Nintendo Switch Brew - Recent changes [en]

Migration services

Yellows8 — Sun, 17 May 2026 02:27:09 GMT

Protocol

← Older revision		Revision as of 06:27, 17 May 2026
(2 intermediate revisions by the same user not shown)
Line 121:		Line 121:
	== CreateSaveDataMigrationClient ==		== CreateSaveDataMigrationClient ==
	Takes an input u32 tmem_size, a type-0x19 input buffer containing a [[#ClientProfile\|ClientProfile]], a TransferMemory handle, returns an [[#IClient_2\|IClient]].		Takes an input u32 tmem_size, a type-0x19 input buffer containing a [[#ClientProfile\|ClientProfile]], a TransferMemory handle, returns an [[#IClient_2\|IClient]].

			The tmem_size must be at least 0x50EA80.

	== ResumeSaveDataMigrationClient ==		== ResumeSaveDataMigrationClient ==
Line 573:		Line 575:

	=== ListServers ===		=== ListServers ===
			Takes a type-0x6 output buffer containing an array of a 0x128-byte struct, returns an output u32 total_out.

	[20.0.0+] The struct size is now 0x130-bytes instead of 0x128-bytes.		[20.0.0+] The struct size is now 0x130-bytes instead of 0x128-bytes.

Line 1,016:		Line 1,020:
	= Protocol =		= Protocol =
	Once connected with [[LDN_services\|ldn]], the client node connects to the server with TCP port 441.		Once connected with [[LDN_services\|ldn]], the client node connects to the server with TCP port 441.

			With [20.0.0+] [[LDN_services\|ldn]] SetProtocol is used with a state field (Protocol3). It's unknown whether the protocol changes later during S2-only savedata transfer.

	== AdvertiseData ==		== AdvertiseData ==

Switch 2: XMSS

Ootulp — Sat, 16 May 2026 20:59:44 GMT

← Older revision		Revision as of 00:59, 17 May 2026
Line 7:		Line 7:
	\|-		\|-
	! XMSS Signature Counter		! XMSS Signature Counter
			! Used by
	\|-		\|-
	\| 496 \|\| [19.0.0+] PSC-BL		\| 496 \|\| [19.0.0+] PSC-BL

Switch 2: XMSS

Ootulp — Sat, 16 May 2026 20:59:16 GMT

Created page with "XMSS is a hash-based post-quantum secure signature scheme. XMSS is used to sign PSC-BL and BR-BCT. XMSS is a stateful signing method where every signature has a unique number. XMSS can only sign finitely many signatures. = Signature Counters = {| class="wikitable" border="1" |- ! XMSS Signature Counter |- | 496 || [19.0.0+] PSC-BL |- | 497 || [19.0.0+] BR-BCT |- | 1335 || [20.0.0+] PSC-BL |- | 1336 || [20.0.0+] BR-BCT |- | 1477 || [21.0.0+] PSC-BL |- | 1478 || [21.0...."

New page

XMSS is a hash-based post-quantum secure signature scheme. XMSS is used to sign PSC-BL and BR-BCT.

XMSS is a stateful signing method where every signature has a unique number. XMSS can only sign finitely many signatures.

= Signature Counters =
{| class="wikitable" border="1"
|-
! XMSS Signature Counter
|-
| 496 || [19.0.0+] PSC-BL
|-
| 497 || [19.0.0+] BR-BCT
|-
| 1335 || [20.0.0+] PSC-BL
|-
| 1336 || [20.0.0+] BR-BCT
|-
| 1477 || [21.0.0+] PSC-BL
|-
| 1478 || [21.0.0+] BR-BCT
|}

Switch 2:PSC-BL

Ootulp — Sat, 16 May 2026 20:55:22 GMT

Ootulp moved page Switch 2:PSC-BL to Switch 2: PSC-BL

New page

PSC-BL is the second stage bootloader that runs after the PSC-ROM. It is executed on the [[Switch 2: PSC|PSC]].

The load address is 0x120000, and the entrypoint is 0x120400.

= Encryption =
The payload is encrypted and authenticated with AES-GCM with the SBK(s).

= Signature =
The Stage1 signature is RSA and the Stage2 signature is XMSS.

= Versions =
{| class="wikitable" border="1"
|-
! XMSS Signature Counter
! Anti-Downgrade Ratchet
|-
| 496 || [19.0.0+] 3
|-
| 1335 || [20.0.0+] 4
|-
| 1477 || [21.0.0+] 5
|}

Switch 2:PSC-BL

Ootulp — Sat, 16 May 2026 20:45:06 GMT

Created page with "PSC-BL is the second stage bootloader that runs after the PSC-ROM. It is executed on the PSC. The load address is 0x120000, and the entrypoint is 0x120400. = Encryption = The payload is encrypted and authenticated with AES-GCM with the SBK(s). = Signature = The Stage1 signature is RSA and the Stage2 signature is XMSS. = Versions = {| class="wikitable" border="1" |- ! XMSS Signature Counter ! Anti-Downgrade Ratchet |- | 496 || [19.0.0+] 3 |- | 1335..."

New page

Switch 2: Flash Filesystem

Ootulp — Sat, 16 May 2026 20:35:33 GMT

← Older revision		Revision as of 00:35, 17 May 2026
Line 29:		Line 29:
	\| 0x9E000		\| 0x9E000
	\| 0x2000		\| 0x2000
	\| PSC [[Switch 2: BCH\|BCH]]		\| [[Switch 2:PSC-BL\|PSC-BL]] [[Switch 2: BCH\|BCH]]
	\|-		\|-
	\| 0xA0000		\| 0xA0000
	\| Variable		\| Variable
	\| PSC		\| [[Switch 2:PSC-BL\|PSC-BL]]
	\|-		\|-
	\| 0xC0000		\| 0xC0000
	\| 0x2000		\| 0x2000
	\| ~~MBCT~~ [[Switch 2: BCH\|BCH]]		\| MB1-BCT [[Switch 2: BCH\|BCH]]
	\|-		\|-
	\| 0xC2000		\| 0xC2000
	\| Variable		\| Variable
	\| ~~MBCT~~		\| MB1-BCT
	\|-		\|-
	\| 0x103000		\| 0x103000

Migration services

Yellows8 — Sat, 16 May 2026 19:28:49 GMT

KeyExchange

@@ Line 1,180: / Line 1,180: @@
 | 0x8 || 0x20 || Data from [[SPL_services|GenerateRandomBytes]].
 |-
-| 0x28 || 0x10 || CMAC ([[SPL_services|ComputeCmac]]) over the above 0x20-bytes, followed by 0x20-bytes from state.
+| 0x28 || 0x10 || CMAC ([[SPL_services|ComputeCmac]]) over the above 0x20-bytes, followed by 0x20-bytes from state (zeros).
 |}
@@ Line 1,330: / Line 1,330: @@
 |-
 | 0x80 || [[#Transfer|Transfer]]
 |-
 | 0xE0 || [20.0.0+] [[#PrepareTransferDisconnect2|PrepareTransferDisconnect2]]
@@ Line 1,517: / Line 1,521: @@
 The transfer payload is the output from exporting savedata from [[Filesystem_services|ISaveDataTransferManager]], which the client then imports.
 ==== PrepareTransferDisconnect2 ====

NAX0

Chainswordcs — Sat, 16 May 2026 00:48:44 GMT

link to SystemSaveData instead of Flash_Filesystem#SystemSaveData

← Older revision		Revision as of 04:48, 16 May 2026
Line 42:		Line 42:
	Key derivation is as follows:		Key derivation is as follows:

	First, FS retrieves the 16-byte console-unique seed that NS registered (data originates from the ns_appman:/private [[~~Flash_Filesystem#System_Savegames~~\|system savegame]]). Next, FS calculates encryptedSeedKeys = <0x20 hardcoded keydata depending on if this NAX0 is a save or an NCA> XORed with the system seed, calculates kek = [[SPL_services#GenerateAesKek\|GenerateAesKek]](<hardcoded keydata>, 0, 0), and then calculates decryptedSeedKeys by doing decryptedSeedKeys[i] = [[SPL_services#GenerateAesKey\|GenerateAesKey]](kek, encryptedSeedKeys[i]); for both keys.		First, FS retrieves the 16-byte console-unique seed that NS registered (data originates from the ns_appman:/private [[SystemSaveData\|system savegame]]). Next, FS calculates encryptedSeedKeys = <0x20 hardcoded keydata depending on if this NAX0 is a save or an NCA> XORed with the system seed, calculates kek = [[SPL_services#GenerateAesKek\|GenerateAesKek]](<hardcoded keydata>, 0, 0), and then calculates decryptedSeedKeys by doing decryptedSeedKeys[i] = [[SPL_services#GenerateAesKey\|GenerateAesKey]](kek, encryptedSeedKeys[i]); for both keys.


	Once the decryptedSeedKeys are calculated, FS calculates naxSpecificKeys = hmac-sha256(key=decryptedSeedKeys[0], data=<NAX0 path, relative to /Nintendo/Contents>); (example path: '/registered/000000FF/cafebabecafebabecafebabecafebabe.nca'). Then, FS does the following decryptions in place: aes128_ecb_decrypt(key=naxSpecificKeys[0], data=Header + 0x28); aes128_ecb_decrypt(key=naxSpecificKeys[1], data=Header + 0x38); Finally, hmac-sha256(key=Header[0x20:0x60], data=decryptedSeedKeys[1]) is calculated, and compared using a constant-time memcmp to the hmac stored at Header + 0x0. If it matches, decryption proceeds using the two decrypted keys at Header + 0x28 as an AES-XTS keypair.		Once the decryptedSeedKeys are calculated, FS calculates naxSpecificKeys = hmac-sha256(key=decryptedSeedKeys[0], data=<NAX0 path, relative to /Nintendo/Contents>); (example path: '/registered/000000FF/cafebabecafebabecafebabecafebabe.nca'). Then, FS does the following decryptions in place: aes128_ecb_decrypt(key=naxSpecificKeys[0], data=Header + 0x28); aes128_ecb_decrypt(key=naxSpecificKeys[1], data=Header + 0x38); Finally, hmac-sha256(key=Header[0x20:0x60], data=decryptedSeedKeys[1]) is calculated, and compared using a constant-time memcmp to the hmac stored at Header + 0x0. If it matches, decryption proceeds using the two decrypted keys at Header + 0x28 as an AES-XTS keypair.

User:Chainswordcs

Chainswordcs — Sat, 16 May 2026 00:43:29 GMT

User account Chainswordcs was created

Migration services

Yellows8 — Fri, 15 May 2026 22:45:33 GMT

← Older revision		Revision as of 02:45, 16 May 2026
(2 intermediate revisions by the same user not shown)
Line 393:		Line 393:
	** Calls a func. This receives [[#Suspend\|Suspend]] or [[#SynchronizeState\|SynchronizeState]] and sends the response.		** Calls a func. This receives [[#Suspend\|Suspend]] or [[#SynchronizeState\|SynchronizeState]] and sends the response.
	* Updates a state flag and returns 0.		* Updates a state flag and returns 0.

			The "nn::migration::device::IServer" version of this is roughly equivalent, except the funcs called after [[#RequestServerProfile\|RequestServerProfile]] above are not used.

	=== GetClientProductModel ===		=== GetClientProductModel ===
Line 780:		Line 782:
	\| 130 \|\|		\| 130 \|\|
	\|-		\|-
	\| 200 \|\|		\| 200 \|\| [[#WaitConnectionAsync\|WaitConnectionAsync]]
	\|-		\|-
	\| 230 \|\|		\| 230 \|\|
Line 786:		Line 788:
	\| 290 \|\|		\| 290 \|\|
	\|-		\|-
	\| 300 \|\|		\| 300 \|\| ProcessTransferAsync
	\|-		\|-
	\| 400 \|\|		\| 400 \|\| CompleteAsync
	\|-		\|-
	\| 510 \|\| [20.0.0-20.5.0]		\| 510 \|\| [20.0.0-20.5.0]
	\|-		\|-
	\| 511 \|\| [21.0.0+]		\| 511 \|\| [21.0.0+] AbortAsync2
	\|-		\|-
	\| 900 \|\|		\| 900 \|\|
Line 1,375:		Line 1,377:
	\| 0x144 \|\| 0x4 \|\| [[Settings_services#GetProductModel\|ProductModel]]		\| 0x144 \|\| 0x4 \|\| [[Settings_services#GetProductModel\|ProductModel]]
	\|}		\|}

			With "nn::migration::device::" this is a 0x398-byte struct.

	When the aforementioned vfunc returned true, the client only uses the response data for verifying that various fields match state. Otherwise when false the client uses this data, in which case:		When the aforementioned vfunc returned true, the client only uses the response data for verifying that various fields match state. Otherwise when false the client uses this data, in which case:
Line 1,398:		Line 1,402:
	\| 0x104 \|\| 0x4 \|\| [20.0.0+] [[System_Version_Title\|SystemVersion]]. u32 in the form: <code>(Major<<16) \| (Minor<<8) \| Micro</code>		\| 0x104 \|\| 0x4 \|\| [20.0.0+] [[System_Version_Title\|SystemVersion]]. u32 in the form: <code>(Major<<16) \| (Minor<<8) \| Micro</code>
	\|}		\|}

			With "nn::migration::device::" this is a 0x218-byte struct.

	The response only contains the header.		The response only contains the header.

Settings services

Hexkyz — Thu, 14 May 2026 01:04:13 GMT

← Older revision		Revision as of 05:04, 14 May 2026
Line 2,575:		Line 2,575:
	= ProductModel =		= ProductModel =
	Ths is "nn::settings::system::ProductModel".		Ths is "nn::settings::system::ProductModel".

	~~Range 1-6 is Nintendo Switch, range 7-12 is Nintendo Switch 2.~~

	{\| class="wikitable" border="1"		{\| class="wikitable" border="1"
	\|-		\|-
	! Value		! Value
	! ~~[[#ProductModelName~~\|~~ProductModelName]]~~		! Description
			\|-
			\| 0 \|\| Invalid
			\|-
			\| 1 \|\| Nx
	\|-		\|-
	\| 1 \|\| ~~"HAC"~~		\| 2 \|\| NxCopper
	\|-		\|-
	\| 3 \|\| ~~"HAD"~~		\| 3 \|\| NxIowa
	\|-		\|-
	\| 4 \|\| ~~"HDH"~~		\| 4 \|\| NxHoag
	\|-		\|-
	\| 6 \|\| ~~"HEG"~~		\| 5 \|\| NxCalcio
	\|-		\|-
	\| 7 \|\| ~~"BEE"~~		\| 6 \|\| NxAula
			\|-
			\| 7 \|\|
			\|-
			\| 8 \|\|
			\|-
			\| 9 \|\|
			\|-
			\| 10 \|\|
			\|-
			\| 11 \|\|
			\|-
			\| 12 \|\|
	\|}		\|}

			Range 1-6 is Nintendo Switch, range 7-12 is Nintendo Switch 2.

	= ProductModelName =		= ProductModelName =
	This is "nn::settings::system::ProductModelName". This is a 0x8-byte struct containing a [[#ProductModel\|string]].		This is "nn::settings::system::ProductModelName". This is a 0x8-byte struct containing a [[#ProductModel\|string]].

	= ~~System Configuration~~ =		{\| class="wikitable" border="1"
			\|-
			! Value
			! [[#ProductModel\|ProductModel]]
			\|-
			\| "HAC" \|\| 1
			\|-
			\| "HAD" \|\| 3
			\|-
			\| "HDH" \|\| 4
			\|-
			\| "HEG" \|\| 6
			\|-
			\| "BEE" \|\| 7
			\|}

			= SystemConfiguration =
	There's a common configuration title (*818), and one configuration title for each [[SMC#HardwareType\|HardwareType]].		There's a common configuration title (*818), and one configuration title for each [[SMC#HardwareType\|HardwareType]].

Migration services

Yellows8 — Wed, 13 May 2026 15:03:58 GMT

Show changes

Network

Yellows8 — Tue, 12 May 2026 21:37:50 GMT

transfer

← Older revision		Revision as of 01:37, 13 May 2026
(4 intermediate revisions by the same user not shown)
Line 274:		Line 274:
	** The json response is parsed as the following (HTTP status must be 201):		** The json response is parsed as the following (HTTP status must be 201):
	*** <code>{"transfer_event":{"transfer_event_id":<number>,"status":<status_str>,"error":<str>,"src_device_serial":<str>,"src_device_appearance_main":<str>,"dst_device_serial":<str>,"src_device_type":<unknown>,"created_at":<timestamp>,"expires_at":<timestamp>}}</code>		*** <code>{"transfer_event":{"transfer_event_id":<number>,"status":<status_str>,"error":<str>,"src_device_serial":<str>,"src_device_appearance_main":<str>,"dst_device_serial":<str>,"src_device_type":<unknown>,"created_at":<timestamp>,"expires_at":<timestamp>}}</code>
	*** The minimum required fields are status and ~~created_at~~. <status_str> must match one of various strings, such as "started".		*** The minimum required fields are status and expires_at. <status_str> must match one of various strings, such as "started".
	*** The output transfer_event_id is then used as the first "%lld" in the above URIs.		*** The output transfer_event_id is then used as the first "%lld" in the above URIs.
			*** The rest of the fields are likely only used with "nn::migration::device::*" (?).

	* "/%lld/%s":		* "/%lld/%s":
	** The POST data is empty.		** The POST data is empty.
	** The json response is parsed as the following (HTTP status must be 200):		** The json response is parsed as the following (HTTP status must be 200):
	*** {...}		*** This is parsed similar to /start above. The minimum required fields are the same as /start. The rest of the output is unused.

			* "/%lld":
			** This is used following certain network requests which failed, depending on the Result. In one case it's used without a prior network request.
			** No POST data (?).
			** The json response is parsed as the following (HTTP status must be 200):
			*** This is parsed similar to /start above. The minimum required fields are the same as /start.
			*** Most usage of this will return 0 instead of the Result from the request which failed, when status is the expected value and expires_at>0.

			* "/%lld/register_destination":
			** The json POST data contains the following:
			*** <code>{"dst_device_appearance_main":"<str0>","dst_device_appearance_controller":"<str1>"}</code>
			*** <str0>/<str1> are the same as with "/start".
			** The json response is parsed as the following (HTTP status must be 200):
			*** This is parsed similar to /start above. The minimum required fields are the same as /start. The rest of the output is unused.

			* "/%lld/save_datas/%lld/generate_key_seed_package" / "/%lld/generate_key_seed_package":
			** The json POST data contains the following:
			*** <code>{"challenge":"%s"}</code>
			*** Where %s is the 0x10-byte challenge ([[Filesystem_services#ISaveDataTransferManagerWithDivision\|ISaveDataTransferManagerWithDivision GetChallenge]]) printed with "%02x" for each byte.
			** The response is parsed as follows (HTTP status must be 200):
			*** This is base64 decoded. The output is then later used with [[Filesystem_services#ISaveDataTransferManagerWithDivision\|ISaveDataTransferManagerWithDivision SetKeySeedPackage]].

	== Others ==		== Others ==

Settings services

Timschneeb — Mon, 11 May 2026 02:55:04 GMT

GetKeyCodeMap

@@ Line 61: / Line 61: @@
 == GetKeyCodeMap ==
-Takes a type-0x16 output buffer containing KeyCodeMap, official sw uses fixed size 0x1000. This is probably related to HID keyboard.
+Takes a type-0x16 output buffer containing KeyCodeMap, official sw uses fixed size 0x1000. This is related to the USB HID keyboard.
 == GetFirmwareVersionForDebug ==

User:Timschneeb

Timschneeb — Mon, 11 May 2026 00:59:54 GMT

User account Timschneeb was created

Qlaunch

UltraSearcher123 — Sun, 10 May 2026 20:45:22 GMT

Forgot to close the parentheses :p

@@ Line 1: / Line 1: @@
-This is the title with process-name "qlaunch" launched by [[NS_services|ns]] with a [[NCM_services#ProgramId|ProgramId]] loaded from system-config.
+This is the title with process name "qlaunch" (Quick Launch), launched by [[NS_services|NS services]], with its [[NCM_services#ProgramId|Program ID]] being loaded from system config.
 * Home Menu
 * [[System Settings]]
@@ Line 7: / Line 8: @@
 = Hidden Features =
 == Flog ==
-qlaunch periodically checks if the user is in "/RootScene/SceneResidentMenu", which represents the Home Menu (aka main-menu). If so, the following checks are then performed in order:
+qlaunch periodically checks if the user is in "/RootScene/SceneResidentMenu", which represents the Home Menu (aka main-menu).
 * The Joy-Cons' state is read from [[HID_Shared_Memory|HID shared memory]] and both must be active and detached from the console.
-* "StartSixAxisSensor" [[HID_services#hid|hid]] command is called for each Joy-Con so motion data can be captured.
+** (The "StartSixAxisSensor" [[HID_services#hid|HID]] command is called for each Joy-Con so that motion data can be captured).
-* After capturing the motion data, the same motion checks for both Joy-Cons must pass at the same time. This motion data is analyzed in a small state machine consisting of a total of 7 steps and the motion itself is a reference to [https://www.youtube.com/watch?v=BdQg43n2OaM&t=17s Iwata's Direct gesture]. Hold the Joy-Cons pointing forwards/downwards, then move Joy-Cons to a vertical position, and hold it there for a bit. The Joy-Con grip can be used for this.
-* The system's month and day must be July 11th, which is the date of Iwata's [https://en.wikipedia.org/wiki/Satoru_Iwata passing]. The loaded date originates from network-time-sync'd time, regardless of whether the user has it enabled or not. When the system was never connected to the Internet and is on [[1.0.0]] it comes from the user-specified date instead. For newer systems, trying to load the network time if it was never set will result in an error: they won't ever be able to launch flog without a time-sync with Nintendo servers. This is loaded from the [[PCV_services|time]] service-cmds, with the actual time-sync being handled by [[NIM_services|NIM]].
+* After capturing the motion data, the same motion checks for both Joy-Cons must pass at the same time:
-* A wrapper for "GetLanguageCode" [[Settings_services#set|set]] command is called and the returned code must be 0 (JPja), 1 (USen) or 2 (EUen). Other combinations of region and language may have it's code translated internally to a valid one (0, 1 or 2), which seems to be the case for 12 (CNzh), 13 (KRko) and 14 (TWzh).
+** (This motion data is analyzed via a 7-step process; the motion itself is a reference to [https://www.youtube.com/watch?v=BdQg43n2OaM&t=17s Iwata's 'Nintendo Direct' gesture], and may take a few attempts to get right)
-* Lastly, "IsSystemProgramInstalled" [[NS_Services#ns:am|ns:am]] command is called, which should return 1 if the [[Flog|flog]] title is installed.
+*** 1) Hold the Joy-Cons in your hand as if you were gripping a steering wheel.
-Once everything passes it continues to the code which launches [[Flog|flog]]. When [[Flog|flog]] is launched a small audio clip named "SeTestTone" is played which matches [https://www.youtube.com/embed/SeVTJu_Yn2Y?start=17&end=18&autoplay=1 this].
+To access the menu, the following conditions must be met:
-As of [[4.0.0]] this feature has been removed from qlaunch.
+* Open the "Settings" app from the Home Menu.
-== SaveData Repair ==
+This will call various [[OLSC_services#olsc:s|OLSC services]], which in turn will issue requests to [[Network#storage|repair services]].
-This will call various [[OLSC_services#olsc:s|olsc:s]] which in turn will issue requests to the [[Network#storage|repair service]]. Without specific authorization from the server, this will always display a message like: "This feature is currently unavailable."
+(Without specific authorization from the server, this will always display a message stating "This feature is currently unavailable", and the menu will not appear).

User:UltraSearcher123

UltraSearcher123 — Sun, 10 May 2026 18:49:23 GMT

User account UltraSearcher123 was created