Boot images (unofficially known as "ancast images") are encrypted and signed binaries for the Espresso and Starbuck processors to execute.
The Espresso contains a secure boot ROM that runs upon a PowerPC hard reset, which will only boot signed code. This code comes in the form of a boot image. Before resetting the PPC, the currently running ARM code (either IOSU or vWii IOS) must load the boot image to the physical address 0x8000000 (Wii U images) or 0x1330000 (vWii images) for the boot ROM to verify and decrypt. The Cafe OS kernel, vWii System Menu, and BC-NAND/BC-WFS are all in the form of boot images; WiiMode images are stored inside a DOL in Data0, while Text0 contains a standard boot stub that was probably automatically added by Nintendo's compiling software.
The Starbuck's boot chain (boot0 and boot1) only boots signed code in the form of a boot image as well. On the ARM side, the IOS-MCP module is responsible for launching cafe2wii and relaunching IOSU (warm boot). IOS-MCP loads ARM boot images into MEM1 (0x1000000), verifies and decrypts them before executing with full privileges (all memory protections are disabled and must be re-enabled by the binary itself).
Structure
| Offset |
Size |
Description
|
| 0x0 |
0x4 |
Magic (0xEFA282D9)
|
| 0x4 |
0x4 |
Reserved
|
| 0x8 |
0x4 |
BootImageSignatureOffset (0x20)
|
| 0xC |
0x4 |
Reserved
|
| 0x10 |
0x10 |
Reserved
|
| 0x20 |
0x80 or 0x180 |
BootImageSignature1 (ESP) or BootImageSignature2 (IOP)
|
| 0xA0 or 0x1A0 |
0x60 |
BootImageInformation
|
| 0x100 or 0x200 |
Variable |
Image (AES-128-CBC encrypted)
|
BootImageSignature1
| Offset |
Size |
Description
|
| 0x0 |
0x4 |
SignatureType
|
| 0x4 |
0x38 |
Signature
|
| 0x3C |
0x4 |
Padding (must be empty)
|
| 0x40 |
0x40 |
Issuer (must be empty)
|
BootImageSignature2
| Offset |
Size |
Description
|
| 0x0 |
0x4 |
SignatureType
|
| 0x4 |
0x100 |
Signature
|
| 0x104 |
0x3C |
Padding (must be empty)
|
| 0x140 |
0x40 |
Issuer (must be empty)
|
BootImageInformation
| Offset |
Size |
Description
|
| 0x0 |
0x1 |
Version (must be empty)
|
| 0x1 |
0x1 |
CrlVersion (must be empty)
|
| 0x2 |
0x2 |
Padding0 (must be empty)
|
| 0x4 |
0x4 |
Type
|
| 0x8 |
0x4 |
Key
|
| 0xC |
0x4 |
ImageSize
|
| 0x10 |
0x14 |
ImageHash
|
| 0x24 |
0x4 |
ImageVersion
|
| 0x28 |
0x38 |
Padding1 (must be empty)
|
BootImageSignatureType
| Value
|
Description
|
| 0x1
|
SIGNATURE_TYPE_ECDSA_224
|
| 0x2
|
SIGNATURE_TYPE_RSA_2048
|
BootImageType
| Value
|
Description
|
| 0x10
|
BOOTIMAGE_TYPE_ESP
|
| 0x11
|
BOOTIMAGE_TYPE_ESP_CAFE
|
| 0x12
|
BOOTIMAGE_TYPE_ESP_RVLHD
|
| 0x13
|
BOOTIMAGE_TYPE_ESP_RVL
|
| 0x14
|
BOOTIMAGE_TYPE_ESP_RMA
|
| 0x20
|
BOOTIMAGE_TYPE_IOP
|
| 0x21
|
BOOTIMAGE_TYPE_IOP_NAND
|
| 0x22
|
BOOTIMAGE_TYPE_IOP_SD
|
| 0x23
|
BOOTIMAGE_TYPE_IOP_DI
|
Type 0x12 is dependent on the Espresso's HID1 special-purpose register having bit28 set, as well as the PPC being in vWii mode.
Type 0x14 is implied to only able to be used on Wii Us with a PpcPvr value where the upper u16 != 0x7001, and the lower u16 >0x100. The prerequisite flags can be triggered on retail units by first writing 0x2 to the lower nibble of LT_PIMEMCOMPAT, and then asserting SRESET just after a normal (0x11) boot image has finished verifying on the Espresso. A second uploaded boot image (written to RAM while SRESET is held asserted) will only verify if the type is 0x14. Type 0x14 boot images will always use retail ECC keys to verify, even on unfused units.
BootImageRootSelect
| Value
|
Description
|
| 0x1
|
BOOTIMAGE_ROOT_SELECT_DEV
|
| 0x2
|
BOOTIMAGE_ROOT_SELECT_PROD
|