CONFIG9 Registers
Registers
| Old3DS | Name | Address | Width | Used by |
|---|---|---|---|---|
| Yes | CFG_SYSPROT9 | 0x10000000 | 1 | Boot9 |
| Yes | CFG_SYSPROT11 | 0x10000001 | 1 | Boot9 |
| Yes | CFG_DEBUGUNIT | 0x10000004 | 4 | |
| Yes | CFG_CARDCONF | 0x1000000C | 2 | |
| Yes | CFG_DEBUGGER | 0x10000010 | 1 | |
| Yes | ? | 0x10000011 | 1 | |
| Yes | ? | 0x10000012 | 2 | |
| Yes | ? | 0x10000014 | 2 | |
| Yes | ? | 0x10000020 | 2 | |
| Yes | ? | 0x10000100 | 2 | |
| No | CFG_EXTMEMCNT9 | 0x10000200 | 1 | Kernel9 |
| Yes | CFG_MPCORECFG? | 0x10000FFC | 4 | |
| Yes | CFG_BOOTENV | 0x10010000 | 4 | |
| Yes | CFG_UNITINFO | 0x10010010 | 1 | |
| Yes | ? | 0x10010014 | 1 |
CFG_SYSPROT9
Writing values to SYSPROT sets the specified bitmask. The ARM9 bootrom(+0x8000) is disabled by writing bit0. bit1 is used by NATIVE_FIRM to make sure console-unique TWL AES-keys are only set at hard-boot. It is not possible to set any other bits.
From disassembly of the New3DS process9, it appears that setting bit1 disables the 0x10012000+ region.
CFG_SYSPROT11
ARM11 bootrom (+0x8000) is disabled by writing bit0. It is not possible to set any other bits.
CFG_CARDCONF
| Bit | Description |
|---|---|
| 1-0 | Gamecard active controller select (0=NTRCARD, 1=?, 2=CTRCARD1, 3=CTRCARD2) |
| 8 | ? |
Depending on the gamecard controller that has been selected, one of the following gamecard registers will become active:
- Selecting NTRCARD will activate the register space at 0x10164000.
- Selecting CTRCARD1 will activate the register space at 0x10004000.
- Selecting CTRCARD2 will activate the register space at 0x10005000.
CFG_EXTMEMCNT9
This register is presumably New3DS-only. Only bit0 is writable: 0 = disable New3DS ARM9 memory at 0x08100000 size 0x80000, 1 = enable.
This bit is set by New3DS ARM9-kernel crt0.
The data in this extended memory doesn't change when disabling the memory, then re-enabling the memory. Reading this extended memory while disabled results in zeros.
CFG_BOOTENV
Initially this is value zero. NATIVE_FIRM writes value 1 here when a FIRM launch begins. The LGY FIRM writes value 3 here when handling PXI command 0x00020080(first TWL PXI command), it also writes value 7 here when handling PXI command 0x00030080(first AGB PXI command). This register can be read to determine what "mode" the system is running under: hard-boot, FIRM launch, or TWL/AGB FIRM.
0=Cold boot, 1=CTR, 3=TWL, 5=NTR, 7=AGB
It is unknown if this register controls anything.
CFG_UNITINFO
This 8-bit register is value zero for retail, non-zero for dev/debug units.
0x10010014
In the console-unique TWL key-init/etc function the ARM9 copies the u8 value from REG_UNITINFO to this register.
This is also used by TWL_FIRM Process9.