Nintendo Switch Brew

LDN services: Difference between revisions

← Older edit
No edit summary
 
(46 intermediate revisions by the same user not shown)
Line 1: Line 1:
LDN handles all local network communication.
LDN handles all local network communication.
There's 2 IPC handler threads for all ldn:* services.


= ldn:m =
= ldn:m =
This is "nn::ldn::detail::IMonitorServiceCreator".
This is "nn::ldn::detail::IMonitorServiceCreator".
This has IPC max_sessions 5.
[20.2.0+] This has max_sessions 6.


{| class="wikitable" border="1"
{| class="wikitable" border="1"
Line 41: Line 47:


=== GetState ===
=== GetState ===
No input, returns an output u32.
No input, returns an output [[#State|u32]].


sdknso implements this by <code>return</code>ing the u32, with 0 being returned on error.
sdknso implements this by <code>return</code>ing the u32, with 0 being returned on error.
Line 84: Line 90:
= ldn:s =
= ldn:s =
This is "nn::ldn::detail::ISystemServiceCreator".
This is "nn::ldn::detail::ISystemServiceCreator".
This has IPC max_sessions 5.
[18.0.0+] The sdknso uses SessionManager with this, where the additional session-count is 0x3.


{| class="wikitable" border="1"
{| class="wikitable" border="1"
Line 97: Line 107:
No input. Returns an [[#ISystemLocalCommunicationService]].
No input. Returns an [[#ISystemLocalCommunicationService]].


The user-process closes the ISystemServiceCreator object immediately after using this cmd. Official sw ignores errors from this cmd.
The user-process closes the ISystemServiceCreator object once finished with it during initialization. Official sw ignores errors from this cmd.


== CreateClientProcessMonitor ==
== CreateClientProcessMonitor ==
Line 197: Line 207:
=== GetNetworkInfo ===
=== GetNetworkInfo ===
Takes a type-0x1A output buffer containing a [[#NetworkInfo]].
Takes a type-0x1A output buffer containing a [[#NetworkInfo]].
[[#GetState|State]] must be 3 or 5.


=== GetIpv4Address ===
=== GetIpv4Address ===
Line 234: Line 246:


The array count must be at least 1. This is clamped to a maximum of 0x18.
The array count must be at least 1. This is clamped to a maximum of 0x18.
[18.0.0+] This now uses the same SecurityMode override as [[#CreateNetwork|CreateNetwork]].


=== ScanPrivate ===
=== ScanPrivate ===
Line 243: Line 253:


See [[#Scan]].
See [[#Scan]].
[18.0.0+] This now uses the same SecurityMode override as [[#CreateNetwork|CreateNetwork]].


=== SetWirelessControllerPolicy ===
=== SetWirelessControllerPolicy ===
Line 257: Line 265:


=== SetProtocol ===
=== SetProtocol ===
Takes an input u32, no output.
Takes an input [[#Protocol|u32]], no output.


This cmd was implemented with [20.0.0+], prior to that this just returned an error.
This cmd was implemented with [20.0.0+], prior to that this just returned an error.


The sdk user-process func will pass value 1 to the cmd when the input [[#Protocol|Protocol]] is 0/1, 3 is passed directly if specified, otherwise Abort. User-processes use SetProtocol immediately after initializing ldn.
The sdk user-process func will pass value 1 to the cmd when the input [[#Protocol|Protocol]] is 0/1, 3 is passed directly if specified, otherwise Abort. User-processes use SetProtocol immediately after initializing ldn.
[20.0.0+] The ldn initialization functionality in sdknso also uses this with value 1 (NX) eventually after the init cmd was used successfully.


The input is validated, then a vfunc is called.
The input is validated, then a vfunc is called.


The cmd_input must be non-zero. BIT(cmd_input) must be set in a state-field, otherwise a separate Result is returned.
The cmd_input must be non-zero. BIT(cmd_input) must be set in a state-field, otherwise a separate Result is returned. This is a permission [[#Protocol|bitmask]] which originates from the ldn:* service object being used.
 
The above state field originates from a ldn:u/ldn:s state field, which on NX is always set to 0xA. Therefore, on NX the above bit check only allows value 1 or 3.


The vfunc sends a message to another thread with the input u32 as the param, and returns the response from that.
The vfunc sends a message to another thread with the input u32 as the param, and returns the response from that.


The thread msg-queue-handler (besides other validation) uses the input param to select what values to write to state fields. Only input value 1 or 3 is allowed, with an error being thrown otherwise. The previously mentioned validation includes verifying that [[#GetState|State]] is Initialized.
The thread msg-queue-handler (besides other validation) uses the input param to select what values to write to state fields. On NX only input value 1 or 3 is allowed, with an error being thrown otherwise. The previously mentioned validation includes verifying that [[#GetState|State]] is Initialized.


=== OpenAccessPoint ===
=== OpenAccessPoint ===
Line 375: Line 383:
This is used immediately after object creation.
This is used immediately after object creation.


With [7.0.0+] [[#InitializeWithVersion|InitializeWithVersion]] is used instead. The cmd impl for Initialize uses [[#InitializeWithVersion|InitializeWithVersion]] with input_u32=0.
On old sysvers the cmd impl for User/System are identical, except different params are used for the funcs called internally.
 
With [7.0.0+] [[#InitializeWithVersion|InitializeWithVersion]] is used instead. The cmd impl for Initialize uses [[#InitializeWithVersion|InitializeWithVersion]] with version=0.


=== Finalize ===
=== Finalize ===
Line 394: Line 404:


=== InitializeWithVersion ===
=== InitializeWithVersion ===
Takes an input PID, an u32, and an u64 pid_placeholder.
Takes an input PID, a s32 version, and an u64 pid_placeholder.
 
The priority is determined by whether the interface is User/System: System = 0x38, User = 0x5A.
 
It then calls the init func, with the cmd input params and the above priority, returning the Result on failure.
 
On newer sysvers this then adds an entry for the state array used by [[#RegisterClient|RegisterClient]].
 
Lastly the input PID and version are written into state, then this returns.


Official sw uses hard-coded value 0x1 for the u32.
The init func does the following:
* The PID must be non-zero, and the version must not be negative. The priority must be 0x5A or 0x38.
* An error is returned if state fields are invalid.
* The input PID and version are written into state (a state field is also set to interface == User).
* Lastly, a vfunc is called with the input priority, returning the Result from that.


The input u32 is ignored, the impl for this cmd is identical to [[#Initialize_2|Initialize]].
The vfunc does the following:
* On newer sysvers, this uses [[Shared_Database_services|pl:s]] RequestApplicationFunctionAuthorizationByProcessId with the input PID and [[Shared_Database_services|ApplicationFunctionAuthorizationId]] = 2 (SecureLdnLocalCommunication), returning the Result on failure.
* Then a message is sent to a msg-queue with the input priority.


Internally this calls a func with params: (..., PID, &{u16 value 0x38}). On success, this then calls another func (which sets two state fields to the input) with params: (state, 0) (these state fields are used during [[#Authentication]] to check which service is being used).
The handler for the above message does the following:
* When state is already initialized, runs handling for that. An error is also thrown if the input priority is larger than a state field.
* Initializes state, etc.
* Various [[Network_Interface_services|nifm]] funcs are eventually used. The input priority is used to determine the value for [[Network_Interface_services#CreateRequest|nn::nifm::RequestParameters]]: value 0x4 or value 0x8 is used, depending on priority > 0x59.
** Newer versions also handle ldn lan_emulation [[System_Settings|sys-settings]] here. For the above value, when lan_emulation is enabled it uses value 0x17, with 0x18 additionally used for priority <= 0x59.
* The rest is state init, including setting [[#State|State]] to value 1. Then 0 is returned.


The first func uses various [[Network_Interface_services|nifm]] funcs. The input value is used to determine the value for [[Network_Interface_services#CreateRequest|nn::nifm::RequestParameters]]: essentially, value 0x4 is used for ldn:u, and value 0x8 is used for ldn:s. The input value is also copied into state.
On old sysvers the cmd impl for User/System are identical, except different params are used for the funcs called internally. With newer sysvers the cmd impl is now identical.


[[#GetState|State]] must be 0, this cmd eventually sets the State to value 1.
Version values passed by official sw:
 
{| class="wikitable" border="1"
|-
! Value || SystemVersion
|-
| 0x1 || [7.0.0+]
|-
| 0x2 || [18.0.0+]
|-
| 0x3 || [19.0.0+]
|-
| 0x4 || [20.0.0+]
|}


=== InitializeWithPriority ===
=== InitializeWithPriority ===
Takes an input PID, an u32, an u32, and an u64 pid_placeholder.
Takes an input PID, a s32 version, a s32 priority, and an u64 pid_placeholder.


This is similar to [[#InitializeWithVersion|InitializeWithVersion]], with the additional cmd input u32 now being passed directly to the init func which is called here.
This is similar to [[#InitializeWithVersion|InitializeWithVersion]]. The input priority is passed directly to the init func which is called here, instead of determining it from whether the interface is User/System.
 
Official sw passes input value 0x38 for the priority as the default, when the user doesn't specify the priority.


=== EnableActionFrame ===
=== EnableActionFrame ===
Line 424: Line 468:
Takes a type-0x21 input buffer, two input [[#MacAddress]], two input s16s ('''Band''' and '''ChannelNumber''') and an input [[#MessageFlagSet]]. No output.
Takes a type-0x21 input buffer, two input [[#MacAddress]], two input s16s ('''Band''' and '''ChannelNumber''') and an input [[#MessageFlagSet]]. No output.


[[#State|State]] must be 3-4 (AccessPointCreated/Station).
[20.0.0+] The input s16s were replaced with a single u16, which has the same format as [[#SetHomeChannel|SetHomeChannel]].
 
The first [[#MacAddress]] is the destination, the second [[#MacAddress]] is the Bssid.
 
The ChannelNumber must be non-zero.


On NX this sends a raw action frame with the input buffer as the data?
[[#State|State]] must be 3-5 (AccessPointCreated/Station/StationConnected).


=== RecvActionFrame ===
=== RecvActionFrame ===
Takes a type-0x22 output buffer and an input [[#MessageFlagSet]]. Returns an output u32 '''Size''', two output [[#MacAddress]], two output s16s ('''Band''' and '''ChannelNumber''') and an output s32 '''LinkLevel'''.
Takes a type-0x22 output buffer and an input [[#MessageFlagSet]]. Returns two output [[#MacAddress]], two output s16s ('''Band''' and '''ChannelNumber'''), an output u32 '''Size''', and an output s32 '''LinkLevel'''.
 
[20.0.0+] The output s16s were replaced with a single u16, which has the same format as [[#SetHomeChannel|SetHomeChannel]].


[[#EnableActionFrame|EnableActionFrame]] must be used prior to this.
[[#EnableActionFrame|EnableActionFrame]] must be used prior to this.
Line 439: Line 489:


On NX Band must be ([20.0.0+] converted Band from the above array) 50 ([20.0.0+] 5000) or 24 ([20.0.0+] 2400).
On NX Band must be ([20.0.0+] converted Band from the above array) 50 ([20.0.0+] 5000) or 24 ([20.0.0+] 2400).
The ChannelNumber must be non-zero.


The [[#State|State]] must be Station.
The [[#State|State]] must be Station.
Line 470: Line 522:
|}
|}


= ldn:u =
=== RegisterClient ===
Takes an input PID and an u64 pid_placeholder.
 
[18.0.0+] [[#CreateClientProcessMonitor|CreateClientProcessMonitor]] and RegisterClient are used by sdknso at the end of the ldn initialization functionality.
 
If the objptr in IClientProcessMonitor state is already set from using this cmd previously, this just returns 0.
 
This goes through global state to locate an entry with a matching PID, if none found 0 is returned. The objptr from the state entry is loaded, if NULL this returns 0. This obj is then incref'd and written into the IClientProcessMonitor state. When PID is 0, 0 is returned. It then locates the above state entry again with a matching PID, clearing the entry which matches. Lastly 0 is returned.
 
The initialization [[#InitializeWithPriority|cmds]] adds an entry to the above global state.
 
= ldn:u =
This is "nn::ldn::detail::IUserServiceCreator".
This is "nn::ldn::detail::IUserServiceCreator".
This has IPC max_sessions 3.
[18.0.0+] The sdknso uses SessionManager with this, where the additional session-count is 0x3.
[S2] There appears to be 2 ldn:u services, this appears to be for having separate [[#Protocol|Protocol]] permissions for NX and Ounce games. The Creator object has the same vtable for both of these. However the vtable for IUserLocalCommunicationService appears to be larger even with NX, which likely indicates there's new commands? There also appears to be 4 additional max-sessions allocated to ldn*, this is probably for one of these ldn:u services?


{| class="wikitable" border="1"
{| class="wikitable" border="1"
Line 485: Line 554:
Returns an [[#IUserLocalCommunicationService]].
Returns an [[#IUserLocalCommunicationService]].


The user-process closes the IUserServiceCreator object immediately after using this cmd. Official sw ignores errors from this cmd.
The user-process closes the IUserServiceCreator object once finished with it during initialization. Official sw ignores errors from this cmd.


== IUserLocalCommunicationService ==
== IUserLocalCommunicationService ==
This is "nn::ldn::detail::IUserLocalCommunicationService".
This is "nn::ldn::detail::IUserLocalCommunicationService".
This is identical to [[#ISystemLocalCommunicationService]], except for the System-only cmd(s), and [[#Initialize_3|Initialize]]/[[#InitializeWithVersion_2|InitializeWithVersion]] differ.


{| class="wikitable" border="1"
{| class="wikitable" border="1"
Line 552: Line 619:
| 304 || [[#Disconnect|Disconnect]]
| 304 || [[#Disconnect|Disconnect]]
|-
|-
| 400 || [[#Initialize_3|Initialize]]
| 400 || [[#Initialize_2|Initialize]]
|-
|-
| 401 || [[#Finalize_3|Finalize]]
| 401 || [[#Finalize_2|Finalize]]
|-
|-
| 402 || [7.0.0+] [[#InitializeWithVersion_2|InitializeWithVersion]]
| 402 || [7.0.0+] [[#InitializeWithVersion|InitializeWithVersion]]
|-
|-
| 403 || [19.0.0+] [[#InitializeWithPriority|InitializeWithPriority]]
| 403 || [19.0.0+] [[#SetOperationMode|SetOperationMode]]
|-
|-
| 500 || [18.0.0+] [[#EnableActionFrame|EnableActionFrame]]
| 500 || [18.0.0+] [[#EnableActionFrame|EnableActionFrame]]
Line 574: Line 641:
| 601 || [18.0.0+] [[#ResetTxPower|ResetTxPower]]
| 601 || [18.0.0+] [[#ResetTxPower|ResetTxPower]]
|}
|}
=== Initialize ===
Takes an input PID and an u64 pid_placeholder.
This is used immediately after object creation.
With [7.0.0+] [[#InitializeWithVersion_2|InitializeWithVersion]] is used instead.
This is identical to [[#Initialize_2|Initialize]] except different params are used for the funcs called internally.
=== Finalize ===
No input/output.
This is used during service exit, prior to closing the object. Official sw will Abort if this fails.
=== InitializeWithVersion ===
Takes an input PID, an u32, and an u64 pid_placeholder.
Official sw uses hard-coded value 0x1 for the u32.
The input u32 is ignored, the impl for this cmd is identical to [[#Initialize_3|Initialize]].
This is identical to [[#InitializeWithVersion|InitializeWithVersion]] except different params are used for the funcs called internally: the u16 value is 0x5A, and the value for the second func is 1.


= ndd =
= ndd =
Line 976: Line 1,020:
= NodeInfo =
= NodeInfo =
This is "nn::ldn::NodeInfo".
This is "nn::ldn::NodeInfo".
The first node in the nodes array is always the AccessPoint (NodeId 0x0). NodeId is the index of the node in the nodes array.


{| class="wikitable" border="1"
{| class="wikitable" border="1"
Line 1,031: Line 1,077:
| 0xC || 0x4 || Reserved
| 0xC || 0x4 || Reserved
|}
|}
* LocalCommunicationId: [[#CreateNetwork|CreateNetwork]], [[#CreateNetworkPrivate|CreateNetworkPrivate]], [[#Connect|Connect]], [[#ConnectPrivate|ConnectPrivate]] (also [[#ScanFilter|ScanFilter]] when enabled with the flag): When -1, this is overwritten with the first LocalCommunicationId from the user-process [[NACP]], if loading fails value 0 is written instead. Otherwise when not -1, if [[NACP]] loading is successful, this field must match one of the LocalCommunicationIds from there.
* SceneId: Arbitrary user data, this can be used for filtering with [[#ScanFilter|ScanFilter]] for example.


= SessionId =
= SessionId =
This is "nn::ldn::SessionId".
This is "nn::ldn::SessionId".
This is used to generate/overwrite the Ssid when needed.


{| class="wikitable" border="1"
{| class="wikitable" border="1"
Line 1,137: Line 1,188:
This is "nn::ldn::ScanFilter". This is a 0x60-byte struct with 8-byte alignment.
This is "nn::ldn::ScanFilter". This is a 0x60-byte struct with 8-byte alignment.


sdknso copies the input ScanFilter to a tmp struct on stack, which is then used with the cmd.
sdknso copies the input ScanFilter to a tmp struct on stack (with [[#ScanFilterFlag|Flag]] masking), which is then used with the cmd. sdknso only copies Bssid with [[#ScanPrivate|ScanPrivate]], with [[#Scan|Scan]] it also masks out the [[#ScanFilterFlag|Flag]] for Bssid.


{| class="wikitable" border="1"
{| class="wikitable" border="1"
Line 1,157: Line 1,208:
| 0x5C || 0x4 || [[#ScanFilterFlag|Flag]]
| 0x5C || 0x4 || [[#ScanFilterFlag|Flag]]
|}
|}
Each [[#ScanFilterFlag|Flag]] bit when set enables using the corresponding ScanFilter data. This is usually a compare with the ScanFilter data and the internal [[#NetworkInfo|NetworkInfo]] data.
* NetworkType: (ScanFilter_NetworkType & NetworkInfo_NetworkType) must be non-zero.
* Ssid: The length fields must match, then memcmp is used.
The filtering func also handles validating the Band/Channel, however these fields are internal only and are not exposed in the user ScanFilter.


= ScanFilterFlag =
= ScanFilterFlag =
Line 1,296: Line 1,354:
This is "nn::ldn::UserConfig". This is a 0x30-byte struct with 1-byte alignment.
This is "nn::ldn::UserConfig". This is a 0x30-byte struct with 1-byte alignment.


sdknso copies the input UserConfig to a tmp struct on stack, which is then used with the cmd.
An error is thrown if UserName+0x20 is non-zero.
 
sdknso copies the input UserConfig to a tmp struct on stack, which is then used with the cmd. Only the first 0x20-bytes are copied, with the rest cleared.


{| class="wikitable" border="1"
{| class="wikitable" border="1"
Line 1,304: Line 1,364:
! Description
! Description
|-
|-
| 0x0 || 0x21 || UserName (NUL-terminated string for the user nickname)
| 0x0 || 0x21 || UserName (NUL-terminated string for the user name)
|-
|-
| 0x21 || 0xF || Reserved (cleared to zero during the copy)
| 0x21 || 0xF || Reserved
|}
|}


Line 1,404: Line 1,464:
|-
|-
| 1 || NX
| 1 || NX
|-
| 2 || [S2]
|-
|-
| 3 || (NXAndOunce?)
| 3 || (NXAndOunce?)
|-
| 4 || [S2]
|}
|}


The Initialize* cmds configure state the same as using [[#SetProtocol|SetProtocol]] with Protocol NX.
The Initialize* cmds configure state the same as using [[#SetProtocol|SetProtocol]] with Protocol NX.


There's presumably a S2-only value which enables using Ounce-only keys. Attempting to decrypt Ounce-only ldn with the Protocol3 keys fails (including with [[#Scan|Scan]]/[[#ScanPrivate|ScanPrivate]]), with the following (with S2 hosting):
There appears to be S2-only values which enables using Ounce-only keys. The following uses new Ounce-only keys (with S2 hosting):
* In-game ldn-usage for a S2-only Application.
* In-game ldn-usage for a S2-only Application.
* Local-game-update with a S2-only Application.
* Local-game-update with a S2-only Application.
* Local-game-update for a S1-game which has a Nintendo Switch 2 Edition available, even without the S2-Edition being installed.
* Local-game-update for a S1-game which has a Nintendo Switch 2 Edition available, even without the S2-Edition being installed.
There's system-titles which [[20.0.0|use]] SetProtocol. While there's game(s) which use SetProtocol, there's no known (?) games using Protocol3 (excluding GameShare which is system).
[S2] Protocol2 and Protocol4 appear to be identical to Protocol3 except for using [[SPL_services|Ounce]] keys (?). It's unknown exactly which Protocol uses which [[SPL_services|Generation]], though presumably 2/4 is Generation 0x0/0x1? lcs (local-content-share) uses Generation 0x1, while Mario Kart World uses 0x0.
[S2] Keys are generated by passing the SHA256 hash as the KeySource to the relevant [[SPL_services|spl:ldn]] command with the above Generation, with the full hash being passed to the Ounce cmds. Only the first 0x10-bytes of the output key is used, since AES-128 is used even with Ounce.
On NX, the Protocol [[#SetProtocol|permission-bitmask]] is always set to 0xA (1 and 3). On Ounce, all services have this set to 0x1E, except for one which has it set to 0xA (which is likely the one for S1-compat). 0x1E allows additional protocol values 2 and 4.


= ActionFrameSettings =
= ActionFrameSettings =
Line 1,435: Line 1,507:
|}
|}


SecurityMode must be 1-2. The same SecurityMode override functionality from elsewhere is used here.
SecurityMode must be 1-2. The same SecurityMode override functionality from elsewhere is used later with this.
 
The same LocalCommunicationId override/validation from elsewhere is used with the input as well.


= MessageFlagSet =
= MessageFlagSet =
Line 1,600: Line 1,674:
After Authentication the Station will scan for another [[#ActionFrame]], with frame-comparision enabled with the above frame (frame must have been updated since the previous scan). The Station locates the index for a [[#MacAddress|MacAddress]] matching itself in the [[#NetworkInfo]] [[#NodeInfo|NodeInfo]] array (the entry for the AccessPoint is skipped), throwing an error if not found. After validating the LocalCommunicationVersion, it proceeds to handle ARP setup below.
After Authentication the Station will scan for another [[#ActionFrame]], with frame-comparision enabled with the above frame (frame must have been updated since the previous scan). The Station locates the index for a [[#MacAddress|MacAddress]] matching itself in the [[#NetworkInfo]] [[#NodeInfo|NodeInfo]] array (the entry for the AccessPoint is skipped), throwing an error if not found. After validating the LocalCommunicationVersion, it proceeds to handle ARP setup below.


This does not use DHCP, each node on the network has to manually setup ARP (without sending ARP network requests) with the [[#NodeInfo|NodeInfo]] array in [[#NetworkInfo]]. [?+] After the client is [[#EthFrame|authenticated]] the host sends an ARP reply to the client (there's no ARP usage besides this).
This does not use DHCP, each node on the network has to manually setup IP-config with the [[#NodeInfo|NodeInfo]] array in [[#NetworkInfo]]. [?+] After the client is [[#EthFrame|authenticated]] ARP may be used in some cases however.


At this point standard sockets can be used over Data frames.
At this point standard sockets can be used over Data frames.
Line 1,633: Line 1,707:
| 0x4 || 0x1 || [6.0.0+] High u8 for the size.
| 0x4 || 0x1 || [6.0.0+] High u8 for the size.
|-
|-
| 0x5 || 0x1 || [20.0.0+] AuthEncryptionType, must match the type being used by the [[#Protocol|Protocol]]. 0 = plaintext ([[#Protocol|Protocol]] NX), 1 = AES-128-GCM ([[#Protocol|Protocol]] 3).
| 0x5 || 0x1 || [20.0.0+] AuthEncryptionType, must match the type being used by the [[#Protocol|Protocol]]. 0 = plaintext ([[#Protocol|Protocol]] NX), 1 = AES-128-GCM ([[#Protocol|Protocol]] non-NX).
|-
|-
| 0x6 || 0x2 || Unused, zeros.
| 0x6 || 0x2 || Unused, zeros.
Line 1,692: Line 1,766:
! Description
! Description
|-
|-
| 0x0 || 0x40 || Zeros. [6.0.0-?] Only included in the frame if it's enabled (+0x0 [[#AuthVersion]] >= 3). Unused by the Station.
| 0x0 || 0x1 || Unused, always set to 0. [S2] This is usually set to value 1?
|-
| 0x1 || 0x3F || Zeros. [6.0.0-?] Only included in the frame if it's enabled (+0x0 [[#AuthVersion]] >= 3). Unused by the Station.
|-
|-
| 0x40 || 0x44 || [6.0.0-?] Only included in the frame if it's enabled (+0x0 [[#AuthVersion]] >= 3). Unused by the Station.
| 0x40 || 0x44 || [6.0.0-?] Only included in the frame if it's enabled (+0x0 [[#AuthVersion]] >= 3). Unused by the Station.
Line 1,700: Line 1,776:


===== AuthVersion =====
===== AuthVersion =====
Must be 0x1-0xF (<x010 with newer versions).
Must be 0x1-0xF (<0x10 with newer versions).


[?+] When the AccessPoint is handling the [[#Authentication|Authentication]] EthFrame, the AuthVersion must be >=1 for [[#Protocol|Protocol]] NX, and >=4 for [[#Protocol|Protocol]] 3.
[?+] When the AccessPoint is handling the [[#Authentication|Authentication]] EthFrame, the AuthVersion must be >=1 for [[#Protocol|Protocol]] NX, and >=4 for [[#Protocol|Protocol]] 3.
Line 1,762: Line 1,838:
|}
|}


Using EncryptionType3 outside of [[#Scan]]/[[#ScanPrivate]] is enabled with [[#Protocol|Protocol]] 3.
Using EncryptionType3 outside of [[#Scan]]/[[#ScanPrivate]] is enabled with [[#Protocol|Protocol]] non-NX.


When encryption is enabled, the encrypted data is at +0x28 (+0x38 with EncryptionType3) with size {remaining frame size}. The key is derived from the raw 0x20-bytes at +0x0. The CTR/IV is {raw Counter above without byte-swap}, with the rest cleared to zeros. The AAD for AES-128-GCM is at +0x0 size 0x28-bytes.
When encryption is enabled, the encrypted data is at +0x28 (+0x38 with EncryptionType3) with size {remaining frame size}. The key is derived from the raw 0x20-bytes at +0x0. The CTR/IV is {raw Counter above without byte-swap}, with the rest cleared to zeros. The AAD for AES-128-GCM is at +0x0 size 0x28-bytes.
Originally [[#Scan]]/[[#ScanPrivate]] used the EncryptionType field to determine encryption handling. With [18.0.0+] these now set an internal SecurityMode field to 0 (Any) initially, then later uses the same SecurityMode override as [[#CreateNetwork|CreateNetwork]]. The internal SecurityMode field is used to determine encryption handling: Any uses the EncryptionType field like before. With non-zero the encryption handling is determined as required by the SecurityMode.


The content data at +{above_header_size} follows, which has the size specified above (which must be >=0x500 with EncryptionType1-2), where all fields are big-endian. For EncryptionType1-2:
The content data at +{above_header_size} follows, which has the size specified above (which must be >=0x500 with EncryptionType1-2), where all fields are big-endian. For EncryptionType1-2:
Line 1,811: Line 1,889:
| 0x0 || 0x10 || [[#NetworkInfo]]+0x50
| 0x0 || 0x10 || [[#NetworkInfo]]+0x50
|-
|-
| 0x10 || 0x8 || [[#NetworkInfo]]+0x478
| 0x10 || 0x8 || [[#NetworkInfo]]+0x478 [S2] The Station seems to verify that this is 0 when the Challenge is unused (ldn:s)? Throws an error if set before connecting to an [[#Protocol|Ounce]] network.
|-
|-
| 0x18 || 0x1 || [[#NetworkInfo]]+0x60
| 0x18 || 0x1 || [[#NetworkInfo]]+0x60
Line 1,881: Line 1,959:


=== ActionFrame2 ===
=== ActionFrame2 ===
The Action frames used by [[#RecvActionFrame|RecvActionFrame]] have the following structure:
The Action frames used by [[#SendActionFrame|SendActionFrame]]/[[#RecvActionFrame|RecvActionFrame]] have the following structure:
* "Fixed parameters":
* "Fixed parameters":
** "Category code: Vendor Specific (127)"
** "Category code: Vendor Specific (127)"
Line 1,897: Line 1,975:
| 0x2 || 0x2 || Protocol ID, must match big-endian 0x0102.
| 0x2 || 0x2 || Protocol ID, must match big-endian 0x0102.
|-
|-
| 0x4 || 0x2 ||  
| 0x4 || 0x2 || 00 00
|-
|-
| 0x6 || 0x2 ||  
| 0x6 || 0x2 || 00 00
|}
|}


Line 1,930: Line 2,008:


The key is derived similar to the regular action-frame key (same KeySource), except: the Generation is always [[17.0.0|0x11]], with the following data for hashing: {big-endian LocalCommunicationId} {+0x10 size 0x10-bytes} {[[#ActionFrameSettings]] Passphrase with the specified PassphraseSize}.
The key is derived similar to the regular action-frame key (same KeySource), except: the Generation is always [[17.0.0|0x11]], with the following data for hashing: {big-endian LocalCommunicationId} {+0x10 size 0x10-bytes} {[[#ActionFrameSettings]] Passphrase with the specified PassphraseSize}.
The data payload is the data buffer for [[#SendActionFrame|SendActionFrame]]/[[#RecvActionFrame|RecvActionFrame]].


== lp2p ==
== lp2p ==
Line 2,080: Line 2,160:
|-
|-
| 0x0 || {remaining size} || Plaintext user-data.
| 0x0 || {remaining size} || Plaintext user-data.
|}
= Notes =
The following services are accessible to ldn:
* arp:r, bsd:s, btm, es, fatal:u, ifcfg, lm, nifm:s, pl:s, set:sys, spl:mig, wlan
[S2] Access to btm and spl:mig were replaced with bt:sys and spl:ldn.
[S2] Various objects/state have the same size/layout as S1, generally?(Other than IPC-related differences) There's also stack differences.
== Code-region Memory Layout ==
=== S2 20.5.0 ===
This is the codebin-region layout for S2 ldn 20.5.0, exact starting version unknown. BuildId is "DC456FA4...".
The on-NX note is for the equivalent memregion location/size, memregion-size/contents compared to NX may vary.
Total size is 0x24F000-bytes.
{| class="wikitable" border="1"
|-
! Offset
! Size
! Permissions
! Description
|-
| 0x0 || 0xE1000 || --X || .text
|-
| 0xE1000 || 0x3D000 || R-- || RO-region
|-
| 0x11E000 || 0x3A000 || RW || On NX this is at 0xEF000. The main ExpHeap is at +0x2000, on NX it's at +0x1000.
|-
| 0x158000 || 0x8000 || non-RW || On NX this is at 0x123000.
|-
| 0x160000 || 0x8000 || RW || On NX this is at 0x12B000.
|-
| 0x168000 || 0xF000 || non-RW || On NX this is at 0x139000.
|-
| 0x177000 || 0x3000 || RW || On NX this is at 0x13F000.
|-
| 0x17A000 || 0x24000 || non-RW || On NX this is at 0x14B000.
|-
| 0x19E000 || 0x4E000 || RW || On NX this is at 0x16F000.
|-
| 0x1EC000 || 0x2000 || -- || On NX this is at 0x1BD000.
|-
| 0x1EE000 || 0x2000 || {accessible} || On NX this is at 0x1BF000.
|-
| 0x1EF000 || 0x5000 || -- || On NX this is at 0x1E2000.
|-
| 0x1F4000 || 0x21000 || {accessible} || On NX this is at 0x1EA000.
|-
| 0x218000 || 0x8000 || -- ||
|-
| 0x220000 || 0x2F000 || {accessible}
|}
|}


[[Category:Services]]
[[Category:Services]]
Retrieved from "https://switchbrew.org/wiki/LDN_services"