Nintendo BOSS servers research

npdl.md

Nintendo BOSS Download server (NPDL)

Possible URL formats:

https://npdl.cdn.nintendowifi.net/p01/nsa/:appID/:taskID/:fileName

https://npdl.cdn.nintendowifi.net/p01/nsa/:appID/:taskID/:languageCode/:fileName

https://npdl.cdn.nintendowifi.net/p01/nsa/:appID/:taskID/:countryCode/:languageCode/:fileName

This server allows users to download files available on BOSS with a given App ID, Task ID and filename. This is used by most SpotPass games for receiving content.

A task ID may enforce usage of country or language on the path, in which case the server will return a 404 if they aren't provided. The country can't be enforced alone. If none of them are enforced by the task, the server will not validate the values given for them when trying to request a file.

Examples:

https://npdl.cdn.nintendowifi.net/p01/nsa/3vveLadT8H6xKkQH/RNG_EC1/1.dlp

https://npdl.cdn.nintendowifi.net/p01/nsa/ZBq1ITue8b9aw64j/NEWS/es/NEWS

https://npdl.cdn.nintendowifi.net/p01/nsa/UrXSeurnxhPrq7AS/sysmsg1/ES/es/sysmsg1

Request

A request may contain some parameters which are added by the BOSS sysmodule if certain conditions are met.

Parameter	Description
ap	Nintendo Zone AP
tm	System model

The BOSS sysmodule can also store the date when the last update to a file was requested, which is used for caching by setting the If-Modified-Since header.

Response

The response is a custom BOSS-encrypted file, which has the the file contents on it.

If the app ID, the task ID or the filename are invalid, the server will return a 404.

HTTP headers:

HTTP/1.1 200 OK
Content-Type: application/octet-stream
Server: nginx
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Download-Options: noopen
X-Permitted-Cross-Domain-Policies: none
Referrer-Policy: strict-origin-when-cross-origin
Last-Modified: Fri, 17 Mar 2023 01:40:00 GMT
Accept-Ranges: bytes
Content-Disposition: attachment
Content-Transfer-Encoding: binary
X-Request-Id: 5f316058-b8cf-4599-bfe9-deeae0292818
X-Runtime: 0.783194
X-Content-Type-Options: nosniff
Content-Length: 5782
Cache-Control: private, max-age=600
Date: Fri, 10 Nov 2023 19:02:35 GMT
Connection: keep-alive

The Last-Modified date of a file doesn't exactly match the updated time that is returned on the filelist. This probably means that the BOSS servers start delivering the files to users some time after it has been uploaded to BOSS.

The response may also include a X-BOSS-Closed header, for which the BOSS sysmodule will return an error internally, reporting the content discontinuation.

Example value for Swapnote / Nintendo Letter Box: X-BOSS-Closed: Fri, 01 Nov 2013 02:00:00 GMT

npfl.md

Nintendo BOSS File List server (NPFL)

URL format: https://npfl.c.app.nintendowifi.net/p01/filelist/:appID/:taskID

This server gives the user a list of files that are available to be downloaded with the given App ID and Task ID. This is used for delivering passwords on Team Kirby Clash Deluxe and Mystery Gifts on Pokémon games for the 3DS.

Example: https://npfl.c.app.nintendowifi.net/p01/filelist/LUX1uLHXK82phCiX/FGONLYT?c=ES&l=es

Parameters

All parameters are optional, with the exceptions of country and language under certain conditions.

A task ID may enforce usage of country or language as a parameter, in which case the server will return a 403 if it isn't provided. The country can't be enforced alone.

Parameter	Description	Notes
c	Country code
l	Language code
a1	Attribute 1	See Attributes
a2	Attribute 2	See Attributes
a3	Attribute 3	See Attributes
ap	Nintendo Zone AP	Set by the BOSS sysmodule
tm	System model	Set by the BOSS sysmodule

If the client gives BOSS a parameter that doesn't exist, the server will return a 403.

Response

HTTP headers:

HTTP/1.1 200 OK
Content-Type: text/plain
Server: nginx
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Download-Options: noopen
X-Permitted-Cross-Domain-Policies: none
Referrer-Policy: strict-origin-when-cross-origin
Last-Modified: Sun, 25 Jun 2023 11:34:17 GMT
X-Request-Id: c58a37c4-5596-472f-9f63-2720d5999fdc
X-Runtime: 0.011714
X-Content-Type-Options: nosniff
Cache-Control: private, must-revalidate, max-age=0
Date: Sun, 25 Jun 2023 11:34:17 GMT
Content-Length: 132
Connection: keep-alive
x-nintendo-akamai-reference-id: 0.c66d655f.1687692856.19dd1094

The response is a custom plaintext format (Content-Type: text/plain) which provides the available files on the server. This format uses CRLF (\r\n) line endings and has a newline at EOF.

If the app ID or the task ID are invalid, the server will return a 403. If the app ID and task ID are valid but there are no files on the server, no files are listed.

Example empty response:

19f16317aee07e7b5978fec00bdddb259720dffc
        54

Example response from Team Kirby Clash Deluxe:

9268c2ae0c210df07a417683e35dd67b42df19f4
       132
007 anniversary	7	tj	5_50	0	1523520046
019	THANKYOU	19	tj	3_15	0	1557371320

SHA-1 Hash

The first line of the response is a SHA-1 hash of the rest of the file.

File size

The second line has the total length of the file, including this line and the previous hash. The size number must match the Content-Length of the response. The size number is padded with spaces on the left to fill up to 10 characters.

For example, when the file size is 54, there will be eight spaces for padding and then the two digits:

        54

File list

The rest of the lines of the response (if any) will be the avilable files on BOSS with some metadata divided into columns. The columns are divided with tabs (\t), and there are seven columns in total. If one of the columns for one of the files has no value, the column is left empty for that file and continues to the next column.

007 anniversary	7	tj	5_50	0	1523520046
019	THANKYOU	19	tj	3_15	0	1557371320

File name	Unknown	Attribute 1	Attribute 2	Attribute 3	Content size	Updated time
007	anniversary	7	tj	5_50	0	1523520046
019	THANKYOU	19	tj	3_15	0	1557371320

File name

This column represents the name of the file stored on the server.

Unknown

There is no exact name documented for this column, but it's used on Team Kirby Clash Deluxe for determining the password that the user must enter to unlock the given prize.

Attributes

A file stored on BOSS may have special attributes, which can be used to filter specific files when querying the filelist with attribute parameters. If attribute parameters are set, the server will search for those files that exactly match the given values by the client.

Attributes are also used on Team Kirby Clash Deluxe for determining the prize that a password will give.

Content size

This column represents the size of the decrypted payload content of the BOSS file.

Updated time

This Unix timestamp usually represents the time a file was last updated.

Interestingly, Nintendo Badge Arcade latest files give a value on November 18th, 2022, even though downloading the files report last updated on March 17th, 2023. This may imply that there may have been some automation system for that game which stopped updating the timestamp correctly after that date.