WiiUBrew

Changes

Hardware/SEEPROM (view source)

Revision as of 02:47, 18 November 2024

173 bytes added ,  02:47, 18 November 2024
There are multiple DRAM vendors, and all systems have 0x5521 no matter the vendor.
Line 1: Line 1: −
== General ==
+
= General =
 
The Latte package contains a [http://www.atmel.com/images/doc0172z.pdf 93C66] (or similar) SPI EEPROM, organized as 256 16-bit words, making it twice the size of the EEPROM found in the Wii's Hollywood package. It is accessed by twiddling some of the Starbuck GPIO lines in the exact same way as it was done on the Wii's Starlet GPIO lines.
 
The Latte package contains a [http://www.atmel.com/images/doc0172z.pdf 93C66] (or similar) SPI EEPROM, organized as 256 16-bit words, making it twice the size of the EEPROM found in the Wii's Hollywood package. It is accessed by twiddling some of the Starbuck GPIO lines in the exact same way as it was done on the Wii's Starlet GPIO lines.
   −
== Contents ==
+
= Contents =
−
Most of the data here is written once at the factory and never changed, but some fields are updated fairly frequently:
+
Most of the data here is only written once during manufacturing, but some fields are updated fairly frequently. Items listed as reserved are empty and not known to be used.
 
{| style="border: 1px solid #bbb; border-collapse: collapse; background-color: #eef; padding: 0.2em 0.2em 0.2em 0.2em;" border="1" cellpadding="2"
 
{| style="border: 1px solid #bbb; border-collapse: collapse; background-color: #eef; padding: 0.2em 0.2em 0.2em 0.2em;" border="1" cellpadding="2"
 
|- style="background-color: #ddd;"
 
|- style="background-color: #ddd;"
Line 10: Line 10:  
! Description
 
! Description
 
|-
 
|-
−
| 0x000 (0x00 * 2) || 0x12 bytes || Empty
+
| 0x000 (0x00 * 2) || 0x12 bytes || Reserved
 
|-
 
|-
−
| 0x012 (0x09 * 2) || 0x08 bytes || SEEPROM RNG seed
+
| 0x012 (0x09 * 2) || 0x08 bytes || RNG seed
 
  This seed is incremented every time IOS-CRYPTO starts.  
 
  This seed is incremented every time IOS-CRYPTO starts.  
−
  It is also combined with the OTP's RNG key and the OTP's RNG seed to setup the IOS-CRYPTO RNG functions.
+
  It is also combined with the OTP's RNG key and seed to setup the IOS-CRYPTO RNG functions.
 
|-
 
|-
−
| 0x01A (0x0D * 2) || 0x06 bytes || Empty
+
| 0x01A (0x0D * 2) || 0x06 bytes || Reserved
 
|-
 
|-
−
| 0x020 (0x10 * 2) || 0x04 bytes || PPC PVR
+
| 0x020 (0x10 * 2) || 0x0C bytes || [[#EspressoPackageInfo|EspressoPackageInfo]]
−
Should always be 0x70010201.
   
|-
 
|-
−
| 0x024 (0x12 * 2) || 0x06 bytes || SEEPROM version name string
+
| 0x02C (0x16 * 2) || 0x0C bytes || [[#LattePackageInfo|LattePackageInfo]]
 
|-
 
|-
−
| 0x02A (0x15 * 2) || 0x02 bytes || SEEPROM version code
+
| 0x038 (0x1C * 2) || 0x48 bytes || [[#BoardConfig|BoardConfig]]
 
|-
 
|-
−
| 0x02C (0x16 * 2) || 0x02 bytes || OTP version code
+
| 0x080 (0x40 * 2) || 0x10 bytes || Drive key
 
|-
 
|-
−
| 0x02E (0x17 * 2) || 0x02 bytes || OTP revision code
+
| 0x090 (0x48 * 2) || 0x10 bytes || Factory key
 +
This key is cleared by IOS-MCP.
 
|-
 
|-
−
| 0x030 (0x18 * 2) || 0x08 bytes || OTP version name string
+
| 0x0A0 (0x50 * 2) || 0x10 bytes || SHDD seed
 
|-
 
|-
−
| 0x038 (0x1C * 2) || 0x04 bytes || BoardConfig struct's CRC32
+
| 0x0B0 (0x58 * 2) || 0x10 bytes || IVS seed
 +
This seed is encrypted with the IVS key from OTP then used to set the /dev/crypto USB key.
 +
The first 0x04 bytes of this key must match the Wii U device ID.
 
|-
 
|-
−
| 0x03C (0x1E * 2) || 0x02 bytes || BoardConfig struct's available size
+
| 0x0C0 (0x60 * 2) || 0x02 bytes || DriveConfig
 +
If the flag is 0x0000, the drive key is unencrypted.
 +
If the flag is 0xFFFE, the drive key is empty.
 +
If the flag is 0xFFFF, the drive key is encrypted with the SEEPROM key.
 
|-
 
|-
−
| 0x03E (0x1F * 2) || 0x02 bytes || BoardConfig library version
+
| 0x0C2 (0x61 * 2) || 0x02 bytes || IvsConfig
 +
If the flag is 0x0010, real IVS should be used.
 
|-
 
|-
−
| 0x040 (0x20 * 2) || 0x02 bytes || BoardConfig author
+
| 0x0C4 (0x62 * 2) || 0x02 bytes || ShddConfig
−
  0x404D: @M (Atmel?)
+
  If the flag is 0x0000, the SHDD seed is empty.
 +
If the flag is 0xFFFF, the SHDD seed is encrypted with the SHDD key from OTP.
 
|-
 
|-
−
| 0x042 (0x21 * 2) || 0x02 bytes || BoardConfig boardType
+
| 0x0C6 (0x63 * 2) || 0x6A bytes || Reserved
−
0x4346: CF (CAFE: Retail/Kiosk)
  −
0x4354: CT (CAT: Devkit)
  −
0x4556: EV (EV: Evaluation board)
  −
0x4944: ID (WUIH_DEV?)
  −
0x4948: IH (WUIH?)
   
|-
 
|-
−
| 0x044 (0x22 * 2) || 0x02 bytes || BoardConfig boardRevision
+
| 0x130 (0x98 * 2) || 0x04 bytes ||  
 
|-
 
|-
−
| 0x046 (0x23 * 2) || 0x02 bytes || BoardConfig bootSource
+
| 0x134 (0x9A * 2) || 0x02 bytes ||  
−
0x4E31: N1 (NAND?)
  −
0x5333: S3 (SDIO?)
   
|-
 
|-
−
| 0x048 (0x24 * 2) || 0x02 bytes || BoardConfig ddr3Size
+
| 0x136 (0x9B * 2) || 0x02 bytes ||  
 
|-
 
|-
−
| 0x04A (0x25 * 2) || 0x02 bytes || BoardConfig ddr3Speed
+
| 0x138 (0x9C * 2) || 0x08 bytes || Reserved
 
|-
 
|-
−
| 0x04C (0x26 * 2) || 0x02 bytes || BoardConfig ppcClockMultiplier
+
| 0x140 (0xA0 * 2) || 0x40 bytes || [[#SysProd|SysProd]]
 
|-
 
|-
−
| 0x04E (0x27 * 2) || 0x02 bytes || BoardConfig iopClockMultiplier
+
| 0x180 (0xC0 * 2) || 0x12 bytes || [[#ProdInfo|ProdInfo]]
 
|-
 
|-
−
| 0x050 (0x28 * 2) || 0x02 bytes || BoardConfig video1080p
+
| 0x192 (0xC9 * 2) || 0x02 bytes || Always 0xAA55
 
|-
 
|-
−
| 0x052 (0x29 * 2) || 0x02 bytes || BoardConfig ddr3Vendor
+
| 0x194 (0xCA * 2) || 0x02 bytes ||  
−
0x5521: U! (Micron?)
   
|-
 
|-
−
| 0x054 (0x2A * 2) || 0x02 bytes || BoardConfig movPassiveReset
+
| 0x196 (0xCB * 2) || 0x02 bytes ||  
 
|-
 
|-
−
| 0x056 (0x2B * 2) || 0x02 bytes || BoardConfig sysPllSpeed
+
| 0x198 (0xCC * 2) || 0x02 bytes ||  
 
|-
 
|-
−
| 0x058 (0x2C * 2) || 0x02 bytes || BoardConfig sataDevice
+
| 0x19A (0xCD * 2) || 0x04 bytes ||  
−
0x0001: Default
  −
0x0002: No device
  −
0x0003: ROM drive (Retail)
  −
0x0004: R drive (Test/Kiosk CAT-I)
  −
0x0005: MION (Debug)
  −
0x0006: SES (Kiosk CAT-SES)
  −
0x0007: GEN2-HDD (Kiosk CAT-I with HDD)
  −
0x0008: GEN1-HDD (Kiosk CAT-I with HDD)
   
|-
 
|-
−
| 0x05A (0x2D * 2) || 0x02 bytes || BoardConfig consoleType
+
| 0x19E (0xCF * 2) || 0x04 bytes ||  
−
0x0001: WUP (Retail)
  −
0x0002: CAT-R (Test)
  −
0x0003: CAT-DEV (Debug)
  −
0x0004: EV board
  −
0x0005: Promotion (Kiosk CAT-I/CAT-SES)
  −
0x0006: OrchestraX
  −
0x0007: WUIH
  −
0x0008: WUIH_DEV
  −
0x0009: CAT_DEV_WUIH
   
|-
 
|-
−
| 0x05C (0x2E * 2) || 0x04 bytes || BoardConfig devicePresence
+
| 0x1A2 (0xD1 * 2) || 0x02 bytes || Always 0xBB66
−
Always 0x00000000 in retail/kiosk units.
   
|-
 
|-
−
| 0x060 (0x30 * 2) || 0x20 bytes || Reserved for BoardConfig
+
| 0x1A4 (0xD2 * 2) || 0x02 bytes ||  
 
|-
 
|-
−
| 0x080 (0x40 * 2) || 0x10 bytes || Wii U drive key
+
| 0x1A6 (0xD3 * 2) || 0x02 bytes ||  
−
Check Drive Key's Status Flag. Decrypt with Wii U SEEPROM Key if needed.
   
|-
 
|-
−
| 0x090 (0x48 * 2) || 0x10 bytes || Wii U factory key
+
| 0x1A8 (0xD4 * 2) || 0x08 bytes ||  
−
This key is cleared by IOS-MCP at factory.
   
|-
 
|-
−
| 0x0A0 (0x50 * 2) || 0x10 bytes || Wii U SHDD key
+
| 0x1B0 (0xD8 * 2) || 0x02 bytes ||  
 
|-
 
|-
−
| 0x0B0 (0x58 * 2) || 0x10 bytes || Wii U USB key seed
+
| 0x1B2 (0xD9 * 2) || 0x02 bytes ||  
−
This seed is encrypted with a key from OTP then used to set the /dev/crypto USB key.
  −
The first 0x04 bytes of this key must match the Wii U NG ID.
   
|-
 
|-
−
| 0x0C0 (0x60 * 2) || 0x02 bytes || Drive key's status Flag
+
| 0x1B4 (0xDA * 2) || 0x08 bytes ||  
−
If the flag is 0xFFFF, the drive key is set and encrypted with the Wii U SEEPROM key.
  −
If the flag is 0x0000, the drive key is set and in plain form.
   
|-
 
|-
−
| 0x0C2 (0x61 * 2) || 0x02 bytes || USB key seed's status flag
+
| 0x1BC (0xDE * 2) || 0x04 bytes || [[#StorageSize|StorageSize]]
 
|-
 
|-
−
| 0x0C4 (0x62 * 2) || 0x02 bytes || SHDD key's status flag
+
| 0x1C0 (0xE0 * 2) || 0x30 bytes || [[#BootParams|BootParams]]
−
If the flag is 0xFFFF, the SHDD key is set and encrypted with a key from OTP.
  −
If the flag is 0x0000, the SHDD key is not set.
   
|-
 
|-
−
| 0x0C6 (0x63 * 2) || 0x6A bytes || Empty
+
| 0x1F0 (0xF8 * 2) || 0x10 bytes || Reserved
 +
|}
 +
 
 +
== EspressoPackageInfo ==
 +
{| class="wikitable" border="1"
 +
|-
 +
! Offset || Size || Description
 +
|-
 +
| 0x0 || 0x4 || PpcPvr (0x70010201)
 +
|-
 +
| 0x4 || 0x6 || EspressoPackageId
 +
|-
 +
| 0xA || 0x2 ||
 +
|}
 +
 
 +
== LattePackageInfo ==
 +
{| class="wikitable" border="1"
 +
|-
 +
! Offset || Size || Description
 +
|-
 +
| 0x0 || 0x2 || LatteWaferX
 +
|-
 +
| 0x2 || 0x2 || LatteWaferY
 +
|-
 +
| 0x4 || 0x8 || [[Hardware/OTP#LattePackageId|LattePackageId]]
 +
|}
 +
 
 +
== BoardConfig ==
 +
{| class="wikitable" border="1"
 +
|-
 +
! Offset || Size || Description
 +
|-
 +
| 0x0 || 0x4 || crc
 
|-
 
|-
−
| 0x130 (0x98 * 2) || 0x04 bytes || Unknown
+
| 0x4 || 0x2 || size
 
|-
 
|-
−
| 0x134 (0x9A * 2) || 0x02 bytes || Unknown
+
| 0x6 || 0x2 || version
 
|-
 
|-
−
| 0x136 (0x9B * 2) || 0x02 bytes || Unknown
+
| 0x8 || 0x2 || [[#author|author]]
 
|-
 
|-
−
| 0x138 (0x9C * 2) || 0x08 bytes || Empty
+
| 0xA || 0x2 || [[#boardType|boardType]]
 
|-
 
|-
−
| 0x140 (0xA0 * 2) || 0x04 bytes || slc:sys_prod.version
+
| 0xC || 0x2 || boardRevision
 
|-
 
|-
−
| 0x144 (0xA2 * 2) || 0x04 bytes || slc:sys_prod.eeprom_version
+
| 0xE || 0x2 || [[#bootSource|bootSource]]
 
|-
 
|-
−
| 0x148 (0xA4 * 2) || 0x04 bytes || slc:sys_prod.product_area
+
| 0x10 || 0x2 || [[#ddr3Size|ddr3Size]]
 
|-
 
|-
−
| 0x14C (0xA6 * 2) || 0x04 bytes || slc:sys_prod.game_region
+
| 0x12 || 0x2 || ddr3Speed
 
|-
 
|-
−
| 0x150 (0xA8 * 2) || 0x04 bytes || slc:sys_prod.ntsc_pal
+
| 0x14 || 0x2 || ppcClockMultiplier
 
|-
 
|-
−
| 0x154 (0xAA * 2) || 0x02 bytes || slc:sys_prod.5ghz_country_code
+
| 0x16 || 0x2 || iopClockMultiplier
 
|-
 
|-
−
| 0x156 (0xAB * 2) || 0x02 bytes || slc:sys_prod.5ghz_country_code_revision
+
| 0x18 || 0x2 || video1080p
 
|-
 
|-
−
| 0x158 (0xAC * 2) || 0x08 bytes || slc:sys_prod.code_id
+
| 0x1A || 0x2 || [[#ddr3Vendor|ddr3Vendor]]
 
|-
 
|-
−
| 0x160 (0xB0 * 2) || 0x10 bytes || slc:sys_prod.serial_id
+
| 0x1C || 0x2 || movPassiveReset
 
|-
 
|-
−
| 0x170 (0xB8 * 2) || 0x10 bytes || slc:sys_prod.model_number
+
| 0x20 || 0x2 || sysPllSpeed
 
|-
 
|-
−
| 0x180 (0xC0 * 2) || 0x02 bytes || Unknown
+
| 0x22 || 0x2 || [[#sataDevice|sataDevice]]
 
|-
 
|-
−
| 0x182 (0xC1 * 2) || 0x02 bytes || Unknown
+
| 0x24 || 0x2 || [[#consoleType|consoleType]]
 
|-
 
|-
−
| 0x184 (0xC2 * 2) || 0x02 bytes || Unknown
+
| 0x26 || 0x4 || devicePresence
 
|-
 
|-
−
| 0x186 (0xC3 * 2) || 0x02 bytes || Unknown
+
| 0x28 || 0x20 || Reserved
 +
|}
 +
 
 +
=== author ===
 +
{| class="wikitable"
 
|-
 
|-
−
| 0x188 (0xC4 * 2) || 0x02 bytes || Production date (year)
+
! Value
 +
! Description
 
|-
 
|-
−
| 0x18A (0xC5 * 2) || 0x02 bytes || Production date (month and day)
+
| 0x404D
 +
| @M (Atmel?)
 +
|}
 +
 
 +
=== boardType ===
 +
{| class="wikitable"
 
|-
 
|-
−
| 0x18C (0xC6 * 2) || 0x02 bytes || Production date (hour and minute)
+
! Value
 +
! Description
 
|-
 
|-
−
| 0x18E (0xC7 * 2) || 0x04 bytes || CRC32 of the last 0x0E bytes
+
| 0x4346
 +
| CF (CAFE: Production/Test)
 
|-
 
|-
−
| 0x192 (0xC9 * 2) || 0x02 bytes || 0xAA55 marker
+
| 0x4354
 +
| CT (CAT: Development)
 
|-
 
|-
−
| 0x194 (0xCA * 2) || 0x02 bytes || Unknown
+
| 0x4556
 +
| EV (EV: Evaluation)
 
|-
 
|-
−
| 0x196 (0xCB * 2) || 0x02 bytes || Unknown
+
| 0x4944
 +
| ID (WUIH_DEV)
 
|-
 
|-
−
| 0x198 (0xCC * 2) || 0x02 bytes || Unknown
+
| 0x4948
 +
| IH (WUIH)
 +
|}
 +
 
 +
=== bootSource ===
 +
{| class="wikitable"
 
|-
 
|-
−
| 0x19A (0xCD * 2) || 0x04 bytes || Empty
+
! Value
 +
! Description
 
|-
 
|-
−
| 0x19E (0xCF * 2) || 0x04 bytes || Unknown
+
| 0x4E31
 +
| N1 (NAND1)
 
|-
 
|-
−
| 0x1A2 (0xD1 * 2) || 0x02 bytes || 0xBB66 marker
+
| 0x5333
 +
| S3 (SDIO3)
 +
|}
 +
 
 +
=== ddr3Size ===
 +
{| class="wikitable"
 
|-
 
|-
−
| 0x1A4 (0xD2 * 2) || 0x02 bytes || Unknown
+
! Value
 +
! Description
 +
|-
 +
| 0x0800
 +
| 2GB (Production/Test)
 +
|-
 +
| 0x1000
 +
| 4GB (Development)
 +
|}
 +
 
 +
=== ddr3Vendor ===
 +
{| class="wikitable"
 
|-
 
|-
−
| 0x1A6 (0xD3 * 2) || 0x02 bytes || Unknown
+
! Value
 +
! Description
 
|-
 
|-
−
| 0x1A8 (0xD4 * 2) || 0x08 bytes || Unknown string
+
| 0x5521
 +
| U!
 +
|}
 +
 
 +
=== sataDevice ===
 +
{| class="wikitable"
 
|-
 
|-
−
| 0x1B0 (0xD8 * 2) || 0x02 bytes || Unknown
+
! Value
 +
! Description
 +
|-
 +
| 0x0001
 +
| Default
 +
|-
 +
| 0x0002
 +
| No device
 +
|-
 +
| 0x0003
 +
| ROM drive (Production)
 +
|-
 +
| 0x0004
 +
| R drive (CAT-R/CAT-I)
 +
|-
 +
| 0x0005
 +
| MION (CAT-DEV)
 +
|-
 +
| 0x0006
 +
| SES (CAT-SES)
 +
|-
 +
| 0x0007
 +
| GEN2-HDD
 +
|-
 +
| 0x0008
 +
| GEN1-HDD
 +
|}
 +
 
 +
=== consoleType ===
 +
{| class="wikitable"
 +
|-
 +
! Value
 +
! Description
 +
|-
 +
| 0x0001
 +
| WUP (Production)
 +
|-
 +
| 0x0002
 +
| CAT-R (Test)
 +
|-
 +
| 0x0003
 +
| CAT-DEV (Development)
 +
|-
 +
| 0x0004
 +
| EV board (Evaluation)
 +
|-
 +
| 0x0005
 +
| Promotion (CAT-I/CAT-SES)
 +
|-
 +
| 0x0006
 +
| OrchestraX
 +
|-
 +
| 0x0007
 +
| WUIH
 +
|-
 +
| 0x0008
 +
| WUIH_DEV
 +
|-
 +
| 0x0009
 +
| CAT_DEV_WUIH
 +
|}
 +
 
 +
== SysProd ==
 +
{| class="wikitable" border="1"
 +
|-
 +
! Offset || Size || Description
 +
|-
 +
| 0x0 || 0x4 || product_area
 +
|-
 +
| 0x4 || 0x2 || eeprom_version
 +
|-
 +
| 0x6 || 0x2 || Reserved
 +
|-
 +
| 0x8 || 0x4 || game_region
 +
|-
 +
| 0xC || 0x4 || Reserved
 +
|-
 +
| 0x10 || 0x4 || ntsc_pal
 +
|-
 +
| 0x14 || 0x3 || 5ghz_country_code
 +
|-
 +
| 0x17 || 0x1 || 5ghz_country_code_revision
 +
|-
 +
| 0x18 || 0x8 || code_id
 +
|-
 +
| 0x20 || 0xC || serial_id
 +
|-
 +
| 0x2C || 0x4 || Reserved
 +
|-
 +
| 0x30 || 0x10 || model_number
 +
|}
 +
 
 +
== ProdInfo ==
 +
This 0x12-byte structure is only present in production/test units. For development units, this structure is left empty.
 +
 
 +
{| class="wikitable" border="1"
 +
|-
 +
! Offset || Size || Description
 +
|-
 +
| 0x0 || 0x4 || LotNumber
 +
|-
 +
| 0x4 || 0x4 || LotNumberEx (only available if [[#BoardConfig|boardRevision]] >= 0x0C)
 +
|-
 +
| 0x8 || 0x2 || ProdYear
 +
|-
 +
| 0xA || 0x2 || ProdMonthDay
 +
|-
 +
| 0xC || 0x2 || ProdHourMinute
 +
|-
 +
| 0xE || 0x4 || ProdInfoCrc (CRC32 over the previous 14 bytes)
 +
|}
 +
 
 +
== StorageSize ==
 +
{| class="wikitable"
 +
|-
 +
! Value
 +
! Description
 +
|-
 +
| 0x1000
 +
| 8GB (MLC)
 +
|-
 +
| 0x4000
 +
| 32GB (MLC)
 +
|-
 +
| 0x14000
 +
| 320GB (MION)
 +
|}
 +
 
 +
== BootParams ==
 +
This 0x30-byte structure is AES-128-ECB encrypted with the SEEPROM key.
 +
 
 +
{| class="wikitable" border="1"
 +
|-
 +
! Offset || Size || Description
 +
|-
 +
| 0x0 || 0x2 || [[#MiscConfig|MiscConfig]]
 +
|-
 +
| 0x2 || 0x2 || [[#BootConfig|BootConfig]]
 +
|-
 +
| 0x4 || 0x4 || NandConfig (value for overwriting the NAND_CONFIG register)
 +
|-
 +
| 0x8 || 0x4 || NandBank (value for overwriting the NAND_BANK register)
 +
|-
 +
| 0xC || 0x4 || BootParamsCrc0 (CRC32 over the previous 12 bytes)
 +
|-
 +
| 0x10 || 0x2 || Boot1Version0
 +
|-
 +
| 0x12 || 0x2 || Boot1Sector0 (default: 0x1000 => 0x40000 pages = NAND bank 1, byte offset 0x0)
 +
|-
 +
| 0x14 || 0x8 || Reserved
 +
|-
 +
| 0x1C || 0x4 || BootParamsCrc1 (CRC32 over the previous 12 bytes)
 +
|-
 +
| 0x20 || 0x2 || Boot1Version1
 +
|-
 +
| 0x22 || 0x2 || Boot1Sector1 (default: 0x1001 => 0x40040 pages = NAND bank 1, byte offset 0x21000)
 +
|-
 +
| 0x24 || 0x8 || Reserved
 +
|-
 +
| 0x2C || 0x4 || BootParamsCrc2 (CRC32 over the previous 12 bytes)
 +
|}
 +
 
 +
=== MiscConfig ===
 +
{| class="wikitable" border="1"
 +
|-
 +
! Bits
 +
! Description
 +
|-
 +
| 0-9
 +
| CPU speed in MHz used for delay calculations
 +
|-
 +
| 10-14
 +
| Value for delaying before checking if the SD boot combo has been pressed
 +
|-
 +
| 15
 +
| Causes 0x3 to be written to LT_IOP2X which increases the ARM CPU clock multiplier
 +
|}
 +
 
 +
=== BootConfig ===
 +
{| class="wikitable" border="1"
 +
|-
 +
! Bits
 +
! Description
 
|-
 
|-
−
| 0x1B2 (0xD9 * 2) || 0x02 bytes || Unknown
+
| 0-7
 +
| SD card clock divider
 
|-
 
|-
−
| 0x1B4 (0xDA * 2) || 0x08 bytes || Empty
+
| 8-9
 +
| Value for delaying before initializing the SD host controller
 
|-
 
|-
−
| 0x1BC (0xDE * 2) || 0x04 bytes || Unknown
+
| 10
 +
| Enables SD card 4-bit bus through CMD55 (SD_APP_CMD) and CMD6 (SD_APP_SET_BUS_WIDTH)
 
|-
 
|-
−
| 0x1C0 (0xE0 * 2) || 0x10 bytes || Boot parameters (encrypted with Wii U SEEPROM key)
+
| 11
−
Structure containing parameters for boot0:
+
| Enables using the supplied value for the SD card clock divider
−
  - 0x1C0 to 0x1C2 (0x02 bytes): CPU control flags.
  −
    - Bits 0-9 set the CPU speed in MHz used for delay calculations.
  −
    - Bits 10-14 set a delay before checking if the SD boot combo has been pressed.
  −
    - Bit 15 causes 0x3 to be written to LT_IOP2X which increases the ARM CPU clock multiplier.
  −
  - 0x1C2 to 0x1C4 (0x02 bytes): NAND and SD control flags.
  −
    - Bits 0-7 supply a custom value for the SD card clock divider.
  −
    - Bits 8-9 set a delay before initializing the SD host controller.
  −
    - Bit 10 enables SD card 4-bit bus through CMD55 (SD_APP_CMD) and CMD6 (SD_APP_SET_BUS_WIDTH).
  −
    - Bit 11 enables using a supplied custom value for the SD card clock divider.
  −
    - Bit 13 enables using a supplied custom value for overwriting NAND_BANK.
  −
    - Bit 14 enables using a supplied custom value for overwriting NAND_CONFIG.
  −
    - Bit 15 forces NAND to validate ECC data.
  −
  - 0x1C4 to 0x1C8 (0x04 bytes): Custom value for NAND_CONFIG (optional).
  −
  - 0x1C8 to 0x1CC (0x04 bytes): Custom value for NAND_BANK (optional).
  −
  - 0x1CC to 0x1D0 (0x04 bytes): CRC32 of data from 0x1C0 to 0x1CC.
   
|-
 
|-
−
| 0x1D0 (0xE8 * 2) || 0x10 bytes || Boot parameters (encrypted with Wii U SEEPROM key)
+
| 12
−
Structure containing parameters for boot0:
+
|  
−
  - 0x1D0 to 0x1D2 (0x02 bytes): boot1 version.
  −
  - 0x1D2 to 0x1D4 (0x02 bytes): boot1 NAND sector in units of 0x40 pages. Default: 0x1000 => 0x40000 pages = NAND bank 1, byte offset 0x0.
  −
  - 0x1D4 to 0x1DC (0x08 bytes): Empty.
  −
  - 0x1DC to 0x1E0 (0x04 bytes): CRC32 of data from 0x1D0 to 0x1DC.
   
|-
 
|-
−
| 0x1E0 (0xF0 * 2) || 0x10 bytes || Boot parameters (encrypted with Wii U SEEPROM key)
+
| 13
−
Structure containing parameters for boot0:
+
| Enables using the supplied value for overwriting NAND_BANK
−
  - 0x1E0 to 0x1E2 (0x02 bytes): boot1 copy version.
  −
  - 0x1E2 to 0x1E4 (0x02 bytes): boot1 copy NAND sector in units of 0x40 pages. Default: 0x1001 => 0x40040 pages = NAND bank 1, byte offset 0x21000.
  −
  - 0x1E4 to 0x1EC (0x08 bytes): Empty.
  −
  - 0x1EC to 0x1F0 (0x04 bytes): CRC32 of data from 0x1E0 to 0x1EC.
   
|-
 
|-
−
| 0x1F0 (0xF8 * 2) || 0x10 bytes || Empty
+
| 14
 +
| Enables using the supplied value for overwriting NAND_CONFIG
 
|-
 
|-
 +
| 15
 +
| Forces NAND to validate ECC data
 
|}
 
|}
    
[[Category:Hardware]]
 
[[Category:Hardware]]
Lazr
31

edits

Retrieved from "https://wiiubrew.org/wiki/Special:MobileDiff/3637...4080"