NIM services

ntc

Presumably Network Time Sync?

Network

• https://sun.hac.%%.d4c.nintendo.net/v1/system_update_meta?device_id=%016llx
• ...
• https://aqua.hac.%%.d4c.nintendo.net/required_system_update_meta?device_id=%016llx
• https://%s.hac.%%.d4c.nintendo.net/t/%c/%016llx/%u?device_id=%016llx
• https://%s.hac.%%.d4c.nintendo.net/c/%c/%s
• https://aauth-%.ndas.srv.nintendo.net/v1/time
• ...
• "https://dauth-%.ndas.srv.nintendo.net/v1/device_auth_token" CURLOPT_POSTFIELDS is set to the output from: snprintf(..., "system_version=%08x&client_id=%s", <output parsed from a func>, "<hard-coded hex string>");

These are not accessible without the required TLS client cert+privk, minus the time URL which can be accessed without any client cert+privk at all.

User-Agent

NIM generates two User-Agent strings:

 snprintf(..., "User-Agent: NintendoSDK Firmware/%s-%u (platform:%s; did:%016llx; eid:%s)", <string at sysver+0x68>, {u32 from sysver+4}, "NX", DeviceId, {NSD cmd11 output});
 snprintf(..., "User-Agent: NintendoSDK Firmware/%s-%u (platform:%s; eid:%s)", <string at sysver+0x68>, {u32 from sysver+4}, "NX", DeviceId, {NSD cmd11 output});

Where the 64bit DeviceId is extracted from the 0x10-bytes at outbuf+0xC6 from set:cal cmd14.

sun

NIM sends a HTTP GET with the sun URL listed above to get the title-listing of the latest system-titles, as .json. The deviceid in the URL is the same one in the above User-Agent section. HTTP header "Accept:application/json" is sent in the request.

The response is json with a "system_update_metas" block, containing "title_id" and "title_version" entries.