Home Menu

The Home Menu is the heart of the Nintendo 3DS. From there one can start games, applications, and access various processes including the friends list. It is launched by NS, and is always running in the background in 3DS-mode except when other programID-high 00040030 applications like Internet Browser, Friend-List, etc are running. Home Menu is still running while System Settings is running, however the System Settings application does not allow directly returning to home-menu. The system will normally re-launch Home Menu when the Home Menu process crashes/terminates. When this re-launch occurs while Home Menu is active, Home Menu displays an error message which says to manually reboot the system.

System Versions

Nintendo devised a system, whereby updates would be delivered via two channels:

• Card Updates (CUP) - The Nintendo 3DS is updated with data from an update partition on retail gamecard title.
• Network Updates (NUP) - The Nintendo 3DS is updated by downloading data from Nintendo's CDN.

CUPs will only deliver updates to core features, such as the Home Menu, Download Play etc. CUPs will not deliver updates to Network features, such as System Transfer, Internet Browser, StreetPass Mii Plaza or eShop.

NUPs can deliver updates to core features as well as (updated) Network Features.

As a result of deciding to make a distinction between what content could be updated and how, Nintendo split the system version displayed by System Settings into two parts: CVer (Console Version) and NVer (Network Update Version). Represented as:

<CVer Major>.<CVer Minor>.<CVer Micro>-<NUP Version><NUP Region>

The Console Version represents the version of the collectively installed core features. And the NUP Version represents the version of the collectively installed network features.

So if a 3DS' System Firmware read 2.1.0-2U, it would indicate a console version of 2.1.0 and a NUP version of 2U.

NOTES:

• CUPs can only update core content, so NVer is never updated with CUPs.
• NUPs will not update NVer if network features are not updated. (Best seen with the USA vs JPN/EUR 6.0.0 NUP)

CUPs are implemented by adding a System Update CFA to retail NCSD gamecard images. Nintendo generally creates CUPs after NUPs are released.

When updating the system from 4.5.0-6 to 4.5.0-10, the following titles are updated(in the order of title download+install): Health and Safety Information, Nintendo 3DS Camera, eShop, System Transfer, Internet Browser, 0004009B00014102, 0004009B00014202, 0004009B00014302, NVer, and AGB_FIRM.

System Versions List

System version	Home Menu title version	Release date	Changelog	System security flaws fixed*	Userland security flaws fixed*	3DS-mode homebrew affected*	CUP Released	CDN Availability	CDN Post Date
1.0.0-0	0	February 26, 2011	Shipped with 3DS on launch				Yes	Available	February 18, 2011
1.1.0-1	0	February ?, 2011	General bug fixes Added 3D Video title to menu. ("For a Limited Time Only")				Yes	Available	March 1, 2011
2.0.0-2	1029	June 6/7, 2011	eShop added, web browser available, System Transfer added. Full DSiWare data management available. Automatic downloading for system updates added. Video stubbed.				No	Available	June 6, 2011
2.1.0-3	2049	June 15, 2011	Fixes the Ridge Racer freeze.				Yes	Available	June 15, 2011
2.1.0-4	Not updated	July 25, 2011	System stability improvements and other adjustments.				No	Available	July 25, 2011
2.2.0	?	November 6, 2011	CUP Only Release. Add "join game" feature to Friend List. Update from some game cards such as Super Mario 3D Land.				Yes	Unavailable	?
3.0.0-5	4111	December 7, 2011	Added 3D video recording to the camera title, updated Mii Streetpass Plaza, System Transfer between 3DS systems available, improved eShop, home menu QR code scanning with QR codes containing URLs. Nintendo Zone is now always accessible, 3D video streaming support was added to NZone. This added support for running GBA VC titles via AGB_FIRM as well, support for GBA VC titles was also added to NATIVE_FIRM.				Yes	Available	December 7, 2011
3.0.0-6	Not updated	December 21, 2011	Only StreetPass Mii Plaza and the NVer title were updated. From Nintendo's release notes: "System stability improvements and other adjustments".				No	Available	December 21, 2011
3.1.0-6	Not updated	Unknown	Unknown. Sighted preinstalled on some early European 3DS XLs.				?	Unknown	Unknown
4.0.0-7	5131	April 24, 2012	Add folders to Home Menu, game patching added, buy more expensive games than 1000 yen in JPN. System titles for CHN, TWN, and KOR became available.	Yes			Yes	Available	April 24, 2012
4.1.0-8	Not updated	May 14, 2012	From changelog: "improvements to overall system stability and other minor adjustments". Once updated to 4.1.0-8, the parental-controls PIN is no longer required for future system updates.	Yes			Yes	Available	May 14, 2012
4.2.0-9	6146	June 26, 2012	Improved eShop safety for entering credit-card info, and behind the scenes improvements. Stored CC info will be deleted by this updated eShop, and can be re-entered again.				Yes	Available	June 26, 2012
4.3.0-10	Not updated	July 24, 2012	Updated eShop, bad word list and NZone hotspot list updated.				Yes	Available	July 24, 2012
4.4.0-10	Not updated	September 19, 2012	NZone hotspot list updated and TWL_FIRM updated for blocking flash cards.				Yes	Available	September 19, 2012
4.4.0-10C	Not updated	October 17, 2012	China-only, the *only* updated title was System Settings. This title was updated to a version already available in TWN/KOR.				?	Available	October 17, 2012
4.5.0-10	Not updated	December 4, 2012	Flash-card block via updated TWL_FIRM and whitelist. NZone hotspot list updated as well.				Yes	Available	December 4, 2012
5.0.0-11	7172	March 25, 2013	Many system titles including NATIVE_FIRM were updated, multiple vulnerabilities were fixed as well.	Yes		Yes	No	Available	March 25, 2013
5.1.0-11	Not updated	April 4, 2013	NATIVE_FIRM and NS were updated. According to the official change-log: "Resolves an issue that may prevent access to the System Settings or other features."	No		No	Yes	Available	April 4, 2013
6.0.0-12 (-11U)	8198	June 17, 2013	Official change-log: "Users can now back up save data for downloadable versions of Nintendo 3DS software and most Virtual Console games". For EUR/JPN, the StreetPass Mii Plaza application and the Nintendo 3DS Camera application were updated. Other titles for all regions were updated as well.	Yes			No	Available	June 17, 2013
6.1.0-12 (-11U)	Not updated	June 27, 2013	Official change-log: "Further improvements to overall system stability and other minor adjustments have been made to enhance the user experience."				Yes	Available	June 27, 2013
6.1.0-12U	Not updated	July 11, 2013	This USA-only update added the updated network features applications which were first released in JPN/EUR with the 6.0.0-12 NUP update.				No	Available	July 11, 2013
6.2.0-12	Not updated	August 6, 2013	This update added support for the StreetPass relay feature, updated TWL_FIRM, and updated the Nintendo Zone hotspots list.				Yes	Available	August 6, 2013
6.3.0-12	Not updated	September 13, 2013	See this.	No		No	No	Available	September 13, 2013
6.4.0-12	?	November 11, 2013	See this(Only for the KOR and TWN regions).				No	Available	November 11, 2013
7.0.0-13	9230	December 9, 2013	See this.	Yes	Yes		No	Available	December 9, 2013
7.1.0-14	Not updated	December 19, 2013	See this.	No			Yes	Available	December 19, 2013
7.1.0-15	Not updated	January 22, 2014	See this.	No		No	No	Available	January 22, 2014
7.1.0-16	Not updated	February 26, 2014	See this.	No		No	No	Available	February 26, 2014
7.2.0-17	Not updated	May 12, 2014	See this.			No	Yes	Available	May 12, 2014
8.0.0-18	Not updated	July 7, 2014	See this.	No		No	Yes	Available	July 7, 2014
8.1.0-18	Not updated	July 24, 2014	See this.	No		No	Yes	Available	July 24, 2014
8.1.0-19	Not updated	August 7, 2014	See this.	No		No	No	Available	August 7, 2014
8.1.0-0 New3DS	Not updated	September 26, 2014	See this.			No	No	Available	September 26, 2014
8.1.0-19	Not updated	October 2, 2014	Japan-only "update", see here. The only change was that a new title(New_3DS-only system application) was added, CVer/NVer titles were not even updated. The initial version of this title is a stub.	No		No	No	Available	October 2, 2014
9.0.0-20	v11272	October 6, 2014	See this.			No	Yes (K)	Available	October 6, 2014
9.1.0-20J	v14336(JPN-region title)	October 10, 2014	Japan-only, see this.	No		No	No	Available	October 10, 2014
9.2.0-20		October 29, 2014	See this.	No		No	Yes (U/E)	Available	October 29, 2014
9.3.0-21		December 8, 2014	See this.	Yes		Yes	No	Available	December 8, 2014
9.4.0-21		December 11, 2014	See this.	No		No	No	Available	December 11, 2014
9.5.0-22		February 2, 2015	See this.	Yes			Yes (J/U/E)	Available	February 2, 2015
9.5.0-23		March 2, 2015	See this.	No	Yes		As above	Available	March 2, 2015
9.6.0-24		March 23, 2015	See this.	See here.			Yes (J/U/E)	Available	March 23, 2015
9.7.0-25		April 20, 2015	See this.	Probably none?		No	Yes (J/U/E)	Available	April 20, 2015
9.8.0-25		June 1, 2015	See this.	No	No	No	Yes (J/U/E)	Available	June 1, 2015
9.9.0-26		July 13, 2015	See this.				Yes (J/U/E/K)	Available	July 13, 2015
10.0.0-27		September 8, 2015	See this.	Yes	No	No	No	Available	September 8, 2015
10.1.0-27		September 14, 2015	See this.	No	No	No	Yes (J/U/E/K)	Available	September 14, 2015
10.2.0-28		October 19, 2015	See this.				Yes (J/U/E)	Available	October 19, 2015
10.3.0-28		November 9, 2015	See this.				Yes (J/U/E)	Available	November 9, 2015
10.4.0-29		January 18, 2016	See this.	Yes	Launching old Ironfall was blocked.	Yes	No	Available	January 18, 2016
10.5.0-30		January 25, 2016	See this.				Yes (J/U/E)	Available	January 25, 2016
10.6.0-31		February 22, 2016	See this.	Yes	Yes	Yes	Yes (J/U)	Available	February 22, 2016
10.7.0-32		March 14, 2016	See this.	No	Yes	Yes	Yes (J/U/E)	Available	March 14, 2016
11.0.0-33		May 9, 2016	See this.	Yes	No	Yes	Yes (J/U/E)	Available	May 9, 2016
11.1.0-34		September 13, 2016	See this.				Yes (J/U/E)	Available	September 13, 2016
11.2.0-35		October 24, 2016	See this.				No	Available	October 24, 2016
11.3.0-36		February 6, 2017	See this.	Yes	Yes	Yes	No	Available	February 6, 2017
11.4.0-37		April 10, 2017	See this.	Yes	Yes	Yes	No	Available	April 10, 2017
11.5.0-38		July 10, 2017	See this.				No	Available	July 10, 2017
11.6.0-39		September 18, 2017	See this.				No	Available	September 18, 2017
11.7.0-40		June 18, 2018	See this.				No	Available	June 18, 2018
11.8.0-41		July 30, 2018	See this.				No	Available	July 30, 2018
11.9.0-42		December 3, 2018	See this.				No	Available	December 3, 2018
11.10.0-43		May 27, 2019	See this.				No	Available	May 27, 2019
11.11.0-43E		August 26, 2019	See this.				No	Available	August 26, 2019
11.12.0-44		November 4, 2019	See this.				No	Available	November 4, 2019
11.13.0-45		December 2, 2019	See this.				No	Available	December 2, 2019
11.14.0-46		November 17, 2020	See this.				No	Available	November 17, 2020
11.15.0-47		July 27, 2021	See this.				No	Available	July 27, 2021
11.16.0-48		August 30, 2022	See this.				No	Available	August 30, 2022
11.16.0-49		September 13, 2022	See this.				No	Available	September 13, 2022
11.17.0-50		May 23, 2023	See this.				No	Available	May 23, 2023

"System/Userland security flaws fixed*": This includes known flaws, and any fixed flaws discovered via code bin-diff.

"System/Userland security flaws fixed*" and "3DS-mode homebrew affected" only apply to the changes done with that specific system-update("affected" does not include hax codebases breaking *just* due to updated codebins).

Auto-Boot Function

When the Home Menu is initially loaded by NS, it checks the gamecard ExeFS:/icon for the auto-boot flag. If the auto-boot flag is set, it will load the application on the cartridge and the home menu will not remain running in the background, or at least not in an operational state. Using software cues to return to the home menu, or sleep menu while in this state, causes a shutdown.

Notable features of demo titles:

• Auto-boot demos generally disable the functionality of the home button.
• The New Super Mario Bros 2 demo, retained the functionality of the home button, and had an timer which triggered the demo to quit after a period of inactivity.

Auto-boot cartridges, can bypass some of the functions of the Home Menu. Auto Booted software:

• Doesn't show usage history in the Activity Log
• Bypasses Parental controls
• Bypasses Forced Game Card Updates
• Bypasses Initial 3DS Setup
• The console does not have a friends list presence.
• Is still subject to region lock(see below).

Region lock is still active, so the home menu will refuse to launch demos with incorrect region lock will not load, displaying "An Error has Occurred". However, game card update partition checks are not done, which allows launching demos that have region free encoding, but have an alternate(or even invalid) region update partition.

The following auto-boot paths can be used by Home Menu, checked in the same order listed below(the above gamecard auto-boot is checked before this):

Key-combo / requirements for this path	Description
R, L, and X	This launches System Settings for touchscreen calibration.
R, L, and Y	This launches System Settings for circlepad calibration.

The following is only checked when the low u16 from config block 0x00110000 is value zero(normally this is non-zero). Thus, the below is only handled when a system setup is required.

Key-combo / requirements for this path	Description
R, X, Y, A, and B, a 3DS gamecard must be inserted as well.	This launches the gamecard application. Note that pressing the HOME button in the gamecard application launched this way will only result in the system shutting down.
This is used when the above path isn't used.	This launches System Settings for the system setup.

Region Lockout

One of the Home Menu's functions, is to regulate region lockout. The region lockout data for any given title is held in the ICN data. There are 6 regions of which have their own region lockout, Japan, USA, Europe(including Nintendo Australia), China, Taiwan and Korea. There is also a value which makes a title exempt from region lockout, and consequently accessible from any region of 3DS.

The region-field stored in the ICN-data is only checked when Home Menu itself launches a title, not when other titles use NS to have Home Menu launch titles. This isn't actually useful for gamecard region-free however, due to the gamecard system-updates, see below.

Also note that while some gamecard games are mostly region-free(main CXI is identical for all regions of the gamecard), those gamecards can't actually be launched with all 3DS regions due to the gamecard system-update, see below. Note that the main CXI being identical for all regions of a gamecard also means the savedata keyY is identical for all regions of that gamecard too(except for old system-version <v2.2 games, in some cases, due to different cardIDs).

Effects of Region Lockout

Every 3DS title regardless of location (NAND/SD Card/Game Card) is subject to region lockout scrutiny by the Home Menu. And the home menu treats 'out-of-region' titles by simply refusing to show them on the home menu. No messages are shown on the home menu to notify the user, the title is simply ignored. However out-of-region SD Card titles, will appear and quickly disappear, while all the SD Titles are being processed. In cases where access to the home menu GUI is not needed to launch the title (like in the case of kiosk demos), the home menu states an error has occurred, and launching of the title is stopped.

Game Card Updates

Either intentionally a region lock mechanism or not, the function which checks the game card update partition returns an error when it is detected the update is for a region other than the 3DS's region (Most likely triggered by the absence of the correct CVer title). And errors returned from checking the update partition, will result in the home menu displaying "This Game Card cannnot be used", when the user attempts to launch the title.

Home-menu SpotPass usage

Home-menu originally used two domains with HTTPS for SpotPass. SpotPass stores this content in Home-menu's NAND shared extdata.

• The system notifications are downloaded from: https://a248.e.akamai.net/f/248/103046/10m/npdl.c.app.nintendowifi.net/p01/nsa/<regionID>/<filename>/<langcode>/<filename> Where langcode is the two-character language codes from config, and regionID is from the below table. <filename> is bashoX/sysmsgX where X is 0-3.
• https://pls.c.shop.nintendowifi.net/pl/upload This URL is used for uploading data from the home menu NAND shared extdata, it's unknown what this is used for. This data is uploaded every 24 hours.
• https://npul.c.app.nintendowifi.net/p01/recv/<regionID>/<filename> This is used for uploading unknown data from extdata. <filename> can be one of the following:
  • "phu"
  • "tiu" The POST data contains a list of BOSS taskIDs etc. This seems to be only for Nintendo titles?(system+eShop apps)
  • "splu"
  • "sendmgn" For this it appears SpotPass does a HTTP POST with data originally from Launcher.dat?

Region	ID
JPN	gWr4JXxb2mKTG3lq
NA	uuI82221UKkqmtbp
EUR / Others	UrXSeurnxhPrq7AS

The SpotPass content payload for notifications begin with a header, followed by an icon and the UTF-16 text, and various metadata.

VersionList

During startup, Home Menu loads "/versionList.dat" from NAND extdata 0xf000000e. This is downloaded via SpotPass, the file-data downloaded via HTTPS here is raw (no SpotPass container):

• Retail: [1]
• Dev-unit: [2] The titles listed in this are not available on the normal CDN.

This is a list of title-updates available on the eShop, for regular app titles and update-titles. This is what Home Menu checks to determine whether the currently selected application needs to be updated or not. When an Internet connection is not available or wifi is disabled, Home Menu will skip VersionList handling/messages when you launch applications.

File structure:

Offset	Size	Description
0x0	0x10	The first u32 is normally 0x1, the rest is normally all-zero.
0x10	<Filesize-0x10>	Title entries, 0x10-bytes each.

Title entry structure:

Offset	Size	Description
0x0	0x8	u64 TitleID
0x8	0x4	u32 titleversion
0xC	0x4	Unknown u32, usually zero?

BOSS usage notes

Home Menu uses 4 hard-coded NsDataIds: 0x1, 0x2, 0x3, and 0x4, under a loop in the same function for writing to "bashotorya.dat".

Automatic System Update Download

See Automatic System Update Download.

Home Menu Error Messages

Dialog Text	Description
"An error has occured. Please save your data ... then restart the system"	This dialog is displayed when a system applet(including Home Menu) crashes/terminates. This dialog is also displayed for system errors as well.

Home Menu Themes

See here.

As of 11.0.0-33 Home Menu themes are only supported with USA, EUR, and JPN. CHN Home Menu was last updated with v7.0, and TWN doesn't even have a Home Menu settings menu(just the old screen brightness config menu + an amiibo Settings icon on the right side of the browser icon).

KOR Home Menu doesn't have the theme-settings menu button. While this does have the theme handling code, it isn't actually usable since extdataID 0x0 is used for theme-extdata for non-<JPN/USA/EUR> regions(which is invalid).

Home Menu NAND savedata

Launcher.dat

Offset	Size	Description
0x0	0x1	Launcher.dat format version.
0x1	0x1	Padding?
0x2	0x2	u16, cart launcher position on the home menu
0x4	0x4	Unknown, normally 0x0.
0x8	0xB40	360 u64s, list of NAND titleIDs. For an unused entry, the u64 value is ~0(in that case, the corresponding entries at 0xD9A/0x106A for this titleID are not used either). This is used for the icons displayed on the main Home Menu screen.
0xB51	0x1	u8, numbers of rows on the home menu, minus 1 (range 0..5) (with the enlarge/reduce option)
0xB5C	0x2	u16, position of the cursor on the home menu
0xB5E	0x2	u16, horizontal scrolling level (divided by the number of rows to get the actual number of columns hidden) on the home menu
0xD80	0x2 or 0x4	u16 or u32, number the next created folder will have (starts at 1)
0xD9A	0x2D0	Array of 360 s16 fields, each one corresponds to the titleIDs at the array located at offset 0x8. This is used for icon position, 0x0 for the very first icon, 0x1 for the next one and so on. This is completely linear, no X/Y coordinates. Implemented with the format-version for 4.0.0-X.
0x106A	0x168	Array of 360 s8 fields, each one corresponds to the titleIDs at the array located at offset 0x8. This is used for icon position. When an s8 here is -1(which is the normal value), the icon is located with the first chunk of icons(outbuf+0), otherwise the base address is outbuf+0xB40+<s8val*0x1E0>(which is equivalent to 60 icons * s8val). Implemented with the format-version for 4.0.0-X. Corresponds to the id of the folder the icon is in, range -1..59, with -1 meaning not in a folder
0x11DC	0x78	Array of 60 s16 fields, corresponding to folders position (with -1 meaning the folder is deleted/not yet created)
0x1434	0x3C	Array of 60 u8 fields, the number of rows in each corresponding folder (defaults to 2)
0x1470	0x78	Array of 60 u16 fields, the position of the cursor in each corresponding folder (defaults to 0)
0x14E8	0x78	Array of 60 u16 fields, the horizontal scroll level in each corresponding folder (divided by the number of rows to get the actual number of columns hidden) (defaults to 0)
0x1560	0x7F8	Array of 60 utf-16 strings of length 0x22 (in bytes, so only 0x11 utf-16 characters) (not NULL-terminated), the name of each corresponding folder
0x1D58	0xF0	Array of 60 u32, the number of each corresponding folder

SD ExtData

The SD ExtData File System for Home Menu introduced with 2.0.0-X is as follows:

root
├── icon
├── boss
└── user
    ├── SaveData.dat
    ├── Cache.dat
    └── CacheD.dat

File	Details	Size	FW Introduced	Plaintext
icon	Stubbed. Always image 00000002.	0x4 Bytes	n/a
SaveData.dat	Always image 00000003.	0x2cb0 Bytes (0x2da0 starting with 4.0.0-7)	2.0.0-2	Download
Cache.dat	Indexes and records details for the cached icon data. Always image 00000004.	0x1688 Bytes	2.0.0-2	Download
CacheD.dat	Cached icon data for Home Menu. Always image 00000005.	0x4cfe00 Bytes	2.0.0-2	Download

Cache.dat & CacheD.dat

These two files work in tandem to allow the home menu to cache icon data for applications which are presented on the Home Menu. The size of both files suggests a maximum cache size of 360 icons. Cache.dat stores details about the cache icon data, and CacheD.dat stores the icon data. The icon cache stores icon data for *all* applications shown on the Home Menu, this includes DSi NAND Titles, and DS(i) cartridges. The format of cached DS(i) icon data is not understood, but they are the same size as 3DS icon data (0x36c0).

In Cache.dat the first 8 bytes are a header where the first byte is the format-version, then follows each icon slots's entry in the format:

OFFSET	SIZE	DESCRIPTION
0x0	8	Title ID in Little Endian
0x8	4	Unknown
0xc	4	Unknown

All unused entries have the Title IDs filled with "0xff".

In CacheD.dat, the icon data is concatenated together, with the first icon at offset 0x0.

SaveData.dat

Offset	Size	Description
0x0	0x1	SaveData.dat format version.
0x8	0xB40	360 u64s, list of titleIDs(used with icons). Equivalent to the same array in Launcher.dat, but for SD titles.
0xB48	0x168	s8 bool array with 360 entries. Some SD-only icon array. Probably an array for each icon present status? Each entry is only known to be set to 0x00 or 0x01, with the former being the default.
0xCB0	0x2D0	s16 array with 360 entries, used with icons. Equivalent to the same array in Launcher.dat. Implemented with format-version 2.
0xF80	0x168	s8 array with 360 entries, used with icons. Equivalent to the same array in Launcher.dat. Implemented with format-version 2.
0x13b8	0x8	Theme entry structure for the regular theme.
0x13c0	0x8*10(0x50)	Array of theme entry structures for theme shuffling.
0x141b	0x1	0 = one regular theme, 1 = multiple themes for theme shuffle.

The icon arrays above are handled exactly the same way as Launcher.dat.

When the theme cache is enabled via the above fields, Home Menu loads the cache at startup(if the used theme structure is valid).

Theme entry structure:

Offset	Size	Description
0x0	0x4	Theme index: for DLC this is the content-index, for built-in themes this is an index for an array selecting the built-in theme.
0x4	0x1	Normally zero. This is the low 8-bits in the DLC titleID that this theme was originally loaded from.
0x5	0x1	Theme type, the valid range is 0..5. 0 = none, 1 = built-in theme from Home Menu RomFS, 2 = theme data loaded from SD cache / content archive. 3 = ?, 4 = ?, 5 = ?
0x6	0x1	Normally zero?
0x7	0x1	Normally zero?

When the theme-type is value1 the themeindex must be <9. When the theme-type is value2 the themeindex has to be non-zero, and the u8 at offset 0x4 must not be >=10.

The theme-loader code (besides the AM <is-current-themeindex-DLC-installed> code) handles all theme-types >=2 the same way. However, it seems all DLC AM code involving checking the currently-used theme DLC only gets executed when the theme-type is value2. The code in the theme-loader for that also checks that a certain Home Menu state flag is non-zero, before running the AM DLC code(it's unknown where this flag value comes from).

SaveData.dat format versions

Version value	Filesize	Implemented with Home Menu system-version
0	0x2CB0	2.0.0-X
2	0x2DA0	4.0.0-X
3	0x2DA0	9.0.0-X
4 (Latest version as of v10.6-v11.0 Home Menu)	0x2DA0	9.3.0-X

The Home Menu code for writing the updated SaveData.dat to FS is broken when the filesize is smaller than expected due to being from an older format-version originally. When writing to the file, Home Menu checks the filesize then attempts to use FSFile:SetSize on mismatch, but FSFile:SetSize can't be used with extdata(error from FSFile:SetSize appears to be ignored). When writing to SaveData.dat the write-size is the one for the current format-version, but since extdata files are fixed-size this will only result in the first {original filesize} bytes being written(result-code = 0xE0E046C1).

Basically, unless the extdata is deleted from the SD card FS manually, the SaveData.dat filesize will never be successfully updated from an old filesize to the current-format filesize by Home Menu.

Home Menu Theme SD ExtData

The filesystem for this extdata is as follows:

root
├── icon
├── boss
└── user
    ├── ThemeManage.bin
    ├── BodyCache.bin
    ├── BgmCache.bin
    └── nsalist

File	Details	Size	Extdata image ID	FW Introduced	Plaintext
ThemeManage.bin	Theme management info. The filesize must match 0x800, otherwise the Home Menu code returns an error.	0x800	00000003	9.0.0-20
BodyCache.bin	Contains cached data from the last loaded theme RomFS body_LZ.bin file. The filesize must match 0x150000, otherwise the Home Menu code returns an error.	0x150000	00000004	9.0.0-20
BgmCache.bin	Contains cached data from the last loaded theme RomFS bgm.bcstm file. The filesize must match 0x337000, otherwise the Home Menu code returns an error.	0x337000	00000005	9.0.0-20
nsalist	Contains the list of DLC themes(IDs+prices), downloaded via SpotPass.		00000007	9.0.0-20

BodyCache.bin and BgmCache.bin contain cached theme data for the currently used DLC theme. ThemeManage.bin is loaded by Home Menu during startup. The cached theme data is loaded at startup when a DLC theme is selected. This also contains theme-shop SpotPass data.

BodyCache.bin and BgmCache.bin are all-zero when no theme is selected.

Starting with 9.3.0-X Home Menu can use more files in this extdata, for theme shuffling. "theme:/ThemeManage.bin" "theme:/BgmCache_%02d.bin" "theme:/BodyCache_rd.bin"

ThemeManage.bin

Offset	Size	Description
0x0	0x4	Unknown, normally value 0x1?
0x4	0x4	Unknown, normally zero?
0x8	0x4	Actual size of the cached body_LZ.bin data.
0xC	0x4	Actual size of the cached bgm.bcstm data.
0x10	0x4	Unknown
0x14	0x4	Unknown
0x18	0x4	When a DLC theme is selected, this is the content-index of the DLC theme.
0x1C	0x4	Unknown, usually value 0x200 when the data in theme-cache is actually used?

The total filesize is 0x800-bytes, normally the data starting at offset 0x1C is all-zero.

When no theme is actually used, the only non-zero fields are the following: the u32 stored at offset 0x0 in ThemeManage.bin is value 0x1, with offset 0x10 u32 set to value 0x1.

Home Menu badge SD ExtData

The filesystem for this extdata(when it actually exists) is as follows:

root
├── icon
├── boss
└── user
    ├── BadgeData.dat
    └── BadgeMngFile.dat

File	Details	Size	Extdata image ID	FW Introduced
BadgeData.dat	See below.	0xF4DF80		9.0.0-20
BadgeMngFile.dat	See below.	0xD4A8		9.0.0-20

BadgeData.dat

Offset	Size	Description
0x0	100 * 16 * 0x8A	UTF-16 Badge Set Titles (16 per set for different languages)
0x35E80	1000 * 16 * 0x8A	UTF-16 Badge Titles (16 per set for different languages)
0x250F80	100 * 0x2000	Tiled RGB565 64x64 Badge Set Icons
0x318F80	1000 * 0x2800	Tiled RGB565 64x64 + Tiled A4 64x64 Badge Icons
0xCDCF80	1000 * 0xA00	Tiled RGB565 32x32 + Tiled A4 32x32 Badge Icons

BadgeMngFile.dat

Offset	Size	Description
0x0	0x4	u32, Must Be Zero
0x4	0x4	u32, Number of Badge Sets
0x8	0x4	u32, Number of Unique Badges
0xC	0x4	u32, Number of Placed Badges
0x10	0x4	u32, Selected Badge Set in Home Menu (0xFFFFFFFF = All Badges)
0x14	0x4	u32, Selected Badge Column in All Badges
0x18	0x4	u32, Number of Total Badges
0x1C	0x4	u32, Nintendo Network ID Number
0x20	0x338	Unknown (always zeros? unused?)
0x358	0x80	Used Badge Slots (each bit = 1 slot)
0x3D8	0x10	Used Badge Set Slots (each bit = 1 slot)
0x3E8	1000 * 0x28	BadgeInfo Entries
0xA028	100 * 0x30	BadgeSetInfo Entries
0xB2E8	360 * 0x18	BadgeLayoutSlot Entries

BadgeIdentifier

Offset	Size	Description
0x0	0x4	u32, Unknown
0x4	0x4	u32, Badge ID
0x8	0x4	u32, Badge Set ID
0xC	0x2	u16, Badge Index
0xE	0x2	u16, Badge Sub ID (used for multi-part badges) Value Meaning 0x0 Badge is a standalone badge 0x0100 Badge is the left piece of a horizontal 2x1 badge 0x0101 Badge is the right piece of a horizontal 2x1 badge 0x1000 Badge is the top piece of a vertical 1x2 badge 0x1010 Badge is the bottom piece of a vertical 1x2 badge 0x1100 Badge is the top left piece of a 2x2 badge 0x1101 Badge is the top right piece of a 2x2 badge 0x1110 Badge is the bottom left piece of a 2x2 badge 0x1111 Badge is the bottom right piece of a 2x2 badge

BadgeSetIdentifier

Offset	Size	Description
0x0	0x4	u32, Unknown (Usually 0xFFFFFFFF)
0x4	0x4	u32, Unknown (Usually 0xFFFFFFFF)
0x8	0x4	u32, Unknown (Usually 0x0)
0xC	0x4	u32, Unknown (Usually 0x2710)
0x10	0x4	u32, Badge Set ID
0x14	0x4	u32, Badge Set Index

BadgeInfo

Offset	Size	Description
0x0	0x10	BadgeIdentifier
0x10	0x2	u16, Number Placed
0x12	0x2	u16, Quantity
0x14	0x4	u32, Unknown (packed data?)
0x18	0x10	u64[2], Shortcut Title ID (twice, once per u64)

BadgeSetInfo

Offset	Size	Description
0x0	0x18	BadgeSetIdentifier
0x18	0x4	u32, Unknown (usually 0xFFFFFFFF)
0x1C	0x4	u32, Number of Unique Badges
0x20	0x4	u32, Number of Total Badges
0x24	0x4	u32, Start Badge Index
0x28	0x4	u32, Unknown (usually 0x0)
0x2C	0x4	u32, Unknown (usually 0x0)

BadgeLayoutSlot

Offset	Size	Description
0x0	0x10	BadgeIdentifier
0x10	0x4	u32, Position
0x14	0x4	u32, Folder (0xF0FF = Icon of a folder, 0xFFFFFFFF = No folder)

The file size must match 0xD4A8, otherwise the Home Menu code returns an error.

Home Menu theme layout SD ExtData

The filesystem for this extdata(when it actually exists) is as follows:

root
├── icon
├── boss
└── user
    └── MngFile.dat

File	Details	Size	Extdata image ID	FW Introduced	Plaintext
MngFile.dat	See below.	0x004D1280	00000003	9.6.0-24

MngFile.dat

Offset	Size	Description
0x0	0x4	u32, must be zero.
0x4	0xC	array of 8 u8, 0 if the corresponding layout slot is not set, 1 if it is
0xC	0x3000 * 8	Start of the layout entries.
0x1800C	0xC	Padding
0x18010	0x2DA0 * 8	Start of the SaveData.dat entries.
0x2ED10	0xD4A8 * 8	Start of the BadgeMngFile.dat entries.
0x99250	0x30	Padding
0x99280	256*3*8 * 400/8 * 8	Start of the top screen (400x240) screenshots, in BGR8 tiled format, rotated 90 degrees and with 8 rows per "chunk", and actually 256 pixels wide instead of 240, with the last 16 being all black
0x2F1280	256*3*8 * 320/8 * 8	Start of the bottom screen (320x240) screenshots, in BGR8 tiled format, rotated 90 degrees and with 8 rows per "chunk", and actually 256 pixels wide instead of 240, with the last 16 being all black

Layout entries structure:

Offset	Size	Description
0x0	0x2558	Exact copy of the entire Home Menu System_SaveData Launcher.dat, this is the actual layout data.
0x2558	0xAA8	Padding

The filesize must match 0x004D1280, otherwise the Home Menu code returns an error. The saved Home Menu layouts are stored here.

When saving a layout, the total layout field is increased, then a new layout entry is created with the contents of the current Home Menu System_SaveData(NAND savedata) Launcher.dat + a screenshot of the main Home Menu screen is written. When loading a layout, Launcher.dat in savedata is written with the current Launcher.dat data already stored in memory(unknown if any data gets changed for it here), then data from the layout entry is copied into the Home Menu System_SaveData Launcher.dat.

Home Menu *only* accesses this file with the Home Menu layout-settings menu / when entering that menu.

Home Menu Jump Parameters

Parameters can be provided to APT:JumpToHomeMenu to perform certain actions when jumping to the home menu.

Command Header

Offset	Size	Description
0x0	0x4	Magic Value "ASHP"
0x4	0x1	Command ID

If the command requires extra arguments, this header will be padded and the arguments will start at offset 0x8. Otherwise it is just 0x5 bytes large as presented here.

Command IDs

ID	Description	Extra Arguments
0x0	Does Nothing	None
0x1	Open Instruction Manual	None
0x2	Download Theme from Theme Shop	4-byte ID of the theme (total command size 0xC bytes). This is divided by 1000000 to determine the title ID variation, and the remainder corresponds to the theme's DLC content index. If the value is 0 the theme shop will not open correctly, and if the ID isn't valid the theme shop will just return to the home screen after initializing the DLC title.
0x3	Open Badge Picker	None

Home Menu startup

The following is what Home Menu does at startup(converted from cmd-logs), from 9.4.0-21, in the same order Home Menu does it.

Originally Home Menu mounted sdmc in main(), starting(?) with 6.0.0-11 Home Menu only has sdmc mounted while handling SD_Savedata_Backups.

Archive	Filename	Read size	Notes
			srv_init(), then srv_GetServiceHandle is used to initialize the service handles for the following services: ns:s, ptm:sysm, and cfg:s.
			CfgS:SecureInfoGetByte101 and CfgS:GetLocalFriendCodeSeed are used, the output data from these are not used. If either of these return an error, Home Menu uses ERR:Throw.
			Cfg:GetSystemModel is then used to initialize a Home Menu state field.
			Home Menu then loads the system language via CfgS:GetConfigInfoBlk2, and uses Cfg:SecureInfoGetRegion, to initialize Home Menu region/language state. Home Menu then uses Cfg:SecureInfoGetRegion again, then loads the CountryInfo via CfgS:GetConfigInfoBlk2.
			Home Menu initializes fs:USER here. Home Menu then mounts the Home Menu CXI RomFS. Then Home Menu uses FSUSER:GetPriority.
			Home Menu starts APT initialization / using APT service commands here. Eventually Home Menu then launches various system-modules.
			Here Home Menu attempts to open NAND shared-extdata 0xe0000000, which will normally fail since it doesn't exist.
			Here Home Menu uses AM command 0x00130040, with input u8 = value 0x0. Home Menu continues using APT commands after this.
			hid:SPVR service initialization is done here.
			PTMSYSM:GetShellStatus is used here.
			FSUSER:GetCardType is used here. AM commands are then used to get the inserted gamecard programID, when successful the gamecard ExeFS:/icon is then read to check the auto-boot flag(see the auto-boot section on this page). The system-setup-required flag is then read here if needed, as mentioned under the auto-boot section of this page.
			Home Menu then uses cfg commands to load system language, region, and CountryInfo.
Home Menu CXI RomFS	"/message/<Region>_<Language>/menu_msbt_LZ.bin"	Presumably loaded from the filesize.
Home Menu CXI RomFS	"/message/<Region>_<Language>/RI_mstl_LZ.bin"	Presumably loaded from the filesize.
Home Menu CXI RomFS	"/message_hud/<Region>_<Language>/hud_msbt_LZ.bin"	Presumably loaded from the filesize.
Home Menu CXI RomFS	"/message_hud/<Region>_<Language>/RI_mstl_LZ.bin"	Presumably loaded from the filesize.
			APT:GetSharedFont is used here.
Home Menu CXI RomFS	"/font/Hud_JP.bcfnt"
			Here Home Menu loads the cfg state for blkID 0x50005.
			Here Home Menu loads the GPU shaders from RomFS.
			Here Home Menu does DSP initialization then starts using DSP commands etc + loads sound data from RomFS.
			Here Home Menu does GSP initialization.
			APT:GetCaptureInfo is used here.
Home Menu CXI RomFS
			Here Home Menu uses PTMSYSM:GetShellStatus, PTMSYSM:GetSoftwareClosedFlag, and PTMSYSM:ClearSoftwareClosedFlag. Home Menu then uses PTMSYSM:GetShellStatus 3 times in a row. Starting from here, Home Menu uses PTMSYSM:GetShellStatus frequently(presumably from a separate thread).
			Home Menu opens the archive for the Home Menu System_SaveData here. Then Home Menu attempts to open "/Launcher.dat" for reading, when successful Home Menu just closes the file.
Home Menu System_SaveData	"/Launcher.dat"	0x2490	Prior to doing the read, Home Menu uses FSFile:GetSize.
System CFA, titleID for USA: 0004009B00013302	"/country.bin"
NS CFA	"/ctr_backup_black_list"		Home Menu first reads 0x10-bytes from offset 0x0, then after that it reads the rest of the file.
Home Menu CXI RomFS			Home Menu reads various RomFS files here.
			Home Menu launches the camera system-module here.
Home Menu CXI RomFS			Home Menu reads various RomFS files here.
NGWord bad word list CFA	"/version.dat"	0x4	Home Menu mounts the ngword archive here, then reads version.dat. Home Menu then loads the cfg data for blkID 0x000A0000.
			Home Menu launches various system-modules here(from a separate thread?).
			Home Menu opens the following NAND shared extdata archives here: 0xf0000001, 0xf0000002, 0xf0000009, 0xf000000b, 0xf000000c, 0xf000000d, and 0xf000000b again.
NAND extdata 0xf000000b	"/ubll.lst"	0x2ee0	Prior to doing the read, Home Menu uses FSFile:GetSize.
			Home Menu opens NAND shared extdata archive 0xf000000b again.
NAND extdata 0xf000000b	"/CFL_DB.dat"	0xe4c0	Home Menu only does one read with size 0xe4c0 for this, even though the value it loads from FSFile:GetSize is larger than that.
NAND extdata 0xf000000b	"/CFL_OldDB.dat"		Home Menu just closes this file immediately after opening it, when opening it was successful at least.
			Home Menu loads the cfg data for blkID 0x000C0000 here.
			Home Menu opens NAND shared extdata archive 0xf000000b again.
NAND extdata 0xf000000b	"/gamecoin.dat"	0x14	Home Menu first tries to use FS:CreateFile with this, which will fail when the file already exists. This file is then opened with openflags=RW. After reading this file, Home Menu then uses PTM:GetTotalStepCount, then uses FSFile:GetSize. Then the service handle for "ndm:u" is initialized with srv_GetServiceHandle(done from a separate thread perhaps?). Then Home Menu writes to the already opened gamecoin.dat file.
			FSUSER:CardSlotIsInserted and FSUSER:GetCardType is used here. AM commands are then used to get the inserted gamecard programID, when successful the gamecard ExeFS:/icon is then read.
			"boss:P" service handle initialization with srv_GetServiceHandle is done here. Then srv_Subscribe is used with various noticationIDs. Home Menu then uses FS:IsSdmcDetected and FS:IsSdmcWritable. Home Menu then loads the cfg data for blkID 0x000D0000. Home Menu uses boss:P command 0x4010082, then uses srv_GetServiceHandle for initializing service handles with the following services: "news:s" and "cecd:s".
			srv_GetServiceHandle is used to initialize the service handle for service "frd:a", then various service commands are used for that.
NAND extdata 0xf000000c			Home Menu first attempts to use FS:CreateFile with "/bashotorya.dat", which normally fails since that file already exists. Home Menu then repeats this with "/bashotorya2.dat".
			Here, Home Menu opens the following SD extdata archives: Home Menu badge SD extdata, Home Menu SD extdata, and the theme-cache SD extdata.
Home Menu SD extdata	"/SaveData.dat"	0x2da0	Prior to doing the read, Home Menu uses FSFile:GetSize.
Home Menu SD extdata	"/Cache.dat"	0x1688	Prior to doing the read, Home Menu uses FSFile:GetSize.
Home Menu SD extdata	"/CacheD.dat"	0x36c0	This is used to read the cached icon data for the currently inserted gamecard, if any. Prior to doing the read, Home Menu uses FSFile:GetSize. After opening the file and before FSFile:GetSize is used, Home Menu uses AM commands 0x10070102(for theme DLC) and 0x30084(gamecard "title-listing").
			Home Menu uses the following AM commands for theme DLC here: 0x10050084 and 0x10020104.
Home Menu Theme SD extdata	"/BodyCache.bin"	0x150000	Before opening the file, Home Menu firsts opens this archive under a new archive-handle again, then closes it. Prior to doing the read, Home Menu uses FSFile:GetSize.
Home Menu Theme SD extdata	"/ThemeManage.bin"	0x8	Prior to doing the read, Home Menu uses FSFile:GetSize(the result is filesize 0x800).
Home Menu Theme SD extdata	"/BgmCache.bin"		The data is read from here as needed. After opening the file, Home Menu uses FSFile:GetSize.
			boss:P commands 0x00040000 and 0x04040080 are used here. Home Menu opens NAND shared-extdata 0xf000000e, then closes it when the archive was opened successfully. Then Home Menu uses boss:P command 0x04500102 with the theme extdata, with string "thmtop".
			boss:P command 0x04040080 is used, with the input programID set to the gamecard one. Then boss:P commands 0x000E0000 and 0x00160082 are used.
			AM:GetTitleIDList is used with mediatype=SD and maxTIDs = 0x1c00.
			boss:P command 0x00160082 is used.
			PTM:GetStepHistory is used.
			srv_GetServiceHandle is used to initialize the service handle for "ac:u", then ACU:SetClientVersion is used. srv_Subscribe is used, then ACU command 0x002F0004 is used.
			AM:GetTitleIDList is used with mediatype=NAND and maxTIDs = 0x1c00.
NAND extdata 0xf000000b	"/gamecoin.dat"	0x14	Home Menu first tries to use FS:CreateFile with this, which will fail when the file already exists. This file is then opened with openflags=RW. After reading this file, Home Menu then uses PTM:GetTotalStepCount, then uses FSFile:GetSize. Then Home Menu writes to the already opened gamecoin.dat file. At the same time as doing the above, Home Menu also uses(probably from a different thread) AM:GetTitleIDList3 with mediatype=NAND and maxTIDs=0x2000. Then Home Menu uses AM:ListTitles with the NAND promotional-video titleID. Then Home Menu attempts to open the ExeFS:/icon in the NAND promotional-video title.
Home Menu System_SaveData	"/Launcher.dat"		Prior to doing the write, Home Menu uses FSFile:GetSize. Home Menu writes 0x2490-bytes to the file here. From a separate thread(?) at the same time, Home Menu also uses AM:ReloadDBS and AM command 0x00130040 with input=0x1.
			Home Menu loads the u8 value from cfg blkID 0x000E0000 here.
			AM:ReloadDBS, AM command 0x10070102(for theme DLC), AM command 0x00130040, and AM command 0x10050084(for theme DLC) are used here. At the same time(from a different thread?), the "act:u" service handle is initialized with srv_GetServiceHandle. Then ACTU commands 0x00010084 and 0x000600C2 are used.
			The "nim:u" service handle is initialized with srv_GetServiceHandle. Then NIMU commands 0x000F0042, 0x00170042, 0x00150000, and 0x00050000 are used.
			AM command 0x10020104(theme DLC) is used here. Then Home Menu CXI RomFS data is read.
			Home Menu CXI RomFS data is read. FS:GetSpecialContentIndex for the gamecard is used, then MICU initialization is done here(separate thread maybe?).
			ACU:GetWifiStatus is used, the NAND shared-extdata 0xf000000b archive is then opened here.
NAND extdata 0xf000000b	"/idb.dat"	0x2008	This first opens the file for writing, then uses FSFile:GetSize(output filesize is 0x6d4000). Then it writes to the file using size 0, then closes the file. Then PTM:GetStepHistory is used. Then Home Menu opens "/idbt.dat", then reads 0x2008-bytes.
			Home Menu starts using "news:s" commands here. While Home Menu is doing this, it also uses(from another thread?) APT:PrepareToStartNewestHomeMenu, NIMU:GetState, and NDMU:OverrideDefaultDaemons with input value 0xF. Later with that news-command code still running, Home Menu also uses the following commands: ACU:GetWifiStatus, NDMU:QueryExclusiveMode, and CECDS command 0x000E0000. Then cfg blkID 0x000D0000 is loaded.
NAND extdata 0xf000000b	"/idbt.dat"		Home Menu writes 0x2008-bytes to this file.
NAND extdata 0xf000000e	"/versionList.dat"	Loaded from the filesize.
			boss:P command 0x00200082 is used with string "mmVerDl".
			...
Home Menu System_SaveData	"/Launcher.dat"		When Home Menu is terminating(?), Home Menu writes 0x2490-bytes to the file here. After doing this, Home Menu opens, writes, and closes the file again.

Hardware reboot

During Home Menu start-up it uses APT:PrepareToStartNewestHomeMenu. If that doesn't return an error(normally NS returns 0xC8A0CFFC for that), Home Menu starts a hardware reboot with APT:StartNewestHomeMenu etc.

On retail this essentially means a hardware-reboot will automatically trigger if configmem SYSCOREVER doesn't match FIRM_SYSCOREVER, or when the current APPMEMTYPE doesn't match the default APPMEMTYPE for this Old3DS/New3ds model. The latter can happen with running New3DS NATIVE_FIRM with Old3DS system-titles, for example.

Returning to Home Menu from a crashed application

When returning to Home Menu from an application that didn't properly shutdown(like with an exception), PTM module writes data to the PTM system savedata. Then the system terminates Home Menu, and starts Home Menu again.

See Also

• http://www.nintendo.com/consumer/systems/3ds/en_na/menu_update.jsp
• http://www.nintendo.co.jp/netinfo/3ds/JPN/ja.html
• https://yls8.mtheall.com/ninupdates/reports.php