Config Savegame
Revision as of 13:45, 18 April 2017 by Wwylele (talk | contribs) (→Configuration blocks: Method of generating 0x00090001 block. I probably made mistakes when RE the config module, so please help me to confirm it)
This page describes the format of the Cfg NAND savegame. These blocks can be accessed with the Cfg service commands.
Structure of save-file "/config"
| Offset | Size | Description |
|---|---|---|
| 0x0 | 0x2 | Total entries |
| 0x2 | 0x2 | Data entries offset |
| 0x4 | 0x4558 | Block entries |
| 0x455C | Data for the entries |
The filesize for this /config file is 0x8000-bytes.
Configuration block entry
| Offset | Size | Description |
|---|---|---|
| 0x0 | 0x4 | BlkID |
| 0x4 | 0x4 | Offset to the data for this block when size is >4, otherwise this word is the data for this block |
| 0x8 | 0x2 | Size |
| 0xA | 0x2 | Flags |
Configuration blocks
| BlkID | Size | Flags | Description |
|---|---|---|---|
| 0x00000000 | 0x2 | 0xC | Config savegame version? |
| 0x00010000 | 0x1 | 0xC | ? |
| 0x00020000 | 0x134 | 0xC | ? |
| 0x00030000 | 0x1 | 0xC | ? |
| 0x00030001 | 0x8 | 0xE | User time offset (read by CECD) |
| 0x00030002 | 0x8 | 0xC | ? |
| 0x00040000 | 0x10 | 0xC | ? (read by HID) |
| 0x00040001 | 0x1C | 0xC | Analog Stick Calibration Param?(read by HID) |
| 0x00040002 | 0x12 | 0xC | ? (read by HID) |
| 0x00040003 | 0xC | 0xC | ? (read by HID) |
| 0x00040004 | 0x1C | 0xC | ? |
| 0x00050000 | 0x2 | 0xC | Upper/Lower screen flicker byte |
| 0x00050001 | 0x2 | 0xC | Backlight controls (u8 ABL_powersave_enable, u8 brightness_level) (read by GSP) |
| 0x00050002 | 0x38 | 0xC | ? (read by GSP) |
| 0x00050003 | 0x20 | 0xC | ? (read by GSP) |
| 0x00050004 | 0x20 | 0xC | ? |
| 0x00050005 | 0x20 | 0xE | Stereo display settings |
| 0x00050006 | 0x2 | 0xC | ? |
| 0x00050007 | 0x4 | 0xC | ? |
| 0x00050008 | 0x10C | 0xC | ? |
| 0x00050009 | 0x8 | 0xC | new3DS only(?) backlight control (5th byte: backlight dimming enable) |
| 0x00060000 | 0x96 | 0xC | ? |
| 0x00070000 | 0x214 | 0xE | ? |
| 0x00070001 | 0x1 | 0xE | Sound output mode (mono/stereo/surround)? |
| 0x00070002 | 0x8 | 0xE | ? |
| 0x00080000 | 0xC00 | 0xC | WiFi configuration slot 0 |
| 0x00080001 | 0xC00 | 0xC | WiFi configuration slot 1 |
| 0x00080002 | 0xC00 | 0xC | WiFi configuration slot 2 |
| 0x00090000 | 0x8 | 0xE | This contains a u64 ID, used by processes using NWMUDS:InitializeWithVersion. The first word is the same as LocalFriendCodeSeed, while the latter is a separate word. |
| 0x00090001 | 0x8 | 0xE | Same content as 0x0009000? This console-unique u64 is used by GenHashConsoleUnique. It is generated by ((0x3FFFFFFFF) & LocalFriendCodeSeed) | (random16 << 48)), where random16 is generated by GenerateRandomBytes
|
| 0x00090002 | 0x4 | 0xE | The first two bytes are the same random16 used in 0x00090001. The second two bytes are zeros. |
| 0x000A0000 | 0x1C | 0xE | Username |
| 0x000A0001 | 0x2 | 0xE | Birthday (u8 month, u8 day) |
| 0x000A0002 | 0x1 | 0xE | Language |
| 0x000B0000 | 0x4 | 0xE | CountryInfo |
| 0x000B0001 | 0x800 | 0xE | Country name in UTF-16, every 0x80-bytes is an entry for each language, in the order of the Language table below (not all entries are set) |
| 0x000B0002 | 0x800 | 0xE | State name in UTF-16, every 0x80-bytes is an entry for each language |
| 0x000B0003 | 0x4 | 0xE | Coordinates. A pair of s16 represents latitude and longitude, respectively. One need to multiply both value by 180/32768 to get coordinates in degrees |
| 0x000C0000 | 0xC0 | 0xE | Restricted photo exchange data, and other info (includes a mirror of Parental Restrictions PIN/Secret Answer) |
| 0x000C0001 | 0x14 | 0xE | Same as above? |
| 0x000C0002 | 0x200 | 0xE | ? Contains the email address set during Parental Restriction setup. |
| 0x000D0000 | 0x4 | 0xE | u16 at offset 0x0: EULA Version which was agreed to. |
| 0x000E0000 | 0x1 | 0xE | ? |
| 0x000F0000 | 0x10 | 0xC | Debug configuration, read by NS on dev-units: on startup, NS does svcKernelSetState(6, 1, (u64)debug_flags & 1);
|
| 0x000F0001 | 0x8 | 0xC | ? |
| 0x000F0003 | 0x1 | 0xC | ? |
| 0x000F0004 | 0x4 | 0xC | The first u8 is the System-Model value, the last 3-bytes are unknown |
| 0x000F0005 | 0x4 | 0xC | The first u8 indicates whether network updates are enabled (however, NIM only checks this flag with developer ENVINFO). |
| 0x000F0006 | 0x28 | 0xC | ? |
| 0x00100000 | 0x2 | 0xC | ? |
| 0x00100001 | 0x94 | 0xC | Stores Parental Restrictions PIN/Secret Answer and other info |
| 0x00100002 | 0x1 | 0xC | ? |
| 0x00100003 | 0x10 | 0xC | ? |
| 0x00110000 | 0x4 | 0xC | The low u16 indicates whether the system setup is required, such as when the system is booted for the first time or after doing a System Format: 0 = setup required, non-zero = no setup required |
| 0x00110001 | 0x8 | 0xC | TitleID of the menu to launch, used by NS on dev units (this block can be edited on dev units with Config) |
| 0x00120000 | 0x8 | 0xC | ? (read by HID) |
| 0x00130000 | 0x4 | 0xE | If response is 0x100 then debug mode is enabled. |
| 0x00150000 | 0x4 | 0xC | ? |
| 0x00150001 | 0x8 | 0xC | ? |
| 0x00150002 | 0x4 | 0xE | ? |
| 0x00160000 | 0x4 | 0xE | Unknown, first byte is used by config service-cmd 0x00070040. (Unknown whether the last 3-bytes are used) |
| 0x00170000 | 0x4 | 0xE | ? |
| 0x00180000 | 0x4 | 0xC | ? |
| 0x00180001 | 0x18 | 0xC | ? |
| 0x00190000 | 0x1 | 0xC | Unknown. NFC-module checks for value1/non-value1. |
The developer unit TID block only exists on developer units.
Stereo Display Settings
All values are hard-coded in cfg module.
| Offset | Size | Value | Description |
|---|---|---|---|
| 0x0 | 4 | 62.0f | assumed pupillary distance in mm? |
| 0x4 | 4 | 289.0f | assumed distance in mm between player's eyes and upper screen? |
| 0x8 | 4 | 76.80f | width in mm of (old) 3DS upper screen (doesn't vary for different models?) |
| 0xC | 4 | 46.08f | height in mm of (old) 3DS upper screen (doesn't vary for different models?) |
| 0x10 | 4 | 10.0f | |
| 0x14 | 4 | 5.0f | |
| 0x18 | 4 | 55.58f | |
| 0x1C | 4 | 21.57f |
Languages
| ID | Description |
|---|---|
| 0 | JP |
| 1 | EN |
| 2 | FR |
| 3 | DE |
| 4 | IT |
| 5 | ES |
| 6 | ZH |
| 7 | KO |
| 8 | NL |
| 9 | PT |
| 10 | RU |
| 11 | TW |
CountryInfo
| Byte | Description |
|---|---|
| 0 | ? |
| 1 | ? |
| 2 | State/Province code. |
| 3 | Country code, same as DSi/Wii country codes. Value 0xFF is invalid. |
0x000A0000 Block
| Byte | Description |
|---|---|
| 0x0-0x13 | UTF-16 username, with no NULL-terminator. |
| 0x14-17 | Usually zero? |
| 0x18-0x1B | u32 NGWord version the username was last checked with. If this value is less than the u32 stored in the NGWord CFA "romfs:/version.dat", the system then checks the username string with the bad-word list CFA again, then updates this field with the value from the CFA |
LCD display config
There seems to be some sort of LCD display configuration stored in this cfg. When using the cfg-save from an Old3DS on a New3DS without formatting the cfg first, the bottom-screen display is somewhat off(which is fixed by formatting the cfg-save).
Parental control Block 0x00100001
| Byte | Size in bytes | Description |
|---|---|---|
| 0x0 | 0xD | Unknown. |
| 0xD | 0x4 | PIN |
| 0x11 | ? | Secret answer in UTF-16 |