Config Savegame: Difference between revisions

From 3dbrew
Jump to navigation Jump to search
← Older edit
m Fixes and some adjustments to formatting
TimmSkiller (talk | contribs)
Trusted
749 edits
No edit summary
 
(71 intermediate revisions by 22 users not shown)
Line 48: Line 48:
| 0xA
| 0xA
| 0x2
| 0x2
| Flags
| Access Flags
|}
|}
===Access Flags===
{| class="wikitable" border="1"
|-
!  Bit Mask
!  Description
|-
| 0x2
| User Readable (cfg:u)
|-
| 0x4
| System Writable (cfg:s / cfg:i)
|-
| 0x8
| System Readable (cfg:s / cfg:i)
|}
Config blocks will typically either use 0xC for system readable/writable or 0xE for all 3.


==Configuration blocks==
==Configuration blocks==
Line 56: Line 74:
!  BlkID
!  BlkID
!  Size
!  Size
!  Flags
!  Access Flags
!  Description
!  Description
|-
| 0x00000000
| 0x2
| 0xC
| Config savegame version?
|-
| 0x00010000
| 0x1
| 0xC
| [[Hardware_calibration#RTC|RTC compensation value]]
|-
| 0x00020000
| 0x134
| 0xC
| [[Hardware_calibration#CDC|Codec]]
|-
| 0x00030000
| 0x1
| 0xC
| Leap Year Counter (read By PTM)
|-
| 0x00030001
| 0x8
| 0xE
| User time offset (read by CECD): displayed timestamp - rtc timestamp
|-
| 0x00030002
| 0x8
| 0xC
| Settings time offset: newly set timestamp - rtc timestamp
|-
| 0x00040000
| 0x10
| 0xC
| [[Hardware_calibration#Touch|Touch calibration]] (read by HID)
|-
| 0x00040001
| 0x1C
| 0xC
| Analog Stick Calibration Param?(read by HID)
|-
| 0x00040002
| 0x12
| 0xC
| [[Hardware_calibration#Gyro|Gyroscope]] (read by HID)
|-
| 0x00040003
| 0xC
| 0xC
| [[Hardware_calibration#Accel|Accelerometer]] (read by HID)
|-
| 0x00040004
| 0x1C
| 0xC
| [[Hardware_calibration#CStick|CStick calibration data]]
|-
| 0x00050000
| 0x2
| 0xC
| [[Hardware_calibration#Screen_flicker|Screen flicker]]
|-
| 0x00050001
| 0x2
| 0xC
| Backlight controls (u8 ABL_powersave_enable, u8 brightness_level) (read by GSP)
|-
| 0x00050002
| 0x38
| 0xC
| [[Hardware_calibration#BLPWM|Backlight PWM]] (read by GSP)
|-
| 0x00050003
| 0x20
| 0xC
| [[Hardware_calibration#ABL|Power saving mode (ABL) calibration]] (read by GSP)
|-
| 0x00050004
| 0x20
| 0xC
| [[Hardware_calibration#ABL|Power saving mode (ABL) calibration]] (for legacy FIRM)
|-
|-
| 0x00050005
| 0x00050005
| 0x20
| 0x20
|?
| 0xE
| Stereo camera settings?
| Stereo display settings (HWCAL block 0x470)
|-
| 0x00050006
| 0x2
| 0xC
| [[Hardware_calibration#ULCD_delay|3D switching delay]]
|-
| 0x00050007
| 0x4
| 0xC
| ?
|-
| 0x00050008
| 0x10C
| 0xC
| [[Hardware_calibration#ABL_extra|Power saving mode (ABL) extra config]]
|-
| 0x00050009
| 0x8
| 0xC
| new3DS only(?) backlight control (5th byte: auto-brightness enable)
|-
| 0x00060000
| 0x96
| 0xC
| ??? (HWCAL block 0x500)
|-
| 0x00070000
| 0x214
| 0xE
| [[Hardware_calibration#3D_filters|3D filters]]
|-
|-
| 0x00070001
| 0x00070001
| 0x1
| 0x1
|?
| 0xE
| Sound output mode?
| Sound output mode (mono=0, stereo=1, surround=2)
|-
| 0x00070002
| 0x8
| 0xE
| [[Hardware_calibration#Microphone_echo_cancel|Microphone echo cancellation params]]
|-
|-
| 0x00080000
| 0x00080000
| 0xC00
| 0xC00
| 0x2?
| 0xC
| WiFi configuration slot 0
| WiFi configuration slot 0
|-
|-
| 0x00080001
| 0x00080001
| 0xC00
| 0xC00
| 0x2?
| 0xC
| WiFi configuration slot 1
| WiFi configuration slot 1
|-
|-
| 0x00080002
| 0x00080002
| 0xC00
| 0xC00
| 0x2?
| 0xC
| WiFi configuration slot 2
| WiFi configuration slot 2
|-
|-
| 0x00090000
| 0x00090000
| 0x8
| 0x8
| 0x2?
| 0xE
| This contains a u64 ID, used by processes using [[NWMUDS:Initialize]]. The first word is the same as [[CfgS:GetLocalFriendCodeSeed|LocalFriendCodeSeed]], while the latter is a separate random word
| This contains a u64 ID, used by processes using [[NWMUDS:InitializeWithVersion]]. The first word is the same as [[CfgS:GetLocalFriendCodeSeed|LocalFriendCodeSeed]], while the latter is a separate word.
|-
|-
| 0x00090001
| 0x00090001
| 0x8
| 0x8
| 0xE
| 0xE
| This console-unique u64 used by [[Cfg:GenHashConsoleUnique|GenHashConsoleUnique]] is generated with the LocalFriendCodeSeed and with random data
| Same content as 0x0009000? This console-unique u64 is used by [[Cfg:GenHashConsoleUnique|GenHashConsoleUnique]]. It is generated by <code>((0x3FFFFFFFF) & LocalFriendCodeSeed) | (random16 << 48))</code>, where random16 is generated by [[PSPXI:GenerateRandomBytes|GenerateRandomBytes]]
|-
| 0x00090002
| 0x4
| 0xE
| The first two bytes are the same random16 used in 0x00090001. The second two bytes are zeros.
|-
|-
| 0x000A0000
| 0x000A0000
| 0x1C
| 0x1C
| 0xE
| 0xE
| Username
| [[#User Name Block 0x000A0000|User Name]]
|-
| 0x000A0001
| 0x2
| 0xE
| Birthday (u8 month, u8 day)
|-
|-
| 0x000A0002
| 0x000A0002
| 0x1
| 0x1
| 0xA
| 0xE
| Language
| Language
|-
|-
| 0x000B0000
| 0x000B0000
| 0x4
| 0x4
| 0x8
| 0xE
| CountryInfo
| CountryInfo
|-
|-
| 0x000B0001
| 0x000B0001
| 0x800
| 0x800
| 0x2?
| 0xE
| Country name in UTF-16, every 0x80-bytes is an entry for each language(not all entries are set)
| Country name in UTF-16, every 0x80-bytes is an entry for each language, in the order of the Language table below (not all entries are set)
|-
|-
| 0x000B0002
| 0x000B0002
| 0x800
| 0x800
| 0x2?
| 0xE
| State name in UTF-16, every 0x80-bytes is an entry for each language
| State name in UTF-16, every 0x80-bytes is an entry for each language
|-
| 0x000B0003
| 0x4
| 0xE
| Coordinates. A pair of s16 represents latitude and longitude, respectively. One need to multiply both value by 180/32768 to get coordinates in degrees
|-
|-
| 0x000C0000
| 0x000C0000
| 0xC0
| 0xC0
|?
| 0xE
| Restricted photo exchange data, and other info
| [[#Parental Control Settings Block 0x000C0000|Parental Controls - Main data]]
|-
|-
| 0x000C0001
| 0x000C0001
| 0x14
| 0x14
|?
| 0xE
| Same as above?
| COPPACS restriction data
|-
| 0x000C0002
| 0x200
| 0xE
| [[#Parental Control Settings Block 0x000C0002|Parental Controls - Registered e-Mail address and custom secret question]]
|-
|-
| 0x000D0000
| 0x000D0000
| 0x4
| 0x4
|?
| 0xE
| u16 at offset 0x0: [[SMDH#EULA_Version|EULA Version]] which was agreed to.
| u16 at offset 0x0: [[SMDH#EULA_Version|EULA Version]] which was agreed to. u16 @ 0x02: latest version
|-
| 0x000E0000
| 0x1
| 0xE
| ? (related to SpotPass options in Internet Settings?)
|-
|-
| 0x000F0000
| 0x000F0000
| 0x10
| 0x10
| 0x8?
| 0xC
| Unknown, used by [[NS]] on dev-units for [[SVC|svcKernelSetState]], where Type is 6. During NS startup on debug-units, NS compares the u32 from +8 in this config-block with the [[Configuration_Memory#APPMEMTYPE|APPMEMTYPE]]. When those don't match NS starts a FIRM-launch (with the same FIRM titleID as the currently running one) to boot into a FIRM with the APPMEMTYPE value from this config-block
| Debug configuration, read by [[NS]] on dev-units: on startup, NS does <code>svcKernelSetState(6, 1, (u64)debug_flags & 1);
svcKernelSetState(6, 2, (u64)debug_flags & 2);</code> (see [[SVC#KernelSetState|here]]) where <code>debug_flags</code> is the u32 located at offset 0xC in this struct. Then it compares the u32 from +8 in this config-block with the [[Configuration_Memory#APPMEMTYPE|APPMEMTYPE]]. When those don't match NS starts a FIRM-launch (with the same FIRM titleID as the currently running one) to boot into a FIRM with the APPMEMTYPE value from this config-block. The byte at offset 0x0 is related to the memtype as well.
|-
| 0x000F0001
| 0x8
| 0xC
| ?
|-
| 0x000F0003
| 0x1
| 0xC
| Home Menu button disable
|-
|-
| 0x000F0004
| 0x000F0004
| 0x4
| 0x4
| 0x8?
| 0xC
| The first u8 is the System-Model [[Cfg:GetSystemModel|value]], the last 3-bytes are unknown
| The first u8 is the System-Model [[Cfg:GetSystemModel|value]], the last 3-bytes are unknown
|-
| 0x000F0005
| 0x4
| 0xC
| The first u8 indicates whether network updates are enabled (however, NIM only checks this flag with developer [[Configuration_Memory#ENVINFO|ENVINFO]]).
|-
| 0x000F0006
| 0x28
| 0xC
| In NIM, taken as a (hopefully null terminated) string used for the "X-Device-Token" http header field for NPNS url.
|-
| 0x00100000
| 0x2
| 0xC
| TWL EULA info ({bool agreed; u8 agreedVersion})
|-
| 0x00100001
| 0x94
| 0xC
| Stores Parental Restrictions PIN/Secret Answer and other info for TWL mode
|-
| 0x00100002
| 0x1
| 0xC
| TWL country code
|-
| 0x00100003
| 0x10
| 0xC
| TWL movable unique ID, used for DSiWare exports
|-
|-
| 0x00110000
| 0x00110000
| 0x4
| 0x4
|?
| 0xC
| The low u16 indicates whether the system setup is required, such as when the system is booted for the first time or after doing a [[System Settings|System Format]]: 0 = setup required, non-zero = no setup required
| The low u16 indicates whether the system setup is required, such as when the system is booted for the first time or after doing a [[System Settings|System Format]]: 0 = setup required, non-zero = no setup required
|-
|-
| 0x00110001
| 0x00110001
| 0x8
| 0x8
| 0xA?
| 0xC
| TitleID of the menu to launch, used by [[NS]] on dev units (this block can be edited on dev units with [[3DS Development Unit Software#Config|Config]])
| TitleID of the menu to launch, used by [[NS]] on dev units (this block can be edited on dev units with [[3DS Development Unit Software#Config|Config]])
|-
| 0x00120000
| 0x8
| 0xC
| Volume Slider Bounds (Read by HID and PTM)
|-
|-
| 0x00130000
| 0x00130000
| 0x4
| 0x4
|?
| 0xE
| If response is 0x100 then debug mode is enabled.
| If response is 0x100 then debug mode is enabled.
|-
| 0x00150000
| 0x4
| 0xC
| Clock Sequence (u16) used for generating UUIDs in [[ACT_Services|ACT]].
|-
| 0x00150001
| 0x8
| 0xC
| ?
|-
| 0x00150002
| 0x4
| 0xE
| [[Friend_Services#Server_Types|NFS (Nintendo Friend Server) Environment]] in the format <code>%c%d</code>. Set by the [[ACT_Services|ACT]] sysmodule. Used in the [[NIM_Services#NIM|NIM]] sysmodule for making the NPNS URL.
|-
|-
| 0x00160000
| 0x00160000
| 0x4
| 0x4
| 0x8?
| 0xE
| Unknown, first byte is used by config service-cmd [[Config_Services|0x00070040]]. (Unknown whether the last 3-bytes are used)
| Unknown, first byte is used by config service-cmd [[Config_Services|0x00070040]]. (Unknown whether the last 3-bytes are used)
|-
| 0x00170000
| 0x4
| 0xE
| Miiverse (OLV) access key
|-
| 0x00180000
| 0x4
| 0xC
| QTM Infrared LED related, can be 0 or 1
|-
| 0x00180001
| 0x18
| 0xC
| [[Hardware_calibration#QTM|QTM calibration data]]
|-
| 0x00190000
| 0x1
| 0xC
| Unknown. NFC-module checks for value1/non-value1.
|}
|}


The dev unit TID block only exists on dev units.
The developer unit TID block only exists on developer units.
 
===Stereo Display Settings===
All values are hard-coded in cfg module.
{| class="wikitable" border="1"
|-
!  Offset
!  Size
!  Value
!  Description
|-
| 0x0
| 4
| 62.0f
|assumed pupillary distance in mm?
|-
| 0x4
| 4
| 289.0f
|assumed distance in mm between player's eyes and upper screen?
|-
| 0x8
| 4
| 76.80f
|width in mm of (old) 3DS upper screen (doesn't vary for different models?)
|-
| 0xC
| 4
| 46.08f
|height in mm of (old) 3DS upper screen (doesn't vary for different models?)
|-
| 0x10
| 4
| 10.0f
|
|-
| 0x14
| 4
| 5.0f
|
|-
| 0x18
| 4
| 55.58f
|
|-
| 0x1C
| 4
| 21.57f
|
|}


===Languages===
===Languages===
Line 205: Line 495:
| 10
| 10
| RU
| RU
|-
| 11
| TW
|}
|}


Line 214: Line 507:
|-
|-
| 0
| 0
| ?
|?
|-
|-
| 1
| 1
Line 220: Line 513:
|-
|-
| 2
| 2
|?
| State/Province code.
|-
|-
| 3
| 3
Line 226: Line 519:
|}
|}


===0x000A0000 Block===
===User Name Block 0x000A0000===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
|-
|-
Line 232: Line 525:
!  Description
!  Description
|-
|-
| 0x0-0x13
| 0x00-0x15
| UTF-16 username, with no NULL-terminator.
| User name (UTF-16)
|-
|-
| 0x14-17
| 0x16-0x17
| Usually zero?
| u16 NGWord flag to denote that the user name is inappropriate
|-
|-
| 0x18-0x1B
| 0x18-0x1B
| u32 NGWord version the username was last checked with. If this value is less than the u32 stored in the NGWord CFA "romfs:/version.dat", the system then checks the username string with the bad-word list CFA again, then updates this field with the value from the CFA
| u32 NGWord version the username was last checked with. If this value is less than the u32 stored in the NGWord CFA "romfs:/version.dat", the system then checks the username string with the bad-word list CFA again, then updates this field with the value from the CFA
|}
While the user name is NULL-terminated, the terminator is not applied when the user name is 10 characters long, which leads to online access breaking (002-0109) and buffer overflows when the user name is retrieved, even in DS games.
===WiFi Slot Structure===
====Network structure====
This is used twice in the actual WiFi slot structure.
{| class="wikitable" border="1"
|-
!  Offset
!  Size
!  Description
|-
| 0x0
| 0x1
| Whether the network was set or not?
|-
| 0x1
| 0x1
| Whether to use this network strucutre to connect?
|-
| 0x2
| 0x1
| Whether this structure is the first (0) or the second (1) in the larger WiFi slot structure?
|-
| 0x3
| 0x1
| Padding ?
|-
| 0x4
| 0x20
| SSID of the network, without a trailing nullbyte.
|-
| 0x24
| 0x1
| Length of the SSID.
|-
| 0x25
| 0x1
| [[Nintendo_Zone#Beacon_payload_format|AP crypto key type]]
|-
| 0x26
| 0x2
| Padding ?
|-
| 0x28
| 0x40
| Plaintext of the passphrase of the network, without a trailing nullbyte.
|-
| 0x68
| 0x20
| PBKDF2 of the passphrase and SSID (http://jorisvr.nl/wpapsk.html).
|-
|}
====Actual structure====
{| class="wikitable" border="1"
|-
!  Offset
!  Size
!  Description
|-
| 0x0
| 0x2
| ?
|-
| 0x2
| 0x2
| [https://github.com/lammertb/libcrc/blob/v2.0/src/crc16.c#L43-L76 CRC-16 checksum] of the next 0x410 bytes.
|-
| 0x4
| 0x88
| First network structure. Only set if the network was set "normally", or was the last to be set using WPS during the session.
|-
| 0x8C
| 0x20
| Padding.
|-
| 0xAC
| 0x88
| Second network structure. Only set if the network was set using WPS, otherwise 0-filled.
|-
| 0x134
| 0x20C
| Padding.
|-
| 0x340
| 0x1
| Whether to automatically get the IP address (use DHCP) or not, defaults to 1.
|-
| 0x341
| 0x1
| Whether to automatically get the DNS or not, defaults to 1.
|-
| 0x342
| 0x2
| Padding ?
|-
| 0x344
| 0x4
| IP address, to use if 0x340 is false.
|-
| 0x348
| 0x4
| IP address of the gateway, to use if 0x340 is false.
|-
| 0x34C
| 0x4
| Subnetwork mask, to use if 0x340 is false.
|-
| 0x350
| 0x4
| IP address of the primary DNS , to use if 0x341 is false.
|-
| 0x354
| 0x4
| IP address of the secondary DNS, to use if 0x341 is false.
|-
| 0x358
| 0x4
| Always 0x01050000 ? Only set if the network was the last to be set during the session.
|-
| 0x35C
| 0x4
| IP address to use. Only set if the network was the last to be set during the session.
|-
| 0x360
| 0x6
| MAC address of the AP. Only set if the network was the last to be set during the session.
|-
| 0x366
| 0x1
| Channel. Only set if the network was the last to be set during the session.
|-
| 0x367
| 0x1
| Padding ? Only set if the network was the last to be set during the session.
|-
| 0x368
| 0x1
| Whether to use a proxy or not, defaults to 0.
|-
| 0x369
| 0x1
| Whether to use a basic authentication for the proxy, defaults to 0.
|-
| 0x36A
| 0x2
| Port to use for the proxy, defaults to 1.
|-
| 0x36C
| 0x30
| URL/address of the proxy, including a trailing nullbyte.
|-
| 0x39C
| 0x34
| Padding.
|-
| 0x3D0
| 0x20
| Username to use for basic authentication, including a trailing nullbyte.
|-
| 0x3F0
| 0x20
| Password to use for basic authentication, including a trailing nullbyte.
|-
| 0x410
| 0x2
| Padding ?
|-
| 0x412
| 0x2
| MTU value, defaults to 1400 and ranges between 576 and 1500, inclusive.
|-
| 0x414
| 0x7EC
| Padding.
|-
|}
===LCD display config===
There seems to be some sort of LCD display configuration stored in this cfg. When using the cfg-save from an Old3DS on a New3DS without formatting the cfg first, the bottom-screen display is somewhat off(which is fixed by formatting the cfg-save).
===Parental Control Settings Block 0x00100001===
{| class="wikitable" border="1"
|-
!  Byte
!  Size in bytes
!  Description
|-
| 0x0
| 0xD
| Unknown.
|-
| 0xD
| 0x4
| PIN
|-
| 0x11
| 0x40
| Secret Answer (UTF-16)
|}
===Parental Control Settings Block 0x000C0000===
{| class="wikitable" border="1"
|-
!  Offset
!  Size
!  Description
|-
| 0x00
| 0x04
| [[#Parental Control Restriction Bitmask|Parental Control Restriction Bitmask]]
|-
| 0x04
| 0x04
| Unknown
|-
| 0x08
| 0x01
| Rating system used for configuration
|-
| 0x09
| 0x01
| Maximum allowed age (20 = No restriction)
|-
| 0x0A
| 0x01
| Secret Question Type (0-5: Pre-defined, 6: Custom)
|-
| 0x0B
| 0x01
| Unknown
|-
| 0x0C
| 0x08
| Parental Controls PIN code (with NULL-termination, although restricted to 4 digits)
|-
| 0x14
| 0x44
| Secret Answer (UTF-16)
|}
====Parental Control Restriction Bitmask====
{| class="wikitable" border="1"
|-
! Bit
! Restriction name
|-
| 0
| Global Parental Controls Enable
|-
| 1
| Internet Browser
|-
| 2
| Display of 3D Images (disabled on 2DS)
|-
| 3
| Sharing Images/Audio/Video/Long Text Data
|-
| 4
| Online Interaction
|-
| 5
| StreetPass
|-
| 6
| Friend Registration
|-
| 7
| DS Download Play
|-
| 8
| Nintendo 3DS Shopping Services (eShop / EC Applet)
|-
| 9
| View Distributed Videos
|-
| 10
| Miiverse (View)
|-
| 11
| Miiverse (Post)
|-
| 31
| "Child Online Privacy Protection" (see [[Cfg:GetRegionCanadaUSA|CFG:IsCoppacsSupported]])
|}
===Parental Control Settings Block 0x000C0002===
{| class="wikitable" border="1"
|-
!  Offset
!  Size
!  Description
|-
| 0x0000
| 0x0001
| Boolean, whether an e-Mail has been registered
|-
| 0x0001
| 0x0101
| Registered e-Mail address (Plaintext)
|-
| 0x0102
| 0x0068
| Custom Secret Question (UTF-16)
|}
|}

Latest revision as of 19:04, 22 January 2025

This page describes the format of the Cfg NAND savegame. These blocks can be accessed with the Cfg service commands.

Structure of save-file "/config"

Offset Size Description
0x0 0x2 Total entries
0x2 0x2 Data entries offset
0x4 0x4558 Block entries
0x455C Data for the entries

The filesize for this /config file is 0x8000-bytes.

Configuration block entry

Offset Size Description
0x0 0x4 BlkID
0x4 0x4 Offset to the data for this block when size is >4, otherwise this word is the data for this block
0x8 0x2 Size
0xA 0x2 Access Flags

Access Flags

Bit Mask Description
0x2 User Readable (cfg:u)
0x4 System Writable (cfg:s / cfg:i)
0x8 System Readable (cfg:s / cfg:i)

Config blocks will typically either use 0xC for system readable/writable or 0xE for all 3.

Configuration blocks

BlkID Size Access Flags Description
0x00000000 0x2 0xC Config savegame version?
0x00010000 0x1 0xC RTC compensation value
0x00020000 0x134 0xC Codec
0x00030000 0x1 0xC Leap Year Counter (read By PTM)
0x00030001 0x8 0xE User time offset (read by CECD): displayed timestamp - rtc timestamp
0x00030002 0x8 0xC Settings time offset: newly set timestamp - rtc timestamp
0x00040000 0x10 0xC Touch calibration (read by HID)
0x00040001 0x1C 0xC Analog Stick Calibration Param?(read by HID)
0x00040002 0x12 0xC Gyroscope (read by HID)
0x00040003 0xC 0xC Accelerometer (read by HID)
0x00040004 0x1C 0xC CStick calibration data
0x00050000 0x2 0xC Screen flicker
0x00050001 0x2 0xC Backlight controls (u8 ABL_powersave_enable, u8 brightness_level) (read by GSP)
0x00050002 0x38 0xC Backlight PWM (read by GSP)
0x00050003 0x20 0xC Power saving mode (ABL) calibration (read by GSP)
0x00050004 0x20 0xC Power saving mode (ABL) calibration (for legacy FIRM)
0x00050005 0x20 0xE Stereo display settings (HWCAL block 0x470)
0x00050006 0x2 0xC 3D switching delay
0x00050007 0x4 0xC ?
0x00050008 0x10C 0xC Power saving mode (ABL) extra config
0x00050009 0x8 0xC new3DS only(?) backlight control (5th byte: auto-brightness enable)
0x00060000 0x96 0xC ??? (HWCAL block 0x500)
0x00070000 0x214 0xE 3D filters
0x00070001 0x1 0xE Sound output mode (mono=0, stereo=1, surround=2)
0x00070002 0x8 0xE Microphone echo cancellation params
0x00080000 0xC00 0xC WiFi configuration slot 0
0x00080001 0xC00 0xC WiFi configuration slot 1
0x00080002 0xC00 0xC WiFi configuration slot 2
0x00090000 0x8 0xE This contains a u64 ID, used by processes using NWMUDS:InitializeWithVersion. The first word is the same as LocalFriendCodeSeed, while the latter is a separate word.
0x00090001 0x8 0xE Same content as 0x0009000? This console-unique u64 is used by GenHashConsoleUnique. It is generated by ((0x3FFFFFFFF) & LocalFriendCodeSeed) | (random16 << 48)), where random16 is generated by GenerateRandomBytes
0x00090002 0x4 0xE The first two bytes are the same random16 used in 0x00090001. The second two bytes are zeros.
0x000A0000 0x1C 0xE User Name
0x000A0001 0x2 0xE Birthday (u8 month, u8 day)
0x000A0002 0x1 0xE Language
0x000B0000 0x4 0xE CountryInfo
0x000B0001 0x800 0xE Country name in UTF-16, every 0x80-bytes is an entry for each language, in the order of the Language table below (not all entries are set)
0x000B0002 0x800 0xE State name in UTF-16, every 0x80-bytes is an entry for each language
0x000B0003 0x4 0xE Coordinates. A pair of s16 represents latitude and longitude, respectively. One need to multiply both value by 180/32768 to get coordinates in degrees
0x000C0000 0xC0 0xE Parental Controls - Main data
0x000C0001 0x14 0xE COPPACS restriction data
0x000C0002 0x200 0xE Parental Controls - Registered e-Mail address and custom secret question
0x000D0000 0x4 0xE u16 at offset 0x0: EULA Version which was agreed to. u16 @ 0x02: latest version
0x000E0000 0x1 0xE ? (related to SpotPass options in Internet Settings?)
0x000F0000 0x10 0xC Debug configuration, read by NS on dev-units: on startup, NS does svcKernelSetState(6, 1, (u64)debug_flags & 1);

svcKernelSetState(6, 2, (u64)debug_flags & 2); (see here) where debug_flags is the u32 located at offset 0xC in this struct. Then it compares the u32 from +8 in this config-block with the APPMEMTYPE. When those don't match NS starts a FIRM-launch (with the same FIRM titleID as the currently running one) to boot into a FIRM with the APPMEMTYPE value from this config-block. The byte at offset 0x0 is related to the memtype as well.

0x000F0001 0x8 0xC ?
0x000F0003 0x1 0xC Home Menu button disable
0x000F0004 0x4 0xC The first u8 is the System-Model value, the last 3-bytes are unknown
0x000F0005 0x4 0xC The first u8 indicates whether network updates are enabled (however, NIM only checks this flag with developer ENVINFO).
0x000F0006 0x28 0xC In NIM, taken as a (hopefully null terminated) string used for the "X-Device-Token" http header field for NPNS url.
0x00100000 0x2 0xC TWL EULA info ({bool agreed; u8 agreedVersion})
0x00100001 0x94 0xC Stores Parental Restrictions PIN/Secret Answer and other info for TWL mode
0x00100002 0x1 0xC TWL country code
0x00100003 0x10 0xC TWL movable unique ID, used for DSiWare exports
0x00110000 0x4 0xC The low u16 indicates whether the system setup is required, such as when the system is booted for the first time or after doing a System Format: 0 = setup required, non-zero = no setup required
0x00110001 0x8 0xC TitleID of the menu to launch, used by NS on dev units (this block can be edited on dev units with Config)
0x00120000 0x8 0xC Volume Slider Bounds (Read by HID and PTM)
0x00130000 0x4 0xE If response is 0x100 then debug mode is enabled.
0x00150000 0x4 0xC Clock Sequence (u16) used for generating UUIDs in ACT.
0x00150001 0x8 0xC ?
0x00150002 0x4 0xE NFS (Nintendo Friend Server) Environment in the format %c%d. Set by the ACT sysmodule. Used in the NIM sysmodule for making the NPNS URL.
0x00160000 0x4 0xE Unknown, first byte is used by config service-cmd 0x00070040. (Unknown whether the last 3-bytes are used)
0x00170000 0x4 0xE Miiverse (OLV) access key
0x00180000 0x4 0xC QTM Infrared LED related, can be 0 or 1
0x00180001 0x18 0xC QTM calibration data
0x00190000 0x1 0xC Unknown. NFC-module checks for value1/non-value1.

The developer unit TID block only exists on developer units.

Stereo Display Settings

All values are hard-coded in cfg module.

Offset Size Value Description
0x0 4 62.0f assumed pupillary distance in mm?
0x4 4 289.0f assumed distance in mm between player's eyes and upper screen?
0x8 4 76.80f width in mm of (old) 3DS upper screen (doesn't vary for different models?)
0xC 4 46.08f height in mm of (old) 3DS upper screen (doesn't vary for different models?)
0x10 4 10.0f
0x14 4 5.0f
0x18 4 55.58f
0x1C 4 21.57f

Languages

ID Description
0 JP
1 EN
2 FR
3 DE
4 IT
5 ES
6 ZH
7 KO
8 NL
9 PT
10 RU
11 TW

CountryInfo

Byte Description
0 ?
1 ?
2 State/Province code.
3 Country code, same as DSi/Wii country codes. Value 0xFF is invalid.

User Name Block 0x000A0000

Byte Description
0x00-0x15 User name (UTF-16)
0x16-0x17 u16 NGWord flag to denote that the user name is inappropriate
0x18-0x1B u32 NGWord version the username was last checked with. If this value is less than the u32 stored in the NGWord CFA "romfs:/version.dat", the system then checks the username string with the bad-word list CFA again, then updates this field with the value from the CFA

While the user name is NULL-terminated, the terminator is not applied when the user name is 10 characters long, which leads to online access breaking (002-0109) and buffer overflows when the user name is retrieved, even in DS games.

WiFi Slot Structure

Network structure

This is used twice in the actual WiFi slot structure.

Offset Size Description
0x0 0x1 Whether the network was set or not?
0x1 0x1 Whether to use this network strucutre to connect?
0x2 0x1 Whether this structure is the first (0) or the second (1) in the larger WiFi slot structure?
0x3 0x1 Padding ?
0x4 0x20 SSID of the network, without a trailing nullbyte.
0x24 0x1 Length of the SSID.
0x25 0x1 AP crypto key type
0x26 0x2 Padding ?
0x28 0x40 Plaintext of the passphrase of the network, without a trailing nullbyte.
0x68 0x20 PBKDF2 of the passphrase and SSID (http://jorisvr.nl/wpapsk.html).

Actual structure

Offset Size Description
0x0 0x2 ?
0x2 0x2 CRC-16 checksum of the next 0x410 bytes.
0x4 0x88 First network structure. Only set if the network was set "normally", or was the last to be set using WPS during the session.
0x8C 0x20 Padding.
0xAC 0x88 Second network structure. Only set if the network was set using WPS, otherwise 0-filled.
0x134 0x20C Padding.
0x340 0x1 Whether to automatically get the IP address (use DHCP) or not, defaults to 1.
0x341 0x1 Whether to automatically get the DNS or not, defaults to 1.
0x342 0x2 Padding ?
0x344 0x4 IP address, to use if 0x340 is false.
0x348 0x4 IP address of the gateway, to use if 0x340 is false.
0x34C 0x4 Subnetwork mask, to use if 0x340 is false.
0x350 0x4 IP address of the primary DNS , to use if 0x341 is false.
0x354 0x4 IP address of the secondary DNS, to use if 0x341 is false.
0x358 0x4 Always 0x01050000 ? Only set if the network was the last to be set during the session.
0x35C 0x4 IP address to use. Only set if the network was the last to be set during the session.
0x360 0x6 MAC address of the AP. Only set if the network was the last to be set during the session.
0x366 0x1 Channel. Only set if the network was the last to be set during the session.
0x367 0x1 Padding ? Only set if the network was the last to be set during the session.
0x368 0x1 Whether to use a proxy or not, defaults to 0.
0x369 0x1 Whether to use a basic authentication for the proxy, defaults to 0.
0x36A 0x2 Port to use for the proxy, defaults to 1.
0x36C 0x30 URL/address of the proxy, including a trailing nullbyte.
0x39C 0x34 Padding.
0x3D0 0x20 Username to use for basic authentication, including a trailing nullbyte.
0x3F0 0x20 Password to use for basic authentication, including a trailing nullbyte.
0x410 0x2 Padding ?
0x412 0x2 MTU value, defaults to 1400 and ranges between 576 and 1500, inclusive.
0x414 0x7EC Padding.

LCD display config

There seems to be some sort of LCD display configuration stored in this cfg. When using the cfg-save from an Old3DS on a New3DS without formatting the cfg first, the bottom-screen display is somewhat off(which is fixed by formatting the cfg-save).


Parental Control Settings Block 0x00100001

Byte Size in bytes Description
0x0 0xD Unknown.
0xD 0x4 PIN
0x11 0x40 Secret Answer (UTF-16)

Parental Control Settings Block 0x000C0000

Offset Size Description
0x00 0x04 Parental Control Restriction Bitmask
0x04 0x04 Unknown
0x08 0x01 Rating system used for configuration
0x09 0x01 Maximum allowed age (20 = No restriction)
0x0A 0x01 Secret Question Type (0-5: Pre-defined, 6: Custom)
0x0B 0x01 Unknown
0x0C 0x08 Parental Controls PIN code (with NULL-termination, although restricted to 4 digits)
0x14 0x44 Secret Answer (UTF-16)

Parental Control Restriction Bitmask

Bit Restriction name
0 Global Parental Controls Enable
1 Internet Browser
2 Display of 3D Images (disabled on 2DS)
3 Sharing Images/Audio/Video/Long Text Data
4 Online Interaction
5 StreetPass
6 Friend Registration
7 DS Download Play
8 Nintendo 3DS Shopping Services (eShop / EC Applet)
9 View Distributed Videos
10 Miiverse (View)
11 Miiverse (Post)
31 "Child Online Privacy Protection" (see CFG:IsCoppacsSupported)

Parental Control Settings Block 0x000C0002

Offset Size Description
0x0000 0x0001 Boolean, whether an e-Mail has been registered
0x0001 0x0101 Registered e-Mail address (Plaintext)
0x0102 0x0068 Custom Secret Question (UTF-16)
Retrieved from "https://www.3dbrew.org/w/index.php?title=Config_Savegame&oldid=23129"