NPDM

This is the Switch equivalent of 3DS exheader. This is the file with extension ".npdm" in {Switch ExeFS}. The size of this file varies.

Offset	Size	Description
0x0	0x80	META
0x80	<Varies>	ACID
<See META>	<See META>	ACI0

META

Offset	Size	Description
0x0	0x4	Magic "META".
0x20	?	Title name
0x70	0x4	#ACI0 offset
0x74	0x4	#ACI0 size
0x78	0x4	#ACID offset
0x7C	0x4	#ACID size

ACID

Offset	Size	Description
0	0x100	RSA-2048 signature
0x100	0x100	RSA-2048 public key
0x200	0x4	Magic "ACID".
0x204	0x8	Zeroes
0x20C	0x4	Format version? (1)
0x210	0x8	Title id
0x218	0x8	Title id again
0x220	0x4	#FS Access Control offset
0x24	0x4	#FS Access Control size
0x28	0x4	#Service Access Control offset
0x2C	0x4	#Service Access Control size
0x30	4	#Kernel Access Control offset
0x34	4	#Kernel Access Control size
0x38	0x8	Padding

ACI0

Looks like an old crappy version of ACID. It has the guessed version field 0 instead of 1.

FS Access Control

Bit	Description
0	MountContent* is accessible when set.
3	This is only bit set for ShopN in the permissions-u32.

Service Access Control

This is a list of service-name strings which the title has access to, with the following structure:

 +0: control_byte
 +1: {service-name without nul-terminator}

Bitmask 0x0F in control_byte is the {length of the service-name without nul-terminator} - 1.

Bitmask 0x80 in control_byte means service is allowed to be registered.

The service string can contain a wildcard * character.

Kernel Access Control

Like the 3DS, the switch has a number of kernel capability descriptors. Unlike 3ds, where descriptors were identified by pattern 11..10 in high bits, on switch descriptors are identified by pattern 01..11 in low bits.

Pattern of bits 20-31	Type	Fields
0bxxxxxxxx0111?	Interrupt info?	?
0bxxxxxxx01111	System call mask	Bits 29-31: System call mask table index; Bits 5-28: mask
0bxxxxx0111111?	Kernel release version?	?
0bxxxx01111111?	Handle table size?	?
0bxxx011111111?	Kernel flags?	?
0bx0111111111?	Map address range?	?
0b011111111111?	Map memory page?	?