diff --git a/nx/include/switch/services/nfc.h b/nx/include/switch/services/nfc.h
index b62ff78a..82567cef 100644
--- a/nx/include/switch/services/nfc.h
+++ b/nx/include/switch/services/nfc.h
@@ -96,6 +96,13 @@ typedef struct {
     u8 reserved[0x99];
 } PACKED NfpuRegisterInfo;
 
+typedef struct {
+    u64 unk1;
+    u64 reserved1[3];
+    u64 unk2;
+    u64 reserved2[3];
+} NfpuInitConfig;
+
 typedef enum {
     NfpuState_NonInitialized = 0,
     NfpuState_Initialized    = 1,
@@ -121,12 +128,9 @@ typedef enum {
     NfpuMountTarget_All = 3,
 } NfpuMountTarget;
 
-typedef struct {
-    u64 unk1;
-    u64 reserved1[3];
-    u64 unk2;
-    u64 reserved2[3];
-} NfpuInitConfig;
+typedef enum {
+    NfpuAppId_SSBU = 0x34f80200,
+} NfpuAppId;
 
 const NfpuInitConfig *nfpuGetDefaultInitConfig(void);
 
@@ -157,5 +161,8 @@ Result nfpuGetRegisterInfo(HidControllerID id, NfpuRegisterInfo *out);
 Result nfpuGetCommonInfo(HidControllerID id, NfpuCommonInfo *out);
 Result nfpuGetModelInfo(HidControllerID id, NfpuModelInfo *out);
 
+Result nfpuOpenApplicationArea(HidControllerID id, NfpuAppId app_id);
+Result nfpuGetApplicationArea(HidControllerID id, void* buf, size_t buf_size);
+
 /// Calls nfc:user.
 Result nfpuIsNfcEnabled(bool *out);
diff --git a/nx/source/services/nfc.c b/nx/source/services/nfc.c
index ab5aed9c..3b052ee9 100644
--- a/nx/source/services/nfc.c
+++ b/nx/source/services/nfc.c
@@ -609,6 +609,84 @@ inline Result nfpuGetModelInfo(HidControllerID id, NfpuModelInfo *out) {
     return _nfpuInterfaceCmdInIdOutBuffer(&g_nfpuInterface, 16, id, out, sizeof(NfpuModelInfo));
 }
 
+Result nfpuOpenApplicationArea(HidControllerID id, NfpuAppId app_id) {
+    if (id == CONTROLLER_P1_AUTO)
+        return nfpuOpenApplicationArea(g_controllerP1AutoID, app_id);
+
+    IpcCommand c;
+    ipcInitialize(&c);
+
+    struct {
+        u64 magic;
+        u64 cmd_id;
+        u64 id;
+        u32 app_id;
+    } *raw;
+
+    raw = serviceIpcPrepareHeader(&g_nfpuInterface, &c, sizeof(*raw));
+
+    raw->magic = SFCI_MAGIC;
+    raw->cmd_id = 7;
+    raw->id = hidControllerIDToOfficial(id);
+    raw->app_id = app_id;
+
+    Result rc = serviceIpcDispatch(&g_nfpuInterface);
+
+    if (R_SUCCEEDED(rc)) {
+        IpcParsedCommand r;
+        struct {
+            u64 magic;
+            u64 result;
+        } *resp;
+
+        serviceIpcParse(&g_nfpuInterface, &r, sizeof(*resp));
+        resp = r.Raw;
+
+        rc = resp->result;          
+    }
+
+    return rc;
+}
+
+Result nfpuGetApplicationArea(HidControllerID id, void* buf, size_t buf_size) {
+    if (id == CONTROLLER_P1_AUTO)
+        return nfpuGetApplicationArea(g_controllerP1AutoID, buf, buf_size);
+
+    IpcCommand c;
+    ipcInitialize(&c);
+
+    ipcAddRecvBuffer(&c, buf, buf_size, BufferType_Normal);
+
+    struct {
+        u64 magic;
+        u64 cmd_id;
+        u64 id;
+    } *raw;
+
+    raw = serviceIpcPrepareHeader(&g_nfpuInterface, &c, sizeof(*raw));
+
+    raw->magic = SFCI_MAGIC;
+    raw->cmd_id = 8;
+    raw->id = hidControllerIDToOfficial(id);
+
+    Result rc = serviceIpcDispatch(&g_nfpuInterface);
+
+    if (R_SUCCEEDED(rc)) {
+        IpcParsedCommand r;
+        struct {
+            u64 magic;
+            u64 result;
+        } *resp;
+
+        serviceIpcParse(&g_nfpuInterface, &r, sizeof(*resp));
+        resp = r.Raw;
+
+        rc = resp->result;          
+    }
+
+    return rc;
+}
+
 Result nfpuIsNfcEnabled(bool *out) {
     IpcCommand c;
     ipcInitialize(&c);