AINB
AINB (AI Node Binary) is a file format used for AI and logic in Tears of the Kingdom as well as other recent Nintendo EPD games. This article is primarily aimed at the version that appears in Tears of the Kingdom and Super Mario Bros. Wonder (v0x0407). AINB files can be found in the AI, Logic, and Sequence folders of the romfs as well as within various packs.
File Structure
AINB is a little endian format similar to most Switch file formats. An AINB file consists of a set of interconnected nodes which act like a syntax tree and control the behavior of actors. These nodes can also be calls to external AINB files (known as modules), allowing AINB files to form entire trees of files. The root file of the tree will have .root.ainb as their extension while each module in the tree will have the extension .module.ainb. There are three primary categories of AINB files in TotK: AI, Logic, and Sequence. For AI and Sequence files, the file's entry point is one or more commands which is linked to one or two child nodes. All nodes are accessed by their index (references to precondition nodes will use their precondition node index which is local to the amount of precondition nodes in the file).
All string offsets in the file are relative to the beginning of the string pool and name hashes are 32-bit murmur3 hashes. There are six possible types for AINB parameters: int (signed 32-bit integer), bool, float (32-bit), vector3f, and pointer. Pointer parameters are pointers to objects.
Section Order
- 0x74-Byte File Header
- Commands
- Nodes
- Local Blackboard Parameters
- Node Bodies
- Attachment Parameters
- Immediate Parameters
- Input/Output Parameters
- Multi-Parameters
- Resident Update Array
- 0x50 Section (Unused in TotK)
- Precondition Nodes
- Expression Binary
- AINB Modules
- External Action Array
- File Hashes
- Child Replacement Table
- 0x6C Section
- Enum Resolve Array
- String Pool
Sections
File Header
AINB files begin with a 0x74 byte header. If the offset for a given section is empty, that section is not present in the file.
| Offset | Size | Type | Description |
|---|---|---|---|
| 0x00 | 0x04 | char[4] | Magic - “AIB “ |
| 0x04 | 0x04 | u32 | Version (0x0407 in TotK, 0x0404 in S3 and NSS) |
| 0x08 | 0x04 | u32 | Filename Offset |
| 0x0C | 0x04 | u32 | Command Count |
| 0x10 | 0x04 | u32 | Node Count |
| 0x14 | 0x04 | u32 | Precondition Node Count |
| 0x18 | 0x04 | u32 | Attachment Parameter Count |
| 0x1C | 0x04 | u32 | Output Node Count |
| 0x20 | 0x04 | u32 | Local Blackboard Parameters Offset |
| 0x24 | 0x04 | u32 | String Pool Offset |
| 0x28 | 0x04 | u32 | Enum Resolve Array Offset |
| 0x2C | 0x04 | u32 | Immediate Parameters Offset |
| 0x30 | 0x04 | u32 | Resident Update Array Offset |
| 0x34 | 0x04 | u32 | Input/Output Parameters Offset |
| 0x38 | 0x04 | u32 | Multi-Parameters Array Offset |
| 0x3C | 0x04 | u32 | Attachment Parameters Offset |
| 0x40 | 0x04 | u32 | Attachment Parameters Index Array Offset |
| 0x44 | 0x04 | u32 | Expression Binary Section Offset |
| 0x48 | 0x04 | u32 | Child Replacement Table Offset |
| 0x4C | 0x04 | u32 | Precondition Node Array Offset |
| 0x50 | 0x04 | u32 | Unknown (unused in TotK, always the same as the Resident Update Array Offset) |
| 0x54 | 0x04 | u32 | Unknown (always 0) |
| 0x58 | 0x04 | u32 | Unknown (always 0, used in Splatoon 3/Nintendo Switch Sports) |
| 0x5C | 0x04 | u32 | AINB Modules Array Offset |
| 0x60 | 0x04 | u32 | File Category Name Offset |
| 0x64 | 0x04 | u32 | File Category (0 = AI, 1 = Logic, 2 = Sequence) - only TotK |
| 0x68 | 0x04 | u32 | External Action Array Offset |
| 0x6C | 0x04 | u32 | Unknown (Unused in TotK) |
| 0x70 | 0x04 | u32 | File Identification Hashes Offset (Purpose Unknown) |
Command Array
The command array immediately follows the file header and is an array of all commands in the file.
| Offset | Size | Type | Description |
|---|---|---|---|
| 0x00 | 0x04 | u32 | Command Name Offset |
| 0x04 | 0x10 | u32 | GUID |
| u16 | |||
| u16 | |||
| u16 | |||
| u8[6] | |||
| 0x14 | 0x02 | u16 | Left Node Index |
| 0x16 | 0x02 | u16 | Right Node Index (one greater than the corresponding node index) |
Command GUIDs are only used for debug messages. Right Node Index will be -1 if the command only has one child node.
Node Array
The node array immediately follows the command array and is an array of all nodes in the file.
| Offset | Size | Type | Description |
|---|---|---|---|
| 0x00 | 0x02 | u16 | Node Type Enum (see below) |
| 0x02 | 0x02 | u16 | Node Index |
| 0x04 | 0x02 | u16 | Attachment Parameters Count |
| 0x06 | 0x01 | bitfield | Node Flags |
| 0x07 | 0x01 | u8 | |
| 0x08 | 0x04 | u32 | Node Type Name Offset (for UserDefined nodes) |
| 0x0C | 0x04 | u32 | Name Hash (version 0x407 only) |
| 0x10 | 0x04 | u32 | |
| 0x14 | 0x04 | u32 | Node Body Offset (relative to the start of the file) |
| 0x18 | 0x02 | u16 | EXB Function Count |
| 0x1A | 0x02 | u16 | EXB Input/Output Field Size |
| 0x1C | 0x02 | u16 | Multi-Param Count |
| 0x1E | 0x02 | u16 | |
| 0x20 | 0x04 | u32 | Base Attachment Parameter Index |
| 0x24 | 0x02 | u16 | Base Precondition Node |
| 0x26 | 0x02 | u16 | Precondition Node Count |
| 0x28 | 0x02 | u16 | 0x58 Section Entry Offset (relative to the start of the file) |
| 0x2A | 0x02 | u16 | |
| 0x2C | 0x10 | u32 | GUID |
| u16 | |||
| u16 | |||
| u16 | |||
| u8[6] |
Just like with commands, node GUIDs are only used for debug messages. The 0x58 section entry offset will be empty if unused.
| Value (Hex) | Value (Dec) | Node Type |
|---|---|---|
| 0x00 | 0 | UserDefined |
| 0x01 | 1 | Element_S32Selector |
| 0x02 | 2 | Element_Sequential |
| 0x03 | 3 | Element_Simultaneous |
| 0x04 | 4 | Element_F32Selector |
| 0x05 | 5 | Element_StringSelector |
| 0x06 | 6 | Element_RandomSelector |
| 0x07 | 7 | Element_BoolSelector |
| 0x08 | 8 | Element_Fork |
| 0x09 | 9 | Element_Join |
| 0x0A | 10 | Element_Alert |
| 0x14 | 20 | Element_Expression |
| 0x64 | 100 | Element_ModuleIF_Input_S32 |
| 0x65 | 101 | Element_ModuleIF_Input_F32 |
| 0x66 | 102 | Element_ModuleIF_Input_Vec3f |
| 0x67 | 103 | Element_ModuleIF_Input_String |
| 0x68 | 104 | Element_ModuleIF_Input_Bool |
| 0x69 | 105 | Element_ModuleIF_Input_Ptr |
| 0xC8 | 200 | Element_ModuleIF_Output_S32 |
| 0xC9 | 201 | Element_ModuleIF_Output_F32 |
| 0xCA | 202 | Element_ModuleIF_Output_Vec3f |
| 0xCB | 203 | Element_ModuleIF_Output_String |
| 0xCC | 204 | Element_ModuleIF_Output_Bool |
| 0xCD | 205 | Element_ModuleIF_Output_Ptr |
| 0x012C | 300 | Element_ModuleIF_Child |
| 0x0190 | 400 | Element_StateEnd |
| 0x01F4 | 500 | Element_SplitTiming |
Node type names are official. For UserDefined nodes, node definitions can be found in a node definition files. This file is located at NodeDefinition/Node.Product.[ver].aidefn.byml.zs in the corresponding file category folder.
| Type | Description |
|---|---|
| UserDefined | Custom node type, definition in NodeDefinition |
| Element_S32Selector | Conditionally links to a node depending on the value of a signed int |
| Element_Sequential | Links to nodes sequentially in the order listed |
| Element_Simultaneous | Links simultaneously to multiple nodes |
| Element_F32Selector | Conditionally links to a node depending on the value of 32-bit float |
| Element_StringSelector | Conditionally links to a node depending on the value of a string |
| Element_RandomSelector | Links to a node randomly |
| Element_BoolSelector | Conditionally links to a node depending on the value of a bool |
| Element_Fork | See Resident Update Array |
| Element_Join | See Resident Update Array |
| Element_Alert | Displays a debug message |
| Element_Expression | Passes values to and from EXB commands |
| Element_ModuleIF_Input_S32 | Receives a signed int input from the calling AINB file |
| Element_ModuleIF_Input_F32 | Receives a 32-bit float input from the calling AINB file |
| Element_ModuleIF_Input_Vec3f | Receives a vector3f input from the calling AINB file |
| Element_ModuleIF_Input_String | Receives a string input from the calling AINB file |
| Element_ModuleIF_Input_Bool | Receives a bool input from the calling AINB file |
| Element_ModuleIF_Input_Ptr | Receives an object pointer input from the calling AINB file |
| Element_ModuleIF_Output_S32 | Returns a signed int output from the module to the calling AINB file |
| Element_ModuleIF_Output_F32 | Returns a 32-bit float output from the module to the calling AINB file |
| Element_ModuleIF_Output_Vec3f | Returns a vector3f output from the module to the calling AINB file |
| Element_ModuleIF_Output_String | Returns a string output from the module to the calling AINB file |
| Element_ModuleIF_Output_Bool | Returns a bool output from the module to the calling AINB file |
| Element_ModuleIF_Output_Ptr | Returns an object pointer output from the module to the calling AINB file |
| Element_ModuleIF_Child | Returns the node connection name from the module to the calling AINB file |
| Element_StateEnd | Termination node, specifies what resident node to return to in the calling AINB file |
| Element_SplitTiming | Changes when child nodes are run (Enter - first time visiting a node, Update - every frame, Leave - ran upon leaving the node) |
| Bits | Description |
|---|---|
| 1 | Is Precondition Node |
| 1 | Is Module |
| 1 | Is Resident Node |
| 5 |
Local Blackboard Parameters
This section contains an array of the Blackboard parameters used by file. These parameters may be sourced from external Blackboards or parameter files. The section begins with a 0x30 byte section header followed by the array of parameters, an array of default values of said parameters, and an array of file references if applicable. The order of parameters is in the order of string, int, float, bool, vector3f, and pointer. The section header contains six entries, one for each type.
| Offset | Size | Type | Description |
|---|---|---|---|
| 0x00 | 0x02 | u16 | Number of Entries of the Corresponding Data Type |
| 0x02 | 0x02 | u16 | Parameter Index of the First Entry of the Corresponding Data Type |
| 0x04 | 0x02 | u16 | Relative Offset of the First Entry of the Corresponding Data Type |
| 0x06 | 0x02 | u16 |
| Offset | Size | Type | Description |
|---|---|---|---|
| 0x00 | 0x04 | bitfield | Name Offset and Flags |
| 0x04 | 0x04 | u32 | String Offset (Notes) |
| Bits | Description |
|---|---|
| 22 | Name Offset |
| 1 | |
| 1 | Does Not Have File Reference |
| 7 | File Reference Index |
| 1 | Is File Reference Valid |
The default value entries vary based on the parameter's data type. For int, float, and bool parameters, the entry is a four byte immediate value. String entries are a four byte string value offset. Vector3f entries are 12 bytes. Note that pointer parameters do not have default value entries and do not have default values.
| Offset | Size | Type | Description |
|---|---|---|---|
| 0x00 | 0x04 | u32 | File Path Offset |
| 0x04 | 0x04 | u32 | File Path Hash |
| 0x08 | 0x04 | u32 | Filename Hash (no extension) |
| 0x0C | 0x04 | u32 | File Extension Hash (no .) |
Node Bodies
Each node body is composed of two parts: a 0x90 byte parameter section and a 0x14 child node section header followed by said section if applicable. The child node section contains information about the child node and specific connection types. The following parameter indices are indices into the parameter array for that specific type and data type.
| Offset | Size | Type | Description |
|---|---|---|---|
| 0x00 | 0x04 | u32 | Int Immediate Parameter Base Index |
| 0x04 | 0x04 | u32 | Int Immediate Parameter Count |
| 0x08 | 0x04 | u32 | Bool Immediate Parameter Base Index |
| 0x0C | 0x04 | u32 | Bool Immediate Parameter Count |
| 0x10 | 0x04 | u32 | Float Immediate Parameter Base Index |
| 0x14 | 0x04 | u32 | Float Immediate Parameter Count |
| 0x18 | 0x04 | u32 | String Immediate Parameter Base Index |
| 0x1C | 0x04 | u32 | String Immediate Parameter Count |
| 0x20 | 0x04 | u32 | Vector3f Immediate Parameter Base Index |
| 0x24 | 0x04 | u32 | Vector3f Immediate Parameter Count |
| 0x28 | 0x04 | u32 | Pointer Immediate Parameter Base Index |
| 0x2C | 0x04 | u32 | Pointer Immediate Parameter Count |
| 0x30 | 0x04 | u32 | Int Input Parameter Base Index |
| 0x34 | 0x04 | u32 | Int Input Parameter Count |
| 0x38 | 0x04 | u32 | Int Output Parameter Base Index |
| 0x3C | 0x04 | u32 | Int Output Parameter Count |
| 0x40 | 0x04 | u32 | Bool Input Parameter Base Index |
| 0x44 | 0x04 | u32 | Bool Input Parameter Count |
| 0x48 | 0x04 | u32 | Bool Output Parameter Base Index |
| 0x4C | 0x04 | u32 | Bool Output Parameter Count |
| 0x50 | 0x04 | u32 | Float Input Parameter Base Index |
| 0x54 | 0x04 | u32 | Float Input Parameter Count |
| 0x58 | 0x04 | u32 | Float Output Parameter Base Index |
| 0x5C | 0x04 | u32 | Float Output Parameter Count |
| 0x60 | 0x04 | u32 | String Input Parameter Base Index |
| 0x64 | 0x04 | u32 | String Input Parameter Count |
| 0x68 | 0x04 | u32 | String Output Parameter Base Index |
| 0x6C | 0x04 | u32 | String Output Parameter Count |
| 0x70 | 0x04 | u32 | Vector3f Input Parameter Base Index |
| 0x74 | 0x04 | u32 | Vector3f Input Parameter Count |
| 0x78 | 0x04 | u32 | Vector3f Output Parameter Base Index |
| 0x7C | 0x04 | u32 | Vector3f Output Parameter Count |
| 0x80 | 0x04 | u32 | Pointer Input Parameter Base Index |
| 0x84 | 0x04 | u32 | Pointer Input Parameter Count |
| 0x88 | 0x04 | u32 | Pointer Output Parameter Base Index |
| 0x8C | 0x04 | u32 | Pointer Output Parameter Count |
| Offset | Size | Type | Description |
|---|---|---|---|
| 0x00 | 0x01 | u8 | Bool/float Input Source Node/Output Source Node Count |
| 0x01 | 0x01 | u8 | Bool/float Input Source Node/Output Source Node Base Index |
| 0x02 | 0x01 | u8 | Unknown Connection Type Count (Unused in TotK) |
| 0x03 | 0x01 | u8 | Unknown Connection Type Base Index (Unused TotK) |
| 0x04 | 0x01 | u8 | Standard Child Node Count |
| 0x05 | 0x01 | u8 | Standard Child Node Base Index |
| 0x06 | 0x01 | u8 | Resident Update Node Count |
| 0x07 | 0x01 | u8 | Resident Update Base Index |
| 0x08 | 0x01 | u8 | String Input Source Node Count |
| 0x09 | 0x01 | u8 | String Input Source Node Base Index |
| 0x0A | 0x01 | u8 | Int Input Source Node Count |
| 0x0B | 0x01 | u8 | Int Input Source Node Base Index |
| 0x0C | 0x01 | u8 | Unknown Connection Type Count (Unused in TotK) |
| 0x0D | 0x01 | u8 | Unknown Connection Type Base Index (Unused TotK) |
| 0x0E | 0x01 | u8 | Unknown Connection Type Count (Unused in TotK) |
| 0x0F | 0x01 | u8 | Unknown Connection Type Base Index (Unused TotK) |
| 0x10 | 0x01 | u8 | Unknown Connection Type Count (Unused in TotK) |
| 0x11 | 0x01 | u8 | Unknown Connection Type Base Index (Unused TotK) |
| 0x12 | 0x01 | u8 | Unknown Connection Type Count (Unused in TotK) |
| 0x13 | 0x01 | u8 | Unknown Connection Type Base Index (Unused TotK) |
If the node has any child nodes, the section header is followed by an array of u32 offsets to each of the child node entries. For most nodes, each entry is eight bytes.
| Offset | Size | Type | Description |
|---|---|---|---|
| 0x00 | 0x04 | u32 | Child Node Index |
| 0x04 | 0x04 | u32 | Value |
The interpretation of the value depends on the connection type. For input or output connections, the value is a string offset to the parameter name. For standard connections, the value is a string offset to the connection name. For resident update connections, the value is an index into the resident update array. Certain node/connection types will also extend the entry length. Selector-type nodes excluding Element_BoolSelector and Element_F32Selector will have an extra four bytes which stores the condition for to link to the child node. For Element_S32Selector, this is an immediate value. For Element_RandomSelector, this is a weight and for Element_StringSelector it is a u32 string offset. The condition for Element_BoolSelector is the entry's value string. Element_F32Selector adds 24 bytes to each entry, consisting of four eight-byte sub-entries.
| Offset | Size | Type | Description |
|---|---|---|---|
| 0x00 | 0x04 | u32 | Local Blackboard Parameter Index and Flags |
| 0x04 | 0x04 | float | Condition Value |
The first two bytes of the four bytes at offset 0x00 are the local blackboard parameter index while the last bit is whether or not the index is used or not. The first entry for Element_F32Selector is the minimum value condition while the second entry is the maximum value condition. The last two entries appear to be unused. The last child node entry for Selector-type nodes is the default case. The condition for this case is either a string offset to the string その他 ("Other") or 0 (in the case of Element_S32Selector). Input nodes that are Selector-type nodes also appear to have an additional eight bytes (purpose unknown). Element_Expression have an additional eight bytes per input node (16 bytes in the case of vector3f entries). The purpose of these bytes is unknown.
Attachment Parameters
This section contains an array of attachments for nodes. This section is preceded by the attachment index array which is an array of u32 indices into the entries in this section. Nodes contain an index into the index array rather than directly into this section. The section contains an array of entries followed by an array of parameter entries.
| Offset | Size | Type | Description |
|---|---|---|---|
| 0x00 | 0x04 | u32 | Name Offset |
| 0x04 | 0x04 | u32 | Parameters Entry Offset |
| 0x08 | 0x02 | u16 | EXB Function Count |
| 0x0A | 0x02 | u16 | EXB Input/Output Field Size |
| 0x0C | 0x04 | u32 | Name Hash (version 0x0407 only) |
| Offset | Size | Type | Description |
|---|---|---|---|
| 0x00 | 0x04 | u32 | Unknown (possibly related to debug) |
| 0x04 | 0x04 | u32 | Int Immediate Parameter Base Index |
| 0x08 | 0x04 | u32 | Int Immediate Parameter Count |
| 0x0C | 0x04 | u32 | Bool Immediate Parameter Base Index |
| 0x10 | 0x04 | u32 | Bool Immediate Parameter Count |
| 0x14 | 0x04 | u32 | Float Immediate Parameter Base Index |
| 0x18 | 0x04 | u32 | Float Immediate Parameter Count |
| 0x1C | 0x04 | u32 | String Immediate Parameter Base Index |
| 0x20 | 0x04 | u32 | String Immediate Parameter Count |
| 0x24 | 0x04 | u32 | Vector3f Immediate Parameter Base Index |
| 0x28 | 0x04 | u32 | Vector3f Immediate Parameter Count |
| 0x2C | 0x04 | u32 | Pointer Immediate Parameter Base Index |
| 0x30 | 0x04 | u32 | Pointer Immediate Parameter Count |
| 0x34 | 0x04 | u32 | |
| 0x38 | 0x04 | u32 | Unknown (contains address to next entry) |
| 0x3C | 0x04 | u32 | |
| 0x40 | 0x04 | u32 | Unknown (contains address to next entry) |
| 0x44 | 0x04 | u32 | |
| 0x48 | 0x04 | u32 | Unknown (contains address to next entry) |
| 0x4C | 0x04 | u32 | |
| 0x50 | 0x04 | u32 | Unknown (contains address to next entry) |
| 0x54 | 0x04 | u32 | |
| 0x58 | 0x04 | u32 | Unknown (contains address to next entry) |
| 0x5C | 0x04 | u32 | |
| 0x60 | 0x04 | u32 | Unknown (contains address to next entry) |
Immediate Parameters
This section contains an array of immediate parameters for nodes. The section begins with a six u32 relative offsets to the first entry for each data type. The data type order for this section is int, bool, float, string, vector3f, and pointer.
| Offset | Size | Type | Description |
|---|---|---|---|
| 0x00 | 0x04 | u32 | Name Offset |
| 0x04 | 0x04 | u32 | Flags |
| 0x08 | Value |
The value is an immediate value for the data type (excluding string which is a string offset and pointer which doesn't store a value). Pointer entries also have an additional u32 class name offset at offset 0x04, pushing the flags to offset 0x08.
| Bits | Description |
|---|---|
| 16 | Source Index |
| 1 | Is Use Index |
| 1 | Is Not Local Blackboard Index |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | Is EXB Index |
| 1 | Pulse Thread Local Storage |
| 1 | Set Pointer Flag Bit Zero |
| 2 | |
| 2 | |
| 2 |
Input/Output Parameters
This section contains an array of input and output parameter entries. Similarly to the immediate parameters section, the section begins with u32 relative offsets to the first entry of each data type. However, instead of six offsets, there are 12 - two for each data type (one input, one output). The order of parameters in this section is int input, int output, bool input, bool output, float intput, float output, string input, string output, vector3f input, vector3f output, pointer input, and pointer output.
| Offset | Size | Type | Description |
|---|---|---|---|
| 0x00 | 0x04 | u32 | Name Offset |
| 0x04 | 0x02 | s16 | Input Child Node Index / Multi-Parameter Array Base Index |
| 0x06 | 0x02 | s16 | Input/Output Source Node Index / Multi-Parameter Count |
| 0x08 | 0x04 | u32 | Flags |
| 0x0C | Default Value |
The default value is an immediate value for the data type (excluding string which is a string offset and pointer which is always an empty four bytes). Pointer entries also have an additional u32 class name offset at offset 0x04, pushing the rest of the entry back by four bytes. If the input child node index is between -32768 and -100, it corresponds to a multi-parameter array index. The multi-parameter index can be calculated as follows: MultiParamIndex = -100 - Index.
| Bits | Description |
|---|---|
| 16 | Source Index |
| 1 | Is Use Index |
| 1 | Is Not Local Blackboard Index |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | Is EXB Index |
| 1 | Pulse Thread Local Storage |
| 1 | Set Pointer Flag Bit Zero |
| 2 | |
| 2 | |
| 2 |
Each output parameter entry is four bytes.
| Bits | Description |
|---|---|
| 31 | Name Offset |
| 1 | Set Pointer Flag Bit Zero |
Multi-Parameters
This section contains entries specifying parameters that have multiple values and the sources of those values. Each entry is eight bytes.
| Offset | Size | Type | Description |
|---|---|---|---|
| 0x00 | 0x02 | u16 | Node Index |
| 0x02 | 0x02 | u16 | Input/Output Source Parameter Index |
| 0x04 | 0x04 | u32 | Flags |
| Bits | Description |
|---|---|
| 16 | Source Index |
| 1 | Is Use Index |
| 1 | Is Not Local Blackboard Index |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | Is EXB Index |
| 1 | Pulse Thread Local Storage |
| 1 | Set Pointer Flag Bit Zero |
| 2 | |
| 2 | |
| 2 |
Resident Update Array
This section is an array of entries for resident nodes that are updated mid-node update sequence. The first four bytes specify the number of entries. Each entry is four bytes.
| Bits | Description |
|---|---|
| 8 | Is Valid Update |
| 23 | |
| 1 | Update Post Current Command Calculation |
If the first byte of the flags is set to false, then the entry contains another four bytes with a string offset (purpose unknown). By default, the node is scheduled to update pre-next command calculation, however, this can change depending on the flags set. Additionally, Fork and Join nodes behave differently. Fork nodes will append the node to the run array while Join nodes will update the node post-current command calculation.
0x50 Section
This section is unused in Tears of the Kingdom.
Precondition Nodes Array
This section is an array of entries of precondition nodes present in the file.
| Offset | Size | Type | Description |
|---|---|---|---|
| 0x00 | 0x02 | u16 | Precondition Node Index (local to number of precondition nodes) |
| 0x02 | 0x02 | u16 |
Expression Binary Section
The EXB (Expression Binary) section is a completely self-contained section that stores custom instructions for a simple command processor. These instructions are grouped into functions that can be called by nodes to perform calculations. Because the section is self-contained, all offsets in this section are local to the section. The EXB section is shared with ASB files (Animation Sequence Binary).
Section Structure
EXB is essentially its own format and allows for the storage of custom functions in files.
Section Order
- 0x2C-Byte Header
- Command Info Table
- Instructions Table
- Parameter Region
- Signature Table
- String Pool
Sub-Sections
Header
| Offset | Size | Type | Description |
|---|---|---|---|
| 0x00 | 0x04 | char[4] | Magic - “EXB “ |
| 0x04 | 0x04 | u32 | Version (0x02) |
| 0x08 | 0x04 | u32 | Static Memory Allocation Size |
| 0x0C | 0x04 | u32 | Parameter EXB Field Entry Count |
| 0x10 | 0x04 | u32 | 32-bit Scratch Allocation Size |
| 0x14 | 0x04 | u32 | 64-bit Scratch Allocation Size |
| 0x18 | 0x04 | u32 | Command Info Offset |
| 0x1C | 0x04 | u32 | Command Table Offset |
| 0x20 | 0x04 | u32 | Signature Table Offset |
| 0x24 | 0x04 | u32 | Parameter Region Offset |
| 0x28 | 0x04 | u32 | String Pool Offset |
Command Info Table
This section contains an array of command (function) info entries. The first four bytes specify the entry count.
| Offset | Size | Type | Description |
|---|---|---|---|
| 0x00 | 0x04 | s32 | Base Index Pre-Command Entry |
| 0x04 | 0x04 | u32 | Pre-Entry Static Memory Usage |
| 0x08 | 0x04 | u32 | Instruction Base Index |
| 0x0C | 0x04 | u32 | Instruction Count |
| 0x10 | 0x04 | u32 | Static Memory Size |
| 0x14 | 0x02 | u16 | 32-bit Scratch Memory Size |
| 0x16 | 0x02 | u16 | 64-bit Scratch Memory Size |
| 0x18 | 0x02 | u16 | Output Data Type Enum |
| 0x1A | 0x02 | u16 | Input Data Type Enum |
| Value (Hex) | Value (Dec) | Data Type |
|---|---|---|
| 0x0 | 0 | No Data |
| 0x1 | 1 | Immediate Value/From User |
| 0x02 | 2 | bool |
| 0x03 | 3 | int |
| 0x04 | 4 | float |
| 0x05 | 5 | string |
| 0x06 | 6 | vector3f |
Instructions Table
This section contains an array of instruction entries which are read by the EXB command processor. The first four bytes specify the entry count.
| Offset | Size | Type | Description |
|---|---|---|---|
| 0x00 | 0x01 | u8 | Instruction Type |
| 0x01 | 0x01 | u8 | Data Type Enum |
| 0x02 | 0x01 | u8 | Left-Hand Side Parameter Source Enum |
| 0x03 | 0x01 | u8 | Right-Hand Side Parameter Source Enum |
| 0x04 | 0x02 | u16 | Left-Hand Side Parameter Value |
| 0x06 | 0x02 | u16 | Right-Hand Side Parameter Value |
For UserDefined type instructions, the bytes at offset 0x02-0x04 become a u16 static memory index and the bytes at 0x04-0x08 become a u32 index into the function signatures table.
| Value (Hex) | Value (Dec) | Instruction Type |
|---|---|---|
| 0x01 | 1 | Terminator |
| 0x02 | 2 | Store |
| 0x03 | 3 | Negate |
| 0x04 | 4 | NegateBool |
| 0x05 | 5 | Add |
| 0x06 | 6 | Subtract |
| 0x07 | 7 | Multiply |
| 0x08 | 8 | Divide |
| 0x09 | 9 | Modulus |
| 0x0A | 10 | Increment |
| 0x0B | 11 | Decrement |
| 0x0C | 12 | ScalarMultiplyVec3f |
| 0x0D | 13 | ScalarDivideVec3f |
| 0x0E | 14 | LeftShift |
| 0x0F | 15 | RightShift |
| 0x10 | 16 | LessThan |
| 0x11 | 17 | LessThanEqual |
| 0x12 | 18 | GreaterThan |
| 0x13 | 19 | GreaterThanEqual |
| 0x14 | 20 | Equal |
| 0x15 | 21 | NotEqual |
| 0x16 | 22 | AND |
| 0x17 | 23 | XOR |
| 0x18 | 24 | OR |
| 0x19 | 25 | LogicalAND |
| 0x1A | 26 | LogicalOR |
| 0x1B | 27 | UserFunction |
| 0x1C | 28 | JumpIfLHSZero |
| 0x1D | 29 | Jump |
UserFunctions are mapped to a function in the executable by function signature. There are two types of these functions: direct and object. Direct functions are straightforward functions that take up to two arguments and are matched using the function signature. Function objects can take additional arguments and are indexed at runtime.
| Value (Hex) | Value (Dec) | Data Type |
|---|---|---|
| 0x0 | 0 | No Data |
| 0x1 | 1 | Immediate Value/From User |
| 0x02 | 2 | bool |
| 0x03 | 3 | int |
| 0x04 | 4 | float |
| 0x05 | 5 | string |
| 0x06 | 6 | vector3f |
| Value (Hex) | Value (Dec) | Parameter Source |
|---|---|---|
| 0x00 | 0 | Immediate Parameters |
| 0x01 | 1 | Immediate Parameters (String) |
| 0x02 | 2 | Static Memory |
| 0x03 | 3 | Parameters Region |
| 0x04 | 4 | Parameters Region (String) |
| 0x05 | 5 | Output Value |
| 0x06 | 6 | Input Value |
| 0x07 | 7 | 32-bit Scratch |
| 0x08 | 8 | 64-bit Scratch |
| 0x09 | 9 | UserOutput |
| 0x0A | 10 | UserInput |
UserCallback is a class that contains virtual functions providing memory allocation. The input value is passed from the calling node and the output value is passed back.
Parameter Region
The parameter region is a region that stores the values for parameters values that are too large to fit into two bytes. Parameters that get their values from this section instead store an offset relative to the beginning of the parameter region to the start of the value.
Signatures Table
This section is an array of u32 string offsets for each function signature.
String Pool
The string pool is an array of null-terminated strings encoded with UTF-8. All string offsets in this section are relative to the beginning of the string pool.
AINB Modules
This section contains an array of all AINB modules linked to the current AINB file. The first four bytes specify the entry count.
| Offset | Size | Type | Description |
|---|---|---|---|
| 0x00 | 0x04 | u32 | File Path Offset |
| 0x04 | 0x04 | u32 | File Category Offset |
| 0x08 | 0x04 | u32 | AINB File Count |
External Action Array
This section appears to interact with XLink. The first four bytes specify the entry count.
| Offset | Size | Type | Description |
|---|---|---|---|
| 0x00 | 0x04 | u32 | Node Index |
| 0x04 | 0x04 | u32 | String 1 Offset (always メインステート ("Main State")) |
| 0x08 | 0x04 | u32 | State Name Offset |
File Hashes
This section contains two 32-bit file hashes. The first hash is a hash for the file itself and the second hash appears to be a hash for that file's parent file. The purpose of these hashes is unclear.
Child Replacement Table
This section is used to remove or replace specific nodes or attachments at runtime. This is used to toggle of debug nodes/attachments for release builds. The section begins with an eight-byte section header.
| Offset | Size | Type | Description |
|---|---|---|---|
| 0x00 | 0x01 | u8 | Initialization Guard (Is Initialized) |
| 0x01 | 0x01 | u8 | |
| 0x02 | 0x02 | u16 | Replacement Count |
| 0x04 | 0x02 | s16 | Override Node Count |
| 0x06 | 0x02 | s16 | Override Attachment Parameter Count |
| Offset | Size | Type | Description |
|---|---|---|---|
| 0x00 | 0x01 | u8 | Replacement Type Enum (0 = remove child node, 1 = replace child node, 2 = remove attachment) |
| 0x01 | 0x01 | u8 | |
| 0x02 | 0x02 | u16 | Node Index |
| 0x04 | 0x02 | u16 | Child Node Index/Attachment Index |
| 0x06 | 0x02 | u16 | New Node Index (for child node replacements) |
0x6C Section
This section is unused in Tears of the Kingdom.
Enum Resolve Array
This section is used to resolve enum values at runtime. This section is unused in Tears of the Kingdom as all enum values are statically present in the file. However, in Splatoon 3, this section is used extensively as all enum values are stored in the main executable. The first four bytes of this section specifies the number of entries in the section.
| Offset | Size | Type | Description |
|---|---|---|---|
| 0x00 | 0x04 | u32 | Enum Value Offset |
| 0x04 | 0x04 | u32 | Enum Class Name Offset |
| 0x08 | 0x04 | u32 | Enum Value Name Offset |
String Pool
The string pool is an array of null-terminated strings encoded with UTF-8. All string offsets in the file are relative to the first byte of this section. Note that this section also contains some unreferenced strings which are the enums for certain parameters.