18.0.0: Difference between revisions

(5 intermediate revisions by 2 users not shown)

Line 24:

* ldn: Service access: added lm.

* ns: Service access: added ldn:s.

** ldn is currently unused in the main-codebin (on NX at least).

* psc: Service access: added ovln:snd, psc:m.

* ssl: Service access: added srepo:u, arp:r.

Line 91:

Line 92:

** Added: 52 - inbytes: 0x8, outbytes: 0x0

* Interface Removed: nn::ts::server::IMeasurementServer

* ~~Unknown~~ Interface ~~cur-version~~: ~~0x710006930C [ID = 0x26f251af]~~

* Interface Added: nn::ts::server::ITsManager

* Interface Changed: nn::psm::IPsmServer

** Added: 19 - inbytes: 0x0, outbytes: 0x0

** Added: 20 - inbytes: 0x0, outbytes: 0x0

* Interface Removed: nn::socket::sf::IClient_MC

* Interface Added: nn::socket::resolver::IPrivateResolver

* Interface Added: nn::socket::sf::IClient

* Unknown Interface cur-version: 0x71000D00F0 [ID = 0xb117a63f]

* Interface Changed: nn::hid::IHidDebugServer

** Added: 18 - buffer_entry_sizes: [0x28], buffers: [0x5], inbytes: 0x8, outbytes: 0x0, pid: True

Line 146:

Line 147:

* Interface Changed: nn::audioctrl::detail::IAudioController

** Removed: 6 - inbytes: 0x4, outbytes: 0x1

* ~~Unknown~~ Interface ~~cur-version~~: ~~0x710002D294 [ID = 0xf8ed3aad]~~

* Interface Added: nn::ldn::detail::IClientProcessMonitor

* Interface Changed: nn::ldn::detail::ISystemLocalCommunicationService

** Added: 106 - inbytes: 0x4, outbytes: 0x0

Line 157:

Line 158:

** Added: 601 - inbytes: 0x0, outbytes: 0x0

* Interface Changed: nn::ldn::detail::ISystemServiceCreator

** Added: 1 - inbytes: 0x0, outbytes: 0x0, outinterfaces: ['~~0x710002D294 [ID = 0xf8ed3aad]~~']

** Added: 1 - inbytes: 0x0, outbytes: 0x0, outinterfaces: ['nn::ldn::detail::IClientProcessMonitor']

* Interface Changed: nn::ldn::detail::IUserLocalCommunicationService

** Added: 106 - inbytes: 0x4, outbytes: 0x0

Line 168:

Line 169:

** Added: 601 - inbytes: 0x0, outbytes: 0x0

* Interface Changed: nn::ldn::detail::IUserServiceCreator

** Added: 1 - inbytes: 0x0, outbytes: 0x0, outinterfaces: ['~~0x710002D294 [ID = 0xf8ed3aad]~~']

** Added: 1 - inbytes: 0x0, outbytes: 0x0, outinterfaces: ['nn::ldn::detail::IClientProcessMonitor']

* Unknown Interface prev-version: 0x7100005828

* Unknown Interface cur-version: 0x7100005438

Line 177:

Line 178:

** Added: 12 - inbytes: 0x8, outbytes: 0x0

** Added: 13 - inbytes: 0x8, outbytes: 0x0

* Unknown Interface prev-version: 0x71000791B8 [ID = 0xf350e826]

* Unknown Interface cur-version: 0x710007E200 [ID = 0xf350e826]

* Interface Changed: nn::account::IAccountEntityServiceForAccountPolicy

** Added: 400 - buffers: [0x5], inbytes: 0x10, outbytes: 0x0

Line 200:

Line 199:

** Added: 402 - buffers: [0x6], inbytes: 0x10, outbytes: 0x4

* Interface Changed: nn::account::baas::IAdministrator

** Changed: 170 - outinterfaces: ['0x71000791B8 [ID = 0xf350e826]'] -> ['0x710007E200 [ID = 0xf350e826]'] (final state: inbytes: 0x8, inhandles: [1], outbytes: 0x0, outinterfaces: ['0x710007E200 [ID = 0xf350e826]'])

** Added: 180 - buffer_entry_sizes: [0x1000, 0x100], buffers: [0x1A, 0x1A], inbytes: 0x4, outbytes: 0x0

* Interface Changed: nn::account::baas::IFloatingRegistrationRequest

Line 207:

Line 205:

** Added: 16 - buffers: [0x6], inbytes: 0x0, outbytes: 0x4

* Interface Changed: nn::account::baas::IManagerForSystemService

** Changed: 170 - outinterfaces: ['0x71000791B8 [ID = 0xf350e826]'] -> ['0x710007E200 [ID = 0xf350e826]'] (final state: inbytes: 0x8, inhandles: [1], outbytes: 0x0, outinterfaces: ['0x710007E200 [ID = 0xf350e826]'])

** Added: 180 - buffer_entry_sizes: [0x1000, 0x100], buffers: [0x1A, 0x1A], inbytes: 0x4, outbytes: 0x0

* Interface Changed: nn::account::nas::IOAuthProcedureForExternalNsa

Line 223:

Line 220:

** Added: 30 - inbytes: 0x0, outbytes: 0x10

** Added: 110 - buffer_entry_sizes: [0x80, 0x0], buffers: [0x19, 0x5], inbytes: 0x38, outbytes: 0x0

* Unknown Interface prev-version: 0x71001BCD60 [ID = 0xf350e826]

* Unknown Interface cur-version: 0x71001B0378 [ID = 0xf350e826]

* Interface Changed: nn::account::IAccountServiceForAdministrator

** Added: 400 - buffers: [0x5], inbytes: 0x10, outbytes: 0x0

Line 236:

Line 231:

** Added: 402 - buffers: [0x6], inbytes: 0x10, outbytes: 0x4

* Interface Changed: nn::account::baas::IAdministrator

** Changed: 170 - outinterfaces: ['0x71001BCD60 [ID = 0xf350e826]'] -> ['0x71001B0378 [ID = 0xf350e826]'] (final state: inbytes: 0x8, inhandles: [1], outbytes: 0x0, outinterfaces: ['0x71001B0378 [ID = 0xf350e826]'])

** Added: 180 - buffer_entry_sizes: [0x1000, 0x100], buffers: [0x1A, 0x1A], inbytes: 0x4, outbytes: 0x0

* Interface Changed: nn::account::baas::IFloatingRegistrationRequest

Line 243:

Line 237:

** Added: 16 - buffers: [0x6], inbytes: 0x0, outbytes: 0x4

* Interface Changed: nn::account::baas::IManagerForSystemService

** Changed: 170 - outinterfaces: ['0x71001BCD60 [ID = 0xf350e826]'] -> ['0x71001B0378 [ID = 0xf350e826]'] (final state: inbytes: 0x8, inhandles: [1], outbytes: 0x0, outinterfaces: ['0x71001B0378 [ID = 0xf350e826]'])

** Added: 180 - buffer_entry_sizes: [0x1000, 0x100], buffers: [0x1A, 0x1A], inbytes: 0x4, outbytes: 0x0

* Interface Changed: nn::account::nas::IOAuthProcedureForExternalNsa

Line 289:

Line 282:

** Added: 3101 - inbytes: 0x0, outbytes: 0x0, outhandles: [1], outinterfaces: ['nn::ns::detail::IAsyncResult']

** Added: 3102 - inbytes: 0x0, outbytes: 0x0

* ~~Unknown~~ Interface ~~prev-version~~: ~~0x71000182AC [ID = 0x5a340f8a]~~

* Interface Added: nn::hshl::IVsysVoltageSession

* Unknown Interface cur-version: ~~0x710001CE6C [ID = 0x5a340f8a]~~

* Unknown Interface cur-version: ~~0x710001D12C [ID = 0x07b4542c]~~

* Interface Changed: nn::hshl::IChargeSetterSession

** Added: 4 - inbytes: 0x1, outbytes: 0x0

* Interface Changed: nn::hshl::IManager

** ~~Changed~~: ~~9 - outinterfaces: ['0x71000182AC [ID = 0x5a340f8a]']~~ -~~> ['0x710001CE6C [ID = 0x5a340f8a]'] (final state:~~ inbytes: 0x0, outbytes: 0x0, outinterfaces: ['~~0x710001CE6C [ID = 0x5a340f8a]'])~~

** Added: 11 - inbytes: 0x0, outbytes: 0x0, outinterfaces: ['nn::hshl::IVsysVoltageSession']

** Added: ~~11 - inbytes~~: ~~0x0, outbytes~~: ~~0x0, outinterfaces~~: ~~['0x710001D12C [ID = 0x07b4542c]~~']

** Added: 12 - inbytes: 0x0, outbytes: 0x1

* Interface Changed: nn::hshl::ISetterManager

Line 312:

Line 302:

** Added: 2435 - inbytes: 0x10, outbytes: 0x0

** Added: 5000 - inbytes: 0x8, outbytes: 0x8

* ~~Unknown~~ Interface ~~cur-version~~: ~~0x71000B9398 [ID = 0xb8f77e09]~~

* Interface Added: nn::am::service::INotificationReceiver

* ~~Unknown~~ Interface ~~cur-version~~: ~~0x71000B9D70 [ID = 0x43c5fa77]~~

* Interface Added: nn::am::service::INotificationSender

* ~~Unknown~~ Interface ~~cur-version~~: ~~0x71000B9A78 [ID = 0xb0c7a8a3]~~

* Interface Added: nn::am::service::IReceiverService

* ~~Unknown~~ Interface ~~cur-version~~: ~~0x71000B90A8 [ID = 0x8db727a9]~~

* Interface Added: nn::am::service::ISenderService

* Interface Changed: nn::am::service::IAppletCommonFunctions

** Added: 82 - inbytes: 0x1, outbytes: 0x0

** Added: 160 - inbytes: 0x0, outbytes: 0x0, outinterfaces: ['~~0x71000B90A8 [ID = 0x8db727a9]~~']

** Added: 160 - inbytes: 0x0, outbytes: 0x0, outinterfaces: ['nn::am::service::IReceiverService']

** Added: 161 - inbytes: 0x0, outbytes: 0x0, outinterfaces: ['~~0x71000B9A78 [ID = 0xb0c7a8a3]~~']

** Added: 161 - inbytes: 0x0, outbytes: 0x0, outinterfaces: ['nn::am::service::ISenderService']

* Interface Changed: nn::am::service::IDebugFunctions

** Added: 53 - inbytes: 0x8, outbytes: 0x8

Line 346:

Line 336:

** Added: 145601 - inbytes: 0x0, outbytes: 0x36

** Added: 195101 - inbytes: 0x36, outbytes: 0x0

* ~~Unknown~~ Interface ~~cur-version~~: ~~0x71000913E4 [ID = 0x10763728]~~

* Interface Added: nn::npns::ISetNetworkServiceAccountIdTokenContext

* Interface Changed: nn::npns::INotificationReceiver

** Added: 5 - buffers: [0x9], inbytes: 0x0, outbytes: 0x0

Line 387:

Line 377:

** Changed: 1 - inbytes: 0x20 -> 0x28 (final state: inbytes: 0x28, inhandles: [1], outbytes: 0x0, outinterfaces: ['nn::grcsrv::IContinuousRecorder'])

** Added: 10 - inbytes: 0x20, outbytes: 0x0, outinterfaces: ['nn::grcsrv::IContinuousRecorder']

* Interface Removed: nn::jitsrv::IJitEnvironment

* Interface Removed: nn::jitsrv::IJitService

* Interface Added: nn::sf::hipc::detail::IHipcManager

* Unknown Interface cur-version: 0x7100000680 [ID = 0x3d92e8a4]

* Unknown Interface cur-version: 0x71000009C4 [ID = 0x2a4c2069]

* Interface Changed: nn::capsrv::sf::IDecoderControlService

** Added: 4002 - buffers: [0x46, 0x5], inbytes: 0x30, outbytes: 0x8

* ~~Unknown~~ Interface ~~cur-version~~: ~~0x710011CA80 [ID = 0x7e450fad]~~

* Interface Added: nn::olsc::srv::IServiceGetter

* Interface Changed: nn::spsm::detail::IPowerStateInterface

** Added: 15 - inbytes: 0x4, outbytes: 0x0

** Added: 16 - inbytes: 0x8, outbytes: 0x0

* ~~Unknown~~ Interface ~~cur-version~~: ~~0x7100021640 [ID = 0xd3808bc8]~~

* Interface Added: nn::fssrv::sf::IMemoryStressor

* Interface Changed: nn::fssrv::sf::IDeviceOperator

** Added: 222 - buffers: [0x6], inbytes: 0x10, outbytes: 0x0

** Added: 302 - inbytes: 0x4, outbytes: 0x0

* Interface Changed: nn::fssrv::sf::IFileSystemProxy

** Added: 1020 - inbytes: 0x0, outbytes: 0x0, outinterfaces: ['~~0x7100021640 [ID = 0xd3808bc8]~~']

** Added: 1020 - inbytes: 0x0, outbytes: 0x0, outinterfaces: ['nn::fssrv::sf::IMemoryStressor']

** Removed: 1100 - buffers: [0x5], inbytes: 0x0, outbytes: 0x0

** Added: 1101 - buffers: [0x5], inbytes: 0x4, outbytes: 0x0

Line 417:

Line 403:

* Interface Changed: nn::spl::detail::IEsInterface

** Added: 33 - buffers: [0x9, 0x9, 0x9], inbytes: 0x4, outbytes: 0x10

* ~~Unknown~~ Interface ~~cur-version~~: ~~0x7100021290 [ID = 0xd3808bc8]~~

* Interface Added: nn::fssrv::sf::IMemoryStressor

* Interface Changed: nn::fssrv::sf::IDeviceOperator

** Added: 222 - buffers: [0x6], inbytes: 0x10, outbytes: 0x0

** Added: 302 - inbytes: 0x4, outbytes: 0x0

* Interface Changed: nn::fssrv::sf::IFileSystemProxy

** Added: 1020 - inbytes: 0x0, outbytes: 0x0, outinterfaces: ['~~0x7100021290 [ID = 0xd3808bc8]~~']

** Added: 1020 - inbytes: 0x0, outbytes: 0x0, outinterfaces: ['nn::fssrv::sf::IMemoryStressor']

** Removed: 1100 - buffers: [0x5], inbytes: 0x0, outbytes: 0x0

** Added: 1101 - buffers: [0x5], inbytes: 0x4, outbytes: 0x0

Line 440:

Line 426:

** Added: 12 - inbytes: 0x8, outbytes: 0x0

** Added: 13 - inbytes: 0x8, outbytes: 0x0

* ~~Unknown~~ Interface ~~prev-version~~: ~~0x710001829C [ID = 0x5a340f8a]~~

* Interface Added: nn::hshl::IVsysVoltageSession

* Unknown Interface cur-version: ~~0x710001CE6C [ID = 0x5a340f8a]~~

* Unknown Interface cur-version: ~~0x710001D12C [ID = 0x07b4542c]~~

* Interface Changed: nn::hshl::IChargeSetterSession

** Added: 4 - inbytes: 0x1, outbytes: 0x0

* Interface Changed: nn::hshl::IManager

** ~~Changed~~: ~~9 - outinterfaces: ['0x710001829C [ID = 0x5a340f8a]']~~ -~~> ['0x710001CE6C [ID = 0x5a340f8a]'] (final state:~~ inbytes: 0x0, outbytes: 0x0, outinterfaces: ['~~0x710001CE6C [ID = 0x5a340f8a]'])~~

** Added: 11 - inbytes: 0x0, outbytes: 0x0, outinterfaces: ['nn::hshl::IVsysVoltageSession']

** Added: ~~11 - inbytes~~: ~~0x0, outbytes~~: ~~0x0, outinterfaces~~: ~~['0x710001D12C [ID = 0x07b4542c]~~']

** Added: 12 - inbytes: 0x0, outbytes: 0x1

* Interface Changed: nn::hshl::ISetterManager

Line 454:

Line 437:

* Interface Changed: nn::spl::detail::IEsInterface

** Added: 33 - buffers: [0x9, 0x9, 0x9], inbytes: 0x4, outbytes: 0x10

* ~~Unknown~~ Interface ~~cur-version~~: ~~0x7100021640 [ID = 0xd3808bc8]~~

* Interface Added: nn::fssrv::sf::IMemoryStressor

* Interface Changed: nn::fssrv::sf::IDeviceOperator

** Added: 222 - buffers: [0x6], inbytes: 0x10, outbytes: 0x0

** Added: 302 - inbytes: 0x4, outbytes: 0x0

* Interface Changed: nn::fssrv::sf::IFileSystemProxy

** Added: 1020 - inbytes: 0x0, outbytes: 0x0, outinterfaces: ['~~0x7100021640 [ID = 0xd3808bc8]~~']

** Added: 1020 - inbytes: 0x0, outbytes: 0x0, outinterfaces: ['nn::fssrv::sf::IMemoryStressor']

** Removed: 1100 - buffers: [0x5], inbytes: 0x0, outbytes: 0x0

** Added: 1101 - buffers: [0x5], inbytes: 0x4, outbytes: 0x0

Line 473:

Line 456:

* Interface Changed: nn::spl::detail::IEsInterface

** Added: 33 - buffers: [0x9, 0x9, 0x9], inbytes: 0x4, outbytes: 0x10

* ~~Unknown~~ Interface ~~cur-version~~: ~~0x7100021290 [ID = 0xd3808bc8]~~

* Interface Added: nn::fssrv::sf::IMemoryStressor

* Interface Changed: nn::fssrv::sf::IDeviceOperator

** Added: 222 - buffers: [0x6], inbytes: 0x10, outbytes: 0x0

** Added: 302 - inbytes: 0x4, outbytes: 0x0

* Interface Changed: nn::fssrv::sf::IFileSystemProxy

** Added: 1020 - inbytes: 0x0, outbytes: 0x0, outinterfaces: ['~~0x7100021290 [ID = 0xd3808bc8]~~']

** Added: 1020 - inbytes: 0x0, outbytes: 0x0, outinterfaces: ['nn::fssrv::sf::IMemoryStressor']

** Removed: 1100 - buffers: [0x5], inbytes: 0x0, outbytes: 0x0

** Added: 1101 - buffers: [0x5], inbytes: 0x4, outbytes: 0x0

Line 496:

Line 479:

** Added: 12 - inbytes: 0x8, outbytes: 0x0

** Added: 13 - inbytes: 0x8, outbytes: 0x0

* ~~Unknown~~ Interface ~~prev-version~~: ~~0x710001829C [ID = 0x5a340f8a]~~

* Interface Added: nn::hshl::IVsysVoltageSession

* Unknown Interface cur-version: ~~0x710001CE6C [ID = 0x5a340f8a]~~

* Unknown Interface cur-version: ~~0x710001D12C [ID = 0x07b4542c]~~

* Interface Changed: nn::hshl::IChargeSetterSession

** Added: 4 - inbytes: 0x1, outbytes: 0x0

* Interface Changed: nn::hshl::IManager

** ~~Changed~~: ~~9 - outinterfaces: ['0x710001829C [ID = 0x5a340f8a]']~~ -~~> ['0x710001CE6C [ID = 0x5a340f8a]'] (final state:~~ inbytes: 0x0, outbytes: 0x0, outinterfaces: ['~~0x710001CE6C [ID = 0x5a340f8a]'])~~

** Added: 11 - inbytes: 0x0, outbytes: 0x0, outinterfaces: ['nn::hshl::IVsysVoltageSession']

** Added: ~~11 - inbytes~~: ~~0x0, outbytes~~: ~~0x0, outinterfaces~~: ~~['0x710001D12C [ID = 0x07b4542c]~~']

** Added: 12 - inbytes: 0x0, outbytes: 0x1

* Interface Changed: nn::hshl::ISetterManager

Line 515:

Line 495:

Using updated master-key: master_key_11 (previously master_key_10). See [[NCA]] for the KeyGeneration listing.

==== Kernel ====

* Compiler/libc was upgraded, this results in various minor optimizations throughout the whole kernel.

** Many, many minor changes that this is almost certainly the cause for, e.g. KThread::SuspendRequest now calculates requested value as (0x10 << suspend_type) instead of (1 << (suspend_type + 4)).

** Biggest one is that sp/lr are now much more commonly not saved to stack until actually needed, if a function has a return path which does not make calls/does not need lr/sp saved.

* Initialize0 changes:

** The physical base address of the kernel is now passed by KernelLdr for use during KernelSlab virtual memory region setup.

*** This replaces the previous call to KInitialPageTable::GetPhysicalAddress.

* SVC-handler accesses to the thread local region's disable count now use userspace access instructions.

* SvcSetHeapSize now only sets the output address on success.

** This wasn't a vulnerability before, because prior to this the ABI meant userland would receive whatever was in the userland register at call time.

* CreateProcessParameter now zeroes many fields before performing initialization.

* When making a deep copy of the KPageGroup for loading InitialProcess segments, a new helper with full error checking/etc is now used instead of doing the copy inline

* New CreateProcessFlag 0x2000 is "EnableReservedRegionExtraSize", when set the reserved region size is increased by (AddressSpaceSize / 8).

** Currently, CreateProcess will return svc::ResultInvalidState() unless all the following conditions are met:

*** Address space type must be 39-bit

*** System resource size must be > 0

*** KTargetSystem::IsDebugMode() must be true.

** New InfoType (0x1C) "InfoType_ReservedRegionExtraSize" retrieves the extra size, which is a member of KPageTableBase.

** Loader does not currently support passing this flag in any capacity yet.

** nn::os::VammManager currently calculates the reserved region as [start, end - extra size], and will not map to the extra part of the region.

* Various KPageTable(Base/Impl) changes:

** InitializeForProcess now takes in the create process flags directly instead of parsing as a bunch of bools.

** InitializeForProcess now performs much more complicated initialization/randomization of the four aslr'd regions, dividing them up before/after the process code using largest-region first selection for randomization order.

** KPageTableImpl's traversal functions now take an additional output byte (which is also a new member at +0x11 in the traversal block and in KMemoryRange), this is always set to zero.

*** This byte is checked when traversing by ::Finalize and ::GetContiguousRangeWithMemoryState, but not other page table functions.

*** This byte is also stored as a new member of the memory range struct returned by GetContiguousRangeWithMemoryState

** AllocateAndMapPagesImpl now takes in the page properties by reference instead of by value.

** Read/WriteReadDebugIoMemory now use simpler logic for determining the current readable size.

* The KMemoryBlock helper "ConvertToKMemoryPermission" was changed to only copy the user-write bit to KernelWrite.

** This fixes a longstanding bug where the input was AND'd with KMemoryPermission_UserReadWrite, and these bits were then ORR'd into the final permission <<='d with KernelShift.

** The intent here was to copy the user read/write permissions into the kernel read/write permissions, but KMemoryPermission_UserReadWrite is not bitmask 0x3, it's bitmask 0x1B (including the KernelRead/Write bits).

** Thus, previously this would allow an input with KernelRead bit to spuriously set the NotMapped bit, and an input with KernelWrite bit to spuriously set the unused top bit.

** This was unexploitable, except maybe for causing a kernel-mode access exception.

* HandleException now handles EsrEc_DataAbortEl0 specially when determining the debug exception type.

** When ESR_EL1.IFSC is 0b100001 ("Alignment Fault"), ExceptionType_UnalignedData is selected instead of ExceptionType_DataAbort.

* KMemoryManager(Impl)/KPageHeap changes:

** KPageHeap's heap_virtual_address member is now removed and is a part of KMemoryManagerImpl now (this is still unused in non-debug kernel).

** KMemoryManager::AllocatePageGroup now takes a parameter for the required minimum alignment for the page group.

*** This is currently passed as 1 page (minimum alignment) at all callsites.

* SecureMonitor access was refactored, actual smc invocation is now in its own helper separate from interrupt disable/enable (and helpers which invoke without interrupt disable now exist).

=== [[Audio_services|audio]] ===

Besides IPC changes, vulns were [[Switch_System_Flaws|fixed]].

=== [[JIT_services|jit]] ===

@@ Line 24: / Line 24: @@
 * ldn: Service access: added lm.
 * ns: Service access: added ldn:s.
+** ldn is currently unused in the main-codebin (on NX at least).
 * psc: Service access: added ovln:snd, psc:m.
 * ssl: Service access: added srepo:u, arp:r.
@@ Line 91: / Line 92: @@
 ** Added:      52 - inbytes: 0x8, outbytes: 0x0
 * Interface Removed: nn::ts::server::IMeasurementServer
-* Unknown Interface cur-version: 0x710006930C [ID = 0x26f251af]
+* Interface Added: nn::ts::server::ITsManager
 * Interface Changed: nn::psm::IPsmServer
 ** Added:      19 - inbytes: 0x0, outbytes: 0x0
 ** Added:      20 - inbytes: 0x0, outbytes: 0x0
 * Interface Removed: nn::socket::sf::IClient_MC
+* Interface Added: nn::socket::resolver::IPrivateResolver
 * Interface Added: nn::socket::sf::IClient
-* Unknown Interface cur-version: 0x71000D00F0 [ID = 0xb117a63f]
 * Interface Changed: nn::hid::IHidDebugServer
 ** Added:      18 - buffer_entry_sizes: [0x28], buffers: [0x5], inbytes: 0x8, outbytes: 0x0, pid: True
@@ Line 146: / Line 147: @@
 * Interface Changed: nn::audioctrl::detail::IAudioController
 ** Removed:     6 - inbytes: 0x4, outbytes: 0x1
-* Unknown Interface cur-version: 0x710002D294 [ID = 0xf8ed3aad]
+* Interface Added: nn::ldn::detail::IClientProcessMonitor
 * Interface Changed: nn::ldn::detail::ISystemLocalCommunicationService
 ** Added:     106 - inbytes: 0x4, outbytes: 0x0
@@ Line 157: / Line 158: @@
 ** Added:     601 - inbytes: 0x0, outbytes: 0x0
 * Interface Changed: nn::ldn::detail::ISystemServiceCreator
-** Added:       1 - inbytes: 0x0, outbytes: 0x0, outinterfaces: ['0x710002D294 [ID = 0xf8ed3aad]']
+** Added:       1 - inbytes: 0x0, outbytes: 0x0, outinterfaces: ['nn::ldn::detail::IClientProcessMonitor']
 * Interface Changed: nn::ldn::detail::IUserLocalCommunicationService
 ** Added:     106 - inbytes: 0x4, outbytes: 0x0
@@ Line 168: / Line 169: @@
 ** Added:     601 - inbytes: 0x0, outbytes: 0x0
 * Interface Changed: nn::ldn::detail::IUserServiceCreator
-** Added:       1 - inbytes: 0x0, outbytes: 0x0, outinterfaces: ['0x710002D294 [ID = 0xf8ed3aad]']
+** Added:       1 - inbytes: 0x0, outbytes: 0x0, outinterfaces: ['nn::ldn::detail::IClientProcessMonitor']
 * Unknown Interface prev-version: 0x7100005828
 * Unknown Interface cur-version: 0x7100005438
@@ Line 177: / Line 178: @@
 ** Added:      12 - inbytes: 0x8, outbytes: 0x0
 ** Added:      13 - inbytes: 0x8, outbytes: 0x0
-* Unknown Interface prev-version: 0x71000791B8 [ID = 0xf350e826]
-* Unknown Interface cur-version: 0x710007E200 [ID = 0xf350e826]
 * Interface Changed: nn::account::IAccountEntityServiceForAccountPolicy
 ** Added:     400 - buffers: [0x5], inbytes: 0x10, outbytes: 0x0
@@ Line 200: / Line 199: @@
 ** Added:     402 - buffers: [0x6], inbytes: 0x10, outbytes: 0x4
 * Interface Changed: nn::account::baas::IAdministrator
-** Changed:   170 - outinterfaces: ['0x71000791B8 [ID = 0xf350e826]'] -> ['0x710007E200 [ID = 0xf350e826]'] (final state: inbytes: 0x8, inhandles: [1], outbytes: 0x0, outinterfaces: ['0x710007E200 [ID = 0xf350e826]'])
 ** Added:     180 - buffer_entry_sizes: [0x1000, 0x100], buffers: [0x1A, 0x1A], inbytes: 0x4, outbytes: 0x0
 * Interface Changed: nn::account::baas::IFloatingRegistrationRequest
@@ Line 207: / Line 205: @@
 ** Added:      16 - buffers: [0x6], inbytes: 0x0, outbytes: 0x4
 * Interface Changed: nn::account::baas::IManagerForSystemService
-** Changed:   170 - outinterfaces: ['0x71000791B8 [ID = 0xf350e826]'] -> ['0x710007E200 [ID = 0xf350e826]'] (final state: inbytes: 0x8, inhandles: [1], outbytes: 0x0, outinterfaces: ['0x710007E200 [ID = 0xf350e826]'])
 ** Added:     180 - buffer_entry_sizes: [0x1000, 0x100], buffers: [0x1A, 0x1A], inbytes: 0x4, outbytes: 0x0
 * Interface Changed: nn::account::nas::IOAuthProcedureForExternalNsa
@@ Line 223: / Line 220: @@
 ** Added:      30 - inbytes: 0x0, outbytes: 0x10
 ** Added:     110 - buffer_entry_sizes: [0x80, 0x0], buffers: [0x19, 0x5], inbytes: 0x38, outbytes: 0x0
-* Unknown Interface prev-version: 0x71001BCD60 [ID = 0xf350e826]
-* Unknown Interface cur-version: 0x71001B0378 [ID = 0xf350e826]
 * Interface Changed: nn::account::IAccountServiceForAdministrator
 ** Added:     400 - buffers: [0x5], inbytes: 0x10, outbytes: 0x0
@@ Line 236: / Line 231: @@
 ** Added:     402 - buffers: [0x6], inbytes: 0x10, outbytes: 0x4
 * Interface Changed: nn::account::baas::IAdministrator
-** Changed:   170 - outinterfaces: ['0x71001BCD60 [ID = 0xf350e826]'] -> ['0x71001B0378 [ID = 0xf350e826]'] (final state: inbytes: 0x8, inhandles: [1], outbytes: 0x0, outinterfaces: ['0x71001B0378 [ID = 0xf350e826]'])
 ** Added:     180 - buffer_entry_sizes: [0x1000, 0x100], buffers: [0x1A, 0x1A], inbytes: 0x4, outbytes: 0x0
 * Interface Changed: nn::account::baas::IFloatingRegistrationRequest
@@ Line 243: / Line 237: @@
 ** Added:      16 - buffers: [0x6], inbytes: 0x0, outbytes: 0x4
 * Interface Changed: nn::account::baas::IManagerForSystemService
-** Changed:   170 - outinterfaces: ['0x71001BCD60 [ID = 0xf350e826]'] -> ['0x71001B0378 [ID = 0xf350e826]'] (final state: inbytes: 0x8, inhandles: [1], outbytes: 0x0, outinterfaces: ['0x71001B0378 [ID = 0xf350e826]'])
 ** Added:     180 - buffer_entry_sizes: [0x1000, 0x100], buffers: [0x1A, 0x1A], inbytes: 0x4, outbytes: 0x0
 * Interface Changed: nn::account::nas::IOAuthProcedureForExternalNsa
@@ Line 289: / Line 282: @@
 ** Added:    3101 - inbytes: 0x0, outbytes: 0x0, outhandles: [1], outinterfaces: ['nn::ns::detail::IAsyncResult']
 ** Added:    3102 - inbytes: 0x0, outbytes: 0x0
-* Unknown Interface prev-version: 0x71000182AC [ID = 0x5a340f8a]
+* Interface Added: nn::hshl::IVsysVoltageSession
-* Unknown Interface cur-version: 0x710001CE6C [ID = 0x5a340f8a]
-* Unknown Interface cur-version: 0x710001D12C [ID = 0x07b4542c]
 * Interface Changed: nn::hshl::IChargeSetterSession
 ** Added:       4 - inbytes: 0x1, outbytes: 0x0
 * Interface Changed: nn::hshl::IManager
-** Changed:     9 - outinterfaces: ['0x71000182AC [ID = 0x5a340f8a]'] -> ['0x710001CE6C [ID = 0x5a340f8a]'] (final state: inbytes: 0x0, outbytes: 0x0, outinterfaces: ['0x710001CE6C [ID = 0x5a340f8a]'])
+** Added:      11 - inbytes: 0x0, outbytes: 0x0, outinterfaces: ['nn::hshl::IVsysVoltageSession']
-** Added:      11 - inbytes: 0x0, outbytes: 0x0, outinterfaces: ['0x710001D12C [ID = 0x07b4542c]']
 ** Added:      12 - inbytes: 0x0, outbytes: 0x1
 * Interface Changed: nn::hshl::ISetterManager
@@ Line 312: / Line 302: @@
 ** Added:    2435 - inbytes: 0x10, outbytes: 0x0
 ** Added:    5000 - inbytes: 0x8, outbytes: 0x8
-* Unknown Interface cur-version: 0x71000B9398 [ID = 0xb8f77e09]
+* Interface Added: nn::am::service::INotificationReceiver
-* Unknown Interface cur-version: 0x71000B9D70 [ID = 0x43c5fa77]
+* Interface Added: nn::am::service::INotificationSender
-* Unknown Interface cur-version: 0x71000B9A78 [ID = 0xb0c7a8a3]
+* Interface Added: nn::am::service::IReceiverService
-* Unknown Interface cur-version: 0x71000B90A8 [ID = 0x8db727a9]
+* Interface Added: nn::am::service::ISenderService
 * Interface Changed: nn::am::service::IAppletCommonFunctions
 ** Added:      82 - inbytes: 0x1, outbytes: 0x0
-** Added:     160 - inbytes: 0x0, outbytes: 0x0, outinterfaces: ['0x71000B90A8 [ID = 0x8db727a9]']
+** Added:     160 - inbytes: 0x0, outbytes: 0x0, outinterfaces: ['nn::am::service::IReceiverService']
-** Added:     161 - inbytes: 0x0, outbytes: 0x0, outinterfaces: ['0x71000B9A78 [ID = 0xb0c7a8a3]']
+** Added:     161 - inbytes: 0x0, outbytes: 0x0, outinterfaces: ['nn::am::service::ISenderService']
 * Interface Changed: nn::am::service::IDebugFunctions
 ** Added:      53 - inbytes: 0x8, outbytes: 0x8
@@ Line 346: / Line 336: @@
 ** Added:   145601 - inbytes: 0x0, outbytes: 0x36
 ** Added:   195101 - inbytes: 0x36, outbytes: 0x0
-* Unknown Interface cur-version: 0x71000913E4 [ID = 0x10763728]
+* Interface Added: nn::npns::ISetNetworkServiceAccountIdTokenContext
 * Interface Changed: nn::npns::INotificationReceiver
 ** Added:       5 - buffers: [0x9], inbytes: 0x0, outbytes: 0x0
@@ Line 387: / Line 377: @@
 ** Changed:     1 - inbytes: 0x20 -> 0x28 (final state: inbytes: 0x28, inhandles: [1], outbytes: 0x0, outinterfaces: ['nn::grcsrv::IContinuousRecorder'])
 ** Added:      10 - inbytes: 0x20, outbytes: 0x0, outinterfaces: ['nn::grcsrv::IContinuousRecorder']
-* Interface Removed: nn::jitsrv::IJitEnvironment
-* Interface Removed: nn::jitsrv::IJitService
 * Interface Added: nn::sf::hipc::detail::IHipcManager
-* Unknown Interface cur-version: 0x7100000680 [ID = 0x3d92e8a4]
-* Unknown Interface cur-version: 0x71000009C4 [ID = 0x2a4c2069]
 * Interface Changed: nn::capsrv::sf::IDecoderControlService
 ** Added:    4002 - buffers: [0x46, 0x5], inbytes: 0x30, outbytes: 0x8
-* Unknown Interface cur-version: 0x710011CA80 [ID = 0x7e450fad]
+* Interface Added: nn::olsc::srv::IServiceGetter
 * Interface Changed: nn::spsm::detail::IPowerStateInterface
 ** Added:      15 - inbytes: 0x4, outbytes: 0x0
 ** Added:      16 - inbytes: 0x8, outbytes: 0x0
-* Unknown Interface cur-version: 0x7100021640 [ID = 0xd3808bc8]
+* Interface Added: nn::fssrv::sf::IMemoryStressor
 * Interface Changed: nn::fssrv::sf::IDeviceOperator
 ** Added:     222 - buffers: [0x6], inbytes: 0x10, outbytes: 0x0
 ** Added:     302 - inbytes: 0x4, outbytes: 0x0
 * Interface Changed: nn::fssrv::sf::IFileSystemProxy
-** Added:    1020 - inbytes: 0x0, outbytes: 0x0, outinterfaces: ['0x7100021640 [ID = 0xd3808bc8]']
+** Added:    1020 - inbytes: 0x0, outbytes: 0x0, outinterfaces: ['nn::fssrv::sf::IMemoryStressor']
 ** Removed:  1100 - buffers: [0x5], inbytes: 0x0, outbytes: 0x0
 ** Added:    1101 - buffers: [0x5], inbytes: 0x4, outbytes: 0x0
@@ Line 417: / Line 403: @@
 * Interface Changed: nn::spl::detail::IEsInterface
 ** Added:      33 - buffers: [0x9, 0x9, 0x9], inbytes: 0x4, outbytes: 0x10
-* Unknown Interface cur-version: 0x7100021290 [ID = 0xd3808bc8]
+* Interface Added: nn::fssrv::sf::IMemoryStressor
 * Interface Changed: nn::fssrv::sf::IDeviceOperator
 ** Added:     222 - buffers: [0x6], inbytes: 0x10, outbytes: 0x0
 ** Added:     302 - inbytes: 0x4, outbytes: 0x0
 * Interface Changed: nn::fssrv::sf::IFileSystemProxy
-** Added:    1020 - inbytes: 0x0, outbytes: 0x0, outinterfaces: ['0x7100021290 [ID = 0xd3808bc8]']
+** Added:    1020 - inbytes: 0x0, outbytes: 0x0, outinterfaces: ['nn::fssrv::sf::IMemoryStressor']
 ** Removed:  1100 - buffers: [0x5], inbytes: 0x0, outbytes: 0x0
 ** Added:    1101 - buffers: [0x5], inbytes: 0x4, outbytes: 0x0
@@ Line 440: / Line 426: @@
 ** Added:      12 - inbytes: 0x8, outbytes: 0x0
 ** Added:      13 - inbytes: 0x8, outbytes: 0x0
-* Unknown Interface prev-version: 0x710001829C [ID = 0x5a340f8a]
+* Interface Added: nn::hshl::IVsysVoltageSession
-* Unknown Interface cur-version: 0x710001CE6C [ID = 0x5a340f8a]
-* Unknown Interface cur-version: 0x710001D12C [ID = 0x07b4542c]
 * Interface Changed: nn::hshl::IChargeSetterSession
 ** Added:       4 - inbytes: 0x1, outbytes: 0x0
 * Interface Changed: nn::hshl::IManager
-** Changed:     9 - outinterfaces: ['0x710001829C [ID = 0x5a340f8a]'] -> ['0x710001CE6C [ID = 0x5a340f8a]'] (final state: inbytes: 0x0, outbytes: 0x0, outinterfaces: ['0x710001CE6C [ID = 0x5a340f8a]'])
+** Added:      11 - inbytes: 0x0, outbytes: 0x0, outinterfaces: ['nn::hshl::IVsysVoltageSession']
-** Added:      11 - inbytes: 0x0, outbytes: 0x0, outinterfaces: ['0x710001D12C [ID = 0x07b4542c]']
 ** Added:      12 - inbytes: 0x0, outbytes: 0x1
 * Interface Changed: nn::hshl::ISetterManager
@@ Line 454: / Line 437: @@
 * Interface Changed: nn::spl::detail::IEsInterface
 ** Added:      33 - buffers: [0x9, 0x9, 0x9], inbytes: 0x4, outbytes: 0x10
-* Unknown Interface cur-version: 0x7100021640 [ID = 0xd3808bc8]
+* Interface Added: nn::fssrv::sf::IMemoryStressor
 * Interface Changed: nn::fssrv::sf::IDeviceOperator
 ** Added:     222 - buffers: [0x6], inbytes: 0x10, outbytes: 0x0
 ** Added:     302 - inbytes: 0x4, outbytes: 0x0
 * Interface Changed: nn::fssrv::sf::IFileSystemProxy
-** Added:    1020 - inbytes: 0x0, outbytes: 0x0, outinterfaces: ['0x7100021640 [ID = 0xd3808bc8]']
+** Added:    1020 - inbytes: 0x0, outbytes: 0x0, outinterfaces: ['nn::fssrv::sf::IMemoryStressor']
 ** Removed:  1100 - buffers: [0x5], inbytes: 0x0, outbytes: 0x0
 ** Added:    1101 - buffers: [0x5], inbytes: 0x4, outbytes: 0x0
@@ Line 473: / Line 456: @@
 * Interface Changed: nn::spl::detail::IEsInterface
 ** Added:      33 - buffers: [0x9, 0x9, 0x9], inbytes: 0x4, outbytes: 0x10
-* Unknown Interface cur-version: 0x7100021290 [ID = 0xd3808bc8]
+* Interface Added: nn::fssrv::sf::IMemoryStressor
 * Interface Changed: nn::fssrv::sf::IDeviceOperator
 ** Added:     222 - buffers: [0x6], inbytes: 0x10, outbytes: 0x0
 ** Added:     302 - inbytes: 0x4, outbytes: 0x0
 * Interface Changed: nn::fssrv::sf::IFileSystemProxy
-** Added:    1020 - inbytes: 0x0, outbytes: 0x0, outinterfaces: ['0x7100021290 [ID = 0xd3808bc8]']
+** Added:    1020 - inbytes: 0x0, outbytes: 0x0, outinterfaces: ['nn::fssrv::sf::IMemoryStressor']
 ** Removed:  1100 - buffers: [0x5], inbytes: 0x0, outbytes: 0x0
 ** Added:    1101 - buffers: [0x5], inbytes: 0x4, outbytes: 0x0
@@ Line 496: / Line 479: @@
 ** Added:      12 - inbytes: 0x8, outbytes: 0x0
 ** Added:      13 - inbytes: 0x8, outbytes: 0x0
-* Unknown Interface prev-version: 0x710001829C [ID = 0x5a340f8a]
+* Interface Added: nn::hshl::IVsysVoltageSession
-* Unknown Interface cur-version: 0x710001CE6C [ID = 0x5a340f8a]
-* Unknown Interface cur-version: 0x710001D12C [ID = 0x07b4542c]
 * Interface Changed: nn::hshl::IChargeSetterSession
 ** Added:       4 - inbytes: 0x1, outbytes: 0x0
 * Interface Changed: nn::hshl::IManager
-** Changed:     9 - outinterfaces: ['0x710001829C [ID = 0x5a340f8a]'] -> ['0x710001CE6C [ID = 0x5a340f8a]'] (final state: inbytes: 0x0, outbytes: 0x0, outinterfaces: ['0x710001CE6C [ID = 0x5a340f8a]'])
+** Added:      11 - inbytes: 0x0, outbytes: 0x0, outinterfaces: ['nn::hshl::IVsysVoltageSession']
-** Added:      11 - inbytes: 0x0, outbytes: 0x0, outinterfaces: ['0x710001D12C [ID = 0x07b4542c]']
 ** Added:      12 - inbytes: 0x0, outbytes: 0x1
 * Interface Changed: nn::hshl::ISetterManager
@@ Line 515: / Line 495: @@
 Using updated master-key: master_key_11 (previously master_key_10). See [[NCA]] for the KeyGeneration listing.
+==== Kernel ====
+* Compiler/libc was upgraded, this results in various minor optimizations throughout the whole kernel.
+** Many, many minor changes that this is almost certainly the cause for, e.g. KThread::SuspendRequest now calculates requested value as (0x10 << suspend_type) instead of (1 << (suspend_type + 4)).
+** Biggest one is that sp/lr are now much more commonly not saved to stack until actually needed, if a function has a return path which does not make calls/does not need lr/sp saved.
+* Initialize0 changes:
+** The physical base address of the kernel is now passed by KernelLdr for use during KernelSlab virtual memory region setup.
+*** This replaces the previous call to KInitialPageTable::GetPhysicalAddress.
+* SVC-handler accesses to the thread local region's disable count now use userspace access instructions.
+* SvcSetHeapSize now only sets the output address on success.
+** This wasn't a vulnerability before, because prior to this the ABI meant userland would receive whatever was in the userland register at call time.
+* CreateProcessParameter now zeroes many fields before performing initialization.
+* When making a deep copy of the KPageGroup for loading InitialProcess segments, a new helper with full error checking/etc is now used instead of doing the copy inline
+* New CreateProcessFlag 0x2000 is "EnableReservedRegionExtraSize", when set the reserved region size is increased by (AddressSpaceSize / 8).
+** Currently, CreateProcess will return svc::ResultInvalidState() unless all the following conditions are met:
+*** Address space type must be 39-bit
+*** System resource size must be > 0
+*** KTargetSystem::IsDebugMode() must be true.
+** New InfoType (0x1C) "InfoType_ReservedRegionExtraSize" retrieves the extra size, which is a member of KPageTableBase.
+** Loader does not currently support passing this flag in any capacity yet.
+** nn::os::VammManager currently calculates the reserved region as [start, end - extra size], and will not map to the extra part of the region.
+* Various KPageTable(Base/Impl) changes:
+** InitializeForProcess now takes in the create process flags directly instead of parsing as a bunch of bools.
+** InitializeForProcess now performs much more complicated initialization/randomization of the four aslr'd regions, dividing them up before/after the process code using largest-region first selection for randomization order.
+** KPageTableImpl's traversal functions now take an additional output byte (which is also a new member at +0x11 in the traversal block and in KMemoryRange), this is always set to zero.
+*** This byte is checked when traversing by ::Finalize and ::GetContiguousRangeWithMemoryState, but not other page table functions.
+*** This byte is also stored as a new member of the memory range struct returned by GetContiguousRangeWithMemoryState
+** AllocateAndMapPagesImpl now takes in the page properties by reference instead of by value.
+** Read/WriteReadDebugIoMemory now use simpler logic for determining the current readable size.
+* The KMemoryBlock helper "ConvertToKMemoryPermission" was changed to only copy the user-write bit to KernelWrite.
+** This fixes a longstanding bug where the input was AND'd with KMemoryPermission_UserReadWrite, and these bits were then ORR'd into the final permission <<='d with KernelShift.
+** The intent here was to copy the user read/write permissions into the kernel read/write permissions, but KMemoryPermission_UserReadWrite is not bitmask 0x3, it's bitmask 0x1B (including the KernelRead/Write bits).
+** Thus, previously this would allow an input with KernelRead bit to spuriously set the NotMapped bit, and an input with KernelWrite bit to spuriously set the unused top bit.
+** This was unexploitable, except maybe for causing a kernel-mode access exception.
+* HandleException now handles EsrEc_DataAbortEl0 specially when determining the debug exception type.
+** When ESR_EL1.IFSC is 0b100001 ("Alignment Fault"), ExceptionType_UnalignedData is selected instead of ExceptionType_DataAbort.
+* KMemoryManager(Impl)/KPageHeap changes:
+** KPageHeap's heap_virtual_address member is now removed and is a part of KMemoryManagerImpl now (this is still unused in non-debug kernel).
+** KMemoryManager::AllocatePageGroup now takes a parameter for the required minimum alignment for the page group.
+*** This is currently passed as 1 page (minimum alignment) at all callsites.
+* SecureMonitor access was refactored, actual smc invocation is now in its own helper separate from interrupt disable/enable (and helpers which invoke without interrupt disable now exist).
+=== [[Audio_services|audio]] ===
+Besides IPC changes, vulns were [[Switch_System_Flaws|fixed]].
 === [[JIT_services|jit]] ===