The Switch uses the NRR file format to verify NRO at load time. These files contain hashes of each NRO that is allowed to be loaded by the program. An NRO's SHA-256 hash must match any of the hashes in the hash table. NRRs are signed with RSASSA-PSS-2048/SHA-256.

Offset Size Description
0x0 0x4 Magic "NRR0"
0x4 0x4 [9.0.0+] KeyGeneration
0x8 0x8 Reserved
0x10 0x220 Certification
0x230 0x100 Signature (verifiable with the certification key, over the rest of the file)
0x330 0x8 ApplicationId
0x338 0x4 Size
0x33C 0x1 NrrKind (0 = User, 1 = JitPlugin)
0x33D 0x3 Reserved
0x340 0x4 HashOffset (always 0x350)
0x344 0x4 NumHash
0x348 0x8 Reserved
0x350 0x20 * NumHash NroHashList (SHA-256)

Certification

Offset Size Description
0x0 0x8 ApplicationIdMask
0x8 0x8 ApplicationIdPattern
0x10 0x10 Reserved
0x20 0x100 PublicKey (modulus for verifying the NRR signature)
0x120 0x100 Signature (over the above contents)