The Home Menu is the heart of the Nintendo 3DS. From there one can start games, applications, and access various processes including the friends list. It is launched by NS, and is always running in the background in 3DS-mode except when other programID-high 00040030 applications like Internet Browser, Friend-List, etc are running. Home Menu is still running while System Settings is running, however the System Settings application does not allow directly returning to home-menu. The system will normally re-launch Home Menu when the Home Menu process crashes/terminates. When this re-launch occurs while Home Menu is active, Home Menu displays an error message which says to manually reboot the system.

System Versions

Nintendo devised a system, whereby updates would be delivered via two channels:

  • Card Updates (CUP) - The Nintendo 3DS is updated with data from an update partition on retail gamecard title.
  • Network Updates (NUP) - The Nintendo 3DS is updated by downloading data from Nintendo's CDN.

CUPs will only deliver updates to core features, such as the Home Menu, Nintendo 3DS Camera etc. CUPs will not deliver updates to Network features, such as System Transfer, Internet Browser, StreetPass Mii Plaza or eShop.

NUPs can deliver updates to core features as well as (updated) Network Features.

As a result of deciding to make a distinction between what content could be updated and how, Nintendo split the system version displayed by System Settings into two parts: CVer (Console Version) and NVer (Network Update Version). Represented as:

<CVer Major>.<CVer Minor>.<CVer Micro>-<NUP Version><NUP Region>

The Console Version represents the version of the collectively installed core features. And the NUP Version represents the version of the collectively installed network features.

So if a 3DS' System Firmware read 2.1.0-2U, it would indicate a console version of 2.1.0 and a NUP version of 2U.

NOTES:

  • CUPs can only update core content, so NVer is never updated with CUPs.
  • NUPs will not update NVer if network features are not updated. (Best seen with the USA vs JPN/EUR 6.0.0 NUP)


CUPs are implemented by adding a System Update CFA to retail NCSD gamecard images. Nintendo generally creates CUPs after NUPs are released.


When updating the system from 4.5.0-6 to 4.5.0-10, the following titles are updated(in the order of title download+install): Health and Safety Information, Nintendo 3DS Camera, eShop, System Transfer, Internet Browser, 0004009B00014102, 0004009B00014202, 0004009B00014302, NVer, and AGB_FIRM.

System Versions List

System version Home Menu title version Release date Changelog System security flaws fixed* 3DS-mode homebrew affected* CUP Released CDN Availability CDN Post Date
1.0.0-0 0 February 26, 2011 Shipped with 3DS on launch Yes Available February 18, 2011
1.1.0-1 0 FebruaryΒ ?, 2011 General bug fixes

Added 3D Video title to menu. ("For a Limited Time Only")

Yes Available March 1, 2011
2.0.0-2 1029 June 6/7, 2011 eShop added, web browser available, System Transfer added. Full DSiWare data management available. Automatic downloading for system updates added. No Available June 6, 2011
2.1.0-3 2049 June 15, 2011 Fixes the Ridge Racer freeze. Yes Available June 15, 2011
2.1.0-4 Not updated July 25, 2011 System stability improvements and other adjustments. No Available July 25, 2011
2.2.0 ? November 6, 2011 CUP Only Release. Improved the arrangement of Friend List. Update from some game cards such as Super Mario 3D Land. Yes Unavailable ?
3.0.0-5 4111 December 7, 2011 Added 3D video recording to the camera title, updated Mii Streetpass Plaza, System Transfer between 3DS systems available, improved eShop, home menu QR code scanning with QR codes containing URLs. Nintendo Zone is now always accessible, 3D video streaming support was added to NZone. This added support for running GBA VC titles via AGB_FIRM as well, support for GBA VC titles was also added to NATIVE_FIRM. Yes Available December 7, 2011
3.0.0-6 Not updated December 21, 2011 Only StreetPass Mii Plaza and the NVer title were updated. From Nintendo's release notes: "System stability improvements and other adjustments". No Available December 21, 2011
4.0.0-7 5131 April 24, 2012 Add folders to Home Menu, game patching added, buy more expensive games than 1000 yen in JPN. System titles for CHN, TWN, and KOR became available. Yes Yes Available April 24, 2012
4.1.0-8 Not updated May 14, 2012 From changelog: "improvements to overall system stability and other minor adjustments". Once updated to 4.1.0-8, the parental-controls PIN is no longer required for future system updates. Yes Yes Available May 14, 2012
4.2.0-9 6146 June 26, 2012 Improved eShop safety for entering credit-card info, and behind the scenes improvements. Stored CC info will be deleted by this updated eShop, and can be re-entered again. Yes Available June 26, 2012
4.3.0-10 Not updated July 24, 2012 Updated eShop, bad word list and NZone hotspot list updated. Yes Available July 24, 2012
4.4.0-10 Not updated September 19, 2012 NZone hotspot list updated and TWL_FIRM updated for blocking flash cards. Yes Available September 19, 2012
4.4.0-10C Not updated October 17, 2012 China-only, the *only* updated title was System Settings. This title was updated to a version already available in TWN/KOR. ? Available October 17, 2012
4.5.0-10 Not updated December 4, 2012 Flash-card block via updated TWL_FIRM and whitelist. NZone hotspot list updated as well. Yes Available December 4, 2012
5.0.0-11 7172 March 25, 2013 Many system titles including NATIVE_FIRM were updated, multiple vulnerabilities were fixed as well. Yes Yes No Available March 25, 2013
5.1.0-11 Not updated April 4, 2013 NATIVE_FIRM and NS were updated. According to the official change-log: "Resolves an issue that may prevent access to the System Settings or other features." No No Yes Available April 4, 2013
6.0.0-12 (-11U) 8198 June 17, 2013 Official change-log: "Users can now back up save data for downloadable versions of Nintendo 3DS software and most Virtual Console games". For EUR/JPN, the StreetPass Mii Plaza application and the Nintendo 3DS Camera application were updated. Other titles for all regions were updated as well. Yes No Available June 17, 2013
6.1.0-12 (-11U) Not updated June 27, 2013 Official change-log: "Further improvements to overall system stability and other minor adjustments have been made to enhance the user experience." Yes Available June 27, 2013
6.1.0-12U Not updated July 11, 2013 This USA-only update added the updated network features applications which were first released in JPN/EUR with the 6.0.0-12 NUP update. No Available July 11, 2013
6.2.0-12 Not updated August 6, 2013 This update added support for the StreetPass relay feature, updated TWL_FIRM, and updated the Nintendo Zone hotspots list. Yes Available August 6, 2013
6.3.0-12 Not updated September 13, 2013 See this. No No No Available September 13, 2013
6.4.0-12 ? November 11, 2013 See this(Only for the KOR and TWN regions). No Available November 11, 2013
7.0.0-13 9230 December 9, 2013 See this. Yes No Available December 9, 2013
7.1.0-14 Not updated December 19, 2013 See this. No Yes Available December 19, 2013
7.1.0-15 Not updated January 22, 2014 See this. No No No Available January 22, 2014
7.1.0-16 Not updated February 26, 2014 See this. No No No Available February 26, 2014
7.2.0-17 Not updated May 12, 2014 See this. No Yes Available May 12, 2014
8.0.0-18 Not updated July 7, 2014 See this. No No Yes Available July 7, 2014
8.1.0-18 Not updated July 24, 2014 See this. No No Yes Available July 24, 2014
8.1.0-19 Not updated August 7, 2014 See this. No No No Available August 7, 2014
8.1.0-0 New3DS Not updated September 26, 2014 See this. No No Available September 26, 2014
8.1.0-19 Not updated October 2, 2014 Japan-only "update", see here. The only change was that a new title(New_3DS-only system application) was added, CVer/NVer titles were not even updated. The initial version of this title is a stub. No No No Available October 2, 2014
9.0.0-20 v11272 October 6, 2014 See this. No No Available October 6, 2014
9.1.0-20J v14336(JPN-region title) October 10, 2014 Japan-only, see this. No No No Available October 10, 2014
9.2.0-20 October 29, 2014 See this. No No No Available October 29, 2014
9.3.0-21 December 8, 2014 See this. Yes Yes No Available December 8, 2014
9.4.0-21 December 11, 2014 See this. No No No Available December 11, 2014

"System security flaws fixed*": This includes known flaws, and any fixed flaws discovered via code bin-diff. This does not include ARM11-userland ROP entrypoints unless specifically mentioned otherwise on the system-update page.

"System security flaws fixed*" and "3DS-mode homebrew affected" only apply to the changes done with that specific system-update.

Auto-Boot Function

When the Home Menu is initially loaded by NS, it checks the gamecard ExeFS:/icon for the auto-boot flag. If the auto-boot flag is set, it will load the application on the cartridge and the home menu will not remain running in the background, or at least not in an operational state. Using software cues to return to the home menu, or sleep menu while in this state, causes a shutdown.

Notable features of demo titles:

  • Auto-boot demos generally disable the functionality of the home button.
  • The New Super Mario Bros 2 demo, retained the functionality of the home button, and had an timer which triggered the demo to quit after a period of inactivity.

Auto-boot cartridges, can bypass some of the functions of the Home Menu. Auto Booted software:

  • Doesn't show usage history in the Activity Log
  • Bypasses Parental controls
  • Bypasses Forced Game Card Updates
  • Bypasses Initial 3DS Setup
  • The console does not have a friends list presence.
  • Is still subject to region lock(see below).

Region lock is still active, so the home menu will refuse to launch demos with incorrect region lock will not load, displaying "An Error has Occurred". However, game card update partition checks are not done, which allows launching demos that have region free encoding, but have an alternate(or even invalid) region update partition.


The following auto-boot paths can be used by Home Menu, checked in the same order listed below(the above gamecard auto-boot is checked before this):

Key-combo / requirements for this path Description
R, L, and X This launches System Settings for touchscreen calibration.
R, L, and Y This launches System Settings for circlepad calibration.

The following is only checked when the low u16 from config block 0x00110000 is value zero(normally this is non-zero). Thus, the below is only handled when a system setup is required.

Key-combo / requirements for this path Description
R, X, Y, A, and B, a 3DS gamecard must be inserted as well. This launches the gamecard application. Note that pressing the HOME button in the gamecard application launched this way will only result in the system shutting down.
This is used when the above path isn't used. This launches System Settings for the system setup.

Region Lockout

One of the Home Menu's functions, is to regulate region lockout. The region lockout data for any given title is held in the ICN data. There are 6 regions of which have their own region lockout, Japan, USA, Europe(including Nintendo Australia), China, Taiwan and Korea. There is also a value which makes a title exempt from region lockout, and consequently accessible from any region of 3DS.

The region-field stored in the ICN-data is only checked when Home Menu itself launches a title, not when other titles use NS to have Home Menu launch titles. This isn't actually useful for gamecard region-free however, due to the gamecard system-updates, see below.

Also note that while some gamecard games are mostly region-free(main CXI is identical for all regions of the gamecard), those gamecards can't actually be launched with all 3DS regions due to the gamecard system-update, see below. Note that the main CXI being identical for all regions of a gamecard also means the savedata keyY is identical for all regions of that gamecard too(except for old system-version <v2.2 games, in some cases, due to different cardIDs).

Effects of Region Lockout

Every 3DS title regardless of location (NAND/SD Card/Game Card) is subject to region lockout scrutiny by the Home Menu. And the home menu treats 'out-of-region' titles by simply refusing to show them on the home menu. No messages are shown on the home menu to notify the user, the title is simply ignored. However out-of-region SD Card titles, will appear and quickly disappear, while all the SD Titles are being processed. In cases where access to the home menu GUI is not needed to launch the title (like in the case of kiosk demos), the home menu states an error has occurred, and launching of the title is stopped.

Game Card Updates

Either intentionally a region lock mechanism or not, the function which checks the game card update partition returns an error when it is detected the update is for a region other than the 3DS's region (Most likely triggered by the absence of the correct CVer title). And errors returned from checking the update partition, will result in the home menu displaying "This Game Card cannnot be used", when the user attempts to launch the title.

Home-menu SpotPass usage

Home-menu uses two domains with HTTPS for SpotPass. SpotPass stores this content in Home-menu's NAND shared extdata.

Region ID
JPN gWr4JXxb2mKTG3lq
NA uuI82221UKkqmtbp
EUR / Others UrXSeurnxhPrq7AS

The SpotPass content payload for notifications begin with a header, followed by an icon and the UTF-16 text, and various metadata.

Automatic System Update Download

See Automatic System Update Download.

Home Menu Error Messages

Dialog Text Description
"An error has occured. Please save your data ... then restart the system" This dialog is displayed when a system applet(including Home Menu) crashes/terminates. This dialog is also displayed for system errors as well.

Home Menu Themes

See here.

SD ExtData

The SD ExtData File System for Home Menu is as follows:

root
β”œβ”€β”€ icon
β”œβ”€β”€ boss
└── user
    β”œβ”€β”€ SaveData.dat
    β”œβ”€β”€ Cache.dat
    └── CacheD.dat
File Details Size FW Introduced Plaintext
icon Stubbed. Always image 00000002. 0x4 Bytes n/a
SaveData.dat Always image 00000003. 0x2cb0 Bytes 1.0.0-0 Download
Cache.dat Indexes and records details for the cached icon data. Always image 00000004. 0x1688 Bytes 1.0.0-0 Download
CacheD.dat Cached icon data for Home Menu. Always image 00000005. 0x4cfe00 Bytes 1.0.0-0 Download

Cache.dat & CacheD.dat

These two files work in tandem to allow the home menu to cache icon data for applications which are presented on the Home Menu. The size of both files suggests a maximum cache size of 360 icons. Cache.dat stores details about the cache icon data, and CacheD.dat stores the icon data. The icon cache stores icon data for *all* applications shown on the Home Menu, this includes DSi NAND Titles, and DS(i) cartridges. The format of cached DS(i) icon data is not understood, but they are the same size as 3DS icon data (0x36c0).

In Cache.dat the first 8 bytes are reserved, then follows each icon slots's entry in the format:

OFFSET SIZE DESCRIPTION
0x0 8 Title ID in Little Endian
0x8 4 Unknown
0xc 4 Unknown

All unused entries have the Title IDs filled with "0xff".

In CacheD.dat, the icon data is concatenated together, with the first icon at offset 0x0.

SaveData.dat

Offset Size Description
0x13b8 0x8 Theme entry structure for the regular theme.
0x13c0 0x8*10(0x50) Array of theme entry structures for theme shuffling.
0x141b 0x1 0 = one regular theme, 1 = multiple themes for theme shuffle.

When the theme cache is enabled via the above fields, Home Menu loads the cache at startup. At startup for cache loading, Home Menu does not check if any theme DLC is installed, or if even the content-index is for an installed theme.

Theme entry structure:

Offset Size Description
0x0 0x4 Theme index: for DLC this is the content-index, for built-in themes this is an index for an array selecting the built-in theme. At startup when loading theme-cache, this value has to be non-zero otherwise the cache won't be loaded, during startup with theme-cache this value isn't used for anything else.
0x4 0x1 Normally zero?
0x5 0x1 Theme type: 0 = none, 1 = built-in theme from Home Menu RomFS, 2 = theme data loaded from SD cache / content archive
0x6 0x1 Normally zero?
0x7 0x1 Normally zero?

Home Menu Theme SD ExtData

The filesystem for this extdata is as follows:

root
β”œβ”€β”€ icon
β”œβ”€β”€ boss
└── user
    β”œβ”€β”€ ThemeManage.bin
    β”œβ”€β”€ BodyCache.bin
    β”œβ”€β”€ BgmCache.bin
    └── nsalist
File Details Size Extdata image ID FW Introduced Plaintext
ThemeManage.bin Theme management info. The filesize must match 0x800, otherwise the Home Menu code returns an error. 0x800 00000003 9.0.0-20
BodyCache.bin Contains cached data from the last loaded theme RomFS body_LZ.bin file. The filesize must match 0x150000, otherwise the Home Menu code returns an error. 0x150000 00000004 9.0.0-20
BgmCache.bin Contains cached data from the last loaded theme RomFS bgm.bcstm file. The filesize must match 0x337000, otherwise the Home Menu code returns an error. 0x337000 00000005 9.0.0-20
nsalist Contains the list of DLC themes(IDs+prices), downloaded via SpotPass. 00000007 9.0.0-20

BodyCache.bin and BgmCache.bin contain cached theme data for the currently used DLC theme. ThemeManage.bin is loaded by Home Menu during startup. The cached theme data is loaded at startup when a DLC theme is selected. This also contains theme-shop SpotPass data.

BodyCache.bin and BgmCache.bin are all-zero when no theme is selected.

Starting with 9.3.0-X Home Menu can use more files in this extdata, for theme shuffling. "theme:/ThemeManage_%02d.bin" "theme:/BgmCache_%02d.bin" "theme:/BodyCache_%02d.bin" "theme:/BodyCache_rd.bin"

ThemeManage.bin

Offset Size Description
0x0 0x4 Unknown, normally value 0x1?
0x4 0x4 Unknown, normally zero?
0x8 0x4 Actual size of the cached body_LZ.bin data.
0xC 0x4 Actual size of the cached bgm.bcstm data.
0x10 0x4 Unknown
0x14 0x4 Unknown
0x18 0x4 When a DLC theme is selected, this is the content-index of the DLC theme.
0x1C 0x4 Unknown, usually value 0x200 when the data in theme-cache is actually used?

The total filesize is 0x800-bytes, normally the data starting at offset 0x1C is all-zero.

When no theme is actually used, the only non-zero fields are the following: the u32 stored at offset 0x0 in ThemeManage.bin is value 0x1, with offset 0x10 u32 set to value 0x1.

Home Menu badge SD ExtData

The filesystem for this extdata(when it actually exists) is as follows:

root
β”œβ”€β”€ icon
β”œβ”€β”€ boss
└── user
    β”œβ”€β”€ BadgeData.dat
    └── BadgeMngFile.dat

Home Menu startup

The following is what Home Menu does at startup(converted from cmd-logs), from 9.4.0-21, in the same order Home Menu does it.

Originally Home Menu mounted sdmc in main(), starting(?) with 6.0.0-11 Home Menu only has sdmc mounted while handling SD_Savedata_Backups.

Archive Filename Read size Notes
srv_init(), then srv_GetServiceHandle is used to initialize the service handles for the following services: ns:s, ptm:sysm, and cfg:s.
CfgS:SecureInfoGetByte101 and CfgS:GetLocalFriendCodeSeed are used, the output data from these are not used. If either of these return an error, Home Menu uses ThrowFatalError.
Cfg:GetSystemModel is then used to initialize a Home Menu state field.
Home Menu then loads the system language via CfgS:GetConfigInfoBlk2, and uses Cfg:SecureInfoGetRegion, to initialize Home Menu region/language state. Home Menu then uses Cfg:SecureInfoGetRegion again, then loads the CountryInfo via CfgS:GetConfigInfoBlk2.
Home Menu initializes fs:USER here. Home Menu then mounts the Home Menu CXI RomFS. Then Home Menu uses FSUSER:GetPriority.
Home Menu starts APT initialization / using APT service commands here. Eventually Home Menu then launches various system-modules.
Here Home Menu attempts to open NAND shared-extdata 0xe0000000, which will normally fail since it doesn't exist.
Here Home Menu uses AM command 0x00130040, with input u8 = value 0x0. Home Menu continues using APT commands after this.
hid:SPVR service initialization is done here.
PTMSYSM:GetShellStatus is used here.
FSUSER:GetCardType is used here. AM commands are then used to check whether a gamecard is inserted, when a gamecard is inserted the gamecard ExeFS:/icon is then read to check the auto-boot flag(see the auto-boot section on this page).
Home Menu System_SaveData "/Launcher.dat" 0x2490
NAND extdata 0xf000000b "/ubll.lst" 0x2ee0
NAND extdata 0xf000000b "/CFL_OldDB.dat" Home Menu just closes this file immediately after opening it, when opening it was successful at least.
NAND extdata 0xf000000b "/CFL_DB.dat" 0xe4c0 Home Menu only does one read with size 0xe4c0 for this, even though the value it loads from FSFile:GetSize is larger than that.
NAND extdata 0xf000000b "/gamecoin.dat" 0x14 This is for loading the file containing play-coins info. Immediately after reading this file, Home Menu then uses FSFile:GetSize, then Home Menu writes to gamecoin.dat for updating the date data.
NAND extdata 0xf000000c Home Menu first attempts to use FS:CreateFile with "/bashotorya.dat", which normally fails since that file already exists. Then Home Menu attempts to open "/bashotorya2.dat" with openflags=4, which normally fails since "/bashotorya2.dat" doesn't exist.
Here, Home Menu opens the following SD extdata archives: Home Menu badge SD extdata, Home Menu SD extdata, and the theme-cache SD extdata.
Home Menu SD extdata "/SaveData.dat" 0x2da0 Prior to doing the read, Home Menu uses FSFile:GetSize.
Home Menu SD extdata "/Cache.dat" 0x1688 Prior to doing the read, Home Menu uses FSFile:GetSize.
Home Menu SD extdata "/CacheD.dat" 0x36c0 This is used to read the cached icon data for the currently inserted gamecard, if any.
Home Menu Theme SD extdata "/BodyCache.bin" 0x150000 Before opening the file, Home Menu firsts opens this archive under a new archive-handle again, then closes it. Prior to doing the read, Home Menu uses FSFile:GetSize.
Home Menu Theme SD extdata "/ThemeManage.bin" 0x8 Prior to doing the read, Home Menu uses FSFile:GetSize(the result is filesize 0x800).
Home Menu Theme SD extdata "/BgmCache.bin" The data is read from here as needed.
NAND extdata 0xf000000b "/gamecoin.dat" 0x14 Home Menu loads the file data here, then writes it to the file again without changing it.
Home Menu System_SaveData "/Launcher.dat" Home Menu writes 0x2490-bytes to the file here.
NAND extdata 0xf000000b "/idb.dat" 0x2008 This firsts opens the file for writing, then uses FSFile:GetSize(output filesize is 0x6d4000). Then it writes to the file using size 0, then closes the file. Then Home Menu re-opens the file, then does the actual read.
NAND extdata 0xf000000b "/idbt.dat" Home Menu writes 0x2008-bytes to this file.
NAND extdata 0xf000000e "/versionList.dat" 0x18a0 Prior to doing the read, Home Menu uses FSFile:GetSize.
Home Menu System_SaveData "/Launcher.dat" When Home Menu is terminating(?), Home Menu writes 0x2490-bytes to the file here. After doing this, Home Menu opens, writes, and closes the file again.

See Also