WiiUBrew

Changes

Hardware/SEEPROM (view source)

Revision as of 02:47, 18 November 2024

814 bytes added ,  02:47, 18 November 2024
There are multiple DRAM vendors, and all systems have 0x5521 no matter the vendor.
Line 3: Line 3:     
= Contents =
 
= Contents =
−
Most of the data here is written once at the factory and never changed, but some fields are updated fairly frequently:
+
Most of the data here is only written once during manufacturing, but some fields are updated fairly frequently. Items listed as reserved are empty and not known to be used.
 
{| style="border: 1px solid #bbb; border-collapse: collapse; background-color: #eef; padding: 0.2em 0.2em 0.2em 0.2em;" border="1" cellpadding="2"
 
{| style="border: 1px solid #bbb; border-collapse: collapse; background-color: #eef; padding: 0.2em 0.2em 0.2em 0.2em;" border="1" cellpadding="2"
 
|- style="background-color: #ddd;"
 
|- style="background-color: #ddd;"
Line 18: Line 18:  
| 0x01A (0x0D * 2) || 0x06 bytes || Reserved
 
| 0x01A (0x0D * 2) || 0x06 bytes || Reserved
 
|-
 
|-
−
| 0x020 (0x10 * 2) || 0x04 bytes || PPC PVR
+
| 0x020 (0x10 * 2) || 0x0C bytes || [[#EspressoPackageInfo|EspressoPackageInfo]]
−
Should always be 0x70010201.
   
|-
 
|-
−
| 0x024 (0x12 * 2) || 0x06 bytes ||
+
| 0x02C (0x16 * 2) || 0x0C bytes || [[#LattePackageInfo|LattePackageInfo]]
−
|-
  −
| 0x02A (0x15 * 2) || 0x02 bytes ||
  −
|-
  −
| 0x02C (0x16 * 2) || 0x02 bytes || OTP version code
  −
|-
  −
| 0x02E (0x17 * 2) || 0x02 bytes || OTP revision code
  −
|-
  −
| 0x030 (0x18 * 2) || 0x08 bytes || OTP version name string
   
|-
 
|-
 
| 0x038 (0x1C * 2) || 0x48 bytes || [[#BoardConfig|BoardConfig]]
 
| 0x038 (0x1C * 2) || 0x48 bytes || [[#BoardConfig|BoardConfig]]
Line 38: Line 29:  
  This key is cleared by IOS-MCP.
 
  This key is cleared by IOS-MCP.
 
|-
 
|-
−
| 0x0A0 (0x50 * 2) || 0x10 bytes || SHDD key
+
| 0x0A0 (0x50 * 2) || 0x10 bytes || SHDD seed
 
|-
 
|-
 
| 0x0B0 (0x58 * 2) || 0x10 bytes || IVS seed
 
| 0x0B0 (0x58 * 2) || 0x10 bytes || IVS seed
−
  This seed is encrypted with a key from OTP then used to set the /dev/crypto USB key.
+
  This seed is encrypted with the IVS key from OTP then used to set the /dev/crypto USB key.
−
  The first 0x04 bytes of this key must match the Wii U DeviceId.
+
  The first 0x04 bytes of this key must match the Wii U device ID.
 
|-
 
|-
 
| 0x0C0 (0x60 * 2) || 0x02 bytes || DriveConfig
 
| 0x0C0 (0x60 * 2) || 0x02 bytes || DriveConfig
−
  If the flag is 0xFFFF, the drive key is set and encrypted with the Wii U SEEPROM key.
+
  If the flag is 0x0000, the drive key is unencrypted.
−
  If the flag is 0x0000, the drive key is set and in plain form.
+
If the flag is 0xFFFE, the drive key is empty.
 +
  If the flag is 0xFFFF, the drive key is encrypted with the SEEPROM key.
 
|-
 
|-
 
| 0x0C2 (0x61 * 2) || 0x02 bytes || IvsConfig
 
| 0x0C2 (0x61 * 2) || 0x02 bytes || IvsConfig
 +
If the flag is 0x0010, real IVS should be used.
 
|-
 
|-
 
| 0x0C4 (0x62 * 2) || 0x02 bytes || ShddConfig
 
| 0x0C4 (0x62 * 2) || 0x02 bytes || ShddConfig
−
  If the flag is 0xFFFF, the SHDD key is set and encrypted with a key from OTP.
+
  If the flag is 0x0000, the SHDD seed is empty.
−
  If the flag is 0x0000, the SHDD key is not set.
+
  If the flag is 0xFFFF, the SHDD seed is encrypted with the SHDD key from OTP.
 
|-
 
|-
 
| 0x0C6 (0x63 * 2) || 0x6A bytes || Reserved
 
| 0x0C6 (0x63 * 2) || 0x6A bytes || Reserved
Line 66: Line 59:  
| 0x140 (0xA0 * 2) || 0x40 bytes || [[#SysProd|SysProd]]
 
| 0x140 (0xA0 * 2) || 0x40 bytes || [[#SysProd|SysProd]]
 
|-
 
|-
−
| 0x180 (0xC0 * 2) || 0x02 bytes ||  
+
| 0x180 (0xC0 * 2) || 0x12 bytes || [[#ProdInfo|ProdInfo]]
−
|-
  −
| 0x182 (0xC1 * 2) || 0x02 bytes ||
  −
|-
  −
| 0x184 (0xC2 * 2) || 0x02 bytes ||
  −
|-
  −
| 0x186 (0xC3 * 2) || 0x02 bytes ||
  −
|-
  −
| 0x188 (0xC4 * 2) || 0x02 bytes || Production date (year)
  −
|-
  −
| 0x18A (0xC5 * 2) || 0x02 bytes || Production date (month and day)
  −
|-
  −
| 0x18C (0xC6 * 2) || 0x02 bytes || Production date (hour and minute)
  −
|-
  −
| 0x18E (0xC7 * 2) || 0x04 bytes || CRC32 of the last 0x0E bytes
   
|-
 
|-
 
| 0x192 (0xC9 * 2) || 0x02 bytes || Always 0xAA55
 
| 0x192 (0xC9 * 2) || 0x02 bytes || Always 0xAA55
Line 108: Line 87:  
| 0x1B4 (0xDA * 2) || 0x08 bytes ||  
 
| 0x1B4 (0xDA * 2) || 0x08 bytes ||  
 
|-
 
|-
−
| 0x1BC (0xDE * 2) || 0x04 bytes ||  
+
| 0x1BC (0xDE * 2) || 0x04 bytes || [[#StorageSize|StorageSize]]
 
|-
 
|-
−
| 0x1C0 (0xE0 * 2) || 0x30 bytes || [[#BootOsVer|BootOsVer]]
+
| 0x1C0 (0xE0 * 2) || 0x30 bytes || [[#BootParams|BootParams]]
 
|-
 
|-
 
| 0x1F0 (0xF8 * 2) || 0x10 bytes || Reserved
 
| 0x1F0 (0xF8 * 2) || 0x10 bytes || Reserved
 +
|}
 +
 +
== EspressoPackageInfo ==
 +
{| class="wikitable" border="1"
 +
|-
 +
! Offset || Size || Description
 +
|-
 +
| 0x0 || 0x4 || PpcPvr (0x70010201)
 +
|-
 +
| 0x4 || 0x6 || EspressoPackageId
 +
|-
 +
| 0xA || 0x2 ||
 +
|}
 +
 +
== LattePackageInfo ==
 +
{| class="wikitable" border="1"
 +
|-
 +
! Offset || Size || Description
 +
|-
 +
| 0x0 || 0x2 || LatteWaferX
 +
|-
 +
| 0x2 || 0x2 || LatteWaferY
 +
|-
 +
| 0x4 || 0x8 || [[Hardware/OTP#LattePackageId|LattePackageId]]
 
|}
 
|}
   Line 134: Line 137:  
| 0xE || 0x2 || [[#bootSource|bootSource]]
 
| 0xE || 0x2 || [[#bootSource|bootSource]]
 
|-
 
|-
−
| 0x10 || 0x2 || ddr3Size
+
| 0x10 || 0x2 || [[#ddr3Size|ddr3Size]]
 
|-
 
|-
 
| 0x12 || 0x2 || ddr3Speed
 
| 0x12 || 0x2 || ddr3Speed
Line 202: Line 205:  
| 0x5333
 
| 0x5333
 
| S3 (SDIO3)
 
| S3 (SDIO3)
 +
|}
 +
 +
=== ddr3Size ===
 +
{| class="wikitable"
 +
|-
 +
! Value
 +
! Description
 +
|-
 +
| 0x0800
 +
| 2GB (Production/Test)
 +
|-
 +
| 0x1000
 +
| 4GB (Development)
 
|}
 
|}
   Line 211: Line 227:  
|-
 
|-
 
| 0x5521
 
| 0x5521
−
| U! (Micron?)
+
| U!
 
|}
 
|}
   Line 239: Line 255:  
|-
 
|-
 
| 0x0007
 
| 0x0007
−
| GEN2-HDD (CAT-I with HDD)
+
| GEN2-HDD
 
|-
 
|-
 
| 0x0008
 
| 0x0008
−
| GEN1-HDD (CAT-I with HDD)
+
| GEN1-HDD
 
|}
 
|}
   Line 261: Line 277:  
|-
 
|-
 
| 0x0004
 
| 0x0004
−
| EV board
+
| EV board (Evaluation)
 
|-
 
|-
 
| 0x0005
 
| 0x0005
Line 288: Line 304:  
| 0x4 || 0x2 || eeprom_version
 
| 0x4 || 0x2 || eeprom_version
 
|-
 
|-
−
| 0x6 || 0x2 ||  
+
| 0x6 || 0x2 || Reserved
 
|-
 
|-
 
| 0x8 || 0x4 || game_region
 
| 0x8 || 0x4 || game_region
 
|-
 
|-
−
| 0xC || 0x4 ||  
+
| 0xC || 0x4 || Reserved
 
|-
 
|-
 
| 0x10 || 0x4 || ntsc_pal
 
| 0x10 || 0x4 || ntsc_pal
Line 304: Line 320:  
| 0x20 || 0xC || serial_id
 
| 0x20 || 0xC || serial_id
 
|-
 
|-
−
| 0x2C || 0x4 ||  
+
| 0x2C || 0x4 || Reserved
 
|-
 
|-
 
| 0x30 || 0x10 || model_number
 
| 0x30 || 0x10 || model_number
 
|}
 
|}
   −
== BootOsVer ==
+
== ProdInfo ==
 +
This 0x12-byte structure is only present in production/test units. For development units, this structure is left empty.
 +
 
 +
{| class="wikitable" border="1"
 +
|-
 +
! Offset || Size || Description
 +
|-
 +
| 0x0 || 0x4 || LotNumber
 +
|-
 +
| 0x4 || 0x4 || LotNumberEx (only available if [[#BoardConfig|boardRevision]] >= 0x0C)
 +
|-
 +
| 0x8 || 0x2 || ProdYear
 +
|-
 +
| 0xA || 0x2 || ProdMonthDay
 +
|-
 +
| 0xC || 0x2 || ProdHourMinute
 +
|-
 +
| 0xE || 0x4 || ProdInfoCrc (CRC32 over the previous 14 bytes)
 +
|}
 +
 
 +
== StorageSize ==
 +
{| class="wikitable"
 +
|-
 +
! Value
 +
! Description
 +
|-
 +
| 0x1000
 +
| 8GB (MLC)
 +
|-
 +
| 0x4000
 +
| 32GB (MLC)
 +
|-
 +
| 0x14000
 +
| 320GB (MION)
 +
|}
 +
 
 +
== BootParams ==
 
This 0x30-byte structure is AES-128-ECB encrypted with the SEEPROM key.
 
This 0x30-byte structure is AES-128-ECB encrypted with the SEEPROM key.
   Line 324: Line 376:  
| 0x8 || 0x4 || NandBank (value for overwriting the NAND_BANK register)
 
| 0x8 || 0x4 || NandBank (value for overwriting the NAND_BANK register)
 
|-
 
|-
−
| 0xC || 0x4 || ConfigCrc (CRC32 over the previous 12 bytes)
+
| 0xC || 0x4 || BootParamsCrc0 (CRC32 over the previous 12 bytes)
 
|-
 
|-
 
| 0x10 || 0x2 || Boot1Version0
 
| 0x10 || 0x2 || Boot1Version0
Line 332: Line 384:  
| 0x14 || 0x8 || Reserved
 
| 0x14 || 0x8 || Reserved
 
|-
 
|-
−
| 0x1C || 0x4 || Boot1Crc0 (CRC32 over the previous 12 bytes)
+
| 0x1C || 0x4 || BootParamsCrc1 (CRC32 over the previous 12 bytes)
 
|-
 
|-
 
| 0x20 || 0x2 || Boot1Version1
 
| 0x20 || 0x2 || Boot1Version1
Line 340: Line 392:  
| 0x24 || 0x8 || Reserved
 
| 0x24 || 0x8 || Reserved
 
|-
 
|-
−
| 0x2C || 0x4 || Boot1Crc1 (CRC32 over the previous 12 bytes)
+
| 0x2C || 0x4 || BootParamsCrc2 (CRC32 over the previous 12 bytes)
 
|}
 
|}
   Line 350: Line 402:  
|-
 
|-
 
| 0-9
 
| 0-9
−
| CPU speed in MHz used for delay calculations.
+
| CPU speed in MHz used for delay calculations
 
|-
 
|-
 
| 10-14
 
| 10-14
−
| Value for delaying before checking if the SD boot combo has been pressed.
+
| Value for delaying before checking if the SD boot combo has been pressed
 
|-
 
|-
 
| 15
 
| 15
−
| Causes 0x3 to be written to LT_IOP2X which increases the ARM CPU clock multiplier.
+
| Causes 0x3 to be written to LT_IOP2X which increases the ARM CPU clock multiplier
 
|}
 
|}
   Line 366: Line 418:  
|-
 
|-
 
| 0-7
 
| 0-7
−
| SD card clock divider.
+
| SD card clock divider
 
|-
 
|-
 
| 8-9
 
| 8-9
−
| Value for delaying before initializing the SD host controller.
+
| Value for delaying before initializing the SD host controller
 
|-
 
|-
 
| 10
 
| 10
−
| Enables SD card 4-bit bus through CMD55 (SD_APP_CMD) and CMD6 (SD_APP_SET_BUS_WIDTH).
+
| Enables SD card 4-bit bus through CMD55 (SD_APP_CMD) and CMD6 (SD_APP_SET_BUS_WIDTH)
 
|-
 
|-
 
| 11
 
| 11
−
| Enables using the supplied value for the SD card clock divider.
+
| Enables using the supplied value for the SD card clock divider
 
|-
 
|-
 
| 12
 
| 12
Line 381: Line 433:  
|-
 
|-
 
| 13
 
| 13
−
| Enables using the supplied value for overwriting NAND_BANK.
+
| Enables using the supplied value for overwriting NAND_BANK
 
|-
 
|-
 
| 14
 
| 14
−
| Enables using the supplied value for overwriting NAND_CONFIG.
+
| Enables using the supplied value for overwriting NAND_CONFIG
 
|-
 
|-
 
| 15
 
| 15
−
| Forces NAND to validate ECC data.
+
| Forces NAND to validate ECC data
 
|}
 
|}
    
[[Category:Hardware]]
 
[[Category:Hardware]]
Lazr
31

edits

Retrieved from "https://wiiubrew.org/wiki/Special:MobileDiff/3665...4080"