Difference between revisions of "Config Savegame"
(59 intermediate revisions by 20 users not shown) | |||
Line 48: | Line 48: | ||
| 0xA | | 0xA | ||
| 0x2 | | 0x2 | ||
− | | Flags | + | | Access Flags |
|} | |} | ||
+ | |||
+ | ===Access Flags=== | ||
+ | {| class="wikitable" border="1" | ||
+ | |- | ||
+ | ! Bit Mask | ||
+ | ! Description | ||
+ | |- | ||
+ | | 0x2 | ||
+ | | User Readable (cfg:u) | ||
+ | |- | ||
+ | | 0x4 | ||
+ | | System Writable (cfg:s / cfg:i) | ||
+ | |- | ||
+ | | 0x8 | ||
+ | | System Readable (cfg:s / cfg:i) | ||
+ | |} | ||
+ | |||
+ | Config blocks will typically either use 0xC for system readable/writable or 0xE for all 3. | ||
==Configuration blocks== | ==Configuration blocks== | ||
Line 56: | Line 74: | ||
! BlkID | ! BlkID | ||
! Size | ! Size | ||
− | ! Flags | + | ! Access Flags |
! Description | ! Description | ||
+ | |- | ||
+ | | 0x00000000 | ||
+ | | 0x2 | ||
+ | | 0xC | ||
+ | | Config savegame version? | ||
+ | |- | ||
+ | | 0x00010000 | ||
+ | | 0x1 | ||
+ | | 0xC | ||
+ | | [[Hardware_calibration#RTC|RTC compensation value]] | ||
+ | |- | ||
+ | | 0x00020000 | ||
+ | | 0x134 | ||
+ | | 0xC | ||
+ | | [[Hardware_calibration#CDC|Codec]] | ||
+ | |- | ||
+ | | 0x00030000 | ||
+ | | 0x1 | ||
+ | | 0xC | ||
+ | | Leap Year Counter (read By PTM) | ||
|- | |- | ||
| 0x00030001 | | 0x00030001 | ||
| 0x8 | | 0x8 | ||
| 0xE | | 0xE | ||
− | | | + | | User time offset (read by CECD): displayed timestamp - rtc timestamp |
+ | |- | ||
+ | | 0x00030002 | ||
+ | | 0x8 | ||
+ | | 0xC | ||
+ | | Settings time offset: newly set timestamp - rtc timestamp | ||
|- | |- | ||
| 0x00040000 | | 0x00040000 | ||
| 0x10 | | 0x10 | ||
− | | | + | | 0xC |
− | | | + | | [[Hardware_calibration#Touch|Touch calibration]] (read by HID) |
|- | |- | ||
| 0x00040001 | | 0x00040001 | ||
| 0x1C | | 0x1C | ||
− | | | + | | 0xC |
− | | ? | + | | Analog Stick Calibration Param?(read by HID) |
|- | |- | ||
| 0x00040002 | | 0x00040002 | ||
| 0x12 | | 0x12 | ||
− | | | + | | 0xC |
− | | | + | | [[Hardware_calibration#Gyro|Gyroscope]] (read by HID) |
|- | |- | ||
| 0x00040003 | | 0x00040003 | ||
| 0xC | | 0xC | ||
− | | | + | | 0xC |
− | | | + | | [[Hardware_calibration#Accel|Accelerometer]] (read by HID) |
+ | |- | ||
+ | | 0x00040004 | ||
+ | | 0x1C | ||
+ | | 0xC | ||
+ | | [[Hardware_calibration#CStick|CStick calibration data]] | ||
+ | |- | ||
+ | | 0x00050000 | ||
+ | | 0x2 | ||
+ | | 0xC | ||
+ | | [[Hardware_calibration#Screen_flicker|Screen flicker]] | ||
|- | |- | ||
| 0x00050001 | | 0x00050001 | ||
| 0x2 | | 0x2 | ||
− | | | + | | 0xC |
− | | | + | | Backlight controls (u8 ABL_powersave_enable, u8 brightness_level) (read by GSP) |
|- | |- | ||
| 0x00050002 | | 0x00050002 | ||
| 0x38 | | 0x38 | ||
− | | | + | | 0xC |
− | | | + | | [[Hardware_calibration#BLPWM|Backlight PWM]] (read by GSP) |
|- | |- | ||
| 0x00050003 | | 0x00050003 | ||
| 0x20 | | 0x20 | ||
− | | | + | | 0xC |
− | | | + | | [[Hardware_calibration#ABL|Power saving mode (ABL) calibration]] (read by GSP) |
+ | |- | ||
+ | | 0x00050004 | ||
+ | | 0x20 | ||
+ | | 0xC | ||
+ | | [[Hardware_calibration#ABL|Power saving mode (ABL) calibration]] (for legacy FIRM) | ||
|- | |- | ||
| 0x00050005 | | 0x00050005 | ||
| 0x20 | | 0x20 | ||
− | | | + | | 0xE |
− | | Stereo | + | | Stereo display settings (HWCAL block 0x470) |
|- | |- | ||
| 0x00050006 | | 0x00050006 | ||
| 0x2 | | 0x2 | ||
+ | | 0xC | ||
+ | | [[Hardware_calibration#ULCD_delay|3D switching delay]] | ||
+ | |- | ||
+ | | 0x00050007 | ||
+ | | 0x4 | ||
+ | | 0xC | ||
+ | | ? | ||
+ | |- | ||
+ | | 0x00050008 | ||
+ | | 0x10C | ||
+ | | 0xC | ||
+ | | [[Hardware_calibration#ABL_extra|Power saving mode (ABL) extra config]] | ||
+ | |- | ||
+ | | 0x00050009 | ||
| 0x8 | | 0x8 | ||
− | | ? | + | | 0xC |
+ | | new3DS only(?) backlight control (5th byte: auto-brightness enable) | ||
+ | |- | ||
+ | | 0x00060000 | ||
+ | | 0x96 | ||
+ | | 0xC | ||
+ | | ??? (HWCAL block 0x500) | ||
+ | |- | ||
+ | | 0x00070000 | ||
+ | | 0x214 | ||
+ | | 0xE | ||
+ | | [[Hardware_calibration#3D_filters|3D filters]] | ||
|- | |- | ||
| 0x00070001 | | 0x00070001 | ||
| 0x1 | | 0x1 | ||
− | | | + | | 0xE |
− | | Sound output mode | + | | Sound output mode (mono=0, stereo=1, surround=2) |
+ | |- | ||
+ | | 0x00070002 | ||
+ | | 0x8 | ||
+ | | 0xE | ||
+ | | [[Hardware_calibration#Microphone_echo_cancel|Microphone echo cancellation params]] | ||
|- | |- | ||
| 0x00080000 | | 0x00080000 | ||
| 0xC00 | | 0xC00 | ||
− | | | + | | 0xC |
| WiFi configuration slot 0 | | WiFi configuration slot 0 | ||
|- | |- | ||
| 0x00080001 | | 0x00080001 | ||
| 0xC00 | | 0xC00 | ||
− | | | + | | 0xC |
| WiFi configuration slot 1 | | WiFi configuration slot 1 | ||
|- | |- | ||
| 0x00080002 | | 0x00080002 | ||
| 0xC00 | | 0xC00 | ||
− | | | + | | 0xC |
| WiFi configuration slot 2 | | WiFi configuration slot 2 | ||
|- | |- | ||
| 0x00090000 | | 0x00090000 | ||
| 0x8 | | 0x8 | ||
− | | | + | | 0xE |
− | | This contains a u64 ID, used by processes using [[NWMUDS: | + | | This contains a u64 ID, used by processes using [[NWMUDS:InitializeWithVersion]]. The first word is the same as [[CfgS:GetLocalFriendCodeSeed|LocalFriendCodeSeed]], while the latter is a separate word. |
|- | |- | ||
| 0x00090001 | | 0x00090001 | ||
| 0x8 | | 0x8 | ||
| 0xE | | 0xE | ||
− | | This console-unique u64 used by [[Cfg:GenHashConsoleUnique|GenHashConsoleUnique]] is generated | + | | Same content as 0x0009000? This console-unique u64 is used by [[Cfg:GenHashConsoleUnique|GenHashConsoleUnique]]. It is generated by <code>((0x3FFFFFFFF) & LocalFriendCodeSeed) | (random16 << 48))</code>, where random16 is generated by [[PSPXI:GenerateRandomBytes|GenerateRandomBytes]] |
+ | |- | ||
+ | | 0x00090002 | ||
+ | | 0x4 | ||
+ | | 0xE | ||
+ | | The first two bytes are the same random16 used in 0x00090001. The second two bytes are zeros. | ||
|- | |- | ||
| 0x000A0000 | | 0x000A0000 | ||
| 0x1C | | 0x1C | ||
| 0xE | | 0xE | ||
− | | | + | | [[#User Name Block 0x000A0000|User Name]] |
|- | |- | ||
| 0x000A0001 | | 0x000A0001 | ||
| 0x2 | | 0x2 | ||
− | | | + | | 0xE |
− | | | + | | Birthday (u8 month, u8 day) |
|- | |- | ||
| 0x000A0002 | | 0x000A0002 | ||
| 0x1 | | 0x1 | ||
− | | | + | | 0xE |
| Language | | Language | ||
− | |||
|- | |- | ||
| 0x000B0000 | | 0x000B0000 | ||
| 0x4 | | 0x4 | ||
− | | | + | | 0xE |
| CountryInfo | | CountryInfo | ||
|- | |- | ||
| 0x000B0001 | | 0x000B0001 | ||
| 0x800 | | 0x800 | ||
− | | | + | | 0xE |
| Country name in UTF-16, every 0x80-bytes is an entry for each language, in the order of the Language table below (not all entries are set) | | Country name in UTF-16, every 0x80-bytes is an entry for each language, in the order of the Language table below (not all entries are set) | ||
|- | |- | ||
| 0x000B0002 | | 0x000B0002 | ||
| 0x800 | | 0x800 | ||
− | | | + | | 0xE |
| State name in UTF-16, every 0x80-bytes is an entry for each language | | State name in UTF-16, every 0x80-bytes is an entry for each language | ||
|- | |- | ||
Line 173: | Line 265: | ||
| 0x4 | | 0x4 | ||
| 0xE | | 0xE | ||
− | | | + | | Coordinates. A pair of s16 represents latitude and longitude, respectively. One need to multiply both value by 180/32768 to get coordinates in degrees |
|- | |- | ||
| 0x000C0000 | | 0x000C0000 | ||
| 0xC0 | | 0xC0 | ||
− | | | + | | 0xE |
− | | | + | | [[#Parental Control Settings Block 0x000C0000|Parental Controls - Main data]] |
|- | |- | ||
| 0x000C0001 | | 0x000C0001 | ||
| 0x14 | | 0x14 | ||
− | | | + | | 0xE |
− | | | + | | COPPACS restriction data |
+ | |- | ||
+ | | 0x000C0002 | ||
+ | | 0x200 | ||
+ | | 0xE | ||
+ | | [[#Parental Control Settings Block 0x000C0002|Parental Controls - Registered e-Mail address and custom secret question]] | ||
|- | |- | ||
| 0x000D0000 | | 0x000D0000 | ||
| 0x4 | | 0x4 | ||
− | | | + | | 0xE |
− | | u16 at offset 0x0: [[SMDH#EULA_Version|EULA Version]] which was agreed to. | + | | u16 at offset 0x0: [[SMDH#EULA_Version|EULA Version]] which was agreed to. u16 @ 0x02: latest version |
+ | |- | ||
+ | | 0x000E0000 | ||
+ | | 0x1 | ||
+ | | 0xE | ||
+ | | ? (related to SpotPass options in Internet Settings?) | ||
|- | |- | ||
| 0x000F0000 | | 0x000F0000 | ||
| 0x10 | | 0x10 | ||
− | | | + | | 0xC |
− | | | + | | Debug configuration, read by [[NS]] on dev-units: on startup, NS does <code>svcKernelSetState(6, 1, (u64)debug_flags & 1); |
+ | svcKernelSetState(6, 2, (u64)debug_flags & 2);</code> (see [[SVC#KernelSetState|here]]) where <code>debug_flags</code> is the u32 located at offset 0xC in this struct. Then it compares the u32 from +8 in this config-block with the [[Configuration_Memory#APPMEMTYPE|APPMEMTYPE]]. When those don't match NS starts a FIRM-launch (with the same FIRM titleID as the currently running one) to boot into a FIRM with the APPMEMTYPE value from this config-block. The byte at offset 0x0 is related to the memtype as well. | ||
+ | |- | ||
+ | | 0x000F0001 | ||
+ | | 0x8 | ||
+ | | 0xC | ||
+ | | ? | ||
+ | |- | ||
+ | | 0x000F0003 | ||
+ | | 0x1 | ||
+ | | 0xC | ||
+ | | Home Menu button disable | ||
|- | |- | ||
| 0x000F0004 | | 0x000F0004 | ||
| 0x4 | | 0x4 | ||
− | | | + | | 0xC |
| The first u8 is the System-Model [[Cfg:GetSystemModel|value]], the last 3-bytes are unknown | | The first u8 is the System-Model [[Cfg:GetSystemModel|value]], the last 3-bytes are unknown | ||
+ | |- | ||
+ | | 0x000F0005 | ||
+ | | 0x4 | ||
+ | | 0xC | ||
+ | | The first u8 indicates whether network updates are enabled (however, NIM only checks this flag with developer [[Configuration_Memory#ENVINFO|ENVINFO]]). | ||
+ | |- | ||
+ | | 0x000F0006 | ||
+ | | 0x28 | ||
+ | | 0xC | ||
+ | | In NIM, taken as a (hopefully null terminated) string used for the "X-Device-Token" http header field for NPNS url. | ||
+ | |- | ||
+ | | 0x00100000 | ||
+ | | 0x2 | ||
+ | | 0xC | ||
+ | | TWL EULA info ({bool agreed; u8 agreedVersion}) | ||
+ | |- | ||
+ | | 0x00100001 | ||
+ | | 0x94 | ||
+ | | 0xC | ||
+ | | Stores Parental Restrictions PIN/Secret Answer and other info for TWL mode | ||
+ | |- | ||
+ | | 0x00100002 | ||
+ | | 0x1 | ||
+ | | 0xC | ||
+ | | TWL country code | ||
+ | |- | ||
+ | | 0x00100003 | ||
+ | | 0x10 | ||
+ | | 0xC | ||
+ | | TWL movable unique ID, used for DSiWare exports | ||
|- | |- | ||
| 0x00110000 | | 0x00110000 | ||
| 0x4 | | 0x4 | ||
− | | | + | | 0xC |
| The low u16 indicates whether the system setup is required, such as when the system is booted for the first time or after doing a [[System Settings|System Format]]: 0 = setup required, non-zero = no setup required | | The low u16 indicates whether the system setup is required, such as when the system is booted for the first time or after doing a [[System Settings|System Format]]: 0 = setup required, non-zero = no setup required | ||
|- | |- | ||
| 0x00110001 | | 0x00110001 | ||
| 0x8 | | 0x8 | ||
− | | | + | | 0xC |
| TitleID of the menu to launch, used by [[NS]] on dev units (this block can be edited on dev units with [[3DS Development Unit Software#Config|Config]]) | | TitleID of the menu to launch, used by [[NS]] on dev units (this block can be edited on dev units with [[3DS Development Unit Software#Config|Config]]) | ||
|- | |- | ||
| 0x00120000 | | 0x00120000 | ||
| 0x8 | | 0x8 | ||
+ | | 0xC | ||
+ | | Volume Slider Bounds (Read by HID and PTM) | ||
+ | |- | ||
+ | | 0x00130000 | ||
+ | | 0x4 | ||
+ | | 0xE | ||
+ | | If response is 0x100 then debug mode is enabled. | ||
+ | |- | ||
+ | | 0x00150000 | ||
+ | | 0x4 | ||
+ | | 0xC | ||
+ | | Clock Sequence (u16) used for generating UUIDs in [[ACT_Services|ACT]]. | ||
+ | |- | ||
+ | | 0x00150001 | ||
| 0x8 | | 0x8 | ||
+ | | 0xC | ||
| ? | | ? | ||
|- | |- | ||
− | | | + | | 0x00150002 |
| 0x4 | | 0x4 | ||
− | | | + | | 0xE |
− | | | + | | In NIM, taken as an u32, using the low u16, casted to a char, and turned lower case for the making of the url for NPNS. |
|- | |- | ||
| 0x00160000 | | 0x00160000 | ||
| 0x4 | | 0x4 | ||
− | | | + | | 0xE |
| Unknown, first byte is used by config service-cmd [[Config_Services|0x00070040]]. (Unknown whether the last 3-bytes are used) | | Unknown, first byte is used by config service-cmd [[Config_Services|0x00070040]]. (Unknown whether the last 3-bytes are used) | ||
+ | |- | ||
+ | | 0x00170000 | ||
+ | | 0x4 | ||
+ | | 0xE | ||
+ | | Miiverse (OLV) access key | ||
+ | |- | ||
+ | | 0x00180000 | ||
+ | | 0x4 | ||
+ | | 0xC | ||
+ | | QTM Infrared LED related, can be 0 or 1 | ||
+ | |- | ||
+ | | 0x00180001 | ||
+ | | 0x18 | ||
+ | | 0xC | ||
+ | | [[Hardware_calibration#QTM|QTM calibration data]] | ||
+ | |- | ||
+ | | 0x00190000 | ||
+ | | 0x1 | ||
+ | | 0xC | ||
+ | | Unknown. NFC-module checks for value1/non-value1. | ||
|} | |} | ||
The developer unit TID block only exists on developer units. | The developer unit TID block only exists on developer units. | ||
+ | |||
+ | ===Stereo Display Settings=== | ||
+ | All values are hard-coded in cfg module. | ||
+ | {| class="wikitable" border="1" | ||
+ | |- | ||
+ | ! Offset | ||
+ | ! Size | ||
+ | ! Value | ||
+ | ! Description | ||
+ | |- | ||
+ | | 0x0 | ||
+ | | 4 | ||
+ | | 62.0f | ||
+ | |assumed pupillary distance in mm? | ||
+ | |- | ||
+ | | 0x4 | ||
+ | | 4 | ||
+ | | 289.0f | ||
+ | |assumed distance in mm between player's eyes and upper screen? | ||
+ | |- | ||
+ | | 0x8 | ||
+ | | 4 | ||
+ | | 76.80f | ||
+ | |width in mm of (old) 3DS upper screen (doesn't vary for different models?) | ||
+ | |- | ||
+ | | 0xC | ||
+ | | 4 | ||
+ | | 46.08f | ||
+ | |height in mm of (old) 3DS upper screen (doesn't vary for different models?) | ||
+ | |- | ||
+ | | 0x10 | ||
+ | | 4 | ||
+ | | 10.0f | ||
+ | | | ||
+ | |- | ||
+ | | 0x14 | ||
+ | | 4 | ||
+ | | 5.0f | ||
+ | | | ||
+ | |- | ||
+ | | 0x18 | ||
+ | | 4 | ||
+ | | 55.58f | ||
+ | | | ||
+ | |- | ||
+ | | 0x1C | ||
+ | | 4 | ||
+ | | 21.57f | ||
+ | | | ||
+ | |} | ||
===Languages=== | ===Languages=== | ||
Line 285: | Line 513: | ||
|- | |- | ||
| 2 | | 2 | ||
− | | | + | | State/Province code. |
|- | |- | ||
| 3 | | 3 | ||
Line 291: | Line 519: | ||
|} | |} | ||
− | ===0x000A0000 | + | ===User Name Block 0x000A0000=== |
{| class="wikitable" border="1" | {| class="wikitable" border="1" | ||
|- | |- | ||
Line 297: | Line 525: | ||
! Description | ! Description | ||
|- | |- | ||
− | | | + | | 0x00-0x15 |
− | | UTF-16 | + | | User name (UTF-16) |
|- | |- | ||
− | | | + | | 0x16-0x17 |
− | | | + | | u16 NGWord flag to denote that the user name is inappropriate |
|- | |- | ||
| 0x18-0x1B | | 0x18-0x1B | ||
| u32 NGWord version the username was last checked with. If this value is less than the u32 stored in the NGWord CFA "romfs:/version.dat", the system then checks the username string with the bad-word list CFA again, then updates this field with the value from the CFA | | u32 NGWord version the username was last checked with. If this value is less than the u32 stored in the NGWord CFA "romfs:/version.dat", the system then checks the username string with the bad-word list CFA again, then updates this field with the value from the CFA | ||
+ | |} | ||
+ | |||
+ | While the user name is NULL-terminated, the terminator is not applied when the user name is 10 characters long, which leads to online access breaking (002-0109) and buffer overflows when the user name is retrieved, even in DS games. | ||
+ | |||
+ | ===WiFi Slot Structure=== | ||
+ | |||
+ | ====Network structure==== | ||
+ | This is used twice in the actual WiFi slot structure. | ||
+ | {| class="wikitable" border="1" | ||
+ | |- | ||
+ | ! Offset | ||
+ | ! Size | ||
+ | ! Description | ||
+ | |- | ||
+ | | 0x0 | ||
+ | | 0x1 | ||
+ | | Whether the network was set or not? | ||
+ | |- | ||
+ | | 0x1 | ||
+ | | 0x1 | ||
+ | | Whether to use this network strucutre to connect? | ||
+ | |- | ||
+ | | 0x2 | ||
+ | | 0x1 | ||
+ | | Whether this structure is the first (0) or the second (1) in the larger WiFi slot structure? | ||
+ | |- | ||
+ | | 0x3 | ||
+ | | 0x1 | ||
+ | | Padding ? | ||
+ | |- | ||
+ | | 0x4 | ||
+ | | 0x20 | ||
+ | | SSID of the network, without a trailing nullbyte. | ||
+ | |- | ||
+ | | 0x24 | ||
+ | | 0x1 | ||
+ | | Length of the SSID. | ||
+ | |- | ||
+ | | 0x25 | ||
+ | | 0x1 | ||
+ | | [[Nintendo_Zone#Beacon_payload_format|AP crypto key type]] | ||
+ | |- | ||
+ | | 0x26 | ||
+ | | 0x2 | ||
+ | | Padding ? | ||
+ | |- | ||
+ | | 0x28 | ||
+ | | 0x40 | ||
+ | | Plaintext of the passphrase of the network, without a trailing nullbyte. | ||
+ | |- | ||
+ | | 0x68 | ||
+ | | 0x20 | ||
+ | | PBKDF2 of the passphrase and SSID (http://jorisvr.nl/wpapsk.html). | ||
+ | |- | ||
+ | |} | ||
+ | |||
+ | ====Actual structure==== | ||
+ | {| class="wikitable" border="1" | ||
+ | |- | ||
+ | ! Offset | ||
+ | ! Size | ||
+ | ! Description | ||
+ | |- | ||
+ | | 0x0 | ||
+ | | 0x2 | ||
+ | | ? | ||
+ | |- | ||
+ | | 0x2 | ||
+ | | 0x2 | ||
+ | | [https://github.com/lammertb/libcrc/blob/v2.0/src/crc16.c#L43-L76 CRC-16 checksum] of the next 0x410 bytes. | ||
+ | |- | ||
+ | | 0x4 | ||
+ | | 0x88 | ||
+ | | First network structure. Only set if the network was set "normally", or was the last to be set using WPS during the session. | ||
+ | |- | ||
+ | | 0x8C | ||
+ | | 0x20 | ||
+ | | Padding. | ||
+ | |- | ||
+ | | 0xAC | ||
+ | | 0x88 | ||
+ | | Second network structure. Only set if the network was set using WPS, otherwise 0-filled. | ||
+ | |- | ||
+ | | 0x134 | ||
+ | | 0x20C | ||
+ | | Padding. | ||
+ | |- | ||
+ | | 0x340 | ||
+ | | 0x1 | ||
+ | | Whether to automatically get the IP address (use DHCP) or not, defaults to 1. | ||
+ | |- | ||
+ | | 0x341 | ||
+ | | 0x1 | ||
+ | | Whether to automatically get the DNS or not, defaults to 1. | ||
+ | |- | ||
+ | | 0x342 | ||
+ | | 0x2 | ||
+ | | Padding ? | ||
+ | |- | ||
+ | | 0x344 | ||
+ | | 0x4 | ||
+ | | IP address, to use if 0x340 is false. | ||
+ | |- | ||
+ | | 0x348 | ||
+ | | 0x4 | ||
+ | | IP address of the gateway, to use if 0x340 is false. | ||
+ | |- | ||
+ | | 0x34C | ||
+ | | 0x4 | ||
+ | | Subnetwork mask, to use if 0x340 is false. | ||
+ | |- | ||
+ | | 0x350 | ||
+ | | 0x4 | ||
+ | | IP address of the primary DNS , to use if 0x341 is false. | ||
+ | |- | ||
+ | | 0x354 | ||
+ | | 0x4 | ||
+ | | IP address of the secondary DNS, to use if 0x341 is false. | ||
+ | |- | ||
+ | | 0x358 | ||
+ | | 0x4 | ||
+ | | Always 0x01050000 ? Only set if the network was the last to be set during the session. | ||
+ | |- | ||
+ | | 0x35C | ||
+ | | 0x4 | ||
+ | | IP address to use. Only set if the network was the last to be set during the session. | ||
+ | |- | ||
+ | | 0x360 | ||
+ | | 0x6 | ||
+ | | MAC address of the AP. Only set if the network was the last to be set during the session. | ||
+ | |- | ||
+ | | 0x366 | ||
+ | | 0x1 | ||
+ | | Channel. Only set if the network was the last to be set during the session. | ||
+ | |- | ||
+ | | 0x367 | ||
+ | | 0x1 | ||
+ | | Padding ? Only set if the network was the last to be set during the session. | ||
+ | |- | ||
+ | | 0x368 | ||
+ | | 0x1 | ||
+ | | Whether to use a proxy or not, defaults to 0. | ||
+ | |- | ||
+ | | 0x369 | ||
+ | | 0x1 | ||
+ | | Whether to use a basic authentication for the proxy, defaults to 0. | ||
+ | |- | ||
+ | | 0x36A | ||
+ | | 0x2 | ||
+ | | Port to use for the proxy, defaults to 1. | ||
+ | |- | ||
+ | | 0x36C | ||
+ | | 0x30 | ||
+ | | URL/address of the proxy, including a trailing nullbyte. | ||
+ | |- | ||
+ | | 0x39C | ||
+ | | 0x34 | ||
+ | | Padding. | ||
+ | |- | ||
+ | | 0x3D0 | ||
+ | | 0x20 | ||
+ | | Username to use for basic authentication, including a trailing nullbyte. | ||
+ | |- | ||
+ | | 0x3F0 | ||
+ | | 0x20 | ||
+ | | Password to use for basic authentication, including a trailing nullbyte. | ||
+ | |- | ||
+ | | 0x410 | ||
+ | | 0x2 | ||
+ | | Padding ? | ||
+ | |- | ||
+ | | 0x412 | ||
+ | | 0x2 | ||
+ | | MTU value, defaults to 1400 and ranges between 576 and 1500, inclusive. | ||
+ | |- | ||
+ | | 0x414 | ||
+ | | 0x7EC | ||
+ | | Padding. | ||
+ | |- | ||
+ | |} | ||
+ | |||
+ | ===LCD display config=== | ||
+ | There seems to be some sort of LCD display configuration stored in this cfg. When using the cfg-save from an Old3DS on a New3DS without formatting the cfg first, the bottom-screen display is somewhat off(which is fixed by formatting the cfg-save). | ||
+ | |||
+ | |||
+ | ===Parental Control Settings Block 0x00100001=== | ||
+ | {| class="wikitable" border="1" | ||
+ | |- | ||
+ | ! Byte | ||
+ | ! Size in bytes | ||
+ | ! Description | ||
+ | |- | ||
+ | | 0x0 | ||
+ | | 0xD | ||
+ | | Unknown. | ||
+ | |- | ||
+ | | 0xD | ||
+ | | 0x4 | ||
+ | | PIN | ||
+ | |- | ||
+ | | 0x11 | ||
+ | | 0x40 | ||
+ | | Secret Answer (UTF-16) | ||
+ | |} | ||
+ | |||
+ | ===Parental Control Settings Block 0x000C0000=== | ||
+ | {| class="wikitable" border="1" | ||
+ | |- | ||
+ | ! Offset | ||
+ | ! Size | ||
+ | ! Description | ||
+ | |- | ||
+ | | 0x00 | ||
+ | | 0x04 | ||
+ | | [[#Parental Control Restriction Bitmask|Parental Control Restriction Bitmask]] | ||
+ | |- | ||
+ | | 0x04 | ||
+ | | 0x04 | ||
+ | | Unknown | ||
+ | |- | ||
+ | | 0x08 | ||
+ | | 0x01 | ||
+ | | Rating system used for configuration | ||
+ | |- | ||
+ | | 0x09 | ||
+ | | 0x01 | ||
+ | | Maximum allowed age (20 = No restriction) | ||
+ | |- | ||
+ | | 0x0A | ||
+ | | 0x01 | ||
+ | | Secret Question Type (0-5: Pre-defined, 6: Custom) | ||
+ | |- | ||
+ | | 0x0B | ||
+ | | 0x01 | ||
+ | | Unknown | ||
+ | |- | ||
+ | | 0x0C | ||
+ | | 0x08 | ||
+ | | Parental Controls PIN code (with NULL-termination, although restricted to 4 digits) | ||
+ | |- | ||
+ | | 0x14 | ||
+ | | 0x44 | ||
+ | | Secret Answer (UTF-16) | ||
+ | |} | ||
+ | |||
+ | ====Parental Control Restriction Bitmask==== | ||
+ | {| class="wikitable" border="1" | ||
+ | |- | ||
+ | ! Bit | ||
+ | ! Restriction name | ||
+ | |- | ||
+ | | 0 | ||
+ | | Global Parental Controls Enable | ||
+ | |- | ||
+ | | 1 | ||
+ | | Internet Browser | ||
+ | |- | ||
+ | | 2 | ||
+ | | Display of 3D Images (disabled on 2DS) | ||
+ | |- | ||
+ | | 3 | ||
+ | | Sharing Images/Audio/Video/Long Text Data | ||
+ | |- | ||
+ | | 4 | ||
+ | | Online Interaction | ||
+ | |- | ||
+ | | 5 | ||
+ | | StreetPass | ||
+ | |- | ||
+ | | 6 | ||
+ | | Friend Registration | ||
+ | |- | ||
+ | | 7 | ||
+ | | DS Download Play | ||
+ | |- | ||
+ | | 8 | ||
+ | | Nintendo 3DS Shopping Services (eShop / EC Applet) | ||
+ | |- | ||
+ | | 9 | ||
+ | | View Distributed Videos | ||
+ | |- | ||
+ | | 10 | ||
+ | | Miiverse (View) | ||
+ | |- | ||
+ | | 11 | ||
+ | | Miiverse (Post) | ||
+ | |- | ||
+ | | 31 | ||
+ | | "Child Online Privacy Protection" (see [[Cfg:GetRegionCanadaUSA|CFG:IsCoppacsSupported]]) | ||
+ | |} | ||
+ | |||
+ | ===Parental Control Settings Block 0x000C0002=== | ||
+ | {| class="wikitable" border="1" | ||
+ | |- | ||
+ | ! Offset | ||
+ | ! Size | ||
+ | ! Description | ||
+ | |- | ||
+ | | 0x0000 | ||
+ | | 0x0001 | ||
+ | | Boolean, whether an e-Mail has been registered | ||
+ | |- | ||
+ | | 0x0001 | ||
+ | | 0x0101 | ||
+ | | Registered e-Mail address (Plaintext) | ||
+ | |- | ||
+ | | 0x0102 | ||
+ | | 0x0068 | ||
+ | | Custom Secret Question (UTF-16) | ||
|} | |} |
Latest revision as of 00:27, 5 June 2024
This page describes the format of the Cfg NAND savegame. These blocks can be accessed with the Cfg service commands.
Structure of save-file "/config"[edit]
Offset | Size | Description |
---|---|---|
0x0 | 0x2 | Total entries |
0x2 | 0x2 | Data entries offset |
0x4 | 0x4558 | Block entries |
0x455C | Data for the entries |
The filesize for this /config file is 0x8000-bytes.
Configuration block entry[edit]
Offset | Size | Description |
---|---|---|
0x0 | 0x4 | BlkID |
0x4 | 0x4 | Offset to the data for this block when size is >4, otherwise this word is the data for this block |
0x8 | 0x2 | Size |
0xA | 0x2 | Access Flags |
Access Flags[edit]
Bit Mask | Description |
---|---|
0x2 | User Readable (cfg:u) |
0x4 | System Writable (cfg:s / cfg:i) |
0x8 | System Readable (cfg:s / cfg:i) |
Config blocks will typically either use 0xC for system readable/writable or 0xE for all 3.
Configuration blocks[edit]
BlkID | Size | Access Flags | Description |
---|---|---|---|
0x00000000 | 0x2 | 0xC | Config savegame version? |
0x00010000 | 0x1 | 0xC | RTC compensation value |
0x00020000 | 0x134 | 0xC | Codec |
0x00030000 | 0x1 | 0xC | Leap Year Counter (read By PTM) |
0x00030001 | 0x8 | 0xE | User time offset (read by CECD): displayed timestamp - rtc timestamp |
0x00030002 | 0x8 | 0xC | Settings time offset: newly set timestamp - rtc timestamp |
0x00040000 | 0x10 | 0xC | Touch calibration (read by HID) |
0x00040001 | 0x1C | 0xC | Analog Stick Calibration Param?(read by HID) |
0x00040002 | 0x12 | 0xC | Gyroscope (read by HID) |
0x00040003 | 0xC | 0xC | Accelerometer (read by HID) |
0x00040004 | 0x1C | 0xC | CStick calibration data |
0x00050000 | 0x2 | 0xC | Screen flicker |
0x00050001 | 0x2 | 0xC | Backlight controls (u8 ABL_powersave_enable, u8 brightness_level) (read by GSP) |
0x00050002 | 0x38 | 0xC | Backlight PWM (read by GSP) |
0x00050003 | 0x20 | 0xC | Power saving mode (ABL) calibration (read by GSP) |
0x00050004 | 0x20 | 0xC | Power saving mode (ABL) calibration (for legacy FIRM) |
0x00050005 | 0x20 | 0xE | Stereo display settings (HWCAL block 0x470) |
0x00050006 | 0x2 | 0xC | 3D switching delay |
0x00050007 | 0x4 | 0xC | ? |
0x00050008 | 0x10C | 0xC | Power saving mode (ABL) extra config |
0x00050009 | 0x8 | 0xC | new3DS only(?) backlight control (5th byte: auto-brightness enable) |
0x00060000 | 0x96 | 0xC | ??? (HWCAL block 0x500) |
0x00070000 | 0x214 | 0xE | 3D filters |
0x00070001 | 0x1 | 0xE | Sound output mode (mono=0, stereo=1, surround=2) |
0x00070002 | 0x8 | 0xE | Microphone echo cancellation params |
0x00080000 | 0xC00 | 0xC | WiFi configuration slot 0 |
0x00080001 | 0xC00 | 0xC | WiFi configuration slot 1 |
0x00080002 | 0xC00 | 0xC | WiFi configuration slot 2 |
0x00090000 | 0x8 | 0xE | This contains a u64 ID, used by processes using NWMUDS:InitializeWithVersion. The first word is the same as LocalFriendCodeSeed, while the latter is a separate word. |
0x00090001 | 0x8 | 0xE | Same content as 0x0009000? This console-unique u64 is used by GenHashConsoleUnique. It is generated by ((0x3FFFFFFFF) & LocalFriendCodeSeed) | (random16 << 48)) , where random16 is generated by GenerateRandomBytes
|
0x00090002 | 0x4 | 0xE | The first two bytes are the same random16 used in 0x00090001. The second two bytes are zeros. |
0x000A0000 | 0x1C | 0xE | User Name |
0x000A0001 | 0x2 | 0xE | Birthday (u8 month, u8 day) |
0x000A0002 | 0x1 | 0xE | Language |
0x000B0000 | 0x4 | 0xE | CountryInfo |
0x000B0001 | 0x800 | 0xE | Country name in UTF-16, every 0x80-bytes is an entry for each language, in the order of the Language table below (not all entries are set) |
0x000B0002 | 0x800 | 0xE | State name in UTF-16, every 0x80-bytes is an entry for each language |
0x000B0003 | 0x4 | 0xE | Coordinates. A pair of s16 represents latitude and longitude, respectively. One need to multiply both value by 180/32768 to get coordinates in degrees |
0x000C0000 | 0xC0 | 0xE | Parental Controls - Main data |
0x000C0001 | 0x14 | 0xE | COPPACS restriction data |
0x000C0002 | 0x200 | 0xE | Parental Controls - Registered e-Mail address and custom secret question |
0x000D0000 | 0x4 | 0xE | u16 at offset 0x0: EULA Version which was agreed to. u16 @ 0x02: latest version |
0x000E0000 | 0x1 | 0xE | ? (related to SpotPass options in Internet Settings?) |
0x000F0000 | 0x10 | 0xC | Debug configuration, read by NS on dev-units: on startup, NS does svcKernelSetState(6, 1, (u64)debug_flags & 1);
|
0x000F0001 | 0x8 | 0xC | ? |
0x000F0003 | 0x1 | 0xC | Home Menu button disable |
0x000F0004 | 0x4 | 0xC | The first u8 is the System-Model value, the last 3-bytes are unknown |
0x000F0005 | 0x4 | 0xC | The first u8 indicates whether network updates are enabled (however, NIM only checks this flag with developer ENVINFO). |
0x000F0006 | 0x28 | 0xC | In NIM, taken as a (hopefully null terminated) string used for the "X-Device-Token" http header field for NPNS url. |
0x00100000 | 0x2 | 0xC | TWL EULA info ({bool agreed; u8 agreedVersion}) |
0x00100001 | 0x94 | 0xC | Stores Parental Restrictions PIN/Secret Answer and other info for TWL mode |
0x00100002 | 0x1 | 0xC | TWL country code |
0x00100003 | 0x10 | 0xC | TWL movable unique ID, used for DSiWare exports |
0x00110000 | 0x4 | 0xC | The low u16 indicates whether the system setup is required, such as when the system is booted for the first time or after doing a System Format: 0 = setup required, non-zero = no setup required |
0x00110001 | 0x8 | 0xC | TitleID of the menu to launch, used by NS on dev units (this block can be edited on dev units with Config) |
0x00120000 | 0x8 | 0xC | Volume Slider Bounds (Read by HID and PTM) |
0x00130000 | 0x4 | 0xE | If response is 0x100 then debug mode is enabled. |
0x00150000 | 0x4 | 0xC | Clock Sequence (u16) used for generating UUIDs in ACT. |
0x00150001 | 0x8 | 0xC | ? |
0x00150002 | 0x4 | 0xE | In NIM, taken as an u32, using the low u16, casted to a char, and turned lower case for the making of the url for NPNS. |
0x00160000 | 0x4 | 0xE | Unknown, first byte is used by config service-cmd 0x00070040. (Unknown whether the last 3-bytes are used) |
0x00170000 | 0x4 | 0xE | Miiverse (OLV) access key |
0x00180000 | 0x4 | 0xC | QTM Infrared LED related, can be 0 or 1 |
0x00180001 | 0x18 | 0xC | QTM calibration data |
0x00190000 | 0x1 | 0xC | Unknown. NFC-module checks for value1/non-value1. |
The developer unit TID block only exists on developer units.
Stereo Display Settings[edit]
All values are hard-coded in cfg module.
Offset | Size | Value | Description |
---|---|---|---|
0x0 | 4 | 62.0f | assumed pupillary distance in mm? |
0x4 | 4 | 289.0f | assumed distance in mm between player's eyes and upper screen? |
0x8 | 4 | 76.80f | width in mm of (old) 3DS upper screen (doesn't vary for different models?) |
0xC | 4 | 46.08f | height in mm of (old) 3DS upper screen (doesn't vary for different models?) |
0x10 | 4 | 10.0f | |
0x14 | 4 | 5.0f | |
0x18 | 4 | 55.58f | |
0x1C | 4 | 21.57f |
Languages[edit]
ID | Description |
---|---|
0 | JP |
1 | EN |
2 | FR |
3 | DE |
4 | IT |
5 | ES |
6 | ZH |
7 | KO |
8 | NL |
9 | PT |
10 | RU |
11 | TW |
CountryInfo[edit]
Byte | Description |
---|---|
0 | ? |
1 | ? |
2 | State/Province code. |
3 | Country code, same as DSi/Wii country codes. Value 0xFF is invalid. |
User Name Block 0x000A0000[edit]
Byte | Description |
---|---|
0x00-0x15 | User name (UTF-16) |
0x16-0x17 | u16 NGWord flag to denote that the user name is inappropriate |
0x18-0x1B | u32 NGWord version the username was last checked with. If this value is less than the u32 stored in the NGWord CFA "romfs:/version.dat", the system then checks the username string with the bad-word list CFA again, then updates this field with the value from the CFA |
While the user name is NULL-terminated, the terminator is not applied when the user name is 10 characters long, which leads to online access breaking (002-0109) and buffer overflows when the user name is retrieved, even in DS games.
WiFi Slot Structure[edit]
Network structure[edit]
This is used twice in the actual WiFi slot structure.
Offset | Size | Description |
---|---|---|
0x0 | 0x1 | Whether the network was set or not? |
0x1 | 0x1 | Whether to use this network strucutre to connect? |
0x2 | 0x1 | Whether this structure is the first (0) or the second (1) in the larger WiFi slot structure? |
0x3 | 0x1 | Padding ? |
0x4 | 0x20 | SSID of the network, without a trailing nullbyte. |
0x24 | 0x1 | Length of the SSID. |
0x25 | 0x1 | AP crypto key type |
0x26 | 0x2 | Padding ? |
0x28 | 0x40 | Plaintext of the passphrase of the network, without a trailing nullbyte. |
0x68 | 0x20 | PBKDF2 of the passphrase and SSID (http://jorisvr.nl/wpapsk.html). |
Actual structure[edit]
Offset | Size | Description |
---|---|---|
0x0 | 0x2 | ? |
0x2 | 0x2 | CRC-16 checksum of the next 0x410 bytes. |
0x4 | 0x88 | First network structure. Only set if the network was set "normally", or was the last to be set using WPS during the session. |
0x8C | 0x20 | Padding. |
0xAC | 0x88 | Second network structure. Only set if the network was set using WPS, otherwise 0-filled. |
0x134 | 0x20C | Padding. |
0x340 | 0x1 | Whether to automatically get the IP address (use DHCP) or not, defaults to 1. |
0x341 | 0x1 | Whether to automatically get the DNS or not, defaults to 1. |
0x342 | 0x2 | Padding ? |
0x344 | 0x4 | IP address, to use if 0x340 is false. |
0x348 | 0x4 | IP address of the gateway, to use if 0x340 is false. |
0x34C | 0x4 | Subnetwork mask, to use if 0x340 is false. |
0x350 | 0x4 | IP address of the primary DNS , to use if 0x341 is false. |
0x354 | 0x4 | IP address of the secondary DNS, to use if 0x341 is false. |
0x358 | 0x4 | Always 0x01050000 ? Only set if the network was the last to be set during the session. |
0x35C | 0x4 | IP address to use. Only set if the network was the last to be set during the session. |
0x360 | 0x6 | MAC address of the AP. Only set if the network was the last to be set during the session. |
0x366 | 0x1 | Channel. Only set if the network was the last to be set during the session. |
0x367 | 0x1 | Padding ? Only set if the network was the last to be set during the session. |
0x368 | 0x1 | Whether to use a proxy or not, defaults to 0. |
0x369 | 0x1 | Whether to use a basic authentication for the proxy, defaults to 0. |
0x36A | 0x2 | Port to use for the proxy, defaults to 1. |
0x36C | 0x30 | URL/address of the proxy, including a trailing nullbyte. |
0x39C | 0x34 | Padding. |
0x3D0 | 0x20 | Username to use for basic authentication, including a trailing nullbyte. |
0x3F0 | 0x20 | Password to use for basic authentication, including a trailing nullbyte. |
0x410 | 0x2 | Padding ? |
0x412 | 0x2 | MTU value, defaults to 1400 and ranges between 576 and 1500, inclusive. |
0x414 | 0x7EC | Padding. |
LCD display config[edit]
There seems to be some sort of LCD display configuration stored in this cfg. When using the cfg-save from an Old3DS on a New3DS without formatting the cfg first, the bottom-screen display is somewhat off(which is fixed by formatting the cfg-save).
Parental Control Settings Block 0x00100001[edit]
Byte | Size in bytes | Description |
---|---|---|
0x0 | 0xD | Unknown. |
0xD | 0x4 | PIN |
0x11 | 0x40 | Secret Answer (UTF-16) |
Parental Control Settings Block 0x000C0000[edit]
Offset | Size | Description |
---|---|---|
0x00 | 0x04 | Parental Control Restriction Bitmask |
0x04 | 0x04 | Unknown |
0x08 | 0x01 | Rating system used for configuration |
0x09 | 0x01 | Maximum allowed age (20 = No restriction) |
0x0A | 0x01 | Secret Question Type (0-5: Pre-defined, 6: Custom) |
0x0B | 0x01 | Unknown |
0x0C | 0x08 | Parental Controls PIN code (with NULL-termination, although restricted to 4 digits) |
0x14 | 0x44 | Secret Answer (UTF-16) |
Parental Control Restriction Bitmask[edit]
Bit | Restriction name |
---|---|
0 | Global Parental Controls Enable |
1 | Internet Browser |
2 | Display of 3D Images (disabled on 2DS) |
3 | Sharing Images/Audio/Video/Long Text Data |
4 | Online Interaction |
5 | StreetPass |
6 | Friend Registration |
7 | DS Download Play |
8 | Nintendo 3DS Shopping Services (eShop / EC Applet) |
9 | View Distributed Videos |
10 | Miiverse (View) |
11 | Miiverse (Post) |
31 | "Child Online Privacy Protection" (see CFG:IsCoppacsSupported) |
Parental Control Settings Block 0x000C0002[edit]
Offset | Size | Description |
---|---|---|
0x0000 | 0x0001 | Boolean, whether an e-Mail has been registered |
0x0001 | 0x0101 | Registered e-Mail address (Plaintext) |
0x0102 | 0x0068 | Custom Secret Question (UTF-16) |