All values in the file are big endian.
| File offset |
Size |
Description |
0x0000 |
0x04 |
Header magic (SCv0) |
0x0004 |
0x02 |
Number of entries in this file *) |
0x0006 |
0x02 each |
Entry offsets, one for every entry ("Number of entries" times) |
0x???? |
0x02 |
Offset past the end of the last valid entry, follows immediately after "Entry offsets" *) |
0x???? |
varies |
Entries, each one at an offset specified by "Entry offsets" |
0x3FB0? |
0x02 each |
Lookup table for specific entry tags, assumed to be 38 entries long (based on tags dumped from the system menu) |
0x3FFC |
0x04 |
EOF magic (SCed) |
*) It is possible that "Number of entries" is another "minus 1" case, and Entry type 0 is an end marker (removing the "Offset past the end of the last valid entry" member from this table, treating it like any other entry).
| Entry offset |
Size |
Description |
0x00 |
0x01 |
Entry descriptor, contains 2 parts encoded as bits: |
NNN????? |
3 bit |
Entry type |
???NNNNN |
5 bit |
Entry name length, minus 1 |
0x01 |
varies |
Entry name, "Entry name length" long |
0x?? |
varies |
Entry content, depends on "Entry type" |
| Entry type |
Size |
Description |
0 |
0x00? |
Unknown, not sure if this type exists. Might be a no-op, empty, unused or "end" entry |
1 |
varies |
BigArray, first word after Entry name is the total array length, minus 1 |
2 |
varies |
SmallArray, first byte after Entry name is the total array length, minus 1 |
3 |
0x01 |
Byte |
4 |
0x02 |
Short |
5 |
0x04 |
Long |
6 |
0x08 |
LongLong |
7 |
0x01 |
Bool |
Size is assumed to be 38 entries, with each entry specifying a particular Entry name.
Every entry contains the "Entry offset" offset where the given Entry name is found (or zero when no entry with that name exists):
- Check the LUT for the desired Entry name
- When non-zero, check at that offset to read the actual Entry offset
- Use the Entry offset to find the Entry
Names/Offsets are based on observations from real-world SYSCONF files.
| Entry offset |
Entry name |
0x3FB0 |
MPLS.MOVIE? |
0x3FB2 |
IPL.TID? |
0x3FB4 |
WWW.RST |
0x3FB6 |
DVD.CNF? |
0x3FB8 |
BT.BAR |
0x3FBA |
BT.MOT |
0x3FBC |
BT.SPKV |
0x3FBE |
BT.SENS |
0x3FC0 |
BT.CDIF |
0x3FC2 |
BT.DINF |
0x3FC4 |
DEV.DSM? |
0x3FC6 |
DEV.CTC? |
0x3FC8 |
DEV.VIM? |
0x3FCA |
DEV.BTM? |
0x3FCC |
NET.WCFG |
0x3FCE |
NET.WCPC? |
0x3FD0 |
NET.PROF? |
0x3FD2 |
NET.CTPC |
0x3FD4 |
NET.CNF? |
0x3FD6 |
IPL.UPT |
0x3FD8 |
IPL.SND? |
0x3FDA |
IPL.SADR |
0x3FDC |
IPL.SSV |
0x3FDE |
IPL.PGS |
0x3FE0 |
IPL.PC |
0x3FE2 |
IPL.NIK |
0x3FE4 |
IPL.LNG |
0x3FE6 |
IPL.INC |
0x3FE8 |
IPL.IDL |
0x3FEA |
IPL.FRC |
0x3FEC |
IPL.EULA |
0x3FEE |
IPL.E60 |
0x3FF0 |
IPL.DH |
0x3FF2 |
IPL.CD2 |
0x3FF4 |
IPL.CD |
0x3FF6 |
IPL.ARN? |
0x3FF8 |
IPL.AR |
0x3FFA |
IPL.CB |
Entries suffixed with ? are guesses based on names dumped from the system menu and might be incorrect.
The order of entries is the reverse of strings found in the system menu, which may indicate that this struct actually grows from the end of the file (which is a sensible choice, as names added over time would break backwards compatibility with older versions).
| Entry name |
Entry type |
Content |
BT.BAR |
Byte |
Sensor bar position (0 = bottom, 1 = top) |
BT.CDIF |
BigArray |
0x205 bytes: Unknown bluetooth setting |
BT.DINF |
BigArray |
List of known/synched/active Bluetooth devices (Wiimotes, Balance Board) |
BT.MOT |
Byte |
Wiimote motor state (0 = off, 1 = on) |
BT.SENS |
Long |
Wiimote sensitivity setting |
BT.SPKV |
Byte |
Wiimote speaker volume |
DEV.BTM |
Byte |
NDEV Boot mode (0 = Production, 1 = Development) |
DEV.CTC |
Byte |
Unknown NDEV setting |
DEV.DSM |
Byte |
NDEV Drive saving (0 = disabled, 1 = enabled, 2 = Debug) |
DEV.VIM |
Byte |
Unknown NDEV setting |
DVD.CNF |
Byte |
Unknown NDEV setting |
IPL.AR |
Byte |
Aspect Ratio setting (0 = 4:3, 1 = 16:9) |
IPL.ARN |
? |
Unknown system setting |
IPL.CB |
Long |
Counter bias (difference between RTC and local time, in seconds) |
IPL.CD |
Bool |
Config done flag (has initial setup been performed?) |
IPL.CD2 |
Bool |
Config2 done flag (has network setup been performed?) |
IPL.DH |
Byte |
Display offset (horizontal); signed number |
IPL.E60 |
Byte |
Use EuRGB60/PAL60 (0 = 50Hz, 1 = 60Hz) |
IPL.EULA |
Bool |
Eula done flag (has EULA been acknowledged?) |
IPL.FRC |
Long |
"Free Channel App Count": Number of free Channel slots on the system menu (max. 48 slots total) |
IPL.IDL |
SmallArray |
WiiConnect24 Standby settings |
IPL.INC |
Long |
"Installed Channel App Count": Number of used Channel slots on the system menu (max. 48 slots total) |
IPL.LNG |
Byte |
System language |
IPL.NIK |
SmallArray |
Console Nickname |
IPL.PC |
SmallArray |
Parental Controls |
IPL.PGS |
Byte |
Use Progressive Scan (0 = off, 1 = on) |
IPL.SADR |
BigArray |
0x1008 bytes: "Simple Address" Location info |
IPL.SND |
Byte |
Sound settings (0 = Mono, 1 = Stereo, 2 = Surround) |
IPL.SSV |
Byte |
Screen saver/Burn-in reduction (0 = off, 1 = on) |
IPL.TID |
? |
Unknown system setting |
IPL.UPT |
Byte |
Update Type (0 = disabled, 1 = enabled, 2 = ask the user?) |
MPLS.MOVIE |
Byte |
Wii Motion Plus tutorial movie has been watched (0 = watched, 1 = not watched?) |
NET.CNF |
? |
Unknown network setting |
NET.CTPC |
Long |
Parent Control network content restrictions (Bitmask; bit 0x01 = Internet Channel, bit 0x02 = Wii Message Board, bit 0x04 = Wii Points/purchases) |
NET.PROF |
? |
Unknown network setting |
NET.WCFG |
Long |
WiiConnect24 Configuration flags (0 = off, 1 = on) |
NET.WCPC |
Long |
WiiConnect24 Parental control flags? |
WWW.RST |
Byte |
Restrict Internet Channel (0 = no, 1 = yes) |
| Offset |
Type |
Size |
Value |
0x0000 |
Word |
0x0002 |
Array Size (minus 1); here: 0x0460 for 0x0461 bytes |
0x0002 |
Byte |
0x0001 |
Number of registered Wiimotes |
0x0003 |
MAC Address |
0x0006 |
Bluetooth MAC Address of registered/known Wiimote No. 1 |
0x0009 |
ASCII String |
0x0040 |
Zero-terminated Device Name of registered/known Wiimote No. 1 |
0x0049 |
until |
0x02BE |
Repeats up to a total of 10 entries. |
0x02BF |
MAC Address |
0x0006 |
Bluetooth MAC Address of active Wiimote No. 1 (only set at runtime, when a Wiimote is actually connected) |
0x02C5 |
ASCII String? |
0x0040 |
Zero-terminated Device Name of active Wiimote No. 1? Usually empty, probably doesn't matter (but reuses the same struct as registered Wiimotes) |
0x0305 |
until |
0x0463 |
Repeats up to a total of 6 entries. |
| Offset |
Type |
Size |
Value |
0x00 |
Byte |
0x01 |
Array Size (minus 1); here: 0x01 for 0x02 bytes |
0x01 |
Byte |
0x01 |
Standby connection (0 = off, 1 = on) |
0x02 |
Byte |
0x01 |
Slot illumination (0 = off, 1 = dim, 2 = bright) |
| Offset |
Type |
Size |
Value |
0x00 |
Byte |
0x01 |
Array Size (minus 1); here: 0x15 for 0x16 bytes |
0x01 |
UTF16BE String |
0x15 |
Console Nickname, max. 10 characters (padded with 0x00 at the end) |
0x16 |
Byte |
0x01 |
Actual string length of the Console Nickname |
| Offset |
Type |
Size |
Value |
0x00 |
Byte |
0x01 |
Array Size (minus 1); here: 0x49 for 0x4A bytes |
0x01 |
Byte |
0x01 |
Are parental controls enabled? (0x00 = off, 0x80 = on) |
0x02 |
Byte |
0x01 |
Always 0x04? Maybe PIN length? |
0x03 |
Byte |
0x01 |
Highest game rating allowed (value equals minimum age; 0x14 = 20 years/up = no restriction) |
0x04 |
ASCII String |
0x04 |
PIN, not delimited by a null-terminator, exactly 4 digits |
0x08 |
Byte |
0x01 |
Secret Question (in case you forget your PIN) |
0x09 |
UTF16BE String |
0x40 |
Answer, max. 32 characters (padded with 0x00 at the end) |
0x4A |
Byte |
0x01 |
Actual string length of the Answer |
| Question ID |
Question |
| 0 |
"What is your mother's maiden name?" |
| 1 |
"What is your place of birth?" |
| 2 |
"What is your favorite sports team?" |
| 3 |
"What was your favorite birthday present?" |
| 4 |
"What's your favorite movie?" |
| 5 |
"If you could go anywhere, where would you go?" |
