NIM services
nim
This is "nn::nim::detail::INetworkInstallManager".
| Cmd | Name |
|---|---|
| 0 | |
| 1 | |
| 2 | |
| 3 | |
| 4 | |
| 5 | |
| 6 | |
| 7 | |
| 8 | |
| 9 | |
| 10 | |
| 11 | |
| 12 | |
| 14 | |
| 15 | |
| 16 | |
| 17 | |
| 18 | |
| 19 | |
| 20 | |
| 21 | |
| 22 | |
| 23 | |
| 24 | |
| 25 | |
| 26 | |
| 27 | |
| 28 | |
| 29 | |
| 30 | |
| 31 | |
| 32 | |
| 33 | |
| 34 | |
| 35 | |
| 36 | |
| 37 | |
| 38 | |
| 39 | |
| 40 | |
| 41 | |
| 42 | |
| 43 | |
| 44 | |
| 45 | |
| 46 |
Cmd1
Takes a 0x10-byte input struct, from the output of cmd2.
Cmd2
Takes a type-0x6 output buffer, for an array of 0x10-byte entries. Returns an u32 for total output entries.
Doesn't return anything on a v2.1 system where sysupdate domains are blocked.
nim:shp
This is "nn::nim::detail::IShopServiceManager".
| Cmd | Name |
|---|---|
| 0 | RequestDeviceAuthenticationToken |
| 1 | RequestCachedDeviceAuthenticationToken |
| 400 | GetAccountByVirtualAccount |
| 300 | RequestUnlinkDevice |
| 301 | RequestUnlinkDeviceIntegrated |
| 302 | RequestLinkDevice |
| 303 | HasDeviceLink |
| 304 | RequestUnlinkDeviceAll |
| 305 | RequestCreateVirtualAccount |
| 306 | RequestDeviceLinkStatus |
| 200 | RequestRegisterNotificationToken |
| 100 | RequestRegisterDeviceAccount |
| 101 | RequestUnregisterDeviceAccount |
| 102 | RequestDeviceAccountStatus |
| 103 | GetDeviceAccountInfo |
| 104 | RequestDeviceRegistrationInfo |
| 105 | RequestTransferDeviceAccount |
| 106 | RequestSyncRegistration |
| 107 | IsOwnDeviceId |
| 500 | RequestSyncTicket |
| 501 | RequestDownloadTicket |
| 502 | [4.0.0+] RequestDownloadTicketForPrepurchasedContents |
ntc
This is "nn::ntc::detail::service::IStaticService".
| Cmd | Name |
|---|---|
| 0 | OpenEnsureNetworkClockAvailabilityService |
| 100 | SuspendAutonomicTimeCorrection |
| 101 | ResumeAutonomicTimeCorrection |
Network-time-sync uses the "<...>/time" HTTPS URL listed in the below Network section. This just returns an UTC Unix time string.
IEnsureNetworkClockAvailabilityService
This is "nn::ntc::detail::service::IEnsureNetworkClockAvailabilityService".
| Cmd | Name |
|---|---|
| 0 | StartTask |
| 1 | GetFinishNotificationEvent |
| 2 | GetResult |
| 3 | Cancel |
| 4 | IsProcessing |
| 5 | GetServerTime |
Network
- https://sun.hac.%%.d4c.nintendo.net/v1/system_update_meta?device_id=%016llx
- https://aqua.hac.%%.d4c.nintendo.net/required_system_update_meta?device_id=%016llx
- https://%s.hac.%%.d4c.nintendo.net/t/%c/%016llx/%u?device_id=%016llx Returns content like the below URL. This is the content for NCA-type0. See below for %c. %016llx is titleID, %u is title-version.
- https://%s.hac.%%.d4c.nintendo.net/c/%c/%s Used for downloading content. First %s is atumn or atum. %c is one of: 'c', 'a', or 's'. %s is just the hex-string NcaId. The server also returns two HTTP headers: "X-Nintendo-Content-Hash: {entire lowercase hex-string of the content SHA256 hash}" and "X-Nintendo-Content-ID: {lowercase hex-string for NcaId}"
- https://superfly.hac.%%.d4c.nintendo.net/v1/t/%016llx/dv %016llx is titleID, only for eShop titles it appears. Returns .json title-info.
- https://superfly.hac.%%.d4c.nintendo.net/v1/a/%016llx/dv %016llx is titleID, only for eShop titles it appears. Output is similar to above URL.
- https://aauth-%.ndas.srv.nintendo.net/v1/time
- https://beach.hac.%.eshop.nintendo.net/v1/rom_cards?application_id=%016llx&rom_card_cert=%s
- https://beach.hac.%.eshop.nintendo.net/v1/rom_cards/register?application_id=%016llx&rom_card_cert=%s&expected_gold_point=%d
- https://beach.hac.%.eshop.nintendo.net/v1/my/devices/hac/link?lang=en
- https://beach.hac.%.eshop.nintendo.net/v1/my/virtual_account?lang=en
- https://tagaya.hac.%.eshop.nintendo.net/tagaya/hac_versionlist
- ...
- "https://dauth-%.ndas.srv.nintendo.net/v1/device_auth_token" CURLOPT_POSTFIELDS is set to the output from: snprintf(..., "system_version=%08x&client_id=%s", <byte-swapped first 3 bytes from System_Version_Title loaded via settings cmd>, "<hard-coded hex string>");
- https://ecs-%.hac.shop.nintendo.net/ecs/services/rest/AccountGetETickets
- https://ecs-%.hac.shop.nintendo.net/ecs/services/rest/GetAccountStatus
- https://ias-%.hac.shop.nintendo.net/ias/services/rest/Register
- https://ias-%.hac.shop.nintendo.net/ias/services/rest/GetChallenge
- https://ias-%.hac.shop.nintendo.net/ias/services/rest/Unregister
- https://ias-%.hac.shop.nintendo.net/ias/services/rest/GetRegistrationInfo
- https://ias-%.hac.shop.nintendo.net/ias/services/rest/CompleteETicketSync
- https://ias-%.hac.shop.nintendo.net/ias/services/rest/AccountTransfer
- https://ias-%.hac.shop.nintendo.net/ias/services/rest/SyncRegistration
- [5.0.0]+ https://pearljam.hac.%.eshop.nintendo.net/sugar
- [5.0.0]+ https://pearljam.hac.%.eshop.nintendo.net/civil
These are not accessible without the required TLS client cert+privk, minus the time URL which can be accessed without any client cert+privk at all.
The returned content data from CDN, for both system-titles and eShop-titles, is identical to the data readable by Content_Manager_services#ReadEntryRaw.
While atumn seems to be for system-titles, and atum for eShop titles, the latter titles are accessible fine with atumn(with "/t/" for NCA-type0 at least).
'a' is used when an input u8 is not 0x3, otherwise 's' is used. This is title-type? A seperate function using the ".../c/" URL is hard-coded to use 'c'. This appears to match 's' usage attempts: the only URL that returned actual data with 's' was with titleID 0100000000000816.
As of June 30, 2017, accessing old content via the atumn "/c/" and "/t/" URLs works fine.
Going by strings in NIM, it appears SOAP isn't used anymore. ecs appears to use REST API?
User-Agent
NIM generates two User-Agent strings:
snprintf(..., "User-Agent: NintendoSDK Firmware/%s-%u (platform:%s; did:%016llx; eid:%s)", <string at sysver+0x68>, {u32 from sysver+4}, "NX", DeviceId, {NSD cmd11 output}); snprintf(..., "User-Agent: NintendoSDK Firmware/%s-%u (platform:%s; eid:%s)", <string at sysver+0x68>, {u32 from sysver+4}, "NX", DeviceId, {NSD cmd11 output});
Where the 64bit DeviceId is parsed from the 0x10-bytes at outbuf+0xC6 from set:cal GetDeviceCert(DeviceCert_certname+2, aka where the hex string for the DeviceId is).
sun
NIM sends a HTTP GET with the sun URL listed above to get the title-listing of the latest system-titles, as .json. The deviceid in the URL is the same one in the above User-Agent section. HTTP header "Accept:application/json" is sent in the request.
The response is json with a "system_update_metas" block, containing "title_id" and "title_version" entries. The actual server response only contains 1 title.
Example, from 2.0 system:
{"timestamp":REDACTED-TIMESTSAMP,"system_update_metas":[{"title_id":"0100000000000816","title_version":201327002}]}
aqua
The following response is json from accessing the above aqua URL:
{
"contents_delivery_required_title_id": "0100000000000816",
"contents_delivery_required_title_version": 0
}
A while after 3.0.0 release, the above title-version was changed to the one for v3.0("Last-Modified: Thu, 29 Jun 2017 00:00:04 GMT").