HAI-IOS

HAI-IOS (sometimes also called IOS255) is a heavily modified IOS used for the WiiMode in HAI mode. It is bundled individually with each HAI title as a giant ELF file containing every IOS module.

Modules

Most modules are very similar to the modules found in normal IOS versions. There are some exceptions listed below.

DI2SD

This replaces the DI module. DVD commands sent to /dev/di are emulated, and disc content is read from either MLC or UMS (using /dev/usb/msc).

OHCI1

This is a modified version of the OHCI1 module which handles communicating with the GamePad. It emulates HCI to handle virtual Bluetooth controllers which can be controlled with the GamePad.

SDI

This modified SDI module adds /dev/sdio/MLC01 to allow reading and writing to the MLC, which is used by DI2SD.

Hai params

The Wii U mode passes some parameters to this IOS which are referred to as "HaiParam" or "Hai params" (see HAI mode).

Format

These parameters are stored in memory at 0xfffff000 and their format is described below.

Header

Start	Length	Description
0x00	4	Magic value: "Hai" (0x48616900)
0x04	2	Total size of the parameters (including header) in bytes
0x06	2	Parameter count

The parameters follow after the header.

Parameter

Start	Length	Description
0x00	2	ID (see table below)
0x02	2	Size of parameter data in bytes

The parameter data follows after the structure described above.

Parameter IDs

ID	Description
0x0	Ticket of the title to boot
0x1	TMD of the title to boot
0x100	This is a string in the following format: target:/path. Where target is either mlc, usb, ahci or file and path is the path to the imginf.bin file containing offsets to the nfs files (usually /shared2/sys/hai/imginf.bin on the slccmpt).
0x101	DI2SD "umsblk devId" (0x10 bytes)
0x200	DI2SD "keep-alive" (4 byte integer which is either 0 or 1)
0x201	APD (Auto Power Down) seconds (4 byte integer)
0x300	DRC controller on or off (1 byte which is always set to 1 by the IOSU)

Syscall 7A

To retrieve these parameters HAI-IOS has an additional syscall in the following format: IOSError syscall_7a(u16 id, void *data, u32 *size).

Companion File

The Companion file usually /shared2/sys/hai/imginf.bin on the slccmpt contains the information about the extends of the nfs files.

Format

The companion file starts with a 8 byte header, followed by a variable number of extends and ends with a 1 byte footer

Header

The companion file starts with a 8 byte header

Start	Length	Description	Example
0x00	4	Number of extends	1
0x04	2	Address Unit Base	0x13
0x06	2	Seems to be ignored by HAI-IOS, but had same value as the Address Base Unit	0x13

The Address Unit is obtained by raising 2 to the power of the address unit base: pow(2,address_unit_base) or just 1<<address_unit_base

Extends

The header is followed by the Array of Extends The format of one extend is:

Start	Length	Description	Example
0x00	4	Start Address	0x0000a575
0x04	4	Length	0x00000684

The start address and length of an extend needs to be multiplied by the address unit obtained from the header to obtain the byte address, which can be divided by the lba size to obtain the lba address:

start_lba = start_address * pow(2,address_unit_base) / lba_size

Footer

The extends are followed by one byte with varying values, which is also ignored by HAI-IOS