Mii

Originally created for the Nintendo Wii (and backported to a selection of DS/i games), the Mii format was expanded with a larger selection of facial features and a new "copying" permission for the 3DS family, and later implemented as-is on Wii U.

See Mii Maker for the application chiefly designed to create, edit, delete, and trade Miis or convert them from and to a QR code.

Mii Database

Format of the Mii main database CFL_DB.dat, found in shared extdata archive f0000000b.

Offset	Length
0x0	0x4	Header "CFOG" (Mii Maker section)
0x4	0x4	Header 0x00010000
0x8	0x23F7	Array of owned (saved in Mii Maker) Miis. Order in file is unrelated to canonical order in-app.
0x23FC	0x4	Header "CFHE"
0x23F8	0x4	Header 0xFFFFFFFF
0x2400	0xA410	Array of objects? See chapter
0xC810	0x10	Terminator? 00 [..] 00 08 83
0xC820	0x4	Header "CFRA" (Invitations section)
0xC824	0x4	Header? 0x39000000
0xC861	0x2B	Weird padding? 0x00
0xC88C	0x1C20 (?)	Array of Miis contributed from games, used for Mii Plaza "invitations" feature. The format isn't that of a full Mii.
0xE4AC	0x14	01 00 [..] 00 D2 74
0xE4C0	0x3D860	Empty (00)

When encrypted in QR codes, 4 additionnal bytes are added. Two null bytes and a CRC-16. It's the exact same CRC-16 as for the Wii blocks on the 0x5e first bytes. It seems that the CRC is ignored, the Mii Maker expecting the result of APT:Unwrap to detect integrity loss.

Mii format

Note: 0x18-3B have been copied as-is from the QR code specification, so they're unverified.

Offset	Length
0x0	0x4	Mii ID
0x4	0x4	System ID (identifies owner, for purpose of enforcing editing restrictions and blue pants). Is not tied to the MAC address anymore.
0x8	0x1	Unknown (always 71?)
0x9	0x1	Allow Copying (?) (A2=on?)
0xA	0x3	unknown; apparently constant for the same source console
0xD	0x1	unknown; apparently constant for the same source console - subtract 2 for personal Mii?
0xE	0x2	unknown; variable (range A-F may alternatively be a timestamp?)
0x10	0x6	Creator's full MAC
0x16	0x2	Padding (0000)
0x18	0x2	Bit-mapped: Birthday (4bit-day,5bit-month), Sex, Shirt, ??
0x1A	0x14	UTF-16 Mii Name (10 chars max, 0000 terminated)
0x2E	0x2	width & height
0x30	0x1	bit 0: disable sharing bit 1-4: face shape bit 5-7: skin color
0x31	0x1	bit 0-3: wrinkles bit 4-7: makeup
0x32	0x1	hair style
0x33	0x1	bit 0-2: hair color bit 3: flip hair
0x34	0x4	unknown
0x38	0x1	bit 0-4: eyebrow style bit 5-7: eyebrow color
0x39	0x1	bit 0-3: eyebrow scale bit 4-6: eyebrow yscale
0x3A	0x2	note that the bytes are swapped over (little-endian layout) bit 0-3: eyebrow rotation bit 5-8: eyebrow x spacing bit 9-13: eyebrow y position
0x3C	0x4	unknown
0x40	0x1	Allow Copying (?) (0D on 0E off 8D on)
0x41	0x7	unknown
0x48	0x14	UTF-16 Author Name (10 chars max, 0000 terminated)

CFHE object

A 0xE-byte long item.

On my database, they're all 0000 0000 0000 0000 0000 FF7F FF7F.

Wild speculation: blacklist of already scanned celebrity (gold) Mii QRs?

Alternative interpretation: FFFF FFFF 0000 0000 0000 0000 0000 is the 1st item; FF7F FF7F 0000 [...] the 2nd, etc;

Mii categories (pants colors)

Initial digits have been mirrored from David Hawley's defunct Wii research. Some information may be outdated.

Specialness will override any other color and make the

Special (gold) Miis

Specialness will override any other color and make the Mii non-editable.

Copying is rumored to have to be disabled.

First digit of Mii ID: 0, 1, 4, 5

Imported (blue) Miis

Any (non-gold) Mii with a different System ID will appear as a foreign one.

There is also a range of Mii IDs that are always foreign and uneditable, regardless of the System ID:

First digit of Mii ID: C, D

Regular (black/red) Miis

Always editable, since they can only appear as such on the console that created them.

First digit of Mii ID: 2, 3, 6, 7, 8, 9, A, B, E, F