NPDM
This is the Switch equivalent of 3DS exheader. This is the file with extension ".npdm" in {Switch ExeFS}. The size of this file varies.
| Offset | Size | Description |
|---|---|---|
| 0x0 | 0x80 | META |
| 0x80 | <Varies> | ACID |
| <See META> | <See META> | ACI0 |
META
| Offset | Size | Description |
|---|---|---|
| 0x0 | 0x4 | Magic "META". |
| 0x4 | ||
| 0x8 | ||
| 0xC | 0x1 | Flags, bit0: 64-bit instructions, bits1-3: address space width (1=64-bit, 2=32-bit). Needs to be <= 0xF |
| 0xE | 0x1 | MainThreadPrio |
| 0xF | 0x1 | DefaultCpuId |
| 0x10 | ||
| 0x18 | 0x4 | ProcessCategory (0: regular title, 1: kernel built-in). Should be 0 here. |
| 0x1C | 0x4 | MainStackSize |
| 0x20 | ? | Title name |
| 0x70 | 0x4 | #ACI0 offset |
| 0x74 | 0x4 | #ACI0 size |
| 0x78 | 0x4 | #ACID offset |
| 0x7C | 0x4 | #ACID size |
ACID
| Offset | Size | Description |
|---|---|---|
| 0x0 | 0x100 | RSA-2048 signature, seems to verify the data starting at 0x100 with the size field from 0x204. |
| 0x100 | 0x100 | RSA-2048 public key, seems to be used for the second NCA signature. |
| 0x200 | 0x4 | Magic "ACID". |
| 0x204 | 0x4 | s32 Size field used with the above signature(?). |
| 0x208 | 0x4 | Zeroes |
| 0x20C | 0x4 | Flags. Bit0 must be 1 on retail, on devunit 0 is also allowed. Bit1 is unknown, set 1 for ARMS? Bit2 is set with web-applet with 5.0.0+. |
| 0x210 | 0x8 | TitleIdRange_Min |
| 0x218 | 0x8 | TitleIdRange_Max |
| 0x220 | 0x4 | #FS Access Control offset |
| 0x224 | 0x4 | #FS Access Control size |
| 0x228 | 0x4 | #Service Access Control offset |
| 0x22C | 0x4 | #Service Access Control size |
| 0x230 | 0x4 | #Kernel Access Control offset |
| 0x234 | 0x4 | #Kernel Access Control size |
| 0x238 | 0x8 | Padding |
ACI0
| Offset | Size | Description |
|---|---|---|
| 0x0 | 0x4 | Magic "ACI0". |
| 0x4 | 0xC | Zeroes |
| 0x10 | 0x8 | Title id |
| 0x18 | 0x8 | Lowest allowed title id? Always 0? |
| 0x20 | 0x4 | #FS Access Header offset |
| 0x24 | 0x4 | #FS Access Header size |
| 0x28 | 0x4 | #Service Access Control offset |
| 0x2C | 0x4 | #Service Access Control size |
| 0x30 | 0x4 | #Kernel Access Control offset |
| 0x34 | 0x4 | #Kernel Access Control size |
| 0x38 | 0x8 | Padding |
FS Access Header
| Offset | Size | Description |
|---|---|---|
| 0x0 | 0x1 | Version? Always 1. Must be non-zero. |
| 0x1 | 0x3 | Padding |
| 0x4 | 0x8 | Permissions bitmask |
| 0xC | 0x4 | Usually 0x1C |
| 0x10 | 0x4 | Usually 0x0 |
| 0x14 | 0x4 | Usually 0x1C |
| 0x18 | 0x4 | Usually 0x0 |
FS Access Control
| Offset | Size | Description |
|---|---|---|
| 0x0 | 0x1 | Version? Always 1. Must be non-zero. |
| 0x1 | 0x3 | Padding |
| 0x4 | 0x8 | Permissions bitmask |
| 0xC | 0x20 | Usually all zeroes for applications |
Permissions bitmask:
| Bit | Description |
|---|---|
| 0 | MountContent* is accessible when set. |
| 34 | Enables access to Bis partitionID 27 and 28? |
| 63 | Enables access to everything: all permission-types which check a bitmask have this bit set. |
For bit62 in permissions, see here.
Web-applets permissions:
- "LibAppletWeb" and "LibAppletOff" have same access control: bit0 and bit3 set, and bit62 set.
- Rest of the web-applets: Same as above except bit0 isn't set.
Service Access Control
This is a list of service-name strings which the title has access to, with the following structure:
+0: control_byte
+1: {service-name without nul-terminator}
Bitmask 0x0F in control_byte is the {length of the service-name without nul-terminator} - 1.
Bitmask 0x80 in control_byte means service is allowed to be registered.
The service string can contain a wildcard * character.
Kernel Access Control
On Switch, descriptors are identified by pattern 01..11 in low bits.
| Pattern of lower bits | Lowest clear bitmask/bit | Type | Fields |
|---|---|---|---|
0bxxxxxxxxxxxx0111
|
Bit3 | KernelFlags | Bit31-24: Highest allowed cpu id, bit23-16: Lowest allowed cpu id, bit15-10: Highest allowed thread prio, bit9-4: Lowest allowed thread prio |
0bxxxxxxxxxxx01111
|
Bit4 | SyscallMask | Bits 29-31: Syscall mask table index; Bits 5-28: Mask |
0bxxxxxxxxx0111111
|
Bit6 | MapIoOrNormalRange | Bits 7-30: Alternating start page and number of pages, bit31: Alternating read-only flag then MemoryAttribute 0x2001/0x42002 selector flag |
0bxxxxxxxx01111111
|
Bit7 | MapNormalPage (RW) | Bits 8-31: Page |
0bxxxx011111111111
|
Bit11 | InterruptPair | Bits 12-21: Irq0, bits 20-31: Irq1, 0x3FF means empty. |
0bxx01111111111111
|
Bit13 | ApplicationType | Bit16-14: ApplicationType (0=sysmodule, 1=application, 2=applet), bit16 ignored. Parsed by Process Manager services. Defaults to 0 if descriptor doesn't exist. Can only run 1 application at a time. |
0bx011111111111111
|
Bit14 | KernelReleaseVersion | Bits 15-X: Version. The raw descriptor is compared with 0x80000, when less than an error is returned. This is equivalent to comparing the bits starting at bit15 with 0x10. This enforces a minimum required version, not a maximum. |
0b0111111111111111
|
Bit15 | HandleTableSize | Bit25-16: Number of handles the table shall fit. |
0b1111111111111111
|
Bit16 | DebugFlags | Bit17: can be debugged, bit18: can debug others |
| All ones | Ignored |
Mapping restrictions
The physaddr range 0x80060000-0x2000000000 is not allowed to be mapped as IO. The physaddr range 0x80000000-0x2000000000 is not allowed to be mapped as Normal.
[2.0.0-4.1.0] The range for IO was changed into 0x80060000-0x81D3FFFF.
[2.0.0-4.1.0] A blacklist was added for IO and Normal mappings:
- 0x50040000-0x50060000 (ARM, Interrupt Controller)
- 0x6000F000 (Exception Vectors)
- 0x6001DC00-0x6001E000 (IPATCH)
- 0x7000E000 (RTC/PMC)
- 0x70019000 (MC)
- 0x7001C000 (MC0)
- 0x7001D000 (MC1)
[5.0.0+] For IO, this blacklist was abandoned and instead two range checks were added. For Normal mappings it is still applied
Kernel versions
| Firmware | Kernel Version | Minimum Allowed |
|---|---|---|
| 1.0.0 | 5.0.0 | 3.0.0 |
| 2.0.0 | 6.1.0 | 3.0.0 |
| 3.0.0 | 7.4.0 | 3.0.0 |
| 3.0.2 | 7.4.0 | 3.0.0 |
Bit31-19: Major version Bit18-15: Minor version Bit14-0: Zeroes