Capture services

caps:a

This is "nn::capsrv::sf::IAlbumAccessorService".

Cmd	Name
0	GetAlbumFileCount
1	GetAlbumFileList
2	LoadAlbumFile
3	DeleteAlbumFile
4	StorageCopyAlbumFile
5	IsAlbumMounted
6	GetAlbumUsage
7	GetAlbumFileSize
8	LoadAlbumFileThumbnail
9	[2.0.0+] LoadAlbumScreenShotImage
10	[2.0.0+] LoadAlbumScreenShotThumbnailImage
11	[2.0.0+] GetAlbumEntryFromApplicationAlbumEntry
12	[3.0.0+] LoadAlbumScreenShotImageEx
13	[3.0.0+] LoadAlbumScreenShotThumbnailImageEx
14	[3.0.0+] LoadAlbumScreenShotImageEx0
15	[4.0.0+] GetAlbumUsage3
16	[4.0.0+] GetAlbumMountResult
17	[4.0.0+] GetAlbumUsage16
18	[6.0.0+]
100	[5.0.0+] GetAlbumFileCountEx0
101	[5.0.0+] GetAlbumFileListEx0
202	[1.0.0-2.3.0] SaveEditedScreenShot
301	GetLastOverlayScreenShotThumbnail
302	[4.0.0+] GetLastOverlayMovieThumbnail
401	GetAutoSavingStorage
501	GetRequiredStorageSpaceSizeToCopyAll
1001	[3.0.0+] LoadAlbumScreenShotThumbnailImageEx0
1002	[3.0.0+] LoadAlbumScreenShotImageEx1
1003	[4.0.0+] LoadAlbumScreenShotThumbnailImageEx1
8001	ForceAlbumUnmounted
8002	ResetAlbumMountStatus
8011	RefreshAlbumCache
8012	GetAlbumCache
8013	[4.0.0+] GetAlbumCacheEx
8021	[2.0.0+] GetAlbumEntryFromApplicationAlbumEntryAruid
10011	SetInternalErrorConversionEnabled
50000	[6.0.0+] LoadMakerNoteInfoForDebug
60002	[4.0.0+] OpenAccessorSession

Cmd1002: Takes a total of 0x38-bytes of input, two type-0x5 input buffers, and returns 0x20-bytes of output. [4.0.0+] No longer returns output, and now takes the following buffers instead: type-0x16, type-0x46, and type-0x6.

Cmd60002: Takes a total of 8-bytes of input, a PID, and returns an #IAlbumAccessorSession.

IAlbumAccessorSession

This is "nn::capsrv::sf::IAlbumAccessorSession".

This was added with [4.0.0+].

Cmd	Name
2001	OpenAlbumMovieReadStream
2002	CloseAlbumMovieReadStream
2003	GetAlbumMovieReadStreamMovieDataSize
2004	ReadMovieDataFromAlbumMovieReadStream
2005	GetAlbumMovieReadStreamBrokenReason
2006	GetAlbumMovieReadStreamImageDataSize
2007	ReadImageDataFromAlbumMovieReadStream
2008	ReadFileAttributeFromAlbumMovieReadStream

caps:c

This is "nn::capsrv::sf::IAlbumControlService", previously "nn::capsrv::sf::ICaptureControllerService" with [1.0.0].

Cmd	Name	Notes
[1.0.0] 1	CaptureRawImage
[1.0.0] 2	CaptureRawImageWithTimeout
33	[7.0.0+]
[1.0.0] 1001	RequestTakingScreenShot
[1.0.0] 1002	RequestTakingScreenShotWithTimeout
[1.0.0] 1011	NotifyTakingScreenShotRefused
2001	NotifyAlbumStorageIsAvailable
2002	NotifyAlbumStorageIsUnavailable
2011	[2.0.0+] RegisterAppletResourceUserId
2012	[2.0.0+] UnregisterAppletResourceUserId
2013	[2.0.0+] GetApplicationIdFromAruid
2014	[2.0.0+] CheckApplicationIdRegistered
2101	[2.0.0+] GenerateCurrentAlbumFileId	Takes an input u8 and u64, returns a 0x18-byte struct.
2102	[2.0.0+] GenerateApplicationAlbumEnrty
[2.0.0-3.0.2] 2201	SaveAlbumScreenShotFile
2202	[4.0.0+] SaveAlbumScreenShotFileEx
2301	[2.0.0+] SetOverlayScreenShotThumbnailData
2302	[4.0.0+] SetOverlayMovieThumbnailData
60001	[4.0.0+] OpenControlSession	Takes a total of 8-bytes of input and a PID, returns an #IAlbumControlSession.

Cmd33

Takes an input u64 #ShimLibraryVersion, an u64 AppletResourceUserId, and a PID, no output.

This is used by caps:su SetShimLibraryVersion.

IAlbumControlSession

This is "nn::capsrv::sf::IAlbumControlSession".

This was added with [4.0.0+].

Cmd	Name	Notes
2001	OpenAlbumMovieReadStream
2002	CloseAlbumMovieReadStream
2003	GetAlbumMovieReadStreamMovieDataSize
2004	ReadMovieDataFromAlbumMovieReadStream
2005	GetAlbumMovieReadStreamBrokenReason
2006	GetAlbumMovieReadStreamImageDataSize
2007	ReadImageDataFromAlbumMovieReadStream
2008	ReadFileAttributeFromAlbumMovieReadStream
2401	OpenAlbumMovieWriteStream
2402	FinishAlbumMovieWriteStream
2403	CommitAlbumMovieWriteStream
2404	DiscardAlbumMovieWriteStream
2405	DiscardAlbumMovieWriteStreamNoDelete
2406	[7.0.0+]
2411	StartAlbumMovieWriteStreamDataSection
2412	EndAlbumMovieWriteStreamDataSection
2413	StartAlbumMovieWriteStreamMetaSection
2414	EndAlbumMovieWriteStreamMetaSection
2421	ReadDataFromAlbumMovieWriteStream
2422	WriteDataToAlbumMovieWriteStream
2424	WriteMetaToAlbumMovieWriteStream
2431	GetAlbumMovieWriteStreamBrokenReason
2433	GetAlbumMovieWriteStreamDataSize
2434	SetAlbumMovieWriteStreamDataSize

caps:u

This is "nn::capsrv::sf::IAlbumApplicationService".

This was added with [5.0.0+].

Cmd	Name
32	[7.0.0+] #SetShimLibraryVersion
102	GetAlbumFileList0AafeAruidDeprecated
103	DeleteAlbumFileByAruid
104	GetAlbumFileSizeByAruid
105	DeleteAlbumFileByAruidForDebug
110	LoadAlbumScreenShotImageByAruid
120	LoadAlbumScreenShotThumbnailImageByAruid
130	PrecheckToCreateContentsByAruid
140	[6.0.0+] GetAlbumFileList1AafeAruidDeprecated
141	[6.0.0+] GetAlbumFileList2AafeUidAruidDeprecated
142	[7.0.0+] GetAlbumFileList3AaeAruid
143	[7.0.0+] GetAlbumFileList4AaeUidAruid
60002	OpenAccessorSessionForApplication

SetShimLibraryVersion

Takes an input u64 #ShimLibraryVersion, an u64 AppletResourceUserId, and a PID, no output.

IAlbumAccessorApplicationSession

This is "nn::capsrv::sf::IAlbumAccessorApplicationSession".

This was added with [5.0.0+].

Cmd	Name
2001	OpenAlbumMovieReadStream
2002	CloseAlbumMovieReadStream
2003	GetAlbumMovieReadStreamMovieDataSize
2004	ReadMovieDataFromAlbumMovieReadStream
2005	GetAlbumMovieReadStreamBrokenReason

ShimLibraryVersion

This is a version field. Official sw uses func nn::capsrv::GetShimLibraryVersion() to load this from a global var, which is then used with various commands (the input for those cmds must match value 1).

[7.0.0-8.1.0] This is value 1.

Controls which struct version to use for #ApplicationAlbumEntry / #AlbumFileEntry. However, the struct size for the newer version is used regardless on [7.0.0+] for the actual cmds.

AlbumEntry

Offset	Size	Description
0x0	0x8	Unknown
0x8	0x8	titleID
0x10	0x2	Year
0x12	0x1	Month
0x13	0x1	Day
0x14	0x1	Hour
0x15	0x1	Minute
0x16	0x1	Second
0x17	0x1	Unknown
0x18	0x1	Unknown
0x19	0x1	Unknown
0x1A	0x6	Padding?

This is "nn::capsrv::AlbumEntry". This is a 0x20-byte struct.

The data at offset 0x10 size 0x8 corresponds to each field in the Album entry filename, prior to the "-".

AlbumFileEntry

This is "nn::album::AlbumFileEntry". This is identical to #ApplicationAlbumEntry. On older versions where official sw used to use cmds which use #ApplicationAlbumFileEntry, this struct matches #ApplicationAlbumFileEntry.

ApplicationAlbumEntry

Offset	Size	Description
0x0	0x20	Unknown.

This is "nn::capsrv::ApplicationAlbumEntry". This is a 0x20-byte struct. On older versions where #ShimLibraryVersion is 0, this has a different format.

With the output from caps:su sdk-nso only uses this for the Share-applet (when the output is used at all), with everything else it's used as an #AlbumFileEntry. In those cases with the nn::album wrapper funcs, it's "converted" by just copying the struct (arrays are "converted" by just returning a ptr to the input array).

ApplicationAlbumFileEntry

This is "nn::capsrv::ApplicationAlbumFileEntry". This is a 0x30-byte struct.

On newer versions where official sw uses #ApplicationAlbumEntry, #ApplicationAlbumEntry is converted to ApplicationAlbumFileEntry when using cmds which need it with:

• First 0x20-bytes are the same.
• u64 ApplicationAlbumFileEntry+0x20 = #ApplicationAlbumEntry+0x10.
• Last 8-bytes = 0.

ApplicationData

Offset	Size	Description
0x0	0x400	UserData
0x400	0x4	UserData size.

This is "nn::capsrv::ApplicationData". This is a 0x404-byte struct.

UserIdList

Offset	Size	Description
0x0	0x80	u128 userIDs
0x80	0x1	Total userIDs.
0x81	0x7	Padding.

This is "nn::capsrv::UserIdList". This is a 0x88-byte struct.

Notes

capsrv is responsible for validating the MACs for screenshots stored on the SD card, if the setting capsrv!enable_album_screenshot_filedata_verification is non-zero.

Screenshots are validated as follows: The JPEG's MAC is extracted from the EXIF maker note, and stored. A timestamp string is generated by calling snprintf(&str, 20, "%04d:%02d:%02d %02d:%02d:%02d", ...); with stored timestamp values. If this doesn't match the timestamp string stored in EXIF, then an error 0xA34CE is returned. Otherwise, the entire JPEG is loaded into memory, and the stored EXIF maker note is cleared to zeroes. Then, an HMAC-SHA256 is computed over the entire JPEG using a hardcoded secret key. if (memcmp(calculated_hmac, stored_hmac, 0x10) == 0), the screenshot is valid, else 0xA3ACE is returned.

In 3.0.0, MAC calculation was changed: now, instead of calculating an HMAC, a plain SHA256 hash is calculated. capsrv basically does screenshot_kek = spl::GenerateAesKek(<hardcoded screenshot_kek_source>); spl::LoadAesKey(screenshot_kek, <hardcoded screenshot_key_source>); MAC = spl::ComputeCmac(hash);

Videos

4.0.0 includes video playback etc support in Album via mp4. These include a JPEG thumbnail, which is used for video "validation". The EXIF is also much larger: the MakerNote is 0x498-bytes, with encrypted data starting at offset +0x8. This encryption uses AES-CTR with hardcoded key/ctr. MAC calculation works the same way as the 3.0.0+ JPEG MAC calculation, except with a different movie_kek_source/movie_key_source.

Note: the Album process itself uses libstagefright for video playback.