From WiiUBrew
Jump to navigation Jump to search


The Latte package contains a 93C66 (or similar) SPI EEPROM, organized as 256 16-bit words, making it twice the size of the EEPROM found in the Wii's Hollywood package. It is accessed by twiddling some of the Starbuck GPIO lines in the exact same way as it was done on the Wii's Starlet GPIO lines.


Most of the data here is only written once during manufacturing, but some fields are updated fairly frequently. Items listed as reserved are empty and not known to be used.

Offset (word index * 2) Size Description
0x000 (0x00 * 2) 0x12 bytes Reserved
0x012 (0x09 * 2) 0x08 bytes RNG seed
This seed is incremented every time IOS-CRYPTO starts. 
It is also combined with the OTP's RNG key and seed to setup the IOS-CRYPTO RNG functions.
0x01A (0x0D * 2) 0x06 bytes Reserved
0x020 (0x10 * 2) 0x0C bytes EspressoPackageInfo
0x02C (0x16 * 2) 0x0C bytes LattePackageInfo
0x038 (0x1C * 2) 0x48 bytes BoardConfig
0x080 (0x40 * 2) 0x10 bytes Drive key
0x090 (0x48 * 2) 0x10 bytes Factory key
This key is cleared by IOS-MCP.
0x0A0 (0x50 * 2) 0x10 bytes SHDD seed
0x0B0 (0x58 * 2) 0x10 bytes IVS seed
This seed is encrypted with the IVS key from OTP then used to set the /dev/crypto USB key.
The first 0x04 bytes of this key must match the Wii U device ID.
0x0C0 (0x60 * 2) 0x02 bytes DriveConfig
If the flag is 0x0000, the drive key is unencrypted.
If the flag is 0xFFFE, the drive key is empty.
If the flag is 0xFFFF, the drive key is encrypted with the SEEPROM key.
0x0C2 (0x61 * 2) 0x02 bytes IvsConfig
If the flag is 0x0010, real IVS should be used.
0x0C4 (0x62 * 2) 0x02 bytes ShddConfig
If the flag is 0x0000, the SHDD seed is empty.
If the flag is 0xFFFF, the SHDD seed is encrypted with the SHDD key from OTP.
0x0C6 (0x63 * 2) 0x6A bytes Reserved
0x130 (0x98 * 2) 0x04 bytes
0x134 (0x9A * 2) 0x02 bytes
0x136 (0x9B * 2) 0x02 bytes
0x138 (0x9C * 2) 0x08 bytes Reserved
0x140 (0xA0 * 2) 0x40 bytes SysProd
0x180 (0xC0 * 2) 0x12 bytes ProdInfo
0x192 (0xC9 * 2) 0x02 bytes Always 0xAA55
0x194 (0xCA * 2) 0x02 bytes
0x196 (0xCB * 2) 0x02 bytes
0x198 (0xCC * 2) 0x02 bytes
0x19A (0xCD * 2) 0x04 bytes
0x19E (0xCF * 2) 0x04 bytes
0x1A2 (0xD1 * 2) 0x02 bytes Always 0xBB66
0x1A4 (0xD2 * 2) 0x02 bytes
0x1A6 (0xD3 * 2) 0x02 bytes
0x1A8 (0xD4 * 2) 0x08 bytes
0x1B0 (0xD8 * 2) 0x02 bytes
0x1B2 (0xD9 * 2) 0x02 bytes
0x1B4 (0xDA * 2) 0x08 bytes
0x1BC (0xDE * 2) 0x04 bytes StorageSize
0x1C0 (0xE0 * 2) 0x30 bytes BootParams
0x1F0 (0xF8 * 2) 0x10 bytes Reserved


Offset Size Description
0x0 0x4 PpcPvr (0x70010201)
0x4 0x6 EspressoPackageId
0xA 0x2


Offset Size Description
0x0 0x2 LatteWaferX
0x2 0x2 LatteWaferY
0x4 0x8 LattePackageId


Offset Size Description
0x0 0x4 crc
0x4 0x2 size
0x6 0x2 version
0x8 0x2 author
0xA 0x2 boardType
0xC 0x2 boardRevision
0xE 0x2 bootSource
0x10 0x2 ddr3Size
0x12 0x2 ddr3Speed
0x14 0x2 ppcClockMultiplier
0x16 0x2 iopClockMultiplier
0x18 0x2 video1080p
0x1A 0x2 ddr3Vendor
0x1C 0x2 movPassiveReset
0x20 0x2 sysPllSpeed
0x22 0x2 sataDevice
0x24 0x2 consoleType
0x26 0x4 devicePresence
0x28 0x20 Reserved


Value Description
0x404D @M (Atmel?)


Value Description
0x4346 CF (CAFE: Production/Test)
0x4354 CT (CAT: Development)
0x4556 EV (EV: Evaluation)
0x4944 ID (WUIH_DEV)
0x4948 IH (WUIH)


Value Description
0x4E31 N1 (NAND1)
0x5333 S3 (SDIO3)


Value Description
0x0800 2GB (Production/Test)
0x1000 4GB (Development)


Value Description
0x5521 U! (Micron?)


Value Description
0x0001 Default
0x0002 No device
0x0003 ROM drive (Production)
0x0004 R drive (CAT-R/CAT-I)
0x0005 MION (CAT-DEV)
0x0006 SES (CAT-SES)
0x0007 GEN2-HDD
0x0008 GEN1-HDD


Value Description
0x0001 WUP (Production)
0x0002 CAT-R (Test)
0x0003 CAT-DEV (Development)
0x0004 EV board (Evaluation)
0x0005 Promotion (CAT-I/CAT-SES)
0x0006 OrchestraX
0x0007 WUIH
0x0008 WUIH_DEV


Offset Size Description
0x0 0x4 product_area
0x4 0x2 eeprom_version
0x6 0x2 Reserved
0x8 0x4 game_region
0xC 0x4 Reserved
0x10 0x4 ntsc_pal
0x14 0x3 5ghz_country_code
0x17 0x1 5ghz_country_code_revision
0x18 0x8 code_id
0x20 0xC serial_id
0x2C 0x4 Reserved
0x30 0x10 model_number


This 0x12-byte structure is only present in production/test units. For development units, this structure is left empty.

Offset Size Description
0x0 0x4 LotNumber
0x4 0x4 LotNumberEx (only available if boardRevision >= 0x0C)
0x8 0x2 ProdYear
0xA 0x2 ProdMonthDay
0xC 0x2 ProdHourMinute
0xE 0x4 ProdInfoCrc (CRC32 over the previous 14 bytes)


Value Description
0x1000 8GB (MLC)
0x4000 32GB (MLC)
0x14000 320GB (MION)


This 0x30-byte structure is AES-128-ECB encrypted with the SEEPROM key.

Offset Size Description
0x0 0x2 MiscConfig
0x2 0x2 BootConfig
0x4 0x4 NandConfig (value for overwriting the NAND_CONFIG register)
0x8 0x4 NandBank (value for overwriting the NAND_BANK register)
0xC 0x4 BootParamsCrc0 (CRC32 over the previous 12 bytes)
0x10 0x2 Boot1Version0
0x12 0x2 Boot1Sector0 (default: 0x1000 => 0x40000 pages = NAND bank 1, byte offset 0x0)
0x14 0x8 Reserved
0x1C 0x4 BootParamsCrc1 (CRC32 over the previous 12 bytes)
0x20 0x2 Boot1Version1
0x22 0x2 Boot1Sector1 (default: 0x1001 => 0x40040 pages = NAND bank 1, byte offset 0x21000)
0x24 0x8 Reserved
0x2C 0x4 BootParamsCrc2 (CRC32 over the previous 12 bytes)


Bits Description
0-9 CPU speed in MHz used for delay calculations
10-14 Value for delaying before checking if the SD boot combo has been pressed
15 Causes 0x3 to be written to LT_IOP2X which increases the ARM CPU clock multiplier


Bits Description
0-7 SD card clock divider
8-9 Value for delaying before initializing the SD host controller
10 Enables SD card 4-bit bus through CMD55 (SD_APP_CMD) and CMD6 (SD_APP_SET_BUS_WIDTH)
11 Enables using the supplied value for the SD card clock divider
13 Enables using the supplied value for overwriting NAND_BANK
14 Enables using the supplied value for overwriting NAND_CONFIG
15 Forces NAND to validate ECC data