cafe2wii
cafe2wii is the process used to transition to WiiMode.
Booting into Wii mode
After being launched, cafe2wii will parse a boot info structure located at 0x00001000. It will copy all the boot info binaries to several memory locations.
The c2w.img from OSv1 version additionally verifies the header of the "hai params" located at 0x00402000 and copies them to 0xfffff000.
It then lowers the Espresso's clock speed, disables Starbuck access to Wii U-exclusive hardware, then directly jumps to the loaded IOS (?).
C2WBin
| Start | Length | Description |
|---|---|---|
| 0x00 | 4 | size |
| 0x04 | 4 | paddr |
C2WBootInfo
| Start | Length | Description |
|---|---|---|
| 0x00 | 4 | iosVer (lowest 2 bytes of the title id and title version) |
| 0x04 | 8 (C2WBin) | eeprom |
| 0x0C | 8 (C2WBin) | romfont |
| 0x14 | 8 (C2WBin) | ios |
| 0x1C | 8 (C2WBin) | boot |
| 0x24 | 8 (C2WBin) | app |
Launching cafe2wii
cafe2wii is launched by the MCP module of the IOSU.
MCP-CMPT will load multiple binaries from OSv0/v1 into MEM1.
It then launches the c2w.img, which prepares those binaries in memory.
There are 3 different launch modes for booting into vWii: "NORMAL", "SIMPLE_DOL" and "HAI". All launch modes load the OSv0/v1 c2w.img and font.bin and read the Wii EEPROM using the "/dev/crpyto" ioctl 0x1e.
NORMAL (0)
This mode uses the c2w.img and font.bin from OSv0.
It reads and parses the TMD of the vWii System Menu stored in the SLCCMPT. Using the boot index of the TMD it loads the System Menu Ancast image into memory.
It also reads the TMD of the IOS specified by the System Menu and loads its boot content into memory.
SIMPLE_DOL (1)
This mode also uses the c2w.img and font.bin from OSv0.
It then tries to load a fw.img, boot.bin and app.dol from OSv0. This might have been a feature used for testing during development, since these files are no longer part of OSv0.
HAI (2)
This mode uses the c2w.img and font.bin from OSv1.
It loads the COMPAT-BS Ancast image (boot.bin) from OSv1 into memory and an IOS named fw.img from the launched title (this is usually HAI-IOS).
It also prepares a structure with hai parameters in memory. Those parameters will be parsed by the loaded IOS.