This page describes the format of the Cfg NAND savegame. These blocks can be accessed with the Cfg service commands.
Structure of save-file "/config"
| Offset
|
Size
|
Description
|
| 0x0
|
0x2
|
Total entries
|
| 0x2
|
0x2
|
Data entries offset
|
| 0x4
|
0x4558
|
Block entries
|
| 0x455C
|
|
Data for the entries
|
The filesize for this /config file is 0x8000-bytes.
Configuration block entry
| Offset
|
Size
|
Description
|
| 0x0
|
0x4
|
BlkID
|
| 0x4
|
0x4
|
Offset to the data for this block when size is >4, otherwise this word is the data for this block
|
| 0x8
|
0x2
|
Size
|
| 0xA
|
0x2
|
Flags
|
Configuration blocks
| BlkID
|
Size
|
Flags
|
Description
|
| 0x00000000
|
0x2
|
0xC
|
Config savegame version?
|
| 0x00010000
|
0x1
|
0xC
|
?
|
| 0x00020000
|
0x134
|
0xC
|
?
|
| 0x00030000
|
0x1
|
0xC
|
?
|
| 0x00030001
|
0x8
|
0xE
|
User time offset (read by CECD)
|
| 0x00030002
|
0x8
|
0xC
|
?
|
| 0x00040000
|
0x10
|
0xC
|
? (read by HID)
|
| 0x00040001
|
0x1C
|
0xC
|
? (read by HID)
|
| 0x00040002
|
0x12
|
0xC
|
? (read by HID)
|
| 0x00040003
|
0xC
|
0xC
|
? (read by HID)
|
| 0x00040004
|
0x1C
|
0xC
|
?
|
| 0x00050000
|
0x2
|
0xC
|
?
|
| 0x00050001
|
0x2
|
0xC
|
? (read by GSP)
|
| 0x00050002
|
0x38
|
0xC
|
? (read by GSP)
|
| 0x00050003
|
0x20
|
0xC
|
? (read by GSP)
|
| 0x00050004
|
0x20
|
0xC
|
?
|
| 0x00050005
|
0x20
|
0xE
|
Stereo display settings
|
| 0x00050006
|
0x2
|
0xC
|
?
|
| 0x00050007
|
0x4
|
0xC
|
?
|
| 0x00050008
|
0x10C
|
0xC
|
?
|
| 0x00050009
|
0x8
|
0xC
|
?
|
| 0x00060000
|
0x96
|
0xC
|
?
|
| 0x00070000
|
0x214
|
0xE
|
?
|
| 0x00070001
|
0x1
|
0xE
|
Sound output mode (mono/stereo/surround)?
|
| 0x00070002
|
0x8
|
0xE
|
?
|
| 0x00080000
|
0xC00
|
0xC
|
WiFi configuration slot 0
|
| 0x00080001
|
0xC00
|
0xC
|
WiFi configuration slot 1
|
| 0x00080002
|
0xC00
|
0xC
|
WiFi configuration slot 2
|
| 0x00090000
|
0x8
|
0xE
|
This contains a u64 ID, used by processes using NWMUDS:InitializeWithVersion. The first word is the same as LocalFriendCodeSeed, while the latter is a separate word.
|
| 0x00090001
|
0x8
|
0xE
|
Same content as 0x0009000? This console-unique u64 used by GenHashConsoleUnique is generated with the LocalFriendCodeSeed and with random data
|
| 0x00090002
|
0x4
|
0xE
|
?
|
| 0x000A0000
|
0x1C
|
0xE
|
Username
|
| 0x000A0001
|
0x2
|
0xE
|
Birthday (u8 month, u8 day)
|
| 0x000A0002
|
0x1
|
0xE
|
Language
|
| 0x000B0000
|
0x4
|
0xE
|
CountryInfo
|
| 0x000B0001
|
0x800
|
0xE
|
Country name in UTF-16, every 0x80-bytes is an entry for each language, in the order of the Language table below (not all entries are set)
|
| 0x000B0002
|
0x800
|
0xE
|
State name in UTF-16, every 0x80-bytes is an entry for each language
|
| 0x000B0003
|
0x4
|
0xE
|
Pair of 16-bit values, meaning unknown but related to address (ZIP code?)
|
| 0x000C0000
|
0xC0
|
0xE
|
Restricted photo exchange data, and other info (includes a mirror of Parental Restrictions PIN/Secret Answer)
|
| 0x000C0001
|
0x14
|
0xE
|
Same as above?
|
| 0x000C0002
|
0x200
|
0xE
|
? Contains the email address set during Parental Restriction setup.
|
| 0x000D0000
|
0x4
|
0xE
|
u16 at offset 0x0: EULA Version which was agreed to.
|
| 0x000E0000
|
0x1
|
0xE
|
?
|
| 0x000F0000
|
0x10
|
0xC
|
Unknown, used by NS on dev-units for svcKernelSetState, where Type is 6. During NS startup on debug-units, NS compares the u32 from +8 in this config-block with the APPMEMTYPE. When those don't match NS starts a FIRM-launch (with the same FIRM titleID as the currently running one) to boot into a FIRM with the APPMEMTYPE value from this config-block
|
| 0x000F0001
|
0x8
|
0xC
|
?
|
| 0x000F0003
|
0x1
|
0xC
|
?
|
| 0x000F0004
|
0x4
|
0xC
|
The first u8 is the System-Model value, the last 3-bytes are unknown
|
| 0x000F0005
|
0x4
|
0xC
|
The first u8 indicates whether network updates are enabled (however, NIM only checks this flag with developer ENVINFO).
|
| 0x000F0006
|
0x28
|
0xC
|
?
|
| 0x00100000
|
0x2
|
0xC
|
?
|
| 0x00100001
|
0x94
|
0xC
|
Stores Parental Restrictions PIN/Secret Answer and other info
|
| 0x00100002
|
0x1
|
0xC
|
?
|
| 0x00100003
|
0x10
|
0xC
|
?
|
| 0x00110000
|
0x4
|
0xC
|
The low u16 indicates whether the system setup is required, such as when the system is booted for the first time or after doing a System Format: 0 = setup required, non-zero = no setup required
|
| 0x00110001
|
0x8
|
0xC
|
TitleID of the menu to launch, used by NS on dev units (this block can be edited on dev units with Config)
|
| 0x00120000
|
0x8
|
0xC
|
? (read by HID)
|
| 0x00130000
|
0x4
|
0xE
|
If response is 0x100 then debug mode is enabled.
|
| 0x00150000
|
0x4
|
0xC
|
?
|
| 0x00150001
|
0x8
|
0xC
|
?
|
| 0x00150002
|
0x4
|
0xE
|
?
|
| 0x00160000
|
0x4
|
0xE
|
Unknown, first byte is used by config service-cmd 0x00070040. (Unknown whether the last 3-bytes are used)
|
| 0x00170000
|
0x4
|
0xE
|
?
|
| 0x00180000
|
0x4
|
0xC
|
?
|
| 0x00180001
|
0x18
|
0xC
|
?
|
| 0x00190000
|
0x1
|
0xC
|
Unknown. NFC-module checks for value1/non-value1.
|
The developer unit TID block only exists on developer units.
Stereo Display Settings
All values are hard-coded in cfg module.
| Offset
|
Size
|
Value
|
Description
|
| 0x0
|
4
|
62.0f
|
assumed pupillary distance in mm?
|
| 0x4
|
4
|
289.0f
|
assumed distance in mm between player's eyes and upper screen?
|
| 0x8
|
4
|
76.80f
|
width in mm of (old) 3DS upper screen (doesn't vary for different models?)
|
| 0xC
|
4
|
46.08f
|
height in mm of (old) 3DS upper screen (doesn't vary for different models?)
|
| 0x10
|
4
|
10.0f
|
|
| 0x14
|
4
|
5.0f
|
|
| 0x18
|
4
|
55.58f
|
|
| 0x1C
|
4
|
21.57f
|
|
Languages
| ID
|
Description
|
| 0
|
JP
|
| 1
|
EN
|
| 2
|
FR
|
| 3
|
DE
|
| 4
|
IT
|
| 5
|
ES
|
| 6
|
ZH
|
| 7
|
KO
|
| 8
|
NL
|
| 9
|
PT
|
| 10
|
RU
|
| 11
|
TW
|
CountryInfo
| Byte
|
Description
|
| 0
|
?
|
| 1
|
?
|
| 2
|
?
|
| 3
|
Country code, same as DSi/Wii country codes. Value 0xFF is invalid.
|
0x000A0000 Block
| Byte
|
Description
|
| 0x0-0x13
|
UTF-16 username, with no NULL-terminator.
|
| 0x14-17
|
Usually zero?
|
| 0x18-0x1B
|
u32 NGWord version the username was last checked with. If this value is less than the u32 stored in the NGWord CFA "romfs:/version.dat", the system then checks the username string with the bad-word list CFA again, then updates this field with the value from the CFA
|
LCD display config
There seems to be some sort of LCD display configuration stored in this cfg. When using the cfg-save from an Old3DS on a New3DS without formatting the cfg first, the bottom-screen display is somewhat off(which is fixed by formatting the cfg-save).
Parental control Block 0x00100001
| Byte
|
Size in bytes
|
Description
|
| 0x0
|
0xD
|
Unknown.
|
| 0xD
|
0x4
|
PIN
|
| 0x11
|
?
|
Secret answer in UTF-16
|