General

The Latte package contains a 93C66 (or similar) SPI EEPROM, organized as 256 16-bit words, making it twice the size of the EEPROM found in the Wii's Hollywood package. It is accessed by twiddling some of the Starbuck GPIO lines in the exact same way as it was done on the Wii's Starlet GPIO lines.

Offset (word index * 2)	Size	Description
0x000 (0x00 * 2)	0x12 bytes	Reserved
0x012 (0x09 * 2)	0x08 bytes	RNG seed This seed is incremented every time IOS-CRYPTO starts. It is also combined with the OTP's RNG key and seed to setup the IOS-CRYPTO RNG functions.
0x01A (0x0D * 2)	0x06 bytes	Reserved
0x020 (0x10 * 2)	0x0C bytes	EspressoPackageInfo
0x02C (0x16 * 2)	0x0C bytes	LattePackageInfo
0x038 (0x1C * 2)	0x48 bytes	BoardConfig
0x080 (0x40 * 2)	0x10 bytes	Drive key
0x090 (0x48 * 2)	0x10 bytes	Factory key This key is cleared by IOS-MCP.
0x0A0 (0x50 * 2)	0x10 bytes	SHDD seed
0x0B0 (0x58 * 2)	0x10 bytes	IVS seed This seed is encrypted with the IVS key from OTP then used to set the /dev/crypto USB key. The first 0x04 bytes of this key must match the Wii U device ID.
0x0C0 (0x60 * 2)	0x02 bytes	DriveConfig If the flag is 0x0000, the drive key is unencrypted. If the flag is 0xFFFE, the drive key is empty. If the flag is 0xFFFF, the drive key is encrypted with the SEEPROM key.
0x0C2 (0x61 * 2)	0x02 bytes	IvsConfig If the flag is 0x0010, real IVS should be used.
0x0C4 (0x62 * 2)	0x02 bytes	ShddConfig If the flag is 0x0000, the SHDD seed is empty. If the flag is 0xFFFF, the SHDD seed is encrypted with the SHDD key from OTP.
0x0C6 (0x63 * 2)	0x6A bytes	Reserved
0x130 (0x98 * 2)	0x04 bytes
0x134 (0x9A * 2)	0x02 bytes
0x136 (0x9B * 2)	0x02 bytes
0x138 (0x9C * 2)	0x08 bytes	Reserved
0x140 (0xA0 * 2)	0x40 bytes	SysProd
0x180 (0xC0 * 2)	0x12 bytes	ProdInfo
0x192 (0xC9 * 2)	0x02 bytes	Always 0xAA55
0x194 (0xCA * 2)	0x02 bytes
0x196 (0xCB * 2)	0x02 bytes
0x198 (0xCC * 2)	0x02 bytes
0x19A (0xCD * 2)	0x04 bytes
0x19E (0xCF * 2)	0x04 bytes
0x1A2 (0xD1 * 2)	0x02 bytes	Always 0xBB66
0x1A4 (0xD2 * 2)	0x02 bytes
0x1A6 (0xD3 * 2)	0x02 bytes
0x1A8 (0xD4 * 2)	0x08 bytes
0x1B0 (0xD8 * 2)	0x02 bytes
0x1B2 (0xD9 * 2)	0x02 bytes
0x1B4 (0xDA * 2)	0x08 bytes
0x1BC (0xDE * 2)	0x04 bytes	StorageSize
0x1C0 (0xE0 * 2)	0x30 bytes	BootParams
0x1F0 (0xF8 * 2)	0x10 bytes	Reserved

EspressoPackageInfo

Offset	Size	Description
0x0	0x4	PpcPvr (0x70010201)
0x4	0x6	EspressoPackageId
0xA	0x2

LattePackageInfo

Offset	Size	Description
0x0	0x2	LatteWaferX
0x2	0x2	LatteWaferY
0x4	0x8	LattePackageId

BoardConfig

Offset	Size	Description
0x0	0x4	crc
0x4	0x2	size
0x6	0x2	version
0x8	0x2	author
0xA	0x2	boardType
0xC	0x2	boardRevision
0xE	0x2	bootSource
0x10	0x2	ddr3Size
0x12	0x2	ddr3Speed
0x14	0x2	ppcClockMultiplier
0x16	0x2	iopClockMultiplier
0x18	0x2	video1080p
0x1A	0x2	ddr3Vendor
0x1C	0x2	movPassiveReset
0x20	0x2	sysPllSpeed
0x22	0x2	sataDevice
0x24	0x2	consoleType
0x26	0x4	devicePresence
0x28	0x20	Reserved

author

Value	Description
0x404D	@M (Atmel?)

boardType

Value	Description
0x4346	CF (CAFE: Production/Test)
0x4354	CT (CAT: Development)
0x4556	EV (EV: Evaluation)
0x4944	ID (WUIH_DEV)
0x4948	IH (WUIH)

bootSource

Value	Description
0x4E31	N1 (NAND1)
0x5333	S3 (SDIO3)

ddr3Size

Value	Description
0x0800	2GB (Production/Test)
0x1000	4GB (Development)

ddr3Vendor

Value	Description
0x5521	U!

sataDevice

Value	Description
0x0001	Default
0x0002	No device
0x0003	ROM drive (Production)
0x0004	R drive (CAT-R/CAT-I)
0x0005	MION (CAT-DEV)
0x0006	SES (CAT-SES)
0x0007	GEN2-HDD
0x0008	GEN1-HDD

consoleType

Value	Description
0x0001	WUP (Production)
0x0002	CAT-R (Test)
0x0003	CAT-DEV (Development)
0x0004	EV board (Evaluation)
0x0005	Promotion (CAT-I/CAT-SES)
0x0006	OrchestraX
0x0007	WUIH
0x0008	WUIH_DEV
0x0009	CAT_DEV_WUIH

SysProd

Offset	Size	Description
0x0	0x4	product_area
0x4	0x2	eeprom_version
0x6	0x2	Reserved
0x8	0x4	game_region
0xC	0x4	Reserved
0x10	0x4	ntsc_pal
0x14	0x3	5ghz_country_code
0x17	0x1	5ghz_country_code_revision
0x18	0x8	code_id
0x20	0xC	serial_id
0x2C	0x4	Reserved
0x30	0x10	model_number

ProdInfo

This 0x12-byte structure is only present in production/test units. For development units, this structure is left empty.

Offset	Size	Description
0x0	0x4	LotNumber
0x4	0x4	LotNumberEx (only available if boardRevision >= 0x0C)
0x8	0x2	ProdYear
0xA	0x2	ProdMonthDay
0xC	0x2	ProdHourMinute
0xE	0x4	ProdInfoCrc (CRC32 over the previous 14 bytes)

StorageSize

Value	Description
0x1000	8GB (MLC)
0x4000	32GB (MLC)
0x14000	320GB (MION)

BootParams

This 0x30-byte structure is AES-128-ECB encrypted with the SEEPROM key.

Offset	Size	Description
0x0	0x2	MiscConfig
0x2	0x2	BootConfig
0x4	0x4	NandConfig (value for overwriting the NAND_CONFIG register)
0x8	0x4	NandBank (value for overwriting the NAND_BANK register)
0xC	0x4	BootParamsCrc0 (CRC32 over the previous 12 bytes)
0x10	0x2	Boot1Version0
0x12	0x2	Boot1Sector0 (default: 0x1000 => 0x40000 pages = NAND bank 1, byte offset 0x0)
0x14	0x8	Reserved
0x1C	0x4	BootParamsCrc1 (CRC32 over the previous 12 bytes)
0x20	0x2	Boot1Version1
0x22	0x2	Boot1Sector1 (default: 0x1001 => 0x40040 pages = NAND bank 1, byte offset 0x21000)
0x24	0x8	Reserved
0x2C	0x4	BootParamsCrc2 (CRC32 over the previous 12 bytes)

MiscConfig

Bits	Description
0-9	CPU speed in MHz used for delay calculations
10-14	Value for delaying before checking if the SD boot combo has been pressed
15	Causes 0x3 to be written to LT_IOP2X which increases the ARM CPU clock multiplier

BootConfig

Bits	Description
0-7	SD card clock divider
8-9	Value for delaying before initializing the SD host controller
10	Enables SD card 4-bit bus through CMD55 (SD_APP_CMD) and CMD6 (SD_APP_SET_BUS_WIDTH)
11	Enables using the supplied value for the SD card clock divider
12
13	Enables using the supplied value for overwriting NAND_BANK
14	Enables using the supplied value for overwriting NAND_CONFIG
15	Forces NAND to validate ECC data

Hardware/SEEPROM

Contents