This page describes the format of the Cfg NAND savegame. These blocks can be accessed with the Cfg service commands.
Structure of save-file "/config"
| Offset
|
Size
|
Description
|
| 0x0
|
0x2
|
Total entries
|
| 0x2
|
0x2
|
Data entries offset
|
| 0x4
|
0x4558
|
Block entries
|
| 0x455C
|
|
Data for the entries
|
The filesize for this /config file is 0x8000-bytes.
Configuration block entry
| Offset
|
Size
|
Description
|
| 0x0
|
0x4
|
BlkID
|
| 0x4
|
0x4
|
Offset to the data for this block when size is >4, otherwise this word is the data for this block
|
| 0x8
|
0x2
|
Size
|
| 0xA
|
0x2
|
Flags
|
Configuration blocks
| BlkID
|
Size
|
Flags
|
Description
|
| 0x00000000
|
0x2
|
0xC
|
Config savegame version?
|
| 0x00010000
|
0x1
|
0xC
|
?
|
| 0x00020000
|
0x134
|
0xC
|
?
|
| 0x00030000
|
0x1
|
0xC
|
?
|
| 0x00030001
|
0x8
|
0xE
|
User time offset (read by CECD)
|
| 0x00030002
|
0x8
|
0xC
|
?
|
| 0x00040000
|
0x10
|
0xC
|
? (read by HID)
|
| 0x00040001
|
0x1C
|
0xC
|
Analog Stick Calibration Param?(read by HID)
|
| 0x00040002
|
0x12
|
0xC
|
? (read by HID)
|
| 0x00040003
|
0xC
|
0xC
|
? (read by HID)
|
| 0x00040004
|
0x1C
|
0xC
|
?
|
| 0x00050000
|
0x2
|
0xC
|
Upper/Lower screen flicker byte
|
| 0x00050001
|
0x2
|
0xC
|
Backlight controls (u8 ABL_powersave_enable, u8 brightness_level) (read by GSP)
|
| 0x00050002
|
0x38
|
0xC
|
? (read by GSP)
|
| 0x00050003
|
0x20
|
0xC
|
? (read by GSP)
|
| 0x00050004
|
0x20
|
0xC
|
?
|
| 0x00050005
|
0x20
|
0xE
|
Stereo display settings
|
| 0x00050006
|
0x2
|
0xC
|
?
|
| 0x00050007
|
0x4
|
0xC
|
?
|
| 0x00050008
|
0x10C
|
0xC
|
?
|
| 0x00050009
|
0x8
|
0xC
|
new3DS only(?) backlight control (5th byte: backlight dimming enable)
|
| 0x00060000
|
0x96
|
0xC
|
?
|
| 0x00070000
|
0x214
|
0xE
|
?
|
| 0x00070001
|
0x1
|
0xE
|
Sound output mode (mono=0, stereo=1, surround=2)
|
| 0x00070002
|
0x8
|
0xE
|
?
|
| 0x00080000
|
0xC00
|
0xC
|
WiFi configuration slot 0
|
| 0x00080001
|
0xC00
|
0xC
|
WiFi configuration slot 1
|
| 0x00080002
|
0xC00
|
0xC
|
WiFi configuration slot 2
|
| 0x00090000
|
0x8
|
0xE
|
This contains a u64 ID, used by processes using NWMUDS:InitializeWithVersion. The first word is the same as LocalFriendCodeSeed, while the latter is a separate word.
|
| 0x00090001
|
0x8
|
0xE
|
Same content as 0x0009000? This console-unique u64 is used by GenHashConsoleUnique. It is generated by ((0x3FFFFFFFF) & LocalFriendCodeSeed) | (random16 << 48)), where random16 is generated by GenerateRandomBytes
|
| 0x00090002
|
0x4
|
0xE
|
The first two bytes are the same random16 used in 0x00090001. The second two bytes are zeros.
|
| 0x000A0000
|
0x1C
|
0xE
|
Username in UTF16
|
| 0x000A0001
|
0x2
|
0xE
|
Birthday (u8 month, u8 day)
|
| 0x000A0002
|
0x1
|
0xE
|
Language
|
| 0x000B0000
|
0x4
|
0xE
|
CountryInfo
|
| 0x000B0001
|
0x800
|
0xE
|
Country name in UTF-16, every 0x80-bytes is an entry for each language, in the order of the Language table below (not all entries are set)
|
| 0x000B0002
|
0x800
|
0xE
|
State name in UTF-16, every 0x80-bytes is an entry for each language
|
| 0x000B0003
|
0x4
|
0xE
|
Coordinates. A pair of s16 represents latitude and longitude, respectively. One need to multiply both value by 180/32768 to get coordinates in degrees
|
| 0x000C0000
|
0xC0
|
0xE
|
Restricted photo exchange data, and other info (includes a mirror of Parental Restrictions PIN/Secret Answer)
|
| 0x000C0001
|
0x14
|
0xE
|
Same as above?
|
| 0x000C0002
|
0x200
|
0xE
|
? Contains the email address set during Parental Restriction setup.
|
| 0x000D0000
|
0x4
|
0xE
|
u16 at offset 0x0: EULA Version which was agreed to.
|
| 0x000E0000
|
0x1
|
0xE
|
?
|
| 0x000F0000
|
0x10
|
0xC
|
Debug configuration, read by NS on dev-units: on startup, NS does svcKernelSetState(6, 1, (u64)debug_flags & 1);
svcKernelSetState(6, 2, (u64)debug_flags & 2); (see here) where debug_flags is the u32 located at offset 0xC in this struct. Then it compares the u32 from +8 in this config-block with the APPMEMTYPE. When those don't match NS starts a FIRM-launch (with the same FIRM titleID as the currently running one) to boot into a FIRM with the APPMEMTYPE value from this config-block. The byte at offset 0x0 is related to the memtype as well.
|
| 0x000F0001
|
0x8
|
0xC
|
?
|
| 0x000F0003
|
0x1
|
0xC
|
?
|
| 0x000F0004
|
0x4
|
0xC
|
The first u8 is the System-Model value, the last 3-bytes are unknown
|
| 0x000F0005
|
0x4
|
0xC
|
The first u8 indicates whether network updates are enabled (however, NIM only checks this flag with developer ENVINFO).
|
| 0x000F0006
|
0x28
|
0xC
|
?
|
| 0x00100000
|
0x2
|
0xC
|
?
|
| 0x00100001
|
0x94
|
0xC
|
Stores Parental Restrictions PIN/Secret Answer and other info
|
| 0x00100002
|
0x1
|
0xC
|
?
|
| 0x00100003
|
0x10
|
0xC
|
?
|
| 0x00110000
|
0x4
|
0xC
|
The low u16 indicates whether the system setup is required, such as when the system is booted for the first time or after doing a System Format: 0 = setup required, non-zero = no setup required
|
| 0x00110001
|
0x8
|
0xC
|
TitleID of the menu to launch, used by NS on dev units (this block can be edited on dev units with Config)
|
| 0x00120000
|
0x8
|
0xC
|
? (read by HID)
|
| 0x00130000
|
0x4
|
0xE
|
If response is 0x100 then debug mode is enabled.
|
| 0x00150000
|
0x4
|
0xC
|
?
|
| 0x00150001
|
0x8
|
0xC
|
?
|
| 0x00150002
|
0x4
|
0xE
|
?
|
| 0x00160000
|
0x4
|
0xE
|
Unknown, first byte is used by config service-cmd 0x00070040. (Unknown whether the last 3-bytes are used)
|
| 0x00170000
|
0x4
|
0xE
|
Miiverse (OLV) access key
|
| 0x00180000
|
0x4
|
0xC
|
?
|
| 0x00180001
|
0x18
|
0xC
|
?
|
| 0x00190000
|
0x1
|
0xC
|
Unknown. NFC-module checks for value1/non-value1.
|
The developer unit TID block only exists on developer units.
Stereo Display Settings
All values are hard-coded in cfg module.
| Offset
|
Size
|
Value
|
Description
|
| 0x0
|
4
|
62.0f
|
assumed pupillary distance in mm?
|
| 0x4
|
4
|
289.0f
|
assumed distance in mm between player's eyes and upper screen?
|
| 0x8
|
4
|
76.80f
|
width in mm of (old) 3DS upper screen (doesn't vary for different models?)
|
| 0xC
|
4
|
46.08f
|
height in mm of (old) 3DS upper screen (doesn't vary for different models?)
|
| 0x10
|
4
|
10.0f
|
|
| 0x14
|
4
|
5.0f
|
|
| 0x18
|
4
|
55.58f
|
|
| 0x1C
|
4
|
21.57f
|
|
Languages
| ID
|
Description
|
| 0
|
JP
|
| 1
|
EN
|
| 2
|
FR
|
| 3
|
DE
|
| 4
|
IT
|
| 5
|
ES
|
| 6
|
ZH
|
| 7
|
KO
|
| 8
|
NL
|
| 9
|
PT
|
| 10
|
RU
|
| 11
|
TW
|
CountryInfo
| Byte
|
Description
|
| 0
|
?
|
| 1
|
?
|
| 2
|
State/Province code.
|
| 3
|
Country code, same as DSi/Wii country codes. Value 0xFF is invalid.
|
0x000A0000 Block
| Byte
|
Description
|
| 0x0-0x13
|
UTF-16 username, with no NULL-terminator.
|
| 0x14-17
|
Usually zero?
|
| 0x18-0x1B
|
u32 NGWord version the username was last checked with. If this value is less than the u32 stored in the NGWord CFA "romfs:/version.dat", the system then checks the username string with the bad-word list CFA again, then updates this field with the value from the CFA
|
WiFi Slot Structure
Network structure
This is used twice in the actual WiFi slot structure.
| Offset
|
Size
|
Description
|
| 0x0
|
0x1
|
Whether the network was set or not?
|
| 0x1
|
0x1
|
Whether to use this network strucutre to connect?
|
| 0x2
|
0x1
|
Whether this structure is the first (0) or the second (1) in the larger WiFi slot structure?
|
| 0x3
|
0x1
|
Padding ?
|
| 0x4
|
0x20
|
SSID of the network, without a trailing nullbyte.
|
| 0x24
|
0x1
|
Length of the SSID.
|
| 0x25
|
0x1
|
AP crypto key type
|
| 0x26
|
0x2
|
Padding ?
|
| 0x28
|
0x40
|
Plaintext of the passphrase of the network, without a trailing nullbyte.
|
| 0x68
|
0x20
|
PBKDF2 of the passphrase and SSID (http://jorisvr.nl/wpapsk.html).
|
Actual structure
| Offset
|
Size
|
Description
|
| 0x0
|
0x2
|
?
|
| 0x2
|
0x2
|
CRC-16 checksum of the next 0x410 bytes.
|
| 0x4
|
0x88
|
First network structure. Only set if the network was set "normally", or was the last to be set using WPS during the session.
|
| 0x8C
|
0x20
|
Padding.
|
| 0xAC
|
0x88
|
Second network structure. Only set if the network was set using WPS, otherwise 0-filled.
|
| 0x134
|
0x20C
|
Padding.
|
| 0x340
|
0x1
|
Whether to automatically get the IP address (use DHCP) or not, defaults to 1.
|
| 0x341
|
0x1
|
Whether to automatically get the DNS or not, defaults to 1.
|
| 0x342
|
0x2
|
Padding ?
|
| 0x344
|
0x4
|
IP address, to use if 0x340 is false.
|
| 0x348
|
0x4
|
IP address of the gateway, to use if 0x340 is false.
|
| 0x34C
|
0x4
|
Subnetwork mask, to use if 0x340 is false.
|
| 0x350
|
0x4
|
IP address of the primary DNS , to use if 0x341 is false.
|
| 0x354
|
0x4
|
IP address of the secondary DNS, to use if 0x341 is false.
|
| 0x358
|
0x4
|
Always 0x01050000 ? Only set if the network was the last to be set during the session.
|
| 0x35C
|
0x4
|
IP address to use. Only set if the network was the last to be set during the session.
|
| 0x360
|
0x6
|
MAC address of the AP. Only set if the network was the last to be set during the session.
|
| 0x366
|
0x1
|
Channel. Only set if the network was the last to be set during the session.
|
| 0x367
|
0x1
|
Padding ? Only set if the network was the last to be set during the session.
|
| 0x368
|
0x1
|
Whether to use a proxy or not, defaults to 0.
|
| 0x369
|
0x1
|
Whether to use a basic authentication for the proxy, defaults to 0.
|
| 0x36A
|
0x2
|
Port to use for the proxy, defaults to 1.
|
| 0x36C
|
0x30
|
URL/address of the proxy, including a trailing nullbyte.
|
| 0x39C
|
0x34
|
Padding.
|
| 0x3D0
|
0x20
|
Username to use for basic authentication, including a trailing nullbyte.
|
| 0x3F0
|
0x20
|
Password to use for basic authentication, including a trailing nullbyte.
|
| 0x410
|
0x2
|
Padding ?
|
| 0x412
|
0x2
|
MTU value, defaults to 1400 and ranges between 576 and 1500, inclusive.
|
| 0x414
|
0x7EC
|
Padding.
|
LCD display config
There seems to be some sort of LCD display configuration stored in this cfg. When using the cfg-save from an Old3DS on a New3DS without formatting the cfg first, the bottom-screen display is somewhat off(which is fixed by formatting the cfg-save).
Parental control Block 0x00100001
| Byte
|
Size in bytes
|
Description
|
| 0x0
|
0xD
|
Unknown.
|
| 0xD
|
0x4
|
PIN
|
| 0x11
|
0x20
|
Secret answer in UTF-16
|