NIM services

ntc

Presumably Network Time Sync?

Network

• https://sun.hac.%%.d4c.nintendo.net/v1/system_update_meta?device_id=%016llx
• ...
• https://aqua.hac.%%.d4c.nintendo.net/required_system_update_meta?device_id=%016llx
• https://%s.hac.%%.d4c.nintendo.net/t/%c/%016llx/%u?device_id=%016llx Returns content like the below URL. This is the content for NCA-type0. See below for %c. %016llx is titleID, %u is title-version.
• https://%s.hac.%%.d4c.nintendo.net/c/%c/%s Used for downloading content. First %s is atumn or atum. %c is one of: 'c', 'a', or 's'. %s is just the hex-string NcaId. The returned data is the same size readable from NCM, with another crypto layer. The server also returns two HTTP headers: "X-Nintendo-Content-Hash: {entire lowercase hex-string of the content SHA256 hash}" and "X-Nintendo-Content-ID: {lowercase hex-string for NcaId}"
• https://aauth-%.ndas.srv.nintendo.net/v1/time
• ...
• "https://dauth-%.ndas.srv.nintendo.net/v1/device_auth_token" CURLOPT_POSTFIELDS is set to the output from: snprintf(..., "system_version=%08x&client_id=%s", <output parsed from a func>, "<hard-coded hex string>");

These are not accessible without the required TLS client cert+privk, minus the time URL which can be accessed without any client cert+privk at all.

While atumn seems to be for system-titles, and atum for eShop titles, the latter titles are accessible fine with atumn(with "/t/" for NCA-type0 at least).

'a' is used when an input u8 is not 0x3, otherwise 's' is used. This is title-type? A seperate function using the ".../c/" URL is hard-coded to use 'c'. This appears to match 's' usage attempts: the only URL that returned actual data with 's' was with titleID 0100000000000816.

Going by strings in NIM, it appears SOAP isn't used anymore. ecs appears to use REST API?

User-Agent

NIM generates two User-Agent strings:

 snprintf(..., "User-Agent: NintendoSDK Firmware/%s-%u (platform:%s; did:%016llx; eid:%s)", <string at sysver+0x68>, {u32 from sysver+4}, "NX", DeviceId, {NSD cmd11 output});
 snprintf(..., "User-Agent: NintendoSDK Firmware/%s-%u (platform:%s; eid:%s)", <string at sysver+0x68>, {u32 from sysver+4}, "NX", DeviceId, {NSD cmd11 output});

Where the 64bit DeviceId is parsed from the 0x10-bytes at outbuf+0xC6 from set:cal GetDeviceCert(DeviceCert_certname+2, aka where the hex string for the DeviceId is).

sun

NIM sends a HTTP GET with the sun URL listed above to get the title-listing of the latest system-titles, as .json. The deviceid in the URL is the same one in the above User-Agent section. HTTP header "Accept:application/json" is sent in the request.

The response is json with a "system_update_metas" block, containing "title_id" and "title_version" entries. The actual server response only contains 1 title.

Example, from 2.0 system:

{"timestamp":REDACTED-TIMESTSAMP,"system_update_metas":[{"title_id":"0100000000000816","title_version":201327002}]}

aqua

The following response is json from accessing the above aqua URL:

{ "contents_delivery_required_title_id": "0100000000000816", "contents_delivery_required_title_version": 0 }