Config Savegame

From 3dbrew
Jump to: navigation, search

This page describes the format of the Cfg NAND savegame. These blocks can be accessed with the Cfg service commands.

Structure of save-file "/config"[edit]

Offset Size Description
0x0 0x2 Total entries
0x2 0x2 Data entries offset
0x4 0x4558 Block entries
0x455C Data for the entries

The filesize for this /config file is 0x8000-bytes.

Configuration block entry[edit]

Offset Size Description
0x0 0x4 BlkID
0x4 0x4 Offset to the data for this block when size is >4, otherwise this word is the data for this block
0x8 0x2 Size
0xA 0x2 Flags

Configuration blocks[edit]

BlkID Size Flags Description
0x00000000 0x2 0xC Config savegame version?
0x00010000 0x1 0xC  ?
0x00020000 0x134 0xC  ?
0x00030000 0x1 0xC  ?
0x00030001 0x8 0xE User time offset (read by CECD)
0x00030002 0x8 0xC  ?
0x00040000 0x10 0xC  ? (read by HID)
0x00040001 0x1C 0xC  ? (read by HID)
0x00040002 0x12 0xC  ? (read by HID)
0x00040003 0xC 0xC  ? (read by HID)
0x00040004 0x1C 0xC  ?
0x00050000 0x2 0xC  ?
0x00050001 0x2 0xC  ? (read by GSP)
0x00050002 0x38 0xC  ? (read by GSP)
0x00050003 0x20 0xC  ? (read by GSP)
0x00050004 0x20 0xC  ?
0x00050005 0x20 0xE Stereo display settings
0x00050006 0x2 0xC  ?
0x00050007 0x4 0xC  ?
0x00050008 0x10C 0xC  ?
0x00050009 0x8 0xC  ?
0x00060000 0x96 0xC  ?
0x00070000 0x214 0xE  ?
0x00070001 0x1 0xE Sound output mode (mono/stereo/surround)?
0x00070002 0x8 0xE  ?
0x00080000 0xC00 0xC WiFi configuration slot 0
0x00080001 0xC00 0xC WiFi configuration slot 1
0x00080002 0xC00 0xC WiFi configuration slot 2
0x00090000 0x8 0xE This contains a u64 ID, used by processes using NWMUDS:InitializeWithVersion. The first word is the same as LocalFriendCodeSeed, while the latter is a separate word.
0x00090001 0x8 0xE Same content as 0x0009000? This console-unique u64 used by GenHashConsoleUnique is generated with the LocalFriendCodeSeed and with random data
0x00090002 0x4 0xE  ?
0x000A0000 0x1C 0xE Username
0x000A0001 0x2 0xE Birthday (u8 month, u8 day)
0x000A0002 0x1 0xE Language
0x000B0000 0x4 0xE CountryInfo
0x000B0001 0x800 0xE Country name in UTF-16, every 0x80-bytes is an entry for each language, in the order of the Language table below (not all entries are set)
0x000B0002 0x800 0xE State name in UTF-16, every 0x80-bytes is an entry for each language
0x000B0003 0x4 0xE Pair of 16-bit values, meaning unknown but related to address (ZIP code?)
0x000C0000 0xC0 0xE Restricted photo exchange data, and other info (includes a mirror of Parental Restrictions PIN/Secret Answer)
0x000C0001 0x14 0xE Same as above?
0x000C0002 0x200 0xE  ? Contains the email address set during Parental Restriction setup.
0x000D0000 0x4 0xE u16 at offset 0x0: EULA Version which was agreed to.
0x000E0000 0x1 0xE  ?
0x000F0000 0x10 0xC Debug configuration, read by NS on dev-units: on startup, NS does svcKernelSetState(6, 1, (u64)debug_flags & 1);

svcKernelSetState(6, 2, (u64)debug_flags & 2); (see here) where debug_flags is the u32 located at offset 0xC in this struct. Then it compares the u32 from +8 in this config-block with the APPMEMTYPE. When those don't match NS starts a FIRM-launch (with the same FIRM titleID as the currently running one) to boot into a FIRM with the APPMEMTYPE value from this config-block. The byte at offset 0x0 is related to the memtype as well.

0x000F0001 0x8 0xC  ?
0x000F0003 0x1 0xC  ?
0x000F0004 0x4 0xC The first u8 is the System-Model value, the last 3-bytes are unknown
0x000F0005 0x4 0xC The first u8 indicates whether network updates are enabled (however, NIM only checks this flag with developer ENVINFO).
0x000F0006 0x28 0xC  ?
0x00100000 0x2 0xC  ?
0x00100001 0x94 0xC Stores Parental Restrictions PIN/Secret Answer and other info
0x00100002 0x1 0xC  ?
0x00100003 0x10 0xC  ?
0x00110000 0x4 0xC The low u16 indicates whether the system setup is required, such as when the system is booted for the first time or after doing a System Format: 0 = setup required, non-zero = no setup required
0x00110001 0x8 0xC TitleID of the menu to launch, used by NS on dev units (this block can be edited on dev units with Config)
0x00120000 0x8 0xC  ? (read by HID)
0x00130000 0x4 0xE If response is 0x100 then debug mode is enabled.
0x00150000 0x4 0xC  ?
0x00150001 0x8 0xC  ?
0x00150002 0x4 0xE  ?
0x00160000 0x4 0xE Unknown, first byte is used by config service-cmd 0x00070040. (Unknown whether the last 3-bytes are used)
0x00170000 0x4 0xE  ?
0x00180000 0x4 0xC  ?
0x00180001 0x18 0xC  ?
0x00190000 0x1 0xC Unknown. NFC-module checks for value1/non-value1.

The developer unit TID block only exists on developer units.

Stereo Display Settings[edit]

All values are hard-coded in cfg module.

Offset Size Value Description
0x0 4 62.0f assumed pupillary distance in mm?
0x4 4 289.0f assumed distance in mm between player's eyes and upper screen?
0x8 4 76.80f width in mm of (old) 3DS upper screen (doesn't vary for different models?)
0xC 4 46.08f height in mm of (old) 3DS upper screen (doesn't vary for different models?)
0x10 4 10.0f
0x14 4 5.0f
0x18 4 55.58f
0x1C 4 21.57f


ID Description
0 JP
1 EN
2 FR
3 DE
4 IT
5 ES
6 ZH
7 KO
8 NL
9 PT
10 RU
11 TW


Byte Description
0 ?
1 ?
2 ?
3 Country code, same as DSi/Wii country codes. Value 0xFF is invalid.

0x000A0000 Block[edit]

Byte Description
0x0-0x13 UTF-16 username, with no NULL-terminator.
0x14-17 Usually zero?
0x18-0x1B u32 NGWord version the username was last checked with. If this value is less than the u32 stored in the NGWord CFA "romfs:/version.dat", the system then checks the username string with the bad-word list CFA again, then updates this field with the value from the CFA

LCD display config[edit]

There seems to be some sort of LCD display configuration stored in this cfg. When using the cfg-save from an Old3DS on a New3DS without formatting the cfg first, the bottom-screen display is somewhat off(which is fixed by formatting the cfg-save).

Parental control Block 0x00100001[edit]

Byte Size in bytes Description
0x0 0xD Unknown.
0xD 0x4 PIN
0x11  ? Secret answer in UTF-16