/shared2/sys/SYSCONF

The SYSCONF contains many Wii system settings.

Its size is always 0x4000, and its values are always encoded in Big Endian. Size/Length indicators are usually "length minus one" (ie. a length of 0x06 means that 7 bytes of data follow.)

Conventions for adding or removing settings to the file are currently unknown, but shouldn't be too hard to determine--although that's not necessarily a useful function.

File structure

File offset	Size	Description
`0x0000`	4 bytes	Header magic (`SCv0`)
`0x0004`	2 bytes	Number of items in this file
`0x0006`	2 bytes each	Item offsets, one for every item ("Number of items" times)
varies	2 bytes	Offset past the end of the last valid entry, follows immediately after "Item offsets"
varies	varies	Items, each one at an offset specified by "Item offsets" Unused offsets are zeroed completely
`0x3FAE` ?	2 bytes each	Lookup table for specific item names, 39 entries long. When the value is non-zero, it contains the offset where the item offset is stored (name LUT → item offset → actual item)
`0x3FFC`	4 bytes	EOF magic (`SCed`)

Item structure

Offset	Size	Description
`0x00`	1 byte	Item header, consists of two components: Item type: 3 high-order bits indicate the item type Item name length: 5 low-order bits indicate the name of this items length (minus one)
`0x01`	varies	Item name, length specified by the item name length in the header.
varies	varies	Item data, length depends on the Item type.

Types

Name	Value	Size	Note
BIGARRAY	1	varies	2 bytes of length (minus one), followed by `$n` bytes of data
SMALLARRAY	2	varies	1 byte of length (minus one), followed by `$n` bytes of data
BYTE	3	1 byte
SHORT	4	2 bytes
LONG	5	4 bytes
LONGLONG	6	8 bytes
BOOL	7	1 byte	0 is `false`, anything else is `true` (most commonly 1)

Note that both BIGARRAY and SMALLARRAY store the length (minus one) in the beginning and their actual size must be calculated from there. The name "ARRAY" need not indicate the actual content type; most settings store an application defined structure in them.

Lookup table for settings

The end of the SYSCONF file acts as lookup table, supposedly to make finding settings easier/quicker. A lookup looks like this:

Seek 82 bytes (2 bytes per entry, 39 known entries at this point, plus 4 bytes for the SCed marker) backwards from the end of the file and read 78 bytes to obtain the lookup table.
Read the desired setting offset. In case this value is 0x0000, the System Menu falls back to searching for the entry (otherwise Dolphin generated SYSCONF files would not work).
When non-zero, it represents an offset in the Item offset list. Seek to the value read, and read another 2 bytes from there.
Seek to the location indicated by the previous read (which is inside the Item offset list, and exists regardless of whether the lookup table is correct) to find the actual setting.

New settings are added at the beginning, supposedly for backwards compatibility.

Settings marked with ? are guesses, since they were not seen in any of the SYSCONF files available while writing

File offset	Setting
`0x3FAE`	`IPL.APD`
`0x3FB0`	`MPLS.MOVIE`?
`0x3FB2`	`IPL.TID`
`0x3FB4`	`WWW.RST`
`0x3FB6`	`DVD.CNF`?
`0x3FB8`	`BT.BAR`
`0x3FBA`	`BT.MOT`
`0x3FBC`	`BT.SPKV`
`0x3FBE`	`BT.SENS`
`0x3FC0`	`BT.CDIF`
`0x3FC2`	`BT.DINF`
`0x3FC4`	`DEV.DSM`?
`0x3FC6`	`DEV.CTC`?
`0x3FC8`	`DEV.VIM`?
`0x3FCA`	`DEV.BTM`?
`0x3FCC`	`NET.WCFG`
`0x3FCE`	`NET.WCPC`
`0x3FD0`	`NET.PROF`?
`0x3FD2`	`NET.CTPC`
`0x3FD4`	`NET.CNF`?
`0x3FD6`	`IPL.UPT`
`0x3FD8`	`IPL.SND`
`0x3FDA`	`IPL.SADR`
`0x3FDC`	`IPL.SSV`
`0x3FDE`	`IPL.PGS`
`0x3FE0`	`IPL.PC`
`0x3FE2`	`IPL.NIK`
`0x3FE4`	`IPL.LNG`
`0x3FE6`	`IPL.INC`
`0x3FE8`	`IPL.IDL`
`0x3FEA`	`IPL.FRC`
`0x3FEC`	`IPL.EULA`
`0x3FEE`	`IPL.E60`
`0x3FF0`	`IPL.DH`
`0x3FF2`	`IPL.CD2`
`0x3FF4`	`IPL.CD`
`0x3FF6`	`IPL.ARN`?
`0x3FF8`	`IPL.AR`
`0x3FFA`	`IPL.CB`

Known settings

BT Settings

Name	Type	Size	Values	Description
BT.BAR	BYTE	1	0 = bottom, 1 = top	Sensor bar position
BT.CDIF	BIGARRAY	0x207	struct	List of something connected/paired (?) to the system
BT.DINF	BIGARRAY	0x463	struct	List of Wiimotes "synced" to the system
BT.MOT	BYTE	1	0 = off, 1 = on	Wiimote motor
BT.SENS	LONG	4	0-4?	Wiimote sensitivity setting
BT.SPKV	BYTE	1	varies	Wiimote speaker volume

IPL Settings

Name	Type	Size	Values	Description
IPL.APD	LONG	4	0, 60, 120, ..., 720	Auto power-down (minutes, 0=never). Only used on the vWii and PAL Wii mini.
IPL.AR	BYTE	1	0 = 4:3, 1 = 16:9	Aspect ratio setting
IPL.ARN	BYTE	1	0 = Off, 1 = On	"Auto Run mode".
IPL.CB	LONG	4	?	Counter Bias (difference between RTC and local time, in seconds)
IPL.CD	BOOL	1	bool	Config Done flag -- has initial setup been performed?
IPL.CD2	BOOL	1	bool	Config2 Done flag -- has network setup been performed?
IPL.DH	BYTE	1	signed byte	Display Offset (horizontal)
IPL.E60	BYTE	1	0 = 50Hz, 1 = 60Hz	Use EuRGB60/PAL60
IPL.EULA	BOOL	1	bool	EULA Done flag -- has EULA been acknowledged?
IPL.FRC	LONG	4	?	"Free Channel App Count": Number of free Channel slots on the system menu (max. 48 slots total)
IPL.INC	LONG	4	?	"Installed Channel App Count": Number of used Channel slots on the system menu (max. 48 slots total)
IPL.IDL	SMALLARRAY	0x03	struct	WiiConnect24 standby settings (Standby connection, Slot illumination)
IPL.LNG	BYTE	1	0,1	System Language, see conf.c for some values
IPL.NIK	SMALLARRAY	0x17	struct	Console Nickname
IPL.PC	SMALLARRAY	0x4B	struct	Parental Controls
IPL.PGS	BYTE	1	0 = off, 1 = on	Use Progressive Scan
IPL.SADR	BIGARRAY	0x100A	struct	"Simple Address"
IPL.SND	BYTE	1	0 = Mono, 1 = Stereo, 2 = Surround	Sound setting
IPL.SSV	BYTE	1	0 = off, 1 = on	Screen Saver/burn-in reduction
IPL.TID	LONGLONG	8	Title ID or 0	ID of the temporarily installed title for the SD channel feature. Set to 0 after erasing the title.
IPL.UPT	BYTE	1	0 = None, 1 = Disc, 2 = Net	Update Type

Misc Settings

Name	Type	Size	Values	Description
DEV.BTM	BYTE	1	0 = Production, 1 = Development	Bootmode (used for NDEV)
DEV.CTC	BYTE	1	0 = JPN, 1 = USA, 2 = EUR, 3 = AUS, 4 = BRA, 5 = TWN, 6 = KOR, 7 = HKG, 8 = ASI, 9 = LTN, 10 = SAF, 11 = CHN	Boot IRDC Code
DEV.DSM	BYTE	1	0 = Disabled, 1 = Enabled, 2 = Debug	Drive saving (used for NDEV)
DEV.VIM	BYTE	1	0 = NTSC, 1 = PAL	Boot IRDV Mode
DVD.CNF	BYTE	1	struct	DVD Config
MPLS.MOVIE	BYTE	1	0 = Not Watched, 1 = Watched	Wii Motion Plus Tutorial Movie
NET.CNF	?	?	?	Network Config?
NET.CTPC	LONG	4	bit 0x01 = Internet Channel bit 0x02 = Wii Message Board, bit 0x04 = Wii Points/purchases	Parental Control network content restrictions
NET.PROF	?	?	?	Network Config?
NET.WCFG	LONG	4	0 = off, 1 = on	WiiConnect24 Configuration flag
NET.WCPC	BOOL	1	always `FALSE`?	WiiConnect24 Parental control flags?
WWW.RST	BYTE	1	0 = no, 1 = yes	Restrict Internet Channel

Application-defined structures

Most SMALLARRAY and BIGARRAY values follow an application-defined structure to store data in a structured way. The type SMALLARRAY or BIGARRAY gives no indication of what kind of data is stored, only that it may not exceed 255 or 65535 bytes in size.

BT.CDIF

Offset	Type	Size	Value
`0x0000`	Word	`0x0002`	Array Size (minus 1); here: `0x0204` for 0x0205 bytes
`0x0002`	Byte	`0x0001`	Number of ? devices
`0x0003`	?	`0x0056`	Entry: `{u8 bdaddr[6]; char name[64]; u8 unk[16]}`
`0x0059`	until	`0x0207`	Repeats up to a total of 6 entries.

BT.DINF

Offset	Type	Size	Value
`0x0000`	Word	`0x0002`	Array Size (minus 1); here: `0x0460` for 0x0461 bytes
`0x0002`	Byte	`0x0001`	Number of registered Wiimotes
`0x0003`	MAC Address	`0x0006`	Bluetooth MAC Address of registered/known Wiimote No. 1
`0x0009`	ASCII String	`0x0040`	Zero-terminated Device Name of registered/known Wiimote No. 1
`0x0049`	until	`0x02BE`	Repeats up to a total of 10 entries.
`0x02BF`	MAC Address	`0x0006`	Bluetooth MAC Address of active Wiimote No. 1 (only set at runtime, when a Wiimote is actually connected)
`0x02C5`	ASCII String?	`0x0040`	Zero-terminated Device Name of active Wiimote No. 1? Usually empty, probably doesn't matter (but reuses the same struct as registered Wiimotes)
`0x0305`	until	`0x0463`	Repeats up to a total of 6 entries.

DVD.CNF

Offset	Type	Size	Value
`0x00`	Byte	`0x01`	Video mode
`0x01`	Byte	`0x01`	Parental Control Level
`0x02`	Short	`0x02`	Parental Control Country

IPL.IDL

Offset	Type	Size	Value
`0x00`	Byte	`0x01`	Array Size (minus 1); here: `0x01` for 0x02 bytes
`0x01`	Byte	`0x01`	Standby connection (0 = off, 1 = on)
`0x02`	Byte	`0x01`	Slot illumination (0 = off, 1 = dim, 2 = bright)

IPL.NIK

Offset	Type	Size	Value
`0x00`	Byte	`0x01`	Array Size (minus 1); here: `0x15` for 0x16 bytes
`0x01`	UTF16BE String	`0x14`	Console Nickname, max. 10 characters (padded with 0x00 at the end)
`0x15`	Word	`0x02`	Actual string length of the Console Nickname

IPL.PC

Offset	Type	Size	Value
`0x00`	Byte	`0x01`	Array Size (minus 1); here: `0x49` for 0x4A bytes
`0x01`	Byte	`0x01`	Are parental controls enabled? (0x00 = off, 0x80 = on)
`0x02`	Byte	`0x01`	Organization
`0x03`	Byte	`0x01`	Highest game rating allowed (value equals minimum age; 0x14 = 20 years/up = no restriction)
`0x04`	ASCII String	`0x04`	PIN, not delimited by a null-terminator, exactly 4 digits
`0x08`	Byte	`0x01`	Secret Question (in case you forget your PIN) Always 0x00 on Wii U
`0x09`	UTF16BE String	`0x40`	Answer, max. 32 characters (padded with 0x00 at the end) Always "Nintendo" on Wii U
`0x49`	Word	`0x02`	Actual string length of the Answer

Secret Questions

Questions differ by language. These are the English questions.

Question ID	Question
0	"What is your mother's maiden name?"
1	"What is your place of birth?"
2	"What is your favorite sports team?"
3	"What was your favorite birthday present?"
4	"What's your favorite movie?"
5	"If you could go anywhere, where would you go?"

IPL.SADR

Offset	Type	Size	Value
`0x0000`	Word	`0x0002`	Array Size (minus 1); here: `0x1007` for 0x1008 bytes
`0x0002`	Byte	`0x0001`	Country code
`0x0003`	Byte	`0x0001`	Region code
`0x0004`	Word	`0x0002`	City code (where relevant, e.g. News Channel, Forecast Channel)
`0x0006`	UTF16BE String	`0x0080`	Japanese country name
`0x0086`	until	`0x0805`	Repeats up to a total of 16 entries (Japanese, English, German, French, Spanish, Italian, Dutch, 9 undefined).
`0x0806`	UTF16BE String	`0x0080`	Japanese region name
`0x0886`	until	`0x1005`	Repeats up to a total of 16 entries (same order).
`0x1006`	Word	`0x0002`	Latitude (N+/S-, measured in increments of 45/8192 degree, allowing up to 180°, though latitude never exceeds 90°)
`0x1008`	Word	`0x0002`	Longitude (E+/W-, measured in increments of 45/8192 degree, allowing up to 180°)

NET.PROF

Offset	Type	Size	Value
`?`	Word	`0x0001`	Flags.
`?`	Byte[4]	`0x0004`	IP Address.
`?`	Byte[4]	`0x0004`	IP Netmask.
`?`	Byte[4]	`0x0004`	DNS 1.
`?`	Byte[4]	`0x0004`	DNS 2.
`?`	Char[256]	`0x0100`	Proxy Server Name.
`?`	Word	`0x0002`	Proxy Server Port.
`?`	Char[1024]	`0x0400`	Another server name?
`?`	BOOL	`0x0001`	Enabled?
`?`	BOOL	`0x0400`	?
`?`	BOOL	`0x0001`	?
`?`	Char[256]	`0x0100`	?
`?`	Char[128]	`0x0080`	PPPOE Service Name.
`?`	Char[256]	`0x0100`	PPPOE Service User Name.
`?`	Char[256]	`0x0100`	PPPOE Service Password

The data is then accessed based on the connection type.

Wired

Offset	Type	Size	Value
`0x0000`	Word	`0x0001`	Link Type.

Wireless

Offset	Type	Size	Value
`0x0000`	Word	`0x0002`	Rate Set.
`0x0002`	Byte	`0x0001`	Configuration Method.