NSO

NSO is the main executable format.

It starts with the "NSO" header and mainly describes .text, .rodata, and .data segments (like a short-form of ELF program headers). If the segments are compressed, they are compressed using LZ4.

NsoHeader

Offset	Size	Description
0x0	4	Signature ("NSO0")
0x4	4	Version
0x8	4	Reserved
0xC	4	Flags
0x10	0x4	TextFileOffset
0x14	0x4	TextMemoryOffset
0x18	0x4	TextSize
0x1C	0x4	ModuleNameOffset (calculated by sizeof(header))
0x20	0x4	RoFileOffset
0x24	0x4	RoMemoryOffset
0x28	0x4	RoSize
0x2C	0x4	ModuleNameSize
0x30	0x4	DataFileOffset
0x34	0x4	DataMemoryOffset
0x38	0x4	DataSize
0x3C	0x4	BssSize
0x40	0x20	ModuleId
0x60	0x4	TextFileSize (.text compressed size)
0x64	0x4	RoFileSize (.rodata compressed size)
0x68	0x4	DataFileSize (.data compressed size)
0x6C	0x1C	Reserved
0x88	0x4	EmbeddedOffset (relative to the .rodata section)
0x8C	0x4	EmbeddedSize
0x90	0x4	DynStrOffset (relative to the .rodata section)
0x94	0x4	DynStrSize
0x98	0x4	DynSymOffset (relative to the .rodata section)
0x9C	0x4	DynSymSize
0xA0	0x20	TextHash (SHA-256 hash over the decompressed .text section using the above size)
0xC0	0x20	RoHash (SHA-256 hash over the decompressed .rodata section using the above size)
0xE0	0x20	DataHash (SHA-256 hash over the decompressed .data section using the above size)
0x100	Variable	Compressed sections

Flags

Bits	Description
0	TextCompress (.text section is compressed)
1	RoCompress (.rodata section is compressed)
2	DataCompress (.data section is compressed)
3	TextHash (.text hash must be checked when loading)
4	RoHash (.rodata hash must be checked when loading)
5	DataHash (.data hash must be checked when loading)
6	[20.0.0+] PreventCodeReads

ModuleId

This is "nn::ro::detail::ModuleId".

Value of "build id" from ELF's GNU .note section. Contains variable sized digest, up to 32bytes.

Arguments

Loader maps memory and writes the arguments to {end of rwdata section}. Official processes use argdata_addr = {page-aligned _end}. svcQueryMemory is used by official sw to verify that argdata_addr is mapped RW, since this memory is only mapped when arguments are specified via that command. Afterwards, official sw aligns the argdata_addr to 4-bytes.

The structure located at argdata_addr is as follows:

Offset	Size	Description
0x0	0x4	This is the total allocated space relative to argdata_addr, used for calculating the max size of the argv ptr array. Normally 0x9000?
0x4	0x4	This is the total_bytesize of the actual argdata string.
0x8	0x18	Unused by official sw.
0x20	See above	Actual argdata string.

• The copy of the args used with the argv array is written by official processes to actual_argdata_string+actual_argdata_size.
• argv_ptrarray written by official processes is at (args_copy+actual_argdata_size) + 0x9 & ~0x7.