This page describes the format of the Cfg NAND savegame. These blocks can be accessed with the Cfg service commands.
Structure of save-file "/config"
| Offset
|
Size
|
Description
|
| 0x0
|
0x2
|
Total entries
|
| 0x2
|
0x2
|
Data entries offset
|
| 0x4
|
0x4558
|
Block entries
|
| 0x455C
|
|
Data for the entries
|
The filesize for this /config file is 0x8000-bytes.
Configuration block entry
| Offset
|
Size
|
Description
|
| 0x0
|
0x4
|
BlkID
|
| 0x4
|
0x4
|
Offset to the data for this block when size is >4, otherwise this word is the data for this block
|
| 0x8
|
0x2
|
Size
|
| 0xA
|
0x2
|
Flags
|
Configuration blocks
| BlkID
|
Size
|
Flags
|
Description
|
| 0x00000000
|
0x2
|
?
|
Config savegame version?
|
| 0x00030001
|
0x8
|
0xE
|
? (zeroed)
|
| 0x00040000
|
0x10
|
0x8
|
? (read by HID)
|
| 0x00040001
|
0x1C
|
0x8
|
? (read by HID)
|
| 0x00040002
|
0x12
|
0x8
|
? (read by HID)
|
| 0x00040003
|
0xC
|
0x8
|
? (read by HID)
|
| 0x00050001
|
0x2
|
0x8
|
? (read by GSP)
|
| 0x00050002
|
0x38
|
0x8
|
? (read by GSP)
|
| 0x00050003
|
0x20
|
0x8
|
? (read by GSP)
|
| 0x00050005
|
0x20
|
?
|
Stereo camera settings?
|
| 0x00050006
|
0x2
|
0x8
|
?
|
| 0x00070001
|
0x1
|
?
|
Sound output mode?
|
| 0x00080000
|
0xC00
|
0x2?
|
WiFi configuration slot 0
|
| 0x00080001
|
0xC00
|
0x2?
|
WiFi configuration slot 1
|
| 0x00080002
|
0xC00
|
0x2?
|
WiFi configuration slot 2
|
| 0x00090000
|
0x8
|
0x2?
|
This contains a u64 ID, used by processes using NWMUDS:InitializeWithVersion. The first word is the same as LocalFriendCodeSeed, while the latter is a separate word.
|
| 0x00090001
|
0x8
|
0xE
|
This console-unique u64 used by GenHashConsoleUnique is generated with the LocalFriendCodeSeed and with random data
|
| 0x000A0000
|
0x1C
|
0xE
|
Username
|
| 0x000A0001
|
0x2
|
0xE
|
Birthday (u8 month, u8 day)
|
| 0x000A0002
|
0x1
|
0xA
|
Language
|
| 0x000B0000
|
0x4
|
0x8
|
CountryInfo
|
| 0x000B0001
|
0x800
|
0x2?
|
Country name in UTF-16, every 0x80-bytes is an entry for each language, in the order of the Language table below (not all entries are set)
|
| 0x000B0002
|
0x800
|
0x2?
|
State name in UTF-16, every 0x80-bytes is an entry for each language
|
| 0x000B0003
|
0x4
|
0xE
|
Pair of 16-bit values, meaning unknown but related to address (ZIP code?)
|
| 0x000C0000
|
0xC0
|
0x8
|
Restricted photo exchange data, and other info
|
| 0x000C0001
|
0x14
|
?
|
Same as above?
|
| 0x000D0000
|
0x4
|
0x2
|
u16 at offset 0x0: EULA Version which was agreed to.
|
| 0x000F0000
|
0x10
|
0x8?
|
Unknown, used by NS on dev-units for svcKernelSetState, where Type is 6. During NS startup on debug-units, NS compares the u32 from +8 in this config-block with the APPMEMTYPE. When those don't match NS starts a FIRM-launch (with the same FIRM titleID as the currently running one) to boot into a FIRM with the APPMEMTYPE value from this config-block
|
| 0x000F0004
|
0x4
|
0x8?
|
The first u8 is the System-Model value, the last 3-bytes are unknown
|
| 0x00110000
|
0x4
|
?
|
The low u16 indicates whether the system setup is required, such as when the system is booted for the first time or after doing a System Format: 0 = setup required, non-zero = no setup required
|
| 0x00110001
|
0x8
|
0xA?
|
TitleID of the menu to launch, used by NS on dev units (this block can be edited on dev units with Config)
|
| 0x00120000
|
0x8
|
0x8
|
? (read by HID)
|
| 0x00130000
|
0x4
|
?
|
If response is 0x100 then debug mode is enabled.
|
| 0x00160000
|
0x4
|
0x8?
|
Unknown, first byte is used by config service-cmd 0x00070040. (Unknown whether the last 3-bytes are used)
|
| 0x00190000
|
0x1
|
0x8?
|
Unknown. NFC-module checks for value1/non-value1.
|
The developer unit TID block only exists on developer units.
Languages
| ID
|
Description
|
| 0
|
JP
|
| 1
|
EN
|
| 2
|
FR
|
| 3
|
DE
|
| 4
|
IT
|
| 5
|
ES
|
| 6
|
ZH
|
| 7
|
KO
|
| 8
|
NL
|
| 9
|
PT
|
| 10
|
RU
|
| 11
|
TW
|
CountryInfo
| Byte
|
Description
|
| 0
|
?
|
| 1
|
?
|
| 2
|
?
|
| 3
|
Country code, same as DSi/Wii country codes. Value 0xFF is invalid.
|
0x000A0000 Block
| Byte
|
Description
|
| 0x0-0x13
|
UTF-16 username, with no NULL-terminator.
|
| 0x14-17
|
Usually zero?
|
| 0x18-0x1B
|
u32 NGWord version the username was last checked with. If this value is less than the u32 stored in the NGWord CFA "romfs:/version.dat", the system then checks the username string with the bad-word list CFA again, then updates this field with the value from the CFA
|
LCD display config
There seems to be some sort of LCD display configuration stored in this cfg. When using the cfg-save from an Old3DS on a New3DS without formatting the cfg first, the bottom-screen display is somewhat off(which is fixed by formatting the cfg-save).