0|v1344274732]] (20.2.0.300) [[20.3.0|v1345323088]] (20.3.0.80) [[20.4.0|v1346371784]] (20.4.0.200) [[21.0.0|v1409287084]] (21.0.0.940) [[21.1.0|v1410335000]] (21.1.0.280) [[21.2.0|v1411383436]] (21.2.0.140) [[22.0.0|v1476396108]] (22.0.0.1100) [[22.5.0|v1481638368]] (22.5.0.480) || [20.0.0+] ClientCertData || [22.5.0+] Contains "meta.json", "eshop_hac_prod.p12" and "eshop_hac_urls.txt" ([20.0.0-22.1.0] contains an empty "meta.json", web applets try to use this for constructing a SSL client certificate).
|-
| 010000000000085C || [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || [20.0.0+] GameCardConfigurationData ||
|}

= System Applets =
{| class=wikitable
! ProgramId || Versions || Description || Notes
|-
| 0100000000001000 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.1.0|v131162]] (0.0.2.90) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.0.1|v335609886]] (5.0.1.30) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.0.1|v402718730]] (6.0.1.10) [[6.1.0|v403701850]] (6.1.0.90) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[8.0.1|v536936528]] (8.0.1.80) [[8.1.0|v537919608]] (8.1.0.120) [[8.1.1|v537919570]] (8.1.0.82) [[9.0.0|v603980216]] (9.0.0.440) [[9.1.0|v605028512]] (9.1.0.160) [[10.0.0|v671088940]] (10.0.0.300) [[10.1.0|v672137336]] (10.1.0.120) [[10.1.1|v672202772]] (10.1.1.20) [[11.0.0|v738197944]] (11.0.0.440) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[13.1.0|v873463908]] (13.1.0.100) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[16.1.0|v1074790860]] (16.1.0.460) [[17.0.0|v1140851668]] (17.0.0.980) [[18.0.0|v1207960612]] (18.0.0.1060) [[18.1.0|v1209008288]] (18.1.0.160) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342179000]] (20.0.0.1720) [[20.1.0|v1343226216]] (20.1.0.360) [[20.1.5|v1343553676]] (20.1.5.140) [[20.2.0|v1344274732]] (20.2.0.300) [[21.0.0|v1409287084]] (21.0.0.940) [[21.1.0|v1410335000]] (21.1.0.280) [[21.2.0|v1411383436]] (21.2.0.140) [[22.0.0|v1476396108]] (22.0.0.1100) [[22.1.0|v1477443784]] (22.1.0.200) [[22.5.0|v1481638368]] (22.5.0.480) || qlaunch (SystemAppletMenu) || [[qlaunch]] system applet. Launched by [[NS_Services#LaunchSystemApplet|ns]].
|-
| 0100000000001001 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[8.1.1|v536871444]] (8.0.0.532) [[9.0.0|v603980216]] (9.0.0.440) [[9.1.0|v605028512]] (9.1.0.160) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197804]] (11.0.0.300) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[16.0.0|v1073742864]] (16.0.0.1040) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[20.2.0|v1344274732]] (20.2.0.300) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) [[22.5.0|v1481638368]] (22.5.0.480) || [[Auth_Applet|auth]] (LibraryAppletAuth)||
|-
| 0100000000001002 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[8.1.1|v536871444]] (8.0.0.532) [[9.0.0|v603980216]] (9.0.0.440) [[9.1.0|v605028512]] (9.1.0.160) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197804]] (11.0.0.300) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[18.0.0|v1207960612]] (18.0.0.1060) [[20.0.0|v1342178920]] (20.0.0.1640) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || cabinet (LibraryAppletCabinet) ||
|-
| 0100000000001003 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[8.1.1|v536871464]] (8.0.0.552) [[9.0.0|v603980216]] (9.0.0.440) [[9.1.0|v605028512]] (9.1.0.160) [[10.0.0|v671088960]] (10.0.0.320) [[10.1.0|v672137336]] (10.1.0.120) [[11.0.0|v738197804]] (11.0.0.300) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[13.1.0|v873463908]] (13.1.0.100) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.1.0|v1074790860]] (16.1.0.460) [[17.0.0|v1140851668]] (17.0.0.980) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || [[Controller_Applet|controller]] (LibraryAppletController) ||
|-
| 0100000000001004 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[8.1.1|v536871444]] (8.0.0.532) [[9.0.0|v603980216]] (9.0.0.440) [[9.1.0|v605028512]] (9.1.0.160) [[10.0.0|v671088940]] (10.0.0.300) [[10.2.0|v673185852]] (10.2.0.60) [[11.0.0|v738197804]] (11.0.0.300) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || dataErase (LibraryAppletDataErase) ||
|-
| 0100000000001005 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[8.1.1|v536871444]] (8.0.0.532) [[9.0.0|v603980216]] (9.0.0.440) [[9.1.0|v605028512]] (9.1.0.160) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197804]] (11.0.0.300) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851668]] (17.0.0.980) [[18.0.0|v1207960612]] (18.0.0.1060) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[20.2.0|v1344274732]] (20.2.0.300) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) [[22.5.0|v1481638368]] (22.5.0.480) || [[Error_Applet|error]] (LibraryAppletError) ||
|-
| 0100000000001006 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[8.1.1|v536871444]] (8.0.0.532) [[9.0.0|v603980216]] (9.0.0.440) [[9.1.0|v605028512]] (9.1.0.160) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197804]] (11.0.0.300) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.1.0|v1074790860]] (16.1.0.460) [[18.0.0|v1207960612]] (18.0.0.1060) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[20.2.0|v1344274732]] (20.2.0.300) [[22.0.0|v1476396108]] (22.0.0.1100) || netConnect (LibraryAppletNetConnect) ||
|-
| 0100000000001007 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.1.0|v403701850]] (6.1.0.90) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[8.1.1|v536871444]] (8.0.0.532) [[9.0.0|v603980216]] (9.0.0.440) [[9.1.0|v605028512]] (9.1.0.160) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197804]] (11.0.0.300) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[13.1.0|v873463908]] (13.1.0.100) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[17.0.0|v1140851668]] (17.0.0.980) [[18.0.0|v1207960612]] (18.0.0.1060) [[18.1.0|v1209008288]] (18.1.0.160) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[20.2.0|v1344274732]] (20.2.0.300) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) [[22.5.0|v1481638368]] (22.5.0.480) || [[Profile Selector|playerSelect (LibraryAppletPlayerSelect)]] ||
|-
| 0100000000001008 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.1.0|v131132]] (0.0.2.60) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[8.1.1|v536871444]] (8.0.0.532) [[9.0.0|v603980216]] (9.0.0.440) [[9.1.0|v605028512]] (9.1.0.160) [[10.0.0|v671088940]] (10.0.0.300) [[10.1.0|v672137336]] (10.1.0.120) [[11.0.0|v738197864]] (11.0.0.360) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[16.1.0|v1074790860]] (16.1.0.460) [[20.0.0|v1342178920]] (20.0.0.1640) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) [[22.5.0|v1481638368]] (22.5.0.480) || [[Software Keyboard|swkbd (LibraryAppletSwkbd)]] ||
|-
| 0100000000001009 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.1.1|v536871444]] (8.0.0.532) [[9.0.0|v603980216]] (9.0.0.440) [[9.1.0|v605028512]] (9.1.0.160) [[10.0.0|v671088940]] (10.0.0.300) [[10.2.0|v673185852]] (10.2.0.60) [[14.0.0|v939525336]] (14.0.0.1240) [[20.0.0|v1342178920]] (20.0.0.1640) [[21.0.0|v1409287084]] (21.0.0.940) || miiEdit (LibraryAppletMiiEdit) ||
|-
| 010000000000100A || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.1.0|v131162]] (0.0.2.90) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.1.0|v403701850]] (6.1.0.90) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[8.1.0|v537919608]] (8.1.0.120) [[9.0.0|v603980216]] (9.0.0.440) [[9.0.1|v604045412]] (9.0.1.100) [[9.1.0|v605028592]] (9.1.0.240) [[10.0.0|v671088960]] (10.0.0.320) [[10.0.4|v671350804]] (10.0.4.20) [[11.0.0|v738197864]] (11.0.0.360) [[12.0.0|v805307608]] (12.0.0.1240) [[12.1.0|v806355064]] (12.1.0.120) [[13.1.0|v873463908]] (13.1.0.100) [[14.0.0|v939525336]] (14.0.0.1240) [[14.1.1|v940638228]] (14.1.1.20) [[15.0.0|v1006634080]] (15.0.0.1120) [[15.0.1|v1006698596]] (15.0.1.100) [[16.0.0|v1073742904]] (16.0.0.1080) [[16.1.0|v1074790860]] (16.1.0.460) [[17.0.0|v1140851708]] (17.0.0.1020) [[18.1.0|v1209008288]] (18.1.0.160) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[20.2.0|v1344274732]] (20.2.0.300) [[20.3.0|v1345323088]] (20.3.0.80) [[20.4.0|v1346371784]] (20.4.0.200) [[21.0.0|v1409287084]] (21.0.0.940) [[21.1.0|v1410335000]] (21.1.0.280) [[21.2.0|v1411383436]] (21.2.0.140) [[22.0.0|v1476396108]] (22.0.0.1100) || LibAppletWeb (LibraryAppletWeb) || [[Internet_Browser|WebApplet]]. [22.0.0+] Stubbed.
|-
| 010000000000100B || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.1.0|v131162]] (0.0.2.90) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.1.0|v403701850]] (6.1.0.90) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[8.1.0|v537919608]] (8.1.0.120) [[9.0.0|v603980216]] (9.0.0.440) [[9.0.1|v604045412]] (9.0.1.100) [[9.1.0|v605028592]] (9.1.0.240) [[10.0.0|v671088960]] (10.0.0.320) [[10.0.4|v671350804]] (10.0.4.20) [[11.0.0|v738197864]] (11.0.0.360) [[12.0.0|v805307608]] (12.0.0.1240) [[12.1.0|v806355064]] (12.1.0.120) [[13.1.0|v873463908]] (13.1.0.100) [[14.0.0|v939525336]] (14.0.0.1240) [[14.1.1|v940638228]] (14.1.1.20) [[15.0.0|v1006634080]] (15.0.0.1120) [[15.0.1|v1006698596]] (15.0.1.100) [[16.0.0|v1073742904]] (16.0.0.1080) [[16.1.0|v1074790860]] (16.1.0.460) [[17.0.0|v1140851708]] (17.0.0.1020) [[18.1.0|v1209008288]] (18.1.0.160) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[20.2.0|v1344274732]] (20.2.0.300) [[20.3.0|v1345323088]] (20.3.0.80) [[20.4.0|v1346371784]] (20.4.0.200) [[21.0.0|v1409287084]] (21.0.0.940) [[21.1.0|v1410335000]] (21.1.0.280) [[21.2.0|v1411383436]] (21.2.0.140) [[22.0.0|v1476396108]] (22.0.0.1100) || LibAppletShop (LibraryAppletShop) || [[Internet_Browser|ShopN]] applet. [22.0.0+] Stubbed.
|-
| 010000000000100C || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.1.0|v403701850]] (6.1.0.90) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[8.1.1|v536871444]] (8.0.0.532) [[9.0.0|v603980216]] (9.0.0.440) [[9.1.0|v605028512]] (9.1.0.160) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197804]] (11.0.0.300) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[13.1.0|v873463908]] (13.1.0.100) [[13.2.0|v874512404]] (13.2.0.20) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[14.0.0|v939525336]] (14.0.0.1240) [[16.0.0|v1073742864]] (16.0.0.1040) [[16.1.0|v1074790860]] (16.1.0.460) [[18.0.0|v1207960612]] (18.0.0.1060) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[20.2.0|v1344274732]] (20.2.0.300) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || overlayDisp (OverlayApplet) || ProgramId is loaded by [[NS_Services|ns]] from system-config-title.
|-
| 010000000000100D || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[8.1.1|v536871444]] (8.0.0.532) [[9.0.0|v603980216]] (9.0.0.440) [[9.1.0|v605028512]] (9.1.0.160) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197804]] (11.0.0.300) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[13.1.0|v873463908]] (13.1.0.100) [[14.0.0|v939525336]] (14.0.0.1240) [[15.0.0|v1006634080]] (15.0.0.1120) [[16.0.0|v1073742864]] (16.0.0.1040) [[16.1.0|v1074790860]] (16.1.0.460) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || [[Album_Applet|photoViewer (LibraryAppletPhotoViewer)]]
|-
| 010000000000100E || || set (LibraryAppletSet) || Not present on retail devices.
|-
| 010000000000100F || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.1.0|v131162]] (0.0.2.90) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.1.0|v403701850]] (6.1.0.90) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[8.1.0|v537919608]] (8.1.0.120) [[9.0.0|v603980216]] (9.0.0.440) [[9.0.1|v604045412]] (9.0.1.100) [[9.1.0|v605028592]] (9.1.0.240) [[10.0.0|v671088960]] (10.0.0.320) [[10.0.4|v671350804]] (10.0.4.20) [[11.0.0|v738197864]] (11.0.0.360) [[12.0.0|v805307608]] (12.0.0.1240) [[12.1.0|v806355064]] (12.1.0.120) [[13.1.0|v873463908]] (13.1.0.100) [[14.0.0|v939525336]] (14.0.0.1240) [[14.1.1|v940638228]] (14.1.1.20) [[15.0.0|v1006634080]] (15.0.0.1120) [[15.0.1|v1006698596]] (15.0.1.100) [[16.0.0|v1073742904]] (16.0.0.1080) [[16.1.0|v1074790860]] (16.1.0.460) [[17.0.0|v1140851708]] (17.0.0.1020) [[18.1.0|v1209008288]] (18.1.0.160) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[20.2.0|v1344274732]] (20.2.0.300) [[20.3.0|v1345323088]] (20.3.0.80) [[20.4.0|v1346371784]] (20.4.0.200) [[21.0.0|v1409287084]] (21.0.0.940) [[21.1.0|v1410335000]] (21.1.0.280) [[21.2.0|v1411383436]] (21.2.0.140) [[22.0.0|v1476396108]] (22.0.0.1100) [[22.5.0|v1481638368]] (22.5.0.480) || LibAppletOff (LibraryAppletOfflineWeb) || [[Internet_Browser|Offline]] web-applet.
|-
| 0100000000001010 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.1.0|v131162]] (0.0.2.90) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.1.0|v403701850]] (6.1.0.90) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[8.1.0|v537919608]] (8.1.0.120) [[9.0.0|v603980216]] (9.0.0.440) [[9.0.1|v604045412]] (9.0.1.100) [[9.1.0|v605028592]] (9.1.0.240) [[10.0.0|v671088960]] (10.0.0.320) [[10.0.4|v671350804]] (10.0.4.20) [[11.0.0|v738197864]] (11.0.0.360) [[12.0.0|v805307608]] (12.0.0.1240) [[12.1.0|v806355064]] (12.1.0.120) [[13.1.0|v873463908]] (13.1.0.100) [[14.0.0|v939525336]] (14.0.0.1240) [[14.1.1|v940638228]] (14.1.1.20) [[15.0.0|v1006634080]] (15.0.0.1120) [[15.0.1|v1006698596]] (15.0.1.100) [[16.0.0|v1073742904]] (16.0.0.1080) [[16.1.0|v1074790860]] (16.1.0.460) [[17.0.0|v1140851708]] (17.0.0.1020) [[18.1.0|v1209008288]] (18.1.0.160) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[20.2.0|v1344274732]] (20.2.0.300) [[20.3.0|v1345323088]] (20.3.0.80) [[20.4.0|v1346371784]] (20.4.0.200) [[21.0.0|v1409287084]] (21.0.0.940) [[21.1.0|v1410335000]] (21.1.0.280) [[21.2.0|v1411383436]] (21.2.0.140) [[22.0.0|v1476396108]] (22.0.0.1100) || LibAppletLns (LibraryAppletLoginShare) || [[Internet_Browser|Whitelisted]] applet. (LoginApplet+ShareApplet+LobbyApplet) [22.0.0+] Stubbed.
|-
| 0100000000001011 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.1.0|v131162]] (0.0.2.90) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.1.0|v403701850]] (6.1.0.90) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[8.1.0|v537919608]] (8.1.0.120) [[9.0.0|v603980216]] (9.0.0.440) [[9.0.1|v604045412]] (9.0.1.100) [[9.1.0|v605028592]] (9.1.0.240) [[10.0.0|v671088960]] (10.0.0.320) [[10.0.4|v671350804]] (10.0.4.20) [[11.0.0|v738197864]] (11.0.0.360) [[12.0.0|v805307608]] (12.0.0.1240) [[12.1.0|v806355064]] (12.1.0.120) [[13.1.0|v873463908]] (13.1.0.100) [[14.0.0|v939525336]] (14.0.0.1240) [[14.1.1|v940638228]] (14.1.1.20) [[15.0.0|v1006634080]] (15.0.0.1120) [[15.0.1|v1006698596]] (15.0.1.100) [[16.0.0|v1073742904]] (16.0.0.1080) [[16.1.0|v1074790860]] (16.1.0.460) [[17.0.0|v1140851708]] (17.0.0.1020) [[18.1.0|v1209008288]] (18.1.0.160) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[20.2.0|v1344274732]] (20.2.0.300) [[20.3.0|v1345323088]] (20.3.0.80) [[20.4.0|v1346371784]] (20.4.0.200) [[21.0.0|v1409287084]] (21.0.0.940) [[21.1.0|v1410335000]] (21.1.0.280) [[21.2.0|v1411383436]] (21.2.0.140) [[22.0.0|v1476396108]] (22.0.0.1100) || LibAppletAuth (LibraryAppletWifiWebAuth) || [[Internet_Browser|WifiWebAuth]] applet. [22.0.0+] Stubbed.
|-
| 0100000000001012 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[8.1.1|v536871444]] (8.0.0.532) [[9.0.0|v603980216]] (9.0.0.440) [[9.0.1|v604045412]] (9.0.1.100) [[9.1.0|v605028512]] (9.1.0.160) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197804]] (11.0.0.300) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[18.0.0|v1207960612]] (18.0.0.1060) [[18.1.0|v1209008288]] (18.1.0.160) [[19.0.0|v1275069496]] (19.0.0.1080) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[20.2.0|v1344274732]] (20.2.0.300) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) || starter (DummyStarter) ||
|-
| 0100000000001013 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[5.0.1|v335609886]] (5.0.1.30) [[5.0.2|v335675432]] (5.0.2.40) [[5.1.0|v336592976]] (5.1.0.80) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[8.1.1|v536871444]] (8.0.0.532) [[9.0.0|v603980216]] (9.0.0.440) [[9.1.0|v605028512]] (9.1.0.160) [[10.0.0|v671088940]] (10.0.0.300) [[10.1.0|v672137336]] (10.1.0.120) [[11.0.0|v738197924]] (11.0.0.420) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[13.1.0|v873463908]] (13.1.0.100) [[14.0.0|v939525336]] (14.0.0.1240) [[16.0.0|v1073742864]] (16.0.0.1040) [[16.1.0|v1074790860]] (16.1.0.460) [[18.1.0|v1209008288]] (18.1.0.160) [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) [[22.5.0|v1481638368]] (22.5.0.480) || [[MyPage_Applet|myPage (LibraryAppletMyPage)]] ||
|-
| 0100000000001014 || || PlayReport || Not present on retail devices.
|-
| 0100000000001015 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) [[5.0.0|v335544750]] (5.0.0.430) [[6.0.0|v402653544]] (6.0.0.360) [[6.2.0|v404750376]] (6.2.0.40) [[7.0.0|v469762248]] (7.0.0.200) [[8.0.0|v536871442]] (8.0.0.530) [[8.1.1|v536871444]] (8.0.0.532) [[9.0.0|v603980216]] (9.0.0.440) [[9.1.0|v605028512]] (9.1.0.160) [[10.0.0|v671088940]] (10.0.0.300) [[11.0.0|v738197804]] (11.0.0.300) [[12.1.0|v806355064]] (12.1.0.120) [[13.0.0|v872415452]] (13.0.0.220) [[14.0.0|v939525336]] (14.0.0.1240) [[20.0.0|v1342178920]] (20.0.0.1640) [[22.0.0|v1476396108]] (22.0.0.1100) || maintenance (MaintenanceMenu) || Initial applet displayed when booting into [[Recovery_Mode|recovery mode]]. Launched by [[NS_Services#LaunchSystemApplet|ns]].
|-
| 0100000000001016 || || || This ProgramId is used by [[NS_Services|ns]] when a certain flag is non-zero, in multiple places including around code using the string "application_install". The program itself doesn't seem to exist.
|-
| 0100000000001017 || || || This ProgramId is used by [5.0.0+] [[Applet_Manager_services|am]] for the "nn.am.SystemReportTask" thread. The program itself doesn't seem to exist.
|-
| 0100000000001018 || || || This ProgramId is used by [5.0.0+] [[NS_Services|ns]] when saving a SystemPlayReport with EventId "systemupdate_dl_throughput". The program itself doesn't seem to exist.
|-
| 0100000000001019 || || || This ProgramId is used by [5.0.0+] [[NS_Services|ns]] when saving a SystemPlayReport with EventId "volume_update" or "output_target_update". The program itself doesn't seem to exist.
|-
| 010000000000101A || || gift (LibraryAppletGift) || Not present on retail devices.
|-
| 010000000000101B || || DummyECApplet (LibraryAppletDummyShop) || Not present on retail devices.
|-
| 010000000000101C || || userMigration (LibraryAppletUserMigration) || Not present on retail devices.
|-
| 010000000000101D || || EncounterSys (LibraryAppletPreomiaSys) || Not present on retail devices.
|-
| 010000000000101E || || || This ProgramId is used by [5.0.0+] [[NIM_services|nim]] when it accesses the [[Network#pearljam|pearljam]] server. The program itself doesn't seem to exist.
|-
| 010000000000101F || || || This ProgramId is used by [6.0.0+] [[NIM_services|nim]] and [9.0.0+] [[Glue_services|glue]]. The program itself doesn't seem to exist.
|-
| 0100000000001020 || || story (LibraryAppletStory) || Not present on retail devices.
|-
| 0100000000001021 || || || This ProgramId is used by [6.0.0+] [[NS_Services|ns]] when saving a SystemPlayReport with EventId "systemupdate_pass". The program itself doesn't seem to exist.
|-
| 0100000000001023 || || || This ProgramId is used by [5.0.0+] [[BCAT_services|bcat]] around code using the string "statistics". The program itself doesn't seem to exist.
|-
| 0100000000001024 || || || This ProgramId is used by [5.0.0+] [[PSC_services|psc]] around code using the string "syslog". The program itself doesn't seem to exist.
|-
| 0100000000001025 || || || This ProgramId is used by [6.0.0+] [[Applet_Manager_services|am]]. The program itself doesn't seem to exist.
|-
| 0100000000001026 || || || This ProgramId is used by [6.0.0+] [[OLSC_services|olsc]]. The program itself doesn't seem to exist.
|-
| 0100000000001027 || || || This ProgramId is used by [8.0.0+] [[Account_services|account]]. The program itself doesn't seem to exist.
|-
| 0100000000001028 || || || This ProgramId is used by [8.0.0+] [[NS_Services|ns]]. The program itself doesn't seem to exist.
|-
| 0100000000001029 || || || This ProgramId is used by [8.0.0+] [[Network_Interface_services|nifm]] around code using the string "request_count". The program itself doesn't seem to exist.
|-
| 010000000000102A || || || This ProgramId is used by [6.0.0+] [[Applet_Manager_services|am]]. The program itself doesn't seem to exist.
|-
| 010000000000102B || || || This ProgramId is used by [9.0.0+] [[Glue_services|glue]]. The program itself doesn't seem to exist.
|-
| 010000000000102C || || || This ProgramId is used by [9.0.0+] [[Applet_Manager_services|am]]. The program itself doesn't seem to exist.
|-
| 010000000000102E || || || This ProgramId is used by [8.0.0+] [[Shared_Database_services|sdb]] around code using the string "blacklist". The program itself doesn't seem to exist.
|-
| 010000000000102F || || || This ProgramId is used by [8.0.0+] [[NS_Services|ns]] around code using the string "content_delivery". The program itself doesn't seem to exist.
|-
| 0100000000001030 || || || This ProgramId is used by [8.0.0+] [[Parental_Control_services|pctl]] around code using the string "npns_create_token". The program itself doesn't seem to exist.
|-
| 0100000000001031 || || || This ProgramId is used by [8.0.0+] [[NS_Services|ns]]. The program itself doesn't seem to exist.
|-
| 0100000000001032 || || || This ProgramId is used by [8.0.0+] [[Glue_services|glue]]. The program itself doesn't seem to exist.
|-
| 0100000000001033 || || || This ProgramId is used by [8.0.0+] [[NS_Services|ns]] and [8.0.0+] [[BCAT_services|bcat]] around code using the string "promotion". The program itself doesn't seem to exist.
|-
| 0100000000001034 || || || This ProgramId is used by [9.0.0+] [[NGCT_services|ngct]] and [9.0.0+] [[BCAT_services|bcat]]. The program itself doesn't seem to exist.
|-
| 0100000000001037 || || || This ProgramId is used by [9.0.0+] [[NIM_services|nim]]. The program itself doesn't seem to exist.
|-
| 0100000000001038 || || sample (LibraryAppletSample) || Not present on retail devices.
|-
| 010000000000103C || || || This ProgramId is used by [13.0.0+] [[BCAT_services|bcat]] around code using the string "mnpp". The program itself doesn't seem to exist.
|-
| 010000000000103D || || || This ProgramId is used by [13.0.0+] [[Sockets_services|bsdsocket]] around code using the string "setting". The program itself doesn't seem to exist.
|-
| 010000000000103E || || || This ProgramId is used by [13.1.0+] [[BCAT_services|bcat]] around code using the strings "recv_push_ntf_mission_completed" and "send_ovl_ntf_mission_completed". The program itself doesn't seem to exist.
|-
| 0100000000001042 || [[22.0.0|v1476396108]] (22.0.0.1100) [[22.5.0|v1481638368]] (22.5.0.480) || [22.0.0+] [[Internet_Browser|systemWeb]] || This ProgramId is used by [16.0.0+] [[Applet_Manager_services|am]].
|-
| 0100000000001043 || [[22.0.0|v1476396108]] (22.0.0.1100) [[22.5.0|v1481638368]] (22.5.0.480) || [22.0.0+] [[Internet_Browser|openWeb]] || This ProgramId is used by [16.0.0+] [[Applet_Manager_services|am]].
|-
| 0100000000001048 || [[20.0.0|v1342178920]] (20.0.0.1640) [[20.1.0|v1343226216]] (20.1.0.360) [[20.2.0|v1344274732]] (20.2.0.300) [[21.0.0|v1409287084]] (21.0.0.940) [[22.0.0|v1476396108]] (22.0.0.1100) [[22.5.0|v1481638368]] (22.5.0.480) || [20.0.0+] [[Splay_Applet|splay]] ||
|-
| 0100000000001FFF || || EndOceanProgramId || Placeholder for the last valid applet ID.
|}

= Development System Applets =
{| class=wikitable
! ProgramId || Versions || Description || Notes
|-
| 0100000000002000 || || A2BoardFunction ||
|-
| 0100000000002001 || || A3Wireless ||
|-
| 0100000000002002 || || C1LcdAndKey (LcdAndKey) || LCD/Keyboard testing.
|-
| 0100000000002003 || || C2UsbHpmic (UsbAndHPMicTest) || USB and audio testing.
|-
| 0100000000002004 || || C3Aging (Aging) || Graphics/Framerate testing.
|-
| 0100000000002005 || || C4SixAxis (6axisTest) || Sixaxis (controller peripheral) testing.
|-
| 0100000000002006 || || C5Wireless (AssembledWireless) || Wireless testing.
|-
| 0100000000002007 || || C7FinalCheck (FinalCheck) ||
|-
| 010000000000203F || || AutoCapture ||
|-
| 0100000000002040 || || DevMenuCommandSystem ||
|-
| 0100000000002041 || || recovery ||
|-
| 0100000000002042 || || DevMenuSystem ||
|-
| 0100000000002044 || || HB-TBIntegrationTest ||
|-
| 010000000000204D || || BackupSaveData ||
|-
| 010000000000204E || || A4BoardCalWriti (BoardCalWriting) || Writes calibration data to NAND.
|-
| 0100000000002054 || || RepairSslCertificate ||
|-
| 0100000000002055 || || GameCardWriter ||
|-
| 0100000000002056 || || UsbPdTestTool ||
|-
| 0100000000002057 || || RepairDeletePctl ||
|-
| 0100000000002058 || || RepairBackup ||
|-
| 0100000000002059 || || RepairRestore ||
|-
| 010000000000205A || || RepairAccountTransfer ||
|-
| 010000000000205B || || RepairAutoNetworkUpdater ||
|-
| 010000000000205C || || RefurbishReset ||
|-
| 010000000000205D || || RepairAssistCup ||
|-
| 010000000000205E || || RepairPairingCutter ||
|-
| 0100000000002064 || || DevMenu ||
|-
| 0100000000002065 || || DevMenuApp ||
|-
| 0100000000002066 || || GetGameCardAsicInfo ||
|-
| 0100000000002068 || || NfpDebugToolSystem ||
|-
| 0100000000002069 || || AlbumSynchronizer ||
|-
| 0100000000002071 || || SnapShotDumper || Used by [[NS_Services|NS]].
|-
| 0100000000002073 || || DevMenuSystemApp ||
|-
| 0100000000002099 || || DevOverlayDisp ||
|-
| 010000000000209A || || NandVerifier ||
|-
| 010000000000209B || || GpuCoreDumper || Used by [[AM_services|AM]].
|-
| 010000000000209C || || TestApplication (TestApplicationLauncher) || Factory qlaunch replacement, used to launch other tests.
|-
| 010000000000209E || || HelloWorld ||
|-
| 01000000000020A0 || || XcieWriter ||
|-
| 01000000000020A1 || || GpuOverrunNotifier ||
|-
| 01000000000020C8 || || NfpDebugTool ||
|-
| 01000000000020CA || || NoftWriter ||
|-
| 01000000000020D0 || || BcatSystemDebugTool ||
|-
| 01000000000020D1 || || DevSafeModeUpdater ||
|-
| 01000000000020D3 || || ControllerConnectionAnalyzer ||
|-
| 01000000000020D4 || || DevKitUpdater ||
|-
| 01000000000020D6 || || RepairTimeReviser ||
|-
| 01000000000020D7 || || RepairReinitializeFuelGauge ||
|-
| 01000000000020DA || || RepairAbortMigration ||
|-
| 01000000000020DC || || RepairShowDeviceId ||
|-
| 01000000000020DD || || RepairSetCycleCountReliability ||
|-
| 01000000000020E0 || || Interface ||
|-
| 01000000000020E1 || || AlbumDownloader ||
|-
| 01000000000020E3 || || FuelGaugeDumper ||
|-
| 01000000000020E4 || || UnsafeExtract ||
|-
| 01000000000020E5 || || UnsafeEngrave ||
|-
| 01000000000020EE || || BluetoothSettingTool ||
|-
| 01000000000020F0 || || ApplicationInstallerRomfs (devmenuapp_installer) || Launched by [[Boot2|boot2]].
|-
| 0100000000002100 || || DevMenuLotcheckDownloader ||
|-
| 0100000000002101 || || DevMenuCommand ||
|-
| 0100000000002102 || || ExportPartition ||
|-
| 0100000000002103 || || [[Factory Setup|SystemInitializer]] (SystemInitializ) ||
|-
| 0100000000002104 || || SystemUpdaterHostFs ||
|-
| 0100000000002105 || || WriteToStorage ||
|-
| 0100000000002106 || || [[Factory Setup|CalWriter]] (CalWriterManu) ||
|-
| 0100000000002107 || || SettingsManager ||
|-
| 0100000000002109 || || testBuildSystemIris ||
|-
| 010000000000210A || || SystemUpdater ||
|-
| 010000000000210B || || nvnflinger_util ||
|-
| 010000000000210C || || ControllerFirmwareUpdater ||
|-
| 010000000000210D || || testBuildSystemNintendoWare (Test) ||
|-
| 0100000000002110 || || TestSaveDataCreator ||
|-
| 0100000000002111 || || C9LcdSpker ||
|-
| 0100000000002114 || || RankTurn ||
|-
| 0100000000002116 || || BleTestTool ||
|-
| 010000000000211A || || PreinstallAppWriter ||
|-
| 010000000000211C || || ControllerSerialFlashTool ||
|-
| 010000000000211D || || ControllerFlashWriter ||
|-
| 010000000000211E || || C13Handling ||
|-
| 010000000000211F || || HidTest ||
|-
| 0100000000002120 || || ControllerTestApp ||
|-
| 0100000000002121 || || HidInspectionTool ||
|-
| 0100000000002124 || || BatteryCyclesEditor ||
|-
| 0100000000002125 || || UsbFirmwareUpdater ||
|-
| 0100000000002126 || || PalmaSerialCodeTool ||
|-
| 0100000000002127 || || renderdoccmd ||
|-
| 0100000000002128 || || HidInspectionToolProd ||
|-
| 010000000000212C || || ExhibitionMenu ||
|-
| 010000000000212F || || ExhibitionSaveData ||
|-
| 0100000000002130 || || LuciaConverter ||
|-
| 0100000000002133 || || CalDumper ||
|-
| 0100000000002134 || || AnalogStickEvaluationTool ||
|-
| 010000000000216A || || ButtonTest ||
|-
| 010000000000216D || || ExhibitionSaveDataSnapshot || Unofficial name.
|-
| 010000000000216E || || HandlingA ||
|-
| 0100000000002178 || || SecureStartupSettings || Unofficial name.
|-
| 010000000000217A || || WirelessInterference ||
|-
| 010000000000217D || || CradleFirmwareUpdater ||
|-
| 0100000000002184 || || HttpInstallSettings || Unofficial name.
|-
| 0100000000002187 || || ExhibitionMovieAssetData || Unofficial name.
|-
| 0100000000002191 || || ExhibitionPlayData || Unofficial name.
|}

= Debug System Modules =
{| class=wikitable
! ProgramId || Versions || Description || Notes
|-
| 0100000000003002 || || DummyProcess ||
|-
| 0100000000003003 || || DebugMonitor0 ||
|-
| 0100000000003004 || || SystemHelloWorld ||
|}

= Development System Modules =
{| class=wikitable
! ProgramId || Versions || Description || Notes
|-
| 010000000000B120 || || nvdbgsvc || Launched by maintenance mode [[Boot2|boot2.manuBoot]], but not present in retail or [[Factory Setup|factory firmware]].
|-
| 010000000000B123 || || acc:CORNX ||
|-
| 010000000000B14A || || [[Manu Services|manu]] || Installed in [[Factory Setup|factory firmware]].
|-
| 010000000000B14B || || ManuUsbLoopBack ||
|-
| 010000000000B1B8 || || DevFwdbgHbPackage ||
|-
| 010000000000B1B9 || || DevFwdbgUsbPackage ||
|-
| 010000000000B1BA || || ProdFwdbgPackage ||
|-
| 010000000000B22A || || scs ||
|-
| 010000000000B22B || || ControllerFirmwareDebug ||
|-
| 010000000000B23D || || dt0 ||
|-
| 010000000000B240 || || htc ||
|}

= Bdk System Modules =
{| class=wikitable
! ProgramId || Versions || Description || Notes
|-
| 010000000000C600 || || BdkSample01 ||
|-
| 010000000000C601 || || BdkSample02 ||
|-
| 010000000000C602 || || BdkSample03 ||
|-
| 010000000000C603 || || BdkSample04 ||
|}

= New Development System Modules =
{| class=wikitable
! ProgramId || Versions || Description || Notes
|-
| 010000000000D609 || || dmnt.gen2 ||
|-
| 010000000000D60A || || ||
|-
| 010000000000D60B || || ||
|-
| 010000000000D60C || || ||
|-
| 010000000000D60D || || ||
|-
| 010000000000D60E || || ||
|-
| 010000000000D610 || || ||
|-
| 010000000000D611 || || ||
|-
| 010000000000D612 || || ||
|-
| 010000000000D613 || || ||
|-
| 010000000000D614 || || ||
|-
| 010000000000D615 || || ||
|-
| 010000000000D616 || || ||
|-
| 010000000000D617 || || ||
|-
| 010000000000D619 || || ||
|-
| 010000000000D621 || || ||
|-
| 010000000000D623 || || DevServer ||
|-
| 010000000000D62F || || WlanControlDaemon ||
|-
| 010000000000D633 || || ||
|-
| 010000000000D640 || || htcnet ||
|-
| 010000000000D65A || || netTcDev ||
|-
| 010000000000D65B || || ||
|-
| 010000000000D65C || || ||
|}

= System Applications =
{| class=wikitable
! ProgramId || Versions || Description || Notes
|-
| 01008BB00013C000 || [[1.0.0|v450]] (0.0.0.450) [[4.0.0|v268435656]] (4.0.0.200) [[6.2.0|v404750376]] (6.2.0.40) || Application ([[flog]]) || NES emulator.
|-
| 0100069000078000 || v0 || RetailInteractiveDisplayMenu (DevQuestMenu) || This program can be launched by [[qlaunch]], but is not normally installed on retail systems.
|-
| 010000B003486000 || || AudioUsbMicDebugTool ||
|-
| 0100458001E04000 || || BcatTestApp01 ||
|-
| 0100F910020F8000 || || BcatTestApp02 ||
|-
| 0100B7D0020FC000 || || BcatTestApp03 ||
|-
| 0100132002100000 || || BcatTestApp04 ||
|-
| 0100935002116000 || || BcatTestApp05 ||
|-
| 0100DA4002130000 || || BcatTestApp06 ||
|-
| 0100B0F002104000 || || BcatTestApp07 ||
|-
| 010051E002132000 || || BcatTestApp08 ||
|-
| 01004CB0015C8000 || || BcatTestApp09 ||
|-
| 01009720015CA000 || || BcatTestApp10 ||
|-
| 01002F20015C6000 || || BcatTestApp11 ||
|-
| 0100204001F90000 || || BcatTestApp12 ||
|-
| 0100060001F92000 || || BcatTestApp13 ||
|-
| 0100C26001F94000 || || BcatTestApp14 ||
|-
| 0100462001F96000 || || BcatTestApp15 ||
|-
| 01005C6001F98000 || || BcatTestApp16 ||
|-
| 010070000E3C0000 || || EncounterUsr (LibraryAppletPreomiaUsr) ||
|-
| 010086000E49C000 || || EncounterUsrDummy (LibraryAppletPreomiaUsrDummy) ||
|-
| 0100810002D5A000 || || ShopMonitaringTool ||
|-
| 010023D002B98000 || || DeltaStress ||
|-
| 010099F00D810000 || || || This ProgramId is used by [[BCAT_services|bcat]]. The program itself doesn't seem to exist.
|-
| 0100E6C01163C000 || || || This ProgramId is used by [[OLSC_services|olsc]]. The program itself doesn't seem to exist.
|}

= Pre-release System Applets =
{| class=wikitable
! ProgramId || Versions || Description || Notes
|-
| 1000000000000001 || || [[Factory Setup|SystemInitializer]] (SystemInitializ) ||
|-
| 1000000000000004 || || [[Factory Setup|CalWriter]] (CalWriterManu) ||
|-
| 1000000000000005 || || DevMenuCommand ||
|-
| 1000000000000006 || || SettingsManager ||
|-
| 1000000000000007 || || DevMenu (debug) TestApplication (factory) ||
|-
| 100000000000000B || || SnapShotDumper ||
|-
| 100000000000000C || || SystemUpdater ||
|-
| 100000000000000E || || ControllerFirmwareUpdater ||
|}

= Pre-release System Modules =
{| class=wikitable
! ProgramId || Versions || Description || Notes
|-
| 1000000000000201 || || usb ||
|-
| 1000000000000202 || || tma ||
|-
| 1000000000000203 || || boot2 ||
|-
| 1000000000000204 || || settings ||
|-
| 1000000000000205 || || Bus ||
|-
| 1000000000000206 || || bluetooth ||
|-
| 1000000000000208 || || DebugMonitor0 ||
|-
| 1000000000000209 || || dmnt ||
|-
| 100000000000020B || || nifm ||
|-
| 100000000000020C || || ptm ||
|-
| 100000000000020E || || bsdsocket ||
|-
| 100000000000020F || || hid ||
|-
| 1000000000000210 || || audio ||
|-
| 1000000000000212 || || LogManager ||
|-
| 1000000000000213 || || wlan ||
|-
| 1000000000000214 || || cs ||
|-
| 1000000000000215 || || ldn ||
|-
| 1000000000000216 || || nvservices ||
|-
| 1000000000000217 || || pcv ||
|-
| 1000000000000218 || || ppc ||
|-
| 100000000000021A || || lbl0 ||
|-
| 100000000000021B || || nvnflinger ||
|-
| 100000000000021C || || pcie ||
|-
| 100000000000021D || || account ||
|-
| 100000000000021E || || ns ||
|-
| 100000000000021F || || nfc ||
|-
| 1000000000000220 || || psc ||
|-
| 1000000000000221 || || capsrv ||
|-
| 1000000000000222 || || am ||
|-
| 1000000000000223 || || ssl ||
|-
| 1000000000000224 || || nim ||
|}

= User Applications =
Nintendo Switch game and application programs follow a higher entropy ProgramId scheme than previous generation consoles. Refer to the [[Title_list/Games|Games List]] for more information.

Switch 2: Title list

2026-08-06T15:22:22Z

Yellows8: /* System Applets */ Sync with NX.

= System Modules =
{| class=wikitable
! ProgramId || Versions || Description || Notes
|-
| 0400000000000006 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 20.2.0|v1344304624]] (20.2.0.30192) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || [[USB_services|usb]] ||
|-
| 0400000000000008 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || [[Boot2|boot2]] (debug) [[Boot2|boot2.SafeMode]] (safe) [[Boot2|boot2.FromHost]] (develop) [[Boot2|boot2.prodBoot]] (retail) [[Boot2|boot2.manuBoot]] (factory) [[Boot2|boot2.Manu1st]] (factory) ||
|-
| 0400000000000009 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 20.2.0|v1344304624]] (20.2.0.30192) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || [[Settings_services|settings]] ||
|-
| 040000000000000A || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || [[Bus_services|Bus]] ||
|-
| 040000000000000B || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.1|v1343321424]] (20.1.1.30032) [[Switch 2: 20.2.0|v1344304624]] (20.2.0.30192) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || [[Bluetooth_Driver_services|bluetooth.autog]] ||
|-
| 040000000000000C || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 20.2.0|v1344304624]] (20.2.0.30192) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || [[BCAT_services|bcat]] ||
|-
| 040000000000000E || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || [[Friend_services|friends]] ||
|-
| 040000000000000F || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 20.2.0|v1344304624]] (20.2.0.30192) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || [[Network_Interface_services|nifm]] ||
|-
| 0400000000000010 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || [[PTM_services|ptm]] ||
|-
| 0400000000000012 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) [[Switch 2: 22.5.0|v1481668160]] (22.5.0.30272) || [[Sockets_services|bsdsocket]] ||
|-
| 0400000000000013 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 20.4.0|v1346401916]] (20.4.0.30332) [[Switch 2: 22.1.0|v1477473756]] (22.1.0.30172) [[Switch 2: 22.5.0|v1481668160]] (22.5.0.30272) || [[HID_services|hid]] ||
|-
| 0400000000000014 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 20.4.0|v1346401916]] (20.4.0.30332) [[Switch 2: 22.1.0|v1477473756]] (22.1.0.30172) [[Switch 2: 22.5.0|v1481668160]] (22.5.0.30272) || [[Audio_services|audio]] ||
|-
| 0400000000000015 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || [[Log_services|LogManager]] (debug) [[Log_services|LogManager.Prod]] (retail) ||
|-
| 0400000000000016 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 20.5.0|v1347450282]] (20.5.0.30122) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) [[Switch 2: 22.5.0|v1481668160]] (22.5.0.30272) || [[WLAN_services|wlan]] ||
|-
| 0400000000000018 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 20.2.0|v1344304624]] (20.2.0.30192) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || [[LDN_services|ldn]] ||
|-
| 0400000000000019 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || [[NV_services|nvservices]] ||
|-
| 040000000000001A || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || [[PCV_services|pcv]] ||
|-
| 040000000000001B || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || [[Capmtp_services|capmtp]] ||
|-
| 040000000000001D || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || [[PCIe_services|pcie]] ||
|-
| 040000000000001E || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 20.5.0|v1347450282]] (20.5.0.30122) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) [[Switch 2: 22.5.0|v1481668160]] (22.5.0.30272) || [[Account_services|account]] ||
|-
| 040000000000001F || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 20.2.0|v1344304624]] (20.2.0.30192) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) [[Switch 2: 22.5.0|v1481668160]] (22.5.0.30272) || [[NS_Services|ns]] ||
|-
| 0400000000000020 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || [[NFC_services|nfc]] ||
|-
| 0400000000000021 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || [[PSC_services|psc]] ||
|-
| 0400000000000022 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || [[Capture_services|capsrv]] ||
|-
| 0400000000000023 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 20.2.0|v1344304624]] (20.2.0.30192) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) [[Switch 2: 22.5.0|v1481668160]] (22.5.0.30272) || [[AM_services|am]] ||
|-
| 0400000000000024 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 20.2.0|v1344304624]] (20.2.0.30192) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) [[Switch 2: 22.5.0|v1481668160]] (22.5.0.30272) || [[SSL_services|ssl]] ||
|-
| 0400000000000025 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 20.2.0|v1344304624]] (20.2.0.30192) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || [[NIM_services|nim]] ||
|-
| 040000000000002B || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 20.2.0|v1344304624]] (20.2.0.30192) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) [[Switch 2: 22.5.0|v1481668160]] (22.5.0.30272) || [[Error_Report_services|erpt]] ||
|-
| 040000000000002E || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 20.4.0|v1346401916]] (20.4.0.30332) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || [[Parental_Control_services|pctl]] ||
|-
| 040000000000002F || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 20.2.0|v1344304624]] (20.2.0.30192) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || [[NPNS_services|npns]] ||
|-
| 0400000000000030 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || [[Error_Upload_services|eupld]] ||
|-
| 0400000000000031 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 20.5.0|v1347450282]] (20.5.0.30122) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || [[Glue_services|glue]] ||
|-
| 0400000000000032 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 20.2.0|v1344304624]] (20.2.0.30192) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || eclct ||
|-
| 0400000000000033 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.1.0|v1477473756]] (22.1.0.30172) [[Switch 2: 22.5.0|v1481668160]] (22.5.0.30272) || [[ETicket_services|es]] ||
|-
| 0400000000000034 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 20.1.5|v1343583688]] (20.1.5.30152) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || [[Fatal_services|fatal]] ||
|-
| 0400000000000035 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 20.2.0|v1344304624]] (20.2.0.30192) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || [[GRC_services|grc]] ||
|-
| 0400000000000036 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 20.2.0|v1344304624]] (20.2.0.30192) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || [[creport]] ||
|-
| 0400000000000037 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || [[RO_services|ro]] ||
|-
| 0400000000000039 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 20.2.0|v1344304624]] (20.2.0.30192) [[Switch 2: 22.1.0|v1477473756]] (22.1.0.30172) || [[Shared_Database_services|sdb]] ||
|-
| 040000000000003A || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.1|v1343321424]] (20.1.1.30032) [[Switch 2: 20.2.0|v1344304624]] (20.2.0.30192) [[Switch 2: 22.1.0|v1477473756]] (22.1.0.30172) [[Switch 2: 22.5.0|v1481668160]] (22.5.0.30272) || [[Migration_services|migration]] ||
|-
| 040000000000003C || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || [[Jpegdec_services|jpegdec]] ||
|-
| 040000000000003E || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 20.2.0|v1344304624]] (20.2.0.30192) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) [[Switch 2: 22.5.0|v1481668160]] (22.5.0.30272) || [[OLSC_services|olsc]] ||
|-
| 0400000000000042 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || [[PGL_services|pgl]] ||
|-
| 0400000000000045 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 20.2.0|v1344304624]] (20.2.0.30192) [[Switch 2: 22.1.0|v1477473756]] (22.1.0.30172) || [[OMM_services|omm]] ||
|-
| 0400000000000046 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || [[Ethernet_services|eth]] ||
|-
| 0400000000000047 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || ||
|-
| 040000000000004A || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 20.4.0|v1346401916]] (20.4.0.30332) [[Switch 2: 22.1.0|v1477473756]] (22.1.0.30172) [[Switch 2: 22.5.0|v1481668160]] (22.5.0.30272) || ||
|-
| 040000000000004D || [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 20.2.0|v1344304624]] (20.2.0.30192) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || [20.1.0+] ||
|-
| 040000000000004F || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || ||
|-
| 0400000000000050 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || ngc ||
|-
| 0400000000000052 || [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 20.4.0|v1346401916]] (20.4.0.30332) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) [[Switch 2: 22.5.0|v1481668160]] (22.5.0.30272) || [20.1.0+] ||
|-
| 0400000000000062 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) [[Switch 2: 22.5.0|v1481668160]] (22.5.0.30272) || ||
|-
| 0400000000000063 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 20.2.0|v1344304624]] (20.2.0.30192) [[Switch 2: 22.1.0|v1477473756]] (22.1.0.30172) || ||
|-
| 0400000000000065 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || ||
|-
| 0400000000000070 || [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 20.2.0|v1344304624]] (20.2.0.30192) [[Switch 2: 22.1.0|v1477473756]] (22.1.0.30172) || [20.1.0+] ||
|-
| 0400000000000071 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 20.2.0|v1344304624]] (20.2.0.30192) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || ||
|-
| 0400000000000072 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 20.2.0|v1344304624]] (20.2.0.30192) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) [[Switch 2: 22.5.0|v1481668160]] (22.5.0.30272) || ||
|-
| 0400000000000080 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || ||
|-
| 0400000000000081 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 20.2.0|v1344304624]] (20.2.0.30192) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || ||
|-
| 0400000000000083 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 20.2.0|v1344304624]] (20.2.0.30192) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || ||
|-
| 0400000000000084 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 20.2.0|v1344304624]] (20.2.0.30192) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || ||
|-
| 0400000000000088 || [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) [[Switch 2: 22.5.0|v1481668160]] (22.5.0.30272) || [20.1.0+] ||
|-
| 0400000000000089 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 20.2.0|v1344304624]] (20.2.0.30192) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || ||
|-
| 040000000000008D || [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || [20.1.0+] ||
|}

= System Data Archives =
{| class=wikitable
! ProgramId || Versions || Description || Notes
|-
| 0400000000000800 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || [[SSL_services#CertStore|CertStore]] || Same as NX.
|-
| 0400000000000802 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || MiiModel || Same as NX.
|-
| 0400000000000803 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257898]] (20.1.0.32042) [[Switch 2: 20.4.0|v1346401916]] (20.4.0.30332) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) [[Switch 2: 22.5.0|v1481668160]] (22.5.0.30272) || [[Internet_Browser#BrowserDll|BrowserDll]] ||
|-
| 0400000000000804 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257748]] (20.1.0.31892) [[Switch 2: 20.4.0|v1346401916]] (20.4.0.30332) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) [[Switch 2: 22.5.0|v1481668160]] (22.5.0.30272) || Help ||
|-
| 0400000000000806 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || NgWord || Same as NX. This has [[NCM_services#ContentMetaAttributes|ContentMetaAttributes]] = Rebootless.
|-
| 0400000000000807 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || [[Hotspot_List|SsidList]] || Same as NX. This has [[NCM_services#ContentMetaAttributes|ContentMetaAttributes]] = Rebootless.
|-
| 0400000000000808 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1342209022]] (20.0.0.31742) [[Switch 2: 21.0.0|v1409316656]] (21.0.0.30512) [[Switch 2: 22.5.0|v1481668160]] (22.5.0.30272) || Dictionary ||
|-
| 0400000000000809 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.1|v1343321424]] (20.1.1.30032) [[Switch 2: 20.5.0|v1347450282]] (20.5.0.30122) [[Switch 2: 22.1.0|v1477473756]] (22.1.0.30172) [[Switch 2: 22.5.0|v1481668160]] (22.5.0.30272) || [[System_Version_Title|SystemVersion]] || [20.1.1+] The digest file is no longer present.
|-
| 040000000000080A || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || AvatarImage || Now just contains "DatabaseInfo.byml.zs" and PNGs in directories "512x512"/"Ocean512x512".
|-
| 040000000000080C || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257808]] (20.1.0.31952) || Eula ||
|-
| 040000000000080D || [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) [[Switch 2: 22.5.0|v1481668160]] (22.5.0.30272) || [21.0.0+] UrlBlackList || Same as NX.
|-
| 040000000000080E || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || TimeZoneBinary || Same as NX.
|-
| 0400000000000810 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || FontNintendoExtension || Same as NX except "nintendo_ext2_003.bfttf" was removed.
|-
| 0400000000000811 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || FontStandard || Same as NX.
|-
| 0400000000000812 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || FontKorean || Same as NX.
|-
| 0400000000000813 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || FontChineseTraditional || Same as NX.
|-
| 0400000000000814 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || FontChineseSimple || Same as NX.
|-
| 0400000000000816 || [[Switch 2: 19.0.0|v1275070438]] (19.0.0.2022) [[Switch 2: 20.1.1|v1343321424]] (20.1.1.30032) [[Switch 2: 20.1.5|v1343583688]] (20.1.5.30152) [[Switch 2: 20.2.0|v1344304624]] (20.2.0.30192) [[Switch 2: 20.3.0|v1345353070]] (20.3.0.30062) [[Switch 2: 20.4.0|v1346401921]] (20.4.0.30337) [[Switch 2: 20.5.0|v1347450282]] (20.5.0.30122) [[Switch 2: 22.1.0|v1477473756]] (22.1.0.30172) [[Switch 2: 22.5.0|v1481668160]] (22.5.0.30272) || SystemUpdate ||
|-
| 0400000000000818 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) [[Switch 2: 22.5.0|v1481668160]] (22.5.0.30272) || [[Switch 2: System_Settings|FirmwareDebugSettings]] ||
|-
| 0400000000000819 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 20.4.0|v1346401916]] (20.4.0.30332) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) [[Switch 2: 22.5.0|v1481668160]] (22.5.0.30272) || BootImagePackage ||
|-
| 040000000000081B || [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 20.4.0|v1346401916]] (20.4.0.30332) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) [[Switch 2: 22.5.0|v1481668160]] (22.5.0.30272) || [20.1.0+] BootImagePackageExFat ||
|-
| 040000000000081D || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || FatalMessage || Compared to NX, "/{lang}/GeneralMessage" were updated, and "zh-CN/" + "zh-TW/" were removed.
|-
| 040000000000081E || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.0.0|v1342209022]] (20.0.0.31742) || ControllerIcon || Now just contains "Footer/controllerIcon.bntx" and "Footer/info.dat".
|-
| 0400000000000822 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.1.0|v1477473756]] (22.1.0.30172) || [[HID_services#Firmware_Update|ControllerFirmware]] ||
|-
| 0400000000000823 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || NgWord2 || Same as NX. This has [[NCM_services#ContentMetaAttributes|ContentMetaAttributes]] = Rebootless.
|-
| 0400000000000826 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257748]] (20.1.0.31892) [[Switch 2: 20.4.0|v1346401916]] (20.4.0.30332) [[Switch 2: 21.0.0|v1409316656]] (21.0.0.30512) || RebootlessSystemUpdateVersion || Version fields were reset to starting with value 1. This has [[NCM_services#ContentMetaAttributes|ContentMetaAttributes]] = Rebootless.
|-
| 0400000000000827 || [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102)) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || [20.1.0+] ContentActionTable || Same as NX. This has [[NCM_services#ContentMetaAttributes|ContentMetaAttributes]] = Rebootless.
|-
| 0400000000000828 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257938]] (20.1.0.32082) [[Switch 2: 20.4.0|v1346401916]] (20.4.0.30332) [[Switch 2: 21.0.0|v1409316656]] (21.0.0.30512) || [[#Shared_Database_services#FunctionBlackList|FunctionBlackList]] || This has [[NCM_services#ContentMetaAttributes|ContentMetaAttributes]] = Rebootless.
|-
| 0400000000000832 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || CradleFirmware ||
|-
| 0400000000000834 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || || Additional [[Switch 2: System_Settings|system-settings]].
|-
| 0400000000000835 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257928]] (20.1.0.32072) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || ErrorMessageUtf8 || This has [[NCM_services#ContentMetaAttributes|ContentMetaAttributes]] = Rebootless.
|-
| 0400000000000836 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 20.2.0|v1344304624]] (20.2.0.30192) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || || Contains data for the wifi/bluetooth controller, including firmware.
|-
| 0400000000000837 || [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 20.4.0|v1346401916]] (20.4.0.30332) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) [[Switch 2: 22.5.0|v1481668160]] (22.5.0.30272) || [20.1.0+] || This is a SystemProgram, so this likely contains the [[Switch 2: Compatibility Mode|compat-modules]].
|-
| 040000000000083A || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || || Contains "nintendo_udsg-r_std_004.bfttf".
|-
| 040000000000083B || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || || Contains "nintendo_udsg-db_std_004.bfttf".
|-
| 040000000000083C || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || || Contains "nintendo_udsg-r_ko_004.bfttf".
|-
| 040000000000083D || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || || Contains "nintendo_udsg-db_ko_004.bfttf".
|-
| 040000000000083E || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || || Contains "nintendo_udsg-r_zh-tw_004.bfttf".
|-
| 040000000000083F || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || || Contains "nintendo_udsg-db_zh-tw_004.bfttf".
|-
| 0400000000000840 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || || Contains "nintendo_udsg-r_ext_zh-cn_004.bfttf" and "nintendo_udsg-r_org_zh-cn_004.bfttf".
|-
| 0400000000000841 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || || Contains "nintendo_udsg-db_ext_zh-cn_004.bfttf" and "nintendo_udsg-db_org_zh-cn_004.bfttf".
|-
| 0400000000000842 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || || Contains "nintendo_ext_004.bfttf".
|-
| 0400000000000843 || [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 20.4.0|v1346401916]] (20.4.0.30332) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) [[Switch 2: 22.5.0|v1481668160]] (22.5.0.30272) || [20.1.0+] || This is a SystemProgram, so this likely contains the [[Switch 2: Compatibility Mode|compat-modules]].
|-
| 0400000000000844 || [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || [20.1.0+] || Contains data for face detection.
|-
| 0400000000000846 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || || [20.1.0+] Contains an empty "Dummy" ([19.0.0] contains 0x3C-byte files: "WrappedKey0Dev.bin", "WrappedKey0End.bin", "WrappedKey0EndQuest.bin").
|-
| 0400000000000847 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.0.0|v1342209022]] (20.0.0.31742) || || Contains "MiiBody.dat" and shaders.
|-
| 0400000000000848 || [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 20.5.0|v1347450282]] (20.5.0.30122) [[Switch 2: 22.1.0|v1477473756]] (22.1.0.30172) [[Switch 2: 22.5.0|v1481668160]] (22.5.0.30272) || [20.1.0+] [[Switch 2: Compatibility Mode|ApplicationCompatibilityInfo]] || This has [[NCM_services#ContentMetaAttributes|ContentMetaAttributes]] = Rebootless.
|-
| 0400000000000849 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || || This appears to be MiiModel updated for Ounce (similar filenames except with "NX" -> "Ounce", etc).
|-
| 040000000000084A || [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || [20.1.0+] || Contains ja-JP voice data.
|-
| 040000000000084B || [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || [20.1.0+] || Contains en-US voice data.
|-
| 040000000000084C || [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || [20.1.0+] || Contains fr-FR voice data.
|-
| 040000000000084D || [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || [20.1.0+] || Contains de-DE voice data.
|-
| 040000000000084E || [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || [20.1.0+] || Only on FirmwareVariationId 0xC. This has [[NCM_services#ContentMetaAttributes|ContentMetaAttributes]] value 0x10.
|-
| 040000000000084F || [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || [20.1.0+] || Only on FirmwareVariationId 0xC. This has [[NCM_services#ContentMetaAttributes|ContentMetaAttributes]] value 0x10.
|-
| 0400000000000850 || [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || [20.1.0+] || Only on FirmwareVariationId 0xC. This has [[NCM_services#ContentMetaAttributes|ContentMetaAttributes]] value 0x10.
|-
| 0400000000000851 || [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || [20.1.0+] || Only on FirmwareVariationId 0xC. This has [[NCM_services#ContentMetaAttributes|ContentMetaAttributes]] value 0x10.
|-
| 0400000000000852 || [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || [20.1.0+] || Only on FirmwareVariationId 0xC. This has [[NCM_services#ContentMetaAttributes|ContentMetaAttributes]] value 0x10.
|-
| 0400000000000853 || [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || [20.1.0+] || Contains en-GB voice data.
|-
| 0400000000000854 || [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || [20.1.0+] || Only on FirmwareVariationId 0xC. This has [[NCM_services#ContentMetaAttributes|ContentMetaAttributes]] value 0x10.
|-
| 0400000000000855 || [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || [20.1.0+] || Contains es-MX voice data.
|-
| 0400000000000858 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || || Same as NgWord2. This has [[NCM_services#ContentMetaAttributes|ContentMetaAttributes]] = Rebootless.
|-
| 0400000000000859 || [[Switch 2: 20.1.0|v1343257748]] (20.1.0.31892) [[Switch 2: 20.5.0|v1347450282]] (20.5.0.30122) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) [[Switch 2: 22.5.0|v1481668160]] (22.5.0.30272) || [20.1.0+] ClientCertData || Compared to NX, "meta.json" was filled in, and "eshop_p01_prod.p12" + "eshop_p01_urls.txt" were added (latter contains a single URL whitelist line).
|-
| 040000000000085A || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) || || Contains "ProductLogo.bin" and "ProductLogoMeta.bin". This is the raw image data for the logo displayed during system-boot.
|-
| 040000000000085B || [[Switch 2: 20.1.0|v1343257898]] (20.1.0.32042) [[Switch 2: 20.5.0|v1347450282]] (20.5.0.30122) [[Switch 2: 22.1.0|v1477473756]] (22.1.0.30172) [[Switch 2: 22.5.0|v1481668160]] (22.5.0.30272) || [20.1.0+] || Contains "/{lang}/gaiji.lex" and "/{lang}/userdict.csv". [22.5.0+] This has [[NCM_services#ContentMetaAttributes|ContentMetaAttributes]] = Rebootless.
|-
| 040000000000085C || [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || [20.1.0+] GameCardConfigurationData || Contains "GameCardConfigurationData.bin", which was updated compared to NX. This has [[NCM_services#ContentMetaAttributes|ContentMetaAttributes]] = Rebootless.
|-
| 040000000000085D || [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) [[Switch 2: 22.5.0|v1481668160]] (22.5.0.30272) || [21.0.0+] BrowserCoreDll ||
|-
| 0400000000000860 || [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || [21.0.0+] CameraFirmware || Contains "NintendoSwitch2CameraFirmware.bin", Squashfs image for the Linux camera firmware.
|}

= System Applets =
{| class=wikitable
! ProgramId || Versions || Description || Notes
|-
| 0400000000001000 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.1|v1343321424]] (20.1.1.30032) [[Switch 2: 20.4.0|v1346401916]] (20.4.0.30332) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) [[Switch 2: 22.5.0|v1481668160]] (22.5.0.30272) || qlaunch (SystemAppletMenu) ||
|-
| 0400000000001001 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257908]] (20.1.0.32052) [[Switch 2: 20.2.0|v1344304624]] (20.2.0.30192) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) [[Switch 2: 22.5.0|v1481668160]] (22.5.0.30272) || [[Auth_Applet|auth]] (LibraryAppletAuth) ||
|-
| 0400000000001003 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257908]] (20.1.0.32052) [[Switch 2: 20.2.0|v1344304624]] (20.2.0.30192) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) [[Switch 2: 22.5.0|v1481668160]] (22.5.0.30272) || [[Controller_Applet|controller]] (LibraryAppletController) ||
|-
| 0400000000001005 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257908]] (20.1.0.32052) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) [[Switch 2: 22.5.0|v1481668160]] (22.5.0.30272) || [[Error_Applet|error]] (LibraryAppletError) ||
|-
| 0400000000001007 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257908]] (20.1.0.32052) [[Switch 2: 20.2.0|v1344304624]] (20.2.0.30192) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) [[Switch 2: 22.5.0|v1481668160]] (22.5.0.30272) || [[Profile Selector|playerSelect (LibraryAppletPlayerSelect)]] ||
|-
| 0400000000001008 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257908]] (20.1.0.32052) [[Switch 2: 20.2.0|v1344304624]] (20.2.0.30192) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) [[Switch 2: 22.5.0|v1481668160]] (22.5.0.30272) || [[Software Keyboard|swkbd (LibraryAppletSwkbd)]] ||
|-
| 0400000000001009 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257908]] (20.1.0.32052) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) [[Switch 2: 22.5.0|v1481668160]] (22.5.0.30272) || miiEdit (LibraryAppletMiiEdit) ||
|-
| 040000000000100C || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257928]] (20.1.0.32072) [[Switch 2: 20.2.0|v1344304624]] (20.2.0.30192) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) [[Switch 2: 22.5.0|v1481668160]] (22.5.0.30272) || overlayDisp (OverlayApplet) || This is also used for cmenu.
|-
| 040000000000100D || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257908]] (20.1.0.32052) [[Switch 2: 20.2.0|v1344304624]] (20.2.0.30192) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) [[Switch 2: 22.5.0|v1481668160]] (22.5.0.30272) || [[Album_Applet|photoViewer (LibraryAppletPhotoViewer)]] ||
|-
| 040000000000100E || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257948]] (20.1.0.32092) [[Switch 2: 20.2.0|v1344304624]] (20.2.0.30192) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) [[Switch 2: 22.5.0|v1481668160]] (22.5.0.30272) || set (LibraryAppletSet) ||
|-
| 040000000000100F || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257898]] (20.1.0.32042) [[Switch 2: 20.4.0|v1346401916]] (20.4.0.30332) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) [[Switch 2: 22.5.0|v1481668160]] (22.5.0.30272) || ||
|-
| 0400000000001013 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257908]] (20.1.0.32052) [[Switch 2: 20.2.0|v1344304624]] (20.2.0.30192) [[Switch 2: 22.1.0|v1477473756]] (22.1.0.30172) [[Switch 2: 22.5.0|v1481668160]] (22.5.0.30272) || [[MyPage_Applet|myPage (LibraryAppletMyPage)]] ||
|-
| 0400000000001015 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257908]] (20.1.0.32052) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) [[Switch 2: 22.5.0|v1481668160]] (22.5.0.30272) || maintenance (MaintenanceMenu) ||
|-
| 0400000000001041 || [[Switch 2: 20.1.0|v1343257908]] (20.1.0.32052) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) [[Switch 2: 22.5.0|v1481668160]] (22.5.0.30272) || [20.1.0+] ||
|-
| 0400000000001042 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257898]] (20.1.0.32042) [[Switch 2: 20.4.0|v1346401916]] (20.4.0.30332) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) [[Switch 2: 22.5.0|v1481668160]] (22.5.0.30272) || [[Internet_Browser|systemWeb]] ||
|-
| 0400000000001043 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257898]] (20.1.0.32042) [[Switch 2: 20.4.0|v1346401916]] (20.4.0.30332) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) [[Switch 2: 22.5.0|v1481668160]] (22.5.0.30272) || [[Internet_Browser|openWeb]] ||
|-
| 0400000000001045 || [[Switch 2: 20.1.1|v1343321424]] (20.1.1.30032) [[Switch 2: 20.2.0|v1344304624]] (20.2.0.30192) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) [[Switch 2: 22.5.0|v1481668160]] (22.5.0.30272) || [20.1.1+] || Only on FirmwareVariationId 0xB.
|-
| 0400000000001048 || [[Switch 2: 20.1.0|v1343257908]] (20.1.0.32052) [[Switch 2: 20.2.0|v1344304624]] (20.2.0.30192) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) [[Switch 2: 22.5.0|v1481668160]] (22.5.0.30272) || [20.1.0+] splay || Only on FirmwareVariationId 0xB.
|-
| 040000000000104B || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257898]] (20.1.0.32042) [[Switch 2: 20.4.0|v1346401916]] (20.4.0.30332) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) [[Switch 2: 22.5.0|v1481668160]] (22.5.0.30272) || || Only on FirmwareVariationId 0xB.
|-
| 040000000000104C || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 20.4.0|v1346401916]] (20.4.0.30332) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || || Only on FirmwareVariationId 0xB.
|-
| 040000000000104D || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257908]] (20.1.0.32052) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) [[Switch 2: 22.5.0|v1481668160]] (22.5.0.30272) || || Only on FirmwareVariationId 0xB.
|}

= Development System Applications =
{| class=wikitable
! ProgramId || Versions || Description || Notes
|-
| 0400000000002065 || || DevMenuApp ||
|-
| 040000000000218F || || BluetoothHciRelayTool ||
|-
| 040000000000219A || || WlanBtRelayTool ||
|}

= Development System Modules =
{| class=wikitable
! ProgramId || Versions || Description || Notes
|-
| 040000000000B240 || [[Switch 2: 19.0.0|v1275070418]] (19.0.0.2002) [[Switch 2: 20.1.0|v1343257958]] (20.1.0.32102) [[Switch 2: 22.0.0|v1476425580]] (22.0.0.30572) || || Present on retail devices, likely (?) stubbed. Only on FirmwareVariationId 0xB.
|}

= System Applications =
{| class=wikitable
! ProgramId || Versions || Description || Notes
|-
|}

= User Applications =
Refer to the [[Switch 2: Title_list/Games|Games List]] for game and application programs.

9.0.0

2026-08-06T03:38:33Z

Yellows8:

The Switch 9.0.0 system update was released on September 9, 2019. This Switch update was released for the following regions: ALL.

Security flaws fixed: <fill this in manually later, see the updatedetails page from the ninupdates-report page(s) once available for now>.

==Change-log==
From [https://en-americas-support.nintendo.com/app/answers/detail/a_id/22525/p/897 official source]:

<blockquote>
Ver. 9.0.0 (Released September 9, 2019)

Added the following system functionality:

* '''Added a search feature for the News Channel.'''
** Channels can be searched using filters or free text.
* '''Added “Display QR Code to Check In” to User Settings.'''
** You can display a QR Code on-screen to check in using your Nintendo Account.
* '''Alarm Notifications have been added to System Settings > Notifications.'''
** You can check or delete pre-set alarms.
** Alarms can be set up only within supported software (to be added at a later time).
** A controller firmware update may be required to use this feature.
* '''You can now configure touch screen sensitivity settings.'''
** Select between Standard and Stylus sensitivity (optimized for stylus input).
* '''Added the option to turn on/off the system button input (Nintendo Switch Lite only).'''
** When this setting is turned off the system no longer receives input from the console buttons, with the exception of the Capture and HOME Buttons, and can only be operated from a wirelessly paired controller (sold separately).
** This setting is on by default and can only be turned off if a compatible controller (sold separately) is wirelessly paired to the console.
** The setting will automatically turn back on when the console is restarted or after returning from sleep mode.
* '''Added “Online Play Invites” section to the User's page.'''
** Invites from friends to join online play in supported software will be displayed in this section.
* '''General system stability improvements to enhance the user's experience.'''
** Resolved an issue where some users can’t start the Fire Emblem: Three Houses game, and get an error instead.
</blockquote>

==System Titles==
All titles were updated except for the following: Dictionary, UrlBlackList, and [[flog]].

New titles [[NGCT_services|ngct-sysmodule]] and NgWordT were added.

[[NPDM]] changes (besides usual version-bump):
* usb: Service access: added ins:s, removed hid:sys.
* settings: Name updated: settings_hoag -> settings.
* Bus: Name updated: Bus_hoag -> Bus.
* ptm: Service server access: added fgm*, apm:am, apm:sys. Service access: added bpc, psm, clkrst:i, time:su, removed time:u. KernelCap ThreadInfo: updated HighestPriority = 0x10 -> 0x4. SVC access: added CreateSharedMemory, MapTransferMemory, UnmapTransferMemory, MapDeviceAddressSpaceByForce, MapDeviceAddressSpaceAligned. Interrupt access: added 0x053. KernelCap IoMemoryMap: added BeginAddress=0x700E2000.
* bsdsocket: Service access: added time:su, removed time:u.
* hid: Name updated: hid_hoag -> hid. Service server access: removed ahid:hdr, ahid:cd. Service access: added ins:s.
* audio: Name updated: audio_hoag -> audio. Service access: added ins:s.
* ldn: Service server access: added lp2p:app, lp2p:sys. Service access: added bsd:s.
* pcv: Fac.FsAccessFlag updated: cleared bitmask 0x0000000000100400 (SetTime, SystemData). Service server access: removed time:u, time:s, time:a, time:r.
* ns: Service access: added ins:s, notif:s, time:su, removed hid:sys, time:u.
* nfc: Name updated: nfc_Hoag -> nfc.
* psc: Service server access: added time:su, time:s, time:al, time:m, time:p, ins:r, ins:s. Service access: added psc:l. KernelCap HandleTableSize: updated HandleTableSize = 0x100 -> 0x200.
* am: Service access: added bgtc:t, ins:r, led, notif:s, time:p. KernelCap HandleTableSize: updated HandleTableSize = 0x100 -> 0x200.
* glue: Fac.FsAccessFlag updated: set bitmask 0x0000000000100408 (SystemSaveData, SetTime, SystemData). Service server access: added notif:a, notif:s, time:a, time:r, time:u. Service access: added arp:r, bgtc:t, fsp-srv, time:m, time:u.
* creport: Service access: added caps:sc.
* sdb: Service server access: added pl:s.
* qlaunch: Service access: added nd:sys, ngct:s, notif:s.
* cabinet: Service access: added ngct:u.
* netConnect: Service access: added ngct:u.
* playerSelect: Service access: added ngct:u.
* miiEdit: Service access: added ngct:u.
* LibAppletWeb: SVC access: added SynchronizePreemptionState.
* LibAppletShop: SVC access: added SynchronizePreemptionState.
* overlayDisp: Service access: added ngct:u, notif:s.
* photoViewer: Service access: added ngct:u.
* LibAppletOff: SVC access: added SynchronizePreemptionState.
* LibAppletLns: SVC access: added SynchronizePreemptionState.
* LibAppletAuth: SVC access: added SynchronizePreemptionState.
* myPage: Service access: added ngct:u.

RomFs changes:
* hid-sysmodule:
** "/ftmFwUpdate/FTS_00120100.fts256" added
** "/ftmFwUpdate/FTS_32000001.fts256" added
** "/ftmFwUpdate/FTS_32000102.fts256" added
** "/ftmFwUpdate/FTS_32000302.fts256" added
** "/ftmFwUpdate/FTS_32000402.fts256" added
** "/ftmFwUpdate/NTD_4CD_1801.fts256" removed
** "/ftmFwUpdate/NTD_4CD_2602.fts256" removed
** "/ftmFwUpdate/NTD_4CD_3801.fts256" removed
** "/ftmFwUpdate/NTD_4CD_xxxx.fts256" removed
* ErrorMessage: updated
** Localization for "zh-HansT" was added. New errors were added. Localization for various errors were updated.
* BrowserDll:
** "/browser/DefaultCss.dat" added
** "/browser/RootCaEtc.pem" updated
** "/browser/UserCss.dat" updated
** "/buildinfo/buildinfo.dat" updated
** "/dll_0/cairo_wkc.nro.lz4" updated
** "/dll_0/libfont.nro.lz4" updated
** "/dll_0/oss_wkc.nro.lz4" updated
** "/dll_0/peer_wkc.nro.lz4" updated
** "/dll_0/webkit_wkc.nro.lz4" updated
** "/dll_1/" added
*** New directory "/dll_1/" was added, which also contains OSS NROs with the same filenames. All web-applets now use this instead of dll_0, except for LibraryAppletOfflineWeb which still uses dll_0. This is likely done so that Offline game manuals etc don't break.
*** dll_0 have binary names in the NRO "D:\for_cruiser\release_326\nx\applications\cruiser_sample\build\NX64\Develop_Dll\...", while dll_1 have "D:\for_cruiser_Safari606\release_31\nx\applications\cruiser_sample\build\NX64\Develop_Dll\...".
** "/lyt/": Various data updated.
** "/message/": Various data updated.
** "/message/CNzhT/" added
* Help:
** "/legallines.htdocs/index.html" updated
** "/safe.htdocs/html/CNzh/" added
** "/safe.htdocs/html/JPja/index.html" updated
** "/safe.htdocs/html/JPja/page_02.html" updated
** "/safe.htdocs/html/JPja/page_04.html" updated
** "/safe.htdocs/html/KRko/index.html" updated
** "/safe.htdocs/html/KRko/page_02.html" updated
** "/safe.htdocs/html/KRko/page_04.html" updated
** "/safe.htdocs/html/TWzh/index.html" updated
** "/safe.htdocs/html/TWzh/page_02.html" updated
** "/safe.htdocs/html/TWzh/page_03.html" updated
** "/safe.htdocs/html/TWzh/page_04.html" updated
** "/safe.htdocs/js/chnscript.js" added
* Chinese and Korean dictionaries:
** "/Iwnn/KO/njubase1.a" updated
** "/Iwnn/KO/njubase2.a" updated
** "/Iwnn/ZH/CN/pinyin/GB18030/njtan.a" updated
** "/Iwnn/ZH/CN/pinyin/GB18030/njtan.ad1" updated
** "/Iwnn/ZH/CN/pinyin/GB2312/njtan.a" updated
** "/Iwnn/ZH/CN/pinyin/GB2312/njtan.ad1" updated
** "/Iwnn/ZH/HK/cangjie/njcangjie.a" updated
** "/Iwnn/ZH/HK/cangjie/quick/njcangjie.a" updated
** "/Iwnn/ZH/HK/cangjie/quick/njcangjie.ad1" updated
** "/Iwnn/ZH/HK/jyutping/njtan.a" updated
** "/Iwnn/ZH/HK/jyutping/njtan.ad1" updated
** "/Iwnn/ZH/HK/stroke/njstroke.a" updated
** "/Iwnn/ZH/TW/bopomofo/keisei/njtan.ad1" updated
** "/Iwnn/ZH/TW/bopomofo/keisei/njubase2.ad1" updated
** "/Iwnn/ZH/TW/bopomofo/njtan.a" updated
** "/Iwnn/ZH/TW/bopomofo/njubase1.a" updated
** "/Iwnn/ZH/TW/bopomofo/njubase2.a" updated
** "/Iwnn/ZH/TW/bopomofo/no_keisei/njtan.ad1" updated
** "/Iwnn/ZH/TW/bopomofo/no_keisei/njubase2.ad1" updated
** "/Iwnn/ZH/TW/cangjie/njcangjie.a" updated
** "/Iwnn/ZH/TW/cangjie/quick/njcangjie.a" updated
** "/Iwnn/ZH/TW/cangjie/quick/njcangjie.ad1" updated
** "/Iwnn/ZH/TW/pinyin/keisei/njtan.ad1" updated
** "/Iwnn/ZH/TW/pinyin/keisei/njubase2.ad1" updated
** "/Iwnn/ZH/TW/pinyin/njtan.a" updated
** "/Iwnn/ZH/TW/pinyin/njubase1.a" updated
** "/Iwnn/ZH/TW/pinyin/njubase2.a" updated
** "/Iwnn/ZH/TW/pinyin/no_keisei/njtan.ad1" updated
** "/Iwnn/ZH/TW/pinyin/no_keisei/njubase2.ad1" updated
** "/Iwnn/ZH/TW/stroke/njstroke.a" updated
* NgWord: "/0.txt" updated, "/common.txt" updated, "/version.dat" updated
* [[System_Version_Title|SystemVersion]]: All files updated.
* AvatarImage: "/DatabaseInfo.bin" updated
* LocalNews:
** "/image/LnShopIntro_Terra/" added
** "/image/LnSupIntro/main_Other.jpg" updated
** "/image/LnSupIntro/main_Terra.jpg" added
** "/message/": Various data updated.
** "/message/CNzhT/" added
* Eula: "/CNzhT/" added, "/revision.txt" updated
* TimeZoneBinary: updated
* [[System_Settings|FirmwareDebugSettings/PlatformConfigIcosa/PlatformConfigCopper/PlatformConfigHoag/PlatformConfigIcosaMariko]]: All files updated.
* FatalMessage:
** "/de/TerraMessage" added
** "/en-GB/TerraMessage" added
** "/en-US/TerraMessage" added
** "/es/TerraMessage" added
** "/es-419/TerraMessage" added
** "/fr/TerraMessage" added
** "/fr-CA/TerraMessage" added
** "/it/TerraMessage" added
** "/ja/TerraMessage" added
** "/ko/TerraMessage" added
** "/nl/TerraMessage" added
** "/pt/TerraMessage" added
** "/ru/TerraMessage" added
** "/zh-CN/TerraMessage" added
** "/zh-Hans/TerraMessage" added
** "/zh-Hant/TerraMessage" added
** "/zh-TW/TerraMessage" added
* ControllerIcon: "/lyt/footer/800/controllerIcon.bntx" updated, "/lyt/footer/800/info.dat" updated
* ControllerFirmware: "/FirmwareInfo.csv" updated, "/ukyosakyo_ep2_ota.bin" updated
* NgWord2: "/ac_0_not_b_nx" updated, "/ac_common_not_b_nx" updated
* RebootlessSystemUpdateVersion: All files updated.
* qlaunch applet:
** "/common/shader/VarietyOceanShader_Nx.arc.szs" updated
** "/lyt/": Various data updated.
** "/message/": Various data updated.
** "/message/CNzh/pshop.msbt.szs" removed
** "/message/CNzhT/" added
** "/message/EUde/pshop.msbt.szs" removed
** "/message/EUen/pshop.msbt.szs" removed
** "/message/EUes/pshop.msbt.szs" removed
** "/message/EUfr/pshop.msbt.szs" removed
** "/message/EUit/pshop.msbt.szs" removed
** "/message/EUnl/pshop.msbt.szs" removed
** "/message/EUpt/pshop.msbt.szs" removed
** "/message/EUru/pshop.msbt.szs" removed
** "/message/JPja/pshop.msbt.szs" removed
** "/message/USen/pshop.msbt.szs" removed
** "/message/USes/pshop.msbt.szs" removed
** "/message/USfr/pshop.msbt.szs" removed
** "/sound/qlaunch_action.bksnd" updated
** "/sound/qlaunch.bfsar" updated
* auth applet:
** "/common/shader/VarietyOceanShader_Nx.arc.szs" updated
** "/lyt/": Various data updated.
** "/message/": Various data updated.
** "/message/CNzhT/" added
** "/sound/auth_action.bksnd" updated
** "/sound/auth.bfsar" updated
* cabinet applet:
** "/common/shader/VarietyOceanShader_Nx.arc.szs" updated
** "/lyt/": Various data updated.
** "/message/": Various data updated.
** "/message/CNzhT/" added
** "/sound/cabinet_action.bksnd" updated
** "/sound/cabinet.bfsar" updated
* controller applet:
** "/common/shader/VarietyOceanShader_Nx.arc.szs" updated
** "/lyt/": Various data updated.
** "/message/": Various data updated.
** "/message/CNzhT/" added
** "/sound/controller_action.bksnd" updated
** "/sound/controller.bfsar" updated
* dataErase applet:
** "/common/shader/VarietyOceanShader_Nx.arc.szs" updated
** "/lyt/": Various data updated.
** "/message/": Various data updated.
** "/message/CNzhT/" added
** "/sound/dataErase_action.bksnd" updated
** "/sound/dataErase.bfsar" updated
* error applet:
** "/common/shader/VarietyOceanShader_Nx.arc.szs" updated
** "/lyt/": Various data updated.
** "/message/": Various data updated.
** "/message/CNzhT/" added
** "/sound/error_action.bksnd" updated
** "/sound/error.bfsar" updated
* netConnect applet:
** "/common/shader/VarietyOceanShader_Nx.arc.szs" updated
** "/lyt/": Various data updated.
** "/message/": Various data updated.
** "/message/CNzhT/" added
** "/sound/netConnect_action.bksnd" updated
** "/sound/netConnect.bfsar" updated
* playerSelect applet:
** "/common/shader/VarietyOceanShader_Nx.arc.szs" updated
** "/lyt/": Various data updated.
** "/message/": Various data updated.
** "/message/CNzhT/" added
** "/sound/playerSelect_action.bksnd" updated
** "/sound/playerSelect.bfsar" updated
* swkbd applet:
** "/common/shader/VarietyOceanShader_Nx.arc.szs" updated
** "/lyt/": Various data updated.
** "/message/": Various data updated.
** "/message/CNzhT/" added
** "/sound/swkbd_action.bksnd" updated
** "/sound/swkbd.bfsar" updated
* miiEdit (LibraryAppletMiiEdit):
** "/archive/Gfx.bin.cmp" updated
** "/archive/Layout.bin.cmp" updated
** "/archive/Mii.bin.cmp" updated
** "/archive/Ptcl.bin.cmp" updated
** "/archive/Shader.bin.cmp" updated
** "/archive/Yaml.bin.cmp" updated
** "/message/": Various data updated.
** "/message/CNzhT/" added
* [[Internet_Browser|LibAppletShop applet]]: "/buildinfo/buildinfo.dat" updated, "/.nrr/netfront.nrr" updated, "/whitelist/WhitelistEc.txt" updated
** "/whitelist/WhitelistEc.txt": "|ch" was added to the main "nintendo" line, for allowing nintendo.ch. Two new lines were added: <nowiki>"^https://([0-9A-Za-z\-]+\.)*nintendoswitch\.cn(/|$)" and "^https://([0-9A-Za-z\-]+\.)*nintendoswitch\.com\.cn(/|$)"</nowiki>.
* overlayDisp applet:
** "/common/shader/SimpleShader_Nx.arc.szs" updated
** "/lyt/": Various data updated.
** "/message/": Various data updated.
** "/message/CNzhT/" added
** "/sound/infoAlarm.raw" added
** "/sound/overlayDisp_action.bksnd" updated
* photoViewer applet:
** "/common/shader/VarietyOceanShader_Nx.arc.szs" updated
** "/lyt/": Various data updated.
** "/message/": Various data updated.
** "/message/CNzhT/" added
** "/sound/photoViewer_action.bksnd" updated
** "/sound/photoViewer.bfsar" updated
* [[Internet_Browser|LibAppletOff/LibAppletWeb/LibAppletAuth]]: "/buildinfo/buildinfo.dat" updated, "/.nrr/netfront.nrr" updated
* [[Internet_Browser|LibAppletLns applet]]: "/buildinfo/buildinfo.dat" updated, "/.nrr/netfront.nrr" updated, "/whitelist/WhitelistLns.txt" updated
** "/whitelist/WhitelistLns.txt": A duplicate "ch|" was removed from the main "nintendo" line. The same new "nintendoswitch" lines from WhitelistEc.txt were added. The "... google(\.[A-Za-z]+)*/(search\?|translate" line had "|amp/)" added at the end. The following new line was added: "---- ^https?://([0-9A-Za-z\-]+\.)*(sites|mail|news)\.google(\.[A-Za-z]+)*/".
* "starter" application:
** "/common/shader/VarietyOceanShader_Nx.arc.szs" updated
** "/lyt/": Various data updated.
** "/message/": Various data updated.
** "/message/CNzhT/" added
** "/sound/starter_action.bksnd" updated
** "/sound/starter.bfsar" updated
* myPage applet:
** "/common/shader/VarietyOceanShader_Nx.arc.szs" updated
** "/lyt/": Various data updated.
** "/message/": Various data updated.
** "/message/CNzhT/" added
** "/sound/myPage_action.bksnd" updated
** "/sound/myPage.bfsar" updated
* maintenance applet:
** "/common/shader/VarietyOceanShader_Nx.arc.szs" updated
** "/lyt/": Various data updated.
** "/message/": Various data updated.
** "/message/CNzhT/" added
** "/sound/maintenance_action.bksnd" updated
** "/sound/maintenance.bfsar" updated

=== BootImagePackages ===
RomFs changes: BootImagePackage/BootImagePackageSafe: All files updated.

[[Package2|INI1]] changes:
* BootImagePackageSafe:
** 0100000000000021 (psc): KernelCap HandleTableSize: updated HandleTableSize = 0x80 -> 0x200.

====NX_BOOTLOADER====
NX bootloader was updated.

<check back later for diff>

====Secure Monitor====
Secure Monitor was updated.

* CPU Suspend SMC code now explicitly initializes the state of I2C5 before communicating with the PMIC, instead of assuming that it is in a valid state.
* Code for initializing MMIO inside package2ldr now writes random values to a number of PMC secure scratch registers, and validates that the written values are read back successfully before locking the scratch.
** This writes to secscratch 4-7 (used to store SRK), then locks them.
*** The SE will overwrite these values during context save despite the lock.
** This then writes to secscratch 112-115 and 24-25, used by TZ during context save to store a MAC and a key source, respectively.
*** These too will be overwritten during context save, as the scratch are not locked.
** secscratch 4-7 are then locked a second time.

====KernelLdr====
[[Kernel Loader|KernelLdr]] was updated.

* TPIDR_EL1 is now set to 0, and VBAR_EL1 is now set to a table that infinite loops on all exceptions other than synchronous from same exception level.
** synch_spx_el1 now restores a number of registers from a context with pointer in TPIDR_EL1.
* TPIDR_EL1 is now set to a context save struct before manufacturer-specific system registers are set, and validated to be non-0/NULL afterwards. It is then cleared.
** Support was added for Cortex-A53 specific CPU initialization.
* Kernel .rodata is now initially mapped as RW- instead of R--, and then reprotected to R-- after relocations are completed.
** This allows for/implements .rel.ro.

====Kernel====
Kernel was updated.

* Starting with this version, Kernel .rwdata is now 0x1000 aligned instead of 0x10000 aligned.

<check back later for diff>

====Warmboot====
* The firmware revision magic was changed from 0x14A to 0x16B.

<check back for more diffs later>

====FIRM Sysmodules====
FIRM sysmodules were updated. Specific diffs available below:

=====[[Filesystem services|FS]]=====
[[Gamecard_ASIC#User_firmware|Gamecard ASIC firmware]] was updated.

A new field "AcidSignatureKeyGeneration" in the [[NPDM|NPDM]] format is now used to select between different public keys for verifying the [[NPDM#ACID|ACID]] signature.

=====[[Loader services|Loader]]=====
The anti-downgrade code in CreateProcess was updated.
* All system modules, and all web applets are now subject to anti-downgrade restrictions.
* Instead of using 1 as the minimum value, the minimum value is looked up from an array in .rodata on a per-module basis.
** All current entries use 0x24000000 (9.0.0) as the minimum version.

=====[[Boot]]=====
Code was added implementing (partial, unfinished) support for a new hardware form-factor. Hardware type for this is 4 ("Calcio"), uses Mariko SoC.

===[[PPC_services|ppc-sysmodule]]===
This sysmodule was stubbed. This is now a SystemData title with an empty [[CNMT]] list.

The services which were previously hosted by this sysmodule were moved into [[PTM_services|ptm-sysmodule]].

===[[RO_services|ro-sysmodule]]===
A new field "CertificationSignatureKeyGeneration" in the [[NRR|NRR]] format is now used to select between different public keys for verifying the [[NRR#Certification|Certification]] signature.

==Keys==
All updated non-FIRM titles use a new masterkey, except for Eula which still uses the keydata from [[1.0.0]].

==See Also==
System update report(s):
* [https://yls8.mtheall.com/ninupdates/reports.php?date=09-09-19_08-05-10&sys=hac]

{{NavboxVersions}}

[[Category:System versions]]

7.0.0

2026-08-06T02:56:29Z

Yellows8:

The Switch 7.0.0 system update was released on January 28, 2019. This Switch update was released for the following regions: ALL.

Security flaws fixed: <fill this in manually later, see the updatedetails page from the ninupdates-report page(s) once available for now>.

==Change-log==
[https://en-americas-support.nintendo.com/app/answers/detail/a_id/22525/p/897 Official] ALL change-log:
* Select from six new New Super Mario Bros.™ U Deluxe icons for your user
* To edit your user icon, head to your My Page > Profile on the top left of the HOME menu
* Added additional language support to the HOME Menu for Chinese, Korean, and Taiwanese
* To change the language, head to the System Settings > System > Language
* General system stability improvements to enhance the user's experience

==System Titles==
All titles were updated, except: "Chinese and Korean dictionaries", "European English and Japanese dictionaries", EULA, "Blacklist URL", "Dummy file", "Hoag system config", and flog.

NPDM:
* New services were [[Services_API|added]].
* bluetooth-sysmodule now has access to svcCreateSharedMemory.
* HID-sysmodule now has access to new service usb:qdb.
* ldn-sysmodule now has access to service psc:m.
* account-sysmodule: now has access to service npns:s.
* ns-sysmodule: service access to prepo:s was replaced with srepo:u. FS permissions now have bitmask 0x0000000400000000 set (CanFormatSdCard).
* nfc-sysmodule: now has access to services: psm, i2c, and gpio.
* am-sysmodule: now has access to services lm and nvgem:cd.
* btm-sysmodule: now has access to service srepo:u.
* npns-sysmodule: main thread stack size changed from 0x8000 to 0x4000. Removed service access for acc:aa and acc:u1, added access to pm:bm.
* glue-sysmodule: now has access to service srepo:u.
* Various applets now have access to service "banana" (which still doesn't exist on retail).

RomFs changes:
* hid-sysmodule: "/ftmFwUpdate/NTD_4CD_xxxx.fts256" added
* ErrorMessage: updated
* BrowserDll:
** "/browser/ErrorPageTemplate.html" updated
** "/browser/UserCss.dat" updated
** "/buildinfo/buildinfo.dat" updated
** "/dll/cairo_wkc.nro.lz4" updated
** "/dll/libfont.nro.lz4" updated
** "/dll/oss_wkc.nro.lz4" updated
** "/dll/peer_wkc.nro.lz4" updated
** "/dll/webkit_wkc.nro.lz4" updated
** "/lyt/": Various data updated.
** "/lyt/Browse/SwkbdCaret.arc" added
** "/lyt/Keyboard/" removed
** "/message/CNzh/" added
** "/message/": Various data updated.
** "/message/KRko/" added
** "/message/TWzh/" added
** "/shader/OceanShader.arc" updated
* Help: "/legallines.htdocs/index.html" updated
* NgWord: "/0.txt" updated, "/13.txt" updated, "/version.dat" updated
* [[System_Version_Title|SystemVersion]]: All files updated.
* AvatarImage:
** "/chara/0000006D.szs" added
** "/chara/0000006E.szs" added
** "/chara/0000006F.szs" added
** "/chara/00000070.szs" added
** "/chara/00000071.szs" added
** "/chara/00000072.szs" added
** "/chara/table.bin" updated
** "/DatabaseInfo.bin" updated
* LocalNews: "/message/CNzh/" added, "/message/KRko/" added, "/message/revision.txt" updated, "/message/TWzh/" added
* [[System_Settings|FirmwareDebugSettings]]: All files updated.
* FatalMessage:
** "/ko/ErrorCode" updated
** "/ko/GeneralMessage" updated
** "/ko/QuestMessage" updated
** "/zh-CN/ErrorCode" updated
** "/zh-CN/GeneralMessage" updated
** "/zh-CN/QuestMessage" updated
** "/zh-Hans/ErrorCode" updated
** "/zh-Hans/GeneralMessage" updated
** "/zh-Hans/QuestMessage" updated
** "/zh-Hant/ErrorCode" updated
** "/zh-Hant/GeneralMessage" updated
** "/zh-Hant/QuestMessage" updated
** "/zh-TW/ErrorCode" updated
** "/zh-TW/GeneralMessage" updated
** "/zh-TW/QuestMessage" updated
* ControllerFirmware: "/FirmwareInfo.csv" updated, "/ukyosakyo_ep2_ota.bin" updated
* NgWord2: "/ac_0_b1_nx" updated, "/ac_0_b2_nx" updated, "/ac_0_not_b_nx" updated, "/ac_13_b1_nx" updated, "/ac_13_b2_nx" updated
* RebootlessSystemUpdateVersion: All files updated.
* ContentActionTable: "/table/" added
** The new file "/table/431FA316E20941779452DD0EBFA05E0E/ApplicationId" contains string "0x01003a400c3da000" - "YouTube".
* qlaunch applet:
** "/lyt/": Various data updated.
** "/message/CNzh/" added
** "/message/": Various data updated.
** "/message/EUde/pshop.msbt.szs" added
** "/message/EUen/pshop.msbt.szs" added
** "/message/EUes/pshop.msbt.szs" added
** "/message/EUfr/pshop.msbt.szs" added
** "/message/EUit/pshop.msbt.szs" added
** "/message/EUnl/pshop.msbt.szs" added
** "/message/EUpt/pshop.msbt.szs" added
** "/message/EUru/pshop.msbt.szs" added
** "/message/JPja/pshop.msbt.szs" added
** "/message/KRko/" added
** "/message/TWzh/" added
** "/message/USen/pshop.msbt.szs" added
** "/message/USes/pshop.msbt.szs" added
** "/message/USfr/pshop.msbt.szs" added
** "/sound/qlaunch_action.bksnd" updated
* auth applet:
** "/lyt/": Various data updated.
** "/message/CNzh/" added
** "/message/": Various data updated.
** "/message/KRko/" added
** "/message/TWzh/" added
** "/sound/auth_action.bksnd" updated
* cabinet applet:
** "/lyt/": Various data updated.
** "/message/CNzh/" added
** "/message/": Various data updated.
** "/message/KRko/" added
** "/message/TWzh/" added
** "/sound/cabinet_action.bksnd" updated
* controller applet:
** "/lyt/": Various data updated.
** "/message/CNzh/" added
** "/message/": Various data updated.
** "/message/KRko/" added
** "/message/TWzh/" added
** "/sound/controller_action.bksnd" updated
* dataErase applet:
** "/lyt/": Various data updated.
** "/message/CNzh/" added
** "/message/": Various data updated.
** "/message/KRko/" added
** "/message/TWzh/" added
** "/sound/dataErase_action.bksnd" updated
* error applet:
** "/lyt/": Various data updated.
** "/message/CNzh/" added
** "/message/": Various data updated.
** "/message/KRko/" added
** "/message/TWzh/" added
** "/sound/error_action.bksnd" updated
* netConnect applet:
** "/lyt/": Various data updated.
** "/message/CNzh/" added
** "/message/": Various data updated.
** "/message/KRko/" added
** "/message/TWzh/" added
** "/sound/netConnect_action.bksnd" updated
* playerSelect applet:
** "/lyt/": Various data updated.
** "/message/CNzh/" added
** "/message/": Various data updated.
** "/message/KRko/" added
** "/message/TWzh/" added
** "/sound/playerSelect_action.bksnd" updated
* swkbd applet:
** "/lyt/": Various data updated.
** "/message/CNzh/" added
** "/message/": Various data updated.
** "/message/KRko/" added
** "/message/TWzh/" added
** "/sound/swkbd_action.bksnd" updated
* miiEdit (LibraryAppletMiiEdit):
** "/archive/Gfx.bin.cmp" updated
** "/archive/Layout.bin.cmp" updated
** "/archive/Mii.bin.cmp" updated
** "/archive/Ptcl.bin.cmp" updated
** "/archive/Shader.bin.cmp" updated
** "/archive/Yaml.bin.cmp" updated
** "/message/CNzh/" added
** "/message/KRko/" added
** "/message/TWzh/" added
* [[Internet_Browser|LibAppletShop applet]]: "/buildinfo/buildinfo.dat" updated, "/.nrr/netfront.nrr" updated, "/whitelist/WhitelistEc.txt" updated
** "/whitelist/WhitelistEc.txt": <nowiki>"^https://([0-9A-Za-z\-]+\.)*eshop\.nintendo\.net($|/)" was changed to "^https://([0-9A-Za-z\-]+\.)*nintendo\.net(/|$)"</nowiki>.
* overlayDisp applet:
** "/lyt/": Various data updated.
** "/message/CNzh/" added
** "/message/": Various data updated.
** "/message/KRko/" added
** "/message/TWzh/" added
** "/sound/overlayDisp_action.bksnd" updated
* photoViewer applet:
** "/lyt/": Various data updated.
** "/message/CNzh/" added
** "/message/": Various data updated.
** "/message/KRko/" added
** "/message/TWzh/" added
** "/sound/photoViewer_action.bksnd" updated
* [[Internet_Browser|LibAppletOff/LibAppletWeb/LibAppletLns/LibAppletAuth]]: "/buildinfo/buildinfo.dat" updated, "/.nrr/netfront.nrr" updated
* "starter" application:
** "/lyt/": Various data updated.
** "/message/CNzh/" added
** "/message/": Various data updated.
** "/message/KRko/" added
** "/message/TWzh/" added
** "/sound/starter_action.bksnd" updated
* myPage applet:
** "/lyt/": Various data updated.
** "/message/CNzh/" added
** "/message/": Various data updated.
** "/message/KRko/" added
** "/message/TWzh/" added
** "/sound/myPage_action.bksnd" updated
* maintenance applet:
** "/lyt/": Various data updated.
** "/message/CNzh/" added
** "/message/": Various data updated.
** "/message/KRko/" added
** "/message/TWzh/" added
** "/sound/maintenance_action.bksnd" updated

=== BootImagePackages ===
RomFs changes: all files updated.

====Package1ldr====
Since [[6.2.0]], the following was changed (besides the usual constant changes for new fuse burnt, incremented version, etc):
* A function that returns a hardware type now returns 0xF whenever it would previously have returned a non-zero value.
** Code validating hardware type has been simplified accordingly.
* The function validating the bootloader version by parsing the BCT no longer hardcodes the BCT address as 0x40000100, and instead adds a relative offset to a BCT address specified via argument.
* The [[TSEC Firmware#SecureBoot|SecureBoot TSEC firmware]] was updated to prevent SMMU virtualization attacks.

====NX_BOOTLOADER====
NX bootloader was updated, and is now stored compressed. Before executing, a small stub now uncompresses the bootloader to 0x40004000, size 0x1C000.

====Secure Monitor====
The Secure Monitor was updated, and is now stored compressed. Before executing, a small stub now uncompresses the main TrustZone image to 0x7C010800 size 0xC800, and environment setup code to 0x40032000 size 0xC000.

* The 0x100 region used for NX_BOOTLOADER <-> SecureMonitor communications is now 0x40000000 instead of 0x40002E00.
* Memory permissions for .rodata have been fixed, it is now correctly mapped R-- instead of RW-.
* Sealed old keys are now stored in the auxilliary data page (0x1F01FA000) instead of in .rwdata.
** An 0x10 block in the auxilliary page is now used for intermediate key derivation, instead of a block on the stack. This block is only memcleared once at the end, instead of after every time it is used.
* TrustZone code is now cleared from IRAM before signalling to NX_BOOTLOADER that the SecMon is awake.
* A function for getting HardwareType based on fuses now returns 0xF whenever it would previously have returned a non-zero value.
** This function is called by [[SMC|smcGetConfig]] when ConfigItem_HardwareType is passed in.
* Warmboot.bin has been moved again, and is now copied from 0x4003E000 size 0x17F0 instead of 0x4003D800 size 0x1FF0
* Code configuring what peripherals to set secure-world only now assumes that the code is a retail unit.
** GetRetailType() is still called (though result is discarded), this probably means they now have compile-time switches for retail vs dev.

====Warmboot====
* The firmware revision magic was changed from 0xA8 to 0x129.

====FIRM Sysmodules====
All FIRM sysmodules were updated. The only FIRM sysmodules with IPC changes were [[Filesystem_services|FS]], [[Process_Manager_services|pm]], and [[NCM_services|NCM]]. Specific diffs for a few sysmodules are below:

=====[[Process Manager services|PM]]=====
Resource limit initialization was changed:
* PM now dynamically calculates the number of extra threads available in the kernel's slab heap compared to the amount it is expecting.
** A [[Process Manager services#BoostApplicationThreadResourceLimit|new command]] was added to pm:shell to make these extra threads available to applications, on retail this doubles the number of threads creatable to 0xC0.

=====[[Filesystem services|FS]]=====
* Device Address Space initialization for nn::sdmmc is now handled differently.
** Previously, the shared SDMMC device address space handle was attached to all devices during global init prior to service registration.
** Now, the handle is attached to specific devices during their relevant DeviceAccessor::Initialize() call, which only happens when the relevant device is ready for access.
* (Many other differences not yet reversed/noted here.)

=====[[NCM services|NCM]]=====
* The ExpHeap used for generic and fs allocations was reduced from 3 MB to 1 MB in size.

=== [[USB_services|usb-sysmodule]] ===
* New services / commands were added.
* The codebin now has .json data embedded in the codebin for [[USB_services#HidGamepad|HidGamepad]] USB-devices.

=== [[Account_services|account-sysmodule]] ===
* Various .text changes. Besides those:
* The "v4-<hexstr>" URLs were changed to "v5" URLs.
* User-agent was changed to "libcurl (nnDauth; <hex>; SDK 7.3.0.0)".

<fill this in (manually) later>

==See Also==
System update report(s):
* [https://yls8.mtheall.com/ninupdates/reports.php?date=01-28-19_07-05-12&sys=hac]

{{NavboxVersions}}

[[Category:System versions]]

5.0.0

2026-08-06T02:44:23Z

Yellows8:

The Switch 5.0.0 system update was released on March 12, 2018. This Switch update was released for the following regions: ALL.

Security flaws fixed: <fill this in manually later, see the updatedetails page from the ninupdates-report page(s) once available for now>.

==Change-log==
[http://en-americas-support.nintendo.com/app/answers/detail/a_id/22525/p/897 Official] ALL change-log:
*Added the following system functionality
:* Facebook and Twitter friends that also use Nintendo Switch can now be added through Friend Suggestions
::* Friend suggestions are based on the Facebook and Twitter accounts you ''have linked to your Nintendo Account''
::* To view your friend suggestions, from the top left of the HOME Menu head to your User Page > Friend Suggestions
::* You must be 13 or older to use this feature
:* Select from 24 new ARMS and the Kirby series icons for your user
::* To edit your user icon, head to your My Page on the top left of the Home Menu > Profile
:* Digital software purchases made from a PC or smart device will start downloading sooner than previously, even if the Nintendo Switch console is in Sleep Mode
:* Filter News to view only unread news or news from specific channels
:* To keep the Parental Controls PIN private, the default method for PIN entry has been changed to entering using the Control Stick and buttons instead of the on-screen number pad
::* When prompted to enter you Parental Controls PIN, press and hold the + Button to change between input methods
:* Captured videos in the Album will be restricted by Parental Controls depending on the Restricted Software setting and Software Rating Organization
:* ''Using the Nintendo Switch Parental Controls app'', add specific software titles to your whitelist to exclude them from the console’s Parental Controls Restricted Software setting
::* Play-Time Limit restrictions will still apply even when the software title has been whitelisted.
:* Receive notification when pre-purchased software is ready to play
:* Nintendo Switch Pro Controller grip colors will now display in the Controllers menu
* General system stability improvements to enhance the user's experience, including:
:* Resolved an issue that caused Play Activity to display incorrectly in the Profile section of your User Page

==System Titles==
All 01000000000010XX titles and most 01000000000008XX titles were updated. Some 8XX titles were just rebuilt with the new NCA crypto without actual RomFS-content changes.

* 0100000000000824(Mariko Config), 0100000000000825, 0100000000000826 were added.
** 0100000000000824 provides configuration for the new "T214" SoC.
** 0100000000000825 contains an empty "/blacklist.dat" file.
** 0100000000000826 contains a 0x40-byte "/version" file, this is all-zero except for '0' at offset 0x20.

The built codebins now have padding in .text after every function for 0x10-byte alignment (and other compiler changes).

The SDK included with titles (main-codebin) for NV changed/updated NVIDIA hw strings:

Previous version:
00000000: 4e56 4944 4941 2054 6567 7261 204b 3100 NVIDIA Tegra K1.
00000010: 4e56 4944 4941 2054 6567 7261 2058 31 NVIDIA Tegra X1

Current version:
00000000: 4e56 4944 4941 2054 6567 7261 2f4e 696e NVIDIA Tegra/Nin
00000010: 7465 6e64 6f20 5377 6974 6368 004e 5649 tendo Switch.NVI
00000020: 4449 4120 5465 6772 6120 5832 0047 5031 DIA Tegra X2.GP1
00000030: 3042 0047 5031 3036 0047 5031 3036 2d41 0B.GP106.GP106-A
00000040: 0047 6546 6f72 6365 2047 5458 2031 3036 .GeForce GTX 106
00000050: 3020 3347 4200 4765 466f 7263 6520 4754 0 3GB.GeForce GT
00000060: 5820 3130 3630 2036 4742 0047 6546 6f72 X 1060 6GB.GeFor
00000070: 6365 2047 5458 2031 3035 3000 4765 466f ce GTX 1050.GeFo
00000080: 7263 6520 4754 5820 3130 3630 0047 6546 rce GTX 1060.GeF
00000090: 6f72 6365 2047 5458 2031 3035 3020 5469 orce GTX 1050 Ti
000000a0: 0047 5031 3036 474c 2d41 0051 7561 6472 .GP106GL-A.Quadr
000000b0: 6f20 5032 3030 3000 4750 3130 362d 4200 o P2000.GP106-B.
000000c0: 4750 3130 3647 4c2d 42 GP106GL-B

[[NPDM]] changes (besides usual version-bump):
* usb: Acid.Flags updated: 0x1 -> 0x9. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* htc.stub: Acid.Flags updated: 0x1 -> 0x9. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* boot2.ProdBoot: Acid.Flags updated: 0x1 -> 0x9. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* settings: Acid.Flags updated: 0x1 -> 0x9. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* Bus: Acid.Flags updated: 0x1 -> 0x9. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* bluetooth: Acid.Flags updated: 0x1 -> 0x9. Service server access: added bt. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* bcat: Acid.Flags updated: 0x1 -> 0x9. Service access: added dauth:0, srepo:a. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* friends: Acid.Flags updated: 0x1 -> 0x9. Service server access: added nd:app, nd:sys. Service access: added ndd, set. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* nifm: Acid.Flags updated: 0x1 -> 0x9. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* ptm: Acid.Flags updated: 0x1 -> 0x9. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* bsdsocket: Acid.Flags updated: 0x1 -> 0x9. KernelCap ThreadInfo: updated MinCoreNumber = 0x0 -> 0x3. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* hid: MainThreadStackSize updated: 0x2000 -> 0x3000. Acid.Flags updated: 0x1 -> 0x9. Service server access: added hidbus. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* audio: Acid.Flags updated: 0x1 -> 0x9. Service server access: removed audrec:a, audrec:d. Service access: added lm. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* LogManager.Prod: Acid.Flags updated: 0x1 -> 0x9. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* wlan: Acid.Flags updated: 0x1 -> 0x9. Service access: added psm. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* ldn: Acid.Flags updated: 0x1 -> 0x9. Service server access: added ndd. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* nvservices: Acid.Flags updated: 0x1 -> 0xD. KernelCap KernelVersion: updated Version = 6.0 -> 9.0. SVC access: removed QueryPhysicalAddress.
* pcv: Acid.Flags updated: 0x1 -> 0x9. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* capmtp: Acid.Flags updated: 0x1 -> 0x9. Service access: removed lm. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* nvnflinger: Acid.Flags updated: 0x1 -> 0x9. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* pcie: Acid.Flags updated: 0x1 -> 0x9. Service access: added set:sys. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* account: Acid.Flags updated: 0x1 -> 0x9. Service server access: added dauth:0. Service access: added ovln:snd, spl:mig. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* ns: Acid.Flags updated: 0x1 -> 0x9. Service access: added erpt:c. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* nfc: Acid.Flags updated: 0x1 -> 0x9. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* psc: Acid.Flags updated: 0x1 -> 0x9. Service server access: added srepo:*. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* capsrv: MainThreadStackSize updated: 0x4000 -> 0x5000. Acid.Flags updated: 0x1 -> 0x9. Fac.FsAccessFlag updated: set bitmask 0x4000000000000000 (Debug (ignored on non-DebugMode, see [[SPL_services#GetConfig|here]])). Service server access: added caps:u. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* am: Acid.Flags updated: 0x1 -> 0x9. Fac.FsAccessFlag updated: set bitmask 0x0000000080000000 (DeviceDetection). Service server access: added tcap. Service access: added acc:u1, pdm:qry. KernelCap KernelVersion: updated Version = 6.0 -> 9.0. SVC access: added MapPhysicalMemoryUnsafe, UnmapPhysicalMemoryUnsafe.
* ssl: Acid.Flags updated: 0x1 -> 0x9. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* nim: Acid.Flags updated: 0x1 -> 0x9. Service server access: added nim:eca. Service access: added arp:r, dauth:0, srepo:u. KernelCap KernelVersion: updated Version = 6.0 -> 9.0. SVC access: added MapTransferMemory, UnmapTransferMemory.
* lbl: Acid.Flags updated: 0x1 -> 0x9. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* btm: Acid.Flags updated: 0x1 -> 0x9. Service server access: added btm:u. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* erpt: Acid.Flags updated: 0x1 -> 0x9. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* vi: Acid.Flags updated: 0x1 -> 0xD. KernelCap KernelVersion: updated Version = 6.0 -> 9.0. KernelCap HandleTableSize: updated HandleTableSize = 0x80 -> 0xA0. SVC access: added MapTransferMemory, UnmapTransferMemory.
* pctl: Acid.Flags updated: 0x1 -> 0x9. Service access: added dauth:0. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* npns: Acid.Flags updated: 0x1 -> 0x9. Service access: added arp:r, dauth:0. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* eupld: Acid.Flags updated: 0x1 -> 0x9. Service access: added bgtc:t, dauth:0. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* glue: Acid.Flags updated: 0x1 -> 0x9. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* eclct: Acid.Flags updated: 0x1 -> 0x9. Fac.FsAccessFlag updated: set bitmask 0x0000000000100000 (SystemData). Service access: added erpt:r, fsp-srv, omm, time:u. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* es: Acid.Flags updated: 0x5 -> 0x9. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* fatal: Acid.Flags updated: 0x1 -> 0x9. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* grc: Acid.Flags updated: 0x1 -> 0x9. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* creport: Acid.Flags updated: 0x1 -> 0x9. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* ro: Acid.Flags updated: 0x1 -> 0x9. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* sdb: Acid.Flags updated: 0x1 -> 0x9. Fac.SaveDataOwnerInfo added 0100000000001009 (miiEdit) access 0x3 (RW). Service server access: added miiimg. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* migration: Acid.Flags updated: 0x1 -> 0x9. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* jpegdec: Acid.Flags updated: 0x1 -> 0x9. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* safemode: Acid.Flags updated: 0x1 -> 0x9. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* qlaunch: Acid.Flags updated: 0x1 -> 0x5. Service access: added miiimg. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* auth: Acid.Flags updated: 0x1 -> 0x5. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* cabinet: Acid.Flags updated: 0x1 -> 0x5. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* controller: Acid.Flags updated: 0x1 -> 0x5. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* dataErase: Acid.Flags updated: 0x1 -> 0x5. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* error: Acid.Flags updated: 0x1 -> 0x5. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* netConnect: Acid.Flags updated: 0x1 -> 0x5. Service access: added ntc. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* playerSelect: Acid.Flags updated: 0x1 -> 0x5. Service access: added miiimg. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* swkbd: Acid.Flags updated: 0x1 -> 0x5. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* miiEdit: Acid.Flags updated: 0x1 -> 0x5. Service access: added miiimg. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* LibAppletWeb: Acid.Flags updated: 0x1 -> 0x5. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* LibAppletShop: Acid.Flags updated: 0x1 -> 0x5. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* overlayDisp: Acid.Flags updated: 0x1 -> 0x5. Service access: added erpt:c. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* photoViewer: Acid.Flags updated: 0x1 -> 0x5. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* LibAppletOff: Acid.Flags updated: 0x1 -> 0x5. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* LibAppletLns: Acid.Flags updated: 0x1 -> 0x5. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* LibAppletAuth: Acid.Flags updated: 0x1 -> 0x5. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* "starter" application: KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* myPage: Acid.Flags updated: 0x1 -> 0x5. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.
* maintenance: Acid.Flags updated: 0x1 -> 0x5. KernelCap KernelVersion: updated Version = 6.0 -> 9.0.

RomFs changes:
* [[System_Version_Title|SystemVersion]]: All files updated.
* [[System_Settings|FirmwareDebugSettings]]: All files updated.
* 801 (Support Error Codes)
* 803 (web-applet "shareddata:/")
* 804 (HTML resources for "Intellectual Property Notices" / "Health & Safety Information")
** "/legallines.htdocs/index.html" was updated with a Twitter mention, and a license section for "Software License for The Fraunhofer FDK AAC Codec Library for Android" was added.
** "/safe.htdocs/html/EU{XX}/index.html" was updated.
* 806 (Bad words)
* 807 ([[Hotspot List]])
** This was updated with more hotspots (these networks use encryption): "nintendoappdebug1", "Nintendo App Debug2", "Nintendo App Debug3", and "NCL-NZSERVICE1-5GHZ".
* 80A (Chara)
* 80B (Offline news)
* 80E (Geo Zoneinfo)
* 810-814 (All fonts)
* 818 (System-config)
* 81E (Controller gfx/icon data + dummy file)
** "/lyt/ColorTable" and "/lyt/footer/controllerIcon.bntx" were updated. The "01-00" image showing handheld-mode with detached joy-cons was replaced with a blank image.
* 81F (Icosa system config)
* 820 (Copper system config)
* 821 (Hoag system config)
* 822 (Firmware binaries for peripherals)
** The following was updated: "FirmwareInfo.csv", "tera_ota.bin", "tera_ota_iap.bin", and "ukyosakyo_ep2_ota.bin".
* 823

=== BootImagePackages ===
RomFs changes:
* "/a/" added, "/nx/bct" updated, "/nx/package1" updated, "/nx/package1.dec" updated, "/nx/package2" updated

[[Package2|INI1]] changes:
* BootImagePackage:
** 0100000000000000 (FS): KernelCap HandleTableSize: updated HandleTableSize = 0x80 -> 0x100. SVC access: added GetSystemInfo, removed QueryPhysicalAddress.
** 0100000000000003 (ProcessMana): SVC access: added SetUnsafeLimit, GetSystemInfo.
** 0100000000000004 (sm): SVC access: added GetSystemInfo.
* BootImagePackageSafe:
** 0100000000000000 (FS): KernelCap HandleTableSize: updated HandleTableSize = 0x80 -> 0x100. SVC access: added GetSystemInfo, removed QueryPhysicalAddress.
** 0100000000000003 (ProcessMana): SVC access: added SetUnsafeLimit, GetSystemInfo.
** 0100000000000004 (sm): SVC access: added GetSystemInfo.
* BootImagePackageExFat:
** 0100000000000000 (FS): KernelCap HandleTableSize: updated HandleTableSize = 0x80 -> 0x100. SVC access: added GetSystemInfo, removed QueryPhysicalAddress.
** 0100000000000003 (ProcessMana): SVC access: added SetUnsafeLimit, GetSystemInfo.
** 0100000000000004 (sm): SVC access: added GetSystemInfo.
* BootImagePackageExFatSafe:
** 0100000000000000 (FS): KernelCap HandleTableSize: updated HandleTableSize = 0x80 -> 0x100. SVC access: added GetSystemInfo, removed QueryPhysicalAddress.
** 0100000000000003 (ProcessMana): SVC access: added SetUnsafeLimit, GetSystemInfo.
** 0100000000000004 (sm): SVC access: added GetSystemInfo.

A new folder "a" was added, in addition to the existing "nx" folder, containing a separate "bct" and "package1". Both of these seem encrypted/meant for the new "Mariko" hardware that support was added for.

====Secure Monitor====
The [[Memory_layout|Memory layout]] was changed significantly:
* .text, .rodata, and .data are now separate sections, mapped with correct permissions (RX, RO, RW, respectively), instead of being mapped RWX.
* Physical layout in TZRAM changed significantly, with pk2ldr being in low TZRAM instead of high TZRAM, etc.

In addition, there were changes to the [[SMC]] interface:

* smcGenerateSpecificAesKey was updated to support generating previous 4.x+ device key(s).
* smcLoadSecureExpModKey/smcLoadRsaOaepKey/smcDecryptRsaPrivateKey no longer exist.
* smcLoadRsaOaepKey was replaced with smcEncryptRsaPrivateKeyForImport.
* smcDecryptRsaPrivateKey was replaced with smcDecryptOrImportRsaPrivateKey.
** All keys which were previously imported with specific keys now first call smcEncryptRsaPrivateKeyForImport with the appopriate enum member to get a sealed copy of the RSA key, then smcDecryptOrImportRsaPrivateKey to import/unseal the key when needed.
* smcGetConfig was extended with two new config items:
** GetConfig(16), which seems to check whether the Switch is running on a Tegra 210:
return (FUSE_RESERVED_ODM4 & 0x800) && FUSE_RESERVED_ODM0 == 0x8E61ECAE && FUSE_RESERVED_ODM1 == 0xF2BA3BB2 ? (FUSE_RESERVED_ODM2 & 0x1F) : 0
** Getconfig(17), which returns the Package2 hash if booting from recovery mode.

<fill in the rest later>

====Kernel====
* Kernel Address Space Layout Randomization was added.
** Instead of using a hardcoded address for per-CPU region, they now use x18 to point to the per-CPU region.
* When using most [[SMC]]s, IRQs are now disabled first then restored to original state afterwards. x18 is also reinitialized right after most SMCs (see above).
* 5 new syscalls.
** Syscalls 0x48+0x49 (svcAllocateUserHeapMemory+svcFreeUserHeapMemory) are used by [[AM_services|AM]]-sysmodule.
*** This is used to allocate Application pool.
** Syscall 0x4A (svcSetUserHeapMemoryAllocationMax) is used by [[Process_Manager_services|PM]]-sysmodule.
*** This allows PM to set a limit on the number of bytes AM can allocate from Application pool.
** Syscall 0x6F (svcGetMemoryInfo) is used by FS, SM, and PM.
** Syscall 0x2E (svcGetNextThreadInfo) was added, but it only works on dev units.
*** Allows fetching how many bytes free/occupied by the different pools.
** svcControlCodeMemory was [[SVC#svcControlCodeMemory|updated]].
* NPDM irq_id's are no longer checked to be < 0x100, instead max-value is loaded from per-cpu state.
* The order slabheaps are laid out in memory is now randomized.
* There are now 4 memory pool partitions.
** This fixes sysmodule takeover with GMMU hax.

===[[Internet Browser]]===
OSS/WebKit was updated.

In the [[NPDM]], besides the RSA region the only changes were the kernel-release-version descriptor + {new ACID flag is set}.

In the "shareddata:/" title, the NROs are now compressed: "{name}.nro.lz4" instead of "{name}.nro".

===[[qlaunch]]===
RomFS changes:
* "/common/shader/VarietyOceanShader_Nx.arc.szs" updated
* "/lyt/common.szs" updated
* "/lyt/DummyGameA.szs" and "/lyt/DummyGame.szs" were removed.
* "/lyt/Entrance.szs" updated
* "/lyt/Eula.szs" added
* "/lyt/Flaunch.szs" updated
* "/lyt/Gift.szs" updated
* "/lyt/Interrupt.szs" updated
* "/lyt/Migration.szs" updated
* "/lyt/Notification.szs" updated
* "/lyt/Option.szs"
* "/lyt/ResidentMenu.szs"
* "/lyt/Set.szs"
* "/message/" Everything under here was updated.
* "/message/Ocean.msbp.szs" added
* "/sound/qlaunch_action.bksnd" and "/sound/qlaunch.bfsar" were updated.
* "/texture" Directory was added, which contains images for Nintendo Switch Parental Controls:
** "IcoPctl.bntx"
** "LogoMoon{region/language-text}.bntx", for every region/language.

===System Config===
New fields were added to [[Settings_services#System_Config|System Config]].

==[[NPDM]]==
New flags bit2/bit3 were added to the flags at ACID+0xC.

==Keys==
[[Flash_Filesystem|Keyblob]] 5 is now used, instead of 4. New NCA keydata is now used as well.

==See Also==
System update report(s):
* [https://yls8.mtheall.com/ninupdates/reports.php?date=03-12-18_08-05-11&sys=hac]

{{NavboxVersions}}

[[Category:System versions]]

12.1.0

2026-08-06T02:20:22Z

Yellows8:

The Switch 12.1.0 system update was released on July 6, 2021 (UTC). This Switch update was released for the following regions: ALL.

Security flaws fixed: yes.

==Change-log==
[https://en-americas-support.nintendo.com/app/answers/detail/a_id/22525/kw/nintendo%20switch%20system%20update Official] ALL change-log:
* Added the following system functionality:
*
* If there is not enough space remaining on the system memory (internal storage) or microSD card when downloading game software update data, you can now delete old data for that software, enabling you to download the new data.
*
* When deleting the old data, you won't be able to play the game until the new data has finished downloading.
*
*
*
* General system stability improvements have been made to enhance the user's experience.

==System Titles==
* Every sysmodule (besides stubs) were updated.
* All SystemData was updated, except for the Dictionary titles, AvatarImage, Eula, ControllerIcon, ApplicationBlackList, FunctionBlackList.
* All applets were updated, except for LibraryAppletCabinet, LibraryAppletSwkbd, LibraryAppletMiiEdit.

The only NPDM changes besides the usual version-bump was adding [[SPL_services|csrng]] service access to the [[Internet_browser|web-applets]]: LibAppletWeb, LibAppletShop, LibAppletOff, LibAppletLns, LibAppletAuth.

There were no sysmodule IPC changes.

The ssl sysmodule codebin was not changed.

RomFs changes:
* ErrorMessage: updated
* BrowserDll:
** "/browser/certBlocklistCommon.json" added
** "/browser/ErrorPageTemplate.html" updated
** "/browser/MediaControlsInline.css" updated
** "/browser/MediaControlsInline.js" updated
** "/browser/RootCaEtc.pem" updated
** "/buildinfo/buildinfo.dat" updated
** "/lyt/": Various data updated.
** "/message/": Various data updated.
** "/nro/netfront/core_0/" added
** "/nro/netfront/core_1/" added
** "/nro/netfront/dll_0/" removed
** "/nro/netfront/dll_1/" removed
* Help: "/legallines.htdocs/index.html" updated
* [[System_Version_Title|SystemVersion]]: All files updated.
* LocalNews:
** "/message/": Various data updated.
* UrlBlackList: "/listLnsChina.txt" updated
* ControllerFirmware: "/FirmwareInfo.csv" updated, "/ukyosakyo_ep2_ota.bin" updated
* RebootlessSystemUpdateVersion: All files updated.
* qlaunch applet:
** "/common/shader/VarietyOceanShader_Nx.arc.szs" updated
** "/lyt/": Various data updated.
** "/message/": Various data updated.
** "/sound/qlaunch_action.bksnd" updated
* auth applet:
** "/common/shader/VarietyOceanShader_Nx.arc.szs" updated
** "/lyt/": Various data updated.
** "/message/": Various data updated.
* controller applet:
** "/common/shader/VarietyOceanShader_Nx.arc.szs" updated
** "/lyt/": Various data updated.
** "/message/": Various data updated.
** "/sound/controller_action.bksnd" updated
* dataErase applet:
** "/common/shader/VarietyOceanShader_Nx.arc.szs" updated
** "/lyt/": Various data updated.
** "/message/": Various data updated.
* error applet:
** "/common/shader/VarietyOceanShader_Nx.arc.szs" updated
** "/lyt/": Various data updated.
** "/message/": Various data updated.
* netConnect applet:
** "/common/shader/VarietyOceanShader_Nx.arc.szs" updated
** "/lyt/": Various data updated.
** "/message/": Various data updated.
* playerSelect applet:
** "/common/shader/VarietyOceanShader_Nx.arc.szs" updated
** "/lyt/": Various data updated.
** "/message/": Various data updated.
* overlayDisp applet:
** "/common/shader/SimpleShader_Nx.arc.szs" updated
** "/lyt/": Various data updated.
** "/message/": Various data updated.
* photoViewer applet:
** "/common/shader/VarietyOceanShader_Nx.arc.szs" updated
** "/http/js/index.js" updated
** "/http/styles/index.css" updated
** "/lyt/": Various data updated.
** "/message/": Various data updated.
** "/sound/photoViewer_action.bksnd" updated
* [[Internet_Browser|LibAppletOff/LibAppletWeb/LibAppletShop/LibAppletLns/LibAppletAuth]]: "/buildinfo/buildinfo.dat" updated, "/.nrr/dll.nrr" was renamed to "/.nrr/modules.nrr"
* "starter" application:
** "/common/shader/VarietyOceanShader_Nx.arc.szs" updated
** "/lyt/": Various data updated.
** "/message/": Various data updated.
* myPage applet:
** "/common/shader/VarietyOceanShader_Nx.arc.szs" updated
** "/lyt/": Various data updated.
** "/message/": Various data updated.
** "/sound/myPage_action.bksnd" updated
* maintenance applet:
** "/common/shader/VarietyOceanShader_Nx.arc.szs" updated
** "/lyt/": Various data updated.
** "/message/": Various data updated.
** "/sound/maintenance_action.bksnd" updated

=== BootImagePackages ===
RomFs changes: all files updated.

===[[USB_services|usb]]===
The only change was updating the [[USB_services#HidGamepad|json]].

===[[Bluetooth_Driver_services|bluetooth]]===
The func for [[Bluetooth_Driver_services#DisableBluetooth|DisableBluetooth]] was updated. Two funcs which handle [[Bluetooth_Driver_services#FatalReason|FatalReason]] no longer clear a global state field.

The remaining changes fixed IPC cmd [[Switch_System_Flaws|vulns]].

===[[Internet_Browser|Web-applets]]===
The [[11.0.0|CFI]] code was updated.

The add/sub instruction was replaced with eor. Hence, the additional code at func entry/exit is now identical. The code now does:
* The low 40-bits of x30 are extracted, then multiplied with x18.
* <code>crc32x w17, w16, x17</code> (which uses the above value - x16 was set to sp after the above bitfield-extract)
* x17 is multiplied with x18 again.
* <code>crc32x w17, wzr, x17</code>
* Then lastly the eor instruction is used with x30, with x17 shifted to bit40.

A vuln with RNG was [[Switch_System_Flaws|fixed]].

==See Also==
System update report(s):
* [https://yls8.mtheall.com/ninupdates/reports.php?date=2021-07-06_00-05-06&sys=hac]

{{NavboxVersions}}

[[Category:System versions]]

9.1.0

2026-08-06T02:14:27Z

Yellows8:

The Switch 9.1.0 system update was released on December 4, 2019. This Switch update was released for the following regions: ALL.

Security flaws fixed: yes.

==Change-log==
[https://en-americas-support.nintendo.com/app/answers/detail/a_id/22525/kw/nintendo%20switch%20system%20update Official] ALL change-log:
* General system stability improvements to enhance the user's experience, including a solution for the following:
*
* Resolved an issue where the color animation was not displaying correctly when attaching a Joy-Con controller to the Nintendo Switch console.
*

See the [https://www.nintendoswitch.com.cn/support/system_update/index.html official] China changelog for the China-specific changelog.

==System Titles==
The following was updated:
* All applets.
* Sysmodules: [[BCAT_services|bcat]], [[Friend_services|friends]], [[Network_Interface_services|nifm]], [[Sockets_services|bsdsockets]], [[HID_services|hid]], [[WLAN_services|wlan]], [[LDN_services|ldn]], [[Account_services|account]], [[NS_Services|ns]], [[NFC_services|nfc]], [[Applet_Manager_services|am]], [[NIM_services|nim]], [[Error_Report_services|erpt]], [[creport]], [[RO_services|ro]], [[Migration_services|migration]], [[OLSC_services|olsc]], and [[NGCT_services|ngct]].
* SystemData (besides the sysver SystemData): ErrorMessage, BrowserDll, Help, SharedFont, LocalNews, Eula, FirmwareDebugSettings, all BootImagePackages, PlatformConfigIcosa, PlatformConfigCopper, PlatformConfigHoag, PlatformConfigIcosaMariko, and NgWordT.

See [[Services_API]] for the new lp2p:m service.

NPDM changes:
* migration: Now has access to srepo:u.
* The following now have access to the new lp2p:m service: qlaunch, LibraryAppletCabinet, LibraryAppletController, LibraryAppletNetConnect, LibraryAppletPlayerSelect, LibraryAppletMiiEdit, all web-applets except for LibraryAppletOfflineWeb, OverlayApplet, and LibraryAppletMyPage.

RomFs changes:
* ErrorMessage: updated
* BrowserDll:
** "/buildinfo/buildinfo.dat" updated
** "/dll_0/cairo_wkc.nro.lz4" updated
** "/dll_0/libfont.nro.lz4" updated
** "/dll_0/oss_wkc.nro.lz4" updated
** "/dll_0/peer_wkc.nro.lz4" updated
** "/dll_0/webkit_wkc.nro.lz4" updated
** "/dll_1/cairo_wkc.nro.lz4" updated
** "/dll_1/libfont.nro.lz4" updated
** "/dll_1/oss_wkc.nro.lz4" updated
** "/dll_1/peer_wkc.nro.lz4" updated
** "/dll_1/webkit_wkc.nro.lz4" updated
** "/message/": Various data updated.
* Help: "/safe.htdocs/html/USen/index.html" updated, "/safe.htdocs/html/USen/page_02.html" updated, "/safe.htdocs/html/USes/index.html" updated, "/safe.htdocs/html/USes/page_02.html" updated, "/safe.htdocs/html/USfr/index.html" updated, "/safe.htdocs/html/USfr/page_02.html" updated
* Chinese and Korean dictionaries: "/Iwnn/ZH/TW/bopomofo/keisei/njtan.ad1" updated, "/Iwnn/ZH/TW/bopomofo/njtan.a" updated, "/Iwnn/ZH/TW/bopomofo/no_keisei/njtan.ad1" updated
* [[System_Version_Title|SystemVersion]]: All files updated.
* LocalNews: "/message/CNzhT/localNews.msbt.szs" updated, "/message/revision.txt" updated, "/message/TWzh/localNews.msbt.szs" updated
* [[System_Settings|FirmwareDebugSettings/PlatformConfigIcosa/PlatformConfigHoag/PlatformConfigIcosaMariko]]: All files updated.
* RebootlessSystemUpdateVersion: All files updated.
* NgWordT: All files updated.
* qlaunch applet:
** "/lyt/": Various data updated.
** "/message/": Various data updated.
** "/sound/qlaunch_action.bksnd" updated
* auth applet: "/message/EUes/common.msbt.szs" updated, "/message/EUfr/common.msbt.szs" updated, "/message/EUit/common.msbt.szs" updated, "/message/EUpt/common.msbt.szs" updated, "/message/Ocean.msbp.szs" updated
* cabinet applet: "/message/EUes/common.msbt.szs" updated, "/message/EUfr/common.msbt.szs" updated, "/message/EUit/common.msbt.szs" updated, "/message/EUpt/common.msbt.szs" updated, "/message/Ocean.msbp.szs" updated
* controller applet:
** "/lyt/": Various data updated.
** "/message/": Various data updated.
** "/sound/controller_action.bksnd" updated
* dataErase applet: "/message/EUes/common.msbt.szs" updated, "/message/EUfr/common.msbt.szs" updated, "/message/EUit/common.msbt.szs" updated, "/message/EUpt/common.msbt.szs" updated, "/message/Ocean.msbp.szs" updated
* error applet: "/message/EUes/common.msbt.szs" updated, "/message/EUfr/common.msbt.szs" updated, "/message/EUit/common.msbt.szs" updated, "/message/EUpt/common.msbt.szs" updated, "/message/Ocean.msbp.szs" updated
* netConnect applet:
** "/lyt/": Various data updated.
** "/message/": Various data updated.
** "/sound/netConnect_action.bksnd" updated
* playerSelect applet:
** "/lyt/": Various data updated.
** "/message/": Various data updated.
** "/sound/playerSelect_action.bksnd" updated
* swkbd applet: "/message/EUes/common.msbt.szs" updated, "/message/EUfr/common.msbt.szs" updated, "/message/EUit/common.msbt.szs" updated, "/message/EUpt/common.msbt.szs" updated, "/message/Ocean.msbp.szs" updated
* overlayDisp applet: "/lyt/MiniSet.szs" updated, "/message/EUes/common.msbt.szs" updated, "/message/EUfr/common.msbt.szs" updated, "/message/EUit/common.msbt.szs" updated, "/message/EUpt/common.msbt.szs" updated, "/message/TWzh/overlayDisp.msbt.szs" updated
* photoViewer applet: "/message/EUes/common.msbt.szs" updated, "/message/EUfr/common.msbt.szs" updated, "/message/EUit/common.msbt.szs" updated, "/message/EUpt/common.msbt.szs" updated, "/message/Ocean.msbp.szs" updated
* [[Internet_Browser|LibAppletOff/LibAppletWeb/LibAppletShop/LibAppletLns/LibAppletAuth]]: "/buildinfo/buildinfo.dat" updated, "/.nrr/netfront.nrr" updated
* "starter" application:
** "/lyt/": Various data updated.
** "/message/": Various data updated.
** "/sound/starter_action.bksnd" updated
* myPage applet:
** "/message/": Various data updated.
** "/sound/myPage_action.bksnd" updated
* maintenance applet:
** "/lyt/": Various data updated.
** "/message/": Various data updated.
** "/sound/maintenance_action.bksnd" updated

=== BootImagePackages ===
RomFs changes: all files updated.

====Secure Monitor====
Secure Monitor was updated.

* System register configuration now sets CPUACTLR_EL1.
** This sets CPUACTLR_EL1 to the same value as in [[Kernel_Loader#KernelLdr_MapInitialIdentityMapping|KernelLdr]], previously this code only configured CPUECTLR_EL1.

====Warmboot====
* The firmware revision magic was changed from 0x16B to 0x18C.

<check back for more diffs later>

====FIRM Sysmodules====
FIRM sysmodules were updated. Specific diffs available below:

=====[[Filesystem services|FS]]=====
The only difference is that nn::crypto::VerifyRsa2048PssSha256 now memsets the decrypted signature buffer to zero after extracting the hash.

=====[[Loader services|Loader]]=====
The only difference besides GNU build hash update is that the Anti-Downgrade arrays were updated to the new title versions.

==See Also==
System update report(s):
* [https://yls8.mtheall.com/ninupdates/reports.php?date=12-04-19_07-05-11&sys=hac]

{{NavboxVersions}}

[[Category:System versions]]

3.0.2

2026-08-06T01:51:47Z

Yellows8:

The Switch 3.0.2 system update was released on September 5, 2017. This Switch update was released for the following regions: ALL.

Security flaws fixed: <fill this in manually later, see the updatedetails page from the ninupdates-report page(s) once available for now>.

==Change-log==
[http://en-americas-support.nintendo.com/app/answers/detail/a_id/22525/p/897 Official] ALL change-log:
* Nintendo Switch Online
** Added online play in Argentina, Brazil, Chile, Colombia, and Peru. This is currently available for free until the paid online service launches in 2018.
* General system stability improvements to enhance the user's experience

==System Titles==
<fill this in (manually) later>

RomFs changes:
* ErrorMessage: updated
* NgWord: "/0.txt" updated, "/1.txt" updated, "/2.txt" updated, "/3.txt" updated, "/version.dat" updated
* [[System_Version_Title|SystemVersion]]: All files updated.
* NgWord2: "/ac_0_not_b_nx" updated, "/ac_1_not_b_nx" updated, "/ac_2_not_b_nx" updated, "/ac_3_b1_nx" updated, "/ac_3_b2_nx" updated, "/ac_3_not_b_nx" updated

=== BootImagePackages ===
RomFs changes:
* BootImagePackage/BootImagePackageSafe/BootImagePackageExFat: "/nx/package2" updated

Kernel was updated. FIRM-sysmodules were not updated.

====Kernel====
* The mmutable init code was updated.
** Some table addrs were updated.
** For the first DRAM mapping loop, the descriptor-ORR value now has bitmask 0x40000000000000 set. This is for TTBR0 vmem 0x80000000. This enables usermode XN for the temporary DRAM mapping only used during kernel boot.
** The descriptor ORR-value for this now has bitmask 0x3000000000000000 set: *(addr+0xf8) = tableaddr | <orrvalue>;//(level2 pagetable descriptor for vmem 0xFFFFFFF7C0000000)
** Descriptor ORR-value bitmask 0x3000000000000000 is now also set for sometable+0xfb0, +0xfc0, and othertable+0xff0.
** Kernel .text descriptor ORR-value now has bitmask 0x40000000000000 set. This enables usermode XN for kernel .text, previously kernel .text was executable from usermode.

* The below code is probably memory-management related?

* L_fffffff7ffc3e9c8
** Updated, prev ver @ L_fffffff7ffc3e9c8
** 0xfffffff7ffc3eed0: "csel x9, xzr, x9, ne" was changed to "csel x9, x11, x9, ne", where x11 is 0x1000000000000000.
** Nothing else changed.

* L_fffffff7ffc3f40c
** Updated, prev ver @ L_fffffff7ffc3f408
** 0xfffffff7ffc3f74c: Same change as L_fffffff7ffc3e9c8.
** Nothing else changed.

* L_fffffff7ffc3faac
** Updated, prev ver @ L_fffffff7ffc3faa4
** Same change as L_fffffff7ffc3e9c8 @ 0xfffffff7ffc3fecc
** Nothing else changed.

* L_fffffff7ffc40088
** Updated, prev ver @ L_fffffff7ffc4007c
** Same change as L_fffffff7ffc3e9c8 @ 0xfffffff7ffc40160
** Nothing else changed.

* L_fffffff7ffc4028c
** Updated, prev ver @ L_fffffff7ffc4027c
** Same change as L_fffffff7ffc3e9c8 @ 0xfffffff7ffc403a0
** Nothing else changed.

* L_fffffff7ffc406f0
** Updated, prev ver @ L_fffffff7ffc406dc
** Same change as L_fffffff7ffc3e9c8, except with value 0x1000000000000001 instead.

==See Also==
System update report(s):
* [https://yls8.mtheall.com/ninupdates/reports.php?date=09-05-17_08-05-14&sys=hac]

{{NavboxVersions}}

5.1.0

2026-08-06T01:47:49Z

Yellows8:

The Switch 5.1.0 system update was released on May 30, 2018. This Switch update was released for the following regions: ALL.

Security flaws fixed: <fill this in manually later, see the updatedetails page from the ninupdates-report page(s) once available for now>.

==Change-log==
[http://en-americas-support.nintendo.com/app/answers/detail/a_id/22525/p/897 Official] ALL change-log:
* General system stability improvements to enhance the user's experience

==System Titles==
<fill this in (manually) later>

System-config / IcosaMariko system-config was updated, however this was just a rebuild (nothing in NCA header changed besides signature+keyarea).

[[NPDM]] changes (besides usual version-bump):
* ptm: Service access: added srepo:u, time:u.
* am: Fac.FsAccessFlag updated: set bitmask 0x0000000000100000 (SystemData).
* eclct: Service access: removed omm.

RomFs changes:
* ErrorMessage: updated
* BrowserDll:
** "/buildinfo/buildinfo.dat" updated
** "/dll/cairo_wkc.nro.lz4" updated
** "/dll/libfont.nro.lz4" updated
** "/dll/oss_wkc.nro.lz4" updated
** "/dll/peer_wkc.nro.lz4" updated
** "/dll/webkit_wkc.nro.lz4" updated
** "/lyt/": Various data updated.
** "/message/": Various data updated.
* Help:
** "/legallines.htdocs/index.html" updated
** "/safe.htdocs/html/USen/index.html" updated
** "/safe.htdocs/html/USen/page_02.html" updated
** "/safe.htdocs/html/USes/index.html" updated
** "/safe.htdocs/html/USes/page_02.html" updated
** "/safe.htdocs/html/USfr/index.html" updated
** "/safe.htdocs/html/USfr/page_02.html" updated
* Chinese and Korean dictionaries:
** "/Iwnn/KO/njexyomi.a" updated
** "/Iwnn/KO/njubase1.a" updated
** "/Iwnn/ZH/CN/pinyin/GB18030/njexyomi.a" updated
** "/Iwnn/ZH/CN/pinyin/GB18030/njexyomi.ad1" updated
** "/Iwnn/ZH/CN/pinyin/GB18030/njtan.a" updated
** "/Iwnn/ZH/CN/pinyin/GB18030/njtan.ad1" updated
** "/Iwnn/ZH/CN/pinyin/GB18030/njubase1.a" updated
** "/Iwnn/ZH/CN/pinyin/GB18030/njubase1.ad1" updated
** "/Iwnn/ZH/CN/pinyin/GB18030/njubase2.a" updated
** "/Iwnn/ZH/CN/pinyin/GB18030/njubase2.ad1" updated
** "/Iwnn/ZH/CN/pinyin/GB18030/njubase3.a" updated
** "/Iwnn/ZH/CN/pinyin/GB18030/njubase3.ad1" updated
** "/Iwnn/ZH/CN/pinyin/GB2312/njexyomi.a" updated
** "/Iwnn/ZH/CN/pinyin/GB2312/njexyomi.ad1" updated
** "/Iwnn/ZH/CN/pinyin/GB2312/njtan.a" updated
** "/Iwnn/ZH/CN/pinyin/GB2312/njtan.ad1" updated
** "/Iwnn/ZH/CN/pinyin/GB2312/njubase1.a" updated
** "/Iwnn/ZH/CN/pinyin/GB2312/njubase1.ad1" updated
** "/Iwnn/ZH/CN/pinyin/GB2312/njubase2.a" updated
** "/Iwnn/ZH/CN/pinyin/GB2312/njubase2.ad1" updated
** "/Iwnn/ZH/CN/pinyin/GB2312/njubase3.a" updated
** "/Iwnn/ZH/CN/pinyin/GB2312/njubase3.ad1" updated
** "/Iwnn/ZH/CN/stroke/GB18030/njstroke.a" updated
** "/Iwnn/ZH/CN/stroke/GB2312/njstroke.a" updated
** "/Iwnn/ZH/HK/cangjie/njcangjie.a" updated
** "/Iwnn/ZH/HK/cangjie/njexyomi.a" added
** "/Iwnn/ZH/HK/cangjie/quick/" added
** "/Iwnn/ZH/HK/jyutping/njexyomi.a" updated
** "/Iwnn/ZH/HK/jyutping/njexyomi.ad1" updated
** "/Iwnn/ZH/HK/jyutping/njtan.a" updated
** "/Iwnn/ZH/HK/jyutping/njtan.ad1" updated
** "/Iwnn/ZH/HK/jyutping/njubase1.a" updated
** "/Iwnn/ZH/HK/jyutping/njubase1.ad1" updated
** "/Iwnn/ZH/HK/jyutping/njubase2.a" updated
** "/Iwnn/ZH/HK/jyutping/njubase2.ad1" updated
** "/Iwnn/ZH/HK/stroke/njstroke.a" updated
** "/Iwnn/ZH/TW/bopomofo/keisei/njexyomi.ad1" updated
** "/Iwnn/ZH/TW/bopomofo/keisei/njtan.ad1" updated
** "/Iwnn/ZH/TW/bopomofo/keisei/njubase1.ad1" updated
** "/Iwnn/ZH/TW/bopomofo/keisei/njubase2.ad1" updated
** "/Iwnn/ZH/TW/bopomofo/njexyomi.a" updated
** "/Iwnn/ZH/TW/bopomofo/njtan.a" updated
** "/Iwnn/ZH/TW/bopomofo/njubase1.a" updated
** "/Iwnn/ZH/TW/bopomofo/njubase2.a" updated
** "/Iwnn/ZH/TW/bopomofo/no_keisei/njexyomi.ad1" updated
** "/Iwnn/ZH/TW/bopomofo/no_keisei/njtan.ad1" updated
** "/Iwnn/ZH/TW/bopomofo/no_keisei/njubase1.ad1" updated
** "/Iwnn/ZH/TW/bopomofo/no_keisei/njubase2.ad1" updated
** "/Iwnn/ZH/TW/cangjie/njcangjie.a" updated
** "/Iwnn/ZH/TW/cangjie/njexyomi.a" added
** "/Iwnn/ZH/TW/cangjie/quick/" added
** "/Iwnn/ZH/TW/pinyin/keisei/njexyomi.ad1" updated
** "/Iwnn/ZH/TW/pinyin/keisei/njtan.ad1" updated
** "/Iwnn/ZH/TW/pinyin/keisei/njubase1.ad1" updated
** "/Iwnn/ZH/TW/pinyin/keisei/njubase2.ad1" updated
** "/Iwnn/ZH/TW/pinyin/njexyomi.a" updated
** "/Iwnn/ZH/TW/pinyin/njtan.a" updated
** "/Iwnn/ZH/TW/pinyin/njubase1.a" updated
** "/Iwnn/ZH/TW/pinyin/njubase2.a" updated
** "/Iwnn/ZH/TW/pinyin/no_keisei/njexyomi.ad1" updated
** "/Iwnn/ZH/TW/pinyin/no_keisei/njtan.ad1" updated
** "/Iwnn/ZH/TW/pinyin/no_keisei/njubase1.ad1" updated
** "/Iwnn/ZH/TW/pinyin/no_keisei/njubase2.ad1" updated
** "/Iwnn/ZH/TW/stroke/njstroke.a" updated
* [[System_Version_Title|SystemVersion]]: All files updated.
* RebootlessSystemUpdateVersion: All files updated.
* qlaunch applet:
** "/lyt/": Various data updated.
** "/message/": Various data updated.
** "/sound/qlaunch_action.bksnd" updated
* controller applet:
** "/lyt/": Various data updated.
** "/message/": Various data updated.
** "/sound/controller_action.bksnd" updated
* playerSelect applet:
** "/lyt/": Various data updated.
** "/message/": Various data updated.
** "/sound/playerSelect_action.bksnd" updated
* swkbd applet:
** "/lyt/": Various data updated.
** "/message/": Various data updated.
** "/sound/swkbd_action.bksnd" updated
* overlayDisp applet:
** "/lyt/": Various data updated.
** "/message/": Various data updated.
** "/sound/overlayDisp_action.bksnd" updated
* photoViewer applet:
** "/lyt/": Various data updated.
** "/message/": Various data updated.
** "/sound/photoViewer_action.bksnd" updated
* [[Internet_Browser|LibAppletOff/LibAppletWeb/LibAppletShop/LibAppletLns/LibAppletAuth]]: "/buildinfo/buildinfo.dat" updated, "/.nrr/netfront.nrr" updated
* myPage applet:
** "/lyt/": Various data updated.
** "/message/": Various data updated.
** "/sound/myPage_action.bksnd" updated

=== BootImagePackages ===
RomFs changes:
* "/nx/package2" updated

Only BootImagePackages that use FS ([[Filesystem_services|FS]], [[NCM_services|NCM]], [[Boot]], [[Loader_services|Loader]] and [[Process_Manager_services|PM]]) were updated. This was solely due to the new cmd 1010 in FS.

===[[qlaunch]]===
The following files were updated in RomFS:

/lyt/common.szs
/lyt/Interrupt.szs
/lyt/Set.szs
/message/<regionlanguage-dirname>/common.msbt.szs
/message/<regionlanguage-dirname>/interrupt.msbt.szs
/message/<regionlanguage-dirname>/option.msbt.szs
/message/<regionlanguage-dirname>/setting.msbt.szs
/sound/qlaunch_action.bksnd

==See Also==
System update report(s):
* [https://yls8.mtheall.com/ninupdates/reports.php?date=05-30-18_08-05-10&sys=hac]

{{NavboxVersions}}

[[Category:System versions]]

6.2.0

2026-08-06T01:39:28Z

Yellows8:

The Switch 6.2.0 system update was released on November 19, 2018. This Switch update was released for the following regions: ALL.

Security flaws fixed: Yes

This update burns an additional fuse and has a fuse count of 8.

6.2.0 changes fundamental key generation, no longer using keyblobs at all (the OS will boot successfully even if both copies of keyblob are replaced with FFs in NAND).

==Change-log==
[https://en-americas-support.nintendo.com/app/answers/detail/a_id/22525/p/897 Official] ALL change-log:
* General system stability improvements to enhance the user's experience.

==System Titles==
''All'' titles were updated (including flog) except for EULA, to use the new keydata.

The following sysmodules were updated with actual changes:
* bcat, friends, hid, nvservices, account

There seems to be no new service IPC commands.

* bcat: The codebin was updated, but no strings were added/changed.
* account: Besides .text changes: String "libcurl (nnDauth; <hex>; SDK 6.4.0.0)" was added. The "v3-<oldhexstr>" in the dauth URLs were changed to "v4-<newhexstr>".
* nvservices: At least 2 vulnerabilities have been patched. See [[Switch_System_Flaws#System_Modules|here]].

RomFs changes:
* [[System_Version_Title|SystemVersion]]: All files updated.
* RebootlessSystemUpdateVersion: All files updated.
* [[Internet_Browser|LibAppletOff/LibAppletWeb/LibAppletShop/LibAppletLns/LibAppletAuth]]: "/.nrr/netfront.nrr" updated
** Only RSA data was changed here.

=== BootImagePackages ===
RomFs changes: all files updated.

====NX_BOOTLOADER====
NX bootloader was updated, and is now stored compressed. Before executing, a small stub now uncompresses the bootloader to 0x40004000, size 0x1C000.

[more details to be filled in later].

====Secure Monitor====
The Secure Monitor was updated:

* BootReason is now saved before security engine/warmboot firmware setup.
* The SYSCTR0 registers are now validated to contain expected values on bootup.
* generate_srk() is now called before any other security engine key derivation is done.
* Code was added to implement new key gen inside initialize_se_derive_keys(), deriving the firmware's master kek and device key using keyslots initialized by the TSEC firmware.
* Keyslots were shuffled around, the master key is now stored inside keyslot 0xD, and the device master key is now stored inside keyslot 0xC.
* The usual code changes for adding a new master key/device master key are in place.

There are zero changes to code outside of the coldboot .init section (pk2ldr).

====Kernel====
* Kernel was not updated.

====FIRM Sysmodules====
* No FIRM sysmodules were updated.

====Warmboot====
* The firmware revision magic was changed from 0x87 to 0xA8.

==See Also==
System update report(s):
* [https://yls8.mtheall.com/ninupdates/reports.php?date=11-19-18_07-05-09&sys=hac]

{{NavboxVersions}}

[[Category:System versions]]

8.1.0

2026-08-06T01:32:43Z

Yellows8:

The Switch 8.1.0 system update was released on June 17, 2019. This Switch update was released for the following regions: ALL.

Security flaws fixed: yes.

==Change-log==
[https://en-americas-support.nintendo.com/app/answers/detail/a_id/22525/p/897 Official] ALL change-log:
* General system stability improvements to enhance the user's experience.
*

==System Titles==
Updated titles:
* Sysmodules:
** settings Rebuilt.
** bus Identical codebin.
** bcat .text updated.
** hid .text updated.
** audio Identical codebin.
** wlan .text updated.
** nvservices Only GNU build hash was updated.
** nvnflinger .text updated.
** account .text updated.
** ns .text updated.
** am .text updated.
** ssl Rebuilt.
** vi .text updated.
** es .text updated.
** fatal .text updated.
** creport Identical codebin.
** ro Identical codebin.
** grc .text updated.
* ErrorMessage, BrowserDll, [[System_Version_Title]], FIRM, qlaunch, web-applets (main codebin rebuilt), and RebootlessSystemUpdateVersion.

No changes with IPC service commands.

RomFs changes:
* ErrorMessage: updated
** Error 2124-4517 was updated with actual strings etc. "/2181/4017/common" and "/DatabaseInfo" were updated.
* BrowserDll: "/buildinfo/buildinfo.dat" updated, "/dll_0/cairo_wkc.nro.lz4" updated, "/dll_0/libfont.nro.lz4" updated, "/dll_0/oss_wkc.nro.lz4" updated, "/dll_0/peer_wkc.nro.lz4" updated, "/dll_0/webkit_wkc.nro.lz4" updated
* [[System_Version_Title|SystemVersion]]: All files updated.
* RebootlessSystemUpdateVersion: All files updated.
* qlaunch applet: "/lyt/Notification.szs" updated
* [[Internet_Browser|LibAppletOff/LibAppletWeb/LibAppletShop/LibAppletLns/LibAppletAuth]]: "/buildinfo/buildinfo.dat" updated, "/.nrr/netfront.nrr" updated

=== BootImagePackages ===
RomFs changes: all files updated.

====Package1ldr====
package1ldr was updated. The TSEC secureboot firmware was updated.

====NX_BOOTLOADER====
NX bootloader was updated.

<check back later for diff>

====Secure Monitor====
The Secure Monitor was updated.

* The SE key read disable function no longer writes zero to AES_KEY_READ_DISABLE/RSA_KEY_READ_DISABLE.
* Functions for locking/checking PMC secure scratch now have additional bitmasks 0x40/0x80 for locking more secure scratch registers.
* NVDEC/TSECB access to the kernel carveout was removed.
* On suspend (SC7 Entry), SWR_USBD_RST is now checked, and AHB arbitration disable is now checked to be COP, ARC, USB, USB2.
** This further mitigates against Deja Vu.
* TZ/SE context save logic has been changed.
** The context save function now first generates 16 random bytes, and securely saves them to scratch (using the usual write-writelock-check-readlock-checklocked pattern).
** It then generates a random aes-256 key, and derives an actual encryption/MAC key by decrypting the random data with that key.
*** Previously, it generated a random aes-256 key and used it directly.
*** This prevents attacks that might coerce the usage of a specific aes-256 key instead of a random one.
** Calls into the check scratch locked/lock scratch function which previously passed one bitmask at a time now pass multiple
*** Accordingly, the lock/check locked functions now support multiple bitmasks instead of single bitmasks at a time.
* The function that initializes the SE/derives keys now sets flag 0x100 on AES keyslots 8-15, and RSA keyslots 0-1.

====Kernel====
Kernel was not changed.

====Warmboot====
* The firmware revision magic was changed from 0x129 to 0x14A.
* Security Engine state validation was changed (first six keyslots now expected to read zeroes instead of FFs).
* <check back for more diffs later>

====FIRM Sysmodules====
FIRM sysmodules were updated. Specific diffs available below:

=====[[Boot]]=====
Only GNU build hash was updated.

=====[[Filesystem services|FS]]=====
Only GNU build hash was updated.

=====[[Loader services|Loader]]=====
*ldr:pm->CreateProcess() now performs additional validation on the NPDM header.
** When the title id is one of certain hardcoded titles, Loader now validates that the version field at NPDM header is non-zero. This prevents selectively downgrading those titles to versions vulnerable to known exploits.
** The titles checked are:
*** settings
*** bus
*** audio
*** nvservices
*** ns
*** ssl
*** es
*** creport
*** ro

=====[[NCM services|NCM]]=====
Only GNU build hash was updated.

=====[[Process Manager services|PM]]=====
Only GNU build hash was updated.

=====[[Services_API|SM]]=====
SM was not updated.

=====[[SPL services|SPL]]=====
SPL was not updated.

==Keys==
Keys were updated.

==See Also==
System update report(s):
* [https://yls8.mtheall.com/ninupdates/reports.php?date=06-17-19_08-05-09&sys=hac]

{{NavboxVersions}}

[[Category:System versions]]

10.1.0

2026-08-06T01:15:30Z

Yellows8: /* System Titles */

The Switch 10.1.0 system update was released on July 14, 2020 (UTC). This Switch update was released for the following regions: ALL.

Security flaws fixed: yes.

==Change-log==
[https://en-americas-support.nintendo.com/app/answers/detail/a_id/22525/kw/nintendo%20switch%20system%20update Official] ALL change-log:
* General system stability improvements to enhance the user's experience.

==System Titles==
* The following sysmodules were updated: [[Settings_services|settings]], [[Friend_services|friends]], [[HID_services|hid]], [[WLAN_services|wlan]], [[NV_services|nvservices]], [[NS_Services|ns]], [[Applet_Manager_services|am]], [[NIM_services|nim]], [[BTM_services|btm]], [[NPNS_services|npns]], [[ETicket_services|es]], [[Migration_services|migration]], [[OLSC_services|olsc]].
* The following SystemData were updated (besides SystemVersion/RebootlessSystemUpdateVersion): [[SSL_services#CertStore|CertStore]], ErrorMessage, SsidList, FirmwareDebugSettings, all BootImagePackages, FatalMessage, [[HID_services#Firmware_update|ControllerFirmware]].
* The following applets were updated: [[qlaunch]], [[Controller_Applet|controller]], [[Software_Keyboard|swkbd]], [[MyPage_Applet|myPage]].

[[NPDM]] changes: version was updated. The Handle Table Size for npns was changed from 100 to 128.

The only sysmodules with IPC changes were: [[Settings_services|settings]], [[Applet_Manager_services|am]], [[NIM_services|nim]], [[OLSC_services|olsc]].

The sysmodules are built with the updated SDK, even though the sdkver wasn't changed.

RomFs changes (besides SystemVersion/RebootlessSystemUpdateVersion):
* [[SSL_services#CertStore|CertStore]]: "/ssl_CaFingerprints.bdf" and "/ssl_TrustedCerts.bdf" were updated.
* ErrorMessage: New errors were added.
* SsidList: "/ssid_list.csv" was updated.
* FirmwareDebugSettings: "/file" was [[System_Settings|updated]].
* FatalMessage: Added "/pt-BR/".
* [[HID_services#Firmware_update|ControllerFirmware]]: "/FirmwareInfo.csv" and "/ukyosakyo_ep2_ota.bin" were updated.
* [[qlaunch]]: "/lyt/Set.szs", "/message/{language}/qlaunch.msbt.szs", "/message/{language}/setting.msbt.szs" were updated.
* [[Controller_Applet|controller]]: "/lyt/Controller.szs", "/message/Ocean.msbp.szs", "/message/USen/controller.msbt.szs", "/message/USes/controller.msbt.szs", "/message/USfr/controller.msbt.szs" were updated.
* [[Software_Keyboard|swkbd]]: "/message/Ocean.msbp.szs" was updated.
* [[MyPage_Applet|myPage]]: "/lyt/MyPage.szs", "/lyt/Set.szs", "/message/{language}/myPage.msbt.szs", "/message/{language}/setting.msbt.szs", "/message/Ocean.msbp.szs", "/sound/myPage_action.bksnd" were updated.

=== BootImagePackages ===
RomFs changes:
* "/nx/package2" updated

=== [[HID_services|hid]]-sysmodule ===
All hidsys ButtonConfig cmds which use an input s32 were updated, the s32 is now [[Switch_System_Flaws#System_Modules|validated]].

Various other funcs were also updated.

=== [[BTM_services|btm]]-sysmodule ===
Two funcs changed:

* First func: This will no longer Abort when [[Bluetooth_Driver_services#StopInquiry|StopInquiry]] fails, the Result is now ignored. Added a call to the below func with arg=8 which is used in some cases, Aborting on fail.
* Second func: Two func calls were removed. A func call was added, for setting a bool flag to false with mutex-locking.

=== [[Migration_services|migration]]-sysmodule ===
Various [[OLSC_services|olsc]] service cmd usage was updated, for using different cmds instead of the previously used cmds, and a new func call which uses an additional cmd was added.

==See Also==
System update report(s):
* [https://yls8.mtheall.com/ninupdates/reports.php?date=2020-07-14_00-05-05&sys=hac]

{{NavboxVersions}}

[[Category:System versions]]

11.0.0

2026-08-06T01:13:41Z

Yellows8:

The Switch 11.0.0 system update was released on December 1, 2020 (UTC). This Switch update was released for the following regions: ALL, and CHN.

Security flaws fixed: <fill this in manually later, see the updatedetails page from the ninupdates-report page(s) once available for now>.

==Change-log==
[https://en-americas-support.nintendo.com/app/answers/detail/a_id/22525/kw/nintendo%20switch%20system%20update Official] ALL change-log:
* Nintendo Switch Online was added to the HOME Menu.
*
* Access all Nintendo Switch Online services, from getting the latest information to checking your membership status.
* *This feature is not available in some countries/regions.
*
* A new feature that automatically downloads backed up save data was added to the Save Data Cloud.
*
* When using software with the same Nintendo Account linked to multiple systems, save data backed up from one console will automatically be downloaded to your other system(s).
* *To use this feature, it must be enabled under System Settings > Data Management > Save Data Cloud.
* *Save data will not be downloaded automatically unless save data for that software exists on the console. The first time only, users must download the save data manually.
* *A Nintendo Switch Online membership is required to use the Save Data Cloud service.
*
* A new Trending feature was added to the User Page.
*
* Users can check what software their friends are playing or have started playing recently.
* Information will not be displayed for friends who have their online status set to display to no one.
*
* Users can now transfer screenshots and videos from Album to their smart devices.
*
* Users can wirelessly connect their smart devices to Nintendo Switch to transfer the screenshots and videos saved within their Album.
* For screenshots, users can transfer a maximum of 10 screenshots and 1 video capture at once.
* *To connect, users must use their smart device to scan the QR Code displayed on the Nintendo Switch screen.
* For more information, please refer to the Nintendo Support website.
* *“QR Code” is a registered trademark of DENSO WAVE INCORPORATED.
*
*
* A new Copy to a Computer via USB Connection feature was added under System Settings > Data Management > Manage Screenshots and Videos.
*
* Users can use a USB cable to connect Nintendo Switch to their computers to copy the screenshots and videos saved under Album.
* * A USB charging cable [model HAC-010] or a USB-IF certified USB cable that supports data transfer is required to connect to a computer.
* For more information, please refer to the Nintendo Support website.
* * Connection via the Nintendo Switch dock is not supported. Please connect the Nintendo Switch system directly to the computer.
*
*
* Users can now select what download to prioritize when there are multiple downloads in progress.
*
* When there are multiple software, update data, or downloadable content downloads in progress, users can now select which they want to download first.
* You can set this under Download Options by selecting the icon for the software you want to download first on the HOME Menu.
*
*
* User icons were added.
*
* 12 user icons that commemorate the 35th anniversary of the Super Mario Bros. series were added.
*
* Users can now name preset button mappings with the Change Button Mapping feature.
* Brazilian Portuguese was added as a supported language.
*
* When users set their region to the Americas and their language to Português, the language used on the HOME Menu and in certain software will be displayed in Brazilian Portuguese.
*
* Several issues were fixed, and usability and stability were improved.

==System Titles==
* All titles were updated, except for the following (minus stubbed titles): SharedFont, Dictionary, UrlBlackList, LibraryAppletMiiEdit.
* The previously stubbed 010000000000001B sysmodule was replaced with [[Capmtp_services|capmtp]].

The following sysmodules had IPC changes: [[USB_services|usb]], [[Settings_services|settings]], [[BCAT_services|bcat]], [[PTM_services|ptm]], [[Sockets_services|bsdsockets]], [[HID_services|hid]], [[Audio_services|audio]], [[WLAN_services|wlan]], [[Account_services|account]], [[NS_Services|ns]], [[PSC_services|psc]], [[Applet_Manager_services|am]], [[NIM_services|nim]], [[Display_services|vi]], [[Parental_Control_services|pctl]], [[Glue_services|glue]], [[ETicket_services|es]], [[Shared_Database_services|sdb]], [[OLSC_services|olsc]], [[PGL_services|pgl]], [[Filesystem_services|fs]], [[Loader_services|loader]], [[Services_API|sm]], [[Capture_services|capsrv]].

[[NPDM]] changes (see [[Services_API]] for service-hosting changes):
* All updated NPDMs now have [[NPDM#Flags|Flags]] bit5 set.
* ptm: Access to hshl:set and ins:r were added.
* ptm/hid: Various services were re-ordered in the Service Access Control.
* wlan now has access to csrng.
* ldn now has access to pl:u.
* pcv now has access to hshl:set.
* account now has access to ectx:w.
* ns now has access to pl:u.
* am: Access to the following was added: arp:r, aud:a, aud:d. Access to the following was removed: audin:a, audin:d, audout:a, audout:d, audren:a, audren:d. Access to hshl:set/hshl:sys was added.
* erpt: Access to svcGetResourceLimitLimitValue and svc 0x37 were added. Access to ectx:r was added.
* vi: The Handle Table Size was changed from 160 to 192. Access to the following services were added: erpt:c, gpio, i2c, lm, psc:m, pwm.
* glue now has access to hshl:sys, and access to psm was removed.
* creport now has access to fsp-srv.
* sdb now has access to bcat:s and pm:info.
* migration now has access to prepo:u.
* qlaunch now has access to [[Capmtp_services|capmtp]].
* [[Controller_Applet|LibraryAppletController]] now has access to [[NGCT_services|ngct:u]].
* [[Profile_Selector|LibraryAppletPlayerSelect]] now has access to [[OLSC_services|olsc:s]].
* [[Album_Applet|LibraryAppletPhotoViewer]]: Access to [[Sockets_services|bsd:u]] was replaced with [[Sockets_services|bsd:s]]. Access to [[LDN_services|lp2p:sys]] was added. Access to [[NS_Services|ns:am2]] was replaced with [[NS_Services|ns:ro]]. FS permission bit0 is now clear, MountContent* is no longer accessible.
* [[Internet_Browser|LibraryAppletLoginShare]] now has access to [[NS_Services|ns:web]].

RomFs changes:
* CertStore was [[SSL_services#CertStore|updated]].
* ErrorMessage: New errors were added / localization changes.
* BrowserDll: The following was updated: "/browser/ErrorPageFilteringTemplate.html", "/browser/MediaControls.css", "/browser/MediaControls.js", "/browser/RootCaEtc.pem", "/browser/RootCaSdkAdditional.pem", "/buildinfo/buildinfo.dat". The following was added: "/browser/MediaControlsInline.css", "/browser/MediaControlsInline.js".
** "/dll_0" and "/dll_1" were moved into "/nro/netfront/dll_{0/1}".
** "/lyt/Lhub.arc" was added.
** "/message/USpt/" was added.
* Help:
** "/legallines.htdocs/index.html" updated
** "/safe.htdocs/html/USpt/" added
** "/safe.htdocs/img/recyclenintendo.jpg" updated
** "/safe.htdocs/js/tapaction.js" updated
* NgWord: updated
* AvatarImage: More icons added.
* LocalNews: Added "/message/revision.txt" and "/message/USpt/".
* Eula:
** "/revision.txt" updated
** Updated "/EUru/Eula.msbt.szs", "/JPja/Eula.msbt.szs".
** Added "/USpt/".
* TimeZoneBinary: TZ info updated.
* FontNintendoExtension: "/nintendo_ext_003.bfttf" and "/nintendo_ext2_003.bfttf" were updated.
* FirmwareDebugSettings: updated
* FatalMessage: Updated "/pt-BR/GeneralMessage" and "/pt-BR/QuestMessage" were updated.
* ControllerIcon: "/lyt/ColorTable" updated
* PlatformConfigIcosa/PlatformConfigCopper/PlatformConfigHoag/PlatformConfigIcosaMariko: updated
* ControllerFirmware: "/TouchScreenFirmwareInfo.csv" updated
* NgWord2: updated
* FunctionBlackList:
** "/blacklist.dat" was replaced with "/blacklist.json".
* NgWordT: updated
* Applets: Various UI/graphics/sound/localization changes.
* Web-applets: "/buildinfo/buildinfo.dat" was updated, and "/.nrr/netfront.nrr" was renamed to "/.nrr/dll.nrr".
* [[Album_Applet|LibraryAppletPhotoViewer]]: In addition to the above, "/http/" was added, which contains the following:
** "index.html"
** "js/index.js"
** "styles/index.css"

The new Nintendo Switch Online menu (which can be launched via qlaunch) is handled by [[Internet_Browser#Whitelisted_Applets|LibraryAppletLoginShare]].

=== BootImagePackages ===
RomFs changes: all files updated.

[[Package2|INI1]] changes:
* BootImagePackageSafe:
** 010000000000001A (PCV): Flags updated: 0x1F -> 0x3F.
** 010000000000000A (Bus): Flags updated: 0x1F -> 0x3F.
** 0100000000000021 (psc): Flags updated: 0x1F -> 0x3F.
* BootImagePackageExFatSafe:
** 010000000000001A (PCV): Flags updated: 0x1F -> 0x3F.
** 010000000000000A (Bus): Flags updated: 0x1F -> 0x3F.
** 0100000000000021 (psc): Flags updated: 0x1F -> 0x3F.

====Secure Monitor====
Secure Monitor was updated.

* The firmware revision magic was changed from 0x1AD to 0x1CE.
* Support was added for an additional DRAM model.

====Warmboot====
* The firmware revision magic was changed from 0x1AD to 0x1CE.

====Kernel====
* Kernel is now built with -Os instead of -O3
** Many functions are no longer inlined.
* crt0 deprivileging code now sets hypervisor EL2 registers.
* Logic for flushing entire data cache and invalidating entire TLB during init is now a function called by JumpFromEL2ToEL1 and DisableMmuICacheAndDCache instead of being duplicated.
* Initialize0 has had several things re-ordered/shuffled:
** InsertDevicePhysicalMemoryBlocks is now called immediately after the KernelCode region is inserted.
** "Needed device virtual space" is now calculated as 3 * (0x18000 + { sum of KernelAutoMap physical device regions } + GetUnknownDebugDeviceRegionSize()
** KernelMisc region size is now util::AlignUp(std::max(needed_device_virtual_space, 32_MB), 2_MB).
** Code for mapping the unknown debug address as UnknownDebug is no longer present.
** Slab region is now memset to zero after the linear region is mapped instead of before.
** Ranges are now more uniform; value in [range address / 2_MB, last_address / 2_MB] is generated and multipled by 2 MB instead of aligning down result.
* KMemoryRegion now has a "last_address" member replacing its "size" member.
** GetSize() now calculated as (last_address - address + 1)
* KMemoryRegionTree::Insert now takes in last address instead of size.
** Several callsites now verify that last_address != 0xFFFF...
* KMemoryRegionAllocator now uses a slabheap of count 200 instead of 1000.
* KLinkedListNode now has slab size = #KThreads instead of #KThreads * 17.
* "Virtual" cores now supported, KThread now stores core ID/affinity for both virtual and physical.
* New SVC 0x37 "GetResourceLimitPeakValue"
** Returns the highest value that a resource limit's current has ever achieved.
** KResourceLimit now stores an array of peak values to enable this
* Two new kernel objects, KAlpha and KBeta (placeholder names, true object names are unknown and cannot be guessed without observing purpose).
** KAlpha has size 0x50, KBeta has size 0x88
** KObjectAllocators for KAlpha/KBeta receive counts 1, 6.
** KProcess has a list of KBeta, intrusive list node is at KBeta + 0x68.
* Four new SVCs, ID 0x39, 0x3A, 0x46, 0x47
** These are likely for interacting with KAlpha and KBeta, but on NX they are (presumably) if-def'd to be "return svc::ResultNotImplemented()"
* KThread had all of its members reordered and its unused members deleted
* Most KThread waits now use KThreadWaiterListIntrusiveNode instead of KThreadQueue
* KConditionVariable no longer uses global threads for the call to .nfind()
* KConditionVariable now sets the cv_key u32 value in userspace to 1 when a condvar has waiters, and to 0 when it does not.
** New nnSdk code relies on this behavior.
* SetupStackForUserModeThreadStarter (KThreadContext::Initialize) now sets X18 to (<cryptographically random u64> | 1), this value is unique for each thread.
** This is used for Pointer Authentication changes in web browser.
* KCoreLocalRegion deleted, replaced with pointer-to-current-thread
** TPIDR_EL1 != X18 now, and TPIDR_EL1 now always points to the exception thread stack.
* KSynchronization was deleted, replaced with namespaced or static-on-ksynchronization-object functions
* KSynchronizationObject now contains a pointer to thread queue, instead of an inline list
* KInterruptEvent no longer has an InterruptEventTask member
* KInterruptEventTask::Reset no longer calls KInterruptManager::ClearInterrupt, instead it calls a new function which returns a result
* KInterruptEventTask now has a KLightLock member
* KHardwareTimer is now an interrupt task again
* KHardwareTimer now has a new member "maximum_time", set to std::numeric_limits<s64>::value().
** Tasks will only be added to the task list if their time is <= maximum_time, this is in addition to the >= 1 checks previously.
* KIntrusiveRedBlackTreeNode now has common member functions instead of templated, size is now packed to 0x1C instead of 0x20.
** All Insert/Remove/etc operations are common regardless of the type the node is intrusive in.
* KDebugLogImpl::Initialize() now assumes uart has been configured for logging by the secure monitor, and does not perform tegra uart init sequence
* vsprintf, KDebugString::PutString are now fully inlined inside KVPrintf.
* KObjectContainer::Insert now returns void instead of Result
** Code which previously did R_TRY() now just calls.
* KPageHeapBitmapRng now has TinyMt as a data member, instead of directly implementing KPageHeap.
** This affects how constructor is invoked.
* New InfoType 24 ("FreeThreadCount") was added, gets the number of threads a process can allocate before exhausting its resource limit.
* KMemoryBlock/KMemoryInfo now has extra members tracking u8 non_contig_bitflags, u16 ipc_non_contig_lock_count, u16 device_non_contig_lock_count
* KMemoryBlockManager Update now takes non-contig flags to determine where to coalesce (all coalescing must now happen forwards instead of either direction)
* KMemoryBlockManagerUpdateAllocator no longer has a result member, instead it has ->Initialize() which takes in a number of blocks to allocate
* KMemoryManager::Allocate, KMemoryManager::AllocatePageGroup, KMemoryManager::AllocatePageGroupForProcess, now call KPageGroup::Open on the returned page group.
** All callsites for these functions no longer call open after allocating.
* KMemoryManager::Open is now KMemoryManager::OpenAdditionalReference, now checks that refcount is >= 1 instead of >= 0
* KPageTableBase now has an additional data member "disable_device_address_space_merge"
** KProcessPageTable::Initialize now takes in (process flags & 0x1000) as a bool argument to set this.
* Page table Query operations now return a number of blocks required to support the above when relevant
* KPageTable now uses 4 sw-reserved bits instead of 1
** Former bit 0x01.... ("Is Mapped") is now bit 0x40..... (PTE bit 58)
** PTE bit 55 "contiguous not allowed" was reworked for significantly more fine-grained control
*** PTE bit 55 is now "start of block non-contiguous", coalescing cannot occur if the first block in a coalesce has this block set.
*** PTE bit 56 is now "not-end-of-block non-contiguous", coalescing cannot occur if a block other than the last in a coalesce has this bit set
*** PTE bit 57 is now "end of block non-contiguous", coalescing cannot occur if the last block in a coalesce has this bit set
*** The old non-contiguous semantics are equivalent to 56 + 57 together.
** These bits are now returned by KPageTableImpl::Traverse
** Upper byte of KPageProperties is now bitflags to control management of these bits.
** Bit 0x1 = "Set/Clear PTE Bit55"
** Bit 0x2 = "Set PTE Bit56"
** Bit 0x4 = "Clear PTE Bit56"
** Bit 0x8 = "Set PTE Bit57"
** Bit 0x10 = "Clear PTE Bit57"
** Bit 0x20 = Force-Clear 56+57 + attempt to merge
* KMemoryBlockManager/KPageTable now prevent coalescing of blocks which are reprotected --- (for transfer memory, ipc, ...)
* They also do not coalesce adjacent GPU mappings that were mapped separately.
* They removed the 0x80 "AnyLocked" bit from KMemoryAttribute
* KMemoryBlock/KMemoryInfo now have additional u16 "device_non_coalesce_right_count".
** Like device_non_coalesce_left_count from previous 11.x, this now prevents merging with block to the right if set.
* KMemoryBlock::Add now takes in the memory block to the right instead of the size of the block to the right.
** This facilitates combining flags for the newly coalesced blocks.
* KPageTableBase::SetProcessMemoryPermission no longer sets non-coalesce bit 24.
* KDeviceAddressSpace::Map/KDeviceAddressSpace::Unmap now call new KPageTableBase function to update non-coalesce state according to partial map state.
* KDevicePageTable::UnmapImpl now invalidates TlbGroup in the failure case of adding to the page group.
* KPageTableBase::MakeAndOpenContiguousPageGroup is now KPageTableBase::MakePageGroupForDeviceAddressSpace, and now prevents coalescing until call completion.
** non_coalesce_mask 0x10 is used for this.
* KPageTableBase::UnmapCodeMemory no longer requires the whole range have the same state.
** It now invalidates instruction cache if any pages are code.
* KPageTable::UnknownVirtualFunction10 now takes in more arguments: _QWORD (address probably), _QWORD (size probably), two bools, _QWORD (address2 probably), _QWORD (size2 probably), void * (probably KAlpha * or KBeta *)
** Returns whether a comparison between address_probably and address_2_probably holds depending on flags at pointer + 0x10.
* KMemoryState_Io now goes to the alias code region in GetRegionAddress/Size (weird, seems like incorrect behavior)
** Also very weird: KPageTableBase::MapIo maps IO into the kernel map region, but KPageTableBase::QueryMapping panics if it is not in the alias code region.
** This "probably" causes kernel panic if mapping IO into process with 32-bit-no-alias address space type?

====FIRM Sysmodules====
FIRM sysmodules were updated. Specific diffs available below:
<check back for more diffs later>

=== [[HID_services|hid]]-sysmodule ===
Besides IPC changes, the ButtonConfig cmds updated the input s32 validation: when the input s32 is invalid (which now uses an unsigned compare), it now returns 0 or an error immediately, instead of Aborting.

=== [[LDN_services|ldn]]-sysmodule ===
lp2p now supports using standard WPA2-PSK, which is used by [[#LibraryAppletPhotoViewer]].

=== [[SSL_services|ssl]]-sysmodule ===
TLS 1.3 is now [[SSL_services#SslVersion|supported]] if the user-process enables it.

See also [[#OSS]].

=== [[PGL_services|pgl]]-sysmodule ===
* pgl now has a new ipc command, which just returns "ResultNotImplemented()"
* pgl now detects when SnapShotDumper crashes, and launches creport in that case.
* pgl now passes an additional argument to creport ("%d", formatted with the value of jit_debug!enable_jit_debug).

=== [[Creport|creport]]-sysmodule ===
* creport now takes in an additional argument "jit_debug_enabled", when this is "1" the target process is not terminated on report completion.
* creport now has access to fsp-srv, this is used to retrieve debugging information that is now attached to error reports. The following functions are called (with output/info attached to erpts):
** GetSdCardSpeedMode
** GetSdCardCid
** GetSdCardUserAreaSize
** GetSdCardProtectedAreaSize
** GetAndClearSdCardErrorInfo
** IsGameCardInserted
** GetGameCardCid
** GetGameCardErrorReportInfo
** GetGameCardDeviceId
** GetMmcSpeedMode
** GetMmcCid
** GetMmcPatrolCount
** GetAndClearMmcErrorInfo
** GetMmcExtendedCsd
** GetAndClearMemoryReportInfo
** GetAndClearFileSystemProxyErrorInfo

=== [[Internet_Browser|Web-applets]] ===
These are now compiled with compiler Pointer Authentication / CFI mitigations enabled. This does not apply to non-web-applets.

Pointer Authentication uses the crc32x instruction, and x18 as a cryptographically-random u64 provided by the kernel. The only userland code using x18 is the mul instruction for this, nothing else (applies to all NSOs/NROs).

This is used to add/subtract x30 starting with bit40, during functions entry/exit. The code for entry/exit is identical, except that entry does add, and exit uses subtract:
* The low 40-bits of x30 are extracted, then multiplied with x18.
* <code>crc32x w17, wzr, x17</code> (which uses the above value)
* Then the previously mentioned add/subtraction operation is done, with the output from the above shifted to bit40.

The x18 is OR'd by kernel with 1, to make sure it is odd. This means that the multiply is a bijection; in other words, no entropy is lost when doing the multiply. If this had not been done, a random value that is divisible by a large power of two (the attacker can just keep spawning threads until gets such a one), would have weak cookies that allows the scheme to be trivially broken.

CFI is implemented as follows: blr instructions no longer exist. When funcptrs are called, new functions are now called instead which handles the call. The u32 at funcptr_addr-4 must match 0xe7ffdefe, otherwise it will branch to undefined instruction 0x0000dead. Otherwise, it will jump to the funcptr_addr.

Almost all functions now have the above u32 at -4, therefore funcptr calls now have to start at the actual funcptr start. However, this doesn't apply to calls done during functions' exit: these directly br to the funcptr_addr without extra validation. The br instructions in the .plt were also replaced with branches to the function described above.

The above applies to all NSOs in ExeFs, except for LibraryAppletOfflineWeb which doesn't have it enabled. The NROs in the BrowserDll SystemData have it enabled for "/nro/netfront/dll_1/", however "dll_0" doesn't have it enabled (which is used by LibraryAppletOfflineWeb).

This is referred to in the build-path strings as "NX-NXFP2-a64-cfi" (nnSdkEmpty), and "NX64-cfi" (OSS).

=== LibraryAppletPhotoViewer ===
For details on the new sharing functionality in the Album applet, see [[Album_Applet|here]].

== OSS ==
[https://www.nintendo.co.jp/support/oss/index.html OSS] was updated.

Besides WebKit, [[SSL_services|NSS/NSPR]] was updated:
* NSPR was updated from 4.12 to 4.24.
* <code>#define NSSUTIL_VERSION "3.26"</code> was changed to <code>#define NSSUTIL_VERSION "3.49.1"</code>

Both src_{versions} directories were updated, with the same changes:
* "rocrt_nro.cpp" updated
* "NX-NXFP2-a64-cfi/rocrt.AssemblyOffset.h" Addded, identical to "NX-NXFP2-a64/rocrt.AssemblyOffset.h".

==See Also==
System update report(s):
* [https://yls8.mtheall.com/ninupdates/reports.php?date=2020-12-01_00-02-35&sys=hac]

{{NavboxVersions}}

[[Category:System versions]]

News

2026-08-06T01:10:05Z

Yellows8: Reverted edits by Yls8bot (talk) to last revision by Yellows8

<noinclude>
==Adding an item==
* Log in to the wiki. Editing is disabled if you don't have an account.
* Add the news event to the top of the list, using this format for the date: <tt><nowiki>'''</nowiki>{{#time: d F y}}<nowiki>''' </nowiki></tt>. Please include the application's creator, version number, and a link to a page on 3DBrew about the application. No external links please.
* '''Move the last entry to the [[:News/Archive|news archive]]. There should be no more than 4 entries in the list.'''

==Archives==
For older news, see the [[:News/Archive|news archive]].

=== News ===
</noinclude>
*'''16 June 26''' Nintendo released system update [[22.5.0]].
*'''7 April 26''' Nintendo released system update [[22.1.0]].
*'''17 March 26''' Nintendo released system update [[22.0.0]].
*'''20 January 26''' Nintendo released system update [[19.0.2]] for CHN region.

News/Archive

2026-08-06T01:09:28Z

Yellows8:

*'''13 January 26''' Nintendo released system update [[21.2.0]].
*'''9 December 25''' Nintendo released system update [[21.1.0]].
*'''25 November 25''' Nintendo released system update [[21.0.1]].
*'''11 November 25''' Nintendo released system update [[21.0.0]].
*'''30 September 25''' Nintendo released system update [[20.5.0]].
*'''2 September 25''' Nintendo released system update [[20.4.0]].
*'''29 July 25''' Nintendo released system update [[20.3.0]].
*'''15 July 25''' Nintendo released system update [[20.2.0]].
*'''19 June 25''' Nintendo released system update [[20.1.5]].
*'''3 June 25''' Nintendo released system update [[20.1.1]].
*'''28 May 25''' Nintendo released system update [[20.1.0]].
*'''2 May 25''' Nintendo released system update [[20.0.1]].
*'''30 April 25''' Nintendo released system update [[20.0.0]].
*'''7 January 25''' Nintendo released a rebootless system update for [[19.0.1]].
*'''29 October 24''' Nintendo released system update [[19.0.1]].
*'''8 October 24''' Nintendo released system update [[19.0.0]].
*'''2 July 24''' Nintendo released a rebootless system update for [[18.1.0]].
*'''11 June 24''' Nintendo released system update [[18.1.0]].
*'''23 April 24''' Nintendo released system update [[18.0.1]].
*'''26 March 24''' Nintendo released system update [[18.0.0]].
*'''20 February 24''' Nintendo released a rebootless system update for [[17.0.1]].
*'''5 December 23''' Nintendo released system update [[17.0.1]].
*'''21 November 23''' Nintendo released a rebootless system update for [[17.0.0]].
*'''11 October 23''' Nintendo released system update [[17.0.0]].
*'''22 August 23''' Nintendo released system update [[16.1.0]].
*'''27 June 23''' Nintendo released a rebootless system update for [[16.0.3]].
*'''30 May 23''' Nintendo released a rebootless system update for [[16.0.3]].
*'''9 May 23''' Nintendo released system update [[16.0.3]].
*'''18 April 23''' Nintendo released system update [[16.0.2]].
*'''23 March 23''' Nintendo released system update [[16.0.1]].
*'''21 February 23''' Nintendo released system update [[16.0.0]].
*'''20 December 22''' Nintendo released a rebootless system update for [[15.0.1]].
*'''1 November 22''' Nintendo released system update [[15.0.1]].
*'''11 October 22''' Nintendo released system update [[15.0.0]].
*'''31 August 22''' Nintendo released a rebootless system update for [[14.1.2]].
*'''26 July 22''' Nintendo released a rebootless system update for [[14.1.2]].
*'''28 June 22''' Nintendo released a rebootless system update for [[14.1.2]].
*'''14 June 22''' Nintendo released system update [[14.1.2]].
*'''19 April 22''' Nintendo released system update [[14.1.1]].
*'''5 April 22''' Nintendo released system update [[14.1.0]].
*'''22 March 22''' Nintendo released system update [[14.0.0]].
*'''20 January 22''' Nintendo released system update [[13.2.1]].
*'''1 December 21''' Nintendo released system update [[13.2.0]].
*'''26 October 21''' Nintendo released system update [[13.1.0]].
*'''15 September 21''' Nintendo released system update [[13.0.0]].
*'''6 July 21''' Nintendo released system update [[12.1.0]].
*'''12 June 21''' [https://devkitpro.org/viewtopic.php?f=13&t=9226&p=17113#p17113 libnx v4.1.0 released].
*'''8 June 21''' Nintendo released system update [[12.0.3]].
*'''12 May 21''' Nintendo released system update [[12.0.2]].
*'''20 April 21''' Nintendo released system update [[12.0.1]].
*'''6 April 21''' Nintendo released system update [[12.0.0]].
*'''9 March 21''' Nintendo released a rebootless system update for [[11.0.1]].
*'''11 December 20''' Nintendo released system update [[11.0.1]].
*'''1 December 20''' Nintendo released system update [[11.0.0]].
*'''15 September 20''' Nintendo released system update [[10.2.0]].
*'''28 July 20''' Nintendo released system update [[10.1.1]].
*'''14 July 20''' Nintendo released system update [[10.1.0]].
*'''5 June 20''' Nintendo released system update [[10.0.4]].
*'''26 May 20''' Nintendo released system update [[10.0.3]].
*'''11 May 20''' [https://devkitpro.org/viewtopic.php?f=13&t=9058 devkitA64 r15, libnx v3.2.0, deko3d v0.2.0, switch-examples v20200511] and [https://github.com/switchbrew/nx-hbloader/releases/tag/v2.3.2 nx-hbloader v2.3.2] released.
*'''30 April 20''' Nintendo released system update [[10.0.2]].
*'''22 April 20''' Nintendo released system update [[10.0.1]].
*'''14 April 20''' Nintendo released system update [[10.0.0]].
*'''4 April 20''' [https://devkitpro.org/viewtopic.php?f=13&t=9035 libnx v3.1.0, switch-examples v20200404 and deko3d v0.1.0 released]. On the 6th nx-hbmenu v3.3.0 was [https://github.com/switchbrew/nx-hbmenu/releases/latest released].
*'''2 April 20''' [https://github.com/switchbrew/nssu-updater nssu-updater] and [https://github.com/switchbrew/contents-delivery-manager contents-delivery-manager] were released.
*'''3 March 20''' Nintendo released system update [[9.2.0]].
*'''10 December 19''' [https://devkitpro.org/viewtopic.php?f=13&t=8989 libnx v3.0.0, switch-examples v20191211, Atmosphère v0.10.1, nx-hbmenu v3.2.0, and nx-hbloader v2.3.0 released].
*'''4 December 19''' Nintendo released system update [[9.1.0]].
*'''30 September 19''' Nintendo released system update [[9.0.1]].
*'''14 September 19''' [https://devkitpro.org/viewtopic.php?f=13&t=8964 libnx v2.5.0 and switch-examples v20190914 released]. nx-hbmenu v3.1.1 [https://github.com/switchbrew/nx-hbmenu/releases/tag/v3.1.1 released]. [https://github.com/Atmosphere-NX/Atmosphere/releases/tag/0.9.4 Atmosphère 0.9.4 released with support for 9.0.0].
*'''9 September 19''' Nintendo released system update [[9.0.0]].
*'''10 July 19''' Nintendo [https://twitter.com/NintendoAmerica/status/1148934589026455552 announced] the Nintendo Switch Lite system.
*'''17 June 19''' Nintendo released system update [[8.1.0]].
*'''1 May 19''' [https://devkitpro.org/viewtopic.php?f=13&t=8908 libnx v2.2.0 and switch-examples v20190501] released.
*'''23 April 19''' Nintendo released system update [[8.0.1]].
*'''15 April 19''' Nintendo released system update [[8.0.0]].
*'''29 March 19''' [https://devkitpro.org/viewtopic.php?f=13&t=8891 devkitA64 r13] and [https://github.com/switchbrew/libnx/releases/tag/v2.1.0 libnx v2.1.0] released with pthread/std::thread support.
*'''26 March 19''' [https://github.com/Atmosphere-NX/Atmosphere/releases/tag/0.8.6 Atmosphère v0.8.6] released with lots of bugfixes, more cheat stuff and web applet homebrew support.
*'''21 February 19''' [https://github.com/Atmosphere-NX/Atmosphere/releases/tag/0.8.4 Atmosphère v0.8.4] released with 7.0.x support.
*'''18 February 19''' Nintendo released system update [[7.0.1]].
*'''28 January 19''' Nintendo released system update [[7.0.0]].
*'''24 January 19''' [https://github.com/Atmosphere-NX/Atmosphere/releases/tag/0.8.3 Atmosphère v0.8.3] and [https://github.com/switchbrew/nx-hbloader/releases/tag/v2.1.0 nx-hbloader v2.1.0] were released.
*'''2 January 19''' [https://devkitpro.org/viewtopic.php?f=13&t=8826 libnx 2.0.0, switch-mesa 18.3 and switch-examples 20190102] were released.
*'''29 November 18''' [https://github.com/Atmosphere-NX/Atmosphere/releases/tag/0.8.0 Atmosphère v0.8.0] was released.
*'''29 November 18''' [https://github.com/switchbrew/nx-hbmenu/releases/latest nx-hbmenu v3.0.1] was released.
*'''28 November 18''' [https://devkitpro.org/viewtopic.php?f=13&t=8813 libnx 1.6.0 and switch-examples 20181128] were released.
*'''19 November 18''' Nintendo released system update [[6.2.0]].
*'''31 October 18''' [https://github.com/switchbrew/nx-hbloader/releases/tag/v2.0.1 nx-hbloader v2.0.1] was released.
*'''29 October 18''' [https://github.com/switchbrew/nx-hbmenu/releases/latest nx-hbmenu] v3.0.0 was released.
*'''29 October 18''' Nintendo released system update [[6.1.0]].
*'''27 October 18''' [https://devkitpro.org/viewtopic.php?f=13&t=8798 libnx 1.5.0 and switch-examples 20181027] were released.
*'''17 October 18''' [https://github.com/Atmosphere-NX/Atmosphere/releases/tag/0.7.0 Atmosphère v0.7.0] and [https://github.com/switchbrew/nx-hbloader/releases/tag/v2.0.0 nx-hbloader v2.0.0] were released.
*'''8 October 18''' Nintendo released system update [[6.0.1]].
*'''18 September 18''' Nintendo released system update [[6.0.0]].
*'''18 September 18''' [https://devkitpro.org/viewtopic.php?f=13&t=8784 libnx 1.4.1, switch-mesa v18.2β and switch-examples 20180918] were released.
*'''9 September 18''' [https://devkitpro.org/viewtopic.php?f=13&t=8780 libnx v1.4.0] was released alongside a Switch port of mesa/nouveau (GPU library).
*'''28 July 18''' [https://devkitpro.org/viewtopic.php?f=13&t=8761 devkitA64] r12 and [https://github.com/switchbrew/libnx/releases/tag/v1.3.1 libnx] v1.3.1 were released.
*'''8 July 18''' [https://github.com/switchbrew/libnx/releases/tag/v1.3.0 libnx] v1.3.0 was released.
*'''30 May 18''' Nintendo released system update [[5.1.0]].
*'''16 April 18''' Nintendo released system update [[5.0.2]].
*'''26 March 18''' Nintendo released system update [[5.0.1]].
*'''12 March 18''' Nintendo released system update [[5.0.0]].
*'''2 March 18''' [https://github.com/switchbrew/libnx/releases/tag/v1.1.0 libnx] v1.1.0 was released.
*'''28 February 18''' [https://github.com/switchbrew/nx-hbmenu/releases/latest nx-hbmenu] v2.0.0 was released.
*'''22 February 18''' [http://devkitpro.org devkitPro] released [https://devkitpro.org/viewtopic.php?f=13&t=8693 devkitA64 alpha7]
*'''18 February 18''' [https://switchbrew.github.io/nx-hbl/ nx-hbl] and [https://github.com/switchbrew/nx-hbmenu nx-hbmenu] were released.
*'''28 December 17''' The 34c3 Switch [https://events.ccc.de/congress/2017/Fahrplan/events/8941.html talk] took place, video available [https://media.ccc.de/v/34c3-8941-console_security_-_switch here].
*'''4 December 17''' Nintendo released system update [[4.1.0]].
*'''25 October 17''' Nintendo released system update [[4.0.1]].
*'''18 October 17''' Nintendo released system update [[4.0.0]].
*'''17 September 17''' [https://github.com/switchbrew/libnx libnx] was made public, with examples available [https://github.com/switchbrew/switch-examples here].
*'''5 September 17''' Nintendo released system update [[3.0.2]].
*'''31 July 17''' Nintendo released system update [[3.0.1]].
*'''19 June 17''' Nintendo released system update [[3.0.0]].
*'''15 May 17''' Nintendo released system update [[2.3.0]].
*'''17 April 17''' Nintendo released system update [[2.2.0]].
*'''27 March 17''' Nintendo released system update [[2.1.0]].
*'''2 March 17''' Nintendo released system update [[2.0.0]].
*'''3 March 17''' Nintendo Switch global release.

11.0.1

2026-08-06T01:05:31Z

Yellows8:

The Switch 11.0.1 system update was released on December 11, 2020 (UTC). This Switch update was released for the following regions: ALL, and CHN.

Additionally, a rebootless system update was released revising the "NgWord" list for 11.0.1 on March 9, 2021 (UTC).

Security flaws fixed: <fill this in manually later, see the updatedetails page from the ninupdates-report page(s) once available for now>.

==Change-log==
[https://en-americas-support.nintendo.com/app/answers/detail/a_id/22525/kw/nintendo%20switch%20system%20update Official] ALL change-log:
* Corrections for the following problems that occurred with system update version 11.0.0:
*
* Corrected a problem where some games couldn't be played correctly.
* Corrected a problem where, in combination with some TVs, the image would not be displayed in TV mode and an error occurred.
* Corrected a problem which changed how the Control Stick and the C Stick on the Nintendo GameCube controller responded.
*

==System Titles==
The following was updated: [[System_Version_Title|SystemVersion]], [[HID_services|hid]], [[Display_services|vi]], BootImagePackages.

There was no IPC changes.

RomFs changes:
* [[System_Version_Title|SystemVersion]]: All files updated.

=== BootImagePackages ===
RomFs changes:
* "/nx/package2" updated

====Kernel====
The kernel was updated.
* The new thread linked list pointer member in KSynchronizationObject (added in 11.0.0) is now two pointers; it is now a head/tail sentinel pair instead of just a head pointer.
** KSynchronizationObject::Wait now updates both pointers accordingly.
* Only other changes are due to KSynchronizationObject (and derivations) increasing in size by 8 bytes.

====FIRM Sysmodules====
No FIRM sysmodules were updated.

=== [[HID_services|hid]] ===
Exactly 1 function was updated, nothing else changed. The codebin is identical to the previous version besides this function and the build-id - the function following this one is at the same offset as before.

==See Also==
System update report(s):
* [https://yls8.mtheall.com/ninupdates/reports.php?date=2020-12-11_00-15-07&sys=hac]
* [https://yls8.mtheall.com/ninupdates/reports.php?date=2021-03-09_00-05-06&sys=hac]

{{NavboxVersions}}

[[Category:System versions]]

12.0.2

2026-08-06T01:03:30Z

Yellows8:

The Switch 12.0.2 system update was released on May 12, 2021 (UTC). This Switch update was released for the following regions: ALL, and CHN.

Security flaws fixed: yes.

==Change-log==
[https://en-americas-support.nintendo.com/app/answers/detail/a_id/22525/kw/nintendo%20switch%20system%20update Official] ALL change-log:
* General system stability improvements to enhance the user's experience.

==System Titles==
The following was updated: [[System_Version_Title|SystemVersion]], [[Bluetooth_Driver_services|bluetooth]], [[PGL_services|pgl]], BootImagePackages.

RomFs changes:
* [[System_Version_Title|SystemVersion]]: All files updated.

=== BootImagePackages ===
RomFs changes: all files updated.

====Secure Monitor====
* GetConfig was updated to reflect new number of burnt fuses.
* Warmboot magic was updated to 0x1EF.
* Package2 versions were changed from 0xF/0x10 to 0x10/0x11.

====Warmboot====
* Magic was updated to 0x1EF.

====FIRM Sysmodules====
Boot, Loader, and SM were updated. Specific diffs available below:

=====SM=====
tipc autogen was updated, asm for buffer serialization is different now.

=====Loader=====
Anti-downgrade list was updated.

=====Boot=====
ChargerDriver::Initialize now sets PINMUX_AUX_CAM_FLASH_EN_0.tristate = PASSTHROUGH. This is the only change.

===[[PGL_services|pgl]]===
tipc autogen was updated (same as sm).

===[[Bluetooth_Driver_services|bluetooth]]===
Only 1 func was changed, this fixed a [[Switch_System_Flaws|vuln]].

==See Also==
System update report(s):
* [https://yls8.mtheall.com/ninupdates/reports.php?date=2021-05-12_00-05-05&sys=hac]

{{NavboxVersions}}

[[Category:System versions]]

12.0.3

2026-08-06T01:02:29Z

Yellows8:

The Switch 12.0.3 system update was released on June 8, 2021 (UTC). This Switch update was released for the following regions: ALL, and CHN.

Security flaws fixed: <fill this in manually later, see the updatedetails page from the ninupdates-report page(s) once available for now>.

This sysupdate was temporarily not available via [[Network|sun]], which was later restored.

==Change-log==
[https://en-americas-support.nintendo.com/app/answers/detail/a_id/22525/kw/nintendo%20switch%20system%20update Official] ALL change-log:
* General system stability improvements to enhance the user's experience.

==System Titles==
The following was updated: [[System_Version_Title|SystemVersion]]/RebootlessSystemUpdateVersion, NgWord/NgWord2, [[SSL_services|ssl]], BootImagePackages.

RomFs changes:
* NgWord: "/0.txt" updated, "/version.dat" updated
* [[System_Version_Title|SystemVersion]]: All files updated.
* NgWord2: "/ac_0_b1_nx" updated, "/ac_0_b2_nx" updated, "/ac_0_not_b_nx" updated
* RebootlessSystemUpdateVersion: All files updated.

=== BootImagePackages ===
RomFs changes:
* "/nx/package2" updated

Kernel was not updated. The only updated sysmodule (besides buildid) was [[Filesystem_services|FS]].

====[[Filesystem services|FS]]====
FS was recompiled against SDK 12.3.1 which now catches invalid characters directly after <code>/</code>, <code>/.</code> or <code>/..</code> when checking if a path is normalized.

===[[SSL_services|ssl]]===
Only 1 func was updated, this func is eventually called from [[SSL_services#SetSocketDescriptor|SetSocketDescriptor]]. This handles [[SSL_services#SslVersion|SslVersion]] etc. The code which allowed using TLS 1.3 was removed, the enum bit for V13 is now handled the same as V12.

==See Also==
System update report(s):
* [https://yls8.mtheall.com/ninupdates/reports.php?date=2021-06-08_00-05-05&sys=hac]

{{NavboxVersions}}

[[Category:System versions]]

15.0.0

2026-08-06T00:58:58Z

Yellows8:

The Switch 15.0.0 system update was released on October 11, 2022 (UTC). This Switch update was released for the following regions: ALL, and CHN.

Security flaws fixed: yes.

==Change-log==
[https://en-americas-support.nintendo.com/app/answers/detail/a_id/22525/kw/nintendo%20switch%20system%20update Official] ALL change-log:
* The location of the Bluetooth® Audio menu within System Settings has moved.
* Screenshots can be taken using the Capture Button while in the Nintendo Switch Online application found on the Nintendo Switch HOME Menu. Video capture is not supported.
*
* General system stability improvements to enhance the user's experience.
*

==System Titles==
* All sysmodules were updated, except for lbl which was previously stubbed. New sysmodule eth was added.
* All SystemData were updated, except for the following: SharedFont, Dictionary, AvatarImage, Eula, ControllerIcon, ApplicationBlackList, FunctionBlackList.
* The following applets were updated: qlaunch, [[Controller_Applet|controller]], dataErase, error, netConnect, [[Profile_Selector|playerSelect]], [[Internet_Browser|web-applets]], OverlayApplet, [[Album_Applet|photoViewer]].

NPDM changes (see [[Services_API|here]] for service hosting changes):
* bluetooth: Access to srepo:u was added.
* bcat: Access to sprof:sp was removed.
* nifm: Access to ethc:c, ethc:i, and various wlan:* services were removed. Access to bsd:nu, eth:nd, wlan, and wlan:nd were added.
* bsdsocket: "Lowest Allowed CPU ID" was changed from 3 to 0. Access to usb:hs and the various wlan:* services were removed.
* wlan: Access to srepo:u was added.
* ldn: Access to psc:m and the various wlan:* services were removed. Access to the wlan service was added.
* ns: Access to audctl was removed. Access to csrng and dauth:0 was added.
* ssl: "Lowest Allowed CPU ID" was changed from 3 to 0.
* nim: Access to ssl was replaced with ssl:s.
* glue: FS permissions now has bitmask 0x0000004000000000 set.
* ro: Access to csrng was added.
* omm: FS permissions now has bitmask 0x0000000000100000 set.
* qlaunch: Access to mnpp:sys and spbg:sp were removed.

RomFs changes (besides sysver titles):
* [[SSL_services|CertStore]]: "/ssl_TrustedCerts.bdf" updated
* ErrorMessage: various error messages updated/added
* BrowserDll:
** "/browser/MediaControlsInline.css" updated
** "/browser/MediaControlsInline.js" updated
** "/buildinfo/buildinfo.dat" updated
** "/lyt/Browse/FocusNodeFrame.arc" updated
** "/message/": localization data updated
** "/nro/": The various NROs located under these sub-dirs were updated.
* Help:
** "/legallines.htdocs/img/HDMI.png" updated
** "/legallines.htdocs/index.html" updated
** "/safe.htdocs/html/{dir}/", where {dir} is "JPja", "KRko", and "TWzh":
*** "index.html", "page_02.html", "page_04.html": updated
* UrlBlackList:
** "/listCommon.txt" updated
* TimeZoneBinary: updated
* FirmwareDebugSettings/PlatformConfigIcosa/PlatformConfigCopper/PlatformConfigHoag/PlatformConfigIcosaMariko/PlatformConfigAula: [[System_Settings|updated]]
* [[HID_services|ControllerFirmware]]: "/FirmwareInfo.csv" and "/raizo_ep2_ota.bin" updated
* NgWordT: updated
* Applets: Various UI/localization data updated. For web-applets, the NRR and buildinfo.dat were also updated.

=== BootImagePackages ===
RomFs changes: all files updated.

Using updated master-key: master_key_0e (previously master_key_0d). See [[NCA]] for the KeyGeneration listing.

The anti-downgrade fuses were [[Fuses#Anti-downgrade|updated]].

====Kernel====
* Compiler changes:
** Compiler upgrade
*** [What version of clang?]
*** Clang is optimizing much more aggressively in some places.
*** Notably, there are many code locations now where clang doesn't actually increment the KSchedulerLock's count field, presumably because it sees it will be decremented at end of scope...
**** This isn't exploitable, and it is """correct""", but it is worth noting to other reverse engineers because it is very confusing to see the count field unchanged or reloaded after function calls.
** Code is now compiled with -fomit-frame-pointer.
* Initialization changes:
** When the thread resource limit is increased, 24 MB of virtual space is now reserved for the Kernel stack region instead of 14 MB.
* In HorizonKernelMain:
** DoOnEachCoreInOrder is no longer inlined, when setting up the main/interrupt threads. It is still inlined in all other places.
* Multiple fixed-allocations from the system pool/resource limit were removed/revised, presumably to prevent them from unnecessarily fragmenting the pool forever.
** AppletSecureMemory is now allocated statically, instead of dynamically.
*** Previously, 4 MB was allocated from the system pool/resource limit during main.
*** Initialize0 now reserves the 4 MB immediately after the slab heaps for this.
**** DRAM layout is now like [tz reserved] [kernel] [slab heaps] [applet secure memory] [pt heap] [init pt] [memory pool partitions].
**** The virtual memory region type is 0x62; the physical memory region type is 0xC200018E.
** The KPageBuffer slab heap is no longer dynamically allocated from KMemoryManager.
*** Previously, the required number of pages were allocated from the system pool/resource limit to setup the heap *immediately* after KMemoryManager was initialized.
*** Now, it is set up during Kernel::InitializeResourceManagers, after setting up the page manager.
**** InitializeKPageBufferSlabHeap now takes heap and page manager as arguments; the slab heap's members are randomly allocated pages from the page manager.
***** This effectively randomizes the page buffer slabheap's page locations, where previously they were a contiguous range somewhere in the system pool.
***** To facilitate this, the page manager now has an Allocate(count) member function in addition to the previous single-page Allocate().
****** To facilitate this, the page manager now tracks the bitmap ends in addition to the bitmap starts, to enable a linear walk of the lowest bitmap layer.
*** This has an important knock-on effect: TLS pages are allocated from the page buffer slab, and correspondingly are no longer heap pages.
**** Correspondingly, KMemoryState_ThreadLocal no longer has the FlagReferenceCounted (0x400000) bit set.
**** However, removing this bit naively breaks IPC, which previously checked FlagReferenceCounted before copying to/from the message buffer.
**** Now, FlagReferenceCounted is checked if and only if the message buffer is a UserBuffer. If it is not, a new flag "FlagLinearMapped" (0x4000000) is checked.
***** This bit is set only on memory types guaranteed to be accessible via the kernel's linear mapping of non-kernel dram (physical ranges with memory region flag 0x80000000).
***** This new flag is set on all memory states other than Free, Io, Static, Inaccessible, Kernel, Coverage.
* Two new SVCs were added for a new "InsecureMemory" concept.
** Svc 0x90 is Result MapInsecureMemory(uintptr_t address, size_t size);
*** This allocates the requested size memory from a pool partition/resource limit, and map it with a new memory state ("KMemoryState_Insecure") at the user-specified address.
**** The resource limit/pool partition are gotten via new KSystemControl functions ("KSystemControl::GetInsecureMemoryResourceLimit", "KSystemControl::GetInsecureMemoryPool").
***** On NX board, these are the system resource limit, and Pool_SystemNonSecure respectively.
**** The specified address/size must be within the alias code region.
**** KMemoryState_Insecure has value 0x5583817.
***** This is type 0x17 with flags CanUseNonDeviceIpc, CanUseNonSecureIpc, Mapped, CanDeviceMap, CanAlignedDeviceMap, ReferenceCounted, CanChangeAttribute, LinearMapped.
** Svc 0x91 is Result UnmapInsecureMemory(uintptr_t address, size_t size);
*** This unmaps/deallocates/releases memory previously mapped with MapInsecureMemory.
* More changes to SvcMapDeviceAddressSpace(ByForce/Aligned).
** The argument which was previously a memory permission ("device_perm") is now an encoded u32 ("option").
*** The low 16 bits of this are the device permission.
*** The upper 16 bits of this are an enum (only defined values are 0 and 1).
** If the enum-arg is not 0 or 1, svc::ResultInvalidEnumValue() is now returned.
** If the enum-arg is 1 and the specified memory is IO, svc::ResultInvalidCombination is returned.
* Partial support was added for the KPageBuffer size being different from the hardware page size.
** There are now two globals, g_PageBufferSize = 0x1000, g_PageBufferCount = 0.
** The KPageBuffer slab heap is initialized with g_PageBufferCount blocks of g_PageBufferSize.
*** if g_PageBufferSize is 0x1000, g_PageBufferCount has the number of required TLS pages added to it (# processes + # threads + (# processes + #threads) / 8).
** KDynamicPageManager::Initialize now takes in an alignment argument for the page buffer size.
*** KSecureSystemResource always passes 0x1000.
** It is possible this is full support but ifdef'd, but on NX board at least all places which allocate/free to the heap panic if g_PageBufferSize != 0x1000...
* The page table heap now receives all but 64 of the available pages; prior to this, it was all but 70.
* KSessionRequest's additional mappings (when sending an IPC request with more than 8 buffers) are now slab-allocated, rather than using KPageBuffers.
** This slab has a count of 40; object size is 0x4A0 (exactly the maximum required size).
** 13.0.0+ Dynamic expansion is supported.
* Scoped setting/clearing of the 14.0.0 exception flag for cache operations has changed.
** Previously, |= on set, &= ~ on clear. Now, the flag is orr'd in only if it is not already set, and cleared only if it was newly set.
** This adds support for recursively setting these flags via a scoped setter, although there are no places in kernel where it is possible for this to occur.
** This applies to cpu::InvalidateDataCache, cpu::StoreDataCache, cpu::FlushDataCache
* The IsInUsermodeExceptionHandler exception flag management was changed:
** This is now cleared by RestoreContext (same place it clears other flags) rather than ClearExceptionSvcPermissions. It is still set by SetExceptionSvcPermissions.
* Changes in and surrounding page table logic:
** Devices can now theoretically (but not on the NX board) be given access to memory mapped as Io.
*** Why one would want to do this is unclear.
*** KMemoryState_Io now supports the CanAlignedDeviceMap and CanDeviceMap flags.
*** KPageTableBase::GetContiguousMemoryRangeWithState no longer checks that the passed memory address is heap.
**** KPageTable::MemoryRange now tracks whether the range is reference counted, and Close() only closes the pages if they are.
*** KPageTableBase::OpenMemoryRangeForMapDeviceAddressSpace no longer checks passes KMemoryState_FlagReferenceCounted.
*** KPageTableBase::LockForMapDeviceAddressSpace takes two new arguments, an output bool * to write whether the state was io, and a bool for whether to check KMemoryState_FlagReferenceCounted.
**** The bool is always passed on true on NX board, preventing this feature from being actually used.
*** KPageTableBase::LockForUnmapDeviceAddressSpace now takes a bool argument for whether to check KMemoryState_FlagReferenceCounted
**** The bool is always passed on true on NX board, preventing this feature from being actually used.
** Pages mapped via MapIoRegion now have KMemoryAttribute_Locked instead of KMemoryAttribute_None.
** Changes were made with respect to the way MapPhysicalMemory/UnmapPhysicalMemory are implemented:
*** KMemoryManager::AllocatePageGroupForProcess no longer calls KPageGroup::Open on the returned page group (essentially reverting the change in 11.0.0).
**** Other KMemoryManager::Allocate* functions still call KPageGroup::Open.
*** KPageTableBase::MapPhysicalMemory now calls a new KPageTable::Operate operation ("MapFirst"), which behaves the same as Map but calls KernelPanic() if the mapped pages have a non-zero reference count.
**** This enforces that MapPhysicalMemory is the first place the pages being mapped have been allocated/opened.
*** KPageTableBase::UnmapPhysicalMemory now calls a new KPageTable::Operate operation ("SeparatePages"), which performs page separation on the requested range.
**** SeparatePages is identical to the separation done at the prologue of ChangePermissions; practically, this just enforces that the pages exist.
*** KPageTableBase::UnmapPhysicalMemory now calls KernelPanic if the unmapping operation fails (since it is guaranteed to succeed by the success of SeparatePages).
**** Logic which previously existed for re-mapping on failure has been removed.
** New Kernel Objects ("KSystemResource", "KSecureSystemResource").
*** Type ID = 0x4600, KSystemResource : public KAutoObject, KSecureSystemResource : public KSystemResource
*** KSystemResource just stores pointers to the three kinds of dynamic resource managers required by processes/page tables.
*** KSecureSystemResource stores the pointed-to objects for these as members.
**** Previously, these were just KProcess members; they are no longer KProcess members and instead live in the KSecureSystemResource object.
*** The slab heap for KSecureSystemResource has capacity = KProcess slab heap.
*** When a process is created with system resource size > 0, it now creates a KSecureSystemResource (which manages allocation with KSystemControl).
**** All actual underlying logic is the same, this just abstracts the KSystemControl/secure memory interaction out of KProcess.
* KInterruptEventTask was removed and no longer exists.
** KInterruptEvent now inherits from KInterruptTask directly.
** There is no longer a global task table; KInterruptManager is expected to return ResultBusy if an interrupt is already bound (it already did this).
** KInterruptEvent::Finalize now unbinds the interrupt directly, and then calls KDpcManager::Request() with a no-op KDpcTask.
*** In practice, this unbinds the interrupt, and then creates an ordering to guarantee all cores will see the interrupt as unbound before continuing.
*** Trivia: this is the first use of KDpcManager::Request on non-debug kernels.
* Minor changes to KHandleTable:
** KHandleTable::KHandleTable now initializes the table_size, max_count, and next_id fields to zero, previously they were uninitialized until Initialize was called.
** KHandleTable::Initialize now instantiates a KScopedDisableDispatch while setting up the table.

====Loader====
The broken RNG for ASLR was [[Switch_System_Flaws|fixed]].

===[[Bluetooth_Driver_services|bluetooth]]===
Besides the various IPC changes, security flaws were [[Switch_System_Flaws|fixed]].

===[[HID_services|hid]]===
Besides the various IPC changes, an infoleak vuln was [[Switch_System_Flaws|fixed]].

===[[WLAN_services|wlan]]===
Besides the various IPC changes, a vulnerable func was [[Switch_System_Flaws|fixed]].

===[[NS_Services|ns]]===
Besides the various IPC changes, vulnerable RNG usage was [[Switch_System_Flaws|fixed]] to properly use secure RNG where needed.

===[[RO_services|ro]]===
The broken RNG for ASLR was [[Switch_System_Flaws|fixed]].

===nnSdk===
<code>nn::diag::detail::VAbortImpl</code> when handling the retaddr for storing elsewhere, now uses instruction [https://developer.arm.com/documentation/dui0801/g/A64-General-Instructions/XPACD--XPACI--XPACLRI xpaclri]. PAC instructions are NOPs on ARM hardware which doesn't support it, which includes current NX consoles.

This is likely due to a LLVM [https://reviews.llvm.org/D84502 patch] where xpaclri is now always emitted and not related to actual Armv8.3 hardware.

=== IPC Interface Changes ===
* The following new interfaces were removed:
** nn::eth::sf::IEthInterface
** nn::eth::sf::IEthInterfaceGroup
** nn::socket::sf::IClient
** nn::wlan::detail::IDetectManager
** nn::wlan::detail::IInfraManager
** nn::wlan::detail::ILocalGetActionFrame
** nn::wlan::detail::ILocalGetFrame
** nn::wlan::detail::ILocalManager
** nn::wlan::detail::ISocketGetFrame
** nn::wlan::detail::ISocketManager
* The following new interfaces were added:
** nn::anif::detail::ISfAssignedNetworkInterfaceService
** nn::anif::detail::ISfDriverService
** nn::anif::detail::ISfDriverServiceCreator
** nn::anif::detail::ISfNetworkInterfaceService
** nn::anif::detail::ISfUserService
** nn::anif::detail::ISfUserServiceCreator
** nn::pl::detail::IPlatformServiceManager
** nn::prepo::detail::ipc::IAsyncContext
** nn::socket::sf::IClient_MC
** nn::srepo::detail::ipc::IAsyncContext
** nn::ssl::sf::ISslContextForSystem
** nn::ssl::sf::ISslServiceForSystem
** nn::wlan::detail::IGeneralServiceCreator
** nn::wlan::detail::IPrivateServiceCreator
** nn::wlan::detail::IPrivateWirelessCommunicationService
** nn::wlan::detail::IWirelessCommunicationService
* The following interfaces were changed:
** nn::account::baas::IAdministrator
*** Added command 143 - inbytes: 0, outbytes: 16
*** Added command 160 - inbytes: 0, outbytes: 0
** nn::account::baas::IManagerForSystemService
*** Added command 143 - inbytes: 0, outbytes: 16
*** Added command 160 - inbytes: 0, outbytes: 0
** nn::am::service::IAppletCommonFunctions
*** Added command 90 - inbytes: 16, outbytes: 0, outinterfaces: ['nn::am::service::IStorageChannel']
*** Added command 91 - inbytes: 16, outbytes: 0, outinterfaces: ['nn::am::service::IStorageChannel']
*** Added command 100 - inbytes: 4, outbytes: 0
** nn::am::service::IDebugFunctions
*** Added command 50 - inbytes: 16, outbytes: 0
*** Added command 200 - buffers: [5], inbytes: 8, outbytes: 0, outinterfaces: ['nn::am::service::IAllSystemAppletProxiesService'], pid: True
** nn::am::service::ILibraryAppletProxy
*** Added command 22 - inbytes: 0, outbytes: 0, outinterfaces: ['nn::am::service::IHomeMenuFunctions']
*** Added command 23 - inbytes: 0, outbytes: 0, outinterfaces: ['nn::am::service::IGlobalStateController']
** nn::am::service::IOverlayAppletProxy
*** Added command 23 - inbytes: 0, outbytes: 0, outinterfaces: ['nn::am::service::IGlobalStateController']
** nn::arp::detail::IWriter
*** Added command 3 - inbytes: 8, outbytes: 0, outinterfaces: ['nn::arp::detail::IUpdater']
** nn::audio::detail::IAudioRenderer
*** Added command 12 - inbytes: 4, outbytes: 0
*** Added command 13 - inbytes: 0, outbytes: 4
** nn::audioctrl::detail::IAudioController
*** Removed command 26 - inbytes: 1, outbytes: 0
*** Removed command 35 - inbytes: 8, outbytes: 0
*** Removed command 36 - inbytes: 0, outbytes: 8
*** Removed command 37 - inbytes: 1, outbytes: 0
*** Removed command 38 - inbytes: 0, outbytes: 1
*** Removed command 39 - inbytes: 0, outbytes: 1
*** Changed command 40 - buffers: [26] -> [22] (final state: buffers: [22], inbytes: 0, outbytes: 0)
*** Added command 41 - inbytes: 8, outbytes: 0
*** Added command 42 - inbytes: 8, outbytes: 0
*** Added command 50000 - inbytes: 4, outbytes: 0
** nn::bluetooth::IBluetoothDriver
*** Added command 101 - inbytes: 0, outbytes: 0
*** Added command 102 - inbytes: 0, outbytes: 0
*** Added command 155 - inbytes: 6, outbytes: 1
** nn::btm::IBtm
*** Removed command 112 - inbytes: 7, outbytes: 0
*** Removed command 113 - inbytes: 6, outbytes: 1
*** Added command 116 - inbytes: 7, outbytes: 0
*** Added command 117 - inbytes: 6, outbytes: 1
** nn::btm::IBtmDebug
*** Added command 14 - inbytes: 8, outbytes: 0
*** Added command 15 - inbytes: 0, outbytes: 0
*** Added command 16 - inbytes: 0, outbytes: 0
*** Added command 17 - inbytes: 0, outbytes: 0
** nn::capsrv::sf::IAlbumAccessorService
*** Added command 110 - buffers: [6, 5], inbytes: 16, outbytes: 8
** nn::clkrst::IClkrstManager
*** Added command 6 - inbytes: 0, outbytes: 0
** nn::dauth::detail::IService
*** Added command 1000 - inbytes: 0, outbytes: 0, outhandles: [1]
*** Added command 9000 - buffers: [5, 5], inbytes: 0, outbytes: 0
*** Added command 9010 - inbytes: 0, outbytes: 0
** nn::es::IActiveRightsContext
*** Removed command 5 - buffers: [5], inbytes: 0, outbytes: 0
*** Added command 216 - inbytes: 0, outbytes: 0, outhandles: [1]
** nn::es::IETicketService
*** Added command 1022 - inbytes: 0, outbytes: 0, outinterfaces: ['nn::es::IActiveRightsContext']
** nn::fssrv::sf::IFileSystem
*** Added command 16 - inbytes: 0, outbytes: 192
** nn::fssrv::sf::IFileSystemProxy
*** Added command 207 - inbytes: 16, outbytes: 0, outinterfaces: ['nn::fssrv::sf::IFileSystem']
*** Added command 1400 - inbytes: 1, outbytes: 0
** nn::grcsrv::IGrcService
*** Changed command 1 - inbytes: 72 -> 32 (final state: inbytes: 32, inhandles: [1], outbytes: 0, outinterfaces: ['nn::grcsrv::IContinuousRecorder'])
** nn::hid::IHidDebugServer
*** Added command 137 - inbytes: 16, outbytes: 0, pid: True
** nn::hid::IHidServer
*** Added command 3000 - buffers: [26], inbytes: 0, outbytes: 0
*** Added command 3001 - buffers: [25], inbytes: 0, outbytes: 0
*** Added command 3002 - inbytes: 0, outbytes: 0
*** Added command 3003 - inbytes: 0, outbytes: 56
*** Added command 3004 - inbytes: 56, outbytes: 0
*** Added command 3005 - inbytes: 0, outbytes: 0
*** Added command 3006 - buffers: [26], inbytes: 4, outbytes: 0
*** Added command 3007 - buffers: [25], inbytes: 4, outbytes: 0
*** Added command 3008 - inbytes: 4, outbytes: 0
*** Added command 3009 - inbytes: 4, outbytes: 64
*** Added command 3010 - inbytes: 68, outbytes: 0
*** Added command 3011 - inbytes: 4, outbytes: 0
** nn::hid::IHidSystemServer
*** Added command 32 - inbytes: 48, outbytes: 0, pid: True
*** Added command 33 - inbytes: 0, outbytes: 0
*** Added command 1135 - inbytes: 8, outbytes: 0, pid: True
** nn::lr::IAddOnContentLocationResolver
*** Added command 5 - buffers: [22, 22], inbytes: 8, outbytes: 0
*** Added command 6 - buffers: [21], inbytes: 16, outbytes: 0
*** Added command 7 - buffers: [21, 21], inbytes: 16, outbytes: 0
** nn::lr::ILocationResolver
*** Added command 20 - inbytes: 0, outbytes: 0
** nn::lr::ILocationResolverManager
*** Added command 4 - buffers: [5], inbytes: 0, outbytes: 0
** nn::mnpp::detail::ipc::IServiceForSystem
*** Removed command 300 - inbytes: 0, outbytes: 1
*** Removed command 400 - inbytes: 0, outbytes: 1
** nn::ncm::IContentMetaDatabase
*** Added command 23 - inbytes: 16, outbytes: 1
*** Added command 24 - inbytes: 24, outbytes: 24
*** Added command 25 - inbytes: 24, outbytes: 24
** nn::ndrm::low::detail::INdrmLowAdminInterface
*** Changed command 3 - inbytes: 8 -> 24 (final state: buffers: [5], inbytes: 24, outbytes: 0)
*** Added command 40 - buffers: [6], inbytes: 8, outbytes: 4
*** Added command 42 - buffers: [6], inbytes: 16, outbytes: 4
*** Added command 43 - buffers: [6], inbytes: 16, outbytes: 4
*** Added command 44 - buffers: [6], inbytes: 16, outbytes: 4
** nn::nim::detail::INetworkInstallManager
*** Removed command 91 - buffers: [5], inbytes: 16, outbytes: 0, outhandles: [1], outinterfaces: ['nn::nim::detail::IAsyncResult']
*** Added command 138 - buffers: [5], inbytes: 8, outbytes: 0, outhandles: [1], outinterfaces: ['nn::nim::detail::IAsyncResult']
*** Added command 139 - inbytes: 0, outbytes: 0
*** Added command 140 - inbytes: 0, outbytes: 0
*** Added command 141 - inbytes: 0, outbytes: 1
** nn::nim::detail::IShopServiceManager
*** Removed command 102 - inbytes: 0, outbytes: 0, outhandles: [1], outinterfaces: ['nn::nim::detail::IAsyncValue']
*** Removed command 103 - inbytes: 0, outbytes: 32
*** Removed command 104 - inbytes: 0, outbytes: 0, outhandles: [1], outinterfaces: ['nn::nim::detail::IAsyncValue']
*** Removed command 105 - inbytes: 0, outbytes: 0, outhandles: [1], outinterfaces: ['nn::nim::detail::IAsyncResult']
*** Removed command 106 - inbytes: 0, outbytes: 0, outhandles: [1], outinterfaces: ['nn::nim::detail::IAsyncResult']
*** Removed command 501 - inbytes: 16, outbytes: 0, outhandles: [1], outinterfaces: ['nn::nim::detail::IAsyncResult']
** nn::ns::detail::IApplicationManagerInterface
*** Added command 90 - inbytes: 8, outbytes: 0
*** Changed command 607 - inbytes: 16 -> 8 (final state: buffers: [6], inbytes: 8, outbytes: 4)
*** Removed command 909 - inbytes: 8, outbytes: 0
*** Added command 2357 - inbytes: 0, outbytes: 0
*** Added command 2358 - inbytes: 0, outbytes: 0
*** Added command 2359 - inbytes: 0, outbytes: 1
*** Removed command 2516 - inbytes: 16, outbytes: 0
** nn::pdm::detail::IQueryService
*** Removed command 7 - buffers: [6, 5], inbytes: 0, outbytes: 4
*** Removed command 13 - buffers: [6, 5], inbytes: 0, outbytes: 4
*** Removed command 14 - buffers: [6], inbytes: 24, outbytes: 4
*** Removed command 15 - inbytes: 0, outbytes: 0, outhandles: [1]
*** Removed command 16 - buffers: [6, 5], inbytes: 16, outbytes: 4
** nn::prepo::detail::ipc::IPrepoService
*** Added command 10500 - buffers: [9], inbytes: 40, inhandles: [1], outbytes: 0, outinterfaces: ['nn::prepo::detail::ipc::IAsyncContext'], pid: True
** nn::settings::ISystemSettingsServer
*** Removed command 119 - inbytes: 1, outbytes: 3
** nn::srepo::detail::ipc::ISrepoService
*** Added command 10300 - buffers: [9], inbytes: 40, inhandles: [1], outbytes: 0, outinterfaces: ['nn::srepo::detail::ipc::IAsyncContext']
*** Added command 20600 - inbytes: 20, outbytes: 0
** nn::usb::ds::IDsEndpoint
*** Removed command 8 - inbytes: 8, inhandles: [1], outbytes: 0
*** Removed command 9 - inbytes: 16, outbytes: 4
** nn::usb::ds::IDsInterface
*** Added command 12 - inbytes: 8, inhandles: [1], outbytes: 0
** nn::visrv::sf::IManagerDisplayService
*** Changed command 8293 - inbytes: 16 -> 40 (final state: buffers: [6], inbytes: 40, outbytes: 8)

==See Also==
System update report(s):
* [https://yls8.mtheall.com/ninupdates/reports.php?date=2022-10-11_00-15-06&sys=hac]

{{NavboxVersions}}

[[Category:System versions]]

News

2026-08-06T00:57:22Z

Yellows8: Undo revision 14897 by Yls8bot (talk)

News/Archive

2026-08-06T00:56:50Z

Yellows8:

*'''13 January 26''' Nintendo released system update [[21.2.0]].
*'''9 December 25''' Nintendo released system update [[21.1.0]].
*'''25 November 25''' Nintendo released system update [[21.0.1]].
*'''11 November 25''' Nintendo released system update [[21.0.0]].
*'''30 September 25''' Nintendo released system update [[20.5.0]].
*'''2 September 25''' Nintendo released system update [[20.4.0]].
*'''29 July 25''' Nintendo released system update [[20.3.0]].
*'''15 July 25''' Nintendo released system update [[20.2.0]].
*'''19 June 25''' Nintendo released system update [[20.1.5]].
*'''3 June 25''' Nintendo released system update [[20.1.1]].
*'''28 May 25''' Nintendo released system update [[20.1.0]].
*'''2 May 25''' Nintendo released system update [[20.0.1]].
*'''30 April 25''' Nintendo released system update [[20.0.0]].
*'''7 January 25''' Nintendo released a rebootless system update for [[19.0.1]].
*'''29 October 24''' Nintendo released system update [[19.0.1]].
*'''8 October 24''' Nintendo released system update [[19.0.0]].
*'''2 July 24''' Nintendo released a rebootless system update for [[18.1.0]].
*'''11 June 24''' Nintendo released system update [[18.1.0]].
*'''23 April 24''' Nintendo released system update [[18.0.1]].
*'''26 March 24''' Nintendo released system update [[18.0.0]].
*'''20 February 24''' Nintendo released a rebootless system update for [[17.0.1]].
*'''5 December 23''' Nintendo released system update [[17.0.1]].
*'''21 November 23''' Nintendo released a rebootless system update for [[17.0.0]].
*'''11 October 23''' Nintendo released system update [[17.0.0]].
*'''22 August 23''' Nintendo released system update [[16.1.0]].
*'''9 May 23''' Nintendo released system update [[16.0.3]].
*'''18 April 23''' Nintendo released system update [[16.0.2]].
*'''23 March 23''' Nintendo released system update [[16.0.1]].
*'''21 February 23''' Nintendo released system update [[16.0.0]].
*'''20 December 22''' Nintendo released a rebootless system update for [[15.0.1]].
*'''1 November 22''' Nintendo released system update [[15.0.1]].
*'''11 October 22''' Nintendo released system update [[15.0.0]].
*'''31 August 22''' Nintendo released a rebootless system update for [[14.1.2]].
*'''26 July 22''' Nintendo released a rebootless system update for [[14.1.2]].
*'''28 June 22''' Nintendo released a rebootless system update for [[14.1.2]].
*'''14 June 22''' Nintendo released system update [[14.1.2]].
*'''19 April 22''' Nintendo released system update [[14.1.1]].
*'''5 April 22''' Nintendo released system update [[14.1.0]].
*'''22 March 22''' Nintendo released system update [[14.0.0]].
*'''20 January 22''' Nintendo released system update [[13.2.1]].
*'''1 December 21''' Nintendo released system update [[13.2.0]].
*'''26 October 21''' Nintendo released system update [[13.1.0]].
*'''15 September 21''' Nintendo released system update [[13.0.0]].
*'''6 July 21''' Nintendo released system update [[12.1.0]].
*'''12 June 21''' [https://devkitpro.org/viewtopic.php?f=13&t=9226&p=17113#p17113 libnx v4.1.0 released].
*'''8 June 21''' Nintendo released system update [[12.0.3]].
*'''12 May 21''' Nintendo released system update [[12.0.2]].
*'''20 April 21''' Nintendo released system update [[12.0.1]].
*'''6 April 21''' Nintendo released system update [[12.0.0]].
*'''9 March 21''' Nintendo released a rebootless system update for [[11.0.1]].
*'''11 December 20''' Nintendo released system update [[11.0.1]].
*'''1 December 20''' Nintendo released system update [[11.0.0]].
*'''15 September 20''' Nintendo released system update [[10.2.0]].
*'''28 July 20''' Nintendo released system update [[10.1.1]].
*'''14 July 20''' Nintendo released system update [[10.1.0]].
*'''5 June 20''' Nintendo released system update [[10.0.4]].
*'''26 May 20''' Nintendo released system update [[10.0.3]].
*'''11 May 20''' [https://devkitpro.org/viewtopic.php?f=13&t=9058 devkitA64 r15, libnx v3.2.0, deko3d v0.2.0, switch-examples v20200511] and [https://github.com/switchbrew/nx-hbloader/releases/tag/v2.3.2 nx-hbloader v2.3.2] released.
*'''30 April 20''' Nintendo released system update [[10.0.2]].
*'''22 April 20''' Nintendo released system update [[10.0.1]].
*'''14 April 20''' Nintendo released system update [[10.0.0]].
*'''4 April 20''' [https://devkitpro.org/viewtopic.php?f=13&t=9035 libnx v3.1.0, switch-examples v20200404 and deko3d v0.1.0 released]. On the 6th nx-hbmenu v3.3.0 was [https://github.com/switchbrew/nx-hbmenu/releases/latest released].
*'''2 April 20''' [https://github.com/switchbrew/nssu-updater nssu-updater] and [https://github.com/switchbrew/contents-delivery-manager contents-delivery-manager] were released.
*'''3 March 20''' Nintendo released system update [[9.2.0]].
*'''10 December 19''' [https://devkitpro.org/viewtopic.php?f=13&t=8989 libnx v3.0.0, switch-examples v20191211, Atmosphère v0.10.1, nx-hbmenu v3.2.0, and nx-hbloader v2.3.0 released].
*'''4 December 19''' Nintendo released system update [[9.1.0]].
*'''30 September 19''' Nintendo released system update [[9.0.1]].
*'''14 September 19''' [https://devkitpro.org/viewtopic.php?f=13&t=8964 libnx v2.5.0 and switch-examples v20190914 released]. nx-hbmenu v3.1.1 [https://github.com/switchbrew/nx-hbmenu/releases/tag/v3.1.1 released]. [https://github.com/Atmosphere-NX/Atmosphere/releases/tag/0.9.4 Atmosphère 0.9.4 released with support for 9.0.0].
*'''9 September 19''' Nintendo released system update [[9.0.0]].
*'''10 July 19''' Nintendo [https://twitter.com/NintendoAmerica/status/1148934589026455552 announced] the Nintendo Switch Lite system.
*'''17 June 19''' Nintendo released system update [[8.1.0]].
*'''1 May 19''' [https://devkitpro.org/viewtopic.php?f=13&t=8908 libnx v2.2.0 and switch-examples v20190501] released.
*'''23 April 19''' Nintendo released system update [[8.0.1]].
*'''15 April 19''' Nintendo released system update [[8.0.0]].
*'''29 March 19''' [https://devkitpro.org/viewtopic.php?f=13&t=8891 devkitA64 r13] and [https://github.com/switchbrew/libnx/releases/tag/v2.1.0 libnx v2.1.0] released with pthread/std::thread support.
*'''26 March 19''' [https://github.com/Atmosphere-NX/Atmosphere/releases/tag/0.8.6 Atmosphère v0.8.6] released with lots of bugfixes, more cheat stuff and web applet homebrew support.
*'''21 February 19''' [https://github.com/Atmosphere-NX/Atmosphere/releases/tag/0.8.4 Atmosphère v0.8.4] released with 7.0.x support.
*'''18 February 19''' Nintendo released system update [[7.0.1]].
*'''28 January 19''' Nintendo released system update [[7.0.0]].
*'''24 January 19''' [https://github.com/Atmosphere-NX/Atmosphere/releases/tag/0.8.3 Atmosphère v0.8.3] and [https://github.com/switchbrew/nx-hbloader/releases/tag/v2.1.0 nx-hbloader v2.1.0] were released.
*'''2 January 19''' [https://devkitpro.org/viewtopic.php?f=13&t=8826 libnx 2.0.0, switch-mesa 18.3 and switch-examples 20190102] were released.
*'''29 November 18''' [https://github.com/Atmosphere-NX/Atmosphere/releases/tag/0.8.0 Atmosphère v0.8.0] was released.
*'''29 November 18''' [https://github.com/switchbrew/nx-hbmenu/releases/latest nx-hbmenu v3.0.1] was released.
*'''28 November 18''' [https://devkitpro.org/viewtopic.php?f=13&t=8813 libnx 1.6.0 and switch-examples 20181128] were released.
*'''19 November 18''' Nintendo released system update [[6.2.0]].
*'''31 October 18''' [https://github.com/switchbrew/nx-hbloader/releases/tag/v2.0.1 nx-hbloader v2.0.1] was released.
*'''29 October 18''' [https://github.com/switchbrew/nx-hbmenu/releases/latest nx-hbmenu] v3.0.0 was released.
*'''29 October 18''' Nintendo released system update [[6.1.0]].
*'''27 October 18''' [https://devkitpro.org/viewtopic.php?f=13&t=8798 libnx 1.5.0 and switch-examples 20181027] were released.
*'''17 October 18''' [https://github.com/Atmosphere-NX/Atmosphere/releases/tag/0.7.0 Atmosphère v0.7.0] and [https://github.com/switchbrew/nx-hbloader/releases/tag/v2.0.0 nx-hbloader v2.0.0] were released.
*'''8 October 18''' Nintendo released system update [[6.0.1]].
*'''18 September 18''' Nintendo released system update [[6.0.0]].
*'''18 September 18''' [https://devkitpro.org/viewtopic.php?f=13&t=8784 libnx 1.4.1, switch-mesa v18.2β and switch-examples 20180918] were released.
*'''9 September 18''' [https://devkitpro.org/viewtopic.php?f=13&t=8780 libnx v1.4.0] was released alongside a Switch port of mesa/nouveau (GPU library).
*'''28 July 18''' [https://devkitpro.org/viewtopic.php?f=13&t=8761 devkitA64] r12 and [https://github.com/switchbrew/libnx/releases/tag/v1.3.1 libnx] v1.3.1 were released.
*'''8 July 18''' [https://github.com/switchbrew/libnx/releases/tag/v1.3.0 libnx] v1.3.0 was released.
*'''30 May 18''' Nintendo released system update [[5.1.0]].
*'''16 April 18''' Nintendo released system update [[5.0.2]].
*'''26 March 18''' Nintendo released system update [[5.0.1]].
*'''12 March 18''' Nintendo released system update [[5.0.0]].
*'''2 March 18''' [https://github.com/switchbrew/libnx/releases/tag/v1.1.0 libnx] v1.1.0 was released.
*'''28 February 18''' [https://github.com/switchbrew/nx-hbmenu/releases/latest nx-hbmenu] v2.0.0 was released.
*'''22 February 18''' [http://devkitpro.org devkitPro] released [https://devkitpro.org/viewtopic.php?f=13&t=8693 devkitA64 alpha7]
*'''18 February 18''' [https://switchbrew.github.io/nx-hbl/ nx-hbl] and [https://github.com/switchbrew/nx-hbmenu nx-hbmenu] were released.
*'''28 December 17''' The 34c3 Switch [https://events.ccc.de/congress/2017/Fahrplan/events/8941.html talk] took place, video available [https://media.ccc.de/v/34c3-8941-console_security_-_switch here].
*'''4 December 17''' Nintendo released system update [[4.1.0]].
*'''25 October 17''' Nintendo released system update [[4.0.1]].
*'''18 October 17''' Nintendo released system update [[4.0.0]].
*'''17 September 17''' [https://github.com/switchbrew/libnx libnx] was made public, with examples available [https://github.com/switchbrew/switch-examples here].
*'''5 September 17''' Nintendo released system update [[3.0.2]].
*'''31 July 17''' Nintendo released system update [[3.0.1]].
*'''19 June 17''' Nintendo released system update [[3.0.0]].
*'''15 May 17''' Nintendo released system update [[2.3.0]].
*'''17 April 17''' Nintendo released system update [[2.2.0]].
*'''27 March 17''' Nintendo released system update [[2.1.0]].
*'''2 March 17''' Nintendo released system update [[2.0.0]].
*'''3 March 17''' Nintendo Switch global release.

News

2026-08-06T00:53:41Z

Yellows8: Reverted edits by Yls8bot (talk) to last revision by Yellows8

News/Archive

2026-08-06T00:52:55Z

Yellows8:

*'''13 January 26''' Nintendo released system update [[21.2.0]].
*'''9 December 25''' Nintendo released system update [[21.1.0]].
*'''25 November 25''' Nintendo released system update [[21.0.1]].
*'''11 November 25''' Nintendo released system update [[21.0.0]].
*'''30 September 25''' Nintendo released system update [[20.5.0]].
*'''2 September 25''' Nintendo released system update [[20.4.0]].
*'''29 July 25''' Nintendo released system update [[20.3.0]].
*'''15 July 25''' Nintendo released system update [[20.2.0]].
*'''19 June 25''' Nintendo released system update [[20.1.5]].
*'''3 June 25''' Nintendo released system update [[20.1.1]].
*'''28 May 25''' Nintendo released system update [[20.1.0]].
*'''2 May 25''' Nintendo released system update [[20.0.1]].
*'''30 April 25''' Nintendo released system update [[20.0.0]].
*'''7 January 25''' Nintendo released a rebootless system update for [[19.0.1]].
*'''29 October 24''' Nintendo released system update [[19.0.1]].
*'''8 October 24''' Nintendo released system update [[19.0.0]].
*'''2 July 24''' Nintendo released a rebootless system update for [[18.1.0]].
*'''11 June 24''' Nintendo released system update [[18.1.0]].
*'''23 April 24''' Nintendo released system update [[18.0.1]].
*'''26 March 24''' Nintendo released system update [[18.0.0]].
*'''20 February 24''' Nintendo released a rebootless system update for [[17.0.1]].
*'''5 December 23''' Nintendo released system update [[17.0.1]].
*'''21 November 23''' Nintendo released a rebootless system update for [[17.0.0]].
*'''11 October 23''' Nintendo released system update [[17.0.0]].
*'''22 August 23''' Nintendo released system update [[16.1.0]].
*'''9 May 23''' Nintendo released system update [[16.0.3]].
*'''18 April 23''' Nintendo released system update [[16.0.2]].
*'''23 March 23''' Nintendo released system update [[16.0.1]].
*'''21 February 23''' Nintendo released system update [[16.0.0]].
*'''1 November 22''' Nintendo released system update [[15.0.1]].
*'''11 October 22''' Nintendo released system update [[15.0.0]].
*'''31 August 22''' Nintendo released a rebootless system update for [[14.1.2]].
*'''26 July 22''' Nintendo released a rebootless system update for [[14.1.2]].
*'''28 June 22''' Nintendo released a rebootless system update for [[14.1.2]].
*'''14 June 22''' Nintendo released system update [[14.1.2]].
*'''19 April 22''' Nintendo released system update [[14.1.1]].
*'''5 April 22''' Nintendo released system update [[14.1.0]].
*'''22 March 22''' Nintendo released system update [[14.0.0]].
*'''20 January 22''' Nintendo released system update [[13.2.1]].
*'''1 December 21''' Nintendo released system update [[13.2.0]].
*'''26 October 21''' Nintendo released system update [[13.1.0]].
*'''15 September 21''' Nintendo released system update [[13.0.0]].
*'''6 July 21''' Nintendo released system update [[12.1.0]].
*'''12 June 21''' [https://devkitpro.org/viewtopic.php?f=13&t=9226&p=17113#p17113 libnx v4.1.0 released].
*'''8 June 21''' Nintendo released system update [[12.0.3]].
*'''12 May 21''' Nintendo released system update [[12.0.2]].
*'''20 April 21''' Nintendo released system update [[12.0.1]].
*'''6 April 21''' Nintendo released system update [[12.0.0]].
*'''9 March 21''' Nintendo released a rebootless system update for [[11.0.1]].
*'''11 December 20''' Nintendo released system update [[11.0.1]].
*'''1 December 20''' Nintendo released system update [[11.0.0]].
*'''15 September 20''' Nintendo released system update [[10.2.0]].
*'''28 July 20''' Nintendo released system update [[10.1.1]].
*'''14 July 20''' Nintendo released system update [[10.1.0]].
*'''5 June 20''' Nintendo released system update [[10.0.4]].
*'''26 May 20''' Nintendo released system update [[10.0.3]].
*'''11 May 20''' [https://devkitpro.org/viewtopic.php?f=13&t=9058 devkitA64 r15, libnx v3.2.0, deko3d v0.2.0, switch-examples v20200511] and [https://github.com/switchbrew/nx-hbloader/releases/tag/v2.3.2 nx-hbloader v2.3.2] released.
*'''30 April 20''' Nintendo released system update [[10.0.2]].
*'''22 April 20''' Nintendo released system update [[10.0.1]].
*'''14 April 20''' Nintendo released system update [[10.0.0]].
*'''4 April 20''' [https://devkitpro.org/viewtopic.php?f=13&t=9035 libnx v3.1.0, switch-examples v20200404 and deko3d v0.1.0 released]. On the 6th nx-hbmenu v3.3.0 was [https://github.com/switchbrew/nx-hbmenu/releases/latest released].
*'''2 April 20''' [https://github.com/switchbrew/nssu-updater nssu-updater] and [https://github.com/switchbrew/contents-delivery-manager contents-delivery-manager] were released.
*'''3 March 20''' Nintendo released system update [[9.2.0]].
*'''10 December 19''' [https://devkitpro.org/viewtopic.php?f=13&t=8989 libnx v3.0.0, switch-examples v20191211, Atmosphère v0.10.1, nx-hbmenu v3.2.0, and nx-hbloader v2.3.0 released].
*'''4 December 19''' Nintendo released system update [[9.1.0]].
*'''30 September 19''' Nintendo released system update [[9.0.1]].
*'''14 September 19''' [https://devkitpro.org/viewtopic.php?f=13&t=8964 libnx v2.5.0 and switch-examples v20190914 released]. nx-hbmenu v3.1.1 [https://github.com/switchbrew/nx-hbmenu/releases/tag/v3.1.1 released]. [https://github.com/Atmosphere-NX/Atmosphere/releases/tag/0.9.4 Atmosphère 0.9.4 released with support for 9.0.0].
*'''9 September 19''' Nintendo released system update [[9.0.0]].
*'''10 July 19''' Nintendo [https://twitter.com/NintendoAmerica/status/1148934589026455552 announced] the Nintendo Switch Lite system.
*'''17 June 19''' Nintendo released system update [[8.1.0]].
*'''1 May 19''' [https://devkitpro.org/viewtopic.php?f=13&t=8908 libnx v2.2.0 and switch-examples v20190501] released.
*'''23 April 19''' Nintendo released system update [[8.0.1]].
*'''15 April 19''' Nintendo released system update [[8.0.0]].
*'''29 March 19''' [https://devkitpro.org/viewtopic.php?f=13&t=8891 devkitA64 r13] and [https://github.com/switchbrew/libnx/releases/tag/v2.1.0 libnx v2.1.0] released with pthread/std::thread support.
*'''26 March 19''' [https://github.com/Atmosphere-NX/Atmosphere/releases/tag/0.8.6 Atmosphère v0.8.6] released with lots of bugfixes, more cheat stuff and web applet homebrew support.
*'''21 February 19''' [https://github.com/Atmosphere-NX/Atmosphere/releases/tag/0.8.4 Atmosphère v0.8.4] released with 7.0.x support.
*'''18 February 19''' Nintendo released system update [[7.0.1]].
*'''28 January 19''' Nintendo released system update [[7.0.0]].
*'''24 January 19''' [https://github.com/Atmosphere-NX/Atmosphere/releases/tag/0.8.3 Atmosphère v0.8.3] and [https://github.com/switchbrew/nx-hbloader/releases/tag/v2.1.0 nx-hbloader v2.1.0] were released.
*'''2 January 19''' [https://devkitpro.org/viewtopic.php?f=13&t=8826 libnx 2.0.0, switch-mesa 18.3 and switch-examples 20190102] were released.
*'''29 November 18''' [https://github.com/Atmosphere-NX/Atmosphere/releases/tag/0.8.0 Atmosphère v0.8.0] was released.
*'''29 November 18''' [https://github.com/switchbrew/nx-hbmenu/releases/latest nx-hbmenu v3.0.1] was released.
*'''28 November 18''' [https://devkitpro.org/viewtopic.php?f=13&t=8813 libnx 1.6.0 and switch-examples 20181128] were released.
*'''19 November 18''' Nintendo released system update [[6.2.0]].
*'''31 October 18''' [https://github.com/switchbrew/nx-hbloader/releases/tag/v2.0.1 nx-hbloader v2.0.1] was released.
*'''29 October 18''' [https://github.com/switchbrew/nx-hbmenu/releases/latest nx-hbmenu] v3.0.0 was released.
*'''29 October 18''' Nintendo released system update [[6.1.0]].
*'''27 October 18''' [https://devkitpro.org/viewtopic.php?f=13&t=8798 libnx 1.5.0 and switch-examples 20181027] were released.
*'''17 October 18''' [https://github.com/Atmosphere-NX/Atmosphere/releases/tag/0.7.0 Atmosphère v0.7.0] and [https://github.com/switchbrew/nx-hbloader/releases/tag/v2.0.0 nx-hbloader v2.0.0] were released.
*'''8 October 18''' Nintendo released system update [[6.0.1]].
*'''18 September 18''' Nintendo released system update [[6.0.0]].
*'''18 September 18''' [https://devkitpro.org/viewtopic.php?f=13&t=8784 libnx 1.4.1, switch-mesa v18.2β and switch-examples 20180918] were released.
*'''9 September 18''' [https://devkitpro.org/viewtopic.php?f=13&t=8780 libnx v1.4.0] was released alongside a Switch port of mesa/nouveau (GPU library).
*'''28 July 18''' [https://devkitpro.org/viewtopic.php?f=13&t=8761 devkitA64] r12 and [https://github.com/switchbrew/libnx/releases/tag/v1.3.1 libnx] v1.3.1 were released.
*'''8 July 18''' [https://github.com/switchbrew/libnx/releases/tag/v1.3.0 libnx] v1.3.0 was released.
*'''30 May 18''' Nintendo released system update [[5.1.0]].
*'''16 April 18''' Nintendo released system update [[5.0.2]].
*'''26 March 18''' Nintendo released system update [[5.0.1]].
*'''12 March 18''' Nintendo released system update [[5.0.0]].
*'''2 March 18''' [https://github.com/switchbrew/libnx/releases/tag/v1.1.0 libnx] v1.1.0 was released.
*'''28 February 18''' [https://github.com/switchbrew/nx-hbmenu/releases/latest nx-hbmenu] v2.0.0 was released.
*'''22 February 18''' [http://devkitpro.org devkitPro] released [https://devkitpro.org/viewtopic.php?f=13&t=8693 devkitA64 alpha7]
*'''18 February 18''' [https://switchbrew.github.io/nx-hbl/ nx-hbl] and [https://github.com/switchbrew/nx-hbmenu nx-hbmenu] were released.
*'''28 December 17''' The 34c3 Switch [https://events.ccc.de/congress/2017/Fahrplan/events/8941.html talk] took place, video available [https://media.ccc.de/v/34c3-8941-console_security_-_switch here].
*'''4 December 17''' Nintendo released system update [[4.1.0]].
*'''25 October 17''' Nintendo released system update [[4.0.1]].
*'''18 October 17''' Nintendo released system update [[4.0.0]].
*'''17 September 17''' [https://github.com/switchbrew/libnx libnx] was made public, with examples available [https://github.com/switchbrew/switch-examples here].
*'''5 September 17''' Nintendo released system update [[3.0.2]].
*'''31 July 17''' Nintendo released system update [[3.0.1]].
*'''19 June 17''' Nintendo released system update [[3.0.0]].
*'''15 May 17''' Nintendo released system update [[2.3.0]].
*'''17 April 17''' Nintendo released system update [[2.2.0]].
*'''27 March 17''' Nintendo released system update [[2.1.0]].
*'''2 March 17''' Nintendo released system update [[2.0.0]].
*'''3 March 17''' Nintendo Switch global release.

News/Archive

2026-08-06T00:49:28Z

Yellows8: Reverted edits by Yls8bot (talk) to last revision by Yellows8

*'''13 January 26''' Nintendo released system update [[21.2.0]].
*'''9 December 25''' Nintendo released system update [[21.1.0]].
*'''25 November 25''' Nintendo released system update [[21.0.1]].
*'''11 November 25''' Nintendo released system update [[21.0.0]].
*'''30 September 25''' Nintendo released system update [[20.5.0]].
*'''2 September 25''' Nintendo released system update [[20.4.0]].
*'''29 July 25''' Nintendo released system update [[20.3.0]].
*'''15 July 25''' Nintendo released system update [[20.2.0]].
*'''19 June 25''' Nintendo released system update [[20.1.5]].
*'''3 June 25''' Nintendo released system update [[20.1.1]].
*'''28 May 25''' Nintendo released system update [[20.1.0]].
*'''2 May 25''' Nintendo released system update [[20.0.1]].
*'''30 April 25''' Nintendo released system update [[20.0.0]].
*'''7 January 25''' Nintendo released a rebootless system update for [[19.0.1]].
*'''29 October 24''' Nintendo released system update [[19.0.1]].
*'''8 October 24''' Nintendo released system update [[19.0.0]].
*'''2 July 24''' Nintendo released a rebootless system update for [[18.1.0]].
*'''11 June 24''' Nintendo released system update [[18.1.0]].
*'''23 April 24''' Nintendo released system update [[18.0.1]].
*'''26 March 24''' Nintendo released system update [[18.0.0]].
*'''20 February 24''' Nintendo released a rebootless system update for [[17.0.1]].
*'''5 December 23''' Nintendo released system update [[17.0.1]].
*'''21 November 23''' Nintendo released a rebootless system update for [[17.0.0]].
*'''11 October 23''' Nintendo released system update [[17.0.0]].
*'''22 August 23''' Nintendo released system update [[16.1.0]].
*'''9 May 23''' Nintendo released system update [[16.0.3]].
*'''18 April 23''' Nintendo released system update [[16.0.2]].
*'''23 March 23''' Nintendo released system update [[16.0.1]].
*'''21 February 23''' Nintendo released system update [[16.0.0]].
*'''1 November 22''' Nintendo released system update [[15.0.1]].
*'''11 October 22''' Nintendo released system update [[15.0.0]].
*'''14 June 22''' Nintendo released system update [[14.1.2]].
*'''19 April 22''' Nintendo released system update [[14.1.1]].
*'''5 April 22''' Nintendo released system update [[14.1.0]].
*'''22 March 22''' Nintendo released system update [[14.0.0]].
*'''20 January 22''' Nintendo released system update [[13.2.1]].
*'''1 December 21''' Nintendo released system update [[13.2.0]].
*'''26 October 21''' Nintendo released system update [[13.1.0]].
*'''15 September 21''' Nintendo released system update [[13.0.0]].
*'''6 July 21''' Nintendo released system update [[12.1.0]].
*'''12 June 21''' [https://devkitpro.org/viewtopic.php?f=13&t=9226&p=17113#p17113 libnx v4.1.0 released].
*'''8 June 21''' Nintendo released system update [[12.0.3]].
*'''12 May 21''' Nintendo released system update [[12.0.2]].
*'''20 April 21''' Nintendo released system update [[12.0.1]].
*'''6 April 21''' Nintendo released system update [[12.0.0]].
*'''9 March 21''' Nintendo released a rebootless system update for [[11.0.1]].
*'''11 December 20''' Nintendo released system update [[11.0.1]].
*'''1 December 20''' Nintendo released system update [[11.0.0]].
*'''15 September 20''' Nintendo released system update [[10.2.0]].
*'''28 July 20''' Nintendo released system update [[10.1.1]].
*'''14 July 20''' Nintendo released system update [[10.1.0]].
*'''5 June 20''' Nintendo released system update [[10.0.4]].
*'''26 May 20''' Nintendo released system update [[10.0.3]].
*'''11 May 20''' [https://devkitpro.org/viewtopic.php?f=13&t=9058 devkitA64 r15, libnx v3.2.0, deko3d v0.2.0, switch-examples v20200511] and [https://github.com/switchbrew/nx-hbloader/releases/tag/v2.3.2 nx-hbloader v2.3.2] released.
*'''30 April 20''' Nintendo released system update [[10.0.2]].
*'''22 April 20''' Nintendo released system update [[10.0.1]].
*'''14 April 20''' Nintendo released system update [[10.0.0]].
*'''4 April 20''' [https://devkitpro.org/viewtopic.php?f=13&t=9035 libnx v3.1.0, switch-examples v20200404 and deko3d v0.1.0 released]. On the 6th nx-hbmenu v3.3.0 was [https://github.com/switchbrew/nx-hbmenu/releases/latest released].
*'''2 April 20''' [https://github.com/switchbrew/nssu-updater nssu-updater] and [https://github.com/switchbrew/contents-delivery-manager contents-delivery-manager] were released.
*'''3 March 20''' Nintendo released system update [[9.2.0]].
*'''10 December 19''' [https://devkitpro.org/viewtopic.php?f=13&t=8989 libnx v3.0.0, switch-examples v20191211, Atmosphère v0.10.1, nx-hbmenu v3.2.0, and nx-hbloader v2.3.0 released].
*'''4 December 19''' Nintendo released system update [[9.1.0]].
*'''30 September 19''' Nintendo released system update [[9.0.1]].
*'''14 September 19''' [https://devkitpro.org/viewtopic.php?f=13&t=8964 libnx v2.5.0 and switch-examples v20190914 released]. nx-hbmenu v3.1.1 [https://github.com/switchbrew/nx-hbmenu/releases/tag/v3.1.1 released]. [https://github.com/Atmosphere-NX/Atmosphere/releases/tag/0.9.4 Atmosphère 0.9.4 released with support for 9.0.0].
*'''9 September 19''' Nintendo released system update [[9.0.0]].
*'''10 July 19''' Nintendo [https://twitter.com/NintendoAmerica/status/1148934589026455552 announced] the Nintendo Switch Lite system.
*'''17 June 19''' Nintendo released system update [[8.1.0]].
*'''1 May 19''' [https://devkitpro.org/viewtopic.php?f=13&t=8908 libnx v2.2.0 and switch-examples v20190501] released.
*'''23 April 19''' Nintendo released system update [[8.0.1]].
*'''15 April 19''' Nintendo released system update [[8.0.0]].
*'''29 March 19''' [https://devkitpro.org/viewtopic.php?f=13&t=8891 devkitA64 r13] and [https://github.com/switchbrew/libnx/releases/tag/v2.1.0 libnx v2.1.0] released with pthread/std::thread support.
*'''26 March 19''' [https://github.com/Atmosphere-NX/Atmosphere/releases/tag/0.8.6 Atmosphère v0.8.6] released with lots of bugfixes, more cheat stuff and web applet homebrew support.
*'''21 February 19''' [https://github.com/Atmosphere-NX/Atmosphere/releases/tag/0.8.4 Atmosphère v0.8.4] released with 7.0.x support.
*'''18 February 19''' Nintendo released system update [[7.0.1]].
*'''28 January 19''' Nintendo released system update [[7.0.0]].
*'''24 January 19''' [https://github.com/Atmosphere-NX/Atmosphere/releases/tag/0.8.3 Atmosphère v0.8.3] and [https://github.com/switchbrew/nx-hbloader/releases/tag/v2.1.0 nx-hbloader v2.1.0] were released.
*'''2 January 19''' [https://devkitpro.org/viewtopic.php?f=13&t=8826 libnx 2.0.0, switch-mesa 18.3 and switch-examples 20190102] were released.
*'''29 November 18''' [https://github.com/Atmosphere-NX/Atmosphere/releases/tag/0.8.0 Atmosphère v0.8.0] was released.
*'''29 November 18''' [https://github.com/switchbrew/nx-hbmenu/releases/latest nx-hbmenu v3.0.1] was released.
*'''28 November 18''' [https://devkitpro.org/viewtopic.php?f=13&t=8813 libnx 1.6.0 and switch-examples 20181128] were released.
*'''19 November 18''' Nintendo released system update [[6.2.0]].
*'''31 October 18''' [https://github.com/switchbrew/nx-hbloader/releases/tag/v2.0.1 nx-hbloader v2.0.1] was released.
*'''29 October 18''' [https://github.com/switchbrew/nx-hbmenu/releases/latest nx-hbmenu] v3.0.0 was released.
*'''29 October 18''' Nintendo released system update [[6.1.0]].
*'''27 October 18''' [https://devkitpro.org/viewtopic.php?f=13&t=8798 libnx 1.5.0 and switch-examples 20181027] were released.
*'''17 October 18''' [https://github.com/Atmosphere-NX/Atmosphere/releases/tag/0.7.0 Atmosphère v0.7.0] and [https://github.com/switchbrew/nx-hbloader/releases/tag/v2.0.0 nx-hbloader v2.0.0] were released.
*'''8 October 18''' Nintendo released system update [[6.0.1]].
*'''18 September 18''' Nintendo released system update [[6.0.0]].
*'''18 September 18''' [https://devkitpro.org/viewtopic.php?f=13&t=8784 libnx 1.4.1, switch-mesa v18.2β and switch-examples 20180918] were released.
*'''9 September 18''' [https://devkitpro.org/viewtopic.php?f=13&t=8780 libnx v1.4.0] was released alongside a Switch port of mesa/nouveau (GPU library).
*'''28 July 18''' [https://devkitpro.org/viewtopic.php?f=13&t=8761 devkitA64] r12 and [https://github.com/switchbrew/libnx/releases/tag/v1.3.1 libnx] v1.3.1 were released.
*'''8 July 18''' [https://github.com/switchbrew/libnx/releases/tag/v1.3.0 libnx] v1.3.0 was released.
*'''30 May 18''' Nintendo released system update [[5.1.0]].
*'''16 April 18''' Nintendo released system update [[5.0.2]].
*'''26 March 18''' Nintendo released system update [[5.0.1]].
*'''12 March 18''' Nintendo released system update [[5.0.0]].
*'''2 March 18''' [https://github.com/switchbrew/libnx/releases/tag/v1.1.0 libnx] v1.1.0 was released.
*'''28 February 18''' [https://github.com/switchbrew/nx-hbmenu/releases/latest nx-hbmenu] v2.0.0 was released.
*'''22 February 18''' [http://devkitpro.org devkitPro] released [https://devkitpro.org/viewtopic.php?f=13&t=8693 devkitA64 alpha7]
*'''18 February 18''' [https://switchbrew.github.io/nx-hbl/ nx-hbl] and [https://github.com/switchbrew/nx-hbmenu nx-hbmenu] were released.
*'''28 December 17''' The 34c3 Switch [https://events.ccc.de/congress/2017/Fahrplan/events/8941.html talk] took place, video available [https://media.ccc.de/v/34c3-8941-console_security_-_switch here].
*'''4 December 17''' Nintendo released system update [[4.1.0]].
*'''25 October 17''' Nintendo released system update [[4.0.1]].
*'''18 October 17''' Nintendo released system update [[4.0.0]].
*'''17 September 17''' [https://github.com/switchbrew/libnx libnx] was made public, with examples available [https://github.com/switchbrew/switch-examples here].
*'''5 September 17''' Nintendo released system update [[3.0.2]].
*'''31 July 17''' Nintendo released system update [[3.0.1]].
*'''19 June 17''' Nintendo released system update [[3.0.0]].
*'''15 May 17''' Nintendo released system update [[2.3.0]].
*'''17 April 17''' Nintendo released system update [[2.2.0]].
*'''27 March 17''' Nintendo released system update [[2.1.0]].
*'''2 March 17''' Nintendo released system update [[2.0.0]].
*'''3 March 17''' Nintendo Switch global release.

13.0.0

2026-08-06T00:46:33Z

Yellows8:

The Switch 13.0.0 system update was released on September 15, 2021 (UTC). This Switch update was released for the following regions: ALL.

Security flaws fixed: <fill this in manually later, see the updatedetails page from the ninupdates-report page(s) once available for now>.

==Change-log==
[https://en-americas-support.nintendo.com/app/answers/detail/a_id/22525/kw/nintendo%20switch%20system%20update Official] ALL change-log:
* Bluetooth® audio support was added.
*
* Headphones, earbuds, speakers, and other audio devices that connect with Bluetooth can now be paired with Nintendo Switch family systems for audio output.
*
* Bluetooth microphones are not supported.
* Up to two compatible wireless controllers can be connected to the system while using Bluetooth audio.
* Bluetooth audio cannot be used while local wireless communication is active.
* For more information, see How to Pair and Manage Bluetooth Audio Devices.
*
*
*
*
*
* “Update Dock” was added under System in System Settings for Nintendo Switch and Nintendo Switch – OLED Model systems, allowing for software updates to Nintendo Switch docks with a LAN port.
*
* Dock software updates are not available for Nintendo Switch docks without a LAN port.
* This feature was not added to Nintendo Switch Lite.
* For more information, see How to Update the Dock Firmware.
*
*
*
* “Maintain Internet Connection in Sleep Mode” was added under Sleep Mode in System Settings.
*
* When this setting is enabled, systems with wired internet connections will maintain internet connection even while in sleep mode. This allows for software and add-on content to download to the system while the system is in sleep mode.
*
* The setting is enabled by default.
*
*
* When this setting is disabled, the system will connect to the internet only periodically, which decreases power consumption.
*
* Note: Systems that are not updated to version 13.0.0 or later behave as if this setting is enabled.
*
*
* The method to initiate “Calibrate Control Sticks” in System Settings was changed.
*
* From System Settings, go to Controllers and Sensors, select Calibrate Control Sticks, then fully tilt the control stick in any one direction and keep it tilted for a few seconds to begin calibration.
*
*
*
* Users can now view whether their wireless internet connection is using the 2.4 GHz or 5 GHz frequency band under “Connection Status” after selecting Internet in System Settings.
*
* The Bluetooth® word mark and logos are registered trademarks owned by Bluetooth SIG, Inc. and any use of such marks by Nintendo is under license. Other trademarks and trade names are those of their respective owners.

==System Titles==
* All sysmodules were updated, excluding stubs.
* All SystemData were updated, except for: BrowserDll, both Dictionary SystemData, AvatarImage, Eula, UrlBlackList, ControllerIcon, ApplicationBlackList, FunctionBlackList.
* All applets were updated, except for: miiEdit and all web-applets.
* SystemData PlatformConfigAula and the SystemData for the Aula dock firmware were added.

The following sysmodules had IPC changes: [[USB_services|usb]], [[Settings_services|settings]], [[Bluetooth_Driver_services|bluetooth]], [[BCAT_services|bcat]], [[HID_services|hid]], [[Audio_services|audio]], [[WLAN_services|wlan]], [[PCV_services|pcv]], [[Account_services|account]], [[NS_Services|ns]], [[Applet_Manager_services|am]], [[NIM_services|nim]], [[BTM_services|btm]], [[Error_Report_services|erpt]], [[Display_services|vi]], [[NPNS_services|npns]], [[ETicket_services|es]], [[Filesystem_services|fs]], [[NCM_services|ncm]].

NPDM changes (see [[Services_API]] for the hosted service changes):
* [[BCAT_services|bcat]]: Access to acc:u1 was replaced with acc:e:u2.
* [[Friend_services|friends]], [[NIM_services|nim]], [[Parental_Control_services|pctl]], eclct, [[Shared_Database_services|sdb]], [[OLSC_services|olsc]]: Access to acc:u1 was replaced with acc:e:u1.
* [[PTM_services|ptm]], [[Sockets_services|bsdsocket]], [[HID_services|hid]], [[Audio_services|audio]], [[WLAN_services|wlan]], [[NV_services|nvservices]], [[PCV_services|pcv]], [[PCIe_services|pcie]], [[PSC_services|psc]], [[Safemode|safemode]]: Access to svcMapDeviceAddressSpace was removed.
* [[HID_services|hid]]: Access to rgltr was added.
* [[Audio_services|audio]]: Access to btdrv and btm were added.
* [[NS_Services|ns]]: Access to acc:e, ndrm:la, and ndrm:lu were added.
* [[Applet_Manager_services|am]]: Access to mnpp:sys was added.
* [[BTM_services|btm]]: Access to ovln:snd was added.
* [[JIT_services|jit]]: Access to svcSynchronizePreemptionState was added.
* [[OLSC_services|olsc]]: Access to sprof:bg and sprof:sp were added.
* [[Profile_Selector|playerSelect]]: Access to bcat:s was added.
* [[Album_Applet|photoViewer]]: Access to hwopus was removed.

RomFs changes:
* ErrorMessage was updated.
* Help was updated: "/legallines.htdocs/index.html" and the localization html under "/safe.htdocs/html/" was updated.
* NgWord/NgWord2/NgWordT was updated.
* LocalNews: message data was updated, and the following directories were added under "/image": "LnMinIntro_Aula", "LnSdAdvice_Aula", "LnSdIntro_Aula".
* TimeZoneBinary: timezone data was updated. "/zoneinfo/posixrules" was removed.
* FontKorean: the font was updated.
* FirmwareDebugSettings, PlatformConfigIcosa, PlatformConfigHoag, PlatformConfigIcosaMariko: [[System_Settings|updated]].
* [[HID_services#Firmware_update|ControllerFirmware]]: updated "FirmwareInfo.csv", "TouchScreenFirmwareInfo.csv", "ukyosakyo_ep2_ota.bin". Added "FTS_33000510.fts256" and "FTS_98000004.ftb".
* Various applet UI/gfx data was updated.

=== BootImagePackages ===
RomFs changes: all files updated.

[[Package2|INI1]] changes:
* BootImagePackageSafe:
** 010000000000001A (PCV): SVC access: removed MapDeviceAddressSpace.
** 010000000000000A (Bus): SVC access: removed MapDeviceAddressSpace.
** 0100000000000021 (psc): SVC access: removed MapDeviceAddressSpace.
* BootImagePackageExFatSafe:
** 010000000000001A (PCV): SVC access: removed MapDeviceAddressSpace.
** 010000000000000A (Bus): SVC access: removed MapDeviceAddressSpace.
** 0100000000000021 (psc): SVC access: removed MapDeviceAddressSpace.

====Kernel====
* Compiler upgrade to LLVM 11.1.
** Most notably, certain code now emits "ands" rather than "and; and; tst" + "bfxil" patterns are more commonly used.
* C++ language upgrade to C++17.
** Slab heaps/object containers are now constant initialized, no longer constructed during .init_array.
* Initialize0 changes:
** KernelLdr now sends back the initial process binary address in state.
** Initialize0 now uses a helper function for selecting random virtual regions, and now verifies KInitialPageTable->IsFree() before selecting regions.
** Initialize0 now verifies that the initial process binary address is in correct place (pool partition), and sets global=initial address.
*** This global is now used where GetInitialProcessBinaryAddress() was used previously.
* KPort limit increased to 0x180 from 0x100.
* SvcMapDeviceAddressSpace() was removed.
** Userland only ever used SvcMapDeviceAddressSpaceByForce and SvcMapDeviceAddressSpaceAligned, so this doesn't break any official software.
** Map only allowed one page table to be allocated, only partially mapping the desired range if more than one would be used.
*** Similarly, it returned an output mapped size so a caller could continue mapping partially until the whole range was done, one page table at a time.
** All parameters required to implement partial mapping have been removed, correspondingly.
*** No out_mapped_size, out_page_table_count, pt_limit parameters to any KDevicePageTable mapping functions any more.
*** UnlockForDevicePageTablePartialMap no longer takes in a partially-mapped size.
**** This code is simplified, since it is no longer possible to have a partially-mapped size other than zero.
* The two new kernel objects/four new SVCs added in 11.0.0 are finally present/instantiated.
** Prototypes for the new SVCs:
*** 0x39: Result CreateIoPool(Handle *out_handle, uint32_t which);
*** 0x3A: Result CreateIoRegion(Handle *out_handle, Handle io_pool, PhysicalAddress physical_address, size_t size, MemoryMapping mapping, MemoryPermission perm);
**** MemoryMapping is a new enum, 0 = IO, 1 = Uncached memory, 2 = Normal Memory.
*** 0x46: Result MapIoRegion(Handle region_handle, uintptr_t address, size_t size, MemoryPermission perm);
*** 0x47: Result UnmapIoRegion(Handle region_handle, uintptr_t address, size_t size);
** These SVCs conceptually allow creating an object for mapping in certain physical address ranges at user-specified virtual addresses, without having to include the ranges in npdm/kip capabilities ahead of time.
*** The only allowed id right now is 0, which corresponds to PCIE_A2 (physical address range 0x12000000-0x1FFFFFFF).
* KLightLock::Lock now uses simplified logic; KLightLock::LockSlowPath now returns a bool for whether the lock was acquired.
* KWritableEvent was deleted.
** Class tokens for types after KWritableEvent have been adjusted downwards to compensate (see mesosphere for class token generation algorithm).
** Handles which were previously returned to KWritableEvent are now returned directly to KEvent.
** KEvent has new boolean member to track whether the readable event has been destroyed.
** KReadableEvent::Initialize now opens reference to the parent event, rather than inline in KEvent::Initialize.
* KReadableEvent::Signal/Clear are no longer virtual functions.
* KAutoObject no longer has virtual destructor.
** This mostly means that base/deleting destructor no longer occur inside vtables.
* New memory state (0x16/0x2016) "Coverage", currently not exposed via any SVCs.
* A number of functions are now devirtualized when possible, indicating either the virtual functions (or the classes) were marked final.
** KProcess::GetId()
** KThread::GetId()
** KSessionRequest::Finalize()
** KInitialPageAllocator::Free()
* KConditionVariable::WaitForAddress/KConditionalVariable::SignalToAddress are now static
* KMemoryManager now operates on physical addresses instead of virtual addresses.
** KMemoryManager::Initialize now iterates the physical tree rather than the virtual tree, when finding pool regions.
** KMemoryManager::Allocate now returns a physical address instead of a virtual address.
** KMemoryManager::Close now takes in a physical address instead of a virtual address.
** KPageHeap now operates on physical addresses rather than virtual addresses.
*** New member stores the linear virtual address for the physical range the heap operates on.
** KBlockInfo now size 0x10 instead of 0x20.
*** Before: struct { KBlockInfo *prev; KBlockInfo *next; size_t num_pages; KVirtualAddress address; }
*** Now: struct { KBlockInfo *next; u32 phys_address_page; u32 num_pages; };
*** phys_address_page is a KPhysicalAddress / PageSize, to ensure it fits in u32.
** This halves memory requirements for KBlockInfos system-wide, effectively doubling the KPageGroup capacity.
** Memory range helper object used by page table functions also now operates on physical addresses.
* KPageTableBase no longer contains virtual memory region cache.
** This was only used in KPageTableBase::MapPageGroupImpl to do ABORT_UNLESS(IsHeapVirtualAddress(...));
** This abort is no longer present, likely because page groups are now physical blocks rather than virtual ones.
* KPageTable::Unmap now incrementally frees pages, rather than freeing them all at once.
* KHandleTableEntryInfo no longer stores object class token, KHandleTable::Add/Register no longer takes class token as argument.
** This reduces KHandleTable size (and thus KProcess size) by 0x800.
* The following types no longer have (unused) slab heaps:
** KClientSession, KLightClientSession, KLightServerSession
* A complete re-work/unification was done for the various kinds of thread waiting operations in the kernel.
** Previously, there were a number of different ways to initiate and end waits, handled manually in each location by invoking thread->SetState(...);
** Now, all waits use a common interface based around thread queue objects with virtual functions for the three kinds of supported waits.
** Supported queue virtual functions:
*** void NotifyAvailable(KThread *waiting_thread, KSynchronizationObject *signaled_object, Result wait_result);
**** This is supported only by the queue used by WaitSynchronization, and sets the signaled object/sync'd index for the thread.
*** void EndWait(KThread *waiting_thread, Result wait_result);
**** This conceptually ends a wait "normally", usually without additional cleanup. This is exclusively called by kernel-handled wait codepaths.
*** void CancelWait(KThread *waiting_thread, Result wait_result, bool cancel_timer_task);
**** This conceptually ends a wait "by force", interrupting it regardless of normal wait completion.
***** This usually involves extra cleanup.
**** This is invoked by e.g. CancelSynchronization, thread termination, thread finalize, etc.
** KThread::SetState is likely private now; it is called only by internal KThread functions.
** KLightSession was notably reworked substantially to take advantage of the new unified wait semantics.
** KSynchronizationObject::DumpWaiters() no longer exists.
* KDebug is now substantially more careful about management of its process pointer.
** New field "is_attached" explicitly tracks whether the KDebug is attached (instead of m_process != nullptr).
** m_process replaced by a new helper object containing KProcess * and reference count.
*** Code which previously used the process field now opens/closes references on m_process_holder.
*** When m_process_holder's reference count hits zero, the process is closed and m_pointer is set to 1 instead of nullptr.
** This makes the way KDebug treats the attached process's reference count much more correct/consistent.
*** In particular, "the KDebug is attached" now counts as one reference to the KProcess, no matter what the KDebug is doing with it.
* Resource management has changed substantially.
** Dynamic slabheaps no longer contain a pointer to an associated page allocator; instead, a page allocator is now passed as an argument to .Allocate().
** There are new helper objects which contain a dynamic slab heap pointer and a page allocator pointer, used for conveniently referencing a slab/page resource pair.
*** There are now helper objects differentiating between KBlockInfo and KPageTableManager allocators for system/application context.
*** KPageTable now has a helper function to allocate a page from the KPageTableManager helper object.
** Instead of allocating all unused pages to the page table page heap, all but 70 pages are allocated to the page table page heap.
** When a new flag from the secure monitor is zero (this is always the case on retail), new logic for "dynamic resource expansion" is enabled.
*** In particular, this causes the helper objects for the system memory blocks, block infos, and page table managers to be set to the dynamic page allocator.
**** Thus, the last 70 unused pages are dynamically allocated to (system memory blocks, system block infos, system page table pages) on a first-come basis as the system uses these resources.
**** NOTE: There is no "free"-ing of these resources back to the unused page heap, once they've been allocated to a specific slab they will remain in that slab until reboot.
*** In addition, when allocating a KSession, KEvent, or KLightSession from the system resource limit fails, an object of the desired type will be allocated from the otherwise unused "gaps" in the slab region.
**** When allocating a KSession dynamically from gap-space, kernel also allocates two KSessionRequests from gap-space and frees them to the KSessionRequest slabheap.
**** Allocator for this uses an intrusive red black tree on in-place nodes in the gaps.
* Minor changes to the atomic operations for slab heaps.
*** Slab heap initialization now panics if L1 cache is direct-mapped (1-way associative).
*** Slab heap allocation no longer issues a clrex on failure.
*** For types supporting the new dynamic allocation, Slab heap free now checks that the object lives within the slab region instead of panicking when object is not within slab extents.
* The interrupt task manager thread no longer exists, functionality has been rolled into KScheduler.
** KScheduler now has member pointer to the interrupt task manager for the current core.
** KScheduler::EnableScheduling now sends scheduler interrupt unconditionally, regardless of disable count.
** KScheduler::RescheduleCurrentCore now uses double-checked-locking-esque strategy for checking scheduling necessity around interrupt disables.
** KScheduler::Schedule now processes interrupt tasks directly (calls a KInterruptTaskManager member function) rather than setting the interrupt task thread to runnable.
* KInterruptEventTask no longer contains a KLightLock member.
** KSchedulerLock is used in places where interrupt events were locked previously.
* KSchedulerInterruptTask is now a KInterruptHandler, rather than a KInterruptTask (no ::DoTask() implementation, any more).
* KProcess::AddSharedMemory now sets all fields in one block/scope, rather than two.
* KWorkerTaskManager::Initialize now hardcodes id=0 instead of taking it as a parameter.
** KWorkerTaskManager no longer has "id"/"active" fields.
* Certain unnecessary conditionals were optimized in KServerSession::SendReply/ReceiveMessage.
** Code of the form `x = condition ? a : b` with condition's value fixed for the block was optimized to `x = a`.
** This may just be a relic of compiler upgrade mentioned above.
* Minor changes to GetInfo:
** Logic which previously disabled interrupt for profiling InfoTypes now instead disables dispatch (KScopedDisableDispatch instead of KScopedDisableInterrupt).
** InfoType_ThreadTickCount has had its value changed from 0xF0000002 to 0x19. This is presumably to generate better asm for the switch statement.
* SendAsyncRequestWithUserBuffer now accepts ResultThreadTerminating as a success result (it does not unlock memory when it is returned).
* KClientSession::SendSyncRequest/SendAsyncRequest no longer hold the scheduler lock while calling KServerSession::OnRequest.
** Lock is now acquired as needed by KServerSession::OnRequest itself.
* KClientSession, KLightClientSession, KLightServerSession no longer inherit from KSlabAllocated/KAutoObjectWithList, and are now correspondingly smaller.
* KResourceLimit::Allocate() now calls KAutoObject::Create().
* KPrintf has been replaced with a function which takes a non-format string, and prints the string, then <current program ID formatted as %016lx>, then a newline.
** "Break() called. %016lx\n" and "Exception occurred. %016lx\n" are now "Break() called. " and "Exception occurred. ", respectively.
* StoreDataCacheSharedForInit has slightly different (but equivalent) iteration logic.

===[[Bluetooth_Driver_services|bluetooth]]===
* New btdrv commands were added.
* A number of funcs now [[Switch_System_Flaws|clear]] stack buffers before sending it elsewhere.
* A new system-setting is now used during [[Bluetooth_Driver_services#EnableBluetooth|audio-enabling]].
* ...

==See Also==
System update report(s):
* [https://yls8.mtheall.com/ninupdates/reports.php?date=2021-09-15_00-05-06&sys=hac]

{{NavboxVersions}}

[[Category:System versions]]

13.1.0

2026-08-06T00:43:29Z

Yellows8:

The Switch 13.1.0 system update was released on October 26, 2021 (UTC). This Switch update was released for the following regions: ALL, and CHN.

Security flaws fixed: <fill this in manually later, see the updatedetails page from the ninupdates-report page(s) once available for now>.

==Change-log==
[https://en-americas-support.nintendo.com/app/answers/detail/a_id/22525/kw/nintendo%20switch%20system%20update Official] ALL change-log:
* Added support for Nintendo Switch Online + Expansion Pack.
* General system stability improvements to enhance the user's experience.

==System Titles==
* The following sysmodules were updated: bluetooth, bcat, nifm, bsdsocket, hid, ldn, nvservices, account, ns, am, nim, btm, erpt, es, olsc.
* The following SystemData were updated: ErrorMessage, BrowserDll, Help, LocalNews, FirmwareDebugSettings, BootImagePackages, ControllerIcon, ControllerFirmware, SystemVersion/RebootlessSystemUpdateVersion.
* The following applets were updated: qlaunch, [[Profile_Selector|playerSelect]], [[Internet_Browser|web-applets]], overlayDisp, [[Album_Applet|photoViewer]], [[MyPage_Applet|myPage]].

The following sysmodules had IPC changes: bcat, ldn, account, ns, nim, btm, es, olsc.

NPDM changes:
* bcat: Access to ovln:snd and sprof:sp were added.
* olsc: Access to mnpp:sys was added, see [[Services_API]] for the service-host change.
* qlaunch: Access to mnpp:sys and spbg:sp were added.
* [[Internet_Browser|LibAppletLns]]: Access to caps:ss and mnpp:web were added.

RomFs changes:
* ErrorMessage: updated
* BrowserDll: Updated "/browser/MediaControlsInline.js", "/buildinfo/buildinfo.dat", localization data under "/message/". Updated the NROs under "/nro/netfront/core_0/" and /nro/netfront/core_1/".
* Help: Updated "/legallines.htdocs/index.html" and "/safe.htdocs/html/CNzh/index.html".
* LocalNews: Updated "/message/CNzh/localNews.msbt.szs" and "/message/revision.txt".
* FirmwareDebugSettings: [[System_Settings|updated]]
* ControllerIcon: Updated "/lyt/footer/800/controllerIcon.bntx" and "/lyt/footer/800/info.dat".
* ControllerFirmware: Updated "/TouchScreenFirmwareInfo.csv". Added "/FTS_50000001.ftb" and removed "/FTS_98000004.ftb".
* Applets: Updated various UI data (and for web-applets, updated "/buildinfo/buildinfo.dat" and "/.nrr/modules.nrr").

=== BootImagePackages ===
RomFs changes:
* "/nx/package2" updated

====Kernel====
* SDK version bump from 13.3.0.0 to 13.4.0.0.
* KSchedulerLock::Unlock now performs a data memory barrier (inner shareable) before performing scheduling.
* KScheduler::Scheduler now performs a data memory barrier before returning, when the next thread is the current thread.
** These changes probably go together, to prevent asynchronous reordering of these operations across cores.

===[[Bluetooth_Driver_services|bluetooth]]===
Error handling (or minor other changes) in various bt-audio funcs were updated.

The func for the "nn.bluetooth.HidMessageHandler" thread was updated.

==See Also==
System update report(s):
* [https://yls8.mtheall.com/ninupdates/reports.php?date=2021-10-26_00-15-05&sys=hac]

{{NavboxVersions}}

[[Category:System versions]]

13.2.1

2026-08-06T00:42:07Z

Yellows8:

The Switch 13.2.1 system update was released on January 20, 2022 (UTC). This Switch update was released for the following regions: ALL, and CHN.

Security flaws fixed: yes.

==Change-log==
[https://en-americas-support.nintendo.com/app/answers/detail/a_id/22525/kw/nintendo%20switch%20system%20update Official] ALL change-log:
* General system stability improvements to enhance the user's experience.

==System Titles==
The following was updated: [[System_Version_Title|SystemVersion]], BootImagePackages, [[Bluetooth_Driver_services|bluetooth]], [[SSL_services|ssl]].

There were no sysmodule IPC changes, and the only NPDM changes were the usual version bump. The only RomFs changes were the usual SystemVersion changes, and see below for BootImagePackage.

=== BootImagePackages ===
RomFs changes: all files updated.

The anti-downgrade fuses were [[Fuses#Anti-downgrade|updated]].

=== [[Bluetooth_Driver_services|bluetooth]] ===
Only 1 func was changed, which fixed a [[Switch_System_Flaws|vuln]].

=== [[SSL_services|ssl]] ===
The only changes were in NSS, which fixed a [[Switch_System_Flaws|vuln]].

==See Also==
System update report(s):
* [https://yls8.mtheall.com/ninupdates/reports.php?date=2022-01-20_00-05-05&sys=hac]

{{NavboxVersions}}

[[Category:System versions]]

14.0.0

2026-08-06T00:41:11Z

Yellows8:

The Switch 14.0.0 system update was released on March 22, 2022 (UTC). This Switch update was released for the following regions: ALL.

Security flaws fixed: <fill this in manually later, see the updatedetails page from the ninupdates-report page(s) once available for now>.

==Change-log==
[https://en-americas-support.nintendo.com/app/answers/detail/a_id/22525/kw/nintendo%20switch%20system%20update Official] ALL change-log:
* "Groups" feature was added to the All Software menu.
*
* You can now create groups of software to help organize your software titles.
* Making groups for different game genres, developers, or whatever you’d like to organize by may make it easier to find the application you want.
*
* Up to 100 groups can be created with a max of 200 titles per group.
*
*
* The button to proceed to the "All Software" screen is displayed only when there are 13 or more software title icons on the system.
* For more information, see How to Create Groups of Software.
*
* Bluetooth® Audio volume behavior was changed.
*
* You can now adjust the volume of Bluetooth audio devices using either the Nintendo Switch™ console or through volume control buttons on the Bluetooth audio device.
*
* The Bluetooth audio device must support AVRCP profiles for these changes to work.
*
*
* The volume displayed on the console will reflect the Bluetooth audio volume when using the device’s control buttons.
* The maximum volume output for some Bluetooth audio devices has been increased.
*
* When first connecting a device, volume will be reduced to avoid sudden loudness.
* For more information, see How to Pair and Manage Bluetooth Audio Devices.
*
*
*
*

==System Titles==
* New sysmodule omm was added, various hosted services from am were moved here.
* Most system titles were updated, except for the following (besides stubs): both Dictionary SystemData, AvatarImage, Eula, UrlBlackList, ControllerIcon, ApplicationBlackList, FunctionBlackList.

[[NPDM]] changes:
* ptm had the order of various accessible-services changed.
* pcv: access to IO page 0x07009f000 was removed. The order of various hosted/accessible-services changed. Access to fsp-srv, pwm, and set:cal were removed.
* ns now has access to pm:info.
* am: access to svcSleepSystem was removed. FS permission bitmask 0x0000000080000000 was removed. Hosted services idle:sys, omm, and spsm were removed. Access to the following services were removed: bgtc:sc, bgtc:t, bpc, cec-mgr, gpio, hshl:set, hshl:sys, led, psc:c, psc:m, psm, tc, time:p, usb:hs, usb:pd, usb:pd:c, vi:m/vi:s, xcd:sys. Access to the following services were added: idle:sys, ommdisp, spsm.
* qlaunch had access to nd:sys removed.
* cabinet had a duplicate service-access entry for set:sys removed.
* playerSelect had a duplicate service-access entry for acc:su removed.
* starter now has access to audctl.

RomFs changes:
* ErrorMessage: various errors added / localization updated.
* BrowserDll:
** "/browser/ErrorPageFilteringTemplate.html" updated
** "/browser/ErrorPageSubFrameTemplate.html" updated
** "/browser/ErrorPageTemplate.html" updated
** "/browser/MediaControlsInline.css" updated
** "/browser/MediaControlsInline.js" updated
** "/browser/RootCaEtc.pem" and "/browser/RootCaSdkAdditional.pem" updated
** "/buildinfo/buildinfo.dat" updated
** "/lyt/Dialog/DAuthentication.arc" updated
** Various localization data under "/message/" was updated.
** The NROs under "/nro/netfront/core_0/" were moved to "/nro/netfront/core_0/default/cfi_disabled".
** The NROs under "/nro/netfront/core_1/" were moved to "/nro/netfront/core_2/default/cfi_enabled" (the core_1 directory was removed).
** "/sound/" was added, which contains "cruiser.bfsar".
* Help: "/legallines.htdocs/index.html" updated
* LocalNews: "/message/revision.txt" updated
* FirmwareDebugSettings/PlatformConfigIcosa/PlatformConfigCopper/PlatformConfigHoag/PlatformConfigIcosaMariko/PlatformConfigAula: [[System_Settings|updated]]
* ControllerFirmware:
** "/FirmwareInfo.csv" and "/TouchScreenFirmwareInfo.csv" updated
** "/FTS_50000001.ftb" removed
** "/FTS_50000002.ftb" added
** "/ukyosakyo_ep2_ota.bin" updated
* NgWordT: "/mars_dirty_words_db" updated
* Various graphics/UI/localization data was updated in various applets.
* web-applets: "/sound/" was removed, it's now located in BrowserDll. "/buildinfo/buildinfo.dat" and "/.nrr/modules.nrr" were updated.

=== BootImagePackages ===
RomFs changes: all files updated.

Using updated master-key: master_key_0d (previously master_key_0c). See [[NCA]] for the KeyGeneration listing.

[[Package2|INI1]] changes:
* BootImagePackage:
** 0100000000000003 (ProcessMana): SVC access: added GetResourceLimitPeakValue.
* BootImagePackageSafe:
** 0100000000000003 (ProcessMana): SVC access: added GetResourceLimitPeakValue.
* BootImagePackageExFat:
** 0100000000000003 (ProcessMana): SVC access: added GetResourceLimitPeakValue.
* BootImagePackageExFatSafe:
** 0100000000000003 (ProcessMana): SVC access: added GetResourceLimitPeakValue.

====Secure Monitor====
* Compiler upgrade to latest llvm (now using same compiler revision as kernel).
** Secure Monitor is now compiled with -fomit-frame-pointer.
*** >:(
* GenerateSeTestVectorImpl now uses a helper to mix each key into the vector.
* ExceptionHandler is now linked in (@ .text + 0x3E04).
** Previously, this was garbage collected/only present in debug secure monitors.
** NOTE: This is unreachable, and stripped (as e.g. logging isn't emitted, likely because the macros are empty on release builds).

====Kernel====
* Kernel is now compiled with -O3 again instead of -Os
** >:(
* crt0 no longer supports booting in EL2.
** Infinite Loop/Panic is performed instead.
* Initialize0 changes:
** KernelStack setup now uses same helper to determine aslr as other random aligned regions.
** KernelTemp setup now uses same helper to determine aslr as other random aligned regions.
* Slab changes:
** When assigned extra resource, the slab heap is now 0x148000 larger instead of 0x68000 larger.
** Correspondingly, instead of increasing the thread resource limit by 160, the thread resource limit is now increased by 736.
*** This corresponds to changes in userland for pm management of resource limits.
*** Old Intended Resource Limits:
**** System (96 + 512) -> (256 + 512)
**** Applet 96 -> 96
**** Application 96 -> 96
*** New Intended Resource Limits:
**** System (96 + 512) -> 1024
**** Applet 96 -> 256
**** Application 96 -> 256
* SetupPoolPartitionMemoryRegions now panics if the end of the pool partition region is not coincidence with the end of dram.
* KThreadContext was completely revised.
** Most of KThreadContext is now stored inline in kernel stack.
*** Kernel stack layout is now u8 stack[0xDB0]; KThreadContext thread_context; KThreadStackParameters stack_parameters;
** KThreadContext now only stores the 8 callee-save FPU registers.
*** The remaining 24 caller-save FPU registers are stored inside KThread, where KThreadContext used to be.
*** NOTE that 32-bit fpu has 4 callee-save FPU registers and 12 caller-save registers, which use the start of the relevant 64-bit storages as usual.
** KThreadStackParameters was revised to facilitate this.
*** The pointer to KThreadContext previously stored in stack parameters now points to the external FPU register array.
*** The members at end of params are now: u16 disable_count; u8 current_svc_id; u8 unused_2c; u8 exception_flags; u8 is_pinned; u8 unused_2f;
**** The "exception_flags" field is a new set of bitflags (encoding old state was were previously separate bools + new state).
***** Bit 0x1 = is_calling_svc
***** Bit 0x2 = is_in_exception_handler
***** Bit 0x4 = is_fpu_state_restore_needed
***** Bit 0x8 = is_64_bit_fpu
***** Bit 0x10 = has_exception_svc_permissions
***** Bit 0x20 = is_in_cache_operation
***** Bit 0x40 = is_in_tlb_operation
** Exception exits now check is_fpu_state_restore_needed, and restore FPU registers only if needed (and clear is_fpu_state_restore_needed on restore).
*** is_fpu_state_restore_needed is set to true *only* on thread switch with FPU enabled.
**** Caller-save FPU registers are saved *only* if a thread is in an SVC and does not have exception svc permissions.
**** All other thread switches save only the 8 (or 4) callee-save FPU registers.
**** All thread switches now guarantee as post-condition that the fpu is disabled leaving the switch (it will be re-enabled on exception exit if needed).
*** On SVC exception return, all caller-save FPU registers are set to zero unless the thread has exception svc permissions.
** KThread::CloneFpuStatus now uses KScopedDisableInterrupt
* Various hw maintenance changes:
** KernelLdr no longer does cache maintenance by set/way when setting up initial identity mapping, no longer invalidates instruction cache/tlb, no longer does dsb after setting sctlr_el1.
** FlushEntireDataCacheLocal/Shared in init now perform dsb sy, FlushEntireDataCacheAndInvalidateTlbForInit no longer does after calling them.
** dsb sy/isb is now performed after setting sctlr_el1, when disabling mmu/icache.
** KInitialPageTable::Map no longer does dsb ish after all attribute writes.
*** Instead does it before writing table entries, and at the end of the function.
** KInitialPageTable::PhysicallyRandomize no longer does StoreEntireCacheForInit.
*** Now does dc cvac on randomized virtual address range, dsb ish, ic iallu, dsb ish, isb. (see weaker-barriers section of diff)
** KInitialPageTable::SwapBlocks now does dsb ish after memcpy to swap blocks.
** KInitialPageTable::Reprotect no longer does dsb ish before performing reprotection.
** KInitialProcessReader::Load no longer calls cpu::FlushEntireDataCache/cpu::InvalidateInstructionCache.
** Set/way cache operations now perform dsb sy before configuring csselr.
*** This affects InvalidateDataCacheForResumeEntry, FlushEntireDataCache, KCacheHelperInterruptHandler, and the initial cache maintenance when disabling the mmu.
** FlushEntireDataCache now does dsb sy after doing full set/way cache flush, instead of after each set/way op.
*** NOTE: This is still only a local flush without coherence guarantees, set/way aren't supposed to be used after multiple cores are online.
** KSystemControl::CpuSleepHandler no longer embeds unreachable cache maintenance assembly after CpuSuspend.
** Kernel now performs different hw maintenance if a thread is in a hw maintenance operation when interrupted:
*** If a thread is interrupted while performing cache maintenance in EL1 (tracked via new exception flags bit 0x20), KInterruptManager::OnHandleInterrupt performs dsb sy.
**** Set and cleared for scope of cpu::InvalidateDataCache instead of disabling core migration.
**** Set and cleared for scope of cpu::StoreDataCache instead of disabling core migration.
**** Set and cleared for scope of cpu::FlushDataCache instead of disabling core migration.
*** If a thread is interrupted while performing tlb maintenance in EL1 (tracked via new exception flags bit 0x40), KInterruptManager::OnHandleInterrupt performs dsb ish.
**** Set and cleared for scope of KPageTable::NoteUpdated
*** If a thread is interrupted while performing cache maintenance in EL0 (tracked via new bool @ TLS + 0x104), KInterruptManager::OnHandleInterrupt performs dsb sy.
**** This is equivalent to the EL1 cache maintenance tracking above, providing an opt-in way for userland to ensure its cache maintenance is coherent even when interrupted.
**** Note that official userland code now sets this bit before performing cache maintenance.
** Memory barriers were revised in many places -- barriers were weakened in many places, and some functions which previously lacked barriers had them added, including:
*** cpu::InvalidateEntireInstructionCache: dsb sy -> dsb ish
*** cpu::EnsureInstructionConsistency: dsb sy; isb; -> dsb ish; isb;
**** NOTE: Functions written in assembly still use the old pattern for ensuring instruction consistency.
*** KCacheInterruptHandler::RequestOperation: dsb sy -> dsb ish
*** KScheduler::EnableScheduling: dsb sy -> dsb ish
*** KScheduler::SwitchThread no longer does dsb sy before setting ttbr0/contextidr_el1.
*** KPageTable::NoteUpdated: dsb sy; if (m_kernel) { ... dsb sy; } else { ... dsb sy; isb; } -- dsb ishst; if (m_kernel) { ... dsb ish; } else { ... dsb ish; isb; }
**** KPageTable::NoteSingleKernelPageUpdated now similarly does dsb ishst for outer and dsb ish for inner barriers.
*** KPageTable::ClearPageTable: now does dsb ish after clearing page to zero via dc zva
*** KPageTable::MapContiguous: now does dsb ishst after merging pages.
*** KPageTable::MapPageGroup: now does dsb ishst after merging pages.
*** KPageTable::PteDataSynchronizationBarrier: now dmb ishst instead of dsb ish (probably KPageTable::PteDataMemoryBarrier, now?)
*** KPageTable::MapL2Blocks/MapL3Blocks: pattern for setting entry for new table went from Barrier(); WriteEntry(); Barrier(); -> Barrier(); WriteEntry();
**** This was PteDataSynchronizationBarrier(), and correspondingly asm is dsb ish; str; dsb ish; -> dmb ishst; str;
*** KSupervisorPageTable::SetTtbr0 no longer does dsb sy before setting ttbr0/contextidr_el1.
** UserspaceAccess::InvalidateInstructionCache was removed (previously unused).
* Various changes to KInterruptName/interrupt management:
** Enum values for IPIs were revised:
*** KInterruptName_ThreadTerminate 4 -> 0
*** KInterruptName_CacheOperation 5 -> 1
*** KInterruptName_Scheduler 6 -> 2
** New KInterruptName (KInterruptName_CoreBarrier) = 3
*** Interrupt handler for this is registered with KInterruptControllerPriority_Scheduler after ThreadTerminate handler is registered.
** Interrupt handler for the user cycle counter interrupt is no longer registered.
*** This is presumably now under the same ifdef that enables svc::InfoType_PerformanceCounter.
* KCapability now has a new member "physical_core_mask", which tracks what physical cores are allowable.
** KThread::FinishTermination now calls a new function (cpu::ForceSynchronizeAllCores) after waiting for the thread to not be current on any scheduler.
*** This function sends an IPI (KInterruptName_CoreBarrier) to all cores in a specified mask (other than the current one), and waits for them to acknowledge the interrupt.
* Changes to KMemoryManager allocation:
** KPageHeap now has an additional KPageHeapBitmapRng @ 0x328 to facilitate additional allocation randomization.
** KMemoryManager::AllocateAndOpenContinuous now uses a new KPageHeap method "AllocateRandomBlock"
*** KPhysicalAddress KPageHeap::AllocateRandomBlock(s32 index, size_t num_pages, size_t align_pages);
*** This method allocates `num_pages` pages (aligned to at least `align_pages`) at random.
**** First, the kernel chooses a random block index to allocate from.
***** This is done by increasing the block index until there are at least 4 possible random choices for the desired alignment, then selecting the block that corresponds to a random pick from those choices.
**** Next, the kernel allocates a random block from within that index.
**** Finally, the kernel selects a random (align_pages)-aligned offset within that block, frees the memory before/after the allocated chunk, and returns the memory.
** Allocation of KPageGroups still uses a `random` argument, however:
*** KPageHeap::PopBlock no longer takes a random argument.
*** KPageHeap::AllocateBlock now calls new new KPageHeap method "AllocateRandomBlock".
**** KPageHeap::AllocateRandomBlock(s32 index, size_t num_pages);
**** This is effectively the same logic as above, but with align_pages == # of pages for the argument block index.
* CreateProcess now calls a new function to validate the user-capabilities before creating the KProcess.
** This checks that the capabilities are user-readable and that the map region capabilities correspond to actually-present regions.
** This corresponds to changes in Loader allowing for map region capabilities (previously, these were only allowed via KIP, and Loader always rejected them).
* New InfoType 0x1A ("InfoType_IsSvcPermitted").
** Returns whether the current process can access a given SVC.
** Nintendo returns InvalidCombination when checking SVCs other than SynchronizePreemptionState.
*** Official userland code now aborts if the process does not have permission to use SynchronizePreemptionState before incrementing ThreadLocalRegion->disable_count for the first time.

=== IPC Interface Changes ===
* The following new interfaces were added:
** nn::sprofile::srv::IServiceGetter
* The following interfaces were changed:
** nn::account::detail::IUserStateManager
*** Added command 900 - inbytes: 24, outbytes: 0
*** Added command 901 - inbytes: 24, outbytes: 0
*** Added command 902 - buffers: [10], inbytes: 8, outbytes: 4
** nn::am::service::IAppletCommonFunctions
*** Added command 80 - inbytes: 1, outbytes: 0
*** Added command 81 - inbytes: 1, outbytes: 0
** nn::am::service::IApplicationFunctions
*** Added command 36 - inbytes: 0, outbytes: 1
*** Added command 37 - inbytes: 0, outbytes: 0, outhandles: [1]
** nn::am::service::IDebugFunctions
*** Added command 140 - inbytes: 0, outbytes: 0
** nn::am::service::IOverlayFunctions
*** Added command 21 - inbytes: 1, outbytes: 0
** nn::audioctrl::detail::IAudioController
*** Removed command 11 - inbytes: 4, outbytes: 0
*** Removed command 12 - inbytes: 0, outbytes: 4
*** Removed command 19 - inbytes: 0, outbytes: 0, outhandles: [1]
*** Removed command 20 - inbytes: 0, outbytes: 0, outhandles: [1]
*** Removed command 21 - inbytes: 0, outbytes: 4
*** Removed command 25 - inbytes: 0, outbytes: 9
*** Removed command 28 - inbytes: 0, outbytes: 4
*** Removed command 29 - inbytes: 0, outbytes: 0, outhandles: [1]
*** Added command 35 - inbytes: 8, outbytes: 0
*** Added command 36 - inbytes: 0, outbytes: 8
*** Added command 37 - inbytes: 1, outbytes: 0
*** Added command 38 - inbytes: 0, outbytes: 1
*** Added command 39 - inbytes: 0, outbytes: 1
*** Added command 40 - buffers: [26], inbytes: 0, outbytes: 0
*** Added command 10100 - inbytes: 0, outbytes: 9
*** Added command 10101 - inbytes: 0, outbytes: 0, outhandles: [1]
*** Added command 10102 - inbytes: 0, outbytes: 0, outhandles: [1]
*** Added command 10103 - inbytes: 0, outbytes: 4
*** Added command 10104 - inbytes: 0, outbytes: 4
*** Added command 10105 - inbytes: 0, outbytes: 0, outhandles: [1]
*** Added command 10106 - inbytes: 0, outbytes: 4
** nn::bluetooth::IBluetoothDriver
*** Removed command 144 - inbytes: 0, outbytes: 0, outhandles: [1]
*** Removed command 145 - buffers: [10], inbytes: 0, outbytes: 4
*** Added command 150 - inbytes: 4, outbytes: 0, outhandles: [1]
*** Added command 151 - inbytes: 4, outbytes: 0, outhandles: [1]
*** Added command 152 - inbytes: 4, outbytes: 1
*** Added command 153 - inbytes: 8, outbytes: 0
*** Added command 154 - inbytes: 4, outbytes: 1
** nn::bpc::IBoardPowerControlManager
*** Removed command 6 - inbytes: 0, outbytes: 4
** nn::btm::IBtm
*** Added command 112 - inbytes: 7, outbytes: 0
*** Added command 113 - inbytes: 6, outbytes: 1
*** Added command 114 - inbytes: 6, outbytes: 1
*** Added command 115 - buffers: [10], inbytes: 4, outbytes: 4
** nn::clkrst::IClkrstSession
*** Added command 12 - inbytes: 4, outbytes: 1
*** Added command 13 - inbytes: 4, outbytes: 0
** nn::es::IActiveRightsContext
*** Added command 17 - buffers: [5, 5], inbytes: 1, outbytes: 0
*** Added command 214 - inbytes: 0, outbytes: 0, outhandles: [1]
*** Added command 215 - inbytes: 0, outbytes: 0
** nn::es::IETicketService
*** Removed command 4 - inbytes: 4, outbytes: 0
** nn::fatalsrv::IPrivateService
*** Added command 10 - buffers: [22], inbytes: 0, outbytes: 16
** nn::fssrv::sf::IFileSystemProxy
*** Added command 37 - buffers: [25], inbytes: 0, outbytes: 0
** nn::grcsrv::IRemoteVideoTransfer
*** Added command 3 - inbytes: 0, outbytes: 1
** nn::hid::IHidSystemServer
*** Added command 327 - buffers: [10], inbytes: 4, outbytes: 8
*** Added command 328 - inbytes: 16, outbytes: 1
*** Added command 329 - inbytes: 0, outbytes: 0
*** Added command 330 - inbytes: 8, outbytes: 0
*** Added command 506 - inbytes: 16, outbytes: 0
*** Added command 507 - inbytes: 16, outbytes: 0
** nn::mnpp::detail::ipc::IServiceForSystem
*** Removed command 200 - inbytes: 0, outbytes: 0
*** Added command 400 - inbytes: 0, outbytes: 1
** nn::mnpp::detail::ipc::IServiceForWebBrowser
*** Added command 1 - buffers: [5, 5, 6], inbytes: 16, outbytes: 0
*** Added command 10 - buffers: [6], inbytes: 16, outbytes: 1
*** Added command 20 - inbytes: 16, outbytes: 0
** nn::ndrm::low::detail::INdrmLowAdminInterface
*** Added command 37 - inbytes: 8, outbytes: 0, outhandles: [1]
*** Added command 38 - buffers: [6], inbytes: 8, outbytes: 4
*** Added command 39 - buffers: [6], inbytes: 8, outbytes: 4
*** Removed command 8003 - buffers: [6], inbytes: 8, outbytes: 4
** nn::nim::detail::INetworkInstallManager
*** Changed command 10 - outbytes: 72 -> 88 (final state: inbytes: 16, outbytes: 88)
*** Changed command 130 - inbytes: 0 -> 8 (final state: inbytes: 8, outbytes: 0, outhandles: [1], outinterfaces: ['nn::nim::detail::IAsyncData'])
*** Added command 135 - inbytes: 0, outbytes: 0
*** Added command 136 - inbytes: 16, outbytes: 0, outhandles: [1], outinterfaces: ['nn::nim::detail::IAsyncValue']
*** Added command 137 - inbytes: 16, outbytes: 4
** nn::nim::detail::IShopServiceManager
*** Added command 108 - buffers: [5], inbytes: 0, outbytes: 0
*** Removed command 303 - inbytes: 16, outbytes: 1
*** Removed command 305 - inbytes: 16, outbytes: 0, outhandles: [1], outinterfaces: ['nn::nim::detail::IAsyncResult']
*** Removed command 400 - inbytes: 4, outbytes: 16
*** Removed command 401 - inbytes: 16, outbytes: 4
*** Added command 600 - inbytes: 0, outbytes: 1
*** Added command 601 - inbytes: 0, outbytes: 0
** nn::ns::detail::IApplicationManagerInterface
*** Added command 610 - inbytes: 16, outbytes: 1
*** Added command 2522 - inbytes: 16, outbytes: 0
*** Added command 3050 - buffers: [6], inbytes: 0, outbytes: 4
** nn::ns::detail::IDevelopInterface
*** Added command 20 - inbytes: 8, outbytes: 8
** nn::ns::detail::IDynamicRightsInterface
*** Added command 22 - inbytes: 8, outbytes: 1
*** Added command 23 - inbytes: 8, outbytes: 0, outhandles: [1]
*** Added command 24 - inbytes: 8, outbytes: 0
*** Added command 25 - inbytes: 0, outbytes: 0, outhandles: [1], outinterfaces: ['nn::ns::detail::IAsyncResult']
** nn::ns::detail::IECommerceInterface
*** Added command 7 - inbytes: 16, outbytes: 0, outhandles: [1], outinterfaces: ['nn::ns::detail::IAsyncValue']
** nn::omm::detail::IOperationModeManager
*** Added command 500 - inbytes: 8, outbytes: 0
*** Added command 501 - inbytes: 8, outbytes: 0
*** Added command 900 - inbytes: 0, outbytes: 0
** nn::pcie::detail::ISession
*** Changed command 4 - outbytes: 24 -> 32 (final state: inbytes: 8, outbytes: 32)
** nn::pm::detail::IDebugMonitorInterface
*** Added command 7 - inbytes: 8, outbytes: 8
** nn::pm::detail::IInformationInterface
*** Added command 1 - inbytes: 0, outbytes: 24
*** Added command 2 - inbytes: 0, outbytes: 24
** nn::pm::detail::IShellInterface
*** Added command 10 - inbytes: 0, outbytes: 0
** nn::pwm::IChannelSession
*** Removed command 2 - inbytes: 4, outbytes: 0
*** Removed command 3 - inbytes: 0, outbytes: 4
** nn::settings::ISystemSettingsServer
*** Added command 207 - inbytes: 0, outbytes: 1
*** Added command 208 - inbytes: 1, outbytes: 0
*** Added command 209 - inbytes: 0, outbytes: 8
*** Added command 210 - inbytes: 8, outbytes: 0
** nn::ssl::sf::ISslService
*** Added command 9 - inbytes: 0, outbytes: 0
** nn::ts::server::IMeasurementServer
*** Removed command 2 - inbytes: 2, outbytes: 0
*** Removed command 3 - inbytes: 1, outbytes: 4
** nn::ts::server::ISession
*** Removed command 1 - inbytes: 0, outbytes: 4
*** Removed command 3 - inbytes: 0, outbytes: 4
** nn::uart::IPortSession
*** Added command 8 - inbytes: 40, inhandles: [1, 1], outbytes: 0

===[[JIT_services|jit]]===
Some minor [[JIT_services|issues]] were [[Switch_System_Flaws|fixed]].

==See Also==
System update report(s):
* [https://yls8.mtheall.com/ninupdates/reports.php?date=2022-03-22_00-05-06&sys=hac]

{{NavboxVersions}}

[[Category:System versions]]

News

2026-08-06T00:31:54Z

Yellows8: Undo revision 14870 by Yls8bot (talk)

News/Archive

2026-08-06T00:31:42Z

Yellows8:

*'''13 January 26''' Nintendo released system update [[21.2.0]].
*'''9 December 25''' Nintendo released system update [[21.1.0]].
*'''25 November 25''' Nintendo released system update [[21.0.1]].
*'''11 November 25''' Nintendo released system update [[21.0.0]].
*'''30 September 25''' Nintendo released system update [[20.5.0]].
*'''2 September 25''' Nintendo released system update [[20.4.0]].
*'''29 July 25''' Nintendo released system update [[20.3.0]].
*'''15 July 25''' Nintendo released system update [[20.2.0]].
*'''19 June 25''' Nintendo released system update [[20.1.5]].
*'''3 June 25''' Nintendo released system update [[20.1.1]].
*'''28 May 25''' Nintendo released system update [[20.1.0]].
*'''2 May 25''' Nintendo released system update [[20.0.1]].
*'''30 April 25''' Nintendo released system update [[20.0.0]].
*'''7 January 25''' Nintendo released a rebootless system update for [[19.0.1]].
*'''29 October 24''' Nintendo released system update [[19.0.1]].
*'''8 October 24''' Nintendo released system update [[19.0.0]].
*'''2 July 24''' Nintendo released a rebootless system update for [[18.1.0]].
*'''11 June 24''' Nintendo released system update [[18.1.0]].
*'''23 April 24''' Nintendo released system update [[18.0.1]].
*'''26 March 24''' Nintendo released system update [[18.0.0]].
*'''20 February 24''' Nintendo released a rebootless system update for [[17.0.1]].
*'''5 December 23''' Nintendo released system update [[17.0.1]].
*'''21 November 23''' Nintendo released a rebootless system update for [[17.0.0]].
*'''11 October 23''' Nintendo released system update [[17.0.0]].
*'''22 August 23''' Nintendo released system update [[16.1.0]].
*'''9 May 23''' Nintendo released system update [[16.0.3]].
*'''18 April 23''' Nintendo released system update [[16.0.2]].
*'''23 March 23''' Nintendo released system update [[16.0.1]].
*'''21 February 23''' Nintendo released system update [[16.0.0]].
*'''1 November 22''' Nintendo released system update [[15.0.1]].
*'''11 October 22''' Nintendo released system update [[15.0.0]].
*'''14 June 22''' Nintendo released system update [[14.1.2]].
*'''19 April 22''' Nintendo released system update [[14.1.1]].
*'''5 April 22''' Nintendo released system update [[14.1.0]].
*'''22 March 22''' Nintendo released system update [[14.0.0]].
*'''20 January 22''' Nintendo released system update [[13.2.1]].
*'''1 December 21''' Nintendo released system update [[13.2.0]].
*'''26 October 21''' Nintendo released system update [[13.1.0]].
*'''15 September 21''' Nintendo released system update [[13.0.0]].
*'''6 July 21''' Nintendo released system update [[12.1.0]].
*'''12 June 21''' [https://devkitpro.org/viewtopic.php?f=13&t=9226&p=17113#p17113 libnx v4.1.0 released].
*'''8 June 21''' Nintendo released system update [[12.0.3]].
*'''12 May 21''' Nintendo released system update [[12.0.2]].
*'''20 April 21''' Nintendo released system update [[12.0.1]].
*'''6 April 21''' Nintendo released system update [[12.0.0]].
*'''9 March 21''' Nintendo released a rebootless system update for [[11.0.1]].
*'''11 December 20''' Nintendo released system update [[11.0.1]].
*'''1 December 20''' Nintendo released system update [[11.0.0]].
*'''15 September 20''' Nintendo released system update [[10.2.0]].
*'''28 July 20''' Nintendo released system update [[10.1.1]].
*'''14 July 20''' Nintendo released system update [[10.1.0]].
*'''5 June 20''' Nintendo released system update [[10.0.4]].
*'''26 May 20''' Nintendo released system update [[10.0.3]].
*'''11 May 20''' [https://devkitpro.org/viewtopic.php?f=13&t=9058 devkitA64 r15, libnx v3.2.0, deko3d v0.2.0, switch-examples v20200511] and [https://github.com/switchbrew/nx-hbloader/releases/tag/v2.3.2 nx-hbloader v2.3.2] released.
*'''30 April 20''' Nintendo released system update [[10.0.2]].
*'''22 April 20''' Nintendo released system update [[10.0.1]].
*'''14 April 20''' Nintendo released system update [[10.0.0]].
*'''4 April 20''' [https://devkitpro.org/viewtopic.php?f=13&t=9035 libnx v3.1.0, switch-examples v20200404 and deko3d v0.1.0 released]. On the 6th nx-hbmenu v3.3.0 was [https://github.com/switchbrew/nx-hbmenu/releases/latest released].
*'''2 April 20''' [https://github.com/switchbrew/nssu-updater nssu-updater] and [https://github.com/switchbrew/contents-delivery-manager contents-delivery-manager] were released.
*'''3 March 20''' Nintendo released system update [[9.2.0]].
*'''10 December 19''' [https://devkitpro.org/viewtopic.php?f=13&t=8989 libnx v3.0.0, switch-examples v20191211, Atmosphère v0.10.1, nx-hbmenu v3.2.0, and nx-hbloader v2.3.0 released].
*'''4 December 19''' Nintendo released system update [[9.1.0]].
*'''30 September 19''' Nintendo released system update [[9.0.1]].
*'''14 September 19''' [https://devkitpro.org/viewtopic.php?f=13&t=8964 libnx v2.5.0 and switch-examples v20190914 released]. nx-hbmenu v3.1.1 [https://github.com/switchbrew/nx-hbmenu/releases/tag/v3.1.1 released]. [https://github.com/Atmosphere-NX/Atmosphere/releases/tag/0.9.4 Atmosphère 0.9.4 released with support for 9.0.0].
*'''9 September 19''' Nintendo released system update [[9.0.0]].
*'''10 July 19''' Nintendo [https://twitter.com/NintendoAmerica/status/1148934589026455552 announced] the Nintendo Switch Lite system.
*'''17 June 19''' Nintendo released system update [[8.1.0]].
*'''1 May 19''' [https://devkitpro.org/viewtopic.php?f=13&t=8908 libnx v2.2.0 and switch-examples v20190501] released.
*'''23 April 19''' Nintendo released system update [[8.0.1]].
*'''15 April 19''' Nintendo released system update [[8.0.0]].
*'''29 March 19''' [https://devkitpro.org/viewtopic.php?f=13&t=8891 devkitA64 r13] and [https://github.com/switchbrew/libnx/releases/tag/v2.1.0 libnx v2.1.0] released with pthread/std::thread support.
*'''26 March 19''' [https://github.com/Atmosphere-NX/Atmosphere/releases/tag/0.8.6 Atmosphère v0.8.6] released with lots of bugfixes, more cheat stuff and web applet homebrew support.
*'''21 February 19''' [https://github.com/Atmosphere-NX/Atmosphere/releases/tag/0.8.4 Atmosphère v0.8.4] released with 7.0.x support.
*'''18 February 19''' Nintendo released system update [[7.0.1]].
*'''28 January 19''' Nintendo released system update [[7.0.0]].
*'''24 January 19''' [https://github.com/Atmosphere-NX/Atmosphere/releases/tag/0.8.3 Atmosphère v0.8.3] and [https://github.com/switchbrew/nx-hbloader/releases/tag/v2.1.0 nx-hbloader v2.1.0] were released.
*'''2 January 19''' [https://devkitpro.org/viewtopic.php?f=13&t=8826 libnx 2.0.0, switch-mesa 18.3 and switch-examples 20190102] were released.
*'''29 November 18''' [https://github.com/Atmosphere-NX/Atmosphere/releases/tag/0.8.0 Atmosphère v0.8.0] was released.
*'''29 November 18''' [https://github.com/switchbrew/nx-hbmenu/releases/latest nx-hbmenu v3.0.1] was released.
*'''28 November 18''' [https://devkitpro.org/viewtopic.php?f=13&t=8813 libnx 1.6.0 and switch-examples 20181128] were released.
*'''19 November 18''' Nintendo released system update [[6.2.0]].
*'''31 October 18''' [https://github.com/switchbrew/nx-hbloader/releases/tag/v2.0.1 nx-hbloader v2.0.1] was released.
*'''29 October 18''' [https://github.com/switchbrew/nx-hbmenu/releases/latest nx-hbmenu] v3.0.0 was released.
*'''29 October 18''' Nintendo released system update [[6.1.0]].
*'''27 October 18''' [https://devkitpro.org/viewtopic.php?f=13&t=8798 libnx 1.5.0 and switch-examples 20181027] were released.
*'''17 October 18''' [https://github.com/Atmosphere-NX/Atmosphere/releases/tag/0.7.0 Atmosphère v0.7.0] and [https://github.com/switchbrew/nx-hbloader/releases/tag/v2.0.0 nx-hbloader v2.0.0] were released.
*'''8 October 18''' Nintendo released system update [[6.0.1]].
*'''18 September 18''' Nintendo released system update [[6.0.0]].
*'''18 September 18''' [https://devkitpro.org/viewtopic.php?f=13&t=8784 libnx 1.4.1, switch-mesa v18.2β and switch-examples 20180918] were released.
*'''9 September 18''' [https://devkitpro.org/viewtopic.php?f=13&t=8780 libnx v1.4.0] was released alongside a Switch port of mesa/nouveau (GPU library).
*'''28 July 18''' [https://devkitpro.org/viewtopic.php?f=13&t=8761 devkitA64] r12 and [https://github.com/switchbrew/libnx/releases/tag/v1.3.1 libnx] v1.3.1 were released.
*'''8 July 18''' [https://github.com/switchbrew/libnx/releases/tag/v1.3.0 libnx] v1.3.0 was released.
*'''30 May 18''' Nintendo released system update [[5.1.0]].
*'''16 April 18''' Nintendo released system update [[5.0.2]].
*'''26 March 18''' Nintendo released system update [[5.0.1]].
*'''12 March 18''' Nintendo released system update [[5.0.0]].
*'''2 March 18''' [https://github.com/switchbrew/libnx/releases/tag/v1.1.0 libnx] v1.1.0 was released.
*'''28 February 18''' [https://github.com/switchbrew/nx-hbmenu/releases/latest nx-hbmenu] v2.0.0 was released.
*'''22 February 18''' [http://devkitpro.org devkitPro] released [https://devkitpro.org/viewtopic.php?f=13&t=8693 devkitA64 alpha7]
*'''18 February 18''' [https://switchbrew.github.io/nx-hbl/ nx-hbl] and [https://github.com/switchbrew/nx-hbmenu nx-hbmenu] were released.
*'''28 December 17''' The 34c3 Switch [https://events.ccc.de/congress/2017/Fahrplan/events/8941.html talk] took place, video available [https://media.ccc.de/v/34c3-8941-console_security_-_switch here].
*'''4 December 17''' Nintendo released system update [[4.1.0]].
*'''25 October 17''' Nintendo released system update [[4.0.1]].
*'''18 October 17''' Nintendo released system update [[4.0.0]].
*'''17 September 17''' [https://github.com/switchbrew/libnx libnx] was made public, with examples available [https://github.com/switchbrew/switch-examples here].
*'''5 September 17''' Nintendo released system update [[3.0.2]].
*'''31 July 17''' Nintendo released system update [[3.0.1]].
*'''19 June 17''' Nintendo released system update [[3.0.0]].
*'''15 May 17''' Nintendo released system update [[2.3.0]].
*'''17 April 17''' Nintendo released system update [[2.2.0]].
*'''27 March 17''' Nintendo released system update [[2.1.0]].
*'''2 March 17''' Nintendo released system update [[2.0.0]].
*'''3 March 17''' Nintendo Switch global release.

10.0.0

2026-08-05T23:50:13Z

Yellows8:

The Switch 10.0.0 system update was released on April 14, 2020 (UTC). This Switch update was released for the following regions: ALL.

Security flaws fixed: <fill this in manually later, see the updatedetails page from the ninupdates-report page(s) once available for now>.

==Change-log==
[https://en-americas-support.nintendo.com/app/answers/detail/a_id/22525/kw/nintendo%20switch%20system%20update Official] ALL change-log:
* Added a bookmark feature to News.
* This feature allows you to bookmark your favorite news items.
*
* A maximum of 300 news items can be bookmarked.
* An internet connection is required to view bookmarked News items.
* News items that are no longer available cannot be viewed, even if they were bookmarked.
*
*
* Added an option to transfer software data between the system memory and an SD card.
*
* Users can now transfer downlopadable software, update data, and DLC from the system memory to an SD card (and vice versa).
* Note that save data and some update data cannot be transferred to an SD card.
*
*
* Added an option to remap the controller buttons.
*
* Analog stick and button configurations can now be changed for each paired controller.
* Custom configurations can be saved as favorites in System Settings > Controllers and Sensors.
*
* Custom configurations are stored on the Nintendo Switch system.
* Configurations can be customized for the following controllers: Joy-Con (L), Joy-Con (R), Nintendo Switch Pro Controller. Button configurations can also be customized on the Nintendo Switch Lite system.
* This feature is not available for other controllers.
* On each system, up to five favorite custom configurations can be saved for Joy-Con (L), five for Joy-Con (R), five for Nintendo Switch Pro Controller. Five configurations can also be saved as favorites for Nintendo Switch Lite.
*
*
*
*
* Added a new section in User Settings for Play Activity Settings.
*
* The options for "Display play activity to:" and "Delete Play Activity" have been moved from Friends Settings to the new Play Activity Settings.
*
*
* Added new selections to the lineup of user profile icons.
*
* Select from 6 new icons from the Animal Crossing: New Horizons game for your user.
*
*
* General system stability improvements to enhance the user's experience.

==System Titles==
* Sysmodules jit and pgl were added.
* All titles were updated, except for: ppc (was already stubbed), Chinese and Korean dictionaries, Dictionary, LocalNews, Eula, ControllerIcon, and flog.
* The following sysmodules had IPC changes: [[Filesystem_services|fs]], [[Loader_services|Loader]], [[NCM_services|ncm]], [[Settings_services|settings]], [[Bus_services|Bus]], [[Bluetooth_Driver_services|bluetooth]], [[BCAT_services|bcat]], [[Friend_services|friends]], [[PTM_services|ptm]], [[Sockets_services|bsdsockets]], [[HID_services|hid]], [[Audio_services|audio]], [[WLAN_services|wlan]], [[NV_services|nvservices]], [[PCV_services|pcv]], [[Account_services|account]], [[NS_Services|ns]], [[PSC_services|psc]], [[Applet_Manager_services|am]], [[NIM_services|nim]], [[Backlight_services|lbl]], [[BTM_services|btm]], [[Display_services|vi]], [[Parental_Control_services|pctl]], [[NPNS_services|npns]], [[Error_Upload_services|eupld]], [[Glue_services|glue]], [[ETicket_services|es]], [[Shared_Database_services|sdb]], [[OLSC_services|olsc]], [[NGCT_services|ngct]].

NPDM changes:
* The version was bumped. See [[Services_API]] for service-hosting changes.
* nifm now has access to pl:u.
* [[PTM_services|ptm]] now hosts lbl. lbl is now stubbed, there's no content besides the Meta and the ContentMetaType is now SystemData.
* [[Sockets_services|bsdsocket]] no longer has access to bgtc:t. It now has access to psc:l and time:al.
* The pcie.withoutHb sysmodule was renamed to pcie.
* The mapped IO range for wlan and pcie was updated.
* [[NS_Services|ns]] now has access to arp:w and pgl. Access to ldr:shel, ncm:v, and pm:shell were removed. Bitmask 0x0000001000000000 is now set in the FS permissions.
* [[SSL_services|ssl]] now has access to lm, but the sysmodule doesn't actually use it.
* [[Error_Upload_services|eupld]] now has access to srepo:u.
* [[Glue_services|glue]] no longer has access to bpc, and access to time:al was added.
** Prior to this sysupdate, no retail system-titles used time:al.
* [[GRC_services|grc]] now has access to time:su.
* [[creport]] no longer has access to ns:dev, and access to pgl was added.
* [[Shared_Database_services|sdb]] no longer has access to prepo:s, and access to srepo:u was added.
* [[OLSC_services|olsc]] now hosts a new [[Services_API|service]], and access to arp:r was added. [[SVC]]s svcMapTransferMemory and svcUnmapTransferMemory are now accessible.
* All web-applets now have access to [[SVC]]s svcMapPhysicalMemoryUnsafe/svcUnmapPhysicalMemoryUnsafe, but these aren't used in the main-codebin for any of these applets.
* [[MyPage_Applet|LibraryAppletMyPage]] now has access to npns:s.

RomFs changes:
* ErrorMessage has a number of new errors/modules, etc.
* BrowserDll:
** "/browser/ErrorPageFilteringTemplate.html" was updated.
** "/buildinfo/buildinfo.dat" was updated.
** The OSS NROs under /dll_0/ and /dll_1/ were updated.
** "/font/NintendoCruiserExt.ttf" was updated.
** "/lyt/Common/BtnFooter.arc" was updated.
** The localization under /message/ was updated.
* Help: "/legallines.htdocs/index.html" and "/safe.htdocs/html/CNzh/index.html" were updated.
* NgWord was updated.
* SsidList: "/ssid_list.csv" was updated.
* AvatarImage: new icons were added.
* UrlBlackList: The whitelists from the web-applets were moved into here:
** "/blacklist.txt" was replaced by "/listCommon.txt", which is the same except the following was inserted at the beginning: <code>---- </code>
** "/listEcGlobal.txt" and "/listEcChina.txt" were added, which contain the same content and are the same as the whitelist originally from LibraryAppletShop.
** "/listLnsGlobal.txt" and "/listLnsChina.txt" were added, these are the same except "/listLnsChina.txt" contains the following additional line: <code><nowiki>^https://([0-9A-Za-z\-]+\.)*qq\.com(/|$)</nowiki></code> Besides that line, these are the same as the whitelist originally from LibraryAppletLoginShare.
** "/listWebYouTubePlayerCommon.txt" was added, containing the same youtube whitelist originally from LibraryAppletWeb.
* TimeZoneBinary was updated with new timezone info.
* FontNintendoExtension: "/nintendo_ext2_003.bfttf" was updated.
* The config in FirmwareDebugSettings, PlatformConfigIcosa, PlatformConfigCopper, PlatformConfigHoag, and PlatformConfigIcosaMariko were updated.
* [[HID_services#Firmware_update|ControllerFirmware]] was updated with new firmware. See that page for the new files, and also regarding hid-sysmodule RomFs. The following files were updated:
** /ExpectVersionInfo-platform.hoag.csv
** /FirmwareInfo.csv
** /FirmwareInfo-platform.hoag.csv
** /sioh.bin
** /sioh_iap.bin
** /ukyosakyo_ep2_ota.bin
* NgWord2 was updated.
* NgWordT was updated.
* "/common/agl/agl_resource_min.Nin_Nx_NVN.release.sarc.szs" and "/common/shader/VarietyOceanShader_Nx.arc.szs" were updated in various applets. Various /lyt/, graphics, localization, and sound files were updated.
* LibraryAppletWeb, LibraryAppletShop, and LibraryAppletLoginShare: "/buildinfo/buildinfo.dat" and "/.nrr/netfront.nrr" were updated. "/whitelist" was removed, see UrlBlackList above.
* LibraryAppletOfflineWeb and LibraryAppletWifiWebAuth: "/buildinfo/buildinfo.dat" and "/.nrr/netfront.nrr" were updated.

=== BootImagePackages ===
RomFs changes: all files updated.

[[Package2|INI1]] changes:
* BootImagePackage:
** 0100000000000000 (FS): MainThreadStackSize updated: 0x8000 -> 0xC000. SVC access: added MapTransferMemory, UnmapTransferMemory.
** 0100000000000005 (boot): KernelCap IoMemoryMap: added BeginAddress=0x7000A000.
* BootImagePackageSafe:
** 0100000000000000 (FS): MainThreadStackSize updated: 0x8000 -> 0xC000. SVC access: added MapTransferMemory, UnmapTransferMemory.
** 0100000000000005 (boot): KernelCap IoMemoryMap: added BeginAddress=0x7000A000.
* BootImagePackageExFat:
** 0100000000000000 (FS): MainThreadStackSize updated: 0x8000 -> 0xC000. SVC access: added MapTransferMemory, UnmapTransferMemory.
** 0100000000000005 (boot): KernelCap IoMemoryMap: added BeginAddress=0x7000A000.
* BootImagePackageExFatSafe:
** 0100000000000000 (FS): MainThreadStackSize updated: 0x8000 -> 0xC000. SVC access: added MapTransferMemory, UnmapTransferMemory.
** 0100000000000005 (boot): KernelCap IoMemoryMap: added BeginAddress=0x7000A000.

====Secure Monitor====
Secure Monitor was updated.

* Compiler/optimization flags were changed, many functions now use more optimized asm to accomplish the same functionality.
* The firmware revision magic was changed from 0x18C to 0x1AD.
* Support was added for an additional 5 DRAM models.
* Asynchronous RSA SMCs now set a global to the result that GetResult should return instead of setting a bool that GetResult checks.
* DecryptOrImportRsaPrivateKey now imports the modulus in addition to the exponent for the ES use cases.
** This fixes a problem where you could specify a "smooth" modulus instead of the correct one when talking to TrustZone and then use Pohlig-Hellman to calculate the discrete logarithm and recover the private key.
* Passing a use case to StorageExpMod for which DecryptOrImportRsaPrivateKey does not import modulus now validates that the provided modulus is correct for the previously imported exponent.
** Future invocations of StorageExpMod will ignore the user-provided modulus, and use the imported one.
* UnwrapTitleKey now returns new result 7 ("NotImported") when attempting to unwrap a titlekey before importing the exponent and modulus.

====Warmboot====
* The firmware revision magic was changed from 0x18C to 0x1AD.
<check back for more diffs later>

====Kernel====
* Kernel crt0 was heavily refactored.
** Core 0 init vs Core 1/2/3 init are now separate functions.
** The initial arguments are now stored inside the Core Local regions before those regions are initialized.
*** This saves a little memory by allowing for reusing that space.
** The initial arguments now store an entrypoint invocation function pointer in addition to the entrypoint.
** Core 1/2/3 now panic if cpuactlr/cpuectlr hold a value different than the one in init argument. Previously, they they did if (real value != expected value) { real value = expected value }.
* The reserved memory size for slab heap aslr gaps was reduced by 64 KB from 2 MB to 0x1F0000.
* Physical ASLR for certain backing regions (Kernel .text/.rodata/.rwdata/.bss + the Slab Heap region) was implemented.
** Physical randomization of the kernel image is done by KernelLdr.
** Randomization of the slab heap region is done by kernel during init.
** To accommodate this, the virtual/physical memory trees no longer track pair blocks for the kernel/slab heap regions (as they no longer correlate directly).
* The global rng is now std::mt19937_64 instead of std::mt19937
* KPageHeap bitmaps now store a small TinyMT rng.
** This is used to allocate random pages from the bitmap instead of first-available. Thus, KPageHeap allocation order is now random/non-deterministic.
* KSpinLock was changed. Previously it used two u16s, each aligned to cache line. Now it packs the u16s into a single non-cache-line aligned u32.
** The new spin lock is identical to the implementation in the ARM Reference Manual.
** KScheduler's spin lock still uses the old cache-line aligned u16s.
** Speculatively, we can consider the following motivation for the change:
*** The old spin lock cannot atomically update both tickets with a single write. Thus, it is required to do two loops (one to update the current ticket, one to check if the obtained ticket is the active and the lock is taken).
*** The new spin lock can atomically update both tickets with a single write. Thus, in the case where the lock is not held by another core when it is acquired, the new spin lock only has to do one atomic loop.
*** From this we can observe that the new spin lock is likely more performant under low contention (where it is expected that the lock is not held), however its downsides are potential false sharing (due to not owning the cache line). It is also probably better when at the start of a cache line and the locked data exists entirely within that cache line.
*** Most kernel locks are expected to be relatively uncontended (and there aren't really cases where two locks are in the same cache line so false sharing isn't such a problem), and thus the switch to the new ARM reference manual style lock should lead to an overall performance upgrade.
*** However, the scheduler lock is heavily contended (all cores will be locking it and unlocking it pretty much all the time). Thus, it makes more sense for it to continue using the old two-cache-line style lock, which performs better under high contention.
* KProcess now has an additional data member storing the kernel virtual address of the process local region.
** This is now used instead of the process virtual address for the tls region when writing context during exception handling.
** This probably fixes a bug if an exception is being handled for a non-current process and the relevant codepath is taken(?)
* Page table entry handling code was changed. Bit 56 is now used as an is valid/present flag. Previously checks that checked entries with bitmask 0x3 now check 0x100000000000002.
* KPageTableBase now has an additional data member storing how much unsafe memory is currently mapped. (This value is incremented/decremented on calls to svcMapPhysicalMemoryUnsafe/svcUnmapPhysicalMemoryUnsafe).
* KPageTableBase::LockForIpc* now takes a KPhysicalAddress * argument. Mapping code will try to write the physical address of the locked virtual address to this out pointer, KernelPanic() is called if physical address translation fails.
* KServerSession::SendReply now takes an additional argument for the physical address of the user message buffer. NULL is passed when doing ReplyAndReceive without a user buffer.
** When this argument is not null, the message buffer is accessed by doing linear phys-to-virt translation on this physaddress, otherwise the message buffer is accessed by doing linear phys-to-virt translation on the TLS physical address.
** Previously, the process virtual address for the user buffer was accessed directly.
* Pages allocated from the dynamic page slab heap are no longer memset to zero after being allocated.
** Instead, they are memset to zero when the heap is first initialized, and when being freed.
** This fixes the issue that pages were sometimes memset to zero unnecessarily, because they were already zero'd by some previous operation.
** Newly allocated pages being all-zero is now a kernel invariant.
* A new KMemoryPermission bit (0x40) was added. When this bit is set, the page is completely unmapped (for both user and kernel). This is done when e.g. memory is mirrored via MapMemory, when memory is locked for IPC usage, etc.
* KPageTable::ChangePermissions was changed substantially to accommodate this.
** Previously, it separated pages, iterated over mappings changing permissions as required (and invalidating + flushing cache if bool arg is true), then merged pages.
** Now, the function has a lambda which iterates over all mappings, changing permissions as required and performing additional operations depending on a bitflag parameter.
** First, the function separates pages.
** Then if the input bool is false, this lambda is called with entry template = input entry template, bitflag parameter = 0. This changes all mappings to the new permissions. Pages are then merged, and the function returns.
** Otherwise if the input bool is true, the lambda is called with entry template = input entry template & ~1 and bitflag parameter = 2. This changes all mappings to be invalid (as low bit of pte is zero). Bitflag & 2 causes entries to be merged during traversal.
** Next, the scheduling lock is locked and immediately unlocked. This forces a reschedule.
** Next, the lambda is called with entry template = input entry template, bitflag parameter = 1. This changes all mappings to new permissions, and flushes data cache on all new mappings.
** Finally, mappings are merged, and the function returns.
* SvcQueryIoMapping's ABI was changed.
** Previously signature was Result QueryIoMapping(uintptr_t *out_address, PhysicalAddress physical_address, size_t size).
** New signature is Result QueryIoMapping(uintptr_t *out_address, size_t *out_size, PhysicalAddress physical_address, size_t size);
** For normal IO, out_size is just written with the input size parameter.
** For special debug regions (mapped using 8.0.0+ memory region descriptor, queried by passing 1/2/3 as phys_addr parameter), out_size is written with the real size of the queried region.
* SvcQueryPhysicalAddress was stubbed, and now always returns ResultInvalidCurrentMemoryState.
* KCurrentContext now stores a dereferencable pointer to the current thread's TLS.
** This is used to check the user disable count (for thread pinning) in the SvcHandler instead of loading tls from tpidrro_el0.

====FIRM Sysmodules====
FIRM sysmodules were updated. Specific diffs available below:
<check back for more diffs later>

==See Also==
System update report(s):
* [https://yls8.mtheall.com/ninupdates/reports.php?date=2020-04-14_00-05-09&sys=hac]

{{NavboxVersions}}

[[Category:System versions]]

7.0.1

2026-08-05T23:43:11Z

Yellows8:

The Switch 7.0.1 system update was released on February 18, 2019. This Switch update was released for the following regions: ALL.

Security flaws fixed: <fill this in manually later, see the updatedetails page from the ninupdates-report page(s) once available for now>.

==Change-log==
[https://en-americas-support.nintendo.com/app/answers/detail/a_id/22525/p/897 Official] ALL change-log:
* General system stability improvements to enhance the user's experience, including:
*
* Resolved an issue where the Pokémon: Let's Go, Pikachu! and Pokémon: Let's Go, Eevee! games cannot reconnect to the Pokémon GO app if the game software was closed after pairing with the app.
*

==System Titles==
<fill this in (manually) later>

Nothing changed for services IPC.

RomFs changes:
* [[System_Version_Title|SystemVersion]]: All files updated.

=== BootImagePackages ===
RomFs changes:
* "/a/bct" updated, "/a/package1" updated, "/nx/bct" updated, "/nx/package1" updated

====Secure Monitor====
The Secure Monitor was updated.

* The only change in .text (besides relative branch offsets updating) is that four instructions were inserted into the SMC handler.
** When the bit in boot reason that restricts access to certain SMCs is set, [[SMC#SecureExpMod|smcSecureExpMod]] is now blacklisted. Previously, only [[SMC#DecryptOrImportRsaKey|smcDecryptOrImportRsaKey]] was blacklisted.
* The only data changes were that smcSecureExpMod is now allowed to be called in recovery mode, and the global pointers for the TIMER, WAIT, and UART-A regions now default to 0 instead of their physical addresses.
** The default pointer value change is not meaningful, as these are overwritten by initialization code before they are ever used.

==See Also==
System update report(s):
* [https://yls8.mtheall.com/ninupdates/reports.php?date=02-18-19_07-05-10&sys=hac]

{{NavboxVersions}}

[[Category:System versions]]

9.2.0

2026-08-05T23:39:09Z

Yellows8:

The Switch 9.2.0 system update was released on March 3, 2020 (UTC). This Switch update was released for the following regions: ALL.

Security flaws fixed: no.

==Change-log==
[https://en-americas-support.nintendo.com/app/answers/detail/a_id/22525/kw/nintendo%20switch%20system%20update Official] ALL change-log:
* General system stability improvements to enhance the user's experience.

==System Titles==
Besides [[System_Version_Title|SystemVersion]], only the BootImagePackages were updated.

RomFs changes:
* [[System_Version_Title|SystemVersion]]: All files updated.

=== BootImagePackages ===
RomFs changes:
* "/nx/package2" updated

No IPC changes.

====Kernel====
Kernel was updated.

The only change was to increase the resource limit for KSessions from 900 to 933.

====FIRM Sysmodules====
The only FIRM sysmodule updated was PM, this was to increase the system resource limit for Sessions to reflect the kernel change.

==See Also==
System update report(s):
* [https://yls8.mtheall.com/ninupdates/reports.php?date=2020-03-03_00-05-10&sys=hac]

{{NavboxVersions}}

[[Category:System versions]]

News/Archive

2026-08-05T23:25:58Z

Yellows8: Undo revision 14854 by Yls8bot (talk)

*'''13 January 26''' Nintendo released system update [[21.2.0]].
*'''9 December 25''' Nintendo released system update [[21.1.0]].
*'''25 November 25''' Nintendo released system update [[21.0.1]].
*'''11 November 25''' Nintendo released system update [[21.0.0]].
*'''30 September 25''' Nintendo released system update [[20.5.0]].
*'''2 September 25''' Nintendo released system update [[20.4.0]].
*'''29 July 25''' Nintendo released system update [[20.3.0]].
*'''15 July 25''' Nintendo released system update [[20.2.0]].
*'''19 June 25''' Nintendo released system update [[20.1.5]].
*'''3 June 25''' Nintendo released system update [[20.1.1]].
*'''28 May 25''' Nintendo released system update [[20.1.0]].
*'''2 May 25''' Nintendo released system update [[20.0.1]].
*'''30 April 25''' Nintendo released system update [[20.0.0]].
*'''7 January 25''' Nintendo released a rebootless system update for [[19.0.1]].
*'''29 October 24''' Nintendo released system update [[19.0.1]].
*'''8 October 24''' Nintendo released system update [[19.0.0]].
*'''2 July 24''' Nintendo released a rebootless system update for [[18.1.0]].
*'''11 June 24''' Nintendo released system update [[18.1.0]].
*'''23 April 24''' Nintendo released system update [[18.0.1]].
*'''26 March 24''' Nintendo released system update [[18.0.0]].
*'''20 February 24''' Nintendo released a rebootless system update for [[17.0.1]].
*'''5 December 23''' Nintendo released system update [[17.0.1]].
*'''21 November 23''' Nintendo released a rebootless system update for [[17.0.0]].
*'''11 October 23''' Nintendo released system update [[17.0.0]].
*'''22 August 23''' Nintendo released system update [[16.1.0]].
*'''9 May 23''' Nintendo released system update [[16.0.3]].
*'''18 April 23''' Nintendo released system update [[16.0.2]].
*'''23 March 23''' Nintendo released system update [[16.0.1]].
*'''21 February 23''' Nintendo released system update [[16.0.0]].
*'''1 November 22''' Nintendo released system update [[15.0.1]].
*'''11 October 22''' Nintendo released system update [[15.0.0]].
*'''14 June 22''' Nintendo released system update [[14.1.2]].
*'''19 April 22''' Nintendo released system update [[14.1.1]].
*'''5 April 22''' Nintendo released system update [[14.1.0]].
*'''22 March 22''' Nintendo released system update [[14.0.0]].
*'''20 January 22''' Nintendo released system update [[13.2.1]].
*'''1 December 21''' Nintendo released system update [[13.2.0]].
*'''26 October 21''' Nintendo released system update [[13.1.0]].
*'''15 September 21''' Nintendo released system update [[13.0.0]].
*'''6 July 21''' Nintendo released system update [[12.1.0]].
*'''12 June 21''' [https://devkitpro.org/viewtopic.php?f=13&t=9226&p=17113#p17113 libnx v4.1.0 released].
*'''8 June 21''' Nintendo released system update [[12.0.3]].
*'''12 May 21''' Nintendo released system update [[12.0.2]].
*'''20 April 21''' Nintendo released system update [[12.0.1]].
*'''9 March 21''' Nintendo released system update [[12.0.0]].
*'''11 December 20''' Nintendo released system update [[11.0.1]].
*'''1 December 20''' Nintendo released system update [[11.0.0]].
*'''15 September 20''' Nintendo released system update [[10.2.0]].
*'''28 July 20''' Nintendo released system update [[10.1.1]].
*'''14 July 20''' Nintendo released system update [[10.1.0]].
*'''5 June 20''' Nintendo released system update [[10.0.4]].
*'''26 May 20''' Nintendo released system update [[10.0.3]].
*'''11 May 20''' [https://devkitpro.org/viewtopic.php?f=13&t=9058 devkitA64 r15, libnx v3.2.0, deko3d v0.2.0, switch-examples v20200511] and [https://github.com/switchbrew/nx-hbloader/releases/tag/v2.3.2 nx-hbloader v2.3.2] released.
*'''30 April 20''' Nintendo released system update [[10.0.2]].
*'''22 April 20''' Nintendo released system update [[10.0.1]].
*'''14 April 20''' Nintendo released system update [[10.0.0]].
*'''4 April 20''' [https://devkitpro.org/viewtopic.php?f=13&t=9035 libnx v3.1.0, switch-examples v20200404 and deko3d v0.1.0 released]. On the 6th nx-hbmenu v3.3.0 was [https://github.com/switchbrew/nx-hbmenu/releases/latest released].
*'''2 April 20''' [https://github.com/switchbrew/nssu-updater nssu-updater] and [https://github.com/switchbrew/contents-delivery-manager contents-delivery-manager] were released.
*'''3 March 20''' Nintendo released system update [[9.2.0]].
*'''10 December 19''' [https://devkitpro.org/viewtopic.php?f=13&t=8989 libnx v3.0.0, switch-examples v20191211, Atmosphère v0.10.1, nx-hbmenu v3.2.0, and nx-hbloader v2.3.0 released].
*'''4 December 19''' Nintendo released system update [[9.1.0]].
*'''30 September 19''' Nintendo released system update [[9.0.1]].
*'''14 September 19''' [https://devkitpro.org/viewtopic.php?f=13&t=8964 libnx v2.5.0 and switch-examples v20190914 released]. nx-hbmenu v3.1.1 [https://github.com/switchbrew/nx-hbmenu/releases/tag/v3.1.1 released]. [https://github.com/Atmosphere-NX/Atmosphere/releases/tag/0.9.4 Atmosphère 0.9.4 released with support for 9.0.0].
*'''9 September 19''' Nintendo released system update [[9.0.0]].
*'''10 July 19''' Nintendo [https://twitter.com/NintendoAmerica/status/1148934589026455552 announced] the Nintendo Switch Lite system.
*'''17 June 19''' Nintendo released system update [[8.1.0]].
*'''1 May 19''' [https://devkitpro.org/viewtopic.php?f=13&t=8908 libnx v2.2.0 and switch-examples v20190501] released.
*'''23 April 19''' Nintendo released system update [[8.0.1]].
*'''15 April 19''' Nintendo released system update [[8.0.0]].
*'''29 March 19''' [https://devkitpro.org/viewtopic.php?f=13&t=8891 devkitA64 r13] and [https://github.com/switchbrew/libnx/releases/tag/v2.1.0 libnx v2.1.0] released with pthread/std::thread support.
*'''26 March 19''' [https://github.com/Atmosphere-NX/Atmosphere/releases/tag/0.8.6 Atmosphère v0.8.6] released with lots of bugfixes, more cheat stuff and web applet homebrew support.
*'''21 February 19''' [https://github.com/Atmosphere-NX/Atmosphere/releases/tag/0.8.4 Atmosphère v0.8.4] released with 7.0.x support.
*'''18 February 19''' Nintendo released system update [[7.0.1]].
*'''28 January 19''' Nintendo released system update [[7.0.0]].
*'''24 January 19''' [https://github.com/Atmosphere-NX/Atmosphere/releases/tag/0.8.3 Atmosphère v0.8.3] and [https://github.com/switchbrew/nx-hbloader/releases/tag/v2.1.0 nx-hbloader v2.1.0] were released.
*'''2 January 19''' [https://devkitpro.org/viewtopic.php?f=13&t=8826 libnx 2.0.0, switch-mesa 18.3 and switch-examples 20190102] were released.
*'''29 November 18''' [https://github.com/Atmosphere-NX/Atmosphere/releases/tag/0.8.0 Atmosphère v0.8.0] was released.
*'''29 November 18''' [https://github.com/switchbrew/nx-hbmenu/releases/latest nx-hbmenu v3.0.1] was released.
*'''28 November 18''' [https://devkitpro.org/viewtopic.php?f=13&t=8813 libnx 1.6.0 and switch-examples 20181128] were released.
*'''19 November 18''' Nintendo released system update [[6.2.0]].
*'''31 October 18''' [https://github.com/switchbrew/nx-hbloader/releases/tag/v2.0.1 nx-hbloader v2.0.1] was released.
*'''29 October 18''' [https://github.com/switchbrew/nx-hbmenu/releases/latest nx-hbmenu] v3.0.0 was released.
*'''29 October 18''' Nintendo released system update [[6.1.0]].
*'''27 October 18''' [https://devkitpro.org/viewtopic.php?f=13&t=8798 libnx 1.5.0 and switch-examples 20181027] were released.
*'''17 October 18''' [https://github.com/Atmosphere-NX/Atmosphere/releases/tag/0.7.0 Atmosphère v0.7.0] and [https://github.com/switchbrew/nx-hbloader/releases/tag/v2.0.0 nx-hbloader v2.0.0] were released.
*'''8 October 18''' Nintendo released system update [[6.0.1]].
*'''18 September 18''' Nintendo released system update [[6.0.0]].
*'''18 September 18''' [https://devkitpro.org/viewtopic.php?f=13&t=8784 libnx 1.4.1, switch-mesa v18.2β and switch-examples 20180918] were released.
*'''9 September 18''' [https://devkitpro.org/viewtopic.php?f=13&t=8780 libnx v1.4.0] was released alongside a Switch port of mesa/nouveau (GPU library).
*'''28 July 18''' [https://devkitpro.org/viewtopic.php?f=13&t=8761 devkitA64] r12 and [https://github.com/switchbrew/libnx/releases/tag/v1.3.1 libnx] v1.3.1 were released.
*'''8 July 18''' [https://github.com/switchbrew/libnx/releases/tag/v1.3.0 libnx] v1.3.0 was released.
*'''30 May 18''' Nintendo released system update [[5.1.0]].
*'''16 April 18''' Nintendo released system update [[5.0.2]].
*'''26 March 18''' Nintendo released system update [[5.0.1]].
*'''12 March 18''' Nintendo released system update [[5.0.0]].
*'''2 March 18''' [https://github.com/switchbrew/libnx/releases/tag/v1.1.0 libnx] v1.1.0 was released.
*'''28 February 18''' [https://github.com/switchbrew/nx-hbmenu/releases/latest nx-hbmenu] v2.0.0 was released.
*'''22 February 18''' [http://devkitpro.org devkitPro] released [https://devkitpro.org/viewtopic.php?f=13&t=8693 devkitA64 alpha7]
*'''18 February 18''' [https://switchbrew.github.io/nx-hbl/ nx-hbl] and [https://github.com/switchbrew/nx-hbmenu nx-hbmenu] were released.
*'''28 December 17''' The 34c3 Switch [https://events.ccc.de/congress/2017/Fahrplan/events/8941.html talk] took place, video available [https://media.ccc.de/v/34c3-8941-console_security_-_switch here].
*'''4 December 17''' Nintendo released system update [[4.1.0]].
*'''25 October 17''' Nintendo released system update [[4.0.1]].
*'''18 October 17''' Nintendo released system update [[4.0.0]].
*'''17 September 17''' [https://github.com/switchbrew/libnx libnx] was made public, with examples available [https://github.com/switchbrew/switch-examples here].
*'''5 September 17''' Nintendo released system update [[3.0.2]].
*'''31 July 17''' Nintendo released system update [[3.0.1]].
*'''19 June 17''' Nintendo released system update [[3.0.0]].
*'''15 May 17''' Nintendo released system update [[2.3.0]].
*'''17 April 17''' Nintendo released system update [[2.2.0]].
*'''27 March 17''' Nintendo released system update [[2.1.0]].
*'''2 March 17''' Nintendo released system update [[2.0.0]].
*'''3 March 17''' Nintendo Switch global release.

News

2026-08-05T23:25:38Z

Yellows8: Undo revision 14853 by Yls8bot (talk)

6.0.0

2026-08-05T23:24:46Z

Yellows8:

The Switch 6.0.0 system update was released on September 18, 2018. This Switch update was released for the following regions: ALL.

Security flaws fixed: Yes.

==Change-log==
[https://en-americas-support.nintendo.com/app/answers/detail/a_id/22525/p/897 Official] ALL change-log:
* Nintendo Switch Online* features and functionality have been added, including:
* Save Data Cloud Backup
*
* User your internet connection to back up game save data for compatible games
* Some games are not compatible with Save Data Cloud
* To back up save data or download a previous backup, head to System Settings > Data Management > Save Data Cloud Backup
*
* *Nintendo Switch Online membership (sold separately) and Nintendo Account required for online play. Not available in all countries. Internet access required for online features. Save Data Cloud backup available in compatible games. Terms apply. To learn more, click here.
*
* Added the following system functionality
* Upload up to four Album screenshots at once on supported social network services
*
* Only one captured video can be uploaded at once
*
*
* Select from six new Captain Toad icons for your user
*
* To edit your user icon, head to your My Page on the top left of the Home Menu > Profile
*
*
* Play your digital software and content on non-primary consoles by linking your Nintendo Account
*
* The term "active console" has been renamed "primary console" in Nintendo eShops
* Playing software in multiple consoles has certain restrictions
*
*
* Display of Nintendo Switch News articles will be limited to match the restricted software parental controls setting selections
*
* Please note that the restriction will only apply to News articles distributed after the release of version 6.0.0.
*
*
* Change the layout of the USB keyboard to the desired language
*
* To change the language, head to the System Settings > System > USB Keyboard
*
*
* Removed the following system functionality
* After installing the system update, it will no longer be possible to unlink your Nintendo Account from your Nintendo Switch user
* General system stability improvements to enhance the user's experience, including:
* Compatibility improvements have been made for a controller licensed by Nintendo

==System Titles==
* All sysmodules were updated.
* Most 8XX titles were updated.
* All applets except "error" and "cabinet" were updated.
* 1 new title was added: olsc-sysmodule.
* New services were added, see [[Services_API|here]].

[[SSL_services#CertStore|CertStore]] RomFs: "/ssl_CaFingerprints.bdf" was added and "/ssl_TrustedCerts.bdf" was updated.

[[NPDM]] changes (besides usual version-bump):
* bcat: Service server access: added prepo:a2, removed prepo:a.
* friends: Service server access: removed nd:app, nd:sys. Service access: added srepo:u, removed ndd. SVC access: added MapTransferMemory, UnmapTransferMemory.
* nifm: Service access: added arp:r, srepo:u.
* ptm: Service access: removed fsp-srv.
* bsdsocket: Service access: added srepo:u.
* audio: Service server access: added auddev. Service access: added srepo:u.
* wlan: Service server access: added wlan:dtc. Service access: added lm.
* ldn: Service server access: removed ndd. Service access: added es.
* capmtp: Service access: removed fsp-srv.
* pcie: Service server access: added pcie:log.
* account: Service access: added srepo:u.
* ns: Fac.FsAccessFlag updated: set bitmask 0x0000000008000000 (GetRightsId), cleared bitmask 0x0000000010000000 (RegisterExternalKey). Service access: added avm, olsc:s, removed arp:w.
* psc: Service access: removed fsp-srv.
* am: Service server access: added caps:su. Service access: added arp:w, olsc:s, srepo:u, removed arp:r.
* ssl: Service access: added set:sys, erpt:c.
* vi: Service server access: removed caps:su.
* pctl: Service access: added srepo:u.
* npns: Service access: added srepo:u. KernelCap HandleTableSize: updated HandleTableSize = 0x50 -> 0x64.
* glue: KernelCap HandleTableSize: updated HandleTableSize = 0x80 -> 0x100.
* eclct: Service access: added bgtc:t, pcie:log.
* es: Fac.FsAccessFlag updated: set bitmask 0x0000000010000000 (RegisterExternalKey). Service access: added time:u.
* grc: Service server access: added grc:d.
* sdb: Service server access: added avm.
* migration: Service access: added olsc:s.
* qlaunch: Service access: added banana, olsc:s.
* auth: Service access: added banana.
* controller: Service access: added banana.
* dataErase: Service access: added banana.
* netConnect: Service access: added banana.
* playerSelect: Service access: added banana.
* swkbd: Service access: added banana.
* miiEdit: Service access: added banana.
* LibAppletWeb: SystemResourceSize updated: 0x0 -> 0x400000. Service access: added banana. SVC access: added MapPhysicalMemory, UnmapPhysicalMemory.
* LibAppletShop: SystemResourceSize updated: 0x0 -> 0x400000. Service access: added banana. SVC access: added MapPhysicalMemory, UnmapPhysicalMemory.
* overlayDisp: Service access: added banana.
* photoViewer: Service access: added banana.
* LibAppletOff: SystemResourceSize updated: 0x0 -> 0x400000. Service access: added banana. SVC access: added MapPhysicalMemory, UnmapPhysicalMemory.
* LibAppletLns: SystemResourceSize updated: 0x0 -> 0x400000. Service access: added banana. SVC access: added MapPhysicalMemory, UnmapPhysicalMemory.
* LibAppletAuth: SystemResourceSize updated: 0x0 -> 0x400000. Service access: added banana. SVC access: added MapPhysicalMemory, UnmapPhysicalMemory.
* "starter" application: Service access: added banana.
* myPage: Service access: added banana.
* maintenance: Service access: added banana.

=== BootImagePackages ===
RomFs changes:
* "/a/bct" updated, "/a/package1" updated, "/nx/bct" updated, "/nx/package1" updated, "/nx/package2" updated

[[Package2|INI1]] changes:
* BootImagePackage:
** 0100000000000003 (ProcessMana): SVC access: added GetResourceLimitLimitValue.
* BootImagePackageSafe:
** 0100000000000003 (ProcessMana): SVC access: added GetResourceLimitLimitValue.
* BootImagePackageExFat:
** 0100000000000003 (ProcessMana): SVC access: added GetResourceLimitLimitValue.
* BootImagePackageExFatSafe:
** 0100000000000003 (ProcessMana): SVC access: added GetResourceLimitLimitValue.

====Secure Monitor====

.rwdata was reduced in size from two pages to one page. Additionally:

Changes were made relating to security engine usage:
* Many functions which previously used an inline GetSecurityEngine() call to get the security engine register address now take in a register base as an argument. This is presumably to facilitate moved Security Engine MMIO on the Mariko SoC.
* Keyslots 0-8, 0xA, 0xC-0xE now have flags 0x1FF set, and keyslot 0xB now additionally has flags 0x17F set.
* The Test Vector used to ensure keyslot contents do not change during wake-from-sleep now uses 256-bit AES instead of 128-bit AES (thus the high parts of the keyslot contents are now verified).

Some changes were made to initial SoC setup:
* Additional magic numbers (0x83 = SKU ID, 0x2 = ?, 0x210 = Tegra 210) are now written into the GPU microcode in DRAM for runtime configuration.
* The warmboot firmware's firmware revision magic was changed from 0x6 to 0x87.
* The GPU microcode carveout setup was moved to later during initialization (after package2 has been fully loaded and verified).
* The IRAM addresses from which [[BootConfig]] warmboot firmware are loaded were changed.

In addition, there were changes to the [[SMC]] interface:

* SMCs which take in a keyslot parameter have been changed to allow use of up to 6 keyslots instead of 4.
* smcUnwrapRsaOaepWrappedTitleKey now takes in a "type" parameter, and the kek used in key generation is now selected from an array based on this parameter. (smcUnwrapAesWrappedTitlekey hardcodes type 0.)
* GetConfig(HardwareType) now returns 4 when it previously would have returned 3.

Additionally, security flaws were addressed in smcCpuSuspend (aiming to further mitigate jamais vu/deja vu):

* The number of devices checked to be held in reset at the time of smcCpuSuspend is called is now greatly increased.
* BPMP SC7 Entry Firmware is now only started ''after'' the following have been done, instead of before:
** TZRAM contents have been encrypted and MAC'd with a random AES-256 key
** The PMC scratch registers where the MAC are stored have been verified not to be read or write-locked.
** The MAC is written into the PMC scratch registers, which are then write-locked.
** The PMC scratch registers are verified to have been write-locked.
** The PMC scratch registers are verified to contain the MAC TZ has written into them.
** The PMC scratch registers are read-locked.
** The PMC scratch registers are verified to be both read and write-locked.
** The BPMP's firmware is copied from TZRAM into IRAM
** memcmp(BPMP firmware in IRAM, BPMP firmware in TZRAM, sizeof(BPMP firmware)) is verified to be zero.

====Kernel====
* Accidentally exported symbols have been renamed:
** Namespace <code>nn::kern::ARM64</code> is now <code>nn::kern::arch::ARM64</code>
** Namespace <code>nn::kern::NX</code> is now <code>nn::kern::board::NX</code> and now contains the class <code>KSystemControl</code>
** <code>ResumeEntry</code> is now a non-static method of <code>KSystemControl</code>
* Kernel now reserves 1024 pages (1MB) of memory in SYSTEM memregion/pool for use by applets (1 at a time) for personal mmheap.
* Memory regions arrange changed, APPLET has 6MB less in all memory arranges.
* Maximum number of sessions and events both increased by 100.
* Kernel mmheap size decreased to 0x10DF000 bytes (was 0x1117000), the both KMemoryBlock pools' capacity is unchanged, but less page tables can be allocated.
* Kernel now properly reports DRAM size in default reslimit.
* Two new svcGetInfoTypes: types 21 and 22. These are like type 6 and 7, but without the contiguous, in-security-carveout, personalmmheap allocation.
* KASLR was changed to invoke smcGetRandomBytes(8) each time, instead of using Mersenne Twister.
* Another layer of randomization has been added to slabheaps (before, it was just the order of slabheaps): an array of N (= 21 = number of slabheaps) random integers, in range (0, 0x200000) is now constructed, sorted via bubble sort; at each slabheap construction the heap offset is further incremented by <code>array[id+1]-array[id]</code> , then page rounded.
* With the exception of KSessionRequest which is not in any KObjectAllocator, all KAutoObject types now use an intrusive rbtree instead of an intrusive list for their KObjectAllocator membership. Comparison key is PID for processes, thread ID for threads, address for others (using a new virtual method).
* A new anonymous KAutoObject type, which sole purpose is to hold a comparison key, is now used for thread lookup by ID.
* Breaking changes in svcGetFutureThreadInfo, which has potentially been renamed. Signature and use case have radically changed, it is now: <code>Result svcGetFutureThreadInfo(ThreadInfo *outThreadInfo, u64 *outTid, Handle debugHandle, s64 timeout)</code>.
* Huge scheduler force-pause and last thread reporting refactor:
** Scheduling flags are now u16 and force-pause flags are 3-nibble-long instead of 1.
** The requirements and mechanism for force-pausing (activity svc, debug, etc.) threads have been considerably simplified:
*** It used to delay the force-pause after end-of-svc, and used some convoluted mechanism.
*** The condition is now "a thread is force-pausable iff no thread is waiting for a kernel mutex it is holding", mechanism is just ORRing scheduling status with force-pause flags now. Appropriate changes have been made to accomodate for this change.
*** Above mentionned convoluted mechanism has been refactored, too, but remains unused.
** When the scheduler selects a process's thread, it now stored the selected thread in an array in the KProcess, for information. It also stores in itself and in array in the selected KProcess the number of times it detected a core being idle before load balancing. Used by BreakDebugProcess. 

* All threads created and started in kernel main() are started force-paused with flags=0x100. This fixes the hypotetical case where a compromised KIP would perform gmmuhax and dump the INI1 (which is stored in APPLICATION -- KIPs are only started after all of them have been loaded). They are unpaused after all KIPs have been created.
* GetThreadContext3 (unprivileged SVC) now dumps TPIDR_EL0.
* DebugActiveProcess now returns 0xFA01 if an attempt to debug the current process is made -- instead of possibly deadlocking
* GetDebugThreadContext and SetDebugThreadContext now return 0xF001 if flags > 15. Additionally, their functionality is now restricted to threads that have been force-paused for debug, not just any kind of force-paused threads anymore.
* ContinueDebugEvent now returns 0xF001 if flags > 15 as well.
* svcSleepSystem has been refactored. Instead of the initiator thread manually starting the sleep handler threads then storing a weak reference to itself, the handler threads are started in kernel init in main() immediately after their creation, and two mutexes are used: one for the initiator/covering svcSleepSystem, another for the handler threads. This likely fixes an UaF or race condition.
* If svcReturnFromException passes the exception the KDebug, ie. if the argument errorCode is not 0, and if the latter has DontCatchExceptions set, the process is terminated (unless errorCode is 0x10001).
* Performance improvements to svcInvalidateProcessDataCache.
* Redundant calls to smcGetConfig(12) have been reduced (12 calls -> 4 calls) during memory setup

====KIPs====
All KIPs were updated. Specific diffs for a few sysmodules are below:

=====[[Loader services|Loader]]=====
* A single null byte stack overflow due to strcat usage was fixed in content path parsing. See [[Switch System Flaws]] for details.
* System Resource Size ([[NPDM]] +0x14) is now allowed to be non-zero for applets in addition to applications.

=====[[Process Manager services|PM]]=====
Memory management initialization was greatly changed:
* PM no longer hardcodes five memory profiles, and no longer calls smcGetConfig to determine which profile to use.
* Instead, PM now uses [[SVC|svcGetResourceLimitLimitValue]] to determine how much space the kernel has allotted for Application + Applet regions and [[SVC|svcGetSystemInfo]] to determine the total physical memory available, and sets the System region size to (Total Memory Size - Application region size - Applet region size - 5 MiB).

===[[USB_services|USB-sysmodule]]===
The only sysmodule with any changes for accessible IO in the [[NPDM]] was USB-sysmodule. The IO page for the [[Fuses|fuse registers]] is now accessible by this sysmodule.

===[[NV_services|nvservices-sysmodule]]===
Among various changes, the [[Switch_System_Flaws#System_Modules|"Transfer Memory leak in nvservices system module"]] system flaw was patched in the following way:
* [[NV_services#Initialize|Initialize]] and [[NV_services#InitializeDevtools|InitializeDevtools]] now keep track of the size of the transfer memory supplied by the user.
* L_34B90 (nvdrv's destructor) now calls L_B4C30 (memset) on the entire transfer memory region (using the size saved previously) before calling [[SVC#svcUnmapTransferMemory|svcUnmapTransferMemory]].

===olsc-sysmodule===
This new sysmodule handles cloud saves.

==See Also==
System update report(s):
* [https://yls8.mtheall.com/ninupdates/reports.php?date=09-18-18_08-35-09&sys=hac]

{{NavboxVersions}}

[[Category:System versions]]

News/Archive

2026-08-05T22:39:00Z

Yellows8: Undo revision 14831 by Yls8bot (talk)

*'''13 January 26''' Nintendo released system update [[21.2.0]].
*'''9 December 25''' Nintendo released system update [[21.1.0]].
*'''25 November 25''' Nintendo released system update [[21.0.1]].
*'''11 November 25''' Nintendo released system update [[21.0.0]].
*'''30 September 25''' Nintendo released system update [[20.5.0]].
*'''2 September 25''' Nintendo released system update [[20.4.0]].
*'''29 July 25''' Nintendo released system update [[20.3.0]].
*'''15 July 25''' Nintendo released system update [[20.2.0]].
*'''19 June 25''' Nintendo released system update [[20.1.5]].
*'''3 June 25''' Nintendo released system update [[20.1.1]].
*'''28 May 25''' Nintendo released system update [[20.1.0]].
*'''2 May 25''' Nintendo released system update [[20.0.1]].
*'''30 April 25''' Nintendo released system update [[20.0.0]].
*'''7 January 25''' Nintendo released a rebootless system update for [[19.0.1]].
*'''29 October 24''' Nintendo released system update [[19.0.1]].
*'''8 October 24''' Nintendo released system update [[19.0.0]].
*'''2 July 24''' Nintendo released a rebootless system update for [[18.1.0]].
*'''11 June 24''' Nintendo released system update [[18.1.0]].
*'''23 April 24''' Nintendo released system update [[18.0.1]].
*'''26 March 24''' Nintendo released system update [[18.0.0]].
*'''20 February 24''' Nintendo released a rebootless system update for [[17.0.1]].
*'''5 December 23''' Nintendo released system update [[17.0.1]].
*'''21 November 23''' Nintendo released a rebootless system update for [[17.0.0]].
*'''11 October 23''' Nintendo released system update [[17.0.0]].
*'''22 August 23''' Nintendo released system update [[16.1.0]].
*'''9 May 23''' Nintendo released system update [[16.0.3]].
*'''18 April 23''' Nintendo released system update [[16.0.2]].
*'''23 March 23''' Nintendo released system update [[16.0.1]].
*'''21 February 23''' Nintendo released system update [[16.0.0]].
*'''1 November 22''' Nintendo released system update [[15.0.1]].
*'''11 October 22''' Nintendo released system update [[15.0.0]].
*'''14 June 22''' Nintendo released system update [[14.1.2]].
*'''19 April 22''' Nintendo released system update [[14.1.1]].
*'''5 April 22''' Nintendo released system update [[14.1.0]].
*'''22 March 22''' Nintendo released system update [[14.0.0]].
*'''20 January 22''' Nintendo released system update [[13.2.1]].
*'''1 December 21''' Nintendo released system update [[13.2.0]].
*'''26 October 21''' Nintendo released system update [[13.1.0]].
*'''15 September 21''' Nintendo released system update [[13.0.0]].
*'''6 July 21''' Nintendo released system update [[12.1.0]].
*'''12 June 21''' [https://devkitpro.org/viewtopic.php?f=13&t=9226&p=17113#p17113 libnx v4.1.0 released].
*'''8 June 21''' Nintendo released system update [[12.0.3]].
*'''12 May 21''' Nintendo released system update [[12.0.2]].
*'''20 April 21''' Nintendo released system update [[12.0.1]].
*'''9 March 21''' Nintendo released system update [[12.0.0]].
*'''11 December 20''' Nintendo released system update [[11.0.1]].
*'''1 December 20''' Nintendo released system update [[11.0.0]].
*'''15 September 20''' Nintendo released system update [[10.2.0]].
*'''28 July 20''' Nintendo released system update [[10.1.1]].
*'''14 July 20''' Nintendo released system update [[10.1.0]].
*'''5 June 20''' Nintendo released system update [[10.0.4]].
*'''26 May 20''' Nintendo released system update [[10.0.3]].
*'''11 May 20''' [https://devkitpro.org/viewtopic.php?f=13&t=9058 devkitA64 r15, libnx v3.2.0, deko3d v0.2.0, switch-examples v20200511] and [https://github.com/switchbrew/nx-hbloader/releases/tag/v2.3.2 nx-hbloader v2.3.2] released.
*'''30 April 20''' Nintendo released system update [[10.0.2]].
*'''22 April 20''' Nintendo released system update [[10.0.1]].
*'''14 April 20''' Nintendo released system update [[10.0.0]].
*'''4 April 20''' [https://devkitpro.org/viewtopic.php?f=13&t=9035 libnx v3.1.0, switch-examples v20200404 and deko3d v0.1.0 released]. On the 6th nx-hbmenu v3.3.0 was [https://github.com/switchbrew/nx-hbmenu/releases/latest released].
*'''2 April 20''' [https://github.com/switchbrew/nssu-updater nssu-updater] and [https://github.com/switchbrew/contents-delivery-manager contents-delivery-manager] were released.
*'''3 March 20''' Nintendo released system update [[9.2.0]].
*'''10 December 19''' [https://devkitpro.org/viewtopic.php?f=13&t=8989 libnx v3.0.0, switch-examples v20191211, Atmosphère v0.10.1, nx-hbmenu v3.2.0, and nx-hbloader v2.3.0 released].
*'''4 December 19''' Nintendo released system update [[9.1.0]].
*'''30 September 19''' Nintendo released system update [[9.0.1]].
*'''14 September 19''' [https://devkitpro.org/viewtopic.php?f=13&t=8964 libnx v2.5.0 and switch-examples v20190914 released]. nx-hbmenu v3.1.1 [https://github.com/switchbrew/nx-hbmenu/releases/tag/v3.1.1 released]. [https://github.com/Atmosphere-NX/Atmosphere/releases/tag/0.9.4 Atmosphère 0.9.4 released with support for 9.0.0].
*'''9 September 19''' Nintendo released system update [[9.0.0]].
*'''10 July 19''' Nintendo [https://twitter.com/NintendoAmerica/status/1148934589026455552 announced] the Nintendo Switch Lite system.
*'''17 June 19''' Nintendo released system update [[8.1.0]].
*'''1 May 19''' [https://devkitpro.org/viewtopic.php?f=13&t=8908 libnx v2.2.0 and switch-examples v20190501] released.
*'''23 April 19''' Nintendo released system update [[8.0.1]].
*'''15 April 19''' Nintendo released system update [[8.0.0]].
*'''29 March 19''' [https://devkitpro.org/viewtopic.php?f=13&t=8891 devkitA64 r13] and [https://github.com/switchbrew/libnx/releases/tag/v2.1.0 libnx v2.1.0] released with pthread/std::thread support.
*'''26 March 19''' [https://github.com/Atmosphere-NX/Atmosphere/releases/tag/0.8.6 Atmosphère v0.8.6] released with lots of bugfixes, more cheat stuff and web applet homebrew support.
*'''21 February 19''' [https://github.com/Atmosphere-NX/Atmosphere/releases/tag/0.8.4 Atmosphère v0.8.4] released with 7.0.x support.
*'''18 February 19''' Nintendo released system update [[7.0.1]].
*'''28 January 19''' Nintendo released system update [[7.0.0]].
*'''24 January 19''' [https://github.com/Atmosphere-NX/Atmosphere/releases/tag/0.8.3 Atmosphère v0.8.3] and [https://github.com/switchbrew/nx-hbloader/releases/tag/v2.1.0 nx-hbloader v2.1.0] were released.
*'''2 January 19''' [https://devkitpro.org/viewtopic.php?f=13&t=8826 libnx 2.0.0, switch-mesa 18.3 and switch-examples 20190102] were released.
*'''29 November 18''' [https://github.com/Atmosphere-NX/Atmosphere/releases/tag/0.8.0 Atmosphère v0.8.0] was released.
*'''29 November 18''' [https://github.com/switchbrew/nx-hbmenu/releases/latest nx-hbmenu v3.0.1] was released.
*'''28 November 18''' [https://devkitpro.org/viewtopic.php?f=13&t=8813 libnx 1.6.0 and switch-examples 20181128] were released.
*'''19 November 18''' Nintendo released system update [[6.2.0]].
*'''31 October 18''' [https://github.com/switchbrew/nx-hbloader/releases/tag/v2.0.1 nx-hbloader v2.0.1] was released.
*'''29 October 18''' [https://github.com/switchbrew/nx-hbmenu/releases/latest nx-hbmenu] v3.0.0 was released.
*'''29 October 18''' Nintendo released system update [[6.1.0]].
*'''27 October 18''' [https://devkitpro.org/viewtopic.php?f=13&t=8798 libnx 1.5.0 and switch-examples 20181027] were released.
*'''17 October 18''' [https://github.com/Atmosphere-NX/Atmosphere/releases/tag/0.7.0 Atmosphère v0.7.0] and [https://github.com/switchbrew/nx-hbloader/releases/tag/v2.0.0 nx-hbloader v2.0.0] were released.
*'''8 October 18''' Nintendo released system update [[6.0.1]].
*'''18 September 18''' Nintendo released system update [[6.0.0]].
*'''18 September 18''' [https://devkitpro.org/viewtopic.php?f=13&t=8784 libnx 1.4.1, switch-mesa v18.2β and switch-examples 20180918] were released.
*'''9 September 18''' [https://devkitpro.org/viewtopic.php?f=13&t=8780 libnx v1.4.0] was released alongside a Switch port of mesa/nouveau (GPU library).
*'''28 July 18''' [https://devkitpro.org/viewtopic.php?f=13&t=8761 devkitA64] r12 and [https://github.com/switchbrew/libnx/releases/tag/v1.3.1 libnx] v1.3.1 were released.
*'''8 July 18''' [https://github.com/switchbrew/libnx/releases/tag/v1.3.0 libnx] v1.3.0 was released.
*'''30 May 18''' Nintendo released system update [[5.1.0]].
*'''16 April 18''' Nintendo released system update [[5.0.2]].
*'''26 March 18''' Nintendo released system update [[5.0.1]].
*'''12 March 18''' Nintendo released system update [[5.0.0]].
*'''2 March 18''' [https://github.com/switchbrew/libnx/releases/tag/v1.1.0 libnx] v1.1.0 was released.
*'''28 February 18''' [https://github.com/switchbrew/nx-hbmenu/releases/latest nx-hbmenu] v2.0.0 was released.
*'''22 February 18''' [http://devkitpro.org devkitPro] released [https://devkitpro.org/viewtopic.php?f=13&t=8693 devkitA64 alpha7]
*'''18 February 18''' [https://switchbrew.github.io/nx-hbl/ nx-hbl] and [https://github.com/switchbrew/nx-hbmenu nx-hbmenu] were released.
*'''28 December 17''' The 34c3 Switch [https://events.ccc.de/congress/2017/Fahrplan/events/8941.html talk] took place, video available [https://media.ccc.de/v/34c3-8941-console_security_-_switch here].
*'''4 December 17''' Nintendo released system update [[4.1.0]].
*'''25 October 17''' Nintendo released system update [[4.0.1]].
*'''18 October 17''' Nintendo released system update [[4.0.0]].
*'''17 September 17''' [https://github.com/switchbrew/libnx libnx] was made public, with examples available [https://github.com/switchbrew/switch-examples here].
*'''5 September 17''' Nintendo released system update [[3.0.2]].
*'''31 July 17''' Nintendo released system update [[3.0.1]].
*'''19 June 17''' Nintendo released system update [[3.0.0]].
*'''15 May 17''' Nintendo released system update [[2.3.0]].
*'''17 April 17''' Nintendo released system update [[2.2.0]].
*'''27 March 17''' Nintendo released system update [[2.1.0]].
*'''2 March 17''' Nintendo released system update [[2.0.0]].
*'''3 March 17''' Nintendo Switch global release.

News

2026-08-05T22:38:43Z

Yellows8: Undo revision 14830 by Yls8bot (talk)

LDN services

2026-07-29T18:06:13Z

Yellows8: /* Protocol */

LDN handles all local network communication.

There's 2 IPC handler threads for all ldn:* services.

= ldn:m =
This is "nn::ldn::detail::IMonitorServiceCreator".

This has IPC max_sessions 5.

[20.2.0+] This has max_sessions 6.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#CreateMonitorService|CreateMonitorService]]
|}

== CreateMonitorService ==
Returns an [[#IMonitorService]].

The user-process closes the IMonitorServiceCreator object immediately after using this cmd.

== IMonitorService ==
This is "nn::ldn::detail::IMonitorService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#GetState|GetState]]
|-
| 1 || [[#GetNetworkInfo|GetNetworkInfo]]
|-
| 2 || [[#GetIpv4Address|GetIpv4Address]]
|-
| 3 || [[#GetDisconnectReason|GetDisconnectReason]]
|-
| 4 || [[#GetSecurityParameter|GetSecurityParameter]]
|-
| 5 || [[#GetNetworkConfig|GetNetworkConfig]]
|-
| 100 || [[#Initialize]]
|-
| 101 || [[#Finalize]]
|}

=== GetState ===
No input, returns an output [[#State|u32]].

sdknso implements this by <code>return</code>ing the u32, with 0 being returned on error.

=== GetNetworkInfo ===
Takes a type-0x1A output buffer containing a [[#NetworkInfo]].

=== GetIpv4Address ===
No input, returns an output [[#Ipv4Address]] and a [[#SubnetMask]].

=== GetDisconnectReason ===
No input, returns an output s16.

This is not exposed by sdknso.

This just returns 0.

=== GetSecurityParameter ===
No input, returns an output [[#SecurityParameter]].

This is not exposed by sdknso.

=== GetNetworkConfig ===
No input, returns an output [[#NetworkConfig]].

This is not exposed by sdknso.

=== Initialize ===
No input/output.

This is used immediately after object creation. Official sw will Abort if this fails.

This just returns 0.

=== Finalize ===
No input/output.

This is used during service exit, prior to closing the object. Official sw will Abort if this fails.

This just returns 0.

= ldn:s =
This is "nn::ldn::detail::ISystemServiceCreator".

This has IPC max_sessions 5.

[18.0.0+] The sdknso uses SessionManager with this, where the additional session-count is 0x3.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#CreateSystemLocalCommunicationService|CreateSystemLocalCommunicationService]]
|-
| 1 || [18.0.0+] [[#CreateClientProcessMonitor|CreateClientProcessMonitor]]
|}

== CreateSystemLocalCommunicationService ==
No input. Returns an [[#ISystemLocalCommunicationService]].

The user-process closes the ISystemServiceCreator object once finished with it during initialization. Official sw ignores errors from this cmd.

== CreateClientProcessMonitor ==
No input. Returns an [[#IClientProcessMonitor]].

== ISystemLocalCommunicationService ==
This is "nn::ldn::detail::ISystemLocalCommunicationService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#GetState_2|GetState]]
|-
| 1 || [[#GetNetworkInfo_2|GetNetworkInfo]]
|-
| 2 || [[#GetIpv4Address_2|GetIpv4Address]]
|-
| 3 || [[#GetDisconnectReason_2|GetDisconnectReason]]
|-
| 4 || [[#GetSecurityParameter_2|GetSecurityParameter]]
|-
| 5 || [[#GetNetworkConfig_2|GetNetworkConfig]]
|-
| 100 || [[#GetStateChangeEvent|GetStateChangeEvent]]
|-
| 101 || [[#GetNetworkInfoAndHistory|GetNetworkInfoAndHistory]]
|-
| 102 || [[#Scan|Scan]]
|-
| 103 || [[#ScanPrivate|ScanPrivate]]
|-
| 104 || [5.0.0+] [[#SetWirelessControllerPolicy|SetWirelessControllerPolicy]]
|-
| 105 || [13.1.0+] [[#SetWirelessAudioPolicy|SetWirelessAudioPolicy]]
|-
| 106 || [18.0.0+] [[#SetProtocol|SetProtocol]]
|-
| 200 || [[#OpenAccessPoint|OpenAccessPoint]]
|-
| 201 || [[#CloseAccessPoint|CloseAccessPoint]]
|-
| 202 || [[#CreateNetwork|CreateNetwork]]
|-
| 203 || [[#CreateNetworkPrivate|CreateNetworkPrivate]]
|-
| 204 || [[#DestroyNetwork|DestroyNetwork]]
|-
| 205 || [[#Reject|Reject]]
|-
| 206 || [[#SetAdvertiseData|SetAdvertiseData]]
|-
| 207 || [[#SetStationAcceptPolicy|SetStationAcceptPolicy]]
|-
| 208 || [[#AddAcceptFilterEntry|AddAcceptFilterEntry]]
|-
| 209 || [[#ClearAcceptFilter|ClearAcceptFilter]]
|-
| 300 || [[#OpenStation|OpenStation]]
|-
| 301 || [[#CloseStation|CloseStation]]
|-
| 302 || [[#Connect|Connect]]
|-
| 303 || [[#ConnectPrivate|ConnectPrivate]]
|-
| 304 || [[#Disconnect|Disconnect]]
|-
| 400 || [[#Initialize_2|Initialize]]
|-
| 401 || [[#Finalize_2|Finalize]]
|-
| 402 || [4.0.0+] [[#SetOperationMode|SetOperationMode]]
|-
| 403 || [7.0.0+] [[#InitializeWithVersion|InitializeWithVersion]]
|-
| 404 || [19.0.0+] [[#InitializeWithPriority|InitializeWithPriority]]
|-
| 500 || [18.0.0+] [[#EnableActionFrame|EnableActionFrame]]
|-
| 501 || [18.0.0+] [[#DisableActionFrame|DisableActionFrame]]
|-
| 502 || [18.0.0+] [[#SendActionFrame|SendActionFrame]]
|-
| 503 || [18.0.0+] [[#RecvActionFrame|RecvActionFrame]]
|-
| 505 || [18.0.0+] [[#SetHomeChannel|SetHomeChannel]]
|-
| 600 || [18.0.0+] [[#SetTxPower|SetTxPower]]
|-
| 601 || [18.0.0+] [[#ResetTxPower|ResetTxPower]]
|}

=== GetState ===
No input, returns an output [[#State]].

sdknso implements this by <code>return</code>ing the u32, with 0 being returned on error / when service isn't initialized.

=== GetNetworkInfo ===
Takes a type-0x1A output buffer containing a [[#NetworkInfo]].

[[#GetState|State]] must be 3 or 5.

=== GetIpv4Address ===
No input, returns an output [[#Ipv4Address]] and a [[#SubnetMask]].

=== GetDisconnectReason ===
No input, returns an output [[#DisconnectReason]].

sdknso implements this by <code>return</code>ing the s16 as a s32, with -1 being returned on error.

=== GetSecurityParameter ===
No input, returns an output [[#SecurityParameter]].

=== GetNetworkConfig ===
No input, returns an output [[#NetworkConfig]].

=== GetStateChangeEvent ===
No input, returns an output Event handle.

sdknso uses EventClearMode=1 with this. sdknso will Abort if this cmd fails.

This is signaled when the data returned by [[#GetNetworkInfo]]/[[#GetNetworkInfoAndHistory]] is updated.

=== GetNetworkInfoAndHistory ===
Takes a type-0x1A output buffer containing a [[#NetworkInfo]] and a type-0xA output buffer containing an array of [[#NodeLatestUpdate]].

The array count must be 8.

=== Scan ===
Takes a type-0x22 output buffer containing an array of [[#NetworkInfo]], a s16 channel, a [[#ScanFilter]], returns an output s16 total_out.

sdknso copies the output s16 to a s32, the value passed for the input s16 is from an user-specified s32 (user-apps generally use value 0 for this).

This is the same as [[#ScanPrivate]], except this also has the same channel-override functionality as [[#CreateNetwork]].

[[#GetState|State]] must be 3-5.

The array count must be at least 1. This is clamped to a maximum of 0x18.

=== ScanPrivate ===
Takes a type-0x22 output buffer containing an array of [[#NetworkInfo]], a s16 channel, a [[#ScanFilter]], returns an output s16 total_out.

sdknso copies the output s16 to a s32, the value passed for the input s16 is from an user-specified s32.

See [[#Scan]].

=== SetWirelessControllerPolicy ===
Takes an input [[#WirelessControllerRestriction]], no output.

[[#GetState|State]] must be 1.

The input value is written into state.

=== SetWirelessAudioPolicy ===
Takes an input [[#BluetoothAudioDeviceConnectableMode]], no output.

=== SetProtocol ===
Takes an input [[#Protocol|u32]], no output.

This cmd was implemented with [20.0.0+], prior to that this just returned an error.

The sdk user-process func will pass value 1 (2 on Ounce) to the cmd when the input [[#Protocol|Protocol]] is 0, valid values passed directly when recognized, otherwise Abort. User-processes use SetProtocol immediately after initializing ldn.

[20.0.0+] The ldn initialization functionality in sdknso also uses this with value 1 (NX) eventually after the init cmd was used successfully.

The input is validated, then a vfunc is called.

The cmd_input must be non-zero. BIT(cmd_input) must be set in a state-field, otherwise a separate Result is returned. This is a permission [[#Protocol|bitmask]] which originates from the ldn:* service object being used.

The vfunc sends a message to another thread with the input u32 as the param, and returns the response from that.

The thread msg-queue-handler (besides other validation) uses the input param to select what values to write to state fields. On NX only input value 1 or 3 is allowed, with an error being thrown otherwise. The previously mentioned validation includes verifying that [[#GetState|State]] is Initialized.

=== OpenAccessPoint ===
No input/output.

[[#GetState|State]] must be 1, this cmd eventually sets the State to value 2.

=== CloseAccessPoint ===
No input/output.

[[#GetState|State]] must be 2-3, this cmd eventually sets the State to value 1.

=== CreateNetwork ===
Takes an input [[#SecurityConfig]], an [[#UserConfig]], a [[#NetworkConfig]], no output.

This is the same as [[#CreateNetworkPrivate]], except the [[#AddressEntry]] params are 0, and the [[#SecurityParameter]] is generated from "nn::util::TinyMt::GenerateRandomBytes".

Unlike CreateNetworkPrivate, this overwrites the channel field in the [[#NetworkConfig]]. When the cached [[SPL_services#IsDevelopment|IsDevelopment]] value is true, the output from [[Settings_services|GetLdnChannel]] will overwrite that field if the s32 setting value is >=0, otherwise the original value is used. Otherwise when the IsDevelopment field is false (retail), the channel is overwritten with value 0.

This overwrites the u16 field at [[#SecurityConfig]]+0. When the cached [[SPL_services#IsDevelopment|IsDevelopment]] value is false (retail) ([18.0.0+] [[System_Settings|system-setting]] <code>ldn!enable_static_security_mode_configuration</code> is checked for being true instead), value 1 is used ([18.0.0+] value from [[System_Settings|system-setting]] <code>ldn!static_security_mode</code> is used, with fallback to value 1 if the setting is >=0x4), otherwise the original value is used.

[[#GetState|State]] must be 2, this cmd eventually sets the State to value 3.

=== CreateNetworkPrivate ===
Takes an input [[#SecurityConfig]], a [[#SecurityParameter]], an [[#UserConfig]], a [[#NetworkConfig]], a type-0x9 input buffer containing an array of [[#AddressEntry]], no output.

The buffer/count for [[#AddressEntry]] can be 0, in which case the network will be non-Private like [[#CreateNetwork]]. The count must be <=8.

See [[#CreateNetwork]].

=== DestroyNetwork ===
No input/output.

[[#GetState|State]] must be 3, this cmd eventually sets the State to value 2.

=== Reject ===
Takes an input [[#Ipv4Address]], no output.

[[#GetState|State]] must be 3.

=== SetAdvertiseData ===
Takes a type-0x21 input buffer, no output.

The input buffer contains arbitrary user data.

The buffer size must be <=0x180. An empty buffer (addr=NULL/size=0) can be used to reset the AdvertiseData size in state to zero.

[[#GetState|State]] must be 2-3.

=== SetStationAcceptPolicy ===
Takes an input [[#AcceptPolicy]], no output.

[[#GetState|State]] must be 2-3.

=== AddAcceptFilterEntry ===
Takes an input [[#MacAddress|MacAddress]], no output.

There are two sdknso funcs implementing this: one which takes a [[#MacAddress|MacAddress]] directly, the other loads the [[#MacAddress|MacAddress]] from the input [[#NodeInfo|NodeInfo]].

[[#GetState|State]] must be 2-3.

=== ClearAcceptFilter ===
No input/output.

[[#GetState|State]] must be 2-3.

=== OpenStation ===
No input/output.

[[#GetState|State]] must be 1, this cmd eventually sets the State to value 4.

=== CloseStation ===
No input/output.

[[#GetState|State]] must be 4-5, this cmd eventually sets the State to value 1.

=== Connect ===
Takes a type-0x19 input buffer containing a [[#NetworkInfo]], a [[#SecurityConfig]], an [[#UserConfig]], a s32 LocalCommunicationVersion, a [[#ConnectOption]], no output.

[[#GetState|State]] must be 4, this cmd eventually sets the State to value 5.

This is identical to [[#ConnectPrivate]] (besides the below), except the data internally passed for [[#SecurityParameter]]/[[#NetworkConfig]] are loaded from the input [[#NetworkInfo]].

[1.0.0-?] This overwrites the u16 field at [[#SecurityConfig]]+0. When the cached [[SPL_services#IsDevelopment|IsDevelopment]] value is false (retail), value 1 is used, otherwise the used value is: original_field == 0 ? {u16 [[#NetworkInfo]]+0x60} : original_field. [18.0.0+] This now uses the same SecurityMode override as [[#CreateNetwork|CreateNetwork]].

u32 LocalCommunicationVersion>>15 must be 0.

=== ConnectPrivate ===
Takes a [[#SecurityConfig]], [[#SecurityParameter]], an [[#UserConfig]], a s32 LocalCommunicationVersion, a [[#ConnectOption]], a [[#NetworkConfig]], no output.

See [[#Connect]].

[1.0.0-?] This overwrites the u16 field at [[#SecurityConfig]]+0. When the cached [[SPL_services#IsDevelopment|IsDevelopment]] value is false (retail), value 1 is used, otherwise the original value is used. [18.0.0+] This now uses the same SecurityMode override as [[#Connect|Connect]].

=== Disconnect ===
No input/output.

[[#GetState|State]] must be 5, this cmd eventually sets the State to value 4.

=== Initialize ===
Takes an input PID and an u64 pid_placeholder.

This is used immediately after object creation.

On old sysvers the cmd impl for User/System are identical, except different params are used for the funcs called internally.

With [7.0.0+] [[#InitializeWithVersion|InitializeWithVersion]] is used instead. The cmd impl for Initialize uses [[#InitializeWithVersion|InitializeWithVersion]] with version=0.

=== Finalize ===
No input/output.

This is used during service exit, prior to closing the object. Official sw will Abort if this fails.

If State is set for it, this will run the equivalent of [[#CloseAccessPoint]]/[[#CloseStation]] when needed.

[[#GetState|State]] must be non-zero, this cmd eventually sets the State to value 0.

=== SetOperationMode ===
Takes an input [[#OperationMode]], no output.

[[#GetState|State]] must be 1.

The input value is written into state.

=== InitializeWithVersion ===
Takes an input PID, a s32 version, and an u64 pid_placeholder.

The priority is determined by whether the interface is User/System: System = 0x38, User = 0x5A.

It then calls the init func, with the cmd input params and the above priority, returning the Result on failure.

On newer sysvers this then adds an entry for the state array used by [[#RegisterClient|RegisterClient]].

Lastly the input PID and version are written into state, then this returns.

The init func does the following:
* The PID must be non-zero, and the version must not be negative. The priority must be 0x5A or 0x38.
* An error is returned if state fields are invalid.
* The input PID and version are written into state (a state field is also set to interface == User).
* Lastly, a vfunc is called with the input priority, returning the Result from that.

The vfunc does the following:
* On newer sysvers, this uses [[Shared_Database_services|pl:s]] RequestApplicationFunctionAuthorizationByProcessId with the input PID and [[Shared_Database_services|ApplicationFunctionAuthorizationId]] = 2 (SecureLdnLocalCommunication), returning the Result on failure.
* Then a message is sent to a msg-queue with the input priority.

The handler for the above message does the following:
* When state is already initialized, runs handling for that. An error is also thrown if the input priority is larger than a state field.
* Initializes state, etc.
* Various [[Network_Interface_services|nifm]] funcs are eventually used. The input priority is used to determine the value for [[Network_Interface_services#CreateRequest|nn::nifm::RequestParameters]]: value 0x4 or value 0x8 is used, depending on priority > 0x59.
** Newer versions also handle ldn lan_emulation [[System_Settings|sys-settings]] here. For the above value, when lan_emulation is enabled it uses value 0x17, with 0x18 additionally used for priority <= 0x59.
* The rest is state init, including setting [[#State|State]] to value 1. Then 0 is returned.

On old sysvers the cmd impl for User/System are identical, except different params are used for the funcs called internally. With newer sysvers the cmd impl is now identical.

Version values passed by official sw:

{| class="wikitable" border="1"
|-
! Value || SystemVersion
|-
| 0x1 || [7.0.0+]
|-
| 0x2 || [18.0.0+]
|-
| 0x3 || [19.0.0+]
|-
| 0x4 || [20.0.0+]
|}

=== InitializeWithPriority ===
Takes an input PID, a s32 version, a s32 priority, and an u64 pid_placeholder.

This is similar to [[#InitializeWithVersion|InitializeWithVersion]]. The input priority is passed directly to the init func which is called here, instead of determining it from whether the interface is User/System.

Official sw passes input value 0x38 for the priority as the default, when the user doesn't specify the priority.

=== EnableActionFrame ===
Takes an input [[#ActionFrameSettings]]. No output.

[[#State|State]] must be Initialized.

=== DisableActionFrame ===
No input/output.

[[#State|State]] must be Initialized.

=== SendActionFrame ===
Takes a type-0x21 input buffer, two input [[#MacAddress]], two input s16s ('''Band''' and '''ChannelNumber''') and an input [[#MessageFlagSet]]. No output.

[20.0.0+] The input s16s were replaced with a single u16, which has the same format as [[#SetHomeChannel|SetHomeChannel]].

The first [[#MacAddress]] is the destination, the second [[#MacAddress]] is the Bssid.

The ChannelNumber must be non-zero.

[[#State|State]] must be 3-5 (AccessPointCreated/Station/StationConnected).

=== RecvActionFrame ===
Takes a type-0x22 output buffer and an input [[#MessageFlagSet]]. Returns two output [[#MacAddress]], two output s16s ('''Band''' and '''ChannelNumber'''), an output u32 '''Size''', and an output s32 '''LinkLevel'''.

[20.0.0+] The output s16s were replaced with a single u16, which has the same format as [[#SetHomeChannel|SetHomeChannel]].

[[#EnableActionFrame|EnableActionFrame]] must be used prior to this.

=== SetHomeChannel ===
Takes two input s16s '''Band''' and '''ChannelNumber'''. No output.

[20.0.0+] Now takes an input u16 instead of two s16s, merging the two params. Bitmask 0x3FF (low 10-bits) is the ChannelNumber, while the remaining upper 6-bits is the Band. The Band is used as an array index to load the actual Band for passing to a func. Only the following Band input is valid, others return 0x0/0xFFFF: 2 - > 2400, 5 -> 5000, 6 -> 6000.

On NX Band must be ([20.0.0+] converted Band from the above array) 50 ([20.0.0+] 5000) or 24 ([20.0.0+] 2400).

The ChannelNumber must be non-zero.

The [[#State|State]] must be Station.

sdknso uses the input channel to convert to the input needed by the cmd.

=== SetTxPower ===
Takes an input s16 '''Power'''. No output.

The input must be 0x0..0xFF.

A state field must be non-zero.

The [[#State|State]] must be 2-5 (AccessPoint*/Station*).

=== ResetTxPower ===
No input/output.

The same state field checked by [[#SetTxPower|SetTxPower]] must be non-zero. The [[#State|State]] check is also the same as [[#SetTxPower|SetTxPower]].

== IClientProcessMonitor ==
This is "nn::ldn::detail::IClientProcessMonitor".

This was added with [18.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || RegisterClient
|}

=== RegisterClient ===
Takes an input PID and an u64 pid_placeholder.

[18.0.0+] [[#CreateClientProcessMonitor|CreateClientProcessMonitor]] and RegisterClient are used by sdknso at the end of the ldn initialization functionality.

If the objptr in IClientProcessMonitor state is already set from using this cmd previously, this just returns 0.

This goes through global state to locate an entry with a matching PID, if none found 0 is returned. The objptr from the state entry is loaded, if NULL this returns 0. This obj is then incref'd and written into the IClientProcessMonitor state. When PID is 0, 0 is returned. It then locates the above state entry again with a matching PID, clearing the entry which matches. Lastly 0 is returned.

The initialization [[#InitializeWithPriority|cmds]] adds an entry to the above global state.

= ldn:u =
This is "nn::ldn::detail::IUserServiceCreator".

This has IPC max_sessions 3.

[18.0.0+] The sdknso uses SessionManager with this, where the additional session-count is 0x3.

[S2] There appears to be 2 ldn:u services, this appears to be for having separate [[#Protocol|Protocol]] permissions for NX and Ounce games. The Creator object has the same vtable for both of these. However the vtable for IUserLocalCommunicationService appears to be larger even with NX, which likely indicates there's new commands? There also appears to be 4 additional max-sessions allocated to ldn*, this is probably for one of these ldn:u services?

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#CreateUserLocalCommunicationService|CreateUserLocalCommunicationService]]
|-
| 1 || [18.0.0+] [[#CreateClientProcessMonitor|CreateClientProcessMonitor]]
|}

== CreateUserLocalCommunicationService==
Returns an [[#IUserLocalCommunicationService]].

The user-process closes the IUserServiceCreator object once finished with it during initialization. Official sw ignores errors from this cmd.

== IUserLocalCommunicationService ==
This is "nn::ldn::detail::IUserLocalCommunicationService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#GetState_2|GetState]]
|-
| 1 || [[#GetNetworkInfo_2|GetNetworkInfo]]
|-
| 2 || [[#GetIpv4Address_2|GetIpv4Address]]
|-
| 3 || [[#GetDisconnectReason_2|GetDisconnectReason]]
|-
| 4 || [[#GetSecurityParameter_2|GetSecurityParameter]]
|-
| 5 || [[#GetNetworkConfig_2|GetNetworkConfig]]
|-
| 100 || [[#GetStateChangeEvent|GetStateChangeEvent]]
|-
| 101 || [[#GetNetworkInfoAndHistory|GetNetworkInfoAndHistory]]
|-
| 102 || [[#Scan|Scan]]
|-
| 103 || [[#ScanPrivate|ScanPrivate]]
|-
| 104 || [5.0.0+] [[#SetWirelessControllerPolicy|SetWirelessControllerPolicy]]
|-
| 105 || [13.1.0+] [[#SetWirelessAudioPolicy|SetWirelessAudioPolicy]]
|-
| 106 || [18.0.0+] [[#SetProtocol|SetProtocol]]
|-
| 200 || [[#OpenAccessPoint|OpenAccessPoint]]
|-
| 201 || [[#CloseAccessPoint|CloseAccessPoint]]
|-
| 202 || [[#CreateNetwork|CreateNetwork]]
|-
| 203 || [[#CreateNetworkPrivate|CreateNetworkPrivate]]
|-
| 204 || [[#DestroyNetwork|DestroyNetwork]]
|-
| 205 || [[#Reject|Reject]]
|-
| 206 || [[#SetAdvertiseData|SetAdvertiseData]]
|-
| 207 || [[#SetStationAcceptPolicy|SetStationAcceptPolicy]]
|-
| 208 || [[#AddAcceptFilterEntry|AddAcceptFilterEntry]]
|-
| 209 || [[#ClearAcceptFilter|ClearAcceptFilter]]
|-
| 300 || [[#OpenStation|OpenStation]]
|-
| 301 || [[#CloseStation|CloseStation]]
|-
| 302 || [[#Connect|Connect]]
|-
| 303 || [[#ConnectPrivate|ConnectPrivate]]
|-
| 304 || [[#Disconnect|Disconnect]]
|-
| 400 || [[#Initialize_2|Initialize]]
|-
| 401 || [[#Finalize_2|Finalize]]
|-
| 402 || [7.0.0+] [[#InitializeWithVersion|InitializeWithVersion]]
|-
| 403 || [19.0.0+] [[#SetOperationMode|SetOperationMode]]
|-
| 500 || [18.0.0+] [[#EnableActionFrame|EnableActionFrame]]
|-
| 501 || [18.0.0+] [[#DisableActionFrame|DisableActionFrame]]
|-
| 502 || [18.0.0+] [[#SendActionFrame|SendActionFrame]]
|-
| 503 || [18.0.0+] [[#RecvActionFrame|RecvActionFrame]]
|-
| 505 || [18.0.0+] [[#SetHomeChannel|SetHomeChannel]]
|-
| 600 || [18.0.0+] [[#SetTxPower|SetTxPower]]
|-
| 601 || [18.0.0+] [[#ResetTxPower|ResetTxPower]]
|}

= ndd =
This is "nn::ndd::IService".

This was added with [5.0.0] and removed with [6.0.0].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || EnableAutoCommunication
|-
| 1 || DisableAutoCommunication
|-
| 2 || IsAutoCommunicationEnabled
|-
| 3 || EnablePowerSave
|-
| 4 || DisablePowerSave
|-
| 5 || IsPowerSaveEnabled
|-
| 6 || IsNetworkActive
|-
| 7 || AcquireSendDataUpdateEvent
|-
| 8 || AddSendData
|-
| 9 || ClearSendData
|-
| 10 || GetSendData
|-
| 11 || AcquireReceiveDataEvent
|-
| 12 || GetCurrentReceiveDataCounter
|-
| 13 || GetOldestReceiveDataCounter
|-
| 14 || GetNextReceiveDataCounter
|-
| 15 || GetAvailableReceiveDataCount
|-
| 16 || GetRecentReceiveDataCounter
|-
| 17 || GetReceiveData
|-
| 18 || AddReceiveData
|-
| 19 || ClearReceiveData
|-
| 20 || ClearDataIdFilter
|-
| 21 || AcquireDeviceScanEvent
|-
| 22 || StartDeviceScan
|-
| 23 || CancelDeviceScan
|-
| 24 || GetDeviceScanResult
|}

= lp2p:app, lp2p:sys =
These are "nn::lp2p::detail::ISfServiceCreator".

These were added with [9.0.0+].

lp2p:app is used by [[Mario Kart Live: Home Circuit]]. lp2p:sys is used by [[Album_Applet|LibraryAppletPhotoViewer]] with [11.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#CreateNetworkService|CreateNetworkService]]
|-
| 8 || [[#CreateNetworkServiceMonitor|CreateNetworkServiceMonitor]]
|}

== CreateNetworkService ==
Takes a PID-descriptor, a reserved input u64 and an input u32. Returns an output [[#ISfService]].

The input u32 must be value 0x1.

== CreateNetworkServiceMonitor ==
Takes a PID-descriptor and a reserved input u64. Returns an output [[#ISfServiceMonitor]].

== ISfService ==
This is "nn::lp2p::detail::ISfService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Initialize_4|Initialize]]
|-
| 256 || [9.0.0-9.0.1] [[#AttachNetworkInterfaceStateChangeEvent|AttachNetworkInterfaceStateChangeEvent]]
|-
| 264 || [9.0.0-9.0.1] [[#GetNetworkInterfaceLastError|GetNetworkInterfaceLastError]]
|-
| 272 || [9.0.0-9.0.1] [[#GetRole|GetRole]]
|-
| 280 || [9.0.0-9.0.1] [[#GetAdvertiseData|GetAdvertiseData]]
|-
| 288 || [9.0.0-9.0.1] [[#GetGroupInfo|GetGroupInfo]]
|-
| 296 || [9.0.0-9.0.1] [[#GetGroupInfo2|GetGroupInfo2]]
|-
| 304 || [9.0.0-9.0.1] [[#GetGroupOwner|GetGroupOwner]]
|-
| 312 || [9.0.0-9.0.1] [[#GetIpConfig|GetIpConfig]]
|-
| 320 || [9.0.0-9.0.1] [[#GetLinkLevel|GetLinkLevel]]
|-
| 512 || [[#Scan_2|Scan]]
|-
| 768 || [[#CreateGroup|CreateGroup]]
|-
| 776 || [[#DestroyGroup|DestroyGroup]]
|-
| 784 || [[#SetAdvertiseData|SetAdvertiseData]]
|-
| 1536 || [[#SendToOtherGroup|SendToOtherGroup]]
|-
| 1544 || [[#RecvFromOtherGroup|RecvFromOtherGroup]]
|-
| 1552 || [[#AddAcceptableGroupId|AddAcceptableGroupId]]
|-
| 1560 || [9.1.0+] [[#ClearAcceptableGroupId|ClearAcceptableGroupId]]
|}

=== Initialize ===
No input/output.

Returns 0.

Unused by official sw.

=== Scan ===
Takes a type-0x19 input buffer containing a [[#GroupInfo]] and a type-0x22 output buffer containing an array of [[#ScanResult]]. Returns an output s32 '''TotalOut'''.

=== CreateGroup ===
Takes a type-0x31 input buffer containing a [[#GroupInfo]]. No output.

[[Mario Kart Live: Home Circuit|mklive]] uses the following string with this: "Failed to create a group: %08X".

The [[#GetRole|role]] must be 0. This eventually sets the [[#GetRole|role]] to value 1.

=== DestroyGroup ===
No input/output.

This destroys the previously [[#CreateGroup|created]] group. If no group was previously created ([[#GetRole|role]] is not 1), this just returns 0.

=== SetAdvertiseData ===
Takes a type-0x21 input buffer. No output.

The buffer size must be <=0x80. The [[#GetRole|role]] must be <=1.

A string in [[Mario Kart Live: Home Circuit|mklive]] refers to the buffer data as "scan advertise data".

=== SendToOtherGroup ===
Takes an input [[#MacAddress_2|MacAddress]], a [[#GroupId]], a s16 '''Frequency''', a s16 '''Channel''', an u32 '''MessageFlag''' and a type-0x21 input buffer. No output.

The buffer size must be <=0x400.

The MacAddress must be non-zero. The s16s must be >=1.

Only bit0 is used from flags: clear = block until the data can be sent, set = return error when the data can't be sent.

A string in [[Mario Kart Live: Home Circuit|mklive]] refers to the buffer data as "Action frame".

The [[#GetRole|role]] must be non-zero. The error from [[#GetNetworkInterfaceLastError]] will be returned if it's set.

[11.0.0+] [[#GroupInfo]]+0x8A must be value 2, otherwise an error is returned.

This sends an Action frame to the specified [[#GroupId]], with the specified destination [[#MacAddress_2|MacAddress]] (can be a broadcast address).

The frequency param is the same as the [[#GroupInfo]]+0x84 field.

=== RecvFromOtherGroup ===
Takes an input u32 '''MessageFlag''' and a type-0x22 output buffer. Returns a [[#MacAddress_2|MacAddress]], an u16 '''Frequency''', a s16 '''Channel''', an u32 '''OutSize''' and a s32.

The OutSize is the original size used for copying to the output buffer, before it's clamped to the output-buffer size.

Only bit0 is used from MessageFlag: clear = block until data is available, set = return error when data is not available.

When data is not available, the error from [[#GetNetworkInterfaceLastError]] will be returned if it's set.

The [[#GetRole|role]] must be non-zero.

This receives an Action frame.

=== AddAcceptableGroupId ===
Takes an input [[#GroupId]]. No output.

=== ClearAcceptableGroupId ===
No input/output.

== ISfServiceMonitor ==
This is "nn::lp2p::detail::ISfServiceMonitor".

This interface has no commands, until [9.1.0+] which added actual commands.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Initialize_5|Initialize]]
|-
| 256 || [[#AttachNetworkInterfaceStateChangeEvent|AttachNetworkInterfaceStateChangeEvent]]
|-
| 264 || [[#GetNetworkInterfaceLastError|GetNetworkInterfaceLastError]]
|-
| 272 || [[#GetRole|GetRole]]
|-
| 280 || [[#GetAdvertiseData|GetAdvertiseData]]
|-
| 281 || [[#GetAdvertiseData2|GetAdvertiseData2]]
|-
| 288 || [[#GetGroupInfo|GetGroupInfo]]
|-
| 296 || [[#GetGroupInfo2|GetGroupInfo2]]
|-
| 304 || [[#GetGroupOwner|GetGroupOwner]]
|-
| 312 || [[#GetIpConfig|GetIpConfig]]
|-
| 320 || [[#GetLinkLevel|GetLinkLevel]]
|-
| 328 || [[#AttachJoinEvent|AttachJoinEvent]]
|-
| 336 || [[#GetMembers|GetMembers]]
|}

=== Initialize ===
Returns 0.

Unused by official sw.

=== AttachNetworkInterfaceStateChangeEvent ===
No input. Returns an output Event handle with EventClearMode=0.

=== GetNetworkInterfaceLastError ===
No input/output.

=== GetRole ===
No input. Returns an output u8.

=== GetAdvertiseData ===
Takes a type-0x22 output buffer. Returns two output u16s.

Validates that the [[#GetRole|role]] is value 2, then copies data from state into the output buffer. The first output u16 is the size used for the memcpy, the second u16 is the original size from state.

=== GetAdvertiseData2 ===
Takes a type-0x22 output buffer. Returns two output u16s.

This is identical to [[#GetAdvertiseData]] except this doesn't run the role validation.

=== GetGroupInfo ===
Takes a type-0x32 output buffer containing a [[#GroupInfo]].

Validates that the [[#GetRole|role]] is non-zero, then copies the struct from state into the output buffer.

=== GetGroupInfo2 ===
Takes a type-0x32 output buffer containing a [[#GroupInfo]] and a type-0x31 input buffer containing a [[#GroupInfo]].

This runs the same code as [[#CreateGroup]] to generate the [[#GroupInfo]] for the input struct (which with [[#CreateGroup]] would be available with [[#GetGroupInfo]]). The input struct is the same as [[#CreateGroup]].

=== GetGroupOwner ===
No input. Returns an output [[#NodeInfo_2|NodeInfo]].

Validates that the [[#GetRole|role]] is non-zero, then copies the data from state to output.

=== GetIpConfig ===
Takes a type-0x1A output buffer containing a 0x100-byte struct.

Validates that the [[#GetRole|role]] is non-zero, then copies the struct from state into the output buffer.

+0x20 is the <code>struct sockaddr</code> IP address, +0x40 is the <code>struct sockaddr</code> subnet-mask, +0x60 is the <code>struct sockaddr</code> gateway(?). The address for the last one is set to localhost.

=== GetLinkLevel ===
No input. Returns an output u32.

=== AttachJoinEvent ===
No input. Returns an output Event handle with EventClearMode=0.

=== GetMembers ===
Takes a type-0x22 output buffer containing an array of [[#NodeInfo_2|NodeInfo]]. Returns an output s32 '''TotalOut'''.

Validates that the [[#GetRole|role]] is value 1. Then any entries from state which are available are copied into the output array buffer, if there's space available. A maximum of 8 entries can be returned.

A string in [[Mario Kart Live: Home Circuit|mklive]] refers to the array data as "connected members".

= lp2p:m =
This is "nn::lp2p::monitor::detail::ISfMonitorServiceCreator".

This was added with [9.1.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#CreateMonitorService|CreateMonitorService]]
|}

== CreateMonitorService ==
Takes a PID-descriptor, a reserved input u64 and an input u64. Returns an [[#ISfMonitorService]].

== ISfMonitorService ==
This is "nn::lp2p::monitor::detail::ISfMonitorService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Initialize_6|Initialize]]
|-
| 288 || [[#GetGroupInfo|GetGroupInfo]]
|-
| 320 || [[#GetLinkLevel|GetLinkLevel]]
|}

=== Initialize ===
Returns 0.

= State =
This is "nn::ldn::State".

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || None
|-
| 1 || Initialized
|-
| 2 || AccessPoint
|-
| 3 || AccessPointCreated
|-
| 4 || Station
|-
| 5 || StationConnected
|-
| 6 || Error
|}

= Ipv4Address =
This is "nn::ldn::Ipv4Address". This is a 0x4-byte struct with 4-byte alignment.

This is essentially the same as <code>struct in_addr</code>, except this is little-endian.

This is generally "169.254.XXX.{...}", where XXX is random per created network.

= SubnetMask =
This is "nn::ldn::SubnetMask". This is a 0x4-byte struct with 4-byte alignment.

This is essentially the same as <code>struct in_addr</code>, except this is little-endian.

= Ssid =
This is "nn::ldn::Ssid".

When converting a Ssid to a string, the loaded chars from the string must be in the range of 0x20-0x7F, otherwise the byte written to the string will be 0.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || Length (excluding NUL-terminator, must be 0x1-0x20)
|-
| 0x1 || 0x21 || Raw (SSID string including NUL-terminator, str[{above length}] must be 0)
|}

= MacAddress =
This is "nn::ldn::MacAddress". This is a 6-byte struct with 1-byte alignment.

= NodeInfo =
This is "nn::ldn::NodeInfo".

The first node in the nodes array is always the AccessPoint (NodeId 0x0). NodeId is the index of the node in the nodes array.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || [[#Ipv4Address|Ipv4Address]]
|-
| 0x4 || 0x6 || [[#MacAddress|MacAddress]]
|-
| 0xA || 0x1 || NodeId
|-
| 0xB || 0x1 || IsConnected
|-
| 0xC || 0x21 || UserName
|-
| 0x2D || 0x1 || [19.0.0+] Platform? (0 = NX, 1 = Ounce)
|-
| 0x2E || 0x2 || LocalCommunicationVersion
|-
| 0x30 || 0x10 || Reserved
|}

= NodeLatestUpdate =
This is "nn::ldn::NodeLatestUpdate". This is a 0x8-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || StateChange
|-
| 0x1 || 0x7 || Reserved
|}

= IntentId =
This is "nn::ldn::IntentId".

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || LocalCommunicationId
|-
| 0x8 || 0x2 || Reserved
|-
| 0xA || 0x2 || SceneId
|-
| 0xC || 0x4 || Reserved
|}

* LocalCommunicationId: [[#CreateNetwork|CreateNetwork]], [[#CreateNetworkPrivate|CreateNetworkPrivate]], [[#Connect|Connect]], [[#ConnectPrivate|ConnectPrivate]] (also [[#ScanFilter|ScanFilter]] when enabled with the flag): When -1, this is overwritten with the first LocalCommunicationId from the user-process [[NACP]], if loading fails value 0 is written instead. Otherwise when not -1, if [[NACP]] loading is successful, this field must match one of the LocalCommunicationIds from there.
* SceneId: Arbitrary user data, this can be used for filtering with [[#ScanFilter|ScanFilter]] for example.

= SessionId =
This is "nn::ldn::SessionId".

This is used to generate/overwrite the Ssid when needed.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x10 || Random
|}

= NetworkId =
This is "nn::ldn::NetworkId". This is a 0x20-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x10 || [[#IntentId|IntentId]]
|-
| 0x10 || 0x10 || [[#SessionId|SessionId]]
|}

= CommonNetworkInfo =
This is "nn::ldn::CommonNetworkInfo". This is a 0x30-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x6 || [[#MacAddress|Bssid]]
|-
| 0x6 || 0x22 || [[#Ssid|Ssid]]
|-
| 0x28 || 0x2 || Channel
|-
| 0x2A || 0x1 || LinkLevel
|-
| 0x2B || 0x1 || NetworkType
|-
| 0x2C || 0x4 || Reserved
|}

= LdnNetworkInfo =
This is "nn::ldn::LdnNetworkInfo". This is a 0x430-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x10 || ServerRandom
|-
| 0x10 || 0x2 || SecurityMode
|-
| 0x12 || 0x1 || StationAcceptPolicy
|-
| 0x13 || 0x1 || Version
|-
| 0x14 || 0x2 || Reserved
|-
| 0x16 || 0x1 || NodeCountMax
|-
| 0x17 || 0x1 || NodeCount
|-
| 0x18 || 0x200 (0x40 * 8) || [[#NodeInfo|Nodes]]
|-
| 0x218 || 0x2 || Reserved
|-
| 0x21A || 0x2 || AdvertiseDataSize
|-
| 0x21C || 0x180 || AdvertiseData
|-
| 0x39C || 0x8C || Reserved
|-
| 0x428 || 0x8 || [6.0.0-?] Challenge (set to the output from [[ETicket_services|es]] cmd1501 during network creation) ([?+] only used internally, not exposed in LdnNetworkInfo anymore)
|}

= NetworkInfo =
This is "nn::ldn::NetworkInfo". This is a 0x480-byte struct.

The fields listed as Reserved (besides the fields before +0x10) are cleared during the memset and are not written to again afterwards, with cmds which return NetworkInfo.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x20 || [[#NetworkId|NetworkId]]
|-
| 0x20 || 0x30 || [[#CommonNetworkInfo|Common]]
|-
| 0x50 || 0x430 || [[#LdnNetworkInfo|Ldn]]
|}

= ScanFilter =
This is "nn::ldn::ScanFilter". This is a 0x60-byte struct with 8-byte alignment.

sdknso copies the input ScanFilter to a tmp struct on stack (with [[#ScanFilterFlag|Flag]] masking), which is then used with the cmd. sdknso only copies Bssid with [[#ScanPrivate|ScanPrivate]], with [[#Scan|Scan]] it also masks out the [[#ScanFilterFlag|Flag]] for Bssid.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x20 || [[#NetworkId|NetworkId]]
|-
| 0x20 || 0x4 || NetworkType
|-
| 0x24 || 0x6 || [[#MacAddress|Bssid]]
|-
| 0x2A || 0x22 || [[#Ssid|Ssid]]
|-
| 0x4C || 0x10 || Reserved
|-
| 0x5C || 0x4 || [[#ScanFilterFlag|Flag]]
|}

Each [[#ScanFilterFlag|Flag]] bit when set enables using the corresponding ScanFilter data. This is usually a compare with the ScanFilter data and the internal [[#NetworkInfo|NetworkInfo]] data.

* NetworkType: (ScanFilter_NetworkType & NetworkInfo_NetworkType) must be non-zero.
* Ssid: The length fields must match, then memcmp is used.

The filtering func also handles validating the Band/Channel, however these fields are internal only and are not exposed in the user ScanFilter.

= ScanFilterFlag =
This is "nn::ldn::ScanFilterFlag".

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0x0 || None
|-
| 0x1 || LocalCommunicationId
|-
| 0x2 || SessionId
|-
| 0x4 || NetworkType
|-
| 0x8 || Bssid
|-
| 0x10 || Ssid
|-
| 0x20 || SceneId
|-
| 0x21 || IntentId
|-
| 0x23 || NetworkId
|-
| 0x3F || All
|}

= NetworkConfig =
This is "nn::ldn::NetworkConfig". This is a 0x20-byte struct with 8-byte alignment.

sdknso copies the input NetworkConfig to a tmp struct on stack, which is then used with the cmd ([[#CreateNetwork]], [[#CreateNetworkPrivate]], [[#ConnectPrivate]]).

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x10 || [[#IntentId|IntentId]]
|-
| 0x10 || 0x2 || Channel
|-
| 0x12 || 0x1 || NodeCountMax
|-
| 0x13 || 0x1 || Reserved
|-
| 0x14 || 0x2 || LocalCommunicationVersion
|-
| 0x16 || 0xA || Reserved
|}

= WirelessControllerRestriction =
This is "nn::ldn::WirelessControllerRestriction". This is an u32 enum.

This is used to determine the value passed to [[BTM_services|btm]] SetWlanMode.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || Disabled
|-
| 1 || Enabled
|}

= WirelessAudioRestriction =
This is "nn::ldn::WirelessAudioRestriction". This is an u32 enum.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || Disabled
|-
| 1 || Enabled
|}

= SecurityMode =
This is "nn::ldn::SecurityMode". This is an u32 enum.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || Any
|-
| 1 || Product
|-
| 2 || Debug
|-
| 3 || SystemDebug
|}

Value:
* 1-2: Broadcast Action frame data is encrypted.
* 3: Broadcast Action frame data is plaintext.

* 1: Data frames are encrypted.
* 2-3: Data frames for normal data-transfer are plaintext - the network is Open.

= SecurityConfig =
This is "nn::ldn::SecurityConfig". This is a 0x44-byte struct with 2-byte alignment.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x2 || [[#SecurityMode|SecurityMode]] (overwritten by [[#CreateNetwork]]/[[#CreateNetworkPrivate]] and [[#Connect]]/[[#ConnectPrivate]], the value used internally by these cmds must be 1-3)
|-
| 0x2 || 0x2 || PassphraseSize (must be 0x10-0x40)
|-
| 0x4 || 0x40 || Passphrase (used with key derivation)
|}

= SecurityParameter =
This is "nn::ldn::SecurityParameter". This is a 0x20-byte struct with 1-byte alignment.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x10 || ServerRandom (used with the same key derivation as [[#SecurityConfig]])
|-
| 0x10 || 0x10 || [[#SessionId|SessionId]]
|}

= UserConfig =
This is "nn::ldn::UserConfig". This is a 0x30-byte struct with 1-byte alignment.

An error is thrown if UserName+0x20 is non-zero.

sdknso copies the input UserConfig to a tmp struct on stack, which is then used with the cmd. Only the first 0x20-bytes are copied, with the rest cleared.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x21 || UserName (NUL-terminated string for the user name)
|-
| 0x21 || 0xF || Reserved
|}

= AddressEntry =
This is "nn::ldn::AddressEntry". This is a 0xC-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || [[#Ipv4Address]]
|-
| 0x4 || 0x6 || [[#MacAddress|MacAddress]]
|-
| 0xA || 0x2 || Reserved
|}

= AcceptPolicy =
This is "nn::ldn::AcceptPolicy". This is an u8.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || AlwaysAccept
|-
| 1 || AlwaysReject
|-
| 2 || BlackList (addresses in the [[#AddAcceptFilterEntry|list]] are not allowed)
|-
| 3 || WhiteList (only addresses in the [[#AddAcceptFilterEntry|list]] are allowed)
|}

= ConnectOption =
This is "nn::ldn::ConnectOption". This is an u32 bitmask.

There's two versions of the sdknso funcs for [[#Connect]]/[[#ConnectPrivate]]: the version where the ConnectOption isn't user-specified uses a default value of 0x1 for it, with the same ShowError code without the bit0 check.

When bit0 here is set after using the above cmds, the sdknso funcs will use [[Error_Applet|ShowError]] with the returned Result if: (rc & 0x3FE1FF) == 0xE0CB.

This must be <=0x1, besides this validation ConnectOption is ignored by [[#Connect]]/[[#ConnectPrivate]].

= DisconnectReason =
This is "nn::ldn::DisconnectReason".

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| -1 || Unknown
|-
| 0 || None
|-
| 1 || DisconnectedByUser
|-
| 2 || DisconnectedBySystem
|-
| 3 || DestroyedByUser
|-
| 4 || DestroyedBySystem
|-
| 5 || Rejected
|-
| 6 || SignalLost
|}

= OperationMode =
This is "nn::ldn::OperationMode". This is an u32 enum.

This controls bit1 in the value passed to [[WLAN_services|wlan:lcl]] cmd0/cmd1: bit1 = OperationMode==1.

Value 1 seems to affect power (?) related fields in the beacon tags?

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || Stable
|-
| 1 || HighSpeed
|}

= Protocol =
This is "nn::ldn::Protocol". This is an u32 enum.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || Default
|-
| 1 || NX
|-
| 2 || [S2]
|-
| 3 || [20.0.0+] (NXAndOunce?)
|-
| 4 || [S2] [20.0.0+]
|}

The Initialize* cmds configure state the same as using [[#SetProtocol|SetProtocol]] with Protocol NX.

There's S2-only values which enables using Ounce-only keys. The following uses new Ounce-only keys (with S2 hosting):
* In-game ldn-usage for a S2-only Application.
* Local-game-update with a S2-only Application.
* Local-game-update for a S1-game which has a Nintendo Switch 2 Edition available, even without the S2-Edition being installed.

There's system-titles which [[20.0.0|use]] SetProtocol. While there's game(s) which use SetProtocol, there's no known (?) games using Protocol3 (excluding GameShare which is system).

[S2] Protocol2 and Protocol4 appear to be identical to Protocol3 except for using [[SPL_services|Ounce]] keys (?). The [[SPL_services|Generation]] is determined with the Protocol: Protocol2 is Generation 0, Protocol4 Generation 1. The following uses each Protocol:
* Protocol2: Mario Kart World
* Protocol4: lcs (local-content-share), Splatoon Raiders (this might be just due to the value used for [[LDN_services#SetProtocol|Default]] being bumped?)

[S2] Keys are generated by passing the SHA256 hash as the KeySource to the relevant [[SPL_services|spl:ldn]] command with the above Generation, with the full hash being passed to the Ounce cmds. Only the first 0x10-bytes of the output key is used, since AES-128 is used even with Ounce.

On NX, the Protocol [[#SetProtocol|permission-bitmask]] is always set to 0xA (1 and 3). On Ounce, all services have this set to 0x1E, except for one which has it set to 0xA (which is likely the one for S1-compat). 0x1E allows additional protocol values 2 and 4.

= ActionFrameSettings =
This is "nn::ldn::ActionFrameSettings". This is a 0x80-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || LocalCommunicationId
|-
| 0x8 || 0x34 || Reserved
|-
| 0x3C || 0x2 || SecurityMode
|-
| 0x3E || 0x2 || PassphraseSize (Must be 0x10-0x40)
|-
| 0x40 || 0x40 || Passphrase
|}

SecurityMode must be 1-2. The same SecurityMode override functionality from elsewhere is used later with this.

The same LocalCommunicationId override/validation from elsewhere is used with the input as well.

= MessageFlagSet =
This is "nn::ldn::MessageFlagSet". This is a BitFlagSet object for [[#MessageFlag]].

= MessageFlag =
This is "nn::ldn::MessageFlag".

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 ||
|}

[[#SendActionFrame|SendActionFrame]]/[[#RecvActionFrame|RecvActionFrame]] handles bit0 the same way as the MessageFlag with lp2p [[#SendToOtherGroup|SendToOtherGroup]]/[[#RecvFromOtherGroup|RecvFromOtherGroup]].

= MacAddress =
This is "nn::lp2p::MacAddress". Same as [[#MacAddress|MacAddress]].

= GroupId =
This is "nn::lp2p::GroupId". This is a 6-byte struct with 1-byte alignment.

This is a WiFi BSSID.

= NodeInfo =
This is "nn::lp2p::NodeInfo". This is a 0x80-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || || <code>struct sockaddr</code> for the IP address.
|-
| 0x24 || 0x6 || [[#MacAddress_2|MacAddress]]
|}

= GroupInfo =
This is "nn::lp2p::GroupInfo". This is a 0x200-byte struct.

[[Mario Kart Live: Home Circuit|mklive]] sets the SSID to a string generated from random data.

[[#Scan_2|Scan]] only uses the following fields for the cmd input struct: SupportedPlatform/Priority, Frequency/Channel, and PresharedKeyBinarySize/PresharedKey.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x10 || Wrapped master key. When zero, set to randomly-generated data. This is decrypted with a "static AES key" and used to derive the 4 encryption keys for the session.
|-
| 0x10 || 0x8 || LocalCommunicationId. When zero, the value from control.nacp is loaded. This is later validated by [[#Join]]/[[#CreateGroup]] the same way as the [[#NetworkConfig]] field. Used during key derivation to derive keys B and D.
|-
| 0x18 || 0x6 || [[#GroupId]] ("GROUP ID (BSSID)"). When zero, the default is used. The default should be used here: an error is thrown if the data here doesn't match the output from [[WLAN_services|wlan:lcl]] cmd2.
|-
| 0x1E || 0x21 || ServiceName ("GROUP NAME (SSID)"). NUL-terminated string. See below.
|-
| 0x3F || 0x1 || s8 Flags count. Must be <=0x3F.
|-
| 0x40 || 0x40 || Array of s8 with the above count. Each entry value must be <=0x3F. Each entry is an array index used to load a set of flags from a global array with the specified index. global_flags are also masked with flags loaded from here. User-processes use entryval=1 as the default, with [11.0.0+] entryval=0 can be used for standard WPA2-PSK (see +0x8A).
|-
| 0x80 || 0x1 || SupportedPlatform. Must match value 1. 0 is PlatformIdNX, 1 is PlatformIdRcd.
|-
| 0x81 || 0x1 || MemberCountMax. s8, Must be <=0x8. During group creation this is passed to [[WLAN_services|wlan:lcl]] cmd40, when this is value 0 a default of value 1 is passed. During group-creation when the below +0x88 field is not value 0x2, the passed [[BTM_services#SetWlanMode|WlanMode]] is <code>x81_field_val > 3</code>.
|-
| 0x82 || 0x1 ||
|-
| 0x84 || 0x2 || Frequency. Wifi frequency: 24 = 2.4GHz, 50 = 5GHz.
|-
| 0x86 || 0x2 || s16 Channel ("CHANNEL"). Wifi channel number. 0 = use default, otherwise this must be one of the following depending on the frequency field:
* 24: 1, 6, 11.
* 50: 36, 40, 44, 48.
|-
| 0x88 || 0x1 || NetworkMode. Used during group-creation to determine the [[BTM_services#SetWlanMode|WlanMode]] to use. When this is value 0x2, mode=3 is used, otherwise it's determined via the +0x81 field.
|-
| 0x89 || 0x1 || PerformanceRequirement.
|-
| 0x8A || 0x1 || Security type, used during key derivation. 0 = use defaults, 1 = plaintext, 2 = encrypted. [11.0.0+] 3: Standard WPA2-PSK.
|-
| 0x8B || 0x1 || StaticAesKeyIndex. s8, used as the array-index for selecting the KeySource used with [[SPL_services#GenerateAesKek|GenerateAesKek]] during key derivation. Should be 1-2, otherwise GenerateAesKek is skipped and zeros are used for the AccessKey instead.
|-
| 0x8D || 0x1 || Priority. Must match one of the following, depending on the used service (doesn't apply to [[#Join]]): 55 = SystemPriority (lp2p:sys), 90 = ApplicationPriority (lp2p:app and lp2p:sys).
|-
| 0x8E || 0x1 || StealthEnabled. Bool flag, controls whether the SSID is hidden.
|-
| 0x8F || 0x1 || If zero, a default value of 0x20 is used.
|-
| 0x1C0 || 0x1 || PresharedKeyBinarySize. Must be 0x20 for PresharedKeyBinary. [11.0.0+] With WPA2-PSK, this must be value 1.
|-
| 0x1C1 || 0x3F ([9.0.0-10.2.0] 0x20) || PresharedKey. Used to derive encryption keys A and C. [11.0.0+] With WPA2-PSK, this is the passphrase string (length must be at least 8).
|}

In order for the ServiceName to be valid without a new one being generated, the following checks must pass:
* It loops through the characters in the string, looking for the first '_' character:
** The loop will exit once a '_' character is found.
** The character must be '-', or alphanumeric (lowercase/uppercase), otherwise the function will immediately return failure.
** The loop will also exit once string_pos is >19, in which case the function will also immediately return failure.
* Then it checks the 11 characters which follow the above:
** The character must be hex: '0'-'9', or 'A-F' / 'a-'f.
* The following character must be a NUL-terminator.
* The last hex character above, then the characters for the whole string prior to the last hex character are summed. return sum % 0x2B == 0. u32 is used for these calculations. (Return success when sum is a multiple of 0x2B, otherwise return failure)

If the above fails, then the following runs, otherwise it just returns 0:
* It loops through the characters in the string.
** The character must be '-', or alphanumeric (lowercase/uppercase), otherwise the function will immediately return failure.
** The loop will exit once string_pos>20 is reached, or when a NUL-terminator is reached.
* Once finished, success is returned if string_pos-1 is <20, otherwise failure is returned (which also immediately occurs if the first character is a NUL-terminator).

If the above fails, an error is returned, otherwise a new ServiceName is generated:
* Up to 20 characters are copied from the original ServiceName to the output ServiceName, stopping once the limit is reached or when a NUL-terminator is reached.
* '_' is appended to the string.
* <code>nn::util::TSNPrintf({strptr following the above character}, {remaining size}, "%02X%02X%02X%02X%02X", [[#GroupId|GroupId_byte3]], [[#GroupId|GroupId_byte4]], [[#GroupId|GroupId_byte5]], ([[SPL_services#IsDevelopment|IsDevelopment]] ? 0x80 : 0) | 0x1, 0);</code>
* Then the last character is set to the output from a calling a function:
** All string characters which were already written are summed same way as above. Then: <code>return character_lookup_table[sum % 0x2B];</code> (If the length passed to this function is 0, this will instead just return character_lookup_table[0])
*** character_lookup_table contains 0x2B entries: [V-A][k-a][5-0][Z-W].

loaded_flags are first loaded from elsewhere, then masked with the above flags when available. loaded_flags are used when +0x8A is 0. global_flags are loaded from global data. These flags are only used with [[#CreateGroup]]/[[#Join]]. Flags (note that the following was updated with [11.0.0+], and differs from below):
* Bit2 clear:
** global_flags must be non-zero, and loaded_flags bit1 must be set.
** u8 +0x8A is set to value 1.
** When the cached [[SPL_services#IsDevelopment|IsDevelopment]] value is false (retail), an error is thrown.
** u8 +0x8B is set to value 0.
* Otherwise, if bit2 is set:
** u8 +0x8A is set to value 2.
** global_flags bit1 set:
*** u8 +0x8B is set to value 1.
** Otherwise, if global_flags bit2 is set:
*** u8 +0x8B is set to value 2.

= ScanResult =
This is "nn::lp2p::ScanResult". This is a 0x300-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x200 || [[#GroupInfo]]
|-
| 0x200 || 0x1 ||
|-
| 0x206 || 0x2 || AdvertiseData size.
|-
| 0x208 || 0x80 || AdvertiseData
|}

= Network protocol =
== ldn ==
A beacon and Action frame are broadcasted. The SSID in the beacon is hidden (32-bytes with value 0). For [[#Scan]]/[[#ScanPrivate]] it doesn't matter if no beacon is available ([[#NetworkInfo]] is the same), as long as the Action frame is broadcasted. However, the Station will not send a probe-request during connection if no beacon is available (and therefore not attempt any communication with the AccessPoint). The beacon doesn't have any custom Nintendo data, that data is in the Action frame.

During connection, the Station first sends a probe-request using the [[#NetworkInfo|generated]] SSID from the Action frame. If the probe-response contains the expected data for the [[#SecurityConfig]] type, the Station then proceeds to connect to the AccessPoint.

Keys are derived with: <code>GenerateAesKek(AccessKey, KeySource, Generation, Option=0); GenerateAesKey(out_key, AccessKey, {output from SHA256(data_to_hash)});</code> The key for data-frames, if [[#SecurityConfig|enabled]], is derived from a buffer containing: {[[#SecurityParameter]]+0x0} followed by {[[#SecurityConfig]] Passphrase with the specified PassphraseSize}. The [[#ActionFrame]]/data-frame keys are derived roughly the same, the only difference is the data for hashing + the [[SPL_services|KeySource]]. The key derived by ldn is used directly as the static CCMP key for all data-frames (CCMP / MIC is standard). When [[#Protocol|Protocol]] is 3 the [[SPL_services|Generation]] is [[19.0.0|0x13]] instead of 0x0, for all of the previously mentioned keys derivation.

Then the Station scans for an [[#ActionFrame]] for loading the [[#NetworkInfo]].

Once connected, the AccessPoint sends Epigram-vendor Action frame(s) (same data) to the Station, the Station doesn't require these frames: <code>dd1afeedfacedeadbeef010000000a00000000000000000000000000</code>. Then the Station must Authenticate with the AccessPoint, this is custom. The Station sends a frame (a maximum of 3 times in some cases if errors occur, with the same data), and the AccessPoint sends a response. Once Authenticated, the node is added to the [[#NodeInfo|NodeInfo]] array in [[#NetworkInfo]]. If the Station does not successfully Authenticate X-seconds after connecting, the AccessPoint disconnects the Station. If the Station fails to Authenticate, the Station itself will disconnect as well.

After Authentication the Station will scan for another [[#ActionFrame]], with frame-comparision enabled with the above frame (frame must have been updated since the previous scan). The Station locates the index for a [[#MacAddress|MacAddress]] matching itself in the [[#NetworkInfo]] [[#NodeInfo|NodeInfo]] array (the entry for the AccessPoint is skipped), throwing an error if not found. After validating the LocalCommunicationVersion, it proceeds to handle ARP setup below.

This does not use DHCP, each node on the network has to manually setup IP-config with the [[#NodeInfo|NodeInfo]] array in [[#NetworkInfo]]. [?+] After the client is [[#EthFrame|authenticated]] ARP may be used in some cases however.

At this point standard sockets can be used over Data frames.

=== EthFrame ===
The custom Ethernet frames have the following structure:
* "Type: IEEE 802a OUI Extended Ethertype (0x88b7)"
* "IEEE802a OUI Extended Ethertype":
** "Organization Code: 00:22:aa (Nintendo Co., Ltd.)"
** "Protocol ID: {...}"
*** Depends on the frame:
*** 0x0102: [[#Authentication]]
*** 0x0103: ?
* The first byte of Data is value 0, then the ProtocolID-specific data follows, see below.
** ProtocolID 0x0103 frames are sent by the AccessPoint to the Station. This is 0x20-bytes of zeros, except for the first byte which is 0x3. This is sent by the AccessPoint prior to destroying the network.

==== Authentication ====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || [[#AuthVersion]]
|-
| 0x1 || 0x1 || Low u8 for the size.
|-
| 0x2 || 0x1 || Status. 0 = success, non-zero = error.
|-
| 0x3 || 0x1 || [2.0.0+] bool flag. The AccessPoint verifies that this is not set. Always set to 1 by the AccessPoint in the response. [2.0.0-?] The Station only uses this when the [[#AuthVersion]] is >=2.
|-
| 0x4 || 0x1 || [6.0.0+] High u8 for the size.
|-
| 0x5 || 0x1 || [20.0.0+] AuthEncryptionType, must match the type being used by the [[#Protocol|Protocol]]. 0 = plaintext ([[#Protocol|Protocol]] NX), 1 = AES-128-GCM ([[#Protocol|Protocol]] non-NX).
|-
| 0x6 || 0x2 || Unused, zeros.
|-
| 0x8 || 0x20 || [[#NetworkInfo]]+0, must match the corresponding data in [[#NetworkInfo]] when the receiving node verifies this. With the
AccessPoint->Station frame, the Station verifies that this matches the data previously sent to the AccessPoint.
|-
| 0x28 || 0x10 || [[#NetworkInfo]]+0x50, must match the corresponding data in [[#NetworkInfo]] when the receiving node verifies this. With the
AccessPoint->Station frame, the Station verifies that this matches the data previously sent to the AccessPoint.
|-
| 0x38 || 0x10 || AuthEncryptionType1: Used for key derivation.
Station->AccessPoint: The Station sets this to random data. Unused by the AccessPoint (besides the above), except for copying into the response.

AccessPoint->Station: +0x38 from the data originally sent by the Station. The Station verifies that this matches the previously sent data.
|-
| 0x48 || 0x10 || Only present with AuthEncryptionType1: AES-128-GCM MAC tag.
|-
| 0x48 (0x58 with AuthEncryptionType1) || || Frame-specific payload data, with the above size. The total frame size - {offset of the start of this data in the frame} must match the above size.
|}

The Station sets the above size to 0x40 ([6.0.0+] if [[#NetworkInfo]]+0x13 is <3) ([?+] 0x64 regardless of [[#AuthVersion]]). [6.0.0+] The Authentication challenge is only used/enabled if that value is >=3, and [[#IUserLocalCommunicationService]] is being used.

The AccessPoint sets the above size to 0x40 ([6.0.0+] 0x0 if the +0x0 [[#AuthVersion]] is <3) ([?+] 0x84 regardless of [[#AuthVersion]]). [6.0.0+] The AccessPoint will only use/enable the Authentication challenge when the +0x0 [[#AuthVersion]] is >=3, and [[#IUserLocalCommunicationService]] is being used. This data will not be included in the frame if the status field indicates error.

[6.0.0+] Support for the Authentication challenge with [[ETicket_services|es]] cmds 1501-1504 was added.

AuthEncryptionType1: The key is derived essentially the same as the data-frame CCMP key, except the input data for hashing is the 0x10-bytes at +0x38 (this also only supports using [[SPL_services|Generation]] 0x13, returning immediately if the input param indicates otherwise due to the [[#Protocol|Protocol]]). The encrypted AES-128-GCM data starts at +0x58 with the above size. The 0xC-bytes IV is at +0x0, the AAD is at +0x0 size 0x48-bytes.

The AccessPoint will not respond to frames where the source mac-address is unrecognized.

Station->AccessPoint payload data, relative to frame_end above (frame size depends on whether the challenge is enabled):

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x20 || [[#UserConfig]]+0. Copied into state by the AccessPoint.
|-
| 0x20 || 0x2 || Big-endian LocalCommunicationVersion. Byte-swapped by the AccessPoint then copied into state. [?+] This is now ignored.
|-
| 0x22 || 0x1 || [19.0.0+] [[#NodeInfo|NodeInfo]] +0x2D. Copied into state by the AccessPoint. On NX the Station always sets this to 0 in the sent payload-data.
|-
| 0x23 || 0x1D || Zeros, unused by the AccessPoint.
|-
| 0x40 || 0x24 || [6.0.0+] Zeros, unused by the AccessPoint.
|-
| 0x64 || 0x300 || [6.0.0+] Authentication challenge data. If enabled, the total frame size must be >= {end offset of this data in the frame}. The frame data does not include this if it's not enabled.
|}

AccessPoint->Station response payload data, relative to frame_end above (frame size depends on whether the challenge is enabled):

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || Unused, always set to 0. [S2] This is usually set to value 1?
|-
| 0x1 || 0x3F || Zeros. [6.0.0-?] Only included in the frame if it's enabled (+0x0 [[#AuthVersion]] >= 3). Unused by the Station.
|-
| 0x40 || 0x44 || [6.0.0-?] Only included in the frame if it's enabled (+0x0 [[#AuthVersion]] >= 3). Unused by the Station.
|-
| 0x84 || 0x100 || [6.0.0+] If enabled, Authentication challenge response data. Not included in the frame if it's not enabled.
|}

===== AuthVersion =====
Must be 0x1-0xF (<0x10 with newer versions).

[?+] When the AccessPoint is handling the [[#Authentication|Authentication]] EthFrame, the AuthVersion must be >=1 for [[#Protocol|Protocol]] NX, and >=4 for [[#Protocol|Protocol]] 3.

{| class="wikitable" border="1"
|-
! Value || SystemVersion
|-
| 1 || [1.0.0+]
|-
| 2 || [2.0.0+]
|-
| 3 || [6.0.0+]
|-
| 4 || [19.0.0+]
|}

=== ActionFrame ===
The Action frames have the following structure:
* "Fixed parameters":
** "Category code: Vendor Specific (127)"
** "OUI: 00:22:aa (Nintendo Co., Ltd.)"
* The Data starts with the following header:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x2 || 04 00 in sent frames.
|-
| 0x2 || 0x2 || Protocol ID, must be 0x0101.
|-
| 0x4 || 0x2 || Must be 0.
|-
| 0x6 || 0x2 || Zeros, unused.
|}

Then the actual data follows:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x20 || [[#NetworkInfo]]+0x0. The u64/u16 are big-endian. Outside of [[#Scan]]/[[#ScanPrivate]], this must match the previously loaded data for this.
|-
| 0x20 || 0x1 || [[#AuthVersion]]. Copied to [[#NetworkInfo]]+0x63. When comparing with a previous frame is enabled, this must match the value from the previous frame.
|-
| 0x21 || 0x1 || Encryption type: 1 = plaintext, 2 = AES-128-CTR, [20.0.0+] 3 = AES-128-GCM, {frames with other values are ignored by [[#Scan]]/[[#ScanPrivate]]}. Must match the type which is currently being used: with [[#Scan]]/[[#ScanPrivate]] this is determined via this field, otherwise [[#SecurityConfig]] is used to determine this.
|-
| 0x22 || 0x2 || Big-endian u16 size for the data starting at +0x48 (+0x38 with EncryptionType3), and must match {total frame size relative to +0x0 above} - {header_size}.
|-
| 0x24 || 0x4 || Big-endian u32 Counter. The initial value is randomly-generated. This is incremented each time the below content is updated (including initial creation). Also used by the Station to determine whether the frame changed compared to a previous one. When comparing against a previous frame, new_counter-prev_counter must be <= 0xFF, and the counters must not match.
|-
| 0x28 || 0x20 || EncryptionType1-2: SHA256 hash over the entire frame starting at +0x0, with the above size + 0x48. During hashing, this hash is cleared, with the new hash overwriting the original in memory (the original is copied to stack for comparing).
|-
| 0x28 || 0x10 || EncryptionType3: AES-128-GCM MAC tag (replaces the SHA256 hash).
|}

Using EncryptionType3 outside of [[#Scan]]/[[#ScanPrivate]] is enabled with [[#Protocol|Protocol]] non-NX.

When encryption is enabled, the encrypted data is at +0x28 (+0x38 with EncryptionType3) with size {remaining frame size}. The key is derived from the raw 0x20-bytes at +0x0. The CTR/IV is {raw Counter above without byte-swap}, with the rest cleared to zeros. The AAD for AES-128-GCM is at +0x0 size 0x28-bytes.

Originally [[#Scan]]/[[#ScanPrivate]] used the EncryptionType field to determine encryption handling. With [18.0.0+] these now set an internal SecurityMode field to 0 (Any) initially, then later uses the same SecurityMode override as [[#CreateNetwork|CreateNetwork]]. The internal SecurityMode field is used to determine encryption handling: Any uses the EncryptionType field like before. With non-zero the encryption handling is determined as required by the SecurityMode.

The content data at +{above_header_size} follows, which has the size specified above (which must be >=0x500 with EncryptionType1-2), where all fields are big-endian. For EncryptionType1-2:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x10 || [[#NetworkInfo]]+0x50
|-
| 0x10 || 0x2 || [[#NetworkInfo]]+0x60
|-
| 0x12 || 0x1 || [[#NetworkInfo]]+0x62
|-
| 0x13 || 0x1 || Unused
|-
| 0x14 || 0x2 ||
|-
| 0x16 || 0x1 || s8 [[#NetworkInfo]]+0x66, clamped to range 1-8.
|-
| 0x17 || 0x1 || s8 [[#NetworkInfo]]+0x67, clamped to range 1-8.
|-
| 0x18 || 0x1C0(0x38*8) || Array of the below node struct.
|-
| 0x1D8 || 0x2 || Unused
|-
| 0x1DA || 0x2 || [[#NetworkInfo]]+0x26A
|-
| 0x1DC || 0x180 || [[#NetworkInfo]]+0x26C
|-
| 0x35C || 0x19C || Unused
|-
| 0x4F8 || 0x8 || [6.0.0+] [[#NetworkInfo]]+0x478
|}

For EncryptionType3:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x10 || [[#NetworkInfo]]+0x50
|-
| 0x10 || 0x8 || [[#NetworkInfo]]+0x478 [S2] The Station seems to verify that this is 0 when the Challenge is unused (ldn:s)? Throws an error if set before connecting to an [[#Protocol|Ounce]] network.
|-
| 0x18 || 0x1 || [[#NetworkInfo]]+0x60
|-
| 0x19 || 0x1 || [[#NetworkInfo]]+0x62
|-
| 0x1A || 0x2 || s16 LocalCommunicationVersion. Must not be negative.
|-
| 0x1C || 0x8 || Unused?
|-
| 0x24 || 0x2 || Same as +0x14 in the above struct for EncryptionType1-2.
|-
| 0x26 || 0x1 || s8 [[#NetworkInfo]]+0x66 (NodeCountMax)
|-
| 0x27 || 0x1 || s8 [[#NetworkInfo]]+0x67 (NodeCount)
|-
| 0x28 || NodeCount*0x30 || Array of the below node struct.
|-
| 0x28 + (NodeCount*0x30) || 0x2 || [[#NetworkInfo]]+0x26A (AdvertiseDataSize)
|-
| 0x2A + (NodeCount*0x30) || AdvertiseDataSize || [[#NetworkInfo]]+0x26C (AdvertiseData)
|}

The data here is copied into [[#NetworkInfo]].

Node data used in the above array (all fields big-endian), which are copied into the [[#NetworkInfo]] [[#NodeInfo|NodeInfo]] array. For EncryptionType1-2:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || [[#Ipv4Address]]
|-
| 0x4 || 0x6 || [[#MacAddress|MacAddress]]
|-
| 0xA || 0x1 || bool IsConnected
|-
| 0xB || 0x1 || [19.0.0+] [[#NodeInfo|NodeInfo]] +0x2D
|-
| 0xC || 0x20 || First 0x20-bytes of [[#UserConfig]].
|-
| 0x2C || 0x2 || s16 LocalCommunicationVersion
|-
| 0x2E || 0xA || Unused
|}

For EncryptionType3:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || [[#Ipv4Address]]
|-
| 0x4 || 0x6 || [[#MacAddress|MacAddress]]
|-
| 0xA || 0x1 || NodeId
|-
| 0xB || 0x1 || [[#NodeInfo|NodeInfo]] +0x2D
|-
| 0xC || 0x20 || First 0x20-bytes of [[#UserConfig]].
|-
| 0x2C || 0x4 || Unused
|}

=== ActionFrame2 ===
The Action frames used by [[#SendActionFrame|SendActionFrame]]/[[#RecvActionFrame|RecvActionFrame]] have the following structure:
* "Fixed parameters":
** "Category code: Vendor Specific (127)"
** "OUI: 00:22:aa (Nintendo Co., Ltd.)"
* The Data starts with the following header:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x2 || 04 00
|-
| 0x2 || 0x2 || Protocol ID, must match big-endian 0x0102.
|-
| 0x4 || 0x2 || 00 00
|-
| 0x6 || 0x2 || 00 00
|}

Then the actual data follows (all fields big-endian):

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || [[#AuthVersion]]
|-
| 0x1 || 0x1 || EncryptionType, must match the expected type for the current SecurityMode. 1 = plaintext, 2 = AES-128-GCM.
|-
| 0x2 || 0x2 || Padding
|-
| 0x4 || 0x4 || Counter
|-
| 0x8 || 0x8 || LocalCommunicationId
|-
| 0x10 || 0x10 || Used with key derivation.
|-
| 0x20 || 0x10 || EncryptionType2: AES-128-GCM MAC tag.
|-
| 0x30 || Remaining frame size || Data payload
|}

The 0xC-byte IV for AES-128-GCM is the raw 4-bytes from the above Counter, with the rest cleared to zeroes. The encrypted data is at +0x30, with the remaining frame size. The AAD is the 0x20-bytes at +0x0.

The key is derived similar to the regular action-frame key (same KeySource), except: the Generation is always [[17.0.0|0x11]], with the following data for hashing: {big-endian LocalCommunicationId} {+0x10 size 0x10-bytes} {[[#ActionFrameSettings]] Passphrase with the specified PassphraseSize}.

The data payload is the data buffer for [[#SendActionFrame|SendActionFrame]]/[[#RecvActionFrame|RecvActionFrame]].

== lp2p ==
This is used for communicating with accessories (external devices on [11.0.0+]) over local wifi. [[Mario Kart Live: Home Circuit]] uses this. [11.0.0+] [[Album_Applet|LibraryAppletPhotoViewer]] uses this.

A beacon is broadcasted.

Action frames are only sent when done so by [[#SendToOtherGroup]] (other than the Epigram one mentioned below).

Communication uses sockets with standard Data frames and the above Action frames. Switch consoles presumably only use the Action frames to communicate with each other?

Key A derived by ldn-sysmodule is used directly as the static CCMP key for all data-frames (CCMP / MIC is standard). However, with [[#GroupInfo]]+0x8A value 3, standard WPA2-PSK is used instead.

This uses infrastructure-mode (AccessPoint), and DHCP is used. The group-owner is the AccessPoint. Note that the probe response includes the same Nintendo tags included with the beacon. Once connected, the group-owner sends the same Epigram-vendor Action frame(s) described in [[#ldn]]. At this point socket communication can begin, including DHCP usage.

The DHCP server thread is started by the "nn.lp2p.StateMachine" thread eventually during group [[#CreateGroup|creation]]. The DHCP Offer option values are the following:
* "Subnet Mask: 255.255.255.0"
* "DHCP Server Identifier: {...}"
* "Broadcast Address: {...}"
* "IP Address Lease Time: (5s) 5 seconds"
* "Renewal Time Value: (0s) 0 seconds"
* "Rebinding Time Value: (0s) 0 seconds"
* "Interface MTU: 1500"

Note that the above options doesn't include "Domain Name Server" or "Router", the client device may fail to connect if it doesn't allow those DHCP options to be missing.

=== Beacon ===
The SSID in the beacon can optionally be [[#GroupInfo|hidden]] (all-zero with the same length as the original SSID). The beacon contains two vendor-specific Nintendo information elements with OUI <code>00:22:aa</code>; each IE has a 2-byte ID following the OUI. These Nintendo IEs are not used when standard WPA2-PSK is being used.

The beacon is identical to ldn, except for the following (besides SSID length difference and the lp2p-only Nintendo tags):
* "Tag: HT Capabilities (802.11n D1.10)": "HT Short GI for 20MHz" is set to "Not supported", for ldn it's "Supported".
* "Tag: Vendor Specific: Microsoft Corp.: WMM/WME: Parameter Element" "Ac Parameters ACI 0": "CW Min: 15" for lp2p, "CW Min: 63" for ldn.

Note that during group creation the beacon may be missing the Nintendo IEs in some cases, since group creation didn't finish yet.

==== Nintendo IE 0 ====

The first Nintendo IE (ID 0x0600) contains the following fixed parameters:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || Fixed 0x20; perhaps a version or other magic number.
|-
| 0x1 || 0x1 || [[#GroupInfo|SecurityType]]
|-
| 0x2 || 0x1 || [[#GroupInfo|StaticAesKeyIndex]]
|-
| 0x3 || 0x1 || Fixed zero; padding byte.
|-
| 0x4 || 0x8 || Big-endian (i.e. byte-reversed) version of [[#GroupInfo|LocalCommunicationId]]. This is the only context where LocalCommunicationId is reversed.
|-
| 0xC || 0x10 || Wrapped master key. Same as [[#GroupInfo]]+0x0.
|-
| 0x1C || 0x4 || If encryption is enabled, a randomly-generated nonce, else nothing. Appending 8 zero bytes to this yields the AES-GCM IV.
|-
| 0x20 || 0x10 || If encryption is enabled, the AES-GCM MAC tag, else nothing. All bytes prior to this (fixed 0x20 through nonce) are the additional authenticated data. All bytes after this are encrypted with key B.
|}

After this, TLV tagged parameters occur. Each TLV tag is formatted as:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || Tag type
|-
| 0x1 || 0x1 || Length
|-
| 0x2 || {above size} || Data for the tag
|}

Known TLV tags:

{| class="wikitable" border="1"
|-
! Type
! Size
! Description
|-
| 0x1 || 0x2 || Additional network parameters: 0xAB 0xCD. A=[[#GroupInfo]]+0x82, B=[[#GroupInfo|MemberCountMax]], C=[[#GroupInfo|NetworkMode]], D=[[#GroupInfo|PerformanceRequirement]].
|-
| 0x2 || 0x8 || Flags: Bitwise-or of (1<<f) for each entry in [[#GroupInfo]]+0x40
|}

==== Nintendo IE 1 ====

The second Nintendo IE (ID 0x0601) contains only TLVs. If encryption is enabled, a 0x4-byte nonce and 0x10-byte AES-GCM tag are written first, as above, and the TLVs are encrypted. Key C is used.

Known TLV tags:

{| class="wikitable" border="1"
|-
! Type
! Size
! Description
|-
| 0x21 || Varies || AdvertiseData
|}

=== ActionFrame ===
The Action frames have the following structure:
* "Fixed parameters":
** "Category code: Vendor Specific (127)"
** "OUI: 00:22:aa (Nintendo Co., Ltd.)"
* The Data starts with the following:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x2 || Usually 06 00?
|-
| 0x2 || 0x2 || Usually 20 02?(Second byte depends on whether encryption is used?)
|-
| 0x4 || 0x2 || Usually 02 00?(varies)
|-
| 0x6 || 0x8 || Big-endian version of [[#GroupInfo]]+0x10.
|-
| 0xE || 0x10 || Same as [[#GroupInfo]]+0x0.
|}

When encryption is used, the remaining data is:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || Big-endian u32 Counter. The initial value is randomly-generated (?). This is incremented with each sent Action frame.
|-
| 0x4 || {remaining size} || Encrypted user-data. Also includes 0x10-bytes of unknown data.
|}

When plaintext is used, the remaining data is:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || {remaining size} || Plaintext user-data.
|}

= Notes =
The following services are accessible to ldn:
* arp:r, bsd:s, btm, es, fatal:u, ifcfg, lm, nifm:s, pl:s, set:sys, spl:mig, wlan

[S2] Access to btm and spl:mig were replaced with bt:sys and spl:ldn.

[S2] Various objects/state have the same size/layout as S1, generally?(Other than IPC-related differences) There's also stack differences.

== Code-region Memory Layout ==
=== S2 20.2.0 ===
This is the codebin-region layout for S2 ldn 20.2.0-20.5.0. BuildId is "DC456FA4...".

The on-NX note is for the equivalent memregion location/size, memregion-size/contents compared to NX may vary.

Total size is 0x24F000-bytes.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Permissions
! Description
|-
| 0x0 || 0xE1000 || --X || .text
|-
| 0xE1000 || 0x3D000 || R-- || RO-region
|-
| 0x11E000 || 0x3A000 || RW || On NX this is at 0xEF000. The main ExpHeap is at +0x2000, on NX it's at +0x1000.
|-
| 0x158000 || 0x8000 || non-RW || On NX this is at 0x123000.
|-
| 0x160000 || 0x8000 || RW || On NX this is at 0x12B000.
|-
| 0x168000 || 0xF000 || non-RW || On NX this is at 0x139000.
|-
| 0x177000 || 0x3000 || RW || On NX this is at 0x13F000.
|-
| 0x17A000 || 0x24000 || non-RW || On NX this is at 0x14B000.
|-
| 0x19E000 || 0x4E000 || RW || On NX this is at 0x16F000.
|-
| 0x1EC000 || 0x2000 || -- || On NX this is at 0x1BD000.
|-
| 0x1EE000 || 0x2000 || {accessible} || On NX this is at 0x1BF000.
|-
| 0x1EF000 || 0x5000 || -- || On NX this is at 0x1E2000.
|-
| 0x1F4000 || 0x21000 || {accessible} || On NX this is at 0x1EA000.
|-
| 0x218000 || 0x8000 || -- ||
|-
| 0x220000 || 0x2F000 || {accessible}
|}

[[Category:Services]]

LDN services

2026-07-26T03:25:05Z

Yellows8: /* Protocol */

LDN handles all local network communication.

There's 2 IPC handler threads for all ldn:* services.

= ldn:m =
This is "nn::ldn::detail::IMonitorServiceCreator".

This has IPC max_sessions 5.

[20.2.0+] This has max_sessions 6.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#CreateMonitorService|CreateMonitorService]]
|}

== CreateMonitorService ==
Returns an [[#IMonitorService]].

The user-process closes the IMonitorServiceCreator object immediately after using this cmd.

== IMonitorService ==
This is "nn::ldn::detail::IMonitorService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#GetState|GetState]]
|-
| 1 || [[#GetNetworkInfo|GetNetworkInfo]]
|-
| 2 || [[#GetIpv4Address|GetIpv4Address]]
|-
| 3 || [[#GetDisconnectReason|GetDisconnectReason]]
|-
| 4 || [[#GetSecurityParameter|GetSecurityParameter]]
|-
| 5 || [[#GetNetworkConfig|GetNetworkConfig]]
|-
| 100 || [[#Initialize]]
|-
| 101 || [[#Finalize]]
|}

=== GetState ===
No input, returns an output [[#State|u32]].

sdknso implements this by <code>return</code>ing the u32, with 0 being returned on error.

=== GetNetworkInfo ===
Takes a type-0x1A output buffer containing a [[#NetworkInfo]].

=== GetIpv4Address ===
No input, returns an output [[#Ipv4Address]] and a [[#SubnetMask]].

=== GetDisconnectReason ===
No input, returns an output s16.

This is not exposed by sdknso.

This just returns 0.

=== GetSecurityParameter ===
No input, returns an output [[#SecurityParameter]].

This is not exposed by sdknso.

=== GetNetworkConfig ===
No input, returns an output [[#NetworkConfig]].

This is not exposed by sdknso.

=== Initialize ===
No input/output.

This is used immediately after object creation. Official sw will Abort if this fails.

This just returns 0.

=== Finalize ===
No input/output.

This is used during service exit, prior to closing the object. Official sw will Abort if this fails.

This just returns 0.

= ldn:s =
This is "nn::ldn::detail::ISystemServiceCreator".

This has IPC max_sessions 5.

[18.0.0+] The sdknso uses SessionManager with this, where the additional session-count is 0x3.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#CreateSystemLocalCommunicationService|CreateSystemLocalCommunicationService]]
|-
| 1 || [18.0.0+] [[#CreateClientProcessMonitor|CreateClientProcessMonitor]]
|}

== CreateSystemLocalCommunicationService ==
No input. Returns an [[#ISystemLocalCommunicationService]].

The user-process closes the ISystemServiceCreator object once finished with it during initialization. Official sw ignores errors from this cmd.

== CreateClientProcessMonitor ==
No input. Returns an [[#IClientProcessMonitor]].

== ISystemLocalCommunicationService ==
This is "nn::ldn::detail::ISystemLocalCommunicationService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#GetState_2|GetState]]
|-
| 1 || [[#GetNetworkInfo_2|GetNetworkInfo]]
|-
| 2 || [[#GetIpv4Address_2|GetIpv4Address]]
|-
| 3 || [[#GetDisconnectReason_2|GetDisconnectReason]]
|-
| 4 || [[#GetSecurityParameter_2|GetSecurityParameter]]
|-
| 5 || [[#GetNetworkConfig_2|GetNetworkConfig]]
|-
| 100 || [[#GetStateChangeEvent|GetStateChangeEvent]]
|-
| 101 || [[#GetNetworkInfoAndHistory|GetNetworkInfoAndHistory]]
|-
| 102 || [[#Scan|Scan]]
|-
| 103 || [[#ScanPrivate|ScanPrivate]]
|-
| 104 || [5.0.0+] [[#SetWirelessControllerPolicy|SetWirelessControllerPolicy]]
|-
| 105 || [13.1.0+] [[#SetWirelessAudioPolicy|SetWirelessAudioPolicy]]
|-
| 106 || [18.0.0+] [[#SetProtocol|SetProtocol]]
|-
| 200 || [[#OpenAccessPoint|OpenAccessPoint]]
|-
| 201 || [[#CloseAccessPoint|CloseAccessPoint]]
|-
| 202 || [[#CreateNetwork|CreateNetwork]]
|-
| 203 || [[#CreateNetworkPrivate|CreateNetworkPrivate]]
|-
| 204 || [[#DestroyNetwork|DestroyNetwork]]
|-
| 205 || [[#Reject|Reject]]
|-
| 206 || [[#SetAdvertiseData|SetAdvertiseData]]
|-
| 207 || [[#SetStationAcceptPolicy|SetStationAcceptPolicy]]
|-
| 208 || [[#AddAcceptFilterEntry|AddAcceptFilterEntry]]
|-
| 209 || [[#ClearAcceptFilter|ClearAcceptFilter]]
|-
| 300 || [[#OpenStation|OpenStation]]
|-
| 301 || [[#CloseStation|CloseStation]]
|-
| 302 || [[#Connect|Connect]]
|-
| 303 || [[#ConnectPrivate|ConnectPrivate]]
|-
| 304 || [[#Disconnect|Disconnect]]
|-
| 400 || [[#Initialize_2|Initialize]]
|-
| 401 || [[#Finalize_2|Finalize]]
|-
| 402 || [4.0.0+] [[#SetOperationMode|SetOperationMode]]
|-
| 403 || [7.0.0+] [[#InitializeWithVersion|InitializeWithVersion]]
|-
| 404 || [19.0.0+] [[#InitializeWithPriority|InitializeWithPriority]]
|-
| 500 || [18.0.0+] [[#EnableActionFrame|EnableActionFrame]]
|-
| 501 || [18.0.0+] [[#DisableActionFrame|DisableActionFrame]]
|-
| 502 || [18.0.0+] [[#SendActionFrame|SendActionFrame]]
|-
| 503 || [18.0.0+] [[#RecvActionFrame|RecvActionFrame]]
|-
| 505 || [18.0.0+] [[#SetHomeChannel|SetHomeChannel]]
|-
| 600 || [18.0.0+] [[#SetTxPower|SetTxPower]]
|-
| 601 || [18.0.0+] [[#ResetTxPower|ResetTxPower]]
|}

=== GetState ===
No input, returns an output [[#State]].

sdknso implements this by <code>return</code>ing the u32, with 0 being returned on error / when service isn't initialized.

=== GetNetworkInfo ===
Takes a type-0x1A output buffer containing a [[#NetworkInfo]].

[[#GetState|State]] must be 3 or 5.

=== GetIpv4Address ===
No input, returns an output [[#Ipv4Address]] and a [[#SubnetMask]].

=== GetDisconnectReason ===
No input, returns an output [[#DisconnectReason]].

sdknso implements this by <code>return</code>ing the s16 as a s32, with -1 being returned on error.

=== GetSecurityParameter ===
No input, returns an output [[#SecurityParameter]].

=== GetNetworkConfig ===
No input, returns an output [[#NetworkConfig]].

=== GetStateChangeEvent ===
No input, returns an output Event handle.

sdknso uses EventClearMode=1 with this. sdknso will Abort if this cmd fails.

This is signaled when the data returned by [[#GetNetworkInfo]]/[[#GetNetworkInfoAndHistory]] is updated.

=== GetNetworkInfoAndHistory ===
Takes a type-0x1A output buffer containing a [[#NetworkInfo]] and a type-0xA output buffer containing an array of [[#NodeLatestUpdate]].

The array count must be 8.

=== Scan ===
Takes a type-0x22 output buffer containing an array of [[#NetworkInfo]], a s16 channel, a [[#ScanFilter]], returns an output s16 total_out.

sdknso copies the output s16 to a s32, the value passed for the input s16 is from an user-specified s32 (user-apps generally use value 0 for this).

This is the same as [[#ScanPrivate]], except this also has the same channel-override functionality as [[#CreateNetwork]].

[[#GetState|State]] must be 3-5.

The array count must be at least 1. This is clamped to a maximum of 0x18.

=== ScanPrivate ===
Takes a type-0x22 output buffer containing an array of [[#NetworkInfo]], a s16 channel, a [[#ScanFilter]], returns an output s16 total_out.

sdknso copies the output s16 to a s32, the value passed for the input s16 is from an user-specified s32.

See [[#Scan]].

=== SetWirelessControllerPolicy ===
Takes an input [[#WirelessControllerRestriction]], no output.

[[#GetState|State]] must be 1.

The input value is written into state.

=== SetWirelessAudioPolicy ===
Takes an input [[#BluetoothAudioDeviceConnectableMode]], no output.

=== SetProtocol ===
Takes an input [[#Protocol|u32]], no output.

This cmd was implemented with [20.0.0+], prior to that this just returned an error.

The sdk user-process func will pass value 1 (2 on Ounce) to the cmd when the input [[#Protocol|Protocol]] is 0, valid values passed directly when recognized, otherwise Abort. User-processes use SetProtocol immediately after initializing ldn.

[20.0.0+] The ldn initialization functionality in sdknso also uses this with value 1 (NX) eventually after the init cmd was used successfully.

The input is validated, then a vfunc is called.

The cmd_input must be non-zero. BIT(cmd_input) must be set in a state-field, otherwise a separate Result is returned. This is a permission [[#Protocol|bitmask]] which originates from the ldn:* service object being used.

The vfunc sends a message to another thread with the input u32 as the param, and returns the response from that.

The thread msg-queue-handler (besides other validation) uses the input param to select what values to write to state fields. On NX only input value 1 or 3 is allowed, with an error being thrown otherwise. The previously mentioned validation includes verifying that [[#GetState|State]] is Initialized.

=== OpenAccessPoint ===
No input/output.

[[#GetState|State]] must be 1, this cmd eventually sets the State to value 2.

=== CloseAccessPoint ===
No input/output.

[[#GetState|State]] must be 2-3, this cmd eventually sets the State to value 1.

=== CreateNetwork ===
Takes an input [[#SecurityConfig]], an [[#UserConfig]], a [[#NetworkConfig]], no output.

This is the same as [[#CreateNetworkPrivate]], except the [[#AddressEntry]] params are 0, and the [[#SecurityParameter]] is generated from "nn::util::TinyMt::GenerateRandomBytes".

Unlike CreateNetworkPrivate, this overwrites the channel field in the [[#NetworkConfig]]. When the cached [[SPL_services#IsDevelopment|IsDevelopment]] value is true, the output from [[Settings_services|GetLdnChannel]] will overwrite that field if the s32 setting value is >=0, otherwise the original value is used. Otherwise when the IsDevelopment field is false (retail), the channel is overwritten with value 0.

This overwrites the u16 field at [[#SecurityConfig]]+0. When the cached [[SPL_services#IsDevelopment|IsDevelopment]] value is false (retail) ([18.0.0+] [[System_Settings|system-setting]] <code>ldn!enable_static_security_mode_configuration</code> is checked for being true instead), value 1 is used ([18.0.0+] value from [[System_Settings|system-setting]] <code>ldn!static_security_mode</code> is used, with fallback to value 1 if the setting is >=0x4), otherwise the original value is used.

[[#GetState|State]] must be 2, this cmd eventually sets the State to value 3.

=== CreateNetworkPrivate ===
Takes an input [[#SecurityConfig]], a [[#SecurityParameter]], an [[#UserConfig]], a [[#NetworkConfig]], a type-0x9 input buffer containing an array of [[#AddressEntry]], no output.

The buffer/count for [[#AddressEntry]] can be 0, in which case the network will be non-Private like [[#CreateNetwork]]. The count must be <=8.

See [[#CreateNetwork]].

=== DestroyNetwork ===
No input/output.

[[#GetState|State]] must be 3, this cmd eventually sets the State to value 2.

=== Reject ===
Takes an input [[#Ipv4Address]], no output.

[[#GetState|State]] must be 3.

=== SetAdvertiseData ===
Takes a type-0x21 input buffer, no output.

The input buffer contains arbitrary user data.

The buffer size must be <=0x180. An empty buffer (addr=NULL/size=0) can be used to reset the AdvertiseData size in state to zero.

[[#GetState|State]] must be 2-3.

=== SetStationAcceptPolicy ===
Takes an input [[#AcceptPolicy]], no output.

[[#GetState|State]] must be 2-3.

=== AddAcceptFilterEntry ===
Takes an input [[#MacAddress|MacAddress]], no output.

There are two sdknso funcs implementing this: one which takes a [[#MacAddress|MacAddress]] directly, the other loads the [[#MacAddress|MacAddress]] from the input [[#NodeInfo|NodeInfo]].

[[#GetState|State]] must be 2-3.

=== ClearAcceptFilter ===
No input/output.

[[#GetState|State]] must be 2-3.

=== OpenStation ===
No input/output.

[[#GetState|State]] must be 1, this cmd eventually sets the State to value 4.

=== CloseStation ===
No input/output.

[[#GetState|State]] must be 4-5, this cmd eventually sets the State to value 1.

=== Connect ===
Takes a type-0x19 input buffer containing a [[#NetworkInfo]], a [[#SecurityConfig]], an [[#UserConfig]], a s32 LocalCommunicationVersion, a [[#ConnectOption]], no output.

[[#GetState|State]] must be 4, this cmd eventually sets the State to value 5.

This is identical to [[#ConnectPrivate]] (besides the below), except the data internally passed for [[#SecurityParameter]]/[[#NetworkConfig]] are loaded from the input [[#NetworkInfo]].

[1.0.0-?] This overwrites the u16 field at [[#SecurityConfig]]+0. When the cached [[SPL_services#IsDevelopment|IsDevelopment]] value is false (retail), value 1 is used, otherwise the used value is: original_field == 0 ? {u16 [[#NetworkInfo]]+0x60} : original_field. [18.0.0+] This now uses the same SecurityMode override as [[#CreateNetwork|CreateNetwork]].

u32 LocalCommunicationVersion>>15 must be 0.

=== ConnectPrivate ===
Takes a [[#SecurityConfig]], [[#SecurityParameter]], an [[#UserConfig]], a s32 LocalCommunicationVersion, a [[#ConnectOption]], a [[#NetworkConfig]], no output.

See [[#Connect]].

[1.0.0-?] This overwrites the u16 field at [[#SecurityConfig]]+0. When the cached [[SPL_services#IsDevelopment|IsDevelopment]] value is false (retail), value 1 is used, otherwise the original value is used. [18.0.0+] This now uses the same SecurityMode override as [[#Connect|Connect]].

=== Disconnect ===
No input/output.

[[#GetState|State]] must be 5, this cmd eventually sets the State to value 4.

=== Initialize ===
Takes an input PID and an u64 pid_placeholder.

This is used immediately after object creation.

On old sysvers the cmd impl for User/System are identical, except different params are used for the funcs called internally.

With [7.0.0+] [[#InitializeWithVersion|InitializeWithVersion]] is used instead. The cmd impl for Initialize uses [[#InitializeWithVersion|InitializeWithVersion]] with version=0.

=== Finalize ===
No input/output.

This is used during service exit, prior to closing the object. Official sw will Abort if this fails.

If State is set for it, this will run the equivalent of [[#CloseAccessPoint]]/[[#CloseStation]] when needed.

[[#GetState|State]] must be non-zero, this cmd eventually sets the State to value 0.

=== SetOperationMode ===
Takes an input [[#OperationMode]], no output.

[[#GetState|State]] must be 1.

The input value is written into state.

=== InitializeWithVersion ===
Takes an input PID, a s32 version, and an u64 pid_placeholder.

The priority is determined by whether the interface is User/System: System = 0x38, User = 0x5A.

It then calls the init func, with the cmd input params and the above priority, returning the Result on failure.

On newer sysvers this then adds an entry for the state array used by [[#RegisterClient|RegisterClient]].

Lastly the input PID and version are written into state, then this returns.

The init func does the following:
* The PID must be non-zero, and the version must not be negative. The priority must be 0x5A or 0x38.
* An error is returned if state fields are invalid.
* The input PID and version are written into state (a state field is also set to interface == User).
* Lastly, a vfunc is called with the input priority, returning the Result from that.

The vfunc does the following:
* On newer sysvers, this uses [[Shared_Database_services|pl:s]] RequestApplicationFunctionAuthorizationByProcessId with the input PID and [[Shared_Database_services|ApplicationFunctionAuthorizationId]] = 2 (SecureLdnLocalCommunication), returning the Result on failure.
* Then a message is sent to a msg-queue with the input priority.

The handler for the above message does the following:
* When state is already initialized, runs handling for that. An error is also thrown if the input priority is larger than a state field.
* Initializes state, etc.
* Various [[Network_Interface_services|nifm]] funcs are eventually used. The input priority is used to determine the value for [[Network_Interface_services#CreateRequest|nn::nifm::RequestParameters]]: value 0x4 or value 0x8 is used, depending on priority > 0x59.
** Newer versions also handle ldn lan_emulation [[System_Settings|sys-settings]] here. For the above value, when lan_emulation is enabled it uses value 0x17, with 0x18 additionally used for priority <= 0x59.
* The rest is state init, including setting [[#State|State]] to value 1. Then 0 is returned.

On old sysvers the cmd impl for User/System are identical, except different params are used for the funcs called internally. With newer sysvers the cmd impl is now identical.

Version values passed by official sw:

{| class="wikitable" border="1"
|-
! Value || SystemVersion
|-
| 0x1 || [7.0.0+]
|-
| 0x2 || [18.0.0+]
|-
| 0x3 || [19.0.0+]
|-
| 0x4 || [20.0.0+]
|}

=== InitializeWithPriority ===
Takes an input PID, a s32 version, a s32 priority, and an u64 pid_placeholder.

This is similar to [[#InitializeWithVersion|InitializeWithVersion]]. The input priority is passed directly to the init func which is called here, instead of determining it from whether the interface is User/System.

Official sw passes input value 0x38 for the priority as the default, when the user doesn't specify the priority.

=== EnableActionFrame ===
Takes an input [[#ActionFrameSettings]]. No output.

[[#State|State]] must be Initialized.

=== DisableActionFrame ===
No input/output.

[[#State|State]] must be Initialized.

=== SendActionFrame ===
Takes a type-0x21 input buffer, two input [[#MacAddress]], two input s16s ('''Band''' and '''ChannelNumber''') and an input [[#MessageFlagSet]]. No output.

[20.0.0+] The input s16s were replaced with a single u16, which has the same format as [[#SetHomeChannel|SetHomeChannel]].

The first [[#MacAddress]] is the destination, the second [[#MacAddress]] is the Bssid.

The ChannelNumber must be non-zero.

[[#State|State]] must be 3-5 (AccessPointCreated/Station/StationConnected).

=== RecvActionFrame ===
Takes a type-0x22 output buffer and an input [[#MessageFlagSet]]. Returns two output [[#MacAddress]], two output s16s ('''Band''' and '''ChannelNumber'''), an output u32 '''Size''', and an output s32 '''LinkLevel'''.

[20.0.0+] The output s16s were replaced with a single u16, which has the same format as [[#SetHomeChannel|SetHomeChannel]].

[[#EnableActionFrame|EnableActionFrame]] must be used prior to this.

=== SetHomeChannel ===
Takes two input s16s '''Band''' and '''ChannelNumber'''. No output.

[20.0.0+] Now takes an input u16 instead of two s16s, merging the two params. Bitmask 0x3FF (low 10-bits) is the ChannelNumber, while the remaining upper 6-bits is the Band. The Band is used as an array index to load the actual Band for passing to a func. Only the following Band input is valid, others return 0x0/0xFFFF: 2 - > 2400, 5 -> 5000, 6 -> 6000.

On NX Band must be ([20.0.0+] converted Band from the above array) 50 ([20.0.0+] 5000) or 24 ([20.0.0+] 2400).

The ChannelNumber must be non-zero.

The [[#State|State]] must be Station.

sdknso uses the input channel to convert to the input needed by the cmd.

=== SetTxPower ===
Takes an input s16 '''Power'''. No output.

The input must be 0x0..0xFF.

A state field must be non-zero.

The [[#State|State]] must be 2-5 (AccessPoint*/Station*).

=== ResetTxPower ===
No input/output.

The same state field checked by [[#SetTxPower|SetTxPower]] must be non-zero. The [[#State|State]] check is also the same as [[#SetTxPower|SetTxPower]].

== IClientProcessMonitor ==
This is "nn::ldn::detail::IClientProcessMonitor".

This was added with [18.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || RegisterClient
|}

=== RegisterClient ===
Takes an input PID and an u64 pid_placeholder.

[18.0.0+] [[#CreateClientProcessMonitor|CreateClientProcessMonitor]] and RegisterClient are used by sdknso at the end of the ldn initialization functionality.

If the objptr in IClientProcessMonitor state is already set from using this cmd previously, this just returns 0.

This goes through global state to locate an entry with a matching PID, if none found 0 is returned. The objptr from the state entry is loaded, if NULL this returns 0. This obj is then incref'd and written into the IClientProcessMonitor state. When PID is 0, 0 is returned. It then locates the above state entry again with a matching PID, clearing the entry which matches. Lastly 0 is returned.

The initialization [[#InitializeWithPriority|cmds]] adds an entry to the above global state.

= ldn:u =
This is "nn::ldn::detail::IUserServiceCreator".

This has IPC max_sessions 3.

[18.0.0+] The sdknso uses SessionManager with this, where the additional session-count is 0x3.

[S2] There appears to be 2 ldn:u services, this appears to be for having separate [[#Protocol|Protocol]] permissions for NX and Ounce games. The Creator object has the same vtable for both of these. However the vtable for IUserLocalCommunicationService appears to be larger even with NX, which likely indicates there's new commands? There also appears to be 4 additional max-sessions allocated to ldn*, this is probably for one of these ldn:u services?

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#CreateUserLocalCommunicationService|CreateUserLocalCommunicationService]]
|-
| 1 || [18.0.0+] [[#CreateClientProcessMonitor|CreateClientProcessMonitor]]
|}

== CreateUserLocalCommunicationService==
Returns an [[#IUserLocalCommunicationService]].

The user-process closes the IUserServiceCreator object once finished with it during initialization. Official sw ignores errors from this cmd.

== IUserLocalCommunicationService ==
This is "nn::ldn::detail::IUserLocalCommunicationService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#GetState_2|GetState]]
|-
| 1 || [[#GetNetworkInfo_2|GetNetworkInfo]]
|-
| 2 || [[#GetIpv4Address_2|GetIpv4Address]]
|-
| 3 || [[#GetDisconnectReason_2|GetDisconnectReason]]
|-
| 4 || [[#GetSecurityParameter_2|GetSecurityParameter]]
|-
| 5 || [[#GetNetworkConfig_2|GetNetworkConfig]]
|-
| 100 || [[#GetStateChangeEvent|GetStateChangeEvent]]
|-
| 101 || [[#GetNetworkInfoAndHistory|GetNetworkInfoAndHistory]]
|-
| 102 || [[#Scan|Scan]]
|-
| 103 || [[#ScanPrivate|ScanPrivate]]
|-
| 104 || [5.0.0+] [[#SetWirelessControllerPolicy|SetWirelessControllerPolicy]]
|-
| 105 || [13.1.0+] [[#SetWirelessAudioPolicy|SetWirelessAudioPolicy]]
|-
| 106 || [18.0.0+] [[#SetProtocol|SetProtocol]]
|-
| 200 || [[#OpenAccessPoint|OpenAccessPoint]]
|-
| 201 || [[#CloseAccessPoint|CloseAccessPoint]]
|-
| 202 || [[#CreateNetwork|CreateNetwork]]
|-
| 203 || [[#CreateNetworkPrivate|CreateNetworkPrivate]]
|-
| 204 || [[#DestroyNetwork|DestroyNetwork]]
|-
| 205 || [[#Reject|Reject]]
|-
| 206 || [[#SetAdvertiseData|SetAdvertiseData]]
|-
| 207 || [[#SetStationAcceptPolicy|SetStationAcceptPolicy]]
|-
| 208 || [[#AddAcceptFilterEntry|AddAcceptFilterEntry]]
|-
| 209 || [[#ClearAcceptFilter|ClearAcceptFilter]]
|-
| 300 || [[#OpenStation|OpenStation]]
|-
| 301 || [[#CloseStation|CloseStation]]
|-
| 302 || [[#Connect|Connect]]
|-
| 303 || [[#ConnectPrivate|ConnectPrivate]]
|-
| 304 || [[#Disconnect|Disconnect]]
|-
| 400 || [[#Initialize_2|Initialize]]
|-
| 401 || [[#Finalize_2|Finalize]]
|-
| 402 || [7.0.0+] [[#InitializeWithVersion|InitializeWithVersion]]
|-
| 403 || [19.0.0+] [[#SetOperationMode|SetOperationMode]]
|-
| 500 || [18.0.0+] [[#EnableActionFrame|EnableActionFrame]]
|-
| 501 || [18.0.0+] [[#DisableActionFrame|DisableActionFrame]]
|-
| 502 || [18.0.0+] [[#SendActionFrame|SendActionFrame]]
|-
| 503 || [18.0.0+] [[#RecvActionFrame|RecvActionFrame]]
|-
| 505 || [18.0.0+] [[#SetHomeChannel|SetHomeChannel]]
|-
| 600 || [18.0.0+] [[#SetTxPower|SetTxPower]]
|-
| 601 || [18.0.0+] [[#ResetTxPower|ResetTxPower]]
|}

= ndd =
This is "nn::ndd::IService".

This was added with [5.0.0] and removed with [6.0.0].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || EnableAutoCommunication
|-
| 1 || DisableAutoCommunication
|-
| 2 || IsAutoCommunicationEnabled
|-
| 3 || EnablePowerSave
|-
| 4 || DisablePowerSave
|-
| 5 || IsPowerSaveEnabled
|-
| 6 || IsNetworkActive
|-
| 7 || AcquireSendDataUpdateEvent
|-
| 8 || AddSendData
|-
| 9 || ClearSendData
|-
| 10 || GetSendData
|-
| 11 || AcquireReceiveDataEvent
|-
| 12 || GetCurrentReceiveDataCounter
|-
| 13 || GetOldestReceiveDataCounter
|-
| 14 || GetNextReceiveDataCounter
|-
| 15 || GetAvailableReceiveDataCount
|-
| 16 || GetRecentReceiveDataCounter
|-
| 17 || GetReceiveData
|-
| 18 || AddReceiveData
|-
| 19 || ClearReceiveData
|-
| 20 || ClearDataIdFilter
|-
| 21 || AcquireDeviceScanEvent
|-
| 22 || StartDeviceScan
|-
| 23 || CancelDeviceScan
|-
| 24 || GetDeviceScanResult
|}

= lp2p:app, lp2p:sys =
These are "nn::lp2p::detail::ISfServiceCreator".

These were added with [9.0.0+].

lp2p:app is used by [[Mario Kart Live: Home Circuit]]. lp2p:sys is used by [[Album_Applet|LibraryAppletPhotoViewer]] with [11.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#CreateNetworkService|CreateNetworkService]]
|-
| 8 || [[#CreateNetworkServiceMonitor|CreateNetworkServiceMonitor]]
|}

== CreateNetworkService ==
Takes a PID-descriptor, a reserved input u64 and an input u32. Returns an output [[#ISfService]].

The input u32 must be value 0x1.

== CreateNetworkServiceMonitor ==
Takes a PID-descriptor and a reserved input u64. Returns an output [[#ISfServiceMonitor]].

== ISfService ==
This is "nn::lp2p::detail::ISfService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Initialize_4|Initialize]]
|-
| 256 || [9.0.0-9.0.1] [[#AttachNetworkInterfaceStateChangeEvent|AttachNetworkInterfaceStateChangeEvent]]
|-
| 264 || [9.0.0-9.0.1] [[#GetNetworkInterfaceLastError|GetNetworkInterfaceLastError]]
|-
| 272 || [9.0.0-9.0.1] [[#GetRole|GetRole]]
|-
| 280 || [9.0.0-9.0.1] [[#GetAdvertiseData|GetAdvertiseData]]
|-
| 288 || [9.0.0-9.0.1] [[#GetGroupInfo|GetGroupInfo]]
|-
| 296 || [9.0.0-9.0.1] [[#GetGroupInfo2|GetGroupInfo2]]
|-
| 304 || [9.0.0-9.0.1] [[#GetGroupOwner|GetGroupOwner]]
|-
| 312 || [9.0.0-9.0.1] [[#GetIpConfig|GetIpConfig]]
|-
| 320 || [9.0.0-9.0.1] [[#GetLinkLevel|GetLinkLevel]]
|-
| 512 || [[#Scan_2|Scan]]
|-
| 768 || [[#CreateGroup|CreateGroup]]
|-
| 776 || [[#DestroyGroup|DestroyGroup]]
|-
| 784 || [[#SetAdvertiseData|SetAdvertiseData]]
|-
| 1536 || [[#SendToOtherGroup|SendToOtherGroup]]
|-
| 1544 || [[#RecvFromOtherGroup|RecvFromOtherGroup]]
|-
| 1552 || [[#AddAcceptableGroupId|AddAcceptableGroupId]]
|-
| 1560 || [9.1.0+] [[#ClearAcceptableGroupId|ClearAcceptableGroupId]]
|}

=== Initialize ===
No input/output.

Returns 0.

Unused by official sw.

=== Scan ===
Takes a type-0x19 input buffer containing a [[#GroupInfo]] and a type-0x22 output buffer containing an array of [[#ScanResult]]. Returns an output s32 '''TotalOut'''.

=== CreateGroup ===
Takes a type-0x31 input buffer containing a [[#GroupInfo]]. No output.

[[Mario Kart Live: Home Circuit|mklive]] uses the following string with this: "Failed to create a group: %08X".

The [[#GetRole|role]] must be 0. This eventually sets the [[#GetRole|role]] to value 1.

=== DestroyGroup ===
No input/output.

This destroys the previously [[#CreateGroup|created]] group. If no group was previously created ([[#GetRole|role]] is not 1), this just returns 0.

=== SetAdvertiseData ===
Takes a type-0x21 input buffer. No output.

The buffer size must be <=0x80. The [[#GetRole|role]] must be <=1.

A string in [[Mario Kart Live: Home Circuit|mklive]] refers to the buffer data as "scan advertise data".

=== SendToOtherGroup ===
Takes an input [[#MacAddress_2|MacAddress]], a [[#GroupId]], a s16 '''Frequency''', a s16 '''Channel''', an u32 '''MessageFlag''' and a type-0x21 input buffer. No output.

The buffer size must be <=0x400.

The MacAddress must be non-zero. The s16s must be >=1.

Only bit0 is used from flags: clear = block until the data can be sent, set = return error when the data can't be sent.

A string in [[Mario Kart Live: Home Circuit|mklive]] refers to the buffer data as "Action frame".

The [[#GetRole|role]] must be non-zero. The error from [[#GetNetworkInterfaceLastError]] will be returned if it's set.

[11.0.0+] [[#GroupInfo]]+0x8A must be value 2, otherwise an error is returned.

This sends an Action frame to the specified [[#GroupId]], with the specified destination [[#MacAddress_2|MacAddress]] (can be a broadcast address).

The frequency param is the same as the [[#GroupInfo]]+0x84 field.

=== RecvFromOtherGroup ===
Takes an input u32 '''MessageFlag''' and a type-0x22 output buffer. Returns a [[#MacAddress_2|MacAddress]], an u16 '''Frequency''', a s16 '''Channel''', an u32 '''OutSize''' and a s32.

The OutSize is the original size used for copying to the output buffer, before it's clamped to the output-buffer size.

Only bit0 is used from MessageFlag: clear = block until data is available, set = return error when data is not available.

When data is not available, the error from [[#GetNetworkInterfaceLastError]] will be returned if it's set.

The [[#GetRole|role]] must be non-zero.

This receives an Action frame.

=== AddAcceptableGroupId ===
Takes an input [[#GroupId]]. No output.

=== ClearAcceptableGroupId ===
No input/output.

== ISfServiceMonitor ==
This is "nn::lp2p::detail::ISfServiceMonitor".

This interface has no commands, until [9.1.0+] which added actual commands.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Initialize_5|Initialize]]
|-
| 256 || [[#AttachNetworkInterfaceStateChangeEvent|AttachNetworkInterfaceStateChangeEvent]]
|-
| 264 || [[#GetNetworkInterfaceLastError|GetNetworkInterfaceLastError]]
|-
| 272 || [[#GetRole|GetRole]]
|-
| 280 || [[#GetAdvertiseData|GetAdvertiseData]]
|-
| 281 || [[#GetAdvertiseData2|GetAdvertiseData2]]
|-
| 288 || [[#GetGroupInfo|GetGroupInfo]]
|-
| 296 || [[#GetGroupInfo2|GetGroupInfo2]]
|-
| 304 || [[#GetGroupOwner|GetGroupOwner]]
|-
| 312 || [[#GetIpConfig|GetIpConfig]]
|-
| 320 || [[#GetLinkLevel|GetLinkLevel]]
|-
| 328 || [[#AttachJoinEvent|AttachJoinEvent]]
|-
| 336 || [[#GetMembers|GetMembers]]
|}

=== Initialize ===
Returns 0.

Unused by official sw.

=== AttachNetworkInterfaceStateChangeEvent ===
No input. Returns an output Event handle with EventClearMode=0.

=== GetNetworkInterfaceLastError ===
No input/output.

=== GetRole ===
No input. Returns an output u8.

=== GetAdvertiseData ===
Takes a type-0x22 output buffer. Returns two output u16s.

Validates that the [[#GetRole|role]] is value 2, then copies data from state into the output buffer. The first output u16 is the size used for the memcpy, the second u16 is the original size from state.

=== GetAdvertiseData2 ===
Takes a type-0x22 output buffer. Returns two output u16s.

This is identical to [[#GetAdvertiseData]] except this doesn't run the role validation.

=== GetGroupInfo ===
Takes a type-0x32 output buffer containing a [[#GroupInfo]].

Validates that the [[#GetRole|role]] is non-zero, then copies the struct from state into the output buffer.

=== GetGroupInfo2 ===
Takes a type-0x32 output buffer containing a [[#GroupInfo]] and a type-0x31 input buffer containing a [[#GroupInfo]].

This runs the same code as [[#CreateGroup]] to generate the [[#GroupInfo]] for the input struct (which with [[#CreateGroup]] would be available with [[#GetGroupInfo]]). The input struct is the same as [[#CreateGroup]].

=== GetGroupOwner ===
No input. Returns an output [[#NodeInfo_2|NodeInfo]].

Validates that the [[#GetRole|role]] is non-zero, then copies the data from state to output.

=== GetIpConfig ===
Takes a type-0x1A output buffer containing a 0x100-byte struct.

Validates that the [[#GetRole|role]] is non-zero, then copies the struct from state into the output buffer.

+0x20 is the <code>struct sockaddr</code> IP address, +0x40 is the <code>struct sockaddr</code> subnet-mask, +0x60 is the <code>struct sockaddr</code> gateway(?). The address for the last one is set to localhost.

=== GetLinkLevel ===
No input. Returns an output u32.

=== AttachJoinEvent ===
No input. Returns an output Event handle with EventClearMode=0.

=== GetMembers ===
Takes a type-0x22 output buffer containing an array of [[#NodeInfo_2|NodeInfo]]. Returns an output s32 '''TotalOut'''.

Validates that the [[#GetRole|role]] is value 1. Then any entries from state which are available are copied into the output array buffer, if there's space available. A maximum of 8 entries can be returned.

A string in [[Mario Kart Live: Home Circuit|mklive]] refers to the array data as "connected members".

= lp2p:m =
This is "nn::lp2p::monitor::detail::ISfMonitorServiceCreator".

This was added with [9.1.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#CreateMonitorService|CreateMonitorService]]
|}

== CreateMonitorService ==
Takes a PID-descriptor, a reserved input u64 and an input u64. Returns an [[#ISfMonitorService]].

== ISfMonitorService ==
This is "nn::lp2p::monitor::detail::ISfMonitorService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Initialize_6|Initialize]]
|-
| 288 || [[#GetGroupInfo|GetGroupInfo]]
|-
| 320 || [[#GetLinkLevel|GetLinkLevel]]
|}

=== Initialize ===
Returns 0.

= State =
This is "nn::ldn::State".

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || None
|-
| 1 || Initialized
|-
| 2 || AccessPoint
|-
| 3 || AccessPointCreated
|-
| 4 || Station
|-
| 5 || StationConnected
|-
| 6 || Error
|}

= Ipv4Address =
This is "nn::ldn::Ipv4Address". This is a 0x4-byte struct with 4-byte alignment.

This is essentially the same as <code>struct in_addr</code>, except this is little-endian.

This is generally "169.254.XXX.{...}", where XXX is random per created network.

= SubnetMask =
This is "nn::ldn::SubnetMask". This is a 0x4-byte struct with 4-byte alignment.

This is essentially the same as <code>struct in_addr</code>, except this is little-endian.

= Ssid =
This is "nn::ldn::Ssid".

When converting a Ssid to a string, the loaded chars from the string must be in the range of 0x20-0x7F, otherwise the byte written to the string will be 0.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || Length (excluding NUL-terminator, must be 0x1-0x20)
|-
| 0x1 || 0x21 || Raw (SSID string including NUL-terminator, str[{above length}] must be 0)
|}

= MacAddress =
This is "nn::ldn::MacAddress". This is a 6-byte struct with 1-byte alignment.

= NodeInfo =
This is "nn::ldn::NodeInfo".

The first node in the nodes array is always the AccessPoint (NodeId 0x0). NodeId is the index of the node in the nodes array.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || [[#Ipv4Address|Ipv4Address]]
|-
| 0x4 || 0x6 || [[#MacAddress|MacAddress]]
|-
| 0xA || 0x1 || NodeId
|-
| 0xB || 0x1 || IsConnected
|-
| 0xC || 0x21 || UserName
|-
| 0x2D || 0x1 || [19.0.0+] Platform? (0 = NX, 1 = Ounce)
|-
| 0x2E || 0x2 || LocalCommunicationVersion
|-
| 0x30 || 0x10 || Reserved
|}

= NodeLatestUpdate =
This is "nn::ldn::NodeLatestUpdate". This is a 0x8-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || StateChange
|-
| 0x1 || 0x7 || Reserved
|}

= IntentId =
This is "nn::ldn::IntentId".

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || LocalCommunicationId
|-
| 0x8 || 0x2 || Reserved
|-
| 0xA || 0x2 || SceneId
|-
| 0xC || 0x4 || Reserved
|}

* LocalCommunicationId: [[#CreateNetwork|CreateNetwork]], [[#CreateNetworkPrivate|CreateNetworkPrivate]], [[#Connect|Connect]], [[#ConnectPrivate|ConnectPrivate]] (also [[#ScanFilter|ScanFilter]] when enabled with the flag): When -1, this is overwritten with the first LocalCommunicationId from the user-process [[NACP]], if loading fails value 0 is written instead. Otherwise when not -1, if [[NACP]] loading is successful, this field must match one of the LocalCommunicationIds from there.
* SceneId: Arbitrary user data, this can be used for filtering with [[#ScanFilter|ScanFilter]] for example.

= SessionId =
This is "nn::ldn::SessionId".

This is used to generate/overwrite the Ssid when needed.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x10 || Random
|}

= NetworkId =
This is "nn::ldn::NetworkId". This is a 0x20-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x10 || [[#IntentId|IntentId]]
|-
| 0x10 || 0x10 || [[#SessionId|SessionId]]
|}

= CommonNetworkInfo =
This is "nn::ldn::CommonNetworkInfo". This is a 0x30-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x6 || [[#MacAddress|Bssid]]
|-
| 0x6 || 0x22 || [[#Ssid|Ssid]]
|-
| 0x28 || 0x2 || Channel
|-
| 0x2A || 0x1 || LinkLevel
|-
| 0x2B || 0x1 || NetworkType
|-
| 0x2C || 0x4 || Reserved
|}

= LdnNetworkInfo =
This is "nn::ldn::LdnNetworkInfo". This is a 0x430-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x10 || ServerRandom
|-
| 0x10 || 0x2 || SecurityMode
|-
| 0x12 || 0x1 || StationAcceptPolicy
|-
| 0x13 || 0x1 || Version
|-
| 0x14 || 0x2 || Reserved
|-
| 0x16 || 0x1 || NodeCountMax
|-
| 0x17 || 0x1 || NodeCount
|-
| 0x18 || 0x200 (0x40 * 8) || [[#NodeInfo|Nodes]]
|-
| 0x218 || 0x2 || Reserved
|-
| 0x21A || 0x2 || AdvertiseDataSize
|-
| 0x21C || 0x180 || AdvertiseData
|-
| 0x39C || 0x8C || Reserved
|-
| 0x428 || 0x8 || [6.0.0-?] Challenge (set to the output from [[ETicket_services|es]] cmd1501 during network creation) ([?+] only used internally, not exposed in LdnNetworkInfo anymore)
|}

= NetworkInfo =
This is "nn::ldn::NetworkInfo". This is a 0x480-byte struct.

The fields listed as Reserved (besides the fields before +0x10) are cleared during the memset and are not written to again afterwards, with cmds which return NetworkInfo.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x20 || [[#NetworkId|NetworkId]]
|-
| 0x20 || 0x30 || [[#CommonNetworkInfo|Common]]
|-
| 0x50 || 0x430 || [[#LdnNetworkInfo|Ldn]]
|}

= ScanFilter =
This is "nn::ldn::ScanFilter". This is a 0x60-byte struct with 8-byte alignment.

sdknso copies the input ScanFilter to a tmp struct on stack (with [[#ScanFilterFlag|Flag]] masking), which is then used with the cmd. sdknso only copies Bssid with [[#ScanPrivate|ScanPrivate]], with [[#Scan|Scan]] it also masks out the [[#ScanFilterFlag|Flag]] for Bssid.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x20 || [[#NetworkId|NetworkId]]
|-
| 0x20 || 0x4 || NetworkType
|-
| 0x24 || 0x6 || [[#MacAddress|Bssid]]
|-
| 0x2A || 0x22 || [[#Ssid|Ssid]]
|-
| 0x4C || 0x10 || Reserved
|-
| 0x5C || 0x4 || [[#ScanFilterFlag|Flag]]
|}

Each [[#ScanFilterFlag|Flag]] bit when set enables using the corresponding ScanFilter data. This is usually a compare with the ScanFilter data and the internal [[#NetworkInfo|NetworkInfo]] data.

* NetworkType: (ScanFilter_NetworkType & NetworkInfo_NetworkType) must be non-zero.
* Ssid: The length fields must match, then memcmp is used.

The filtering func also handles validating the Band/Channel, however these fields are internal only and are not exposed in the user ScanFilter.

= ScanFilterFlag =
This is "nn::ldn::ScanFilterFlag".

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0x0 || None
|-
| 0x1 || LocalCommunicationId
|-
| 0x2 || SessionId
|-
| 0x4 || NetworkType
|-
| 0x8 || Bssid
|-
| 0x10 || Ssid
|-
| 0x20 || SceneId
|-
| 0x21 || IntentId
|-
| 0x23 || NetworkId
|-
| 0x3F || All
|}

= NetworkConfig =
This is "nn::ldn::NetworkConfig". This is a 0x20-byte struct with 8-byte alignment.

sdknso copies the input NetworkConfig to a tmp struct on stack, which is then used with the cmd ([[#CreateNetwork]], [[#CreateNetworkPrivate]], [[#ConnectPrivate]]).

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x10 || [[#IntentId|IntentId]]
|-
| 0x10 || 0x2 || Channel
|-
| 0x12 || 0x1 || NodeCountMax
|-
| 0x13 || 0x1 || Reserved
|-
| 0x14 || 0x2 || LocalCommunicationVersion
|-
| 0x16 || 0xA || Reserved
|}

= WirelessControllerRestriction =
This is "nn::ldn::WirelessControllerRestriction". This is an u32 enum.

This is used to determine the value passed to [[BTM_services|btm]] SetWlanMode.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || Disabled
|-
| 1 || Enabled
|}

= WirelessAudioRestriction =
This is "nn::ldn::WirelessAudioRestriction". This is an u32 enum.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || Disabled
|-
| 1 || Enabled
|}

= SecurityMode =
This is "nn::ldn::SecurityMode". This is an u32 enum.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || Any
|-
| 1 || Product
|-
| 2 || Debug
|-
| 3 || SystemDebug
|}

Value:
* 1-2: Broadcast Action frame data is encrypted.
* 3: Broadcast Action frame data is plaintext.

* 1: Data frames are encrypted.
* 2-3: Data frames for normal data-transfer are plaintext - the network is Open.

= SecurityConfig =
This is "nn::ldn::SecurityConfig". This is a 0x44-byte struct with 2-byte alignment.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x2 || [[#SecurityMode|SecurityMode]] (overwritten by [[#CreateNetwork]]/[[#CreateNetworkPrivate]] and [[#Connect]]/[[#ConnectPrivate]], the value used internally by these cmds must be 1-3)
|-
| 0x2 || 0x2 || PassphraseSize (must be 0x10-0x40)
|-
| 0x4 || 0x40 || Passphrase (used with key derivation)
|}

= SecurityParameter =
This is "nn::ldn::SecurityParameter". This is a 0x20-byte struct with 1-byte alignment.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x10 || ServerRandom (used with the same key derivation as [[#SecurityConfig]])
|-
| 0x10 || 0x10 || [[#SessionId|SessionId]]
|}

= UserConfig =
This is "nn::ldn::UserConfig". This is a 0x30-byte struct with 1-byte alignment.

An error is thrown if UserName+0x20 is non-zero.

sdknso copies the input UserConfig to a tmp struct on stack, which is then used with the cmd. Only the first 0x20-bytes are copied, with the rest cleared.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x21 || UserName (NUL-terminated string for the user name)
|-
| 0x21 || 0xF || Reserved
|}

= AddressEntry =
This is "nn::ldn::AddressEntry". This is a 0xC-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || [[#Ipv4Address]]
|-
| 0x4 || 0x6 || [[#MacAddress|MacAddress]]
|-
| 0xA || 0x2 || Reserved
|}

= AcceptPolicy =
This is "nn::ldn::AcceptPolicy". This is an u8.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || AlwaysAccept
|-
| 1 || AlwaysReject
|-
| 2 || BlackList (addresses in the [[#AddAcceptFilterEntry|list]] are not allowed)
|-
| 3 || WhiteList (only addresses in the [[#AddAcceptFilterEntry|list]] are allowed)
|}

= ConnectOption =
This is "nn::ldn::ConnectOption". This is an u32 bitmask.

There's two versions of the sdknso funcs for [[#Connect]]/[[#ConnectPrivate]]: the version where the ConnectOption isn't user-specified uses a default value of 0x1 for it, with the same ShowError code without the bit0 check.

When bit0 here is set after using the above cmds, the sdknso funcs will use [[Error_Applet|ShowError]] with the returned Result if: (rc & 0x3FE1FF) == 0xE0CB.

This must be <=0x1, besides this validation ConnectOption is ignored by [[#Connect]]/[[#ConnectPrivate]].

= DisconnectReason =
This is "nn::ldn::DisconnectReason".

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| -1 || Unknown
|-
| 0 || None
|-
| 1 || DisconnectedByUser
|-
| 2 || DisconnectedBySystem
|-
| 3 || DestroyedByUser
|-
| 4 || DestroyedBySystem
|-
| 5 || Rejected
|-
| 6 || SignalLost
|}

= OperationMode =
This is "nn::ldn::OperationMode". This is an u32 enum.

This controls bit1 in the value passed to [[WLAN_services|wlan:lcl]] cmd0/cmd1: bit1 = OperationMode==1.

Value 1 seems to affect power (?) related fields in the beacon tags?

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || Stable
|-
| 1 || HighSpeed
|}

= Protocol =
This is "nn::ldn::Protocol". This is an u32 enum.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || Default
|-
| 1 || NX
|-
| 2 || [S2]
|-
| 3 || [20.0.0+] (NXAndOunce?)
|-
| 4 || [S2] [20.0.0+]
|}

The Initialize* cmds configure state the same as using [[#SetProtocol|SetProtocol]] with Protocol NX.

There's S2-only values which enables using Ounce-only keys. The following uses new Ounce-only keys (with S2 hosting):
* In-game ldn-usage for a S2-only Application.
* Local-game-update with a S2-only Application.
* Local-game-update for a S1-game which has a Nintendo Switch 2 Edition available, even without the S2-Edition being installed.

There's system-titles which [[20.0.0|use]] SetProtocol. While there's game(s) which use SetProtocol, there's no known (?) games using Protocol3 (excluding GameShare which is system).

[S2] Protocol2 and Protocol4 appear to be identical to Protocol3 except for using [[SPL_services|Ounce]] keys (?). It's unknown exactly which Protocol uses which [[SPL_services|Generation]], though presumably 2/4 is Generation 0/1? The following uses each Generation:
* Generation 0: Mario Kart World
* Generation 1: lcs (local-content-share), Splatoon Raiders (this might be just due to the value used for [[LDN_services#SetProtocol|Default]] being bumped?)

[S2] Keys are generated by passing the SHA256 hash as the KeySource to the relevant [[SPL_services|spl:ldn]] command with the above Generation, with the full hash being passed to the Ounce cmds. Only the first 0x10-bytes of the output key is used, since AES-128 is used even with Ounce.

On NX, the Protocol [[#SetProtocol|permission-bitmask]] is always set to 0xA (1 and 3). On Ounce, all services have this set to 0x1E, except for one which has it set to 0xA (which is likely the one for S1-compat). 0x1E allows additional protocol values 2 and 4.

= ActionFrameSettings =
This is "nn::ldn::ActionFrameSettings". This is a 0x80-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || LocalCommunicationId
|-
| 0x8 || 0x34 || Reserved
|-
| 0x3C || 0x2 || SecurityMode
|-
| 0x3E || 0x2 || PassphraseSize (Must be 0x10-0x40)
|-
| 0x40 || 0x40 || Passphrase
|}

SecurityMode must be 1-2. The same SecurityMode override functionality from elsewhere is used later with this.

The same LocalCommunicationId override/validation from elsewhere is used with the input as well.

= MessageFlagSet =
This is "nn::ldn::MessageFlagSet". This is a BitFlagSet object for [[#MessageFlag]].

= MessageFlag =
This is "nn::ldn::MessageFlag".

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 ||
|}

[[#SendActionFrame|SendActionFrame]]/[[#RecvActionFrame|RecvActionFrame]] handles bit0 the same way as the MessageFlag with lp2p [[#SendToOtherGroup|SendToOtherGroup]]/[[#RecvFromOtherGroup|RecvFromOtherGroup]].

= MacAddress =
This is "nn::lp2p::MacAddress". Same as [[#MacAddress|MacAddress]].

= GroupId =
This is "nn::lp2p::GroupId". This is a 6-byte struct with 1-byte alignment.

This is a WiFi BSSID.

= NodeInfo =
This is "nn::lp2p::NodeInfo". This is a 0x80-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || || <code>struct sockaddr</code> for the IP address.
|-
| 0x24 || 0x6 || [[#MacAddress_2|MacAddress]]
|}

= GroupInfo =
This is "nn::lp2p::GroupInfo". This is a 0x200-byte struct.

[[Mario Kart Live: Home Circuit|mklive]] sets the SSID to a string generated from random data.

[[#Scan_2|Scan]] only uses the following fields for the cmd input struct: SupportedPlatform/Priority, Frequency/Channel, and PresharedKeyBinarySize/PresharedKey.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x10 || Wrapped master key. When zero, set to randomly-generated data. This is decrypted with a "static AES key" and used to derive the 4 encryption keys for the session.
|-
| 0x10 || 0x8 || LocalCommunicationId. When zero, the value from control.nacp is loaded. This is later validated by [[#Join]]/[[#CreateGroup]] the same way as the [[#NetworkConfig]] field. Used during key derivation to derive keys B and D.
|-
| 0x18 || 0x6 || [[#GroupId]] ("GROUP ID (BSSID)"). When zero, the default is used. The default should be used here: an error is thrown if the data here doesn't match the output from [[WLAN_services|wlan:lcl]] cmd2.
|-
| 0x1E || 0x21 || ServiceName ("GROUP NAME (SSID)"). NUL-terminated string. See below.
|-
| 0x3F || 0x1 || s8 Flags count. Must be <=0x3F.
|-
| 0x40 || 0x40 || Array of s8 with the above count. Each entry value must be <=0x3F. Each entry is an array index used to load a set of flags from a global array with the specified index. global_flags are also masked with flags loaded from here. User-processes use entryval=1 as the default, with [11.0.0+] entryval=0 can be used for standard WPA2-PSK (see +0x8A).
|-
| 0x80 || 0x1 || SupportedPlatform. Must match value 1. 0 is PlatformIdNX, 1 is PlatformIdRcd.
|-
| 0x81 || 0x1 || MemberCountMax. s8, Must be <=0x8. During group creation this is passed to [[WLAN_services|wlan:lcl]] cmd40, when this is value 0 a default of value 1 is passed. During group-creation when the below +0x88 field is not value 0x2, the passed [[BTM_services#SetWlanMode|WlanMode]] is <code>x81_field_val > 3</code>.
|-
| 0x82 || 0x1 ||
|-
| 0x84 || 0x2 || Frequency. Wifi frequency: 24 = 2.4GHz, 50 = 5GHz.
|-
| 0x86 || 0x2 || s16 Channel ("CHANNEL"). Wifi channel number. 0 = use default, otherwise this must be one of the following depending on the frequency field:
* 24: 1, 6, 11.
* 50: 36, 40, 44, 48.
|-
| 0x88 || 0x1 || NetworkMode. Used during group-creation to determine the [[BTM_services#SetWlanMode|WlanMode]] to use. When this is value 0x2, mode=3 is used, otherwise it's determined via the +0x81 field.
|-
| 0x89 || 0x1 || PerformanceRequirement.
|-
| 0x8A || 0x1 || Security type, used during key derivation. 0 = use defaults, 1 = plaintext, 2 = encrypted. [11.0.0+] 3: Standard WPA2-PSK.
|-
| 0x8B || 0x1 || StaticAesKeyIndex. s8, used as the array-index for selecting the KeySource used with [[SPL_services#GenerateAesKek|GenerateAesKek]] during key derivation. Should be 1-2, otherwise GenerateAesKek is skipped and zeros are used for the AccessKey instead.
|-
| 0x8D || 0x1 || Priority. Must match one of the following, depending on the used service (doesn't apply to [[#Join]]): 55 = SystemPriority (lp2p:sys), 90 = ApplicationPriority (lp2p:app and lp2p:sys).
|-
| 0x8E || 0x1 || StealthEnabled. Bool flag, controls whether the SSID is hidden.
|-
| 0x8F || 0x1 || If zero, a default value of 0x20 is used.
|-
| 0x1C0 || 0x1 || PresharedKeyBinarySize. Must be 0x20 for PresharedKeyBinary. [11.0.0+] With WPA2-PSK, this must be value 1.
|-
| 0x1C1 || 0x3F ([9.0.0-10.2.0] 0x20) || PresharedKey. Used to derive encryption keys A and C. [11.0.0+] With WPA2-PSK, this is the passphrase string (length must be at least 8).
|}

In order for the ServiceName to be valid without a new one being generated, the following checks must pass:
* It loops through the characters in the string, looking for the first '_' character:
** The loop will exit once a '_' character is found.
** The character must be '-', or alphanumeric (lowercase/uppercase), otherwise the function will immediately return failure.
** The loop will also exit once string_pos is >19, in which case the function will also immediately return failure.
* Then it checks the 11 characters which follow the above:
** The character must be hex: '0'-'9', or 'A-F' / 'a-'f.
* The following character must be a NUL-terminator.
* The last hex character above, then the characters for the whole string prior to the last hex character are summed. return sum % 0x2B == 0. u32 is used for these calculations. (Return success when sum is a multiple of 0x2B, otherwise return failure)

If the above fails, then the following runs, otherwise it just returns 0:
* It loops through the characters in the string.
** The character must be '-', or alphanumeric (lowercase/uppercase), otherwise the function will immediately return failure.
** The loop will exit once string_pos>20 is reached, or when a NUL-terminator is reached.
* Once finished, success is returned if string_pos-1 is <20, otherwise failure is returned (which also immediately occurs if the first character is a NUL-terminator).

If the above fails, an error is returned, otherwise a new ServiceName is generated:
* Up to 20 characters are copied from the original ServiceName to the output ServiceName, stopping once the limit is reached or when a NUL-terminator is reached.
* '_' is appended to the string.
* <code>nn::util::TSNPrintf({strptr following the above character}, {remaining size}, "%02X%02X%02X%02X%02X", [[#GroupId|GroupId_byte3]], [[#GroupId|GroupId_byte4]], [[#GroupId|GroupId_byte5]], ([[SPL_services#IsDevelopment|IsDevelopment]] ? 0x80 : 0) | 0x1, 0);</code>
* Then the last character is set to the output from a calling a function:
** All string characters which were already written are summed same way as above. Then: <code>return character_lookup_table[sum % 0x2B];</code> (If the length passed to this function is 0, this will instead just return character_lookup_table[0])
*** character_lookup_table contains 0x2B entries: [V-A][k-a][5-0][Z-W].

loaded_flags are first loaded from elsewhere, then masked with the above flags when available. loaded_flags are used when +0x8A is 0. global_flags are loaded from global data. These flags are only used with [[#CreateGroup]]/[[#Join]]. Flags (note that the following was updated with [11.0.0+], and differs from below):
* Bit2 clear:
** global_flags must be non-zero, and loaded_flags bit1 must be set.
** u8 +0x8A is set to value 1.
** When the cached [[SPL_services#IsDevelopment|IsDevelopment]] value is false (retail), an error is thrown.
** u8 +0x8B is set to value 0.
* Otherwise, if bit2 is set:
** u8 +0x8A is set to value 2.
** global_flags bit1 set:
*** u8 +0x8B is set to value 1.
** Otherwise, if global_flags bit2 is set:
*** u8 +0x8B is set to value 2.

= ScanResult =
This is "nn::lp2p::ScanResult". This is a 0x300-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x200 || [[#GroupInfo]]
|-
| 0x200 || 0x1 ||
|-
| 0x206 || 0x2 || AdvertiseData size.
|-
| 0x208 || 0x80 || AdvertiseData
|}

= Network protocol =
== ldn ==
A beacon and Action frame are broadcasted. The SSID in the beacon is hidden (32-bytes with value 0). For [[#Scan]]/[[#ScanPrivate]] it doesn't matter if no beacon is available ([[#NetworkInfo]] is the same), as long as the Action frame is broadcasted. However, the Station will not send a probe-request during connection if no beacon is available (and therefore not attempt any communication with the AccessPoint). The beacon doesn't have any custom Nintendo data, that data is in the Action frame.

During connection, the Station first sends a probe-request using the [[#NetworkInfo|generated]] SSID from the Action frame. If the probe-response contains the expected data for the [[#SecurityConfig]] type, the Station then proceeds to connect to the AccessPoint.

Keys are derived with: <code>GenerateAesKek(AccessKey, KeySource, Generation, Option=0); GenerateAesKey(out_key, AccessKey, {output from SHA256(data_to_hash)});</code> The key for data-frames, if [[#SecurityConfig|enabled]], is derived from a buffer containing: {[[#SecurityParameter]]+0x0} followed by {[[#SecurityConfig]] Passphrase with the specified PassphraseSize}. The [[#ActionFrame]]/data-frame keys are derived roughly the same, the only difference is the data for hashing + the [[SPL_services|KeySource]]. The key derived by ldn is used directly as the static CCMP key for all data-frames (CCMP / MIC is standard). When [[#Protocol|Protocol]] is 3 the [[SPL_services|Generation]] is [[19.0.0|0x13]] instead of 0x0, for all of the previously mentioned keys derivation.

Then the Station scans for an [[#ActionFrame]] for loading the [[#NetworkInfo]].

Once connected, the AccessPoint sends Epigram-vendor Action frame(s) (same data) to the Station, the Station doesn't require these frames: <code>dd1afeedfacedeadbeef010000000a00000000000000000000000000</code>. Then the Station must Authenticate with the AccessPoint, this is custom. The Station sends a frame (a maximum of 3 times in some cases if errors occur, with the same data), and the AccessPoint sends a response. Once Authenticated, the node is added to the [[#NodeInfo|NodeInfo]] array in [[#NetworkInfo]]. If the Station does not successfully Authenticate X-seconds after connecting, the AccessPoint disconnects the Station. If the Station fails to Authenticate, the Station itself will disconnect as well.

After Authentication the Station will scan for another [[#ActionFrame]], with frame-comparision enabled with the above frame (frame must have been updated since the previous scan). The Station locates the index for a [[#MacAddress|MacAddress]] matching itself in the [[#NetworkInfo]] [[#NodeInfo|NodeInfo]] array (the entry for the AccessPoint is skipped), throwing an error if not found. After validating the LocalCommunicationVersion, it proceeds to handle ARP setup below.

This does not use DHCP, each node on the network has to manually setup IP-config with the [[#NodeInfo|NodeInfo]] array in [[#NetworkInfo]]. [?+] After the client is [[#EthFrame|authenticated]] ARP may be used in some cases however.

At this point standard sockets can be used over Data frames.

=== EthFrame ===
The custom Ethernet frames have the following structure:
* "Type: IEEE 802a OUI Extended Ethertype (0x88b7)"
* "IEEE802a OUI Extended Ethertype":
** "Organization Code: 00:22:aa (Nintendo Co., Ltd.)"
** "Protocol ID: {...}"
*** Depends on the frame:
*** 0x0102: [[#Authentication]]
*** 0x0103: ?
* The first byte of Data is value 0, then the ProtocolID-specific data follows, see below.
** ProtocolID 0x0103 frames are sent by the AccessPoint to the Station. This is 0x20-bytes of zeros, except for the first byte which is 0x3. This is sent by the AccessPoint prior to destroying the network.

==== Authentication ====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || [[#AuthVersion]]
|-
| 0x1 || 0x1 || Low u8 for the size.
|-
| 0x2 || 0x1 || Status. 0 = success, non-zero = error.
|-
| 0x3 || 0x1 || [2.0.0+] bool flag. The AccessPoint verifies that this is not set. Always set to 1 by the AccessPoint in the response. [2.0.0-?] The Station only uses this when the [[#AuthVersion]] is >=2.
|-
| 0x4 || 0x1 || [6.0.0+] High u8 for the size.
|-
| 0x5 || 0x1 || [20.0.0+] AuthEncryptionType, must match the type being used by the [[#Protocol|Protocol]]. 0 = plaintext ([[#Protocol|Protocol]] NX), 1 = AES-128-GCM ([[#Protocol|Protocol]] non-NX).
|-
| 0x6 || 0x2 || Unused, zeros.
|-
| 0x8 || 0x20 || [[#NetworkInfo]]+0, must match the corresponding data in [[#NetworkInfo]] when the receiving node verifies this. With the
AccessPoint->Station frame, the Station verifies that this matches the data previously sent to the AccessPoint.
|-
| 0x28 || 0x10 || [[#NetworkInfo]]+0x50, must match the corresponding data in [[#NetworkInfo]] when the receiving node verifies this. With the
AccessPoint->Station frame, the Station verifies that this matches the data previously sent to the AccessPoint.
|-
| 0x38 || 0x10 || AuthEncryptionType1: Used for key derivation.
Station->AccessPoint: The Station sets this to random data. Unused by the AccessPoint (besides the above), except for copying into the response.

AccessPoint->Station: +0x38 from the data originally sent by the Station. The Station verifies that this matches the previously sent data.
|-
| 0x48 || 0x10 || Only present with AuthEncryptionType1: AES-128-GCM MAC tag.
|-
| 0x48 (0x58 with AuthEncryptionType1) || || Frame-specific payload data, with the above size. The total frame size - {offset of the start of this data in the frame} must match the above size.
|}

The Station sets the above size to 0x40 ([6.0.0+] if [[#NetworkInfo]]+0x13 is <3) ([?+] 0x64 regardless of [[#AuthVersion]]). [6.0.0+] The Authentication challenge is only used/enabled if that value is >=3, and [[#IUserLocalCommunicationService]] is being used.

The AccessPoint sets the above size to 0x40 ([6.0.0+] 0x0 if the +0x0 [[#AuthVersion]] is <3) ([?+] 0x84 regardless of [[#AuthVersion]]). [6.0.0+] The AccessPoint will only use/enable the Authentication challenge when the +0x0 [[#AuthVersion]] is >=3, and [[#IUserLocalCommunicationService]] is being used. This data will not be included in the frame if the status field indicates error.

[6.0.0+] Support for the Authentication challenge with [[ETicket_services|es]] cmds 1501-1504 was added.

AuthEncryptionType1: The key is derived essentially the same as the data-frame CCMP key, except the input data for hashing is the 0x10-bytes at +0x38 (this also only supports using [[SPL_services|Generation]] 0x13, returning immediately if the input param indicates otherwise due to the [[#Protocol|Protocol]]). The encrypted AES-128-GCM data starts at +0x58 with the above size. The 0xC-bytes IV is at +0x0, the AAD is at +0x0 size 0x48-bytes.

The AccessPoint will not respond to frames where the source mac-address is unrecognized.

Station->AccessPoint payload data, relative to frame_end above (frame size depends on whether the challenge is enabled):

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x20 || [[#UserConfig]]+0. Copied into state by the AccessPoint.
|-
| 0x20 || 0x2 || Big-endian LocalCommunicationVersion. Byte-swapped by the AccessPoint then copied into state. [?+] This is now ignored.
|-
| 0x22 || 0x1 || [19.0.0+] [[#NodeInfo|NodeInfo]] +0x2D. Copied into state by the AccessPoint. On NX the Station always sets this to 0 in the sent payload-data.
|-
| 0x23 || 0x1D || Zeros, unused by the AccessPoint.
|-
| 0x40 || 0x24 || [6.0.0+] Zeros, unused by the AccessPoint.
|-
| 0x64 || 0x300 || [6.0.0+] Authentication challenge data. If enabled, the total frame size must be >= {end offset of this data in the frame}. The frame data does not include this if it's not enabled.
|}

AccessPoint->Station response payload data, relative to frame_end above (frame size depends on whether the challenge is enabled):

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || Unused, always set to 0. [S2] This is usually set to value 1?
|-
| 0x1 || 0x3F || Zeros. [6.0.0-?] Only included in the frame if it's enabled (+0x0 [[#AuthVersion]] >= 3). Unused by the Station.
|-
| 0x40 || 0x44 || [6.0.0-?] Only included in the frame if it's enabled (+0x0 [[#AuthVersion]] >= 3). Unused by the Station.
|-
| 0x84 || 0x100 || [6.0.0+] If enabled, Authentication challenge response data. Not included in the frame if it's not enabled.
|}

===== AuthVersion =====
Must be 0x1-0xF (<0x10 with newer versions).

[?+] When the AccessPoint is handling the [[#Authentication|Authentication]] EthFrame, the AuthVersion must be >=1 for [[#Protocol|Protocol]] NX, and >=4 for [[#Protocol|Protocol]] 3.

{| class="wikitable" border="1"
|-
! Value || SystemVersion
|-
| 1 || [1.0.0+]
|-
| 2 || [2.0.0+]
|-
| 3 || [6.0.0+]
|-
| 4 || [19.0.0+]
|}

=== ActionFrame ===
The Action frames have the following structure:
* "Fixed parameters":
** "Category code: Vendor Specific (127)"
** "OUI: 00:22:aa (Nintendo Co., Ltd.)"
* The Data starts with the following header:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x2 || 04 00 in sent frames.
|-
| 0x2 || 0x2 || Protocol ID, must be 0x0101.
|-
| 0x4 || 0x2 || Must be 0.
|-
| 0x6 || 0x2 || Zeros, unused.
|}

Then the actual data follows:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x20 || [[#NetworkInfo]]+0x0. The u64/u16 are big-endian. Outside of [[#Scan]]/[[#ScanPrivate]], this must match the previously loaded data for this.
|-
| 0x20 || 0x1 || [[#AuthVersion]]. Copied to [[#NetworkInfo]]+0x63. When comparing with a previous frame is enabled, this must match the value from the previous frame.
|-
| 0x21 || 0x1 || Encryption type: 1 = plaintext, 2 = AES-128-CTR, [20.0.0+] 3 = AES-128-GCM, {frames with other values are ignored by [[#Scan]]/[[#ScanPrivate]]}. Must match the type which is currently being used: with [[#Scan]]/[[#ScanPrivate]] this is determined via this field, otherwise [[#SecurityConfig]] is used to determine this.
|-
| 0x22 || 0x2 || Big-endian u16 size for the data starting at +0x48 (+0x38 with EncryptionType3), and must match {total frame size relative to +0x0 above} - {header_size}.
|-
| 0x24 || 0x4 || Big-endian u32 Counter. The initial value is randomly-generated. This is incremented each time the below content is updated (including initial creation). Also used by the Station to determine whether the frame changed compared to a previous one. When comparing against a previous frame, new_counter-prev_counter must be <= 0xFF, and the counters must not match.
|-
| 0x28 || 0x20 || EncryptionType1-2: SHA256 hash over the entire frame starting at +0x0, with the above size + 0x48. During hashing, this hash is cleared, with the new hash overwriting the original in memory (the original is copied to stack for comparing).
|-
| 0x28 || 0x10 || EncryptionType3: AES-128-GCM MAC tag (replaces the SHA256 hash).
|}

Using EncryptionType3 outside of [[#Scan]]/[[#ScanPrivate]] is enabled with [[#Protocol|Protocol]] non-NX.

When encryption is enabled, the encrypted data is at +0x28 (+0x38 with EncryptionType3) with size {remaining frame size}. The key is derived from the raw 0x20-bytes at +0x0. The CTR/IV is {raw Counter above without byte-swap}, with the rest cleared to zeros. The AAD for AES-128-GCM is at +0x0 size 0x28-bytes.

Originally [[#Scan]]/[[#ScanPrivate]] used the EncryptionType field to determine encryption handling. With [18.0.0+] these now set an internal SecurityMode field to 0 (Any) initially, then later uses the same SecurityMode override as [[#CreateNetwork|CreateNetwork]]. The internal SecurityMode field is used to determine encryption handling: Any uses the EncryptionType field like before. With non-zero the encryption handling is determined as required by the SecurityMode.

The content data at +{above_header_size} follows, which has the size specified above (which must be >=0x500 with EncryptionType1-2), where all fields are big-endian. For EncryptionType1-2:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x10 || [[#NetworkInfo]]+0x50
|-
| 0x10 || 0x2 || [[#NetworkInfo]]+0x60
|-
| 0x12 || 0x1 || [[#NetworkInfo]]+0x62
|-
| 0x13 || 0x1 || Unused
|-
| 0x14 || 0x2 ||
|-
| 0x16 || 0x1 || s8 [[#NetworkInfo]]+0x66, clamped to range 1-8.
|-
| 0x17 || 0x1 || s8 [[#NetworkInfo]]+0x67, clamped to range 1-8.
|-
| 0x18 || 0x1C0(0x38*8) || Array of the below node struct.
|-
| 0x1D8 || 0x2 || Unused
|-
| 0x1DA || 0x2 || [[#NetworkInfo]]+0x26A
|-
| 0x1DC || 0x180 || [[#NetworkInfo]]+0x26C
|-
| 0x35C || 0x19C || Unused
|-
| 0x4F8 || 0x8 || [6.0.0+] [[#NetworkInfo]]+0x478
|}

For EncryptionType3:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x10 || [[#NetworkInfo]]+0x50
|-
| 0x10 || 0x8 || [[#NetworkInfo]]+0x478 [S2] The Station seems to verify that this is 0 when the Challenge is unused (ldn:s)? Throws an error if set before connecting to an [[#Protocol|Ounce]] network.
|-
| 0x18 || 0x1 || [[#NetworkInfo]]+0x60
|-
| 0x19 || 0x1 || [[#NetworkInfo]]+0x62
|-
| 0x1A || 0x2 || s16 LocalCommunicationVersion. Must not be negative.
|-
| 0x1C || 0x8 || Unused?
|-
| 0x24 || 0x2 || Same as +0x14 in the above struct for EncryptionType1-2.
|-
| 0x26 || 0x1 || s8 [[#NetworkInfo]]+0x66 (NodeCountMax)
|-
| 0x27 || 0x1 || s8 [[#NetworkInfo]]+0x67 (NodeCount)
|-
| 0x28 || NodeCount*0x30 || Array of the below node struct.
|-
| 0x28 + (NodeCount*0x30) || 0x2 || [[#NetworkInfo]]+0x26A (AdvertiseDataSize)
|-
| 0x2A + (NodeCount*0x30) || AdvertiseDataSize || [[#NetworkInfo]]+0x26C (AdvertiseData)
|}

The data here is copied into [[#NetworkInfo]].

Node data used in the above array (all fields big-endian), which are copied into the [[#NetworkInfo]] [[#NodeInfo|NodeInfo]] array. For EncryptionType1-2:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || [[#Ipv4Address]]
|-
| 0x4 || 0x6 || [[#MacAddress|MacAddress]]
|-
| 0xA || 0x1 || bool IsConnected
|-
| 0xB || 0x1 || [19.0.0+] [[#NodeInfo|NodeInfo]] +0x2D
|-
| 0xC || 0x20 || First 0x20-bytes of [[#UserConfig]].
|-
| 0x2C || 0x2 || s16 LocalCommunicationVersion
|-
| 0x2E || 0xA || Unused
|}

For EncryptionType3:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || [[#Ipv4Address]]
|-
| 0x4 || 0x6 || [[#MacAddress|MacAddress]]
|-
| 0xA || 0x1 || NodeId
|-
| 0xB || 0x1 || [[#NodeInfo|NodeInfo]] +0x2D
|-
| 0xC || 0x20 || First 0x20-bytes of [[#UserConfig]].
|-
| 0x2C || 0x4 || Unused
|}

=== ActionFrame2 ===
The Action frames used by [[#SendActionFrame|SendActionFrame]]/[[#RecvActionFrame|RecvActionFrame]] have the following structure:
* "Fixed parameters":
** "Category code: Vendor Specific (127)"
** "OUI: 00:22:aa (Nintendo Co., Ltd.)"
* The Data starts with the following header:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x2 || 04 00
|-
| 0x2 || 0x2 || Protocol ID, must match big-endian 0x0102.
|-
| 0x4 || 0x2 || 00 00
|-
| 0x6 || 0x2 || 00 00
|}

Then the actual data follows (all fields big-endian):

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || [[#AuthVersion]]
|-
| 0x1 || 0x1 || EncryptionType, must match the expected type for the current SecurityMode. 1 = plaintext, 2 = AES-128-GCM.
|-
| 0x2 || 0x2 || Padding
|-
| 0x4 || 0x4 || Counter
|-
| 0x8 || 0x8 || LocalCommunicationId
|-
| 0x10 || 0x10 || Used with key derivation.
|-
| 0x20 || 0x10 || EncryptionType2: AES-128-GCM MAC tag.
|-
| 0x30 || Remaining frame size || Data payload
|}

The 0xC-byte IV for AES-128-GCM is the raw 4-bytes from the above Counter, with the rest cleared to zeroes. The encrypted data is at +0x30, with the remaining frame size. The AAD is the 0x20-bytes at +0x0.

The key is derived similar to the regular action-frame key (same KeySource), except: the Generation is always [[17.0.0|0x11]], with the following data for hashing: {big-endian LocalCommunicationId} {+0x10 size 0x10-bytes} {[[#ActionFrameSettings]] Passphrase with the specified PassphraseSize}.

The data payload is the data buffer for [[#SendActionFrame|SendActionFrame]]/[[#RecvActionFrame|RecvActionFrame]].

== lp2p ==
This is used for communicating with accessories (external devices on [11.0.0+]) over local wifi. [[Mario Kart Live: Home Circuit]] uses this. [11.0.0+] [[Album_Applet|LibraryAppletPhotoViewer]] uses this.

A beacon is broadcasted.

Action frames are only sent when done so by [[#SendToOtherGroup]] (other than the Epigram one mentioned below).

Communication uses sockets with standard Data frames and the above Action frames. Switch consoles presumably only use the Action frames to communicate with each other?

Key A derived by ldn-sysmodule is used directly as the static CCMP key for all data-frames (CCMP / MIC is standard). However, with [[#GroupInfo]]+0x8A value 3, standard WPA2-PSK is used instead.

This uses infrastructure-mode (AccessPoint), and DHCP is used. The group-owner is the AccessPoint. Note that the probe response includes the same Nintendo tags included with the beacon. Once connected, the group-owner sends the same Epigram-vendor Action frame(s) described in [[#ldn]]. At this point socket communication can begin, including DHCP usage.

The DHCP server thread is started by the "nn.lp2p.StateMachine" thread eventually during group [[#CreateGroup|creation]]. The DHCP Offer option values are the following:
* "Subnet Mask: 255.255.255.0"
* "DHCP Server Identifier: {...}"
* "Broadcast Address: {...}"
* "IP Address Lease Time: (5s) 5 seconds"
* "Renewal Time Value: (0s) 0 seconds"
* "Rebinding Time Value: (0s) 0 seconds"
* "Interface MTU: 1500"

Note that the above options doesn't include "Domain Name Server" or "Router", the client device may fail to connect if it doesn't allow those DHCP options to be missing.

=== Beacon ===
The SSID in the beacon can optionally be [[#GroupInfo|hidden]] (all-zero with the same length as the original SSID). The beacon contains two vendor-specific Nintendo information elements with OUI <code>00:22:aa</code>; each IE has a 2-byte ID following the OUI. These Nintendo IEs are not used when standard WPA2-PSK is being used.

The beacon is identical to ldn, except for the following (besides SSID length difference and the lp2p-only Nintendo tags):
* "Tag: HT Capabilities (802.11n D1.10)": "HT Short GI for 20MHz" is set to "Not supported", for ldn it's "Supported".
* "Tag: Vendor Specific: Microsoft Corp.: WMM/WME: Parameter Element" "Ac Parameters ACI 0": "CW Min: 15" for lp2p, "CW Min: 63" for ldn.

Note that during group creation the beacon may be missing the Nintendo IEs in some cases, since group creation didn't finish yet.

==== Nintendo IE 0 ====

The first Nintendo IE (ID 0x0600) contains the following fixed parameters:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || Fixed 0x20; perhaps a version or other magic number.
|-
| 0x1 || 0x1 || [[#GroupInfo|SecurityType]]
|-
| 0x2 || 0x1 || [[#GroupInfo|StaticAesKeyIndex]]
|-
| 0x3 || 0x1 || Fixed zero; padding byte.
|-
| 0x4 || 0x8 || Big-endian (i.e. byte-reversed) version of [[#GroupInfo|LocalCommunicationId]]. This is the only context where LocalCommunicationId is reversed.
|-
| 0xC || 0x10 || Wrapped master key. Same as [[#GroupInfo]]+0x0.
|-
| 0x1C || 0x4 || If encryption is enabled, a randomly-generated nonce, else nothing. Appending 8 zero bytes to this yields the AES-GCM IV.
|-
| 0x20 || 0x10 || If encryption is enabled, the AES-GCM MAC tag, else nothing. All bytes prior to this (fixed 0x20 through nonce) are the additional authenticated data. All bytes after this are encrypted with key B.
|}

After this, TLV tagged parameters occur. Each TLV tag is formatted as:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || Tag type
|-
| 0x1 || 0x1 || Length
|-
| 0x2 || {above size} || Data for the tag
|}

Known TLV tags:

{| class="wikitable" border="1"
|-
! Type
! Size
! Description
|-
| 0x1 || 0x2 || Additional network parameters: 0xAB 0xCD. A=[[#GroupInfo]]+0x82, B=[[#GroupInfo|MemberCountMax]], C=[[#GroupInfo|NetworkMode]], D=[[#GroupInfo|PerformanceRequirement]].
|-
| 0x2 || 0x8 || Flags: Bitwise-or of (1<<f) for each entry in [[#GroupInfo]]+0x40
|}

==== Nintendo IE 1 ====

The second Nintendo IE (ID 0x0601) contains only TLVs. If encryption is enabled, a 0x4-byte nonce and 0x10-byte AES-GCM tag are written first, as above, and the TLVs are encrypted. Key C is used.

Known TLV tags:

{| class="wikitable" border="1"
|-
! Type
! Size
! Description
|-
| 0x21 || Varies || AdvertiseData
|}

=== ActionFrame ===
The Action frames have the following structure:
* "Fixed parameters":
** "Category code: Vendor Specific (127)"
** "OUI: 00:22:aa (Nintendo Co., Ltd.)"
* The Data starts with the following:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x2 || Usually 06 00?
|-
| 0x2 || 0x2 || Usually 20 02?(Second byte depends on whether encryption is used?)
|-
| 0x4 || 0x2 || Usually 02 00?(varies)
|-
| 0x6 || 0x8 || Big-endian version of [[#GroupInfo]]+0x10.
|-
| 0xE || 0x10 || Same as [[#GroupInfo]]+0x0.
|}

When encryption is used, the remaining data is:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || Big-endian u32 Counter. The initial value is randomly-generated (?). This is incremented with each sent Action frame.
|-
| 0x4 || {remaining size} || Encrypted user-data. Also includes 0x10-bytes of unknown data.
|}

When plaintext is used, the remaining data is:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || {remaining size} || Plaintext user-data.
|}

= Notes =
The following services are accessible to ldn:
* arp:r, bsd:s, btm, es, fatal:u, ifcfg, lm, nifm:s, pl:s, set:sys, spl:mig, wlan

[S2] Access to btm and spl:mig were replaced with bt:sys and spl:ldn.

[S2] Various objects/state have the same size/layout as S1, generally?(Other than IPC-related differences) There's also stack differences.

== Code-region Memory Layout ==
=== S2 20.2.0 ===
This is the codebin-region layout for S2 ldn 20.2.0-20.5.0. BuildId is "DC456FA4...".

The on-NX note is for the equivalent memregion location/size, memregion-size/contents compared to NX may vary.

Total size is 0x24F000-bytes.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Permissions
! Description
|-
| 0x0 || 0xE1000 || --X || .text
|-
| 0xE1000 || 0x3D000 || R-- || RO-region
|-
| 0x11E000 || 0x3A000 || RW || On NX this is at 0xEF000. The main ExpHeap is at +0x2000, on NX it's at +0x1000.
|-
| 0x158000 || 0x8000 || non-RW || On NX this is at 0x123000.
|-
| 0x160000 || 0x8000 || RW || On NX this is at 0x12B000.
|-
| 0x168000 || 0xF000 || non-RW || On NX this is at 0x139000.
|-
| 0x177000 || 0x3000 || RW || On NX this is at 0x13F000.
|-
| 0x17A000 || 0x24000 || non-RW || On NX this is at 0x14B000.
|-
| 0x19E000 || 0x4E000 || RW || On NX this is at 0x16F000.
|-
| 0x1EC000 || 0x2000 || -- || On NX this is at 0x1BD000.
|-
| 0x1EE000 || 0x2000 || {accessible} || On NX this is at 0x1BF000.
|-
| 0x1EF000 || 0x5000 || -- || On NX this is at 0x1E2000.
|-
| 0x1F4000 || 0x21000 || {accessible} || On NX this is at 0x1EA000.
|-
| 0x218000 || 0x8000 || -- ||
|-
| 0x220000 || 0x2F000 || {accessible}
|}

[[Category:Services]]

Internet Browser

2026-07-25T19:39:10Z

Yellows8: /* WebApplet launch with Tetris */

Nintendo Switch does not have a normal Internet Browser for user usage. However, there is multiple browser applets. It is the [https://web.archive.org/web/20170304075230/https://gl.access-company.com/news_event/archives/2017/170303/ NetFront NX] browser, which is based on Webkit.

When linking the Nintendo Account with Facebook, the Facebook Auth website will open, offering a search box that can be used to browse the Internet ("LoginApplet"). Alternatively, it can be accessed with custom DNS settings which simulate a Wi-Fi login page ([[#WifiWebAuthApplet|WifiWebAuthApplet]] for captive-portal).

At some point WebApplet started sending header "Upgrade-Insecure-Requests: 1" with all plain-HTTP requests (unknown whether other applets affected). This is only for server-use: plain-HTTP content and redirects to plain-HTTP URLs are still allowed (at least on S1).

== Known User Agent Strings ==
{| class='wikitable'
! System Version
! UA String
|-
| [[1.0.0]]
| Mozilla/5.0 (Nintendo Switch; <appletname>) AppleWebKit/601.6 (KHTML, like Gecko) NF/4.0.0.4.25 NintendoBrowser/5.1.0.11682
|-
| [[2.0.0]]
| Mozilla/5.0 (Nintendo Switch; <appletname>) AppleWebKit/601.6 (KHTML, like Gecko) NF/4.0.0.5.9 NintendoBrowser/5.1.0.13341
|-
| [[2.1.0]]-[[2.3.0]]
| Mozilla/5.0 (Nintendo Switch; <appletname>) AppleWebKit/601.6 (KHTML, like Gecko) NF/4.0.0.5.10 NintendoBrowser/5.1.0.13343
|-
| [[3.0.0]]
| Mozilla/5.0 (Nintendo Switch; <appletname>) AppleWebKit/601.6 (KHTML, like Gecko) NF/4.0.0.6.9 NintendoBrowser/5.1.0.14936
|-
| [[4.0.0]]
| Mozilla/5.0 (Nintendo Switch; <appletname>) AppleWebKit/601.6 (KHTML, like Gecko) NF/4.0.0.7.9 NintendoBrowser/5.1.0.15785
|-
| [[5.0.0]]
| Mozilla/5.0 (Nintendo Switch; <appletname>) AppleWebKit/601.6 (KHTML, like Gecko) NF/4.0.0.8.9 NintendoBrowser/5.1.0.16739
|-
| [[5.1.0]]
| Mozilla/5.0 (Nintendo Switch; <appletname>) AppleWebKit/601.6 (KHTML, like Gecko) NF/4.0.0.9.3 NintendoBrowser/5.1.0.16958
|-
| [[6.0.0]]
| Mozilla/5.0 (Nintendo Switch; <appletname>) AppleWebKit/601.6 (KHTML, like Gecko) NF/4.0.0.10.13 NintendoBrowser/5.1.0.17805
|-
| [[6.1.0]]
| Mozilla/5.0 (Nintendo Switch; <appletname>) AppleWebKit/601.6 (KHTML, like Gecko) NF/4.0.0.10.14 NintendoBrowser/5.1.0.17806
|-
| [[10.0.0]]
| Mozilla/5.0 (Nintendo Switch; <appletname>) AppleWebKit/606.4 (KHTML, like Gecko) NF/6.0.1.15.4 NintendoBrowser/5.1.0.20389
|-
| [[20.1.0]]-[[20.1.1]]
| Mozilla/5.0 (Nintendo Switch; <appletname>) AppleWebKit/613.0 (KHTML, like Gecko) NF/6.0.3.27.11 NintendoBrowser/5.1.0.35219
[S2] Mozilla/5.0 (Nintendo Switch; <appletname>) AppleWebKit/613.0 (KHTML, like Gecko) NF/7.0.3.8.11 NintendoBrowser/5.2.0.35483
|}

The UA is generated with: "Mozilla/5.0 (Nintendo Switch; <appletname>) AppleWebKit/<webkitver> (KHTML, like Gecko) NF/<nfver0>.<nfver1>.<nfver2> NintendoBrowser/5.<ninver0>.<ninver1>.<ninver2>"

The full UA for Switch and Switch 2 are similar, on matching system-versions. The NF and NintendoBrowser versions are newer for S2 however.

== Browser Applets ==
{| class='wikitable'
! appletname (From UA)
! Usage
! Invalid TLS cert handling
! Uses whitelist
! [[Applet_Manager_services#AppletId|AppletId]]
! Notes
|-
| WebApplet
| General web-applet for use by applications(online manuals, ...).
| Displays an error dialog without an option to ignore it.
| Yes
| 0x13
|
|-
| ShopN
| Actual eShop client
| Just displays an error-code.
| Yes
| 0x14
|
|-
| WebApplet
| Offline HTML display
|
|
| 0x17
|
|-
| LoginApplet
| Nintendo Account linking, and for linking Facebook and Twitter to suggest friends
| Just displays an error-code.
| Yes
| 0x18
|
|-
| ShareApplet
| Posting screenshots to social media, and (optionally) linking social media accounts
| Just displays an error-code.
| Yes
| 0x18
|
|-
| LobbyApplet
| "Nintendo Switch Online Lounge"
| Just displays an error-code.
| Yes
| 0x18
|
|-
| NsoApplet
| Nintendo Switch Online menu
|
|
| 0x18
|
|-
| WifiWebAuthApplet
| Captive-portal
| Displays an error dialog with an option to ignore it.
| No
| 0x19
|
|}

When whitelisting is enabled, you can only load page domains included in the whitelist, otherwise an error is displayed. This only applies to page navigation. Videos via the <video> tag are not affected, likewise with network requests with JS.

No known applets can directly access the SD card via mounting it. This includes ShareApplet (which posts screenshots from SD to social media).

== BrowserDll ==
The NROs for the OSS are stored under the BrowserDll [[Title_list|SystemData]]. All of the web-applets use the same OSS NROs via this SystemData.

String from v2.0 in oss_wkc.nro: "libcurl/7.50.1".

Almost all RomFs data for the web-applets is stored here.

S2 has the following changes for BrowserDll, compared to S1:
* Various data under "/browser/" was updated.
** Also, the following was added under "/browser/": "icudt62l.dat.lz4", "UserCssNxCompatibleLineHeight.dat".
** [21.0.0-21.2.0] Updated "/browser/ErrorPageTemplate.html".
** [21.0.0-21.2.0] Updated "icudt62l.dat.lz4".
* "/buildinfo/buildinfo.dat" differ.
* Added "/font/nintendo_private_ext.bfttf". [21.0.0-21.2.0] updated
* Updated "/gfxShader/BrowserOffscreenDrawer.bnsh", added "/gfxShader/MediaPlayerCcDrawer.bnsh", updated "/gfxShader/MediaPlayerDrawer.bnsh".
* The contents of UrlBlackList were moved here to "/". These are the following:
** "listCommon.txt", "listEcChina.txt", "listEcGlobal.txt", "listIframe.txt", "listLnsChina.txt", "listLnsGlobal.txt", "listWebYouTubePlayerCommon.txt"
** These are identical except for "listLnsGlobal.txt", which adds a newline at end-of-file.
** [21.0.0-21.2.0] These were moved into the SystemData UrlBlackList.
* Removed "/lyt/".
* The various localization data under "/message/" was updated, etc.
** [21.0.0-21.2.0] updated
* "/nro/netfront/core_0/default":
** "cfi_disabled/" is now "cfi_enabled/".
** [21.0.0-21.2.0] "cfi_enabled/" is now "cfi_nncfi/".
* "/nro/netfront/core_3/":
** "default/" is now "mse/".
** [21.0.0-21.2.0] Removed "/nro/netfront/core_3/".
* Removed "/shader/".
* Moved "/sound/" from SystemData into the applet RomFs, with filename/content being updated.
* Added "/ui/".
** [21.0.0-21.2.0] updated

== UrlBlackList ==
With [S2] [21.0.0-21.2.0] the list* files from BrowserDll were moved here, with the following changes:
* "listCommon.txt", "listIframe.txt", "listWebYouTubePlayerCommon.txt" are identical.
* The files for China/Global were removed.
* Added "listOpenWebJump.txt", same as "listLnsGlobal.txt" which was removed, except the "nintendo*" entries were removed.
* Added "listSystemWeb.txt", identical to "listEcGlobal.txt" which was removed.

== Video Playback ==
WifiWebAuthApplet does not fully support playing videos. It will [[Error_codes|assert]] with normal videos. The assert triggers before it even starts MP4 parsing?(For example, selecting a video from a video-tag will assert even though it doesn't send any network request for it) However, in some cases with certain MP4s using vulns it will display an error dialog instead.

With v3.0 WifiWebAuthApplet video-playback was disabled, it now throws the following error when attempting to play a video: "Support Code: 2809-1212" "This feature is not available." On past system-versions it would just trigger a fatal-error(see above). Video playback still works on the whitelisted applets following v3.0.0, which allows video playback through Facebook and embedded into Google Sites.

== Trusted RootCAs ==
While the rootCA(s) for Let's Encrypt isn't included, Let's Encrypt is indirectly trusted via "Digital Signature Trust Co.". This seems to be only(?) the case for WifiWebAuthApplet, hence non-WifiWebAuthApplet seems to have a different set of trusted rootCAs.

== WifiWebAuthApplet ==
When doing a connection-test in system-settings, it will detect that the captive-portal is required and display an error for it when the response for "http://conntest.nintendowifi.net/" doesn't include the "X-Organization: Nintendo" HTTP header. The web-applet will not load until something else attempts a conntest, for example when launching eShop and prior to LoginApplet launching. The initial page loaded by this applet is the above conntest URL.

This is only available starting with [[2.0.0]].

Prior to version [[3.0.0]], this applet was launched when attempting a system update from recovery mode if needed. This was changed to display a "This feature is not available." popup instead.

The conntest URL from [[#WebWifiPageArg]] is used to poll whether the connection is usable, with the SDK [[libcurl]].

In later versions the above domain was replaced with [[Network|ctest.{...}]].

==Whitelisted Applets==
The v2.1 main-codebin page-aligned .text size is 0x1000-bytes larger than ShopN.

The file at "data:/whitelist/WhitelistLns.txt" for LoginApplet/ShareApplet/LobbyApplet, which doesn't exist in WifiWebAuthApplet, contains the following:

<nowiki>^https://([0-9A-Za-z\-]+\.)*nintendo\.net(/|$)
^https?://([0-9A-Za-z\-]+\.)*nintendo\.(co\.jp|com|eu|co\.uk|es|pt|ch|at|de|nl|be|ch|ru|fr|it|co\.za|co\.kr|tw|com\.hk|com\.au|ca|co\.nz)(/|$)
^https?://([0-9A-Za-z\-]+\.)*nintendo-europe\.com(/|$)
^https?://([0-9A-Za-z\-]+\.)*nintendoservicecentre\.co\.uk(/|$)
^https?://([0-9A-Za-z\-]+\.)*google\.(com|ad|ae|com\.af|com\.ag|com\.ai|al|am|co\.ao|com\.ar|as|at|com\.au|az|ba|com\.bd|be|bf|bg|com\.bh|bi|bj|com\.bn|com\.bo|com\.br|bs|bt|co\.bw|by|com\.bz|ca|cd|cf|cg|ch|ci|co\.ck|cl|cm|cn|com\.co|co\.cr|com\.cu|cv|com\.cy|cz|de|dj|dk|dm|com\.do|dz|com\.ec|ee|com\.eg|es|com\.et|fi|com\.fj|fm|fr|ga|ge|gg|com\.gh|com\.gi|gl|gm|gp|gr|com\.gt|gy|com\.hk|hn|hr|ht|hu|co\.id|ie|co\.il|im|co\.in|iq|is|it|je|com\.jm|jo|co\.jp|co\.ke|com\.kh|ki|kg|co\.kr|com\.kw|kz|la|com\.lb|li|lk|co\.ls|lt|lu|lv|com\.ly|co\.ma|md|me|mg|mk|ml|com\.mm|mn|ms|com\.mt|mu|mv|mw|com\.mx|com\.my|co\.mz|com\.na|com\.nf|com\.ng|com\.ni|ne|nl|no|com\.np|nr|nu|co\.nz|com\.om|com\.pa|com\.pe|com\.pg|com\.ph|com\.pk|pl|pn|com\.pr|ps|pt|com\.py|com\.qa|ro|ru|rw|com\.sa|com\.sb|sc|se|com\.sg|sh|si|sk|com\.sl|sn|so|sm|sr|st|com\.sv|td|tg|co\.th|com\.tj|tk|tl|tm|tn|to|com\.tr|tt|com\.tw|co\.tz|com\.ua|co\.ug|co\.uk|com\.uy|co\.uz|com\.vc|co\.ve|vg|co\.vi|com\.vn|vu|ws|rs|co\.za|co\.zm|co\.zw|cat)(/|$)
^https://([0-9A-Za-z\-]+\.)*facebook\.com(/|$)
^https://([0-9A-Za-z\-]+\.)*twitter\.com(/|$)</nowiki>

[3.0.0+]: The "google\.(com" line now starts with "^https://" instead of "https?://", hence plain HTTP is no longer allowed. The following line was added right after the original google line: "---- ^https?://([0-9A-Za-z\-]+\.)*google(\.[A-Za-z]+)*/(search|translate)\?"

[4.0.0+]: Lines 2-4 ("...nintendo\.(co...", "nintendo-europe", and "nintendoservicecentre") now starts with "^https://" instead of "https?://". Hence, plain HTTP for these are no longer allowed.

===ShareApplet===
The initial page loaded by this applet is controlled by the [[#ShareStartPage]] TLV.

The "web-lp1.share.srv.nintendo.net" site will return a HTTP 302 redirect to <nowiki>"https://nintendo.com/"</nowiki> when the specified User-Agent isn't the one for ShareApplet.

===LobbyApplet===
Support for Lobby was added with [2.0.0+]. This applet is for "Nintendo Switch Online Lounge"

The initial page loaded by this applet is: <nowiki>"https://web-lp1.znc.srv.nintendo.net/lobby/"</nowiki>.

The content of the above URL refers to "rooms", "NxView_Img_Google_Play_Icon", etc.

And also:
Your room has been created.

You can invite friends to the room via
the Nintendo Switch Online Lounge app.

=== NsoApplet ===
[11.0.0+] This applet handles the new Nintendo Switch Online menu, which is launched from qlaunch.

The initial page loaded by this applet is: <nowiki>"https://%.nso.nintendo.net/</nowiki>{string from [[#TLVs|TLV]] 0x2}"

== ShopN ==
The initial page loaded by ShopN is: <nowiki>"https://bugyo.hac.lp1.eshop.nintendo.net/ashigaru/"</nowiki>.
This can be accessed via computer possesed the certificate ShopN.

The file at "data:/whitelist/WhitelistEc.txt", which doesn't exist in WifiWebAuthApplet, contains the following:

<nowiki>^https://([0-9A-Za-z\-]+\.)*eshop\.nintendo\.net($|/)
^https?://([0-9A-Za-z\-]+\.)*nintendo\.(co\.jp|com|de)($|/)</nowiki>

== WebApplet ==
===010000000000100A===
The initial page loaded by this applet is specified by the title which launched this applet. Plain HTTP is allowed.

The files under "data:/" are identical to WifiWebAuthApplet except that the content of each file differs.

This applet uses a whitelist, but it doesn't come from "data:/" like whitelisted-applet.

==== WebApplet launch with Tetris ====
See [[Switch_System_Flaws#Whitelist|here]].

=== Offline Applet ===
Minus TIDs, the [[NPDM]] is the same as 010000000000100A except 010000000000100A has access to more/other services.

== [[NPDM]] ==
All web-applets have access to the following services: acc:u1, appletAE, audin:u, audout:u, audren:u, [7.0.0+] banana, bsd:u, bsdcfg, [12.1.0+] csrng, erpt:c, fatal:u, fsp-srv, hid, hid:sys, htc, htc:tenv, htcs, hwopus, irs, ldn:m, ldr:ro, lm, [9.1.0+] lp2p:m, mm:u, nifm:s, [3.0.0+] ns:vm, ns:am, nsd:u, nvdrv:a, pl:u, prepo:s, set, set:sys, sfdnsres, ssl, time:u, [1.0.0] tspm, vi:s

[3.0.0+] ns:am was replaced with ns:web.

[17.0.0+] htcs:sys access was added. [18.1.0+] htcs access was removed.

[19.0.0+] bsd:u was replaced with bsd:a.

WebApplet also has access to ntc. [3.0.0+] Added ntc access for Shop and LibAppletLns.

LibAppletLns has access to the above + caps:a. Also [13.1.0+] caps:ss, [13.1.0+] mnpp:web, [3.0.0+] pctl. [20.0.0+] ns:sweb is accessible instead of ns:web.

Shop also has access to [2.0.0+] nim:shp, [?+] <nowiki>news:c</nowiki>. Shop has access to ns:ec instead of ns:web.

Offline has access to nifm:u instead of nifm:s. Unlike the other applets, Offline doesn't have access to the following: ldn:m, lp2p:m, ssl.

Unlike the other applets, LibAppletAuth doesn't have access to following: [3.0.0+] mm:u, [3.0.0+] ns:web.

All web-applets have fs-permission [[NPDM|SystemSaveData]].

Unlike the applets listed above, WebApplet/Offline also have access to fs-permission [[NPDM|ApplicationInfo]]. This is so it can open the specified Manual content. With WebApplet this is used for loading the whitelist from "/accessible-urls/accessible-urls.txt" in the mounted content.

[S2] OpenWeb has access to the following services: acc:u1, adraw:a, appletAE, aud:u, auddmg:u, audsmx:u, banana, bsd:a, csrng, erpt:c, fatal:u, fsp-srv, hid, hid:sys, htc, htc:tenv, htcs:sys, imf, ldn:m, ldr:ro, lm, lp2p:m, nifm:s, ns:vm, ns:web, nsd:u, ntc, pl:u, prepo:s, set, set:sys, sfdnsres, ssl, time:u
* [S2] OpenWeb: [20.1.0+] pctl access was added.

== Heap ==
The size used for [[SVC|svcSetHeapSize]] by the web-applets is 0x15600000. Under ShopN, the largest size that can be passed to this without an error being returned, is 0x1B400000.

The size used by title 010000000000100A (on 10.0.0 at least) is 0x14200000.

The heap for the main-codebin (<code>malloc</code>/<code>operator new</code>) uses nn::lmem::*ExpHeap. [8.0.0+] <code>malloc</code>/<code>operator new</code> now checks the return-addr (addr located in a relevant NRO), with wkc_malloc_crashonfailure being called for the allocation if the check passes, otherwise a normal allocation is done (the code which runs for this will Abort if allocation fails).

<code>malloc</code> passes the input size directly to the called func. <code>operator new</code> when handling normal non-wkc allocations passes the following to the called func: <code>sxtw x1, {inw0}</code> (for wkc allocations the size is passed directly). [12.1.0+] The size is now passed directly (64bit) without using sxtw.

[11.0.0+] There's now optional code for using [[SVC|svcMapPhysicalMemoryUnsafe]] etc, however it's unknown what sets the flag for this. An Abort string used this is: "{path}/TransferredMemoryManager.cpp"

== Applet Launching ==
The web-applets are launched using a storage containing the input arg data, on exit the output storage contains the "*ReturnValue" reply data.

Input/output storage size for TLV data is 0x2000-bytes.

=== Library Applet Versions ===
{| class="wikitable" border="1"
|-
! System Version || Value
|-
| [1.0.0+] || 0x20000
|-
| [3.0.0+] || 0x30000
|-
| [5.0.0+] || 0x50000
|-
| [6.0.0+] || 0x60000
|-
| [8.0.0+] || 0x80000
|}

The above only (?) applies to non-WebWifi. WebWifi uses version 0x0.

=== ShimKind ===
This enum is "nn::web::common::ShimKind".

This indicates the type of web-applet.

{| class="wikitable" border="1"
|-
! Value
! Name
|-
| 1
| Shop
|-
| 2
| Login
|-
| 3
| Offline
|-
| 4
| Share
|-
| 5
| Web
|-
| 6
| Wifi
|-
| 7
| Lobby
|-
| 8
| [[#NsoApplet|Lhub]]
|}

=== WebSession ===
With [5.0.0+] sdk-nso added <code>nn::web::Session::</code>. With [6.0.0+] this was removed, however it was reintroduced with [7.0.0+] as <code>nn::web::*WebSession</code> (for ShimKind Offline and Web).

This is for sending/receiving [[#SessionMessage]]s via applet Interactive storage.

During state init, max_messages is set to 0xA ([7.0.0+] 0x10), with message_count=0 and cur_size=0. [5.0.0-5.1.0] max_size is set to 0x5000. [7.0.0+] Two queues are used for message_count/cur_size: first one is for BrowserEngineContent (max_size 0x8000 is used), the second one is for non-BrowserEngineContent (max_size 0x1000 is used).

When sending messages, there has to be an available message slot available (<code>max_messages!=message_count</code>), and there has to be enough space available (<code>msghdr_contentsize+0x10 + cur_size <= max_size</code>). After pushing the storage, message_count is incremented and cur_size is increased by <code>msghdr_contentsize+0x10</code>.

When receiving messages, it will repeatedly pop Interactive output storage until no more are available. Non-Ack messages are Acked.
* Ack: Verifies that message_count is not already 0, then decrements it. Then cur_size is decreased by the u32 loaded from msgcontent+0.
* 0x0: Does some validation. Reads the message content into the user buffer, when contentsize is non-zero. The original contentsize is written to an user output param. The last byte in the user buffer (contentsize clamped to the user max-buf-size, -1) is set to 0 for NUL-termination.

Next info was tested in 9.0.0

In the js side (which is only available when enabled via the JsExtensionEnabled TLV), there is a method called <code>window.nx.sendMessage(arg)</code> that sends data to the native side, this method returns a boolean indicating if sending was successful and accepts a string as an argument. The string is encoded like a C null terminated string in the message content. For receive messages from native part, there is a dom event called <code>message</code> which is dispatched when a message arrives. The event can be listened using <code>window.nx.addEventListener("message", callback)</code> being callback a function which first parameter is like a dom event arg and contains a member called <code>data</code> which contains the string decoded from the arrived message.

If messages aren't acked by the native part, js side will not longer receive messages. Ack to web applet '''must''' have 4 bytes after the message content or the applet will Abort.

==== SessionMessage ====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x10
| [[#SessionMessageHeader]]
|-
| 0x10
| Size from header
| Message content
|-
| After message content
| 0x4 if message is ack, 0x0 otherwise
| Padding
|}

==== SessionMessageHeader ====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Message Kind ([[#WebSessionSendMessageKind]] / [[#WebSessionReceiveMessageKind]])
|-
| 0x4
| 0x4
| Data size following the header.
|-
| 0x8
| 0x8
| Unused
|}

==== WebSessionSendMessageKind ====
This is "nn::web::detail::WebSessionSendMessageKind".

{| class="wikitable" border="1"
|-
! ID
! Content size
! Description
|-
| 0x0
| Arbitrary
| BrowserEngine Content, NUL-terminated string. Used to communicate with the applet via JsExtensions used by the Js being run by the applet on the current page.
|-
| 0x100
| 0x0
| SystemMessage Appear. Requests the applet to Appear, this is only needed with [[#WebSessionBootMode]] AllForegroundInitiallyHidden.
|-
| 0x1000
| 0xC
| Ack. Content: first u32 is the entire storage size of the message being acked, the rest is not used.
|}

==== WebSessionReceiveMessageKind ====
This is "nn::web::detail::WebSessionReceiveMessageKind".

{| class="wikitable" border="1"
|-
! ID
! Content size
! Description
|-
| 0x0
| Arbitrary
| BrowserEngine Content, see [[#WebSessionSendMessageKind]].
|-
| 0x1000
| 0xC
| Ack BrowserEngine
|-
| 0x1001
| 0xC
| Ack SystemMessage
|}

=== WebWifiPageArg ===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || Official sw sets this to 0 with appletStorageWrite, separately from the rest of the config struct.
|-
| 0x4 || 0x100 || URL used for the connection-test requests.
|-
| 0x104 || 0x400 || Initial URL navigated to by the applet.
|-
| 0x504 || 0x10 || NIFM Network UUID. Can be value zero. Only used by the applet when conntest_url is set.
|-
| 0x514 || 0x4 || Input value for nifm cmd SetRequirementByRevision. Can be value zero. Only used by the applet when conntest_url is set.
|}

This is the input struct for WifiWebAuthApplet. This is a total of 0x518-bytes.

When the conntest_url is empty, the applet will test the connection with nifm and throw an error on failure.

=== WebWifiReturnValue ===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || ?
|-
| 0x4 || 0x8 || Result
|}

This is the output struct for WifiWebAuthApplet. This is a total of 0x8-bytes.

=== WebCommonReturnValue ===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || u32 exitReason
|-
| 0x4 || 0x4 || Padding
|-
| 0x8 || 0x1000 || lastUrl string
|-
| 0x1008 || 0x8 || lastUrlSize
|}

This is the 0x1010-byte output storage used by all non-WebWifi applets - except for Share which returns a TLV storage on [3.0.0+], and Web on [8.0.0+].

=== WebArgHeader ===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x2 || Total [[#WebArgTLV]] entries following this struct.
|-
| 0x2 || 0x2 || Padding
|-
| 0x4 || 0x4 || [[#ShimKind]]
|}

This is the header struct at offset 0 in the input web Arg storage for non-WebWifi. This is a total of 0x8-bytes. The total storage size used for input/output TLVs is 0x2000.

=== WebArgTLV ===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x2 || Type of this arg.
|-
| 0x2 || 0x2 || Size of the arg data following this struct.
|-
| 0x4 || 0x4 || Padding
|}

Web TLV used in the input web Arg storage, after [[#WebArgHeader]]. This is a total of 0x8-bytes.

=== WebBootFooterButtonEntry ===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || [[#FooterButtonId]]
|-
| 0x4 || 0x1 || u8 bool visible flag
|-
| 0x5 || 0x2 || ?
|-
| 0x7 || 0x1 || ?
|}

=== TLVs ===
All strings are NUL-terminated.

==== Input TLVs ====
{| class="wikitable" border="1"
|-
! System Version
! Applets
! Type
! Size
! Value
! Description
|-
| [1.0.0+]
|
| 0x1
| 0xC00
| string
| Initial URL
|-
| [1.0.0+]
|
| 0x3
| 0x400
| string
| CallbackUrl
|-
| [1.0.0+]
|
| 0x4
| 0x400
| string
| CallbackableUrl
|-
| [1.0.0+]
| Offline
| 0x5
| 0x8
| u64 titleID
| ApplicationId, for DocumentKind_OfflineHtmlPage/DocumentKind_ApplicationLegalInformation. Should be zero for DocumentKind_OfflineHtmlPage since it's ignored.
|-
| [1.0.0+]
| Offline
| 0x6
| 0xC00
| string
| DocumentPath
|-
| [1.0.0+]
| Offline
| 0x7
| 0x4
| u32 enum OfflineDocumentKind
| [[#DocumentKind]]
|-
| [1.0.0+]
| Offline
| 0x8
| 0x8
| u64 titleID
| SystemDataId, for DocumentKind_SystemDataPage.
|-
|
| Share
| 0x9
| 0x4
| u32 enum [[#ShareStartPage]]
| ShareStartPage
|-
| [1.0.0+]
|
| 0xA
| 0x1000
| string
| Whitelist. If not formatted properly, the applet will exit briefly after the applet is launched. Each line is a regex for each whitelisted URL.
|-
| [1.0.0+]
|
| 0xB
| 0x1
| u8 bool
| News flag. When set the domain from the input URL is automatically whitelisted, in addition to any already loaded whitelist.
|-
| [1.0.0+]
|
| 0xE
| 0x10
| userID
| userID, controls which user-specific savedata to mount.
|-
|
| Share
| 0xF
| 0x20
| [[Capture_services|AlbumEntry]]
| AlbumEntry0
|-
| [1.0.0+]
|
| 0x10
| 0x1
| u8 bool
| ScreenShotEnabled. Controls whether screen-shot capture is allowed.
|-
| [1.0.0+]
|
| 0x11
| 0x1
| u8 bool
| EcClientCertEnabled
|-
| [1.0.0+]
|
| 0x12
| 0x1
| u8
| ?
|-
| [1.0.0+]
| Offline
| 0x13
| 0x1
| u8 bool
| PlayReportEnabled
|-
| [1.0.0+]
|
| 0x14
| 0x1
| u8
| ?
|-
| [1.0.0+]
|
| 0x15
| 0x1
| u8
| ?
|-
| [1.0.0+]
|
| 0x17
| 0x4
| u32 enum [[#BootDisplayKind]]
| BootDisplayKind
|-
| [1.0.0+]
|
| 0x18
| 0x4
| u32 enum [[#BackgroundKind]]
| BackgroundKind
|-
| [1.0.0+]
|
| 0x19
| 0x1
| u8 bool
| FooterEnabled. Controls whether the UI footer is enabled.
|-
| [1.0.0+]
|
| 0x1A
| 0x1
| u8 bool
| PointerEnabled
|-
| [1.0.0+]
|
| 0x1B
| 0x4
| u32 enum [[#LeftStickMode]]
| LeftStickMode
|-
| [1.0.0+]
|
| 0x1C
| 0x4
| s32
| KeyRepeatFrame, first param
|-
| [1.0.0+]
|
| 0x1D
| 0x4
| s32
| KeyRepeatFrame, second param
|-
| [1.0.0+]
|
| 0x1E
| 0x1
| u8 bool
| Set after BootAsMediaPlayer with the value inverted.
|-
| [1.0.0+]
|
| 0x1F
| 0x1
| u8 bool
| DisplayUrlKind (<code>value = (input_enumval==0x1)</code>)
|-
| [2.0.0+]
|
| 0x21
| 0x1
| u8 bool
| BootAsMediaPlayer
|-
| [2.0.0+]
|
| 0x22
| 0x1
| u8 bool
| ShopJumpEnabled
|-
| [2.0.0+]
|
| 0x23
| 0x1
| u8 bool
| [6.0.0+] MediaAutoPlayEnabled ([2.0.0-5.1.0] MediaPlayerUserGestureRestrictionEnabled)
|-
| [2.0.0+]
|
| 0x24
| 0x100
| string
| LobbyParameter
|-
| [3.0.0+]
| Share
| 0x26
| 0x20
| [[Capture_services|ApplicationAlbumEntry]]
| ApplicationAlbumEntry
|-
| [3.0.0+]
|
| 0x27
| 0x1
| u8 bool
| JsExtensionEnabled
|-
| [4.0.0+]
| Share
| 0x28
| 0x100
| string
| AdditionalCommentText
|-
| [4.0.0+]
|
| 0x29
| 0x1
| u8 bool
| TouchEnabledOnContents
|-
| [4.0.0+]
|
| 0x2A
| 0x80
| string
| UserAgentAdditionalString. " " followed by this string are appended to the normal User-Agent string.
|-
| [4.0.0+]
| Share
| 0x2B
| 0x10
| u8 array
| AdditionalMediaData0 (If the user-input size is less than 0x10, the remaining tmp data used for the TLV is cleared)
|-
| [4.0.0+]
|
| 0x2C
| 0x1
| u8 bool
| MediaPlayerAutoCloseEnabled
|-
| [4.0.0+]
|
| 0x2D
| 0x1
| u8 bool
| PageCacheEnabled
|-
| [4.0.0+]
|
| 0x2E
| 0x1
| u8 bool
| WebAudioEnabled
|-
| [5.0.0+]
|
| 0x2F
| 0x1
| u8
| ?
|-
| [5.0.0+]
|
| 0x31
| 0x1
| u8 bool
| When set, indicates the whitelist for YouTubeVideo should be used (loaded from web-applet RomFS).
|-
| [5.0.0+]
|
| 0x32
| 0x4
| u32 enum *WebFooterFixedKind
| FooterFixedKind
|-
| [5.0.0+]
|
| 0x33
| 0x1
| u8 bool
| PageFadeEnabled
|-
| [5.0.0+]
| Share
| 0x34
| 0x20
| s8 data[32]
| MediaCreatorApplicationRatingAge
|-
| [5.0.0+]
|
| 0x35
| 0x1
| u8 bool
| BootLoadingIconEnabled
|-
| [5.0.0+]
|
| 0x36
| 0x1
| u8 bool
| PageScrollIndicatorEnabled
|-
| [6.0.0+]
|
| 0x37
| 0x1
| u8 bool
| MediaPlayerSpeedControlEnabled
|-
| [6.0.0+]
| Share
| 0x38
| 0x20
| [[Capture_services|AlbumEntry]]
| AlbumEntry1
|-
| [6.0.0+]
| Share
| 0x39
| 0x20
| [[Capture_services|AlbumEntry]]
| AlbumEntry2
|-
| [6.0.0+]
| Share
| 0x3A
| 0x20
| [[Capture_services|AlbumEntry]]
| AlbumEntry3
|-
| [6.0.0+]
| Share
| 0x3B
| 0x10
| u8 array
| AdditionalMediaData1
|-
| [6.0.0+]
| Share
| 0x3C
| 0x10
| u8 array
| AdditionalMediaData2
|-
| [6.0.0+]
| Share
| 0x3D
| 0x10
| u8 array
| AdditionalMediaData3
|-
| [6.0.0+]
| BootFooterButton
| 0x3E
| 0x80
| Array of [[#WebBootFooterButtonEntry]] with 0x10 entries.
| BootFooterButton
|-
| [6.0.0+]
|
| 0x3F
| 0x4
| float
| OverrideWebAudioVolume
|-
| [6.0.0+]
|
| 0x40
| 0x4
| float
| OverrideMediaAudioVolume
|-
| [7.0.0+]
|
| 0x41
| 0x4
| u32 enum [[#WebSessionBootMode]]
| BootMode
|-
| [7.0.0+]
|
| 0x42
| 0x1
| u8 bool
| Enables using [[#WebSession]] when set.
|-
| [8.0.0+]
| Offline
| 0x43
| 0x1
| u8 bool
| MediaPlayerUiEnabled
|-
| [11.0.0+]
|
| 0x44
| 0x1
| bool
| TransferMemoryEnabled
|}

Offline: title to load the content from is controlled by ApplicationId/SystemDataId. With DocumentKind_OfflineHtmlPage, it will ignore this and only load from the user-process title.

Offline DocumentPath: Initial document path in RomFS, without the leading '/'. For DocumentKind_OfflineHtmlPage, this is relative to "html-document/" in RomFS. For the other DocumentKind values, this is relative to "/" in RomFS. This path must contain ".htdocs/".

Share/Lobby: if a non-zero userID isn't set, the applet will launch the profile-selector applet to select an account.

Share: An error will be displayed if neither AlbumEntry or ApplicationAlbumEntry are set, with [[#ShareStartPage|ShareStartPage_Default]].

[6.0.0+] <code>AddAlbumEntryAndMediaData</code> was added:
* Looks for AlbumEntry{N} TLVs, when a TLV is not found it is written, then the associated AdditionalMediaData{N} TLV is written the same way as AdditionalMediaData0. If all AlbumEntry{N} TLVs already exist, this returns without writing anything.

TransferMemoryEnabled: sdknso only exposes this for the Web applet. The sdknso func uses <code>nn::os::QueryMemoryInfo</code> at the start of the func, however the output is unused. The applet doesn't seem to parse this TLV.

==== Output TLVs ====
{| class="wikitable" border="1"
|-
! System Version
! Applets
! Type
! Size
! Value
! Description
|-
| [3.0.0+]
| Share, Web
| 0x1
| 0x4
| u32
| ShareExitReason
|-
| [3.0.0+]
| Share, Web
| 0x2
|
| string
| LastUrl
|-
| [3.0.0+]
| Share, Web
| 0x3
| 0x8
| u64
| LastUrlSize
|-
| [3.0.0+]
| Share
| 0x4
| 0x4
| u32
| SharePostResult
|-
| [3.0.0+]
| Share
| 0x5
|
| string
| PostServiceName
|-
| [3.0.0+]
| Share
| 0x6
| 0x8
| u64
| PostServiceNameSize
|-
| [3.0.0+]
| Share
| 0x7
|
| string
| PostId
|-
| [3.0.0+]
| Share
| 0x8
| 0x8
| u64
| PostIdSize
|-
| [8.0.0+]
| Web
| 0x9
| 0x1
| u8 bool
| MediaPlayerAutoClosedByCompletion
|}

These are used for Share-applet on [3.0.0+], and with Web on [8.0.0+]. Official user-processes doesn't check the TLV size for any of these.

==== DocumentKind ====
{| class="wikitable" border="1"
|-
! Value
! Name
! Description
|-
| 0x1
| DocumentKind_OfflineHtmlPage
| Use the HtmlDocument NCA content from the application.
|-
| 0x2
| DocumentKind_ApplicationLegalInformation
| Use the LegalInformation NCA content from the application.
|-
| 0x3
| DocumentKind_SystemDataPage
| Use the Data NCA content from the specified title, see also: [[Title_list#System_Data_Archives]]
|}

This controls the kind of content to mount with Offline-applet.

==== ShareStartPage ====
{| class="wikitable" border="1"
|-
! Value
! Name
! URL
|-
| 0
| ShareStartPage_Default
| [[Network|"https://web-%.share.srv.nintendo.net/"]]
|-
| 1
| ShareStartPage_Settings
| [[Network|"https://web-%.share.srv.nintendo.net/settings/"]]
|}

This enum controls the initial page for ShareApplet.

==== BootDisplayKind ====
{| class="wikitable" border="1"
|-
! Value
! Name
! Description
|-
| 0
| BootDisplayKind_White
| Default white background.
|-
| 1
|
| Unknown. Used by Offline default Arg initialization for DocumentKind_ApplicationLegalInformation/DocumentKind_SystemDataPage.
|-
| 2
| BootDisplayKind_Black
| Black background.
|-
| 3
|
| Unknown. Used by Share default Arg initialization.
|-
| 4
|
| Unknown. Used by Lobby default default Arg initialization.
|}

Kind values for BootDisplayKind. Controls the background color while displaying the loading screen during applet boot. Also controls the BackgroundKind when value is non-zero.

The applet converts this to internal values.
* BootDisplayKind 0:
** If launched by an Application:
*** If [[#BackgroundKind]] is 2..1, return 3..2. When 0, run the below, otherwise assert.
** return TLV value from BootAsMediaPlayer
* BootDisplayKind 1..4: return 0..3.

==== BackgroundKind ====
{| class="wikitable" border="1"
|-
! Value
! Name
! Description
|-
| 0
|
| Unknown. Used by Offline default Arg initialization for DocumentKind_ApplicationLegalInformation/DocumentKind_SystemDataPage.
|-
| 1
|
| Same as [[#BootDisplayKind]] value 3.
|-
| 2
|
| Same as [[#BootDisplayKind]] value 4. Used by Lobby default Arg initialization.
|}

Kind values for BackgroundKind. Only used when [[#BootDisplayKind]] is 0.

==== LeftStickMode ====
{| class="wikitable" border="1"
|-
! Value
! Name
! Description
|-
| 0
| LeftStickMode_Pointer
| The user can directly control the pointer via the left-stick.
|-
| 1
| LeftStickMode_Cursor
| The user can only select elements on the page via the left-stick.
|}

Controls the initial mode, this can be toggled by the user via the pressing the left-stick button. If the Pointer flag is set to false, only LeftStickMode_Cursor will be used and mode toggle by the user is disabled (input value ignored).

==== FooterButtonId ====
{| class="wikitable" border="1"
|-
! Value
! Name
! Description
|-
| 0
| None
| None, for empty [[#WebBootFooterButtonEntry]]. Invalid for use as an input Id.
|-
| 1
|
|
|-
| 2
|
|
|-
| 3
|
|
|-
| 4
|
|
|-
| 5
|
|
|-
| 6
|
|
|-
| 7
|
| Values starting with this are invalid.
|-
|}

==== WebSessionBootMode ====
This is "nn::web::WebSessionBootMode".

{| class="wikitable" border="1"
|-
! Value
! Name
! Description
|-
| 0
|
| Normal/default (AllForeground)
|-
| 1
|
| AllForegroundInitiallyHidden
|}

This controls which [[Applet_Manager_services|LibraryAppletMode]] the applet will be launched with, by the user-process. The TLV for this seems to be ignored by the applet.

==== LastUrl ====
When the applet loads a page where the beginning of the URL matches the URL from CallbackUrl, the applet will exit and set LastUrl to that URL (exit doesn't occur when CallbackableUrl is set). With Offline-applet for CallbackUrl handling, it compares the domain with "localhost" instead of using the CallbackUrl TLV.

== Versions ==

=== [[1.0.0]] ===
"shareddata:/buildinfo/buildinfo.dat" content:
r:11682
p:NX64
v:Pilot
d:2016-11-25 23:30
n:0.4.25

=== [[2.0.0]] ===

"shareddata:/buildinfo/buildinfo.dat" content:
r:13341
p:NX64
v:Release
d:2017-02-13 22:57
n:0.5.9

=== [[2.1.0]] ===
See [[Switch_Userland_Flaws|here]] for vuln-related changes.

The WebKit NRO was updated. For the WebKit NRO, the page-aligned size for the R-X, R--, and RW- pages are the same as v2.0.
* The actual code in the NRO starts differing starting at offset 0xE780. In v2.0 the offset following the last code instruction is text_lastpage+0x3F8(text_end-0xC08), while for v2.1 it's text_lastpage+0xE60(text_end-0x1A0). Compared to the previous version, there's a val0 u32(padding) inserted where the code for the import stubs begin, near the end of .text. Relative to that end offset going backwards, .text differs starting at v2.0 textbase+0xD56530 / v2.1 textbase+0xD56F94.
* The R-- section was updated. Besides the large table(?) which was updated(nothing was added/removed there), the strings containing "D:/for_cruiser/release_182/nx/webkit/" were updated: "182" was changed to "189". 0x10-bytes at offset 0x57292C were removed. 0x8-bytes were inserted at offset 0x14B2B5C in the v2.1 section. 0x8-bytes were inserted at offset 0x14B5C10 in the v2.1 section. ...
* The RW- section was updated, mainly for different addrs. Nothing was added/removed. Most(?)/all(?) main-codebin func import-addrs relative to main-codebin-base are the same as v2.0.

Main-codebin region(titleID 010000000000100B):
* rtld is same as before basically, minus addrs. Likewise for the "nnSdkEmpty" binary following the main-codebin.
* Various byte values were changed in the main .text.
* In the main R-- section:
** The length of a string used with the user-agent changed, due to being changed from "{...}.9" to "{...}.10".
** The version in the following string was changed from "1.2.2" to "1.2.3": "FS_ACCESS: { sdk_versio n: 1.2.3, spec: NX }"
** The datetime strings following "b/23876444" was changed from "Feb 10 2017" "02:24:47" to "Mar 9 201 7" "21:41:27".
** A 0x10-byte block prior to SDK library tag strings was updated. The version in those strings was changed from "1_2_2" to "1_2_3".
* The main RW- section appears to be basically the same minus addrs.

All of the other NROs were updated in FS with only the following changes:
* The R-X section is identical to the previous version except for the 0x10-byte block in the NRO header.
* The R-- section only had version values in "/release_{ver}/" strings updated, see the for_cruiser path mentioned for WebKit NRO above. The only other change was that a 0x10-byte block following a "GNU" string was updated.

==== FS ====
The content of "blacklist:/" and "oceanShared:/" haven't changed. Only the content of "shareddata:/" and "data:/" changed.

===== "shareddata:/" =====
The following files were updated here(nothing added/removed):

* /buildinfo/buildinfo.dat
* /dll/cairo_wkc.nro
* /dll/libfont.nro
* /dll/oss_wkc.nro
* /dll/peer_wkc.nro
* /dll/webkit_wkc.nro

That is, every .nro under the above directory was updated.

"shareddata:/buildinfo/buildinfo.dat" content:
r:13343
p::NX64
v:Release
d:2017-03-14 21:08
n:0.5.10

===== "data:/" =====
The following files were updated here(nothing added/removed):

* /.nrr/netfront.nrr
* /buildinfo/buildinfo.dat

=== [[3.0.1]] ===
While main-codebin .text was updated, no actual code was changed.

The .nss path string in main-codebin was changed from "Q:\work\LibraryApplet\..." to "Q:\work\nup\LibraryApplet\...".

See [[3.0.1|here]] regarding "shareddata:/" buildinfo.

=== [[5.0.0]] ===
Support for YouTubeVideo was added, and new [[#TLVs]] etc.

In RomFS "/whitelist/WhitelistYouTubePlayer.txt" was added for the YouTubeVideo whitelist, which contains the following: <nowiki>"^https://www\.youtube\.com/embed/"</nowiki>. This file has the same content on 7.0.x.

[[Category:Library Applets]]

Switch System Flaws

2026-07-25T19:39:01Z

Yellows8: /* Whitelist */

Switch 2: Title list/Games

2026-07-24T22:41:35Z

Yellows8:

The Id listed by eShop-data for Upgrade Packs for Nintendo Switch 2 Edition is DLC for the base NX Application: the Id is [[NACP|AddOnContentBaseId]] + index, like other DLC.

= Applications / Games =
{| class="wikitable sortable"
! ApplicationId || Description || Region || Minimum Required OS || Distribution Method || Versions || Notes || Type
|-
| 040003901FBC2000 || Survival Kids || CHN EUR JPN KOR USA || || Digital || || [[Shared_Database_services#FunctionBlackList|ApplicationUpdateRequired]] = v0. || Game
|-
| 04000470212CE000 || Kunitsu-Gami: Path of the Goddess || CHN EUR JPN KOR USA || || Digital || || [[Shared_Database_services#FunctionBlackList|ApplicationUpdateRequired]] = v0. || Game
|-
| 040029A01D3E0000 || Nintendo GameCube™ – Nintendo Classics || EUR KOR USA || || Digital || || || Application
|-
| 0400303021AAC000 || DELTARUNE || EUR JPN USA || || Digital || || || Game
|-
| 04003DC020784000 || シャインポスト Be Your アイドル！ || JPN || || Digital || || [[Shared_Database_services#FunctionBlackList|ApplicationUpdateRequired]] = v0. || Game
|-
| 04003FB022F4E000 || RAIDOU Remastered: The Mystery of the Soulless Army || EUR USA || || Digital || || [[Shared_Database_services#FunctionBlackList|ApplicationUpdateRequired]] = v0. || Game
|-
| 0400CE7022F4A000 || RAIDOU Remastered: The Mystery of the Soulless Army || JPN || || Digital || || [[Shared_Database_services#FunctionBlackList|ApplicationUpdateRequired]] = v0. || Game
|-
| 040041601D83A000 || Drag x Drive™ || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 040041E0212AE000 || Fast Fusion || EUR JPN USA || || Digital || || || Game
|-
| 040047D020DB2000 || Puyo Puyo Tetris 2S || CHN EUR JPN KOR USA || || Digital || || [[Shared_Database_services#FunctionBlackList|ApplicationUpdateRequired]] = v0. || Game
|-
| 040052E01D3DA000 || Nintendo GameCube™ – Nintendo Classics || CHN JPN || || Digital || || || Application
|-
| 040057C02159A000 || Nintendo Switch 2 Welcome Tour || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 04005C902322C000 || No Sleep For Kaname Date - From AI: THE SOMNIUM FILES || EUR USA || || Digital || || [[Shared_Database_services#FunctionBlackList|ApplicationUpdateRequired]] = v0. || Game
|-
| 04008980227DC000 || DRAGON QUEST XI S: Echoes of an Elusive Age - Definitive Edition || EUR KOR USA || || Digital || || || Game
|-
| 0400DCC0223F8000 || No Sleep For Kaname Date - From AI: THE SOMNIUM FILES || JPN || || Digital || || [[Shared_Database_services#FunctionBlackList|ApplicationUpdateRequired]] = v0. || Game
|-
| 0400E32022656000 || ドラゴンクエストXI　過ぎ去りし時を求めて S || JPN || || Digital || || [[Shared_Database_services#FunctionBlackList|ApplicationUpdateRequired]] = v0. || Game
|-
| 04006CC0223D2000 || HITMAN World of Assassination – Signature Edition || CHN EUR JPN KOR USA || || Digital || || [[Shared_Database_services#FunctionBlackList|ApplicationUpdateRequired]] = v0. || Game
|-
| 040074A01BF12000 || Donkey Kong Bananza || CHN EUR JPN KOR USA || 19.1.0 (update-partition) || Digital || || || Game
|-
| 040077201BE50000 || Kirby™ Air Riders || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 040078001CCF6000 || Street Fighter 6 || CHN EUR JPN KOR USA || || Digital || || [[Shared_Database_services#FunctionBlackList|ApplicationUpdateRequired]] = v0. || Game
|-
| 04007EF01F8AE000 || Fire Emblem™: Fortune’s Weave || EUR JPN KOR USA || || Digital / Cartridge || || || Game
|-
| 0400813022B32000 || Fortnite || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 040082902313C000 || Arcade Archives 2 RIDGE RACER || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 04009570209F8000 || Hogwarts Legacy || CHN EUR JPN KOR USA || || Digital || || [[Shared_Database_services#FunctionBlackList|ApplicationUpdateRequired]] = v0. || Game
|-
| 0400959022CA2000 || || || || || || [[Shared_Database_services#FunctionBlackList|ApplicationUpdateRequired]] = v0. ||
|-
| 0400A4802437E000 || Drag x Drive™: Global Jam || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 0400A940233E0000 || Daemon X Machina: Titanic Scion || USA || || Digital || || || Game
|-
| 0400408021236000 || Daemon X Machina: Titanic Scion || JPN KOR || || Digital || || [[Shared_Database_services#FunctionBlackList|ApplicationUpdateRequired]] = v0. || Game
|-
| 0400BA202340A000 || Daemon X Machina: Titanic Scion || EUR || || Digital || || || Game
|-
| 0400BBB020FF0000 || Yakuza 0 Director’s Cut || CHN EUR JPN KOR USA || || Digital || || [[Shared_Database_services#FunctionBlackList|ApplicationUpdateRequired]] = v0. || Game
|-
| 0400BE601F38A000 || EA SPORTS Madden NFL 26 || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 0400C3F00006E000 || Mario Kart World || CHN EUR JPN KOR USA || 19.1.0 (update-partition) || Digital / Cartridge || || || Game
|-
| 0400CA40208C8000 || Split Fiction || CHN EUR JPN KOR USA || || Digital || || [[Shared_Database_services#FunctionBlackList|ApplicationUpdateRequired]] = v0. || Game
|-
| 0400CBA0221EA000 || BRAVELY DEFAULT FLYING FAIRY HD Remaster || EUR USA || || Digital || || [[Shared_Database_services#FunctionBlackList|ApplicationUpdateRequired]] = v0. || Game
|-
| 0400DC401FCE6000 || BRAVELY DEFAULT FLYING FAIRY HD Remaster || JPN KOR || || Digital || || [[Shared_Database_services#FunctionBlackList|ApplicationUpdateRequired]] = v0. || Game
|-
| 0400D9E02053C000 || NOBUNAGA'S AMBITION: Awakening Complete Edition || EUR USA || || Digital || || || Game
|-
| 04009DE020850000 || NOBUNAGA'S AMBITION: Awakening Complete Edition || JPN || || Digital || || [[Shared_Database_services#FunctionBlackList|ApplicationUpdateRequired]] = v0. || Game
|-
| 0400DDB020648000 || Cyberpunk 2077: Ultimate Edition || CHN EUR KOR USA || || Digital || || || Game
|-
| 04000FC022CC8000 || Cyberpunk 2077: Ultimate Edition || JPN || || Digital || || || Game
|-
| 0400E140216D4000 || SONIC X SHADOW GENERATIONS || CHN EUR JPN KOR USA || || Digital / Game Key Card || || [[Shared_Database_services#FunctionBlackList|ApplicationUpdateRequired]] = v0. || Game
|-
| 0400E23021102000 || WILD HEARTS S || CHN EUR JPN KOR USA || || Digital || || [[Shared_Database_services#FunctionBlackList|ApplicationUpdateRequired]] = v0. || Game
|-
| 0400E88025B1A000 || Star Fox™ || EUR JPN KOR USA || 21.2.0 (update-partition) || Digital / Cartridge || || || Game
|-
| 0400EBD0236AE000 || Tony Hawk's™ Pro Skater 3 + 4 || CHN EUR JPN USA || || Digital || || [[Shared_Database_services#FunctionBlackList|ApplicationUpdateRequired]] = v0. || Game
|-
| 0400F4E022F4C000 || || || || || || [[Shared_Database_services#FunctionBlackList|ApplicationUpdateRequired]] = v0. ||
|-
| 0400F6D020A02000 || Suikoden I&II HD Remaster for Nintendo Switch 2: Gate Rune and Dunan Unification Wars || CHN EUR JPN KOR USA || || Digital || || [[Shared_Database_services#FunctionBlackList|ApplicationUpdateRequired]] = v0. || Game
|-
|-
| 04001BD027712000 || Vampire Crawlers: The Turbo Wildcard from Vampire Survivors || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 0400A95026AB2000 || Alien: Rogue Incursion Evolved Edition || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 0400E5502720C000 || Truxton Extreme || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 0400F9E025342000 || Bubsy 4D || CHN EUR JPN USA || || Digital || || || Game
|-
| 040091C0232EE000 || Persona 3 Reload || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 0400380020056000 || Splatoon Raiders || CHN EUR JPN KOR USA || 22.1.0 (update-partition) || Digital || || || Game
|-
| 040045F02661E000 || Mixtape || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 04002FC02493E000 || Outbound || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 0400AC8025344000 || Total Chaos || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 04006020233D4000 || MARVEL Cosmic Invasion || EUR USA || || Digital || || || Game
|-
| 0400C76024710000 || PRAGMATA || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 0400912023308000 || Goat Simulator 3 || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 04007CF02469A000 || Console Archives Ishin no Arashi || EUR JPN USA || || Digital || || || Game
|-
| 0400E98025DE4000 || OPUS: Prism Peak || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 04007FD027916000 || Police Simulator: Patrol Officers || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 0400160026F40000 || Arcade Archives 2 KONAMI GT || EUR JPN USA || || Digital || || || Game
|-
| 0400E070279B6000 || Amnesia: Rebirth || CHN EUR USA || || Digital || || || Game
|-
| 0400C460219B2000 || EA SPORTS FC™ 26 || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 04000E1023AB4000 || Bandit Trap || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 0400172024E7A000 || Overwatch® || EUR JPN KOR USA || || Digital || || || Game
|-
| 0400D28024076000 || Call of the Elder Gods || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 0400B3402468C000 || Console Archives SEICROSS || EUR JPN USA || || Digital || || || Game
|-
| 04000D0027188000 || Arcade Archives 2 POLARIS || EUR JPN USA || || Digital || || || Game
|-
| 0400C11023B5A000 || Indiana Jones and the Great Circle™ || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 0400BE70262DA000 || System Shock || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 04004890268C0000 || THE NEW DENPA MEN || JPN USA || || Digital || || || Game
|-
| 04002550248C4000 || Content Warning || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 04000A3024F22000 || Darwin's Paradox! || EUR JPN USA || || Digital || || || Game
|-
| 0400E570261A2000 || South of Midnight Weaver's Edition || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 0400A86024AF6000 || MotoGP™26 || EUR JPN USA || || Digital || || || Game
|-
| 0400304025212000 || WWE 2K26 Standard Edition || EUR USA || || Digital || || || Game
|-
| 0400CF702589C000 || Warframe || JPN USA || || Digital || || || Game
|-
| 0400817025C2C000 || The Midnight Walk || EUR JPN KOR USA || || Digital || || || Game
|-
| 040048C027456000 || Dread Delusion || EUR USA || || Digital || || || Game
|-
| 0400FF902081C000 || Apex Legends™ || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 040080D0277C6000 || Haste || CHN EUR JPN USA || || Digital || || || Game
|-
| 0400D09026580000 || AFL 26 || EUR USA || || Digital || || || Game
|-
| 0400245021D2C000 || Yoshi and the Mysterious Book || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 0400322024480000 || Virtua Fighter 5 R.E.V.O. World Stage || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 0400D9E01D3E6000 || Pokémon Winds || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 040046201D3E8000 || Pokémon Waves || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 040062C02722A000 || Super Meat Boy 3D || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 0400D8D02466E000 || Console Archives TERRA CRESTA || EUR JPN USA || || Digital || || || Game
|-
| 0400A62026C7E000 || Arcade Archives 2 FINAL LAP || EUR JPN USA || || Digital || || || Game
|-
| 040094B02455C000 || MOUSE: P.I. For Hire || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 0400A79026B36000 || Kena: Bridge of Spirits || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 040069E024F5A000 || Deadzone: Rogue || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 0400984020BE8000 || eFootball™ Kick-Off! || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 040092E026C70000 || Bluey's Quest For The Gold Pen || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 0400557024B3E000 || Under Par Golf Architect || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 04000D9025B16000 || Minecraft Dungeons II || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 0400EE2024E98000 || Denshattack! || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 0400135024684000 || Console Archives Ninja-Kid II || EUR JPN USA || || Digital || || || Game
|-
| 0400F16026F62000 || Arcade Archives 2 DEVASTATORS || EUR JPN USA || || Digital || || || Game
|-
| 040042E02684C000 || Dosa Divas || EUR USA || || Digital || || || Game
|-
| 0400EF4026274000 || Snoopy & The Great Mystery Club || EUR USA || || Digital || || || Game
|-
| 0400B20025A70000 || Tomb Raider I-III Remastered || CHN EUR JPN USA || || Digital || || || Game
|-
| 0400B1E02610C000 || People of Note || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 04006F70246E2000 || Console Archives SONIC WINGS Special || EUR JPN USA || || Digital || || || Game
|-
| 0400327026C56000 || Arcade Archives 2 PLUMP POP || EUR JPN USA || || Digital || || || Game
|-
| 0400A02022D2A000 || Two Point Museum || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 0400D1E0237CC000 || Monster Hunter Stories 3: Twisted Reflection || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 0400A3A0269E6000 || Citadelum || CHN EUR JPN USA || || Digital || || || Game
|-
| 0400F12025CCC000 || Shadow Tactics: Blades of the Shogun - Aiko's Choice || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 0400A2B02653E000 || Starship Troopers: Ultimate Bug War! || EUR USA || || Digital || || || Game
|-
| 04005CB027440000 || Royal Revolt Survivors || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 0400054025D02000 || Rushing Beat X: Return of Brawl Brothers || EUR USA || || Digital || || || Game
|-
| 04000EE026672000 || Arcade Archives 2 Rave Racer || EUR JPN USA || || Digital || || || Game
|-
| 0400C470236D6000 || FULL METAL SCHOOLGIRL || JPN USA || || Digital || || || Game
|-
| 04005550254B8000 || FATAL FRAME II: Crimson Butterfly REMAKE　 || EUR JPN KOR USA || || Digital || || || Game
|-
| 0400125024470000 || Console Archives NOBUNAGA'S AMBITION || EUR JPN USA || || Digital || || || Game
|-
| 040055202608A000 || Back to the Dawn || CHN JPN KOR USA || || Digital || || || Game
|-
| 0400A3A01EE4C000 || Pokémon Pokopia || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 04006D1023DB6000 || Rotwood || CHN EUR JPN USA || || Digital || || || Game
|-
| 0400C18025BBA000 || Blue Prince || EUR USA || || Digital || || || Game
|-
| 04005290268BE000 || SUSHI BAR MOEBIUS for Nintendo Switch™ 2 || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 04003A4026868000 || City Hunter || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 040029202747A000 || Balatro || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 0400207026A48000 || Arcade Archives 2 ADVENTURE CANOE || EUR JPN USA || || Digital || || || Game
|-
| 04005870238DA000 || The Duskbloods || EUR USA || || Digital || || || Game
|-
| 04005E2024678000 || Console Archives Dezaemon || EUR JPN USA || || Digital || || || Game
|-
| 040078D025266000 || Exit Lab ~15 Rooms~ || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 0400410024C4E000 || High On Life 2 || CHN EUR USA || || Digital || || || Game
|-
| 040051B0269D8000 || Arcade Archives 2 MEGA ZONE || EUR JPN USA || || Digital || || || Game
|-
| 040073D025D98000 || Scott Pilgrim EX || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 04008BE0262BC000 || FINAL FANTASY VII REBIRTH || EUR JPN USA || || Digital || || || Game
|-
| 0400D4201C6EA000 || Mario Tennis Fever || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 0400617024E42000 || DYNASTY WARRIORS: ORIGINS || EUR JPN KOR USA || || Digital || || || Game
|-
| 040076E025B46000 || Star Trek: Voyager - Across the Unknown || CHN EUR JPN USA || || Digital || || || Game
|-
| 040037C025346000 || PGA TOUR 2K25 || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 0400B6302227E000 || The Adventures of Elliot: The Millennium Tales || EUR JPN USA || || Digital || || || Game
|-
| 0400472025966000 || Arcade Archives 2 TOP SPEED || EUR JPN USA || || Digital || || || Game
|-
| 040032B023CA4000 || Orbitals || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 040093D0233B0000 || FINAL FANTASY VII REMAKE INTERGRADE || EUR JPN USA || || Digital || || || Game
|-
| 0400F1C021178000 || Granblue Fantasy: Relink - Endless Ragnarok || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 0400B7A02454A000 || Fallout 4: Anniversary Edition || CHN EUR JPN USA || || Digital || || || Game
|-
| 04006C5025F8A000 || Digimon Story Time Stranger || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 0400528024B30000 || Console Archives NINJA GAIDEN II: THE DARK SWORD OF CHAOS || EUR JPN USA || || Digital || || || Game
|-
| 0400360024B26000 || Console Archives Cool Boarders || EUR JPN USA || || Digital || || || Game
|-
| 04003170238F0000 || Valheim || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 0400A15024D62000 || Turok: Origins || CHN EUR JPN USA || || Digital || || || Game
|-
| 040096D024506000 || TOKYO SCRAMBLE || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 0400114025CCA000 || Shadow Tactics: Blades of the Shogun || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 0400A58024718000 || Resident Evil Requiem || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 040021E02594A000 || The Disney Afternoon Collection || EUR JPN USA || || Digital || || || Game
|-
| 04004F70262B2000 || Draw King || JPN USA || || Digital || || || Game
|-
| 0400E380261E2000 || Arcade Archives 2 QUESTER || EUR JPN USA || || Digital || || || Game
|-
| 04000B0024B12000 || UNDERWARD: LASTBOSS, Genius Gyaru Doctor || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 040036E024882000 || Yakuza Kiwami 3 & Dark Ties || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 04002D602483C000 || "Run for Money": Hunter VS Runner! Which Side Will You Win With!? || JPN USA || || Digital || || || Game
|-
| 04004A00263D6000 || Arcade Archives 2 LABYRINTH RUNNER || EUR JPN USA || || Digital || || || Game
|-
| 04000E9024DDA000 || Ys X: Proud Nordics || EUR USA || || Digital || || || Game
|-
| 0400AEE0246B0000 || POOL ROOM BILLIARD || CHN JPN USA || || Digital || || || Game
|-
| 0400994022308000 || Little Nightmares Enhanced Edition - Complete Edition || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 0400F23024BDE000 || Carmageddon: Rogue Shift || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 04008A9025E38000 || Arcade Archives 2 BOMB JACK TWIN || EUR JPN USA || || Digital || || || Game
|-
| 04000A8024AEE000 || GRID™ Legends: Deluxe Edition || CHN EUR JPN USA || || Digital || || || Game
|-
| 0400B4B021792000 || REANIMAL || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 04000DE025BF6000 || Arcade Archives 2 SPACE INVADERS PART II || EUR JPN USA || || Digital || || || Game
|-
| 0400FF8023CF0000 || They are Billions || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 0400CB3024EF8000 || Suika Game Planet || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 0400D1C026514000 || Tombi! Special Edition || EUR JPN USA || || Digital || || || Game
|-
| 04005CC022C9E000 || DRAGON QUEST VII Reimagined || EUR JPN USA || || Digital || || [[Shared_Database_services#FunctionBlackList|ApplicationUpdateRequired]] = v0. || Game
|-
| 04004A1024BD6000 || MIO: Memories in Orbit || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 0400473025B00000 || Arcade Archives 2 SPACE INVADERS || EUR JPN USA || || Digital || || || Game
|-
| 040045B025E5A000 || Layers of Fear: The Final Masterpiece Edition || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 04001040243D4000 || The Legend of Heroes: Trails beyond the Horizon || EUR USA || || Digital || || || Game
|-
| 0400152025A96000 || Arcade Archives 2 THE OUTFOXIES || EUR JPN USA || || Digital || || || Game
|-
| 0400018025B92000 || Arcade Archives 2 ROC'N ROPE || EUR JPN USA || || Digital || || || Game
|-
| 040003C023FC4000 || LEGO® Batman™: Legacy of the Dark Knight || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 0400256024344000 || Gear.Club Unlimited 3 || CHN EUR KOR USA || || Digital || || || Game
|-
| 040026802427E000 || The Rogue Prince of Persia™ || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 0400255025990000 || Ultimate Sheep Raccoon || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 04008C6024BB4000 || The Elder Scrolls V: Skyrim Anniversary Edition || CHN EUR JPN USA || || Digital || || || Game
|-
| 04007E00249C2000 || Skate Story || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 04009B9023ABC000 || Yooka-Replaylee || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 0400FED0215A4000 || Star Wars Outlaws Gold Edition || CHN EUR JPN KOR USA || || Digital || || [[Shared_Database_services#FunctionBlackList|ApplicationUpdateRequired]] = v0. || Game
|-
| 04007A7024024000 || Warhammer 40,000: Rogue Trader || CHN EUR JPN USA || || Digital || || || Game
|-
| 0400C45026074000 || Tombi! 2: The Evil Swine Return Special Edition || EUR JPN USA || || Digital || || || Game
|-
| 0400AE40256CE000 || RippleIsland Kyle and Cal’s Restaurant || EUR JPN USA || || Digital || || || Game
|-
| 04002310235C2000 || Handy Hockey || JPN USA || || Digital || || || Game
|-
| 0400D30025242000 || Arcade Archives 2 BOMB BEE || EUR JPN USA || || Digital || || || Game
|-
| 04004800254A6000 || PUNYAN for Nintendo Switch 2 || CHN JPN KOR USA || || Digital || || || Game
|-
| 040065A023ABA000 || ChromaGun 2: Dye Hard || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 0400668024E94000 || Squirrel with a Gun || EUR USA || || Digital || || || Game
|-
| 04008150213A2000 || Assassin's Creed Shadows || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 0400FDB022B7C000 || Tomb Raider: Definitive Edition || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 04008430258C6000 || Arcade Archives 2 GALACTIC WARRIORS || EUR JPN USA || || Digital || || || Game
|-
| 0400890023806000 || OCTOPATH TRAVELER 0 || JPN USA || || Digital || || || Game
|-
| 0400DA10226BE000 || NBA 2K26 || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 0400412024EB4000 || Nicktoons & The Dice of Destiny || EUR USA || || Digital || || || Game
|-
| 0400255024C1C000 || Arcade Archives 2 TOKYO WARS || EUR JPN USA || || Digital || || || Game
|-
| 04003F40232DE000 || Hyrule Warriors: Age of Imprisonment || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 0400DB8025084000 || Arcade Archives 2 SCION || EUR JPN USA || || Digital || || || Game
|-
| 04000220234BA000 || DRAGON QUEST I & II HD-2D Remake || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 0400B78024F7E000 || Resident Evil Village Gold Edition || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 0400101024F7A000 || Resident Evil 7 biohazard Gold Edition || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 0400C800247DE000 || SpongeBob SquarePants: Titans of the Tide || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 0400F7D0239A6000 || PowerWash Simulator 2 || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 04001B102590C000 || Arcade Archives 2 MIDNIGHT LANDING || EUR JPN USA || || Digital || || || Game
|-
| 0400B21022266000 || WWE 2K25 Standard Edition || EUR USA || || Digital || || || Game
|-
| 0400F7F02353E000 || Goodnight Universe || CHN EUR JPN USA || || Digital || || || Game
|-
| 040013C024128000 || Atelier Ryza: Ever Darkness & the Secret Hideout DX || JPN USA || || Digital || || || Game
|-
| 04008E302412C000 || Atelier Ryza 3: Alchemist of the End & the Secret Key DX || JPN USA || || Digital || || || Game
|-
| 040097D02412A000 || Atelier Ryza 2: Lost Legends & the Secret Fairy DX || EUR JPN USA || || Digital || || || Game
|-
| 04004CD022304000 || Little Nightmares III || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 0400E54024C2E000 || Arcade Archives 2 BATTLANTIS || EUR JPN USA || || Digital || || || Game
|-
| 04003940236DC000 || PAC-MAN WORLD 2 Re-PAC || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 0400B5E02408A000 || Farming Simulator: Signature Edition || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 040036B0237FA000 || Majogami || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 040016E025052000 || Arcade Archives 2 GEE BEE || EUR JPN USA || || Digital || || || Game
|-
| 0400E7D0239DC000 || Mortal Kombat: Legacy Kollection || EUR USA || || Digital || || || Game
|-
| 0400224023CF8000 || Relayer Advanced Definitive Edition || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 04007D1024268000 || Yakuza Kiwami 2 || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 0400F65024266000 || Yakuza Kiwami || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 0400483024390000 || Arcade Archives 2 STEEL WORKER || EUR JPN USA || || Digital || || || Game
|-
| 0400C420250EC000 || The Touryst Deluxe || EUR JPN USA || || Digital || || || Game
|-
| 0400BDE024DF4000 || ShapeHero Factory || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 0400DAE0251C8000 || LEGO® Voyagers || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 040004B024908000 || Arcade Archives 2 VIDEO HUSTLER || EUR JPN USA || || Digital || || || Game
|-
| 0400EDD023C64000 || Arcade Archives 2 MACH BREAKERS || EUR JPN USA || || Digital || || || Game
|-
| 040023502410A000 || Cronos: The New Dawn || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 0400A69024378000 || Arcade Archives 2 SCRAMBLED EGG || EUR JPN USA || || Digital || || || Game
|-
| 0400F97023C72000 || Disgaea 7 Complete || EUR USA || || Digital || || || Game
|-
| 0400F98023D16000 || Arcade Archives 2 AQUA JET || EUR JPN USA || || Digital || || || Game
|-
| 040046A0248C0000 || BOKURA: planet || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 0400F9A021142000 || DRAGON BALL: Sparking! ZERO || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 040071401FF84000 || Chillin' by the Fire || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 04005860239F4000 || Plants vs. Zombies™: Replanted || CHN EUR JPN USA || || Digital || || || Game
|-
| 0400E440238BC000 || Dear me, I was ... || CHN EUR JPN KOR USA || || Digital || || || Game
|-
| 04000510239A8000 || Arcade Archives2 AIR COMBAT 22 || EUR JPN USA || || Digital || || || Game
|}

NS services

2026-07-24T17:42:52Z

Yellows8: /* GetGameCardUpdateDetectionEvent */

= aoc:u =
This is "nn::aocsrv::detail::IAddOnContentManager".

This is only available when [[Process_Manager_services|pm:bm]] GetBootMode returns output 0 (Normal).

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [1.0.0-6.2.0] CountAddOnContentByApplicationId
|-
| 1 || [1.0.0-6.2.0] ListAddOnContentByApplicationId
|-
| 2 || CountAddOnContent
|-
| 3 || ListAddOnContent
|-
| 4 || [1.0.0-6.2.0] GetAddOnContentBaseIdByApplicationId
|-
| 5 || GetAddOnContentBaseId
|-
| 6 || [1.0.0-6.2.0] PrepareAddOnContentByApplicationId
|-
| 7 || PrepareAddOnContent
|-
| 8 || [4.0.0+] GetAddOnContentListChangedEvent
|-
| 9 || [10.0.0+] GetAddOnContentLostErrorCode
|-
| 10 || [11.0.0+] GetAddOnContentListChangedEventWithProcessId
|-
| 11 || [13.0.0+] NotifyMountAddOnContent
|-
| 12 || [13.0.0+] NotifyUnmountAddOnContent
|-
| 13 || [13.0.0+] IsAddOnContentMountedForDebug
|-
| 50 || [13.0.0+] CheckAddOnContentMountStatus
|-
| 100 || [7.0.0+] [[#IPurchaseEventManager|CreateEcPurchasedEventManager]]
|-
| 101 || [9.0.0+] [[#IPurchaseEventManager|CreatePermanentEcPurchasedEventManager]]
|-
| 110 || [12.0.0+] [[#IContentsServiceManager|CreateContentsServiceManager]]
|-
| 200 || [13.1.0+] SetRequiredAddOnContentsOnContentsAvailabilityTransition
|-
| 300 || [16.0.0+] SetupHostAddOnContent
|-
| 301 || [16.0.0+] GetRegisteredAddOnContentPath
|-
| 302 || [16.0.0+] UpdateCachedList
|}

== IPurchaseEventManager ==
This is "nn::ec::IPurchaseEventManager".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || SetDefaultDeliveryTarget
|-
| 1 || SetDeliveryTarget
|-
| 2 || GetPurchasedEventReadableHandle
|-
| 3 || PopPurchasedProductInfo
|-
| 4 || [9.0.0+] PopPurchasedProductInfoWithUid
|}

== IContentsServiceManager ==
This is "nn::ec::IContentsServiceManager".

This was added with [12.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [16.0.0+] RequestContentsAuthorizationTokenDeprecated ([12.0.0-15.0.1] [[#RequestContentsAuthorizationToken]])
|-
| 1 || [16.0.0+] RequestContentsAuthorizationToken
|}

=== RequestContentsAuthorizationToken ===
Takes a total of 0x50-bytes of input, a PID, a type-0x5 input buffer. Returns an [[#IAsyncData|IAsyncData]] and an output handle.

== IAsyncData ==
This is "nn::ec::detail::IAsyncData".

This was added with [12.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetSize
|-
| 1 || Get
|-
| 2 || Cancel
|}

= ns:am =
This is "nn::ns::detail::IApplicationManagerInterface".

[3.0.0+] This service was replaced by [[#ns:am2, ns:ec, ns:rid, ns:rt, ns:web, ns:ro, ns:sweb|ns:am2]].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#ListApplicationRecord]]
|-
| 1 || GenerateApplicationRecordCount
|-
| 2 || GetApplicationRecordUpdateSystemEvent
|-
| 3 || GetApplicationView
|-
| 4 || DeleteApplicationEntity
|-
| 5 || DeleteApplicationCompletely
|-
| 6 || IsAnyApplicationEntityRedundant
|-
| 7 || DeleteRedundantApplicationEntity
|-
| 8 || IsApplicationEntityMovable
|-
| 9 || MoveApplicationEntity
|-
| 11 || [[#CalculateApplicationOccupiedSize]]
|-
| 16 || PushApplicationRecord
|-
| 17 || ListApplicationRecordContentMeta
|-
| 18 || CheckLaunchRights
|-
| 19 || [[#LaunchApplication]]
|-
| 21 || [[#GetApplicationContentPath]]
|-
| 22 || TerminateApplication
|-
| 23 || [2.0.0+] ResolveApplicationContentPath
|-
| 26 || BeginInstallApplication
|-
| 27 || DeleteApplicationRecord
|-
| 30 || RequestApplicationUpdateInfo
|-
| 31 || RequestUpdateApplication
|-
| 32 || CancelApplicationDownload
|-
| 33 || ResumeApplicationDownload
|-
| 34 || ClearTaskStatusList
|-
| 35 || UpdateVersionList
|-
| 36 || PushLaunchVersion
|-
| 37 || ListRequiredVersion
|-
| 38 || CheckApplicationLaunchVersion
|-
| 39 || CheckApplicationLaunchRights
|-
| 40 || GetApplicationLogoData
|-
| 41 || CalculateApplicationDownloadRequiredSize
|-
| 42 || CleanupSdCard
|-
| 43 || [[#CheckSdCardMountStatus]]
|-
| 44 || GetSdCardMountStatusChangedEvent
|-
| 45 || GetGameCardAttachmentEvent
|-
| 46 || GetGameCardAttachmentInfo
|-
| 47 || [[#GetTotalSpaceSize]]
|-
| 48 || [[#GetFreeSpaceSize]]
|-
| 49 || GetSdCardRemovedEvent
|-
| 52 || GetGameCardUpdateDetectionEvent
|-
| 53 || DisableApplicationAutoDelete
|-
| 54 || EnableApplicationAutoDelete
|-
| 55 || [[#GetApplicationDesiredLanguage]]
|-
| 56 || SetApplicationTerminateResult
|-
| 57 || ClearApplicationTerminateResult
|-
| 58 || GetLastSdCardMountUnexpectedResult
|-
| 59 || ConvertApplicationLanguageToLanguageCode
|-
| 60 || [[#ConvertLanguageCodeToApplicationLanguage]]
|-
| 61 || GetBackgroundDownloadStressTaskInfo
|-
| 62 || GetGameCardStopper
|-
| 63 || IsSystemProgramInstalled
|-
| 64 || [2.0.0+] StartApplyDeltaTask
|-
| 65 || [2.0.0+] GetRequestServerStopper
|-
| 100 || ResetToFactorySettings
|-
| 101 || ResetToFactorySettingsWithoutUserSaveData
|-
| 102 || [2.0.0+] ResetToFactorySettingsForRefurbishment
|-
| 200 || CalculateUserSaveDataStatistics
|-
| 201 || DeleteUserSaveDataAll
|-
| 210 || DeleteUserSystemSaveData
|-
| 220 || UnregisterNetworkServiceAccount
|-
| 300 || GetApplicationShellEvent
|-
| 301 || PopApplicationShellEventInfo
|-
| 302 || LaunchLibraryApplet
|-
| 303 || TerminateLibraryApplet
|-
| 304 || LaunchSystemApplet
|-
| 305 || TerminateSystemApplet
|-
| 306 || LaunchOverlayApplet
|-
| 307 || TerminateOverlayApplet
|-
| 400 || [[#GetApplicationControlData]]
|-
| 401 || InvalidateAllApplicationControlCache
|-
| 402 || RequestDownloadApplicationControlData
|-
| 403 || GetMaxApplicationControlCacheCount
|-
| 404 || [2.0.0+] InvalidateApplicationControlCache
|-
| 405 || [2.0.0+] ListApplicationControlCacheEntryInfo
|-
| 502 || [2.0.0+] RequestCheckGameCardRegistration
|-
| 503 || [2.0.0+] RequestGameCardRegistrationGoldPoint
|-
| 504 || [2.0.0+] RequestRegisterGameCard
|-
| 600 || [2.0.0+] [[#CountApplicationContentMeta]]
|-
| 601 || [2.0.0+] [[#ListApplicationContentMetaStatus]]
|-
| 602 || [2.0.0+] ListOwnedAndInstalledAddOnContent
|-
| 603 || [2.0.0+] GetOwnedApplicationContentMetaStatus
|-
| 604 || [2.0.0+] RegisterContentsExternalKey
|-
| 605 || [2.0.0+] ListApplicationContentMetaStatusWithRightsCheck
|-
| 700 || [2.0.0+] PushDownloadTaskList
|-
| 701 || [2.0.0+] [[#ClearTaskStatusList]]
|-
| 702 || [2.0.0+] [[#RequestDownloadTaskList]]
|-
| 703 || [2.0.0+] [[#RequestEnsureDownloadTask]]
|-
| 704 || [2.0.0+] [[#ListDownloadTaskStatus]]
|-
| 705 || [2.0.0+] RequestDownloadTaskListData
|-
| 800 || [2.0.0+] RequestVersionList
|-
| 801 || [2.0.0+] ListVersionList
|-
| 900 || [2.0.0+] GetApplicationRecord
|-
| 901 || [2.0.0+] GetApplicationRecordProperty
|-
| 902 || [2.0.0+] EnableApplicationAutoUpdate
|-
| 903 || [2.0.0+] DisableApplicationAutoUpdate
|-
| 904 || [2.0.0+] TouchApplication
|-
| 905 || [2.0.0+] RequestApplicationUpdate
|-
| 906 || [2.0.0+] IsApplicationUpdateRequested
|-
| 907 || [2.0.0+] WithdrawApplicationUpdateRequest
|-
| 908 || [2.0.0+] ListApplicationRecordInstalledContentMeta
|-
| 1000 || [2.0.0+] RequestVerifyApplication
|-
| 1001 || [2.0.0+] CorruptApplicationForDebug
|-
| 1200 || [2.0.0+] [[#NeedsUpdateVulnerability]]
|-
| 1300 || [2.0.0+] IsAnyApplicationEntityInstalled
|-
| 1301 || [2.0.0+] DeleteApplicationContentEntities
|-
| 1302 || [2.0.0+] CleanupUnrecordedApplicationEntity
|-
| 1400 || [2.0.0+] PrepareShutdown
|-
| 1500 || [2.0.0+] FormatSdCard
|-
| 1501 || [2.0.0+] NeedsSystemUpdateToFormatSdCard
|-
| 1502 || [2.0.0+] GetLastSdCardFormatUnexpectedResult
|-
| 1503 || [2.0.0+] DetachSdCard
|-
| 1600 || [2.0.0+] GetSystemSeedForPseudoDeviceId
|-
| 1700 || [2.0.0+] ListApplicationDownloadingContentMeta
|-
| 1800 || [2.0.0+] IsNotificationSetupCompleted
|-
| 1801 || [2.0.0+] GetLastNotificationInfoCount
|-
| 1802 || [2.0.0+] ListLastNotificationInfo
|}

== ListApplicationRecord ==
Takes a type-0x6 output buffer containing an array of [[#ApplicationRecord]] and an s32 entry_offset, returns an output s32 out_entrycount.

Returns an array of entries with the below format using the specified offset and count.

== LaunchApplication ==
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output u64 PID.

Launches an application title which is registered with NS.

== GetApplicationContentPath ==
Takes a 0x16-type output buffer, an u8 [[NCM_services#ContentType|ContentType]], and an [[NCM_services#ApplicationId|ApplicationId]].

The input [[NCM_services#ApplicationId|ApplicationId]] is used with the application-title table like various other cmds, anything not in that table can't be used with this.

Returns a string path for the specified type of patch content with this [[NCM_services#ApplicationId|ApplicationId]], otherwise returns regular-application paths when update-title not installed. Returns an error when the specified type of content doesn't exist for this title. Starts with "@{SdCardContent,UserContent}://" and ends in ".nca".

For gamecard content, the output path is: "@GcSXXXXXXXX:/<NcaId>.nca". NCA-type0 with gamecard returns 0 with an empty output string.

The output string is then used by the user-process with [[Filesystem_services|FS]] to mount the content.

== GetTotalSpaceSize ==
Takes an input u8 [[NCM_services#StorageId|StorageId]], no output.

The StorageId must be SdCard.

Returns the s64 from [[NCM_services#IContentStorage]] GetFreeSpaceSize.

== GetFreeSpaceSize ==
Takes an input u8 [[NCM_services#StorageId|StorageId]], no output.

The StorageId must be SdCard.

Returns the s64 from [[NCM_services#IContentStorage]] GetTotalSpaceSize.

== GetApplicationDesiredLanguage ==
Takes an input u8 language-bitmask, returns an output u8 [[control.nacp]] langentry index.

User-processes generate the language-bitmask with the following for all 16 lang-entries: <code>if(<either string in langentry[i] is non-empty>)bitmask |= 1<<i</code>

== ConvertLanguageCodeToApplicationLanguage ==
Takes an input u8 pointer for the resulting Id to be written to and a string represented as a u64 (i.e 0x53552D6E65 for 'en-US').

Returns 0 if an ID was successfully found, otherwise returns 0x25810.

== GetApplicationControlData ==
Takes an input u8 [[#ApplicationControlSource]], an [[NCM_services#ApplicationId|ApplicationId]], and a type-0x6 output buffer. Returns an output u32 for actual_size. Official user-processes use buffer size 0x24000. [[qlaunch]] only uses source value 0x1 (Storage if not in cache).

Loads cached [[control.nacp]] to buf+0 and the cached icon to buf+0x4000. Returns an error if the buffer is too small.

== ListApplicationContentMetaStatus ==
Takes a type-0x6 output buffer containing an array of [[#ApplicationContentMetaStatus]], an input s32 index and [[NCM_services#ApplicationId|ApplicationId]], returns an output s32 out_entrycount.

Returns 0x10-byte entries using the specified [[NCM_services#ApplicationId|ApplicationId]] starting at the specified index. Can only return game titles. The second entry if any is the update-title usually. When the input entryindex is >= totalentries, this will return 0 with out_entrycount=0.

= ns:am2, ns:ec, ns:rid, ns:rt, ns:web, ns:ro, ns:sweb =
These are "nn::ns::detail::IServiceGetterInterface".

These commands check a state field for a command-specific bit and returns an error if not set, this is a permissions check for service+command.

[11.0.0+] ns:ro was added.

[15.0.0+] ns:sweb was added.

{| class="wikitable" border="1"
|-
! Cmd || Name || Permission bit
|-
| 7988 || [6.0.0+] [[#IDynamicRightsInterface|GetDynamicRightsInterface]] || 10
|-
| 7989 || [5.1.0+] [[#IReadOnlyApplicationControlDataInterface|GetReadOnlyApplicationControlDataInterface]] || 9
|-
| 7991 || [5.0.0+] [[#IReadOnlyApplicationRecordInterface|GetReadOnlyApplicationRecordInterface]] || 8
|-
| 7992 || [4.0.0+] [[#IECommerceInterface|GetECommerceInterface]] || 7
|-
| 7993 || [4.0.0+] [[#IApplicationVersionInterface|GetApplicationVersionInterface]] || 6
|-
| 7994 || [[#IFactoryResetInterface|GetFactoryResetInterface]] || 5
|-
| 7995 || [[#IAccountProxyInterface|GetAccountProxyInterface]] || 4
|-
| 7996 || [[#IApplicationManagerInterface|GetApplicationManagerInterface]] || 3
|-
| 7997 || [[#IDownloadTaskInterface|GetDownloadTaskInterface]] || 1
|-
| 7998 || [[#IContentManagementInterface|GetContentManagementInterface]] || 0
|-
| 7999 || [[#IDocumentInterface|GetDocumentInterface]] || 2
|}

Permissions state field with each service:

{| class="wikitable" border="1"
|-
! Service || Permissions
|-
| ns:web || 0x304
|-
| ns:ec || 0x83
|-
| ns:sweb || 0x387
|-
| ns:rid || 0x10
|-
| ns:rt || 0x20
|-
| ns:ro || 0x301
|-
| ns:am2 || 0x7FF
|}

=== IAccountProxyInterface ===
This is "nn::ns::detail::IAccountProxyInterface".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || CreateUserAccount
|}

=== IApplicationManagerInterface ===
This is "nn::ns::detail::IApplicationManagerInterface".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#ListApplicationRecord]]
|-
| 1 || GenerateApplicationRecordCount
|-
| 2 || [[#GetApplicationRecordUpdateSystemEvent]]
|-
| 3 || [[#GetApplicationViewDeprecated]]
|-
| 4 || [[#DeleteApplicationEntity]]
|-
| 5 || [[#DeleteApplicationCompletely]]
|-
| 6 || IsAnyApplicationEntityRedundant
|-
| 7 || [[#DeleteRedundantApplicationEntity]]
|-
| 8 || [[#IsApplicationEntityMovable]]
|-
| 9 || [1.0.0-9.2.0] [[#MoveApplicationEntity]]
|-
| 11 || [[#CalculateApplicationOccupiedSize]]
|-
| 16 || PushApplicationRecord
|-
| 17 || ListApplicationRecordContentMeta
|-
| 19 || [1.0.0-5.1.0] LaunchApplicationOld
|-
| 21 || [[#GetApplicationContentPath]]
|-
| 22 || TerminateApplication
|-
| 23 || ResolveApplicationContentPath
|-
| 26 || BeginInstallApplication
|-
| 27 || DeleteApplicationRecord
|-
| 30 || [[#RequestApplicationUpdateInfo]]
|-
| 31 || [1.0.0-3.0.2] RequestUpdateApplication
|-
| 32 || [[#CancelApplicationDownload]]
|-
| 33 || [[#ResumeApplicationDownload]]
|-
| 35 || UpdateVersionList
|-
| 36 || PushLaunchVersion
|-
| 37 || ListRequiredVersion
|-
| 38 || [[#CheckApplicationLaunchVersion]]
|-
| 39 || [1.0.0-6.2.0] CheckApplicationLaunchRights
|-
| 40 || GetApplicationLogoData
|-
| 41 || CalculateApplicationDownloadRequiredSize
|-
| 42 || [[#CleanupSdCard]]
|-
| 43 || [[#CheckSdCardMountStatus]]
|-
| 44 || [[#GetSdCardMountStatusChangedEvent]]
|-
| 45 || GetGameCardAttachmentEvent
|-
| 46 || GetGameCardAttachmentInfo
|-
| 47 || [[#GetTotalSpaceSize]]
|-
| 48 || [[#GetFreeSpaceSize]]
|-
| 49 || GetSdCardRemovedEvent
|-
| 52 || [[#GetGameCardUpdateDetectionEvent]]
|-
| 53 || [[#DisableApplicationAutoDelete]]
|-
| 54 || [[#EnableApplicationAutoDelete]]
|-
| 55 || GetApplicationDesiredLanguage
|-
| 56 || [[#SetApplicationTerminateResult]]
|-
| 57 || [[#ClearApplicationTerminateResult]]
|-
| 58 || [[#GetLastSdCardMountUnexpectedResult]]
|-
| 59 || ConvertApplicationLanguageToLanguageCode
|-
| 60 || [[#ConvertLanguageCodeToApplicationLanguage]]
|-
| 61 || GetBackgroundDownloadStressTaskInfo
|-
| 62 || GetGameCardStopper
|-
| 63 || IsSystemProgramInstalled
|-
| 64 || StartApplyDeltaTask
|-
| 65 || [[#GetRequestServerStopper]]
|-
| 66 || [3.0.0+] GetBackgroundApplyDeltaStressTaskInfo
|-
| 67 || [3.0.0+] [[#CancelApplicationApplyDelta]]
|-
| 68 || [3.0.0+] [[#ResumeApplicationApplyDelta]]
|-
| 69 || [3.0.0+] [[#CalculateApplicationApplyDeltaRequiredSize]]
|-
| 70 || [3.0.0+] [[#ResumeAll]]
|-
| 71 || [3.0.0+] [[#GetStorageSize]]
|-
| 80 || [3.0.0+] RequestDownloadApplication
|-
| 81 || [3.0.0+] RequestDownloadAddOnContent
|-
| 82 || [3.0.0+] DownloadApplication
|-
| 83 || [4.0.0-6.2.0] CheckApplicationResumeRights
|-
| 84 || [4.0.0-16.1.0] GetDynamicCommitEvent
|-
| 85 || [4.0.0+] [[#RequestUpdateApplication2]]
|-
| 86 || [4.0.0+] EnableApplicationCrashReport
|-
| 87 || [4.0.0+] IsApplicationCrashReportEnabled
|-
| 90 || [15.0.0+] BoostSystemMemoryResourceLimit ([4.0.0-8.1.0] BoostSystemMemoryResourceLimit)
|-
| 91 || [5.0.0+] DeprecatedLaunchApplication
|-
| 92 || [5.0.0+] GetRunningApplicationProgramId
|-
| 93 || [5.0.0+] GetMainApplicationProgramIndex
|-
| 94 || [6.0.0+] [[#LaunchApplication_2|LaunchApplication]]
|-
| 95 || [6.0.0+] [[#GetApplicationLaunchInfo]]
|-
| 96 || [6.0.0+] [[#AcquireApplicationLaunchInfo]]
|-
| 97 || [6.0.0+] [[#GetMainApplicationProgramIndexByApplicationLaunchInfo]]
|-
| 98 || [6.0.0+] EnableApplicationAllThreadDumpOnCrash
|-
| 99 || [8.0.0+] [[#LaunchDevMenu]]
|-
| 100 || [[#ResetToFactorySettings]]
|-
| 101 || [[#ResetToFactorySettingsWithoutUserSaveData]]
|-
| 102 || [[#ResetToFactorySettingsForRefurbishment]]
|-
| 103 || [9.1.0+] [[#ResetToFactorySettingsWithPlatformRegion]]
|-
| 104 || [9.1.0+] [[#ResetToFactorySettingsWithPlatformRegionAuthentication]]
|-
| 105 || [10.0.0+] [[#RequestResetToFactorySettingsSecurely]]
|-
| 106 || [10.0.0+] [[#RequestResetToFactorySettingsWithPlatformRegionAuthenticationSecurely]]
|-
| 200 || CalculateUserSaveDataStatistics
|-
| 201 || [[#DeleteUserSaveDataAll]]
|-
| 210 || [[#DeleteUserSystemSaveData]]
|-
| 211 || [6.0.0+] [[#DeleteSaveData]]
|-
| 220 || [[#UnregisterNetworkServiceAccount]]
|-
| 221 || [6.0.0+] [[#UnregisterNetworkServiceAccountWithUserSaveDataDeletion]]
|-
| 300 || GetApplicationShellEvent
|-
| 301 || PopApplicationShellEventInfo
|-
| 302 || [[#LaunchLibraryApplet]]
|-
| 303 || TerminateLibraryApplet
|-
| 304 || [[#LaunchSystemApplet]]
|-
| 305 || TerminateSystemApplet
|-
| 306 || [[#LaunchOverlayApplet]]
|-
| 307 || TerminateOverlayApplet
|-
| 308 || [S2]
|-
| 309 || [S2]
|-
| 400 || [[#GetApplicationControlData]]
|-
| 401 || InvalidateAllApplicationControlCache
|-
| 402 || [[#RequestDownloadApplicationControlData]]
|-
| 403 || GetMaxApplicationControlCacheCount
|-
| 404 || InvalidateApplicationControlCache
|-
| 405 || ListApplicationControlCacheEntryInfo
|-
| 406 || [6.0.0-18.1.0] [[#GetApplicationControlProperty]]
|-
| 407 || [8.0.0+] [[#ListApplicationTitle]]
|-
| 408 || [8.0.0+] [[#ListApplicationIcon]]
|-
| 409 || [S2]
|-
| 410 || [S2]
|-
| 411 || [19.0.0+]
|-
| 412 || [19.0.0+]
|-
| 413 || [19.0.0+]
|-
| 414 || [19.0.0+]
|-
| 415 || [19.0.0+]
|-
| 416 || [19.0.0+]
|-
| 417 || [19.0.0+] InvalidateAllApplicationControlCacheOfTheStage
|-
| 418 || [19.0.0+] InvalidateApplicationControlCacheOfTheStage
|-
| 419 || [19.0.0+] RequestDownloadApplicationControlDataInBackground
|-
| 420 || [19.0.0+] CloneApplicationControlDataCacheForDebug
|-
| 421 || [20.0.0+]
|-
| 422 || [20.0.0+]
|-
| 423 || [20.0.0+]
|-
| 424 || [20.0.0+]
|-
| 425 || [20.0.0+]
|-
| 426 || [20.0.0+]
|-
| 427 || [20.0.0+]
|-
| 428 || [21.0.0+]
|-
| 429 || [21.0.0+]
|-
| 430 || [21.0.0+]
|-
| 502 || [[#RequestCheckGameCardRegistration]]
|-
| 503 || [[#RequestGameCardRegistrationGoldPoint]]
|-
| 504 || [[#RequestRegisterGameCard]]
|-
| 505 || [3.0.0+] [[#GetGameCardMountFailureEvent]]
|-
| 506 || [3.0.0+] [[#IsGameCardInserted]]
|-
| 507 || [3.0.0+] [[#EnsureGameCardAccess]]
|-
| 508 || [3.0.0+] [[#GetLastGameCardMountFailureResult]]
|-
| 509 || [5.0.0+] [[#ListApplicationIdOnGameCard]]
|-
| 510 || [9.0.0+] [[#GetGameCardPlatformRegion]]
|-
| 511 || [19.0.0+] GetGameCardWakenReadyEvent
|-
| 512 || [19.0.0+] IsGameCardApplicationRunning
|-
| 513 || [20.0.0+]
|-
| 514 || [20.0.0+]
|-
| 515 || [20.0.0+]
|-
| 516 || [21.0.0+]
|-
| 517 || [21.0.0+]
|-
| 518 || [21.0.0+]
|-
| 519 || [21.0.0+]
|-
| 600 || [[#CountApplicationContentMeta]]
|-
| 601 || [[#ListApplicationContentMetaStatus]]
|-
| 602 || [2.0.0-5.1.0] ListAvailableAddOnContent
|-
| 603 || GetOwnedApplicationContentMetaStatus
|-
| 604 || [1.0.0-15.0.1] RegisterContentsExternalKey
|-
| 605 || ListApplicationContentMetaStatusWithRightsCheck
|-
| 606 || [3.0.0+] GetContentMetaStorage
|-
| 607 || [6.0.0+] [[#ListAvailableAddOnContent]]
|-
| 609 || [13.0.0+] ListAvailabilityAssuredAddOnContent
|-
| 610 || [14.0.0+] GetInstalledContentMetaStorage
|-
| 611 || [16.0.0+] PrepareAddOnContent
|-
| 700 || PushDownloadTaskList
|-
| 701 || [[#ClearTaskStatusList]]
|-
| 702 || [[#RequestDownloadTaskList]]
|-
| 703 || [[#RequestEnsureDownloadTask]]
|-
| 704 || [[#ListDownloadTaskStatus]]
|-
| 705 || [[#RequestDownloadTaskListData]]
|-
| 800 || RequestVersionList
|-
| 801 || ListVersionList
|-
| 802 || [3.0.0+] [[#RequestVersionListData]]
|-
| 900 || GetApplicationRecord
|-
| 901 || GetApplicationRecordProperty
|-
| 902 || EnableApplicationAutoUpdate
|-
| 903 || DisableApplicationAutoUpdate
|-
| 904 || [[#TouchApplication]]
|-
| 905 || RequestApplicationUpdate
|-
| 906 || [[#IsApplicationUpdateRequested]]
|-
| 907 || [[#WithdrawApplicationUpdateRequest]]
|-
| 908 || ListApplicationRecordInstalledContentMeta
|-
| 909 || [3.0.0-14.1.2] WithdrawCleanupAddOnContentsWithNoRightsRecommendation
|-
| 910 || [5.0.0+] HasApplicationRecord
|-
| 911 || [5.1.0+] SetPreInstalledApplication
|-
| 912 || [5.1.0+] ClearPreInstalledApplicationFlag
|-
| 913 || [9.0.0+] ListAllApplicationRecord
|-
| 914 || [9.0.0+] HideApplicationRecord
|-
| 915 || [9.0.0+] ShowApplicationRecord
|-
| 916 || [11.0.0+] IsApplicationAutoDeleteDisabled
|-
| 917 || [20.0.0+]
|-
| 918 || [20.0.0+]
|-
| 919 || [20.0.0+]
|-
| 920 || [20.0.0+]
|-
| 921 || [20.0.0+]
|-
| 922 || [20.0.0+]
|-
| 923 || [20.0.0+]
|-
| 924 || [S2]
|-
| 925 || [S2]
|-
| 926 || [S2]
|-
| 927 || [S2]
|-
| 928 || [20.0.0+]
|-
| 929 || [20.0.0+]
|-
| 930 || [20.0.0+]
|-
| 931 || [20.0.0+]
|-
| 933 || [20.1.0+]
|-
| 934 || [21.0.0+]
|-
| 935 || [21.0.0+]
|-
| 936 || [21.0.0+]
|-
| 1000 || [[#RequestVerifyApplicationDeprecated]]
|-
| 1001 || CorruptApplicationForDebug
|-
| 1002 || [3.0.0-9.2.0] [[#RequestVerifyAddOnContentsRights]]
|-
| 1003 || [5.0.0+] [[#RequestVerifyApplication]]
|-
| 1004 || [5.0.0+] CorruptContentForDebug
|-
| 1200 || [[#NeedsUpdateVulnerability]]
|-
| 1300 || [[#IsAnyApplicationEntityInstalled]]
|-
| 1301 || DeleteApplicationContentEntities
|-
| 1302 || CleanupUnrecordedApplicationEntity
|-
| 1303 || [3.0.0-9.2.0] CleanupAddOnContentsWithNoRights
|-
| 1304 || [3.0.0+] DeleteApplicationContentEntity
|-
| 1308 || [5.0.0+] DeleteApplicationCompletelyForDebug
|-
| 1309 || [6.0.0+] [[#CleanupUnavailableAddOnContents]]
|-
| 1310 || [10.0.0+] [[#RequestMoveApplicationEntity]]
|-
| 1311 || [10.0.0+] [[#EstimateSizeToMove]]
|-
| 1312 || [10.0.0+] HasMovableEntity
|-
| 1313 || [11.0.0+] CleanupOrphanContents
|-
| 1314 || [11.0.0+] CheckPreconditionSatisfiedToMove
|-
| 1400 || PrepareShutdown
|-
| 1500 || [[#FormatSdCard]]
|-
| 1501 || [[#NeedsSystemUpdateToFormatSdCard]]
|-
| 1502 || [[#GetLastSdCardFormatUnexpectedResult]]
|-
| 1504 || [3.0.0+] InsertSdCard
|-
| 1505 || [3.0.0+] RemoveSdCard
|-
| 1506 || [9.0.0+] GetSdCardStartupStatus
|-
| 1508 || [20.0.0+]
|-
| 1509 || [20.0.0+]
|-
| 1510 || [20.0.0+]
|-
| 1511 || [20.0.0+]
|-
| 1512 || [20.0.0+]
|-
| 1600 || GetSystemSeedForPseudoDeviceId
|-
| 1601 || [3.0.0+] ResetSystemSeedForPseudoDeviceId
|-
| 1700 || ListApplicationDownloadingContentMeta
|-
| 1701 || [3.0.0+] [[#GetApplicationView]]
|-
| 1702 || [3.0.0+] GetApplicationDownloadTaskStatus
|-
| 1703 || [4.0.0+] [[#GetApplicationViewDownloadErrorContext]]
|-
| 1704 || [8.0.0+] [[#GetApplicationViewWithPromotionInfo]]
|-
| 1705 || [11.0.0+] [[#IsPatchAutoDeletableApplication]]
|-
| 1706 || [20.0.0+]
|-
| 1800 || IsNotificationSetupCompleted
|-
| 1801 || GetLastNotificationInfoCount
|-
| 1802 || [[#ListLastNotificationInfo]]
|-
| 1803 || [3.0.0+] [[#ListNotificationTask]]
|-
| 1900 || [3.0.0-12.1.0] IsActiveAccount
|-
| 1901 || [4.0.0+] [[#RequestDownloadApplicationPrepurchasedRights]]
|-
| 1902 || [5.0.0+] GetApplicationTicketInfo
|-
| 1903 || [13.1.0+] RequestDownloadApplicationPrepurchasedRightsForAccount
|-
| 2000 || [4.0.0+] [[#GetSystemDeliveryInfo]]
|-
| 2001 || [4.0.0+] [[#SelectLatestSystemDeliveryInfo]]
|-
| 2002 || [4.0.0+] [[#VerifyDeliveryProtocolVersion]]
|-
| 2003 || [4.0.0+] [[#GetApplicationDeliveryInfo]]
|-
| 2004 || [4.0.0+] [[#HasAllContentsToDeliver]]
|-
| 2005 || [4.0.0+] [[#CompareApplicationDeliveryInfo]]
|-
| 2006 || [4.0.0+] [[#CanDeliverApplication]]
|-
| 2007 || [4.0.0+] [[#ListContentMetaKeyToDeliverApplication]]
|-
| 2008 || [4.0.0+] [[#NeedsSystemUpdateToDeliverApplication]]
|-
| 2009 || [4.0.0+] [[#EstimateRequiredSize]]
|-
| 2010 || [4.0.0+] [[#RequestReceiveApplication]]
|-
| 2011 || [4.0.0+] [[#CommitReceiveApplication]]
|-
| 2012 || [4.0.0+] [[#GetReceiveApplicationProgress]]
|-
| 2013 || [4.0.0+] [[#RequestSendApplication]]
|-
| 2014 || [4.0.0+] [[#GetSendApplicationProgress]]
|-
| 2015 || [4.0.0+] [[#CompareSystemDeliveryInfo]]
|-
| 2016 || [4.0.0+] [[#ListNotCommittedContentMeta]]
|-
| 2017 || [4.0.0+] [[#RecoverDownloadTask]]
|-
| 2018 || [5.0.0+] [[#GetApplicationDeliveryInfoHash]]
|-
| 2019 || [20.0.0+]
|-
| 2050 || [6.0.0+] [[#GetApplicationRightsOnClient]]
|-
| 2051 || [9.0.0+] InvalidateRightsIdCache
|-
| 2052 || [20.0.0+]
|-
| 2053 || [20.0.0+]
|-
| 2100 || [6.0.0+] [[#GetApplicationTerminateResult]]
|-
| 2101 || [6.0.0+] GetRawApplicationTerminateResult
|-
| 2150 || [6.0.0+] CreateRightsEnvironment
|-
| 2151 || [6.0.0+] DestroyRightsEnvironment
|-
| 2152 || [6.0.0+] ActivateRightsEnvironment
|-
| 2153 || [6.0.0+] DeactivateRightsEnvironment
|-
| 2154 || [6.0.0+] ForceActivateRightsContextForExit
|-
| 2155 || [7.0.0+] UpdateRightsEnvironmentStatus
|-
| 2156 || [10.0.0-12.1.0] CreateRightsEnvironmentForMicroApplication ([9.0.0-9.2.0] CreateRightsEnvironmentForPreomia)
|-
| 2160 || [6.0.0+] AddTargetApplicationToRightsEnvironment
|-
| 2161 || [6.0.0+] SetUsersToRightsEnvironment
|-
| 2170 || [6.0.0+] GetRightsEnvironmentStatus
|-
| 2171 || [6.0.0+] GetRightsEnvironmentStatusChangedEvent
|-
| 2180 || [6.0.0+] RequestExtendExpirationInRightsEnvironment
|-
| 2181 || [6.0.0+] GetResultOfExtendExpirationInRightsEnvironment
|-
| 2182 || [6.0.0+] SetActiveRightsContextUsingStateToRightsEnvironment
|-
| 2183 || [20.1.0+]
|-
| 2190 || [6.0.0+] [[#GetRightsEnvironmentHandleForApplication]]
|-
| 2199 || [6.0.0+] GetRightsEnvironmentCountForDebug
|-
| 2200 || [6.0.0-9.2.0] GetGameCardApplicationCopyIdentifier
|-
| 2201 || [6.0.0-9.2.0] GetInstalledApplicationCopyIdentifier
|-
| 2250 || [6.0.0-6.2.0] RequestReportActiveELicence
|-
| 2300 || [6.0.0-8.1.0] ListEventLog
|-
| 2350 || [7.0.0+] PerformAutoUpdateByApplicationId
|-
| 2351 || [9.0.0+] [[#RequestNoDownloadRightsErrorResolution]]
|-
| 2352 || [9.0.0+] [[#RequestResolveNoDownloadRightsError]]
|-
| 2353 || [10.0.0+] GetApplicationDownloadTaskInfo
|-
| 2354 || [11.0.0+] PrioritizeApplicationBackgroundTask
|-
| 2355 || [12.0.0+] PreferStorageEfficientUpdate
|-
| 2356 || [12.0.0+] RequestStorageEfficientUpdatePreferable
|-
| 2357 || [15.0.0+] EnableMultiCoreDownload
|-
| 2358 || [15.0.0+] DisableMultiCoreDownload
|-
| 2359 || [15.0.0+] IsMultiCoreDownloadEnabled
|-
| 2360 || [19.0.0+] GetApplicationDownloadTaskCount
|-
| 2361 || [19.0.0+] GetMaxApplicationDownloadTaskCount
|-
| 2362 || [20.0.0+]
|-
| 2363 || [20.0.0+]
|-
| 2364 || [20.0.0+]
|-
| 2365 || [20.0.0+]
|-
| 2366 || [20.0.0+]
|-
| 2367 || [20.0.0+]
|-
| 2368 || [20.0.0+]
|-
| 2369 || [21.0.0+]
|-
| 2400 || [8.0.0+] [[#GetPromotionInfo]]
|-
| 2401 || [8.0.0+] CountPromotionInfo
|-
| 2402 || [8.0.0+] [[#ListPromotionInfo|ListPromotionInfo]]
|-
| 2403 || [8.0.0+] [[#ImportPromotionJsonForDebug]]
|-
| 2404 || [8.0.0+] [[#ClearPromotionInfoForDebug]]
|-
| 2500 || [8.0.0+] ConfirmAvailableTime
|-
| 2510 || [9.0.0+] [[#CreateApplicationResource]]
|-
| 2511 || [9.0.0+] [[#GetApplicationResource]]
|-
| 2513 || [10.0.0+] [[#LaunchMicroApplication]] ([9.0.0-9.2.0] LaunchPreomia)
|-
| 2514 || [9.0.0+] ClearTaskOfAsyncTaskManager
|-
| 2515 || [10.0.0+] CleanupAllPlaceHolderAndFragmentsIfNoTask
|-
| 2516 || [10.0.0-14.1.2] EnsureApplicationCertificate
|-
| 2517 || [13.0.0+] [[#CreateApplicationInstance]]
|-
| 2518 || [13.0.0+] UpdateQualificationForDebug
|-
| 2519 || [13.0.0+] IsQualificationTransitionSupported
|-
| 2520 || [13.0.0+] IsQualificationTransitionSupportedByProcessId
|-
| 2521 || [13.0.0-16.1.0] GetRightsUserChangedEvent
|-
| 2522 || [14.0.0+] IsRomRedirectionAvailable
|-
| 2523 || [17.0.0+] GetProgramId
|-
| 2524 || [19.0.0+]
|-
| 2525 || [20.0.0+]
|-
| 2800 || [9.0.0+] GetApplicationIdOfPreomia
|-
| 3000 || [11.0.0+] [[#RegisterDeviceLockKey]]
|-
| 3001 || [11.0.0+] [[#UnregisterDeviceLockKey]]
|-
| 3002 || [11.0.0+] [[#VerifyDeviceLockKey]]
|-
| 3003 || [11.0.0+] [[#HideApplicationIcon]]
|-
| 3004 || [11.0.0+] [[#ShowApplicationIcon]]
|-
| 3005 || [11.0.0+] [[#HideApplicationTitle]]
|-
| 3006 || [11.0.0+] [[#ShowApplicationTitle]]
|-
| 3007 || [11.0.0+] [[#EnableGameCard]]
|-
| 3008 || [11.0.0+] [[#DisableGameCard]]
|-
| 3009 || [11.0.0+] [[#EnableLocalContentShare]]
|-
| 3010 || [11.0.0+] [[#DisableLocalContentShare]]
|-
| 3011 || [11.0.0+] [[#IsApplicationIconHidden]]
|-
| 3012 || [11.0.0+] [[#IsApplicationTitleHidden]]
|-
| 3013 || [11.0.0+] [[#IsGameCardEnabled]]
|-
| 3014 || [11.0.0+] [[#IsLocalContentShareEnabled]]
|-
| 3015 || [18.0.0+] GetNetworkUpdateRequiredByGameCardDetectionEvent
|-
| 3050 || [14.0.0+] ListAssignELicenseTaskResult
|-
| 3100 || [17.0.0+] [[#GetSafeSystemVersionCheckInfo|GetSafeSystemVersionCheckInfo]]
|-
| 3101 || [17.0.0+] [[#RequestUpdateSafeSystemVersionCheckInfo|RequestUpdateSafeSystemVersionCheckInfo]]
|-
| 3102 || [17.0.0+] [[#ResetSafeSystemVersionCheckInfo|ResetSafeSystemVersionCheckInfo]]
|-
| 3104 || [18.0.0+] GetApplicationNintendoLogo
|-
| 3105 || [18.0.0+] GetApplicationStartupMovie
|-
| 3150 || [S2]
|-
| 4000 || [20.0.0+]
|-
| 4004 || [20.0.0+]
|-
| 4006 || [20.0.0+]
|-
| 4007 || [20.0.0+]
|-
| 4008 || [20.0.0+]
|-
| 4009 || [20.0.0+]
|-
| 4010 || [20.0.0+]
|-
| 4011 || [20.0.0+]
|-
| 4012 || [20.0.0+]
|-
| 4013 || [20.0.0+]
|-
| 4015 || [20.0.0+]
|-
| 4017 || [20.0.0+]
|-
| 4019 || [20.0.0+]
|-
| 4020 || [20.0.0+]
|-
| 4021 || [20.0.0+]
|-
| 4022 || [20.0.0+]
|-
| 4023 || [20.0.0+]
|-
| 4024 || [20.0.0+]
|-
| 4025 || [20.0.0+]
|-
| 4026 || [20.0.0+]
|-
| 4027 || [20.0.0+]
|-
| 4028 || [20.0.0+]
|-
| 4029 || [20.0.0+]
|-
| 4030 || [20.0.0+]
|-
| 4031 || [20.0.0+]
|-
| 4032 || [20.0.0+]
|-
| 4033 || [20.0.0+]
|-
| 4034 || [20.0.0+]
|-
| 4035 || [20.0.0+]
|-
| 4037 || [20.0.0+]
|-
| 4038 || [20.0.0+]
|-
| 4039 || [20.0.0+]
|-
| 4040 || [20.0.0+]
|-
| 4041 || [20.0.0+]
|-
| 4042 || [20.0.0+]
|-
| 4043 || [20.0.0+]
|-
| 4044 || [20.0.0+]
|-
| 4045 || [20.0.0+]
|-
| 4046 || [20.0.0+]
|-
| 4049 || [20.0.0+]
|-
| 4050 || [20.0.0+]
|-
| 4051 || [20.0.0+]
|-
| 4052 || [20.0.0+]
|-
| 4053 || [20.0.0+]
|-
| 4054 || [20.0.0+]
|-
| 4055 || [20.0.0+]
|-
| 4056 || [20.0.0+]
|-
| 4057 || [20.0.0+]
|-
| 4058 || [20.0.0+]
|-
| 4059 || [20.0.0+]
|-
| 4060 || [20.0.0+]
|-
| 4061 || [20.0.0+]
|-
| 4062 || [20.0.0+]
|-
| 4063 || [20.0.0+]
|-
| 4064 || [20.0.0+]
|-
| 4065 || [20.0.0+]
|-
| 4066 || [20.0.0+]
|-
| 4067 || [20.0.0+]
|-
| 4068 || [20.0.0+]
|-
| 4069 || [20.0.0+]
|-
| 4070 || [20.0.0+]
|-
| 4071 || [20.0.0+]
|-
| 4072 || [20.0.0+]
|-
| 4073 || [20.0.0+]
|-
| 4074 || [20.0.0+]
|-
| 4075 || [20.0.0+]
|-
| 4076 || [20.0.0+]
|-
| 4077 || [20.0.0+]
|-
| 4078 || [20.0.0+]
|-
| 4079 || [20.0.0+]
|-
| 4080 || [20.0.0+]
|-
| 4081 || [20.0.0+]
|-
| 4083 || [20.0.0+]
|-
| 4084 || [20.0.0+]
|-
| 4085 || [20.0.0+]
|-
| 4086 || [20.0.0+]
|-
| 4087 || [20.0.0+]
|-
| 4088 || [20.0.0+]
|-
| 4089 || [20.0.0+]
|-
| 4090 || [20.0.0+]
|-
| 4091 || [20.0.0+]
|-
| 4092 || [20.0.0+]
|-
| 4093 || [20.0.0+]
|-
| 4094 || [20.0.0+]
|-
| 4095 || [20.0.0+]
|-
| 4096 || [20.0.0+]
|-
| 4097 || [20.0.0+]
|-
| 4099 || [21.0.0+]
|-
| 5000 || [18.0.0+]
|-
| 5001 || [18.0.0+]
|-
| 9999 || [10.0.0-10.2.0] GetApplicationCertificate
|}

[4.0.0+] RequestDownloadAddOnContent now takes an additional 8-bytes of input.

==== GetApplicationRecordUpdateSystemEvent ====
No input, returns an output Event handle with EventClearMode=1.

==== GetApplicationViewDeprecated ====
Takes a type-0x6 output buffer containing an array of [[#ApplicationViewDeprecated]], a type-0x5 input buffer containing an array of u64 [[NCM_services#ApplicationId|ApplicationIds]], no output.

On newer system-versions this is the same as [[#GetApplicationView]], except this converts the output from the func called in the loop from [[#ApplicationView]] to [[#ApplicationViewDeprecated]].

==== DeleteApplicationEntity ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], no output.

==== DeleteApplicationCompletely ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], no output.

==== DeleteRedundantApplicationEntity ====
No input/output.

==== IsApplicationEntityMovable ====
Takes an input u8 [[NCM_services#StorageId|StorageId]], an [[NCM_services#ApplicationId|ApplicationId]], returns an output u8 bool.

==== MoveApplicationEntity ====
Takes an input u8 [[NCM_services#StorageId|StorageId]], an [[NCM_services#ApplicationId|ApplicationId]], no output.

==== RequestApplicationUpdateInfo ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IAsyncValue]].

The data that can be read from the [[#IAsyncValue]] is [[#ApplicationUpdateInfo]].

Before using the cmd, official sw uses [[Network_Interface_services#IsAnyInternetRequestAccepted|IsAnyInternetRequestAccepted]] with the output from [[Network_Interface_services#GetClientId|GetClientId]], throwing an error when the returned bool is false.

==== CancelApplicationDownload ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], no output.

==== ResumeApplicationDownload ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], no output.

==== CheckApplicationLaunchVersion ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], no output.

==== CalculateApplicationDownloadRequiredSize ====
Takes an input u8 [[NCM_services#StorageId|StorageId]], an [[NCM_services#ApplicationId|ApplicationId]], returns an output s64.

==== CleanupSdCard ====
No input/output.

==== GetSdCardMountStatusChangedEvent ====
No input, returns an output Event handle with EventClearMode=0.

==== GetGameCardUpdateDetectionEvent ====
No input, returns an output Event handle with EventClearMode=0.

This Event is used by [[qlaunch]] to check whether a card-sysupdate is required.

==== DisableApplicationAutoDelete ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], no output.

==== EnableApplicationAutoDelete ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], no output.

==== SetApplicationTerminateResult ====
Takes an input u32 Result, an [[NCM_services#ApplicationId|ApplicationId]], no output.

==== ClearApplicationTerminateResult ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], no output.

==== GetLastSdCardMountUnexpectedResult ====
No input/output.

==== GetRequestServerStopper ====
No input, returns an output [[#IRequestServerStopper]].

This increfs a state ref-count, with decref being handled when the object is closed. This ref-count is checked by [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]] and related cmds.

==== CancelApplicationApplyDelta ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], no output.

==== ResumeApplicationApplyDelta ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], no output.

==== CalculateApplicationApplyDeltaRequiredSize ====
Takes an input u8 [[NCM_services#StorageId|StorageId]], an [[NCM_services#ApplicationId|ApplicationId]], returns an output s64.

==== ResumeAll ====
No input/output.

==== GetStorageSize ====
Takes an input u8 [[NCM_services#StorageId|StorageId]], returns two output s64s.

This temporarily mounts the [[Filesystem_services#OpenContentStorageFileSystem|ContentStorage]] specified by the StorageId (must be BuiltInUser or SdCard). The two output s64s are the output from [[Filesystem_services#GetTotalSpaceSize|GetTotalSpaceSize]] and [[Filesystem_services#GetFreeSpaceSize|GetFreeSpaceSize]] with this ContentStorage, with it this being unmounted afterwards.

==== RequestUpdateApplication2 ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IAsyncResult]].

See [[#RequestApplicationUpdateInfo]] regarding nifm.

==== LaunchApplication ====
Takes an input u8 ProgramIndex, an input [[#ApplicationLaunchInfo]], returns an output u64.

[18.0.0+] Now takes a total of 0x58 bytes of input.

[19.0.0+] Now takes a total of 0x88 bytes of input.

==== GetApplicationLaunchInfo ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output [[#ApplicationLaunchInfo]].

[18.0.0+] Now returns a total of 0x50 bytes of output.

[19.0.0+] Now returns a total of 0x80 bytes of output.

==== AcquireApplicationLaunchInfo ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output [[#ApplicationLaunchInfo]].

This verifies that a state flag is set and that a state field matches the input ApplicationId, throwing an error otherwise. The [[#ApplicationLaunchInfo]] from state is copied to output, then the state flag is cleared.

[18.0.0+] Now returns a total of 0x50 bytes of output.

[19.0.0+] Now returns a total of 0x80 bytes of output.

==== GetMainApplicationProgramIndexByApplicationLaunchInfo ====
[18.0.0+] Now takes a total of 0x50 bytes of input.

[19.0.0+] Now returns a total of 0x80 bytes of output.

==== LaunchDevMenu ====
No input/output.

This is used by AM cmd [[Applet_Manager_services#LaunchDevMenu|LaunchDevMenu]].

This loads ProgramIds from [[System_Settings|system-settings]] <code>ns.applet!devmenu_id</code> and <code>ns.applet!devoverlaydisp_id</code>, which only exists on devunits. An error is thrown if loading these fail.

[[NCM_services#ncm|OpenContentMetaDatabase]] is used with StorageId = NandSystem, then IContentMetaDatabase GetLatestContentMetaKey is used with both of the above ProgramIds to verify that the cmd is successful.

Then if the above succeeds, the above titles are launched with the above StorageId via [[Process_Manager_services|pmshell]] LaunchProgram ([10.0.0+] [[PGL_services#LaunchProgram|pgl]] with pgl_launch_flags=0), with a 0.5s sleep-thread afterwards on success. [[Process_Manager_services#LaunchFlags|LaunchFlags]] value 0xB is used here.

==== DeleteUserSaveDataAll ====
Takes an input [[Account_services#Uid|Uid]], returns an output [[#IProgressMonitorForDeleteUserSaveDataAll]].

On success, [[#IProgressMonitorForDeleteUserSaveDataAll]] GetProgress is used with the output being copied into object state.

==== DeleteUserSystemSaveData ====
Takes an input [[Account_services#Uid|Uid]], an u64 SystemSaveDataId, no output.

==== DeleteSaveData ====
Takes an input u8 [[Filesystem_services#SaveDataSpaceId|SaveDataSpaceId]], an u64 SaveDataId, no output.

==== UnregisterNetworkServiceAccount ====
Takes an input [[Account_services#Uid|Uid]], no output.

==== UnregisterNetworkServiceAccountWithUserSaveDataDeletion ====
Takes an input [[Account_services#Uid|Uid]], no output.

==== LaunchLibraryApplet ====
Takes an input u64 [[NCM_services#ProgramId|ProgramId]], returns an output u64.

The specified program is launched with StorageId=BuiltInSystem via [[Process_Manager_services|pmshell]] LaunchProgram ([10.0.0+] [[PGL_services#LaunchProgram|pgl]] with pgl_launch_flags=0). [[Process_Manager_services#LaunchFlags|LaunchFlags]] value 0x9 is used here. The output u64 from here is written to the output for this cmd, on success.

This is used by [[Applet_Manager_services|AM]].

==== LaunchSystemApplet ====
No input, returns an output u64.

A state flag must be non-zero, otherwise an error is thrown. When a state field is value 1, a hard-coded ProgramId for MaintenanceMenu is used. Otherwise, the ProgramId is loaded from [[System_Settings|system-setting]] <code>ns.applet!system_applet_id</code> ([20.0.0+] <code>ns.applet!system_applet_id_gen2</code>).

The SystemApplet is launched with StorageId=BuiltInSystem via [[Process_Manager_services|pmshell]] LaunchProgram ([10.0.0+] [[PGL_services#LaunchProgram|pgl]] with pgl_launch_flags=0). [[Process_Manager_services#LaunchFlags|LaunchFlags]] value 0x9 is used here. The output u64 from here is written to the output for this cmd, on success.

This is used by [[Applet_Manager_services|AM]].

==== LaunchOverlayApplet ====
No input, returns an output u64.

A state flag must be non-zero, otherwise an error is thrown. The ProgramId is loaded from [[System_Settings|system-setting]] <code>ns.applet!overlay_applet_id</code>.

The OverlayApplet is launched with StorageId=BuiltInSystem via [[Process_Manager_services|pmshell]] LaunchProgram ([10.0.0+] [[PGL_services#LaunchProgram|pgl]] with pgl_launch_flags=0). [[Process_Manager_services#LaunchFlags|LaunchFlags]] value 0x9 is used here. The output u64 from here is written to the output for this cmd, on success.

This is used by [[Applet_Manager_services|AM]].

==== RequestDownloadApplicationControlData ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IAsyncResult]].

See [[#RequestApplicationUpdateInfo]] regarding nifm.

==== GetApplicationControlProperty ====
[18.0.0+] Now takes a total of 0x58 bytes of input.

==== ListApplicationTitle ====
Takes an input TransferMemory handle, a type-0x5 input buffer containing an array of u64 [[NCM_services#ApplicationId|ApplicationIds]], an u8 [[#ApplicationControlSource]], an u64 size, returns an output Event handle and an [[#IAsyncValue]].

[[qlaunch]] uses value 0x1 for the u8.

The user-process creates the TransferMemory with permissions=R--.

The data available with [[#IAsyncValue]] Get is a s32 for the offset within the TransferMemory where the output data is located, GetSize returns the total byte-size of the data located here. The data located here is the [[NACP_Format|NACP]] title-entry for each specified ApplicationId.

The TransferMemory size must be at least: count*sizeof([[NACP_Format|title-entry]]) + count*sizeof(u64) + count*[[#GetApplicationControlData|0x24000]].

This is essentially an async wrapper for [[#GetApplicationControlData]], with support for multiple ApplicationIds.

==== ListApplicationIcon ====
Takes an input TransferMemory handle, a type-0x5 input buffer containing an array of u64 [[NCM_services#ApplicationId|ApplicationIds]], an u8 [[#ApplicationControlSource]], an u64 size, returns an output Event handle and an [[#IAsyncValue]].

The user-process creates the TransferMemory with permissions=R--.

The data available with [[#IAsyncValue]] Get is a s32 for the offset within the TransferMemory where the output data is located, GetSize returns the total byte-size of the data located here. This data is: an u64 for total entries, an array of u64s for each icon size, then the icon JPEGs for the specified ApplicationIds.

The TransferMemory size must be at least: 0x4 + count*sizeof(u64) + count*[[#GetApplicationControlData|0x20000]] + count*sizeof(u64) + [[#GetApplicationControlData|0x24000]].

This is essentially an async wrapper for [[#GetApplicationControlData]], with support for multiple ApplicationIds.

==== Cmd421 ====
Takes an input TransferMemory handle, a type-0x5 input buffer containing an array of u64 [[NCM_services#ApplicationId|ApplicationIds]], an u8 [[#ApplicationControlSource]], an u64 size, returns an output Event handle and an [[#IAsyncValue]].

This is essentially the same as [[#ListApplicationTitle|ListApplicationTitle]] except the ApplicationControlSource is used here (ListApplicationTitle ignores it and uses 0xF0 instead).

The TransferMemory size must be at least: count*sizeof(u64) + count*[[NACP#ApplicationTitle|0x300]] + [[#GetApplicationControlData|0x1d000]].

The async task impl code eventually compares ApplicationControlSource with 0xF0, with a separate code-path being used when it doesn't match (which also handles [[NACP|compression]] when needed).

==== RequestCheckGameCardRegistration ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IAsyncResult]].

See [[#RequestApplicationUpdateInfo]] regarding nifm.

==== RequestGameCardRegistrationGoldPoint ====
Takes an input [[Account_services#Uid|Uid]], an [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IAsyncValue]].

The data that can be read from the [[#IAsyncValue]] is 4-bytes.

See [[#RequestApplicationUpdateInfo]] regarding nifm.

==== RequestRegisterGameCard ====
Takes an input s32, an [[Account_services#Uid|Uid]], an [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IAsyncResult]].

See [[#RequestApplicationUpdateInfo]] regarding nifm.

==== GetGameCardMountFailureEvent ====
No input, returns an output Event handle with EventClearMode=0.

==== IsGameCardInserted ====
No input, returns an output u8 bool.

==== EnsureGameCardAccess ====
No input/output.

==== GetLastGameCardMountFailureResult ====
No input/output.

==== ListApplicationIdOnGameCard ====
Takes a type-0x6 output buffer containing an array of u64 [[NCM_services#ApplicationId|ApplicationIds]], returns an output s32 for total output entries.

==== GetGameCardPlatformRegion ====
No input, returns an u8 '''GameCardPlatformRegion''' (0x00 = Global, 0x01 = China).

This calls [[Filesystem_services#IDeviceOperator|fsp-srv IDeviceOperator]] GetGameCardCompatibilityType and returns the result.

==== ListAvailableAddOnContent ====
[10.0.0+] This now takes a total of 0x10-bytes of input instead of a total of 0x18-bytes of input.

[15.0.0+] This now takes a total of 0x8-bytes of input instead of a total of 0x10-bytes of input.

==== RequestDownloadTaskListData ====
No input, returns an output Event handle and an [[#IAsyncValue]].

==== TouchApplication ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], no output.

==== IsApplicationUpdateRequested ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output u8 bool and an u32.

The output u32 is only valid when the output bool is set.

==== WithdrawApplicationUpdateRequest ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], no output.

==== RequestVerifyApplicationDeprecated ====
Takes an input TransferMemory handle, an [[NCM_services#ApplicationId|ApplicationId]], an u64 size, returns an output Event handle and an [[#IProgressAsyncResult]].

On newer system-versions this calls the same func as [[#RequestVerifyApplication]], with the u32 value set to 0x7.

==== RequestVerifyAddOnContentsRights ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IProgressAsyncResult]].

==== RequestVerifyApplication ====
Takes an input TransferMemory handle, an u32, an [[NCM_services#ApplicationId|ApplicationId]], an u64 size, returns an output Event handle and an [[#IProgressAsyncResult]].

Official sw creates the TransferMemory with an user-specified buffer with permissions=0. [[qlaunch]] uses buffer size 0x100000.

Official sw has an additional wrapper func which calls the original wrapper func, this uses value 0x7 for the u32. This is the same func used by [[qlaunch]].

==== IsAnyApplicationEntityInstalled ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output u8 bool.

==== CleanupUnavailableAddOnContents ====
Takes an input u64 [[NCM_services#ApplicationId|ApplicationId]], an [[Account_services#Uid|Uid]], no output.

==== RequestMoveApplicationEntity ====
Takes an input TransferMemory handle, a type-0x5 input buffer containing an array of [[NCM_services#StorageId|StorageId]], a [[NCM_services#StorageId|StorageId]], an u32 bitfield of "nn::ns::KeepApplicationEntityFlagTag", an [[NCM_services#ApplicationId|ApplicationId]], an u64 tmem_size, returns an output Event handle and an [[#IProgressAsyncResult]].

The TransferMemory uses permissions=0.

==== EstimateSizeToMove ====
Takes a type-0x5 input buffer containing an array of [[NCM_services#StorageId|StorageId]], a [[NCM_services#StorageId|StorageId]], an u32 bitfield of "nn::ns::KeepApplicationEntityFlagTag", an [[NCM_services#ApplicationId|ApplicationId]], returns an output s64.

This calls a func also used by [[#RequestMoveApplicationEntity]], then calls another func.

==== FormatSdCard ====
No input/output.

==== NeedsSystemUpdateToFormatSdCard ====
No input, returns an output u8 bool.

==== GetLastSdCardFormatUnexpectedResult ====
No input/output.

==== GetApplicationView ====
Takes a type-0x6 output buffer containing an array of [[#ApplicationView]], a type-0x5 input buffer containing an array of u64 [[NCM_services#ApplicationId|ApplicationIds]], no output.

==== GetApplicationViewDownloadErrorContext ====
Takes a type-0x16 output buffer containg an [[Error_Applet#ErrorContext|ErrorContext]], an u64 [[NCM_services#ApplicationId|ApplicationId]], no output.

==== GetApplicationViewWithPromotionInfo ====
Takes a type-0x6 output buffer containing an array of [[#ApplicationViewWithPromotionInfo]], a type-0x5 input buffer containing an array of u64 [[NCM_services#ApplicationId|ApplicationIds]], no output.

==== IsPatchAutoDeletableApplication ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output bool.

Compares the input ApplicationId with the value of [[System_Settings|system-setting]] <code>ns.application!auto_deletable_application_id_on_not_enough_space</code>, with the bool being set to the comparsion result.

==== ListLastNotificationInfo ====
Takes a type-0x6 buffer containing an array with struct entry size 0x90-bytes. Returns 4-bytes of output.

[19.0.0+] The struct size is now 0x98-bytes.

==== ListNotificationTask ====
Takes a type-0x6 buffer containing an array with struct entry size 0xB0-bytes. Returns 4-bytes of output.

[19.0.0+] The struct size is now 0xB8-bytes.

==== RequestDownloadApplicationPrepurchasedRights ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IAsyncResult]].

See [[#RequestApplicationUpdateInfo]] regarding nifm.

==== GetSystemDeliveryInfo ====
Takes a type-0x16 output buffer containing a [[#SystemDeliveryInfo]], no output.

This generates a [[#SystemDeliveryInfo]] using the currently installed SystemUpdate meta title.

==== SelectLatestSystemDeliveryInfo ====
Takes a type-0x15 input buffer containing a [[#SystemDeliveryInfo]], a type-0x5 input buffer containing an array of [[#SystemDeliveryInfo]], a type-0x5 input buffer containing an array of [[#ApplicationDeliveryInfo]], and returns an output s32.

This determines the latest version (RequiredSystemVersion) from the input [[#ApplicationDeliveryInfo]] array (ApplicationDeliveryProtocolVersion and the HMAC are also validated), using value 0 if the array is empty.

* [20.0.0+] The following code block now only runs when the SystemDeliveryInfoPlatform from the type-0x15 [[#SystemDeliveryInfo]] buffer matches the [[System_Settings|sys-setting]].
** It then loops through the [[#ApplicationDeliveryInfo]] array again:
** This uses functionality which essentially uses [[Shared_Database_services|pl:s]] GetFunctionBlackListSystemVersionToAuthorize with the [[#ApplicationDeliveryInfo]] ApplicationId and ApplicationFunctionAuthorizationId=0x5 then parses the output, using cached data if available. The error is returned on failure.
** tmp_version = out_u8 == 0 ? 0 : out_u32 + 0x10000;
** Then the current latest-version value is updated with tmp_version, if tmp_version is higher.

If this version value is less than a state field, the state field value is used instead (state field originates from [[System_Settings|system-setting]] <code>contents_delivery!required_system_version_to_deliver_application</code>).

Then this selects the [[#SystemDeliveryInfo]] with the latest version from the input array. The output s32 is an index in that array for the selected entry, -1 if none found.

During the above loop it first calls the [[#SystemDeliveryInfo]] validation func, returning the Result on failure. Then it runs additional validation, with the [[#SystemDeliveryInfo]] entry being ignored on failure:
* The above latest-version value must be at least the version value from the type-0x15 [[#SystemDeliveryInfo]] buffer and the [[#SystemDeliveryInfo]] array entry.
* When HasExFat is set in the type-0x15 [[#SystemDeliveryInfo]] buffer, it must be set in the [[#SystemDeliveryInfo]] array entry.
* FirmwareVariationId in the type-0x15 [[#SystemDeliveryInfo]] buffer must not be 0xFF.
* UpdatableFirmwareGroupId in the [[#SystemDeliveryInfo]] array entry must not be 0xFF. The value must be within bounds of the settings array ([[System_Settings|sys-settings]] <code>contents_delivery!updatable_firmware_group_string</code>).
* PlatformRegion in the [[#SystemDeliveryInfo]] array entry and the type-0x15 [[#SystemDeliveryInfo]] buffer must match.
* Lastly when the following is true, this indicates success: (settings_array[UpdatableFirmwareGroupId] >> {above FirmwareVariationId}) & 1.

==== VerifyDeliveryProtocolVersion ====
Takes a type-0x15 input buffer containing a [[#SystemDeliveryInfo]], no output.

This validates the [[#SystemDeliveryInfo]] HMAC and the protocol-version fields. Then an error is returned when SystemUpdateVersion is less than a state field, otherwise 0 is returned (state field originates from [[System_Settings|system-setting]] <code>contents_delivery!required_system_version_to_deliver_application</code>).

==== GetApplicationDeliveryInfo ====
Takes a type-0x6 output buffer containing an array of [[#ApplicationDeliveryInfo|ApplicationDeliveryInfo]], an input u32 bitmask <code>nn::ns::ApplicationDeliveryAttributeTag</code>, an [[NCM_services#ApplicationId|ApplicationId]], and returns an output s32 total_out.

[11.0.0+] An error is thrown if LocalContentShare is not [[#IsLocalContentShareEnabled|enabled]].

An error is thrown if any bit is set in ApplicationDeliveryAttributeTag besides bit1, this must also be <=0x3. The output array-count must be at least 1: only 1 entry will be written to this array (hence on success total_out will also only be 1 on success).

[7.0.0+] An error is thrown if the state ref-count for [[#GetRequestServerStopper|RequestServerStopper]] is zero. [7.0.0-7.0.1] The func which checks this would also return success when a field prior to the previously mentioned field is 0 (checked before the ref-count).

An error is thrown if [[NIM_services|nim]] ListApplicationApplyDeltaTask returns a task.

HasApplicationRecord is called with the input [[NCM_services#ApplicationId|ApplicationId]], an error is returned if the record isn't found.

[[#ApplicationDeliveryInfo|RequiredApplicationVersion]] is initially set to the output version from [[Shared_Database_services|avm]] GetLaunchRequiredVersion. Later when ContentMetaType == Application etc, it calls a func. This func uses [[NCM_services|ncm]] IContentMetaDatabase GetRequiredApplicationVersion. If the output version is higher than the [[#ApplicationDeliveryInfo|RequiredApplicationVersion]] field then the output version is written here. Immediately aferwards, it also checks whether the bit for Compacted is set from [[NCM_services|ncm]] IContentMetaDatabase GetAttributes, clearing [[#ApplicationDeliveryInfo|ApplicationVersion]] if the attribute is set.

[20.0.0+] [[#ApplicationDeliveryInfo|ApplicationDeliveryInfo]] ContentMetaPlatform and ProperProgramExists are now set using data from [[NCM_services|ncm]].

[20.0.0+] [[Shared_Database_services|pl:s]] GetFunctionBlackListSystemVersionToAuthorize with ApplicationFunctionAuthorizationId=0x5 is now used, the output version is written to [[#ApplicationDeliveryInfo|RequiredSystemVersion]] when it's higher than the value previously written here.

[20.0.0+] [[Shared_Database_services|pl:s]] GetRequiredApplicationVersion with ApplicationFunctionAuthorizationId=0x5 is now used, the output version is written to [[#ApplicationDeliveryInfo|RequiredApplicationVersion]] when it's higher than the value previously written here.

==== HasAllContentsToDeliver ====
Takes a type-0x5 input buffer containing an array of [[#ApplicationDeliveryInfo]], returns an output u8 bool.

The array-count must match 1.

This uses the same LocalContentShare check as [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]].

After validating the [[#ApplicationDeliveryInfo]], the output bool is set to [[#ApplicationDeliveryInfo|ApplicationDeliveryAttributeTag]] & 0x10000002 != 0x2, then this returns 0.

==== CompareApplicationDeliveryInfo ====
Takes two type-0x5 input buffers containing an array of [[#ApplicationDeliveryInfo]], returns an output s32.

This uses the same LocalContentShare check as [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]].

The array-count for both buffers must be 1, otherwise an error is returned.

Both [[#ApplicationDeliveryInfo]] are validated, then the application-version in the first/second buffer are compared. The output s32 is set to the comparison result: -1 for less than, 0 for equal, and 1 for higher than.

==== CanDeliverApplication ====
Takes two type-0x5 input buffers containing an array of [[#ApplicationDeliveryInfo]], returns an output u8 bool.

The array-count for the second buffer must be 1, otherwise an error is returned.

This uses the same LocalContentShare check as [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]].

The second [[#ApplicationDeliveryInfo]] buffer is validated. An error is thrown when [[#ApplicationDeliveryInfo|ApplicationDeliveryAttributeTag]] (second buffer) & 0x3 != 0x2, likewise when bit28 is clear in this field (bitmask 0x10000000).

The array-count for the first buffer must be <=1, otherwise an error is returned. If the array-count for the first buffer is 0, this will return 0 with the output bool set to 0. The first [[#ApplicationDeliveryInfo]] buffer is validated. An error is thrown when [[#ApplicationDeliveryInfo|ApplicationDeliveryAttributeTag]] (first buffer) bit1 is clear or bit0 set. An error is thrown when [[#ApplicationDeliveryInfo|ApplicationDeliveryAttributeTag]] (second buffer) bit1 is clear.

When [[#ApplicationDeliveryInfo|RequiredApplicationVersion]] (first or second buffer) is higher than [[#ApplicationDeliveryInfo|ApplicationVersion]] (second buffer), this will return 0 with the output bool set to 0.

When [[#ApplicationDeliveryInfo|ApplicationDeliveryAttributeTag]] (first buffer) bit28 is set (bitmask 0x10000000):
* When [[#ApplicationDeliveryInfo|ApplicationVersion]] (first buffer) >= [[#ApplicationDeliveryInfo|ApplicationVersion]] (second buffer), write 0 to the output bool, otherwise write 1. Then return 0.
Otherwise when the above bit28 is clear:
* When [[#ApplicationDeliveryInfo|ApplicationVersion]] (first buffer) > [[#ApplicationDeliveryInfo|ApplicationVersion]] (second buffer), write 0 to the output bool, otherwise write 1. Then return 0.

==== ListContentMetaKeyToDeliverApplication ====
Takes a type-0x6 output buffer containing an array of [[NCM_services#ContentMetaKey|ContentMetaKey]], a type-0x5 input buffer containing an array of [[#ApplicationDeliveryInfo]], a s32, and returns an output s32 total_out.

This uses the same LocalContentShare check as [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]].

The array-count for ContentMetaKey must be at least 1, and for ApplicationDeliveryInfo it must match 1.

The [[#ApplicationDeliveryInfo|ApplicationDeliveryInfo]] is validated (ApplicationDeliveryProtocolVersion/HMAC). An error is thrown when [[#ApplicationDeliveryInfo|ApplicationDeliveryAttributeTag]] bit0 is set.

This uses the same ref-count check as [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]].

An error is thrown if [[NIM_services|nim]] ListApplicationApplyDeltaTask returns a task.

This will only return 1 ContentMetaKey entry. This will not output the entry when the input s32 is larger than 0, or when [[#ApplicationDeliveryInfo|ApplicationDeliveryAttributeTag]] bit1 is clear.

==== NeedsSystemUpdateToDeliverApplication ====
Takes a type-0x15 input buffer containing a [[#SystemDeliveryInfo]], a type-0x5 input buffer containing an array of [[#ApplicationDeliveryInfo]], and returns an output u8 bool.

This uses the same LocalContentShare check as [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]].

The [[#SystemDeliveryInfo]] is validated (validation for ApplicationDeliveryProtocolVersion is enabled).

The array-count must match 1.

The [[#ApplicationDeliveryInfo]] is validated (ApplicationDeliveryProtocolVersion/HMAC).

This then runs functionality similar to [[#SelectLatestSystemDeliveryInfo]]:
* [20.0.0+] The following code block now only runs when the SystemDeliveryInfoPlatform from the input [[#SystemDeliveryInfo]] matches the [[System_Settings|sys-setting]].
* Uses the same functionality as [[#SelectLatestSystemDeliveryInfo]] for GetFunctionBlackListSystemVersionToAuthorize, returning the Result on failure.
* The output bool is set to: out_u8!=0 && out_u32 >= [[#SystemDeliveryInfo]] SystemUpdateVersion (only the upper 16bits are used from the SystemUpdateVersion).

Otherwise when the output bool is still false, this sets the output bool by comparing system-version fields in the [[#SystemDeliveryInfo]]/[[#ApplicationDeliveryInfo]] and with a state field (state field originates from [[System_Settings|system-setting]] <code>contents_delivery!required_system_version_to_deliver_application</code>).

==== EstimateRequiredSize ====
Takes a type-0x5 input buffer containing an array of [[NCM_services#ContentMetaKey|ContentMetaKey]], returns an output s64.

When the array-count is less than 1, this will return 0 with the s64 set to 0.

==== RequestReceiveApplication ====
Takes a type-0x5 input buffer containing an array of [[NCM_services#ContentMetaKey|ContentMetaKey]], a [[NCM_services#StorageId|StorageId]], an u16 port, an u32 Ipv4Address, an [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IAsyncResult]].

[[qlaunch]] uses value Any for the StorageId, and value 55556 for the port.

This uses the same LocalContentShare and ref-count checks as [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]].

An error is thrown if [[NIM_services|nim]] ListApplicationApplyDeltaTask returns a task.

HasApplicationRecord is called with the input [[NCM_services#ApplicationId|ApplicationId]], an error is returned if the record isn't found.

This loops through the input [[NCM_services#ContentMetaKey|ContentMetaKey]] array, throwing an error if the [[NCM_services#ContentMetaType|ContentMetaType]] doesn't match Patch. The input array is copied into state which is used later by the thread for [[NIM_services|nim]] CreateLocalCommunicationReceiveApplicationTask, max entries is 0x12.

This does various setup then creates the [[#IAsyncResult]] + the async thread which handles the [[#IAsyncResult]] operation. Then the thread does:

* Calls a func which does:
** Throws an error if a state flag is set.
** Uses [[NIM_services|nim]] CreateLocalCommunicationReceiveApplicationTask, returning the Result on failure.
** Uses [[NIM_services|nim]] RequestLocalCommunicationReceiveApplicationTaskRun, returning the Result on failure. Waits for the IAsyncResult operation from this to finish, then uses the Get cmd to get the output Result.
*** When the Result from Get is an error, a func is called for filling in the [[#IAsyncResult|IAsyncResult]] ErrorContext with Type4.
** Handles cleanup and returns.
* On success, this loads various data which is then used for saving a SystemPlayReport when the cached [[System_Settings|system-setting]] "systemreport!enabled" is set.
** The EventId is "receive_app_contents" with ApplicationId <NS ProgramId>.
** This report has the following fields:
*** "ApplicationId"
*** "DestinationVersion"
*** "SourceVersion"
*** "HasApplicationEntity"
*** "HasPatchEntity"
*** "ApplicationStorageId"
*** "PatchStorageId"
*** "Size"
*** "ThroughputKBps"

==== CommitReceiveApplication ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], no output.

This uses the same LocalContentShare and ref-count checks as [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]].

An error is thrown if [[NIM_services|nim]] ListApplicationApplyDeltaTask returns a task.

==== GetReceiveApplicationProgress ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output [[#ReceiveApplicationProgress]].

This uses the same ref-count check as [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]].

An error is thrown if [[NIM_services|nim]] ListApplicationApplyDeltaTask returns a task.

Uses [[NIM_services|nim]] ListApplicationLocalCommunicationReceiveApplicationTask, throwing an error if no task is returned. Then [[NIM_services|nim]] GetLocalCommunicationReceiveApplicationTaskInfo is used, returning the error from there on failure. Lastly, this writes the 0x10-bytes from output+8 from the latter cmd to the output [[#ReceiveApplicationProgress]], and returns 0.

==== RequestSendApplication ====
Takes a type-0x5 input buffer containing an array of [[NCM_services#ContentMetaKey|ContentMetaKey]], an u16 port, an u32 Ipv4Address, an [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IAsyncResult]].

[[qlaunch]] uses value 55556 for the port.

This uses the same LocalContentShare and ref-count checks as [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]].

An error is thrown if [[NIM_services|nim]] ListApplicationApplyDeltaTask returns a task.

This does various setup and loops through the input ContentMetaKey array for initializing the array passed to the nim cmd during the async task. This loop does the following:
* Throws an error if the [[NCM_services#ContentMetaType|ContentMetaType]] in the ContentMetaKey doesn't match Patch.
* Calls a func with the ContentMetaKey and the ApplicationId, throwing an error if the output value is 0.
* Calls a func with the ContentMetaKey for getting the StorageId. This essentially loops through each valid ncm [[NCM_services|IContentMetaDatabase]] using cmd [[NCM_services|Has]] with the input ContentMetaKey, returning the relevant StorageId when found.
* The ContentMetaKey and the StorageId are copied into a tmp struct.
* if (ContentMetaType==Patch && StorageId==GameCard) { <call a func etc> }
* Copies the above tmp struct into the async task state array.

This then creates the [[#IAsyncResult]] + the async thread which handles the [[#IAsyncResult]] operation. Then the thread does:

* Calls a func which does:
** Throws an error if a state flag is set.
** Uses [[NIM_services|nim]] CreateLocalCommunicationSendApplicationTask, returning the Result on failure.
** Uses [[NIM_services|nim]] RequestLocalCommunicationSendApplicationTaskRun, returning the Result on failure. Waits for the IAsyncResult operation from this to finish, then uses the Get cmd to get the output Result.
*** When the Result from Get is an error, a func is called for filling in the [[#IAsyncResult|IAsyncResult]] ErrorContext with Type4.
** Handles cleanup and returns.
* On success, this loads various data which is then used for saving a SystemPlayReport when the cached [[System_Settings|system-setting]] "systemreport!enabled" is set.
** The EventId is "send_app_contents" with ApplicationId <NS ProgramId>.
** This report has the following fields:
*** "ApplicationId"
*** "Version"
*** "ApplicationStorageId"
*** "PatchStorageId"

==== GetSendApplicationProgress ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output [[#SendApplicationProgress]].

Same as [[#GetReceiveApplicationProgress]] except this is the Send version, and uses [[NIM_services|nim]] ListApplicationLocalCommunicationSendApplicationTask/GetLocalCommunicationSendApplicationTaskInfo instead. The data copied to output is also swapped: u64 nim_out+0x8 is copied to out+0x8, and u64 nim_out+0x10 is copied to out+0x0.

==== CompareSystemDeliveryInfo ====
Takes two type-0x15 input buffers containing a [[#SystemDeliveryInfo]], returns an output s32.

This is essentially the same as [[#CompareApplicationDeliveryInfo]], except this compares the [[#SystemDeliveryInfo]] SystemUpdate version.

==== ListNotCommittedContentMeta ====
Takes a type-0x6 output buffer containing an array of [[NCM_services#ContentMetaKey|ContentMetaKey]], a s32, an [[NCM_services#ApplicationId|ApplicationId]], returns an output s32 total_out.

This uses the same ref-count check as [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]].

An error is thrown if [[NIM_services|nim]] ListApplicationApplyDeltaTask returns a task.

==== RecoverDownloadTask ====
Takes a type-0x5 input buffer containing an array of {unknown} and an input u64, no output.

This uses the same LocalContentShare and ref-count checks as [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]].

==== GetApplicationDeliveryInfoHash ====
Takes a type-0x5 input buffer containing an array of [[#ApplicationDeliveryInfo]], returns an output 0x20-byte SHA256 hash.

This uses the same LocalContentShare check as [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]].

This extracts data from the input array for hashing with SHA256, with validation being done when handling each entry (ApplicationDeliveryProtocolVersion/HMAC).

The 0x14-bytes from [[#ApplicationDeliveryInfo|ApplicationDeliveryInfo]]+0x8 are copied into a 0x18-byte struct entry in an array buffer, with the last 4-bytes being cleared. Then each 0x18-byte struct entry is hashed.

==== Cmd2019 ====
Takes a type-0x15 input buffer containing a [[#SystemDeliveryInfo]], a type-0x5 input buffer containing an array of [[#ApplicationDeliveryInfo]], a type-0x5 input buffer containing an array of [[#ApplicationDeliveryInfo]], returns an output u8 bool.

This is essentially an extended version of [[#CanDeliverApplication|CanDeliverApplication]], with additional functionality for determining platform compatibility.

This calls a func for validating the [[#SystemDeliveryInfo]] from the type-0x15 buffer, returning the Result on failure.

Then [[#CanDeliverApplication|CanDeliverApplication]] is called with the output bool and the input arrays, returning the Result on failure.

If the output bool is set after calling the above, it then calls a func with the output bool, the second [[#ApplicationDeliveryInfo]] buffer, and the [[#SystemDeliveryInfo]] from the type-0x15 buffer. This func does the following:
* When the SystemDeliveryInfoPlatform from the input [[#SystemDeliveryInfo]] matches the [[System_Settings|sys-setting]], it does the following:
** Uses [[Shared_Database_services|pl:s]] RequestApplicationFunctionAuthorizationByApplicationId with the [[#ApplicationDeliveryInfo]] ApplicationId/ApplicationVersion and ApplicationFunctionAuthorizationId=0x5, handling the Result on failure.
* When the platform fields from the input [[#SystemDeliveryInfo]]/[[#ApplicationDeliveryInfo]] match, write 1 to the output bool and return 0. Otherwise:
** When the [[#SystemDeliveryInfo]] SystemDeliveryInfoPlatform is 0x1 (Ounce): *output = [[#ApplicationDeliveryInfo|ContentMetaPlatform]] == 0 && [[#ApplicationDeliveryInfo|ProperProgramExists]] == 0;
** When the [[#SystemDeliveryInfo]] SystemDeliveryInfoPlatform is 0x0 (NX): write 0 to the output bool and return 0.
** Otherwise, Abort.

==== GetApplicationRightsOnClient ====
Takes a type-0x6 output buffer containing an array of [[#ApplicationRightsOnClient]], an input u32 flags, an [[NCM_services#ApplicationId|ApplicationId]], an [[Account_services#Uid|Uid]], returns 4-bytes of output for total output entries.

Official sw has at least two wrappers which use this cmd: one with an all-zero Uid, one with an user-specified Uid. With both of these, the passed flags are hard-coded to value 0x3.

For the output array count, [[qlaunch]] uses value 3.

==== GetApplicationTerminateResult ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output u32 Result.

==== GetRightsEnvironmentHandleForApplication ====
No input, returns a total of 8-bytes of output.

[9.0.0+] Now takes a total of 8-bytes of input, returns a total of 8-bytes of output.

==== RequestNoDownloadRightsErrorResolution ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IAsyncValue]].

The data that can be read from the [[#IAsyncValue]] is [[#NoDownloadRightsErrorResolution]].

See [[#RequestApplicationUpdateInfo]] regarding nifm.

==== RequestResolveNoDownloadRightsError ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IAsyncValue]].

The data that can be read from the [[#IAsyncValue]] is [[#NoDownloadRightsErrorResolution]].

See [[#RequestApplicationUpdateInfo]] regarding nifm.

==== GetPromotionInfo ====
Takes a type-0x6 output buffer containing an array of [[#PromotionInfo]], a type-0x5 input buffer containing an array of u64 [[NCM_services#ApplicationId|ApplicationIds]], a type-0x5 input buffer containing an array of [[Account_services#Uid|Uids]], no output.

Official sw uses hard-coded value 1 for the count with each of these arrays.

==== ListPromotionInfo ====
[20.0.0+] The struct size for the output buffer array is now 0x28-bytes instead of 0x20-bytes.

==== ImportPromotionJsonForDebug ====
Takes a type-0x5 input buffer, no output.

The output from [[Settings_services#GetDebugModeFlag]] must be 1, otherwise an error is returned.

==== ClearPromotionInfoForDebug ====
No input/output.

The output from [[Settings_services#GetDebugModeFlag]] must be 1, otherwise an error is returned.

This just clears 0xC-bytes in state.

==== CreateApplicationResource ====
Takes an input [[#ApplicationResourceType]]. Returns an [[#IApplicationResource]].

==== GetApplicationResource ====
Takes an input u64 ProcessId and an input [[#ApplicationResourceType]]. Returns an [[#IApplicationResource]].

==== LaunchMicroApplication ====
[18.0.0+] Now takes a total of 0x50 bytes of input.

[19.0.0+] Now takes a total of 0x80 bytes of input.

==== CreateApplicationInstance ====
[18.0.0+] Now takes a total of 0x50 bytes of input.

[19.0.0+] Now takes a total of 0x80 bytes of input.

==== RegisterDeviceLockKey ====
Takes a type-0x5 input buffer containing an InArray of u8, no output.

User-processes expose this with two funcs: one which uses an user-specified u8 array directly, while the other uses [[HID_services#NpadButtonSet|NpadButton]].

This does SHA256 hashing, etc.

==== UnregisterDeviceLockKey ====
No input/output.

Runs code identical to [[#RegisterDeviceLockKey]], except the passed buffer/size are 0.

==== VerifyDeviceLockKey ====
Takes a type-0x5 input buffer containing an InArray of u8, no output.

User-processes expose this with two funcs: one which uses an user-specified u8 array directly, while the other uses [[HID_services#NpadButtonSet|NpadButton]].

This runs hashing similar to [[#RegisterDeviceLockKey]], with the calculated hash being verified with the one from state.

==== HideApplicationIcon ====
No input/output.

==== ShowApplicationIcon ====
No input/output.

==== HideApplicationTitle ====
No input/output.

==== ShowApplicationTitle ====
No input/output.

==== EnableGameCard ====
No input/output.

==== DisableGameCard ====
No input/output.

==== EnableLocalContentShare ====
No input/output.

==== DisableLocalContentShare ====
No input/output.

==== IsApplicationIconHidden ====
No input, returns an output bool.

==== IsApplicationTitleHidden ====
No input, returns an output bool.

==== IsGameCardEnabled ====
No input, returns an output bool.

==== IsLocalContentShareEnabled ====
No input, returns an output bool.

Various Deliver cmds now run essentially the same code as IsLocalContentShareEnabled, with an error being returned when it's not enabled.

==== Cmd4026 ====
Takes an input u64, returns an [[#IHostSession|IHostSession]].

The input u64 must match a state field.

This initializes [[LDN_services|ldn]] etc, and creates a network.

==== Cmd4027 ====
Takes an input u64, returns an [[#IClientSession|IClientSession]].

The input u64 must match a state field.

This initializes [[LDN_services|ldn]] etc.

=== IGameCardStopper ===
This is "nn::ns::detail::IGameCardStopper".

This interface has no commands.

=== IRequestServerStopper ===
This is "nn::ns::detail::IRequestServerStopper".

This interface has no commands.

=== IProgressMonitorForDeleteUserSaveDataAll ===
This is "nn::ns::detail::IProgressMonitorForDeleteUserSaveDataAll".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetSystemEvent
|-
| 1 || IsFinished
|-
| 2 || GetResult
|-
| 10 || GetProgress
|}

When closing the object, official sw uses IsFinished first, asserting when the output bool is false.

* GetSystemEvent: No input, returns an output Event handle. [[qlaunch]] doesn't use this.

* IsFinished: No input, returns an output u8 bool.

* GetResult: No input/output.

* GetProgress: No input, returns an output [[#ProgressForDeleteUserSaveDataAll]]. Official sw writes this struct directly to object state.

=== IProgressAsyncResult ===
This is "nn::ns::detail::IProgressAsyncResult".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Get
|-
| 1 || Cancel
|-
| 2 || GetProgress
|-
| 3 || GetDetailResult
|-
| 4 || [4.0.0+] GetErrorContext
|}

=== IHostSession ===
This is "nn::ns::vphym::detail::IHostSession".

This was added with [20.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 ||
|-
| 1 ||
|-
| 2 ||
|}

==== Cmd0 ====
No input, returns an output Event handle and an [[#IAsyncValue]].

The async task does the following:
* This waits for a client to connect.
* The [[LDN_services|NodeInfo]] UserName is converted into two u64s, which are used to locate a state entry with matching values.
* The client [[LDN_services|NodeInfo]] Ipv4Address is copied into state.
* Then a ptr to the above located state entry is also written into state.

==== Cmd1 ====
No input, returns an output Event handle and an [[#IAsyncResult]].

The async task uses [[NIM_services|nim]] cmd2018 or cmd2027, depending on a state field. Once finished when a state flag is set, [[LDN_services|ldn]] is finalized and that state flag is cleared.

==== Cmd2 ====
No input, returns an output Event handle and an [[#IAsyncResult]].

The async task uses [[NIM_sevices|nim]] cmd2024.

=== IClientSession ===
This is "nn::ns::vphym::detail::IClientSession".

This was added with [20.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 ||
|-
| 1 ||
|-
| 2 ||
|}

==== Cmd0 ====
No input, returns an output Event handle and an [[#IAsyncValue]].

The async task does the following:
* Uses [[LDN_services|ldn]] Scan.
* After a [[LDN_services|NodeInfo]] is found with a matching UserName, the Ipv4Address for it is copied into state.
* If a timeout didn't occur and a valid NodeInfo was found, it proceeds with connecting to the network.

==== Cmd1 ====
No input, returns an output Event handle and an [[#IAsyncResult]].

The async task uses [[NIM_services|nim]] cmd2019 or cmd2028, depending on a state field. Once finished when a state flag is set, [[LDN_services|ldn]] is finalized and that state flag is cleared.

==== Cmd2 ====
No input, returns an output Event handle and an [[#IAsyncResult]].

This is identical to [[#IHostSession|IHostSession]] Cmd2.

=== IApplicationVersionInterface ===
This is "nn::ns::detail::IApplicationVersionInterface".

This was added with [4.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetLaunchRequiredVersion
|-
| 1 || UpgradeLaunchRequiredVersion
|-
| 35 || UpdateVersionList
|-
| 36 || PushLaunchVersion
|-
| 37 || ListRequiredVersion
|-
| 800 || RequestVersionList
|-
| 801 || ListVersionList
|-
| 802 || [[#RequestVersionListData]]
|-
| 900 || [12.0.0+] ImportAutoUpdatePolicyJsonForDebug
|-
| 901 || [12.0.0+] ListDefaultAutoUpdatePolicy
|-
| 902 || [12.0.0+] ListAutoUpdatePolicyForSpecificApplication
|-
| 1000 || PerformAutoUpdate
|-
| 1001 || [11.0.0+] ListAutoUpdateSchedule
|}

==== RequestVersionListData ====
No input, returns an output Event handle and an [[#IAsyncValue]].

The data that can be read from the [[#IAsyncValue]] is [[#VersionListData]].

=== IContentManagementInterface ===
This is "nn::ns::detail::IContentManagementInterface".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 11 || [[#CalculateApplicationOccupiedSize]]
|-
| 43 || [[#CheckSdCardMountStatus]]
|-
| 47 || [[#GetTotalSpaceSize]]
|-
| 48 || [[#GetFreeSpaceSize]]
|-
| 58 || [20.1.0+]
|-
| 71 || [20.1.0+]
|-
| 600 || [[#CountApplicationContentMeta]]
|-
| 601 || [[#ListApplicationContentMetaStatus]]
|-
| 605 || [[#ListApplicationContentMetaStatusWithRightsCheck]]
|-
| 607 || [[#IsAnyApplicationRunning]]
|-
| 608 || [21.0.0+]
|}

==== CalculateApplicationOccupiedSize ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output [[#ApplicationOccupiedSize]].

==== CheckSdCardMountStatus ====
No input/output.

==== CountApplicationContentMeta ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output s32.

==== ListApplicationContentMetaStatusWithRightsCheck ====
Same input/output as [[#ListApplicationContentMetaStatus]].

==== IsAnyApplicationRunning ====
No input, returns an output u8 bool.

=== IDocumentInterface ===
This is "nn::ns::detail::IDocumentInterface".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 21 || GetApplicationContentPath
|-
| 23 || ResolveApplicationContentPath
|-
| 92 || [5.0.0+] GetRunningApplicationProgramId
|-
| 100 || [S2]
|-
| 101 || [S2]
|-
| 2524 || [19.0.0+]
|}

==== Cmd100 ====
Takes a type-0x16 output buffer containing a 0x300-byte struct, an input u8, an u64. Returns two output u8s.

==== Cmd101 ====
Takes a type-0x16 output buffer containing a 0x300-byte struct, an input u8, an u64. Returns an output u8, an u8 [[Filesystem_services|ContentAttributes]], and a [[NCM_services#ProgramId|ProgramId]].

This is similar to Cmd2524. On [S2] this is used instead of Cmd2524.

==== Cmd2524 ====
Takes a type-0x16 output buffer containing a 0x300-byte struct, an input u8, an u64. Returns an output u8 [[Filesystem_services|ContentAttributes]] and a [[NCM_services#ProgramId|ProgramId]].

The user-process uses the output from this as the input for [[Filesystem_services|OpenFileSystemWithId]] (out-buffer is used as the [[Filesystem_services|FspPath]]).

=== IDownloadTaskInterface ===
This is "nn::ns::detail::IDownloadTaskInterface".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 701 || [[#ClearTaskStatusList]]
|-
| 702 || [[#RequestDownloadTaskList]]
|-
| 703 || [[#RequestEnsureDownloadTask]]
|-
| 704 || [[#ListDownloadTaskStatus]]
|-
| 705 || [[#RequestDownloadTaskListData]]
|-
| 706 || [4.0.0+] [[#TryCommitCurrentApplicationDownloadTask]]
|-
| 707 || [4.0.0+] [[#EnableAutoCommit]]
|-
| 708 || [4.0.0+] [[#DisableAutoCommit]]
|-
| 709 || [4.0.0+] [[#TriggerDynamicCommitEvent]]
|-
| 710 || [20.0.0+]
|}

==== ClearTaskStatusList ====
No input/output.

==== RequestDownloadTaskList ====
No input/output.

==== RequestEnsureDownloadTask ====
No input, returns an output Event handle and an [[#IAsyncResult]].

==== ListDownloadTaskStatus ====
Takes a type-0x6 output buffer containing an array of [[#DownloadTaskStatus]], returns an output s32 total_out.

A maximum of 0x100 tasks can be stored in state.

==== TryCommitCurrentApplicationDownloadTask ====
No input/output.

==== EnableAutoCommit ====
No input/output.

==== DisableAutoCommit ====
No input/output.

==== TriggerDynamicCommitEvent ====
No input/output.

=== IReadOnlyApplicationRecordInterface ===
This is "nn::ns::detail::IReadOnlyApplicationRecordInterface".

This was added with [5.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || HasApplicationRecord || Same as [[#IApplicationManagerInterface]] cmd 910
|-
| 1 || [10.0.0+] NotifyApplicationFailure ||
|-
| 2 || [10.0.0+] IsDataCorruptedResult ||
|-
| 3 || [20.0.0+] [[#ListApplicationRecord|ListApplicationRecord]] ||
|}

=== IReadOnlyApplicationControlDataInterface ===
This is "nn::ns::detail::IReadOnlyApplicationControlDataInterface".

This was added with [5.1.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || [[#GetApplicationControlData]] || Same as [[#IApplicationManagerInterface]] cmd 400
|-
| 1 || [[#GetApplicationDesiredLanguage]] || Same as [[#IApplicationManagerInterface]] cmd 55
|-
| 2 || ConvertApplicationLanguageToLanguageCode || Same as [[#IApplicationManagerInterface]] cmd 59
|-
| 3 || [[#ConvertLanguageCodeToApplicationLanguage]] || Same as [[#IApplicationManagerInterface]] cmd 60
|-
| 4 || [9.0.0+] SelectApplicationDesiredLanguage ||
|-
| 5 || [19.0.0+] || Same as [[#IApplicationManagerInterface]] cmd 411
|-
| 6 || [19.0.0+] || Same as [[#IApplicationManagerInterface]] cmd 416
|-
| 7 || [20.0.0+] || Same as [[#IApplicationManagerInterface]] cmd 921
|-
| 8 || [20.0.0+] || Same as [[#IApplicationManagerInterface]] cmd 922
|-
| 9 || [20.0.0+] || Same as [[#IApplicationManagerInterface]] cmd 923
|-
| 10 || [20.0.0+] || Same as [[#IApplicationManagerInterface]] cmd 421
|-
| 11 || [20.0.0+] || Same as [[#IApplicationManagerInterface]] cmd 422
|-
| 12 || [20.0.0+] || Same as [[#IApplicationManagerInterface]] cmd 423
|-
| 13 || [20.0.0+] || Same as [[#IApplicationManagerInterface]] cmd 407
|-
| 14 || [20.0.0+] || Same as [[#IApplicationManagerInterface]] cmd 408
|-
| 15 || [20.0.0+] || Same as [[#IApplicationManagerInterface]] cmd 415
|-
| 16 || [20.0.0+] ||
|-
| 17 || [20.1.0+] || Same as [[#IApplicationManagerInterface]] cmd 933
|-
| 18 || [21.0.0+] ||
|-
| 19 || [21.0.0+] ||
|-
| 20 || [21.0.0+] ||
|-
| 21 || [21.0.0+] ||
|-
| 22 || [21.0.0+] ||
|}

=== IDynamicRightsInterface ===
This is "nn::ns::detail::IDynamicRightsInterface".

This was added with [6.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#RequestApplicationRightsOnServer]]
|-
| 1 || [[#RequestAssignRights]]
|-
| 4 || [[#DeprecatedRequestAssignRightsToResume]]
|-
| 5 || [[#VerifyActivatedRightsOwners]]
|-
| 6 || [[#DeprecatedGetApplicationRightsStatus]]
|-
| 7 || [[#RequestPrefetchForDynamicRights]]
|-
| 8 || [[#GetDynamicRightsState]]
|-
| 9 || [7.0.0+] [[#RequestApplicationRightsOnServerToResume]]
|-
| 10 || [7.0.0+] [[#RequestAssignRightsToResume]]
|-
| 11 || [7.0.0+] [[#GetActivatedRightsUsers]]
|-
| 12 || [8.0.0+] [[#GetApplicationRightsStatus]]
|-
| 13 || [8.0.0+] [[#GetRunningApplicationStatus]]
|-
| 14 || [10.0.0-15.0.1] SelectApplicationLicense
|-
| 15 || [12.0.0+] [[#RequestContentsAuthorizationToken]]
|-
| 16 || [13.0.0+] QualifyUser
|-
| 17 || [13.0.0+] QualifyUserWithProcessId
|-
| 18 || [13.0.0+] NotifyApplicationRightsCheckStart
|-
| 19 || [13.0.0+] UpdateUserList
|-
| 20 || [13.0.0+] IsRightsLostUser
|-
| 21 || [13.1.0+] SetRequiredAddOnContentsOnContentsAvailabilityTransition
|-
| 22 || [14.0.0+] GetLimitedApplicationLicense
|-
| 23 || [14.0.0+] GetLimitedApplicationLicenseUpgradableEvent
|-
| 24 || [14.0.0+] NotifyLimitedApplicationLicenseUpgradableEventForDebug
|-
| 25 || [14.0.0+] RequestProceedDynamicRightsState
|-
| 26 || [18.0.0+] HasAccountRestrictedRightsInRunningApplications
|-
| 27 || [20.0.0+]
|-
| 28 || [20.0.0+]
|-
| 29 || [21.0.0+]
|-
| 30 || [21.0.0+]
|}

==== RequestApplicationRightsOnServer ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], an [[Account_services#Uid|Uid]] and an u32. Returns an output Event handle and an [[#IAsyncValue]].

==== RequestAssignRights ====
Takes a type-0x5 input buffer containing an array of "nn::ns::ApplicationRightsOnServer". Returns an output Event handle and an [[#IAsyncResult]].

==== DeprecatedRequestAssignRightsToResume ====
Takes an input u64 "nn::ns::RightsEnvironmentHandle" and an [[Account_services#Uid|Uid]]. Returns an output Event handle and an [[#IAsyncResult]].

==== VerifyActivatedRightsOwners ====
Takes an input u64 "nn::ns::RightsEnvironmentHandle". No output.

==== DeprecatedGetApplicationRightsStatus ====
Takes an input u64 "nn::ns::RightsEnvironmentHandle". Returns a bool "nn::ns::ApplicationRightsStatus".

==== RequestPrefetchForDynamicRights ====
Takes an input [[Account_services#Uid|Uid]]. Returns an output Event handle and an [[#IAsyncResult]].

==== GetDynamicRightsState ====
No input. Returns a bool "nn::ns::DynamicRightsState".

==== RequestApplicationRightsOnServerToResume ====
Takes an input u64 "nn::ns::RightsEnvironmentHandle". Returns an output Event handle and an [[#IAsyncValue]].

==== RequestAssignRightsToResume ====
Takes an input u64 "nn::ns::RightsEnvironmentHandle". Returns an output Event handle and an [[#IAsyncResult]].

==== GetActivatedRightsUsers ====
Takes an input u64 "nn::ns::RightsEnvironmentHandle". Returns a bool, an u32 and a type-0x6 output buffer containing an array of [[Account_services#Uid|Uid]].

==== GetApplicationRightsStatus ====
Takes an input "nn::ns::RightsEnvironmentHandle". Returns 2 bools "nn::ns::ApplicationRightsStatus" and "nn::ns::ApplicationLicenseType".

==== GetRunningApplicationStatus ====
Takes an input u64 "nn::ns::RightsEnvironmentHandle". Returns an u32 "nn::ns::RunningApplicationStatus".

==== RequestContentsAuthorizationToken ====
Takes a total of 0x50-bytes of input, a type-0x5 input buffer. Returns an [[#IAsyncData_2|IAsyncData]] and an output handle.

==== IAsyncData ====
This is "nn::ns::detail::IAsyncData".

This was added with [12.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetSize
|-
| 1 || Get
|-
| 2 || Cancel
|-
| 3 || GetErrorContext
|}

=== IECommerceInterface===
This is "nn::ns::detail::IECommerceInterface".

This was added with [4.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#RequestLinkDevice]]
|-
| 1 || [6.0.0+] [[#RequestCleanupAllPreInstalledApplications]]
|-
| 2 || [6.0.0+] [[#RequestCleanupPreInstalledApplication]]
|-
| 3 || [6.0.0+] [[#RequestSyncRights]]
|-
| 4 || [6.0.0+] [[#RequestUnlinkDevice]]
|-
| 5 || [6.1.0+] [[#RequestRevokeAllELicense]]
|-
| 6 || [9.0.0+] [[#RequestSyncRightsBasedOnAssignedELicenses]]
|-
| 7 || [14.0.0+] RequestOnlineSubscriptionFreeTrialAvailability
|-
| 8 || [20.0.0+]
|-
| 9 || [20.0.0+]
|-
| 10 || [20.0.0+]
|-
| 11 || [20.0.0+]
|-
| 12 || [20.0.0+]
|-
| 13 || [20.0.0+]
|-
| 14 || [21.0.0+]
|}

==== RequestLinkDevice ====
Takes an input [[Account_services#Uid|Uid]], returns an output Event handle and an [[#IAsyncResult]].

See [[#RequestApplicationUpdateInfo]] regarding nifm.

==== RequestCleanupAllPreInstalledApplications ====
No input, returns an output Event handle and an [[#IAsyncResult]].

==== RequestCleanupPreInstalledApplication ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output Event handle and an [[#IAsyncResult]].

==== RequestSyncRights ====
No input, returns an output Event handle and an [[#IAsyncResult]].

==== RequestUnlinkDevice ====
Takes an input [[Account_services#Uid|Uid]], returns an output Event handle and an [[#IAsyncResult]].

See [[#RequestApplicationUpdateInfo]] regarding nifm.

==== RequestRevokeAllELicense ====
Takes an input [[Account_services#Uid|Uid]], returns an output Event handle and an [[#IAsyncResult]].

==== RequestSyncRightsBasedOnAssignedELicenses ====
No input, returns an output Event handle and an [[#IAsyncResult]].

=== IFactoryResetInterface ===
This is "nn::ns::detail::IFactoryResetInterface".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 100 || [[#ResetToFactorySettings]]
|-
| 101 || [[#ResetToFactorySettingsWithoutUserSaveData]]
|-
| 102 || [[#ResetToFactorySettingsForRefurbishment]]
|-
| 103 || [9.1.0+] [[#ResetToFactorySettingsWithPlatformRegion]]
|-
| 104 || [9.1.0+] [[#ResetToFactorySettingsWithPlatformRegionAuthentication]]
|-
| 105 || [10.0.0+] [[#RequestResetToFactorySettingsSecurely]]
|-
| 106 || [10.0.0+] [[#RequestResetToFactorySettingsWithPlatformRegionAuthenticationSecurely]]
|-
| 107 || [20.0.0+]
|-
| 108 || [20.0.0+]
|}

==== ResetToFactorySettings ====
No input/output.

As of [9.1.0] this is the only [[#IFactoryResetInterface]] cmd used by [[qlaunch]].

==== ResetToFactorySettingsWithoutUserSaveData ====
No input/output.

==== ResetToFactorySettingsForRefurbishment ====
No input/output.

==== ResetToFactorySettingsWithPlatformRegion ====
No input/output.

==== ResetToFactorySettingsWithPlatformRegionAuthentication ====
No input/output.

==== RequestResetToFactorySettingsSecurely ====
Takes an input u64 tmem_size, a TransferMemory handle, returns an output [[#IAsyncValueAndProgress]] and an Event handle.

The TransferMemory uses permissions=0.

==== RequestResetToFactorySettingsWithPlatformRegionAuthenticationSecurely ====
Takes an input u32 "nn::ae::PlatformRegion", an u64 tmem_size, a TransferMemory handle, returns an output [[#IAsyncValueAndProgress]] and an Event handle.

The TransferMemory uses permissions=0.

===== IAsyncValueAndProgress =====
This is "nn::ns::detail::IAsyncValueAndProgress".

This was added with [10.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetSize
|-
| 1 || Get
|-
| 2 || Cancel
|-
| 3 || GetErrorContext
|-
| 4 || GetProgress
|}

=== IApplicationResource ===
This is "nn::ns::detail::IApplicationResource".

This was added with [9.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Attach
|-
| 1 || BoostSystemMemoryResourceLimit
|}

= ns:vm =
This is "nn::ns::detail::IVulnerabilityManagerInterface".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 1200 || [3.0.0+] [[#NeedsUpdateVulnerability]]
|-
| 1201 || [4.0.0+] [[#UpdateSafeSystemVersionForDebug]]
|-
| 1202 || [4.0.0+] [[#GetSafeSystemVersion]]
|-
| 3100 || [18.0.0+] [[#GetSafeSystemVersionCheckInfo|GetSafeSystemVersionCheckInfo]]
|-
| 3101 || [18.0.0+] [[#RequestUpdateSafeSystemVersionCheckInfo|RequestUpdateSafeSystemVersionCheckInfo]]
|-
| 3102 || [18.0.0+] [[#ResetSafeSystemVersionCheckInfo|ResetSafeSystemVersionCheckInfo]]
|}

== NeedsUpdateVulnerability ==
No input, returns an output u8 bool flag.

[S1] Web-applets use this command to check if the system needs an update.

== UpdateSafeSystemVersionForDebug ==
Takes an input u32 '''version''' and an [[NCM_services#ApplicationId|ApplicationId]].

This command is not available for retail units. On a debug unit, if the [[System_Settings|system setting]] <code>vulnerability!enable_debug</code> is set, this mounts the system savegame [[Flash_Filesystem#System_Savegames|0x8000000000000049]] as "ns_ssversion:/", opens the file "ns_ssversion:/entry" and writes the supplied [[NCM_services#ApplicationId|ApplicationId]] and '''version''' in it.

Finally, it calls [[NCM_services#ncm|OpenContentMetaDatabase]] with [[NCM_services#StorageId|StorageId]] 3, then calls [[NCM_services#IContentMetaDatabase|GetLatestContentMetaKey]] with the supplied [[NCM_services#ApplicationId|ApplicationId]] and compares the version field from the returned [[CNMT#Content_Meta_Records|Content Meta Record]] with the supplied '''version'''.

If the supplied '''version''' is higher than the one in NCM's database, the value returned by [[NS_Services#NeedsUpdateVulnerability|NeedsUpdateVulnerability]] is set to "true".

== GetSafeSystemVersion ==
No input, returns an output [[NCM_services#ContentMetaKey|ContentMetaKey]] with the cached contents of "ns_ssversion:/entry" ([[NCM_services#ApplicationId|ApplicationId]], u32 '''version''' and u32 '''policy''' from <code>vulnerability!needs_update_vulnerability_policy</code>).

== GetSafeSystemVersionCheckInfo ==
No input, returns 0x10-bytes of output.

[S2] Used by web-applets via ns:vm.

== RequestUpdateSafeSystemVersionCheckInfo ==
No input, returns an output Event handle and an [[#IAsyncResult|IAsyncResult]].

[S2] Used by web-applets via ns:vm.

The async task thread uses [[NIM_services|nim]] RequestCheckSafeSystemVersion, etc.

== ResetSafeSystemVersionCheckInfo ==
No input/output.

This throws an error if [[Settings_services|GetDebugModeFlag]] returns false.

= ns:su =
This is "nn::ns::detail::ISystemUpdateInterface".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#GetBackgroundNetworkUpdateState]]
|-
| 1 || [[#OpenSystemUpdateControl]]
|-
| 2 || [[#NotifyExFatDriverRequired]]
|-
| 3 || [[#ClearExFatDriverStatusForDebug]]
|-
| 4 || [[#RequestBackgroundNetworkUpdate]]
|-
| 5 || [[#NotifyBackgroundNetworkUpdate]]
|-
| 6 || [[#NotifyExFatDriverDownloadedForDebug]]
|-
| 9 || [[#GetSystemUpdateNotificationEventForContentDelivery]]
|-
| 10 || [[#NotifySystemUpdateForContentDelivery]]
|-
| 11 || [3.0.0+] [[#PrepareShutdown]]
|-
| 12 || [3.0.0-3.0.2]
|-
| 13 || [3.0.0-3.0.2]
|-
| 14 || [3.0.0-3.0.2]
|-
| 15 || [3.0.0-3.0.2]
|-
| 16 || [4.0.0+] [[#DestroySystemUpdateTask]]
|-
| 17 || [4.0.0+] [[#RequestSendSystemUpdate]]
|-
| 18 || [4.0.0+] [[#GetSendSystemUpdateProgress]]
|-
| 19 || [S2]
|-
| 20 || [S2]
|}

== GetBackgroundNetworkUpdateState ==
No input, returns an output [[#BackgroundNetworkUpdateState]].

This is similar to [[#HasDownloaded]], see [[#BackgroundNetworkUpdateState]].

== OpenSystemUpdateControl ==
No input, returns an [[#ISystemUpdateControl]].

Only 1 ISystemUpdateControl can be open at a time.

== NotifyExFatDriverRequired ==
No input/output.

Only usable when an [[#ISystemUpdateControl]] isn't open.

This uses [[NIM_services|nim]] ListSystemUpdateTask, then when a task is returned uses it with DestroySystemUpdateTask.

Then this runs ExFat handling, updates state, and sets the same state flag as [[#RequestBackgroundNetworkUpdate]].

== ClearExFatDriverStatusForDebug ==
No input/output.

== RequestBackgroundNetworkUpdate ==
No input/output.

Only usable when an [[#ISystemUpdateControl]] isn't open.

This sets a state flag to value 1.

== NotifyBackgroundNetworkUpdate ==
Takes an input [[NCM_services#ContentMetaKey|ContentMetaKey]], no output.

This checks whether a sysupdate is needed with the input ContentMetaKey using [[NCM_services|NCM]] commands, if not this will just return 0. Otherwise, this will then run code which is identical to [[#RequestBackgroundNetworkUpdate]].

== NotifyExFatDriverDownloadedForDebug ==
No input/output.

== GetSystemUpdateNotificationEventForContentDelivery ==
No input, returns an output Event handle with EventClearMode=0.

== NotifySystemUpdateForContentDelivery ==
No input/output.

Signals the Event returned by [[#GetSystemUpdateNotificationEventForContentDelivery]].

== PrepareShutdown ==
No input/output.

This is used by [[AM_services|AM]].

Just returns 0 when an [[#ISystemUpdateControl]] is open.

This does various cleanup / uses various service-cmds etc for shutdown preparation.

== DestroySystemUpdateTask ==
No input/output.

Only usable when an [[#ISystemUpdateControl]] isn't open.

This uses [[NIM_services|nim]] ListSystemUpdateTask, then when a task is returned uses it with DestroySystemUpdateTask.

== RequestSendSystemUpdate ==
Takes a type-0x15 input buffer containing a [[#SystemDeliveryInfo]], an u16 port, an u32 Ipv4Address, returns an output Event handle and an [[#IAsyncResult]].

[[qlaunch]] uses value 55556 for the port. IP is normally a local-WLAN address, however this can be any address. port/addr are little-endian.

See [[NIM_services|nim]] regarding the input addr/port usage, etc.

[11.0.0+] An error is thrown if LocalContentShare is not [[#IsLocalContentShareEnabled|enabled]].

This validates the [[#SystemDeliveryInfo]] and generates a [[NCM_services#ContentMetaKey|ContentMetaKey]] from that, and creates the [[#IAsyncResult]] + the async thread which handles the [[#IAsyncResult]] operation.

The above validation verifies that the HMAC and SystemDeliveryProtocolVersion are valid. The OldSystemUpdateId ([20.0.0+] SystemUpdateId, SystemUpdateIdFlag ignored) must match the Id for the installed SystemUpdate as returned by [[NCM_services|ncm]].

Then the thread does:
* Calls a func which does:
** Uses [[NIM_services|nim]] CreateLocalCommunicationSendSystemUpdateTask, returning the Result on failure.
*** The input firmware_variation is from the [[#SystemDeliveryInfo|FirmwareVariationId]].
** Uses [[NIM_services|nim]] RequestLocalCommunicationSendSystemUpdateTaskRun, returning the Result on failure. Waits for the IAsyncResult operation from this to finish, then uses the Get cmd to get the output Result.
*** When the Result from Get is an error, a func is called for filling in the [[#IAsyncResult|IAsyncResult]] ErrorContext with Type4.
** Handles cleanup and returns.
* Unlike [[#RequestReceiveSystemUpdate]], this doesn't save a SystemPlayReport.

== GetSendSystemUpdateProgress ==
No input, returns an output [[#SystemUpdateProgress]].

Same as [[#GetReceiveProgress]] except this uses nim ListLocalCommunicationSendSystemUpdateTask and GetLocalCommunicationSendSystemUpdateTaskInfo. The data copied to output is also swapped: u64 nim_out+0x8 is copied to out+0x8, and u64 nim_out+0x10 is copied to out+0x0.

== Cmd19 ==
This is exclusive to S2.

No input/output.

== Cmd20 ==
This is exclusive to S2.

No input, returns an output u8.

== ISystemUpdateControl ==
This is "nn::ns::detail::ISystemUpdateControl".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#HasDownloaded]]
|-
| 1 || [[#RequestCheckLatestUpdate]]
|-
| 2 || [[#RequestDownloadLatestUpdate]]
|-
| 3 || [[#GetDownloadProgress]]
|-
| 4 || [[#ApplyDownloadedUpdate]]
|-
| 5 || [[#RequestPrepareCardUpdate]]
|-
| 6 || [[#GetPrepareCardUpdateProgress]]
|-
| 7 || [[#HasPreparedCardUpdate]]
|-
| 8 || [[#ApplyCardUpdate]]
|-
| 9 || [[#GetDownloadedEulaDataSize]]
|-
| 10 || [[#GetDownloadedEulaData]]
|-
| 11 || [[#SetupCardUpdate]]
|-
| 12 || [[#GetPreparedCardUpdateEulaDataSize]]
|-
| 13 || [[#GetPreparedCardUpdateEulaData]]
|-
| 14 || [4.0.0+] [[#SetupCardUpdateViaSystemUpdater]]
|-
| 15 || [4.0.0+] [[#HasReceived]]
|-
| 16 || [4.0.0+] [[#RequestReceiveSystemUpdate]]
|-
| 17 || [4.0.0+] [[#GetReceiveProgress]]
|-
| 18 || [4.0.0+] [[#ApplyReceivedUpdate]]
|-
| 19 || [4.0.0+] [[#GetReceivedEulaDataSize]]
|-
| 20 || [4.0.0+] [[#GetReceivedEulaData]]
|-
| 21 || [4.0.0+] [[#SetupToReceiveSystemUpdate]]
|-
| 22 || [6.0.0+] [[#RequestCheckLatestUpdateIncludesRebootlessUpdate]]
|}

All Card cmds except SetupCardUpdate* require [[#SetupCardUpdate]]/[[#SetupCardUpdateViaSystemUpdater]] to be used previously. [[#GetPreparedCardUpdateEulaDataSize]]/[[#GetPreparedCardUpdateEulaData]] checks a different state flag.

=== HasDownloaded ===
No input, returns an output u8 bool flag.

Gets whether a network sysupdate was downloaded, with install pending.

Uses [[NIM_services|nim]] ListSystemUpdateTask and [[NIM_services|nim]] GetSystemUpdateTaskInfo. When ListSystemUpdateTask successfully returns a task and GetSystemUpdateTaskInfo is successful, the output flag is set to: <code>*((u8*)(taskinfo+0) == 0x3</code>. Otherwise, flag=0.

This always returns 0, however this will assert if GetSystemUpdateTaskInfo fails with ret!=0x3C89.

=== RequestCheckLatestUpdate ===
No input, returns an output Event handle and an [[#IAsyncValue]].

The data that can be read from the [[#IAsyncValue]] is [[#LatestSystemUpdate]].

=== RequestDownloadLatestUpdate ===
No input, returns an output Event handle and an [[#IAsyncResult]].

=== GetDownloadProgress ===
No input, returns an output [[#SystemUpdateProgress]].

Similar to [[#HasDownloaded]] except instead of a flag, this returns the 0x10-bytes from taskinfo+8. The output struct is cleared when the task(info) isn't available.

=== ApplyDownloadedUpdate ===
No input/output.

Runs code similar to [[#HasDownloaded]], throwing an error if a network sysupdate isn't ready for install. Then the sysupdate is installed:

* Uses ListSystemUpdateTask again, then [[NIM_services|nim]] IsExFatDriverIncluded. Runs ExFat handling when the output flag is set.
* On newer system-versions, this uses [[NIM_services|nim]] GetSystemUpdateTaskInfo then on success uses data from there to save a SystemPlayReport when the cached [[System_Settings|system-setting]] "systemreport!enabled" is set.
** The EventId is "systemupdate_dl_throughput" with ApplicationId 0100000000001018.
** The following fields are added to the report, see [[NIM_services#SystemUpdateTaskInfo|nim SystemUpdateTaskInfo]]: "ContentMetaId", "Version", "DownloadSize", and "ThroughputKBps".
* On newer system-versions, this saves another SystemPlayReport when a state flag is set (same flag mentioned above).
** The EventId is "systemupdate_pass" with ApplicationId 0100000000001021.
** This report has the following fields:
*** "Type"
*** "SourceSystemUpdateMetaId"
*** "SourceSystemUpdateMetaVersion"
*** "SourceExFatStatus"
*** "DestinationSystemUpdateMetaId"
*** "DestinationSystemUpdateMetaVersion"
*** "DestinationExFatStatus"
*** "Rebootless"
* Since BootImagePackage will be installed later, the two flags in [[Flash_Filesystem#System_Update_Control]] are set to 1.
* Uses [[NIM_services|nim]] CommitSystemUpdateTask and [[NIM_services|nim]] DestroySystemUpdateTask.
* Installs BootImagePackage. After installing each BootImagePackage, the associated flag in [[Flash_Filesystem#System_Update_Control]] is set to 0.
* On newer system versions when an input flag is set, this uses [[Filesystem_services|NotifySystemDataUpdateEvent]], however this doesn't happen with ApplyDownloadedUpdate since that input flag is 0.

=== RequestPrepareCardUpdate ===
No input, returns an output Event handle and an [[#IAsyncResult]].

=== GetPrepareCardUpdateProgress ===
No input, returns an output [[#SystemUpdateProgress]].

=== HasPreparedCardUpdate ===
No input, returns an output u8 bool flag.

=== ApplyCardUpdate ===
No input/output.

=== GetDownloadedEulaDataSize ===
Takes a type-0x15 input buffer [[#EulaDataPath]], returns an output u64 '''filesize'''.

Runs code similar to [[#HasDownloaded]], throwing an error if a network sysupdate isn't ready for install.

Uses ListSystemUpdateTask again. Then [[NIM_services|nim]] GetDownloadedSystemDataPath, with the output ContentPath being used to mount the EULA title with FS.

Then "<mountname>:/<[[#EulaDataPath]]>" is opened, gets the '''filesize''', then runs cleanup.

=== GetDownloadedEulaData ===
Takes a type-0x15 input buffer [[#EulaDataPath]] and a type-0x6 output buffer, returns an output u64 '''filesize'''.

Similar to [[#GetDownloadedEulaDataSize]] except this reads the file instead, using the specified output buffer with size=filesize. This will throw an error if the filesize is larger than the buffer size.

=== SetupCardUpdate ===
Takes an input u64 size and a TransferMemory handle, no output.

Official sw creates the TransferMemory with an user-specified buffer, with permissions=None.

[[qlaunch]] uses size 0x100000 for the TransferMemory buffer.

=== GetPreparedCardUpdateEulaDataSize ===
Takes a type-0x15 input buffer [[#EulaDataPath]], returns an output u64 '''filesize'''.

This is similar to [[#GetDownloadedEulaDataSize]].

=== GetPreparedCardUpdateEulaData ===
Takes a type-0x15 input buffer [[#EulaDataPath]] and a type-0x6 output buffer, returns an output u64 '''filesize'''.

This is similar to [[#GetDownloadedEulaData]].

=== SetupCardUpdateViaSystemUpdater ===
Takes an input u64 size and a TransferMemory handle, no output.

The permissions for the TransferMemory is None.

Same as [[#SetupCardUpdate]], except this doesn't have the code for [[Filesystem_services|GetGameCardHandle/GetGameCardUpdatePartitionInfo]], and uses [[Filesystem_services|OpenRegisteredUpdatePartition]] instead of [[Filesystem_services|OpenGameCardFileSystem]]. This uses the same is_initialized bool state flag.

=== HasReceived ===
No input, returns an output u8 bool.

Same as [[#HasDownloaded]] except this uses [[NIM_services|nim]] ListLocalCommunicationReceiveSystemUpdateTask and GetLocalCommunicationReceiveSystemUpdateTaskInfo.

=== RequestReceiveSystemUpdate ===
Takes a type-0x15 input buffer containing a [[#SystemDeliveryInfo]], an u16 port, an u32 Ipv4Address, returns an output Event handle and an [[#IAsyncResult]].

[[qlaunch]] uses the same value for the port as [[#RequestSendSystemUpdate]] (see [[#RequestSendSystemUpdate]] for addr as well).

See [[NIM_services|nim]] regarding the input addr/port usage, etc.

This uses the same LocalContentShare check as [[#RequestSendSystemUpdate|RequestSendSystemUpdate]].

An error is thrown if a state flag is clear.

This validates the [[#SystemDeliveryInfo]] (same as [[#RequestSendSystemUpdate|RequestSendSystemUpdate]]) and generates a [[NCM_services#ContentMetaKey|ContentMetaKey]] from that, and creates the [[#IAsyncResult]] + the async thread which handles the [[#IAsyncResult]] operation.

Then the thread does:

* Calls a func which does:
** Throws an error if [[NIM_services#ListSystemUpdateTask|ListSystemUpdateTask]] returns any task.
** Checks whether a sysupdate is actually required using the previously generated [[NCM_services#ContentMetaKey|ContentMetaKey]] (this func is also passed the below statefield as the last param), throwing an error if not.
*** [20.0.0+] The above check-sysupdate func was updated (which is also used elsewhere), flag handling during the loop was updated (which uses the last input param).
** Uses [[NIM_services|nim]] CreateLocalCommunicationReceiveSystemUpdateTask, returning the Result on failure.
*** The input firmware_variation is from [[System_Settings|system-setting]] <code>ns.systemupdate!firmware_variation</code> or <code>ns.systemupdate!t_firmware_variation</code>, depending on the [[Settings_services|PlatformRegion]] (value 0xFF is used when the output setting-size is invalid).
*** The input '''unk''' is set to: <code>unk = statefield == 0 ? 0x4 : 0xC</code> ([20.0.0+] uses statefield & 1 == 0). [20.0.0+] Additional data is now ORRed with unk afterwards: <code>unk |= ((statefield>>1) & 0x3) << 8;</code> (same statefield as before)
** Uses [[NIM_services|nim]] RequestLocalCommunicationReceiveSystemUpdateTaskRun, returning the Result on failure. Waits for the IAsyncResult operation from this to finish, then uses the Get cmd to get the output Result.
*** When the Result from Get is an error, a func is called for filling in the [[#IAsyncResult|IAsyncResult]] ErrorContext with Type4.
** Handles cleanup and returns.
* On success, this loads various data which is then used for saving a SystemPlayReport when the cached [[System_Settings|system-setting]] "systemreport!enabled" is set.
** The EventId is "receive_system_update" with ApplicationId <NS ProgramId>.
** This report has the following fields:
*** "SourceSystemUpdateId"
*** "DestinationSystemUpdateId"
*** "SourceSystemUpdateVersion"
*** "DestinationSystemUpdateVersion"
*** "SenderFirmwareVariationId"
*** "ReceiverFirmwareVariationId"
*** "SenderPlatformRegion"
*** "ReceiverPlatformRegion"
*** "SenderHasExFat"
*** "ReceiverHasExFat"
*** "Size"
*** "ThroughputKBps"

=== GetReceiveProgress ===
No input, returns an output [[#SystemUpdateProgress]].

Same as [[#GetDownloadProgress]] except this uses [[NIM_services|nim]] ListLocalCommunicationReceiveSystemUpdateTask and GetLocalCommunicationReceiveSystemUpdateTaskInfo.

=== ApplyReceivedUpdate ===
No input/output.

This uses the same LocalContentShare check as [[#RequestSendSystemUpdate|RequestSendSystemUpdate]].

=== GetReceivedEulaDataSize ===
Takes a type-0x15 input buffer [[#EulaDataPath]], returns an output u64 '''filesize'''.

This is similar to [[#GetDownloadedEulaDataSize]].

=== GetReceivedEulaData ===
Takes a type-0x15 input buffer [[#EulaDataPath]] and a type-0x6 output buffer, returns an output u64 '''filesize'''.

This is similar to [[#GetDownloadedEulaData]].

=== SetupToReceiveSystemUpdate ===
No input/output.

This just uses [[NIM_services|nim]] ListSystemUpdateTask, then when a task is returned uses it with DestroySystemUpdateTask.

[[qlaunch]] uses this before [[#RequestReceiveSystemUpdate]].

=== RequestCheckLatestUpdateIncludesRebootlessUpdate ===
No input, returns an output Event handle and an [[#IAsyncValue]].

= IAsyncValue =
This is "nn::ns::detail::IAsyncValue".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetSize
|-
| 1 || Get
|-
| 2 || Cancel
|-
| 3 || [4.0.0+] GetErrorContext
|}

Official sw creates a container object for this using the output from the service commands, which contains the IAsyncValue object, and the Event with EventClearMode=0.

* GetSize: No input, returns an output u64.
* Get: Takes a type-0x6 output buffer, no output. Official sw waits on the Event prior to using this cmd.
* Cancel: No input/output. Used by official sw when closing the object, when the serv-obj is initialized (after using the cmd, official sw will also wait on the Event). This cmd is also used in other official sw funcs.
* GetErrorContext: No input/output, takes a type-0x16 output buffer containing an [[Error_Applet#ErrorContext|ErrorContext]].

= IAsyncResult =
This is "nn::ns::detail::IAsyncResult".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Get
|-
| 1 || Cancel
|-
| 2 || [4.0.0+] GetErrorContext
|}

Official sw creates a container object for this using the output from the service commands, which contains the IAsyncResult object, and the Event with EventClearMode=0.

* Get: No input/output. Official sw waits on the Event prior to using this cmd.
* Cancel: No input/output. Used by official sw when closing the object, when the serv-obj is initialized (after using the cmd, official sw will also wait on the Event). This cmd is also used in other official sw funcs.
* GetErrorContext: No input/output, takes a type-0x16 output buffer containing an [[Error_Applet#ErrorContext|ErrorContext]].

= ns:dev =
This is "nn::ns::detail::IDevelopInterface".

[10.0.0+] Some of these cmds were replaced by the [[PGL_services|pgl]] system module.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [1.0.0-9.2.0] [[#LaunchProgram]]
|-
| 1 || [[#TerminateProcess]]
|-
| 2 || [1.0.0-9.2.0] [[#TerminateProgram]]
|-
| 4 || [1.0.0-9.2.0] [[#GetShellEvent]]
|-
| 5 || [1.0.0-9.2.0] [[#GetShellEventInfo]]
|-
| 6 || [[#TerminateApplication]]
|-
| 7 || [1.0.0-9.2.0] [[#PrepareLaunchProgramFromHost]]
|-
| 8 || [10.0.0-17.0.1] [[#LaunchApplicationFromHost]] ([1.0.0-9.2.0] LaunchApplication)
|-
| 9 || [1.0.0-17.0.1] [[#LaunchApplicationWithStorageId]]
|-
| 10 || [6.0.0-8.1.0] [[#IsSystemMemoryResourceLimitBoosted]]
|-
| 11 || [6.0.0+] [[#GetRunningApplicationProcessId]]
|-
| 12 || [6.0.0+] [[#SetCurrentApplicationRightsEnvironmentCanBeActive]]
|-
| 13 || [9.0.0+] [[#CreateApplicationResource]]
|-
| 14 || [9.0.0+] [[#IsPreomia]]
|-
| 15 || [10.0.0-17.0.1] [[#GetApplicationProgramIdFromHost]]
|-
| 16 || [12.0.0+] RefreshCachedDebugValues
|-
| 17 || [12.0.0+] [[#PrepareLaunchApplicationFromHost]]
|-
| 18 || [12.0.0+] [[#GetLaunchEvent]]
|-
| 19 || [12.0.0+] [[#GetLaunchResult]]
|-
| 20 || [14.0.0+] GetProgramId
|-
| 21 || [18.0.0+] [[#PrepareLaunchApplication]]
|-
| 22 || [18.0.0+] [[#LaunchApplication]]
|-
| 23 || [18.0.0+] [[#GetProgramIdByApplicationLaunchInfo]]
|-
| 24 || [18.0.0+] DestroyApplicationLaunchPreparation
|}

== LaunchProgram ==
Wrapper for "pm:shell" [[Process_Manager_services#pm:shell|LaunchProcess]].

== TerminateProcess ==
Wrapper for "pm:shell" [[Process_Manager_services#pm:shell|TerminateProcess]].

== TerminateProgram ==
Wrapper for "pm:shell" [[Process_Manager_services#pm:shell|TerminateProgram]].

== GetShellEvent ==
Wrapper for "pm:shell" [[Process_Manager_services#pm:shell|GetProcessEventHandle]].

== GetShellEventInfo ==
Wrapper for "pm:shell" [[Process_Manager_services#pm:shell|GetProcessEventInfo]].

== TerminateApplication ==
Calls "pm:shell" [[Process_Manager_services#pm:shell|GetApplicationProcessIdForShell]] and sends the ProcessId to [[Process_Manager_services#pm:shell|TerminateProcess]].

== PrepareLaunchProgramFromHost ==
Takes a type-0x5 input buffer containing the [[Filesystem_services#FspPath|FspPath]], returns an output 0x10-byte struct.

Calls [[NCM_services#IPathResolverForStorage|IPathResolverForStorage]] Set...NcaPath functions.

== LaunchApplicationFromHost ==
Takes an input u32 [[Process_Manager_services#LaunchFlags|LaunchFlags]] and a type-0x5 input buffer containing the [[Filesystem_services#FspPath|FspPath]]. Returns an output u64 ProcessId.

== LaunchApplicationWithStorageId ==
Takes 2 input u8 [[NCM_services#StorageId|StorageIds]], an u32 [[Process_Manager_services#LaunchFlags|LaunchFlags]], and an [[NCM_services#ApplicationId|ApplicationId]]. Returns an output u64 ProcessId.

Launches an application title which is registered with NS.

== IsSystemMemoryResourceLimitBoosted ==
No input. Returns a bool.

== GetRunningApplicationProcessId ==
Returns an output u64 ProcessId.

== SetCurrentApplicationRightsEnvironmentCanBeActive ==
Takes an input bool. No output.

== CreateApplicationResource ==
Takes an input u32 (1 = Preomia/MicroApplication). Returns an [[#IApplicationResource]].

== IsPreomia ==
Takes an input u64 [[NCM_services#ProgramId|ProgramId]]. Returns a bool.

== GetApplicationProgramIdFromHost ==
Takes a type-0x5 input buffer containing the [[Filesystem_services#FspPath|FspPath]]. Returns an u64 [[NCM_services#ProgramId|ProgramId]].

== PrepareLaunchApplicationFromHost ==
[18.0.0+] Now returns a total of 0x50 bytes of output.

[19.0.0+] Now returns a total of 0x80 bytes of output.

== GetLaunchEvent ==
[18.0.0+] Now takes a total of 0x50 bytes of input.

[19.0.0+] Now takes a total of 0x80 bytes of input.

== GetLaunchResult ==
[18.0.0+] Now takes a total of 0x50 bytes of input.

[19.0.0+] Now takes a total of 0x80 bytes of input.

== PrepareLaunchApplication ==
Takes a total of 0x10-bytes of input. Returns a total of 0x50-bytes of output.

[19.0.0+] Now returns a total of 0x80-bytes of output.

== LaunchApplication ==
Takes a total of 0x50-bytes of input. Returns a total of 8-bytes of output.

[19.0.0+] Now takes a total of 0x80 bytes of input.

== GetProgramIdByApplicationLaunchInfo ==
Takes a total of 0x50-bytes of input. Returns a total of 8-bytes of output.

[19.0.0+] Now takes a total of 0x80 bytes of input.

= acc:su =
This is "nn::account::IAccountServiceForAdministrator".

[13.0.0+] This was moved from [[Account_services|account]].

This is only available when the output from [[Process_Manager_services|pm:bm]] GetBootMode is Normal/Maintenance.

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || GetUserCount ||
|-
| 1 || GetUserExistence ||
|-
| 2 || ListAllUsers ||
|-
| 3 || ListOpenUsers ||
|-
| 4 || GetLastOpenedUser ||
|-
| 5 || GetProfile || Returns an [[#IProfile]].
|-
| 6 || [3.0.0+] GetProfileDigest ||
|-
| 50 || [[#IsUserRegistrationRequestPermitted]] ||
|-
| 51 || TrySelectUserWithoutInteractionDeprecated ([1.0.0-18.1.0] [[#TrySelectUserWithoutInteraction]]) ||
|-
| 52 || [19.0.0+] TrySelectUserWithoutInteraction ||
|-
| 60 || [5.0.0-5.1.0] ListOpenContextStoredUsers ||
|-
| 99 || [6.0.0+] DebugActivateOpenContextRetention || No input, returns an [[#ISessionObject]].
|-
| 100 || GetUserRegistrationNotifier || Returns an [[#INotifier]].
|-
| 101 || GetUserStateChangeNotifier || Returns an [[#INotifier]].
|-
| 102 || GetBaasAccountManagerForSystemService || Returns an [[#IManagerForSystemService]].
|-
| 103 || GetBaasUserAvailabilityChangeNotifier || Returns an [[#INotifier]].
|-
| 104 || GetProfileUpdateNotifier || Returns an [[#INotifier]].
|-
| 105 || [4.0.0+] CheckNetworkServiceAvailabilityAsync || Returns an [[#IAsyncContext]].
|-
| 106 || [9.0.0+] GetProfileSyncNotifier ||
|-
| 110 || StoreSaveDataThumbnail ||
|-
| 111 || ClearSaveDataThumbnail ||
|-
| 112 || LoadSaveDataThumbnail ||
|-
| 113 || [5.0.0+] GetSaveDataThumbnailExistence ||
|-
| 120 || [10.0.0+] ListOpenUsersInApplication ||
|-
| 130 || [6.0.0+] ActivateOpenContextRetention || Takes a total of 0x8-bytes of input, returns an [[#ISessionObject]].
|-
| 140 || [6.0.0+] ListQualifiedUsers ||
|-
| 150 || [10.0.0-10.2.0] AuthenticateApplicationAsync ||
|-
| 151 || [12.0.0+] EnsureSignedDeviceIdentifierCacheForNintendoAccountAsync ||
|-
| 152 || [12.0.0+] LoadSignedDeviceIdentifierCacheForNintendoAccount ||
|-
| 170 || [13.0.0+] GetNasOp2MembershipStateChangeNotifier ||
|-
| 190 || [1.0.0-9.2.0] GetUserLastOpenedApplication ||
|-
| 191 || [7.0.0-19.0.1] UpdateNotificationReceiverInfo ([5.0.0-5.1.0] ActivateOpenContextHolder) ||
|-
| 200 || BeginUserRegistration ||
|-
| 201 || CompleteUserRegistration ||
|-
| 202 || CancelUserRegistration ||
|-
| 203 || DeleteUser ||
|-
| 204 || SetUserPosition ||
|-
| 205 || GetProfileEditor || Takes an input userID and returns an [[#IProfileEditor]].
|-
| 206 || CompleteUserRegistrationForcibly ||
|-
| 210 || [3.0.0+] CreateFloatingRegistrationRequest || Returns an [[#IFloatingRegistrationRequest]].
|-
| 211 || [8.0.0+] CreateProcedureToRegisterUserWithNintendoAccount || Takes a total of 0x4-bytes of input and a handle, returns an [[#IOAuthProcedureForUserRegistration]].
|-
| 212 || [8.0.0+] ResumeProcedureToRegisterUserWithNintendoAccount || Takes a total of 0x14-bytes of input and a handle, returns an [[#IOAuthProcedureForUserRegistration]].
|-
| 213 || [17.0.0+] CreateProcedureToCreateUserWithNintendoAccount ||
|-
| 214 || [17.0.0+] ResumeProcedureToCreateUserWithNintendoAccount ||
|-
| 215 || [17.0.0+] ResumeProcedureToCreateUserWithNintendoAccountAfterApplyResponse ||
|-
| 230 || AuthenticateServiceAsync || Returns an [[#IAsyncContext]].
|-
| 250 || GetBaasAccountAdministrator || Returns an [[#IAdministrator]].
|-
| 251 || [20.0.0+] SynchronizeNetworkServiceAccountsSnapshotAsync ||
|-
| 290 || ProxyProcedureForGuestLoginWithNintendoAccount || Returns an [[#IOAuthProcedureForExternalNsa]] (formerly [[#IOAuthProcedureForGuestLogin]] with [1.0.0-2.3.0]).
|-
| 291 || [3.0.0+] ProxyProcedureForFloatingRegistrationWithNintendoAccount || Returns an [[#IOAuthProcedureForExternalNsa]].
|-
| 292 || [20.0.0+] ProxyProcedureForDeviceMigrationAuthenticatingOperatingUser ||
|-
| 293 || [20.0.0+] ProxyProcedureForDeviceMigrationDownload ||
|-
| 299 || SuspendBackgroundDaemon || Returns an [[#ISessionObject]].
|-
| 350 || [20.0.0+] CreateDeviceMigrationUserExportRequest ||
|-
| 351 || [20.0.0+] UploadNasCredential ||
|-
| 352 || [20.0.0+] CreateDeviceMigrationUserImportRequest ||
|-
| 353 || [20.0.0+] DeleteUserMigrationSaveData ||
|-
| 400 || [18.0.0+] SetPinCode ||
|-
| 401 || [18.0.0+] GetPinCodeLength ||
|-
| 402 || [18.0.0-19.0.1] GetPinCode ||
|-
| 403 || [20.0.0+] GetPinCodeParity ||
|-
| 404 || [20.0.0+] VerifyPinCode ||
|-
| 405 || [20.0.0+] IsPinCodeVerificationForbidden ||
|-
| 410 || [18.0.0+] GetPinCodeErrorCount ||
|-
| 411 || [18.0.0-19.0.1] ResetPinCodeErrorCount ||
|-
| 412 || [18.0.0-19.0.1] IncrementPinCodeErrorCount ||
|-
| 413 || [20.0.0+] SetPinCodeErrorCount ||
|-
| 420 || [19.0.0+] SetStartPenaltyTime ||
|-
| 421 || [19.0.0+] GetStartPenaltyTime ||
|-
| 900 || [13.0.0+] SetUserUnqualifiedForDebug ||
|-
| 901 || [13.0.0+] UnsetUserUnqualifiedForDebug ||
|-
| 902 || [13.0.0+] ListUsersUnqualifiedForDebug ||
|-
| 910 || [16.0.0+] RefreshFirmwareSettingsForDebug ||
|-
| 997 || [3.0.0+] DebugInvalidateTokenCacheForUser ||
|-
| 998 || DebugSetUserStateClose ||
|-
| 999 || DebugSetUserStateOpen ||
|}

[10.0.0+] DebugSetUserStateClose/DebugSetUserStateOpen now takes an additional 8-bytes of input.

== IsUserRegistrationRequestPermitted ==
Takes a PID, an input u64 pid_reserved, and returns an output u8 bool.

== TrySelectUserWithoutInteraction ==
Takes an input u8 bool isNetworkServiceAccountRequired, returns an output Uid.

== IManagerForSystemService ==
This is "nn::account::baas::IManagerForSystemService".

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || CheckAvailability ||
|-
| 1 || GetAccountId ||
|-
| 2 || EnsureIdTokenCacheAsync || Returns an [[#IAsyncContext]].
|-
| 3 || [19.0.0+] LoadIdTokenCacheDeprecated ([1.0.0-18.1.0] LoadIdTokenCache) ||
|-
| 4 || [19.0.0+] LoadIdTokenCache ||
|-
| 100 || SetSystemProgramIdentification ||
|-
| 101 || RefreshNotificationTokenAsync ||
|-
| 110 || GetServiceEntryRequirementCacheForLogin ||
|-
| 111 || InvalidateServiceEntryRequirementCache ||
|-
| 113 || GetServiceEntryRequirementCacheForOnlinePlay || Takes a total of 0x8-bytes of input, returns a total of 0x4-bytes of output.
|-
| 120 || GetNintendoAccountId ||
|-
| 121 || CalculateNintendoAccountAuthenticationFingerprint ||
|-
| 130 || GetNintendoAccountUserResourceCache ||
|-
| 131 || RefreshNintendoAccountUserResourceCacheAsync || Returns an [[#IAsyncContext]].
|-
| 132 || RefreshNintendoAccountUserResourceCacheAsyncIfSecondsElapsed || Returns an [[#IAsyncContext]].
|-
| 133 || GetNintendoAccountVerificationUrlCache ||
|-
| 134 || RefreshNintendoAccountVerificationUrlCacheAsync ||
|-
| 135 || RefreshNintendoAccountVerificationUrlCacheAsyncIfSecondsElapsed ||
|-
| 136 || [19.0.0+] GetNintendoAccountUserResourceCache ||
|-
| 140 || GetNetworkServiceLicenseCache ||
|-
| 141 || RefreshNetworkServiceLicenseCacheAsync || Returns an [[#IAsyncContext]].
|-
| 142 || RefreshNetworkServiceLicenseCacheAsyncIfSecondsElapsed || Returns an [[#IAsyncContext]].
|-
| 143 || [15.0.0+] GetNetworkServiceLicenseCacheEx ||
|-
| 150 || CreateAuthorizationRequest || Returns an [[#IAuthorizationRequest]].
|-
| 160 || [15.0.0+] RequiresUpdateNetworkServiceAccountIdTokenCache ||
|-
| 161 || [16.0.0+] RequireReauthenticationOfNetworkServiceAccount ||
|-
| 180 || [18.0.0-19.0.1] GetRequestForNintendoAccountReauthentication ||
|-
| 181 || [20.0.0+] CreateProcedureToReauthenticateNintendoAccount ||
|-
| 182 || [20.0.0+] ResumeProcedureToReauthenticateNintendoAccount ||
|}

== IFloatingRegistrationRequest ==
This is "nn::account::baas::IFloatingRegistrationRequest".

Added with [3.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || GetSessionId ||
|-
| 12 || GetAccountId ||
|-
| 13 || GetLinkedNintendoAccountId ||
|-
| 14 || GetNickname ||
|-
| 15 || GetProfileImage ||
|-
| 16 || [18.0.0+] GetProfileLargeImage ||
|-
| 21 || LoadIdTokenCache ||
|-
| 100 || RegisterUser ([1.0.0-3.0.2] RegisterAsync) || [1.0.0-3.0.2] Used to return an [[#IAsyncContext]].
|-
| 101 || RegisterUserWithUid ([1.0.0-3.0.2] RegisterWithUidAsync) || [1.0.0-3.0.2] Used to return an [[#IAsyncContext]].
|-
| 102 || [4.0.0+] RegisterNetworkServiceAccountAsync || Returns an [[#IAsyncContext]].
|-
| 103 || [4.0.0+] RegisterNetworkServiceAccountWithUidAsync || Returns an [[#IAsyncContext]].
|-
| 110 || SetSystemProgramIdentification ||
|-
| 111 || EnsureIdTokenCacheAsync || Returns an [[#IAsyncContext]].
|}

== IAdministrator ==
This is "nn::account::baas::IAdministrator".

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || CheckAvailability ||
|-
| 1 || GetAccountId ||
|-
| 2 || EnsureIdTokenCacheAsync || Returns an [[#IAsyncContext]].
|-
| 3 || [19.0.0+] LoadIdTokenCacheDeprecated ([1.0.0-18.1.0] LoadIdTokenCache) ||
|-
| 4 || [19.0.0+] LoadIdTokenCache ||
|-
| 100 || SetSystemProgramIdentification ||
|-
| 101 || [7.0.0+] RefreshNotificationTokenAsync
|-
| 110 || [4.0.0+] GetServiceEntryRequirementCache ||
|-
| 111 || [4.0.0+] InvalidateServiceEntryRequirementCache ||
|-
| 112 || [4.0.0-6.2.0] InvalidateTokenCache ||
|-
| 113 || [6.1.0+] GetServiceEntryRequirementCacheForOnlinePlay || Takes a total of 0x8-bytes of input, returns a total of 0x4-bytes of output.
|-
| 120 || GetNintendoAccountId ||
|-
| 121 || [9.0.0+] CalculateNintendoAccountAuthenticationFingerprint ||
|-
| 130 || GetNintendoAccountUserResourceCache ||
|-
| 131 || RefreshNintendoAccountUserResourceCacheAsync || Returns an [[#IAsyncContext]].
|-
| 132 || RefreshNintendoAccountUserResourceCacheAsyncIfSecondsElapsed || Returns an [[#IAsyncContext]].
|-
| 133 || [9.0.0+] GetNintendoAccountVerificationUrlCache ||
|-
| 134 || [9.0.0+] RefreshNintendoAccountVerificationUrlCacheAsync ||
|-
| 135 || [9.0.0+] RefreshNintendoAccountVerificationUrlCacheAsyncIfSecondsElapsed ||
|-
| 136 || [19.0.0+] GetNintendoAccountUserResourceCache ||
|-
| 140 || [5.0.0+] GetNetworkServiceLicenseCache ||
|-
| 141 || [5.0.0+] RefreshNetworkServiceLicenseCacheAsync ||
|-
| 142 || [5.0.0+] RefreshNetworkServiceLicenseCacheAsyncIfSecondsElapsed ||
|-
| 143 || [15.0.0+] GetNetworkServiceLicenseCacheEx ||
|-
| 150 || CreateAuthorizationRequest || Returns an [[#IAuthorizationRequest]].
|-
| 160 || [15.0.0+] RequiresUpdateNetworkServiceAccountIdTokenCache ||
|-
| 161 || [16.0.0+] RequireReauthenticationOfNetworkServiceAccount ||
|-
| 180 || [18.0.0-19.0.1] GetRequestForNintendoAccountReauthentication ||
|-
| 181 || [20.0.0+] CreateProcedureToReauthenticateNintendoAccount ||
|-
| 182 || [20.0.0+] ResumeProcedureToReauthenticateNintendoAccount ||
|-
| 200 || IsRegistered ||
|-
| 201 || RegisterAsync || Returns an [[#IAsyncContext]].
|-
| 202 || UnregisterAsync || Returns an [[#IAsyncContext]].
|-
| 203 || DeleteRegistrationInfoLocally ||
|-
| 204 || [19.0.0-19.0.1] UnregisterDeviceAsync ||
|-
| 220 || SynchronizeProfileAsync || Returns an [[#IAsyncContext]].
|-
| 221 || UploadProfileAsync || Returns an [[#IAsyncContext]].
|-
| 222 || SynchronizeProfileAsyncIfSecondsElapsed || Returns an [[#IAsyncContext]].
|-
| 223 || [19.0.0+] DownloadProfileAsync ||
|-
| 250 || IsLinkedWithNintendoAccount ||
|-
| 251 || CreateProcedureToLinkWithNintendoAccount || Returns an [[#IOAuthProcedureForNintendoAccountLinkage]].
|-
| 252 || ResumeProcedureToLinkWithNintendoAccount || Returns an [[#IOAuthProcedureForNintendoAccountLinkage]].
|-
| 255 || CreateProcedureToUpdateLinkageStateOfNintendoAccount || Returns an [[#IOAuthProcedure]].
|-
| 256 || ResumeProcedureToUpdateLinkageStateOfNintendoAccount || Returns an [[#IOAuthProcedure]].
|-
| 260 || [3.0.0+] CreateProcedureToLinkNnidWithNintendoAccount || Returns an [[#IOAuthProcedure]].
|-
| 261 || [3.0.0+] ResumeProcedureToLinkNnidWithNintendoAccount || Returns an [[#IOAuthProcedure]].
|-
| 280 || ProxyProcedureToAcquireApplicationAuthorizationForNintendoAccount || Returns an [[#IOAuthProcedure]].
|-
| 290 || [8.0.0+] GetRequestForNintendoAccountUserResourceView ||
|-
| 300 || [6.0.0+] TryRecoverNintendoAccountUserStateAsync || Returns an [[#IAsyncContext]].
|-
| 400 || [6.1.0+] IsServiceEntryRequirementCacheRefreshRequiredForOnlinePlay || Takes a total of 0x8-bytes of input, returns an output u8.
|-
| 401 || [6.1.0+] RefreshServiceEntryRequirementCacheForOnlinePlayAsync || Takes a total of 0x8-bytes of input, returns an [[#IAsyncContext]].
|-
| 900 || [9.0.0+] GetAuthenticationInfoForWin ||
|-
| 901 || [9.0.0+] ImportAsyncForWin ||
|-
| 997 || DebugUnlinkNintendoAccountAsync || Returns an [[#IAsyncContext]].
|-
| 998 || DebugSetAvailabilityErrorDetail ||
|}

== IAuthorizationRequest ==
This is "nn::account::nas::IAuthorizationRequest".

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || GetSessionId ||
|-
| 10 || InvokeWithoutInteractionAsync || Returns an [[#IAsyncContext]].
|-
| 19 || IsAuthorized ||
|-
| 20 || GetAuthorizationCode ||
|-
| 21 || GetIdToken ||
|-
| 22 || GetState ||
|}

== IOAuthProcedure ==
This is "nn::account::http::IOAuthProcedure".

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || PrepareAsync || Returns an [[#IAsyncContext]].
|-
| 1 || GetRequest ||
|-
| 2 || ApplyResponse ||
|-
| 3 || ApplyResponseAsync || Returns an [[#IAsyncContext]].
|-
| 10 || Suspend ||
|}

== IOAuthProcedureForExternalNsa ==
This is "nn::account::nas::IOAuthProcedureForExternalNsa".

Added with [3.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || PrepareAsync || Returns an [[#IAsyncContext]].
|-
| 1 || GetRequest ||
|-
| 2 || ApplyResponse ||
|-
| 3 || ApplyResponseAsync || Returns an [[#IAsyncContext]].
|-
| 10 || Suspend ||
|-
| 100 || GetAccountId ||
|-
| 101 || GetLinkedNintendoAccountId ||
|-
| 102 || GetNickname ||
|-
| 103 || GetProfileImage ||
|-
| 104 || [18.0.0+] GetProfileLargeImage ||
|}

== IOAuthProcedureForNintendoAccountLinkage ==
This is "nn::account::nas::IOAuthProcedureForNintendoAccountLinkage".

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || PrepareAsync || Returns an [[#IAsyncContext]].
|-
| 1 || GetRequest ||
|-
| 2 || ApplyResponse ||
|-
| 3 || ApplyResponseAsync || Returns an [[#IAsyncContext]].
|-
| 10 || Suspend ||
|-
| 100 || GetRequestWithTheme ||
|-
| 101 || IsNetworkServiceAccountReplaced ||
|-
| 199 || [2.0.0-5.1.0] GetUrlForIntroductionOfExtraMembership ||
|-
| 200 || [16.0.0+] ApplyAsyncWithAuthorizedToken ||
|}

== INotifier ==
This is "nn::account::detail::INotifier".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetSystemEvent
|}

== IProfile ==
This is "nn::account::profile::IProfile".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Get]]
|-
| 1 || [[#GetBase]]
|-
| 10 || [[#GetImageSize]]
|-
| 11 || [[#LoadImage]]
|-
| 20 || [18.0.0+] GetLargeImageSize
|-
| 21 || [18.0.0+] LoadLargeImage
|-
| 30 || [18.0.0+] GetImageId
|}

=== Get ===
Takes an output type-0x1A buffer for [[#UserData]], returns an output [[#ProfileBase]].

=== GetBase ===
No input, returns an output [[#ProfileBase]].

=== GetImageSize ===
No input, returns an output u32 for the size of the image buffer.

=== LoadImage ===
Takes an output type-0x6 buffer, returns the same output u32 as [[#GetImageSize]].

The output buffer contains the JPEG profile image icon. This is valid for both Miis and character icons.

== IProfileEditor ==
This is "nn::account::profile::IProfileEditor".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Get]]
|-
| 1 || [[#GetBase]]
|-
| 10 || [[#GetImageSize]]
|-
| 11 || [[#LoadImage]]
|-
| 20 || [18.0.0+] GetLargeImageSize
|-
| 21 || [18.0.0+] LoadLargeImage
|-
| 30 || [18.0.0+] GetImageId
|-
| 100 || [[#Store]]
|-
| 101 || [[#StoreWithImage]]
|-
| 110 || [18.0.0+] StoreWithLargeImage
|}

=== Store ===
Takes a [[#ProfileBase]] and an input type-0x19 buffer for [[#UserData]].

=== StoreWithImage ===
Takes a [[#ProfileBase]], an input type-0x19 buffer for [[#UserData]], and an input type-0x5 buffer.

== IAsyncContext ==
This is "nn::account::detail::IAsyncContext".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetSystemEvent
|-
| 1 || Cancel
|-
| 2 || HasDone
|-
| 3 || GetResult
|}

== ISessionObject ==
This is "nn::account::detail::ISessionObject".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 999 || Dummy
|}

= acc:u0 =
This is "nn::account::IAccountServiceForApplication".

[13.0.0+] This was moved from [[Account_services|account]].

This is only available when the output from [[Process_Manager_services|pm:bm]] GetBootMode is Normal/Maintenance.

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || GetUserCount ||
|-
| 1 || GetUserExistence ||
|-
| 2 || ListAllUsers ||
|-
| 3 || ListOpenUsers ||
|-
| 4 || GetLastOpenedUser ||
|-
| 5 || GetProfile || Takes an input userID, returns an [[#IProfile]].
|-
| 6 || [3.0.0+] GetProfileDigest ||
|-
| 50 || [[#IsUserRegistrationRequestPermitted]] ||
|-
| 51 || TrySelectUserWithoutInteractionDeprecated ([1.0.0-18.1.0] [[#TrySelectUserWithoutInteraction]]) ||
|-
| 52 || [19.0.0+] TrySelectUserWithoutInteraction ||
|-
| 60 || [5.0.0-5.1.0] ListOpenContextStoredUsers ||
|-
| 99 || [6.0.0+] DebugActivateOpenContextRetention || No input, returns an [[#ISessionObject]].
|-
| 100 || [[#InitializeApplicationInfoV0]] ||
|-
| 101 || GetBaasAccountManagerForApplication || Takes an input userID, returns an [[#IManagerForApplication]].
|-
| 102 || AuthenticateApplicationAsync || Returns an [[#IAsyncContext]].
|-
| 103 || [4.0.0+] CheckNetworkServiceAvailabilityAsync || Returns an [[#IAsyncContext]].
|-
| 110 || StoreSaveDataThumbnail ||
|-
| 111 || ClearSaveDataThumbnail ||
|-
| 120 || CreateGuestLoginRequest || Returns an [[#IGuestLoginRequest]].
|-
| 130 || [5.0.0+] LoadOpenContext ||
|-
| 131 || [6.0.0+] ListOpenContextStoredUsers ||
|-
| 140 || [6.0.0+] [[#InitializeApplicationInfoV1]] ||
|-
| 141 || [6.0.0+] ListQualifiedUsers ||
|-
| 150 || [6.0.0+] IsUserAccountSwitchLocked ||
|-
| 160 || [13.0.0+] InitializeApplicationInfoV2 ||
|}

InitializeApplicationInfo* is used by the user-process during service init.

== InitializeApplicationInfoV0 ==
Takes a PID and an input u64 pid_placeholder, no output.

== InitializeApplicationInfoV1 ==
Takes a PID and an input u64 pid_placeholder, no output.

== IGuestLoginRequest ==
This is "nn::account::baas::IGuestLoginRequest".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetSessionId
|-
| 11 || [1.0.0-2.3.0]
|-
| 12 || GetAccountId
|-
| 13 || GetLinkedNintendoAccountId
|-
| 14 || GetNickname
|-
| 15 || GetProfileImage
|-
| 16 || [18.0.0+] GetProfileLargeImage
|-
| 21 || [3.0.0+] LoadIdTokenCache
|}

== IManagerForApplication ==
This is "nn::account::baas::IManagerForApplication".

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || CheckAvailability ||
|-
| 1 || GetAccountId ||
|-
| 2 || EnsureIdTokenCacheAsync || Returns an [[#IAsyncContext]].
|-
| 3 || LoadIdTokenCache ||
|-
| 130 || GetNintendoAccountUserResourceCacheForApplication ||
|-
| 150 || CreateAuthorizationRequest || Returns an [[#IAuthorizationRequest]].
|-
| 160 || [5.0.0+] StoreOpenContext ||
|-
| 170 || [13.0.0+] EnsureIdTokenCacheForOnlinePlayAsync ([6.0.0-12.1.0] LoadNetworkServiceLicenseKindAsync) || No input, returns an [[#IAsyncContextForLoginForOnlinePlay]] ([6.0.0-12.1.0] [[#IAsyncNetworkServiceLicenseKindContext]]).
|}

== IAsyncNetworkServiceLicenseKindContext ==
This is "nn::account::detail::IAsyncNetworkServiceLicenseKindContext".

This was added with [6.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || GetSystemEvent ||
|-
| 1 || Cancel ||
|-
| 2 || HasDone ||
|-
| 3 || GetResult ||
|-
| 100 || GetNetworkServiceLicenseKind ||
|}

== IAsyncContextForLoginForOnlinePlay ==
This is "nn::account::baas::IAsyncContextForLoginForOnlinePlay".

This was added with [13.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || GetSystemEvent ||
|-
| 1 || Cancel ||
|-
| 2 || HasDone ||
|-
| 3 || GetResult ||
|-
| 100 || GetNetworkServiceLicenseInfoForOnlinePlay ||
|}

= acc:u1 =
This is "nn::account::IAccountServiceForSystemService".

[13.0.0+] This was moved from [[Account_services|account]].

This is only available when the output from [[Process_Manager_services|pm:bm]] GetBootMode is Normal/Maintenance.

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || GetUserCount ||
|-
| 1 || GetUserExistence ||
|-
| 2 || ListAllUsers ||
|-
| 3 || ListOpenUsers ||
|-
| 4 || GetLastOpenedUser ||
|-
| 5 || GetProfile || Returns an [[#IProfile]].
|-
| 6 || [3.0.0+] GetProfileDigest ||
|-
| 50 || [[#IsUserRegistrationRequestPermitted]] ||
|-
| 51 || TrySelectUserWithoutInteractionDeprecated ([1.0.0-18.1.0] [[#TrySelectUserWithoutInteraction]]) ||
|-
| 52 || [19.0.0+] TrySelectUserWithoutInteraction ||
|-
| 60 || [5.0.0-5.1.0] ListOpenContextStoredUsers ||
|-
| 99 || [6.0.0+] DebugActivateOpenContextRetention || No input, returns an [[#ISessionObject]].
|-
| 100 || GetUserRegistrationNotifier || Returns an [[#INotifier]].
|-
| 101 || GetUserStateChangeNotifier || Returns an [[#INotifier]].
|-
| 102 || GetBaasAccountManagerForSystemService || Returns an [[#IManagerForSystemService]].
|-
| 103 || GetBaasUserAvailabilityChangeNotifier || Returns an [[#INotifier]].
|-
| 104 || GetProfileUpdateNotifier || Returns an [[#INotifier]].
|-
| 105 || [4.0.0+] CheckNetworkServiceAvailabilityAsync || Returns an [[#IAsyncContext]].
|-
| 106 || [9.0.0+] GetProfileSyncNotifier ||
|-
| 110 || StoreSaveDataThumbnail ||
|-
| 111 || ClearSaveDataThumbnail ||
|-
| 112 || LoadSaveDataThumbnail ||
|-
| 113 || [5.0.0+] GetSaveDataThumbnailExistence ||
|-
| 120 || [10.0.0+] ListOpenUsersInApplication ||
|-
| 130 || [6.0.0+] ActivateOpenContextRetention || Takes a total of 0x8-bytes of input, returns an [[#ISessionObject]].
|-
| 140 || [6.0.0+] ListQualifiedUsers ||
|-
| 150 || [10.0.0-10.2.0] AuthenticateApplicationAsync ||
|-
| 151 || [12.0.0+] EnsureSignedDeviceIdentifierCacheForNintendoAccountAsync ||
|-
| 152 || [12.0.0+] LoadSignedDeviceIdentifierCacheForNintendoAccount ||
|-
| 170 || [13.0.0+] GetNasOp2MembershipStateChangeNotifier ||
|-
| 190 || [1.0.0-9.2.0] GetUserLastOpenedApplication ||
|-
| 191 || [7.0.0-19.0.1] UpdateNotificationReceiverInfo ([5.0.0-5.1.0] ActivateOpenContextHolder) ||
|-
| 401 || [18.0.0+] GetPinCodeLength ||
|-
| 402 || [18.0.0-19.0.1] GetPinCode ||
|-
| 403 || [20.0.0+] GetPinCodeParity ||
|-
| 404 || [20.0.0+] VerifyPinCode ||
|-
| 405 || [20.0.0+] IsPinCodeVerificationForbidden ||
|-
| 997 || [3.0.0+] DebugInvalidateTokenCacheForUser ||
|-
| 998 || DebugSetUserStateClose ||
|-
| 999 || DebugSetUserStateOpen ||
|}

[10.0.0+] DebugSetUserStateClose/DebugSetUserStateOpen now takes an additional 8-bytes of input.

== IOAuthProcedureForUserRegistration ==
This is "nn::account::nas::IOAuthProcedureForUserRegistration".

This was added with [8.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || PrepareAsync || No input, returns an [[#IAsyncContext]].
|-
| 1 || GetRequest ||
|-
| 2 || ApplyResponse ||
|-
| 3 || ApplyResponseAsync || Takes a type-0x9 input buffer, returns an [[#IAsyncContext]].
|-
| 10 || Suspend ||
|-
| 100 || GetAccountId ||
|-
| 101 || GetLinkedNintendoAccountId ||
|-
| 102 || GetNickname ||
|-
| 103 || GetProfileImage ||
|-
| 104 || [18.0.0+] GetProfileLargeImage ||
|-
| 110 || RegisterUserAsync || No input, returns an [[#IAsyncContext]].
|-
| 111 || GetUid ||
|-
| 200 || [17.0.0+] ApplyResponseForUserCreationAsync ||
|-
| 205 || [17.0.0+] SuspendAfterApplyResponse ||
|-
| 210 || [17.0.0+] IsProfileAvailable ||
|-
| 220 || [17.0.0+] RegisterUserAsyncWithoutProfile ||
|-
| 221 || [17.0.0+] RegisterUserWithProfileAsync ||
|-
| 230 || [18.0.0+] RegisterUserWithLargeImageProfileAsync ||
|}

= ApplicationRecord =
This is "nn::ns::ApplicationRecord".

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| [[NCM_services#ApplicationId|Id]]
|-
| 0x8
| 0x1
| [[#ApplicationEvent|LastEvent]]
|-
| 0x9
| 0x1
| Attributes
|-
| 0xA
| 0x6
| Reserved
|-
| 0x10
| 0x8
| LastUpdated
|}

= ApplicationEvent =
This is "nn::ns::ApplicationEvent".

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || Launched
|-
| 1 || LocalInstalled
|-
| 2 || DownloadStarted
|-
| 3 || GameCardInserted
|-
| 4 || Touched
|-
| 5 ||
|-
| 6 ||
|-
| 7 ||
|-
| 8 ||
|-
| 9 ||
|-
| 10 ||
|-
| 11 ||
|-
| 12 ||
|-
| 13 ||
|-
| 14 ||
|-
| 15 ||
|-
| 16 ||
|}

= ApplicationControlSource =
This is "nn::ns::ApplicationControlSource".

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| CacheOnly
|-
| 1
| Storage
|-
| 2
| StorageOnly
|}

= ApplicationContentMetaStatus =
This is "nn::ns::ApplicationContentMetaStatus".

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| [[NCM_services#ContentMetaType|Type]]
|-
| 0x1
| 0x1
| [[NCM_services#StorageId|InstalledStorage]]
|-
| 0x2
| 0x1
| [[#ContentMetaRightsCheck|RightsCheck]]
|-
| 0x3
| 0x1
| Reserved
|-
| 0x4
| 0x4
| Version
|-
| 0x8
| 0x8
| [[NCM_services#ApplicationId|Id]]
|}

= ContentMetaRightsCheck =
This is "nn::ns::ContentMetaRightsCheck".

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| NotChecked
|-
| 1
| NotNeeded
|-
| 2
| CommonRights
|-
| 3
| PersonalizedRights
|-
| 4
| NoRights
|}

= VersionListData =
This is "nn::ns::VersionListData".

= ApplicationUpdateInfo =
This is "nn::ns::ApplicationUpdateInfo".

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || UpToDate
|-
| 1 || Updatable
|}

= ApplicationOccupiedSize =
This is "nn::ns::ApplicationOccupiedSize". This is a 0x80-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x20 * 4 || Array of [[#ApplicationOccupiedSizeEntity]]
|}

= ApplicationOccupiedSizeEntity =
This is "nn::ns::ApplicationOccupiedSizeEntity". This is a 0x20-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || [[NCM_services#StorageId|StorageId]]
|-
| 0x1 || 0x7 || Reserved
|-
| 0x8 || 0x8 || AppSize
|-
| 0x10 || 0x8 || PatchSize
|-
| 0x18 || 0x8 || AocSize
|}

= ProgressForDeleteUserSaveDataAll =
This is "nn::ns::detail::ProgressForDeleteUserSaveDataAll". This is a 0x28-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || StartedAt
|-
| 0x8 || 0x4 || Count
|-
| 0xC || 0x4 || Reserved
|-
| 0x10 || 0x8 || SizeInBytes
|-
| 0x18 || 0x1 || IsSystem
|-
| 0x19 || 0x7 || Reserved
|-
| 0x20 || 0x8 || ApplicationId
|}

= ApplicationViewDeprecated =
This is "nn::ns::ApplicationViewDeprecated". This is a 0x40-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || [[NCM_services#ApplicationId|ApplicationId]]
|-
| 0x8 || 0x4 || Version
|-
| 0xC || 0x4 || [[#ApplicationViewFlag|Flag]]
|-
| 0x10 || 0x18 || [[#ApplicationDownloadProgress|Progress]]
|-
| 0x28 || 0x18 || [[#ApplicationApplyDeltaProgress|ApplyProgress]]
|}

This is converted from [[#ApplicationView]] by [[#GetApplicationViewDeprecated]] on newer system-versions as follows:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x20 || Same as [[#ApplicationView]] +0x0.
|-
| 0x20 || 0x4 || Same as [[#ApplicationView]] +0x20.
|-
| 0x24 || 0x2 || Same as [[#ApplicationView]] +0x24.
|-
| 0x26 || 0x2 || Cleared to 0.
|-
| 0x28 || 0x10 || Same as [[#ApplicationView]] +0x30.
|-
| 0x38 || 0x4 || Same as [[#ApplicationView]] +0x40.
|-
| 0x3C || 0x1 || Same as [[#ApplicationView]] +0x44.
|-
| 0x3D || 0x2 || Cleared to 0.
|-
| 0x3F || 0x1 || Cleared to 0.
|}

= ApplicationViewFlag =
This is "nn::ns::ApplicationViewFlag". This is a 32-bit flag.

{| class="wikitable" border="1"
|-
! Bit
! Description
|-
| 0
|
|-
| 1
|
|-
| 2
|
|-
| 3
|
|-
| 4
|
|-
| 5
|
|-
| 6
|
|-
| 7
|
|-
| 8
|
|-
| 9
|
|-
| 10
|
|-
| 11
|
|-
| 12
|
|-
| 13
|
|-
| 14
|
|-
| 15
|
|-
| 16
|
|-
| 17
|
|}

= ApplicationDownloadProgress =
This is "nn::ns::ApplicationDownloadProgress". This is a 0x18-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || Downloaded
|-
| 0x8 || 0x8 || Total
|-
| 0x10 || 0x4 || LastResult
|-
| 0x14 || 0x1 || [[#ApplicationDownloadState|State]]
|-
| 0x15 || 0x3 || Reserved
|}

= ApplicationApplyDeltaProgress =
This is "nn::ns::ApplicationApplyDeltaProgress". This is a 0x18-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || Applied
|-
| 0x8 || 0x8 || Total
|-
| 0x10 || 0x4 || LastResult
|-
| 0x14 || 0x1 || [[#ApplicationApplyDeltaState|State]]
|-
| 0x15 || 0x3 || Reserved
|}

= ApplicationDownloadState =
This is "nn::ns::ApplicationDownloadState". This is an u8.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || Runnable
|-
| 1 || Suspended
|-
| 2 || NotEnoughSpace
|-
| 3 || Fatal
|-
| 4 || Finished
|}

= ApplicationApplyDeltaState =
This is "nn::ns::ApplicationApplyDeltaState". This is an u8.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || Applying
|-
| 1 || Suspended
|-
| 2 || NotEnoughSpace
|-
| 3 || Fatal
|-
| 4 || NoTask
|-
| 5 || WaitApply
|-
| 6 || Applied
|}

= ApplicationView =
This is "nn::ns::ApplicationView". This is a 0x50-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || [[NCM_services#ApplicationId|ApplicationId]]
|-
| 0x8 || 0x4 || ?
|-
| 0xC || 0x4 || Flags
|-
| 0x10 || 0x40 || ?
|}

= ApplicationViewWithPromotionInfo =
This is a 0x70-byte struct.

[20.0.0+] This is a 0x78-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x50 || [[#ApplicationView]]
|-
| 0x50 || 0x20 || [[#PromotionInfo]]
|}

= PromotionInfo =
This is a 0x20-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || PosixTime start_timestamp.
|-
| 0x8 || 0x8 || PosixTime end_timestamp.
|-
| 0x10 || 0x8 || Remaining time until the promotion ends, in nanoseconds ({end_timestamp - current_time} converted to nanoseconds).
|-
| 0x18 || 0x4 || Not set, left at zero.
|-
| 0x1C || 0x1 || Flags. Bit0: whether the PromotionInfo is valid (including bit1). Bit1 clear: u64 +0x10 is set.
|-
| 0x1D || 0x3 || Padding
|}

= ApplicationResourceType =
This is "nn::ns::ApplicationResourceType". This is an u8.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || ApplicationResource
|-
| 1 || MicroApplicationResource
|}

= ApplicationErrorCodeCategory =
This is "nn::ns::ApplicationErrorCodeCategory". This is an u64.

= NoDownloadRightsErrorResolution =
This is "nn::ns::NoDownloadRightsErrorResolution".

= BackgroundNetworkUpdateState =
This is "nn::ns::BackgroundNetworkUpdateState". This is an u8.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || None
|-
| 1 || InProgress
|-
| 2 || Ready
|}

Similar to [[#HasDownloaded]], [[#GetBackgroundNetworkUpdateState]] uses [[NIM_services|nim]] ListSystemUpdateTask and [[NIM_services|nim]] GetSystemUpdateTaskInfo. When ListSystemUpdateTask successfully returns a task and GetSystemUpdateTaskInfo is successful, the output value is set to: <code>1 + *((u8*)(taskinfo+0) == 0x3</code>. Otherwise, value=0.

[[#GetBackgroundNetworkUpdateState]] always returns Result 0, however this will assert if GetSystemUpdateTaskInfo fails with ret!=0x3C89.

= SystemUpdateProgress =
This is "nn::ns::SystemUpdateProgress". This is a 0x10-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || Loaded (this value can be larger than total_size when the async operation is finishing and when total_size is <=0, this current_size field may contain a progress value for when the total_size is not yet determined)
|-
| 0x8 || 0x8 || Total (this field is only valid when >0)
|}

Commands which have this as output will return 0 with the output cleared, when no task is available.

= EulaDataPath =
This is "nn::ns::detail::EulaDataPath". This is a 0x100-byte struct.

This contains a file path.

= SystemDeliveryInfo =
This is "nn::ns::SystemDeliveryInfo". This is a 0x100-byte struct.

Originally the SystemDeliveryInfo validation func verified that OldSystemUpdateId matched the installed SystemUpdate Id. [20.0.0+] The used (Old)SystemUpdateId as selected by SystemUpdateIdFlag must now match one of the Ids in [[System_Settings|system-setting]] <code>contents_delivery!acceptable_system_update_ids_string</code> (replaces the previously mentioned installed-SystemUpdate check).

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || SystemDeliveryProtocolVersion. Must be <= to and match [[System_Settings|system-setting]] <code>contents_delivery!system_delivery_protocol_version</code>.
|-
| 0x4 || 0x4 || ApplicationDeliveryProtocolVersion. Loaded from [[System_Settings|system-setting]] <code>contents_delivery!application_delivery_protocol_version</code>. Unused by [[#RequestSendSystemUpdate]]/[[#RequestReceiveSystemUpdate]], besides HMAC validation.
|-
| 0x8 || 0x1 || HasExFat. Unused by [[#RequestSendSystemUpdate]]/[[#RequestReceiveSystemUpdate]], besides HMAC validation.
|-
| 0x9 || 0x3 || Reserved.
|-
| 0xC || 0x4 || SystemUpdateVersion.
|-
| 0x10 || 0x8 || OldSystemUpdateId. [20.0.0+] Always the NX Id: this is loaded from [[System_Settings|system-setting]] <code>contents_delivery!old_system_update_id</code>.
|-
| 0x18 || 0x1 || FirmwareVariationId. Used by [[#RequestSendSystemUpdate]]. Loaded from [[System_Settings|system-setting]] <code>ns.systemupdate!firmware_variation</code> or <code>ns.systemupdate!t_firmware_variation</code>, depending on the [[Settings_services|PlatformRegion]].
|-
| 0x19 || 0x1 || UpdatableFirmwareGroupId. Unused by [[#RequestSendSystemUpdate]]/[[#RequestReceiveSystemUpdate]], besides HMAC validation. Loaded from [[System_Settings|system-setting]] <code>ns.systemupdate!updatable_firmware_group_id</code> or <code>ns.systemupdate!t_updatable_firmware_group_id</code>, depending on the [[Settings_services|PlatformRegion]].
|-
| 0x1A || 0x1 || PlatformRegion (0x00 = Unknown/Global, 0x01 = China).
|-
| 0x1B || 0x1 || [20.0.0+] SystemDeliveryInfoPlatform. Loaded from [[System_Settings|system-setting]] <code>ns.systemupdate!system_delivery_info_platform</code>. Elsewhere this is compared against the sys-setting, etc.
|-
| 0x1C || 0x1 || [20.0.0+] SystemUpdateIdFlag. When non-zero, SystemUpdateId is used instead of OldSystemUpdateId. Always set to 0x1 by [[#GetSystemDeliveryInfo]] with [20.0.0+].
|-
| 0x1D || 0x3 || Padding
|-
| 0x20 || 0x8 || [20.0.0+] SystemUpdateId. See above. With [20.0.0+] [[#GetSystemDeliveryInfo]] now writes the Id here instead of OldSystemUpdateId (for the installed SystemUpdate). On S2 this is set to the Ounce Id.
|-
| 0x28 || 0xB8 || Reserved
|-
| 0xE0 || 0x20 || HMAC-SHA256 over the previous 0xE0-bytes.
|}

= ApplicationDeliveryInfo =
This is "nn::ns::ApplicationDeliveryInfo". This is a 0x100-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || ApplicationDeliveryProtocolVersion. Loaded from [[System_Settings|system-setting]] <code>contents_delivery!application_delivery_protocol_version</code>. An error is thrown when [[System_Settings|system-setting]] <code>contents_delivery!application_delivery_protocol_version</code> < version, or when [[System_Settings|system-setting]] <code>contents_delivery!acceptable_application_delivery_protocol_version</code> > version.
|-
| 0x4 || 0x4 || Padding
|-
| 0x8 || 0x8 || ApplicationId.
|-
| 0x10 || 0x4 || ApplicationVersion.
|-
| 0x14 || 0x4 || RequiredApplicationVersion.
|-
| 0x18 || 0x4 || RequiredSystemVersion.
|-
| 0x1C || 0x4 || u32 bitmask <code>nn::ns::ApplicationDeliveryAttributeTag</code>. [[#GetApplicationDeliveryInfo|GetApplicationDeliveryInfo]] sets this to the input u32. Bit30 and bit28 are additionally set, depending on [[NCM_services|ContentMetaType]] == Patch, etc.
|-
| 0x20 || 0x1 || [20.0.0+] [[NCM_services|ContentMetaPlatform]]. Loaded from [[NCM_services|ncm]] IContentMetaDatabase GetPlatform.
|-
| 0x21 || 0x1 || [20.0.0+] ProperProgramExists. Set to whether the bit for ProperProgramExists is set from [[NCM_services|ncm]] IContentMetaDatabase GetAttributes.
|-
| 0x22 || 0x1 || [S2]
|-
| 0x23 || 0xBD || Reserved
|-
| 0xE0 || 0x20 || HMAC-SHA256 over the previous 0xE0-bytes. Uses a different key than [[#SystemDeliveryInfo]].
|}

= LatestSystemUpdate =
This is "nn::ns::LatestSystemUpdate". This is an u8.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || UpToDate
|-
| 1 || Downloaded
|-
| 2 || NeedsDownload
|}

= ReceiveApplicationProgress =
This is "nn::ns::ReceiveApplicationProgress". This is a 0x10-byte struct.

= SendApplicationProgress =
This is "nn::ns::SendApplicationProgress". This is a 0x10-byte struct.

= ApplicationRightsOnClient =
This is a 0x20-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || [[NCM_services#ApplicationId|ApplicationId]]
|-
| 0x8 || 0x10 || [[Account_services#Uid|Uid]]
|-
| 0x18 || 0x1 || Flags, [[qlaunch]] only uses bit0-bit4 and bit7.
|-
| 0x19 || 0x1 || Flags, [[qlaunch]] only uses bit0.
|-
| 0x1A || 0x6 || Unknown
|}

[[qlaunch]] only uses +0x18/+0x19 in this struct.

= DownloadTaskStatus =
This is "nn::ns::DownloadTaskStatus". This is a 0x20-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x10 || Uuid
|-
| 0x10 || 0x8 || [[NCM_services#ApplicationId|ApplicationId]]
|-
| 0x18 || 0x1 || [[#DownloadTaskStatusDetail|Detail]]
|-
| 0x19 || 0x1 || NeedsCleanup
|-
| 0x1A || 0x2 || Reserved
|-
| 0x1C || 0x4 || Result
|}

= DownloadTaskStatusDetail =
This is "nn::ns::DownloadTaskStatusDetail". This is an u8.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || Created
|-
| 1 || Added
|-
| 2 || AlreadyExists
|-
| 3 || Failed
|}

= ApplicationLaunchInfo =
This is a 0x40-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x8 || [[NCM_services#ApplicationId|ApplicationId]]
|-
| 0x8 || 0x4 || Application version
|-
| 0xC || 0x4 || [[Process_Manager_services#LaunchFlags|LaunchFlags]], set to hard-coded value 0xB by [[#GetApplicationLaunchInfo]].
|-
| 0x10 || 0x1 || Application [[NCM_services#StorageId|StorageId]]
|-
| 0x11 || 0x1 || Update [[NCM_services#StorageId|StorageId]]
|-
| 0x12 || 0x2E ||
|}

= UserData =
This is a 0x80-byte struct.

{| class="wikitable" border="1"
|-
! Offset || Size || Description
|-
| 0x0 || 0x4? || ?
|-
| 0x4 || 0x4? || Icon ID. 0 = Mii, the rest are character icon IDs.
|-
| 0x8 || 0x1? || Profile icon background color ID
|-
| 0x9 || 0x7 || ?
|-
| 0x10 || 0x10 || Some ID related to the Mii? All zeros when a character icon is used.
|-
| 0x20 || 0x60 || Usually zeros?
|}

= ProfileBase =
This is a 0x38-byte struct.

{| class="wikitable" border="1"
|-
! Offset || Size || Description
|-
| 0x0 || 0x10 || userID
|-
| 0x10 || 0x8 || POSIX UTC timestamp, for last account edit.
|-
| 0x18 || 0x20 || UTF-8 Nickname. Official sw uses strncpy to copy this into another struct (<code>nn::account::Nickname</code>), with a NUL-byte written after the copied data.
|}

= Uid =
This is "nn::account::Uid". This is a 0x10-byte struct. This contains 2 u64s for the UserId.

= Notes =
[[Process_Manager_services|pm:bm]] GetBootMode is used to determine whether aoc:u is available (see above). This value is also passed to thread "nn.ns.DelayedInitialization", which calls various funcs depending on the BootMode in various cases.

The "nn.ns.DelayedInitialization" thread uses BootMode as follows (this also handles various other initialization):
* Initializes [[NPNS_services|npns:s]] only for BootMode Normal/Maintenance.
* Initializes the hosted acc:* services and service [[Account_services|acc:su]] only for BootMode Normal/Maintenance.
* Calls a func only for BootMode Normal.
* Initializes [[ETicket_services|es]] and [[Shared_Database_services|avm]] only for BootMode Normal/Maintenance.

The output of GetBootMode is also written into state. This same func later enters a code block when BootMode is Maintenance/SafeMode: various [[NCM_services|ncm]] cmds are used with input StorageId=BuiltInUser (VerifyContentMetaDatabase, VerifyContentStorage, ActivateContentMetaDatabase, ActivateContentStorage, InactivateContentMetaDatabase, InactivateContentStorage) and state fields are written. Then if the BootMode is Maintenance the savedata for [[Flash_Filesystem|ns_rightsid]] (0x800000000000004A) is deleted. Then 0 is returned. Otherwise for BootMode Normal it continues with various initialization, including gamecard handling which handles launching the gamecard title in certain conditions (this is the only time ns launches anything with pgl outside of service cmds).

In the above block, InactivateContentMetaDatabase/InactivateContentStorage are only used if using ActivateContentMetaDatabase/ActivateContentStorage failed (error is only checked after using both cmds). If any of the ncm cmds prior to this fail, it will skip using the rest of the ncm cmds.

[[Category:Services]]

Applet Manager services

2026-07-23T18:01:58Z

Yellows8:

AM (Applet Manager) provides services for interacting with system applets while abstracting several aspects of power and operation management.

Contains multiple raw images, with at least the following: "NN_OMM_CHARGING_BIN_{begin|end}"(charging icon), low-battery icon, and the Nintendo Switch logo displayed during system boot.

= appletAE =
This is "nn::am::service::IAllSystemAppletProxiesService".

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 100 || OpenSystemAppletProxyOld ([1.0.0-19.0.1] OpenSystemAppletProxy) || Returns an [[#ISystemAppletProxy]].
|-
| 110 || [20.0.0+] OpenSystemAppletProxy || Same as OpenSystemAppletProxyOld except this now takes a type-0x15 buffer containing an [[#AppletAttribute|AppletAttribute]].
|-
| 200 || OpenLibraryAppletProxyOld ([1.0.0-2.3.0] OpenLibraryAppletProxy) || Returns an [[#ILibraryAppletProxy]].
|-
| 201 || [3.0.0+] [[#OpenLibraryAppletProxy]] || Returns an [[#ILibraryAppletProxy]].
|-
| 300 || OpenOverlayAppletProxy || Returns an [[#IOverlayAppletProxy]].
|-
| 310 || [S2] || Returns an [[#ICMenuProxy|ICMenuProxy]].
|-
| 350 || OpenSystemApplicationProxy || Returns an [[#IApplicationProxy]].
|-
| 400 || [[#CreateSelfLibraryAppletCreatorForDevelop]] ||
|-
| 410 || [6.0.0+] [[#GetSystemAppletControllerForDebug]] ||
|-
| 450 || [19.0.0+] [[#GetSystemProcessCommonFunctions]] ||
|-
| 460 || [20.0.0+] || Returns an [[#IAppletAlternativeFunctions]].
|-
| 500 || [S2] || Returns an [[#IChatProxy|IChatProxy]].
|-
| 1000 || [6.0.0+] [[#GetDebugFunctions]] ||
|}

All of these Open*Proxy commands except [[#OpenLibraryAppletProxy]] take the same input as [[#OpenApplicationProxy]], with the same user-process retry-loop as [[#OpenApplicationProxy]]. These Open*Proxy commands (including appletOE) doesn't seem to usable from processes which aren't actual applets (such as sysmodules), at least for applet-types which aren't already in use.

OpenLibraryAppletProxyOld eventually calls the same func as [[#OpenLibraryAppletProxy]], except that the [[#AppletAttribute]] is all-zero.

This service is used by all system non-regular-applications.

The 01000000000010XX system [[Title_list|titles]] use the following applet types(above Open{type}Proxy commands):
* "qlaunch": SystemApplet
* "overlay": OverlayApplet
* "starter": SystemApplication
* "maintenance": SystemApplet
* All others: LibraryApplet

== OpenLibraryAppletProxy ==
Returns an [[#ILibraryAppletProxy]].

Takes a [[IPC_Marshalling|reserved]] input u64(official user-processes use hard-coded value 0), a PID,a process copy-handle(cur-proc handle alias), and a type-0x15 input buffer containing an [[#AppletAttribute]].

Official user-processes use the same retry loop with this as the other Open*Proxy commands.

== CreateSelfLibraryAppletCreatorForDevelop ==
Takes a PID and an input u64 pid_placeholder, returns an [[#ILibraryAppletCreator]].

The cached value loaded from [[Settings_services#GetDebugModeFlag]] must be 1, otherwise an error is returned.

The cached value loaded from [[System_Settings|system-setting]] <code>am.debug!dev_function</code> must be set to 0x1 with size 0x1, otherwise an error is returned.

== GetSystemAppletControllerForDebug ==
No input, returns an [[#ISystemAppletControllerForDebug]].

The cached value loaded from [[System_Settings|system-setting]] <code>am.debug!dev_function</code> must be set to 0x1 with size 0x1, and various state checks must pass, otherwise 0 is returned with no output interface.

== GetSystemProcessCommonFunctions ==
No input. Returns an [[#ISystemProcessCommonFunctions]].

== GetDebugFunctions ==
No input, returns an [[#IDebugFunctions]].

The cached value loaded from [[System_Settings|system-setting]] <code>am.debug!dev_function</code> must be set to 0x1 with size 0x1, otherwise 0 is returned with no output interface.

== ISystemAppletProxy ==
This is "nn::am::service::ISystemAppletProxy".

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || GetCommonStateGetter || Returns an [[#ICommonStateGetter]].
|-
| 1 || GetSelfController || Returns an [[#ISelfController]].
|-
| 2 || GetWindowController || Returns an [[#IWindowController]].
|-
| 3 || GetAudioController || Returns an [[#IAudioController]].
|-
| 4 || GetDisplayController || Returns an [[#IDisplayController]].
|-
| 10 || GetProcessWindingController || Returns an [[#IProcessWindingController]].
|-
| 11 || GetLibraryAppletCreator || Returns an [[#ILibraryAppletCreator]].
|-
| 20 || GetHomeMenuFunctions || Returns an [[#IHomeMenuFunctions]].
|-
| 21 || GetGlobalStateController || Returns an [[#IGlobalStateController]].
|-
| 22 || GetApplicationCreator || Returns an [[#IApplicationCreator]].
|-
| 23 || [7.0.0+] GetAppletCommonFunctions || Returns an [[#IAppletCommonFunctions]].
|-
| 1000 || GetDebugFunctions || Returns an [[#IDebugFunctions]].
|}

=== IHomeMenuFunctions ===
This is "nn::am::service::IHomeMenuFunctions".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 10 || [[#RequestToGetForeground]]
|-
| 11 || [[#LockForeground]]
|-
| 12 || [[#UnlockForeground]]
|-
| 20 || [[#PopFromGeneralChannel]]
|-
| 21 || [[#GetPopFromGeneralChannelEvent]]
|-
| 30 || [[#GetHomeButtonWriterLockAccessor]]
|-
| 31 || [2.0.0+] [[#GetWriterLockAccessorEx]]
|-
| 40 || [11.0.0+] [[#IsSleepEnabled]]
|-
| 41 || [12.0.0+] [[#IsRebootEnabled]]
|-
| 50 || [16.0.0+] [[#LaunchSystemApplet]]
|-
| 51 || [16.0.0+] [[#LaunchStarter]]
|-
| 60 || [19.0.0+]
|-
| 61 || [19.0.0+]
|-
| 100 || [6.0.0+] [[#PopRequestLaunchApplicationForDebug]]
|-
| 110 || [9.0.0+] [[#IsForceTerminateApplicationDisabledForDebug]]
|-
| 200 || [8.0.0+] [[#LaunchDevMenu]]
|-
| 1000 || [11.0.0+] [[#SetLastApplicationExitReason]]
|}

==== RequestToGetForeground ====
No input/output.

==== LockForeground ====
No input/output.

==== UnlockForeground ====
No input/output.

==== PopFromGeneralChannel ====
No input, returns an output [[#IStorage]].

==== GetPopFromGeneralChannelEvent ====
No input, returns an output Event handle with autoclear=false.

==== GetHomeButtonWriterLockAccessor ====
No input, returns an output [[#ILockAccessor]].

Similar to using [[#GetWriterLockAccessorEx]] with inval=0.

==== GetWriterLockAccessorEx ====
Takes an input u32, returns an output [[#ILockAccessor]].

The input value must be 0-3. 0 = HomeButton.

==== IsSleepEnabled ====
No input, returns an output bool.

==== IsRebootEnabled ====
No input, returns an output bool.

==== LaunchSystemApplet ====
No input/output.

This wraps [[NS_Services|ns]] LaunchSystemApplet, ignoring the u64 returned by that cmd (and other functionality).

==== LaunchStarter ====
No input/output.

This is similar to [[#LaunchSystemApplet]], except this uses [[NS_Services|ns]] LaunchLibraryApplet with a ProgramId from global state.

The global state field is initialized elsewhere with the value of [[System_Settings|system-setting]] <code>am.debug!starter_id</code>, defaulting to ProgramId 0100000000001012 ([[Title_list|starter]]) if not available.

==== PopRequestLaunchApplicationForDebug ====
Takes a type-0x6 output buffer containing an array of u128 userIDs, returns an output [[NCM_services#ApplicationId|ApplicationId]] and an output s32 '''total_userIDs'''.

The total entries in the userID buffer must be >= {total userIDs in state}.

==== IsForceTerminateApplicationDisabledForDebug ====
No input, returns an output u8 bool.

When the cached value loaded from [[Settings_services#GetDebugModeFlag]] is 0 this will just set the bool to 0. Otherwise, the bool is loaded using data from [[System_Settings|system-setting]] <code>am.debug!disable_force_terminate_application</code>.

==== LaunchDevMenu ====
No input/output.

The cached value loaded from [[Settings_services#GetDebugModeFlag]] must be 1, otherwise an error is returned.

Uses [[NS_Services|ns]] LaunchDevMenu.

This is used by [[qlaunch]]. On success, official sw will enter an infinite loop with sleep-thread value 86400000000000.

==== SetLastApplicationExitReason ====
Takes an input s32, no output.

==== ILockAccessor ====
This is "nn::am::service::ILockAccessor".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 1 || [[#TryLock]]
|-
| 2 || [[#Unlock]]
|-
| 3 || [[#GetEvent]]
|-
| 4 || [10.0.0+] [[#IsLocked]]
|}

===== TryLock =====
Takes an input u8 bool flag, returns an output u8 bool flag and a handle.

Official sw waits on the previously loaded event from [[#GetEvent]]. The output flag indicates whether locking was successful, the user-process can try using this cmd again when flag=false.

Official sw only uses inflag=false. Official sw just closes the output handle. The input flag controls whether this returns the output handle.

===== Unlock =====
No input/output.

===== GetEvent =====
No input, returns an output Event handle with autoclear=false.

==== IsLocked ====
No input, returns an output u8 bool.

=== IGlobalStateController ===
This is "nn::am::service::IGlobalStateController".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#RequestToEnterSleep]]
|-
| 1 || [[#EnterSleep]]
|-
| 2 || [[#StartSleepSequence]]
|-
| 3 || [[#StartShutdownSequence]]
|-
| 4 || [[#StartRebootSequence]]
|-
| 9 || [7.0.0+] [[#IsAutoPowerDownRequested]]
|-
| 10 || [[#LoadAndApplyIdlePolicySettings]]
|-
| 11 || [2.0.0+] [[#NotifyCecSettingsChanged]]
|-
| 12 || [3.0.0+] [[#SetDefaultHomeButtonLongPressTime]]
|-
| 13 || [3.0.0+] [[#UpdateDefaultDisplayResolution]]
|-
| 14 || [3.0.0+] [[#ShouldSleepOnBoot]]
|-
| 15 || [4.0.0+] [[#GetHdcpAuthenticationFailedEvent]]
|-
| 30 || [12.0.0+] [[#OpenCradleFirmwareUpdater]]
|-
| 100 || [S2]
|}

==== RequestToEnterSleep ====
No input/output.

Stubbed, just returns an error.

==== EnterSleep ====
No input/output.

Stubbed, just returns an error.

==== StartSleepSequence ====
Takes an input u8 bool, no output.

Official sw uses hard-coded input value = 1.

==== StartShutdownSequence ====
No input/output.

==== StartRebootSequence ====
No input/output.

==== IsAutoPowerDownRequested ====
No input, returns an output u8 bool.

Uses [[#idle:sys]] cmd1.

==== LoadAndApplyIdlePolicySettings ====
No input/output.

Uses [[#idle:sys]] cmd LoadAndApplySettings.

==== NotifyCecSettingsChanged ====
No input/output.

Uses [[#omm]] cmd NotifyCecSettingsChanged.

==== SetDefaultHomeButtonLongPressTime ====
Takes an input s64, no output.

==== UpdateDefaultDisplayResolution ====
No input/output.

Uses [[#omm]] cmd UpdateDefaultDisplayResolution.

==== ShouldSleepOnBoot ====
No input, returns an output u8 bool.

Uses [[#omm]] cmd ShouldSleepOnBoot.

==== GetHdcpAuthenticationFailedEvent ====
No input, returns an output Event handle with autoclear=false.

Uses [[#omm]] cmd GetHdcpAuthenticationFailedEvent.

==== OpenCradleFirmwareUpdater ====
No input, returns an [[#ICradleFirmwareUpdater]].

==== Cmd100 ====
No input, returns an output handle.

=== ICradleFirmwareUpdater ===
This is "nn::am::service::ICradleFirmwareUpdater".

This was added with [12.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || StartUpdate
|-
| 1 || FinishUpdate
|-
| 2 || [[#GetCradleDeviceInfo]]
|-
| 3 || GetCradleDeviceInfoChangeEvent
|-
| 4 || GetUpdateProgressInfo
|-
| 5 || GetLastInternalResult
|}

==== GetCradleDeviceInfo ====
No input, returns a 8-byte CradleDeviceInfo.

[13.0.0+] Now returns a total of 0xC-bytes.

=== IApplicationCreator ===
This is "nn::am::service::IApplicationCreator".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#CreateApplication]]
|-
| 1 || [[#PopLaunchRequestedApplication]]
|-
| 10 || [[#CreateSystemApplication]]
|-
| 100 || [[#PopFloatingApplicationForDevelopment]]
|}

[[#CreateApplication]]/[[#CreateSystemApplication]] eventually call the same internal func. With [[#CreateApplication]], two ptrs passed to the internal func are NULL, while with [[#CreateSystemApplication]] these are loaded from state. The initial content of [[#ApplicationLaunchRequestInfo]] is all-zero with [[#CreateSystemApplication]], while with [[#CreateApplication]] the first two u32s are value 0x3 with the rest all-zero. The [[#AppletId]] is set to 0x01 with [[#CreateApplication]], while with [[#CreateSystemApplication]] it's 0x04.

==== CreateApplication ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an [[#IApplicationAccessor]].

==== PopLaunchRequestedApplication ====
No input, returns an [[#IApplicationAccessor]].

==== CreateSystemApplication ====
Takes an input [[NCM_services#ApplicationId|SystemApplicationId]], returns an [[#IApplicationAccessor]].

[[qlaunch]] only uses this with a hard-coded id for the "starter" title.

==== PopFloatingApplicationForDevelopment ====
No input, returns an [[#IApplicationAccessor]].

Should not be used if no FloatingApplication is available (svcBreak).

==== IApplicationAccessor ====
This is "nn::am::service::IApplicationAccessor".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#GetAppletStateChangedEvent]]
|-
| 1 || [[#IsCompleted]]
|-
| 10 || [[#Start]]
|-
| 20 || [[#RequestExit]]
|-
| 25 || [[#Terminate]]
|-
| 30 || [[#GetResult]]
|-
| 101 || [[#RequestForApplicationToGetForeground]]
|-
| 110 || [[#TerminateAllLibraryApplets]]
|-
| 111 || [[#AreAnyLibraryAppletsLeft]]
|-
| 112 || [[#GetCurrentLibraryApplet]]
|-
| 120 || [[#GetApplicationId]]
|-
| 121 || [[#PushLaunchParameter]]
|-
| 122 || [[#GetApplicationControlProperty]]
|-
| 123 || [2.0.0+] [[#GetApplicationLaunchProperty]]
|-
| 124 || [6.0.0+] [[#GetApplicationLaunchRequestInfo]]
|-
| 130 || [6.0.0+] [[#SetUsers]]
|-
| 131 || [6.0.0+] [[#CheckRightsEnvironmentAvailable]]
|-
| 132 || [6.0.0+] [[#GetNsRightsEnvironmentHandle]]
|-
| 140 || [6.0.0+] [[#GetDesirableUids]]
|-
| 150 || [6.0.0+] [[#ReportApplicationExitTimeout]]
|-
| 160 || [8.0.0+] [[#SetApplicationAttribute]]
|-
| 170 || [8.0.0+] [[#HasSaveDataAccessPermission]]
|-
| 180 || [9.0.0+] [[#PushToFriendInvitationStorageChannel]]
|-
| 190 || [9.0.0+] [[#PushToNotificationStorageChannel]]
|-
| 200 || [10.0.0+] [[#RequestApplicationSoftReset]]
|-
| 201 || [10.0.0+] [[#RestartApplicationTimer]]
|-
| 300 || [20.0.0+]
|-
| 301 || [20.0.0+]
|-
| 310 || [21.0.0+]
|}

Commands <=30 are inherited from [[#IAppletAccessor]].

===== RequestForApplicationToGetForeground =====
No input/output.

===== GetCurrentLibraryApplet =====
No input, returns an output [[#IAppletAccessor]].

===== GetApplicationId =====
No input, returns an output [[NCM_services#ApplicationId|ApplicationId]].

===== PushLaunchParameter =====
Takes an input u32 [[#LaunchParameterKind]] and an input [[#IStorage]], no output.

===== GetApplicationControlProperty =====
No input, takes a type-0x6 output buffer.

The output buffer must be at least 0x4000-bytes. Returns an error when the [[#AppletId]] is 0x04, aka when the IApplicationAccessor is for a SystemApplication.

This gets the application [[NACP_Format|control.nacp]].

===== GetApplicationLaunchProperty =====
Takes a type-0x6 output buffer.

The output buffer size must be at least 0x10-bytes. Returns an error when the [[#AppletId]] is 0x04, aka when the IApplicationAccessor is for a SystemApplication.

This gets the [[#ApplicationLaunchProperty]].

===== GetApplicationLaunchRequestInfo =====
No input, returns an output 0x10-byte struct.

This gets the [[#ApplicationLaunchRequestInfo]] from state. The output struct is "nn::applet::ApplicationLaunchRequestInfo".

===== SetUsers =====
Takes an input u8 bool flag and a type-0x5 input buffer containing an array of u128 userIDs.

The total entries for the userIDs must be <=8.

When the input flag is true, this just clears the '''users_available''' state flag to 0 and returns.

===== CheckRightsEnvironmentAvailable =====
No input, returns an output u8 bool.

===== GetNsRightsEnvironmentHandle =====
No input, returns an output u64.

===== GetDesirableUids =====
Takes a type-0x6 output buffer containing an array of u128 userIDs, returns an output s32 '''total_entries'''.

Gets a userID listing, this is unrelated to [[#SetUsers]]. [[qlaunch]] only uses 1 userID with this.

The stored entry-count in state must be <= <size of output buffer in entries>.

===== ReportApplicationExitTimeout =====
No input/output.

===== SetApplicationAttribute =====
Takes a type-0x15 input buffer containing an [[#ApplicationAttribute]], no output.

===== HasSaveDataAccessPermission =====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], returns an output u8 bool flag.

Gets whether the savedata specified by the input ApplicationId is accessible. The output flag indicates whether it's accessible.

If the ApplicationId matches the current application, this immediately returns success with flag=1.

===== PushToFriendInvitationStorageChannel =====
Takes an input [[#IStorage]], no output.

Clears the FriendInvitation StorageChannel, then pushes the input storage there.

===== PushToNotificationStorageChannel =====
Takes an input [[#IStorage]], no output.

Clears the Notification StorageChannel, then pushes the input storage there.

[[qlaunch]] will only push data for this when launching the Application when the Alarm was triggered, where the system was previously in sleep-mode. This data is the [[Glue_services|Notification]] ApplicationParameter.

===== RequestApplicationSoftReset =====
No input/output.

===== RestartApplicationTimer =====
No input/output.

===== IAppletAccessor =====
This is "nn::am::service::IAppletAccessor".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#GetAppletStateChangedEvent]]
|-
| 1 || [[#IsCompleted]]
|-
| 10 || [[#Start]]
|-
| 20 || [[#RequestExit]]
|-
| 25 || [[#Terminate]]
|-
| 30 || [[#GetResult]]
|}

==== GetAppletStateChangedEvent ====
No input, returns an output event handle with autoclear=false.

==== IsCompleted ====
No input, returns an output u8 bool.

==== Start ====
No input/output.

==== RequestExit ====
No input/output.

==== Terminate ====
No input/output.

==== GetResult====
No input/output.

== IAppletCommonFunctions ==
This is "nn::am::service::IAppletCommonFunctions".

This was added with [7.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [9.0.0+] [[#SetTerminateResult]]
|-
| 10 || [[#ReadThemeStorage]]
|-
| 11 || [[#WriteThemeStorage]]
|-
| 20 || [9.0.0+] [[#PushToAppletBoundChannel]]
|-
| 21 || [9.0.0+] [[#TryPopFromAppletBoundChannel]]
|-
| 40 || [8.0.0+] [[#GetDisplayLogicalResolution]]
|-
| 42 || [8.0.0+] [[#SetDisplayMagnification]]
|-
| 50 || [8.0.0+] [[#SetHomeButtonDoubleClickEnabled]]
|-
| 51 || [8.0.0+] [[#GetHomeButtonDoubleClickEnabled]]
|-
| 52 || [10.0.0+] [[#IsHomeButtonShortPressedBlocked]]
|-
| 60 || [11.0.0+] [[#IsVrModeCurtainRequired]]
|-
| 61 || [12.0.0+] IsSleepRequiredByHighTemperature
|-
| 62 || [12.0.0+] IsSleepRequiredByLowBattery
|-
| 70 || [11.0.0+] [[#SetCpuBoostRequestPriority]]
|-
| 80 || [14.0.0+] SetHandlingCaptureButtonShortPressedMessageEnabledForApplet
|-
| 81 || [14.0.0+] SetHandlingCaptureButtonLongPressedMessageEnabledForApplet
|-
| 82 || [18.0.0+] SetBlockingCaptureButtonInEntireSystem
|-
| 90 || [15.0.0+] OpenNamedChannelAsParent
|-
| 91 || [15.0.0+] OpenNamedChannelAsChild
|-
| 100 || [15.0.0+] SetApplicationCoreUsageMode
|-
| 110 || [S2]
|-
| 111 || [S2]
|-
| 112 || [S2]
|-
| 113 || [S2]
|-
| 114 || [S2]
|-
| 115 || [S2]
|-
| 116 || [S2]
|-
| 117 || [S2]
|-
| 118 || [S2]
|-
| 119 || [S2]
|-
| 120 || [S2]
|-
| 121 || [S2]
|-
| 122 || [S2]
|-
| 123 || [S2]
|-
| 124 || [S2]
|-
| 130 || [S2]
|-
| 131 || [S2] [20.0.0+]
|-
| 135 || [S2] [20.0.0+]
|-
| 140 || [S2]
|-
| 150 || [S2]
|-
| 160 || [18.0.0+] [[#GetNotificationReceiverService|GetNotificationReceiverService]]
|-
| 161 || [18.0.0+] [[#GetNotificationSenderService|GetNotificationSenderService]]
|-
| 170 || [S2]
|-
| 171 || [S2]
|-
| 200 || [S2]
|-
| 210 || [S2]
|-
| 211 || [S2]
|-
| 220 || [S2]
|-
| 221 || [S2]
|-
| 230 || [S2]
|-
| 231 || [S2]
|-
| 250 || [S2]
|-
| 251 || [S2]
|-
| 252 || [S2]
|-
| 253 || [S2]
|-
| 260 || [S2]
|-
| 271 || [S2] [20.0.0+]
|-
| 280 || [S2] [20.0.0+]
|-
| 290 || [S2] [20.0.0+] RequestChatProhibition
|-
| 291 || [S2] [20.0.0+] RequestChatExpirationCheckSkip
|-
| 300 || [17.0.0+] GetCurrentApplicationId
|-
| 310 || [19.0.0+] IsSystemAppletHomeMenu
|-
| 311 || [20.0.0+]
|-
| 320 || [19.0.0+] SetGpuTimeSliceBoost
|-
| 321 || [19.0.0+] SetGpuTimeSliceBoostDueToApplication
|-
| 322 || [20.0.0+]
|-
| 330 || [19.0.0+]
|-
| 340 || [20.0.0+]
|-
| 341 || [20.0.0+]
|-
| 342 || [20.0.0+]
|-
| 350 || [20.0.0+]
|-
| 360 || [20.0.0+]
|-
| 370 || [22.0.0+] GetGpuErrorEventForApplet
|-
| 2000 || [S2]
|-
| 2010 || [S2]
|-
| 3000 || [S2] [20.0.0+]
|-
| 3010 || [S2] [20.0.0+]
|}

ReadThemeStorage/WriteThemeStorage: these commands copy data from/to a state buffer and the user specified buffer. The size of the state buffer is 0x400-bytes. The default content of the ThemeStorage prior to using the WriteThemeStorage cmd, is: <code>memset(statebuf, 0xAA, 0x400);</code>

=== ReadThemeStorage ===
Takes an input u64 '''offset''' and a type-0x22 output buffer, returns an output u64 '''actual_transfer_size'''.

=== WriteThemeStorage ===
Takes an input u64 '''offset''' and a type-0x21 input buffer, no output.

=== PushToAppletBoundChannel ===
Takes an input [[#IStorage]], no output.

This is similar to [[#PushToAppletBoundChannelForDebug]] (no DebugMode check), except the used s32 is loaded from elsewhere and must be in the range 31-32.

=== TryPopFromAppletBoundChannel ===
No input, returns an output [[#IStorage]].

This is similar to [[#TryPopFromAppletBoundChannelForDebug]] (no DebugMode check), except the used s32 is loaded from elsewhere and must be in the range 31-32.

=== GetDisplayLogicalResolution ===
No input, returns an output s32 '''width''' and s32 '''height'''.

=== SetDisplayMagnification ===
Takes an input float '''x''', float '''y''', float '''width''', and float '''height''', no output.

Sets the DisplayMagnification. This is essentially layer image crop, for everything non-Overlay.

'''x''' and '''width''' are multiplied with the same width value returned by [[#GetDisplayLogicalResolution]], so these should be in the range 0.0f-1.0f. Likewise for y and height, except these are multipled with the height value.

=== SetHomeButtonDoubleClickEnabled ===
Takes an input u8 bool, no output.

=== GetHomeButtonDoubleClickEnabled ===
No input, returns an output u8 bool.

=== IsHomeButtonShortPressedBlocked ===
No input, returns an output u8 bool.

=== IsVrModeCurtainRequired ===
No input, returns an output bool.

=== SetCpuBoostRequestPriority ===
Takes an input s32, no output.

=== GetNotificationReceiverService ===
No input, returns an [[#IReceiverService|IReceiverService]].

=== GetNotificationSenderService ===
No input, returns an [[#ISenderService|ISenderService]].

=== IReceiverService ===
This is "nn::am::service::IReceiverService".

This was added with [18.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 ||
|}

==== Cmd0 ====
No input, returns an [[#INotificationReceiver|INotificationReceiver]].

==== INotificationReceiver ====
This is "nn::am::service::INotificationReceiver".

This was added with [18.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || AddSource
|-
| 1 || RemoveSource
|-
| 2 || GetEvent
|-
| 3 || Receive
|-
| 4 || ReceiveWithTick
|}

===== GetEvent =====
Unofficial name.

No input, returns an Event handle.

===== ReceiveWithTick =====
Unofficial name.

=== ISenderService ===
This is "nn::am::service::ISenderService".

This was added with [18.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 ||
|}

==== Cmd0 ====
Takes a total of 0x18-bytes of input, returns an [[#INotificationSender|INotificationSender]].

=== INotificationSender ===
This is "nn::am::service::INotificationSender".

This was added with [18.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Send
|-
| 1 || GetUnreceivedMessageCount
|}

== ILibraryAppletProxy ==
This is "nn::am::service::ILibraryAppletProxy".

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || GetCommonStateGetter || Returns an [[#ICommonStateGetter]].
|-
| 1 || GetSelfController || Returns an [[#ISelfController]].
|-
| 2 || GetWindowController || Returns an [[#IWindowController]].
|-
| 3 || GetAudioController || Returns an [[#IAudioController]].
|-
| 4 || GetDisplayController || Returns an [[#IDisplayController]].
|-
| 10 || GetProcessWindingController || Returns an [[#IProcessWindingController]].
|-
| 11 || GetLibraryAppletCreator || Returns an [[#ILibraryAppletCreator]].
|-
| 20 || OpenLibraryAppletSelfAccessor || Returns an [[#ILibraryAppletSelfAccessor]].
|-
| 21 || [7.0.0+] GetAppletCommonFunctions || No input, returns an [[#IAppletCommonFunctions]].
|-
| 22 || [15.0.0+] GetHomeMenuFunctions || No input, returns an [[#IHomeMenuFunctions]].
|-
| 23 || [15.0.0+] GetGlobalStateController || No input, returns an [[#IGlobalStateController]].
|-
| 1000 || GetDebugFunctions || Returns an [[#IDebugFunctions]].
|}

=== ILibraryAppletSelfAccessor ===
This is "nn::am::service::ILibraryAppletSelfAccessor".

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || [[#PopInData]] ||
|-
| 1 || [[#PushOutData]] ||
|-
| 2 || [[#PopInteractiveInData]] ||
|-
| 3 || [[#PushInteractiveOutData]] ||
|-
| 5 || [[#GetPopInDataEvent]] ||
|-
| 6 || [[#GetPopInteractiveInDataEvent]] ||
|-
| 10 || [[#ExitProcessAndReturn]] ||
|-
| 11 || [[#GetLibraryAppletInfo]] ||
|-
| 12 || [[#GetMainAppletIdentityInfo]] ||
|-
| 13 || [[#CanUseApplicationCore]] ||
|-
| 14 || [[#GetCallerAppletIdentityInfo]] ||
|-
| 15 || [2.0.0+] [[#GetMainAppletApplicationControlProperty]] ||
|-
| 16 || [2.0.0+] [[#GetMainAppletStorageId]] ||
|-
| 17 || [3.0.0+] [[#GetCallerAppletIdentityInfoStack]] ||
|-
| 18 || [4.0.0+] [[#GetNextReturnDestinationAppletIdentityInfo]] ||
|-
| 19 || [4.0.0+] [[#GetDesirableKeyboardLayout]] ||
|-
| 20 || [[#PopExtraStorage]] ||
|-
| 25 || [[#GetPopExtraStorageEvent]] ||
|-
| 30 || [[#UnpopInData]] ||
|-
| 31 || [[#UnpopExtraStorage]] ||
|-
| 40 || [2.0.0+] [[#GetIndirectLayerProducerHandle]] ||
|-
| 50 || [3.0.0+] [[#ReportVisibleError]] ||
|-
| 51 || [4.0.0+] [[#ReportVisibleErrorWithErrorContext]] ||
|-
| 60 || [4.0.0+] [[#GetMainAppletApplicationDesiredLanguage]] ||
|-
| 70 || [8.0.0+] [[#GetCurrentApplicationId]] ||
|-
| 80 || [6.0.0+] [[#RequestExitToSelf]] ||
|-
| 90 || [5.0.0+] [[#CreateApplicationAndPushAndRequestToLaunch]] ||
|-
| 100 || [4.0.0+] [[#CreateGameMovieTrimmer]] ||
|-
| 101 || [5.0.0+] [[#ReserveResourceForMovieOperation]] ||
|-
| 102 || [5.0.0+] [[#UnreserveResourceForMovieOperation]] ||
|-
| 110 || [6.0.0+] [[#GetMainAppletAvailableUsers]] ||
|-
| 120 || [9.0.0+] [[#GetLaunchStorageInfoForDebug]] ||
|-
| 130 || [9.0.0+] [[#GetGpuErrorDetectedSystemEvent]] ||
|-
| 140 || [10.0.0+] [[#SetApplicationMemoryReservation]] ||
|-
| 150 || [10.0.0+] [[#ShouldSetGpuTimeSliceManually]] ||
|-
| 160 || [17.0.0+] [[#GetLibraryAppletInfoEx]] ||
|}

==== PopInData ====
No input, returns an output [[#IStorage]].

==== PushOutData ====
Takes an input [[#IStorage]], no output.

==== PopInteractiveInData ====
No input, returns an output [[#IStorage]].

==== PushInteractiveOutData ====
Takes an input [[#IStorage]], no output.

==== GetPopInDataEvent ====
No input, returns an output Event handle with autoclear=false.

==== GetPopInteractiveInDataEvent ====
No input, returns an output Event handle with autoclear=false.

==== ExitProcessAndReturn ====
No input/output.

Exits the LibraryApplet and returns to running the title which launched this LibraryApplet ([[qlaunch]] for example).

On success, official sw will enter an infinite loop with sleep-thread value 86400000000000.

==== GetLibraryAppletInfo ====
No input, returns an output [[#LibraryAppletInfo]].

==== GetMainAppletIdentityInfo ====
No input, returns an output [[#AppletIdentityInfo]].

==== CanUseApplicationCore ====
No input, returns an output u8 bool.

==== GetCallerAppletIdentityInfo ====
No input, returns an output [[#AppletIdentityInfo]].

==== GetMainAppletApplicationControlProperty ====
No input, takes a type-0x16 output buffer.

This gets the [[NACP_Format|control.nacp]].

==== GetMainAppletStorageId ====
No input, returns an output u8 storageId.

==== GetCallerAppletIdentityInfoStack ====
Takes a type-0x6 output buffer containing an array of [[#AppletIdentityInfo]], and returns an output s32 total_entries.

==== GetNextReturnDestinationAppletIdentityInfo ====
No input, returns an output [[#AppletIdentityInfo]].

==== GetDesirableKeyboardLayout ====
No input, returns an output u32.

The output u32 is "nn::settings::KeyboardLayout".

This gets the value previously set by [[#SetDesirableKeyboardLayout]]. An error is returned if it's not set.

==== PopExtraStorage ====
No input, returns an output [[#IStorage]].

==== GetPopExtraStorageEvent ====
No input, returns an output Event handle with autoclear=false.

==== UnpopInData ====
Takes an input [[#IStorage]], no output.

==== UnpopExtraStorage ====
Takes an input [[#IStorage]], no output.

==== GetIndirectLayerProducerHandle ====
No input, returns an output u64.

==== ReportVisibleError ====
Takes an input [[Error_Applet#ErrorCode|ErrorCode]], no output.

==== ReportVisibleErrorWithErrorContext ====
Takes an input [[Error_Applet#ErrorCode|ErrorCode]] and a type-0x15 input buffer containing an [[Error_Applet#ErrorContext|ErrorContext]], no output.

==== GetMainAppletApplicationDesiredLanguage ====
No input, returns an output [[Settings_services#LanguageCode|LanguageCode]].

==== GetCurrentApplicationId ====
No input, returns an output [[NCM_services#ApplicationId|ApplicationId]].

Gets the [[NCM_services#ApplicationId|ApplicationId]] for the currently running Application. ApplicationId=0 when no Application is running.

==== RequestExitToSelf ====
No input/output.

Same as [[#RequestExit]] except this is for the current applet.

==== CreateApplicationAndPushAndRequestToLaunch ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]] and an input #IStorage, no output.

This is is similar to [[#CreateApplicationAndPushAndRequestToStart]].

==== CreateGameMovieTrimmer ====
Takes an input u64 size and a TransferMemory handle, returns a GRC [[GRC_services#IGameMovieTrimmer|IGameMovieTrimmer]].

This is a wrapper for GRC [[GRC_services#OpenGameMovieTrimmer|OpenGameMovieTrimmer]].

Official sw uses an user-buffer for the tmem, with permissions=0.

==== ReserveResourceForMovieOperation ====
No input/output.

Updates state fields. This must be used before [[#CreateGameMovieTrimmer]].

==== UnreserveResourceForMovieOperation ====
No input/output.

Updates state fields. This must be used once finished with [[GRC_services#IGameMovieTrimmer|IGameMovieTrimmer]].

==== GetMainAppletAvailableUsers ====
Takes a type-0x6 output buffer containing an array of u128 userIDs, returns an output u8 bool and a s32 '''total_entries'''.

This gets the userIDs previously set by [[#SetUsers]].

The size of the output buffer in entries must be at least 8.

Normally the output bool is set to 0, however when no users are available it's set to 1 with '''total_entries''' = -1.

==== SetApplicationMemoryReservation ====
Takes an input u64, no output.

An Application must be currently running. The input u64 must be 0x1000-byte aligned.

==== ShouldSetGpuTimeSliceManually ====
No input, returns an output u8 bool.

==== GetLibraryAppletInfoEx ====
No input, returns an output u64. Currently always returns 0.

== IOverlayAppletProxy ==
This is "nn::am::service::IOverlayAppletProxy".

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || GetCommonStateGetter || Returns an [[#ICommonStateGetter]].
|-
| 1 || GetSelfController || Returns an [[#ISelfController]].
|-
| 2 || GetWindowController || Returns an [[#IWindowController]].
|-
| 3 || GetAudioController || Returns an [[#IAudioController]].
|-
| 4 || GetDisplayController || Returns an [[#IDisplayController]].
|-
| 10 || GetProcessWindingController || Returns an [[#IProcessWindingController]].
|-
| 11 || GetLibraryAppletCreator || Returns an [[#ILibraryAppletCreator]].
|-
| 20 || GetOverlayFunctions || Returns an [[#IOverlayFunctions]].
|-
| 21 || [7.0.0+] GetAppletCommonFunctions || No input, returns an [[#IAppletCommonFunctions]].
|-
| 23 || [15.0.0+] GetGlobalStateController || No input, returns an [[#IGlobalStateController]].
|-
| 1000 || GetDebugFunctions || Returns an [[#IDebugFunctions]].
|}

=== IOverlayFunctions ===
This is "nn::am::service::IOverlayFunctions".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#BeginToWatchShortHomeButtonMessage]]
|-
| 1 || [[#EndToWatchShortHomeButtonMessage]]
|-
| 2 || [[#GetApplicationIdForLogo]]
|-
| 3 || [[#SetGpuTimeSliceBoost]]
|-
| 4 || [2.0.0+] [[#SetAutoSleepTimeAndDimmingTimeEnabled]]
|-
| 5 || [2.0.0+] [[#TerminateApplicationAndSetReason]]
|-
| 6 || [3.0.0+] [[#SetScreenShotPermissionGlobally]]
|-
| 10 || [6.0.0+] [[#StartShutdownSequenceForOverlay]]
|-
| 11 || [6.0.0+] [[#StartRebootSequenceForOverlay]]
|-
| 20 || [8.0.0+] [[#SetHandlingHomeButtonShortPressedEnabled]]
|-
| 21 || [14.0.0+] SetHandlingTouchScreenInputEnabled
|-
| 30 || [9.0.0+] [[#SetHealthWarningShowingState]]
|-
| 31 || [10.0.0+] [[#IsHealthWarningRequired]]
|-
| 40 || [18.0.0+] GetApplicationNintendoLogo
|-
| 41 || [18.0.0+] GetApplicationStartupMovie
|-
| 50 || [19.0.0+] SetGpuTimeSliceBoostForApplication
|-
| 60 || [19.0.0+]
|-
| 61 || [S2]
|-
| 70 || [21.0.0+]
|-
| 71 || [21.0.0+]
|-
| 75 || [21.0.0+]
|-
| 90 || [7.0.0+] [[#SetRequiresGpuResourceUse]]
|-
| 101 || [5.0.0+] [[#BeginToObserveHidInputForDevelop]]
|-
| 110 || [S2]
|-
| 1000 || [S2]
|}

==== BeginToWatchShortHomeButtonMessage ====
No input/output.

==== EndToWatchShortHomeButtonMessage ====
No input/output.

==== GetApplicationIdForLogo ====
No input, returns an output [[NCM_services#ApplicationId|ApplicationId]].

Gets the ApplicationId for displaying the logo screen during application launch.

When no application is running, this returns success with ApplicationId=0.

==== SetGpuTimeSliceBoost ====
Takes an input u64, no output.

==== SetAutoSleepTimeAndDimmingTimeEnabled ====
Takes an input u8 bool, no output.

==== TerminateApplicationAndSetReason ====
Takes an input u32 Result, no output.

==== SetScreenShotPermissionGlobally ====
Takes an input u8 bool, no output.

==== StartShutdownSequenceForOverlay ====
No input/output.

On success, official sw will enter an infinite loop with sleep-thread value 86400000000000.

==== StartRebootSequenceForOverlay ====
No input/output.

On success, official sw will enter an infinite loop with sleep-thread value 86400000000000.

==== SetHandlingHomeButtonShortPressedEnabled ====
Takes an input u8 bool, no output.

==== SetHealthWarningShowingState ====
Takes an input u8 bool, no output.

This writes the input bool into state, signals an Event, and returns 0.

==== IsHealthWarningRequired ====
No input, returns an output u8 bool.

==== SetRequiresGpuResourceUse ====
Takes an input u8 bool, no output.

Just returns 0.

==== BeginToObserveHidInputForDevelop ====
No input/output.

Sets various state fields and signals an userspace-event.

Enables HID input for the OverlayApplet, without disabling input for the foreground applet.

== ICMenuProxy ==
This is "nn::am::service::ICMenuProxy".

This is exclusive to Switch 2.

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || GetCommonStateGetter || Returns an [[#ICommonStateGetter]].
|-
| 1 || GetSelfController || Returns an [[#ISelfController]].
|-
| 2 || GetWindowController || Returns an [[#IWindowController]].
|-
| 3 || GetAudioController || Returns an [[#IAudioController]].
|-
| 4 || GetDisplayController || Returns an [[#IDisplayController]].
|-
| 1000 || GetDebugFunctions || Returns an [[#IDebugFunctions]].
|-
| 10 || GetProcessWindingController || Returns an [[#IProcessWindingController]].
|-
| 11 || GetLibraryAppletCreator || Returns an [[#ILibraryAppletCreator]].
|-
| 20 || GetOverlayFunctions || Returns an [[#IOverlayFunctions]].
|-
| 21 || GetAppletCommonFunctions || No input, returns an [[#IAppletCommonFunctions]].
|-
| 23 || GetGlobalStateController || No input, returns an [[#IGlobalStateController]].
|-
| 24 || || No input, returns an [[#ICMenuFunctions|ICMenuFunctions]].
|}

=== ICMenuFunctions ===
This is "nn::am::service::ICMenuFunctions".

This is exclusive to Switch 2.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 ||
|-
| 1 ||
|-
| 2 ||
|-
| 3 ||
|-
| 4 ||
|-
| 5 ||
|-
| 6 ||
|-
| 10 ||
|-
| 11 ||
|-
| 20 ||
|-
| 21 ||
|-
| 30 ||
|-
| 31 ||
|-
| 40 ||
|-
| 41 ||
|-
| 50 ||
|-
| 60 ||
|-
| 61 ||
|-
| 90 ||
|-
| 101 ||
|-
| 110 ||
|-
| 1000 ||
|-
| 200 ||
|-
| 202 ||
|-
| 210 || [20.0.0+]
|-
| 220 || [20.0.0+]
|}

==== Cmd200 ====
No input, returns an [[#ILibraryAppletAgent|ILibraryAppletAgent]].

==== Cmd202 ====
Takes {...}, returns an [[#IFocusableLayer|IFocusableLayer]].

==== ILibraryAppletAgent ====
This is "nn::am::service::ILibraryAppletAgent".

This is exclusive to Switch 2.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 ||
|-
| 1 ||
|-
| 2 ||
|-
| 3 ||
|-
| 4 ||
|-
| 5 ||
|-
| 10 ||
|-
| 20 ||
|-
| 21 ||
|-
| 31 ||
|-
| 32 ||
|-
| 33 ||
|-
| 34 ||
|-
| 35 ||
|-
| 40 ||
|-
| 41 ||
|-
| 42 ||
|}

===== Cmd0 =====
No input, returns an [[#IStorage|IStorage]].

===== Cmd1 =====
Takes an unknown input interface, no output.

===== Cmd2 =====
No input, returns an [[#IStorage|IStorage]].

===== Cmd3 =====
Takes an unknown input interface, no output.

===== Cmd10 =====
No input, returns an [[#IStorage|IStorage]].

===== Cmd20 =====
Takes an unknown input interface, no output.

===== Cmd21 =====
Takes an unknown input interface, no output.

==== IFocusableLayer ====
This is "nn::am::service::IFocusableLayer".

This is exclusive to Switch 2.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 ||
|-
| 1 ||
|-
| 2 ||
|-
| 3 ||
|-
| 4 ||
|-
| 10 ||
|-
| 11 ||
|-
| 20 ||
|-
| 21 ||
|-
| 32 ||
|-
| 33 ||
|-
| 40 ||
|-
| 41 ||
|-
| 42 ||
|-
| 50 || [20.0.0+]
|-
| 51 || [20.0.0+]
|-
| 60 || [20.0.0+]
|-
| 70 || [20.0.0+]
|-
| 71 || [20.0.0+]
|}

== IApplicationProxy ==
This is "nn::am::service::IApplicationProxy".

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || GetCommonStateGetter || Returns an [[#ICommonStateGetter]].
|-
| 1 || GetSelfController || Returns an [[#ISelfController]].
|-
| 2 || GetWindowController || Returns an [[#IWindowController]].
|-
| 3 || GetAudioController || Returns an [[#IAudioController]].
|-
| 4 || GetDisplayController || Returns an [[#IDisplayController]].
|-
| 10 || GetProcessWindingController || Returns an [[#IProcessWindingController]].
|-
| 11 || GetLibraryAppletCreator || Returns an [[#ILibraryAppletCreator]].
|-
| 20 || GetApplicationFunctions || Returns an [[#IApplicationFunctions]].
|-
| 40 || [S2] || Returns an [[#IPerformanceFunctions|IPerformanceFunctions]].
|-
| 60 || [S2] || Returns an [[#IGraphicsScalingParametersFunctions|IGraphicsScalingParametersFunctions]].
|-
| 1000 || GetDebugFunctions || Returns an [[#IDebugFunctions]].
|}

=== IApplicationFunctions ===
This is "nn::am::service::IApplicationFunctions".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 1 || [[#PopLaunchParameter]]
|-
| 10 || [[#CreateApplicationAndPushAndRequestToStart]]
|-
| 11 || [3.0.0+] [[#CreateApplicationAndPushAndRequestToStartForQuest]]
|-
| 12 || [4.0.0+] [[#CreateApplicationAndRequestToStart]]
|-
| 13 || [4.0.0+] [[#CreateApplicationAndRequestToStartForQuest]]
|-
| 14 || [7.0.0+] [[#CreateApplicationWithAttributeAndPushAndRequestToStartForQuest]]
|-
| 15 || [7.0.0+] [[#CreateApplicationWithAttributeAndRequestToStartForQuest]]
|-
| 20 || [[#EnsureSaveData]]
|-
| 21 || [[#GetDesiredLanguage]]
|-
| 22 || [[#SetTerminateResult]]
|-
| 23 || [[#GetDisplayVersion]]
|-
| 24 || [2.0.0+] [[#GetLaunchStorageInfoForDebug]]
|-
| 25 || [3.0.0+] ExtendSaveData
|-
| 26 || [3.0.0+] GetSaveDataSize
|-
| 27 || [5.0.0+] CreateCacheStorage
|-
| 28 || [11.0.0+] [[#GetSaveDataSizeMax]]
|-
| 29 || [11.0.0+] [[#GetCacheStorageMax]]
|-
| 30 || [[#BeginBlockingHomeButtonShortAndLongPressed]]
|-
| 31 || [[#EndBlockingHomeButtonShortAndLongPressed]]
|-
| 32 || [[#BeginBlockingHomeButton]]
|-
| 33 || [[#EndBlockingHomeButton]]
|-
| 34 || [10.0.0-15.0.1] [[#SelectApplicationLicense]]
|-
| 35 || [11.0.0+] [[#GetDeviceSaveDataSizeMax]]
|-
| 36 || [14.0.0+] GetLimitedApplicationLicense
|-
| 37 || [14.0.0+] GetLimitedApplicationLicenseUpgradableEvent
|-
| 40 || [[#NotifyRunning]]
|-
| 50 || [2.0.0+] [[#GetPseudoDeviceId]]
|-
| 60 || [2.0.0+] [[#SetMediaPlaybackStateForApplication]]
|-
| 65 || [3.0.0+] [[#IsGamePlayRecordingSupported]]
|-
| 66 || [3.0.0+] [[#InitializeGamePlayRecording]]
|-
| 67 || [3.0.0+] [[#SetGamePlayRecordingState]]
|-
| 68 || [4.0.0+] [[#RequestFlushGamePlayingMovieForDebug]]
|-
| 70 || [3.0.0+] [[#RequestToShutdown]]
|-
| 71 || [3.0.0+] [[#RequestToReboot]]
|-
| 72 || [10.0.0+] [[#RequestToSleep]]
|-
| 80 || [4.0.0+] [[#ExitAndRequestToShowThanksMessage]]
|-
| 90 || [4.0.0+] [[#EnableApplicationCrashReport]]
|-
| 100 || [5.0.0+] [[#InitializeApplicationCopyrightFrameBuffer]]
|-
| 101 || [5.0.0+] [[#SetApplicationCopyrightImage]]
|-
| 102 || [5.0.0+] [[#SetApplicationCopyrightVisibility]]
|-
| 110 || [5.0.0+] [[#QueryApplicationPlayStatistics]]
|-
| 111 || [6.0.0+] [[#QueryApplicationPlayStatisticsByUid]]
|-
| 112 || [20.0.0+]
|-
| 113 || [20.0.0+]
|-
| 120 || [5.0.0+] [[#ExecuteProgram]]
|-
| 121 || [5.0.0+] [[#ClearUserChannel]]
|-
| 122 || [5.0.0+] [[#UnpopToUserChannel]]
|-
| 123 || [5.0.0+] [[#GetPreviousProgramIndex]]
|-
| 124 || [6.0.0+] [[#EnableApplicationAllThreadDumpOnCrash]]
|-
| 130 || [8.0.0+] [[#GetGpuErrorDetectedSystemEvent]]
|-
| 131 || [11.0.0+] [[#SetDelayTimeToAbortOnGpuError]]
|-
| 140 || [9.0.0+] [[#GetFriendInvitationStorageChannelEvent]]
|-
| 141 || [9.0.0+] [[#TryPopFromFriendInvitationStorageChannel]]
|-
| 150 || [9.0.0+] [[#GetNotificationStorageChannelEvent]]
|-
| 151 || [9.0.0+] [[#TryPopFromNotificationStorageChannel]]
|-
| 160 || [9.0.0+] [[#GetHealthWarningDisappearedSystemEvent]]
|-
| 170 || [9.0.0+] [[#SetHdcpAuthenticationActivated]]
|-
| 180 || [10.1.0+] [[#GetLaunchRequiredVersion]]
|-
| 181 || [10.1.0+] [[#UpgradeLaunchRequiredVersion]]
|-
| 190 || [11.0.0+] [[#SendServerMaintenanceOverlayNotification]]
|-
| 200 || [11.0.0+] [[#GetLastApplicationExitReason]]
|-
| 210 || [20.0.0+]
|-
| 220 || [20.0.0+] [[#SetAudioOutputPolicy|SetAudioOutputPolicy]]
|-
| 230 || [S2] [20.0.0+] IsTensorRtSupported
|-
| 300 || [19.0.0+] [[#CreateMovieWriter]]
|-
| 310 || [20.0.0+] [[#RequestExitApplicationAndTryPopMessage|RequestExitApplicationAndTryPopMessage]]
|-
| 320 || [20.0.0+]
|-
| 321 || [S2] [20.0.0+]
|-
| 330 || [20.2.0+] IsLanguageSelectionLimited
|-
| 500 || [5.0.0+] [[#StartContinuousRecordingFlushForDebug]]
|-
| 1000 || [5.0.0+] [[#CreateMovieMaker]]
|-
| 1001 || [5.0.0+] [[#PrepareForJit]]
|}

The BOTW game uses this GamePlayRecording functionality from the main-nso "nninitStartup" function, with size 0x6000000(96MiB). The official GamePlayRecording-enable code does the following(this will panic on any failure):
* [[SVC|Creates]] TransferMemory using the input buffer and size, with permissions=0.
* Uses [[#InitializeGamePlayRecording]] with the TransferMemory.
* Closes the TransferMemory handle, + TransferMemory cleanup.
* Uses [[#SetGamePlayRecordingState]] with value 0x1.
This GamePlayRecording functionality presumably enables the video-recording usable starting with [[4.0.0]].

==== PopLaunchParameter ====
Takes an input u32 [[#LaunchParameterKind]], returns an output [[#IStorage]].

Pops a LaunchParameter [[#IStorage]], the storage will be removed from sysmodule state during this.

==== CreateApplicationAndPushAndRequestToStart ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]] and an input [[#IStorage]], no output. ApplicationId=0 can be used to relaunch the current application.

==== CreateApplicationAndPushAndRequestToStartForQuest ====
Takes 2 input u32s (loaded from struct [[#ApplicationAttributeForQuest]]), an input [[NCM_services#ApplicationId|ApplicationId]], and an input [[#IStorage]], no output.

==== CreateApplicationAndRequestToStart ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], no output.

Same as [[#CreateApplicationAndPushAndRequestToStart]] except without the input storage, official sw uses this when no input storage is specified.

==== CreateApplicationAndRequestToStartForQuest ====
Takes 2 input u32s (loaded from struct [[#ApplicationAttributeForQuest]]) and an input [[NCM_services#ApplicationId|ApplicationId]], no output.

Same as [[#CreateApplicationAndPushAndRequestToStartForQuest]] except without the input storage, official sw uses this when no input storage is specified.

==== CreateApplicationWithAttributeAndPushAndRequestToStartForQuest ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], a type-0x15 input buffer containing an [[#ApplicationAttribute]], an input [[#IStorage]], no output.

[21.0.0+] Now returns an output [[#IStorage]].

Same as [[#CreateApplicationAndPushAndRequestToStartForQuest]] except the entire attributes structure is directly specified via the input buffer. This command replaces [[#CreateApplicationAndPushAndRequestToStartForQuest]], official user-processes no longer use [[#CreateApplicationAndPushAndRequestToStartForQuest]].

==== CreateApplicationWithAttributeAndRequestToStartForQuest ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]] and a type-0x15 input buffer containing an [[#ApplicationAttribute]], no output.

Same as [[#CreateApplicationAndRequestToStartForQuest]] except the entire attributes structure is directly specified via the input buffer. This command replaces [[#CreateApplicationAndRequestToStartForQuest]], official user-processes no longer use [[#CreateApplicationAndPushAndRequestToStartForQuest]].

==== EnsureSaveData ====
Takes an input u128 userID, returns an output u64 size.

Calls sdk func <code>nn::fs::EnsureApplicationSaveData</code>. [[qlaunch]] also calls this same sdk func directly.

Creates the various savedata as specified by the application [[NACP_Format|control.nacp]] when the savedata doesn't exist.

Official user-processes launch the dataErase LibraryApplet depending on the Result, the above output size is used with this.

==== GetDesiredLanguage ====
No input, returns an output [[Settings_services#LanguageCode|LanguageCode]].

==== SetTerminateResult ====
Takes an input u32 '''Result''', no output.

For example, in some cases official apps use this with [[Error_codes|error]] 0x2A2 then uses svcBreak.

==== GetDisplayVersion ====
No input, returns an output 0x10-byte struct.

The output struct is "nn::oe::DisplayVersion". This the DisplayVersion string copied from the application [[NACP_Format|control.nacp]], this is always NUL-terminated.

==== GetLaunchStorageInfoForDebug ====
No input, returns an output u8 [[Filesystem_services#StorageId|StorageId]] and u8 [[Filesystem_services#StorageId|StorageId]].

This returns two u8s loaded from state, these are the same StorageIds from [[#ApplicationLaunchProperty]].

==== GetSaveDataSizeMax ====
No input, returns two ouput s64s.

==== GetCacheStorageMax ====
No input, returns an output s32 and s64.

==== BeginBlockingHomeButtonShortAndLongPressed ====
Takes an input s64, no output.

Official user-processes use hard-coded value 0 for the s64.

Starts blocking the Home button.

==== EndBlockingHomeButtonShortAndLongPressed ====
No input/output.

Ends the blocking started by [[#BeginBlockingHomeButtonShortAndLongPressed]].

==== BeginBlockingHomeButton ====
Takes an input s64 nanoseconds, no output. The input nanoseconds can be zero.

==== EndBlockingHomeButton ====
No input/output.

==== SelectApplicationLicense ====
Takes an input array of [[#ApplicationLicenseType]], returns an output [[#ApplicationLicenseType]].

==== GetDeviceSaveDataSizeMax ====
No input, returns two output s64s.

==== NotifyRunning ====
Takes no input. Returns an output u8 bool, which is ignored by official user-processes.

==== GetPseudoDeviceId ====
No input, returns an output 0x10-byte "nn::util::Uuid" struct.

The 0x20-byte output data from [[NS_Services|GetSystemSeedForPseudoDeviceId]] followed by the 8-byte [[NACP_Format|SeedForPseudoDeviceId]] from the current control.nacp, is hashed with SHA1. Then "nn::util::GenerateUuidVersion5" is called with the final hash, the output from this is then returned for the Uuid.

==== SetMediaPlaybackStateForApplication ====
Takes an input u8 bool, no output.

==== IsGamePlayRecordingSupported ====
No input, returns an output u8 bool.

==== InitializeGamePlayRecording ====
Takes a TransferMemory handle and an u64 for the size of the TransferMemory. The size must match 0x6000000 otherwise an error is returned.

==== SetGamePlayRecordingState ====
Takes an input u32. 0 = disable/pause, 1 = enable/restart.

==== RequestFlushGamePlayingMovieForDebug ====
No input/output.

Requests to save the video recording, as if the Capture-button was held.

==== RequestToShutdown ====
No input/output.

On success, official sw will enter an infinite loop with sleep-thread value 86400000000000.

==== RequestToReboot ====
No input/output.

On success, official sw will enter an infinite loop with sleep-thread value 86400000000000.

==== RequestToSleep ====
No input/output.

==== ExitAndRequestToShowThanksMessage ====
No input/output.

Used to exit the application and return to the kiosk menu. Official sw uses [[#UnlockExit]] immediately before this if needed.

On success, official sw will enter an infinite loop with sleep-thread value 86400000000000.

This throws an error when the cached [[Settings_services#GetQuestFlag]] value is 0.

==== EnableApplicationCrashReport ====
Takes an input u8 bool, no output.

==== InitializeApplicationCopyrightFrameBuffer ====
Takes an input TransferMemory handle, an s32 '''width''', an s32 '''height''', an u64 tmem_size, and no output.

tmem_size must be 0x40000-byte aligned. '''width''' must be 1-1280, and '''height''' must be 1-720.

User-processes create the tmem with an user-specified buffer with permissions=0. '''width''' = 1280 and '''height''' = 720.

After the validation checks pass the input is passed to [[OMM_services|ommdisp]] cmd500.

This is used as an overlay for screenshots.

==== SetApplicationCopyrightImage ====
Takes a type-0x45 input buffer, an s32 '''x''', an s32 '''y''', an s32 '''width''', an s32 '''height''', an s32 [[#WindowOriginMode]], and no output.

'''x''' and '''y''' must not have the negative bit set. '''width''' and '''height''' must not be <1.

Sets the RGBA8 image for use with [[#InitializeApplicationCopyrightFrameBuffer]]. Overrides the current image, if this was already used previously.

==== SetApplicationCopyrightVisibility ====
Takes an input u8 bool, no output.

Sets the visibility for the image set by [[#SetApplicationCopyrightImage]], in screenshots. By default it's visible.

==== QueryApplicationPlayStatistics ====
Takes a type-0x6 output buffer containing an array of [[Shared_Database_services|ApplicationPlayStatistics]] and a type-0x5 input buffer containing an array of [[NCM_services#ApplicationId|ApplicationId]]. Returns an output s32 for actual total output entries.

The number of entries in each array is the same.

See also [[NACP_Format#PlayLogQueryCapability|PlayLogQueryCapability]].

This uses [[Shared_Database_services|pdm:qry]] QueryApplicationPlayStatisticsForSystem.

==== QueryApplicationPlayStatisticsByUid ====
Takes a u128 userID, a type-0x6 output buffer containing an array of [[Shared_Database_services|ApplicationPlayStatistics]] and a type-0x5 input buffer containing an array of [[NCM_services#ApplicationId|ApplicationId]]. Returns an output s32 for actual total output entries.

Same as [[#QueryApplicationPlayStatistics]] except this uses [[Shared_Database_services|pdm:qry]] cmd16, to get playstats specific to userIDs.

==== ExecuteProgram ====
Takes an input u32 [[#ProgramSpecifyKind]] and an input u64, no output.

==== ClearUserChannel ====
No input/output.

Clears the UserChannel used by [[#UnpopToUserChannel]].

==== UnpopToUserChannel ====
Takes an input [[#IStorage]], no output.

The input storage is pushed to the UserChannel. This is the same channel used by [[#LaunchParameterKind]] value 1.

User-processes create a storage using data specified by the user (written to offset=0 size=inputsize), with max size 0x1000. This storage is then used with this cmd.

==== GetPreviousProgramIndex ====
No input, returns an output s32.

Gets the ProgramIndex of the Application which launched this title. The output ProgramIndex is -1 when there was no previous title.

==== EnableApplicationAllThreadDumpOnCrash ====
Takes an input u8 bool, no output.

==== GetGpuErrorDetectedSystemEvent ====
No input, returns an output Event handle with autoclear=false.

This is used by sdknso during applet-application initialization. A separate thread is setup where event-waiting is handled. When the Event is signaled, official sw will Abort.

==== SetDelayTimeToAbortOnGpuError ====
Takes an input s64 "nn::TimeSpan", no output.

==== GetFriendInvitationStorageChannelEvent ====
No input, returns an output Event handle with EventClearMode=0.

This is exposed by sdknso under <code>nn::friends::</code>. This returns a ptr to the cached Event in global state, with the Event being loaded if not previously initialized.

==== TryPopFromFriendInvitationStorageChannel ====
No input, returns an output [[#IStorage]].

This uses the same StorageChannel as [[#PushToFriendInvitationStorageChannel]].

This is exposed by sdknso under <code>nn::friends::</code>. When the storage_size is <0x10, this returns false. <code>data_size = storage_size-0x10;</code> Then the first 0x10-bytes from storage are read to stack, which is later copied to the output Uid on success prior to returning. Then the storage is read into the specified output buffer with storage-offset 0x10, where the size is <code>size = data_size > buf_size ? buf_size : data_size</code>. Reading is skipped if size is zero. Afterwards the used size is written to an output param. On success, true is returned.

==== GetNotificationStorageChannelEvent ====
No input, returns an output Event handle with EventClearMode=0.

This is exposed by sdknso under <code>nn::notification::</code>. This returns a ptr to the cached Event in global state, with the Event being loaded if not previously initialized.

==== TryPopFromNotificationStorageChannel ====
No input, returns an output [[#IStorage]].

This uses the same StorageChannel as [[#PushToNotificationStorageChannel]].

This is exposed by sdknso under <code>nn::notification::</code>. The storage is read into the specified output buffer, where the size is <code>size = storage_size > buf_size ? buf_size : storage_size</code>. Reading is skipped if size is zero. Afterwards the used size is written to an output param.

==== GetHealthWarningDisappearedSystemEvent ====
No input, returns an output Event with EventClearMode=0.

==== SetHdcpAuthenticationActivated ====
Takes an input u8 bool, no output.

==== GetLaunchRequiredVersion ====
Takes an input [[NCM_services#ApplicationId|ApplicationId]], an u64, returns an output [[#LaunchRequiredVersion]].

sdknso passes hard-coded value 0 for the u64.

==== UpgradeLaunchRequiredVersion ====
Takes an input [[#LaunchRequiredVersion]], an [[NCM_services#ApplicationId|ApplicationId]], an u64, no output.

sdknso passes hard-coded value 0 for the u64.

==== SendServerMaintenanceOverlayNotification ====
Takes two input [[PCV_services#PosixTime|PosixTime]], no output.

The second input value can optionally be 0.

==== GetLastApplicationExitReason ====
No input, returns an output s32.

==== Cmd210 ====
No input, returns an output Event handle.

==== SetAudioOutputPolicy ====
Takes an input u8, no output.

The input must be <=1.

==== CreateMovieWriter ====
Takes 8-bytes of input and a handle. Returns an [[#IMovieWriter]].

This internally uses the GRC cmd to open an [[GRC_services|IMovieWriter]]. This is therefore not usable on NX since that cmd is stubbed.

==== RequestExitApplicationAndTryPopMessage ====
Takes an input [[#IStorage|IStorage]], no output.

[21.0.0+] Now additionally takes a total of 0x18-bytes of input.

==== IsLanguageSelectionLimited ====
No input, returns 1-byte of output.

On NX this just writes 0 to output and returns 0.

==== StartContinuousRecordingFlushForDebug ====
Takes an input s64 nanoseconds-value, returns an output Event handle with autoclear=false.

The cached value loaded from [[System_Settings|system-setting]] <code>am.debug!dev_function</code> must be set to 0x1 with size 0x1, otherwise an error is returned.

==== CreateMovieMaker ====
Takes an input u64 size and a TransferMemory handle, returns an [[#IMovieMaker]].

Official sw retries using the cmd in a loop on error 0x8D4 with svcSleepThread(100000000) being used first.

Official sw uses permissions=None for the TransferMemory, with an user-specified buffer. The size of the buffer used by official sw is 0x6000000.

==== PrepareForJit ====
Takes no input. Launches the [[JIT_services|jit-sysmodule]] via [[NS_Services|ns]] LaunchLibraryApplet if it has not already been launched for the current application, storing a std::shared_ptr<> for jit-sysmodule process tracking object as an IApplicationFunctions member.

~IApplicationFunctions() includes:

if (this->jit_process) {
Terminate(this->jit_process);
this->jit_process = nullptr;
}

Thus the lifetime of the jit sysmodule is tied to the application which uses it, and each application gets its own fresh copy of the jit sysmodule.

AM can also optionally launch jit-sysmodule automatically if the [[NACP]] enables it.

[S2] This is no longer usable since this returns Result 0x408 (sysmodule doesn't exist).

=== IMovieWriter ===
This is "nn::am::service::IMovieWriter".

This was added with [19.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 ||
|}

==== Cmd0 ====
No input. Returns a GRC [[GRC_services|IMovieWriter]].

=== IMovieMaker ===
This is "nn::am::service::IMovieMaker".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#GetGrcMovieMaker]]
|-
| 1 || [[#GetLayerHandle]]
|}

==== GetGrcMovieMaker ====
No input, returns a GRC [[GRC_services|IMovieMaker]].

==== GetLayerHandle ====
No input, returns an output u64.

=== IPerformanceFunctions ===
This is "nn::am::service::IPerformanceFunctions".

This is exclusive to Switch 2.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || IsCpuOverclockEnabled
|-
| 1 || SetCpuOverclockEnabled
|}

=== IGraphicsScalingParametersFunctions ===
This is "nn::am::service::IGraphicsScalingParametersFunctions".

This is exclusive to Switch 2.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 10 || GetGraphicsScalingParameters
|-
| 1000 || SetSupportingGraphicsScalingParametersForDebug
|-
| 1010 || SetGpuQuotaForDebug
|-
| 1020 || ClearGpuQuotaForDebug
|-
| 1030 || SetScreenRatioForDebug
|-
| 1040 || ClearScreenRatioForDebug
|-
| 1050 || SetGraphicsScaleChangedNotificationEnabled
|}

== ILibraryAppletCreator ==
This is "nn::am::service::ILibraryAppletCreator".

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || [[#CreateLibraryAppletOld|CreateLibraryAppletOld]] ([1.0.0-19.0.1] CreateLibraryApplet) ||
|-
| 1 || [[#TerminateAllLibraryApplets]] ||
|-
| 2 || [[#AreAnyLibraryAppletsLeft]] ||
|-
| 3 || [20.0.0+] [[#CreateLibraryApplet|CreateLibraryApplet]] ||
|-
| 10 || [[#CreateStorage]] ||
|-
| 11 || [[#CreateTransferMemoryStorage]] ||
|-
| 12 || [2.0.0+] [[#CreateHandleStorage]] ||
|}

=== CreateLibraryAppletOld ===
Unofficial name.

Takes 2 input u32s [[#AppletId]] and [[#LibraryAppletMode]], returns an [[#ILibraryAppletAccessor]].

=== TerminateAllLibraryApplets ===
No input/output.

Stubbed with an ILibraryAppletCreator from [[#CreateSelfLibraryAppletCreatorForDevelop]], just returns an error.

Terminates all LibraryApplets which were created by the current applet (or by the Application when used from the [[#IApplicationAccessor]] cmd).

=== AreAnyLibraryAppletsLeft ===
No input, returns an output u8 bool.

Stubbed with an ILibraryAppletCreator from [[#CreateSelfLibraryAppletCreatorForDevelop]], just returns an error.

Gets whether any LibraryApplets ([[#ILibraryAppletAccessor]]) which were created by the current applet are still open (or by the Application when used from the [[#IApplicationAccessor]] cmd).

=== CreateLibraryApplet ===
Unofficial name.

Takes 2 input u32s [[#AppletId]] and [[#LibraryAppletMode]], an u64 ThreadId, returns an [[#ILibraryAppletAccessor]].

The ThreadId is from the current-thread of the user-process which is using the cmd.

=== CreateStorage ===
Takes an input s64 for the storage size, returns an [[#IStorage]].

This allocates a buffer with the specified size which can then be accessed via [[#IStorageAccessor]].

=== CreateTransferMemoryStorage ===
Takes an input TransferMemory copy-handle, an input u8 bool, and an s64 size, returns an [[#IStorage]].

The user-process creates the TransferMemory with permissions=0.

The TransferMemory is mapped, which can then be accessed via [[#IStorageAccessor]]. The input bool controls whether writing to the storage is allowed: [[#Write]] will throw an error if this flag is not set.

=== CreateHandleStorage ===
Takes an input copy-handle and an input s64, returns an [[#IStorage]]. In some cases the s64 must not have the negative bit set.

The input can be arbitrary, however official sw is only (?) known to use this for TransferMemory (with s64=size).

=== ILibraryAppletAccessor ===
This is "nn::am::service::ILibraryAppletAccessor".

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || [[#GetAppletStateChangedEvent]] ||
|-
| 1 || [[#IsCompleted]] ||
|-
| 10 || [[#Start]] ||
|-
| 20 || [[#RequestExit]] ||
|-
| 25 || [[#Terminate]] ||
|-
| 30 || [[#GetResult]] ||
|-
| 50 || [[#SetOutOfFocusApplicationSuspendingEnabled]] ||
|-
| 60 || [10.0.0+] [[#PresetLibraryAppletGpuTimeSliceZero]] ||
|-
| 70 || [S2] ||
|-
| 80 || [19.0.0+] RequestForLibraryAppletToGetForeground ||
|-
| 81 || [19.0.0+] GetCurrentChildLibraryApplet ||
|-
| 90 || [20.0.0+] ||
|-
| 100 || [[#PushInData]] ||
|-
| 101 || [[#PopOutData]] ||
|-
| 102 || [[#PushExtraStorage]] ||
|-
| 103 || [[#PushInteractiveInData]] ||
|-
| 104 || [[#PopInteractiveOutData]] ||
|-
| 105 || [[#GetPopOutDataEvent]] ||
|-
| 106 || [[#GetPopInteractiveOutDataEvent]] ||
|-
| 110 || [[#NeedsToExitProcess]] ||
|-
| 120 || [[#GetLibraryAppletInfo]] ||
|-
| 150 || [[#RequestForAppletToGetForeground]] ||
|-
| 160 || [2.0.0+] [[#GetIndirectLayerConsumerHandle]] ||
|-
| 170 || [22.0.0+]
|}

Commands <=30 are inherited from [[#IAppletAccessor]]. GetLibraryAppletInfo is identical to the [[#ILibraryAppletSelfAccessor]] cmd.

==== SetOutOfFocusApplicationSuspendingEnabled ====
Takes an input u8 bool, no output.

Official sw will assert prior to using this if applet-service was not initialized as *Application.

==== PresetLibraryAppletGpuTimeSliceZero ====
No input/output.

sdknso only uses with with [[Software_Keyboard|swkbd-inline]], immediately after creating the LibraryApplet.

==== PushInData ====
Takes an input [[#IStorage]], no output.

==== PopOutData ====
No input, returns an output [[#IStorage]].

==== PushExtraStorage ====
Takes an input [[#IStorage]], no output.

==== PushInteractiveInData ====
Takes an input [[#IStorage]], no output.

==== PopInteractiveOutData ====
No input, returns an output [[#IStorage]].

==== GetPopOutDataEvent ====
No input, returns an output handle with autoclear=false.

==== GetPopInteractiveOutDataEvent ====
No input, returns an output event handle with autoclear=false.

==== NeedsToExitProcess ====
No input, returns an output u8 bool.

Stubbed, just returns an error.

==== RequestForAppletToGetForeground ====
No input/output.

Stubbed, just returns an error.

==== GetIndirectLayerConsumerHandle ====
Takes an input PID and an input u64 AppletResourceUserId, returns an output u64 IndirectLayerConsumerHandle.

Official sw uses this during LibraryApplet creation when [[#LibraryAppletMode]] is 0x3.

== ICommonStateGetter ==
This is "nn::am::service::ICommonStateGetter".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#GetEventHandle]]
|-
| 1 || [[#ReceiveMessage]]
|-
| 2 || [[#GetThisAppletKind]]
|-
| 3 || [[#AllowToEnterSleep]]
|-
| 4 || [[#DisallowToEnterSleep]]
|-
| 5 || [[#GetOperationMode]]
|-
| 6 || [[#GetPerformanceMode]]
|-
| 7 || [[#GetCradleStatus]]
|-
| 8 || [[#GetBootMode]]
|-
| 9 || [[#GetCurrentFocusState]]
|-
| 10 || [[#RequestToAcquireSleepLock]]
|-
| 11 || [[#ReleaseSleepLock]]
|-
| 12 || [[#ReleaseSleepLockTransiently]]
|-
| 13 || [[#GetAcquiredSleepLockEvent]]
|-
| 14 || [11.0.0+] [[#GetWakeupCount]]
|-
| 15 || [19.0.0+]
|-
| 20 || [[#PushToGeneralChannel]]
|-
| 30 || [[#GetHomeButtonReaderLockAccessor]]
|-
| 31 || [2.0.0+] [[#GetReaderLockAccessorEx]]
|-
| 32 || [7.0.0+] [[#GetWriterLockAccessorEx]]
|-
| 40 || [2.0.0+] [[#GetCradleFwVersion]]
|-
| 50 || [3.0.0+] [[#IsVrModeEnabled]]
|-
| 51 || [3.0.0+] [[#SetVrModeEnabled]]
|-
| 52 || [4.0.0+] [[#SetLcdBacklighOffEnabled]]
|-
| 53 || [7.0.0+] [[#BeginVrModeEx]]
|-
| 54 || [7.0.0+] [[#EndVrModeEx]]
|-
| 55 || [3.0.0+] [[#IsInControllerFirmwareUpdateSection]]
|-
| 59 || [11.0.0+] [[#SetVrPositionForDebug]]
|-
| 60 || [3.0.0+] [[#GetDefaultDisplayResolution]]
|-
| 61 || [3.0.0+] [[#GetDefaultDisplayResolutionChangeEvent]]
|-
| 62 || [4.0.0+] [[#GetHdcpAuthenticationState]]
|-
| 63 || [4.0.0+] [[#GetHdcpAuthenticationStateChangeEvent]]
|-
| 64 || [5.0.0+] [[#SetTvPowerStateMatchingMode]]
|-
| 65 || [5.1.0+] [[#GetApplicationIdByContentActionName]]
|-
| 66 || [6.0.0+] [[#SetCpuBoostMode]]
|-
| 67 || [10.0.0+] [[#CancelCpuBoostMode]]
|-
| 68 || [11.0.0+] [[#GetBuiltInDisplayType]]
|-
| 80 || [6.0.0+] [[#PerformSystemButtonPressingIfInFocus]]
|-
| 90 || [7.0.0+] [[#SetPerformanceConfigurationChangedNotification]]
|-
| 91 || [7.0.0+] [[#GetCurrentPerformanceConfiguration]]
|-
| 100 || [9.1.0+] [[#SetHandlingHomeButtonShortPressedEnabled]]
|-
| 110 || [11.0.0+] [[#OpenMyGpuErrorHandler]]
|-
| 120 || [13.0.0+] GetAppletLaunchedHistory
|-
| 130 || [21.0.0+] EnableStartupLogoDisappearedMessage
|-
| 200 || [7.0.0+] [[#GetOperationModeSystemInfo]]
|-
| 300 || [9.0.0+] [[#GetSettingsPlatformRegion]]
|-
| 400 || [10.0.0+] [[#ActivateMigrationService]]
|-
| 401 || [10.0.0+] [[#DeactivateMigrationService]]
|-
| 500 || [11.0.0+] [[#DisableSleepTillShutdown]]
|-
| 501 || [11.0.0+] [[#SuppressDisablingSleepTemporarily]]
|-
| 502 || [12.0.0+] IsSleepEnabled
|-
| 503 || [12.0.0+] IsDisablingSleepSuppressed
|-
| 600 || [20.0.0+] SetHidInputMagnificationForApplication ([17.0.0-18.1.0] OpenNamedChannelAsChild)
|-
| 610 || [21.0.0+]
|-
| 611 || [22.0.0+]
|-
| 650 || [S2] BeginUsingCameraResource
|-
| 651 || [S2] EndUsingCameraResource
|-
| 900 || [11.0.0+] [[#SetRequestExitToLibraryAppletAtExecuteNextProgramEnabled]]
|-
| 910 || [17.0.0+] GetLaunchRequiredTick
|-
| 1000 || [19.0.0+] BeginVrMode3d
|-
| 1001 || [19.0.0+] EndVrMode3d
|-
| 1002 || [19.0.0+] IsVrModeEnabled3d
|-
| 1003 || [21.0.0+] GetVrLaboGoggleViewport
|-
| 1004 || [21.0.0+] GetPanelPhysicalSizeForSpecificTitle
|-
| 1005 || [21.0.0+] GetPanelResolutionForSpecificTitle
|-
| 2000 || [S2] SetRtcModeChangedMessageEnabled
|-
| 2010 || [S2] GetCurrentDisplayLayoutRatio
|}

Officially notification messages are handled by the application itself, not sdk-nso in ExeFS. Official apps call code in sdk-nso which basically uses svcWaitSynchronization with the event from [[#GetEventHandle]] to check whether a message is available, then if so it uses [[#ReceiveMessage]]. The actual handling for message IDs is done in the app itself(see [[#AppletMessage]]).

[7.0.0+] User-processes now use BeginVrModeEx/EndVrModeEx instead of [[#SetVrModeEnabled]]. Prior to using using BeginVrModeEx, [[Parental_Control_services|pctl]] IsStereoVisionPermitted is used and error 0xD08E is thrown if not allowed by pctl.

=== GetEventHandle ===
No input. Returns an output event handle. This is signalled when a message is available with [[#ReceiveMessage]].

=== ReceiveMessage ===
No input. Returns an output [[#AppletMessage]]. Error 0x680 indicates no message is available.

=== GetThisAppletKind ===
No input, returns an output [[#AppletKind]].

Stubbed, just returns an error.

=== AllowToEnterSleep ===
No input/output.

Stubbed, just returns an error.

=== DisallowToEnterSleep ===
No input/output.

Stubbed, just returns an error.

=== GetOperationMode ===
No input. Returns an output u8 for the current [[#OperationMode]].

=== GetPerformanceMode ===
No input. Returns an output u32 for the current [[#PerformanceMode]].

=== GetCradleStatus ===
No input, returns an output u8.

This uses [[#omm]] GetCradleStatus.

=== GetBootMode ===
No input, returns an output u8.

Returns the value from [[Process_Manager_services|pm:bm]] GetBootMode.

=== GetCurrentFocusState ===
No input. Returns an output u8 [[#FocusState]].

=== RequestToAcquireSleepLock ===
No input/output.

=== ReleaseSleepLock ===
No input/output.

=== ReleaseSleepLockTransiently ===
No input/output.

=== GetAcquiredSleepLockEvent ===
No input, returns an output Event handle with autoclear=false.

=== GetWakeupCount ===
No input, returns an output u64.

=== PushToGeneralChannel ===
Takes an input [[#IStorage]], no output.

This is not usable under an Application, however it is usable under a LibraryApplet.

Used for sending requests to [[qlaunch]]. sdk-nso creates a 0x10-byte storage which is sent to this. The following are the functions which use this, with the data written to the storage:
* <code>RequestHomeMenu</code> <code>5341 4d53 0100 0000 0200 0000 0100 0000</code> Returns to the main Home Menu, equivalent to pressing the HOME button.
* <code>RequestJumpToSystemUpdate</code> <code>5341 4d53 0100 0000 0b00 0000 0100 0000</code> Equivalent to entering "System Update" under System Settings. When leaving this, it returns to the main Home Menu.

=== GetHomeButtonReaderLockAccessor ===
No input, returns an output [[#ILockAccessor]].

Similar to using [[#GetReaderLockAccessorEx]] with inval=0.

=== GetReaderLockAccessorEx ===
Takes an input u32, returns an output [[#ILockAccessor]].

The input value must be 0-3. 0 = HomeButton.

=== GetWriterLockAccessorEx ===
Takes an input u32, returns an output [[#ILockAccessor]].

The input value must be 0-3. 0 = HomeButton.

=== GetCradleFwVersion ===
No input, returns 4 output u32s.

This uses [[#omm]] GetCradleFwVersion.

=== IsVrModeEnabled ===
No input, returns an output u8 bool.

=== SetVrModeEnabled ===
Takes an input u8 bool flag. No output.

Updates internal AM state fields. If the new state doesn't match the previous state, this uses the [[Backlight_services]] {Disable/Enable}VrMode command depending on whether flag={disable/enable}.

When the VrMode is set to true, the console shows a screen rendered like vr asking the user to move his face away and hit the 'close' button. When this button is pressed, the console resets the vrMode to false.

=== SetLcdBacklighOffEnabled ===
Takes an input u8 bool, no output.

Sets whether the LCD screen blacklight is turned off.

=== BeginVrModeEx ===
No input/output.

Identical to [[#SetVrModeEnabled]] except with hard-coded flag=1.

=== EndVrModeEx ===
No input/output.

Identical to [[#SetVrModeEnabled]] except with hard-coded flag=0.

=== IsInControllerFirmwareUpdateSection ===
No input, returns an output u8 bool.

=== SetVrPositionForDebug ===
Takes 4 input s32s, no output.

The s32s are: x, y, width, height.

The cached value loaded from [[Settings_services#GetDebugModeFlag]] must be 1, otherwise an error is returned.

width must be 1-1280, height must be 1-720.

x and y must not be negative. x+width must be <=1280. y+height must be <=720.

=== GetDefaultDisplayResolution ===
No input, returns two output s32s '''width''' and '''height'''.

=== GetDefaultDisplayResolutionChangeEvent ===
No input, returns an output Event handle with autoclear=true.

=== GetHdcpAuthenticationState ===
No input, returns an output s32.

=== GetHdcpAuthenticationStateChangeEvent ===
No input, returns an output Event handle with autoclear=true.

=== SetTvPowerStateMatchingMode ===
Takes an input s32 [[#TvPowerStateMatchingMode]], no output.

=== GetApplicationIdByContentActionName ===
Takes a type-0x5 input buffer containing a string, returns an output [[NCM_services#ApplicationId|ApplicationId]].

Gets the ApplicationId for the specified ContentActionName string. Returns an error when the current [[#AppletId]] isn't 0x04 (when the current applet isn't a SystemApplication).

=== SetCpuBoostMode ===
Takes an input u32 [[#CpuBoostMode]] and passes it to [[PPC_services#apm:sys|SetCpuBoostMode]].

=== CancelCpuBoostMode ===
No input/output.

=== GetBuiltInDisplayType ===
No input, returns an output s32.

This is not exposed by sdknso.

This loads a s32 index from global state (originates from [[SPL_services#GetConfig|GetConfig]] [[SMC#HardwareType|HardwareType]]), Aborts if it's out-of-bounds, then the following is returned for the output s32: global_array[loaded_index].

=== PerformSystemButtonPressingIfInFocus ===
Takes an input [[#SystemButtonType]], no output.

Just returns 0 when a state field is not value 1. Verifies that the input button is allowed, then calls the same func as [[#PerformSystemButtonPressing]] internally.

=== SetPerformanceConfigurationChangedNotification ===
Takes an input u8 bool, no output.

=== GetCurrentPerformanceConfiguration ===
No input, returns the result of calling [[PPC_services#apm:sys|GetCurrentPerformanceConfiguration]].

=== OpenMyGpuErrorHandler ===
No input, returns an [[#IGpuErrorHandler]].

The cached value loaded from [[Settings_services#GetDebugModeFlag]] must be 1, otherwise an error is returned.

=== GetOperationModeSystemInfo ===
No input, returns an output u32.

This returns the output from [[#GetOperationModeSystemInfo_2|omm GetOperationModeSystemInfo]].

=== GetSettingsPlatformRegion ===
No input, returns an output u8.

This just returns the output from [[Settings_services#GetPlatformRegion|setsys GetPlatformRegion]].

=== ActivateMigrationService ===
No input/output.

Besides various other functionality, if required this eventually uses [[NS_Services|ns]] LaunchLibraryApplet to launch [[Migration_services|migration]].

=== DeactivateMigrationService ===
No input/output.

=== DisableSleepTillShutdown ===
No input/output.

=== SuppressDisablingSleepTemporarily ===
Takes an input u64 "nn::TimeSpanType", no output.

=== SetRequestExitToLibraryAppletAtExecuteNextProgramEnabled ===
No input/output.

=== IGpuErrorHandler ===
This is "nn::am::service::IGpuErrorHandler".

This was added with [11.0.0+].

This uses various [[NV_services#nvgem:cd|nvgem:cd]] commands.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 100 || [[#GetManualGpuErrorInfoSize]]
|-
| 101 || [[#GetManualGpuErrorInfo]]
|-
| 102 || [[#GetManualGpuErrorDetectionSystemEvent]]
|-
| 103 || [[#FinishManualGpuErrorHandling]]
|}

==== GetManualGpuErrorInfoSize ====
No input, returns an output u64.

==== GetManualGpuErrorInfo ====
Takes a type-0x6 output buffer, returns an output u64.

The OutBuffer_size must be >= the output size from [[#GetManualGpuErrorInfoSize]].

sdknso exposes the buffer as <code>void*</code>.

==== GetManualGpuErrorDetectionSystemEvent ====
No input, returns an output Event handle with EventClearMode=0.

==== FinishManualGpuErrorHandling ====
No input/output.

== ISelfController ==
This is "nn::am::service::ISelfController".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Exit]]
|-
| 1 || [[#LockExit]]
|-
| 2 || [[#UnlockExit]]
|-
| 3 || [2.0.0+] [[#EnterFatalSection]]
|-
| 4 || [2.0.0+] [[#LeaveFatalSection]]
|-
| 9 || [[#GetLibraryAppletLaunchableEvent]]
|-
| 10 || [[#SetScreenShotPermission]]
|-
| 11 || [[#SetOperationModeChangedNotification]]
|-
| 12 || [[#SetPerformanceModeChangedNotification]]
|-
| 13 || [[#SetFocusHandlingMode]]
|-
| 14 || [[#SetRestartMessageEnabled]]
|-
| 15 || [2.0.0+] [[#SetScreenShotAppletIdentityInfo]]
|-
| 16 || [2.0.0+] [[#SetOutOfFocusSuspendingEnabled]]
|-
| 17 || [3.0.0+] [[#SetControllerFirmwareUpdateSection]]
|-
| 18 || [3.0.0+] [[#SetRequiresCaptureButtonShortPressedMessage]]
|-
| 19 || [3.0.0+] [[#SetAlbumImageOrientation]]
|-
| 20 || [4.0.0+] [[#SetDesirableKeyboardLayout]]
|-
| 21 || [13.0.0+] GetScreenShotProgramId
|-
| 22 || [19.0.0+] GetScreenShotAcdIndex
|-
| 23 || [19.0.0+] GetScreenShotApparentPlatform
|-
| 24 || [19.0.0+] GetScreenShotApplicationProperty
|-
| 40 || [[#CreateManagedDisplayLayer]]
|-
| 41 || [4.0.0+] [[#IsSystemBufferSharingEnabled]]
|-
| 42 || [4.0.0+] [[#GetSystemSharedLayerHandle]]
|-
| 43 || [5.0.0+] [[#GetSystemSharedBufferHandle]]
|-
| 44 || [10.0.0+] [[#CreateManagedDisplaySeparableLayer]]
|-
| 45 || [10.0.0+] [[#SetManagedDisplayLayerSeparationMode]]
|-
| 46 || [13.0.0+] [[#SetRecordingLayerCompositionEnabled]]
|-
| 50 || [[#SetHandlesRequestToDisplay]]
|-
| 51 || [[#ApproveToDisplay]]
|-
| 60 || [[#OverrideAutoSleepTimeAndDimmingTime]]
|-
| 61 || [[#SetMediaPlaybackState]]
|-
| 62 || [[#SetIdleTimeDetectionExtension]]
|-
| 63 || [[#GetIdleTimeDetectionExtension]]
|-
| 64 || [[#SetInputDetectionSourceSet]]
|-
| 65 || [2.0.0+] [[#ReportUserIsActive]]
|-
| 66 || [3.0.0+] [[#GetCurrentIlluminance]]
|-
| 67 || [3.0.0+] [[#IsIlluminanceAvailable]]
|-
| 68 || [5.0.0+] [[#SetAutoSleepDisabled]]
|-
| 69 || [5.0.0+] [[#IsAutoSleepDisabled]]
|-
| 70 || [4.0.0+] [[#ReportMultimediaError]]
|-
| 71 || [5.0.0+] [[#GetCurrentIlluminanceEx]]
|-
| 72 || [9.0.0+] [[#SetInputDetectionPolicy]]
|-
| 73 || [21.0.0+]
|-
| 80 || [4.0.0+] [[#SetWirelessPriorityMode]]
|-
| 90 || [6.0.0+] [[#GetAccumulatedSuspendedTickValue]]
|-
| 91 || [6.0.0+] [[#GetAccumulatedSuspendedTickChangedEvent]]
|-
| 100 || [7.0.0+] [[#SetAlbumImageTakenNotificationEnabled]]
|-
| 110 || [8.0.0+] [[#SetApplicationAlbumUserData]]
|-
| 120 || [11.0.0+] [[#SaveCurrentScreenshot]]
|-
| 130 || [13.0.0+] [[#SetRecordVolumeMuted]]
|-
| 200 || [20.0.0+]
|-
| 210 || [20.0.0+]
|-
| 211 || [20.0.0+]
|-
| 220 || [20.0.0+]
|-
| 221 || [20.0.0+]
|-
| 230 || [20.0.0+]
|-
| 1000 || [7.0.0+] [[#GetDebugStorageChannel]]
|-
| 2000 || [S2] [[#GetGraphicsSupervisor]]
|-
| 2100 || [S2] SetRecordingLayerEnabled
|-
| 2200 || [S2] SetSharingLayerEnabled
|-
| 2300 || [S2] [20.0.0+] SetCopyrightLayerEnabled
|-
| 2400 || [S2] SetRtcScreenSharingAudioEnabled
|-
| 2401 || [S2] [20.0.0+] SetStreamPlayMirroringAudioEnabled
|-
| 2402 || [S2] [20.0.0+]
|}

=== Exit ===
No input/output.

Exits the current applet. On success, official sw will enter an infinite loop with sleep-thread value 86400000000000.

=== LockExit ===
No input/output.

Locks exit process of pressing X to close in HOME Menu for an application or HOME button for an applet. When locked, it will show the "waiting for software to be closed dialog" until UnlockExit is called or a 15 seconds timeout (when the latter occurs, the process is force-terminated).

=== UnlockExit ===
No input/output.

Unlocks exit process, if LockExit was previously used.

=== EnterFatalSection ===
No input/output.

=== LeaveFatalSection ===
No input/output.

[[#EnterFatalSection]] must be executed at least once before executing this command, otherwise error code 0x40080 will be returned. EnterFatalSection and LeaveFatalSection work in pairs, that is, N calls to EnterFatalSection must be performed first in order to perform N executions of LeaveFatalSection. Essentially, these two functions operate like how one would lock and unlock a recursive mutex.

=== GetLibraryAppletLaunchableEvent ===
No input, returns an output event handle with autoclear=false.

=== SetScreenShotPermission ===
Takes an input s32. No output.

Controls whether screenshot-capture is allowed.

{| class="wikitable" border="1"
|-
! Value || Description
|-
| 0 || Inherit from parent applet
|-
| 1 || Enable
|-
| 2 || Disable
|-
|}

=== SetOperationModeChangedNotification ===
Takes an input u8 bool flag. No output.

=== SetPerformanceModeChangedNotification ===
Takes an input u8 bool flag. No output.

=== SetFocusHandlingMode ===
Takes 3 input u8s with each field located immediately after the previous u8, these are bool flags. No output.

=== SetRestartMessageEnabled ===
Takes an input u8 bool flag, no output.

See [[#AppletMessage]].

=== SetScreenShotAppletIdentityInfo ===
Takes an input [[#AppletIdentityInfo]], no output.

=== SetOutOfFocusSuspendingEnabled ===
Takes an input u8 bool flag. No output.

=== SetControllerFirmwareUpdateSection ===
Takes an input u8 bool flag, no output.

This throws error 0x40280 when the internal state flag already matches the input value.

=== SetRequiresCaptureButtonShortPressedMessage ===
Takes an input u8 bool flag, no output.

See [[#AppletMessage]].

When enabled with a non-Overlay applet, Overlay applet will not be notified of capture button short-presses for screenshots.

=== SetAlbumImageOrientation ===
Takes an input u32 "nn::album::ImageOrientation". No output.

The input value must not be >3.

=== SetDesirableKeyboardLayout ===
Takes an input u32, no output.

The input u32 is "nn::settings::KeyboardLayout".

=== CreateManagedDisplayLayer ===
Returns an output u64 LayerId which is then used by the user-process with [[Display_services#OpenLayer]].

=== IsSystemBufferSharingEnabled ===
No input/output.

Not available when the current applet is an Application ([[#AppletId]] == 0x01).

Checks whether SystemBufferSharing is enabled, throwing an error otherwise.

=== GetSystemSharedLayerHandle ===
No input, returns two output u64s "nn::vi::fbshare::SharedBufferHandle" and "nn::vi::fbshare::SharedLayerHandle".

Runs code similar to [[#IsSystemBufferSharingEnabled]] first.

=== GetSystemSharedBufferHandle ===
No input, returns an output u64 "nn::vi::fbshare::SharedBufferHandle".

Runs code similar to [[#IsSystemBufferSharingEnabled]] first.

Same as [[#GetSystemSharedLayerHandle]] except this just gets the SharedBufferHandle.

=== CreateManagedDisplaySeparableLayer ===
No input, returns two output u64 LayerIds.

sdknso now uses this instead of [[#CreateManagedDisplayLayer]]. sdknso caches the output from the cmd so that it's only used once. The first u64 is used the same as the original LayerId from [[#CreateManagedDisplayLayer]]. <code>nn::vi::CreateRecordingLayer</code> uses the second LayerId, the layer creation is identical besides which LayerId is used.

=== SetManagedDisplayLayerSeparationMode ===
Takes an input u32, no output.

sdknso exposes this as <code>nn::vi::SetRecordingLayerEnabled(bool)</code>.

The input u32 must be 0-1.

=== SetRecordingLayerCompositionEnabled ===
Takes an input bool, no output.

=== SetHandlesRequestToDisplay ===
Takes an input u8 bool, no output.

Sets an internal state flag. When the input flag is 0, this will in additional run the same code as [[#ApproveToDisplay]].

See [[#AppletMessage]].

=== ApproveToDisplay ===
No input/output.

Used to handle the notification enabled by [[#SetHandlesRequestToDisplay]].

=== OverrideAutoSleepTimeAndDimmingTime ===
Takes 4 input s32s, no output.

=== SetMediaPlaybackState ===
Takes an input u8 bool, no output.

=== SetIdleTimeDetectionExtension ===
Takes an input u32, no output.

The input value must be 0-2: 0 = disabled, 1 = Extended, and 2 = ExtendedUnsafe.

=== GetIdleTimeDetectionExtension ===
No input, returns an output u32.

Returns the value set by [[#SetIdleTimeDetectionExtension]].

=== SetInputDetectionSourceSet ===
Takes an input u32, no output.

=== ReportUserIsActive ===
No input/output.

Uses idle:sys ReportUserIsActive.

Reports that the user is active, for idle detection (screen dimming / auto-sleep). This is equivalent to when the user uses HID input.

=== GetCurrentIlluminance ===
No input, returns an output float.

Uses [[Backlight_services|lbl]] command GetAmbientLightSensorValue, where only the output float is used.

=== IsIlluminanceAvailable ===
No input, returns an output u8 bool.

Uses [[Backlight_services|lbl]] command IsAmbientLightSensorAvailable.

User-processes can use this to determine whether to continue with using GetCurrentIlluminance(Ex).

=== SetAutoSleepDisabled ===
Takes an input u8 bool, no output.

=== IsAutoSleepDisabled ===
No input, returns an output u8 bool.

=== ReportMultimediaError ===
Takes an input Result and a type-0x5 input buffer, no output.

The buffer contains a 0x138-byte "movie::MultimediaTelemetryReport" struct.

=== GetCurrentIlluminanceEx ===
No input, returns an output u8 bool and float.

Uses [[Backlight_services|lbl]] command GetAmbientLightSensorValue.

=== SetInputDetectionPolicy ===
Takes an input [[#InputDetectionPolicy]], no output.

=== SetWirelessPriorityMode ===
Takes an input s32 [[#WirelessPriorityMode]], no output.

=== GetAccumulatedSuspendedTickValue ===
No input, returns an output u64 tick value.

Gets the total time in ticks that the process was suspended, relative to when the applet-service was last initialized.

=== GetAccumulatedSuspendedTickChangedEvent ===
No input, returns an output Event handle with autoclear=true.

This is signaled when the output from [[#GetAccumulatedSuspendedTickValue]] is updated.

=== SetAlbumImageTakenNotificationEnabled ===
Takes an input u8 bool, no output.

See [[#AppletMessage]].

=== SetApplicationAlbumUserData ===
Takes a type-0x21 input buffer, no output.

The buffer contains arbitrary UserData.

The size must be <=0x400. The input buffer is copied to a buffer loaded from a state ptr (throwing an error when the state ptr is not set), with the u32 size being written to statebuf+0x400 afterwards.

=== SaveCurrentScreenshot ===
Takes an input s32 [[Capture_services#AlbumReportOption|AlbumReportOption]], no output.

sdknso exposes this under "nn::album::".

=== SetRecordVolumeMuted ===
Takes an input bool, no output.

=== GetDebugStorageChannel ===
No input, returns an output [[#IStorageChannel]].

The cached value loaded from [[System_Settings|system-setting]] <code>am.debug!dev_function</code> must be set to 0x1 with size 0x1, otherwise an error is returned.

=== GetGraphicsSupervisor ===
This is exclusive to S2.

No input. Returns an output TIPC handle to [[Switch_2:_GSV_services|GraphicsSupervisor]].

== IStorageChannel ==
This is "nn::am::service::IStorageChannel".

This was added with [7.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || Push || No input, returns an output [[#IStorage]].
|-
| 1 || Unpop || No input, returns an output [[#IStorage]].
|-
| 2 || Pop || No input, returns an output [[#IStorage]].
|-
| 3 || GetPopEventHandle || No input, returns an output handle.
|-
| 4 || Clear || No input/output.
|}

== IWindowController ==
This is "nn::am::service::IWindowController".

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || [[#CreateWindow]] ||
|-
| 1 || [[#GetAppletResourceUserId]] ||
|-
| 2 || [6.0.0+] [[#GetAppletResourceUserIdOfCallerApplet]] ||
|-
| 10 || [[#AcquireForegroundRights]] ||
|-
| 11 || [[#ReleaseForegroundRights]] ||
|-
| 12 || [[#RejectToChangeIntoBackground]] ||
|-
| 20 || [7.0.0+] [[#SetAppletWindowVisibility]] ||
|-
| 21 || [7.0.0+] [[#SetAppletGpuTimeSlice]] ||
|}

=== CreateWindow ===
Takes an input u32, returns an output [[#IWindow]].

Stubbed, just returns an error.

=== GetAppletResourceUserId ===
No input, returns an output u64 [[#AppletResourceUserId]].

=== GetAppletResourceUserIdOfCallerApplet ===
No input, returns an output u64 [[#AppletResourceUserId]].

=== AcquireForegroundRights ===
No input/output.

Just returns 0.

=== ReleaseForegroundRights ===
No input/output.

Just returns 0.

=== RejectToChangeIntoBackground ===
No input/output.

Just returns 0.

=== SetAppletWindowVisibility ===
Takes an input u8 bool, no output.

=== SetAppletGpuTimeSlice ===
Takes an input s64, no output.

The input s64 must not be negative.

== IAudioController ==
This is "nn::am::service::IAudioController".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#SetExpectedMasterVolume]]
|-
| 1 || [[#GetMainAppletExpectedMasterVolume]]
|-
| 2 || [[#GetLibraryAppletExpectedMasterVolume]]
|-
| 3 || [[#ChangeMainAppletMasterVolume]]
|-
| 4 || [[#SetTransparentVolumeRate]]
|-
| 5 || [20.0.0+]
|}

GetMainAppletExpectedMasterVolume/SetExpectedMasterVolume are used for saving/restoring state for LibraryApplet launching, with SetExpectedMasterVolume being used with new state prior to launching a LibraryApplet. With official sw these applet funcs are used directly in the main-codebin.

=== SetExpectedMasterVolume ===
Takes two input floats, no output.

Writes the input floats to state: first one is used by [[#GetMainAppletExpectedMasterVolume]], second one is used by [[#GetLibraryAppletExpectedMasterVolume]].

=== GetMainAppletExpectedMasterVolume ===
No input, returns an output float.

=== GetLibraryAppletExpectedMasterVolume ===
No input, returns an output float.

=== ChangeMainAppletMasterVolume ===
Takes an input float and an input u64, no output.

=== SetTransparentVolumeRate ===
Takes an input float, no output.

== IDisplayController ==
This is "nn::am::service::IDisplayController".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#GetLastForegroundCaptureImage]]
|-
| 1 || [[#UpdateLastForegroundCaptureImage]]
|-
| 2 || [[#GetLastApplicationCaptureImage]]
|-
| 3 || [[#GetCallerAppletCaptureImage]]
|-
| 4 || [[#UpdateCallerAppletCaptureImage]]
|-
| 5 || [[#GetLastForegroundCaptureImageEx]]
|-
| 6 || [[#GetLastApplicationCaptureImageEx]]
|-
| 7 || [[#GetCallerAppletCaptureImageEx]]
|-
| 8 || [2.0.0+] [[#TakeScreenShotOfOwnLayer]]
|-
| 9 || [5.0.0+] [[#CopyBetweenCaptureBuffers]]
|-
| 10 || [[#AcquireLastApplicationCaptureBuffer]]
|-
| 11 || [[#ReleaseLastApplicationCaptureBuffer]]
|-
| 12 || [[#AcquireLastForegroundCaptureBuffer]]
|-
| 13 || [[#ReleaseLastForegroundCaptureBuffer]]
|-
| 14 || [[#AcquireCallerAppletCaptureBuffer]]
|-
| 15 || [[#ReleaseCallerAppletCaptureBuffer]]
|-
| 16 || [[#AcquireLastApplicationCaptureBufferEx]]
|-
| 17 || [[#AcquireLastForegroundCaptureBufferEx]]
|-
| 18 || [[#AcquireCallerAppletCaptureBufferEx]]
|-
| 20 || [3.0.0+] [[#ClearCaptureBuffer]]
|-
| 21 || [3.0.0+] [[#ClearAppletTransitionBuffer]]
|-
| 22 || [4.0.0+] [[#AcquireLastApplicationCaptureSharedBuffer]]
|-
| 23 || [4.0.0+] [[#ReleaseLastApplicationCaptureSharedBuffer]]
|-
| 24 || [4.0.0+] [[#AcquireLastForegroundCaptureSharedBuffer]]
|-
| 25 || [4.0.0+] [[#ReleaseLastForegroundCaptureSharedBuffer]]
|-
| 26 || [4.0.0+] [[#AcquireCallerAppletCaptureSharedBuffer]]
|-
| 27 || [4.0.0+] [[#ReleaseCallerAppletCaptureSharedBuffer]]
|-
| 28 || [6.0.0+] [[#TakeScreenShotOfOwnLayerEx]]
|}

=== GetLastForegroundCaptureImage ===
Takes a type-0x6 output buffer.

Stubbed, just returns an error.

=== UpdateLastForegroundCaptureImage ===
No input/output.

=== GetLastApplicationCaptureImage ===
Takes a type-0x6 output buffer.

Stubbed, just returns an error.

=== GetCallerAppletCaptureImage ===
Takes a type-0x6 output buffer.

Stubbed, just returns an error.

=== UpdateCallerAppletCaptureImage ===
No input/output.

Calls the same func internally as [[#UpdateLastForegroundCaptureImage]], except this passes param value 2 instead of 1.

=== GetLastForegroundCaptureImageEx ===
Takes a type-0x6 output buffer, returns an output u8 bool.

The buffer size must match 0x384000.

=== GetLastApplicationCaptureImageEx ===
Takes a type-0x6 output buffer, returns an output u8 bool.

The buffer size must match 0x384000.

Calls the same internal func as [[#GetLastForegroundCaptureImageEx]], except that the last param is set to value 0 instead of 1.

=== GetCallerAppletCaptureImageEx ===
Takes a type-0x6 output buffer, returns an output u8 bool.

The buffer size must match 0x384000.

Calls the same internal func as [[#GetLastForegroundCaptureImageEx]], except that the last param is set to value 2 instead of 1.

=== TakeScreenShotOfOwnLayer ===
Takes an input u8 bool and a s32, no output.

=== CopyBetweenCaptureBuffers ===
Takes two input s32s, no output.

=== AcquireLastApplicationCaptureBuffer ===
No input, returns an output handle.

Stubbed, just returns an error.

=== ReleaseLastApplicationCaptureBuffer ===
No input/output.

Clears a state field if it's not already 0, returning an error otherwise. On newer sysvers: then a func is called which just returns 0, then this cmd returns 0.

=== AcquireLastForegroundCaptureBuffer ===
No input, returns an output handle.

Stubbed, just returns an error.

=== ReleaseLastForegroundCaptureBuffer ===
No input/output.

Same as [[#ReleaseLastApplicationCaptureBuffer]] except with a different state field + different input param for the called func.

=== AcquireCallerAppletCaptureBuffer ===
No input, returns an output handle.

Stubbed, just returns an error.

=== ReleaseCallerAppletCaptureBuffer ===
No input/output.

Same as [[#ReleaseLastApplicationCaptureBuffer]] except with a different state field + different input param for the called func.

=== AcquireLastApplicationCaptureBufferEx ===
No input, returns an output TransferMemory handle and an output u8 bool.

The state field used by [[#ReleaseLastApplicationCaptureBuffer]] must be 0. Calls a func which just returns an error (this is only the case on newer sysvers), hence this cmd will just return that error. If that func would have returned successfully, the state field would be set to 1 and the cmd would return 0.

On old sysvers, the output TransferMemory is size 0x384000 with permissions=RW.

=== AcquireLastForegroundCaptureBufferEx ===
No input, returns an output TransferMemory handle and an output u8 bool.

Same as [[#AcquireLastApplicationCaptureBufferEx]] except this uses the [[#ReleaseLastForegroundCaptureBuffer]] state field, and uses a different input param value for the called func.

=== AcquireCallerAppletCaptureBufferEx ===
No input, returns an output TransferMemory handle and an output u8 bool.

Same as [[#AcquireLastApplicationCaptureBufferEx]] except this uses the [[#ReleaseCallerAppletCaptureBuffer]] state field, and uses a different input param value for the called func.

=== ClearCaptureBuffer ===
Takes an input u8 bool, a s32 CaptureSharedBuffer, and an u32 color, returns no output.

Clear the input CaptureSharedBuffer with the specified RGBA8 color.

=== ClearAppletTransitionBuffer ===
Takes an input u32, no output.

Clear the AppletTransitionBuffer with the specified RGBA8 color.

=== AcquireLastApplicationCaptureSharedBuffer ===
No input, returns an output u8 bool and an s32.

This loads data from state.

=== ReleaseLastApplicationCaptureSharedBuffer ===
No input/output.

Depending on whether a state field is 0, this just returns an error or returns 0.

=== AcquireLastForegroundCaptureSharedBuffer ===
No input, returns an output u8 bool and an s32.

Calls the same func internally as [[#AcquireLastApplicationCaptureSharedBuffer]], except this passes value 1 for the last param instead of 0.

=== ReleaseLastForegroundCaptureSharedBuffer ===
No input/output.

Calls the same func internally as [[#ReleaseLastApplicationCaptureSharedBuffer]], except this passes value 1 for the last param instead of 0.

=== AcquireCallerAppletCaptureSharedBuffer ===
No input, returns an output u8 bool and an s32.

Calls the same func internally as [[#AcquireLastApplicationCaptureSharedBuffer]], except this passes value 2 for the last param instead of 0.

=== ReleaseCallerAppletCaptureSharedBuffer ===
No input/output.

Calls the same func internally as [[#ReleaseLastApplicationCaptureSharedBuffer]], except this passes value 2 for the last param instead of 0.

=== TakeScreenShotOfOwnLayerEx ===
Takes two input u8 bools and a s32, no output.

Calls the same func internally as [[#TakeScreenShotOfOwnLayer]], except the last bool param is the last cmd param bool instead of hard-coded 0. This flag indicates whether the screenshot should be taken Immediately.

== ISystemAppletControllerForDebug ==
This is "nn::am::service::ISystemAppletControllerForDebug".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 1 || RequestLaunchApplicationForDebug
|-
| 2 || [7.0.0+] [[#GetDebugStorageChannel]]
|-
| 3 || [7.0.0+] [[#CreateStorageForDebug]]
|-
| 4 || [12.0.0+] [[#CreateCradleFirmwareUpdaterForDebug]]
|}

=== GetDebugStorageChannel ===
No input. Returns an output [[#IStorageChannel]].

=== CreateStorageForDebug ===
Takes a total of 8-bytes of input. Returns an [[#IStorage]].

=== CreateCradleFirmwareUpdaterForDebug ===
No input. Returns an [[#ICradleFirmwareUpdater]].

== IProcessWindingController ==
This is "nn::am::service::IProcessWindingController".

GetProcessWindingController throws an error when used from non-LibraryApplet (at least with Application).

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || [[#GetLaunchReason]] ||
|-
| 11 || [[#OpenCallingLibraryApplet]] ||
|-
| 21 || [[#PushContext]] ||
|-
| 22 || [[#PopContext]] ||
|-
| 23 || [[#CancelWindingReservation]] ||
|-
| 30 || [[#WindAndDoReserved]] ||
|-
| 40 || [[#ReserveToStartAndWaitAndUnwindThis]] ||
|-
| 41 || [4.0.0+] [[#ReserveToStartAndWait]] ||
|}

=== GetLaunchReason ===
No input, returns an output [[#AppletProcessLaunchReason]].

Used by LibraryApplets.

=== OpenCallingLibraryApplet ===
No input, returns an output [[#ILibraryAppletAccessor]].

The objptr from state is cleared during this, an error is thrown if it's already 0.

=== PushContext ===
Takes an input [[#IStorage]], no output.

=== PopContext ===
No input, returns an output [[#IStorage]].

=== CancelWindingReservation ===
No input/output.

=== WindAndDoReserved ===
No input/output.

=== ReserveToStartAndWaitAndUnwindThis ===
Takes an input [[#ILibraryAppletAccessor]], no output.

=== ReserveToStartAndWait ===
Takes an input [[#ILibraryAppletAccessor]], no output.

== ISystemProcessCommonFunctions ==
This is "nn::am::service::ISystemProcessCommonFunctions".

This was added with [19.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 1 ||
|}

=== Cmd1 ===
No input. Returns an [[#IApplicationObserver]].

=== IApplicationObserver ===
This is "nn::am::service::IApplicationObserver".

This was added with [19.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 1 ||
|-
| 2 ||
|-
| 10 ||
|-
| 20 ||
|-
| 30 ||
|-
| 40 || [S2] [20.0.0+]
|}

== IAppletAlternativeFunctions ==
This is "nn::am::service::IAppletAlternativeFunctions".

This was added with [20.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 ||
|-
| 1 ||
|-
| 2 ||
|}

== IChatProxy ==
This is "nn::am::service::IChatProxy".

This is exclusive to Switch 2.

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || GetCommonStateGetter || Returns an [[#ICommonStateGetter]].
|-
| 1 || GetSelfController || Returns an [[#ISelfController]].
|-
| 2 || GetWindowController || Returns an [[#IWindowController]].
|-
| 3 || GetAudioController || Returns an [[#IAudioController]].
|-
| 4 || GetDisplayController || Returns an [[#IDisplayController]].
|-
| 1000 || GetDebugFunctions || Returns an [[#IDebugFunctions]].
|-
| 10 || GetProcessWindingController || Returns an [[#IProcessWindingController]].
|-
| 11 || GetLibraryAppletCreator || Returns an [[#ILibraryAppletCreator]].
|-
| 20 || || Returns an [[#IChatFunctions]].
|}

=== IChatFunctions ===
This is "nn::am::service::IChatFunctions".

This is exclusive to Switch 2.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 1 ||
|-
| 102 ||
|-
| 103 ||
|-
| 104 ||
|-
| 110 ||
|-
| 120 ||
|-
| 121 ||
|-
| 130 ||
|-
| 140 || [20.0.0+]
|-
| 141 || [20.0.0+]
|-
| 200 ||
|-
| 201 ||
|-
| 210 || [20.0.0+]
|-
| 220 || [20.0.0+]
|}

== IDebugFunctions ==
This is "nn::am::service::IDebugFunctions".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#NotifyMessageToHomeMenuForDebug]]
|-
| 1 || [1.0.0-9.2.0] [[#OpenMainApplication]]
|-
| 10 || [[#PerformSystemButtonPressing]]
|-
| 20 || [[#InvalidateTransitionLayer]]
|-
| 30 || [6.0.0+] [[#RequestLaunchApplicationWithUserAndArgumentForDebug]]
|-
| 31 || [12.0.0+] [[#RequestLaunchApplicationByApplicationLaunchInfoForDebug]]
|-
| 40 || [6.0.0+] [[#GetAppletResourceUsageInfo]]
|-
| 50 || [15.0.0+] AddSystemProgramIdAndAppletIdForDebug
|-
| 51 || [16.0.0+] AddOperationConfirmedLibraryAppletIdForDebug
|-
| 52 || [17.0.0+] GetProgramIdFromAppletIdForDebug
|-
| 53 || [18.0.0+] GetProgramIdFromAppletIdAndLibraryAppletModeForDebug
|-
| 100 || [7.0.0+] [[#SetCpuBoostModeForApplet]]
|-
| 101 || [10.0.0+] [[#CancelCpuBoostModeForApplet]]
|-
| 110 || [9.0.0+] [[#PushToAppletBoundChannelForDebug]]
|-
| 111 || [9.0.0+] [[#TryPopFromAppletBoundChannelForDebug]]
|-
| 120 || [9.0.0+] [[#AlarmSettingNotificationEnableAppEventReserve]]
|-
| 121 || [9.0.0+] [[#AlarmSettingNotificationDisableAppEventReserve]]
|-
| 122 || [9.0.0+] [[#AlarmSettingNotificationPushAppEventNotify]]
|-
| 130 || [9.0.0+] [[#FriendInvitationSetApplicationParameter]]
|-
| 131 || [9.0.0+] [[#FriendInvitationClearApplicationParameter]]
|-
| 132 || [9.0.0+] [[#FriendInvitationPushApplicationParameter]]
|-
| 140 || [14.0.0+] [[#RestrictPowerOperationForSecureLaunchModeForDebug|RestrictPowerOperationForSecureLaunchModeForDebug]]
|-
| 150 || [21.0.0+]
|-
| 200 || [15.0.0+] [[#CreateFloatingLibraryAppletAccepterForDebug|CreateFloatingLibraryAppletAccepterForDebug]]
|-
| 300 || [16.0.0+] TerminateAllRunningApplicationsForDebug
|-
| 400 || [S2] LaunchDebugAppletForDebug
|-
| 401 || [S2] TerminateDebugAppletForDebug
|-
| 402 || [S2] IsDebugAppletLaunchedForDebug
|-
| 403 || [S2]
|-
| 410 || [18.0.0+] [[#CreateGeneralStorageForDebug|CreateGeneralStorageForDebug]]
|-
| 411 || [18.0.0+] [[#ReadGeneralStorageForDebug|ReadGeneralStorageForDebug]]
|-
| 412 || [18.0.0+] [[#WriteGeneralStorageForDebug|WriteGeneralStorageForDebug]]
|-
| 430 || [20.0.0+]
|-
| 431 || [20.0.0+]
|-
| 900 || [12.0.0+] GetGrcProcessLaunchedSystemEvent
|-
| 910 || [20.0.0+]
|-
| 2000 || [S2] [20.0.0+]
|-
| 10000 || [S2]
|}

=== NotifyMessageToHomeMenuForDebug ===
Takes an input [[#AppletMessage]], no output.

Stubbed, just returns an error.

=== OpenMainApplication ===
No input, returns an output [[#IApplicationAccessor]].

Should not be used when no Application is running (svcBreak).

=== PerformSystemButtonPressing ===
Takes an input [[#SystemButtonType]], no output.

=== InvalidateTransitionLayer ===
No input/output.

=== RequestLaunchApplicationWithUserAndArgumentForDebug ===
Takes an input u8 bool flag, an [[NCM_services#ApplicationId|ApplicationId]], a type-0x5 input buffer containing an array of u128 userIDs, and a type-0x5 input buffer, no output.

Requests to launch the specified Application, with the specified users. When the bool flag is true, the content of the second input buffer is used to create a storage which is pushed to the UserChannel for this Application (see [[#LaunchParameterKind]]).

=== RequestLaunchApplicationByApplicationLaunchInfoForDebug ===
Takes a total of 0x58-bytes of input, a type-0x5 input buffer containing an array of 0x10-byte entries, and a type-0x5 input buffer. No output.

[19.0.0+] Takes a total of 0x88-bytes of input, a type-0x5 input buffer containing an array of 0x10-byte entries, and a type-0x5 input buffer. No output.

=== GetAppletResourceUsageInfo ===
No input, returns an output [[#AppletResourceUsageInfo]].

=== SetCpuBoostModeForApplet ===
Takes an input u32 [[#CpuBoostMode]] and passes it to [[PPC_services#apm:sys|SetCpuBoostMode]].

The cached value loaded from [[Settings_services#GetDebugModeFlag]] must be 1, otherwise an error is returned.

=== CancelCpuBoostModeForApplet ===
No input/output.

=== PushToAppletBoundChannelForDebug ===
Takes an input [[#IStorage]] and a s32, no output.

The cached value loaded from [[Settings_services#GetDebugModeFlag]] must be 1, otherwise an error is returned.

The s32 must match the value already stored in state when the state value is non-zero, otherwise an error is returned. When the state value is 0, the s32 is written into state. Then the input storage is pushed to the StorageChannel.

=== TryPopFromAppletBoundChannelForDebug ===
Takes an input s32, returns an output [[#IStorage]].

The cached value loaded from [[Settings_services#GetDebugModeFlag]] must be 1, otherwise an error is returned.

The s32 must not be 0 and must match the value previously saved by [[#PushToAppletBoundChannelForDebug]], otherwise errors are returned. Then the output storage is popped from the StorageChannel.

=== AlarmSettingNotificationEnableAppEventReserve ===
Takes an input [[#IStorage]] and an [[NCM_services#ApplicationId|ApplicationId]], no output.

Clears a StorageChannel, pushes the input storage there, and writes the ApplicationId into state.

When launching an Application with a matching ApplicationId, this storage is popped, then pushed to [[#PushToNotificationStorageChannel|NotificationStorageChannel]].

=== AlarmSettingNotificationDisableAppEventReserve ===
No input/output.

Clears the StorageChannel/saved-ApplicationId used by [[#AlarmSettingNotificationEnableAppEventReserve]].

=== AlarmSettingNotificationPushAppEventNotify ===
Takes an input [[#IStorage]], no output.

Same as [[#PushToNotificationStorageChannel]] except this uses the MainApplication.

=== FriendInvitationSetApplicationParameter ===
Takes an input [[#IStorage]] and an [[NCM_services#ApplicationId|ApplicationId]], no output.

Clears a StorageChannel, pushes the input storage there, and writes the ApplicationId into state.

When launching an Application with a matching ApplicationId, this storage is popped, then pushed to [[#PushToFriendInvitationStorageChannel|FriendInvitationStorageChannel]].

=== FriendInvitationClearApplicationParameter ===
No input/output.

Clears the StorageChannel/saved-ApplicationId used by [[#FriendInvitationSetApplicationParameter]].

=== FriendInvitationPushApplicationParameter ===
Takes an input [[#IStorage]], no output.

Same as [[#PushToFriendInvitationStorageChannel]] except this uses the MainApplication.

=== RestrictPowerOperationForSecureLaunchModeForDebug ===
No input/output.

This runs the same functionality as [[#DisableSleepTillShutdown|DisableSleepTillShutdown]].

=== CreateFloatingLibraryAppletAccepterForDebug ===
Takes a PID, an input u64 reserved_pid, a type-0x5 input buffer containing an array of u32s, returns an [[#IFloatingLibraryAppletAccepter|IFloatingLibraryAppletAccepter]].

If a state field is already set it must match the PID, otherwise when state==0 the PID is written into state etc.

=== CreateGeneralStorageForDebug ===
Takes two input u64s Id and size, no output.

The high-byte of Id must be 0.

Goes through a linked-list to check whether there's already an entry with a matching Id. If there's a matching Id, return 0 if the size matches, otherwise return error.

When no entry is found, a new entry is added with a buffer allocated using the input size.

=== ReadGeneralStorageForDebug ===
Takes a type-0x22 output buffer, two input u64s Id and offset, returns an output u64 out_size.

The high-byte of Id must be 0.

Reads data from the buffer previously allocated by [[#CreateGeneralStorageForDebug|CreateGeneralStorageForDebug]] with the specified Id.

The out_size is always the buffer-size (an error is thrown when bounds-check fails).

=== WriteGeneralStorageForDebug ===
Takes a type-0x21 input buffer, two input u64s Id and offset.

Same as [[#ReadGeneralStorageForDebug|ReadGeneralStorageForDebug]] except this writes into the buffer, and no out_size.

== IStorage ==
This is "nn::am::service::IStorage".

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || Open || No input. Returns an [[#IStorageAccessor]].
|-
| 1 || [2.0.0+] OpenTransferStorage || No input. Returns an [[#ITransferStorageAccessor]].
|}

Open can only be used when the IStorage was created by [[#CreateStorage]] or [[#CreateTransferMemoryStorage]]. OpenTransferStorage can only be used when the IStorage was created by [[#CreateHandleStorage]].

Only 1 *Accessor session can be open for each IStorage at a time.

== IStorageAccessor ==
This is "nn::am::service::IStorageAccessor".

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || GetSize || No input. Returns an s64.
|-
| 10 || Write || Takes an input s64 and a type-0x21 input buffer.
|-
| 11 || Read || Takes an input s64 and a type-0x22 output buffer.
|}

== ITransferStorageAccessor ==
This is "nn::am::service::ITransferStorageAccessor".

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || GetSize || No input. Returns an output s64.
|-
| 1 || GetHandle || No input. Returns an output s64 and handle.
|}

These commands return the data originally from [[#CreateHandleStorage]] input, both return the same s64.

== IFloatingLibraryAppletAccepter ==
This is "nn::am::service::IFloatingLibraryAppletAccepter".

This interface has no commands.

= appletOE =
This is "nn::am::service::IApplicationProxyService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 2000 || [S2] [[#OpenCompatApplicationFunctions|OpenCompatApplicationFunctions]]
|-
| 0 || [[#OpenApplicationProxy]]
|-
| 10 || [S2] [[#OpenApplicationProxy2|OpenApplicationProxy2]]
|}

This is used by all regular-applications, including [[flog]] and "Retail Interactive Display Menu". Only one session can be open for this service at a time.

== OpenApplicationProxy ==
Takes a reserved input u64 (official user-processes use hard-coded value 0), a PID, and a process copy-handle (cur-proc handle alias). Returns an [[#IApplicationProxy]].

On failure, official user-processes will retry using this command in a loop while the retval is 0x19280, with svcSleepThread(10000000) being called first.

== OpenApplicationProxy2 ==
Unofficial name.

Takes an input u32, an u64 pid_reserved, a PID, and a process copy-handle (cur-proc handle alias). Returns an [[#IApplicationProxy]].

= idle:sys =
This is "nn::idle::detail::IPolicyManagerSystem"

This was moved to [[OMM_services|omm]] with [14.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetAutoPowerDownEvent
|-
| 1 || [7.0.0+] IsAutoPowerDownRequested ([1.0.0-3.0.2] )
|-
| 2 || [1.0.0-3.0.2]
|-
| 3 || [[#SetHandlingContext]]
|-
| 4 || LoadAndApplySettings
|-
| 5 || ReportUserIsActive
|}

== SetHandlingContext ==
[3.0.0+] Now takes an additional 0x10-bytes of input.

[13.0.0+] Total input size is now 0x30 instead of 0x38.

= omm =
This is "nn::omm::detail::IOperationModeManager"

Operation Mode Manager (OMM) is a service responsible for arbitrating the operation changes between docked and handheld modes.
Besides [[PTM_services|PTM]], this is the only service that interacts with the [[Dock]] through [[USB_services|usb:pd*]].

This was moved to [[OMM_services|omm]] with [14.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetOperationMode
|-
| 1 || GetOperationModeChangeEvent
|-
| 2 || EnableAudioVisual
|-
| 3 || DisableAudioVisual
|-
| 4 || EnterSleepAndWait
|-
| 5 || GetCradleStatus
|-
| 6 || FadeInDisplay
|-
| 7 || FadeOutDisplay
|-
| 8 || [2.0.0+] GetCradleFwVersion
|-
| 9 || [2.0.0+] NotifyCecSettingsChanged
|-
| 10 || [3.0.0+] SetOperationModePolicy
|-
| 11 || [3.0.0+] GetDefaultDisplayResolution
|-
| 12 || [3.0.0+] GetDefaultDisplayResolutionChangeEvent
|-
| 13 || [3.0.0+] UpdateDefaultDisplayResolution
|-
| 14 || [3.0.0+] ShouldSleepOnBoot
|-
| 15 || [4.0.0+] NotifyHdcpApplicationExecutionStarted
|-
| 16 || [4.0.0+] NotifyHdcpApplicationExecutionFinished
|-
| 17 || [4.0.0+] NotifyHdcpApplicationDrawingStarted
|-
| 18 || [4.0.0+] NotifyHdcpApplicationDrawingFinished
|-
| 19 || [4.0.0+] GetHdcpAuthenticationFailedEvent
|-
| 20 || [4.0.0+] GetHdcpAuthenticationFailedEmulationEnabled
|-
| 21 || [4.0.0+] SetHdcpAuthenticationFailedEmulation
|-
| 22 || [4.0.0+] GetHdcpStateChangeEvent
|-
| 23 || [4.0.0+] GetHdcpState
|-
| 24 || [5.0.0+] ShowCardUpdateProcessing
|-
| 25 || [5.0.0+] SetApplicationCecSettingsAndNotifyChanged
|-
| 26 || [7.0.0+] [[#GetOperationModeSystemInfo]]
|-
| 27 || [9.0.0+] GetAppletFullAwakingSystemEvent
|-
| 28 || [12.0.0+] [[#CreateCradleFirmwareUpdater]]
|}

== GetOperationModeSystemInfo ==
No input, returns an output u32.

This is used by [[#GetOperationModeSystemInfo|ICommonStateGetter GetOperationModeSystemInfo]].

== CreateCradleFirmwareUpdater ==
No input. Returns an [[#ICradleFirmwareUpdater]].

== ICradleFirmwareUpdater ==
This is "nn::am::service::ICradleFirmwareUpdater".

This was added with [12.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Start
|-
| 1 || Finish
|-
| 2 || GetUpdateDeviceStatus
|-
| 3 || GetUpdateProgress
|-
| 4 || GetUpdateDeviceStatusChangeEvent
|-
| 5 || GetUpdateProgress2
|}

= spsm =
This is "nn::spsm::detail::IPowerStateInterface".

This was moved to [[OMM_services|omm]] with [14.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetCurrentState
|-
| 1 || EnterSleep
|-
| 2 || GetLastWakeReason
|-
| 3 || Shutdown
|-
| 4 || GetNotificationMessageEventHandle
|-
| 5 || ReceiveNotificationMessage
|-
| 6 || AnalyzeLogForLastSleepWakeSequence
|-
| 7 || ResetEventLog
|-
| 8 || AnalyzePerformanceLogForLastSleepWakeSequence
|-
| 9 || ChangeHomeButtonLongPressingTime
|-
| 10 || PutErrorState
|-
| 11 || [1.0.0-3.0.2] InvalidateCurrentHomeButtonPressing
|}

[3.0.0+] Cmd11 now takes a total of 8-bytes of input.

= tcap =
This is "nn::tcap::server::IManager".

This was removed with [11.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetContinuousHighSkinTemperatureEvent
|-
| 1 || SetOperationMode
|-
| 2 || LoadAndApplySettings
|}

= caps:su =
This is "nn::capsrv::sf::IScreenShotApplicationService".

This was added with [6.0.0+].

This can be used by applications to save screenshots.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 32 || [7.0.0+] [[#SetShimLibraryVersion]]
|-
| 201 || [[#SaveScreenShot]]
|-
| 203 || [[#SaveScreenShotEx0]]
|-
| 205 || [8.0.0+] [[#SaveScreenShotEx1]]
|-
| 210 || [[#SaveScreenShotEx2]]
|}

== SetShimLibraryVersion ==
Takes a total of 0x10-bytes of input and a PID, no output.

This is a wrapper for [[Capture_services|caps:c]] cmd33. Commands '''SaveScreenShot''', '''SaveScreenShotEx0''', '''SaveScreenShotEx1''' and '''SaveScreenShotEx2''' are wrappers for [[Display_services|caps:sc]] cmd210.

== SaveScreenShot ==
Takes two input u32s, an u64 AppletResourceUserId, a PID, and a type-0x45 input buffer containing image data. Returns an [[Capture_services|ApplicationAlbumEntry]].

Official user-processes doesn't use this, instead [[#SaveScreenShotEx0]] is used: ScreenShotAttributeEx0 is all-zero, except +4 is set to an input u32 and u32 +0xC = 0x1.

This cmd internally uses an all-zero ScreenShotAttributeEx0, with u32 +0 = input u32 and u32 +0x8 = 0x3.

== SaveScreenShotEx0 ==
Takes an input 0x40-byte struct '''ScreenShotAttributeEx0''', an input u32, an input u64 AppletResourceUserId, a PID, and a type-0x45 input buffer containing image data. Returns an [[Capture_services|ApplicationAlbumEntry]].

== SaveScreenShotEx1 ==
Takes an input 0x40-byte struct '''ScreenShotAttributeEx0''', an input u32, an input u64 AppletResourceUserId, a PID, a type-0x15 input buffer containing an [[Capture_services|ApplicationData]], and a type-0x45 input buffer containing image data. Returns an [[Capture_services|ApplicationAlbumEntry]].

== SaveScreenShotEx2 ==
Takes an input 0x40-byte struct '''ScreenShotAttributeEx0''', an input u32, an input u64 AppletResourceUserId, a type-0x15 input buffer containing an [[Capture_services|UserIdList]], and a type-0x45 input buffer containing image data. Returns an [[Capture_services|ApplicationAlbumEntry]].

= apm =
This is "nn::am::service::IApmManager".

This was added with [8.0.0+].

[S2] Official sw no longer uses this (stubbed out).

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#OpenSession]]
|-
| 1 || GetPerformanceMode
|-
| 6 || [7.0.0+] [[#IsCpuOverclockEnabled]]
|}

== OpenSession ==
Returns an [[#ISession]].

== IsCpuOverclockEnabled ==
No input, returns an output u8 bool.

== ISession ==
This is "nn::am::service::IApmSession".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || SetPerformanceConfiguration
|-
| 1 || GetPerformanceConfiguration
|-
| 2 || [8.0.0+] SetCpuOverclockEnabled
|}

= (S2) adraw:a =
This is "nn::appletdraw::sfif::IAppletRoot".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 1 || [[#OpenResourceSession]]
|-
| 2 || [[#OpenAppletSession]]
|}

== OpenResourceSession ==
Unofficial name.

Takes a PID and an input [[#AppletResourceUserId|AppletResourceUserId]]. Returns a [[#IResourceSession]].

== OpenAppletSession ==
Unofficial name.

Takes a PID and an input [[#AppletResourceUserId|AppletResourceUserId]]. Returns a [[#IAppletSession]].

== IResourceSession ==
This is "nn::appletdraw::sfif::IResourceSession".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 1 || [[#Ping|Ping]]
|-
| 10 ||
|-
| 11 ||
|}

=== Ping ===
Unofficial name.

Takes an input u64. Returns an output u64.

The output u64 should match the input u64. Official software sends the current system tick value.

=== Cmd10 ===
Takes a handle, a u64 and an int. Returns a handle.

=== Cmd11 ===
No input/output.

== IAppletSession ==
This is "nn::appletdraw::sfif::IAppletSession".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 1 || [[#Ping|Ping]]
|-
| 2 || [[#GetEvent|GetEvent]]
|-
| 3 || [20.1.1+]
|-
| 10 ||
|-
| 11 ||
|-
| 12 ||
|-
| 13 ||
|-
| 15 ||
|-
| 16 || [20.1.1+]
|-
| 17 || [20.1.1+]
|-
| 18 || [20.1.1+]
|-
| 19 || [20.1.1+]
|-
| 21 ||
|-
| 22 ||
|-
| 23 || [20.1.1+]
|-
| 24 || [20.1.1+]
|-
| 31 || [[#GetFrameBufferInfo|GetFrameBufferInfo]]
|-
| 8001 || [[#GetFrameBufferInfoForDebug|GetFrameBufferInfoForDebug]]
|-
| 8003 || [19.0.0-19.1.0]
|-
| 8004 ||
|}

=== GetEvent ===
Unofficial name.

No input. Returns an output Event handle.

=== Cmd3 ===
Takes a handle. No output.

=== Cmd10 ===
Takes an input u32. No output.

=== Cmd11 ===
Takes an input u32. No output.

=== Cmd12 ===
Takes an input u64. Returns an output u32.

=== Cmd13 ===
Takes an input u32. Returns an output u32.

=== Cmd15 ===
Takes an input u32. Returns three output u32s.

=== Cmd16 ===
No input. Returns an output u32.

=== Cmd17 ===
Takes an input u32. Returns an output u32 and an output u16.

=== Cmd18 ===
Takes an input u32. Returns three output u32s and an output u16.

=== Cmd19 ===
Takes an input u32. Returns an output u32 and an output u16.

=== Cmd21 ===
Takes an input u32. Returns a struct of size 0x40.

=== Cmd22 ===
Takes a struct of size 0x20. Returns a struct of size 0x40.

=== Cmd23 ===
No input. Returns a struct of size 0xC8.

=== Cmd24 ===
Takes an ipc-buf with size 0xD8. No output.

=== GetFrameBufferInfo ===
Unofficial name.

No input. Returns an [[#(S2)_AdrawFrameBufferInfo|AdrawFrameBufferInfo]].

[[#(S2)_AdrawFrameBufferInfo|Id]] is "adrawfb".

=== GetFrameBufferInfoForDebug ===
Unofficial name.

No input. Returns an [[#(S2)_AdrawFrameBufferInfo|AdrawFrameBufferInfo]].

=== Cmd8003 ===
Takes an input u64. Returns a struct with size 0x18.

=== Cmd8004 ===
Takes an input u32. Returns an output u64.

= (S2) appletOE =
This is "nn::am::service::IApplicationProxyServiceForNxCompat".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#OpenApplicationProxy]]
|-
| 2000 || [[#OpenCompatApplicationFunctions]]
|}

== OpenCompatApplicationFunctions ==
No input. Returns an [[#INxCompatApplicationFunctions]].

== INxCompatApplicationFunctions ==
This is "nn::am::service::INxCompatApplicationFunctions".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 2000 || [[#GetGraphicsSupervisorForNxCompat]]
|-
| 2001 ||
|-
| 2002 ||
|-
| 2003 || [[#SetCopyright]]
|-
| 2004 ||
|-
| 2010 ||
|-
| 2020 || [[#Initialize]]
|-
| 2030 || [[#GetVsyncEvent]]
|-
| 2040 || [[#GetVsyncTimestamp]]
|-
| 2050 ||
|-
| 2060 ||
|-
| 2070 || [[#CreateMovieMaker]]
|}

=== GetGraphicsSupervisorForNxCompat ===
Unofficial name.

No input. Returns an output TIPC handle to [[Switch_2:_GSV_services|GraphicsSupervisor]].

Same as [[#GetGraphicsSupervisor]] but for compat mode.

=== SetCopyright ===
Unofficial name.

Takes an input bool. No output.

Called directly after "nn::vi::WriteToCopyrightFramebuffer".

=== Initialize ===
Unofficial name.

No input/output.

Called during init.

=== GetVsyncEvent ===
Unofficial name.

No input. Returns an Event handle.

=== GetVsyncTimestamp ===
Unofficial name.

No input. Returns an output u64.

When event from [[#GetVsyncEvent]] triggers, this returns a timestamp.

= Library Applets =
This section documents library applet launching.

Before starting the applet, [[#IStorage]]s are [[#ILibraryAppletCreator|created]] and written, then passed to [[#ILibraryAppletAccessor]] PushInData. The [[#IStorage]] session is closed afterwards. The first [[#IStorage]] is [[#CommonArguments]], followed by any applet-specific [[#IStorage]]s.

Once the applet finishes running successfully, [[#ILibraryAppletAccessor]] PopOutData can be used to get the applet-specific [[#IStorage]] containing the applet output data.

== CommonArguments ==
The first [[#CreateStorage|IStorage]] passed to applets should contain the common library applet arguments. This is populated by <code>nn::la::CommonArgumentsWriter</code> and has the following format.

This struct is 0x20-bytes.

Official sw handles the first 8-bytes separately, which is a header. With CommonArguments version 0x0, the header is 4-bytes, while starting with version 0x1 it's 8-bytes.

{| class="wikitable" border="1"
|-
! Offset || Size || Typical Value || Notes
|-
| 0x0 || 4 || 1 || Common Arguments version
|-
| 0x4 || 4 || 0x20 || Common Arguments size
|-
| 0x8 || 4 || || Library applet version (API version)
|-
| 0xC || 4 || 0 || Theme color
|-
| 0x10 || 1 || 0 || Play startup sound
|-
| 0x18 || 8 || N/A || System tick (see [[SVC#svcGetSystemTick|svcGetSystemTick]])
|-
|}

= AppletId =
This is "nn::applet::AppletId". See also [[:Category:Library Applets]].

{| class="wikitable" border="1"
|-
! Value
! ProgramId
! Description
|-
| 0x00000000
|
| None
|-
| 0x00000001
|
| Application (not valid for use with LibraryApplets)
|-
| 0x00000002
| 0x010000000000100C
| OverlayApplet (overlayDisp)
|-
| 0x00000003
| 0x0100000000001000
| SystemAppletMenu (qlaunch)
|-
| 0x00000004
| 0x0100000000001012
| SystemApplication (starter)
|-
| 0x0000000A
| 0x0100000000001001
| [[Auth_Applet|LibraryAppletAuth (auth)]]
|-
| 0x0000000B
| 0x0100000000001002
| [[Cabinet_Applet|LibraryAppletCabinet (cabinet)]]
|-
| 0x0000000C
| 0x0100000000001003
| [[Controller_Applet|LibraryAppletController (controller)]]
|-
| 0x0000000D
| 0x0100000000001004
| LibraryAppletDataErase (dataErase)
|-
| 0x0000000E
| 0x0100000000001005
| [[Error_Applet|LibraryAppletError (error)]]
|-
| 0x0000000F
| 0x0100000000001006
| LibraryAppletNetConnect (netConnect)
|-
| 0x00000010
| 0x0100000000001007
| [[Profile_Selector|LibraryAppletPlayerSelect (playerSelect)]]
|-
| 0x00000011
| 0x0100000000001008
| [[Software_Keyboard|LibraryAppletSwkbd (swkbd)]]
|-
| 0x00000012
| 0x0100000000001009
| [[MiiEdit_Applet|LibraryAppletMiiEdit (miiEdit)]]
|-
| 0x00000013
| [22.0.0+] 0x0100000000001043 ([1.0.0-21.2.0] 0x010000000000100A)
| [[Internet_Browser#010000000000100A|LibraryAppletWeb (web)]]
|-
| 0x00000014
| 0x010000000000100B
| [[Internet_Browser#ShopN|LibraryAppletShop (shop)]]
|-
| 0x00000015
| 0x010000000000100D
| [[Album_Applet|LibraryAppletPhotoViewer (photoViewer)]]
|-
| 0x00000016
| 0x010000000000100E
| LibraryAppletSet (set)
|-
| 0x00000017
| 0x010000000000100F
| [[Internet_Browser#Offline_Applet|LibraryAppletOfflineWeb (offlineWeb)]] (LibraryAppletOfflineWebApp_0 in Ounce)
|-
| 0x00000018
| [22.0.0+] 0x0100000000001042 ([1.0.0-21.2.0] 0x0100000000001010)
| [[Internet_Browser#Whitelisted_Applets|LibraryAppletLoginShare (loginShare)]]
|-
| 0x00000019
| [22.0.0+] 0x0100000000001043 ([1.0.0-21.2.0] 0x0100000000001011)
| [[Internet_Browser#WifiWebAuthApplet|LibraryAppletWifiWebAuth (wifiWebAuth)]]
|-
| 0x0000001A
| 0x0100000000001013
| [[MyPage_Applet|LibraryAppletMyPage (myPage)]]
|-
| 0x0000001B
| 0x010000000000101A
| LibraryAppletGift (gift)
|-
| 0x0000001C
| 0x010000000000101C
| LibraryAppletUserMigration (userMigration)
|-
| 0x0000001D
| 0x010000000000101D
| [9.0.0+] LibraryAppletPreomiaSys (EncounterSys)
|-
| 0x0000001E
| 0x0100000000001020
| [9.0.0+] LibraryAppletStory (story)
|-
| 0x0000001F
| 0x010070000E3C0000
| [9.0.0+] LibraryAppletPreomiaUsr (EncounterUsr)
|-
| 0x00000020
| 0x010086000E49C000
| [9.0.0+] LibraryAppletPreomiaUsrDummy (EncounterUsrDummy)
|-
| 0x00000021
| 0x0100000000001038
| [10.0.0+] LibraryAppletSample (sample)
|-
| 0x00000022
| 0x0100000000001007
| [13.0.0+] LibraryAppletPromoteQualification (playerSelect)
|-
| 0x00000032
| 0x010000000000100F
| [17.0.0+] LibraryAppletOfflineWebApp_3 ([[Internet_Browser#Offline_Applet|LibraryAppletOfflineWeb (offlineWeb)]] in NX)
|-
| 0x00000033
| 0x010000000000100F
| [17.0.0+] LibraryAppletOfflineWebSystem ([[Internet_Browser#Offline_Applet|LibraryAppletOfflineWeb (offlineWeb)]] in NX)
|-
| 0x00000035
| [22.0.0+] 0x0100000000001042 ([17.0.0-21.2.0] 0x0100000000001010, [16.0.0-16.1.0] 0x0100000000001042)
| [17.0.0+] LibraryAppletLhub ([16.0.0-16.1.0] ) ([[Internet_Browser#Whitelisted_Applets|LibraryAppletLoginShare (loginShare)]] in NX)
|-
| 0x00000036
| [22.0.0+] 0x0100000000001042 ([17.0.0-21.2.0] 0x0100000000001010, [16.0.0-16.1.0] 0x0100000000001042)
| [17.0.0+] LibraryAppletLogin ([16.0.0-16.1.0] ) ([[Internet_Browser#Whitelisted_Applets|LibraryAppletLoginShare (loginShare)]] in NX)
|-
| 0x00000037
| [22.0.0+] 0x0100000000001042 ([17.0.0-21.2.0] 0x0100000000001010, [16.0.0-16.1.0] 0x0100000000001042)
| [17.0.0+] LibraryAppletShare ([16.0.0-16.1.0] ) ([[Internet_Browser#Whitelisted_Applets|LibraryAppletLoginShare (loginShare)]] in NX)
|-
| 0x00000038
| 0x0100000000001043
| [16.0.0-16.1.0]
|-
| 0x00000050
| 0x0100000000001007
| [18.0.0+]
|-
| 0x00000051
| 0x0100000000001007
| [18.0.0+]
|-
| 0x00000052
| 0x0100000000001001
| [22.0.0+]
|-
| 0x00000064
| 0x0100000000001048
| [20.0.0+] [[Splay_Applet|splay]]
|-
| 0x00000066
| 0x0100000000001054
| [21.0.0+]
|-
| 0x000003E8
|
| [10.0.0-16.1.0] DevlopmentTool
|-
| 0x000003F1
| 0x010000000000D619
| [10.0.0-16.1.0] CombinationLA
|-
| 0x000003F2
| 0x010000000000D610
| [10.0.0-16.1.0] AeSystemApplet
|-
| 0x000003F3
| 0x010000000000D611
| [10.0.0-16.1.0] AeOverlayApplet
|-
| 0x000003F4
| 0x010000000000D612
| [10.0.0-16.1.0] AeStarter
|-
| 0x000003F5
| 0x010000000000D613
| [10.0.0-16.1.0] AeLibraryAppletAlone
|-
| 0x000003F6
| 0x010000000000D614
| [10.0.0-16.1.0] AeLibraryApplet1
|-
| 0x000003F7
| 0x010000000000D615
| [10.0.0-16.1.0] AeLibraryApplet2
|-
| 0x000003F8
| 0x010000000000D616
| [10.0.0-16.1.0] AeLibraryApplet3
|-
| 0x000003F9
| 0x010000000000D617
| [10.0.0-16.1.0] AeLibraryApplet4
|-
| 0x000003FA
| 0x010000000000D60A
| [10.0.0-16.1.0] AppletISA
|-
| 0x000003FB
| 0x010000000000D60B
| [10.0.0-16.1.0] AppletIOA
|-
| 0x000003FC
| 0x010000000000D60C
| [10.0.0-16.1.0] AppletISTA
|-
| 0x000003FD
| 0x010000000000D60D
| [10.0.0-16.1.0] AppletILA1
|-
| 0x000003FE
| 0x010000000000D60E
| [10.0.0-16.1.0] AppletILA2
|-
| 0x0100000A
|
| [[Auth_Applet|LibraryAppletAuth]]
|-
| 0x0100000B
|
| [[Cabinet_Applet|LibraryAppletCabinet]]
|-
| 0x0100000C
|
| [[Controller_Applet|LibraryAppletController]]
|-
| 0x0100000D
|
| [S2]
|-
| 0x0100000E
|
| [S2] LibraryAppletError
|-
| 0x01000010
|
| [S2] LibraryAppletPlayerSelect
|-
| 0x01010011
|
| [S2] SwkbdModeless
|-
| 0x01020011
|
| [S2] Swkbd
|-
| 0x01010012
|
| [S2] [[MiiEdit_Applet|LibraryAppletMiiEdit]] (for ShowMiiEdit)
|-
| 0x01020012
|
| [S2] [[MiiEdit_Applet|LibraryAppletMiiEdit]] (for AppendMii)
|-
| 0x01070012
|
| [S2] [[MiiEdit_Applet|LibraryAppletMiiEdit]] (for CreateMii)
|-
| 0x01080012
|
| [S2] [[MiiEdit_Applet|LibraryAppletMiiEdit]] (for EditMii)
|-
| 0x01000013
|
| [S2] OpenWeb
|-
| 0x01000014
|
| [S2] LibraryAppletShop
|-
| 0x01000015
|
| [S2] [[Album_Applet|Album]]
|-
| 0x01000017
|
| [S2] LibraryAppletOffline (for Gen0)
|-
| 0x01000018
|
| [S2] [[Internet_Browser#Whitelisted_Applets|LibraryAppletLoginShare]] (for Lobby)
|-
| 0x0100001A
|
| [S2] [[MyPage_Applet|MyPageApplet]]
|-
| 0x01000022
|
| [S2] LibraryAppletPromoteQualification
|-
| 0x01000024
|
| [S2] SplayApplet
|-
| 0x01030024
|
| [S2] SplayApplet
|-
| 0x01010025
|
| [S2] SaveDataBackup (System Settings menu for Save Data Cloud)
|-
| 0x01020025
|
| [S2] SaveDataBackup (Same as above except with ApplicationId specified)
|-
| 0x01000028
|
| [S2] Eula
|-
| 0x01000032
|
| [S2] LibraryAppletOfflineWebApp_3
|-
| 0x01000033
|
| [S2] LibraryAppletOfflineWebSystem
|-
| 0x01000035
|
| [S2] LibraryAppletLhub
|-
| 0x01000036
|
| [S2] LibraryAppletLogin
|-
| 0x01000037
|
| [S2] LibraryAppletShare
|-
| 0x01000050
|
| [S2] PlayerSelect
|-
| 0x01000051
|
| [S2] PlayerSelect
|-
| 0x01000052
|
| [S2] PlayerSelect
|-
| 0x01000065
|
| [S2] Chat (ForChatStart)
|-
| 0x01010065
|
| [S2] Chat (ForCameraConfiguration)
|-
| 0x01020065
|
| [S2] Chat (ForFullScreen)
|-
| 0x01030065
|
| [S2] Chat (ForCameraSharingGuide)
|-
| 0x700000C8
| 0x010000000000D65B
| [18.0.0+]
|-
| 0x700000C9
| 0x010000000000D65C
| [18.0.0+]
|-
| 0x700000DC
| 0x010000000000D619
| [17.0.0+] CombinationLA
|-
| 0x700000E6
| 0x010000000000D610
| [17.0.0+] AeSystemApplet
|-
| 0x700000E7
| 0x010000000000D611
| [17.0.0+] AeOverlayApplet
|-
| 0x700000E8
| 0x010000000000D612
| [17.0.0+] AeStarter
|-
| 0x700000E9
| 0x010000000000D613
| [17.0.0+] AeLibraryAppletAlone
|-
| 0x700000EA
| 0x010000000000D614
| [17.0.0+] AeLibraryApplet1
|-
| 0x700000EB
| 0x010000000000D615
| [17.0.0+] AeLibraryApplet2
|-
| 0x700000EC
| 0x010000000000D616
| [17.0.0+] AeLibraryApplet3
|-
| 0x700000ED
| 0x010000000000D617
| [17.0.0+] AeLibraryApplet4
|-
| 0x700000F0
| 0x010000000000D60A
| [17.0.0+] AppletISA
|-
| 0x700000F1
| 0x010000000000D60B
| [17.0.0+] AppletIOA
|-
| 0x700000F2
| 0x010000000000D60C
| [17.0.0+] AppletISTA
|-
| 0x700000F3
| 0x010000000000D60D
| [17.0.0+] AppletILA1
|-
| 0x700000F4
| 0x010000000000D60E
| [17.0.0+] AppletILA2
|-
| 0x700000FA
| 0x010000000000D677
| [20.1.0+]
|}

= LibraryAppletMode =
This is "nn::applet::LibraryAppletMode".

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0x0
| AllForeground
|-
| 0x1
| PartialForeground
|-
| 0x2
| NoUi
|-
| 0x3
| PartialForegroundWithIndirectDisplay (see also [[#GetIndirectLayerConsumerHandle]], only used by swkbd [[Software_Keyboard|InlineKeyboard]])
|-
| 0x4
| AllForegroundInitiallyHidden (can be used by [7.0.0+] [[Internet_Browser|WebSession]])
|}

= AppletMessage =
This is "nn::am::AppletMessage".

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || None
|-
| 1 || ChangeIntoForeground
|-
| 2 || ChangeIntoBackground
|-
| 4 || Exit
|-
| 6 || ApplicationExited
|-
| 7 ||
|-
| 15 || [[#FocusState|FocusStateChanged]]
|-
| 16 || [[#SetRestartMessageEnabled|Resume]]
|-
| 20 || DetectShortPressingHomeButton
|-
| 21 || DetectLongPressingHomeButton
|-
| 22 || DetectShortPressingPowerButton
|-
| 23 || DetectMiddlePressingPowerButton
|-
| 24 || DetectLongPressingPowerButton
|-
| 25 || RequestToPrepareSleep
|-
| 26 || FinishedSleepSequence
|-
| 27 || SleepRequiredByHighTemperature
|-
| 28 || SleepRequiredByLowBattery
|-
| 29 || AutoPowerDown
|-
| 30 || [[#OperationMode|OperationModeChanged]]
|-
| 31 || [[#PerformanceMode|PerformanceModeChanged]]
|-
| 32 || DetectReceivingCecSystemStandby
|-
| 33 || SdCardRemoved
|-
| 34 ||
|-
| 50 || LaunchApplicationRequested
|-
| 51 || [[#SetHandlesRequestToDisplay|RequestToDisplay]]
|-
| 55 || ShowApplicationLogo
|-
| 56 || HideApplicationLogo
|-
| 57 || ForceHideApplicationLogo
|-
| 58 ||
|-
| 59 ||
|-
| 60 || FloatingApplicationDetected
|-
| 61 || [7.0.0+] PerformanceConfigurationChanged
|-
| 70 ||
|-
| 71 ||
|-
| 72 ||
|-
| 73 ||
|-
| 75 ||
|-
| 80 ||
|-
| 81 ||
|-
| 82 ||
|-
| 83 ||
|-
| 85 ||
|-
| 86 ||
|-
| 90 || [[#SetRequiresCaptureButtonShortPressedMessage|DetectShortPressingCaptureButton]]
|-
| 92 || [[#SetAlbumImageTakenNotificationEnabled|AlbumScreenShotTaken]]
|-
| 93 || AlbumRecordingSaved
|-
| 94 ||
|-
| 100 ||
|-
| 101 ||
|-
| 110 || [14.0.0+] DetectShortPressingCaptureButtonForApplet
|-
| 111 || [14.0.0+] DetectLongPressingCaptureButtonForApplet
|-
| 1000 ||
|}

= OperationMode =
This is "nn::oe::OperationMode".

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || Handheld
|-
| 1 || Console
|}

= PerformanceMode =
This is "nn::oe::PerformanceMode".

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| -1 || Invalid
|-
| 0 || Normal
|-
| 1 || Boost
|}

= FocusState =
This is "nn::oe::FocusState".

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 1 || InFocus
|-
| 2 || OutOfFocus
|-
| 3 || Background
|}

= CpuBoostMode =
This is "nn::oe::CpuBoostMode".

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || Normal
|-
| 1 || FastLoad
|}

= WindowOriginMode =
This is "nn::oe::WindowOriginMode".

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || LowerLeft
|-
| 1 || UpperLeft
|}

= WirelessPriorityMode =
This is "nn::oe::WirelessPriorityMode".

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || Default
|-
| 1 || OptimizedForWlan
|}

= TvPowerStateMatchingMode =
This is "nn::oe::TvPowerStateMatchingMode". This is used with [[#SetTvPowerStateMatchingMode]].

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || Unknown
|-
| 1 || Unknown
|}

= SystemButtonType =
This is "nn::am::service::SystemButtonType". This is used with [[#PerformSystemButtonPressingIfInFocus]]/[[#PerformSystemButtonPressing]].

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 1 || PerformHomeButtonShortPressing
|-
| 2 || PerformHomeButtonLongPressing
|-
| 3 || Short-pressing with the Power-button. Only available with [[#PerformSystemButtonPressing]].
|-
| 4 || Long-pressing with the Power-button. Only available with [[#PerformSystemButtonPressing]].
|-
| 5 || Shutdown the system. Only available with [[#PerformSystemButtonPressing]].
|-
| 6 || PerformCaptureButtonShortPressing
|-
| 7 || PerformCaptureButtonLongPressing
|}

= LaunchParameterKind =
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 1 || UserChannel. Application-specific LaunchParameter.
|-
| 2 || account PreselectedUser
|-
| 3 || Unknown if used by anything?
|}

= LibraryAppletExitReason =
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || Normal
|-
| 1 || Canceled
|-
| 2 || Abnormal
|-
| 10 || Unexpected
|}

= ProgramSpecifyKind =
This is "nn::am::service::ProgramSpecifyKind". This controls the type of the u64 passed to [[#ExecuteProgram]].

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || u8 ProgramIndex. "ExecuteProgram". [[NS_Services|NS]] handles ProgramIndex by launching ApplicationId+ProgramIndex. After using [[#ExecuteProgram]] with this successfully, official user-processes will enter an infinite loop with sleep-thread value 86400000000000.
|-
| 1 || [[NCM_services#ApplicationId|ApplicationId]]. "JumpToSubApplicationProgramForDevelopment". Only available when [[Settings_services#GetDebugModeFlag|DebugMode]] is 1.
|-
| 2 || u64 = value 0. "RestartProgram"
|}

ProgramIndex values where the title is not installed should not be used: [[qlaunch]] will display an error message and the current title will become "corrupted", however Home Menu will have an option to repair it.

= InputDetectionPolicy =
This is u32 enum "nn::applet::InputDetectionPolicy".

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || Unknown
|-
| 1 || Unknown
|}

= AppletResourceUserId =
This is "nn::applet::AppletResourceUserId". Used by a number of non-AM services.

= AppletAttribute =
This is "nn::am::AppletAttribute". This struct is 0x80 bytes.

{| class="wikitable" border="1"
|-
! Offset || Size || Description
|-
| 0x0 || 0x1 || Flag. When non-zero, two state fields are set to 1.
|-
| 0x1 || 0x7F || Unused
|}

This is used by [[#OpenLibraryAppletProxy]].

= AppletProcessLaunchReason =
This is "nn::am::service::AppletProcessLaunchReason". This struct is 0x4-bytes.

{| class="wikitable" border="1"
|-
! Offset || Size || Description
|-
| 0x0 || 0x1 || Flag. When non-zero, LibraryApplets then use [[#OpenCallingLibraryApplet]].
|-
| 0x1 || 0x2 || Always 0.
|-
| 0x3 || 0x1 || Always 0.
|}

= LibraryAppletInfo =
This is "nn::am::service::LibraryAppletInfo". This struct is 0x8-bytes.

{| class="wikitable" border="1"
|-
! Offset || Size || Description
|-
| 0x0 || 0x4 || [[#AppletId]]
|-
| 0x4 || 0x4 || [[#LibraryAppletMode]]
|}

= AppletKind =
This is "nn::am::service::AppletKind". This is 8-bytes.

= AppletIdentityInfo =
This struct is "nn::am::service::AppletIdentityInfo". This struct is 0x10-bytes.

{| class="wikitable" border="1"
|-
! Offset || Size || Description
|-
| 0x0 || 0x4 || [[#AppletId]]
|-
| 0x4 || 0x4 || Padding
|-
| 0x8 || 0x8 || [[NCM_services#ApplicationId|ApplicationId]]
|}

= ApplicationAttributeForQuest =
This struct is "nn::applet::ApplicationAttributeForQuest".

{| class="wikitable" border="1"
|-
! Offset || Size || Description
|-
| 0x0 || 0x4 || See [[#ApplicationAttribute]].
|-
| 0x4 || 0x4 || See [[#ApplicationAttribute]].
|-
| 0x8 || 0x4 || [7.0.0+] See [[#ApplicationAttribute]].
|}

User-processes copy the first 0x8-bytes (0xC-bytes with [[#CreateApplicationWithAttributeAndPushAndRequestToStartForQuest]]/[[#CreateApplicationWithAttributeAndRequestToStartForQuest]]) to a [[#ApplicationAttribute]] with the rest of the struct being cleared, which is then passed to the actual cmd (CreateApplication*ToStartForQuest).

= ApplicationAttribute =
This struct is "nn::am::ApplicationAttribute". This struct is 0x20-bytes.

{| class="wikitable" border="1"
|-
! Offset || Size || Description
|-
| 0x0 || 0x4 || Default is 0 for non-Quest. Only used when non-zero: unknown value in seconds.
|-
| 0x4 || 0x4 || Default is 0 for non-Quest. Only used when non-zero: unknown value in seconds.
|-
| 0x8 || 0x4 || float audio volume. Must be in the range of 0.0f-1.0f. The default is 1.0f.
|-
| 0xC || 0x14 || Unused. Default is 0.
|}

Internally AM only uses the first 0xC-bytes from ApplicationAttribute, regardless of the cmd.

= ApplicationLaunchProperty =
This struct is 0x10-bytes.

{| class="wikitable" border="1"
|-
! Offset || Size || Description
|-
| 0x0 || 0x8 || [[NCM_services#ApplicationId|ApplicationId]]
|-
| 0x8 || 0x4 || Application title-version.
|-
| 0xC || 0x1 || [[Filesystem_services#StorageId|StorageId]] for the Application base title.
|-
| 0xD || 0x1 || [[Filesystem_services#StorageId|StorageId]] for the Application update title.
|-
| 0xE || 0x1 || Unknown.
|-
| 0xF || 0x1 || Padding.
|}

= ApplicationLaunchRequestInfo =
This is "nn::applet::ApplicationLaunchRequestInfo". This struct is 0x10-bytes.

{| class="wikitable" border="1"
|-
! Offset || Size || Description
|-
| 0x0 || 0x4 || Unknown. The default is 0x0 with [[#CreateSystemApplication]], 0x3 with [[#CreateApplication]].
|-
| 0x4 || 0x4 || Unknown. The default is 0x0 with [[#CreateSystemApplication]], 0x3 with [[#CreateApplication]].
|-
| 0x8 || 0x8 || Unknown. The default is 0x0.
|}

= AppletResourceUsageInfo =
This is "nn::am::service::AppletResourceUsageInfo". This struct is 0x20-bytes.

{| class="wikitable" border="1"
|-
! Offset || Size || Description
|-
| 0x0 || 0x4 || Unknown counter.
|-
| 0x4 || 0x4 || Unknown counter.
|-
| 0x8 || 0x4 || Output from [[NS_Services|NS GetRightsEnvironmentCountForDebug]].
|-
| 0xC || 0x14 || Always zero.
|}

= ApplicationLicenseType =
This is "nn::oe::ApplicationLicenseType". This is 1-byte.

= LaunchRequiredVersion =
This is "nn::oe::LaunchRequiredVersion". This is a 0x40-byte struct with 1-byte alignment.

= ServerEnvironmentType =
This is "nn::oe::ServerEnvironmentType".

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || dd
|-
| 1 || lp
|-
| 2 || sd
|-
| 3 || sp
|-
| 4 || dp
|}

= (S2) AdrawFrameBufferInfo =
{| class="wikitable" border="1"
|-
! Offset || Size || Description
|-
| 0x0 || 0x8 || Id
|-
| 0x8 || 0x2 || Width
|-
| 0xA || 0x2 || Height
|-
| 0xC || 0x4 || BlockCount
|-
| 0x10 || 0x8 ||
|-
| 0x18 || 0x8 ||
|-
| 0x20 || 0x8 ||
|}

= (S2) ImageInfo =
{| class="wikitable" border="1"
|-
! Offset || Size || Description
|-
| 0x0 || 0x8 ||
|-
| 0x8 || 0x8 || Address
|-
| 0x10 || 0x8 ||
|-
| 0x18 || 0x8 ||
|-
| 0x20 || 0x8 ||
|-
| 0x28 || 0x8 ||
|-
| 0x30 || 0x8 ||
|-
| 0x38 || 0x4 || Offset
|-
| 0x3C || 0x4 || Size
|-
| 0x40 || 0x8 ||
|-
| 0x48 || 0x8 ||
|-
| 0x50 || 0x8 ||
|-
| 0x58 || 0x8 ||
|-
| 0x60 || 0x8 ||
|-
| 0x68 || 0x8 ||
|-
| 0x70 || 0x8 ||
|-
| 0x78 || 0x8 ||
|-
| 0x80 || 0x8 ||
|-
| 0x88 || 0x8 ||
|-
| 0x90 || 0x4 || Flags
|}

= Notes =
AM-sysmodule will only initialize [[Shared_Database_services|pdm:ntfy]] / use pdm:ntfy service commands when the value from [[Process_Manager_services|pm:bm]] GetBootMode is not 0x1 (Maintenance).

An object constructor also writes the output from [[Process_Manager_services|pm:bm]] GetBootMode into the created object. A vfunc for this object checks whether this field is Maintenance: if so, it calls a vfunc then a func and returns. Otherwise after calling various (v)funcs, if required this eventually uses [[OMM_services|ommdisp]] cmd600.

[[Category:Services]]