Nintendo Switch Brew

SPL services: Difference between revisions

← Older edit
No edit summary
 
(6 intermediate revisions by 2 users not shown)
Line 2: Line 2:


During [1.0.0-3.0.2], the only existing services were "csrng" and "spl:". However, in [4.0.0+] the "spl:" service was refactored and split into new services with different permission levels. Each service exposes the IPC command list differently in order to prevent cryptographic operations to take place in the wrong context.
During [1.0.0-3.0.2], the only existing services were "csrng" and "spl:". However, in [4.0.0+] the "spl:" service was refactored and split into new services with different permission levels. Each service exposes the IPC command list differently in order to prevent cryptographic operations to take place in the wrong context.
In [2.0.0+] where previously only one AES keyslot was used, there is now support for 4 of them and when the session closes, all allocated AES keyslots are automatically freed.


= csrng =
= csrng =
Line 14: Line 16:


== GenerateRandomBytes ==
== GenerateRandomBytes ==
Takes a type-6 buffer and fills it with random data from [[SMC#GetRandomBytes|GetRandomBytes SMC]]. Same command for "spl:" and "csrng" services.
Takes an output type-0xA buffer and fills it with random data from [[SMC#GenerateRandomBytes|GenerateRandomBytes SMC]]. Same command for "spl:" and "csrng" services, except for buffer-type.
 
= spl:, spl:mig, spl:fs, spl:ssl, spl:es, spl:manu =
These are "nn::spl::detail::IGeneralInterface", "nn::spl::detail::ICryptoInterface", "nn::spl::detail::IFsInterface", "nn::spl::detail::ISslInterface", "nn::spl::detail::IEsInterface" and "nn::spl::detail::IManuInterface".
 
[2.0.0+] Where previously only one AES keyslot was used, there is now support for 4 of them.


[2.0.0+] When the session closes, all allocated AES keyslots are automatically freed.
= spl: =
This is "nn::spl::detail::IGeneralInterface".


{| class="wikitable" border="1"
{| class="wikitable" border="1"
|-
|-
! Cmd || Name || Permissions
! Cmd || Name
|-
| 0 || [[#GetConfig]] || spl:, spl:mig, spl:fs, spl:ssl, spl:es, spl:manu
|-
| 1 || [[#ExpMod]] || spl:, spl:mig, spl:fs, spl:ssl, spl:es, spl:manu
|-
| 2 || [[#GenerateAesKek]] || spl:mig, spl:fs, spl:ssl, spl:es, spl:manu
|-
| 3 || [[#LoadAesKey]] || spl:mig, spl:fs, spl:ssl, spl:es, spl:manu
|-
| 4 || [[#GenerateAesKey]] || spl:mig, spl:fs, spl:ssl, spl:es, spl:manu
|-
| 5 || [[#SetConfig]] || spl:, spl:mig, spl:fs, spl:ssl, spl:es, spl:manu
|-
| 7 || [[#GenerateRandomBytes]] || spl:, spl:mig, spl:fs, spl:ssl, spl:es, spl:manu
|-
| 9 || [[#ImportLotusKey]] || spl:fs
|-
| 10 || [[#DecryptLotusMessage]] || spl:fs
|-
| 11 || [[#IsDevelopment]] || spl:, spl:mig, spl:fs, spl:ssl spl:es, spl:manu
|-
| 12 || [[#GenerateSpecificAesKey]] || spl:fs
|-
|-
| 13 || [[#DecryptRsaPrivateKey]] || spl:ssl, spl:es, spl:manu
| 0 || [[#GetConfig]]
|-
|-
| 14 || [[#DecryptAesKey]] || spl:mig, spl:fs, spl:ssl, spl:es, spl:manu
| 1 || [[#ModularExponentiate]]
|-
|-
| 15 || [[#CryptAesCtr]] || spl:mig, spl:fs, spl:ssl, spl:es, spl:manu
| 5 || [[#SetConfig]]
|-
|-
| 16 || [[#ComputeCmac]] || spl:mig, spl:fs, spl:ssl, spl:es, spl:manu
| 7 || [[#GenerateRandomBytes]]
|-
|-
| 17 || [[#ImportEsKey]] || spl:es
| 11 || [[#IsDevelopment]]
|-
|-
| 18 || [[#UnwrapTitleKey]] || spl:es
| 24 || [3.0.0+] [[#SetBootReason]]
|-
|-
| 19 || [[#LoadTitleKey]] || spl:fs
| 25 || [3.0.0+] [[#GetBootReason]]
|-
| 20 || [2.0.0+] [[#UnwrapCommonTitleKey]] || spl:es
|-
| 21 || [2.0.0+] [[#AllocateAesKeyslot]] || spl:mig, spl:fs, spl:ssl, spl:es, spl:manu
|-
| 22 || [2.0.0+] [[#FreeAesKeyslot]] || spl:mig, spl:fs, spl:ssl, spl:es, spl:manu
|-
| 23 || [2.0.0+] [[#GetAesKeyslotAvailableEvent]] || spl:mig, spl:fs, spl:ssl, spl:es, spl:manu
|-
| 24 || [3.0.0+] [[#SetBootReason]] || spl:, spl:mig, spl:fs, spl:ssl, spl:es, spl:manu
|-
| 25 || [3.0.0+] [[#GetBootReason]] || spl:, spl:mig, spl:fs, spl:ssl, spl:es, spl:manu
|-
| 26 || [5.0.0+] ImportSslKey || spl:ssl
|-
| 27 || [5.0.0+] SslExpMod || spl:ssl
|-
| 28 || [5.0.0+] ImportDrmKey || spl:es
|-
| 29 || [5.0.0+] DrmExpMod || spl:es
|-
| 30 || [5.0.0+] ReEncryptRsaPrivateKey || spl:manu
|-
| 31 || [5.0.0+] GetPackage2Hash || spl:fs
|-
| 31 || [6.0.0+] UnwrapElicenseKey || spl:es
|-
| 32 || [6.0.0+] [[#LoadElicenseKey]] || spl:es
|}
|}


Line 95: Line 43:
Wrapper for [[SMC#GetConfig|GetConfig SMC]].
Wrapper for [[SMC#GetConfig|GetConfig SMC]].


Takes a u32 ('''ConfigItem'''), and returns one or more u64s ('''ConfigVal''').
Takes an input u32 '''ConfigItem'''. Returns one or more output u64s '''ConfigValue'''.


== ExpMod ==
== ModularExponentiate ==
Wrapper for [[SMC#ExpMod|ExpMod SMC]].
Wrapper for [[SMC#ModularExponentiate|ModularExponentiate SMC]].


Takes one type-10 (C descriptor) buffer ('''data_out_buf''') and 3 type-9 (X descriptor) buffers ('''data_in_buf''', '''exp_in_buf''' and '''mod_in_buf''').
Takes an output type-0xA buffer '''DataOut''' and 3 input type-0x9 buffers '''DataIn''', '''ExpIn''' and '''ModIn'''.


Performs asymmetric crypto with user supplied modulus and exponent.
Performs asymmetric crypto with user supplied modulus and exponent.
Line 107: Line 55:
Wrapper for [[SMC#GenerateAesKek|GenerateAesKek SMC]].
Wrapper for [[SMC#GenerateAesKek|GenerateAesKek SMC]].


Takes a 16-byte EKS ('''Encryption Key Source''') and two words ('''KeyGeneration''' and '''option''') as input.
Takes an input 16-byte '''KeySource''' and two input u32s '''Generation''' and '''Option'''. Returns an output 16-byte '''AccessKey'''.
 
Returns a scrambled sealed KEK ('''Key Encryption Key''' used as '''key_x''').


== LoadAesKey ==
== LoadAesKey ==
Wrapper for [[SMC#LoadAesKey|LoadAesKey SMC]].
Wrapper for [[SMC#LoadAesKey|LoadAesKey SMC]].


Takes a u32 ('''keyslot''') and two 16-byte keys ('''key_x''' and '''key_y''').
Takes an input u32 '''KeySlot''' , an input 16-byte '''AccessKey''' and an input 16-byte '''KeySource'''.


Sets the specified '''keyslot''' with a key generated from '''key_x''' and '''key_y'''.
Sets the specified '''KeySlot''' with a key generated from '''AccessKey''' and '''KeySource'''.


[2.0.0+] Now verifies that the keyslot in use (0..3) is allocated by the current spl session, otherwise errors with 0xD21A. Previously, keyslot was hardcoded to 0.
[2.0.0+] Now verifies that the keyslot in use (0..3) is allocated by the current spl session, otherwise errors with 0xD21A. Previously, keyslot was hardcoded to 0.


== GenerateAesKey ==
== GenerateAesKey ==
Takes a 16-byte KEK ('''key_x''') and a 16-byte encrypted key ('''enc_key''').
Takes an input 16-byte '''AccessKey''' and an input 16-byte '''KeySource'''. Returns an output 16-byte '''AesKey'''.


Generates a new key by decrypting (AES-ECB) '''enc_key''' with a key generated from the supplied '''key_x''' and a fixed '''key_y''' set with [[SMC#LoadAesKey|LoadAesKey SMC]].
Generates a new key by decrypting (AES-ECB) '''KeySource''' with a key generated from the supplied '''AccessKey''' and the key set with [[SMC#LoadAesKey|LoadAesKey SMC]].


[2.0.0+] Previously, it always used keyslot 0. Now it tries to allocate a keyslot to be used and returns 0xD01A if they're all busy. When the command is done, the keyslot is released.
[2.0.0+] Previously, it always used keyslot 0. Now it tries to allocate a keyslot to be used and returns 0xD01A if they're all busy. When the command is done, the keyslot is released.
Line 130: Line 76:
Wrapper for [[SMC#SetConfig|SetConfig SMC]].
Wrapper for [[SMC#SetConfig|SetConfig SMC]].


Takes a u32 ('''ConfigItem''') and a u64 ('''ConfigVal''').
Takes an input u32 '''ConfigItem''' and an input u64 '''ConfigValue'''.


{| class="wikitable" border="1"
Only '''ConfigItem''' 13 (IsChargerHiZModeEnabled) can be set.
|-
! ConfigItem || Name
|-
| 13 || IsChargerHiZModeEnabled
|}


Any other '''ConfigItem''', besides 13, can't be set.
== DecryptAndStoreGcKey ==
Wrapper for [[SMC#DecryptAndImportLotusKey|DecryptAndImportLotusKey SMC]].


== ImportLotusKey ==
Takes an input type-0x9 buffer '''DataIn''', an input 16-byte '''AccessKey''', an input 16-byte '''KeySource''' and an input u32 '''Version''' (0 for normal keys or 1 for extended keys).
Wrapper for [[SMC#ImportLotusKey|ImportLotusKey SMC]].


Takes one type-9 (X descriptor) buffer ('''enc_privk_in_buf'''), a 16-byte KEK ('''key_x'''), a 16-byte key ('''key_y''') and a u32 ('''version''').
Decrypts '''DataIn''' with a key generated from '''AccessKey''' and '''KeySource''' and imports it for later usage.
'''version''' is 0 for normal keys or 1 for extended keys.


Decrypts '''enc_privk_in_buf''' with a key generated from '''key_x''' and '''key_y''' and imports it for later usage.
[5.0.0+] The '''Version''' argument was removed and this now calls the [[SMC#ReencryptDeviceUniqueData|ReencryptDeviceUniqueData SMC]] instead.


[5.0.0+] This now calls [[SMC#ReEncryptRsaPrivateKey|ReEncryptRsaPrivateKey SMC]] instead.
== DecryptGcMessage ==
Takes 3 input type-0x9 buffers '''DataIn''', '''ModIn''' and '''LabelHashIn'''.


== DecryptLotusMessage ==
Uses the [[SMC#ModularExponentiateByStorageKey|ModularExponentiateByStorageKey SMC]] to decrypt '''DataIn''' using the private key imported with [[#DecryptAndStoreGcKey]] and the supplied '''ModIn''' and '''LabelHashIn'''.
Takes 3 type-9 (X descriptor) buffers ('''data_in_buf''', '''mod_in_buf''' and '''label_hash_in_buf''').
 
Uses [[SMC#SecureExpMod|SecureExpMod SMC]] to decrypt '''data_in_buf''' using the private key imported with [[#ImportLotusKey]] and the supplied '''mod_in_buf''' and '''label_hash_in_buf'''.


== IsDevelopment ==
== IsDevelopment ==
No input params.
No input. Returns an output u8 bool.


Uses [[#GetConfig]] internally with id=6. Returns true if output from that is 0, or if the SMC returned error 2.
Uses [[#GetConfig]] internally.
 
Returns an u8 flag for whether the system is devunit. Output flag is 0 on retail.


== GenerateSpecificAesKey ==
== GenerateSpecificAesKey ==
Wrapper for [[SMC#GenerateSpecificAesKey|GenerateSpecificAesKey SMC]].
Wrapper for [[SMC#GenerateSpecificAesKey|GenerateSpecificAesKey SMC]].


Takes a 16-byte seed ('''key_seed''') and two words ('''KeyGeneration''' and '''option''') as input.
Takes an input 16-byte '''KeySource''' and two input u32s '''Generation''' and '''Option'''. Returns an output 16-byte '''AesKey'''.


Returns a scrambled key ('''key_a''').
== DecryptDeviceUniqueData ==
Wrapper for [[SMC#DecryptDeviceUniqueData|DecryptDeviceUniqueData SMC]].


== DecryptRsaPrivateKey ==
Takes an output type-0xA buffer '''DataOut''', an input type-0x9 '''DataIn''', an input 16-byte '''AccessKey''', an input 16-byte '''KeySource''' and an input u32 '''Version''' (0 for normal keys or 1 for extended keys).
Wrapper for [[SMC#DecryptRsaPrivateKey|DecryptRsaPrivateKey SMC]].


Takes one type-10 (C descriptor) buffer ('''dec_privk_out_buf'''), one type-9 (X descriptor) buffer ('''enc_privk_in_buf'''), a 16-byte KEK ('''key_x'''), a 16-byte key ('''key_y''') and a u32 ('''version''').
Decrypts '''DataIn''' into '''DataOut''' with a key generated from '''AccessKey''' and '''KeySource'''.
'''version''' is 0 for normal keys or 1 for extended keys.


Decrypts '''enc_privk_in_buf''' into '''dec_privk_out_buf''' with a key generated from '''key_x''' and '''key_y'''.
Used by [[SSL_services|SSL]] for TLS client-privk.


Used by [[SSL_services|SSL]]-sysmodule for TLS client-privk.
[5.0.0+] The '''Version''' argument was removed.
 
[5.0.0+] This now calls [[SMC#DecryptOrImportRsaPrivateKey|DecryptOrImportRsaPrivateKey SMC]] instead.


== DecryptAesKey ==
== DecryptAesKey ==
Takes a 16-byte encrypted key ('''enc_key''') and two words ('''KeyGeneration''' and '''option''') as input.
Takes an input 16-byte '''KeySource''' and two input u32s '''Generation''' and '''Option'''. Returns an output 16-byte '''AesKey'''.


Decrypts (AES-ECB) '''enc_key''' with a key generated from fixed '''key_x''' and '''key_y''' set with [[SMC#LoadAesKey|LoadAesKey SMC]] and returns a 16-byte decrypted key ('''dec_key''').
Decrypts (AES-ECB) '''KeySource''' with a key set with [[SMC#LoadAesKey|LoadAesKey SMC]].


[2.0.0+] Introduced same keyslot allocation code as for [[#GenerateAesKey]].
[2.0.0+] Introduced same keyslot allocation code as for [[#GenerateAesKey]].


== CryptAesCtr ==
== ComputeCtr ==
Takes a type-0x46 (B descriptor) buffer ('''data_out_buf'''), a u32 ('''keyslot'''), a type-0x45 (A descriptor) buffer ('''data_in_buf''') and a 16-byte CTR ('''aes_ctr''').
Takes an output type-0x46 buffer '''DataOut''', an input u32 '''KeySlot''', an input type-0x45 buffer '''DataIn''' and an input 16-byte '''IvCtr'''.


Uses [[SMC#ComputeAes|ComputeAes SMC]] to decrypt '''data_in_buf''' into '''data_out_buf''', using the key set in the specified '''keyslot'''.
Uses [[SMC#ComputeAes|ComputeAes SMC]] to decrypt '''DataIn''' into '''DataOut''' using the key set in the specified '''KeySlot'''.


[2.0.0+] Verifies the keyslot was allocated in the current session.
[2.0.0+] Verifies the keyslot was allocated by the current session.


== ComputeCmac ==
== ComputeCmac ==
Wrapper for [[SMC#ComputeCmac|ComputeCmac SMC]].
Wrapper for [[SMC#ComputeCmac|ComputeCmac SMC]].


Takes one type-9 (X descriptor) buffer ('''data_in_buf''') and a u32 ('''type?''').
Takes an input type-0x9 buffer '''DataIn''' and an input u32 '''KeySlot'''. Returns an output 16-byte '''Cmac'''.
 
[2.0.0+] Verifies the keyslot was allocated by the current session.
 
== LoadEsDeviceKey ==
Wrapper for [[SMC#DecryptAndImportEsDeviceKey|DecryptAndImportEsDeviceKey SMC]].
 
Takes an input type-0x9 buffer '''DataIn''', an input 16-byte '''AccessKey''', an input 16-byte '''KeySource''' and an input u32 '''Version''' (0 for normal keys or 1 for extended keys).
 
Decrypts '''DataIn''' with a key generated from '''AccessKey''' and '''KeySource''' and imports it for later usage.
 
[5.0.0+] The '''Version''' argument was removed and this now calls the [[SMC#ReencryptDeviceUniqueData|ReencryptDeviceUniqueData SMC]] instead.


Returns a 16-byte CMAC calculated over '''data_in_buf'''.
== PrepareEsTitleKey ==
Wrapper for [[SMC#PrepareEsDeviceUniqueKey|PrepareEsDeviceUniqueKey SMC]].


[2.0.0+] Verifies the keyslot was allocated in the current session.
Takes an output type-0xA buffer '''DataOut''' and 3 input type-0x9 buffers '''DataIn''', '''ModIn''' and '''LabelHashIn'''. Returns an output u32 '''DataOutSize'''.


== ImportEsKey ==
[3.0.0+] Now takes an input u32 '''Generation'''.
Wrapper for [[SMC#ImportEsKey|ImportEsKey SMC]].


Takes one type-9 (X descriptor) buffer (enc_privk_in_buf), a 16-byte KEK (key_x), a 16-byte key (key_y) and a u32 (version). version is 0 for normal keys or 1 for extended keys.
Decrypts '''DataIn''' into '''DataOut''' using the private key imported with [[#LoadEsDeviceKey]] and the supplied '''ModIn'''. Afterwards, verifies RSA-OAEP encoding using '''LabelHashIn'''.


Decrypts enc_privk_in_buf with a key generated from key_x and key_y and imports it for later usage.
== LoadPreparedAesKey ==
Wrapper for [[SMC#LoadPreparedAesKey|LoadPreparedAesKey SMC]].


[5.0.0+] This now calls [[SMC#ReEncryptRsaPrivateKey|ReEncryptRsaPrivateKey SMC]] instead.
Takes an input u32 '''KeySlot''' and an input 16-byte '''AccessKey'''.


== UnwrapTitleKey ==
[2.0.0+] Verifies the keyslot was allocated in the current session.
Wrapper for [[SMC#UnwrapTitleKey|UnwrapTitleKey SMC]].


Takes one type-10 (C descriptor) buffer ('''data_out_buf''') and 3 type-9 (X descriptor) buffers ('''data_in_buf''', '''mod_in_buf''' and '''label_hash_in_buf''').
== PrepareCommonEsTitleKey ==
Wrapper for [[SMC#PrepareEsCommonKey|PrepareEsCommonKey SMC]].


[3.0.0+] Now takes an additional 4-bytes of input.
Takes an input 16-byte '''KeySource'''. Returns an output 16-byte '''AccessKey'''.


Decrypts '''data_in_buf''' into '''data_out_buf''' using the private key imported with [[#ImportEsKey]] and the supplied '''mod_in_buf'''. Afterwards, verifies RSA-OAEP encoding using '''label_hash_in_buf'''.
[3.0.0+] Now takes an input u32 '''Generation'''.


Returns an u32 ('''dec_data_size''').
== AllocateAesKeySlot ==
Returns an output u32 '''KeySlot'''.


== LoadTitleKey ==
Returns error 0xD01A if all keyslots are taken.
Wrapper for [[SMC#LoadTitleKey|LoadTitleKey SMC]].


Takes a u32 ('''keyslot''') and a 16-byte sealed titlekey.
== DeallocateAesKeySlot ==
Takes an input u32 '''KeySlot'''.


Sets the specified '''keyslot''' with the titlekey.
Returns error 0xD21A if the keyslot wasn't allocated by current session.


[2.0.0+] Verifies the keyslot was allocated in the current session.
== GetAesKeySlotAvailableEvent ==
Returns an output event handle for synchronizing with the AES keyslots.


== UnwrapCommonTitleKey ==
== SetBootReason ==
Wrapper for [[SMC#UnwrapCommonTitleKey|UnwrapCommonTitleKey SMC]].
Takes an input u32 '''BootReason'''.


Takes a 16-byte EKS ('''Encryption Key Source''').
[4.0.0+] Returns 0xD41A if a value has been previously set without being [[#GetBootReason|gotten]].


[3.0.0+] Now takes an additional 4-bytes of input.
== GetBootReason ==
Returns an output u32 '''BootReason'''.


Returns a sealed titlekey.
[4.0.0+] Returns 0xD61A if a value has not previously been set and unsets the value after getting it.


== AllocateAesKeyslot ==
= spl:mig =
Returns an allocated keyslot, or 0xD01A if all keyslots are taken. You need to allocate a keyslot before using AES functions.
This is "nn::spl::detail::ICryptoInterface".


== FreeAesKeyslot ==
{| class="wikitable" border="1"
Takes a single u32 and frees the keyslot. The keyslot must have been allocated by current session otherwise 0xD21A will be returned.
|-
! Cmd || Name
|-
| 0 || [[#GetConfig]]
|-
| 1 || [[#ModularExponentiate]]
|-
| 5 || [[#SetConfig]]
|-
| 7 || [[#GenerateRandomBytes]]
|-
| 11 || [[#IsDevelopment]]
|-
| 24 || [3.0.0+] [[#SetBootReason]]
|-
| 25 || [3.0.0+] [[#GetBootReason]]
|-
| 2 || [[#GenerateAesKek]]
|-
| 3 || [[#LoadAesKey]]
|-
| 4 || [[#GenerateAesKey]]
|-
| 14 || [[#DecryptAesKey]]
|-
| 15 || [[#ComputeCtr]]
|-
| 16 || [[#ComputeCmac]]
|-
| 21 || [2.0.0+] [[#AllocateAesKeySlot]]
|-
| 22 || [2.0.0+] [[#DeallocateAesKeySlot]]
|-
| 23 || [2.0.0+] [[#GetAesKeySlotAvailableEvent]]
|}


== GetAesKeyslotAvailableEvent ==
= spl:fs =
Returns an event handle for synchronizing with the AES keyslots.
This is "nn::spl::detail::IFsInterface".


== SetBootReason ==
{| class="wikitable" border="1"
Sets a static dword in spl .bss to the input u32 '''BootReason'''.
|-
! Cmd || Name
|-
| 0 || [[#GetConfig]]
|-
| 1 || [[#ModularExponentiate]]
|-
| 5 || [[#SetConfig]]
|-
| 7 || [[#GenerateRandomBytes]]
|-
| 11 || [[#IsDevelopment]]
|-
| 24 || [3.0.0+] [[#SetBootReason]]
|-
| 25 || [3.0.0+] [[#GetBootReason]]
|-
| 2 || [[#GenerateAesKek]]
|-
| 3 || [[#LoadAesKey]]
|-
| 4 || [[#GenerateAesKey]]
|-
| 14 || [[#DecryptAesKey]]
|-
| 15 || [[#ComputeCtr]]
|-
| 16 || [[#ComputeCmac]]
|-
| 21 || [2.0.0+] [[#AllocateAesKeySlot]]
|-
| 22 || [2.0.0+] [[#DeallocateAesKeySlot]]
|-
| 23 || [2.0.0+] [[#GetAesKeySlotAvailableEvent]]
|-
| 9 || [[#DecryptAndStoreGcKey]]
|-
| 10 || [[#DecryptGcMessage]]
|-
| 12 || [[#GenerateSpecificAesKey]]
|-
| 19 || [[#LoadPreparedAesKey]]
|-
| 31 || [5.0.0+] GetPackage2Hash
|}
 
= spl:ssl =
This is "nn::spl::detail::ISslInterface".
 
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#GetConfig]]
|-
| 1 || [[#ModularExponentiate]]
|-
| 5 || [[#SetConfig]]
|-
| 7 || [[#GenerateRandomBytes]]
|-
| 11 || [[#IsDevelopment]]
|-
| 24 || [3.0.0+] [[#SetBootReason]]
|-
| 25 || [3.0.0+] [[#GetBootReason]]
|-
| 2 || [[#GenerateAesKek]]
|-
| 3 || [[#LoadAesKey]]
|-
| 4 || [[#GenerateAesKey]]
|-
| 14 || [[#DecryptAesKey]]
|-
| 15 || [[#ComputeCtr]]
|-
| 16 || [[#ComputeCmac]]
|-
| 21 || [2.0.0+] [[#AllocateAesKeySlot]]
|-
| 22 || [2.0.0+] [[#DeallocateAesKeySlot]]
|-
| 23 || [2.0.0+] [[#GetAesKeySlotAvailableEvent]]
|-
| 13 || [[#DecryptDeviceUniqueData]]
|-
| 26 || [5.0.0+] DecryptAndStoreSslClientCertKey
|-
| 27 || [5.0.0+] ModularExponentiateWithSslClientCertKey
|}


[4.0.0+] returns 0xD41A if a value has been previously set without being [[#GetBootReason|gotten]].
= spl:es =
This is "nn::spl::detail::IEsInterface".


== GetBootReason ==
{| class="wikitable" border="1"
Returns the static dword '''BootReason''' in spl .bss that can be set via [[#SetBootReason]].
|-
! Cmd || Name
|-
| 0 || [[#GetConfig]]
|-
| 1 || [[#ModularExponentiate]]
|-
| 5 || [[#SetConfig]]
|-
| 7 || [[#GenerateRandomBytes]]
|-
| 11 || [[#IsDevelopment]]
|-
| 24 || [3.0.0+] [[#SetBootReason]]
|-
| 25 || [3.0.0+] [[#GetBootReason]]
|-
| 2 || [[#GenerateAesKek]]
|-
| 3 || [[#LoadAesKey]]
|-
| 4 || [[#GenerateAesKey]]
|-
| 14 || [[#DecryptAesKey]]
|-
| 15 || [[#ComputeCtr]]
|-
| 16 || [[#ComputeCmac]]
|-
| 21 || [2.0.0+] [[#AllocateAesKeySlot]]
|-
| 22 || [2.0.0+] [[#DeallocateAesKeySlot]]
|-
| 23 || [2.0.0+] [[#GetAesKeySlotAvailableEvent]]
|-
| 13 || [[#DecryptDeviceUniqueData]]
|-
| 17 || [[#LoadEsDeviceKey]]
|-
| 18 || [[#PrepareEsTitleKey]]
|-
| 20 || [2.0.0+] [[#PrepareCommonEsTitleKey]]
|-
| 28 || [5.0.0+] DecryptAndStoreDrmDeviceCertKey
|-
| 29 || [5.0.0+] ModularExponentiateWithDrmDeviceCertKey
|-
| 31 || [6.0.0+] PrepareEsArchiveKey
|-
| 32 || [6.0.0+] [[#LoadPreparedAesKey]]
|-
| 33 || [18.0.0+]
|}


[4.0.0+] returns 0xD61A if a value has not previously been set, and unsets the value after getting it.
= spl:manu =
This is "nn::spl::detail::IManuInterface".


== LoadElicenseKey ==
{| class="wikitable" border="1"
Same as [[#LoadTitleKey|LoadTitleKey]].
|-
! Cmd || Name
|-
| 0 || [[#GetConfig]]
|-
| 1 || [[#ModularExponentiate]]
|-
| 5 || [[#SetConfig]]
|-
| 7 || [[#GenerateRandomBytes]]
|-
| 11 || [[#IsDevelopment]]
|-
| 24 || [3.0.0+] [[#SetBootReason]]
|-
| 25 || [3.0.0+] [[#GetBootReason]]
|-
| 2 || [[#GenerateAesKek]]
|-
| 3 || [[#LoadAesKey]]
|-
| 4 || [[#GenerateAesKey]]
|-
| 14 || [[#DecryptAesKey]]
|-
| 15 || [[#ComputeCtr]]
|-
| 16 || [[#ComputeCmac]]
|-
| 21 || [2.0.0+] [[#AllocateAesKeySlot]]
|-
| 22 || [2.0.0+] [[#DeallocateAesKeySlot]]
|-
| 23 || [2.0.0+] [[#GetAesKeySlotAvailableEvent]]
|-
| 13 || [[#DecryptDeviceUniqueData]]
|-
| 30 || [5.0.0+] ReencryptDeviceUniqueData
|}


[[Category:Services]]
[[Category:Services]]
Retrieved from "https://switchbrew.org/wiki/SPL_services"