3dbrew - User contributions [en]

Config Savegame

2024-02-22T21:32:43Z

CyberYoshi64: Fix minor mistake on config block 0x000A0000

This page describes the format of the [[Config_Services|Cfg]] [[System_SaveData|NAND]] savegame. These blocks can be accessed with the Cfg service commands.

==Structure of save-file "/config"==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x2
| Total entries
|-
| 0x2
| 0x2
| Data entries offset
|-
| 0x4
| 0x4558
| Block entries
|-
| 0x455C
|
| Data for the entries
|}

The filesize for this /config file is 0x8000-bytes.

==Configuration block entry ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| BlkID
|-
| 0x4
| 0x4
| Offset to the data for this block when size is >4, otherwise this word is the data for this block
|-
| 0x8
| 0x2
| Size
|-
| 0xA
| 0x2
| Access Flags
|}

===Access Flags===
{| class="wikitable" border="1"
|-
! Bit Mask
! Description
|-
| 0x2
| User Readable (cfg:u)
|-
| 0x4
| System Writable (cfg:s / cfg:i)
|-
| 0x8
| System Readable (cfg:s / cfg:i)
|}

Config blocks will typically either use 0xC for system readable/writable or 0xE for all 3.

==Configuration blocks==
{| class="wikitable" border="1"
|-
! BlkID
! Size
! Access Flags
! Description
|-
| 0x00000000
| 0x2
| 0xC
| Config savegame version?
|-
| 0x00010000
| 0x1
| 0xC
| [[Hardware_calibration#RTC|RTC compensation value]]
|-
| 0x00020000
| 0x134
| 0xC
| [[Hardware_calibration#CDC|Codec]]
|-
| 0x00030000
| 0x1
| 0xC
| Leap Year Counter (read By PTM)
|-
| 0x00030001
| 0x8
| 0xE
| User time offset (read by CECD): displayed timestamp - rtc timestamp
|-
| 0x00030002
| 0x8
| 0xC
| Settings time offset: newly set timestamp - rtc timestamp
|-
| 0x00040000
| 0x10
| 0xC
| [[Hardware_calibration#Touch|Touch calibration]] (read by HID)
|-
| 0x00040001
| 0x1C
| 0xC
| Analog Stick Calibration Param?(read by HID)
|-
| 0x00040002
| 0x12
| 0xC
| [[Hardware_calibration#Gyro|Gyroscope]] (read by HID)
|-
| 0x00040003
| 0xC
| 0xC
| [[Hardware_calibration#Accel|Accelerometer]] (read by HID)
|-
| 0x00040004
| 0x1C
| 0xC
| [[Hardware_calibration#CStick|CStick calibration data]]
|-
| 0x00050000
| 0x2
| 0xC
| [[Hardware_calibration#Screen_flicker|Screen flicker]]
|-
| 0x00050001
| 0x2
| 0xC
| Backlight controls (u8 ABL_powersave_enable, u8 brightness_level) (read by GSP)
|-
| 0x00050002
| 0x38
| 0xC
| [[Hardware_calibration#BLPWM|Backlight PWM]] (read by GSP)
|-
| 0x00050003
| 0x20
| 0xC
| [[Hardware_calibration#ABL|Power saving mode (ABL) calibration]] (read by GSP)
|-
| 0x00050004
| 0x20
| 0xC
| [[Hardware_calibration#ABL|Power saving mode (ABL) calibration]] (for legacy FIRM)
|-
| 0x00050005
| 0x20
| 0xE
| Stereo display settings (HWCAL block 0x470)
|-
| 0x00050006
| 0x2
| 0xC
| [[Hardware_calibration#ULCD_delay|3D switching delay]]
|-
| 0x00050007
| 0x4
| 0xC
| ?
|-
| 0x00050008
| 0x10C
| 0xC
| [[Hardware_calibration#ABL_extra|Power saving mode (ABL) extra config]]
|-
| 0x00050009
| 0x8
| 0xC
| new3DS only(?) backlight control (5th byte: auto-brightness enable)
|-
| 0x00060000
| 0x96
| 0xC
| ??? (HWCAL block 0x500)
|-
| 0x00070000
| 0x214
| 0xE
| [[Hardware_calibration#3D_filters|3D filters]]
|-
| 0x00070001
| 0x1
| 0xE
| Sound output mode (mono=0, stereo=1, surround=2)
|-
| 0x00070002
| 0x8
| 0xE
| [[Hardware_calibration#Microphone_echo_cancel|Microphone echo cancellation params]]
|-
| 0x00080000
| 0xC00
| 0xC
| WiFi configuration slot 0
|-
| 0x00080001
| 0xC00
| 0xC
| WiFi configuration slot 1
|-
| 0x00080002
| 0xC00
| 0xC
| WiFi configuration slot 2
|-
| 0x00090000
| 0x8
| 0xE
| This contains a u64 ID, used by processes using [[NWMUDS:InitializeWithVersion]]. The first word is the same as [[CfgS:GetLocalFriendCodeSeed|LocalFriendCodeSeed]], while the latter is a separate word.
|-
| 0x00090001
| 0x8
| 0xE
| Same content as 0x0009000? This console-unique u64 is used by [[Cfg:GenHashConsoleUnique|GenHashConsoleUnique]]. It is generated by <code>((0x3FFFFFFFF) & LocalFriendCodeSeed) | (random16 << 48))</code>, where random16 is generated by [[PSPXI:GenerateRandomBytes|GenerateRandomBytes]]
|-
| 0x00090002
| 0x4
| 0xE
| The first two bytes are the same random16 used in 0x00090001. The second two bytes are zeros.
|-
| 0x000A0000
| 0x1C
| 0xE
| [[#User Name Block 0x000A0000|User Name]]
|-
| 0x000A0001
| 0x2
| 0xE
| Birthday (u8 month, u8 day)
|-
| 0x000A0002
| 0x1
| 0xE
| Language
|-
| 0x000B0000
| 0x4
| 0xE
| CountryInfo
|-
| 0x000B0001
| 0x800
| 0xE
| Country name in UTF-16, every 0x80-bytes is an entry for each language, in the order of the Language table below (not all entries are set)
|-
| 0x000B0002
| 0x800
| 0xE
| State name in UTF-16, every 0x80-bytes is an entry for each language
|-
| 0x000B0003
| 0x4
| 0xE
| Coordinates. A pair of s16 represents latitude and longitude, respectively. One need to multiply both value by 180/32768 to get coordinates in degrees

|-
| 0x000C0000
| 0xC0
| 0xE
| [[#Parental Control Settings Block 0x000C0000|Parental Controls - Main data]]
|-
| 0x000C0001
| 0x14
| 0xE
| COPPACS restriction data
|-
| 0x000C0002
| 0x200
| 0xE
| [[#Parental Control Settings Block 0x000C0002|Parental Controls - Registered e-Mail address and custom secret question]]
|-
| 0x000D0000
| 0x4
| 0xE
| u16 at offset 0x0: [[SMDH#EULA_Version|EULA Version]] which was agreed to. u16 @ 0x02: latest version
|-
| 0x000E0000
| 0x1
| 0xE
| ? (related to SpotPass options in Internet Settings?)
|-
| 0x000F0000
| 0x10
| 0xC
| Debug configuration, read by [[NS]] on dev-units: on startup, NS does <code>svcKernelSetState(6, 1, (u64)debug_flags & 1);
svcKernelSetState(6, 2, (u64)debug_flags & 2);</code> (see [[SVC#KernelSetState|here]]) where <code>debug_flags</code> is the u32 located at offset 0xC in this struct. Then it compares the u32 from +8 in this config-block with the [[Configuration_Memory#APPMEMTYPE|APPMEMTYPE]]. When those don't match NS starts a FIRM-launch (with the same FIRM titleID as the currently running one) to boot into a FIRM with the APPMEMTYPE value from this config-block. The byte at offset 0x0 is related to the memtype as well.
|-
| 0x000F0001
| 0x8
| 0xC
| ?
|-
| 0x000F0003
| 0x1
| 0xC
| ?
|-
| 0x000F0004
| 0x4
| 0xC
| The first u8 is the System-Model [[Cfg:GetSystemModel|value]], the last 3-bytes are unknown
|-
| 0x000F0005
| 0x4
| 0xC
| The first u8 indicates whether network updates are enabled (however, NIM only checks this flag with developer [[Configuration_Memory#ENVINFO|ENVINFO]]).
|-
| 0x000F0006
| 0x28
| 0xC
| In NIM, taken as a (hopefully null terminated) string used for the "X-Device-Token" http header field for NPNS url.
|-
| 0x00100000
| 0x2
| 0xC
| TWL EULA info ({bool agreed; u8 agreedVersion})
|-
| 0x00100001
| 0x94
| 0xC
| Stores Parental Restrictions PIN/Secret Answer and other info for TWL mode
|-
| 0x00100002
| 0x1
| 0xC
| TWL country code
|-
| 0x00100003
| 0x10
| 0xC
| TWL movable unique ID, used for DSiWare exports
|-
| 0x00110000
| 0x4
| 0xC
| The low u16 indicates whether the system setup is required, such as when the system is booted for the first time or after doing a [[System Settings|System Format]]: 0 = setup required, non-zero = no setup required
|-
| 0x00110001
| 0x8
| 0xC
| TitleID of the menu to launch, used by [[NS]] on dev units (this block can be edited on dev units with [[3DS Development Unit Software#Config|Config]])
|-
| 0x00120000
| 0x8
| 0xC
| Volume Slider Bounds (Read by HID and PTM)
|-
| 0x00130000
| 0x4
| 0xE
| If response is 0x100 then debug mode is enabled.
|-
| 0x00150000
| 0x4
| 0xC
| Clock Sequence (u16) used for generating UUIDs in [[ACT_Services|ACT]].
|-
| 0x00150001
| 0x8
| 0xC
| ?
|-
| 0x00150002
| 0x4
| 0xE
| In NIM, taken as an u32, using the low u16, casted to a char, and turned lower case for the making of the url for NPNS.
|-
| 0x00160000
| 0x4
| 0xE
| Unknown, first byte is used by config service-cmd [[Config_Services|0x00070040]]. (Unknown whether the last 3-bytes are used)
|-
| 0x00170000
| 0x4
| 0xE
| Miiverse (OLV) access key
|-
| 0x00180000
| 0x4
| 0xC
| QTM Infrared LED related, can be 0 or 1
|-
| 0x00180001
| 0x18
| 0xC
| [[Hardware_calibration#QTM|QTM calibration data]]
|-
| 0x00190000
| 0x1
| 0xC
| Unknown. NFC-module checks for value1/non-value1.
|}

The developer unit TID block only exists on developer units.

===Stereo Display Settings===
All values are hard-coded in cfg module.
{| class="wikitable" border="1"
|-
! Offset
! Size
! Value
! Description
|-
| 0x0
| 4
| 62.0f
|assumed pupillary distance in mm?
|-
| 0x4
| 4
| 289.0f
|assumed distance in mm between player's eyes and upper screen?
|-
| 0x8
| 4
| 76.80f
|width in mm of (old) 3DS upper screen (doesn't vary for different models?)
|-
| 0xC
| 4
| 46.08f
|height in mm of (old) 3DS upper screen (doesn't vary for different models?)
|-
| 0x10
| 4
| 10.0f
|
|-
| 0x14
| 4
| 5.0f
|
|-
| 0x18
| 4
| 55.58f
|
|-
| 0x1C
| 4
| 21.57f
|
|}

===Languages===
{| class="wikitable" border="1"
|-
! ID
! Description
|-
| 0
| JP
|-
| 1
| EN
|-
| 2
| FR
|-
| 3
| DE
|-
| 4
| IT
|-
| 5
| ES
|-
| 6
| ZH
|-
| 7
| KO
|-
| 8
| NL
|-
| 9
| PT
|-
| 10
| RU
|-
| 11
| TW
|}

===CountryInfo===
{| class="wikitable" border="1"
|-
! Byte
! Description
|-
| 0
|?
|-
| 1
|?
|-
| 2
| State/Province code.
|-
| 3
| Country code, same as DSi/Wii country codes. Value 0xFF is invalid.
|}

===User Name Block 0x000A0000===
{| class="wikitable" border="1"
|-
! Byte
! Description
|-
| 0x00-0x15
| User name (UTF-16)
|-
| 0x16-0x17
| u16 NGWord flag to denote that the user name is inappropriate
|-
| 0x18-0x1B
| u32 NGWord version the username was last checked with. If this value is less than the u32 stored in the NGWord CFA "romfs:/version.dat", the system then checks the username string with the bad-word list CFA again, then updates this field with the value from the CFA
|}

While the user name is NULL-terminated, the terminator is not applied when the user name is 10 characters long, which leads to online access breaking (002-0109) and buffer overflows when the user name is retrieved, even in DS games.

===WiFi Slot Structure===

====Network structure====
This is used twice in the actual WiFi slot structure.
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| Whether the network was set or not?
|-
| 0x1
| 0x1
| Whether to use this network strucutre to connect?
|-
| 0x2
| 0x1
| Whether this structure is the first (0) or the second (1) in the larger WiFi slot structure?
|-
| 0x3
| 0x1
| Padding ?
|-
| 0x4
| 0x20
| SSID of the network, without a trailing nullbyte.
|-
| 0x24
| 0x1
| Length of the SSID.
|-
| 0x25
| 0x1
| [[Nintendo_Zone#Beacon_payload_format|AP crypto key type]]
|-
| 0x26
| 0x2
| Padding ?
|-
| 0x28
| 0x40
| Plaintext of the passphrase of the network, without a trailing nullbyte.
|-
| 0x68
| 0x20
| PBKDF2 of the passphrase and SSID (http://jorisvr.nl/wpapsk.html).
|-
|}

====Actual structure====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x2
| ?
|-
| 0x2
| 0x2
| [https://github.com/lammertb/libcrc/blob/v2.0/src/crc16.c#L43-L76 CRC-16 checksum] of the next 0x410 bytes.
|-
| 0x4
| 0x88
| First network structure. Only set if the network was set "normally", or was the last to be set using WPS during the session.
|-
| 0x8C
| 0x20
| Padding.
|-
| 0xAC
| 0x88
| Second network structure. Only set if the network was set using WPS, otherwise 0-filled.
|-
| 0x134
| 0x20C
| Padding.
|-
| 0x340
| 0x1
| Whether to automatically get the IP address (use DHCP) or not, defaults to 1.
|-
| 0x341
| 0x1
| Whether to automatically get the DNS or not, defaults to 1.
|-
| 0x342
| 0x2
| Padding ?
|-
| 0x344
| 0x4
| IP address, to use if 0x340 is false.
|-
| 0x348
| 0x4
| IP address of the gateway, to use if 0x340 is false.
|-
| 0x34C
| 0x4
| Subnetwork mask, to use if 0x340 is false.
|-
| 0x350
| 0x4
| IP address of the primary DNS , to use if 0x341 is false.
|-
| 0x354
| 0x4
| IP address of the secondary DNS, to use if 0x341 is false.
|-
| 0x358
| 0x4
| Always 0x01050000 ? Only set if the network was the last to be set during the session.
|-
| 0x35C
| 0x4
| IP address to use. Only set if the network was the last to be set during the session.
|-
| 0x360
| 0x6
| MAC address of the AP. Only set if the network was the last to be set during the session.
|-
| 0x366
| 0x1
| Channel. Only set if the network was the last to be set during the session.
|-
| 0x367
| 0x1
| Padding ? Only set if the network was the last to be set during the session.
|-
| 0x368
| 0x1
| Whether to use a proxy or not, defaults to 0.
|-
| 0x369
| 0x1
| Whether to use a basic authentication for the proxy, defaults to 0.
|-
| 0x36A
| 0x2
| Port to use for the proxy, defaults to 1.
|-
| 0x36C
| 0x30
| URL/address of the proxy, including a trailing nullbyte.
|-
| 0x39C
| 0x34
| Padding.
|-
| 0x3D0
| 0x20
| Username to use for basic authentication, including a trailing nullbyte.
|-
| 0x3F0
| 0x20
| Password to use for basic authentication, including a trailing nullbyte.
|-
| 0x410
| 0x2
| Padding ?
|-
| 0x412
| 0x2
| MTU value, defaults to 1400 and ranges between 576 and 1500, inclusive.
|-
| 0x414
| 0x7EC
| Padding.
|-
|}

===LCD display config===
There seems to be some sort of LCD display configuration stored in this cfg. When using the cfg-save from an Old3DS on a New3DS without formatting the cfg first, the bottom-screen display is somewhat off(which is fixed by formatting the cfg-save).

===Parental Control Settings Block 0x00100001===
{| class="wikitable" border="1"
|-
! Byte
! Size in bytes
! Description
|-
| 0x0
| 0xD
| Unknown.
|-
| 0xD
| 0x4
| PIN
|-
| 0x11
| 0x40
| Secret Answer (UTF-16)
|}

===Parental Control Settings Block 0x000C0000===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x00
| 0x04
| [[#Parental Control Restriction Bitmask|Parental Control Restriction Bitmask]]
|-
| 0x04
| 0x04
| Unknown
|-
| 0x08
| 0x01
| Rating system used for configuration
|-
| 0x09
| 0x01
| Maximum allowed age (20 = No restriction)
|-
| 0x0A
| 0x01
| Secret Question Type (0-5: Pre-defined, 6: Custom)
|-
| 0x0B
| 0x01
| Unknown
|-
| 0x0C
| 0x08
| Parental Controls PIN code (with NULL-termination, although restricted to 4 digits)
|-
| 0x14
| 0x44
| Secret Answer (UTF-16)
|}

====Parental Control Restriction Bitmask====
{| class="wikitable" border="1"
|-
! Bit
! Restriction name
|-
| 0
| Global Parental Controls Enable
|-
| 1
| Internet Browser
|-
| 2
| Display of 3D Images (disabled on 2DS)
|-
| 3
| Sharing Images/Audio/Video/Long Text Data
|-
| 4
| Online Interaction
|-
| 5
| StreetPass
|-
| 6
| Friend Registration
|-
| 7
| DS Download Play
|-
| 8
| Nintendo 3DS Shopping Services (eShop / EC Applet)
|-
| 9
| View Distributed Videos
|-
| 10
| Miiverse (View)
|-
| 11
| Miiverse (Post)
|-
| 31
| "Child Online Privacy Protection" (see [[Cfg:GetRegionCanadaUSA|CFG:IsCoppacsSupported]])
|}

===Parental Control Settings Block 0x000C0002===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0000
| 0x0001
| Boolean, whether an e-Mail has been registered
|-
| 0x0001
| 0x0101
| Registered e-Mail address (Plaintext)
|-
| 0x0102
| 0x0068
| Custom Secret Question (UTF-16)
|}

Config Savegame

2024-02-22T21:26:12Z

CyberYoshi64: Edit some config blocks & add parental control bitmask bit 2

This page describes the format of the [[Config_Services|Cfg]] [[System_SaveData|NAND]] savegame. These blocks can be accessed with the Cfg service commands.

==Structure of save-file "/config"==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x2
| Total entries
|-
| 0x2
| 0x2
| Data entries offset
|-
| 0x4
| 0x4558
| Block entries
|-
| 0x455C
|
| Data for the entries
|}

The filesize for this /config file is 0x8000-bytes.

==Configuration block entry ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| BlkID
|-
| 0x4
| 0x4
| Offset to the data for this block when size is >4, otherwise this word is the data for this block
|-
| 0x8
| 0x2
| Size
|-
| 0xA
| 0x2
| Access Flags
|}

===Access Flags===
{| class="wikitable" border="1"
|-
! Bit Mask
! Description
|-
| 0x2
| User Readable (cfg:u)
|-
| 0x4
| System Writable (cfg:s / cfg:i)
|-
| 0x8
| System Readable (cfg:s / cfg:i)
|}

Config blocks will typically either use 0xC for system readable/writable or 0xE for all 3.

==Configuration blocks==
{| class="wikitable" border="1"
|-
! BlkID
! Size
! Access Flags
! Description
|-
| 0x00000000
| 0x2
| 0xC
| Config savegame version?
|-
| 0x00010000
| 0x1
| 0xC
| [[Hardware_calibration#RTC|RTC compensation value]]
|-
| 0x00020000
| 0x134
| 0xC
| [[Hardware_calibration#CDC|Codec]]
|-
| 0x00030000
| 0x1
| 0xC
| Leap Year Counter (read By PTM)
|-
| 0x00030001
| 0x8
| 0xE
| User time offset (read by CECD): displayed timestamp - rtc timestamp
|-
| 0x00030002
| 0x8
| 0xC
| Settings time offset: newly set timestamp - rtc timestamp
|-
| 0x00040000
| 0x10
| 0xC
| [[Hardware_calibration#Touch|Touch calibration]] (read by HID)
|-
| 0x00040001
| 0x1C
| 0xC
| Analog Stick Calibration Param?(read by HID)
|-
| 0x00040002
| 0x12
| 0xC
| [[Hardware_calibration#Gyro|Gyroscope]] (read by HID)
|-
| 0x00040003
| 0xC
| 0xC
| [[Hardware_calibration#Accel|Accelerometer]] (read by HID)
|-
| 0x00040004
| 0x1C
| 0xC
| [[Hardware_calibration#CStick|CStick calibration data]]
|-
| 0x00050000
| 0x2
| 0xC
| [[Hardware_calibration#Screen_flicker|Screen flicker]]
|-
| 0x00050001
| 0x2
| 0xC
| Backlight controls (u8 ABL_powersave_enable, u8 brightness_level) (read by GSP)
|-
| 0x00050002
| 0x38
| 0xC
| [[Hardware_calibration#BLPWM|Backlight PWM]] (read by GSP)
|-
| 0x00050003
| 0x20
| 0xC
| [[Hardware_calibration#ABL|Power saving mode (ABL) calibration]] (read by GSP)
|-
| 0x00050004
| 0x20
| 0xC
| [[Hardware_calibration#ABL|Power saving mode (ABL) calibration]] (for legacy FIRM)
|-
| 0x00050005
| 0x20
| 0xE
| Stereo display settings (HWCAL block 0x470)
|-
| 0x00050006
| 0x2
| 0xC
| [[Hardware_calibration#ULCD_delay|3D switching delay]]
|-
| 0x00050007
| 0x4
| 0xC
| ?
|-
| 0x00050008
| 0x10C
| 0xC
| [[Hardware_calibration#ABL_extra|Power saving mode (ABL) extra config]]
|-
| 0x00050009
| 0x8
| 0xC
| new3DS only(?) backlight control (5th byte: auto-brightness enable)
|-
| 0x00060000
| 0x96
| 0xC
| ??? (HWCAL block 0x500)
|-
| 0x00070000
| 0x214
| 0xE
| [[Hardware_calibration#3D_filters|3D filters]]
|-
| 0x00070001
| 0x1
| 0xE
| Sound output mode (mono=0, stereo=1, surround=2)
|-
| 0x00070002
| 0x8
| 0xE
| [[Hardware_calibration#Microphone_echo_cancel|Microphone echo cancellation params]]
|-
| 0x00080000
| 0xC00
| 0xC
| WiFi configuration slot 0
|-
| 0x00080001
| 0xC00
| 0xC
| WiFi configuration slot 1
|-
| 0x00080002
| 0xC00
| 0xC
| WiFi configuration slot 2
|-
| 0x00090000
| 0x8
| 0xE
| This contains a u64 ID, used by processes using [[NWMUDS:InitializeWithVersion]]. The first word is the same as [[CfgS:GetLocalFriendCodeSeed|LocalFriendCodeSeed]], while the latter is a separate word.
|-
| 0x00090001
| 0x8
| 0xE
| Same content as 0x0009000? This console-unique u64 is used by [[Cfg:GenHashConsoleUnique|GenHashConsoleUnique]]. It is generated by <code>((0x3FFFFFFFF) & LocalFriendCodeSeed) | (random16 << 48))</code>, where random16 is generated by [[PSPXI:GenerateRandomBytes|GenerateRandomBytes]]
|-
| 0x00090002
| 0x4
| 0xE
| The first two bytes are the same random16 used in 0x00090001. The second two bytes are zeros.
|-
| 0x000A0000
| 0x1C
| 0xE
| [[#User Name Block 0x000A0000|User Name]]
|-
| 0x000A0001
| 0x2
| 0xE
| Birthday (u8 month, u8 day)
|-
| 0x000A0002
| 0x1
| 0xE
| Language
|-
| 0x000B0000
| 0x4
| 0xE
| CountryInfo
|-
| 0x000B0001
| 0x800
| 0xE
| Country name in UTF-16, every 0x80-bytes is an entry for each language, in the order of the Language table below (not all entries are set)
|-
| 0x000B0002
| 0x800
| 0xE
| State name in UTF-16, every 0x80-bytes is an entry for each language
|-
| 0x000B0003
| 0x4
| 0xE
| Coordinates. A pair of s16 represents latitude and longitude, respectively. One need to multiply both value by 180/32768 to get coordinates in degrees

|-
| 0x000C0000
| 0xC0
| 0xE
| [[#Parental Control Settings Block 0x000C0000|Parental Controls - Main data]]
|-
| 0x000C0001
| 0x14
| 0xE
| COPPACS restriction data
|-
| 0x000C0002
| 0x200
| 0xE
| [[#Parental Control Settings Block 0x000C0002|Parental Controls - Registered e-Mail address and custom secret question]]
|-
| 0x000D0000
| 0x4
| 0xE
| u16 at offset 0x0: [[SMDH#EULA_Version|EULA Version]] which was agreed to. u16 @ 0x02: latest version
|-
| 0x000E0000
| 0x1
| 0xE
| ? (related to SpotPass options in Internet Settings?)
|-
| 0x000F0000
| 0x10
| 0xC
| Debug configuration, read by [[NS]] on dev-units: on startup, NS does <code>svcKernelSetState(6, 1, (u64)debug_flags & 1);
svcKernelSetState(6, 2, (u64)debug_flags & 2);</code> (see [[SVC#KernelSetState|here]]) where <code>debug_flags</code> is the u32 located at offset 0xC in this struct. Then it compares the u32 from +8 in this config-block with the [[Configuration_Memory#APPMEMTYPE|APPMEMTYPE]]. When those don't match NS starts a FIRM-launch (with the same FIRM titleID as the currently running one) to boot into a FIRM with the APPMEMTYPE value from this config-block. The byte at offset 0x0 is related to the memtype as well.
|-
| 0x000F0001
| 0x8
| 0xC
| ?
|-
| 0x000F0003
| 0x1
| 0xC
| ?
|-
| 0x000F0004
| 0x4
| 0xC
| The first u8 is the System-Model [[Cfg:GetSystemModel|value]], the last 3-bytes are unknown
|-
| 0x000F0005
| 0x4
| 0xC
| The first u8 indicates whether network updates are enabled (however, NIM only checks this flag with developer [[Configuration_Memory#ENVINFO|ENVINFO]]).
|-
| 0x000F0006
| 0x28
| 0xC
| In NIM, taken as a (hopefully null terminated) string used for the "X-Device-Token" http header field for NPNS url.
|-
| 0x00100000
| 0x2
| 0xC
| TWL EULA info ({bool agreed; u8 agreedVersion})
|-
| 0x00100001
| 0x94
| 0xC
| Stores Parental Restrictions PIN/Secret Answer and other info for TWL mode
|-
| 0x00100002
| 0x1
| 0xC
| TWL country code
|-
| 0x00100003
| 0x10
| 0xC
| TWL movable unique ID, used for DSiWare exports
|-
| 0x00110000
| 0x4
| 0xC
| The low u16 indicates whether the system setup is required, such as when the system is booted for the first time or after doing a [[System Settings|System Format]]: 0 = setup required, non-zero = no setup required
|-
| 0x00110001
| 0x8
| 0xC
| TitleID of the menu to launch, used by [[NS]] on dev units (this block can be edited on dev units with [[3DS Development Unit Software#Config|Config]])
|-
| 0x00120000
| 0x8
| 0xC
| Volume Slider Bounds (Read by HID and PTM)
|-
| 0x00130000
| 0x4
| 0xE
| If response is 0x100 then debug mode is enabled.
|-
| 0x00150000
| 0x4
| 0xC
| Clock Sequence (u16) used for generating UUIDs in [[ACT_Services|ACT]].
|-
| 0x00150001
| 0x8
| 0xC
| ?
|-
| 0x00150002
| 0x4
| 0xE
| In NIM, taken as an u32, using the low u16, casted to a char, and turned lower case for the making of the url for NPNS.
|-
| 0x00160000
| 0x4
| 0xE
| Unknown, first byte is used by config service-cmd [[Config_Services|0x00070040]]. (Unknown whether the last 3-bytes are used)
|-
| 0x00170000
| 0x4
| 0xE
| Miiverse (OLV) access key
|-
| 0x00180000
| 0x4
| 0xC
| QTM Infrared LED related, can be 0 or 1
|-
| 0x00180001
| 0x18
| 0xC
| [[Hardware_calibration#QTM|QTM calibration data]]
|-
| 0x00190000
| 0x1
| 0xC
| Unknown. NFC-module checks for value1/non-value1.
|}

The developer unit TID block only exists on developer units.

===Stereo Display Settings===
All values are hard-coded in cfg module.
{| class="wikitable" border="1"
|-
! Offset
! Size
! Value
! Description
|-
| 0x0
| 4
| 62.0f
|assumed pupillary distance in mm?
|-
| 0x4
| 4
| 289.0f
|assumed distance in mm between player's eyes and upper screen?
|-
| 0x8
| 4
| 76.80f
|width in mm of (old) 3DS upper screen (doesn't vary for different models?)
|-
| 0xC
| 4
| 46.08f
|height in mm of (old) 3DS upper screen (doesn't vary for different models?)
|-
| 0x10
| 4
| 10.0f
|
|-
| 0x14
| 4
| 5.0f
|
|-
| 0x18
| 4
| 55.58f
|
|-
| 0x1C
| 4
| 21.57f
|
|}

===Languages===
{| class="wikitable" border="1"
|-
! ID
! Description
|-
| 0
| JP
|-
| 1
| EN
|-
| 2
| FR
|-
| 3
| DE
|-
| 4
| IT
|-
| 5
| ES
|-
| 6
| ZH
|-
| 7
| KO
|-
| 8
| NL
|-
| 9
| PT
|-
| 10
| RU
|-
| 11
| TW
|}

===CountryInfo===
{| class="wikitable" border="1"
|-
! Byte
! Description
|-
| 0
|?
|-
| 1
|?
|-
| 2
| State/Province code.
|-
| 3
| Country code, same as DSi/Wii country codes. Value 0xFF is invalid.
|}

===User Name Block 0x000A0000===
{| class="wikitable" border="1"
|-
! Byte
! Description
|-
| 0x0-0x15
| User name (UTF-16)
|-
| 0x16-17
| u16 NGWord flag to denote that the user name is inappropriate
|-
| 0x18-0x1B
| u32 NGWord version the username was last checked with. If this value is less than the u32 stored in the NGWord CFA "romfs:/version.dat", the system then checks the username string with the bad-word list CFA again, then updates this field with the value from the CFA
|}

While the user name is NULL-terminated, the terminator is not applied when the user name is 10 characters long, which leads to online access breaking (002-0109) and buffer overflows when the user name is retrieved, even in DS games.

===WiFi Slot Structure===

====Network structure====
This is used twice in the actual WiFi slot structure.
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| Whether the network was set or not?
|-
| 0x1
| 0x1
| Whether to use this network strucutre to connect?
|-
| 0x2
| 0x1
| Whether this structure is the first (0) or the second (1) in the larger WiFi slot structure?
|-
| 0x3
| 0x1
| Padding ?
|-
| 0x4
| 0x20
| SSID of the network, without a trailing nullbyte.
|-
| 0x24
| 0x1
| Length of the SSID.
|-
| 0x25
| 0x1
| [[Nintendo_Zone#Beacon_payload_format|AP crypto key type]]
|-
| 0x26
| 0x2
| Padding ?
|-
| 0x28
| 0x40
| Plaintext of the passphrase of the network, without a trailing nullbyte.
|-
| 0x68
| 0x20
| PBKDF2 of the passphrase and SSID (http://jorisvr.nl/wpapsk.html).
|-
|}

====Actual structure====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x2
| ?
|-
| 0x2
| 0x2
| [https://github.com/lammertb/libcrc/blob/v2.0/src/crc16.c#L43-L76 CRC-16 checksum] of the next 0x410 bytes.
|-
| 0x4
| 0x88
| First network structure. Only set if the network was set "normally", or was the last to be set using WPS during the session.
|-
| 0x8C
| 0x20
| Padding.
|-
| 0xAC
| 0x88
| Second network structure. Only set if the network was set using WPS, otherwise 0-filled.
|-
| 0x134
| 0x20C
| Padding.
|-
| 0x340
| 0x1
| Whether to automatically get the IP address (use DHCP) or not, defaults to 1.
|-
| 0x341
| 0x1
| Whether to automatically get the DNS or not, defaults to 1.
|-
| 0x342
| 0x2
| Padding ?
|-
| 0x344
| 0x4
| IP address, to use if 0x340 is false.
|-
| 0x348
| 0x4
| IP address of the gateway, to use if 0x340 is false.
|-
| 0x34C
| 0x4
| Subnetwork mask, to use if 0x340 is false.
|-
| 0x350
| 0x4
| IP address of the primary DNS , to use if 0x341 is false.
|-
| 0x354
| 0x4
| IP address of the secondary DNS, to use if 0x341 is false.
|-
| 0x358
| 0x4
| Always 0x01050000 ? Only set if the network was the last to be set during the session.
|-
| 0x35C
| 0x4
| IP address to use. Only set if the network was the last to be set during the session.
|-
| 0x360
| 0x6
| MAC address of the AP. Only set if the network was the last to be set during the session.
|-
| 0x366
| 0x1
| Channel. Only set if the network was the last to be set during the session.
|-
| 0x367
| 0x1
| Padding ? Only set if the network was the last to be set during the session.
|-
| 0x368
| 0x1
| Whether to use a proxy or not, defaults to 0.
|-
| 0x369
| 0x1
| Whether to use a basic authentication for the proxy, defaults to 0.
|-
| 0x36A
| 0x2
| Port to use for the proxy, defaults to 1.
|-
| 0x36C
| 0x30
| URL/address of the proxy, including a trailing nullbyte.
|-
| 0x39C
| 0x34
| Padding.
|-
| 0x3D0
| 0x20
| Username to use for basic authentication, including a trailing nullbyte.
|-
| 0x3F0
| 0x20
| Password to use for basic authentication, including a trailing nullbyte.
|-
| 0x410
| 0x2
| Padding ?
|-
| 0x412
| 0x2
| MTU value, defaults to 1400 and ranges between 576 and 1500, inclusive.
|-
| 0x414
| 0x7EC
| Padding.
|-
|}

===LCD display config===
There seems to be some sort of LCD display configuration stored in this cfg. When using the cfg-save from an Old3DS on a New3DS without formatting the cfg first, the bottom-screen display is somewhat off(which is fixed by formatting the cfg-save).

===Parental Control Settings Block 0x00100001===
{| class="wikitable" border="1"
|-
! Byte
! Size in bytes
! Description
|-
| 0x0
| 0xD
| Unknown.
|-
| 0xD
| 0x4
| PIN
|-
| 0x11
| 0x40
| Secret Answer (UTF-16)
|}

===Parental Control Settings Block 0x000C0000===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x00
| 0x04
| [[#Parental Control Restriction Bitmask|Parental Control Restriction Bitmask]]
|-
| 0x04
| 0x04
| Unknown
|-
| 0x08
| 0x01
| Rating system used for configuration
|-
| 0x09
| 0x01
| Maximum allowed age (20 = No restriction)
|-
| 0x0A
| 0x01
| Secret Question Type (0-5: Pre-defined, 6: Custom)
|-
| 0x0B
| 0x01
| Unknown
|-
| 0x0C
| 0x08
| Parental Controls PIN code (with NULL-termination, although restricted to 4 digits)
|-
| 0x14
| 0x44
| Secret Answer (UTF-16)
|}

====Parental Control Restriction Bitmask====
{| class="wikitable" border="1"
|-
! Bit
! Restriction name
|-
| 0
| Global Parental Controls Enable
|-
| 1
| Internet Browser
|-
| 2
| Display of 3D Images (disabled on 2DS)
|-
| 3
| Sharing Images/Audio/Video/Long Text Data
|-
| 4
| Online Interaction
|-
| 5
| StreetPass
|-
| 6
| Friend Registration
|-
| 7
| DS Download Play
|-
| 8
| Nintendo 3DS Shopping Services (eShop / EC Applet)
|-
| 9
| View Distributed Videos
|-
| 10
| Miiverse (View)
|-
| 11
| Miiverse (Post)
|-
| 31
| "Child Online Privacy Protection" (see [[Cfg:GetRegionCanadaUSA|CFG:IsCoppacsSupported]])
|}

===Parental Control Settings Block 0x000C0002===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0000
| 0x0001
| Boolean, whether an e-Mail has been registered
|-
| 0x0001
| 0x0101
| Registered e-Mail address (Plaintext)
|-
| 0x0102
| 0x0068
| Custom Secret Question (UTF-16)
|}

Config Savegame

2024-02-19T12:21:19Z

CyberYoshi64: Add bits to parental control bitmask

This page describes the format of the [[Config_Services|Cfg]] [[System_SaveData|NAND]] savegame. These blocks can be accessed with the Cfg service commands.

==Structure of save-file "/config"==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x2
| Total entries
|-
| 0x2
| 0x2
| Data entries offset
|-
| 0x4
| 0x4558
| Block entries
|-
| 0x455C
|
| Data for the entries
|}

The filesize for this /config file is 0x8000-bytes.

==Configuration block entry ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| BlkID
|-
| 0x4
| 0x4
| Offset to the data for this block when size is >4, otherwise this word is the data for this block
|-
| 0x8
| 0x2
| Size
|-
| 0xA
| 0x2
| Access Flags
|}

===Access Flags===
{| class="wikitable" border="1"
|-
! Bit Mask
! Description
|-
| 0x2
| User Readable (cfg:u)
|-
| 0x4
| System Writable (cfg:s / cfg:i)
|-
| 0x8
| System Readable (cfg:s / cfg:i)
|}

Config blocks will typically either use 0xC for system readable/writable or 0xE for all 3.

==Configuration blocks==
{| class="wikitable" border="1"
|-
! BlkID
! Size
! Access Flags
! Description
|-
| 0x00000000
| 0x2
| 0xC
| Config savegame version?
|-
| 0x00010000
| 0x1
| 0xC
| [[Hardware_calibration#RTC|RTC compensation value]]
|-
| 0x00020000
| 0x134
| 0xC
| [[Hardware_calibration#CDC|Codec]]
|-
| 0x00030000
| 0x1
| 0xC
| Leap Year Counter (read By PTM)
|-
| 0x00030001
| 0x8
| 0xE
| User time offset (read by CECD): displayed timestamp - rtc timestamp
|-
| 0x00030002
| 0x8
| 0xC
| Settings time offset: newly set timestamp - rtc timestamp
|-
| 0x00040000
| 0x10
| 0xC
| [[Hardware_calibration#Touch|Touch calibration]] (read by HID)
|-
| 0x00040001
| 0x1C
| 0xC
| Analog Stick Calibration Param?(read by HID)
|-
| 0x00040002
| 0x12
| 0xC
| [[Hardware_calibration#Gyro|Gyroscope]] (read by HID)
|-
| 0x00040003
| 0xC
| 0xC
| [[Hardware_calibration#Accel|Accelerometer]] (read by HID)
|-
| 0x00040004
| 0x1C
| 0xC
| [[Hardware_calibration#CStick|CStick calibration data]]
|-
| 0x00050000
| 0x2
| 0xC
| [[Hardware_calibration#Screen_flicker|Screen flicker]]
|-
| 0x00050001
| 0x2
| 0xC
| Backlight controls (u8 ABL_powersave_enable, u8 brightness_level) (read by GSP)
|-
| 0x00050002
| 0x38
| 0xC
| [[Hardware_calibration#BLPWM|Backlight PWM]] (read by GSP)
|-
| 0x00050003
| 0x20
| 0xC
| [[Hardware_calibration#ABL|Power saving mode (ABL) calibration]] (read by GSP)
|-
| 0x00050004
| 0x20
| 0xC
| [[Hardware_calibration#ABL|Power saving mode (ABL) calibration]] (for legacy FIRM)
|-
| 0x00050005
| 0x20
| 0xE
| Stereo display settings (HWCAL block 0x470)
|-
| 0x00050006
| 0x2
| 0xC
| [[Hardware_calibration#ULCD_delay|3D switching delay]]
|-
| 0x00050007
| 0x4
| 0xC
| ?
|-
| 0x00050008
| 0x10C
| 0xC
| [[Hardware_calibration#ABL_extra|Power saving mode (ABL) extra config]]
|-
| 0x00050009
| 0x8
| 0xC
| new3DS only(?) backlight control (5th byte: auto-brightness enable)
|-
| 0x00060000
| 0x96
| 0xC
| ??? (HWCAL block 0x500)
|-
| 0x00070000
| 0x214
| 0xE
| [[Hardware_calibration#3D_filters|3D filters]]
|-
| 0x00070001
| 0x1
| 0xE
| Sound output mode (mono=0, stereo=1, surround=2)
|-
| 0x00070002
| 0x8
| 0xE
| [[Hardware_calibration#Microphone_echo_cancel|Microphone echo cancellation params]]
|-
| 0x00080000
| 0xC00
| 0xC
| WiFi configuration slot 0
|-
| 0x00080001
| 0xC00
| 0xC
| WiFi configuration slot 1
|-
| 0x00080002
| 0xC00
| 0xC
| WiFi configuration slot 2
|-
| 0x00090000
| 0x8
| 0xE
| This contains a u64 ID, used by processes using [[NWMUDS:InitializeWithVersion]]. The first word is the same as [[CfgS:GetLocalFriendCodeSeed|LocalFriendCodeSeed]], while the latter is a separate word.
|-
| 0x00090001
| 0x8
| 0xE
| Same content as 0x0009000? This console-unique u64 is used by [[Cfg:GenHashConsoleUnique|GenHashConsoleUnique]]. It is generated by <code>((0x3FFFFFFFF) & LocalFriendCodeSeed) | (random16 << 48))</code>, where random16 is generated by [[PSPXI:GenerateRandomBytes|GenerateRandomBytes]]
|-
| 0x00090002
| 0x4
| 0xE
| The first two bytes are the same random16 used in 0x00090001. The second two bytes are zeros.
|-
| 0x000A0000
| 0x1C
| 0xE
| Username in UTF16
|-
| 0x000A0001
| 0x2
| 0xE
| Birthday (u8 month, u8 day)
|-
| 0x000A0002
| 0x1
| 0xE
| Language
|-
| 0x000B0000
| 0x4
| 0xE
| CountryInfo
|-
| 0x000B0001
| 0x800
| 0xE
| Country name in UTF-16, every 0x80-bytes is an entry for each language, in the order of the Language table below (not all entries are set)
|-
| 0x000B0002
| 0x800
| 0xE
| State name in UTF-16, every 0x80-bytes is an entry for each language
|-
| 0x000B0003
| 0x4
| 0xE
| Coordinates. A pair of s16 represents latitude and longitude, respectively. One need to multiply both value by 180/32768 to get coordinates in degrees

|-
| 0x000C0000
| 0xC0
| 0xE
| Restricted photo exchange data, and other info (includes a mirror of Parental Restrictions PIN/Secret Answer)
|-
| 0x000C0001
| 0x14
| 0xE
| COPPACS restriction data
|-
| 0x000C0002
| 0x200
| 0xE
| ? Contains the email address set during Parental Restriction setup.
|-
| 0x000D0000
| 0x4
| 0xE
| u16 at offset 0x0: [[SMDH#EULA_Version|EULA Version]] which was agreed to. u16 @ 0x02: latest version
|-
| 0x000E0000
| 0x1
| 0xE
| ?
|-
| 0x000F0000
| 0x10
| 0xC
| Debug configuration, read by [[NS]] on dev-units: on startup, NS does <code>svcKernelSetState(6, 1, (u64)debug_flags & 1);
svcKernelSetState(6, 2, (u64)debug_flags & 2);</code> (see [[SVC#KernelSetState|here]]) where <code>debug_flags</code> is the u32 located at offset 0xC in this struct. Then it compares the u32 from +8 in this config-block with the [[Configuration_Memory#APPMEMTYPE|APPMEMTYPE]]. When those don't match NS starts a FIRM-launch (with the same FIRM titleID as the currently running one) to boot into a FIRM with the APPMEMTYPE value from this config-block. The byte at offset 0x0 is related to the memtype as well.
|-
| 0x000F0001
| 0x8
| 0xC
| ?
|-
| 0x000F0003
| 0x1
| 0xC
| ?
|-
| 0x000F0004
| 0x4
| 0xC
| The first u8 is the System-Model [[Cfg:GetSystemModel|value]], the last 3-bytes are unknown
|-
| 0x000F0005
| 0x4
| 0xC
| The first u8 indicates whether network updates are enabled (however, NIM only checks this flag with developer [[Configuration_Memory#ENVINFO|ENVINFO]]).
|-
| 0x000F0006
| 0x28
| 0xC
| In NIM, taken as a (hopefully null terminated) string used for the "X-Device-Token" http header field for NPNS url.
|-
| 0x00100000
| 0x2
| 0xC
| TWL EULA info ({bool agreed; u8 agreedVersion})
|-
| 0x00100001
| 0x94
| 0xC
| Stores Parental Restrictions PIN/Secret Answer and other info for TWL mode
|-
| 0x00100002
| 0x1
| 0xC
| TWL country code
|-
| 0x00100003
| 0x10
| 0xC
| TWL movable unique ID, used for DSiWare exports
|-
| 0x00110000
| 0x4
| 0xC
| The low u16 indicates whether the system setup is required, such as when the system is booted for the first time or after doing a [[System Settings|System Format]]: 0 = setup required, non-zero = no setup required
|-
| 0x00110001
| 0x8
| 0xC
| TitleID of the menu to launch, used by [[NS]] on dev units (this block can be edited on dev units with [[3DS Development Unit Software#Config|Config]])
|-
| 0x00120000
| 0x8
| 0xC
| Volume Slider Bounds (Read by HID and PTM)
|-
| 0x00130000
| 0x4
| 0xE
| If response is 0x100 then debug mode is enabled.
|-
| 0x00150000
| 0x4
| 0xC
| Clock Sequence (u16) used for generating UUIDs in [[ACT_Services|ACT]].
|-
| 0x00150001
| 0x8
| 0xC
| ?
|-
| 0x00150002
| 0x4
| 0xE
| In NIM, taken as an u32, using the low u16, casted to a char, and turned lower case for the making of the url for NPNS.
|-
| 0x00160000
| 0x4
| 0xE
| Unknown, first byte is used by config service-cmd [[Config_Services|0x00070040]]. (Unknown whether the last 3-bytes are used)
|-
| 0x00170000
| 0x4
| 0xE
| Miiverse (OLV) access key
|-
| 0x00180000
| 0x4
| 0xC
| QTM Infrared LED related, can be 0 or 1
|-
| 0x00180001
| 0x18
| 0xC
| [[Hardware_calibration#QTM|QTM calibration data]]
|-
| 0x00190000
| 0x1
| 0xC
| Unknown. NFC-module checks for value1/non-value1.
|}

The developer unit TID block only exists on developer units.

===Stereo Display Settings===
All values are hard-coded in cfg module.
{| class="wikitable" border="1"
|-
! Offset
! Size
! Value
! Description
|-
| 0x0
| 4
| 62.0f
|assumed pupillary distance in mm?
|-
| 0x4
| 4
| 289.0f
|assumed distance in mm between player's eyes and upper screen?
|-
| 0x8
| 4
| 76.80f
|width in mm of (old) 3DS upper screen (doesn't vary for different models?)
|-
| 0xC
| 4
| 46.08f
|height in mm of (old) 3DS upper screen (doesn't vary for different models?)
|-
| 0x10
| 4
| 10.0f
|
|-
| 0x14
| 4
| 5.0f
|
|-
| 0x18
| 4
| 55.58f
|
|-
| 0x1C
| 4
| 21.57f
|
|}

===Languages===
{| class="wikitable" border="1"
|-
! ID
! Description
|-
| 0
| JP
|-
| 1
| EN
|-
| 2
| FR
|-
| 3
| DE
|-
| 4
| IT
|-
| 5
| ES
|-
| 6
| ZH
|-
| 7
| KO
|-
| 8
| NL
|-
| 9
| PT
|-
| 10
| RU
|-
| 11
| TW
|}

===CountryInfo===
{| class="wikitable" border="1"
|-
! Byte
! Description
|-
| 0
|?
|-
| 1
|?
|-
| 2
| State/Province code.
|-
| 3
| Country code, same as DSi/Wii country codes. Value 0xFF is invalid.
|}

===0x000A0000 Block===
{| class="wikitable" border="1"
|-
! Byte
! Description
|-
| 0x0-0x13
| UTF-16 username, with no NULL-terminator.
|-
| 0x14-17
| Usually zero?
|-
| 0x18-0x1B
| u32 NGWord version the username was last checked with. If this value is less than the u32 stored in the NGWord CFA "romfs:/version.dat", the system then checks the username string with the bad-word list CFA again, then updates this field with the value from the CFA
|}

===WiFi Slot Structure===

====Network structure====
This is used twice in the actual WiFi slot structure.
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| Whether the network was set or not?
|-
| 0x1
| 0x1
| Whether to use this network strucutre to connect?
|-
| 0x2
| 0x1
| Whether this structure is the first (0) or the second (1) in the larger WiFi slot structure?
|-
| 0x3
| 0x1
| Padding ?
|-
| 0x4
| 0x20
| SSID of the network, without a trailing nullbyte.
|-
| 0x24
| 0x1
| Length of the SSID.
|-
| 0x25
| 0x1
| [[Nintendo_Zone#Beacon_payload_format|AP crypto key type]]
|-
| 0x26
| 0x2
| Padding ?
|-
| 0x28
| 0x40
| Plaintext of the passphrase of the network, without a trailing nullbyte.
|-
| 0x68
| 0x20
| PBKDF2 of the passphrase and SSID (http://jorisvr.nl/wpapsk.html).
|-
|}

====Actual structure====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x2
| ?
|-
| 0x2
| 0x2
| [https://github.com/lammertb/libcrc/blob/v2.0/src/crc16.c#L43-L76 CRC-16 checksum] of the next 0x410 bytes.
|-
| 0x4
| 0x88
| First network structure. Only set if the network was set "normally", or was the last to be set using WPS during the session.
|-
| 0x8C
| 0x20
| Padding.
|-
| 0xAC
| 0x88
| Second network structure. Only set if the network was set using WPS, otherwise 0-filled.
|-
| 0x134
| 0x20C
| Padding.
|-
| 0x340
| 0x1
| Whether to automatically get the IP address (use DHCP) or not, defaults to 1.
|-
| 0x341
| 0x1
| Whether to automatically get the DNS or not, defaults to 1.
|-
| 0x342
| 0x2
| Padding ?
|-
| 0x344
| 0x4
| IP address, to use if 0x340 is false.
|-
| 0x348
| 0x4
| IP address of the gateway, to use if 0x340 is false.
|-
| 0x34C
| 0x4
| Subnetwork mask, to use if 0x340 is false.
|-
| 0x350
| 0x4
| IP address of the primary DNS , to use if 0x341 is false.
|-
| 0x354
| 0x4
| IP address of the secondary DNS, to use if 0x341 is false.
|-
| 0x358
| 0x4
| Always 0x01050000 ? Only set if the network was the last to be set during the session.
|-
| 0x35C
| 0x4
| IP address to use. Only set if the network was the last to be set during the session.
|-
| 0x360
| 0x6
| MAC address of the AP. Only set if the network was the last to be set during the session.
|-
| 0x366
| 0x1
| Channel. Only set if the network was the last to be set during the session.
|-
| 0x367
| 0x1
| Padding ? Only set if the network was the last to be set during the session.
|-
| 0x368
| 0x1
| Whether to use a proxy or not, defaults to 0.
|-
| 0x369
| 0x1
| Whether to use a basic authentication for the proxy, defaults to 0.
|-
| 0x36A
| 0x2
| Port to use for the proxy, defaults to 1.
|-
| 0x36C
| 0x30
| URL/address of the proxy, including a trailing nullbyte.
|-
| 0x39C
| 0x34
| Padding.
|-
| 0x3D0
| 0x20
| Username to use for basic authentication, including a trailing nullbyte.
|-
| 0x3F0
| 0x20
| Password to use for basic authentication, including a trailing nullbyte.
|-
| 0x410
| 0x2
| Padding ?
|-
| 0x412
| 0x2
| MTU value, defaults to 1400 and ranges between 576 and 1500, inclusive.
|-
| 0x414
| 0x7EC
| Padding.
|-
|}

===LCD display config===
There seems to be some sort of LCD display configuration stored in this cfg. When using the cfg-save from an Old3DS on a New3DS without formatting the cfg first, the bottom-screen display is somewhat off(which is fixed by formatting the cfg-save).

===Parental control Block 0x00100001===
{| class="wikitable" border="1"
|-
! Byte
! Size in bytes
! Description
|-
| 0x0
| 0xD
| Unknown.
|-
| 0xD
| 0x4
| PIN
|-
| 0x11
| 0x20
| Secret answer in UTF-16
|}

===Parental Control setting block 0xC0000===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x00
| 0x04
| [[#Parental Control restriction bitmask|Parental Control restriction bitmask]]
|-
| 0x0C
| 0x04
| Parental Controls PIN code
|}

====Parental Control restriction bitmask====
{| class="wikitable" border="1"
|-
! Bit
! Restriction name
|-
| 0
| Global Parental Controls enable
|-
| 1
| Internet Browser
|-
| 3
| Sharing Images/Audio/Video/Long Text Data
|-
| 4
| Online Interaction
|-
| 5
| StreetPass
|-
| 6
| Friend Registration
|-
| 7
| DS Download Play
|-
| 8
| Nintendo 3DS Shopping Services (eShop / EC Applet)
|-
| 9
| View Distributed Videos
|-
| 10
| Miiverse (View)
|-
| 11
| Miiverse (Post)
|-
| 31
| "Child Online Privacy Protection" (see [[Cfg:GetRegionCanadaUSA|CFG:IsCoppacsSupported]])
|}