Nintendo Switch Brew

SPL services: Difference between revisions

← Older edit
No edit summary
→(S2) spl:ldn: Moved to the ldn page.
 
(9 intermediate revisions by 3 users not shown)
Line 4: Line 4:


In [2.0.0+] where previously only one AES keyslot was used, there is now support for 4 of them and when the session closes, all allocated AES keyslots are automatically freed.
In [2.0.0+] where previously only one AES keyslot was used, there is now support for 4 of them and when the session closes, all allocated AES keyslots are automatically freed.
[S2] The spl services were overhauled. New services were added, this appears to replace spl:mig where required for the relevant sysmodules. GenerateAesKek is no longer directly exposed, thus the Kek AccessKey and KeySource are no longer exposed.


= csrng =
= csrng =
Line 16: Line 18:


== GenerateRandomBytes ==
== GenerateRandomBytes ==
Takes an output type-0xA buffer and fills it with random data from [[SMC#GetRandomBytes|GetRandomBytes SMC]]. Same command for "spl:" and "csrng" services, except for buffer-type.
Takes an output type-0xA buffer and fills it with random data from [[SMC#GenerateRandomBytes|GenerateRandomBytes SMC]]. Same command for "spl:" and "csrng" services, except for buffer-type.


= spl: =
= spl: =
Line 27: Line 29:
| 0 || [[#GetConfig]]
| 0 || [[#GetConfig]]
|-
|-
| 1 || [[#ExpMod]]
| 1 || [[#ModularExponentiate]]
|-
|-
| 5 || [[#SetConfig]]
| 5 || [[#SetConfig]]
Line 39: Line 41:
| 25 || [3.0.0+] [[#GetBootReason]]
| 25 || [3.0.0+] [[#GetBootReason]]
|}
|}
Going by spl:ldn, this likely has a new interface on [S2]:
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#GenerateRandomBytes|GenerateRandomBytes]]
|-
| 1 || [[#GetConfig|GetConfig]]
|-
| 2 ||
|-
| 3 ||
|-
| 4 ||
|-
| 5 || [[#GetConfigWithBuffer|GetConfigWithBuffer]]
|}
== GetConfig ==
Wrapper for [[SMC#GetConfig|GetConfig SMC]].
Takes an input u32 '''ConfigItem'''. Returns one or more output u64s '''ConfigValue'''.
== ModularExponentiate ==
Wrapper for [[SMC#ModularExponentiate|ModularExponentiate SMC]].
Takes an output type-0xA buffer '''DataOut''' and 3 input type-0x9 buffers '''DataIn''', '''ExpIn''' and '''ModIn'''.
Performs asymmetric crypto with user supplied modulus and exponent.
== Cmd2 ==
This is for the [S2] interface.
Takes no input, returns 0x10-bytes of output.
This returns the first 0xD-bytes from [[#GetConfigWithBuffer|GetConfigWithBuffer]] ConfigItem 8, byteswapped.
== Cmd3 ==
This is for the [S2] interface.
Takes no input. Returns unknown output, usually zeros?
== Cmd4 ==
This is for the [S2] interface.
Takes no input. Returns unknown output, usually zeros?
== GetConfigWithBuffer ==
Unofficial name.
Some config is incomplete when accessed with [[#GetConfig|GetConfig]], this allows returning the full config.
Takes an input u32 '''ConfigItem''' and an output type-0xA buffer.
== GenerateAesKek ==
Wrapper for [[SMC#GenerateAesKek|GenerateAesKek SMC]].
Takes an input 16-byte '''KeySource''' and two input u32s '''Generation''' and '''Option'''. Returns an output 16-byte '''AccessKey'''.
== LoadAesKey ==
Wrapper for [[SMC#LoadAesKey|LoadAesKey SMC]].
Takes an input u32 '''KeySlot''' , an input 16-byte '''AccessKey''' and an input 16-byte '''KeySource'''.
Sets the specified '''KeySlot''' with a key generated from '''AccessKey''' and '''KeySource'''.
[2.0.0+] Now verifies that the keyslot in use (0..3) is allocated by the current spl session, otherwise errors with 0xD21A. Previously, keyslot was hardcoded to 0.
== GenerateAesKey ==
Takes an input 16-byte '''AccessKey''' and an input 16-byte '''KeySource'''. Returns an output 16-byte '''AesKey'''.
Generates a new key by decrypting (AES-ECB) '''KeySource''' with a key generated from the supplied '''AccessKey''' and the key set with [[SMC#LoadAesKey|LoadAesKey SMC]].
[2.0.0+] Previously, it always used keyslot 0. Now it tries to allocate a keyslot to be used and returns 0xD01A if they're all busy. When the command is done, the keyslot is released.
== SetConfig ==
Wrapper for [[SMC#SetConfig|SetConfig SMC]].
Takes an input u32 '''ConfigItem''' and an input u64 '''ConfigValue'''.
Only '''ConfigItem''' 13 (IsChargerHiZModeEnabled) can be set.
== DecryptAndStoreGcKey ==
Wrapper for [[SMC#DecryptAndImportLotusKey|DecryptAndImportLotusKey SMC]].
Takes an input type-0x9 buffer '''DataIn''', an input 16-byte '''AccessKey''', an input 16-byte '''KeySource''' and an input u32 '''Version''' (0 for normal keys or 1 for extended keys).
Decrypts '''DataIn''' with a key generated from '''AccessKey''' and '''KeySource''' and imports it for later usage.
[5.0.0+] The '''Version''' argument was removed and this now calls the [[SMC#ReencryptDeviceUniqueData|ReencryptDeviceUniqueData SMC]] instead.
== DecryptGcMessage ==
Takes 3 input type-0x9 buffers '''DataIn''', '''ModIn''' and '''LabelHashIn'''.
Uses the [[SMC#ModularExponentiateByStorageKey|ModularExponentiateByStorageKey SMC]] to decrypt '''DataIn''' using the private key imported with [[#DecryptAndStoreGcKey]] and the supplied '''ModIn''' and '''LabelHashIn'''.
== IsDevelopment ==
No input. Returns an output u8 bool.
Uses [[#GetConfig]] internally.
== GenerateSpecificAesKey ==
Wrapper for [[SMC#GenerateSpecificAesKey|GenerateSpecificAesKey SMC]].
Takes an input 16-byte '''KeySource''' and two input u32s '''Generation''' and '''Option'''. Returns an output 16-byte '''AesKey'''.
== DecryptDeviceUniqueData ==
Wrapper for [[SMC#DecryptDeviceUniqueData|DecryptDeviceUniqueData SMC]].
Takes an output type-0xA buffer '''DataOut''', an input type-0x9 '''DataIn''', an input 16-byte '''AccessKey''', an input 16-byte '''KeySource''' and an input u32 '''Version''' (0 for normal keys or 1 for extended keys).
Decrypts '''DataIn''' into '''DataOut''' with a key generated from '''AccessKey''' and '''KeySource'''.
Used by [[SSL_services|SSL]] for TLS client-privk.
[5.0.0+] The '''Version''' argument was removed.
== DecryptAesKey ==
Takes an input 16-byte '''KeySource''' and two input u32s '''Generation''' and '''Option'''. Returns an output 16-byte '''AesKey'''.
Decrypts (AES-ECB) '''KeySource''' with a key set with [[SMC#LoadAesKey|LoadAesKey SMC]].
[2.0.0+] Introduced same keyslot allocation code as for [[#GenerateAesKey]].
== ComputeCtr ==
Takes an output type-0x46 buffer '''DataOut''', an input u32 '''KeySlot''', an input type-0x45 buffer '''DataIn''' and an input 16-byte '''IvCtr'''.
Uses [[SMC#ComputeAes|ComputeAes SMC]] to decrypt '''DataIn''' into '''DataOut''' using the key set in the specified '''KeySlot'''.
[2.0.0+] Verifies the keyslot was allocated by the current session.
== ComputeCmac ==
Wrapper for [[SMC#ComputeCmac|ComputeCmac SMC]].
Takes an input type-0x9 buffer '''DataIn''' and an input u32 '''KeySlot'''. Returns an output 16-byte '''Cmac'''.
[2.0.0+] Verifies the keyslot was allocated by the current session.
== LoadEsDeviceKey ==
Wrapper for [[SMC#DecryptAndImportEsDeviceKey|DecryptAndImportEsDeviceKey SMC]].
Takes an input type-0x9 buffer '''DataIn''', an input 16-byte '''AccessKey''', an input 16-byte '''KeySource''' and an input u32 '''Version''' (0 for normal keys or 1 for extended keys).
Decrypts '''DataIn''' with a key generated from '''AccessKey''' and '''KeySource''' and imports it for later usage.
[5.0.0+] The '''Version''' argument was removed and this now calls the [[SMC#ReencryptDeviceUniqueData|ReencryptDeviceUniqueData SMC]] instead.
== PrepareEsTitleKey ==
Wrapper for [[SMC#PrepareEsDeviceUniqueKey|PrepareEsDeviceUniqueKey SMC]].
Takes an output type-0xA buffer '''DataOut''' and 3 input type-0x9 buffers '''DataIn''', '''ModIn''' and '''LabelHashIn'''. Returns an output u32 '''DataOutSize'''.
[3.0.0+] Now takes an input u32 '''Generation'''.
Decrypts '''DataIn''' into '''DataOut''' using the private key imported with [[#LoadEsDeviceKey]] and the supplied '''ModIn'''. Afterwards, verifies RSA-OAEP encoding using '''LabelHashIn'''.
== LoadPreparedAesKey ==
Wrapper for [[SMC#LoadPreparedAesKey|LoadPreparedAesKey SMC]].
Takes an input u32 '''KeySlot''' and an input 16-byte '''AccessKey'''.
[2.0.0+] Verifies the keyslot was allocated in the current session.
== PrepareCommonEsTitleKey ==
Wrapper for [[SMC#PrepareEsCommonKey|PrepareEsCommonKey SMC]].
Takes an input 16-byte '''KeySource'''. Returns an output 16-byte '''AccessKey'''.
[3.0.0+] Now takes an input u32 '''Generation'''.
== AllocateAesKeySlot ==
Returns an output u32 '''KeySlot'''.
Returns error 0xD01A if all keyslots are taken.
== DeallocateAesKeySlot ==
Takes an input u32 '''KeySlot'''.
Returns error 0xD21A if the keyslot wasn't allocated by current session.
== GetAesKeySlotAvailableEvent ==
Returns an output event handle for synchronizing with the AES keyslots.
== SetBootReason ==
Takes an input u32 '''BootReason'''.
[4.0.0+] Returns 0xD41A if a value has been previously set without being [[#GetBootReason|gotten]].
== GetBootReason ==
Returns an output u32 '''BootReason'''.
[4.0.0+] Returns 0xD61A if a value has not previously been set and unsets the value after getting it.


= spl:mig =
= spl:mig =
Line 49: Line 245:
| 0 || [[#GetConfig]]
| 0 || [[#GetConfig]]
|-
|-
| 1 || [[#ExpMod]]
| 1 || [[#ModularExponentiate]]
|-
|-
| 5 || [[#SetConfig]]
| 5 || [[#SetConfig]]
Line 69: Line 265:
| 14 || [[#DecryptAesKey]]
| 14 || [[#DecryptAesKey]]
|-
|-
| 15 || [[#CryptAesCtr]]
| 15 || [[#ComputeCtr]]
|-
|-
| 16 || [[#ComputeCmac]]
| 16 || [[#ComputeCmac]]
|-
|-
| 21 || [2.0.0+] [[#AllocateAesKeyslot]]
| 21 || [2.0.0+] [[#AllocateAesKeySlot]]
|-
|-
| 22 || [2.0.0+] [[#FreeAesKeyslot]]
| 22 || [2.0.0+] [[#DeallocateAesKeySlot]]
|-
|-
| 23 || [2.0.0+] [[#GetAesKeyslotAvailableEvent]]
| 23 || [2.0.0+] [[#GetAesKeySlotAvailableEvent]]
|}
|}


Line 89: Line 285:
| 0 || [[#GetConfig]]
| 0 || [[#GetConfig]]
|-
|-
| 1 || [[#ExpMod]]
| 1 || [[#ModularExponentiate]]
|-
|-
| 5 || [[#SetConfig]]
| 5 || [[#SetConfig]]
Line 109: Line 305:
| 14 || [[#DecryptAesKey]]
| 14 || [[#DecryptAesKey]]
|-
|-
| 15 || [[#CryptAesCtr]]
| 15 || [[#ComputeCtr]]
|-
|-
| 16 || [[#ComputeCmac]]
| 16 || [[#ComputeCmac]]
|-
|-
| 21 || [2.0.0+] [[#AllocateAesKeyslot]]
| 21 || [2.0.0+] [[#AllocateAesKeySlot]]
|-
|-
| 22 || [2.0.0+] [[#FreeAesKeyslot]]
| 22 || [2.0.0+] [[#DeallocateAesKeySlot]]
|-
|-
| 23 || [2.0.0+] [[#GetAesKeyslotAvailableEvent]]
| 23 || [2.0.0+] [[#GetAesKeySlotAvailableEvent]]
|-
|-
| 9 || [[#ImportLotusKey]]
| 9 || [[#DecryptAndStoreGcKey]]
|-
|-
| 10 || [[#DecryptLotusMessage]]
| 10 || [[#DecryptGcMessage]]
|-
|-
| 12 || [[#GenerateSpecificAesKey]]
| 12 || [[#GenerateSpecificAesKey]]
|-
|-
| 19 || [[#LoadTitleKey]]
| 19 || [[#LoadPreparedAesKey]]
|-
|-
| 31 || [5.0.0+] GetPackage2Hash
| 31 || [5.0.0+] GetPackage2Hash
Line 139: Line 335:
| 0 || [[#GetConfig]]
| 0 || [[#GetConfig]]
|-
|-
| 1 || [[#ExpMod]]
| 1 || [[#ModularExponentiate]]
|-
|-
| 5 || [[#SetConfig]]
| 5 || [[#SetConfig]]
Line 159: Line 355:
| 14 || [[#DecryptAesKey]]
| 14 || [[#DecryptAesKey]]
|-
|-
| 15 || [[#CryptAesCtr]]
| 15 || [[#ComputeCtr]]
|-
|-
| 16 || [[#ComputeCmac]]
| 16 || [[#ComputeCmac]]
|-
|-
| 21 || [2.0.0+] [[#AllocateAesKeyslot]]
| 21 || [2.0.0+] [[#AllocateAesKeySlot]]
|-
|-
| 22 || [2.0.0+] [[#FreeAesKeyslot]]
| 22 || [2.0.0+] [[#DeallocateAesKeySlot]]
|-
|-
| 23 || [2.0.0+] [[#GetAesKeyslotAvailableEvent]]
| 23 || [2.0.0+] [[#GetAesKeySlotAvailableEvent]]
|-
|-
| 13 || [[#DecryptRsaPrivateKey]]
| 13 || [[#DecryptDeviceUniqueData]]
|-
|-
| 26 || [5.0.0+] ImportSslKey
| 26 || [5.0.0+] DecryptAndStoreSslClientCertKey
|-
|-
| 27 || [5.0.0+] SslExpMod
| 27 || [5.0.0+] ModularExponentiateWithSslClientCertKey
|}
|}


Line 185: Line 381:
| 0 || [[#GetConfig]]
| 0 || [[#GetConfig]]
|-
|-
| 1 || [[#ExpMod]]
| 1 || [[#ModularExponentiate]]
|-
|-
| 5 || [[#SetConfig]]
| 5 || [[#SetConfig]]
Line 205: Line 401:
| 14 || [[#DecryptAesKey]]
| 14 || [[#DecryptAesKey]]
|-
|-
| 15 || [[#CryptAesCtr]]
| 15 || [[#ComputeCtr]]
|-
|-
| 16 || [[#ComputeCmac]]
| 16 || [[#ComputeCmac]]
|-
|-
| 21 || [2.0.0+] [[#AllocateAesKeyslot]]
| 21 || [2.0.0+] [[#AllocateAesKeySlot]]
|-
| 22 || [2.0.0+] [[#DeallocateAesKeySlot]]
|-
|-
| 22 || [2.0.0+] [[#FreeAesKeyslot]]
| 23 || [2.0.0+] [[#GetAesKeySlotAvailableEvent]]
|-
|-
| 23 || [2.0.0+] [[#GetAesKeyslotAvailableEvent]]
| 13 || [[#DecryptDeviceUniqueData]]
|-
|-
| 13 || [[#DecryptRsaPrivateKey]]
| 17 || [[#LoadEsDeviceKey]]
|-
|-
| 17 || [[#ImportEsKey]]
| 18 || [[#PrepareEsTitleKey]]
|-
|-
| 18 || [[#UnwrapTitleKey]]
| 20 || [2.0.0+] [[#PrepareCommonEsTitleKey]]
|-
|-
| 20 || [2.0.0+] [[#UnwrapCommonTitleKey]]
| 28 || [5.0.0+] DecryptAndStoreDrmDeviceCertKey
|-
|-
| 28 || [5.0.0+] ImportDrmKey
| 29 || [5.0.0+] ModularExponentiateWithDrmDeviceCertKey
|-
|-
| 29 || [5.0.0+] DrmExpMod
| 31 || [6.0.0+] PrepareEsArchiveKey
|-
|-
| 31 || [6.0.0+] UnwrapElicenseKey
| 32 || [6.0.0+] [[#LoadPreparedAesKey]]
|-
|-
| 32 || [6.0.0+] [[#LoadElicenseKey]]
| 33 || [18.0.0+]  
|}
|}


Line 241: Line 439:
| 0 || [[#GetConfig]]
| 0 || [[#GetConfig]]
|-
|-
| 1 || [[#ExpMod]]
| 1 || [[#ModularExponentiate]]
|-
|-
| 5 || [[#SetConfig]]
| 5 || [[#SetConfig]]
Line 261: Line 459:
| 14 || [[#DecryptAesKey]]
| 14 || [[#DecryptAesKey]]
|-
|-
| 15 || [[#CryptAesCtr]]
| 15 || [[#ComputeCtr]]
|-
|-
| 16 || [[#ComputeCmac]]
| 16 || [[#ComputeCmac]]
|-
|-
| 21 || [2.0.0+] [[#AllocateAesKeyslot]]
| 21 || [2.0.0+] [[#AllocateAesKeySlot]]
|-
|-
| 22 || [2.0.0+] [[#FreeAesKeyslot]]
| 22 || [2.0.0+] [[#DeallocateAesKeySlot]]
|-
|-
| 23 || [2.0.0+] [[#GetAesKeyslotAvailableEvent]]
| 23 || [2.0.0+] [[#GetAesKeySlotAvailableEvent]]
|-
|-
| 13 || [[#DecryptRsaPrivateKey]]
| 13 || [[#DecryptDeviceUniqueData]]
|-
|-
| 30 || [5.0.0+] ReEncryptRsaPrivateKey
| 30 || [5.0.0+] ReencryptDeviceUniqueData
|}
|}


== GetConfig ==
= (S2) spl:da =
Wrapper for [[SMC#GetConfig|GetConfig SMC]].


Takes an input u32 '''ConfigItem'''. Returns one or more output u64s '''ConfigValue'''.
= (S2) spl:gc =


== ExpMod ==
= (S2) spl:nv =
Wrapper for [[SMC#ExpMod|ExpMod SMC]].


Takes an output type-0xA buffer '''DataOut''' and 3 input type-0x9 buffers '''DataIn''', '''ExpIn''' and '''ModIn'''.
= (S2) spl:hid =


Performs asymmetric crypto with user supplied modulus and exponent.
= (S2) spl:ldn =
This is "nn::spl::detail::ILdnInterface".


== GenerateAesKek ==
This has IPC max_sessions 1?
Wrapper for [[SMC#GenerateAesKek|GenerateAesKek SMC]].


Takes an input 16-byte '''KeySource''' and two input u32s '''Generation''' and '''Option'''. Returns an output 16-byte '''AccessKey'''.
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#GenerateRandomBytes|GenerateRandomBytes]]
|-
| 1 || [[#GetConfig|GetConfig]]
|-
| 2 ||
|-
| 3 ||
|-
| 4 ||
|-
| 5 || [[#GetConfigWithBuffer|GetConfigWithBuffer]]
|-
| 7000 || [[#GenerateNxAdvertiseKey|GenerateNxAdvertiseKey]]
|-
| 7001 || [[#GenerateNxSessionKey|GenerateNxSessionKey]]
|-
| 7002 || [[#GenerateNxLp2pKeyIndex1|GenerateNxLp2pKeyIndex1]]
|-
| 7003 || [[#GenerateNxLp2pKeyIndex2|GenerateNxLp2pKeyIndex2]]
|-
| 7004 || [[#GenerateOunceAdvertiseKey|GenerateOunceAdvertiseKey]]
|-
| 7005 || [[#GenerateOunceSessionKey|GenerateOunceSessionKey]]
|}


== LoadAesKey ==
The below 7000+ cmds take a KeySource (equivalent to NX-GenerateAesKey) and an u32. Bitmask 0x1F of the u32 is the Generation, 0x20 is valid but doesn't seem to do anything. Values >=0x21 throw error. A 0x10-byte outbuf is used for the output key. Cmd7004/Cmd7005 use a 0x20-byte outbuf. These are equivalent to GenerateAesKek+GenerateAesKey combined.
Wrapper for [[SMC#LoadAesKey|LoadAesKey SMC]].


Takes an input u32 '''Keyslot''' , an input 16-byte '''AccessKey''' and an input 16-byte '''KeySource'''.
With Nx commands, valid key generations match what's expected for S1. With Ounce commands, the valid key generations on 20.x are 0/1.


Sets the specified '''Keyslot''' with a key generated from '''AccessKey''' and '''KeySource'''.
All of these use AES-ECB with the input KeySource, with the buffer as the output.


[2.0.0+] Now verifies that the keyslot in use (0..3) is allocated by the current spl session, otherwise errors with 0xD21A. Previously, keyslot was hardcoded to 0.
== GenerateNxAdvertiseKey ==
Unofficial name.


== GenerateAesKey ==
Takes an input 16-byte '''KeySource''', an input u32, and an output type-0xA buffer '''AesKey'''.
Takes an input 16-byte '''AccessKey''' and an input 16-byte '''KeySource'''. Returns an output 16-byte '''AesKey'''.


Generates a new key by decrypting (AES-ECB) '''KeySource''' with a key generated from the supplied '''AccessKey''' and the key set with [[SMC#LoadAesKey|LoadAesKey SMC]].
Generates a key using the NX-equivalent of the ldn Kek-action_keysource.  


[2.0.0+] Previously, it always used keyslot 0. Now it tries to allocate a keyslot to be used and returns 0xD01A if they're all busy. When the command is done, the keyslot is released.
== GenerateNxSessionKey ==
Unofficial name.


== SetConfig ==
Takes an input 16-byte '''KeySource''', an input u32, and an output type-0xA buffer '''AesKey'''.
Wrapper for [[SMC#SetConfig|SetConfig SMC]].


Takes an input u32 '''ConfigItem''' and an input u64 '''ConfigValue'''.
Generates a key using the NX-equivalent of the ldn Kek-data_keysource.


Only '''ConfigItem''' 13 (IsChargerHiZModeEnabled) can be set.
== GenerateNxLp2pKeyIndex1 ==
Unofficial name.


== ImportLotusKey ==
Takes an input 16-byte '''KeySource''', an input u32, and an output type-0xA buffer '''AesKey'''.
Wrapper for [[SMC#ImportLotusKey|ImportLotusKey SMC]].


Takes an input type-0x9 buffer '''DataIn''', an input 16-byte '''AccessKey''', an input 16-byte '''KeySource''' and an input u32 '''Version''' (0 for normal keys or 1 for extended keys).
Generates a key using the NX-equivalent of the lp2p Kek-Index1.  


Decrypts '''DataIn''' with a key generated from '''AccessKey''' and '''KeySource''' and imports it for later usage.
== GenerateNxLp2pKeyIndex2 ==
Unofficial name.


[5.0.0+] The '''Version''' argument was removed and this now calls the [[SMC#ReEncryptRsaPrivateKey|ReEncryptRsaPrivateKey SMC]] instead.
Takes an input 16-byte '''KeySource''', an input u32, and an output type-0xA buffer '''AesKey'''.


== DecryptLotusMessage ==
Generates a key using the NX-equivalent of the lp2p Kek-Index2.
Takes 3 input type-0x9 buffers '''DataIn''', '''ModIn''' and '''LabelHashIn'''.


Uses the [[SMC#SecureExpMod|SecureExpMod SMC]] to decrypt '''DataIn''' using the private key imported with [[#ImportLotusKey]] and the supplied '''ModIn''' and '''LabelHashIn'''.
== GenerateOunceAdvertiseKey ==
Unofficial name.


== IsDevelopment ==
Takes an input 32-byte '''KeySource''', an input u32, and an output type-0xA buffer '''AesKey'''.
No input. Returns an output u8 bool.


Uses [[#GetConfig]] internally.
Ounce version of [[#GenerateNxAdvertiseKey|GenerateNxAdvertiseKey]].


== GenerateSpecificAesKey ==
== GenerateOunceSessionKey ==
Wrapper for [[SMC#GenerateSpecificAesKey|GenerateSpecificAesKey SMC]].
Unofficial name.


Takes an input 16-byte '''KeySource''' and two input u32s '''Generation''' and '''Option'''. Returns an output 16-byte '''AesKey'''.
Takes an input 32-byte '''KeySource''', an input u32, and an output type-0xA buffer '''AesKey'''.
 
== DecryptRsaPrivateKey ==
Wrapper for [[SMC#DecryptRsaPrivateKey|DecryptRsaPrivateKey SMC]].
 
Takes an output type-0xA buffer '''DataOut''', an input type-0x9 '''DataIn''', an input 16-byte '''AccessKey''', an input 16-byte '''KeySource''' and an input u32 '''Version''' (0 for normal keys or 1 for extended keys).
 
Decrypts '''DataIn''' into '''DataOut''' with a key generated from '''AccessKey''' and '''KeySource'''.
 
Used by [[SSL_services|SSL]] for TLS client-privk.
 
[5.0.0+] The '''Version''' argument was removed and this now calls [[SMC#DecryptOrImportRsaPrivateKey|DecryptOrImportRsaPrivateKey SMC]] instead.
 
== DecryptAesKey ==
Takes an input 16-byte '''KeySource''' and two input u32s '''Generation''' and '''Option'''. Returns an output 16-byte '''AesKey'''.
 
Decrypts (AES-ECB) '''KeySource''' with a key set with [[SMC#LoadAesKey|LoadAesKey SMC]].
 
[2.0.0+] Introduced same keyslot allocation code as for [[#GenerateAesKey]].
 
== CryptAesCtr ==
Takes an output type-0x46 buffer '''DataOut''', an input u32 '''Keyslot''', an input type-0x45 buffer '''DataIn''' and an input 16-byte '''IvCtr'''.
 
Uses [[SMC#ComputeAes|ComputeAes SMC]] to decrypt '''DataIn''' into '''DataOut''' using the key set in the specified '''Keyslot'''.
 
[2.0.0+] Verifies the keyslot was allocated by the current session.
 
== ComputeCmac ==
Wrapper for [[SMC#ComputeCmac|ComputeCmac SMC]].
 
Takes an input type-0x9 buffer '''DataIn''' and an input u32 '''Keyslot'''. Returns an output 16-byte '''Cmac'''.
 
[2.0.0+] Verifies the keyslot was allocated by the current session.
 
== ImportEsKey ==
Wrapper for [[SMC#ImportEsKey|ImportEsKey SMC]].
 
Takes an input type-0x9 buffer '''DataIn''', an input 16-byte '''AccessKey''', an input 16-byte '''KeySource''' and an input u32 '''Version''' (0 for normal keys or 1 for extended keys).
 
Decrypts '''DataIn''' with a key generated from '''AccessKey''' and '''KeySource''' and imports it for later usage.
 
[5.0.0+] The '''Version''' argument was removed and this now calls the [[SMC#ReEncryptRsaPrivateKey|ReEncryptRsaPrivateKey SMC]] instead.
 
== UnwrapTitleKey ==
Wrapper for [[SMC#UnwrapTitleKey|UnwrapTitleKey SMC]].
 
Takes an output type-0xA buffer '''DataOut''' and 3 input type-0x9 buffers '''DataIn''', '''ModIn''' and '''LabelHashIn'''. Returns an output u32 '''DataOutSize'''.
 
[3.0.0+] Now takes an input u32 '''Generation'''.
 
Decrypts '''DataIn''' into '''DataOut''' using the private key imported with [[#ImportEsKey]] and the supplied '''ModIn'''. Afterwards, verifies RSA-OAEP encoding using '''LabelHashIn'''.
 
== LoadTitleKey ==
Wrapper for [[SMC#LoadTitleKey|LoadTitleKey SMC]].
 
Takes an input u32 '''Keyslot''' and an input 16-byte '''AccessKey'''.
 
[2.0.0+] Verifies the keyslot was allocated in the current session.
 
== UnwrapCommonTitleKey ==
Wrapper for [[SMC#UnwrapCommonTitleKey|UnwrapCommonTitleKey SMC]].
 
Takes an input 16-byte '''KeySource'''. Returns an output 16-byte '''AccessKey'''.
 
[3.0.0+] Now takes an input u32 '''Generation'''.
 
== AllocateAesKeyslot ==
Returns an output u32 '''Keyslot'''.
 
Returns error 0xD01A if all keyslots are taken.
 
== FreeAesKeyslot ==
Takes an input u32 '''Keyslot'''.
 
Returns error 0xD21A if the keyslot wasn't allocated by current session.
 
== GetAesKeyslotAvailableEvent ==
Returns an output event handle for synchronizing with the AES keyslots.
 
== SetBootReason ==
Takes an input u32 '''BootReason'''.
 
[4.0.0+] Returns 0xD41A if a value has been previously set without being [[#GetBootReason|gotten]].
 
== GetBootReason ==
Returns an output u32 '''BootReason'''.
 
[4.0.0+] Returns 0xD61A if a value has not previously been set and unsets the value after getting it.


== LoadElicenseKey ==
Ounce version of [[#GenerateNxSessionKey|GenerateNxSessionKey]].
Same as [[#LoadTitleKey|LoadTitleKey]].


[[Category:Services]]
[[Category:Services]]
Retrieved from "https://switchbrew.org/wiki/SPL_services"