NFC services

nfc:am

This is "nn::nfc::am::detail::IAmManager".

Cmd	Name
0	CreateAmInterface

IAm

This is "nn::nfc::am::detail::IAm".

Cmd	Name
0	Initialize
1	Finalize
2	NotifyForegroundApplet

nfc:mf:u

This is "nn::nfc::mifare::detail::IUserManager".

Cmd	Name
0	CreateUserInterface

IUser

This is "nn::nfc::mifare::detail::IUser".

Cmd	Name
0	#Initialize
1	#Finalize
2	#ListDevices
3	StartDetection
4	#StopDetection
5	Read
6	Write
7	#GetTagInfo
8	GetActivateEventHandle
9	GetDeactivateEventHandle
10	#GetState
11	#GetDeviceState
12	#GetNpadId
13	[3.0.0+] GetAvailabilityChangeEventHandle

nfc:user

This is "nn::nfc::detail::IUserManager".

Cmd	Name
0	CreateUserInterface

IUser

This is "nn::nfc::detail::IUser".

Cmd	Name
0	InitializeOld
1	FinalizeOld
2	#GetStateOld
3	#IsNfcEnabledOld
400	[4.0.0+] #Initialize
401	[4.0.0+] #Finalize
402	[4.0.0+] #GetState
403	[4.0.0+] #IsNfcEnabled
404	[4.0.0+] #ListDevices
405	[4.0.0+] #GetDeviceState
406	[4.0.0+] #GetNpadId
407	[4.0.0+] #AttachAvailabilityChangeEvent
408	[4.0.0+] #StartDetection
409	[4.0.0+] #StopDetection
410	[4.0.0+] #GetTagInfo
411	[4.0.0+] #AttachActivateEvent
412	[4.0.0+] #AttachDeactivateEvent
1000	[4.0.0+] #ReadMifare
1001	[4.0.0+] #WriteMifare
1300	[4.0.0+] #SendCommandByPassThrough
1301	[4.0.0+] #KeepPassThroughSession
1302	[4.0.0+] #ReleasePassThroughSession

GetStateOld

No input, returns an output u32.

IsNfcEnabledOld

No input, returns an output bool.

This runs the same code as #IsNfcEnabled.

GetState

No input, returns an output u32.

This replaces #GetStateOld.

IsNfcEnabled

No input, returns an output bool.

This replaces #IsNfcEnabledOld.

StartDetection

Takes an input #DeviceHandle and a #NfcProtocol, no output.

StopDetection

Takes an input #DeviceHandle, no output.

ReadMifare

Takes an input #DeviceHandle, a type-0x6 output buffer containing an array of #MifareReadBlockData, a type-0x5 input buffer containing an array of #MifareReadBlockParameter, no output.

sdknso passes the same user-specified array-count for both buffers.

WriteMifare

Takes an input #DeviceHandle, a type-0x5 input buffer containing an array of #MifareWriteBlockParameter, no output.

SendCommandByPassThrough

Takes an input #DeviceHandle, a nn::TimeSpan timeout, a type-0x6 output buffer, a type-0x5 input buffer, returns an output u32 out_size.

sdknso copies the output u32 into an u64. This is the actual size which was copied into the output buffer.

This allows using a raw NFC command. The input buffer contains the command data (id + params), and the output buffer contains the response.

KeepPassThroughSession

Takes an input #DeviceHandle, no output.

ReleasePassThroughSession

Takes an input #DeviceHandle, no output.

nfc:sys

This is "nn::nfc::detail::ISystemManager".

Cmd	Name
0	CreateSystemInterface

ISystem

This is "nn::nfc::detail::ISystem".

Cmd	Name
0	#Initialize
1	#Finalize
2	#GetStateOld
3	#IsNfcEnabledOld
100	#SetNfcEnabledOld
400	[4.0.0+] InitializeSystem
401	[4.0.0+] FinalizeSystem
402	[4.0.0+] #GetState
403	[4.0.0+] #IsNfcEnabled
404	[4.0.0+] #ListDevices
405	[4.0.0+] #GetDeviceState
406	[4.0.0+] #GetNpadId
407	[4.0.0+] #AttachAvailabilityChangeEvent
408	[4.0.0+] #StartDetection
409	[4.0.0+] #StopDetection
410	[4.0.0+] #GetTagInfo
411	[4.0.0+] #AttachActivateEvent
412	[4.0.0+] #AttachDeactivateEvent
500	[4.0.0+] #SetNfcEnabled
510	[7.0.0+] #OutputTestWave
1000	[4.0.0+] #ReadMifare
1001	[4.0.0+] #WriteMifare
1300	[4.0.0+] #SendCommandByPassThrough
1301	[4.0.0+] #KeepPassThroughSession
1302	[4.0.0+] #ReleasePassThroughSession

SetNfcEnabledOld

Takes an input bool, no output.

This runs the same code as #SetNfcEnabled.

SetNfcEnabled

Takes an input bool, no output.

This replaces #SetNfcEnabledOld.

OutputTestWave

Takes an input bool and a #TestWaveType, no output.

nfp services

These are used for amiibo support (nfp = Nintendo Figurine Protocol, internal name for amiibo protocol)

nfp:user

This is "nn::nfp::detail::IUserManager".

Cmd	Name
0	CreateUserInterface

IUser

This is "nn::nfp::detail::IUser".

Cmd	Name
0	Initialize
1	Finalize
2	#ListDevices
3	#StartDetection
4	#StopDetection
5	#Mount
6	#Unmount
7	#OpenApplicationArea
8	#GetApplicationArea
9	#SetApplicationArea
10	#Flush
11	#Restore
12	#CreateApplicationArea
13	#GetTagInfo
14	#GetRegisterInfo
15	#GetCommonInfo
16	#GetModelInfo
17	#AttachActivateEvent
18	#AttachDeactivateEvent
19	#GetState
20	#GetDeviceState
21	#GetNpadId
22	#GetApplicationAreaSize
23	[3.0.0+] #AttachAvailabilityChangeEvent
24	[3.0.0+] #RecreateApplicationArea

nfp:sys

This is "nn::nfp::detail::ISystemManager".

Cmd	Name
0	CreateSystemInterface

ISystem

This is "nn::nfp::detail::ISystem".

Cmd	Name
0	InitializeSystem
1	FinalizeSystem
2	#ListDevices
3	#StartDetection
4	#StopDetection
5	#Mount
6	#Unmount
10	#Flush
11	#Restore
13	#GetTagInfo
14	#GetRegisterInfo
15	#GetCommonInfo
16	#GetModelInfo
17	#AttachActivateEvent
18	#AttachDeactivateEvent
19	#GetState
20	#GetDeviceState
21	#GetNpadId
23	[3.0.0+] #AttachAvailabilityChangeEvent
100	#Format
101	#GetAdminInfo
102	#GetRegisterInfoPrivate
103	#SetRegisterInfoPrivate
104	#DeleteRegisterInfo
105	#DeleteApplicationArea
106	#ExistsApplicationArea

nfp:dbg

This is "nn::nfp::detail::IDebugManager".

Cmd	Name
0	CreateDebugInterface

IDebug

This is "nn::nfp::detail::IDebug".

Cmd	Name
0	InitializeDebug
1	FinalizeDebug
2	#ListDevices
3	#StartDetection
4	#StopDetection
5	#Mount
6	#Unmount
7	#OpenApplicationArea
8	#GetApplicationArea
9	#SetApplicationArea
10	#Flush
11	#Restore
12	#CreateApplicationArea
13	#GetTagInfo
14	#GetRegisterInfo
15	#GetCommonInfo
16	#GetModelInfo
17	#AttachActivateEvent
18	#AttachDeactivateEvent
19	#GetState
20	#GetDeviceState
21	#GetNpadId
22	#GetApplicationAreaSize
23	[3.0.0+] #AttachAvailabilityChangeEvent
24	[3.0.0+] #RecreateApplicationArea
100	#Format
101	#GetAdminInfo
102	#GetRegisterInfoPrivate
103	#SetRegisterInfoPrivate
104	#DeleteRegisterInfo
105	#DeleteApplicationArea
106	#ExistsApplicationArea
200	#GetAll
201	#SetAll
202	#FlushDebug
203	#BreakTag
204	#ReadBackupData
205	#WriteBackupData
206	#WriteNtf
300	[3.0.0-3.0.2]
301	[3.0.0-3.0.2]
302	[3.0.0-3.0.2]
303	[3.0.0-3.0.2]
304	[3.0.0-3.0.2]
305	[3.0.0-3.0.2]
306	[3.0.0-3.0.2]
307	[3.0.0-3.0.2]
308	[3.0.0-3.0.2]
309	[3.0.0-3.0.2]
310	[3.0.0-3.0.2]
311	[3.0.0-3.0.2]
312	[3.0.0-3.0.2]
313	[3.0.0-3.0.2]
314	[3.0.0-3.0.2]

GetAll

Takes an input #DeviceHandle, a type-0x1A output buffer containing #NfpData, no output.

SetAll

Takes an input #DeviceHandle, a type-0x19 input buffer containing #NfpData, no output.

FlushDebug

Takes an input #DeviceHandle, no output.

BreakTag

Takes an input #DeviceHandle, an input u32 #BreakType, no output.

ReadBackupData

Takes an input #DeviceHandle, a type-0x6 output buffer, and an output u32 (read_size).

WriteBackupData

Takes an input #DeviceHandle, a type-0x5 input buffer, no output.

The buffer size must be less or equal than 0x1FBD20.

WriteNtf

Takes an input #DeviceHandle, an input u32 #WriteType, a type-0x5 input buffer, no output.

The input buffer size must match 0x2A0. This handles Amiibo crypto, etc.

Common

Create*Interface

Returns an output interface (#IUser, #ISystem or #IDebug depending on the service).

Initialize*

Takes a PID, an AppletResourceUserId, an u64 placeholder for the PID, a type-0x5 input buffer containing an array of #RequiredMcuVersionData, no output.

Internally this is mostly the same for each service, this differs depending on the service/cmd however.

Finalize*

No input/output.

Internally this is mostly the same for each service, this differs depending on the service/cmd however.

ListDevices

Takes a type-0xA output buffer containing an array of #DeviceHandle, returns an output s32 total_out.

This can return a maximum of 0xA entries.

StartDetection

Takes an input #DeviceHandle, no output.

This runs the same code as nfc #StartDetection with #NfcProtocol = -1.

StopDetection

Takes an input #DeviceHandle, no output.

Mount

Takes an input #DeviceHandle, an input u32 #ModelType and an input u32 #MountTarget, no output.

Unmount

Takes an input #DeviceHandle, no output.

OpenApplicationArea

Takes an input #DeviceHandle and an input u32 #Access ID, no output.

The amiibo must be already using its application area with the input access ID (the game must have already created savedata there). Result 0x10073 will be returned if no application area exists, result 0x13073 will be returned if the application area is currently used with a different access ID.

GetApplicationArea

Takes an input #DeviceHandle and a type-0x6 output buffer, returns an output u32 size.

Reads the buffer data in the application area and returns the size read from the application area.

The application area needs to be opened first.

SetApplicationArea

Takes an input #DeviceHandle and a type-0x5 input buffer, no output.

Writes the buffer data in the application area.

The application area needs to be opened first.

Flush

Takes an input #DeviceHandle, no output.

Restore

Takes an input #DeviceHandle, no output.

CreateApplicationArea

Takes an input #DeviceHandle, an input u32 #Access ID and a type-0x5 input buffer, no output.

Creates the application area with the input access ID, and writes the buffer data there.

GetTagInfo

Takes an input #DeviceHandle and a type-0x1A output buffer containing a #TagInfo.

GetRegisterInfo

Takes an input #DeviceHandle and a type-0x1A output buffer containing a #RegisterInfo.

GetCommonInfo

Takes an input #DeviceHandle and a type-0x1A output buffer containing a #CommonInfo.

GetModelInfo

Takes an input #DeviceHandle and a type-0x1A output buffer containing a #ModelInfo.

AttachActivateEvent

Takes an input #DeviceHandle, returns an output Event handle.

sdknso uses EventClearMode=1.

AttachDeactivateEvent

Takes an input #DeviceHandle, returns an output Event handle.

sdknso uses EventClearMode=1.

GetState

Returns an output u32 #State.

GetDeviceState

Takes an input #DeviceHandle, returns an output u32 #DeviceState.

The returned state is loaded from a lookup table. nfp services uses the same table, mifare uses a separate one, and the nfc services use another separate table.

GetNpadId

Takes an input #DeviceHandle, returns an output u32 NpadId.

GetApplicationAreaSize

Takes an input #DeviceHandle, returns an output u32 size.

Actually returns a hardcoded value of 0xD8.

AttachAvailabilityChangeEvent

No input, returns an output Event handle.

sdknso uses EventClearMode=1.

RecreateApplicationArea

Takes an input #DeviceHandle, an input u32 #Access ID and a type-0x5 input buffer, no output.

Recreates the application area with the input access ID, and writes the buffer data there.

Format

Takes an input #DeviceHandle, no output.

GetAdminInfo

Takes an input #DeviceHandle and a type-0x1A output buffer containing a #AdminInfo.

GetRegisterInfoPrivate

Takes an input #DeviceHandle and a type-0x1A output buffer containing a #RegisterInfoPrivate.

SetRegisterInfoPrivate

Takes an input #DeviceHandle and a type-0x19 input buffer containing a #RegisterInfoPrivate.

DeleteRegisterInfo

Takes an input #DeviceHandle, no output.

DeleteApplicationArea

Takes an input #DeviceHandle, no output.

ExistsApplicationArea

Takes an input #DeviceHandle, returns an output u8/bool.

RequiredMcuVersionData

In sdknso, the global data containing the array data for this is "nn::nfc::client::RequiredMcuVersionData". The array entry is 0x20-bytes.

DeviceHandle

This is "nn::nfc::DeviceHandle". This is a 8-byte struct with 4-byte alignment.

NfcProtocol

This is s32 enum "nn::nfc::NfcProtocol". Value -1 can be used as a default.

TestWaveType

This is u32 enum "nn::nfc::TestWaveType".

MifareKey

This is a 0x10-byte struct.

Offset	Size	Description
0x0	0x1	MifareCommand
0x1	0x1	Unknown
0x2	0x6	Padding
0x8	0x6	Key data
0xE	0x2	Padding

MifareReadBlockData

This is "nn::nfc::MifareReadBlockData". This is a 0x18-byte struct.

Offset	Size	Description
0x0	0x10	Data
0x10	0x1	Block index
0x11	0x7	Padding

MifareReadBlockParameter

This is "nn::nfc::MifareReadBlockParameter". This is a 0x18-byte struct.

Offset	Size	Description
0x0	0x1	Block index
0x1	0x7	Padding
0x8	0x10	#MifareKey

MifareWriteBlockParameter

This is "nn::nfc::MifareWriteBlockParameter". This is a 0x28-byte struct.

Offset	Size	Description
0x0	0x10	Data
0x10	0x1	Block index
0x11	0x7	Padding
0x18	0x10	#MifareKey

State

Value	Description
0	NonInitialized
1	Initialized

DeviceState

Value	Description
0	Initialized
1	Searching for tag
2	Tag found
3	Tag removed
4	Tag mounted
5	Unavailable
6	Finalized

ModelType

Value	Description
0	Amiibo

MountTarget

Value	Description
1	ROM
2	RAM
3	All

Date

This is "nn::nfp::Date":

Offset	Size	Description
0x0	0x2	Year
0x2	0x1	Month
0x3	0x1	Day

TagInfo

This is "nn::nfp::TagInfo". This is a 0x58-byte struct.

Offset	Size	Description
0x0	0xA	UUID
0xA	0x1	UUID length
0xB	0x15	Reserved
0x20	0x4	Protocol
0x24	0x4	Tag type
0x28	0x30	Reserved

RegisterInfo

This is "nn::nfp::RegisterInfo". This is a 0x100-byte struct.

Offset	Size	Description
0x0	0x58	Mii CharInfo (see mii services)
0x58	0x4	First write date (see #Date)
0x5C	0x29	Amiibo name (NUL-terminated UTF-8 string)
0x85	0x1	Font region
0x86	0x7A	Reserved

CommonInfo

This is ""nn::nfp::CommonInfo". This is a 0x40-byte struct.

Offset	Size	Description
0x0	0x4	Last write date (see #Date)
0x4	0x2	Write counter
0x6	0x1	Version
0x7	0x1	Padding
0x8	0x4	Application area size (hardcoded to be 0xD8, like in #GetApplicationAreaSize)
0xC	0x34	Reserved

ModelInfo

This is "nn::nfp::ModelInfo". This is a 0x40-byte struct.

Offset	Size	Description
0x0	0x2	Game and character ID
0x2	0x1	Character variant
0x3	0x1	Figure type
0x4	0x2	Model number
0x6	0x1	Series
0x7	0x39	Reserved

AdminInfo

This is "nn::nfp::AdminInfo". This is a 0x40-byte struct.

Offset	Size	Description
0x0	0x8	Program ID (From the Wii U, 3DS or Switch title who created the application area)
0x8	0x4	#Access ID
0xC	0x2	CRC32 change counter
0xE	0x1	Flags (bit0 = amiibo was initialized in console settings, bit1 = has application area, bit2/bit3 unknown)
0xF	0x1	Unknown, hardcoded to 0x2
0x10	0x1	0xFF if there is no application area, related to the console of the application area game otherwise (0/2 = 3DS, 1 = Wii U, 3 = Switch)
0x11	0x7	Padding
0x18	0x28	Reserved

RegisterInfoPrivate

This is "nn::nfp::RegisterInfoPrivate". This is a 0x100-byte struct.

This is almost identical to #RegisterInfo, but containing mii data as a StoreData instead of a CharInfo and more reserved bytes.

Offset	Size	Description
0x0	0x44	Mii StoreData (see mii services)
0x44	0x4	First write date (see #Date)
0x48	0x29	Amiibo name (NUL-terminated string)
0x71	0x1	Unknown
0x72	0x8E	Reserved

NfpData

This is "nn::nfp::NfpData". This is a 0x298-byte struct.

Offset	Size	Description
0x0	0x1	Magic (Always 0xA5)
0x1	0x1	Reserved
0x2	0x1	Write counter
0x3	0x1	Reserved
0x4	0x4	Settings CRC32
0x8	0x38	Reserved
0x40	0x40	#CommonInfo
0x80	0x5C	Mii char info V3 (see https://www.3dbrew.org/wiki/Mii#Mii_format)
0xDC	0x2	Padding
0xDE	0x2	Mii char info V3 CRC16
0xE0	0x8	Mii StoreDataExtension
0xE8	0x4	First write date (see #Date)
0xEC	0xB * 2	Amiibo name (NUL-terminated UTF-16 string)
0x102	0x1	Settings flags (bit4 = amiibo was initialized in console settings, bit5 = has application area)
0x103	0x1	Unknown, normally zero
0x104	0x4	Register Info CRC32
0x108	0x4 * 5	Unknown, normally zero
0x11c	0x64	Reserved
0x180	0x8	Program ID (From the Wii U, 3DS or Switch title who created the application area)
0x188	0x4	#Access ID
0x18c	0x2	Settings CRC32 change counter
0x18e	0x1	Font region
0x18f	0x1	Tag type, hardcoded to 0x2
0x190	0x1	Console type, (3DS = 0, Wiiu = 1, 3DSv2 = 2, switch = 3, not set = 0xFF)
0x191	0x1	(Original Program ID >> 0x24) & 0xF byte (Program ID has this byte swapped with console type)
0x192	0x2E	Reserved
0x1c0	0xd8	Application area data

BreakType

This is "nn::nfp::BreakType".

Value	Description
0	?
1	?
2	?

Value 0 is internally used in some places, aside for #BreakTag commands called externally.

WriteType

This is "nn::nfp::WriteType".

Value	Description
0	?
1	?

Access ID

Access IDs are game-unique u32s used to access the amiibo application area.

For a list of Nintendo 3DS access IDs, see https://www.3dbrew.org/wiki/Amiibo#Games_using_Amiibo_AppData.

Nintendo Switch titles

Game	Access ID
Splatoon 2	0x10162B00
Shovel Knight: Treasure Trove	0x1016E100
The Legend of Zelda: Breath of the Wild	0x1019C800
Super Smash Bros. Ultimate	0x34F80200
Splatoon 3	0x38600500
The Legend of Zelda: Link's Awakening	0x3B440400

RomFS

[9.0.0+] The nfc-sysmodule RomFS contains:

 ST21NFCD_01_05_6811.bin

These are firmware files for the NFC IC inside Switch Lite units.