The printable version is no longer supported and may have rendering errors. Please update your browser bookmarks and please use the default browser print function instead.
This page describes the format of the Cfg NAND savegame. These blocks can be accessed with the Cfg service commands.
Structure of save-file "/config"
Offset
|
Size
|
Description
|
0x0
|
0x2
|
Total entries
|
0x2
|
0x2
|
Data entries offset
|
0x4
|
0x4558
|
Block entries
|
0x455C
|
|
Data for the entries
|
The filesize for this /config file is 0x8000-bytes.
Configuration block entry
Offset
|
Size
|
Description
|
0x0
|
0x4
|
BlkID
|
0x4
|
0x4
|
Offset to the data for this block when size is >4, otherwise this word is the data for this block
|
0x8
|
0x2
|
Size
|
0xA
|
0x2
|
Flags
|
Configuration blocks
BlkID
|
Size
|
Flags
|
Description
|
0x00000000
|
0x2
|
0xC
|
Config savegame version?
|
0x00010000
|
0x1
|
0xC
|
RTC compensation value
|
0x00020000
|
0x134
|
0xC
|
Codec
|
0x00030000
|
0x1
|
0xC
|
??? (HWCAL block 0x28)
|
0x00030001
|
0x8
|
0xE
|
User time offset (read by CECD)
|
0x00030002
|
0x8
|
0xC
|
?
|
0x00040000
|
0x10
|
0xC
|
Touch calibration (read by HID)
|
0x00040001
|
0x1C
|
0xC
|
Analog Stick Calibration Param?(read by HID)
|
0x00040002
|
0x12
|
0xC
|
Gyroscope (read by HID)
|
0x00040003
|
0xC
|
0xC
|
Accelerometer (read by HID)
|
0x00040004
|
0x1C
|
0xC
|
CStick calibration data
|
0x00050000
|
0x2
|
0xC
|
Screen flicker
|
0x00050001
|
0x2
|
0xC
|
Backlight controls (u8 ABL_powersave_enable, u8 brightness_level) (read by GSP)
|
0x00050002
|
0x38
|
0xC
|
Backlight PWM (read by GSP)
|
0x00050003
|
0x20
|
0xC
|
Power saving mode (ABL) calibration (read by GSP)
|
0x00050004
|
0x20
|
0xC
|
Power saving mode (ABL) calibration
|
0x00050005
|
0x20
|
0xE
|
Stereo display settings (HWCAL block 0x470)
|
0x00050006
|
0x2
|
0xC
|
3D switching delay
|
0x00050007
|
0x4
|
0xC
|
?
|
0x00050008
|
0x10C
|
0xC
|
Power saving mode (ABL) extra config
|
0x00050009
|
0x8
|
0xC
|
new3DS only(?) backlight control (5th byte: auto-brightness enable)
|
0x00060000
|
0x96
|
0xC
|
??? (HWCAL block 0x500)
|
0x00070000
|
0x214
|
0xE
|
3D filters
|
0x00070001
|
0x1
|
0xE
|
Sound output mode (mono=0, stereo=1, surround=2)
|
0x00070002
|
0x8
|
0xE
|
Microphone echo cancellation params
|
0x00080000
|
0xC00
|
0xC
|
WiFi configuration slot 0
|
0x00080001
|
0xC00
|
0xC
|
WiFi configuration slot 1
|
0x00080002
|
0xC00
|
0xC
|
WiFi configuration slot 2
|
0x00090000
|
0x8
|
0xE
|
This contains a u64 ID, used by processes using NWMUDS:InitializeWithVersion. The first word is the same as LocalFriendCodeSeed, while the latter is a separate word.
|
0x00090001
|
0x8
|
0xE
|
Same content as 0x0009000? This console-unique u64 is used by GenHashConsoleUnique. It is generated by ((0x3FFFFFFFF) & LocalFriendCodeSeed) | (random16 << 48)) , where random16 is generated by GenerateRandomBytes
|
0x00090002
|
0x4
|
0xE
|
The first two bytes are the same random16 used in 0x00090001. The second two bytes are zeros.
|
0x000A0000
|
0x1C
|
0xE
|
Username in UTF16
|
0x000A0001
|
0x2
|
0xE
|
Birthday (u8 month, u8 day)
|
0x000A0002
|
0x1
|
0xE
|
Language
|
0x000B0000
|
0x4
|
0xE
|
CountryInfo
|
0x000B0001
|
0x800
|
0xE
|
Country name in UTF-16, every 0x80-bytes is an entry for each language, in the order of the Language table below (not all entries are set)
|
0x000B0002
|
0x800
|
0xE
|
State name in UTF-16, every 0x80-bytes is an entry for each language
|
0x000B0003
|
0x4
|
0xE
|
Coordinates. A pair of s16 represents latitude and longitude, respectively. One need to multiply both value by 180/32768 to get coordinates in degrees
|
0x000C0000
|
0xC0
|
0xE
|
Restricted photo exchange data, and other info (includes a mirror of Parental Restrictions PIN/Secret Answer)
|
0x000C0001
|
0x14
|
0xE
|
COPPACS restriction data
|
0x000C0002
|
0x200
|
0xE
|
? Contains the email address set during Parental Restriction setup.
|
0x000D0000
|
0x4
|
0xE
|
u16 at offset 0x0: EULA Version which was agreed to.
|
0x000E0000
|
0x1
|
0xE
|
?
|
0x000F0000
|
0x10
|
0xC
|
Debug configuration, read by NS on dev-units: on startup, NS does svcKernelSetState(6, 1, (u64)debug_flags & 1);
svcKernelSetState(6, 2, (u64)debug_flags & 2); (see here) where debug_flags is the u32 located at offset 0xC in this struct. Then it compares the u32 from +8 in this config-block with the APPMEMTYPE. When those don't match NS starts a FIRM-launch (with the same FIRM titleID as the currently running one) to boot into a FIRM with the APPMEMTYPE value from this config-block. The byte at offset 0x0 is related to the memtype as well.
|
0x000F0001
|
0x8
|
0xC
|
?
|
0x000F0003
|
0x1
|
0xC
|
?
|
0x000F0004
|
0x4
|
0xC
|
The first u8 is the System-Model value, the last 3-bytes are unknown
|
0x000F0005
|
0x4
|
0xC
|
The first u8 indicates whether network updates are enabled (however, NIM only checks this flag with developer ENVINFO).
|
0x000F0006
|
0x28
|
0xC
|
?
|
0x00100000
|
0x2
|
0xC
|
?
|
0x00100001
|
0x94
|
0xC
|
Stores Parental Restrictions PIN/Secret Answer and other info
|
0x00100002
|
0x1
|
0xC
|
?
|
0x00100003
|
0x10
|
0xC
|
?
|
0x00110000
|
0x4
|
0xC
|
The low u16 indicates whether the system setup is required, such as when the system is booted for the first time or after doing a System Format: 0 = setup required, non-zero = no setup required
|
0x00110001
|
0x8
|
0xC
|
TitleID of the menu to launch, used by NS on dev units (this block can be edited on dev units with Config)
|
0x00120000
|
0x8
|
0xC
|
MCU volume slider related (read by HID)
|
0x00130000
|
0x4
|
0xE
|
If response is 0x100 then debug mode is enabled.
|
0x00150000
|
0x4
|
0xC
|
?
|
0x00150001
|
0x8
|
0xC
|
?
|
0x00150002
|
0x4
|
0xE
|
?
|
0x00160000
|
0x4
|
0xE
|
Unknown, first byte is used by config service-cmd 0x00070040. (Unknown whether the last 3-bytes are used)
|
0x00170000
|
0x4
|
0xE
|
Miiverse (OLV) access key
|
0x00180000
|
0x4
|
0xC
|
QTM Infrared LED related, can be 0 or 1
|
0x00180001
|
0x18
|
0xC
|
QTM calibration data
|
0x00190000
|
0x1
|
0xC
|
Unknown. NFC-module checks for value1/non-value1.
|
The developer unit TID block only exists on developer units.
Stereo Display Settings
All values are hard-coded in cfg module.
Offset
|
Size
|
Value
|
Description
|
0x0
|
4
|
62.0f
|
assumed pupillary distance in mm?
|
0x4
|
4
|
289.0f
|
assumed distance in mm between player's eyes and upper screen?
|
0x8
|
4
|
76.80f
|
width in mm of (old) 3DS upper screen (doesn't vary for different models?)
|
0xC
|
4
|
46.08f
|
height in mm of (old) 3DS upper screen (doesn't vary for different models?)
|
0x10
|
4
|
10.0f
|
|
0x14
|
4
|
5.0f
|
|
0x18
|
4
|
55.58f
|
|
0x1C
|
4
|
21.57f
|
|
Languages
ID
|
Description
|
0
|
JP
|
1
|
EN
|
2
|
FR
|
3
|
DE
|
4
|
IT
|
5
|
ES
|
6
|
ZH
|
7
|
KO
|
8
|
NL
|
9
|
PT
|
10
|
RU
|
11
|
TW
|
CountryInfo
Byte
|
Description
|
0
|
?
|
1
|
?
|
2
|
State/Province code.
|
3
|
Country code, same as DSi/Wii country codes. Value 0xFF is invalid.
|
0x000A0000 Block
Byte
|
Description
|
0x0-0x13
|
UTF-16 username, with no NULL-terminator.
|
0x14-17
|
Usually zero?
|
0x18-0x1B
|
u32 NGWord version the username was last checked with. If this value is less than the u32 stored in the NGWord CFA "romfs:/version.dat", the system then checks the username string with the bad-word list CFA again, then updates this field with the value from the CFA
|
WiFi Slot Structure
Network structure
This is used twice in the actual WiFi slot structure.
Offset
|
Size
|
Description
|
0x0
|
0x1
|
Whether the network was set or not?
|
0x1
|
0x1
|
Whether to use this network strucutre to connect?
|
0x2
|
0x1
|
Whether this structure is the first (0) or the second (1) in the larger WiFi slot structure?
|
0x3
|
0x1
|
Padding ?
|
0x4
|
0x20
|
SSID of the network, without a trailing nullbyte.
|
0x24
|
0x1
|
Length of the SSID.
|
0x25
|
0x1
|
AP crypto key type
|
0x26
|
0x2
|
Padding ?
|
0x28
|
0x40
|
Plaintext of the passphrase of the network, without a trailing nullbyte.
|
0x68
|
0x20
|
PBKDF2 of the passphrase and SSID (http://jorisvr.nl/wpapsk.html).
|
Actual structure
Offset
|
Size
|
Description
|
0x0
|
0x2
|
?
|
0x2
|
0x2
|
CRC-16 checksum of the next 0x410 bytes.
|
0x4
|
0x88
|
First network structure. Only set if the network was set "normally", or was the last to be set using WPS during the session.
|
0x8C
|
0x20
|
Padding.
|
0xAC
|
0x88
|
Second network structure. Only set if the network was set using WPS, otherwise 0-filled.
|
0x134
|
0x20C
|
Padding.
|
0x340
|
0x1
|
Whether to automatically get the IP address (use DHCP) or not, defaults to 1.
|
0x341
|
0x1
|
Whether to automatically get the DNS or not, defaults to 1.
|
0x342
|
0x2
|
Padding ?
|
0x344
|
0x4
|
IP address, to use if 0x340 is false.
|
0x348
|
0x4
|
IP address of the gateway, to use if 0x340 is false.
|
0x34C
|
0x4
|
Subnetwork mask, to use if 0x340 is false.
|
0x350
|
0x4
|
IP address of the primary DNS , to use if 0x341 is false.
|
0x354
|
0x4
|
IP address of the secondary DNS, to use if 0x341 is false.
|
0x358
|
0x4
|
Always 0x01050000 ? Only set if the network was the last to be set during the session.
|
0x35C
|
0x4
|
IP address to use. Only set if the network was the last to be set during the session.
|
0x360
|
0x6
|
MAC address of the AP. Only set if the network was the last to be set during the session.
|
0x366
|
0x1
|
Channel. Only set if the network was the last to be set during the session.
|
0x367
|
0x1
|
Padding ? Only set if the network was the last to be set during the session.
|
0x368
|
0x1
|
Whether to use a proxy or not, defaults to 0.
|
0x369
|
0x1
|
Whether to use a basic authentication for the proxy, defaults to 0.
|
0x36A
|
0x2
|
Port to use for the proxy, defaults to 1.
|
0x36C
|
0x30
|
URL/address of the proxy, including a trailing nullbyte.
|
0x39C
|
0x34
|
Padding.
|
0x3D0
|
0x20
|
Username to use for basic authentication, including a trailing nullbyte.
|
0x3F0
|
0x20
|
Password to use for basic authentication, including a trailing nullbyte.
|
0x410
|
0x2
|
Padding ?
|
0x412
|
0x2
|
MTU value, defaults to 1400 and ranges between 576 and 1500, inclusive.
|
0x414
|
0x7EC
|
Padding.
|
LCD display config
There seems to be some sort of LCD display configuration stored in this cfg. When using the cfg-save from an Old3DS on a New3DS without formatting the cfg first, the bottom-screen display is somewhat off(which is fixed by formatting the cfg-save).
Parental control Block 0x00100001
Byte
|
Size in bytes
|
Description
|
0x0
|
0xD
|
Unknown.
|
0xD
|
0x4
|
PIN
|
0x11
|
0x20
|
Secret answer in UTF-16
|
Parental Control setting block 0xC0000
Parental Control restriction bitmask
Bit
|
Restriction name
|
0
|
Global Parental Controls enable
|
3
|
Sharing Images/Audio/Video/Long Text Data
|
4
|
Internet Browser
|
5
|
StreetPass
|
6
|
Friend Registration
|
8
|
eShop
|
10
|
Miiverse (view)
|
11
|
Miiverse (post)
|
31
|
"Child Online Privacy Protection" (see CFG:IsCoppacsSupported)
|