(10th August 2018: If you are interested in doing this for the Switch you may contact Traiver.)

Some useful information:
The first version gbatemp version of this guide was written by Samplasion with information by derberg (Discord names); now derberg is maintaining changes.
(Click for our Documentation)
(Click for Discord discussion)
It is somewhat similar to the Home Menu costumizing process described on dungeonfire.tk (if you want to help the customizing community you can also find a Discord link there).
Also a note by derberg: (removed now, cause confirmed in post #7)
Also note that there is still no full customization. You can only change visual parts of what is already there: You can hex edit positions of elements and change their look (after this tutorial you will be able to do something of this by using our linked docs) or replace images with tools like png2bclim or Kuriimu or change Text with e.g. the reloaded MSBT Editor or Kuriimu. But we still don't know how we can replace what elements do on a click and we can't add completly new things.

Actual start of the tutorial:
(after setting it up editing & testing a change may take less than a minute (if you use luma), cause you can restart at Macrostep 3 point 6 then)

DISCLAIMER: I am not responsible if your console bricks. You assume your responsibilities by following this guide.

This guide is about how to edit the System Settings (mset) app.

Requirements

• A 3ds with GodMode9
• The Low TID of the System Settings app corresponding to your region
• Asia81's HackingToolkit9DS (curently V11) (If you take Macrostep 1a you don't need it; or if you like it hard take the not fully documented 1b)
• A Hex editor (Samplasion recommends HxD; derberg uses Hex-Editor MX Hex Workshop; feel free to recommend us better ones)
• DarcTool3DS 5.5 or DSDecmp(GUI version included in 3DSExplorer) or maybe nlzss (untested yet) or EveryFileExplorer (only for decompression, so you need a plugin for EFE or a second tool for compression)(I recommend DarcTool3DS, but please recommend us a better alternative for those tools; it works, but yeah.. Hope GodMode9 will implement LZ11 decompression and luma will implement LZ11 compression, cause this would save time..)
  
• A computer
• A functional brain (according to DeKay)

Macrostep 0: enabling Luma's Game Patching

1. Boot your 3DS while holding Select to open Luma's Config Menu
2. Enable "Enable game patching"
3. Press Start to save
4. Turn your 3DS off

Macrostep 1: dumping the System Settings app

1. Boot your device and enter GodMode9 by holding Start
2. Navigate to [1:] SYSNAND CTRNAND
3. Navigate to title
4. Navigate to 00040010
5. Navigate to the folder corresponding to the System Settings app Low TID you took earlier
6. Navigate to content

(this may be moved into another Macrostep in the future, so that's why they are not named 7. and 8. anymore (when 1b is working), but currently you still need to do it: )

1. Press (A) on the .tmd file → TMD file options... → Build CIA (standard)
2. Turn your 3DS off and go to Macrostep 2 (or go to Macrostep 1a instead which is faster for Luma users!)

Spoiler: Macrostep 1a

Exporting a binary directly from the CIA (example with base_LZ)

Thanks to https://gbatemp.net/threads/title-dumping-and-file-extraction-using-godmode9-1-0.465427/

1. In GodMode9 navigate to [0:] SYSNAND CTRNAND
   
2. Navigate to gm9out
3. Press (A) on 00040010[LowTID] System Settings (CTRN-HASP) ([REGION]).cia → CIA image options... → Mount image to drive
4. Go into 0000.000000[XX] (the folder which has much more content; for me XX is 3D, for you it may be something other..)
5. Get into romfs
6. Select a binary like base_LZ.bin and press (A) → Copy to 0:/gm9out
7. Skip Macrostep 2 & 2a and go directly to Macrostep 3.

Spoiler: Macrostep 1b. You don't need this if you don't care about "no fragmention" cxi and cia rebuilding. Go for luma or wait for PackHack instead of this, it will take much more time. Also this is not fully documented, It is an alternative for Macrostep 2 + 2a + 1a.

(WIP:) Decrypting an .app and exporting a binary from that (example with base_LZ)

1. Press (A) on the smaller .app (XX is variable) named like 000000[XX] → NCCH image options... → Decrypt file (...) → Decrypt to (0:/gm9out)
2. Go into (the folder which has much more content; for me XX is 3D, for you it may be something other..)
3. In GodMode9 navigate to [0:] SYSNAND CTRNAND
   
4. Navigate to gm9out
5. Press (A) on 00040010[LowTID] .000000[XX] System Settings (CTR...([REGION]).cxi → NCCH image options... → Mount image to drive
6. Get into romfs
7. Select a binary like base_LZ.bin and press (A) → Copy to 0:/gm9out

For the rest I don't have a guide, but you can write one for me if you like (log from Eix's Discord):
Eix's New Years Waifu
the file is already decrypted in your output directory so copy the edited binary then find where that file begins in the decrypted file aslong as it isnt bigger or smaller than the unedited .bin file you can inject it decrypted .cxi files have 0 fragmentation so its byte to byte in the hex editor just grab the offset and inject the file there or if your feeling like you want to inject a bigger or smaller file you can do it line by line in ctrxplorer
then ofcourse reencrypt it
derberg
So if I get this right after injecting the edited base_LZ.bin back into the .cxi (and maybe reencrypting) do I have to select the modified .cxi then and choose "Build CIA from file"? Btw. the CIA would be much smaller then the original CIA of system settings cause system settings has two .app files.
Eix's New Years Waifu
yeah thats right to fix the cia size you can start out by building a decrypted cia from the tmd then following the normal steps

Eix's New Years Waifu-heute um 21:35 Uhr
cia files are normally never ment to be edited so the files are just listed inside 0 fragmentation

Macrostep 2: extracting the RomFS

1. Insert the SD of the 3ds into your computer
2. Extract HackingToolkit9DS.zip on your computer
3. Navigate to gm9/out/
4. Copy the 00040010[LowTID].cia file to the /PackEnglishV11/PackHack/ folder
5. Rename the .cia with something short, like mset.cia
6. Run the SetupUS.exe file
7. Run the HackingToolkit9DS.exe file
8. Type CE and press Enter
9. Type the name you used in step 5 without extention (.cia)
10. Wait some seconds and press a key
11. Go to the ExtractedRomFS folder (if you don't have it, go to macrostep 2a)

Spoiler: Macrostep 2a

Macrostep 2a: encrypting the .cia

1. Boot your device and enter GodMode9 by holding Start
2. Navigate to gm9
3. Navigate to out
4. Press (A) on the .cia file → CIA file options... → Encrypt CIA... → Encrypt Inplace
5. Turn your 3DS off
6. Insert the SD of the 3ds into your computer
7. Run /PackEnglishV11/PackHack/CleanTool9.exe
8. Copy the .cia file to the /PackEnglishV11/PackHack/ folder
9. Repeat Macrostep 2 from step 7

Macrostep 3: editing base_LZ.bin (or any other binary from System Settings)

(Of course you just need one tool for decompression and one for compression. Just listed a few ones after someone had problems with DarcTool3DS, which is the fastest one of those. Also I have only looked wether the alternative tools change the size of base_LZ.bin to 158KB, so I don't know wether they decompress correctly. So at first try it with DarcTool3DS)

Spoiler: Decompression with DarcTool3DS

1. Extract DarkTool3DS.zip on your computer
   
2. Copy base_LZ.bin from SD:/gm9out/ (if you took Macrostep 1a) or from /PackEnglishV11/PackHack /ExtractedRomFS (if you did not took Macrostep 1a) into DarcTool3ds/DarcTool3ds/, next to the .bat file
3. Run DarcTool3DS.bat
4. Choose option 2 by pressing 2 on your numpad and then the Enter/Return key (it won't give you big feedback, so look wether file size changed; bigger)
   
5. Close DarcTool3DS.bat

Spoiler: Decompression with 3DSExplorer

1. Extract 3dsexplorer_v1.5.3.zip on your computer
   
2. Run 3DSExplorer.exe
3. Ignore the warning and click the Button that stands for "continue" in your language
   
4. Click on "Tools" which you can find in the menu bar
5. Click on "DSDecmp GUI"
6. "Browse..." for base_LZ.bin
7. "Decompress" with Algorithm: "LZ11" and choose a new file name ending .bin

Spoiler: Decompression with EveryFileExplorer

1. Extract EveryFileExplorer_lwyx2016_Nov-9-2017.rar on your computer
   
2. Run EveryFileExplorer.exe
3. Click on "Tools" which you can find in the menu bar
   
4. Click on "Compression" → Common Compressors Plugin → LZ11 → Decompress...
   
5. Open your base_LZ.bin
6. Save your decompressed binary with the new file dialog which just opened itself

Edit the decompressed base_LZ.bin with an hex editor. (Click for our Documentation)
(make a backup before you compress if you want to edit more later, cause multiple compression & decompression of one file may not work)

Spoiler: Compression with DarcTool3DS

1. Run DarcTool3DS.bat
2. Choose option 4 by pressing 4 on your numpad and then the Enter/Return key (it won't give you big feedback, so look wether file size changed; smaller)
   
3. Close DarcTool3DS.bat

Spoiler: Compression with 3DSExplorer

1. Run 3DSExplorer.exe
2. Ignore the warning and click the Button that stands for "continue" in your language
   
3. Click on "Tools" which you can find in the menu bar
4. Click on "DSDecmp GUI"
5. "Browse..." for your edited binary
   
6. "Compress" with Algorithm: "LZ11" and choose a new file name ending .bin

Macrostep 4: loading the custom .bin with Luma

1. Navigate to SD:/luma
2. Create a new folder called titles
3. Create a new folder called 00040010[LowTID]
4. Create a folder called romfs
5. Copy the base_LZ.bin file to the newly created romfs folder
6. DONE! Now you can show us your modifications. (I want New Year themed ones, please.)

Credits

• derberg on Discord at Custom 3DS Assets (formelery known as Home Menu Asset Discussion): writing a basic guide
• Samplasion: Improving the guide for GBATemp & writing a troubleshoot (macrostep 2a)
• Eix: For pointing out a way where luma isn't needed (see macrostep 1b)(but it's damn long)
• Alerdy, Traiver, Dungeonfire & DeKay: for their Home Menu stuff, which is somewhat similar and helped a lot

Feel free to upload images to share your own System Settings customizations!
Also feel free to recommend me any other method/tool (+example, please) which could replace the tools mentioned in this tutorial or which may be helpful for editing things (for real, yesterday I messed with so many (outdated) tools and I don't want to mess with any more without knowing that there is a high success chance with it...).

Spoiler: Example pictures

For historical reasons something which isn't handled in this guide, but I think Kuriimu helps there now. Also you can always ask us.
Did this back when HANS was completly new at the 3rd of November 2015 after smea wanted "[...] to see my avatar in there somewhere" (he meant in the system settings app) with braindump, BatchLZ77, png2clim (which had a renaming bug), I think with LITTOMA's version of darctool (it had a bug cause of it's recursive path "feature" - System settings app has multiple folders with the same names..) and HANS:

 

[SirNapkin1334]

Oh I know that you'll be perfectly fine in the end, it's just for others who are perhaps beginners it looks a bit scary. Wouldn't you be a bit worried if you had to edit a core module of your system using a hex editor? Of course you could simply restore your nand and boom everythings fine but it's still kind of spoopy.

But, how could I know what editing what does what? How can we know what will actually be modified if we just change random bytes with a Hex Editor? Also, If you don't want to install a Hex Editor, GM9 has a really good built-in one.

--------------------- MERGED ---------------------------

Edit the decrypted base_LZ.bin with an hex editor. (Click for our Documentation)

Ooops. Didn't see that.

 

[schrmh]

I think it's because it looks too complex and risky.If it was just some app where you type in your text and it does it for you then I bet people would be going all over this.

For the Home Menu one there is a Cheat Engine table with some values which helps a lot. Also I was working on a easy graphical tool for previewing things, but never finished it:

Would be nice if someone could make a working one.

Also as Samplasion pointed out customizing is somewhat safe. If you have b9s you may have a backup anyways, but with luma's LayeredFS there should be no real risk, if is isn't doing stupid things.

 

[SirNapkin1334]

• Press (A) on 00040010[LowTID] System Settings (CTRN-HASP) ([REGION]).cia → CIA image options... → Mount image to drive

• Go into 0000.0000003D

0000.0000003D does not exist for me. I think you assumed it would be the same for all regions.
There are two folders. One has romFS and exeFS, one has only romFS. Which one should I go into?

--------------------- MERGED ---------------------------

Is it possible to completely remove the "In sleep mode, the system can...." screen? I'd love to see that added to Luma or something.

 

[schrmh]

yes, but a cia installation would be a lot easier

Yeah, if you don't use luma's LayeredFS feature. I will edit the OP when PackHack can rebuild a cia. Or if someone sends me a working documentation for rebuilding a cia.

Ooops. Didn't see that.

Yeah, careful reading helps a lot, haha. Maybe I should link to the Documentation at the top of the OP?

0000.0000003D does not exist for me. I think you assumed it would be the same for all regions.
There are two folders. One has romFS and exeFS, one has only romFS. Which one should I go into?

Yeah, I haven't checked with other regions. My region is Europe. You have to go into the folder with the most content: A exefs folder and a romfs folder and six binaries. Please tell me your region and the name of your folder.
The other folder just contains a two binaries and a romfs folder with a Manual.bcma in there

Is it possible to completely remove the "In sleep mode, the system can...." screen? I'd love to see that added to Luma or something.

If you go on dungeonfire.tk and scroll down to the link to their documentation (sleep_LZ.bin for sleep menu) you will find what you can change in the home & sleep menu. There are also some pictures in there.
With our current knowledge you can basically modify the text (idk about font size), change the stripes, the background, the button colour, replace the home menu icon image, recolour the two white stripes, etc in the sleep menu.

 

[SirNapkin1334]

Yeah, if you don't use luma's LayeredFS feature. I will edit the OP when PackHack can rebuild a cia. Or if someone sends me a working documentation for rebuilding a cia.


Yeah, careful reading helps a lot, haha. Maybe I should link to the Documentation at the top of the OP?


Yeah, I haven't checked with other regions. My region is Europe. You have to go into the folder with the most content: A exefs folder and a romfs folder and six binaries. Please tell me your region and the name of your folder.
The other folder just contains a two binaries and a romfs folder with a Manual.bcma in there


If you go on dungeonfire.tk and scroll down to the link to their documentation you will find what you can change in the home & sleep menu. There are also some pictures in there.
With our current knowledge you can basically modify the text (idk about font size), change the stripes, the background, the button colour, replace the home menu icon image, recolour the two white stripes, etc in the sleep menu.

Yes. For me, the folder 0000.0000004D has the most data. The folder 0001.0000004F has the less important data. You should tell people to go into the folder that is 0000.xxxxxxxx

--------------------- MERGED ---------------------------

Yes, please find an alternative to darctools. It's hosted on zippyshare, which redirected me to...pornhub...after I downloaded it. Yeeeeaaaaah........

 

[Jacklack3]

Yes. For me, the folder 0000.0000004D has the most data. The folder 0001.0000004F has the less important data. You should tell people to go into the folder that is 0000.xxxxxxxx

--------------------- MERGED ---------------------------

Yes, please find an alternative to darctools. It's hosted on zippyshare, which redirected me to...pornhub...after I downloaded it. Yeeeeaaaaah........

Use an ad-blocker or get someone to download it for you.

 

[SirNapkin1334]

I'm not sure if DarcTools is working...I put in 2, then hit enter, and the 2 disappeared, but I don't think the file was decrypted, it's SHA-1 is the exact same...

 

[schrmh]

I'm not sure if DarcTools is working...I put in 2, then hit enter, and the 2 disappeared, but I don't think the file was decrypted, it's SHA-1 is the exact same...

The file gets rapidly larger after decryption. For my base_LZ.bin it was from 20KB to 158KB.
Also have you placed your binary in the folder next to the .bat file before?

 

[SirNapkin1334]

The file gets rapidly larger after decryption. For my base_LZ.bin it was from 20KB to 158KB.
Also have you placed your binary in the folder next to the .bat file before?

What do you mean?
I put it in the folder, then ran the bat.

 

[SirNapkin1334]

@schrmh do we need to decompress the base_LZ.bin or decrypt it?

 

[schrmh]

@schrmh do we need to decompress the base_LZ.bin or decrypt it?

Oh, I mean decompression.
Option 2 "- Enter 2 for decompress (LZ11) all DARC archives" for that should change the file size of base_LZ.bin to 158KB

TO (look at "Größe" which means "size"

(The CompressLZ11 just does what DarcTool3DS's option 4 does "- Enter 4 for compress (LZ11) all DARC archives". So don't care about that, the folder "originalfiles" or the link to the romfs folder - This makes things just faster for me)

 

[SirNapkin1334]

Oh, I mean decompression.
Option 2 "- Enter 2 for decompress (LZ11) all DARC archives" for that should change the file size of base_LZ.bin to 158KB
View attachment 109806
TO (look at "Größe" which means "size"
View attachment 109807
(The CompressLZ11 just does what DarcTool3DS's option 4 does "- Enter 4 for compress (LZ11) all DARC archives". So don't care about that, the folder "originalfiles" or the link to the romfs folder - This makes things just faster for me)

Hey, I speak German too!
Do I just press 2, or do I press 2, then enter?

 

[schrmh]

Hey, I speak German too!

I would like to ask you where you have learned it, etc. But that would sadly lead to a discussion which is way too off-topic.

Do I just press 2, or do I press 2, then enter?

2 and the enter key. You may see then a small message for one half second "Please wait..." in the cmd window and then it goes back to the menu with all options.

 

[SirNapkin1334]

I would like to ask you where you have learned it, etc. But that would sadly lead to a discussion which is way too off-topic.


2 and the enter key. You may see then a small message for one half second "Please wait..." in the cmd window and then it goes back to the menu with all options.

Odd. Pressing two then enter makes the 2 disappear and the prompt to enter an option is immediately back.
Send me your copy of the bat and the scripts folder.

 

[Samplasion]

But the first advice before doing something like this is:

Do a NAND Backup, because there's a chance of bricking.

Also, this method is 100% safe

Oh I know that you'll be perfectly fine in the end, it's just for others who are perhaps beginners it looks a bit scary. Wouldn't you be a bit worried if you had to edit a core module of your system using a hex editor? Of course you could simply restore your nand and boom everythings fine but it's still kind of spoopy.

You're right, too

 

[schrmh]

Found a few other tools which supports LZ11 decompression and/or compression. Added them to the OP.
Hope one of those works for SirNapkin. Also feel free to suggest me other tools.
Maybe someone knows a way how Luma's LayeredFS can compress LZ11 (if it is able to do that)? This would save me a lot of time cause sometimes I forget the compression. Also LZ11 decompression with GodMode9 would be nice (is it already able to do that?).

 

[IcySon55]

or Kuriimu or change Text with e.g. the reloaded MSBT Editor.

Just a small note. Kuriimu has superseded MSBT Editor Reloaded. Kuriimu can edit MSBT files more accurately than the old editor.

 

[TomodachiDeath]

Where do i even start? What can I do with the hex editor?

 

[schrmh]

Where do i even start? What can I do with the hex editor?

Basically you can edit the position and the colour of elements for now (but we only documented colour things on the spreadsheet so far, cause I spend my time on other things currently). E.g. if you want your system settings background to be red instead of this yellowish then you can do this. More things are listed on the documentation spreadsheet.
You start by folliwing the tutorial. While editing you jump to the Offset for the thing (Ctrl+G in HxD or Ctrl+Z in MX but without 0x; in HexWorkshop you may use Ctrl+Z and "Find all Instances" to search for hex values instead of Offset and then jump to Offsets via appeared Offset list) you want to edit and replace the Bytes blocks.
Example: You want to recolour something of the big button which you press when you want to exit system settings. You open the base_LZ file with the Hex editor of your choice. Then you press the correct key combination to open the Offset search thing and you search for 0x1FC40 or 1FC40 (depends on the hex editor). The hex editor will now jump to the correct position and you will see three blocks (78 78 78 in this case) which represents the elements colour; fourth block may be alpha, but you most likely will ignore this. Now replace them with any other numbers from 0-9 or A-F; you can find tables and colour pickers for hex colours online.
When done just save the file and follow the rest of the tutorial. Once done you can of course always recontinue from the editing part in case that you have a backup of working files.

Hope this clears things up for you. If you have problems by understanding some part of the guide don't bother to ask, but try to be more precise. Also you can always ask us at Discord; there are also some more pictures, if you just want to see what we edited by using hex editors in the past.

 

[Travy]

I don't know if this is the right place to ask this, but I was wondering if we could modify the "quick settings" in the 3ds menu, for example to add functionality.

I would like to replace the brightness selection with a slider and a bar with "%", with a notch to enter in the "advanced" brightness mode, which allows to go beyond the basic brightness settings, as well as an "Anti-blue light" mode which added a yellow filter (adjustable and even automatable) to the screen.