This is the Switch equivalent of 3DS exheader. This is the file with extension ".npdm" in {Switch ExeFS}. The size of this file varies.
| Offset
|
Size
|
Description
|
| 0x0
|
0x80
|
META
|
| 0x80
|
<Varies>
|
ACID
|
| <See META>
|
<See META>
|
ACI0
|
META
| Offset
|
Size
|
Description
|
| 0x0
|
0x4
|
Magic "META".
|
| 0xE
|
1
|
|
| 0xF
|
1
|
|
| 0x1C
|
4
|
|
| 0x20
|
?
|
Title name
|
| 0x70
|
0x4
|
#ACI0 offset
|
| 0x74
|
0x4
|
#ACI0 size
|
| 0x78
|
0x4
|
#ACID offset
|
| 0x7C
|
0x4
|
#ACID size
|
ACID
| Offset
|
Size
|
Description
|
| 0
|
0x100
|
RSA-2048 signature, seems to verify the data starting at 0x100 with the size field from 0x204.
|
| 0x100
|
0x100
|
RSA-2048 public key, seems to be used for the second NCA signature.
|
| 0x200
|
0x4
|
Magic "ACID".
|
| 0x204
|
0x4
|
s32 Size field used with the above signature(?).
|
| 0x208
|
0x4
|
Zeroes
|
| 0x20C
|
0x4
|
Retail flag. Must be 1 on retail, on devunit 0 is also allowed.
|
| 0x210
|
0x8
|
Title id
|
| 0x218
|
0x8
|
Title id again
|
| 0x220
|
0x4
|
#FS Access Control offset
|
| 0x224
|
0x4
|
#FS Access Control size
|
| 0x228
|
0x4
|
#Service Access Control offset
|
| 0x22C
|
0x4
|
#Service Access Control size
|
| 0x230
|
4
|
#Kernel Access Control offset
|
| 0x234
|
4
|
#Kernel Access Control size
|
| 0x238
|
0x8
|
Padding
|
ACI0
Looks like an old crappy version of ACID. It has the guessed version field 0 instead of 1.
FS Access Control
| Word
|
Bit
|
Description
|
| 0
|
|
Version? Always 1.
|
| 1
|
0
|
MountContent* is accessible when set.
|
| 1
|
2
|
Enables access to Bis partitionID 27 and 28?
|
Web-applets access control:
- "LibAppletWeb" and "LibAppletOff" have same access control: word0 bit0 set, word1 bit0 and bit3 set, and word2 bit30 set.
- Rest of the web-applets: Same as above except word1 bit0 isn't set.
Service Access Control
This is a list of service-name strings which the title has access to, with the following structure:
+0: control_byte
+1: {service-name without nul-terminator}
Bitmask 0x0F in control_byte is the {length of the service-name without nul-terminator} - 1.
Bitmask 0x80 in control_byte means service is allowed to be registered.
The service string can contain a wildcard * character.
Kernel Access Control
On Switch, descriptors are identified by pattern 01..11 in low bits.
| Pattern of lower bits
|
Type
|
Fields
|
0bxxxxxxxxxxxx0111
|
Kernel flags
|
Bit31-24: Highest allowed cpu id, bit23-16: Lowest allowed cpu id, bit15-10: Highest allowed thread prio, bit9-4: Lowest allowed thread prio
|
0bxxxxxxxxxxx01111
|
Syscall mask
|
Bits 29-31: Syscall mask table index; Bits 5-28: Mask
|
0bxxxxxxxxx0111111
|
Map IO page (RW)
|
Bits 7-31: Page
|
0bxxxxxxxx01111111
|
Map IO range
|
Bits 7-30: Alternating start page and number of pages, bit31: Alternating read-only flag then MemoryAttribute 0x2001/0x42002 selector flag
|
0bxxxx011111111111
|
Interrupt pair
|
Bits 12-21: Irq0, bits 20-31: Irq1, 0x3FF means empty.
|
0xxxx0111111111111
|
|
|
0xxx01111111111111
|
|
|
0xx011111111111111
|
|
|
0x0111111111111111
|
|
|
| All ones
|
Ignored
|
|