Config Savegame

This page describes the format of the Cfg NAND savegame. These blocks can be accessed with the Cfg service commands.

Structure of save-file “/config” #

Offset	Size	Description
0x0	0x2	Total entries
0x2	0x2	Data entries offset
0x4	0x4558	Block entries
0x455C		Data for the entries

The filesize for this /config file is 0x8000-bytes.

Configuration block entry #

Offset	Size	Description
0x0	0x4	BlkID
0x4	0x4	Offset to the data for this block when size is >4, otherwise this word is the data for this block
0x8	0x2	Size
0xA	0x2	Access Flags

Access Flags #

Bit Mask	Description
0x2	User Readable (cfg:u)
0x4	System Writable (cfg:s / cfg:i)
0x8	System Readable (cfg:s / cfg:i)

Config blocks will typically either use 0xC for system readable/writable or 0xE for all 3.

Configuration blocks #

BlkID	Size	Access Flags	Description
0x00000000	0x2	0xC	Config savegame version?
0x00010000	0x1	0xC	RTC compensation value
0x00020000	0x134	0xC	Codec
0x00030000	0x1	0xC	Leap Year Counter (read By PTM)
0x00030001	0x8	0xE	User time offset (read by CECD): displayed timestamp - rtc timestamp
0x00030002	0x8	0xC	Settings time offset: newly set timestamp - rtc timestamp
0x00040000	0x10	0xC	Touch calibration (read by HID)
0x00040001	0x1C	0xC	Analog Stick Calibration Param?(read by HID)
0x00040002	0x12	0xC	Gyroscope (read by HID)
0x00040003	0xC	0xC	Accelerometer (read by HID)
0x00040004	0x1C	0xC	CStick calibration data
0x00050000	0x2	0xC	Screen flicker
0x00050001	0x2	0xC	Backlight controls (u8 ABL_powersave_enable, u8 brightness_level) (read by GSP)
0x00050002	0x38	0xC	Backlight PWM (read by GSP)
0x00050003	0x20	0xC	Power saving mode (ABL) calibration (read by GSP)
0x00050004	0x20	0xC	Power saving mode (ABL) calibration (for legacy FIRM)
0x00050005	0x20	0xE	Stereo display settings (HWCAL block 0x470)
0x00050006	0x2	0xC	3D switching delay
0x00050007	0x4	0xC	?
0x00050008	0x10C	0xC	Power saving mode (ABL) extra config
0x00050009	0x8	0xC	new3DS only(?) backlight control (5th byte: auto-brightness enable)
0x00060000	0x96	0xC	??? (HWCAL block 0x500)
0x00070000	0x214	0xE	3D filters
0x00070001	0x1	0xE	Sound output mode (mono=0, stereo=1, surround=2)
0x00070002	0x8	0xE	Microphone echo cancellation params
0x00080000	0xC00	0xC	WiFi configuration slot 0
0x00080001	0xC00	0xC	WiFi configuration slot 1
0x00080002	0xC00	0xC	WiFi configuration slot 2
0x00090000	0x8	0xE	This contains a u64 ID, used by processes using NWMUDS:InitializeWithVersion. The first word is the same as LocalFriendCodeSeed, while the latter is a separate word.
0x00090001	0x8	0xE	Same content as 0x0009000? This console-unique u64 is used by GenHashConsoleUnique. It is generated by `((0x3FFFFFFFF) & LocalFriendCodeSeed)
0x00090002	0x4	0xE	The first two bytes are the same random16 used in 0x00090001. The second two bytes are zeros.
0x000A0000	0x1C	0xE	User Name
0x000A0001	0x2	0xE	Birthday (u8 month, u8 day)
0x000A0002	0x1	0xE	Language
0x000B0000	0x4	0xE	CountryInfo
0x000B0001	0x800	0xE	Country name in UTF-16, every 0x80-bytes is an entry for each language, in the order of the Language table below (not all entries are set)
0x000B0002	0x800	0xE	State name in UTF-16, every 0x80-bytes is an entry for each language
0x000B0003	0x4	0xE	Coordinates. A pair of s16 represents latitude and longitude, respectively. One need to multiply both value by 180/32768 to get coordinates in degrees
0x000C0000	0xC0	0xE	Parental Controls - Main data
0x000C0001	0x14	0xE	COPPACS restriction data
0x000C0002	0x200	0xE	Parental Controls - Registered e-Mail address and custom secret question
0x000D0000	0x4	0xE	u16 at offset 0x0: EULA Version which was agreed to. u16 @ 0x02: latest version
0x000E0000	0x1	0xE	? (related to SpotPass options in Internet Settings?)
0x000F0000	0x10	0xC	Debug configuration, read by NS on dev-units: on startup, NS does `svcKernelSetState(6, 1, (u64)debug_flags & 1); svcKernelSetState(6, 2, (u64)debug_flags & 2);` (see here) where `debug_flags` is the u32 located at offset 0xC in this struct. Then it compares the u32 from +8 in this config-block with the APPMEMTYPE. When those don’t match NS starts a FIRM-launch (with the same FIRM titleID as the currently running one) to boot into a FIRM with the APPMEMTYPE value from this config-block. The byte at offset 0x0 is related to the memtype as well.
0x000F0001	0x8	0xC	?
0x000F0003	0x1	0xC	Home Menu button disable
0x000F0004	0x4	0xC	The first u8 is the System-Model value, the last 3-bytes are unknown
0x000F0005	0x4	0xC	The first u8 indicates whether network updates are enabled (however, NIM only checks this flag with developer ENVINFO).
0x000F0006	0x28	0xC	In NIM, taken as a (hopefully null terminated) string used for the “X-Device-Token” http header field for NPNS url.
0x00100000	0x2	0xC	TWL EULA info ({bool agreed; u8 agreedVersion})
0x00100001	0x94	0xC	Stores Parental Restrictions PIN/Secret Answer and other info for TWL mode
0x00100002	0x1	0xC	TWL country code
0x00100003	0x10	0xC	TWL movable unique ID, used for DSiWare exports
0x00110000	0x4	0xC	The low u16 indicates whether the system setup is required, such as when the system is booted for the first time or after doing a System Format: 0 = setup required, non-zero = no setup required
0x00110001	0x8	0xC	TitleID of the menu to launch, used by NS on dev units (this block can be edited on dev units with Config)
0x00120000	0x8	0xC	Volume Slider Bounds (Read by HID and PTM)
0x00130000	0x4	0xE	If response is 0x100 then debug mode is enabled.
0x00150000	0x4	0xC	Clock Sequence (u16) used for generating UUIDs in ACT.
0x00150001	0x8	0xC	?
0x00150002	0x4	0xE	In NIM, taken as an u32, using the low u16, casted to a char, and turned lower case for the making of the url for NPNS.
0x00160000	0x4	0xE	Unknown, first byte is used by config service-cmd 0x00070040. (Unknown whether the last 3-bytes are used)
0x00170000	0x4	0xE	Miiverse (OLV) access key
0x00180000	0x4	0xC	QTM Infrared LED related, can be 0 or 1
0x00180001	0x18	0xC	QTM calibration data
0x00190000	0x1	0xC	Unknown. NFC-module checks for value1/non-value1.

The developer unit TID block only exists on developer units.

Stereo Display Settings #

All values are hard-coded in cfg module.

Offset	Size	Value	Description
0x0	4	62.0f	assumed pupillary distance in mm?
0x4	4	289.0f	assumed distance in mm between player’s eyes and upper screen?
0x8	4	76.80f	width in mm of (old) 3DS upper screen (doesn’t vary for different models?)
0xC	4	46.08f	height in mm of (old) 3DS upper screen (doesn’t vary for different models?)
0x10	4	10.0f
0x14	4	5.0f
0x18	4	55.58f
0x1C	4	21.57f

Languages #

ID	Description
0	JP
1	EN
2	FR
3	DE
4	IT
5	ES
6	ZH
7	KO
8	NL
9	PT
10	RU
11	TW

CountryInfo #

Byte	Description
0	?
1	?
2	State/Province code.
3	Country code, same as DSi/Wii country codes. Value 0xFF is invalid.

User Name Block 0x000A0000 #

Byte	Description
0x00-0x15	User name (UTF-16)
0x16-0x17	u16 NGWord flag to denote that the user name is inappropriate
0x18-0x1B	u32 NGWord version the username was last checked with. If this value is less than the u32 stored in the NGWord CFA “romfs:/version.dat”, the system then checks the username string with the bad-word list CFA again, then updates this field with the value from the CFA

While the user name is NULL-terminated, the terminator is not applied when the user name is 10 characters long, which leads to online access breaking (002-0109) and buffer overflows when the user name is retrieved, even in DS games.

WiFi Slot Structure #

Network structure #

This is used twice in the actual WiFi slot structure.

Offset	Size	Description
0x0	0x1	Whether the network was set or not?
0x1	0x1	Whether to use this network strucutre to connect?
0x2	0x1	Whether this structure is the first (0) or the second (1) in the larger WiFi slot structure?
0x3	0x1	Padding ?
0x4	0x20	SSID of the network, without a trailing nullbyte.
0x24	0x1	Length of the SSID.
0x25	0x1	AP crypto key type
0x26	0x2	Padding ?
0x28	0x40	Plaintext of the passphrase of the network, without a trailing nullbyte.
0x68	0x20	PBKDF2 of the passphrase and SSID ( 🔗 http://jorisvr.nl/wpapsk.html).

Actual structure #

Offset	Size	Description
0x0	0x2	?
0x2	0x2	🔗 CRC-16 checksum of the next 0x410 bytes.
0x4	0x88	First network structure. Only set if the network was set “normally”, or was the last to be set using WPS during the session.
0x8C	0x20	Padding.
0xAC	0x88	Second network structure. Only set if the network was set using WPS, otherwise 0-filled.
0x134	0x20C	Padding.
0x340	0x1	Whether to automatically get the IP address (use DHCP) or not, defaults to 1.
0x341	0x1	Whether to automatically get the DNS or not, defaults to 1.
0x342	0x2	Padding ?
0x344	0x4	IP address, to use if 0x340 is false.
0x348	0x4	IP address of the gateway, to use if 0x340 is false.
0x34C	0x4	Subnetwork mask, to use if 0x340 is false.
0x350	0x4	IP address of the primary DNS , to use if 0x341 is false.
0x354	0x4	IP address of the secondary DNS, to use if 0x341 is false.
0x358	0x4	Always 0x01050000 ? Only set if the network was the last to be set during the session.
0x35C	0x4	IP address to use. Only set if the network was the last to be set during the session.
0x360	0x6	MAC address of the AP. Only set if the network was the last to be set during the session.
0x366	0x1	Channel. Only set if the network was the last to be set during the session.
0x367	0x1	Padding ? Only set if the network was the last to be set during the session.
0x368	0x1	Whether to use a proxy or not, defaults to 0.
0x369	0x1	Whether to use a basic authentication for the proxy, defaults to 0.
0x36A	0x2	Port to use for the proxy, defaults to 1.
0x36C	0x30	URL/address of the proxy, including a trailing nullbyte.
0x39C	0x34	Padding.
0x3D0	0x20	Username to use for basic authentication, including a trailing nullbyte.
0x3F0	0x20	Password to use for basic authentication, including a trailing nullbyte.
0x410	0x2	Padding ?
0x412	0x2	MTU value, defaults to 1400 and ranges between 576 and 1500, inclusive.
0x414	0x7EC	Padding.

LCD display config #

There seems to be some sort of LCD display configuration stored in this cfg. When using the cfg-save from an Old3DS on a New3DS without formatting the cfg first, the bottom-screen display is somewhat off(which is fixed by formatting the cfg-save).

Parental Control Settings Block 0x00100001 #

Byte	Size in bytes	Description
0x0	0xD	Unknown.
0xD	0x4	PIN
0x11	0x40	Secret Answer (UTF-16)

Parental Control Settings Block 0x000C0000 #

Offset	Size	Description
0x00	0x04	Parental Control Restriction Bitmask
0x04	0x04	Unknown
0x08	0x01	Rating system used for configuration
0x09	0x01	Maximum allowed age (20 = No restriction)
0x0A	0x01	Secret Question Type (0-5: Pre-defined, 6: Custom)
0x0B	0x01	Unknown
0x0C	0x08	Parental Controls PIN code (with NULL-termination, although restricted to 4 digits)
0x14	0x44	Secret Answer (UTF-16)

Parental Control Restriction Bitmask #

Bit	Restriction name
0	Global Parental Controls Enable
1	Internet Browser
2	Display of 3D Images (disabled on 2DS)
3	Sharing Images/Audio/Video/Long Text Data
4	Online Interaction
5	StreetPass
6	Friend Registration
7	DS Download Play
8	Nintendo 3DS Shopping Services (eShop / EC Applet)
9	View Distributed Videos
10	Miiverse (View)
11	Miiverse (Post)
31	“Child Online Privacy Protection” (see CFG:IsCoppacsSupported)

Parental Control Settings Block 0x000C0002 #

Offset	Size	Description
0x0000	0x0001	Boolean, whether an e-Mail has been registered
0x0001	0x0101	Registered e-Mail address (Plaintext)
0x0102	0x0068	Custom Secret Question (UTF-16)