AINB

AINB (AI Node Binary) is a file format implementing behavior trees for game-specific code. At time of writing it has only appeared in titles on the ModuleSystem game engine. This article is primarily aimed at the version that appears in Tears of the Kingdom, Super Mario Bros. Wonder, Mario vs Donkey Kong, and the original October 2024 version of Nintendo Switch Online: Playtest Program (v0x407). ModuleSystem provides 3 built-in file categories that appear in their own dedicated folders in a title's romfs, being "AI" for actor behavior, "Logic" for actor ai group behavior, and "Sequence" for scene behavior, individual games are free to create their own file categories.

Version Table

Version	Applications	Differences From Previous
0x404	Nintendo Switch Sports, Splatoon 3
0x407	The Legend of Zelda: Tears of the Kingdom, Super Mario Bros. Wonder, Mario Vs Donkey Kong, Nintendo Switch Online: Playtest Program (010)
0x408	Nintendo Switch Online: Playtest Program (021)	>Now uses exb version 3 (u32 support) >Added u32 type to blackboard

File Structure

AINB assumes little endian. Hashes can be assumed to be 32-bit Murmur3 unless otherwise specified.

An AINB file defines a set of commands to evaluate a tree of built-in or game-specific node classes. The built-in "Element_ModuleCaller" node and supporting structures allow a "root" AINB file to call out to an external "module" AINB file, module's can call further modules, allowing AINB files to form a tree of tree's. An AINB's file extension typically designates whether it is a root .root.ainb or module .module.ainb. For AI and Sequence files, the file's entry point is one or more commands which is linked to one or two child nodes. All nodes are accessed by their index (references to query nodes will use their query node index which is local to the amount of query nodes in the file).

All string offsets in the file are relative to the beginning of the string pool and name hashes are 32-bit murmur3 hashes. There are six possible data types for AINB parameters: int (signed 32-bit integer), bool, float (32-bit), vector3f, and pointer. Pointer parameters are pointers to objects.

Section Order

Version 0x407

1. File Header (0x74)
2. Command Array
3. Element Array
4. Blackboard
5. Element Param Region
6. Attachment Parameters
7. Property Parameters
8. Input/Output Parameters
9. Multi-Inputs
10. Jump Array
11. 0x50 Section (Unused in TotK)
12. Query Id Array
13. Expression Binary
14. AINB Modules
15. External Action Array
16. File Hashes
17. Child Replacement Table
18. 0x6C Section
19. Enum Resolve Array
20. String Pool

Structures

Helpers

AinbString

Represents a u32 offset relative to a null-terminated string from the start of the file's string pool.

AinbPtr<T>

Represents a u32 absolute offset from the start of the file to the struct of type "T" enclosed by <>.

AinbArray<T>

Represents a u32 absolute offset from the start of the file to:

Offset	Size	Type	Description
0x0	0x4	u32	Count
0x4		T[Count]	Array of struct of type T. Note; asb files only use 32-bit aligned types.

File Header

AINB files begin with a 0x74 byte header. If the offset for a given section is empty, that section is not present in the file.

File Header

Offset	Size	Type	Description
0x00	0x04	char[4]	Magic - “AIB “
0x04	0x04	u32	Version
0x08	0x04	AinbString	Filename
0x0C	0x04	u32	Command Count
0x10	0x04	u32	Element Count
0x14	0x04	u32	Query Element Count
0x18	0x04	u32	Attachment Count
0x1C	0x04	u32	Output Element Count
0x20	0x04	AinbPtr<Blackboard>	Blackboard
0x24	0x04	AinbPtr<char>	String Pool
0x28	0x04	AinbPtr<AinbArray<Enum Relocation>>	Enum Relocation Array
0x2C	0x04	AinbPtr<Property Table>	Property Table
0x30	0x04	AinbPtr<Jump[]>	Jump Table
0x34	0x04	AinbPtr<Input Output Table>	Input/Output Table
0x38	0x04	AinbPtr<Multi Input[]>	Multi-Input Array
0x3C	0x04	AinbPtr<Attachment[Attachment Count]>	Attachment Array
0x40	0x04	AinbPtr<u32[]>	Attachment Id Array
0x44	0x04	AinbPtr<Exb>	Expression Binary
0x48	0x04	u32	Child Replacement Table
0x4C	0x04	AinbPtr<u32[]>	Query Element Id Array
0x50	0x04	u32	Unknown (unused in TotK, always the same as the Active Node Update Array Offset)
0x54	0x04	u32	Unknown (always 0)
0x58	0x04	u32	Unknown (always 0, used in Splatoon 3/Nintendo Switch Sports)
0x5C	0x04	AinbPtr<AinbArray<Module Caller>>	Module Caller Array
0x60	0x04	AinbString	File Category Name
0x64	0x04	u32	File Category? (0 = AI, 1 = Logic, 2 = Sequence) (Splatoon 3 game specific, 3 = UniqueSequenceSPL)
0x68	0x04	AinbPtr<AinbArray<External Action>>	External Action Array
0x6C	0x04	u32	Unknown (Unused in TotK)
0x70	0x04	AinbPtr<Module Caller Link>	Module Caller Link

Command Array

The command array immediately follows the file header and is an array of all commands in the file.

Command Entry

Offset	Size	Type	Description
0x00	0x04	AinbString	Name
0x04	0x10	Guid	Guid
0x14	0x02	u16	Main Element Id
0x16	0x02	u16	Secondary Element Id (value offset by 1, 0 is reserved for invalid)

Unlike asb, command GUIDs only appear to be used for debug messages. Secondary Element Id will be -1 if the command only has one child element.

Property Table

Offset	Size	Type	Description
0x00	0x04	AsbPtr<Property<s32>[]>	Property Array
0x04	0x04	AsbPtr<Property<bool>[]>	Property Array
0x08	0x04	AsbPtr<Property<float>[]>	Property Array
0x0c	0x04	AsbPtr<Property<AinbString>[]>	Property Array
0x10	0x04	AsbPtr<Property<Vector3f>[]>	Property Array
0x14	0x04	AsbPtr<PropertyPointer[]>	Property Array

Property<T>

Offset	Size	Type	Description
0x0	0x4	AinbString	Name
0x4	0x4	Property Flags	Flags
0x8	0x4, or 0xc	T	Immediate Value

Property Flags

Offset	Size	Type	Description
0x0	0x4	u32 : 16	Index
		u32 : 1	Is Use Index
		u32 : 1	Is Not Local Blackboard Index
		u32 : 1
		u32 : 1
		u32 : 1
		u32 : 1
		u32 : 1	Is EXB Index
		u32 : 1	Pulse Thread Local Storage
		u32 : 1	Set Pointer Flag Bit Zero
		u32 : 7

PropertyPointer

Offset	Size	Type	Description
0x0	0x4	AinbString	Name
0x4	0x4	AinbString	Class Name
0x8	0x4	Property Flags	Flags

Property Entries

Offset	Size	Type	Description
0x0	0x8	Property Type Entry	S32 Entries
0x8	0x8	Property Type Entry	Bool Entries
0x10	0x8	Property Type Entry	Float Entries
0x18	0x8	Property Type Entry	String Entries
0x20	0x8	Property Type Entry	Vector3f Entries
0x28	0x8	Property Type Entry	Pointer Entries

Property Type Entry

Offset	Size	Type	Description
0x0	0x4	u32	Base Index - base index into the Property Table's Property Array for the specified type
0x4	0x4	u32	Count

Input Output Table

Offset	Size	Type	Description
0x00	0x04	AsbPtr<Input<s32>[]>	Input Array
0x04	0x04	AsbPtr<Output<s32>[]>	Output Array
0x08	0x04	AsbPtr<Input<bool>[]>	Input Array
0x0c	0x04	AsbPtr<Output<bool[]>	Output Array
0x10	0x04	AsbPtr<Input<float>[]>	Input Array
0x14	0x04	AsbPtr<Output<float>[]>	Output Array
0x18	0x04	AsbPtr<Input<AinbString>[]>	Input Array
0x1c	0x04	AsbPtr<Output<AinbString>[]>	Output Array
0x20	0x04	AsbPtr<Input<Vector3f>[]>	Input Array
0x24	0x04	AsbPtr<Output<Vector3f>[]>	Output Array
0x28	0x04	AsbPtr<InputPointer[]>	Input Array
0x2c	0x04	AsbPtr<OutputPointer[]>	Output Array

Input<T>

Offset	Size	Type	Description
0x0	0x4	AinbString	Name
0x4	0x2	s16	Input Element Id or Base Multi-Input Id
0x6	0x2	s16	Input Element Output Plug Id or Multi-Input Count
0x8	0x4	Property Flags	Flags
0xc	0x4, or 0xc	T	Immediate Value

If the input element id is between -32768 and -100, then the input uses a multi-input. The multi-input id can be calculated as follows: BaseMultiInputIndex = -100 - Index.

InputPointer

Offset	Size	Type	Description
0x0	0x4	AinbString	Name
0x4	0x4	AinbString	Class Name
0x8	0x2	s16	Input Element Id or Base Multi-Input Id
0xa	0x2	s16	Input Element Output Plug Id or Multi-Input Count
0xc	0x4	Property Flags	Flags
0x10	0x4	u32

Output<T>

Offset	Size	Type	Description
0x0	0x4	AinbString : 31	Name
		u32 : 1

OutputPointer

Offset	Size	Type	Description
0x0	0x4	AinbString : 31	Name
		u32 : 1
0x4	0x4	AinbString	Class Name

Input Output Entries

Offset	Size	Type	Description
0x0	0x10	Input Output Type Entry	S32 Entries
0x10	0x10	Input Output Type Entry	Bool Entries
0x20	0x10	Input Output Type Entry	Float Entries
0x30	0x10	Input Output Type Entry	String Entries
0x40	0x10	Input Output Type Entry	Vector3f Entries
0x50	0x10	Input Output Type Entry	Pointer Entries

Input Output Type Entry

Offset	Size	Type	Description
0x0	0x4	u32	Input Base Index - base index into the Input Output Table's Input<T> array for the specified type
0x4	0x4	u32	Input Count
0x8	0x4	u32	Output Base Index - base index into the Input Output Table's Output<T> array for the specified type
0x10	0x4	u32	Output Count

Element Array

The node array immediately follows the command array and is an array of all nodes in the file.

Node Entry

Offset	Size	Type	Description
0x00	0x02	u16	Element Type
0x02	0x02	u16	Element Id - Index of this element within the element array
0x04	0x02	u16	Attachment Count
0x06	0x01	bitfield	Element Flags
0x07	0x01	u8
0x08	0x04	AinbString	Element Type Name (for ApplicationDefined nodes)
0x0C	0x04	u32	Name Hash (version 0x407+)
0x10	0x04	u32
0x14	0x04	AinbPtr<ElementParam<Element Type>>	Element Param
0x18	0x02	u16	EXB Function Count
0x1A	0x02	u16	EXB Input/Output Field Size
0x1C	0x02	u16	Multi-Input Count
0x1E	0x02	u16
0x20	0x04	u32	Base Attachment Id
0x24	0x02	u16	Base Query Element Id
0x26	0x02	u16	Query Element Count
0x28	0x02	u16	0x58 Section Entry Offset (relative to the start of the file)
0x2A	0x02	u16
0x2C	0x10	Guid	Guid

Just like with commands, node GUIDs are only used for debug messages. The 0x58 section entry offset will be empty if unused.

Element Type

Element Types

Value (Hex)	Value (Dec)	Node Type
0x00	0	Application Defined
0x01	1	Element_S32Selector
0x02	2	Element_Sequential
0x03	3	Element_Simultaneous
0x04	4	Element_F32Selector
0x05	5	Element_StringSelector
0x06	6	Element_RandomSelector
0x07	7	Element_BoolSelector
0x08	8	Element_Fork
0x09	9	Element_Join
0x0A	10	Element_Alert
0x14	20	Element_Expression
0x64	100	Element_ModuleIF_Input_S32
0x65	101	Element_ModuleIF_Input_F32
0x66	102	Element_ModuleIF_Input_Vec3f
0x67	103	Element_ModuleIF_Input_String
0x68	104	Element_ModuleIF_Input_Bool
0x69	105	Element_ModuleIF_Input_Ptr
0xC8	200	Element_ModuleIF_Output_S32
0xC9	201	Element_ModuleIF_Output_F32
0xCA	202	Element_ModuleIF_Output_Vec3f
0xCB	203	Element_ModuleIF_Output_String
0xCC	204	Element_ModuleIF_Output_Bool
0xCD	205	Element_ModuleIF_Output_Ptr
0x012C	300	Element_ModuleIF_Child
0x0190	400	Element_StateEnd
0x01F4	500	Element_SplitTiming

Element type names are official (outside ApplicationDefined). For ApplicationDefined elements, definitions can be found in a node definition file for the respective file category. This file is located at NodeDefinition/Node.Product.[ver].aidefn.byml.zs in the corresponding file category folder.

Node Type Descriptions

Type	Description
UserDefined	Custom node type, definition in NodeDefinition
Element_S32Selector	Conditionally links to a node depending on the value of a signed int
Element_Sequential	Links to nodes sequentially in the order listed
Element_Simultaneous	Links simultaneously to multiple nodes
Element_F32Selector	Conditionally links to a node depending on the value of 32-bit float
Element_StringSelector	Conditionally links to a node depending on the value of a string
Element_RandomSelector	Links to a node randomly
Element_BoolSelector	Conditionally links to a node depending on the value of a bool
Element_Fork	See Active Node Update Array
Element_Join	See Active Node Update Array
Element_Alert	Displays a debug message
Element_Expression	Passes values to and from EXB commands
Element_ModuleIF_Input_S32	Receives a signed int input from the calling AINB file
Element_ModuleIF_Input_F32	Receives a 32-bit float input from the calling AINB file
Element_ModuleIF_Input_Vec3f	Receives a vector3f input from the calling AINB file
Element_ModuleIF_Input_String	Receives a string input from the calling AINB file
Element_ModuleIF_Input_Bool	Receives a bool input from the calling AINB file
Element_ModuleIF_Input_Ptr	Receives an object pointer input from the calling AINB file
Element_ModuleIF_Output_S32	Returns a signed int output from the module to the calling AINB file
Element_ModuleIF_Output_F32	Returns a 32-bit float output from the module to the calling AINB file
Element_ModuleIF_Output_Vec3f	Returns a vector3f output from the module to the calling AINB file
Element_ModuleIF_Output_String	Returns a string output from the module to the calling AINB file
Element_ModuleIF_Output_Bool	Returns a bool output from the module to the calling AINB file
Element_ModuleIF_Output_Ptr	Returns an object pointer output from the module to the calling AINB file
Element_ModuleIF_Child	Returns the node connection name from the module to the calling AINB file
Element_StateEnd	Termination node, specifies what resident node to return to in the calling AINB file
Element_SplitTiming	Changes when child nodes are run (Enter - first time visiting a node, Update - every frame, Leave - ran upon leaving the node)

Element Flags

Element Flags

Bits	Description
1	Is Query Element
1	Is Module Caller
1	Is Resident Initialized
1	Is Query Multi-Input
4

ElementParam<T>

Each element contains a table into the 4 parameter types, properties, inputs, outputs, and plugs. The child plugs inform the structure of the element tree.

Offset	Size	Type	Description
0x0	0x30	Property Entries	Entries into the Property Table.
0x30	0x60	Input Output Entries	Entries into the Input Output Table.
0x90	0x14	Plug Entries	Entries into the following plug pointer array.
0xa4	AsbPtr<>[Total Plug Count]	Plug Data	Plug Data Pointer Array.

Plug Entries

Offset	Size	Type	Description
0x0	0x2	Plug Type Entry	Bool/float Input Source/Output Source
0x2	0x2	Plug Type Entry
0x4	0x2	Plug Type Entry	Child Plugs
0x6	0x2	Plug Type Entry	Jump Plugs
0x8	0x2	Plug Type Entry	String Input Source
0xa	0x2	Plug Type Entry	Int Input Source
0xc	0x2	Plug Type Entry
0xe	0x2	Plug Type Entry
0x10	0x2	Plug Type Entry
0x12	0x2	Plug Type Entry

Plug Type Entry

Offset	Size	Type	Description
0x0	0x1	u8	Count
0x1	0x1	u8	Base Index - base index into Plug Pointer Array

Plugs

Typical Plug Data

Offset	Size	Type	Description
0x00	0x04	u32	Element Id
0x04	0x04	u32	Value

The interpretation of the value depends on the connection type. For input or output connections, the value is a string of the parameter name. For standard connections, the value is a string of the connection name. For jump connections, the value is an id into the Jump Table. Elements are free to extend the plug data with their own element specific values. For built-in element selector-types, excluding Element_BoolSelector and Element_F32Selector, an extra four bytes stores data used to select the child plug. For Element_S32Selector, this is an immediate value. For Element_RandomSelector, this is a weight and for Element_StringSelector it is a string. The condition for Element_BoolSelector is the entry's value string. Element_F32Selector adds 24 bytes to each entry, consisting of four eight-byte sub-entries.

Element_F32Selector Condition Entry

Offset	Size	Type	Description
0x00	0x04	u32	Local Blackboard Parameter Index and Flags
0x04	0x04	float	Condition Value

The first two bytes of the four bytes at offset 0x00 are the blackboard parameter index while the last bit is whether or not the index is used or not. The first entry for Element_F32Selector is the minimum value condition while the second entry is the maximum value condition. The last two entries appear to be unused. The last child element entry for Selector-type nodes is the default case. The condition for this case is either the string その他 ("Other") or 0 (in the case of Element_S32Selector). Input elements that are Selector-type elements also appear to have an additional eight bytes (purpose unknown). Element_Expression has an additional eight bytes per input element (16 bytes in the case of vector3f entries). The purpose of these bytes is unknown.

Blackboard

This section contains an array of the Blackboard parameters used by file. These parameters may be sourced from external Blackboards or parameter files. The section begins with a 0x30 byte section header followed by the array of parameters, an array of default values of said parameters, and an array of file references if applicable. The order of parameters is in the order of string, int, float, bool, vector3f, and pointer. The section header contains six entries, one for each type.

Section Header Entry

Offset	Size	Type	Description
0x00	0x02	u16	Number of Entries of the Corresponding Data Type
0x02	0x02	u16	Parameter Index of the First Entry of the Corresponding Data Type
0x04	0x02	u16	Relative Offset of the First Entry of the Corresponding Data Type
0x06	0x02	u16

Local Blackboard Parameter Entry

Offset	Size	Type	Description
0x00	0x04	bitfield	Name Offset and Flags
0x04	0x04	u32	String Offset (Notes)

Name Offset Flags

Bits	Description
22	Name Offset
1
1	Does Not Have File Reference
7	File Reference Index
1	Is File Reference Valid

The default value entries vary based on the parameter's data type. For int, float, and bool parameters, the entry is a four byte immediate value. String entries are a four byte string value offset. Vector3f entries are 12 bytes. Note that pointer parameters do not have default value entries and do not have default values.

File Reference Entry

Offset	Size	Type	Description
0x00	0x04	u32	File Path Offset
0x04	0x04	u32	File Path Hash
0x08	0x04	u32	Filename Hash (no extension)
0x0C	0x04	u32	File Extension Hash (no .)

Attachments

Offset	Size	Type	Description
0x00	0x04	AinbString	Name
0x04	0x04	AinbPtr<Attachment Param>	Parameters Entry Offset
0x08	0x02	u16	EXB Function Count
0x0A	0x02	u16	EXB Input/Output Field Size
0x0C	0x04	u32	Name Hash (version 0x407+)

Attachment Param

Parameter Entry

Offset	Size	Type	Description
0x00	0x1	u8	Unknown (possibly related to debug)
0x01	0x3	u24
0x4	0x30	Property Entries	Property Entries

Multi-Input

Multi-Input Entry

Offset	Size	Type	Description
0x00	0x02	u16	Node Index
0x02	0x02	u16	Input/Output Source Parameter Index
0x04	0x04	u32	Flags

Jump

Bits	Description
8	Is Valid Update
23
1	Update Post Calc

If the first byte of the flags is set to false, then the entry contains another four bytes with a string offset (purpose unknown). Otherwise, the entry is considered valid if the first byte equals 1. When evaluating the behavior trees, the game maintains an array of each root element. When a command is set, the root element of the command is set to this context. A jump will change that root element to the element specified by the jump plug's element id. This usually happens right before the next command's calculation occurs, but if the top bit is set, then it will occur immediately after the current command's calculation finishes (if the source element is an Element_Join, it will always update the root elements post current command calculation). This is primarily used for "subroutines" that run a single time then return to the main execution routine. Element_Fork and Element_Join are the main mechanism to manage multiple root elements. An Element_Fork will replace the current root elements with the element id's of it's jump plugs, possibly "forking" execution into multiple roots. The element at the end of a root element specified by an Element_Fork will optionally have a jump plug referencing a specific Element_Join. Each of these elements will push the Element_Join into the root element array. However, Element_Join has a property parameter called InFlowNum, and until that element has been pushed onto the root element array that many times in a single calculation, it will not activate and remain dormant. However, once this threshold is reached, it will begin execution (with a guard to make sure only one of the instances added to the array will execute).

0x50 Section

This section is unused in Tears of the Kingdom.

Query Element Id Array

This section is an array of entries of query element ids present in the file.

Query Node Entry

Offset	Size	Type	Description
0x00	0x02	u16	Query Element Id (local to number of query nodes)
0x02	0x02	u16

Expression Binary

The EXB (Expression Binary) section is a completely self-contained section that stores custom instructions for a simple command processor. These instructions are grouped into functions that can be called by nodes to perform calculations. Because the section is self-contained, all offsets in this section are local to the section. The EXB section is shared with ASB files (Animation Sequence Binary).

Section Structure

EXB is essentially its own format and allows for the storage of custom functions in files.

Section Order

1. 0x2C-Byte Header
2. Command Info Table
3. Instructions Table
4. Parameter Region
5. Signature Table
6. String Pool

Sub-Sections

Header

EXB Header

Offset	Size	Type	Description
0x00	0x04	char[4]	Magic - “EXB “
0x04	0x04	u32	Version (0x02)
0x08	0x04	u32	Static Memory Allocation Size
0x0C	0x04	u32	Parameter EXB Field Entry Count
0x10	0x04	u32	32-bit Scratch Allocation Size
0x14	0x04	u32	64-bit Scratch Allocation Size
0x18	0x04	u32	Command Info Offset
0x1C	0x04	u32	Command Table Offset
0x20	0x04	u32	Signature Table Offset
0x24	0x04	u32	Parameter Region Offset
0x28	0x04	u32	String Pool Offset

Command Info Table

This section contains an array of command (function) info entries. The first four bytes specify the entry count.

Command Info Entry

Offset	Size	Type	Description
0x00	0x04	s32	Base Index Pre-Command Entry
0x04	0x04	u32	Pre-Entry Static Memory Usage
0x08	0x04	u32	Instruction Base Index
0x0C	0x04	u32	Instruction Count
0x10	0x04	u32	Static Memory Size
0x14	0x02	u16	32-bit Scratch Memory Size
0x16	0x02	u16	64-bit Scratch Memory Size
0x18	0x02	u16	Output Data Type Enum
0x1A	0x02	u16	Input Data Type Enum

Data Type Enum

Value (Hex)	Value (Dec)	Data Type
0x0	0	No Data
0x1	1	Immediate Value/From User
0x02	2	bool
0x03	3	int
0x04	4	float
0x05	5	string
0x06	6	vector3f

Instructions Table

This section contains an array of instruction entries which are read by the EXB command processor. The first four bytes specify the entry count.

Instruction Entry

Offset	Size	Type	Description
0x00	0x01	u8	Instruction Type
0x01	0x01	u8	Data Type Enum
0x02	0x01	u8	Left-Hand Side Parameter Source Enum
0x03	0x01	u8	Right-Hand Side Parameter Source Enum
0x04	0x02	u16	Left-Hand Side Parameter Value
0x06	0x02	u16	Right-Hand Side Parameter Value

For UserDefined type instructions, the bytes at offset 0x02-0x04 become a u16 static memory index and the bytes at 0x04-0x08 become a u32 index into the function signatures table.

Instruction Types

Value (Hex)	Value (Dec)	Instruction Type
0x01	1	Terminator
0x02	2	Store
0x03	3	Negate
0x04	4	NegateBool
0x05	5	Add
0x06	6	Subtract
0x07	7	Multiply
0x08	8	Divide
0x09	9	Modulus
0x0A	10	Increment
0x0B	11	Decrement
0x0C	12	ScalarMultiplyVec3f
0x0D	13	ScalarDivideVec3f
0x0E	14	LeftShift
0x0F	15	RightShift
0x10	16	LessThan
0x11	17	LessThanEqual
0x12	18	GreaterThan
0x13	19	GreaterThanEqual
0x14	20	Equal
0x15	21	NotEqual
0x16	22	AND
0x17	23	XOR
0x18	24	OR
0x19	25	LogicalAND
0x1A	26	LogicalOR
0x1B	27	UserFunction
0x1C	28	JumpIfLHSZero
0x1D	29	Jump

UserFunctions are mapped to a function in the executable by function signature. There are two types of these functions: direct and object. Direct functions are straightforward functions that take up to two arguments and are matched using the function signature. Function objects can take additional arguments and are indexed at runtime.

Data Type Enum

Value (Hex)	Value (Dec)	Data Type
0x0	0	No Data
0x1	1	Immediate Value/From User
0x02	2	bool
0x03	3	int
0x04	4	float
0x05	5	string
0x06	6	vector3f

Parameter Source Enum

Value (Hex)	Value (Dec)	Parameter Source
0x00	0	Immediate Parameters
0x01	1	Immediate Parameters (String)
0x02	2	Static Memory
0x03	3	Parameters Region
0x04	4	Parameters Region (String)
0x05	5	Output Value
0x06	6	Input Value
0x07	7	32-bit Scratch
0x08	8	64-bit Scratch
0x09	9	UserOutput
0x0A	10	UserInput

UserCallback is a class that contains virtual functions providing memory allocation. The input value is passed from the calling node and the output value is passed back.

Parameter Region

The parameter region is a region that stores the values for parameters values that are too large to fit into two bytes. Parameters that get their values from this section instead store an offset relative to the beginning of the parameter region to the start of the value.

Signatures Table

This section is an array of u32 string offsets for each function signature.

String Pool

The string pool is an array of null-terminated strings encoded with UTF-8. All string offsets in this section are relative to the beginning of the string pool.

Module Caller

This section contains an array of all AINB modules linked to the current AINB file. The first four bytes specify the entry count.

AINB Module Entry

Offset	Size	Type	Description
0x00	0x04	u32	File Path Offset
0x04	0x04	u32	File Category Offset
0x08	0x04	u32	AINB File Count

External Action Array

This section appears to interact with XLink. The first four bytes specify the entry count.

Entry String Entry

Offset	Size	Type	Description
0x00	0x04	u32	Node Index
0x04	0x04	u32	String 1 Offset (always メインステート ("Main State"))
0x08	0x04	u32	State Name Offset

Module Caller Link

This section contains two 32-bit file hashes. The first hash is a hash for the file itself and the second hash appears to be a hash for that file's parent file. These are used by Element_ModuleCaller.

Child Replacement Table

This section is used to remove or replace specific elements or attachments at runtime. This is used to toggle off debug elements/attachments in release builds. The section begins with an eight-byte section header.

Child Replacement Section Header

Offset	Size	Type	Description
0x00	0x01	u8	Initialization Guard (Is Initialized)
0x01	0x01	u8
0x02	0x02	u16	Replacement Count
0x04	0x02	s16	Override Element Count
0x06	0x02	s16	Override Attachment Parameter Count

Child Replacement Table Entry

Offset	Size	Type	Description
0x00	0x01	u8	Replacement Type Enum (0 = remove child element, 1 = replace child element, 2 = remove attachment)
0x01	0x01	u8
0x02	0x02	u16	Element Id
0x04	0x02	u16	Child Element Id/Attachment Id
0x06	0x02	u16	New Element Id (for child element replacements)

0x6C Section

This section is unused in Tears of the Kingdom.

Enum Relocation

This section is used to resolve enum values at runtime. This section is unused in Tears of the Kingdom as all enum values are statically present in the file. However, in Splatoon 3, this section is used extensively as all enum values are stored in the main executable. The first four bytes of this section specifies the number of entries in the section.

Enum Resolve Array Entry

Offset	Size	Type	Description
0x00	0x04	u32	Enum Value Offset
0x04	0x04	u32	Enum Class Name Offset
0x08	0x04	u32	Enum Value Name Offset

String Pool

The string pool is an array of null-terminated strings encoded with UTF-8. All string offsets in the file are relative to the first byte of this section. Note that this section also contains some unreferenced strings which are the enums for certain parameters.