AINB

AINB (AI Node Binary) is a file format used for AI and logic on Tears of the Kingdom as well as other recent Nintendo EPD games. This article is primarily aimed at the version that appears in Tears of the Kingdom and Super Mario Bros. Wonder (v0x0407). AINB files can be found in the AI, Logic, and Sequence folders of the romfs as well as within various packs.

File Structure

AINB is a little endian format similar to most Switch file formats. An AINB file consists of a set of interconnected nodes which act like a syntax tree and control the behavior of actors. These nodes can also be calls to external AINB files, allowing AINB files to form entire trees of files. The root file of the tree will have .root.ainb as their extension while each module in the tree will have the extension .module.ainb. There are three primary categories of AINB files in TotK: AI, Logic, and Sequence. For AI and Sequence files, the file's entry point is one or more commands which is linked to one or two child nodes. All nodes are accessed by their index (references to precondition nodes will use their precondition node index which is local to the amount of precondition nodes in the file).

All string offsets in the file are relative to the beginning of the string pool and name hashes are 32-bit murmur3 hashes. There are six possible types for AINB parameters: int (signed 32-bit integer), bool, float (32-bit), vector3f, and pointer. Pointer parameters are pointers to objects.

Section Order

1. 0x74-Byte File Header
2. Commands
3. Nodes
4. Local Blackboard Parameters
5. Node Bodies
6. Attachment Parameters
7. Immediate Parameters
8. Input/Output Parameters
9. Multi-Parameters
10. Resident Update Array
11. 0x50 Section (Unused in TotK)
12. Precondition Nodes
13. Expression Binary
14. Embedded AINB Files
15. Entry Strings
16. File Hashes
17. Child Replacement Table
18. 0x6C Section
19. Enum Resolve Array
20. String Pool

Sections

File Header

AINB files begin with a 0x74 byte header. If the offset for a given section is empty, that section is not present in the file.

File Header

Offset	Size	Type	Description
0x00	0x04	char[4]	Magic - “AIB “
0x04	0x04	u32	Version (0x0407 in TotK, 0x0404 in S3 and NSS)
0x08	0x04	u32	Filename Offset
0x0C	0x04	u32	Command Count
0x10	0x04	u32	Node Count
0x14	0x04	u32	Precondition Node Count
0x18	0x04	u32	Attachment Parameter Count
0x1C	0x04	u32	Output Node Count
0x20	0x04	u32	Local Blackboard Parameters Offset
0x24	0x04	u32	String Pool Offset
0x28	0x04	u32	Enum Resolve Array Offset
0x2C	0x04	u32	Immediate Parameters Offset
0x30	0x04	u32	Resident Update Array Offset
0x34	0x04	u32	Input/Output Parameters Offset
0x38	0x04	u32	Multi-Parameters Array Offset
0x3C	0x04	u32	Attachment Parameters Offset
0x40	0x04	u32	Attachment Parameters Index Array Offset
0x44	0x04	u32	Expression Binary Section Offset
0x48	0x04	u32	Child Replacement Table Offset
0x4C	0x04	u32	Precondition Node Array Offset
0x50	0x04	u32	Unknown (unused in TotK, always the same as the Resident Update Array Offset)
0x54	0x04	u32	Unknown (always 0)
0x58	0x04	u32	Unknown (always 0, used in Splatoon 3/Nintendo Switch Sports)
0x5C	0x04	u32	Embedded AINB Files Offset
0x60	0x04	u32	File Category Name Offset
0x64	0x04	u32	File Category (0 = AI, 1 = Logic, 2 = Sequence) - only TotK
0x68	0x04	u32	Entry Strings Offset (purpose unknown)
0x6C	0x04	u32	Unknown (Unused in TotK)
0x70	0x04	u32	File Identification Hashes Offset (Purpose Unknown)

Command Array

The command array immediately follows the file header and is an array of all commands in the file.

Command Entry

Offset	Size	Type	Description
0x00	0x04	u32	Command Name Offset
0x04	0x10	u32	GUID
		u16
		u16
		u16
		u8[6]
0x14	0x02	u16	Left Node Index
0x16	0x02	u16	Right Node Index (one greater than the corresponding node index)

Command GUIDs are only used for debug messages. Right Node Index will be -1 if the command only has one child node.

Node Array

The node array immediately follows the command array and is an array of all nodes in the file.

Node Entry

Offset	Size	Type	Description
0x00	0x02	u16	Node Type Enum (see below)
0x02	0x02	u16	Node Index
0x04	0x02	u16	Attachment Parameters Count
0x06	0x01	bitfield	Node Flags
0x07	0x01	u8
0x08	0x04	u32	Node Type Name Offset (for UserDefined nodes)
0x0C	0x04	u32	Name Hash (version 0x407 only)
0x10	0x04	u32
0x14	0x04	u32	Node Body Offset (relative to the start of the file)
0x18	0x02	u16	EXB Function Count
0x1A	0x02	u16	EXB Input/Output Field Size
0x1C	0x02	u16	Multi-Param Count
0x1E	0x02	u16
0x20	0x04	u32	Base Attachment Parameter Index
0x24	0x02	u16	Base Precondition Node
0x26	0x02	u16	Precondition Node Count
0x28	0x02	u16	0x58 Section Entry Offset (relative to the start of the file)
0x2A	0x02	u16
0x2C	0x10	u32	GUID
		u16
		u16
		u16
		u8[6]

Just like with commands, node GUIDs are only used for debug messages. The 0x58 section entry offset will be empty if unused.

Node Types

Value (Hex)	Value (Dec)	Node Type
0x00	0	UserDefined
0x01	1	Element_S32Selector
0x02	2	Element_Sequential
0x03	3	Element_Simultaneous
0x04	4	Element_F32Selector
0x05	5	Element_StringSelector
0x06	6	Element_RandomSelector
0x07	7	Element_BoolSelector
0x08	8	Element_Fork
0x09	9	Element_Join
0x0A	10	Element_Alert
0x14	20	Element_Expression
0x64	100	Element_ModuleIF_Input_S32
0x65	101	Element_ModuleIF_Input_F32
0x66	102	Element_ModuleIF_Input_Vec3f
0x67	103	Element_ModuleIF_Input_String
0x68	104	Element_ModuleIF_Input_Bool
0x69	105	Element_ModuleIF_Input_Ptr
0xC8	200	Element_ModuleIF_Output_S32
0xC9	201	Element_ModuleIF_Output_F32
0xCA	202	Element_ModuleIF_Output_Vec3f
0xCB	203	Element_ModuleIF_Output_String
0xCC	204	Element_ModuleIF_Output_Bool
0xCD	205	Element_ModuleIF_Output_Ptr
0x012C	300	Element_ModuleIF_Child
0x0190	400	Element_StateEnd
0x01F4	500	Element_SplitTiming

Node type names are official. For UserDefined nodes, node definitions can be found in a node definition files. This file is located at NodeDefinition/Node.Product.[ver].aidefn.byml.zs in the corresponding file category folder.

Node Type Descriptions

Type	Description
UserDefined	Custom node type, definition in NodeDefinition
Element_S32Selector	Conditionally links to a node depending on the value of a signed int
Element_Sequential	Links to nodes sequentially in the order listed
Element_Simultaneous	Links simultaneously to multiple nodes
Element_F32Selector	Conditionally links to a node depending on the value of 32-bit float
Element_StringSelector	Conditionally links to a node depending on the value of a string
Element_RandomSelector	Links to a node randomly
Element_BoolSelector	Conditionally links to a node depending on the value of a bool
Element_Fork	See Resident Update Array
Element_Join	See Resident Update Array
Element_Alert	Displays a debug message
Element_Expression	Passes values to and from EXB commands
Element_ModuleIF_Input_S32	Passes a signed int as output to another node as input
Element_ModuleIF_Input_F32	Passes a 32-bit float as output to another node as input
Element_ModuleIF_Input_Vec3f	Passes a vector3f as output to another node as input
Element_ModuleIF_Input_String	Passes a string as output to another node as input
Element_ModuleIF_Input_Bool	Passes a boolean int as output to another node as input
Element_ModuleIF_Input_Ptr	Passes a pointer as output to another node as input
Element_ModuleIF_Output_S32	Passes a signed int as output to another node as output
Element_ModuleIF_Output_F32	Passes a 32-bit float as output to another node as output
Element_ModuleIF_Output_Vec3f	Passes a vector3f as output to another node as output
Element_ModuleIF_Output_String	Passes a string as output to another node as output
Element_ModuleIF_Output_Bool	Passes a boolean int as output to another node as output
Element_ModuleIF_Output_Ptr	Passes a pointer as output to another node as output
Element_ModuleIF_Child	Unsure, appears to just be a node connected to a ModuleIF node as a child node
Element_StateEnd	Termination node
Element_SplitTiming	Changes when child nodes are run (Enter - first time visiting a node, Update - every frame, Leave - ran upon leaving the node)

Node Flags

Bits	Description
1	Is Precondition Node
1	Is External AINB File
1	Is Resident Node
5

Local Blackboard Parameters

This section contains an array of the Blackboard parameters used by file. These parameters may be sourced from external Blackboards or parameter files. The section begins with a 0x30 byte section header followed by the array of parameters, an array of default values of said parameters, and an array of file references if applicable. The order of parameters is in the order of string, int, float, bool, vector3f, and pointer. The section header contains six entries, one for each type.

Section Header Entry

Offset	Size	Type	Description
0x00	0x02	u16	Number of Entries of the Corresponding Data Type
0x02	0x02	u16	Parameter Index of the First Entry of the Corresponding Data Type
0x04	0x02	u16	Relative Offset of the First Entry of the Corresponding Data Type
0x06	0x02	u16

Local Blackboard Parameter Entry

Offset	Size	Type	Description
0x00	0x04	bitfield	Name Offset and Flags
0x04	0x04	u32	String Offset (Notes)

Name Offset Flags

Bits	Description
22	Name Offset
1
1	Does Not Have File Reference
7	File Reference Index
1	Is File Reference Valid

The default value entries vary based on the parameter's data type. For int and float parameters, the entry is a four byte immediate value. String entries are a four byte string value offset. Bool entries are a single byte immediate value and vector3f entries are 12 bytes. Note that pointer parameters do not have default value entries and do not have default values.

File Reference Entry

Offset	Size	Type	Description
0x00	0x04	u32	File Path Offset
0x04	0x04	u32	File Path Hash
0x08	0x04	u32	Unknown Hash
0x0C	0x04	u32	Unknown Hash

Node Bodies

Each node body is composed of two parts: a 0x90 byte parameter section and a 0x14 child node section header followed by said section if applicable. The child node section contains information about the child node and specific connection types. The following parameter indices are indices into the parameter array for that specific type and data type.

Offset	Size	Type	Description
0x00	0x04	u32	Int Immediate Parameter Base Index
0x04	0x04	u32	Int Immediate Parameter Count
0x08	0x04	u32	Bool Immediate Parameter Base Index
0x0C	0x04	u32	Bool Immediate Parameter Count
0x10	0x04	u32	Float Immediate Parameter Base Index
0x14	0x04	u32	Float Immediate Parameter Count
0x18	0x04	u32	String Immediate Parameter Base Index
0x1C	0x04	u32	String Immediate Parameter Count
0x20	0x04	u32	Vector3f Immediate Parameter Base Index
0x24	0x04	u32	Vector3f Immediate Parameter Count
0x28	0x04	u32	Pointer Immediate Parameter Base Index
0x2C	0x04	u32	Pointer Immediate Parameter Count
0x30	0x04	u32	Int Input Parameter Base Index
0x34	0x04	u32	Int Input Parameter Count
0x38	0x04	u32	Int Output Parameter Base Index
0x3C	0x04	u32	Int Output Parameter Count
0x40	0x04	u32	Bool Input Parameter Base Index
0x44	0x04	u32	Bool Input Parameter Count
0x48	0x04	u32	Bool Output Parameter Base Index
0x4C	0x04	u32	Bool Output Parameter Count
0x50	0x04	u32	Float Input Parameter Base Index
0x54	0x04	u32	Float Input Parameter Count
0x58	0x04	u32	Float Output Parameter Base Index
0x5C	0x04	u32	Float Output Parameter Count
0x60	0x04	u32	String Input Parameter Base Index
0x64	0x04	u32	String Input Parameter Count
0x68	0x04	u32	String Output Parameter Base Index
0x6C	0x04	u32	String Output Parameter Count
0x70	0x04	u32	Vector3f Input Parameter Base Index
0x74	0x04	u32	Vector3f Input Parameter Count
0x78	0x04	u32	Vector3f Output Parameter Base Index
0x7C	0x04	u32	Vector3f Output Parameter Count
0x80	0x04	u32	Pointer Input Parameter Base Index
0x84	0x04	u32	Pointer Input Parameter Count
0x88	0x04	u32	Pointer Output Parameter Base Index
0x8C	0x04	u32	Pointer Output Parameter Count

Child Node Section Header

Offset	Size	Type	Description
0x00	0x01	u8	Bool/float Input Source Node/Output Source Node Count
0x01	0x01	u8	Bool/float Input Source Node/Output Source Node Base Index
0x02	0x01	u8	Unknown Connection Type Count (Unused in TotK)
0x03	0x01	u8	Unknown Connection Type Base Index (Unused TotK)
0x04	0x01	u8	Standard Child Node Count
0x05	0x01	u8	Standard Child Node Base Index
0x06	0x01	u8	Resident Update Node Count
0x07	0x01	u8	Resident Update Base Index
0x08	0x01	u8	String Input Source Node Count
0x09	0x01	u8	String Input Source Node Base Index
0x0A	0x01	u8	Int Input Source Node Count
0x0B	0x01	u8	Int Input Source Node Base Index
0x0C	0x01	u8	Unknown Connection Type Count (Unused in TotK)
0x0D	0x01	u8	Unknown Connection Type Base Index (Unused TotK)
0x0E	0x01	u8	Unknown Connection Type Count (Unused in TotK)
0x0F	0x01	u8	Unknown Connection Type Base Index (Unused TotK)
0x10	0x01	u8	Unknown Connection Type Count (Unused in TotK)
0x11	0x01	u8	Unknown Connection Type Base Index (Unused TotK)
0x12	0x01	u8	Unknown Connection Type Count (Unused in TotK)
0x13	0x01	u8	Unknown Connection Type Base Index (Unused TotK)

If the node has any child nodes, the section header is followed by an array of u32 offsets to each of the child node entries. For most nodes, each entry is eight bytes.

Child Node Entry

Offset	Size	Type	Description
0x00	0x04	u32	Child Node Index
0x04	0x04	u32	Value

The interpretation of the value depends on the connection type. For input or output connections, the value is a string offset to the parameter name. For standard connections, the value is a string offset to the connection name. For resident update connections, the value is an index into the resident update array. Certain node/connection types will also extend the entry length. Selector-type nodes excluding Element_BoolSelector and Element_F32Selector will have an extra four bytes which stores the condition for to link to the child node. For Element_S32Selector, this is an immediate value. For Element_RandomSelector, this is a weight and for Element_StringSelector it is a u32 string offset. The condition for Element_BoolSelector is the entry's value string. Element_F32Selector adds 24 bytes to each entry, consisting of four eight-byte sub-entries.

Element_F32Selector Condition Entry

Offset	Size	Type	Description
0x00	0x04	u32	Local Blackboard Parameter Index and Flags
0x04	0x04	float	Condition Value

The first two bytes of the four bytes at offset 0x00 are the local blackboard parameter index while the last bit is whether or not the index is used or not. The first entry for Element_F32Selector is the minimum value condition while the second entry is the maximum value condition. The last two entries appear to be unused. The last child node entry for Selector-type nodes is the default case. The condition for this case is either a string offset to the string その他 ("Other") or 0 (in the case of Element_S32Selector). Input nodes that are Selector-type nodes also appear to have an additional eight bytes (purpose unknown). Element_Expression have an additional eight bytes per input node (16 bytes in the case of vector3f entries). The purpose of these bytes is unknown.

Attachment Parameters

This section contains an array of attachments for nodes. This section is preceded by the attachment index array which is an array of u32 indices into the entries in this section. Nodes contain an index into the index array rather than directly into this section. The section contains an array of entries followed by an array of parameter entries.

Attachment Parameter Entry

Offset	Size	Type	Description
0x00	0x04	u32	Name Offset
0x04	0x04	u32	Parameters Entry Offset
0x08	0x02	u16	EXB Function Count
0x0A	0x02	u16	EXB Input/Output Field Size
0x0C	0x04	u32	Name Hash (version 0x0407 only)

Parameter Entry

Offset	Size	Type	Description
0x00	0x04	u32	Unknown (possibly related to debug)
0x04	0x04	u32	Int Immediate Parameter Base Index
0x08	0x04	u32	Int Immediate Parameter Count
0x0C	0x04	u32	Bool Immediate Parameter Base Index
0x10	0x04	u32	Bool Immediate Parameter Count
0x14	0x04	u32	Float Immediate Parameter Base Index
0x18	0x04	u32	Float Immediate Parameter Count
0x1C	0x04	u32	String Immediate Parameter Base Index
0x20	0x04	u32	String Immediate Parameter Count
0x24	0x04	u32	Vector3f Immediate Parameter Base Index
0x28	0x04	u32	Vector3f Immediate Parameter Count
0x2C	0x04	u32	Pointer Immediate Parameter Base Index
0x30	0x04	u32	Pointer Immediate Parameter Count
0x34	0x04	u32
0x38	0x04	u32	Unknown (contains address to next entry)
0x3C	0x04	u32
0x40	0x04	u32	Unknown (contains address to next entry)
0x44	0x04	u32
0x48	0x04	u32	Unknown (contains address to next entry)
0x4C	0x04	u32
0x50	0x04	u32	Unknown (contains address to next entry)
0x54	0x04	u32
0x58	0x04	u32	Unknown (contains address to next entry)
0x5C	0x04	u32
0x60	0x04	u32	Unknown (contains address to next entry)

Immediate Parameters

This section contains an array of immediate parameters for nodes. The section begins with a six u32 relative offsets to the first entry for each data type. The data type order for this section is int, bool, float, string, vector3f, and pointer.

Parameter Entry

Offset	Size	Type	Description
0x00	0x04	u32	Name Offset
0x04	0x04	u32	Flags
0x08			Value

The value is an immediate value for the data type (excluding string which is a string offset and pointer which doesn't store a value). Pointer entries also have an additional u32 class name offset at offset 0x04, pushing the flags to offset 0x08.

Parameter Flags

Bits	Description
16	Source Index
1	Is Use Index
1	Is Not Local Blackboard Index
1
1
1
1
1	Is EXB Index
1	Pulse Thread Local Storage
1	Set Pointer Flag Bit Zero
2
2
2

Input/Output Parameters

This section contains an array of input and output parameter entries. Similarly to the immediate parameters section, the section begins with u32 relative offsets to the first entry of each data type. However, instead of six offsets, there are 12 - two for each data type (one input, one output). The order of parameters in this section is int input, int output, bool input, bool output, float intput, float output, string input, string output, vector3f input, vector3f output, pointer input, and pointer output.

Input Parameter Entry

Offset	Size	Type	Description
0x00	0x04	u32	Name Offset
0x04	0x02	s16	Input Child Node Index / Multi-Parameter Array Base Index
0x06	0x02	s16	Input/Output Source Node Index / Multi-Parameter Count
0x08	0x04	u32	Flags
0x0C			Default Value

The default value is an immediate value for the data type (excluding string which is a string offset and pointer which is always an empty four bytes). Pointer entries also have an additional u32 class name offset at offset 0x04, pushing the rest of the entry back by four bytes. If the input child node index is between -32768 and -100, it corresponds to a multi-parameter array index. The multi-parameter index can be calculated as follows: MultiParamIndex = -100 - Index.

Parameter Flags

Bits	Description
16	Source Index
1	Is Use Index
1	Is Not Local Blackboard Index
1
1
1
1
1	Is EXB Index
1	Pulse Thread Local Storage
1	Set Pointer Flag Bit Zero
2
2
2

Each output parameter entry is four bytes.

Output Parameter Entry

Bits	Description
31	Name Offset
1	Set Pointer Flag Bit Zero

Multi-Parameters

This section contains entries specifying parameters that have multiple values and the sources of those values. Each entry is eight bytes.

Multi-Parameter Entry

Offset	Size	Type	Description
0x00	0x02	u16	Node Index
0x02	0x02	u16	Input/Output Source Parameter Index
0x04	0x04	u32	Flags

Parameter Flags

Bits	Description
16	Source Index
1	Is Use Index
1	Is Not Local Blackboard Index
1
1
1
1
1	Is EXB Index
1	Pulse Thread Local Storage
1	Set Pointer Flag Bit Zero
2
2
2

Resident Update Array

This section is an array of entries for resident nodes that are updated mid-node update sequence. The first four bytes specify the number of entries. Each entry is four bytes.

Bits	Description
8	Is Valid Update
23
1	Update Post Current Command Calculation

If the first byte of the flags is set to false, then the entry contains another four bytes with a string offset (purpose unknown). By default, the node is scheduled to update pre-next command calculation, however, this can change depending on the flags set. Additionally, Fork and Join nodes behave differently. Fork nodes will append the node to the run array while Join nodes will update the node post-current command calculation.

0x50 Section

This section is unused in Tears of the Kingdom.

Precondition Nodes Array

This section is an array of entries of precondition nodes present in the file.

Precondition Node Entry

Offset	Size	Type	Description
0x00	0x02	u16	Precondition Node Index (local to number of precondition nodes)
0x02	0x02	u16

Expression Binary Section

The EXB (Expression Binary) section is a completely self-contained section that stores custom instructions for a simple command processor. These instructions are grouped into functions that can be called by nodes to perform calculations. Because the section is self-contained, all offsets in this section are local to the section. The EXB section is shared with ASB files (Animation Sequence Binary).

Section Structure

EXB is essentially its own format and allows for the storage of custom functions in files.

Section Order

1. 0x2C-Byte Header
2. Command Info Table
3. Instructions Table
4. Parameter Region
5. Signature Table
6. String Pool

Sub-Sections

Header

EXB Header

Offset	Size	Type	Description
0x00	0x04	char[4]	Magic - “EXB “
0x04	0x04	u32	Version (0x02)
0x08	0x04	u32	Static Memory Allocation Size
0x0C	0x04	u32	Parameter EXB Field Entry Count
0x10	0x04	u32	32-bit Scratch Allocation Size
0x14	0x04	u32	64-bit Scratch Allocation Size
0x18	0x04	u32	Command Info Offset
0x1C	0x04	u32	Command Table Offset
0x20	0x04	u32	Signature Table Offset
0x24	0x04	u32	Parameter Region Offset
0x28	0x04	u32	String Pool Offset

Command Info Table

This section contains an array of command (function) info entries. The first four bytes specify the entry count.

Command Info Entry

Offset	Size	Type	Description
0x00	0x04	s32	Base Index Pre-Command Entry
0x04	0x04	u32	Pre-Entry Static Memory Usage
0x08	0x04	u32	Instruction Base Index
0x0C	0x04	u32	Instruction Count
0x10	0x04	u32	Static Memory Size
0x14	0x02	u16	32-bit Scratch Memory Size
0x16	0x02	u16	64-bit Scratch Memory Size
0x18	0x02	u16	Output Data Type Enum
0x1A	0x02	u16	Input Data Type Enum

Data Type Enum

Value (Hex)	Value (Dec)	Data Type
0x0	0	No Data
0x1	1	Immediate Value/From User
0x02	2	bool
0x03	3	int
0x04	4	float
0x05	5	string
0x06	6	vector3f

Instructions Table

This section contains an array of instruction entries which are read by the EXB command processor. The first four bytes specify the entry count.

Instruction Entry

Offset	Size	Type	Description
0x00	0x01	u8	Instruction Type
0x01	0x01	u8	Data Type Enum
0x02	0x01	u8	Left-Hand Side Parameter Source Enum
0x03	0x01	u8	Right-Hand Side Parameter Source Enum
0x04	0x02	u16	Left-Hand Side Parameter Value
0x06	0x02	u16	Right-Hand Side Parameter Value

For UserDefined type instructions, the bytes at offset 0x02-0x04 become a u16 static memory index and the bytes at 0x04-0x08 become a u32 index into the function signatures table.

Instruction Types

Value (Hex)	Value (Dec)	Instruction Type
0x01	1	Terminator
0x02	2	Store
0x03	3	Negate
0x04	4	NegateBool
0x05	5	Add
0x06	6	Subtract
0x07	7	Multiply
0x08	8	Divide
0x09	9	Modulus
0x0A	10	Increment
0x0B	11	Decrement
0x0C	12	ScalarMultiplyVec3f
0x0D	13	ScalarDivideVec3f
0x0E	14	LeftShift
0x0F	15	RightShift
0x10	16	LessThan
0x11	17	LessThanEqual
0x12	18	GreaterThan
0x13	19	GreaterThanEqual
0x14	20	Equal
0x15	21	NotEqual
0x16	22	AND
0x17	23	XOR
0x18	24	OR
0x19	25	LogicalAND
0x1A	26	LogicalOR
0x1B	27	UserFunction
0x1C	28	JumpIfLHSZero
0x1D	29	Jump

UserFunctions are mapped to a function in the executable by function signature. There are two types of these functions: direct and object. Direct functions are straightforward functions that take up to two arguments and are matched using the function signature. Function objects can take additional arguments and are indexed at runtime.

Data Type Enum

Value (Hex)	Value (Dec)	Data Type
0x0	0	No Data
0x1	1	Immediate Value/From User
0x02	2	bool
0x03	3	int
0x04	4	float
0x05	5	string
0x06	6	vector3f

Parameter Source Enum

Value (Hex)	Value (Dec)	Parameter Source
0x00	0	Immediate Parameters
0x01	1	Immediate Parameters (String)
0x02	2	Static Memory
0x03	3	Parameters Region
0x04	4	Parameters Region (String)
0x05	5	Output Value
0x06	6	Input Value
0x07	7	32-bit Scratch
0x08	8	64-bit Scratch
0x09	9	UserOutput
0x0A	10	UserInput

UserCallback is a class that contains virtual functions providing memory allocation. The input value is passed from the calling node and the output value is passed back.

Parameter Region

The parameter region is a region that stores the values for parameters values that are too large to fit into two bytes. Parameters that get their values from this section instead store an offset relative to the beginning of the parameter region to the start of the value.

Signatures Table

This section is an array of u32 string offsets for each function signature.

String Pool

The string pool is an array of null-terminated strings encoded with UTF-8. All string offsets in this section are relative to the beginning of the string pool.

Embedded AINB Files

This section contains an array of all external AINB files linked to the current AINB file. The first four bytes specify the entry count.

Embedded AINB File Entry

Offset	Size	Type	Description
0x00	0x04	u32	File Path Offset
0x04	0x04	u32	File Category Offset
0x08	0x04	u32	AINB File Count

Entry Strings

The purpose of this section is unknown. The first four bytes specify the entry count.

Entry String Entry

Offset	Size	Type	Description
0x00	0x04	u32	Node Index
0x04	0x04	u32	String 1 Offset (always メインステート ("Main State"))
0x08	0x04	u32	State Name Offset

File Hashes

This section contains two 32-bit file hashes. The first hash is a hash for the file itself and the second hash appears to be a hash for that file's parent file. The purpose of these hashes is unclear.

Child Replacement Table

This section is used to remove or replace specific nodes or attachments at runtime. This is used to toggle of debug nodes/attachments for release builds. The section begins with an eight-byte section header.

Child Replacement Section Header

Offset	Size	Type	Description
0x00	0x01	u8	Initialization Guard (Is Initialized)
0x01	0x01	u8
0x02	0x02	u16	Replacement Count
0x04	0x02	s16	Override Node Count
0x06	0x02	s16	Override Attachment Parameter Count

Child Replacement Table Entry

Offset	Size	Type	Description
0x00	0x01	u8	Replacement Type Enum (0 = remove child node, 1 = replace child node, 2 = remove attachment)
0x01	0x01	u8
0x02	0x02	u16	Node Index
0x04	0x02	u16	Child Node Index/Attachment Index
0x06	0x02	u16	New Node Index (for child node replacements)

0x6C Section

This section is unused in Tears of the Kingdom.

Enum Resolve Array

This section is used to resolve enum values at runtime. This section is unused in Tears of the Kingdom as all enum values are statically present in the file. However, in Splatoon 3, this section is used extensively as all enum values are stored in the main executable. The first four bytes of this section specifies the number of entries in the section.

Enum Resolve Array Entry

Offset	Size	Type	Description
0x00	0x04	u32	Enum Value Offset
0x04	0x04	u32	Enum Class Name Offset
0x08	0x04	u32	Enum Value Name Offset

String Pool

The string pool is an array of null-terminated strings encoded with UTF-8. All string offsets in the file are relative to the first byte of this section. Note that this section also contains some unreferenced strings which are the enums for certain parameters.