Config Savegame

This page describes the format of the Cfg NAND savegame. These blocks can be accessed with the Cfg service commands.

Structure of save-file "/config"

Offset	Size	Description
0x0	0x2	Total entries
0x2	0x2	Data entries offset
0x4	0x4558	Block entries
0x455C		Data for the entries

The filesize for this /config file is 0x8000-bytes.

Configuration block entry

Offset	Size	Description
0x0	0x4	BlkID
0x4	0x4	Offset to the data for this block when size is >4, otherwise this word is the data for this block
0x8	0x2	Size
0xA	0x2	Flags

Configuration blocks

BlkID	Size	Flags	Description
0x00000000	0x2	?	Config savegame version?
0x00030001	0x8	0xE	User time offset (read by CECD)
0x00040000	0x10	0x8	? (read by HID)
0x00040001	0x1C	0x8	? (read by HID)
0x00040002	0x12	0x8	? (read by HID)
0x00040003	0xC	0x8	? (read by HID)
0x00050001	0x2	0x8	? (read by GSP)
0x00050002	0x38	0x8	? (read by GSP)
0x00050003	0x20	0x8	? (read by GSP)
0x00050005	0x20	?	Stereo display settings
0x00050006	0x2	0x8	?
0x00070001	0x1	?	Sound output mode (mono/stereo/surround)?
0x00080000	0xC00	0x2?	WiFi configuration slot 0
0x00080001	0xC00	0x2?	WiFi configuration slot 1
0x00080002	0xC00	0x2?	WiFi configuration slot 2
0x00090000	0x8	0x2?	This contains a u64 ID, used by processes using NWMUDS:InitializeWithVersion. The first word is the same as LocalFriendCodeSeed, while the latter is a separate word.
0x00090001	0x8	0xE	This console-unique u64 used by GenHashConsoleUnique is generated with the LocalFriendCodeSeed and with random data
0x000A0000	0x1C	0xE	Username
0x000A0001	0x2	0xE	Birthday (u8 month, u8 day)
0x000A0002	0x1	0xA	Language
0x000B0000	0x4	0x8	CountryInfo
0x000B0001	0x800	0x2?	Country name in UTF-16, every 0x80-bytes is an entry for each language, in the order of the Language table below (not all entries are set)
0x000B0002	0x800	0x2?	State name in UTF-16, every 0x80-bytes is an entry for each language
0x000B0003	0x4	0xE	Pair of 16-bit values, meaning unknown but related to address (ZIP code?)
0x000C0000	0xC0	0x8	Restricted photo exchange data, and other info
0x000C0001	0x14	?	Same as above?
0x000D0000	0x4	0x2	u16 at offset 0x0: EULA Version which was agreed to.
0x000F0000	0x10	0x8?	Unknown, used by NS on dev-units for svcKernelSetState, where Type is 6. During NS startup on debug-units, NS compares the u32 from +8 in this config-block with the APPMEMTYPE. When those don't match NS starts a FIRM-launch (with the same FIRM titleID as the currently running one) to boot into a FIRM with the APPMEMTYPE value from this config-block
0x000F0004	0x4	0x8?	The first u8 is the System-Model value, the last 3-bytes are unknown
0x00110000	0x4	?	The low u16 indicates whether the system setup is required, such as when the system is booted for the first time or after doing a System Format: 0 = setup required, non-zero = no setup required
0x00110001	0x8	0xA?	TitleID of the menu to launch, used by NS on dev units (this block can be edited on dev units with Config)
0x00120000	0x8	0x8	? (read by HID)
0x00130000	0x4	?	If response is 0x100 then debug mode is enabled.
0x00160000	0x4	0x8?	Unknown, first byte is used by config service-cmd 0x00070040. (Unknown whether the last 3-bytes are used)
0x00190000	0x1	0x8?	Unknown. NFC-module checks for value1/non-value1.

The developer unit TID block only exists on developer units.

Stereo Display Settings

All values are hard-coded in cfg module.

Offset	Size	Value	Description
0x0	4	62.0f	assumed pupillary distance in mm?
0x4	4	289.0f	assumed distance in mm between player's eyes and upper screen?
0x8	4	76.80f	width in mm of (old) 3DS upper screen (doesn't vary for different models?)
0xC	4	46.08f	height in mm of (old) 3DS upper screen (doesn't vary for different models?)
0x10	4	10.0f
0x14	4	5.0f
0x18	4	55.58f
0x1C	4	21.57f

Languages

ID	Description
0	JP
1	EN
2	FR
3	DE
4	IT
5	ES
6	ZH
7	KO
8	NL
9	PT
10	RU
11	TW

CountryInfo

Byte	Description
0	?
1	?
2	?
3	Country code, same as DSi/Wii country codes. Value 0xFF is invalid.

0x000A0000 Block

Byte	Description
0x0-0x13	UTF-16 username, with no NULL-terminator.
0x14-17	Usually zero?
0x18-0x1B	u32 NGWord version the username was last checked with. If this value is less than the u32 stored in the NGWord CFA "romfs:/version.dat", the system then checks the username string with the bad-word list CFA again, then updates this field with the value from the CFA

LCD display config

There seems to be some sort of LCD display configuration stored in this cfg. When using the cfg-save from an Old3DS on a New3DS without formatting the cfg first, the bottom-screen display is somewhat off(which is fixed by formatting the cfg-save).