Filesystem Services

Filesystem Services

Services #

Filesystem service “fs:USER” #

You can at most have 32 FS archive handles.

Command HeaderAvailable since system versionDescriptionRequired exheader access info bitmask
0x000100C6?Dummy1None
0x040100C4?ControlNone
0x08010002?InitializeNone
0x080201C2?OpenFileNone
0x08030204?OpenFileDirectlyNone
0x08040142?DeleteFileNone
0x08050244?RenameFileNone
0x08060142?DeleteDirectoryNone
0x08070142?DeleteDirectoryRecursivelyNone
0x08080202?CreateFileNone
0x08090182?CreateDirectoryNone
0x080A0244?RenameDirectoryNone
0x080B0102?OpenDirectoryNone
0x080C00C2?OpenArchiveEach archive ID code has separate access info bitmasks, if it has any
0x080D0144?ControlArchiveNone
0x080E0080?CloseArchiveNone
0x080F0180?Obsoleted_2_0_FormatThisUserSaveDataNone
0x08100200?Obsoleted_3_0_CreateSystemSaveData0x4, for when the input saveID doesn’t match the exheader saveID
0x08110040?Obsoleted_3_0_DeleteSystemSaveData0x1004, for when the input saveID doesn’t match the exheader saveID
0x08120080?GetFreeBytesNone
0x08130000?GetCardType0x1017
0x08140000?GetSdmcArchiveResourceNone
0x08150000?GetNandArchiveResource0x1007
0x08160000?GetSdmcFatfsError0x2
0x08170000?IsSdmcDetectedNone
0x08180000?IsSdmcWritableNone
0x08190042?GetSdmcCid0x2
0x081A0042?GetNandCid0x2
0x081B0000?GetSdmcSpeedInfo0x2
0x081C0000?GetNandSpeedInfo0x2
0x081D0042?GetSdmcLog0x2
0x081E0042?GetNandLog0x2
0x081F0000?ClearSdmcLog0x2
0x08200000?ClearNandLog0x2
0x08210000?CardSlotIsInserted0x1017
0x08220000?CardSlotPowerOn0x2
0x08230000?CardSlotPowerOff0x2
0x08240000?CardSlotGetCardIFPowerStatus0x2
0x08250040?CardNorDirectCommand0x2
0x08260080?CardNorDirectCommandWithAddress0x2
0x08270082?CardNorDirectRead0x2
0x082800C2?CardNorDirectReadWithAddress0x2
0x08290082?CardNorDirectWrite0x2
0x082A00C2?CardNorDirectWriteWithAddress0x2
0x082B00C2?CardNorDirectRead_4xIO0x2
0x082C0082?CardNorDirectCpuWriteWithoutVerify0x2
0x082D0040?CardNorDirectSectorEraseWithoutVerify0x2
0x082E0040?GetProductInfo0x1005
0x082F0040?GetProgramLaunchInfo0x1005
0x08300182?Obsoleted_3_0_CreateExtSaveData0xC, for when the input extdataID doesn’t match the exheader extdataID
0x08310180?Obsoleted_3_0_CreateSharedExtSaveData0x1005
0x08320102?Obsoleted_3_0_ReadExtSaveDataIcon0x100D, for when the input extdataID doesn’t match the exheader extdataID
0x08330082?Obsoleted_3_0_EnumerateExtSaveData0x1005
0x08340082?Obsoleted_3_0_EnumerateSharedExtSaveData0x1005
0x08350080?Obsoleted_3_0_DeleteExtSaveData0x100D, for when the input extdataID doesn’t match the exheader extdataID
0x08360080?Obsoleted_3_0_DeleteSharedExtSaveData0x1005
0x08370040?SetCardSpiBaudRate0x2
0x08380040?SetCardSpiBusMode0x2
0x08390000?SendInitializeInfoTo9None
0x083A0100?GetSpecialContentIndex0x1005
0x083B00C2?GetLegacyRomHeader0x1015
0x083C00C2?GetLegacyBannerData0x1015
0x083D0100?CheckAuthorityToAccessExtSaveData0x44
0x083E00C2?QueryTotalQuotaSizeNone
0x083F00C0?Obsoleted_3_0_GetExtDataBlockSizeNone
0x08400040?AbnegateAccessRight?
0x08410000?DeleteSdmcRoot0x1005
0x08420040?DeleteAllExtSaveDataOnNand0x1005
0x08430000?InitializeCtrFileSystemNone
0x08440000?CreateSeed0x2
0x084500C2?GetFormatInfo?
0x08460102?GetLegacyRomHeader20x1015
0x08470180?Obsoleted_2_0_FormatCtrCardUserSaveData0x6
0x08480042?GetSdmcCtrRootPath0x100D
0x08490040?GetArchiveResource?
0x084A0002?ExportIntegrityVerificationSeed0x4000
0x084B0002?ImportIntegrityVerificationSeed0x4000
0x084C0242?FormatSaveData0x6, in some cases this write isn’t needed however
0x084D0102?GetLegacySubBannerData0x1015
0x084E0342?UpdateSha256Context0x5
0x084F0102?ReadSpecialFileNone
0x08500040?GetSpecialFileSizeNone
0x085102423.0.0-5CreateExtSaveDataShared extdata: 0x101005. Regular extdata in certain cases: 0xC
0x085201003.0.0-5DeleteExtSaveDataShared extdata: 0x101005. Regular extdata in certain cases: 0x10100D
0x085301423.0.0-5ReadExtSaveDataIcon0x10100D (this doesn’t apply in certain cases, however)
0x085400C03.0.0-5GetExtDataBlockSize0x10100D (this doesn’t apply in certain cases, however)
0x085501023.0.0-5EnumerateExtSaveData0x101005
0x085602403.0.0-5CreateSystemSaveData0x4 (this doesn’t apply in certain cases, however)
0x085700803.0.0-5DeleteSystemSaveData0x1004 (this doesn’t apply in certain cases, however)
0x085800003.0.0-5StartDeviceMoveAsSource0x2004
0x085902003.0.0-5StartDeviceMoveAsDestination0x2004
0x085A00C03.0.0-5SetArchivePriorityNone
0x085B00803.0.0-5GetArchivePriorityNone
0x085C00C03.0.0-5SetCtrCardLatencyParameter0xE
0x085D01C03.0.0-5SetFsCompatibilityInfo0x100001
0x085E00403.0.0-5ResetCardCompatibilityParameter0xE
0x085F00403.0.0-5SwitchCleanupInvalidSaveData0x12004
0x086000423.0.0-5EnumerateSystemSaveData0x2004
0x086100423.0.0-5InitializeWithSdkVersionNone
0x086200403.0.0-5SetPriorityNone
0x086300003.0.0-5GetPriorityNone
0x086400003.0.0-5Obsoleted_4_0_GetNandInfoStubbed, this returns an error
0x086501404.0.0-7SetSaveDataSecureValue0x121004 (in certain cases this doesn’t apply, however)
0x086600C04.0.0-7GetSaveDataSecureValue0x121004 (in certain cases this doesn’t apply, however)
0x086700C44.0.0-7ControlSecureSave0x121004
0x086800004.0.0-7GetMediaTypeNone
0x086900004.0.0-7Obsoleted_4_0_GetNandEraseCountStubbed, this returns an error.
0x086A00824.0.0-7ReadNandReportNone
0x086B00C2?SetOtherSaveDataSecureValue00121004
0x086C00C2?GetOtherSaveDataSecureValue00121004
0x086D0040??00020004
0x086E00C0Related to Secure Value? Used in Pokemon Sun/Moon.SetThisSaveDataSecureValueNone?
0x086F0040Related to Secure Value? Used in Pokemon Sun/Moon.GetThisSaveDataSecureValue0xE
0x087000C2??None?
0x08710100??0xC
0x087201C0??00080004
0x087300C0??00080004
0x08740000??00080004
0x08750140??None?
0x087600C0??None?
0x08770100???
0x087800C0???
0x087900C2?Same as GetLegacyBannerData, except for the last parameter this passes u8 value 0x1 instead of 0x0, for the FSPXI command.0x00101015
0x087A01809.6.0-XAddSeed0x00200000
0x087B….9.6.0-XWrapper for the code internally used for command <0x087A….>.0x00200000
0x087C….9.6.0-XEventually calls same code as command <0x087A….>.0x00200000
0x087D00009.6.0-XGetNumSeeds. Writes the number of seeds to cmdreply[2]0x00200000
0x087E00429.6.0-XEventually calls same code as command <0x087A….>. Writes a list of titleIDs to the outbuf, this is for titles with content-lock-seed(s) stored in SEEDDB. (u32 total_titleids_probably, ((Size<<4) | 12), outbufptr)0x00200000
0x087F….9.6.0-X?0x00200000
0x0880….9.6.0-XEventually calls same code as command <0x087A….>.0x00200000
0x0881….9.6.0-XEventually calls same code as command <0x087A….>.0x00200000
0x0882….9.6.0-XEventually calls same code as command <0x087A….>.0x00200000
0x088300009.6.0-XWrites an output value to cmdreply[2].0x00200000
0x088400429.6.0-XEventually calls same code as command <0x087A….>.0x00200000
0x0885….9.6.0-X?0x00200000
0x088600C011.1.0-XCheckUpdatedDat0x00080000

Note: The question marks from Dummy1 to GetSpecialFileSize on the “available since system version” field are mainly there because I think that most of these are necessary for the main system to function, so theoretically that would mean that since the creation of the 3DS these were available, or since launch if that makes more sense. But because of the peculiar nature of some of the functions, they will remain question marks until they can be confirmed 100%.

When access rights are required for a command, at least one of the bits in the process access info specified in the above table for the command must be set. Error 0xD9004676 is returned when a process attempts to use a command which it doesn’t have access rights for the command. The exheader access info field is all zero’s for most applications. Note that the permissions listed in the above table is for system-version v2.x, therefore permission bit(s) added with newer FIRM may be missing from this.

Each session for fs:USER has separate permissions, initially these are set to all zero’s for new fs:USER sessions. The permissions/etc for fs:USER sessions are initialized via FS:Initialize(loaded from the user process exheader).

Filesystem service “fs:LDR” #

This service is identical to fs:USER, except FS:OpenArchive archive 0x2345678E can only be accessed with fs:LDR.

ProgramRegistry service “fs:REG” #

Command HeaderDescription
0x000100C6Dummy1
0x040103C0Register
0x04020040Unregister
0x040300C0GetProgramInfo
0x04040100LoadProgram
0x04050080UnloadProgram
0x04060080CheckHostLoadId

Only two sessions can be opened for this service at a time, hence no other processes can use this due to pm-module and loader using this.

File and directory access #

Files #

File session handles obtained via FS:OpenFile and FS:OpenFileDirectly can be used to access files through a service-like interface, despite not being an actual service registered using SRV:RegisterService. To use this service-like interface, simply call the SendSyncRequest SVC with a file session handle, using the IPC buffer in thread-local storage for parameters and responses, just like you would with a proper service.

Command HeaderDescription
0x000100C6Dummy1
0x040100C4Control
0x08010100OpenSubFile
0x080200C2Read
0x08030102Write
0x08040000GetSize
0x08050080SetSize
0x08060000GetAttributes
0x08070040SetAttributes
0x08080000Close
0x08090000Flush
0x080A0040SetPriority
0x080B0000GetPriority
0x080C0000OpenLinkFile
0x0C010100GetAvailable

Directories #

Directory session handles obtained via FS:OpenDirectory are usable via a service-like interface, following the exact same procedure described above for file sessions.

Command HeaderAvailable since system versionDescription
0x000100C61.0.0-0Dummy1
0x040100C41.0.0-0Control
0x080100421.0.0-0Read
0x080200001.0.0-0Close
0x08030040?SetPriority
0x08040000?GetPriority

Archives #

ArchiveIdDescriptionAccessible via FSAccessible via FSPXIOnly accessible by Process9 internallyRequires binary LowpathRequired exheader FS access info bitmask
0x00000003SelfNCCH (including RomFS)YesNoNoNoNone
0x00000004SaveData (the saveID/mediatype for this is loaded from data originally from the user process’ exheader)YesNoNoNoNone
0x00000006ExtSaveDataYesNoNoYes0x100D, when the input extdataID isn’t listed in the exheader.
0x00000007Shared ExtSaveDataYesNoNoYesNone
0x00000008SystemSaveDataYesNoNoYes0x4, when the input saveID doesn’t match the exheader system-saveID.
0x00000009SDMCYesYesNoNo0x8E
0x0000000ASDMC Write-OnlyYesNoNoNo0x808E
0x12345678ExtSaveData for BOSSYesNoNoYes0x44
0x12345679CARD SPI FSYesYesNoNo0x16
0x1234567BExtSaveData, and ExtSaveData for BOSSNoYesNoYes
0x1234567CSystemSaveDataNoYesNoYes
0x1234567DNAND RWYesYesNoNo0x800
0x1234567ENAND ROYesYesNoNo0x200
0x1234567FNAND RO Write FSNoYesNoNo?
0x12345680Unknown. There’s code for this in spider v9.9, but that code isn’t actually used.Yes?NoYes?
0x12345681Unknown. Accessed by FS service.??No??
0x12345682Unknown. There’s code for this in spider v9.9, but that code isn’t actually used.Yes?NoYes?
0x2345678AUsed for accessing general NCCH data. With FSPXI this also allows savedata access.YesYesNoYes0x1005
0x2345678B?NoNoYesYes
0x2345678CUsed internally to access /dbs files?NoNoYesYes
0x2345678D?NoNoYesNo
0x2345678EFSPXI: Similar to archive 0x2345678A. For fs:LDR(used by the “loader” FIRM ARM11-process), only ExeFS. Not accessible with fs:USER.YesYesNoYesNone, see description.
0x567890ABNAND CTR FSNoYesNoNo?
0x567890ACTWL PHOTOYesYesNoNo?
0x567890ADTWLS (DSi Sound stores recordings here). This is mapped to the FAT12 image stored in the file at Twln/shared2/0000.NoYesNoNo?
0x567890AENAND TWL FSYesYesNoNo0x100
0x567890AFNAND W FSYesYesNoNo0x100
0x567890B0?NoYesNoNo
0x567890B1Gamecard SaveData (for check). This is a wrapper for UserSaveDataForCheck: the OpenArchive code for that is called with archive-lowpath TID=0/mediatype=2(gamecard).YesNoNoNo0x6
0x567890B2UserSaveData (for check). This is the same as the regular SaveData archive, except with this the savedata ID and mediatype is loaded from the input archive lowpath.YesNoNoYes0x6
0x567890B4Similar to 0x567890B2 but can only access Accessible Save specified in exheader?YesNoNoYes?

Archives listed as not requiring a binary lowpath, use lowpath type empty.

The above permission bitmasks are from v2.x, see the above Services section for how these are handled.

Archives CTR NAND, NAND RO Write FS, TWL NAND, NAND W FS, and CARD SPI FS require the corresponding process exheader access control mount flag to be set, in the exheader for any of the currently running ARM11 processes, for FSPXI. The access rights checked by FS module for archive mounting with fs:USER, are stored in the process’ exheader accessinfo.

The CARDSPI archive allows access to the gamecard CARD1 raw savedata flash(aka “cardspi:/” in Process9), the file lowpath must be WCHAR “/”. The “NAND W FS” archive allows access to the raw NAND image(aka “wnand:/” in Process9), the file lowpath must be WCHAR “/”.

Filenames and Paths #

PathType:

ValueDescription
-1Returned internally by Process9, when errors occur it seems(in particular when no nul-terminator was found in the input path). The data ptr is set to NULL.
0x0INVALID - Specifies an invalid path
0x1EMPTY - Specifies an empty path
0x2BINARY - Non-text based path. Meaning is per-archive
0x3ASCII - Text-based path with 7-bit ASCII characters padded to 8-bits each (signed char)
0x4UTF16 - Text-based path with UTF-16 characters

In IPC requests, sizes of ASCII and UTF16 paths must include space for the null-terminator.

Binary LowPath #

The format of the data that a binary LowPath points to is custom per archive.

SelfNCCH File Path Data Format #

Index wordDescription
0Type:

  • 0x0: RomFS
  • 0x1: error 0xD9004676
  • 0x2: ExeFS
  • 0x3: Error 0xE0E046BE.
  • 0x4: FS-module crashes on this
  • 0x5: Update RomFS?
1-2File name for ExeFS ("icon"/"banner"/"logo"). ".code" is not allowed

Note that ExeFS files only support reading from offset=0 and with size=file_size.

SystemSaveData Archive Path Data Format #

FS #

Index wordDescription
0Mediatype (must be zero for NAND)
1saveid

The file/directory lowpath is a text lowpath in the savegame filesystem.

FSPXI #

Index wordDescription
0u8 Mediatype (must be zero for NAND)

The file lowpath is a binary lowpath containing the u64 saveid, however the high word of the saveid is always zero. The mounted file is the cleartext savegame image. Up to 32 SystemSaveData image files can be opened under a single mounted FSPXI archive.

UserSaveDataForCheck Archive Path Data Format #

Index wordDescription
0Mediatype (must be non-zero)
1Lower word saveid
2Upper word saveid

The file/directory lowpath for this FS archive is a text path in the savegame filesystem.

0x567890B4 Archive Path Data Format #

Index wordDescription
0Mediatype
1Lower_word_saveid >> 8 ?
2Unknown. Game calculate this using formula `0xFFFFFF00

ExtSaveData Archive Path Data Format #

Index wordDescription
0Mediatype
1Lower word saveid
2Upper word saveid

For FS, the file/directory lowpath is a text path in the extdata filesystem. For FSPXI, the file lowpath is a text path relative to the “/extdata//” directory on SD/NAND, for the cleartext extdata image to mount.

0x2345678A Archive Path Data Format #

Index wordDescription
0Lower word programID
1Upper word programID
2( Mediatype & 0xFF) | (uninitialized_data? & 0xFFFFFF00)
3Number of something? Hardcoded per-archive, 0 for ExeFS, 200 for area:, 100 for rate:, 40 for eula:, etc.

File lowpath:

Index wordDescription
00 for NCCH data, 1 for savedata. The latter is only valid for FSPXI. Value 2 is allowed via archive 0x3, it’s unknown what this is.
1TMD content index / NCSD partition index.
2Type: 0=romfs(0 for non-NCCH as well), 1=exefs “.code”(?), 2=exefs “icon”/“banner”/“logo”, 3=unknown, 4=unknown, 5=unknown.
3-4Filename for ExeFS.

The 0x14-byte lowpath is all-zero for accessing the title’s main RomFS.

Archives 0x3 and 0x2345678E both allow for accessing the level-3 IVFC images for RomFS access. The main CXI RomFS is accessible via an all-zero 0xc-byte binary file-lowpath. The update RomFS can be accessed with the first u32 in the binary file-lowpath being set to 0x5. The user must handle parsing the filesystem used in the exposed image itself.

With FSPXI the returned data for RomFS is the entire RomFS section from the NCCH, starting at the IVFC header.

The 0x3 archive is an interface for the 0x2345678E archive with the current process programID+mediatype. The file lowpath is 3-words. These words are written to 0x2345678E-archive file_lowpath+0, with the rest of that lowpath set to all-zero(lowpath is different from archive 0x2345678A). File lowpath:

Index wordDescription
0See above. The only values which FS-module doesn't allow to be used here are:

  • 0x1: Error 0xE0E046BE.
  • 0x3: Error 0xE0E046BE.
  • 0x4: FS-module executes svcBreak when using this.
1-2See above. Not validated by FS-module.

SEEDDB #

With 9.6.0-X new System_SaveData with saveID 0001000F was added, this seems to be handled by FS-module itself, probably via the new service-cmds added to fsuser. Home Menu and NIM module have access to those commands.

The SEEDDB savedata contains the title-unique seed-data used for the new NCCH keyY generation added with FIRM 9.6.0-X.

Common Types #

MediaType #

ValueDescription
0NAND
1SD
2Game Card

SystemMediaType #

ValueDescription
0CTR NAND
1TWL NAND
2SD
3TWL Photo

OpenFlags #

BitDescription
0Read
1Write
2Create

Attributes #

OffsetSizeDescription
0x00x1Is Directory
0x10x1Is Hidden
0x20x1Is Archive
0x30x1Is Read-Only

WriteOption #

OffsetSizeDescription
0x00x1Flush
0x10x1Update Time Stamp
0x20x1Reserved
0x30x1Reserved

DirectoryEntry #

OffsetSizeDescription
0x00x20CUTF-16 Entry Name
0x20C0xA8.3 short filename name
0x2160x48.3 short filename extension
0x21A0x1Always 1
0x21B0x1Reserved
0x21C0x4Attributes
0x2200x8Entry Size

ArchiveResource #

OffsetSizeDescription
0x00x4Sector byte-size
0x40x4Cluster byte-size
0x80x4Partition capacity in clusters
0xC0x4Available free space in clusters

ProgramInfo #

OffsetSizeDescription
0x00x8Program ID
0x80x1Media Type
0x90x7Padding

ProductInfo #

OffsetSizeDescription
0x00x10Product Code
0x100x2Company Code
0x120x2Remaster Version

IntegrityVerificationSeed #

OffsetSizeDescription
0x00x10AES-CBC MAC over a SHA256 hash, which hashes the first 0x110-bytes of the cleartext SEED.
0x100x120The nand/private/movable.sed, encrypted with AES-CBC using the above MAC for the counter.

ExtSaveDataInfo #

OffsetSizeDescription
0x00x1Media Type
0x10x1Unknown
0x20x2Reserved
0x40x8Save ID
0xC0x4Reserved

SystemSaveDataInfo #

OffsetSizeDescription
0x00x1Media Type
0x10x1Unknown
0x20x2Reserved
0x40x4Save ID

SecureValueSlot #

ValueDescription
0x1000SD Application

CardSpiBaudRate #

ValueDescription
0x0512KHz
0x11MHz
0x22MHz
0x34MHz
0x48MHz
0x516MHz

CardSpiBusMode #

ValueDescription
0x01-bit
0x14-bit

SpecialContentType #

ValueDescription
0x1Update
0x2Manual
0x3DLP Child

DeviceMoveContext #

OffsetSizeDescription
0x00x10IVs
0x100x10Encrypt Parameter

Errors #

See Filesystem_services_PXI.

Category:Services