3dbrew - User contributions [en]

Config Savegame

2026-06-23T20:39:05Z

TimmSkiller: /* Configuration blocks */

This page describes the format of the [[Config_Services|Cfg]] [[System_SaveData|NAND]] savegame. These blocks can be accessed with the Cfg service commands.

==Structure of save-file "/config"==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x2
| Total entries
|-
| 0x2
| 0x2
| Data entries offset
|-
| 0x4
| 0x4558
| Block entries
|-
| 0x455C
|
| Data for the entries
|}

The filesize for this /config file is 0x8000-bytes.

==Configuration block entry ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| BlkID
|-
| 0x4
| 0x4
| Offset to the data for this block when size is >4, otherwise this word is the data for this block
|-
| 0x8
| 0x2
| Size
|-
| 0xA
| 0x2
| Access Flags
|}

===Access Flags===
{| class="wikitable" border="1"
|-
! Bit Mask
! Description
|-
| 0x2
| User Readable (cfg:u)
|-
| 0x4
| System Writable (cfg:s / cfg:i)
|-
| 0x8
| System Readable (cfg:s / cfg:i)
|}

Config blocks will typically either use 0xC for system readable/writable or 0xE for all 3.

==Configuration blocks==
{| class="wikitable" border="1"
|-
! BlkID
! Size
! Access Flags
! Description
|-
| 0x00000000
| 0x2
| 0xC
| Config savegame version?
|-
| 0x00010000
| 0x1
| 0xC
| [[Hardware_calibration#RTC|RTC compensation value]]
|-
| 0x00020000
| 0x134
| 0xC
| [[Hardware_calibration#CDC|Codec]]
|-
| 0x00030000
| 0x1
| 0xC
| Leap Year Counter (read By PTM)
|-
| 0x00030001
| 0x8
| 0xE
| User time offset (read by CECD): displayed timestamp - rtc timestamp
|-
| 0x00030002
| 0x8
| 0xC
| Difference (in nanoseconds) between UTC server time and RTC time. Updated by [[Friend_Services|the Friends sysmodule]] after every [[Online_Play|NASC]] login. Used by System settings to calculate the real current time according to the online play authentication server, in order to determine the user's actual age based on the given date of birth (related to COPPA, since this is used to check whether the user is at least 13 years old).
|-
| 0x00040000
| 0x10
| 0xC
| [[Hardware_calibration#Touch|Touch calibration]] (read by HID)
|-
| 0x00040001
| 0x1C
| 0xC
| Analog Stick Calibration Param?(read by HID)
|-
| 0x00040002
| 0x12
| 0xC
| [[Hardware_calibration#Gyro|Gyroscope]] (read by HID)
|-
| 0x00040003
| 0xC
| 0xC
| [[Hardware_calibration#Accel|Accelerometer]] (read by HID)
|-
| 0x00040004
| 0x1C
| 0xC
| [[Hardware_calibration#CStick|CStick calibration data]]
|-
| 0x00050000
| 0x2
| 0xC
| [[Hardware_calibration#Screen_flicker|Screen flicker]]
|-
| 0x00050001
| 0x2
| 0xC
| Backlight controls (u8 ABL_powersave_enable, u8 brightness_level) (read by GSP)
|-
| 0x00050002
| 0x38
| 0xC
| [[Hardware_calibration#BLPWM|Backlight PWM]] (read by GSP)
|-
| 0x00050003
| 0x20
| 0xC
| [[Hardware_calibration#ABL|Power saving mode (ABL) calibration]] (read by GSP)
|-
| 0x00050004
| 0x20
| 0xC
| [[Hardware_calibration#ABL|Power saving mode (ABL) calibration]] (for legacy FIRM)
|-
| 0x00050005
| 0x20
| 0xE
| Stereo display settings (HWCAL block 0x470)
|-
| 0x00050006
| 0x2
| 0xC
| [[Hardware_calibration#ULCD_delay|3D switching delay]]
|-
| 0x00050007
| 0x4
| 0xC
| ?
|-
| 0x00050008
| 0x10C
| 0xC
| [[Hardware_calibration#ABL_extra|Power saving mode (ABL) extra config]]
|-
| 0x00050009
| 0x8
| 0xC
| new3DS only(?) backlight control (5th byte: auto-brightness enable)
|-
| 0x00060000
| 0x96
| 0xC
| ??? (HWCAL block 0x500)
|-
| 0x00070000
| 0x214
| 0xE
| [[Hardware_calibration#3D_filters|3D filters]]
|-
| 0x00070001
| 0x1
| 0xE
| Sound output mode (mono=0, stereo=1, surround=2)
|-
| 0x00070002
| 0x8
| 0xE
| [[Hardware_calibration#Microphone_echo_cancel|Microphone echo cancellation params]]
|-
| 0x00080000
| 0xC00
| 0xC
| WiFi configuration slot 0
|-
| 0x00080001
| 0xC00
| 0xC
| WiFi configuration slot 1
|-
| 0x00080002
| 0xC00
| 0xC
| WiFi configuration slot 2
|-
| 0x00090000
| 0x8
| 0xE
| u64, Current local friend code. Updated by the friends sysmodule when a local friends account is loaded with [[FRDA:LoadLocalAccount]] accordingly.
|-
| 0x00090001
| 0x8
| 0xE
| u64, Local friend code base value. This value is sent by the friends sysmodule to the friends gameserver during NEX account creation and serves as a means to find PIDs (and thus "online" friend codes) for other consoles' that were registered using [[FRDA:AddFriendOffline]] when those console(s) hadn't yet registered with the friends services at the time. The lower 34 bits are from [[Nandrw/sys/LocalFriendCodeSeed_B|LocalFriendCodeSeed]], and the upper 16 bits are from the LocalFriendCodeSeed counter (see below block, 0x90002). The remaining bits are left zero. This value is initialized as described by the CFG module when the LocalFriendCodeSeed part is zero. Used by [[Cfg:GenHashConsoleUnique|GenHashConsoleUnique]].
|-
| 0x00090002
| 0x4
| 0xE
| u16, Local friend code counter. This value is initialized by the CFG module alongside block 0x90001 to two random bytes generated by [[PS:GenerateRandomBytes]] and also serves as a component of that block. It is incremented by PTM and stored in MCU storage when PTM save data is formatted. Once incremented, upon reboot, PTM will use the counter stored in MCU storage to update the local friend code base value (block 0x90001). After updating the relevant configuration blocks, PTM sets the storage area reserved for the counter to 0.
|-
| 0x000A0000
| 0x1C
| 0xE
| [[#User Name Block 0x000A0000|User Name]]
|-
| 0x000A0001
| 0x2
| 0xE
| Birthday (u8 month, u8 day)
|-
| 0x000A0002
| 0x1
| 0xE
| Language
|-
| 0x000B0000
| 0x4
| 0xE
| CountryInfo
|-
| 0x000B0001
| 0x800
| 0xE
| Country name in UTF-16, every 0x80-bytes is an entry for each language, in the order of the Language table below (not all entries are set)
|-
| 0x000B0002
| 0x800
| 0xE
| State name in UTF-16, every 0x80-bytes is an entry for each language
|-
| 0x000B0003
| 0x4
| 0xE
| Coordinates. A pair of s16 represents latitude and longitude, respectively. One need to multiply both value by 180/32768 to get coordinates in degrees

|-
| 0x000C0000
| 0xC0
| 0xE
| [[#Parental Control Settings Block 0x000C0000|Parental Controls - Main data]]
|-
| 0x000C0001
| 0x14
| 0xE
| COPPACS restriction data
|-
| 0x000C0002
| 0x200
| 0xE
| [[#Parental Control Settings Block 0x000C0002|Parental Controls - Registered e-Mail address and custom secret question]]
|-
| 0x000D0000
| 0x4
| 0xE
| u16 at offset 0x0: [[SMDH#EULA_Version|EULA Version]] which was agreed to. u16 @ 0x02: latest version
|-
| 0x000E0000
| 0x1
| 0xE
| ? (related to SpotPass options in Internet Settings?)
|-
| 0x000F0000
| 0x10
| 0xC
| Debug configuration, read by [[NS]] on dev-units: on startup, NS does <code>svcKernelSetState(6, 1, (u64)debug_flags & 1);
svcKernelSetState(6, 2, (u64)debug_flags & 2);</code> (see [[SVC#KernelSetState|here]]) where <code>debug_flags</code> is the u32 located at offset 0xC in this struct. Then it compares the u32 from +8 in this config-block with the [[Configuration_Memory#APPMEMTYPE|APPMEMTYPE]]. When those don't match NS starts a FIRM-launch (with the same FIRM titleID as the currently running one) to boot into a FIRM with the APPMEMTYPE value from this config-block. The byte at offset 0x0 is related to the memtype as well.
|-
| 0x000F0001
| 0x8
| 0xC
| ?
|-
| 0x000F0003
| 0x1
| 0xC
| Home Menu button disable
|-
| 0x000F0004
| 0x4
| 0xC
| The first u8 is the System-Model [[Cfg:GetSystemModel|value]], the last 3-bytes are unknown
|-
| 0x000F0005
| 0x4
| 0xC
| The first u8 indicates whether network updates are enabled (however, NIM only checks this flag with developer [[Configuration_Memory#ENVINFO|ENVINFO]]).
|-
| 0x000F0006
| 0x28
| 0xC
| In NIM, taken as a (hopefully null terminated) string used for the "X-Device-Token" http header field for NPNS url.
|-
| 0x00100000
| 0x2
| 0xC
| TWL EULA info ({bool agreed; u8 agreedVersion})
|-
| 0x00100001
| 0x94
| 0xC
| Stores Parental Restrictions PIN/Secret Answer and other info for TWL mode
|-
| 0x00100002
| 0x1
| 0xC
| TWL country code
|-
| 0x00100003
| 0x10
| 0xC
| TWL movable unique ID, used for DSiWare exports
|-
| 0x00110000
| 0x4
| 0xC
| The low u16 indicates whether the system setup is required, such as when the system is booted for the first time or after doing a [[System Settings|System Format]]: 0 = setup required, non-zero = no setup required
|-
| 0x00110001
| 0x8
| 0xC
| TitleID of the menu to launch, used by [[NS]] on dev units (this block can be edited on dev units with [[3DS Development Unit Software#Config|Config]])
|-
| 0x00120000
| 0x8
| 0xC
| Volume Slider Bounds (Read by HID and PTM)
|-
| 0x00130000
| 0x4
| 0xE
| If response is 0x100 then debug mode is enabled.
|-
| 0x00150000
| 0x4
| 0xC
| Clock Sequence (u16) used for generating UUIDs in [[ACT_Services|ACT]].
|-
| 0x00150001
| 0x8
| 0xC
| ?
|-
| 0x00150002
| 0x4
| 0xE
| [[Friend_Services#Server_Types|NFS (Nintendo Friend Server) Environment]] in the format <code>%c%d</code>. Set by the [[ACT_Services|ACT]] sysmodule. Used in the [[NIM_Services#NIM|NIM]] sysmodule for making the NPNS URL.
|-
| 0x00160000
| 0x4
| 0xE
| Unknown, first byte is used by config service-cmd [[Config_Services|0x00070040]]. (Unknown whether the last 3-bytes are used)
|-
| 0x00170000
| 0x4
| 0xE
| Miiverse (OLV) access key
|-
| 0x00180000
| 0x4
| 0xC
| QTM Infrared LED related, can be 0 or 1
|-
| 0x00180001
| 0x18
| 0xC
| [[Hardware_calibration#QTM|QTM calibration data]]
|-
| 0x00190000
| 0x1
| 0xC
| Unknown. NFC-module checks for value1/non-value1.
|}

The developer unit TID block only exists on developer units.

===Stereo Display Settings===
All values are hard-coded in cfg module.
{| class="wikitable" border="1"
|-
! Offset
! Size
! Value
! Description
|-
| 0x0
| 4
| 62.0f
|assumed pupillary distance in mm?
|-
| 0x4
| 4
| 289.0f
|assumed distance in mm between player's eyes and upper screen?
|-
| 0x8
| 4
| 76.80f
|width in mm of (old) 3DS upper screen (doesn't vary for different models?)
|-
| 0xC
| 4
| 46.08f
|height in mm of (old) 3DS upper screen (doesn't vary for different models?)
|-
| 0x10
| 4
| 10.0f
|
|-
| 0x14
| 4
| 5.0f
|
|-
| 0x18
| 4
| 55.58f
|
|-
| 0x1C
| 4
| 21.57f
|
|}

===Languages===
{| class="wikitable" border="1"
|-
! ID
! Description
|-
| 0
| JP
|-
| 1
| EN
|-
| 2
| FR
|-
| 3
| DE
|-
| 4
| IT
|-
| 5
| ES
|-
| 6
| ZH
|-
| 7
| KO
|-
| 8
| NL
|-
| 9
| PT
|-
| 10
| RU
|-
| 11
| TW
|}

===CountryInfo===
{| class="wikitable" border="1"
|-
! Byte
! Description
|-
| 0
|?
|-
| 1
|?
|-
| 2
| State/Province code.
|-
| 3
| Country code, same as DSi/Wii country codes. Value 0xFF is invalid.
|}

===User Name Block 0x000A0000===
{| class="wikitable" border="1"
|-
! Byte
! Description
|-
| 0x00-0x15
| User name (UTF-16)
|-
| 0x16-0x17
| u16 NGWord flag to denote that the user name is inappropriate
|-
| 0x18-0x1B
| u32 NGWord version the username was last checked with. If this value is less than the u32 stored in the NGWord CFA "romfs:/version.dat", the system then checks the username string with the bad-word list CFA again, then updates this field with the value from the CFA
|}

While the user name is NULL-terminated, the terminator is not applied when the user name is 10 characters long, which leads to online access breaking (002-0109) and buffer overflows when the user name is retrieved, even in DS games.

===WiFi Slot Structure===

====Network structure====
This is used twice in the actual WiFi slot structure.
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| Whether the network was set or not?
|-
| 0x1
| 0x1
| Whether to use this network strucutre to connect?
|-
| 0x2
| 0x1
| Whether this structure is the first (0) or the second (1) in the larger WiFi slot structure?
|-
| 0x3
| 0x1
| Padding ?
|-
| 0x4
| 0x20
| SSID of the network, without a trailing nullbyte.
|-
| 0x24
| 0x1
| Length of the SSID.
|-
| 0x25
| 0x1
| [[Nintendo_Zone#Beacon_payload_format|AP crypto key type]]
|-
| 0x26
| 0x2
| Padding ?
|-
| 0x28
| 0x40
| Plaintext of the passphrase of the network, without a trailing nullbyte.
|-
| 0x68
| 0x20
| PBKDF2 of the passphrase and SSID (http://jorisvr.nl/wpapsk.html).
|-
|}

====Actual structure====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x2
| ?
|-
| 0x2
| 0x2
| [https://github.com/lammertb/libcrc/blob/v2.0/src/crc16.c#L43-L76 CRC-16 checksum] of the next 0x410 bytes.
|-
| 0x4
| 0x88
| First network structure. Only set if the network was set "normally", or was the last to be set using WPS during the session.
|-
| 0x8C
| 0x20
| Padding.
|-
| 0xAC
| 0x88
| Second network structure. Only set if the network was set using WPS, otherwise 0-filled.
|-
| 0x134
| 0x20C
| Padding.
|-
| 0x340
| 0x1
| Whether to automatically get the IP address (use DHCP) or not, defaults to 1.
|-
| 0x341
| 0x1
| Whether to automatically get the DNS or not, defaults to 1.
|-
| 0x342
| 0x2
| Padding ?
|-
| 0x344
| 0x4
| IP address, to use if 0x340 is false.
|-
| 0x348
| 0x4
| IP address of the gateway, to use if 0x340 is false.
|-
| 0x34C
| 0x4
| Subnetwork mask, to use if 0x340 is false.
|-
| 0x350
| 0x4
| IP address of the primary DNS , to use if 0x341 is false.
|-
| 0x354
| 0x4
| IP address of the secondary DNS, to use if 0x341 is false.
|-
| 0x358
| 0x4
| Always 0x01050000 ? Only set if the network was the last to be set during the session.
|-
| 0x35C
| 0x4
| IP address to use. Only set if the network was the last to be set during the session.
|-
| 0x360
| 0x6
| MAC address of the AP. Only set if the network was the last to be set during the session.
|-
| 0x366
| 0x1
| Channel. Only set if the network was the last to be set during the session.
|-
| 0x367
| 0x1
| Padding ? Only set if the network was the last to be set during the session.
|-
| 0x368
| 0x1
| Whether to use a proxy or not, defaults to 0.
|-
| 0x369
| 0x1
| Whether to use a basic authentication for the proxy, defaults to 0.
|-
| 0x36A
| 0x2
| Port to use for the proxy, defaults to 1.
|-
| 0x36C
| 0x30
| URL/address of the proxy, including a trailing nullbyte.
|-
| 0x39C
| 0x34
| Padding.
|-
| 0x3D0
| 0x20
| Username to use for basic authentication, including a trailing nullbyte.
|-
| 0x3F0
| 0x20
| Password to use for basic authentication, including a trailing nullbyte.
|-
| 0x410
| 0x2
| Padding ?
|-
| 0x412
| 0x2
| MTU value, defaults to 1400 and ranges between 576 and 1500, inclusive.
|-
| 0x414
| 0x7EC
| Padding.
|-
|}

===LCD display config===
There seems to be some sort of LCD display configuration stored in this cfg. When using the cfg-save from an Old3DS on a New3DS without formatting the cfg first, the bottom-screen display is somewhat off(which is fixed by formatting the cfg-save).

===Parental Control Settings Block 0x00100001===
{| class="wikitable" border="1"
|-
! Byte
! Size in bytes
! Description
|-
| 0x0
| 0xD
| Unknown.
|-
| 0xD
| 0x4
| PIN
|-
| 0x11
| 0x40
| Secret Answer (UTF-16)
|}

===Parental Control Settings Block 0x000C0000===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x00
| 0x04
| [[#Parental Control Restriction Bitmask|Parental Control Restriction Bitmask]]
|-
| 0x04
| 0x04
| Unknown
|-
| 0x08
| 0x01
| Rating system used for configuration
|-
| 0x09
| 0x01
| Maximum allowed age (20 = No restriction)
|-
| 0x0A
| 0x01
| Secret Question Type (0-5: Pre-defined, 6: Custom)
|-
| 0x0B
| 0x01
| Unknown
|-
| 0x0C
| 0x08
| Parental Controls PIN code (with NULL-termination, although restricted to 4 digits)
|-
| 0x14
| 0x44
| Secret Answer (UTF-16)
|}

====Parental Control Restriction Bitmask====
{| class="wikitable" border="1"
|-
! Bit
! Restriction name
|-
| 0
| Global Parental Controls Enable
|-
| 1
| Internet Browser
|-
| 2
| Display of 3D Images (disabled on 2DS)
|-
| 3
| Sharing Images/Audio/Video/Long Text Data
|-
| 4
| Online Interaction
|-
| 5
| StreetPass
|-
| 6
| Friend Registration
|-
| 7
| DS Download Play
|-
| 8
| Nintendo 3DS Shopping Services (eShop / EC Applet)
|-
| 9
| View Distributed Videos
|-
| 10
| Miiverse (View)
|-
| 11
| Miiverse (Post)
|-
| 31
| "Child Online Privacy Protection" (see [[Cfg:GetRegionCanadaUSA|CFG:IsCoppacsSupported]])
|}

===Parental Control Settings Block 0x000C0002===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0000
| 0x0001
| Boolean, whether an e-Mail has been registered
|-
| 0x0001
| 0x0101
| Registered e-Mail address (Plaintext)
|-
| 0x0102
| 0x0068
| Custom Secret Question (UTF-16)
|}

Config Savegame

2026-06-23T18:04:51Z

TimmSkiller: Correct information regarding local friend code/(base/counter)

This page describes the format of the [[Config_Services|Cfg]] [[System_SaveData|NAND]] savegame. These blocks can be accessed with the Cfg service commands.

==Structure of save-file "/config"==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x2
| Total entries
|-
| 0x2
| 0x2
| Data entries offset
|-
| 0x4
| 0x4558
| Block entries
|-
| 0x455C
|
| Data for the entries
|}

The filesize for this /config file is 0x8000-bytes.

==Configuration block entry ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| BlkID
|-
| 0x4
| 0x4
| Offset to the data for this block when size is >4, otherwise this word is the data for this block
|-
| 0x8
| 0x2
| Size
|-
| 0xA
| 0x2
| Access Flags
|}

===Access Flags===
{| class="wikitable" border="1"
|-
! Bit Mask
! Description
|-
| 0x2
| User Readable (cfg:u)
|-
| 0x4
| System Writable (cfg:s / cfg:i)
|-
| 0x8
| System Readable (cfg:s / cfg:i)
|}

Config blocks will typically either use 0xC for system readable/writable or 0xE for all 3.

==Configuration blocks==
{| class="wikitable" border="1"
|-
! BlkID
! Size
! Access Flags
! Description
|-
| 0x00000000
| 0x2
| 0xC
| Config savegame version?
|-
| 0x00010000
| 0x1
| 0xC
| [[Hardware_calibration#RTC|RTC compensation value]]
|-
| 0x00020000
| 0x134
| 0xC
| [[Hardware_calibration#CDC|Codec]]
|-
| 0x00030000
| 0x1
| 0xC
| Leap Year Counter (read By PTM)
|-
| 0x00030001
| 0x8
| 0xE
| User time offset (read by CECD): displayed timestamp - rtc timestamp
|-
| 0x00030002
| 0x8
| 0xC
| Difference (in nanoseconds) between UTC server time and RTC time. Updated by [[Friend_Services|the Friends sysmodule]] after every [[Online_Play|NASC]] login. Used by System settings to calculate the real current time according to the online play authentication server, in order to determine the user's actual age based on the given date of birth (related to COPPA, since this is used to check whether the user is at least 13 years old).
|-
| 0x00040000
| 0x10
| 0xC
| [[Hardware_calibration#Touch|Touch calibration]] (read by HID)
|-
| 0x00040001
| 0x1C
| 0xC
| Analog Stick Calibration Param?(read by HID)
|-
| 0x00040002
| 0x12
| 0xC
| [[Hardware_calibration#Gyro|Gyroscope]] (read by HID)
|-
| 0x00040003
| 0xC
| 0xC
| [[Hardware_calibration#Accel|Accelerometer]] (read by HID)
|-
| 0x00040004
| 0x1C
| 0xC
| [[Hardware_calibration#CStick|CStick calibration data]]
|-
| 0x00050000
| 0x2
| 0xC
| [[Hardware_calibration#Screen_flicker|Screen flicker]]
|-
| 0x00050001
| 0x2
| 0xC
| Backlight controls (u8 ABL_powersave_enable, u8 brightness_level) (read by GSP)
|-
| 0x00050002
| 0x38
| 0xC
| [[Hardware_calibration#BLPWM|Backlight PWM]] (read by GSP)
|-
| 0x00050003
| 0x20
| 0xC
| [[Hardware_calibration#ABL|Power saving mode (ABL) calibration]] (read by GSP)
|-
| 0x00050004
| 0x20
| 0xC
| [[Hardware_calibration#ABL|Power saving mode (ABL) calibration]] (for legacy FIRM)
|-
| 0x00050005
| 0x20
| 0xE
| Stereo display settings (HWCAL block 0x470)
|-
| 0x00050006
| 0x2
| 0xC
| [[Hardware_calibration#ULCD_delay|3D switching delay]]
|-
| 0x00050007
| 0x4
| 0xC
| ?
|-
| 0x00050008
| 0x10C
| 0xC
| [[Hardware_calibration#ABL_extra|Power saving mode (ABL) extra config]]
|-
| 0x00050009
| 0x8
| 0xC
| new3DS only(?) backlight control (5th byte: auto-brightness enable)
|-
| 0x00060000
| 0x96
| 0xC
| ??? (HWCAL block 0x500)
|-
| 0x00070000
| 0x214
| 0xE
| [[Hardware_calibration#3D_filters|3D filters]]
|-
| 0x00070001
| 0x1
| 0xE
| Sound output mode (mono=0, stereo=1, surround=2)
|-
| 0x00070002
| 0x8
| 0xE
| [[Hardware_calibration#Microphone_echo_cancel|Microphone echo cancellation params]]
|-
| 0x00080000
| 0xC00
| 0xC
| WiFi configuration slot 0
|-
| 0x00080001
| 0xC00
| 0xC
| WiFi configuration slot 1
|-
| 0x00080002
| 0xC00
| 0xC
| WiFi configuration slot 2
|-
| 0x00090000
| 0x8
| 0xE
| u64, Current local friend code. Updated by the friends sysmodule when a local friends account is loaded with [[FRDA:LoadLocalAccount]] accordingly.
|-
| 0x00090001
| 0x8
| 0xE
| u64, Local friend code base value. This value is sent by the friends sysmodule to the friends gameserver during NEX account creation and serves as a means to find PIDs (and thus "online" friend codes) for other consoles' that were registered using [[FRDA:AddFriendOffline]] when those console(s) hadn't yet registered with the friends services at the time. The lower 48 bits are from [[Nandrw/sys/LocalFriendCodeSeed_B|LocalFriendCodeSeed]], and the upper 16 bits are from the LocalFriendCodeSeed counter (see below block, 0x90002). This value is initialized as described by the CFG module when the LocalFriendCodeSeed part is zero. Used by [[Cfg:GenHashConsoleUnique|GenHashConsoleUnique]].
|-
| 0x00090002
| 0x4
| 0xE
| u16, Local friend code counter. This value is initialized by the CFG module alongside block 0x90001 to two random bytes generated by [[PS:GenerateRandomBytes]] and also serves as a component of that block. It is incremented by PTM and stored in MCU storage when PTM save data is formatted. Once incremented, upon reboot, PTM will use the counter stored in MCU storage to update the local friend code base value (block 0x90001). After updating the relevant configuration blocks, PTM sets the storage area reserved for the counter to 0.
|-
| 0x000A0000
| 0x1C
| 0xE
| [[#User Name Block 0x000A0000|User Name]]
|-
| 0x000A0001
| 0x2
| 0xE
| Birthday (u8 month, u8 day)
|-
| 0x000A0002
| 0x1
| 0xE
| Language
|-
| 0x000B0000
| 0x4
| 0xE
| CountryInfo
|-
| 0x000B0001
| 0x800
| 0xE
| Country name in UTF-16, every 0x80-bytes is an entry for each language, in the order of the Language table below (not all entries are set)
|-
| 0x000B0002
| 0x800
| 0xE
| State name in UTF-16, every 0x80-bytes is an entry for each language
|-
| 0x000B0003
| 0x4
| 0xE
| Coordinates. A pair of s16 represents latitude and longitude, respectively. One need to multiply both value by 180/32768 to get coordinates in degrees

|-
| 0x000C0000
| 0xC0
| 0xE
| [[#Parental Control Settings Block 0x000C0000|Parental Controls - Main data]]
|-
| 0x000C0001
| 0x14
| 0xE
| COPPACS restriction data
|-
| 0x000C0002
| 0x200
| 0xE
| [[#Parental Control Settings Block 0x000C0002|Parental Controls - Registered e-Mail address and custom secret question]]
|-
| 0x000D0000
| 0x4
| 0xE
| u16 at offset 0x0: [[SMDH#EULA_Version|EULA Version]] which was agreed to. u16 @ 0x02: latest version
|-
| 0x000E0000
| 0x1
| 0xE
| ? (related to SpotPass options in Internet Settings?)
|-
| 0x000F0000
| 0x10
| 0xC
| Debug configuration, read by [[NS]] on dev-units: on startup, NS does <code>svcKernelSetState(6, 1, (u64)debug_flags & 1);
svcKernelSetState(6, 2, (u64)debug_flags & 2);</code> (see [[SVC#KernelSetState|here]]) where <code>debug_flags</code> is the u32 located at offset 0xC in this struct. Then it compares the u32 from +8 in this config-block with the [[Configuration_Memory#APPMEMTYPE|APPMEMTYPE]]. When those don't match NS starts a FIRM-launch (with the same FIRM titleID as the currently running one) to boot into a FIRM with the APPMEMTYPE value from this config-block. The byte at offset 0x0 is related to the memtype as well.
|-
| 0x000F0001
| 0x8
| 0xC
| ?
|-
| 0x000F0003
| 0x1
| 0xC
| Home Menu button disable
|-
| 0x000F0004
| 0x4
| 0xC
| The first u8 is the System-Model [[Cfg:GetSystemModel|value]], the last 3-bytes are unknown
|-
| 0x000F0005
| 0x4
| 0xC
| The first u8 indicates whether network updates are enabled (however, NIM only checks this flag with developer [[Configuration_Memory#ENVINFO|ENVINFO]]).
|-
| 0x000F0006
| 0x28
| 0xC
| In NIM, taken as a (hopefully null terminated) string used for the "X-Device-Token" http header field for NPNS url.
|-
| 0x00100000
| 0x2
| 0xC
| TWL EULA info ({bool agreed; u8 agreedVersion})
|-
| 0x00100001
| 0x94
| 0xC
| Stores Parental Restrictions PIN/Secret Answer and other info for TWL mode
|-
| 0x00100002
| 0x1
| 0xC
| TWL country code
|-
| 0x00100003
| 0x10
| 0xC
| TWL movable unique ID, used for DSiWare exports
|-
| 0x00110000
| 0x4
| 0xC
| The low u16 indicates whether the system setup is required, such as when the system is booted for the first time or after doing a [[System Settings|System Format]]: 0 = setup required, non-zero = no setup required
|-
| 0x00110001
| 0x8
| 0xC
| TitleID of the menu to launch, used by [[NS]] on dev units (this block can be edited on dev units with [[3DS Development Unit Software#Config|Config]])
|-
| 0x00120000
| 0x8
| 0xC
| Volume Slider Bounds (Read by HID and PTM)
|-
| 0x00130000
| 0x4
| 0xE
| If response is 0x100 then debug mode is enabled.
|-
| 0x00150000
| 0x4
| 0xC
| Clock Sequence (u16) used for generating UUIDs in [[ACT_Services|ACT]].
|-
| 0x00150001
| 0x8
| 0xC
| ?
|-
| 0x00150002
| 0x4
| 0xE
| [[Friend_Services#Server_Types|NFS (Nintendo Friend Server) Environment]] in the format <code>%c%d</code>. Set by the [[ACT_Services|ACT]] sysmodule. Used in the [[NIM_Services#NIM|NIM]] sysmodule for making the NPNS URL.
|-
| 0x00160000
| 0x4
| 0xE
| Unknown, first byte is used by config service-cmd [[Config_Services|0x00070040]]. (Unknown whether the last 3-bytes are used)
|-
| 0x00170000
| 0x4
| 0xE
| Miiverse (OLV) access key
|-
| 0x00180000
| 0x4
| 0xC
| QTM Infrared LED related, can be 0 or 1
|-
| 0x00180001
| 0x18
| 0xC
| [[Hardware_calibration#QTM|QTM calibration data]]
|-
| 0x00190000
| 0x1
| 0xC
| Unknown. NFC-module checks for value1/non-value1.
|}

The developer unit TID block only exists on developer units.

===Stereo Display Settings===
All values are hard-coded in cfg module.
{| class="wikitable" border="1"
|-
! Offset
! Size
! Value
! Description
|-
| 0x0
| 4
| 62.0f
|assumed pupillary distance in mm?
|-
| 0x4
| 4
| 289.0f
|assumed distance in mm between player's eyes and upper screen?
|-
| 0x8
| 4
| 76.80f
|width in mm of (old) 3DS upper screen (doesn't vary for different models?)
|-
| 0xC
| 4
| 46.08f
|height in mm of (old) 3DS upper screen (doesn't vary for different models?)
|-
| 0x10
| 4
| 10.0f
|
|-
| 0x14
| 4
| 5.0f
|
|-
| 0x18
| 4
| 55.58f
|
|-
| 0x1C
| 4
| 21.57f
|
|}

===Languages===
{| class="wikitable" border="1"
|-
! ID
! Description
|-
| 0
| JP
|-
| 1
| EN
|-
| 2
| FR
|-
| 3
| DE
|-
| 4
| IT
|-
| 5
| ES
|-
| 6
| ZH
|-
| 7
| KO
|-
| 8
| NL
|-
| 9
| PT
|-
| 10
| RU
|-
| 11
| TW
|}

===CountryInfo===
{| class="wikitable" border="1"
|-
! Byte
! Description
|-
| 0
|?
|-
| 1
|?
|-
| 2
| State/Province code.
|-
| 3
| Country code, same as DSi/Wii country codes. Value 0xFF is invalid.
|}

===User Name Block 0x000A0000===
{| class="wikitable" border="1"
|-
! Byte
! Description
|-
| 0x00-0x15
| User name (UTF-16)
|-
| 0x16-0x17
| u16 NGWord flag to denote that the user name is inappropriate
|-
| 0x18-0x1B
| u32 NGWord version the username was last checked with. If this value is less than the u32 stored in the NGWord CFA "romfs:/version.dat", the system then checks the username string with the bad-word list CFA again, then updates this field with the value from the CFA
|}

While the user name is NULL-terminated, the terminator is not applied when the user name is 10 characters long, which leads to online access breaking (002-0109) and buffer overflows when the user name is retrieved, even in DS games.

===WiFi Slot Structure===

====Network structure====
This is used twice in the actual WiFi slot structure.
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| Whether the network was set or not?
|-
| 0x1
| 0x1
| Whether to use this network strucutre to connect?
|-
| 0x2
| 0x1
| Whether this structure is the first (0) or the second (1) in the larger WiFi slot structure?
|-
| 0x3
| 0x1
| Padding ?
|-
| 0x4
| 0x20
| SSID of the network, without a trailing nullbyte.
|-
| 0x24
| 0x1
| Length of the SSID.
|-
| 0x25
| 0x1
| [[Nintendo_Zone#Beacon_payload_format|AP crypto key type]]
|-
| 0x26
| 0x2
| Padding ?
|-
| 0x28
| 0x40
| Plaintext of the passphrase of the network, without a trailing nullbyte.
|-
| 0x68
| 0x20
| PBKDF2 of the passphrase and SSID (http://jorisvr.nl/wpapsk.html).
|-
|}

====Actual structure====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x2
| ?
|-
| 0x2
| 0x2
| [https://github.com/lammertb/libcrc/blob/v2.0/src/crc16.c#L43-L76 CRC-16 checksum] of the next 0x410 bytes.
|-
| 0x4
| 0x88
| First network structure. Only set if the network was set "normally", or was the last to be set using WPS during the session.
|-
| 0x8C
| 0x20
| Padding.
|-
| 0xAC
| 0x88
| Second network structure. Only set if the network was set using WPS, otherwise 0-filled.
|-
| 0x134
| 0x20C
| Padding.
|-
| 0x340
| 0x1
| Whether to automatically get the IP address (use DHCP) or not, defaults to 1.
|-
| 0x341
| 0x1
| Whether to automatically get the DNS or not, defaults to 1.
|-
| 0x342
| 0x2
| Padding ?
|-
| 0x344
| 0x4
| IP address, to use if 0x340 is false.
|-
| 0x348
| 0x4
| IP address of the gateway, to use if 0x340 is false.
|-
| 0x34C
| 0x4
| Subnetwork mask, to use if 0x340 is false.
|-
| 0x350
| 0x4
| IP address of the primary DNS , to use if 0x341 is false.
|-
| 0x354
| 0x4
| IP address of the secondary DNS, to use if 0x341 is false.
|-
| 0x358
| 0x4
| Always 0x01050000 ? Only set if the network was the last to be set during the session.
|-
| 0x35C
| 0x4
| IP address to use. Only set if the network was the last to be set during the session.
|-
| 0x360
| 0x6
| MAC address of the AP. Only set if the network was the last to be set during the session.
|-
| 0x366
| 0x1
| Channel. Only set if the network was the last to be set during the session.
|-
| 0x367
| 0x1
| Padding ? Only set if the network was the last to be set during the session.
|-
| 0x368
| 0x1
| Whether to use a proxy or not, defaults to 0.
|-
| 0x369
| 0x1
| Whether to use a basic authentication for the proxy, defaults to 0.
|-
| 0x36A
| 0x2
| Port to use for the proxy, defaults to 1.
|-
| 0x36C
| 0x30
| URL/address of the proxy, including a trailing nullbyte.
|-
| 0x39C
| 0x34
| Padding.
|-
| 0x3D0
| 0x20
| Username to use for basic authentication, including a trailing nullbyte.
|-
| 0x3F0
| 0x20
| Password to use for basic authentication, including a trailing nullbyte.
|-
| 0x410
| 0x2
| Padding ?
|-
| 0x412
| 0x2
| MTU value, defaults to 1400 and ranges between 576 and 1500, inclusive.
|-
| 0x414
| 0x7EC
| Padding.
|-
|}

===LCD display config===
There seems to be some sort of LCD display configuration stored in this cfg. When using the cfg-save from an Old3DS on a New3DS without formatting the cfg first, the bottom-screen display is somewhat off(which is fixed by formatting the cfg-save).

===Parental Control Settings Block 0x00100001===
{| class="wikitable" border="1"
|-
! Byte
! Size in bytes
! Description
|-
| 0x0
| 0xD
| Unknown.
|-
| 0xD
| 0x4
| PIN
|-
| 0x11
| 0x40
| Secret Answer (UTF-16)
|}

===Parental Control Settings Block 0x000C0000===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x00
| 0x04
| [[#Parental Control Restriction Bitmask|Parental Control Restriction Bitmask]]
|-
| 0x04
| 0x04
| Unknown
|-
| 0x08
| 0x01
| Rating system used for configuration
|-
| 0x09
| 0x01
| Maximum allowed age (20 = No restriction)
|-
| 0x0A
| 0x01
| Secret Question Type (0-5: Pre-defined, 6: Custom)
|-
| 0x0B
| 0x01
| Unknown
|-
| 0x0C
| 0x08
| Parental Controls PIN code (with NULL-termination, although restricted to 4 digits)
|-
| 0x14
| 0x44
| Secret Answer (UTF-16)
|}

====Parental Control Restriction Bitmask====
{| class="wikitable" border="1"
|-
! Bit
! Restriction name
|-
| 0
| Global Parental Controls Enable
|-
| 1
| Internet Browser
|-
| 2
| Display of 3D Images (disabled on 2DS)
|-
| 3
| Sharing Images/Audio/Video/Long Text Data
|-
| 4
| Online Interaction
|-
| 5
| StreetPass
|-
| 6
| Friend Registration
|-
| 7
| DS Download Play
|-
| 8
| Nintendo 3DS Shopping Services (eShop / EC Applet)
|-
| 9
| View Distributed Videos
|-
| 10
| Miiverse (View)
|-
| 11
| Miiverse (Post)
|-
| 31
| "Child Online Privacy Protection" (see [[Cfg:GetRegionCanadaUSA|CFG:IsCoppacsSupported]])
|}

===Parental Control Settings Block 0x000C0002===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0000
| 0x0001
| Boolean, whether an e-Mail has been registered
|-
| 0x0001
| 0x0101
| Registered e-Mail address (Plaintext)
|-
| 0x0102
| 0x0068
| Custom Secret Question (UTF-16)
|}

Config Savegame

2026-06-23T12:14:12Z

TimmSkiller: Update description for local friend code counter

This page describes the format of the [[Config_Services|Cfg]] [[System_SaveData|NAND]] savegame. These blocks can be accessed with the Cfg service commands.

==Structure of save-file "/config"==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x2
| Total entries
|-
| 0x2
| 0x2
| Data entries offset
|-
| 0x4
| 0x4558
| Block entries
|-
| 0x455C
|
| Data for the entries
|}

The filesize for this /config file is 0x8000-bytes.

==Configuration block entry ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| BlkID
|-
| 0x4
| 0x4
| Offset to the data for this block when size is >4, otherwise this word is the data for this block
|-
| 0x8
| 0x2
| Size
|-
| 0xA
| 0x2
| Access Flags
|}

===Access Flags===
{| class="wikitable" border="1"
|-
! Bit Mask
! Description
|-
| 0x2
| User Readable (cfg:u)
|-
| 0x4
| System Writable (cfg:s / cfg:i)
|-
| 0x8
| System Readable (cfg:s / cfg:i)
|}

Config blocks will typically either use 0xC for system readable/writable or 0xE for all 3.

==Configuration blocks==
{| class="wikitable" border="1"
|-
! BlkID
! Size
! Access Flags
! Description
|-
| 0x00000000
| 0x2
| 0xC
| Config savegame version?
|-
| 0x00010000
| 0x1
| 0xC
| [[Hardware_calibration#RTC|RTC compensation value]]
|-
| 0x00020000
| 0x134
| 0xC
| [[Hardware_calibration#CDC|Codec]]
|-
| 0x00030000
| 0x1
| 0xC
| Leap Year Counter (read By PTM)
|-
| 0x00030001
| 0x8
| 0xE
| User time offset (read by CECD): displayed timestamp - rtc timestamp
|-
| 0x00030002
| 0x8
| 0xC
| Difference (in nanoseconds) between UTC server time and RTC time. Updated by [[Friend_Services|the Friends sysmodule]] after every [[Online_Play|NASC]] login. Used by System settings to calculate the real current time according to the online play authentication server, in order to determine the user's actual age based on the given date of birth (related to COPPA, since this is used to check whether the user is at least 13 years old).
|-
| 0x00040000
| 0x10
| 0xC
| [[Hardware_calibration#Touch|Touch calibration]] (read by HID)
|-
| 0x00040001
| 0x1C
| 0xC
| Analog Stick Calibration Param?(read by HID)
|-
| 0x00040002
| 0x12
| 0xC
| [[Hardware_calibration#Gyro|Gyroscope]] (read by HID)
|-
| 0x00040003
| 0xC
| 0xC
| [[Hardware_calibration#Accel|Accelerometer]] (read by HID)
|-
| 0x00040004
| 0x1C
| 0xC
| [[Hardware_calibration#CStick|CStick calibration data]]
|-
| 0x00050000
| 0x2
| 0xC
| [[Hardware_calibration#Screen_flicker|Screen flicker]]
|-
| 0x00050001
| 0x2
| 0xC
| Backlight controls (u8 ABL_powersave_enable, u8 brightness_level) (read by GSP)
|-
| 0x00050002
| 0x38
| 0xC
| [[Hardware_calibration#BLPWM|Backlight PWM]] (read by GSP)
|-
| 0x00050003
| 0x20
| 0xC
| [[Hardware_calibration#ABL|Power saving mode (ABL) calibration]] (read by GSP)
|-
| 0x00050004
| 0x20
| 0xC
| [[Hardware_calibration#ABL|Power saving mode (ABL) calibration]] (for legacy FIRM)
|-
| 0x00050005
| 0x20
| 0xE
| Stereo display settings (HWCAL block 0x470)
|-
| 0x00050006
| 0x2
| 0xC
| [[Hardware_calibration#ULCD_delay|3D switching delay]]
|-
| 0x00050007
| 0x4
| 0xC
| ?
|-
| 0x00050008
| 0x10C
| 0xC
| [[Hardware_calibration#ABL_extra|Power saving mode (ABL) extra config]]
|-
| 0x00050009
| 0x8
| 0xC
| new3DS only(?) backlight control (5th byte: auto-brightness enable)
|-
| 0x00060000
| 0x96
| 0xC
| ??? (HWCAL block 0x500)
|-
| 0x00070000
| 0x214
| 0xE
| [[Hardware_calibration#3D_filters|3D filters]]
|-
| 0x00070001
| 0x1
| 0xE
| Sound output mode (mono=0, stereo=1, surround=2)
|-
| 0x00070002
| 0x8
| 0xE
| [[Hardware_calibration#Microphone_echo_cancel|Microphone echo cancellation params]]
|-
| 0x00080000
| 0xC00
| 0xC
| WiFi configuration slot 0
|-
| 0x00080001
| 0xC00
| 0xC
| WiFi configuration slot 1
|-
| 0x00080002
| 0xC00
| 0xC
| WiFi configuration slot 2
|-
| 0x00090000
| 0x8
| 0xE
| This contains a u64 ID, used by processes using [[NWMUDS:InitializeWithVersion]]. The first word is the same as [[CfgS:GetLocalFriendCodeSeed|LocalFriendCodeSeed]], while the latter is a separate word.
|-
| 0x00090001
| 0x8
| 0xE
| Local friend code. This console-unique u64 is used by [[Cfg:GenHashConsoleUnique|GenHashConsoleUnique]]. It is generated by <code>((0x3FFFFFFFF) & LocalFriendCodeSeed) | (LocalFriendCodeCounter << 48))</code>, where LocalFriendCodeCounter is generated by [[PSPXI:GenerateRandomBytes|GenerateRandomBytes]]
|-
| 0x00090002
| 0x4
| 0xE
| u16, Local friend code counter. Incremented by PTM and stored in MCU storage when PTM save data is formatted. Once incremented, upon reboot, PTM will use the counter stored in MCU storage to update the local friend code (block 0x90001).
|-
| 0x000A0000
| 0x1C
| 0xE
| [[#User Name Block 0x000A0000|User Name]]
|-
| 0x000A0001
| 0x2
| 0xE
| Birthday (u8 month, u8 day)
|-
| 0x000A0002
| 0x1
| 0xE
| Language
|-
| 0x000B0000
| 0x4
| 0xE
| CountryInfo
|-
| 0x000B0001
| 0x800
| 0xE
| Country name in UTF-16, every 0x80-bytes is an entry for each language, in the order of the Language table below (not all entries are set)
|-
| 0x000B0002
| 0x800
| 0xE
| State name in UTF-16, every 0x80-bytes is an entry for each language
|-
| 0x000B0003
| 0x4
| 0xE
| Coordinates. A pair of s16 represents latitude and longitude, respectively. One need to multiply both value by 180/32768 to get coordinates in degrees

|-
| 0x000C0000
| 0xC0
| 0xE
| [[#Parental Control Settings Block 0x000C0000|Parental Controls - Main data]]
|-
| 0x000C0001
| 0x14
| 0xE
| COPPACS restriction data
|-
| 0x000C0002
| 0x200
| 0xE
| [[#Parental Control Settings Block 0x000C0002|Parental Controls - Registered e-Mail address and custom secret question]]
|-
| 0x000D0000
| 0x4
| 0xE
| u16 at offset 0x0: [[SMDH#EULA_Version|EULA Version]] which was agreed to. u16 @ 0x02: latest version
|-
| 0x000E0000
| 0x1
| 0xE
| ? (related to SpotPass options in Internet Settings?)
|-
| 0x000F0000
| 0x10
| 0xC
| Debug configuration, read by [[NS]] on dev-units: on startup, NS does <code>svcKernelSetState(6, 1, (u64)debug_flags & 1);
svcKernelSetState(6, 2, (u64)debug_flags & 2);</code> (see [[SVC#KernelSetState|here]]) where <code>debug_flags</code> is the u32 located at offset 0xC in this struct. Then it compares the u32 from +8 in this config-block with the [[Configuration_Memory#APPMEMTYPE|APPMEMTYPE]]. When those don't match NS starts a FIRM-launch (with the same FIRM titleID as the currently running one) to boot into a FIRM with the APPMEMTYPE value from this config-block. The byte at offset 0x0 is related to the memtype as well.
|-
| 0x000F0001
| 0x8
| 0xC
| ?
|-
| 0x000F0003
| 0x1
| 0xC
| Home Menu button disable
|-
| 0x000F0004
| 0x4
| 0xC
| The first u8 is the System-Model [[Cfg:GetSystemModel|value]], the last 3-bytes are unknown
|-
| 0x000F0005
| 0x4
| 0xC
| The first u8 indicates whether network updates are enabled (however, NIM only checks this flag with developer [[Configuration_Memory#ENVINFO|ENVINFO]]).
|-
| 0x000F0006
| 0x28
| 0xC
| In NIM, taken as a (hopefully null terminated) string used for the "X-Device-Token" http header field for NPNS url.
|-
| 0x00100000
| 0x2
| 0xC
| TWL EULA info ({bool agreed; u8 agreedVersion})
|-
| 0x00100001
| 0x94
| 0xC
| Stores Parental Restrictions PIN/Secret Answer and other info for TWL mode
|-
| 0x00100002
| 0x1
| 0xC
| TWL country code
|-
| 0x00100003
| 0x10
| 0xC
| TWL movable unique ID, used for DSiWare exports
|-
| 0x00110000
| 0x4
| 0xC
| The low u16 indicates whether the system setup is required, such as when the system is booted for the first time or after doing a [[System Settings|System Format]]: 0 = setup required, non-zero = no setup required
|-
| 0x00110001
| 0x8
| 0xC
| TitleID of the menu to launch, used by [[NS]] on dev units (this block can be edited on dev units with [[3DS Development Unit Software#Config|Config]])
|-
| 0x00120000
| 0x8
| 0xC
| Volume Slider Bounds (Read by HID and PTM)
|-
| 0x00130000
| 0x4
| 0xE
| If response is 0x100 then debug mode is enabled.
|-
| 0x00150000
| 0x4
| 0xC
| Clock Sequence (u16) used for generating UUIDs in [[ACT_Services|ACT]].
|-
| 0x00150001
| 0x8
| 0xC
| ?
|-
| 0x00150002
| 0x4
| 0xE
| [[Friend_Services#Server_Types|NFS (Nintendo Friend Server) Environment]] in the format <code>%c%d</code>. Set by the [[ACT_Services|ACT]] sysmodule. Used in the [[NIM_Services#NIM|NIM]] sysmodule for making the NPNS URL.
|-
| 0x00160000
| 0x4
| 0xE
| Unknown, first byte is used by config service-cmd [[Config_Services|0x00070040]]. (Unknown whether the last 3-bytes are used)
|-
| 0x00170000
| 0x4
| 0xE
| Miiverse (OLV) access key
|-
| 0x00180000
| 0x4
| 0xC
| QTM Infrared LED related, can be 0 or 1
|-
| 0x00180001
| 0x18
| 0xC
| [[Hardware_calibration#QTM|QTM calibration data]]
|-
| 0x00190000
| 0x1
| 0xC
| Unknown. NFC-module checks for value1/non-value1.
|}

The developer unit TID block only exists on developer units.

===Stereo Display Settings===
All values are hard-coded in cfg module.
{| class="wikitable" border="1"
|-
! Offset
! Size
! Value
! Description
|-
| 0x0
| 4
| 62.0f
|assumed pupillary distance in mm?
|-
| 0x4
| 4
| 289.0f
|assumed distance in mm between player's eyes and upper screen?
|-
| 0x8
| 4
| 76.80f
|width in mm of (old) 3DS upper screen (doesn't vary for different models?)
|-
| 0xC
| 4
| 46.08f
|height in mm of (old) 3DS upper screen (doesn't vary for different models?)
|-
| 0x10
| 4
| 10.0f
|
|-
| 0x14
| 4
| 5.0f
|
|-
| 0x18
| 4
| 55.58f
|
|-
| 0x1C
| 4
| 21.57f
|
|}

===Languages===
{| class="wikitable" border="1"
|-
! ID
! Description
|-
| 0
| JP
|-
| 1
| EN
|-
| 2
| FR
|-
| 3
| DE
|-
| 4
| IT
|-
| 5
| ES
|-
| 6
| ZH
|-
| 7
| KO
|-
| 8
| NL
|-
| 9
| PT
|-
| 10
| RU
|-
| 11
| TW
|}

===CountryInfo===
{| class="wikitable" border="1"
|-
! Byte
! Description
|-
| 0
|?
|-
| 1
|?
|-
| 2
| State/Province code.
|-
| 3
| Country code, same as DSi/Wii country codes. Value 0xFF is invalid.
|}

===User Name Block 0x000A0000===
{| class="wikitable" border="1"
|-
! Byte
! Description
|-
| 0x00-0x15
| User name (UTF-16)
|-
| 0x16-0x17
| u16 NGWord flag to denote that the user name is inappropriate
|-
| 0x18-0x1B
| u32 NGWord version the username was last checked with. If this value is less than the u32 stored in the NGWord CFA "romfs:/version.dat", the system then checks the username string with the bad-word list CFA again, then updates this field with the value from the CFA
|}

While the user name is NULL-terminated, the terminator is not applied when the user name is 10 characters long, which leads to online access breaking (002-0109) and buffer overflows when the user name is retrieved, even in DS games.

===WiFi Slot Structure===

====Network structure====
This is used twice in the actual WiFi slot structure.
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| Whether the network was set or not?
|-
| 0x1
| 0x1
| Whether to use this network strucutre to connect?
|-
| 0x2
| 0x1
| Whether this structure is the first (0) or the second (1) in the larger WiFi slot structure?
|-
| 0x3
| 0x1
| Padding ?
|-
| 0x4
| 0x20
| SSID of the network, without a trailing nullbyte.
|-
| 0x24
| 0x1
| Length of the SSID.
|-
| 0x25
| 0x1
| [[Nintendo_Zone#Beacon_payload_format|AP crypto key type]]
|-
| 0x26
| 0x2
| Padding ?
|-
| 0x28
| 0x40
| Plaintext of the passphrase of the network, without a trailing nullbyte.
|-
| 0x68
| 0x20
| PBKDF2 of the passphrase and SSID (http://jorisvr.nl/wpapsk.html).
|-
|}

====Actual structure====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x2
| ?
|-
| 0x2
| 0x2
| [https://github.com/lammertb/libcrc/blob/v2.0/src/crc16.c#L43-L76 CRC-16 checksum] of the next 0x410 bytes.
|-
| 0x4
| 0x88
| First network structure. Only set if the network was set "normally", or was the last to be set using WPS during the session.
|-
| 0x8C
| 0x20
| Padding.
|-
| 0xAC
| 0x88
| Second network structure. Only set if the network was set using WPS, otherwise 0-filled.
|-
| 0x134
| 0x20C
| Padding.
|-
| 0x340
| 0x1
| Whether to automatically get the IP address (use DHCP) or not, defaults to 1.
|-
| 0x341
| 0x1
| Whether to automatically get the DNS or not, defaults to 1.
|-
| 0x342
| 0x2
| Padding ?
|-
| 0x344
| 0x4
| IP address, to use if 0x340 is false.
|-
| 0x348
| 0x4
| IP address of the gateway, to use if 0x340 is false.
|-
| 0x34C
| 0x4
| Subnetwork mask, to use if 0x340 is false.
|-
| 0x350
| 0x4
| IP address of the primary DNS , to use if 0x341 is false.
|-
| 0x354
| 0x4
| IP address of the secondary DNS, to use if 0x341 is false.
|-
| 0x358
| 0x4
| Always 0x01050000 ? Only set if the network was the last to be set during the session.
|-
| 0x35C
| 0x4
| IP address to use. Only set if the network was the last to be set during the session.
|-
| 0x360
| 0x6
| MAC address of the AP. Only set if the network was the last to be set during the session.
|-
| 0x366
| 0x1
| Channel. Only set if the network was the last to be set during the session.
|-
| 0x367
| 0x1
| Padding ? Only set if the network was the last to be set during the session.
|-
| 0x368
| 0x1
| Whether to use a proxy or not, defaults to 0.
|-
| 0x369
| 0x1
| Whether to use a basic authentication for the proxy, defaults to 0.
|-
| 0x36A
| 0x2
| Port to use for the proxy, defaults to 1.
|-
| 0x36C
| 0x30
| URL/address of the proxy, including a trailing nullbyte.
|-
| 0x39C
| 0x34
| Padding.
|-
| 0x3D0
| 0x20
| Username to use for basic authentication, including a trailing nullbyte.
|-
| 0x3F0
| 0x20
| Password to use for basic authentication, including a trailing nullbyte.
|-
| 0x410
| 0x2
| Padding ?
|-
| 0x412
| 0x2
| MTU value, defaults to 1400 and ranges between 576 and 1500, inclusive.
|-
| 0x414
| 0x7EC
| Padding.
|-
|}

===LCD display config===
There seems to be some sort of LCD display configuration stored in this cfg. When using the cfg-save from an Old3DS on a New3DS without formatting the cfg first, the bottom-screen display is somewhat off(which is fixed by formatting the cfg-save).

===Parental Control Settings Block 0x00100001===
{| class="wikitable" border="1"
|-
! Byte
! Size in bytes
! Description
|-
| 0x0
| 0xD
| Unknown.
|-
| 0xD
| 0x4
| PIN
|-
| 0x11
| 0x40
| Secret Answer (UTF-16)
|}

===Parental Control Settings Block 0x000C0000===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x00
| 0x04
| [[#Parental Control Restriction Bitmask|Parental Control Restriction Bitmask]]
|-
| 0x04
| 0x04
| Unknown
|-
| 0x08
| 0x01
| Rating system used for configuration
|-
| 0x09
| 0x01
| Maximum allowed age (20 = No restriction)
|-
| 0x0A
| 0x01
| Secret Question Type (0-5: Pre-defined, 6: Custom)
|-
| 0x0B
| 0x01
| Unknown
|-
| 0x0C
| 0x08
| Parental Controls PIN code (with NULL-termination, although restricted to 4 digits)
|-
| 0x14
| 0x44
| Secret Answer (UTF-16)
|}

====Parental Control Restriction Bitmask====
{| class="wikitable" border="1"
|-
! Bit
! Restriction name
|-
| 0
| Global Parental Controls Enable
|-
| 1
| Internet Browser
|-
| 2
| Display of 3D Images (disabled on 2DS)
|-
| 3
| Sharing Images/Audio/Video/Long Text Data
|-
| 4
| Online Interaction
|-
| 5
| StreetPass
|-
| 6
| Friend Registration
|-
| 7
| DS Download Play
|-
| 8
| Nintendo 3DS Shopping Services (eShop / EC Applet)
|-
| 9
| View Distributed Videos
|-
| 10
| Miiverse (View)
|-
| 11
| Miiverse (Post)
|-
| 31
| "Child Online Privacy Protection" (see [[Cfg:GetRegionCanadaUSA|CFG:IsCoppacsSupported]])
|}

===Parental Control Settings Block 0x000C0002===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0000
| 0x0001
| Boolean, whether an e-Mail has been registered
|-
| 0x0001
| 0x0101
| Registered e-Mail address (Plaintext)
|-
| 0x0102
| 0x0068
| Custom Secret Question (UTF-16)
|}

Config Savegame

2026-06-23T11:49:29Z

TimmSkiller: 0x90002 -> Local friend code counter

This page describes the format of the [[Config_Services|Cfg]] [[System_SaveData|NAND]] savegame. These blocks can be accessed with the Cfg service commands.

==Structure of save-file "/config"==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x2
| Total entries
|-
| 0x2
| 0x2
| Data entries offset
|-
| 0x4
| 0x4558
| Block entries
|-
| 0x455C
|
| Data for the entries
|}

The filesize for this /config file is 0x8000-bytes.

==Configuration block entry ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| BlkID
|-
| 0x4
| 0x4
| Offset to the data for this block when size is >4, otherwise this word is the data for this block
|-
| 0x8
| 0x2
| Size
|-
| 0xA
| 0x2
| Access Flags
|}

===Access Flags===
{| class="wikitable" border="1"
|-
! Bit Mask
! Description
|-
| 0x2
| User Readable (cfg:u)
|-
| 0x4
| System Writable (cfg:s / cfg:i)
|-
| 0x8
| System Readable (cfg:s / cfg:i)
|}

Config blocks will typically either use 0xC for system readable/writable or 0xE for all 3.

==Configuration blocks==
{| class="wikitable" border="1"
|-
! BlkID
! Size
! Access Flags
! Description
|-
| 0x00000000
| 0x2
| 0xC
| Config savegame version?
|-
| 0x00010000
| 0x1
| 0xC
| [[Hardware_calibration#RTC|RTC compensation value]]
|-
| 0x00020000
| 0x134
| 0xC
| [[Hardware_calibration#CDC|Codec]]
|-
| 0x00030000
| 0x1
| 0xC
| Leap Year Counter (read By PTM)
|-
| 0x00030001
| 0x8
| 0xE
| User time offset (read by CECD): displayed timestamp - rtc timestamp
|-
| 0x00030002
| 0x8
| 0xC
| Difference (in nanoseconds) between UTC server time and RTC time. Updated by [[Friend_Services|the Friends sysmodule]] after every [[Online_Play|NASC]] login. Used by System settings to calculate the real current time according to the online play authentication server, in order to determine the user's actual age based on the given date of birth (related to COPPA, since this is used to check whether the user is at least 13 years old).
|-
| 0x00040000
| 0x10
| 0xC
| [[Hardware_calibration#Touch|Touch calibration]] (read by HID)
|-
| 0x00040001
| 0x1C
| 0xC
| Analog Stick Calibration Param?(read by HID)
|-
| 0x00040002
| 0x12
| 0xC
| [[Hardware_calibration#Gyro|Gyroscope]] (read by HID)
|-
| 0x00040003
| 0xC
| 0xC
| [[Hardware_calibration#Accel|Accelerometer]] (read by HID)
|-
| 0x00040004
| 0x1C
| 0xC
| [[Hardware_calibration#CStick|CStick calibration data]]
|-
| 0x00050000
| 0x2
| 0xC
| [[Hardware_calibration#Screen_flicker|Screen flicker]]
|-
| 0x00050001
| 0x2
| 0xC
| Backlight controls (u8 ABL_powersave_enable, u8 brightness_level) (read by GSP)
|-
| 0x00050002
| 0x38
| 0xC
| [[Hardware_calibration#BLPWM|Backlight PWM]] (read by GSP)
|-
| 0x00050003
| 0x20
| 0xC
| [[Hardware_calibration#ABL|Power saving mode (ABL) calibration]] (read by GSP)
|-
| 0x00050004
| 0x20
| 0xC
| [[Hardware_calibration#ABL|Power saving mode (ABL) calibration]] (for legacy FIRM)
|-
| 0x00050005
| 0x20
| 0xE
| Stereo display settings (HWCAL block 0x470)
|-
| 0x00050006
| 0x2
| 0xC
| [[Hardware_calibration#ULCD_delay|3D switching delay]]
|-
| 0x00050007
| 0x4
| 0xC
| ?
|-
| 0x00050008
| 0x10C
| 0xC
| [[Hardware_calibration#ABL_extra|Power saving mode (ABL) extra config]]
|-
| 0x00050009
| 0x8
| 0xC
| new3DS only(?) backlight control (5th byte: auto-brightness enable)
|-
| 0x00060000
| 0x96
| 0xC
| ??? (HWCAL block 0x500)
|-
| 0x00070000
| 0x214
| 0xE
| [[Hardware_calibration#3D_filters|3D filters]]
|-
| 0x00070001
| 0x1
| 0xE
| Sound output mode (mono=0, stereo=1, surround=2)
|-
| 0x00070002
| 0x8
| 0xE
| [[Hardware_calibration#Microphone_echo_cancel|Microphone echo cancellation params]]
|-
| 0x00080000
| 0xC00
| 0xC
| WiFi configuration slot 0
|-
| 0x00080001
| 0xC00
| 0xC
| WiFi configuration slot 1
|-
| 0x00080002
| 0xC00
| 0xC
| WiFi configuration slot 2
|-
| 0x00090000
| 0x8
| 0xE
| This contains a u64 ID, used by processes using [[NWMUDS:InitializeWithVersion]]. The first word is the same as [[CfgS:GetLocalFriendCodeSeed|LocalFriendCodeSeed]], while the latter is a separate word.
|-
| 0x00090001
| 0x8
| 0xE
| Local friend code. This console-unique u64 is used by [[Cfg:GenHashConsoleUnique|GenHashConsoleUnique]]. It is generated by <code>((0x3FFFFFFFF) & LocalFriendCodeSeed) | (LocalFriendCodeCounter << 48))</code>, where LocalFriendCodeCounter is generated by [[PSPXI:GenerateRandomBytes|GenerateRandomBytes]]
|-
| 0x00090002
| 0x4
| 0xE
| u16, Local friend code counter
|-
| 0x000A0000
| 0x1C
| 0xE
| [[#User Name Block 0x000A0000|User Name]]
|-
| 0x000A0001
| 0x2
| 0xE
| Birthday (u8 month, u8 day)
|-
| 0x000A0002
| 0x1
| 0xE
| Language
|-
| 0x000B0000
| 0x4
| 0xE
| CountryInfo
|-
| 0x000B0001
| 0x800
| 0xE
| Country name in UTF-16, every 0x80-bytes is an entry for each language, in the order of the Language table below (not all entries are set)
|-
| 0x000B0002
| 0x800
| 0xE
| State name in UTF-16, every 0x80-bytes is an entry for each language
|-
| 0x000B0003
| 0x4
| 0xE
| Coordinates. A pair of s16 represents latitude and longitude, respectively. One need to multiply both value by 180/32768 to get coordinates in degrees

|-
| 0x000C0000
| 0xC0
| 0xE
| [[#Parental Control Settings Block 0x000C0000|Parental Controls - Main data]]
|-
| 0x000C0001
| 0x14
| 0xE
| COPPACS restriction data
|-
| 0x000C0002
| 0x200
| 0xE
| [[#Parental Control Settings Block 0x000C0002|Parental Controls - Registered e-Mail address and custom secret question]]
|-
| 0x000D0000
| 0x4
| 0xE
| u16 at offset 0x0: [[SMDH#EULA_Version|EULA Version]] which was agreed to. u16 @ 0x02: latest version
|-
| 0x000E0000
| 0x1
| 0xE
| ? (related to SpotPass options in Internet Settings?)
|-
| 0x000F0000
| 0x10
| 0xC
| Debug configuration, read by [[NS]] on dev-units: on startup, NS does <code>svcKernelSetState(6, 1, (u64)debug_flags & 1);
svcKernelSetState(6, 2, (u64)debug_flags & 2);</code> (see [[SVC#KernelSetState|here]]) where <code>debug_flags</code> is the u32 located at offset 0xC in this struct. Then it compares the u32 from +8 in this config-block with the [[Configuration_Memory#APPMEMTYPE|APPMEMTYPE]]. When those don't match NS starts a FIRM-launch (with the same FIRM titleID as the currently running one) to boot into a FIRM with the APPMEMTYPE value from this config-block. The byte at offset 0x0 is related to the memtype as well.
|-
| 0x000F0001
| 0x8
| 0xC
| ?
|-
| 0x000F0003
| 0x1
| 0xC
| Home Menu button disable
|-
| 0x000F0004
| 0x4
| 0xC
| The first u8 is the System-Model [[Cfg:GetSystemModel|value]], the last 3-bytes are unknown
|-
| 0x000F0005
| 0x4
| 0xC
| The first u8 indicates whether network updates are enabled (however, NIM only checks this flag with developer [[Configuration_Memory#ENVINFO|ENVINFO]]).
|-
| 0x000F0006
| 0x28
| 0xC
| In NIM, taken as a (hopefully null terminated) string used for the "X-Device-Token" http header field for NPNS url.
|-
| 0x00100000
| 0x2
| 0xC
| TWL EULA info ({bool agreed; u8 agreedVersion})
|-
| 0x00100001
| 0x94
| 0xC
| Stores Parental Restrictions PIN/Secret Answer and other info for TWL mode
|-
| 0x00100002
| 0x1
| 0xC
| TWL country code
|-
| 0x00100003
| 0x10
| 0xC
| TWL movable unique ID, used for DSiWare exports
|-
| 0x00110000
| 0x4
| 0xC
| The low u16 indicates whether the system setup is required, such as when the system is booted for the first time or after doing a [[System Settings|System Format]]: 0 = setup required, non-zero = no setup required
|-
| 0x00110001
| 0x8
| 0xC
| TitleID of the menu to launch, used by [[NS]] on dev units (this block can be edited on dev units with [[3DS Development Unit Software#Config|Config]])
|-
| 0x00120000
| 0x8
| 0xC
| Volume Slider Bounds (Read by HID and PTM)
|-
| 0x00130000
| 0x4
| 0xE
| If response is 0x100 then debug mode is enabled.
|-
| 0x00150000
| 0x4
| 0xC
| Clock Sequence (u16) used for generating UUIDs in [[ACT_Services|ACT]].
|-
| 0x00150001
| 0x8
| 0xC
| ?
|-
| 0x00150002
| 0x4
| 0xE
| [[Friend_Services#Server_Types|NFS (Nintendo Friend Server) Environment]] in the format <code>%c%d</code>. Set by the [[ACT_Services|ACT]] sysmodule. Used in the [[NIM_Services#NIM|NIM]] sysmodule for making the NPNS URL.
|-
| 0x00160000
| 0x4
| 0xE
| Unknown, first byte is used by config service-cmd [[Config_Services|0x00070040]]. (Unknown whether the last 3-bytes are used)
|-
| 0x00170000
| 0x4
| 0xE
| Miiverse (OLV) access key
|-
| 0x00180000
| 0x4
| 0xC
| QTM Infrared LED related, can be 0 or 1
|-
| 0x00180001
| 0x18
| 0xC
| [[Hardware_calibration#QTM|QTM calibration data]]
|-
| 0x00190000
| 0x1
| 0xC
| Unknown. NFC-module checks for value1/non-value1.
|}

The developer unit TID block only exists on developer units.

===Stereo Display Settings===
All values are hard-coded in cfg module.
{| class="wikitable" border="1"
|-
! Offset
! Size
! Value
! Description
|-
| 0x0
| 4
| 62.0f
|assumed pupillary distance in mm?
|-
| 0x4
| 4
| 289.0f
|assumed distance in mm between player's eyes and upper screen?
|-
| 0x8
| 4
| 76.80f
|width in mm of (old) 3DS upper screen (doesn't vary for different models?)
|-
| 0xC
| 4
| 46.08f
|height in mm of (old) 3DS upper screen (doesn't vary for different models?)
|-
| 0x10
| 4
| 10.0f
|
|-
| 0x14
| 4
| 5.0f
|
|-
| 0x18
| 4
| 55.58f
|
|-
| 0x1C
| 4
| 21.57f
|
|}

===Languages===
{| class="wikitable" border="1"
|-
! ID
! Description
|-
| 0
| JP
|-
| 1
| EN
|-
| 2
| FR
|-
| 3
| DE
|-
| 4
| IT
|-
| 5
| ES
|-
| 6
| ZH
|-
| 7
| KO
|-
| 8
| NL
|-
| 9
| PT
|-
| 10
| RU
|-
| 11
| TW
|}

===CountryInfo===
{| class="wikitable" border="1"
|-
! Byte
! Description
|-
| 0
|?
|-
| 1
|?
|-
| 2
| State/Province code.
|-
| 3
| Country code, same as DSi/Wii country codes. Value 0xFF is invalid.
|}

===User Name Block 0x000A0000===
{| class="wikitable" border="1"
|-
! Byte
! Description
|-
| 0x00-0x15
| User name (UTF-16)
|-
| 0x16-0x17
| u16 NGWord flag to denote that the user name is inappropriate
|-
| 0x18-0x1B
| u32 NGWord version the username was last checked with. If this value is less than the u32 stored in the NGWord CFA "romfs:/version.dat", the system then checks the username string with the bad-word list CFA again, then updates this field with the value from the CFA
|}

While the user name is NULL-terminated, the terminator is not applied when the user name is 10 characters long, which leads to online access breaking (002-0109) and buffer overflows when the user name is retrieved, even in DS games.

===WiFi Slot Structure===

====Network structure====
This is used twice in the actual WiFi slot structure.
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| Whether the network was set or not?
|-
| 0x1
| 0x1
| Whether to use this network strucutre to connect?
|-
| 0x2
| 0x1
| Whether this structure is the first (0) or the second (1) in the larger WiFi slot structure?
|-
| 0x3
| 0x1
| Padding ?
|-
| 0x4
| 0x20
| SSID of the network, without a trailing nullbyte.
|-
| 0x24
| 0x1
| Length of the SSID.
|-
| 0x25
| 0x1
| [[Nintendo_Zone#Beacon_payload_format|AP crypto key type]]
|-
| 0x26
| 0x2
| Padding ?
|-
| 0x28
| 0x40
| Plaintext of the passphrase of the network, without a trailing nullbyte.
|-
| 0x68
| 0x20
| PBKDF2 of the passphrase and SSID (http://jorisvr.nl/wpapsk.html).
|-
|}

====Actual structure====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x2
| ?
|-
| 0x2
| 0x2
| [https://github.com/lammertb/libcrc/blob/v2.0/src/crc16.c#L43-L76 CRC-16 checksum] of the next 0x410 bytes.
|-
| 0x4
| 0x88
| First network structure. Only set if the network was set "normally", or was the last to be set using WPS during the session.
|-
| 0x8C
| 0x20
| Padding.
|-
| 0xAC
| 0x88
| Second network structure. Only set if the network was set using WPS, otherwise 0-filled.
|-
| 0x134
| 0x20C
| Padding.
|-
| 0x340
| 0x1
| Whether to automatically get the IP address (use DHCP) or not, defaults to 1.
|-
| 0x341
| 0x1
| Whether to automatically get the DNS or not, defaults to 1.
|-
| 0x342
| 0x2
| Padding ?
|-
| 0x344
| 0x4
| IP address, to use if 0x340 is false.
|-
| 0x348
| 0x4
| IP address of the gateway, to use if 0x340 is false.
|-
| 0x34C
| 0x4
| Subnetwork mask, to use if 0x340 is false.
|-
| 0x350
| 0x4
| IP address of the primary DNS , to use if 0x341 is false.
|-
| 0x354
| 0x4
| IP address of the secondary DNS, to use if 0x341 is false.
|-
| 0x358
| 0x4
| Always 0x01050000 ? Only set if the network was the last to be set during the session.
|-
| 0x35C
| 0x4
| IP address to use. Only set if the network was the last to be set during the session.
|-
| 0x360
| 0x6
| MAC address of the AP. Only set if the network was the last to be set during the session.
|-
| 0x366
| 0x1
| Channel. Only set if the network was the last to be set during the session.
|-
| 0x367
| 0x1
| Padding ? Only set if the network was the last to be set during the session.
|-
| 0x368
| 0x1
| Whether to use a proxy or not, defaults to 0.
|-
| 0x369
| 0x1
| Whether to use a basic authentication for the proxy, defaults to 0.
|-
| 0x36A
| 0x2
| Port to use for the proxy, defaults to 1.
|-
| 0x36C
| 0x30
| URL/address of the proxy, including a trailing nullbyte.
|-
| 0x39C
| 0x34
| Padding.
|-
| 0x3D0
| 0x20
| Username to use for basic authentication, including a trailing nullbyte.
|-
| 0x3F0
| 0x20
| Password to use for basic authentication, including a trailing nullbyte.
|-
| 0x410
| 0x2
| Padding ?
|-
| 0x412
| 0x2
| MTU value, defaults to 1400 and ranges between 576 and 1500, inclusive.
|-
| 0x414
| 0x7EC
| Padding.
|-
|}

===LCD display config===
There seems to be some sort of LCD display configuration stored in this cfg. When using the cfg-save from an Old3DS on a New3DS without formatting the cfg first, the bottom-screen display is somewhat off(which is fixed by formatting the cfg-save).

===Parental Control Settings Block 0x00100001===
{| class="wikitable" border="1"
|-
! Byte
! Size in bytes
! Description
|-
| 0x0
| 0xD
| Unknown.
|-
| 0xD
| 0x4
| PIN
|-
| 0x11
| 0x40
| Secret Answer (UTF-16)
|}

===Parental Control Settings Block 0x000C0000===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x00
| 0x04
| [[#Parental Control Restriction Bitmask|Parental Control Restriction Bitmask]]
|-
| 0x04
| 0x04
| Unknown
|-
| 0x08
| 0x01
| Rating system used for configuration
|-
| 0x09
| 0x01
| Maximum allowed age (20 = No restriction)
|-
| 0x0A
| 0x01
| Secret Question Type (0-5: Pre-defined, 6: Custom)
|-
| 0x0B
| 0x01
| Unknown
|-
| 0x0C
| 0x08
| Parental Controls PIN code (with NULL-termination, although restricted to 4 digits)
|-
| 0x14
| 0x44
| Secret Answer (UTF-16)
|}

====Parental Control Restriction Bitmask====
{| class="wikitable" border="1"
|-
! Bit
! Restriction name
|-
| 0
| Global Parental Controls Enable
|-
| 1
| Internet Browser
|-
| 2
| Display of 3D Images (disabled on 2DS)
|-
| 3
| Sharing Images/Audio/Video/Long Text Data
|-
| 4
| Online Interaction
|-
| 5
| StreetPass
|-
| 6
| Friend Registration
|-
| 7
| DS Download Play
|-
| 8
| Nintendo 3DS Shopping Services (eShop / EC Applet)
|-
| 9
| View Distributed Videos
|-
| 10
| Miiverse (View)
|-
| 11
| Miiverse (Post)
|-
| 31
| "Child Online Privacy Protection" (see [[Cfg:GetRegionCanadaUSA|CFG:IsCoppacsSupported]])
|}

===Parental Control Settings Block 0x000C0002===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0000
| 0x0001
| Boolean, whether an e-Mail has been registered
|-
| 0x0001
| 0x0101
| Registered e-Mail address (Plaintext)
|-
| 0x0102
| 0x0068
| Custom Secret Question (UTF-16)
|}

Config Savegame

2026-06-23T11:43:21Z

TimmSkiller: 0x90001 -> Local friend code

This page describes the format of the [[Config_Services|Cfg]] [[System_SaveData|NAND]] savegame. These blocks can be accessed with the Cfg service commands.

==Structure of save-file "/config"==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x2
| Total entries
|-
| 0x2
| 0x2
| Data entries offset
|-
| 0x4
| 0x4558
| Block entries
|-
| 0x455C
|
| Data for the entries
|}

The filesize for this /config file is 0x8000-bytes.

==Configuration block entry ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| BlkID
|-
| 0x4
| 0x4
| Offset to the data for this block when size is >4, otherwise this word is the data for this block
|-
| 0x8
| 0x2
| Size
|-
| 0xA
| 0x2
| Access Flags
|}

===Access Flags===
{| class="wikitable" border="1"
|-
! Bit Mask
! Description
|-
| 0x2
| User Readable (cfg:u)
|-
| 0x4
| System Writable (cfg:s / cfg:i)
|-
| 0x8
| System Readable (cfg:s / cfg:i)
|}

Config blocks will typically either use 0xC for system readable/writable or 0xE for all 3.

==Configuration blocks==
{| class="wikitable" border="1"
|-
! BlkID
! Size
! Access Flags
! Description
|-
| 0x00000000
| 0x2
| 0xC
| Config savegame version?
|-
| 0x00010000
| 0x1
| 0xC
| [[Hardware_calibration#RTC|RTC compensation value]]
|-
| 0x00020000
| 0x134
| 0xC
| [[Hardware_calibration#CDC|Codec]]
|-
| 0x00030000
| 0x1
| 0xC
| Leap Year Counter (read By PTM)
|-
| 0x00030001
| 0x8
| 0xE
| User time offset (read by CECD): displayed timestamp - rtc timestamp
|-
| 0x00030002
| 0x8
| 0xC
| Difference (in nanoseconds) between UTC server time and RTC time. Updated by [[Friend_Services|the Friends sysmodule]] after every [[Online_Play|NASC]] login. Used by System settings to calculate the real current time according to the online play authentication server, in order to determine the user's actual age based on the given date of birth (related to COPPA, since this is used to check whether the user is at least 13 years old).
|-
| 0x00040000
| 0x10
| 0xC
| [[Hardware_calibration#Touch|Touch calibration]] (read by HID)
|-
| 0x00040001
| 0x1C
| 0xC
| Analog Stick Calibration Param?(read by HID)
|-
| 0x00040002
| 0x12
| 0xC
| [[Hardware_calibration#Gyro|Gyroscope]] (read by HID)
|-
| 0x00040003
| 0xC
| 0xC
| [[Hardware_calibration#Accel|Accelerometer]] (read by HID)
|-
| 0x00040004
| 0x1C
| 0xC
| [[Hardware_calibration#CStick|CStick calibration data]]
|-
| 0x00050000
| 0x2
| 0xC
| [[Hardware_calibration#Screen_flicker|Screen flicker]]
|-
| 0x00050001
| 0x2
| 0xC
| Backlight controls (u8 ABL_powersave_enable, u8 brightness_level) (read by GSP)
|-
| 0x00050002
| 0x38
| 0xC
| [[Hardware_calibration#BLPWM|Backlight PWM]] (read by GSP)
|-
| 0x00050003
| 0x20
| 0xC
| [[Hardware_calibration#ABL|Power saving mode (ABL) calibration]] (read by GSP)
|-
| 0x00050004
| 0x20
| 0xC
| [[Hardware_calibration#ABL|Power saving mode (ABL) calibration]] (for legacy FIRM)
|-
| 0x00050005
| 0x20
| 0xE
| Stereo display settings (HWCAL block 0x470)
|-
| 0x00050006
| 0x2
| 0xC
| [[Hardware_calibration#ULCD_delay|3D switching delay]]
|-
| 0x00050007
| 0x4
| 0xC
| ?
|-
| 0x00050008
| 0x10C
| 0xC
| [[Hardware_calibration#ABL_extra|Power saving mode (ABL) extra config]]
|-
| 0x00050009
| 0x8
| 0xC
| new3DS only(?) backlight control (5th byte: auto-brightness enable)
|-
| 0x00060000
| 0x96
| 0xC
| ??? (HWCAL block 0x500)
|-
| 0x00070000
| 0x214
| 0xE
| [[Hardware_calibration#3D_filters|3D filters]]
|-
| 0x00070001
| 0x1
| 0xE
| Sound output mode (mono=0, stereo=1, surround=2)
|-
| 0x00070002
| 0x8
| 0xE
| [[Hardware_calibration#Microphone_echo_cancel|Microphone echo cancellation params]]
|-
| 0x00080000
| 0xC00
| 0xC
| WiFi configuration slot 0
|-
| 0x00080001
| 0xC00
| 0xC
| WiFi configuration slot 1
|-
| 0x00080002
| 0xC00
| 0xC
| WiFi configuration slot 2
|-
| 0x00090000
| 0x8
| 0xE
| This contains a u64 ID, used by processes using [[NWMUDS:InitializeWithVersion]]. The first word is the same as [[CfgS:GetLocalFriendCodeSeed|LocalFriendCodeSeed]], while the latter is a separate word.
|-
| 0x00090001
| 0x8
| 0xE
| Local friend code. This console-unique u64 is used by [[Cfg:GenHashConsoleUnique|GenHashConsoleUnique]]. It is generated by <code>((0x3FFFFFFFF) & LocalFriendCodeSeed) | (random16 << 48))</code>, where random16 is generated by [[PSPXI:GenerateRandomBytes|GenerateRandomBytes]]
|-
| 0x00090002
| 0x4
| 0xE
| The first two bytes are the same random16 used in 0x00090001. The second two bytes are zeros.
|-
| 0x000A0000
| 0x1C
| 0xE
| [[#User Name Block 0x000A0000|User Name]]
|-
| 0x000A0001
| 0x2
| 0xE
| Birthday (u8 month, u8 day)
|-
| 0x000A0002
| 0x1
| 0xE
| Language
|-
| 0x000B0000
| 0x4
| 0xE
| CountryInfo
|-
| 0x000B0001
| 0x800
| 0xE
| Country name in UTF-16, every 0x80-bytes is an entry for each language, in the order of the Language table below (not all entries are set)
|-
| 0x000B0002
| 0x800
| 0xE
| State name in UTF-16, every 0x80-bytes is an entry for each language
|-
| 0x000B0003
| 0x4
| 0xE
| Coordinates. A pair of s16 represents latitude and longitude, respectively. One need to multiply both value by 180/32768 to get coordinates in degrees

|-
| 0x000C0000
| 0xC0
| 0xE
| [[#Parental Control Settings Block 0x000C0000|Parental Controls - Main data]]
|-
| 0x000C0001
| 0x14
| 0xE
| COPPACS restriction data
|-
| 0x000C0002
| 0x200
| 0xE
| [[#Parental Control Settings Block 0x000C0002|Parental Controls - Registered e-Mail address and custom secret question]]
|-
| 0x000D0000
| 0x4
| 0xE
| u16 at offset 0x0: [[SMDH#EULA_Version|EULA Version]] which was agreed to. u16 @ 0x02: latest version
|-
| 0x000E0000
| 0x1
| 0xE
| ? (related to SpotPass options in Internet Settings?)
|-
| 0x000F0000
| 0x10
| 0xC
| Debug configuration, read by [[NS]] on dev-units: on startup, NS does <code>svcKernelSetState(6, 1, (u64)debug_flags & 1);
svcKernelSetState(6, 2, (u64)debug_flags & 2);</code> (see [[SVC#KernelSetState|here]]) where <code>debug_flags</code> is the u32 located at offset 0xC in this struct. Then it compares the u32 from +8 in this config-block with the [[Configuration_Memory#APPMEMTYPE|APPMEMTYPE]]. When those don't match NS starts a FIRM-launch (with the same FIRM titleID as the currently running one) to boot into a FIRM with the APPMEMTYPE value from this config-block. The byte at offset 0x0 is related to the memtype as well.
|-
| 0x000F0001
| 0x8
| 0xC
| ?
|-
| 0x000F0003
| 0x1
| 0xC
| Home Menu button disable
|-
| 0x000F0004
| 0x4
| 0xC
| The first u8 is the System-Model [[Cfg:GetSystemModel|value]], the last 3-bytes are unknown
|-
| 0x000F0005
| 0x4
| 0xC
| The first u8 indicates whether network updates are enabled (however, NIM only checks this flag with developer [[Configuration_Memory#ENVINFO|ENVINFO]]).
|-
| 0x000F0006
| 0x28
| 0xC
| In NIM, taken as a (hopefully null terminated) string used for the "X-Device-Token" http header field for NPNS url.
|-
| 0x00100000
| 0x2
| 0xC
| TWL EULA info ({bool agreed; u8 agreedVersion})
|-
| 0x00100001
| 0x94
| 0xC
| Stores Parental Restrictions PIN/Secret Answer and other info for TWL mode
|-
| 0x00100002
| 0x1
| 0xC
| TWL country code
|-
| 0x00100003
| 0x10
| 0xC
| TWL movable unique ID, used for DSiWare exports
|-
| 0x00110000
| 0x4
| 0xC
| The low u16 indicates whether the system setup is required, such as when the system is booted for the first time or after doing a [[System Settings|System Format]]: 0 = setup required, non-zero = no setup required
|-
| 0x00110001
| 0x8
| 0xC
| TitleID of the menu to launch, used by [[NS]] on dev units (this block can be edited on dev units with [[3DS Development Unit Software#Config|Config]])
|-
| 0x00120000
| 0x8
| 0xC
| Volume Slider Bounds (Read by HID and PTM)
|-
| 0x00130000
| 0x4
| 0xE
| If response is 0x100 then debug mode is enabled.
|-
| 0x00150000
| 0x4
| 0xC
| Clock Sequence (u16) used for generating UUIDs in [[ACT_Services|ACT]].
|-
| 0x00150001
| 0x8
| 0xC
| ?
|-
| 0x00150002
| 0x4
| 0xE
| [[Friend_Services#Server_Types|NFS (Nintendo Friend Server) Environment]] in the format <code>%c%d</code>. Set by the [[ACT_Services|ACT]] sysmodule. Used in the [[NIM_Services#NIM|NIM]] sysmodule for making the NPNS URL.
|-
| 0x00160000
| 0x4
| 0xE
| Unknown, first byte is used by config service-cmd [[Config_Services|0x00070040]]. (Unknown whether the last 3-bytes are used)
|-
| 0x00170000
| 0x4
| 0xE
| Miiverse (OLV) access key
|-
| 0x00180000
| 0x4
| 0xC
| QTM Infrared LED related, can be 0 or 1
|-
| 0x00180001
| 0x18
| 0xC
| [[Hardware_calibration#QTM|QTM calibration data]]
|-
| 0x00190000
| 0x1
| 0xC
| Unknown. NFC-module checks for value1/non-value1.
|}

The developer unit TID block only exists on developer units.

===Stereo Display Settings===
All values are hard-coded in cfg module.
{| class="wikitable" border="1"
|-
! Offset
! Size
! Value
! Description
|-
| 0x0
| 4
| 62.0f
|assumed pupillary distance in mm?
|-
| 0x4
| 4
| 289.0f
|assumed distance in mm between player's eyes and upper screen?
|-
| 0x8
| 4
| 76.80f
|width in mm of (old) 3DS upper screen (doesn't vary for different models?)
|-
| 0xC
| 4
| 46.08f
|height in mm of (old) 3DS upper screen (doesn't vary for different models?)
|-
| 0x10
| 4
| 10.0f
|
|-
| 0x14
| 4
| 5.0f
|
|-
| 0x18
| 4
| 55.58f
|
|-
| 0x1C
| 4
| 21.57f
|
|}

===Languages===
{| class="wikitable" border="1"
|-
! ID
! Description
|-
| 0
| JP
|-
| 1
| EN
|-
| 2
| FR
|-
| 3
| DE
|-
| 4
| IT
|-
| 5
| ES
|-
| 6
| ZH
|-
| 7
| KO
|-
| 8
| NL
|-
| 9
| PT
|-
| 10
| RU
|-
| 11
| TW
|}

===CountryInfo===
{| class="wikitable" border="1"
|-
! Byte
! Description
|-
| 0
|?
|-
| 1
|?
|-
| 2
| State/Province code.
|-
| 3
| Country code, same as DSi/Wii country codes. Value 0xFF is invalid.
|}

===User Name Block 0x000A0000===
{| class="wikitable" border="1"
|-
! Byte
! Description
|-
| 0x00-0x15
| User name (UTF-16)
|-
| 0x16-0x17
| u16 NGWord flag to denote that the user name is inappropriate
|-
| 0x18-0x1B
| u32 NGWord version the username was last checked with. If this value is less than the u32 stored in the NGWord CFA "romfs:/version.dat", the system then checks the username string with the bad-word list CFA again, then updates this field with the value from the CFA
|}

While the user name is NULL-terminated, the terminator is not applied when the user name is 10 characters long, which leads to online access breaking (002-0109) and buffer overflows when the user name is retrieved, even in DS games.

===WiFi Slot Structure===

====Network structure====
This is used twice in the actual WiFi slot structure.
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| Whether the network was set or not?
|-
| 0x1
| 0x1
| Whether to use this network strucutre to connect?
|-
| 0x2
| 0x1
| Whether this structure is the first (0) or the second (1) in the larger WiFi slot structure?
|-
| 0x3
| 0x1
| Padding ?
|-
| 0x4
| 0x20
| SSID of the network, without a trailing nullbyte.
|-
| 0x24
| 0x1
| Length of the SSID.
|-
| 0x25
| 0x1
| [[Nintendo_Zone#Beacon_payload_format|AP crypto key type]]
|-
| 0x26
| 0x2
| Padding ?
|-
| 0x28
| 0x40
| Plaintext of the passphrase of the network, without a trailing nullbyte.
|-
| 0x68
| 0x20
| PBKDF2 of the passphrase and SSID (http://jorisvr.nl/wpapsk.html).
|-
|}

====Actual structure====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x2
| ?
|-
| 0x2
| 0x2
| [https://github.com/lammertb/libcrc/blob/v2.0/src/crc16.c#L43-L76 CRC-16 checksum] of the next 0x410 bytes.
|-
| 0x4
| 0x88
| First network structure. Only set if the network was set "normally", or was the last to be set using WPS during the session.
|-
| 0x8C
| 0x20
| Padding.
|-
| 0xAC
| 0x88
| Second network structure. Only set if the network was set using WPS, otherwise 0-filled.
|-
| 0x134
| 0x20C
| Padding.
|-
| 0x340
| 0x1
| Whether to automatically get the IP address (use DHCP) or not, defaults to 1.
|-
| 0x341
| 0x1
| Whether to automatically get the DNS or not, defaults to 1.
|-
| 0x342
| 0x2
| Padding ?
|-
| 0x344
| 0x4
| IP address, to use if 0x340 is false.
|-
| 0x348
| 0x4
| IP address of the gateway, to use if 0x340 is false.
|-
| 0x34C
| 0x4
| Subnetwork mask, to use if 0x340 is false.
|-
| 0x350
| 0x4
| IP address of the primary DNS , to use if 0x341 is false.
|-
| 0x354
| 0x4
| IP address of the secondary DNS, to use if 0x341 is false.
|-
| 0x358
| 0x4
| Always 0x01050000 ? Only set if the network was the last to be set during the session.
|-
| 0x35C
| 0x4
| IP address to use. Only set if the network was the last to be set during the session.
|-
| 0x360
| 0x6
| MAC address of the AP. Only set if the network was the last to be set during the session.
|-
| 0x366
| 0x1
| Channel. Only set if the network was the last to be set during the session.
|-
| 0x367
| 0x1
| Padding ? Only set if the network was the last to be set during the session.
|-
| 0x368
| 0x1
| Whether to use a proxy or not, defaults to 0.
|-
| 0x369
| 0x1
| Whether to use a basic authentication for the proxy, defaults to 0.
|-
| 0x36A
| 0x2
| Port to use for the proxy, defaults to 1.
|-
| 0x36C
| 0x30
| URL/address of the proxy, including a trailing nullbyte.
|-
| 0x39C
| 0x34
| Padding.
|-
| 0x3D0
| 0x20
| Username to use for basic authentication, including a trailing nullbyte.
|-
| 0x3F0
| 0x20
| Password to use for basic authentication, including a trailing nullbyte.
|-
| 0x410
| 0x2
| Padding ?
|-
| 0x412
| 0x2
| MTU value, defaults to 1400 and ranges between 576 and 1500, inclusive.
|-
| 0x414
| 0x7EC
| Padding.
|-
|}

===LCD display config===
There seems to be some sort of LCD display configuration stored in this cfg. When using the cfg-save from an Old3DS on a New3DS without formatting the cfg first, the bottom-screen display is somewhat off(which is fixed by formatting the cfg-save).

===Parental Control Settings Block 0x00100001===
{| class="wikitable" border="1"
|-
! Byte
! Size in bytes
! Description
|-
| 0x0
| 0xD
| Unknown.
|-
| 0xD
| 0x4
| PIN
|-
| 0x11
| 0x40
| Secret Answer (UTF-16)
|}

===Parental Control Settings Block 0x000C0000===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x00
| 0x04
| [[#Parental Control Restriction Bitmask|Parental Control Restriction Bitmask]]
|-
| 0x04
| 0x04
| Unknown
|-
| 0x08
| 0x01
| Rating system used for configuration
|-
| 0x09
| 0x01
| Maximum allowed age (20 = No restriction)
|-
| 0x0A
| 0x01
| Secret Question Type (0-5: Pre-defined, 6: Custom)
|-
| 0x0B
| 0x01
| Unknown
|-
| 0x0C
| 0x08
| Parental Controls PIN code (with NULL-termination, although restricted to 4 digits)
|-
| 0x14
| 0x44
| Secret Answer (UTF-16)
|}

====Parental Control Restriction Bitmask====
{| class="wikitable" border="1"
|-
! Bit
! Restriction name
|-
| 0
| Global Parental Controls Enable
|-
| 1
| Internet Browser
|-
| 2
| Display of 3D Images (disabled on 2DS)
|-
| 3
| Sharing Images/Audio/Video/Long Text Data
|-
| 4
| Online Interaction
|-
| 5
| StreetPass
|-
| 6
| Friend Registration
|-
| 7
| DS Download Play
|-
| 8
| Nintendo 3DS Shopping Services (eShop / EC Applet)
|-
| 9
| View Distributed Videos
|-
| 10
| Miiverse (View)
|-
| 11
| Miiverse (Post)
|-
| 31
| "Child Online Privacy Protection" (see [[Cfg:GetRegionCanadaUSA|CFG:IsCoppacsSupported]])
|}

===Parental Control Settings Block 0x000C0002===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0000
| 0x0001
| Boolean, whether an e-Mail has been registered
|-
| 0x0001
| 0x0101
| Registered e-Mail address (Plaintext)
|-
| 0x0102
| 0x0068
| Custom Secret Question (UTF-16)
|}

Title Database

2026-06-16T11:24:26Z

TimmSkiller: Move table of contents to the correct location

__TOC__

These files contain data relating to install/usage/management of installed 3DS titles. The database files are located at:

* nand/dbs
* sdmc/Nintendo 3DS/<ID0>/<ID1>/dbs

ID0 is the first 0x10-bytes from a SHA256 [[nand/private/movable.sed|hash]]. The installation of [[SD Filesystem|SD Card]] titles was introduced in the [[2.0.0-2]] update and the SD dbs files are encrypted by [[SD Filesystem|the general SD filesystem encryption rule]]. These files are [[DISA and DIFF|DIFF containers]]. These DIFF files do not use external IVFC level 4, so all database data is duplicated in the container. In this page only the inner content of the container is described.

These files are only created on SD (via [[Application_Manager_Services|AM]]) if they don't exist when the [[eShop]] application is starting up, during network init etc (prior to showing the "system update required" dialog).

These files are stored under this directory:
{| class="wikitable" border="1"
|-
! Stored on SD card
! Stored in CTR-NAND
! Filename
! [[DISA and DIFF#CTR-9DB0|CTR-9DB0]] ID
! Description
|-
| No
| Yes
| ticket.db
| 0x0
| This contains the installed tickets (NAND and SD).
|-
| No
| Yes
| certs.db
| 0x1
| This contains the certificate chain used to verify TMDs and other certificates.
|-
| Yes
| Yes
| title.db
| 0x2
| Title database, this contains entries for all installed titles (TWL & CTR) on the 3DS (Each database is responsible for titles installed on its medium).
|-
| Yes
| Yes
| import.db
| 0x3
| This is an Import Database, it contains entries for titles (or versions of titles) not yet installed, ready for transferring to the title.db. (Automatic Update uses this, so completing the update takes seconds.)
|-
| No
| Yes
| tmp_t.db
| 0x4
| This is the temporary Title database containing one entry for the currently installed [[Download Play]] Child.
|-
| No
| Yes
| tmp_i.db
| 0x5
| Similar to import.db, except it's used in conjunction with tmp_t.db, for installing [[Download Play]] Children.
|}

The inner content of the container consists of a pre-header with size of 0x80 identifying the Database Type, followed by a BDRI container. The offsets in the BDRI header are usually relative to the offset to the start of the BDRI header (0x80 in the file)

== Pre Header ==

{| class="wikitable"
|-
! Start
! Length
! Description
|-
| 0x00
| 8
| Database Type "Magic" (see below)
|-
| 0x08
| 0x4
| Version (always 0)
|-
| 0xC
| 0x74
| Reserved
|}

For ticket.db, a different pre-header is used:

{| class="wikitable"
|-
! Start
! Length
! Description
|-
| 0x00
| 4
| Database Type "Magic" (see below)
|-
| 0x04
| 0x04
| Version (always 1)
|-
| 0x08
| 0x08
| Reserved
|}

=== Database Magic ===

{| class="wikitable"
|-
! Database Type
! Magic
|-
| CTR-NAND ticket.db
| TICK
|-
| CTR-NAND import.db
| NANDIDB
|-
| CTR-NAND title.db
| NANDTDB
|-
| CTR-NAND tmp_i.db
| TEMPIDB
|-
| CTR-NAND tmp_t.db
| TEMPIDB
|-
| SD Card import.db
| TEMPTDB
|-
| SD Card title.db
| TEMPTDB
|-
| (unused, likely supposed to be SD card import.db)
| SDMCIDB
|}

== BDRI ==

This is a variant of [[Inner FAT|FAT filesystem]]. It consists one "root" directory and multiple "files". Each "file" is one title info entry described below.

=== Title Info Entry ===

An entry contains information taken from both the application NCCH file(s) and TMD.

{| class="wikitable"
|-
! Start !! Length !! Description
|-
| 0x0 || 0x8 || u64, Title Size
|-
| 0x8 || 0x4 || u32, Title Type from TMD (usually 0x40)
|-
| 0xC || 0x2 || u16, Title Version
|-
| 0xE || 0x2 || u16, Content index for Download Play Child content
|-
| 0x10 || 0x2 || u16, Content index for Instruction Manual content
|-
| 0x12 || 0x2 || u16, Content index for Old3DS update partition (even though this is unused because digital titles don't have update partitions)
|-
| 0x14 || 0x4 || TMD file ID (the ID part in <code>{ID}.tmd</code> inside the title folder)
|-
| 0x18 || 0x4 || CMD file ID (the ID part in <code>{ID}.cmd</code> inside the title folder)
|-
| 0x1C || 0x4 || save file ID (the ID part in <code>{ID}.sav</code> inside the title/data folder)
|-
| 0x20 || 0x8 || u64, extdata ID (zero if title does not use extdata)
|-
| 0x28 || 0x1 || bool, has public.sav (DSiWare only)
|-
| 0x29 || 0x1 || bool, has private.sav (DSiWare only)
|-
| 0x2A || 0x1 || bool, has banner.sav (DSiWare only)
|-
| 0x2B || 0x1 || bool, requires moving public/private/banner.new to public/private/banner.sav (DSiWare only) (see [[AMPXI:WriteTWLSavedata]])
|-
| 0x2C || 0x1 || u8, CMD format version (see [[Titles#Data_Structure|Title Data Structure]])
|-
| 0x2D || 0x1 || bool, is user DSiWare title (as in, does not have system title bit set, see [[Title_list#TWL_(DSi)_Titles|TWL (DSi) Titles]] for more information)
|-
| 0x2E || 0x2 || u16, New3DS update partition content index (even though this is unused because digital titles don't have update partitions)
|-
| 0x30 || 0x10 || Product code (first 12 bytes of raw .nds for DSiWare, which is the game title)
|-
| 0x40 || 0x8 || u64, ordering number. Used in some code paths to find the "latest" added entry, but this value is never written and always 0.
|-
| 0x48 || 0x1 || bool, is temporary (true for DLP child titles added into tmp_i/tmp_t.db)
|-
| 0x49 || 0x1 || u8, [[Application_Manager_Services#ImportTitleContextState|ImportTitleContextState]]
|-
| 0x4A || 0x1 || bool, overwrite (set when reinstalling an existing title)
|-
| 0x4B || 0x1 || Reserved
|-
| 0x4C || 0x4 || Content ID for content index 0, 0xFFFFFFFF if not applicable
|-
| 0x50 || 0x4 || u32, random value generated during title installation (See [[CTXT]])
|-
| 0x54 || 0x2C || Reserved
|}

=== Ticket Info Entry ===
For ticket.db entries, there is a header indicates ticket count (as a Title ID can have more than one ticket installed). Then each entry contains the size, followed by the actual ticket data.

{| class="wikitable"
|+ Header
|-
! Start
! Length
! Description
|-
| 0x0
| 4
| Amount of tickets X
|-
| 0x4
| X * (size of tickets + 4)
| Ticket entries
|}
{| class="wikitable"
|+ Ticket entry
|-
! Start
! Length
! Description
|-
| 0x0
| 4
| Ticket data size X (often 0x350 but some DLC tickets may be larger)
|-
| 0x4
| X
| [[Ticket|Ticket]] data
|}

'''NOTES:'''

It is important to note the database doesn't contain a hash of the [[Title Data Structure|.cmd]]. So if a user has more than one valid set of [[Title Data Structure|application data]] for a given .cmd Content ID they can be manually interchanged without issue. Though renaming a .cmd file to match the Content ID which the title.db is expecting will result in an error, as the CTR for the per-console encryption layer changes depending on the file path, and the MAC of the .cmd is probably generated with the .cmd Content ID in mind.

These NAND/SD /dbs images seem to be loaded by the ARM9 while NATIVE_FIRM is booting.

Removing ticket.db from a New-3DS with signature checks disabled will not result in an unbootable system, however all icons except Slot-1 will disappear from Home. Applets can however still be used. Recovery can be accomplished via [[Hardware|hardmod]] or [[arm9loaderhax]] plus a known good backup of the file (or the whole partition or disk); Gamecard exploits were not tested, and Browserhax did not work.

Template:IPC/SendPXIBufferRW

2026-06-06T08:45:08Z

TimmSkiller:

<noinclude>
{{IPC/Request|ipc_offset_prefix=n + }}
</noinclude>{{IPC/RequestEntry|''{{Tooltip|Descriptor|0x00000004 {{!}} ({{{2}}} <nowiki><<</nowiki> 4) {{!}} (size <nowiki><<</nowiki> 8)}} for copying a [[IPC#Usage_Examples_for_other_Translation_Types|read-write buffer over PXI]] to the target process (id {{{2}}})''|descstyle=border-bottom-style:dashed}}
{{IPC/RequestEntry|{{{1}}}|descstyle=border-top-style:none}}<noinclude>
{{IPC/RequestEnd}}
{{Documentation}}
[[Category:IPC message contents templates]]</noinclude>

Template:IPC/SendPXIBufferR

2026-06-06T08:44:45Z

TimmSkiller:

<noinclude>
{{IPC/Request|ipc_offset_prefix=n + }}
</noinclude>{{IPC/RequestEntry|''{{Tooltip|Descriptor|0x00000006 {{!}} ({{{2}}} <nowiki><<</nowiki> 4) {{!}} (size <nowiki><<</nowiki> 8)}} for copying a [[IPC#Usage_Examples_for_other_Translation_Types|read-only buffer over PXI]] to the target process (id {{{2}}})''|descstyle=border-bottom-style:dashed}}
{{IPC/RequestEntry|{{{1}}}|descstyle=border-top-style:none}}<noinclude>
{{IPC/RequestEnd}}
{{Documentation}}
[[Category:IPC message contents templates]]</noinclude>

Template:IPC/SendPXIBufferR

2026-06-06T08:44:18Z

TimmSkiller:

<noinclude>
{{IPC/Request|ipc_offset_prefix=n + }}
</noinclude>{{IPC/RequestEntry|''{{Tooltip|Descriptor|0x00000006 {{!}} (size <nowiki><<</nowiki> 8) {{!}} ({{{2}}} <nowiki><<</nowiki> 4)}} for copying a [[IPC#Usage_Examples_for_other_Translation_Types|read-only buffer over PXI]] to the target process (id {{{2}}})''|descstyle=border-bottom-style:dashed}}
{{IPC/RequestEntry|{{{1}}}|descstyle=border-top-style:none}}<noinclude>
{{IPC/RequestEnd}}
{{Documentation}}
[[Category:IPC message contents templates]]</noinclude>

Template:IPC/SendPXIBufferR

2026-06-06T08:43:44Z

TimmSkiller:

<noinclude>
{{IPC/Request|ipc_offset_prefix=n + }}
</noinclude>{{IPC/RequestEntry|''{{Tooltip|Descriptor|0x00000006 {{!}} (size <nowiki><<</nowiki> 8) {{!}} ({{{2}}} <nowiki><<</nowiki> 4)}} for copying a [[IPC#Usage_Examples_for_other_Translation_Types|read-only buffer over PXI]] to the target process ({{{2}}})''|descstyle=border-bottom-style:dashed}}
{{IPC/RequestEntry|{{{1}}}|descstyle=border-top-style:none}}<noinclude>
{{IPC/RequestEnd}}
{{Documentation}}
[[Category:IPC message contents templates]]</noinclude>

Template:IPC/SendPXIBufferRW

2026-06-06T08:43:28Z

TimmSkiller:

<noinclude>
{{IPC/Request|ipc_offset_prefix=n + }}
</noinclude>{{IPC/RequestEntry|''{{Tooltip|Descriptor|0x00000004 {{!}} (size <nowiki><<</nowiki> 8) {{!}} ({{{2}}} <nowiki><<</nowiki> 4)}} for copying a [[IPC#Usage_Examples_for_other_Translation_Types|read-write buffer over PXI]] to the target process ({{{2}}})''|descstyle=border-bottom-style:dashed}}
{{IPC/RequestEntry|{{{1}}}|descstyle=border-top-style:none}}<noinclude>
{{IPC/RequestEnd}}
{{Documentation}}
[[Category:IPC message contents templates]]</noinclude>

Template:IPC/SendPXIBufferRW

2026-06-06T08:38:59Z

TimmSkiller: Created page with "<noinclude> {{IPC/Request|ipc_offset_prefix=n + }} </noinclude>{{IPC/RequestEntry|''{{Tooltip|Descriptor|0x00000004 {{!}} (size <nowiki><<</nowiki> 8) {{!}} ({{{2}}} <nowiki><<</nowiki> 4)}} for copying a {{#if:{{{2|}}}|{{{2}}} byte<nowiki> </nowiki>|}}read-write buffer over PXI to the target process ({{{2}}})''|descstyle=border-bottom-style:dashed}} {{IPC/RequestEntry|{{{1}}}|descstyle=border-top-style:none}}<..."

<noinclude>
{{IPC/Request|ipc_offset_prefix=n + }}
</noinclude>{{IPC/RequestEntry|''{{Tooltip|Descriptor|0x00000004 {{!}} (size <nowiki><<</nowiki> 8) {{!}} ({{{2}}} <nowiki><<</nowiki> 4)}} for copying a {{#if:{{{2|}}}|{{{2}}} byte<nowiki> </nowiki>|}}[[IPC#Usage_Examples_for_other_Translation_Types|read-write buffer over PXI]] to the target process ({{{2}}})''|descstyle=border-bottom-style:dashed}}
{{IPC/RequestEntry|{{{1}}}|descstyle=border-top-style:none}}<noinclude>
{{IPC/RequestEnd}}
{{Documentation}}
[[Category:IPC message contents templates]]</noinclude>

Template:IPC/SendPXIBufferR

2026-06-06T08:37:06Z

TimmSkiller: Created page with "<noinclude> {{IPC/Request|ipc_offset_prefix=n + }} </noinclude>{{IPC/RequestEntry|''{{Tooltip|Descriptor|0x00000006 {{!}} (size <nowiki><<</nowiki> 8) {{!}} ({{{2}}} <nowiki><<</nowiki> 4)}} for copying a {{#if:{{{2|}}}|{{{2}}} byte<nowiki> </nowiki>|}}read-only buffer over PXI to the target process ({{{2}}})''|descstyle=border-bottom-style:dashed}} {{IPC/RequestEntry|{{{1}}}|descstyle=border-top-style:none}}<n..."

<noinclude>
{{IPC/Request|ipc_offset_prefix=n + }}
</noinclude>{{IPC/RequestEntry|''{{Tooltip|Descriptor|0x00000006 {{!}} (size <nowiki><<</nowiki> 8) {{!}} ({{{2}}} <nowiki><<</nowiki> 4)}} for copying a {{#if:{{{2|}}}|{{{2}}} byte<nowiki> </nowiki>|}}[[IPC#Usage_Examples_for_other_Translation_Types|read-only buffer over PXI]] to the target process ({{{2}}})''|descstyle=border-bottom-style:dashed}}
{{IPC/RequestEntry|{{{1}}}|descstyle=border-top-style:none}}<noinclude>
{{IPC/RequestEnd}}
{{Documentation}}
[[Category:IPC message contents templates]]</noinclude>

I2C Services

2026-05-28T12:49:36Z

TimmSkiller: /* I2C Service Names */

[[Category:Services]]
__FORCETOC__
== I2C Service Names ==
{| class="wikitable" border="1"
|-
! Service names
! Accessible [[I2C_Registers#I2C_Devices|deviceIDs]]
! Service used by sysmodule
|-
| "i2c::MCU"
| 0, 3
| [[MCU_Services|MCU]]
|-
| "i2c::CAM"
| 1, 2, 4
| [[Camera_Services|Camera]]
|-
| "i2c::LCD"
| 5, 6
| [[GSP_Services|GSP]]
|-
| "i2c::DEB"
| 7, 8
| dmnt
|-
| "i2c::HID"
| 9, 10, 11, 12
| [[HID_Services|HID]]
|-
| "i2c::IR"
| 13, and additionally for New3DS i2c module: 17
| [[IR_Services|IR]]
|-
| "i2c::EEP"
| 14
| [[Config_Services|Cfg]]
|-
| colspan="3" |
New3DS-sysmodule specific services:

|-
| "i2c::NFC"
| 15
| New3DS [[NFC_Services|NFC]]
|-
| "i2c::QTM"
| 16
| New3DS [[QTM_Services|QTM]]
|}

Each I2C service can only access certain I2C [[I2C_Registers|device(s)]].

== Commands ==
{| class="wikitable" border="1"
|-
! Command Header !! Description !! Available since system-version
|-
| 0x00010100 || [[I2C:ReplaceRegisterBits8|ReplaceRegisterBits8]] || All
|-
| 0x000200C0 || [[I2C:SetRegisterBits8|SetRegisterBits8]] || All
|-
| 0x000300C0 || [[I2C:ClearRegisterBits8|ClearRegisterBits8]] || All
|-
| 0x00040102 || [[I2C:MultiReplaceRegisterBits16|MultiReplaceRegisterBits16]] || All
|-
| 0x000500C0 || [[I2C:WriteRegister8|WriteRegister8]] || All
|-
| 0x00060080 || [[I2C:WriteDeviceRaw8|WriteDeviceRaw8]] || All
|-
| 0x000700C0 || [[I2C:WriteRegister16|WriteRegister16]] || All
|-
| 0x000800C2 || [[I2C:MultiWriteRegister16|MultiWriteRegister16]] || All
|-
| 0x00090080 || [[I2C:ReadRegister8|ReadRegister8]] || All
|-
| 0x000A0080 || [[I2C:ReadRegister16|ReadRegister16]] || All
|-
| 0x000B00C2 || [[I2C:WriteRegisters8|WriteRegisters8]] || All
|-
| 0x000C00C2 || [[I2C:WriteRegisters16|WriteRegisters16]] || All
|-
| 0x000D00C0 || [[I2C:ReadRegisters8|ReadRegisters8]] || All
|-
| 0x000E00C2 || [[I2C:WriteRegisters8_2|WriteRegisters8_2]] || All
|-
| 0x000F00C0 || [[I2C:LegacyReadRegisters8|LegacyReadRegisters8]] || All
|-
| 0x001000C0 || [[I2C:ReadRegisters16|ReadRegisters16]] || All
|-
| 0x001100C2 || [[I2C:WriteRegistersBuffer8|WriteRegistersBuffer8]] || All
|-
| 0x001200C2 || [[I2C:ReadRegistersBuffer8|ReadRegistersBuffer8]] || All
|-
| colspan="3" |
and, for the New3DS-specific version of the sysmodule (though technically the Old3DS supports these commands as well):

|-
| 0x00130040 || [[I2C:ReadDeviceRaw8|ReadDeviceRaw8]] || [[8.0.0-18]]
|-
| 0x00140082 || [[I2C:WriteDeviceRaw|WriteDeviceRaw]] || [[8.0.0-18]]
|-
| 0x00150080 || [[I2C:ReadDeviceRaw|ReadDeviceRaw]] || [[8.0.0-18]]
|}

Commands 0x00140082 and 0x00150080 are used by [[NFC_Services|NFC]] module.

Command 0x00150080 is also used for reading ZL, ZR, and C-stick data by [[IR Services]].

== Common Result Values ==
{| class="wikitable" border="1"
|-
! Result code !! Description
|-
| 0xE0A02FEA || The current session is not permitted to access the specified device ID.
|-
| 0xF9602FEF || Communication error. Device may not be connected.
|}

I2C Services

2026-05-28T12:48:58Z

TimmSkiller:

[[Category:Services]]
__FORCETOC__
== I2C Service Names ==
{| class="wikitable" border="1"
|-
! Service names
! Accessible [[I2C_Registers#I2C_Devices|deviceIDs]]
! Service used by sysmodule
|-
| "i2c::MCU"
| 0, 3
| [[MCU_Services|MCU]]
|-
| "i2c::CAM"
| 1, 2, 4
| [[Camera_Services|Camera]]
|-
| "i2c::LCD"
| 5, 6
| [[GSP_Services|GSP]]
|-
| "i2c::DEB"
| 7, 8
| Unknown
|-
| "i2c::HID"
| 9, 10, 11, 12
| [[HID_Services|HID]]
|-
| "i2c::IR"
| 13, and additionally for New3DS i2c module: 17
| [[IR_Services|IR]]
|-
| "i2c::EEP"
| 14
| [[Config_Services|Cfg]]
|-
| colspan="3" |
New3DS-sysmodule specific services:

|-
| "i2c::NFC"
| 15
| New3DS [[NFC_Services|NFC]]
|-
| "i2c::QTM"
| 16
| New3DS [[QTM_Services|QTM]]
|}

Each I2C service can only access certain I2C [[I2C_Registers|device(s)]].

== Commands ==
{| class="wikitable" border="1"
|-
! Command Header !! Description !! Available since system-version
|-
| 0x00010100 || [[I2C:ReplaceRegisterBits8|ReplaceRegisterBits8]] || All
|-
| 0x000200C0 || [[I2C:SetRegisterBits8|SetRegisterBits8]] || All
|-
| 0x000300C0 || [[I2C:ClearRegisterBits8|ClearRegisterBits8]] || All
|-
| 0x00040102 || [[I2C:MultiReplaceRegisterBits16|MultiReplaceRegisterBits16]] || All
|-
| 0x000500C0 || [[I2C:WriteRegister8|WriteRegister8]] || All
|-
| 0x00060080 || [[I2C:WriteDeviceRaw8|WriteDeviceRaw8]] || All
|-
| 0x000700C0 || [[I2C:WriteRegister16|WriteRegister16]] || All
|-
| 0x000800C2 || [[I2C:MultiWriteRegister16|MultiWriteRegister16]] || All
|-
| 0x00090080 || [[I2C:ReadRegister8|ReadRegister8]] || All
|-
| 0x000A0080 || [[I2C:ReadRegister16|ReadRegister16]] || All
|-
| 0x000B00C2 || [[I2C:WriteRegisters8|WriteRegisters8]] || All
|-
| 0x000C00C2 || [[I2C:WriteRegisters16|WriteRegisters16]] || All
|-
| 0x000D00C0 || [[I2C:ReadRegisters8|ReadRegisters8]] || All
|-
| 0x000E00C2 || [[I2C:WriteRegisters8_2|WriteRegisters8_2]] || All
|-
| 0x000F00C0 || [[I2C:LegacyReadRegisters8|LegacyReadRegisters8]] || All
|-
| 0x001000C0 || [[I2C:ReadRegisters16|ReadRegisters16]] || All
|-
| 0x001100C2 || [[I2C:WriteRegistersBuffer8|WriteRegistersBuffer8]] || All
|-
| 0x001200C2 || [[I2C:ReadRegistersBuffer8|ReadRegistersBuffer8]] || All
|-
| colspan="3" |
and, for the New3DS-specific version of the sysmodule (though technically the Old3DS supports these commands as well):

|-
| 0x00130040 || [[I2C:ReadDeviceRaw8|ReadDeviceRaw8]] || [[8.0.0-18]]
|-
| 0x00140082 || [[I2C:WriteDeviceRaw|WriteDeviceRaw]] || [[8.0.0-18]]
|-
| 0x00150080 || [[I2C:ReadDeviceRaw|ReadDeviceRaw]] || [[8.0.0-18]]
|}

Commands 0x00140082 and 0x00150080 are used by [[NFC_Services|NFC]] module.

Command 0x00150080 is also used for reading ZL, ZR, and C-stick data by [[IR Services]].

== Common Result Values ==
{| class="wikitable" border="1"
|-
! Result code !! Description
|-
| 0xE0A02FEA || The current session is not permitted to access the specified device ID.
|-
| 0xF9602FEF || Communication error. Device may not be connected.
|}

I2C Services

2026-05-28T12:48:17Z

TimmSkiller:

[[Category:Services]]
== I2C Service Names ==
{| class="wikitable" border="1"
|-
! Service names
! Accessible [[I2C_Registers#I2C_Devices|deviceIDs]]
! Service used by sysmodule
|-
| "i2c::MCU"
| 0, 3
| [[MCU_Services|MCU]]
|-
| "i2c::CAM"
| 1, 2, 4
| [[Camera_Services|Camera]]
|-
| "i2c::LCD"
| 5, 6
| [[GSP_Services|GSP]]
|-
| "i2c::DEB"
| 7, 8
| Unknown
|-
| "i2c::HID"
| 9, 10, 11, 12
| [[HID_Services|HID]]
|-
| "i2c::IR"
| 13, and additionally for New3DS i2c module: 17
| [[IR_Services|IR]]
|-
| "i2c::EEP"
| 14
| [[Config_Services|Cfg]]
|-
| colspan="3" |
New3DS-sysmodule specific services:

|-
| "i2c::NFC"
| 15
| New3DS [[NFC_Services|NFC]]
|-
| "i2c::QTM"
| 16
| New3DS [[QTM_Services|QTM]]
|}

Each I2C service can only access certain I2C [[I2C_Registers|device(s)]].

== Commands ==
{| class="wikitable" border="1"
|-
! Command Header !! Description !! Available since system-version
|-
| 0x00010100 || [[I2C:ReplaceRegisterBits8|ReplaceRegisterBits8]] || All
|-
| 0x000200C0 || [[I2C:SetRegisterBits8|SetRegisterBits8]] || All
|-
| 0x000300C0 || [[I2C:ClearRegisterBits8|ClearRegisterBits8]] || All
|-
| 0x00040102 || [[I2C:MultiReplaceRegisterBits16|MultiReplaceRegisterBits16]] || All
|-
| 0x000500C0 || [[I2C:WriteRegister8|WriteRegister8]] || All
|-
| 0x00060080 || [[I2C:WriteDeviceRaw8|WriteDeviceRaw8]] || All
|-
| 0x000700C0 || [[I2C:WriteRegister16|WriteRegister16]] || All
|-
| 0x000800C2 || [[I2C:MultiWriteRegister16|MultiWriteRegister16]] || All
|-
| 0x00090080 || [[I2C:ReadRegister8|ReadRegister8]] || All
|-
| 0x000A0080 || [[I2C:ReadRegister16|ReadRegister16]] || All
|-
| 0x000B00C2 || [[I2C:WriteRegisters8|WriteRegisters8]] || All
|-
| 0x000C00C2 || [[I2C:WriteRegisters16|WriteRegisters16]] || All
|-
| 0x000D00C0 || [[I2C:ReadRegisters8|ReadRegisters8]] || All
|-
| 0x000E00C2 || [[I2C:WriteRegisters8_2|WriteRegisters8_2]] || All
|-
| 0x000F00C0 || [[I2C:LegacyReadRegisters8|LegacyReadRegisters8]] || All
|-
| 0x001000C0 || [[I2C:ReadRegisters16|ReadRegisters16]] || All
|-
| 0x001100C2 || [[I2C:WriteRegistersBuffer8|WriteRegistersBuffer8]] || All
|-
| 0x001200C2 || [[I2C:ReadRegistersBuffer8|ReadRegistersBuffer8]] || All
|-
| colspan="3" |
and, for the New3DS-specific version of the sysmodule (though technically the Old3DS supports these commands as well):

|-
| 0x00130040 || [[I2C:ReadDeviceRaw8|ReadDeviceRaw8]] || [[8.0.0-18]]
|-
| 0x00140082 || [[I2C:WriteDeviceRaw|WriteDeviceRaw]] || [[8.0.0-18]]
|-
| 0x00150080 || [[I2C:ReadDeviceRaw|ReadDeviceRaw]] || [[8.0.0-18]]
|}

Commands 0x00140082 and 0x00150080 are used by [[NFC_Services|NFC]] module.

Command 0x00150080 is also used for reading ZL, ZR, and C-stick data by [[IR Services]].

== Common Result Values ==
{| class="wikitable" border="1"
|-
! Result code !! Description
|-
| 0xE0A02FEA || The current session is not permitted to access the specified device ID.
|-
| 0xF9602FEF || Communication error. Device may not be connected.
|}

I2C Services

2026-05-28T12:47:34Z

TimmSkiller: Add common errors

[[Category:Services]]
= I2C Service Names =
{| class="wikitable" border="1"
|-
! Service names
! Accessible [[I2C_Registers#I2C_Devices|deviceIDs]]
! Service used by sysmodule
|-
| "i2c::MCU"
| 0, 3
| [[MCU_Services|MCU]]
|-
| "i2c::CAM"
| 1, 2, 4
| [[Camera_Services|Camera]]
|-
| "i2c::LCD"
| 5, 6
| [[GSP_Services|GSP]]
|-
| "i2c::DEB"
| 7, 8
| Unknown
|-
| "i2c::HID"
| 9, 10, 11, 12
| [[HID_Services|HID]]
|-
| "i2c::IR"
| 13, and additionally for New3DS i2c module: 17
| [[IR_Services|IR]]
|-
| "i2c::EEP"
| 14
| [[Config_Services|Cfg]]
|-
| colspan="3" |
New3DS-sysmodule specific services:

|-
| "i2c::NFC"
| 15
| New3DS [[NFC_Services|NFC]]
|-
| "i2c::QTM"
| 16
| New3DS [[QTM_Services|QTM]]
|}

Each I2C service can only access certain I2C [[I2C_Registers|device(s)]].

= I2C Service =
{| class="wikitable" border="1"
|-
! Command Header !! Description !! Available since system-version
|-
| 0x00010100 || [[I2C:ReplaceRegisterBits8|ReplaceRegisterBits8]] || All
|-
| 0x000200C0 || [[I2C:SetRegisterBits8|SetRegisterBits8]] || All
|-
| 0x000300C0 || [[I2C:ClearRegisterBits8|ClearRegisterBits8]] || All
|-
| 0x00040102 || [[I2C:MultiReplaceRegisterBits16|MultiReplaceRegisterBits16]] || All
|-
| 0x000500C0 || [[I2C:WriteRegister8|WriteRegister8]] || All
|-
| 0x00060080 || [[I2C:WriteDeviceRaw8|WriteDeviceRaw8]] || All
|-
| 0x000700C0 || [[I2C:WriteRegister16|WriteRegister16]] || All
|-
| 0x000800C2 || [[I2C:MultiWriteRegister16|MultiWriteRegister16]] || All
|-
| 0x00090080 || [[I2C:ReadRegister8|ReadRegister8]] || All
|-
| 0x000A0080 || [[I2C:ReadRegister16|ReadRegister16]] || All
|-
| 0x000B00C2 || [[I2C:WriteRegisters8|WriteRegisters8]] || All
|-
| 0x000C00C2 || [[I2C:WriteRegisters16|WriteRegisters16]] || All
|-
| 0x000D00C0 || [[I2C:ReadRegisters8|ReadRegisters8]] || All
|-
| 0x000E00C2 || [[I2C:WriteRegisters8_2|WriteRegisters8_2]] || All
|-
| 0x000F00C0 || [[I2C:LegacyReadRegisters8|LegacyReadRegisters8]] || All
|-
| 0x001000C0 || [[I2C:ReadRegisters16|ReadRegisters16]] || All
|-
| 0x001100C2 || [[I2C:WriteRegistersBuffer8|WriteRegistersBuffer8]] || All
|-
| 0x001200C2 || [[I2C:ReadRegistersBuffer8|ReadRegistersBuffer8]] || All
|-
| colspan="3" |
and, for the New3DS-specific version of the sysmodule (though technically the Old3DS supports these commands as well):

|-
| 0x00130040 || [[I2C:ReadDeviceRaw8|ReadDeviceRaw8]] || [[8.0.0-18]]
|-
| 0x00140082 || [[I2C:WriteDeviceRaw|WriteDeviceRaw]] || [[8.0.0-18]]
|-
| 0x00150080 || [[I2C:ReadDeviceRaw|ReadDeviceRaw]] || [[8.0.0-18]]
|}

Commands 0x00140082 and 0x00150080 are used by [[NFC_Services|NFC]] module.

Command 0x00150080 is also used for reading ZL, ZR, and C-stick data by [[IR Services]].

= Common Result Values =
{| class="wikitable" border="1"
|-
! Result code !! Description
|-
| 0xE0A02FEA || The current session is not permitted to access the specified device ID.
|-
| 0xF9602FEF || Communication error. Device may not be connected.
|}

I2C:ReadDeviceRaw

2026-05-28T12:43:06Z

TimmSkiller:

=Request=

{{IPC/Request}}
{{IPC/RequestHeader|0x0015|1|0}}
{{IPC/RequestEntry|u8, device ID}}
{{IPC/RequestEnd}}

=Request Static Buffers=
{{IPC/RequestStaticBuffers}}
{{#vardefine:ipc_offset|0}}
{{IPC/TranslateStaticBuffer|Output buffer pointer|0}}
{{IPC/RequestEnd}}

=Response=

{{IPC/Request}}
{{#vardefine:ipc_offset|0}}
{{IPC/RequestHeader|0x0015|1|2}}
{{IPC/RequestEntry|Result code}}
{{IPC/TranslateStaticBuffer|Output buffer pointer|0}}
{{IPC/RequestEnd}}

=Description=
Reads a buffer from the given I2C device raw, without selecting a specific register first.

The maximum output buffer size is 0x200 for the New3DS i2c-sysmodule, and 0x20 for the Old3DS version.

This is similar to [[I2C:ReadDeviceRaw8]], except this allows for reading a buffer instead of a single value.

I2C:WriteDeviceRaw

2026-05-28T12:42:50Z

TimmSkiller:

=Request=

{{IPC/Request}}
{{IPC/RequestHeader|0x0014|2|2}}
{{IPC/RequestEntry|u8, device ID}}
{{IPC/RequestEntry|u32, size}}
{{IPC/TranslateStaticBuffer|Input buffer pointer|1}}
{{IPC/RequestEnd}}

=Response=

{{IPC/Request}}
{{#vardefine:ipc_offset|0}}
{{IPC/RequestHeader|0x0014|1|0}}
{{IPC/RequestEntry|Result code}}
{{IPC/RequestEnd}}

=Description=
Writes a buffer to the given I2C device raw, without selecting a specific register first.

The maximum input buffer size is 0x200 for the New3DS i2c-sysmodule, and 0x10 for the Old3DS version.

This is similar to [[I2C:WriteDeviceRaw8]], except this allows for writing a buffer instead of a single value.

I2C:ReadRegisters16

2026-05-28T12:42:29Z

TimmSkiller:

=Request=

{{IPC/Request}}
{{IPC/RequestHeader|0x0010|3|0}}
{{IPC/RequestEntry|u8, device ID}}
{{IPC/RequestEntry|u16, starting register}}
{{IPC/RequestEntry|u32, count}}
{{IPC/RequestEnd}}

=Request Static Buffers=
{{IPC/RequestStaticBuffers}}
{{#vardefine:ipc_offset|0}}
{{IPC/TranslateStaticBuffer|Output buffer pointer|0}}
{{IPC/RequestEnd}}

=Response=

{{IPC/Request}}
{{#vardefine:ipc_offset|0}}
{{IPC/RequestHeader|0x0010|1|2}}
{{IPC/RequestEntry|Result code}}
{{IPC/TranslateStaticBuffer|Output buffer pointer|0}}
{{IPC/RequestEnd}}

=Description=
Reads a range of 16-bit I2C registers of the specified device sequentially to the given buffer.

The maximum output buffer size is 0x200 for the New3DS i2c-sysmodule, and 0x20 for the Old3DS version.

This is similar to [[I2C:ReadRegisters8]], except this reads from 16-bit registers.

For example, assuming:

<pre>
reg[5] = 0xAAAA, reg[6] = 0xBBBB, reg[7] = 0xCCCC, reg[8] = 0xDDDD
</pre>

Then reading with count 4 and starting register 5 would result in:

<pre>
outbuf[0] = 0xAAAA
outbuf[1] = 0xBBBB
outbuf[2] = 0xCCCC
outbuf[3] = 0xDDDD
</pre>

I2C:LegacyReadRegisters8

2026-05-28T12:42:14Z

TimmSkiller:

=Request=

{{IPC/Request}}
{{IPC/RequestHeader|0x000F|3|0}}
{{IPC/RequestEntry|u8, device ID}}
{{IPC/RequestEntry|u8, starting register}}
{{IPC/RequestEntry|u32, size}}
{{IPC/RequestEnd}}

=Request Static Buffers=
{{IPC/RequestStaticBuffers}}
{{#vardefine:ipc_offset|0}}
{{IPC/TranslateStaticBuffer|Output buffer pointer|0}}
{{IPC/RequestEnd}}

=Response=

{{IPC/Request}}
{{#vardefine:ipc_offset|0}}
{{IPC/RequestHeader|0x000F|1|2}}
{{IPC/RequestEntry|Result code}}
{{IPC/TranslateStaticBuffer|Output buffer pointer|0}}
{{IPC/RequestEnd}}

=Description=
Reads a range of 8-bit I2C registers of the specified device sequentially to the given buffer.

The maximum output buffer size is 0x200 for the New3DS i2c-sysmodule, and 0x20 for the Old3DS version.

This is similar to [[I2C:ReadRegisters8]] except:
* Before selecting the device, this waits 1500ns.
* Before reading the first byte and after reading the last byte, this waits 15µs.

For example, assuming:

<pre>
reg[5] = 0xAA, reg[6] = 0xBB, reg[7] = 0xCC, reg[8] = 0xDD
</pre>

Then reading 4 bytes with starting register 5 would result in:

<pre>
outbuf[0] = 0xAA
outbuf[1] = 0xBB
outbuf[2] = 0xCC
outbuf[3] = 0xDD
</pre>

I2C:WriteRegisters8 2

2026-05-28T12:41:52Z

TimmSkiller:

=Request=

{{IPC/Request}}
{{IPC/RequestHeader|0x000E|3|2}}
{{IPC/RequestEntry|u8, device ID}}
{{IPC/RequestEntry|u8, starting register}}
{{IPC/RequestEntry|u32, size}}
{{IPC/TranslateStaticBuffer|Input buffer pointer|1}}
{{IPC/RequestEnd}}

=Response=

{{IPC/Request}}
{{#vardefine:ipc_offset|0}}
{{IPC/RequestHeader|0x000E|1|0}}
{{IPC/RequestEntry|Result code}}
{{IPC/RequestEnd}}

=Description=
This is identical to [[I2C:WriteRegisters8]].

Writes the given buffer sequentially to a range of 8-bit I2C registers of the specified device.

The maximum input buffer size is 0x200 for the New3DS i2c-sysmodule, and 0x10 for the Old3DS version.

For example, writing a buffer of consisting of <code>{ 0xAA, 0xBB, 0xCC, 0xDD }</code> with starting register 0x5 would do the following:

<pre>
reg[0x5] = 0xAA
reg[0x6] = 0xBB
reg[0x7] = 0xCC
reg[0x8] = 0xDD
</pre>

I2C:ReadRegisters8

2026-05-28T12:41:37Z

TimmSkiller:

=Request=

{{IPC/Request}}
{{IPC/RequestHeader|0x000D|3|0}}
{{IPC/RequestEntry|u8, device ID}}
{{IPC/RequestEntry|u8, starting register}}
{{IPC/RequestEntry|u32, size}}
{{IPC/RequestEnd}}

=Request Static Buffers=
{{IPC/RequestStaticBuffers}}
{{#vardefine:ipc_offset|0}}
{{IPC/TranslateStaticBuffer|Output buffer pointer|0}}
{{IPC/RequestEnd}}

=Response=

{{IPC/Request}}
{{#vardefine:ipc_offset|0}}
{{IPC/RequestHeader|0x000D|1|2}}
{{IPC/RequestEntry|Result code}}
{{IPC/TranslateStaticBuffer|Output buffer pointer|0}}
{{IPC/RequestEnd}}

=Description=
Reads a range of 8-bit I2C registers of the specified device sequentially to the given buffer.

The maximum output buffer size is 0x200 for the New3DS i2c-sysmodule, and 0x20 for the Old3DS version.

For example, assuming:

<pre>
reg[5] = 0xAA, reg[6] = 0xBB, reg[7] = 0xCC, reg[8] = 0xDD
</pre>

Then reading 4 bytes with starting register 5 would result in:

<pre>
outbuf[0] = 0xAA
outbuf[1] = 0xBB
outbuf[2] = 0xCC
outbuf[3] = 0xDD
</pre>

I2C:WriteRegisters16

2026-05-28T12:41:21Z

TimmSkiller:

=Request=

{{IPC/Request}}
{{IPC/RequestHeader|0x000C|3|2}}
{{IPC/RequestEntry|u8, device ID}}
{{IPC/RequestEntry|u16, starting register}}
{{IPC/RequestEntry|u32, size}}
{{IPC/TranslateStaticBuffer|Input buffer pointer|1}}
{{IPC/RequestEnd}}

=Response=

{{IPC/Request}}
{{#vardefine:ipc_offset|0}}
{{IPC/RequestHeader|0x000C|1|0}}
{{IPC/RequestEntry|Result code}}
{{IPC/RequestEnd}}

=Description=
Writes the given buffer sequentially to a range of 16-bit I2C registers of the specified device.

The maximum input buffer size is 0x200 for the New3DS i2c-sysmodule, and 0x10 for the Old3DS version.

For example, writing a buffer of consisting of <code>{ 0xAAAA, 0xBBBB, 0xCCCC, 0xDDDD }</code> with starting register 0x5 would do the following:

<pre>
reg[0x5] = 0xAAAA
reg[0x6] = 0xBBBB
reg[0x7] = 0xCCCC
reg[0x8] = 0xDDDD
</pre>

This is similar to [[I2C:WriteRegisters8]] except this uses 16-bit registers.

I2C:WriteRegisters8

2026-05-28T12:41:11Z

TimmSkiller:

=Request=

{{IPC/Request}}
{{IPC/RequestHeader|0x000B|3|2}}
{{IPC/RequestEntry|u8, device ID}}
{{IPC/RequestEntry|u8, starting register}}
{{IPC/RequestEntry|u32, size}}
{{IPC/TranslateStaticBuffer|Input buffer pointer|1}}
{{IPC/RequestEnd}}

=Response=

{{IPC/Request}}
{{#vardefine:ipc_offset|0}}
{{IPC/RequestHeader|0x000B|1|0}}
{{IPC/RequestEntry|Result code}}
{{IPC/RequestEnd}}

=Description=
Writes the given buffer sequentially to a range of 8-bit I2C registers of the specified device.

The maximum input buffer size is 0x200 for the New3DS i2c-sysmodule, and 0x10 for the Old3DS version.

For example, writing a buffer of consisting of <code>{ 0xAA, 0xBB, 0xCC, 0xDD }</code> with starting register 0x5 would do the following:

<pre>
reg[0x5] = 0xAA
reg[0x6] = 0xBB
reg[0x7] = 0xCC
reg[0x8] = 0xDD
</pre>

I2C:MultiWriteRegister16

2026-05-28T12:40:54Z

TimmSkiller:

=Request=

{{IPC/Request}}
{{IPC/RequestHeader|0x0008|3|2}}
{{IPC/RequestEntry|u16, register}}
{{IPC/RequestEntry|u16, value}}
{{IPC/RequestEntry|u32, number of device IDs}}
{{IPC/TranslateStaticBuffer|Input device IDs pointer|0}}
{{IPC/RequestEnd}}

=Response=

{{IPC/Request}}
{{#vardefine:ipc_offset|0}}
{{IPC/RequestHeader|0x0008|1|0}}
{{IPC/RequestEntry|Result code}}
{{IPC/RequestEnd}}

=Description=
Writes to the same register across multiple I2C devices.

The maximum input buffer size is 0x200 for the New3DS i2c-sysmodule, and 0x10 for the Old3DS version.

I2C:MultiReplaceRegisterBits16

2026-05-28T12:40:36Z

TimmSkiller:

=Request=

{{IPC/Request}}
{{IPC/RequestHeader|0x0004|4|2}}
{{IPC/RequestEntry|u16, register}}
{{IPC/RequestEntry|u16, value}}
{{IPC/RequestEntry|u16, mask}}
{{IPC/RequestEntry|u32, number of device IDs}}
{{IPC/TranslateStaticBuffer|Input device IDs pointer|0}}
{{IPC/RequestEnd}}

=Response=

{{IPC/Request}}
{{#vardefine:ipc_offset|0}}
{{IPC/RequestHeader|0x0004|1|0}}
{{IPC/RequestEntry|Result code}}
{{IPC/RequestEnd}}

=Description=
Replaces bits in the same register across multiple devices according to the given mask and value. This is similar to [[I2C:ReplaceRegisterBits8]], except this version uses 16 bit registers/masks/values.

The maximum input buffer size is 0x200 for the New3DS i2c-sysmodule, and 0x10 for the Old3DS version.

I2C Services

2026-05-28T12:27:43Z

TimmSkiller: /* I2C Service Names */

[[Category:Services]]
= I2C Service Names =
{| class="wikitable" border="1"
|-
! Service names
! Accessible [[I2C_Registers#I2C_Devices|deviceIDs]]
! Service used by sysmodule
|-
| "i2c::MCU"
| 0, 3
| [[MCU_Services|MCU]]
|-
| "i2c::CAM"
| 1, 2, 4
| [[Camera_Services|Camera]]
|-
| "i2c::LCD"
| 5, 6
| [[GSP_Services|GSP]]
|-
| "i2c::DEB"
| 7, 8
| Unknown
|-
| "i2c::HID"
| 9, 10, 11, 12
| [[HID_Services|HID]]
|-
| "i2c::IR"
| 13, and additionally for New3DS i2c module: 17
| [[IR_Services|IR]]
|-
| "i2c::EEP"
| 14
| [[Config_Services|Cfg]]
|-
| colspan="3" |
New3DS-sysmodule specific services:

|-
| "i2c::NFC"
| 15
| New3DS [[NFC_Services|NFC]]
|-
| "i2c::QTM"
| 16
| New3DS [[QTM_Services|QTM]]
|}

Each I2C service can only access certain I2C [[I2C_Registers|device(s)]]. When the specified deviceid isn't accessible, error 0xE0A02FEA is returned.

= I2C Service =
{| class="wikitable" border="1"
|-
! Command Header !! Description !! Available since system-version
|-
| 0x00010100 || [[I2C:ReplaceRegisterBits8|ReplaceRegisterBits8]] || All
|-
| 0x000200C0 || [[I2C:SetRegisterBits8|SetRegisterBits8]] || All
|-
| 0x000300C0 || [[I2C:ClearRegisterBits8|ClearRegisterBits8]] || All
|-
| 0x00040102 || [[I2C:MultiReplaceRegisterBits16|MultiReplaceRegisterBits16]] || All
|-
| 0x000500C0 || [[I2C:WriteRegister8|WriteRegister8]] || All
|-
| 0x00060080 || [[I2C:WriteDeviceRaw8|WriteDeviceRaw8]] || All
|-
| 0x000700C0 || [[I2C:WriteRegister16|WriteRegister16]] || All
|-
| 0x000800C2 || [[I2C:MultiWriteRegister16|MultiWriteRegister16]] || All
|-
| 0x00090080 || [[I2C:ReadRegister8|ReadRegister8]] || All
|-
| 0x000A0080 || [[I2C:ReadRegister16|ReadRegister16]] || All
|-
| 0x000B00C2 || [[I2C:WriteRegisters8|WriteRegisters8]] || All
|-
| 0x000C00C2 || [[I2C:WriteRegisters16|WriteRegisters16]] || All
|-
| 0x000D00C0 || [[I2C:ReadRegisters8|ReadRegisters8]] || All
|-
| 0x000E00C2 || [[I2C:WriteRegisters8_2|WriteRegisters8_2]] || All
|-
| 0x000F00C0 || [[I2C:LegacyReadRegisters8|LegacyReadRegisters8]] || All
|-
| 0x001000C0 || [[I2C:ReadRegisters16|ReadRegisters16]] || All
|-
| 0x001100C2 || [[I2C:WriteRegistersBuffer8|WriteRegistersBuffer8]] || All
|-
| 0x001200C2 || [[I2C:ReadRegistersBuffer8|ReadRegistersBuffer8]] || All
|-
| colspan="3" |
and, for the New3DS-specific version of the sysmodule (though technically the Old3DS supports these commands as well):

|-
| 0x00130040 || [[I2C:ReadDeviceRaw8|ReadDeviceRaw8]] || [[8.0.0-18]]
|-
| 0x00140082 || [[I2C:WriteDeviceRaw|WriteDeviceRaw]] || [[8.0.0-18]]
|-
| 0x00150080 || [[I2C:ReadDeviceRaw|ReadDeviceRaw]] || [[8.0.0-18]]
|}

Commands 0x00140082 and 0x00150080 are used by [[NFC_Services|NFC]] module.

Command 0x00150080 is also used for reading ZL, ZR, and C-stick data by [[IR Services]].

I2C:ReadDeviceRaw

2026-05-28T12:25:50Z

TimmSkiller: Created page with "=Request= {{IPC/Request}} {{IPC/RequestHeader|0x0015|1|0}} {{IPC/RequestEntry|u8, device ID}} {{IPC/RequestEnd}} =Request Static Buffers= {{IPC/RequestStaticBuffers}} {{#vardefine:ipc_offset|0}} {{IPC/TranslateStaticBuffer|Output buffer pointer|0}} {{IPC/RequestEnd}} =Response= {{IPC/Request}} {{#vardefine:ipc_offset|0}} {{IPC/RequestHeader|0x0015|1|2}} {{IPC/RequestEntry|Result code}} {{IPC/TranslateStaticBuffer|Output buffer pointer|0}} {{IPC/RequestEnd}} =Descrip..."

=Request=

{{IPC/Request}}
{{IPC/RequestHeader|0x0015|1|0}}
{{IPC/RequestEntry|u8, device ID}}
{{IPC/RequestEnd}}

=Request Static Buffers=
{{IPC/RequestStaticBuffers}}
{{#vardefine:ipc_offset|0}}
{{IPC/TranslateStaticBuffer|Output buffer pointer|0}}
{{IPC/RequestEnd}}

=Response=

{{IPC/Request}}
{{#vardefine:ipc_offset|0}}
{{IPC/RequestHeader|0x0015|1|2}}
{{IPC/RequestEntry|Result code}}
{{IPC/TranslateStaticBuffer|Output buffer pointer|0}}
{{IPC/RequestEnd}}

=Description=
Reads a buffer from the given I2C device raw, without selecting a specific register first.

This is similar to [[I2C:ReadDeviceRaw8]], except this allows for reading a buffer instead of a single value.

I2C:WriteDeviceRaw

2026-05-28T12:20:13Z

TimmSkiller: Created page with "=Request= {{IPC/Request}} {{IPC/RequestHeader|0x0014|2|2}} {{IPC/RequestEntry|u8, device ID}} {{IPC/RequestEntry|u32, size}} {{IPC/TranslateStaticBuffer|Input buffer pointer|1}} {{IPC/RequestEnd}} =Response= {{IPC/Request}} {{#vardefine:ipc_offset|0}} {{IPC/RequestHeader|0x0014|1|0}} {{IPC/RequestEntry|Result code}} {{IPC/RequestEnd}} =Description= Writes a buffer to the given I2C device raw, without selecting a specific register first. This is similar to I2C:Writ..."

=Request=

{{IPC/Request}}
{{IPC/RequestHeader|0x0014|2|2}}
{{IPC/RequestEntry|u8, device ID}}
{{IPC/RequestEntry|u32, size}}
{{IPC/TranslateStaticBuffer|Input buffer pointer|1}}
{{IPC/RequestEnd}}

=Response=

{{IPC/Request}}
{{#vardefine:ipc_offset|0}}
{{IPC/RequestHeader|0x0014|1|0}}
{{IPC/RequestEntry|Result code}}
{{IPC/RequestEnd}}

=Description=
Writes a buffer to the given I2C device raw, without selecting a specific register first.

This is similar to [[I2C:WriteDeviceRaw8]], except this allows for writing a buffer instead of a single value.

I2C:ReadDeviceRaw8

2026-05-28T12:17:58Z

TimmSkiller: Created page with "=Request= {{IPC/Request}} {{IPC/RequestHeader|0x0013|1|0}} {{IPC/RequestEntry|u8, device ID}} {{IPC/RequestEnd}} =Response= {{IPC/Request}} {{#vardefine:ipc_offset|0}} {{IPC/RequestHeader|0x0013|2|0}} {{IPC/RequestEntry|Result code}} {{IPC/RequestEntry|u8, value read from register}} {{IPC/RequestEnd}} =Description= Reads from the given I2C device raw, without selecting a specific register first."

=Request=

{{IPC/Request}}
{{IPC/RequestHeader|0x0013|1|0}}
{{IPC/RequestEntry|u8, device ID}}
{{IPC/RequestEnd}}

=Response=

{{IPC/Request}}
{{#vardefine:ipc_offset|0}}
{{IPC/RequestHeader|0x0013|2|0}}
{{IPC/RequestEntry|Result code}}
{{IPC/RequestEntry|u8, value read from register}}
{{IPC/RequestEnd}}

=Description=
Reads from the given I2C device raw, without selecting a specific register first.

I2C:ReadRegistersBuffer8

2026-05-28T12:16:45Z

TimmSkiller: Created page with "=Request= {{IPC/Request}} {{IPC/RequestHeader|0x0012|3|2}} {{IPC/RequestEntry|u8, device ID}} {{IPC/RequestEntry|u8, starting register}} {{IPC/RequestEntry|u32, size}} {{IPC/MapPointerW|Output buffer pointer}} {{IPC/RequestEnd}} =Response= {{IPC/Request}} {{#vardefine:ipc_offset|0}} {{IPC/RequestHeader|0x0012|1|2}} {{IPC/RequestEntry|Result code}} {{IPC/MapPointerW|Output buffer pointer}} {{IPC/RequestEnd}} =Description= Reads a range of 8-bit I2C registers of the s..."

=Request=

{{IPC/Request}}
{{IPC/RequestHeader|0x0012|3|2}}
{{IPC/RequestEntry|u8, device ID}}
{{IPC/RequestEntry|u8, starting register}}
{{IPC/RequestEntry|u32, size}}
{{IPC/MapPointerW|Output buffer pointer}}
{{IPC/RequestEnd}}

=Response=

{{IPC/Request}}
{{#vardefine:ipc_offset|0}}
{{IPC/RequestHeader|0x0012|1|2}}
{{IPC/RequestEntry|Result code}}
{{IPC/MapPointerW|Output buffer pointer}}
{{IPC/RequestEnd}}

=Description=
Reads a range of 8-bit I2C registers of the specified device sequentially to the given buffer.

Similar to [[I2C:ReadRegisters8]], except this version uses a mapped buffer instead of a static buffer.

For example, assuming:

<pre>
reg[5] = 0xAA, reg[6] = 0xBB, reg[7] = 0xCC, reg[8] = 0xDD
</pre>

Then reading 4 bytes with starting register 5 would result in:

<pre>
outbuf[0] = 0xAA
outbuf[1] = 0xBB
outbuf[2] = 0xCC
outbuf[3] = 0xDD
</pre>

I2C:WriteRegistersBuffer8

2026-05-28T12:15:21Z

TimmSkiller: Created page with "=Request= {{IPC/Request}} {{IPC/RequestHeader|0x0011|3|2}} {{IPC/RequestEntry|u8, device ID}} {{IPC/RequestEntry|u8, starting register}} {{IPC/RequestEntry|u32, size}} {{IPC/MapPointerR|Input buffer pointer}} {{IPC/RequestEnd}} =Response= {{IPC/Request}} {{#vardefine:ipc_offset|0}} {{IPC/RequestHeader|0x0011|1|2}} {{IPC/RequestEntry|Result code}} {{IPC/MapPointerR|Input buffer pointer}} {{IPC/RequestEnd}} =Description= Writes the given buffer sequentially to a range..."

=Request=

{{IPC/Request}}
{{IPC/RequestHeader|0x0011|3|2}}
{{IPC/RequestEntry|u8, device ID}}
{{IPC/RequestEntry|u8, starting register}}
{{IPC/RequestEntry|u32, size}}
{{IPC/MapPointerR|Input buffer pointer}}
{{IPC/RequestEnd}}

=Response=

{{IPC/Request}}
{{#vardefine:ipc_offset|0}}
{{IPC/RequestHeader|0x0011|1|2}}
{{IPC/RequestEntry|Result code}}
{{IPC/MapPointerR|Input buffer pointer}}
{{IPC/RequestEnd}}

=Description=
Writes the given buffer sequentially to a range of 8-bit I2C registers of the specified device.

Similar to [[I2C:WriteRegisters8]], except this version uses a mapped buffer instead of a static buffer.

For example, writing a buffer of consisting of <code>{ 0xAA, 0xBB, 0xCC, 0xDD }</code> with starting register 0x5 would do the following:

<pre>
reg[0x5] = 0xAA
reg[0x6] = 0xBB
reg[0x7] = 0xCC
reg[0x8] = 0xDD
</pre>

I2C Services

2026-05-28T12:07:25Z

TimmSkiller: /* I2C Service Names */

[[Category:Services]]
= I2C Service Names =
{| class="wikitable" border="1"
|-
! Service names
! Accessible [[I2C_Registers|deviceIDs]]
! Service used by sysmodule
|-
| "i2c::MCU"
| 0, 3
| [[MCU_Services|MCU]]
|-
| "i2c::CAM"
| 1, 2, 4
| [[Camera_Services|Camera]]
|-
| "i2c::LCD"
| 5, 6
| [[GSP_Services|GSP]]
|-
| "i2c::DEB"
| 7, 8
| Unknown
|-
| "i2c::HID"
| 9, 10, 11, 12
| [[HID_Services|HID]]
|-
| "i2c::IR"
| 13, and additionally for New3DS i2c module: 17
| [[IR_Services|IR]]
|-
| "i2c::EEP"
| 14
| [[Config_Services|Cfg]]
|-
| colspan="3" |
New3DS-sysmodule specific services:

|-
| "i2c::NFC"
| 15
| New3DS [[NFC_Services|NFC]]
|-
| "i2c::QTM"
| 16
| New3DS [[QTM_Services|QTM]]
|}

Each I2C service can only access certain I2C [[I2C_Registers|device(s)]]. When the specified deviceid isn't accessible, error 0xE0A02FEA is returned.

= I2C Service =
{| class="wikitable" border="1"
|-
! Command Header !! Description !! Available since system-version
|-
| 0x00010100 || [[I2C:ReplaceRegisterBits8|ReplaceRegisterBits8]] || All
|-
| 0x000200C0 || [[I2C:SetRegisterBits8|SetRegisterBits8]] || All
|-
| 0x000300C0 || [[I2C:ClearRegisterBits8|ClearRegisterBits8]] || All
|-
| 0x00040102 || [[I2C:MultiReplaceRegisterBits16|MultiReplaceRegisterBits16]] || All
|-
| 0x000500C0 || [[I2C:WriteRegister8|WriteRegister8]] || All
|-
| 0x00060080 || [[I2C:WriteDeviceRaw8|WriteDeviceRaw8]] || All
|-
| 0x000700C0 || [[I2C:WriteRegister16|WriteRegister16]] || All
|-
| 0x000800C2 || [[I2C:MultiWriteRegister16|MultiWriteRegister16]] || All
|-
| 0x00090080 || [[I2C:ReadRegister8|ReadRegister8]] || All
|-
| 0x000A0080 || [[I2C:ReadRegister16|ReadRegister16]] || All
|-
| 0x000B00C2 || [[I2C:WriteRegisters8|WriteRegisters8]] || All
|-
| 0x000C00C2 || [[I2C:WriteRegisters16|WriteRegisters16]] || All
|-
| 0x000D00C0 || [[I2C:ReadRegisters8|ReadRegisters8]] || All
|-
| 0x000E00C2 || [[I2C:WriteRegisters8_2|WriteRegisters8_2]] || All
|-
| 0x000F00C0 || [[I2C:LegacyReadRegisters8|LegacyReadRegisters8]] || All
|-
| 0x001000C0 || [[I2C:ReadRegisters16|ReadRegisters16]] || All
|-
| 0x001100C2 || [[I2C:WriteRegistersBuffer8|WriteRegistersBuffer8]] || All
|-
| 0x001200C2 || [[I2C:ReadRegistersBuffer8|ReadRegistersBuffer8]] || All
|-
| colspan="3" |
and, for the New3DS-specific version of the sysmodule (though technically the Old3DS supports these commands as well):

|-
| 0x00130040 || [[I2C:ReadDeviceRaw8|ReadDeviceRaw8]] || [[8.0.0-18]]
|-
| 0x00140082 || [[I2C:WriteDeviceRaw|WriteDeviceRaw]] || [[8.0.0-18]]
|-
| 0x00150080 || [[I2C:ReadDeviceRaw|ReadDeviceRaw]] || [[8.0.0-18]]
|}

Commands 0x00140082 and 0x00150080 are used by [[NFC_Services|NFC]] module.

Command 0x00150080 is also used for reading ZL, ZR, and C-stick data by [[IR Services]].

I2C:ReadRegisters16

2026-05-28T12:01:32Z

TimmSkiller: Created page with "=Request= {{IPC/Request}} {{IPC/RequestHeader|0x0010|3|0}} {{IPC/RequestEntry|u8, device ID}} {{IPC/RequestEntry|u16, starting register}} {{IPC/RequestEntry|u32, count}} {{IPC/RequestEnd}} =Request Static Buffers= {{IPC/RequestStaticBuffers}} {{#vardefine:ipc_offset|0}} {{IPC/TranslateStaticBuffer|Output buffer pointer|0}} {{IPC/RequestEnd}} =Response= {{IPC/Request}} {{#vardefine:ipc_offset|0}} {{IPC/RequestHeader|0x0010|1|2}} {{IPC/RequestEntry|Result code}} {{IPC..."

=Request=

{{IPC/Request}}
{{IPC/RequestHeader|0x0010|3|0}}
{{IPC/RequestEntry|u8, device ID}}
{{IPC/RequestEntry|u16, starting register}}
{{IPC/RequestEntry|u32, count}}
{{IPC/RequestEnd}}

=Request Static Buffers=
{{IPC/RequestStaticBuffers}}
{{#vardefine:ipc_offset|0}}
{{IPC/TranslateStaticBuffer|Output buffer pointer|0}}
{{IPC/RequestEnd}}

=Response=

{{IPC/Request}}
{{#vardefine:ipc_offset|0}}
{{IPC/RequestHeader|0x0010|1|2}}
{{IPC/RequestEntry|Result code}}
{{IPC/TranslateStaticBuffer|Output buffer pointer|0}}
{{IPC/RequestEnd}}

=Description=
Reads a range of 16-bit I2C registers of the specified device sequentially to the given buffer.

This is similar to [[I2C:ReadRegisters8]], except this reads from 16-bit registers.

For example, assuming:

<pre>
reg[5] = 0xAAAA, reg[6] = 0xBBBB, reg[7] = 0xCCCC, reg[8] = 0xDDDD
</pre>

Then reading with count 4 and starting register 5 would result in:

<pre>
outbuf[0] = 0xAAAA
outbuf[1] = 0xBBBB
outbuf[2] = 0xCCCC
outbuf[3] = 0xDDDD
</pre>

I2C Services

2026-05-28T11:57:52Z

TimmSkiller: /* I2C Service */

[[Category:Services]]
= I2C Service Names =
{| class="wikitable" border="1"
|-
! Service names
! Notes
! Accessible [[I2C_Registers|deviceIDs]]
! Service used by sysmodule
|-
| "i2c::MCU"
|
| 0, 3
| [[MCU_Services|MCU]]
|-
| "i2c::CAM"
|
| 1, 2, 4
| [[Camera_Services|Camera]]
|-
| "i2c::LCD"
|
| 5, 6
| [[GSP_Services|GSP]]
|-
| "i2c::DEB"
|
| 7, 8
| Unknown
|-
| "i2c::HID"
|
| 9, 10, 11, 12
| [[HID_Services|HID]]
|-
| "i2c::IR"
|
| 13, and additionally for New3DS i2c module: 17
| [[IR_Services|IR]]
|-
| "i2c::EEP"
|
| 14
| [[Config_Services|Cfg]]
|-
| "i2c::NFC"
| Only available via the New3DS i2c sysmodule.
| 15
| New3DS [[NFC_Services|NFC]]
|-
| "i2c::QTM"
| Only available via the New3DS i2c sysmodule.
| 16
| New3DS [[QTM_Services|QTM]]
|}

Each I2C service can only access certain I2C [[I2C_Registers|device(s)]]. When the specified deviceid isn't accessible, error 0xE0A02FEA is returned.

= I2C Service =
{| class="wikitable" border="1"
|-
! Command Header !! Description !! Available since system-version
|-
| 0x00010100 || [[I2C:ReplaceRegisterBits8|ReplaceRegisterBits8]] || All
|-
| 0x000200C0 || [[I2C:SetRegisterBits8|SetRegisterBits8]] || All
|-
| 0x000300C0 || [[I2C:ClearRegisterBits8|ClearRegisterBits8]] || All
|-
| 0x00040102 || [[I2C:MultiReplaceRegisterBits16|MultiReplaceRegisterBits16]] || All
|-
| 0x000500C0 || [[I2C:WriteRegister8|WriteRegister8]] || All
|-
| 0x00060080 || [[I2C:WriteDeviceRaw8|WriteDeviceRaw8]] || All
|-
| 0x000700C0 || [[I2C:WriteRegister16|WriteRegister16]] || All
|-
| 0x000800C2 || [[I2C:MultiWriteRegister16|MultiWriteRegister16]] || All
|-
| 0x00090080 || [[I2C:ReadRegister8|ReadRegister8]] || All
|-
| 0x000A0080 || [[I2C:ReadRegister16|ReadRegister16]] || All
|-
| 0x000B00C2 || [[I2C:WriteRegisters8|WriteRegisters8]] || All
|-
| 0x000C00C2 || [[I2C:WriteRegisters16|WriteRegisters16]] || All
|-
| 0x000D00C0 || [[I2C:ReadRegisters8|ReadRegisters8]] || All
|-
| 0x000E00C2 || [[I2C:WriteRegisters8_2|WriteRegisters8_2]] || All
|-
| 0x000F00C0 || [[I2C:LegacyReadRegisters8|LegacyReadRegisters8]] || All
|-
| 0x001000C0 || [[I2C:ReadRegisters16|ReadRegisters16]] || All
|-
| 0x001100C2 || [[I2C:WriteRegistersBuffer8|WriteRegistersBuffer8]] || All
|-
| 0x001200C2 || [[I2C:ReadRegistersBuffer8|ReadRegistersBuffer8]] || All
|-
| colspan="3" |
and, for the New3DS-specific version of the sysmodule (though technically the Old3DS supports these commands as well):

|-
| 0x00130040 || [[I2C:ReadDeviceRaw8|ReadDeviceRaw8]] || [[8.0.0-18]]
|-
| 0x00140082 || [[I2C:WriteDeviceRaw|WriteDeviceRaw]] || [[8.0.0-18]]
|-
| 0x00150080 || [[I2C:ReadDeviceRaw|ReadDeviceRaw]] || [[8.0.0-18]]
|}

Commands 0x00140082 and 0x00150080 are used by [[NFC_Services|NFC]] module.

Command 0x00150080 is also used for reading ZL, ZR, and C-stick data by [[IR Services]].

I2C Services

2026-05-28T11:56:07Z

TimmSkiller: /* I2C Service */

[[Category:Services]]
= I2C Service Names =
{| class="wikitable" border="1"
|-
! Service names
! Notes
! Accessible [[I2C_Registers|deviceIDs]]
! Service used by sysmodule
|-
| "i2c::MCU"
|
| 0, 3
| [[MCU_Services|MCU]]
|-
| "i2c::CAM"
|
| 1, 2, 4
| [[Camera_Services|Camera]]
|-
| "i2c::LCD"
|
| 5, 6
| [[GSP_Services|GSP]]
|-
| "i2c::DEB"
|
| 7, 8
| Unknown
|-
| "i2c::HID"
|
| 9, 10, 11, 12
| [[HID_Services|HID]]
|-
| "i2c::IR"
|
| 13, and additionally for New3DS i2c module: 17
| [[IR_Services|IR]]
|-
| "i2c::EEP"
|
| 14
| [[Config_Services|Cfg]]
|-
| "i2c::NFC"
| Only available via the New3DS i2c sysmodule.
| 15
| New3DS [[NFC_Services|NFC]]
|-
| "i2c::QTM"
| Only available via the New3DS i2c sysmodule.
| 16
| New3DS [[QTM_Services|QTM]]
|}

Each I2C service can only access certain I2C [[I2C_Registers|device(s)]]. When the specified deviceid isn't accessible, error 0xE0A02FEA is returned.

= I2C Service =
{| class="wikitable" border="1"
|-
! Command Header !! Description !! Available since system-version
|-
| 0x00010100 || [[I2C:ReplaceRegisterBits8|ReplaceRegisterBits8]] || All
|-
| 0x000200C0 || [[I2C:SetRegisterBits8|SetRegisterBits8]] || All
|-
| 0x000300C0 || [[I2C:ClearRegisterBits8|ClearRegisterBits8]] || All
|-
| 0x00040102 || [[I2C:MultiReplaceRegisterBits16|MultiReplaceRegisterBits16]] || All
|-
| 0x000500C0 || [[I2C:WriteRegister8|WriteRegister8]] || All
|-
| 0x00060080 || [[I2C:WriteDeviceRaw8|WriteDeviceRaw8]] || All
|-
| 0x000700C0 || [[I2C:WriteRegister16|WriteRegister16]] || All
|-
| 0x000800C2 || [[I2C:MultiWriteRegister16|MultiWriteRegister16]] || All
|-
| 0x00090080 || [[I2C:ReadRegister8|ReadRegister8]] || All
|-
| 0x000A0080 || [[I2C:ReadRegister16|ReadRegister16]] || All
|-
| 0x000B00C2 || [[I2C:WriteRegisters8|WriteRegisters8]] || All
|-
| 0x000C00C2 || [[I2C:WriteRegisters16|WriteRegisters16]] || All
|-
| 0x000D00C0 || [[I2C:ReadRegisters8|ReadRegisters8]] || All
|-
| 0x000E00C2 || [[I2C:WriteRegisters8_2|WriteRegisters8_2]] || All
|-
| 0x000F00C0 || [[I2C:LegacyReadRegisters8|LegacyReadRegisters8]] || All
|-
| 0x001000C0 || [[I2C:ReadRegisters16|ReadRegisters16]] || All
|-
| 0x001100C2 || [[I2C:WriteRegistersBuffer8|WriteRegistersBuffer8]] || All
|-
| 0x001200C2 || [[I2C:ReadRegistersBuffer8|ReadRegistersBuffer8]] || All
|}
and, for the New3DS-specific version of the sysmodule (though technically the Old3DS supports these commands as well):
{| class="wikitable" border="1"
|-
| 0x00130040 || [[I2C:ReadDeviceRaw8|ReadDeviceRaw8]] || [[8.0.0-18]]
|-
| 0x00140082 || [[I2C:WriteDeviceRaw|WriteDeviceRaw]] || [[8.0.0-18]]
|-
| 0x00150080 || [[I2C:ReadDeviceRaw|ReadDeviceRaw]] || [[8.0.0-18]]
|}

Commands 0x00140082 and 0x00150080 are used by [[NFC_Services|NFC]] module.

Command 0x00150080 is also used for reading ZL, ZR, and C-stick data by [[IR Services]].

I2C:LegacyReadRegisters8

2026-05-28T11:53:25Z

TimmSkiller: Created page with "=Request= {{IPC/Request}} {{IPC/RequestHeader|0x000F|3|0}} {{IPC/RequestEntry|u8, device ID}} {{IPC/RequestEntry|u8, starting register}} {{IPC/RequestEntry|u32, size}} {{IPC/RequestEnd}} =Request Static Buffers= {{IPC/RequestStaticBuffers}} {{#vardefine:ipc_offset|0}} {{IPC/TranslateStaticBuffer|Output buffer pointer|0}} {{IPC/RequestEnd}} =Response= {{IPC/Request}} {{#vardefine:ipc_offset|0}} {{IPC/RequestHeader|0x000F|1|2}} {{IPC/RequestEntry|Result code}} {{IPC/Tr..."

=Request=

{{IPC/Request}}
{{IPC/RequestHeader|0x000F|3|0}}
{{IPC/RequestEntry|u8, device ID}}
{{IPC/RequestEntry|u8, starting register}}
{{IPC/RequestEntry|u32, size}}
{{IPC/RequestEnd}}

=Request Static Buffers=
{{IPC/RequestStaticBuffers}}
{{#vardefine:ipc_offset|0}}
{{IPC/TranslateStaticBuffer|Output buffer pointer|0}}
{{IPC/RequestEnd}}

=Response=

{{IPC/Request}}
{{#vardefine:ipc_offset|0}}
{{IPC/RequestHeader|0x000F|1|2}}
{{IPC/RequestEntry|Result code}}
{{IPC/TranslateStaticBuffer|Output buffer pointer|0}}
{{IPC/RequestEnd}}

=Description=
Reads a range of 8-bit I2C registers of the specified device sequentially to the given buffer.

This is similar to [[I2C:ReadRegisters8]] except:
* Before selecting the device, this waits 1500ns.
* Before reading the first byte and after reading the last byte, this waits 15µs.

For example, assuming:

<pre>
reg[5] = 0xAA, reg[6] = 0xBB, reg[7] = 0xCC, reg[8] = 0xDD
</pre>

Then reading 4 bytes with starting register 5 would result in:

<pre>
outbuf[0] = 0xAA
outbuf[1] = 0xBB
outbuf[2] = 0xCC
outbuf[3] = 0xDD
</pre>

I2C:WriteRegisters8 2

2026-05-28T11:47:02Z

TimmSkiller: Created page with "=Request= {{IPC/Request}} {{IPC/RequestHeader|0x000E|3|2}} {{IPC/RequestEntry|u8, device ID}} {{IPC/RequestEntry|u8, starting register}} {{IPC/RequestEntry|u32, size}} {{IPC/TranslateStaticBuffer|Input buffer pointer|1}} {{IPC/RequestEnd}} =Response= {{IPC/Request}} {{#vardefine:ipc_offset|0}} {{IPC/RequestHeader|0x000E|1|0}} {{IPC/RequestEntry|Result code}} {{IPC/RequestEnd}} =Description= This is identical to I2C:WriteRegisters8. Writes the given buffer seque..."

=Request=

{{IPC/Request}}
{{IPC/RequestHeader|0x000E|3|2}}
{{IPC/RequestEntry|u8, device ID}}
{{IPC/RequestEntry|u8, starting register}}
{{IPC/RequestEntry|u32, size}}
{{IPC/TranslateStaticBuffer|Input buffer pointer|1}}
{{IPC/RequestEnd}}

=Response=

{{IPC/Request}}
{{#vardefine:ipc_offset|0}}
{{IPC/RequestHeader|0x000E|1|0}}
{{IPC/RequestEntry|Result code}}
{{IPC/RequestEnd}}

=Description=
This is identical to [[I2C:WriteRegisters8]].

Writes the given buffer sequentially to a range of 8-bit I2C registers of the specified device.

For example, writing a buffer of consisting of <code>{ 0xAA, 0xBB, 0xCC, 0xDD }</code> with starting register 0x5 would do the following:

<pre>
reg[0x5] = 0xAA
reg[0x6] = 0xBB
reg[0x7] = 0xCC
reg[0x8] = 0xDD
</pre>

I2C:ReadRegisters8

2026-05-28T11:45:47Z

TimmSkiller: /* Request Static Buffers */

=Request=

{{IPC/Request}}
{{IPC/RequestHeader|0x000D|3|0}}
{{IPC/RequestEntry|u8, device ID}}
{{IPC/RequestEntry|u8, starting register}}
{{IPC/RequestEntry|u32, size}}
{{IPC/RequestEnd}}

=Request Static Buffers=
{{IPC/RequestStaticBuffers}}
{{#vardefine:ipc_offset|0}}
{{IPC/TranslateStaticBuffer|Output buffer pointer|0}}
{{IPC/RequestEnd}}

=Response=

{{IPC/Request}}
{{#vardefine:ipc_offset|0}}
{{IPC/RequestHeader|0x000D|1|2}}
{{IPC/RequestEntry|Result code}}
{{IPC/TranslateStaticBuffer|Output buffer pointer|0}}
{{IPC/RequestEnd}}

=Description=
Reads a range of 8-bit I2C registers of the specified device sequentially to the given buffer.

For example, assuming:

<pre>
reg[5] = 0xAA, reg[6] = 0xBB, reg[7] = 0xCC, reg[8] = 0xDD
</pre>

Then reading 4 bytes with starting register 5 would result in:

<pre>
outbuf[0] = 0xAA
outbuf[1] = 0xBB
outbuf[2] = 0xCC
outbuf[3] = 0xDD
</pre>

Template:IPC/TranslateStaticBuffer

2026-05-28T11:45:37Z

TimmSkiller:

<noinclude>{{IPC/Request|ipc_offset_prefix=n + }}
</noinclude>{{IPC/RequestEntry|''{{Tooltip|Descriptor|0x00000002 {{!}} (size <nowiki><<</nowiki> 14) {{!}} ({{{2}}} <nowiki><<</nowiki> 10)}} for [[IPC#Static_Buffer_Translation|static buffer]] (id {{{2}}})''|descstyle=border-bottom-style:dashed}}
{{IPC/RequestEntry|{{{1}}}|descstyle=border-top-style:none}}<noinclude>
{{IPC/RequestEnd}}</noinclude><noinclude>[[Category:IPC message contents templates]]</noinclude>

Template:IPC/RequestStaticBuffers

2026-05-28T11:44:59Z

TimmSkiller:

The handler for this IPC command expects the following 0x100-bytes after the beginning of the above command buffer:
{{IPC/Request}}<noinclude>[[Category:IPC message contents templates]]</noinclude>

Template:IPC/TranslateStaticBuffer

2026-05-28T11:44:05Z

TimmSkiller: Undo revision 23815 by TimmSkiller (talk)

<noinclude>{{IPC/Request|ipc_offset_prefix=n + }}
</noinclude>{{IPC/RequestEntry|''{{Tooltip|Descriptor|0x00000002 {{!}} (size <nowiki><<</nowiki> 14) {{!}} ({{{2}}} <nowiki><<</nowiki> 10)}} for [[IPC#Static_Buffer_Translation|static buffer]] (id {{{2}}})''|descstyle=border-bottom-style:dashed}}
{{IPC/RequestEntry|{{{1}}}|descstyle=border-top-style:none}}<noinclude>
{{IPC/RequestEnd}}
</noinclude><noinclude>[[Category:IPC message contents templates]]</noinclude>

Template:IPC/TranslateStaticBuffer

2026-05-28T11:43:44Z

TimmSkiller:

{{IPC/RequestEntry|''{{Tooltip|Descriptor|0x00000002 {{!}} (size <nowiki><<</nowiki> 14) {{!}} ({{{2}}} <nowiki><<</nowiki> 10)}} for [[IPC#Static_Buffer_Translation|static buffer]] (id {{{2}}})''|descstyle=border-bottom-style:dashed}}
{{IPC/RequestEntry|{{{1}}}|descstyle=border-top-style:none}}<noinclude>
{{IPC/RequestEnd}}
</noinclude><noinclude>[[Category:IPC message contents templates]]</noinclude>

Template:IPC/TranslateStaticBuffer

2026-05-28T11:39:10Z

TimmSkiller:

<noinclude>{{IPC/Request|ipc_offset_prefix=n + }}
</noinclude>{{IPC/RequestEntry|''{{Tooltip|Descriptor|0x00000002 {{!}} (size <nowiki><<</nowiki> 14) {{!}} ({{{2}}} <nowiki><<</nowiki> 10)}} for [[IPC#Static_Buffer_Translation|static buffer]] (id {{{2}}})''|descstyle=border-bottom-style:dashed}}
{{IPC/RequestEntry|{{{1}}}|descstyle=border-top-style:none}}<noinclude>
{{IPC/RequestEnd}}
</noinclude><noinclude>[[Category:IPC message contents templates]]</noinclude>

Template:IPC/RequestStaticBuffers

2026-05-28T11:34:03Z

TimmSkiller:

The handler for this IPC command expects the following 0x100-bytes after the beginning of the above command buffer:
{{IPC/Request}}
<noinclude>[[Category:IPC message contents templates]]</noinclude>

Template:IPC/TranslateStaticBuffer

2026-05-28T11:33:41Z

TimmSkiller:

<noinclude>{{IPC/Request|ipc_offset_prefix=n + }}</noinclude>
{{IPC/RequestEntry|''{{Tooltip|Descriptor|0x00000002 {{!}} (size <nowiki><<</nowiki> 14) {{!}} ({{{2}}} <nowiki><<</nowiki> 10)}} for [[IPC#Static_Buffer_Translation|static buffer]] (id {{{2}}})''|descstyle=border-bottom-style:dashed}}
{{IPC/RequestEntry|{{{1}}}|descstyle=border-top-style:none}}<noinclude>
{{IPC/RequestEnd}}
</noinclude><noinclude>[[Category:IPC message contents templates]]</noinclude>

Template:IPC/Request

2026-05-28T11:33:16Z

TimmSkiller:

{{#vardefine:ipc_offset|{{{ipc_offset|0}}}}}{{#vardefine:ipc_offset_prefix|{{{ipc_offset_prefix|}}}}}{| class="wikitable" border="1"
|-
! {{{1|Index}}} Word !! Description<noinclude>
|-
| n
| …
|}[[Category:IPC message contents templates]]</noinclude>

Template:IPC/Request

2026-05-28T11:32:41Z

TimmSkiller:

{{#vardefine:ipc_offset|{{{ipc_offset|0}}}}}{{#vardefine:ipc_offset_prefix|{{{ipc_offset_prefix|}}}}}{| class="wikitable" border="1"
|-
! {{{1|Index}}} Word !! Description
<noinclude>
|-
| n
| …
|}[[Category:IPC message contents templates]]</noinclude>

Template:IPC/RequestStaticBuffers

2026-05-28T11:32:20Z

TimmSkiller:

The handler for this IPC command expects the following 0x100-bytes after the beginning of the above command buffer:
{{IPC/Request}}<noinclude>[[Category:IPC message contents templates]]</noinclude>