Config Savegame
This page describes the format of the Cfg NAND savegame. These blocks can be accessed with the Cfg service commands.
Structure of save-file "/config"
| Offset | Size | Description |
|---|---|---|
| 0x0 | 0x2 | Total entries |
| 0x2 | 0x2 | Data entries offset |
| 0x4 | 0x4558 | Block entries |
| 0x455C | Data for the entries |
The filesize for this /config file is 0x8000-bytes.
Configuration block entry
| Offset | Size | Description |
|---|---|---|
| 0x0 | 0x4 | BlkID |
| 0x4 | 0x4 | Offset to the data for this block when size is >4, otherwise this word is the data for this block |
| 0x8 | 0x2 | Size |
| 0xA | 0x2 | Flags |
Configuration blocks
| BlkID | Size | Flags | Description |
|---|---|---|---|
| 0x00000000 | 0x2 | 0xC | Config savegame version? |
| 0x00010000 | 0x1 | 0xC | ? |
| 0x00020000 | 0x134 | 0xC | ? |
| 0x00030000 | 0x1 | 0xC | ? |
| 0x00030001 | 0x8 | 0xE | User time offset (read by CECD) |
| 0x00030002 | 0x8 | 0xC | ? |
| 0x00040000 | 0x10 | 0xC | ? (read by HID) |
| 0x00040001 | 0x1C | 0xC | Analog Stick Calibration Param?(read by HID) |
| 0x00040002 | 0x12 | 0xC | ? (read by HID) |
| 0x00040003 | 0xC | 0xC | ? (read by HID) |
| 0x00040004 | 0x1C | 0xC | ? |
| 0x00050000 | 0x2 | 0xC | Upper/Lower screen flicker byte |
| 0x00050001 | 0x2 | 0xC | Backlight controls (u8 ABL_powersave_enable, u8 brightness_level) (read by GSP) |
| 0x00050002 | 0x38 | 0xC | ? (read by GSP) |
| 0x00050003 | 0x20 | 0xC | ? (read by GSP) |
| 0x00050004 | 0x20 | 0xC | ? |
| 0x00050005 | 0x20 | 0xE | Stereo display settings |
| 0x00050006 | 0x2 | 0xC | ? |
| 0x00050007 | 0x4 | 0xC | ? |
| 0x00050008 | 0x10C | 0xC | ? |
| 0x00050009 | 0x8 | 0xC | new3DS only(?) backlight control (5th byte: backlight dimming enable) |
| 0x00060000 | 0x96 | 0xC | ? |
| 0x00070000 | 0x214 | 0xE | ? |
| 0x00070001 | 0x1 | 0xE | Sound output mode (mono/stereo/surround)? |
| 0x00070002 | 0x8 | 0xE | ? |
| 0x00080000 | 0xC00 | 0xC | WiFi configuration slot 0 |
| 0x00080001 | 0xC00 | 0xC | WiFi configuration slot 1 |
| 0x00080002 | 0xC00 | 0xC | WiFi configuration slot 2 |
| 0x00090000 | 0x8 | 0xE | This contains a u64 ID, used by processes using NWMUDS:InitializeWithVersion. The first word is the same as LocalFriendCodeSeed, while the latter is a separate word. |
| 0x00090001 | 0x8 | 0xE | Same content as 0x0009000? This console-unique u64 used by GenHashConsoleUnique is generated with the LocalFriendCodeSeed and with random data |
| 0x00090002 | 0x4 | 0xE | ? |
| 0x000A0000 | 0x1C | 0xE | Username |
| 0x000A0001 | 0x2 | 0xE | Birthday (u8 month, u8 day) |
| 0x000A0002 | 0x1 | 0xE | Language |
| 0x000B0000 | 0x4 | 0xE | CountryInfo |
| 0x000B0001 | 0x800 | 0xE | Country name in UTF-16, every 0x80-bytes is an entry for each language, in the order of the Language table below (not all entries are set) |
| 0x000B0002 | 0x800 | 0xE | State name in UTF-16, every 0x80-bytes is an entry for each language |
| 0x000B0003 | 0x4 | 0xE | Coordinates. A pair of s16 represents latitude and longitude, respectively. One need to multiply both value by 180/32768 to get coordinates in degrees |
| 0x000C0000 | 0xC0 | 0xE | Restricted photo exchange data, and other info (includes a mirror of Parental Restrictions PIN/Secret Answer) |
| 0x000C0001 | 0x14 | 0xE | Same as above? |
| 0x000C0002 | 0x200 | 0xE | ? Contains the email address set during Parental Restriction setup. |
| 0x000D0000 | 0x4 | 0xE | u16 at offset 0x0: EULA Version which was agreed to. |
| 0x000E0000 | 0x1 | 0xE | ? |
| 0x000F0000 | 0x10 | 0xC | Debug configuration, read by NS on dev-units: on startup, NS does svcKernelSetState(6, 1, (u64)debug_flags & 1);
|
| 0x000F0001 | 0x8 | 0xC | ? |
| 0x000F0003 | 0x1 | 0xC | ? |
| 0x000F0004 | 0x4 | 0xC | The first u8 is the System-Model value, the last 3-bytes are unknown |
| 0x000F0005 | 0x4 | 0xC | The first u8 indicates whether network updates are enabled (however, NIM only checks this flag with developer ENVINFO). |
| 0x000F0006 | 0x28 | 0xC | ? |
| 0x00100000 | 0x2 | 0xC | ? |
| 0x00100001 | 0x94 | 0xC | Stores Parental Restrictions PIN/Secret Answer and other info |
| 0x00100002 | 0x1 | 0xC | ? |
| 0x00100003 | 0x10 | 0xC | ? |
| 0x00110000 | 0x4 | 0xC | The low u16 indicates whether the system setup is required, such as when the system is booted for the first time or after doing a System Format: 0 = setup required, non-zero = no setup required |
| 0x00110001 | 0x8 | 0xC | TitleID of the menu to launch, used by NS on dev units (this block can be edited on dev units with Config) |
| 0x00120000 | 0x8 | 0xC | ? (read by HID) |
| 0x00130000 | 0x4 | 0xE | If response is 0x100 then debug mode is enabled. |
| 0x00150000 | 0x4 | 0xC | ? |
| 0x00150001 | 0x8 | 0xC | ? |
| 0x00150002 | 0x4 | 0xE | ? |
| 0x00160000 | 0x4 | 0xE | Unknown, first byte is used by config service-cmd 0x00070040. (Unknown whether the last 3-bytes are used) |
| 0x00170000 | 0x4 | 0xE | ? |
| 0x00180000 | 0x4 | 0xC | ? |
| 0x00180001 | 0x18 | 0xC | ? |
| 0x00190000 | 0x1 | 0xC | Unknown. NFC-module checks for value1/non-value1. |
The developer unit TID block only exists on developer units.
Stereo Display Settings
All values are hard-coded in cfg module.
| Offset | Size | Value | Description |
|---|---|---|---|
| 0x0 | 4 | 62.0f | assumed pupillary distance in mm? |
| 0x4 | 4 | 289.0f | assumed distance in mm between player's eyes and upper screen? |
| 0x8 | 4 | 76.80f | width in mm of (old) 3DS upper screen (doesn't vary for different models?) |
| 0xC | 4 | 46.08f | height in mm of (old) 3DS upper screen (doesn't vary for different models?) |
| 0x10 | 4 | 10.0f | |
| 0x14 | 4 | 5.0f | |
| 0x18 | 4 | 55.58f | |
| 0x1C | 4 | 21.57f |
Languages
| ID | Description |
|---|---|
| 0 | JP |
| 1 | EN |
| 2 | FR |
| 3 | DE |
| 4 | IT |
| 5 | ES |
| 6 | ZH |
| 7 | KO |
| 8 | NL |
| 9 | PT |
| 10 | RU |
| 11 | TW |
CountryInfo
| Byte | Description |
|---|---|
| 0 | ? |
| 1 | ? |
| 2 | State/Province code. |
| 3 | Country code, same as DSi/Wii country codes. Value 0xFF is invalid. |
0x000A0000 Block
| Byte | Description |
|---|---|
| 0x0-0x13 | UTF-16 username, with no NULL-terminator. |
| 0x14-17 | Usually zero? |
| 0x18-0x1B | u32 NGWord version the username was last checked with. If this value is less than the u32 stored in the NGWord CFA "romfs:/version.dat", the system then checks the username string with the bad-word list CFA again, then updates this field with the value from the CFA |
LCD display config
There seems to be some sort of LCD display configuration stored in this cfg. When using the cfg-save from an Old3DS on a New3DS without formatting the cfg first, the bottom-screen display is somewhat off(which is fixed by formatting the cfg-save).
Parental control Block 0x00100001
| Byte | Size in bytes | Description |
|---|---|---|
| 0x0 | 0xD | Unknown. |
| 0xD | 0x4 | PIN |
| 0x11 | ? | Secret answer in UTF-16 |