These commands are common to both ac:u and ac:i

These commands are exclusive to ac:i

The ACT module handles NNID accounts. This module behaves very similarly to the 🔗 Wii U implementation (nn::act)

These commands are used generally by most titles, and are also present in act:a.

This service is used mainly by the Nintendo Network ID Settings application accessible in System Settings.

The only commands accessible with this service are listed under this section.

boss:P also contains all of the commands from boss:U.

Same as cam:u

Same as cam:u

This was added with New3DS.

Most commands are same as cam:u, although, with different command headers since some commands which are available in cam:u do not exist in cam:q

Streetpass stuff.

This contains a similar (probably the same) command handler from 0x0001…. to 0x0021…. as them in cecd:u. In addition, it also contains

cfg:s contains all the commands in cfg:u, in addition to the following:

The CSND service talks to the DSP using the DSP FIFO to negotiate what CSND channels are allocated to the DSP, and this seems to be channels 0-7 (usually). The rest are dedicated to CSND services.

A maximum of 4 service sessions can be opened at the same time for this service.

This is the main service for playing audio. The CSND service can be used for playing audio as well, however most processes use this DSP service for playing audio. The DSP and CSND hardware can play audio simultaneously.

This system process handles displaying the error screens, such as “an error has occurred, the system needs shutdown”. This can also display a register dump for exceptions, and info for fatal errors. (Normally the black-screen errors are displayed on retail, while the latter is displayed on development units.)

The register dump/fatal error info can also be written to nandrw/sys/native.log. On retail consoles, the system does not notify ErrDisp that any user-land exceptions occurred, ErrDisp is only notified for this on dev/debug units. Therefore, on retail consoles native.log only contains info from fatal errors. Starting with 5.0.0-11 ErrDisp no longer writes logs to native.log, except when the error-type is value 5 and when other checks with the errorinfo structure are successful (normally processes using this port never use error-type 5).

You can at most have 32 FS archive handles.

Note: The question marks from Dummy1 to GetSpecialFileSize on the “available since system version” field are mainly there because I think that most of these are necessary for the main system to function, so theoretically that would mean that since the creation of the 3DS these were available, or since launch if that makes more sense. But because of the peculiar nature of some of the functions, they will remain question marks until they can be confirmed 100%.

Includes all the commands in frd:u, and, in addition:

For the mapping between GPIO bitmasks and IRQs see: GPIO:BindInterrupt#Supported_values.

The commands for these services are identical.

The input bitmask for each command is masked with the above permission bitmask, if the result is non-zero an error is occurred.

The bitmask used by the service commands determines which bits in the GPIO registers to access. The output value from GetGPIOData uses the same format as the bitmask: the values of bits in the output field are set to the value of GPIO data when those bits are set in the input bitmask.

__TOC__

The GSP module starts a thread for handling commands for each service session, a maximum of 4 processes can use this service at once. Official applications have an optional code-path which writes to registers during initialization, this is normally not used however.

The maximum number of sessions that can open with all of these services combined is 6.

This is used by Home Menu and other system titles. The command-handler for this is the same as the other HID services, see above.

Initially a HTTP context will not trust any root-CAs at all. Which root-CAs to trust must be explicitly specified via the add-root-CA service command(s).

Each I2C service can only access certain I2C device(s). When the specified deviceid isn’t accessible, error 0xE0A02FEA is returned.

This service was added with 2.0.0-2.

Category:Services

This is an interface for using the MIC hardware via the “cdc:MIC” service and the MIC IO registers.

This is used for 3DS<>DS(i) local-WLAN communications, via the DS<>DS wifi protocol.

See also here.

This is an u32 value where the intended range is <16. It’s unknown whether this is for nodes or some sessionID.

Represents the status of a single daemon.

This system module handles the system notifications.

The maximum number of notifications that can be stored/handled is 100, hence the intended range for notificationIDs is 0-99.

This service only has one command.

• “news.db”: This is the main save-file, the filesize is fixed to 0x2BD0-bytes.
• “newsXXX.txt” This is the message data for this notification, where XXX is the decimal notification-index in the below headers-array. The filesize should be <= <size listed here>, since that’s the max size read by the notifications applet.
• “newsXXX.mpo” This is the MPO data for this notification if any, where XXX is the decimal notification-index in the below headers-array. The filesize should be <= <size listed here>, since that’s the max size read by the notifications applet.

The actual main function called by main() does the following:

The nim system module communicates with a server called kagiya (kagiya-ctr.cdn.nintendo.net or kagiya-dev-ctr.cdn.nintendo.net for development units). It provides the 9.6 crypto seed in binary form for any given title ID under (HTTPS) kagiya-ctr.cdn.nintendo.net/title/0x%16llx/ext_key?country=%s, where %16llx is the title ID and %s is a country code as used in the eShop.

The NS (Nintendo User Interface Shell) system module is the first module launched from a CTR-NAND title after the FIRM processes are loaded (also see Bootloader). This module is launched by the pm process, with the titleID loaded from NS state(hard-coded TID initialized during applet TID-array initialization). NS first launches ErrDisp, then the menu. On retail the menu TID is loaded from NS state, while on dev/debug the menu TID is loaded from config. On dev-units if the menu TID block doesn’t exist in config, NS will attempt to launch the alternate menu instead. The TID of the launched menu is then written to ACTIVEMENUTID. NS uses pm:app to launch titles.

These NWM services are used for local-WLAN communications, NWM module handles regular wifi APs as well. These services are used for creating/connecting to networks, and for sending/receiving data over the network etc. NWM module uses the wifi SDIO hardware via the IO registers for this.

PullPacket is used for receiving data over the network and SendTo is for sending data over the network.

Used by Codec Services.

A maximum of three sessions can be open with both of these services combined, therefore only three processes can use either of these services at once.

These commands are an interface for Process_Services_PXI.

A total of 24 sessions can be open for each of these services combined. The commands for each service are handled by the PTM module main() thread.

The above commands are available for all PTM services, except the SetSystemTime service.

The ‘pxi’ sysmodule contains the following services:

• PxiFS0
• PxiFS1
• PxiFSB
• PxiFSR
• PxiPM
• pxi:am9
• pxi:dev
• pxi:mc
• pxi:ps9

Each of these services has up to 4 static IPC buffers of size 0x1000. When any of these service ports are sync:d, the IPC cmdbuf (TLS+0x80+) is sent over PXI to the ARM9.

Each PXI service can only have one session open for it at a time.

The communication protocol for normal PXI commands is documented below. The size of cmd_buf is calculated from the cmd_hdr. With newer FIRM the total size for command header + buffer must be at most 0x40 words, otherwise Process9 will panic.

QTM is the New_3DS system module in charge of handling head tracking. A maximum of three (only two until 9.3.0-21) sessions for *all* QTM services combined.

Head tracking is not usable when any other process is using any of the cameras, QTM returns error 0xC8A18008 for this.

QTM only tracks the position of the user’s two eyes, but does not track the area they are focusing at. Hence, “eye-tracking” is sometimes used to refer to this feature on 3DS, even though it means something else outside the 3DS hacking scene.

The mapadress used in these services is calculated by the user-process like so: when inputaddr is <0x08000000, the address used is the same one from inputaddr. Otherwise, the address is: mapvaddr = inputaddr - (0x08000000 - <main-process .text address + .text, .rodata, .data, and .bss size aligned to pagesize>). This service API is used for CTR “DLLs”/shared libraries: CRO.

Services are an abstraction of ports and are the commonly used way of inter-process communication outside of the kernel. While handles of regular ports are retrieved from svcConnectToPort, service handles are retrieved through the port srv: (“service manager”).

When a service is registered, svcCreatePort is used without a port-name. This means that the port is inaccessible via the port SVCs outside of sm-module. See below for getting a session handle for sending commands to services.

The socket sysmodule has a maximum limit of 64 sockets in total.

There can be up to 18 sessions of this service.

There can be up to 3 sessions of this service.

• “SPI::NOR” (used by cfg:NOR)
• “SPI::CD2” (used by Codec Services)
• “SPI::CS2”
• “SPI::CS3”
• “SPI::DEF”

There can only be 5 sessions open total, with 1 per service. When there’s already a session open for the target service(with session_count<5), SPI-module will wait for the original thread to terminate(triggered by the session closing), then start a new thread.

0,1,2: 0x1EC60800
3,4,5: 0x1EC42800
    6: 0x1EC43800

Category:Services

Going by strings in the SSL sysmodule it appears the sysmodule uses RSA BSAFE(like certain other 3DS software), this is also likely where the “ssl:C” name comes from(RSA BSAFE “SSL-C”).