This page describes the format of the Cfg NAND savegame. These blocks can be accessed with the Cfg service commands.

Structure of save-file "/config"

Offset Size Description
0x0 0x2 Total entries
0x2 0x2 Data entries offset
0x4 0x4558 Block entries
0x455C Data for the entries

The filesize for this /config file is 0x8000-bytes.

Configuration block entry

Offset Size Description
0x0 0x4 BlkID
0x4 0x4 Offset to the data for this block when size is >4, otherwise this word is the data for this block
0x8 0x2 Size
0xA 0x2 Flags

Configuration blocks

BlkID Size Flags Description
0x00000000 0x2 0xC Config savegame version?
0x00010000 0x1 0xC ?
0x00020000 0x134 0xC ?
0x00030000 0x1 0xC ?
0x00030001 0x8 0xE User time offset (read by CECD)
0x00030002 0x8 0xC ?
0x00040000 0x10 0xC ? (read by HID)
0x00040001 0x1C 0xC Analog Stick Calibration Param?(read by HID)
0x00040002 0x12 0xC ? (read by HID)
0x00040003 0xC 0xC ? (read by HID)
0x00040004 0x1C 0xC ?
0x00050000 0x2 0xC Upper/Lower screen flicker byte
0x00050001 0x2 0xC Backlight controls (u8 ABL_powersave_enable, u8 brightness_level) (read by GSP)
0x00050002 0x38 0xC ? (read by GSP)
0x00050003 0x20 0xC ? (read by GSP)
0x00050004 0x20 0xC ?
0x00050005 0x20 0xE Stereo display settings
0x00050006 0x2 0xC ?
0x00050007 0x4 0xC ?
0x00050008 0x10C 0xC ?
0x00050009 0x8 0xC new3DS only(?) backlight control (5th byte: backlight dimming enable)
0x00060000 0x96 0xC ?
0x00070000 0x214 0xE ?
0x00070001 0x1 0xE Sound output mode (mono/stereo/surround)?
0x00070002 0x8 0xE ?
0x00080000 0xC00 0xC WiFi configuration slot 0
0x00080001 0xC00 0xC WiFi configuration slot 1
0x00080002 0xC00 0xC WiFi configuration slot 2
0x00090000 0x8 0xE This contains a u64 ID, used by processes using NWMUDS:InitializeWithVersion. The first word is the same as LocalFriendCodeSeed, while the latter is a separate word.
0x00090001 0x8 0xE Same content as 0x0009000? This console-unique u64 used by GenHashConsoleUnique is generated with the LocalFriendCodeSeed and with random data
0x00090002 0x4 0xE ?
0x000A0000 0x1C 0xE Username
0x000A0001 0x2 0xE Birthday (u8 month, u8 day)
0x000A0002 0x1 0xE Language
0x000B0000 0x4 0xE CountryInfo
0x000B0001 0x800 0xE Country name in UTF-16, every 0x80-bytes is an entry for each language, in the order of the Language table below (not all entries are set)
0x000B0002 0x800 0xE State name in UTF-16, every 0x80-bytes is an entry for each language
0x000B0003 0x4 0xE Coordinates. A pair of s16 represents latitude and longitude, respectively. One need to multiply both value by 180/32768 to get coordinates in degrees
0x000C0000 0xC0 0xE Restricted photo exchange data, and other info (includes a mirror of Parental Restrictions PIN/Secret Answer)
0x000C0001 0x14 0xE Same as above?
0x000C0002 0x200 0xE ? Contains the email address set during Parental Restriction setup.
0x000D0000 0x4 0xE u16 at offset 0x0: EULA Version which was agreed to.
0x000E0000 0x1 0xE ?
0x000F0000 0x10 0xC Debug configuration, read by NS on dev-units: on startup, NS does svcKernelSetState(6, 1, (u64)debug_flags & 1);

svcKernelSetState(6, 2, (u64)debug_flags & 2); (see here) where debug_flags is the u32 located at offset 0xC in this struct. Then it compares the u32 from +8 in this config-block with the APPMEMTYPE. When those don't match NS starts a FIRM-launch (with the same FIRM titleID as the currently running one) to boot into a FIRM with the APPMEMTYPE value from this config-block. The byte at offset 0x0 is related to the memtype as well.

0x000F0001 0x8 0xC ?
0x000F0003 0x1 0xC ?
0x000F0004 0x4 0xC The first u8 is the System-Model value, the last 3-bytes are unknown
0x000F0005 0x4 0xC The first u8 indicates whether network updates are enabled (however, NIM only checks this flag with developer ENVINFO).
0x000F0006 0x28 0xC ?
0x00100000 0x2 0xC ?
0x00100001 0x94 0xC Stores Parental Restrictions PIN/Secret Answer and other info
0x00100002 0x1 0xC ?
0x00100003 0x10 0xC ?
0x00110000 0x4 0xC The low u16 indicates whether the system setup is required, such as when the system is booted for the first time or after doing a System Format: 0 = setup required, non-zero = no setup required
0x00110001 0x8 0xC TitleID of the menu to launch, used by NS on dev units (this block can be edited on dev units with Config)
0x00120000 0x8 0xC ? (read by HID)
0x00130000 0x4 0xE If response is 0x100 then debug mode is enabled.
0x00150000 0x4 0xC ?
0x00150001 0x8 0xC ?
0x00150002 0x4 0xE ?
0x00160000 0x4 0xE Unknown, first byte is used by config service-cmd 0x00070040. (Unknown whether the last 3-bytes are used)
0x00170000 0x4 0xE ?
0x00180000 0x4 0xC ?
0x00180001 0x18 0xC ?
0x00190000 0x1 0xC Unknown. NFC-module checks for value1/non-value1.

The developer unit TID block only exists on developer units.

Stereo Display Settings

All values are hard-coded in cfg module.

Offset Size Value Description
0x0 4 62.0f assumed pupillary distance in mm?
0x4 4 289.0f assumed distance in mm between player's eyes and upper screen?
0x8 4 76.80f width in mm of (old) 3DS upper screen (doesn't vary for different models?)
0xC 4 46.08f height in mm of (old) 3DS upper screen (doesn't vary for different models?)
0x10 4 10.0f
0x14 4 5.0f
0x18 4 55.58f
0x1C 4 21.57f

Languages

ID Description
0 JP
1 EN
2 FR
3 DE
4 IT
5 ES
6 ZH
7 KO
8 NL
9 PT
10 RU
11 TW

CountryInfo

Byte Description
0 ?
1 ?
2 State/Province code.
3 Country code, same as DSi/Wii country codes. Value 0xFF is invalid.

0x000A0000 Block

Byte Description
0x0-0x13 UTF-16 username, with no NULL-terminator.
0x14-17 Usually zero?
0x18-0x1B u32 NGWord version the username was last checked with. If this value is less than the u32 stored in the NGWord CFA "romfs:/version.dat", the system then checks the username string with the bad-word list CFA again, then updates this field with the value from the CFA


LCD display config

There seems to be some sort of LCD display configuration stored in this cfg. When using the cfg-save from an Old3DS on a New3DS without formatting the cfg first, the bottom-screen display is somewhat off(which is fixed by formatting the cfg-save).


Parental control Block 0x00100001

Byte Size in bytes Description
0x0 0xD Unknown.
0xD 0x4 PIN
0x11 ? Secret answer in UTF-16