General
The Latte package contains a 93C66 (or similar) SPI EEPROM, organized as 256 16-bit words, making it twice the size of the EEPROM found in the Wii's Hollywood package. It is accessed by twiddling some of the Starbuck GPIO lines in the exact same way as it was done on the Wii's Starlet GPIO lines.
Contents
Most of the data here is only written once during manufacturing, but some fields are updated fairly frequently. Items listed as reserved are empty and not known to be used.
| Offset (word index * 2)
|
Size
|
Description
|
| 0x000 (0x00 * 2) |
0x12 bytes |
Reserved
|
| 0x012 (0x09 * 2) |
0x08 bytes |
RNG seed
This seed is incremented every time IOS-CRYPTO starts.
It is also combined with the OTP's RNG key and seed to setup the IOS-CRYPTO RNG functions.
|
| 0x01A (0x0D * 2) |
0x06 bytes |
Reserved
|
| 0x020 (0x10 * 2) |
0x0C bytes |
EspressoPackageInfo
|
| 0x02C (0x16 * 2) |
0x0C bytes |
LattePackageInfo
|
| 0x038 (0x1C * 2) |
0x48 bytes |
BoardConfig
|
| 0x080 (0x40 * 2) |
0x10 bytes |
Drive key
|
| 0x090 (0x48 * 2) |
0x10 bytes |
Factory key
This key is cleared by IOS-MCP.
|
| 0x0A0 (0x50 * 2) |
0x10 bytes |
SHDD seed
|
| 0x0B0 (0x58 * 2) |
0x10 bytes |
IVS seed
This seed is encrypted with the IVS key from OTP then used to set the /dev/crypto USB key.
The first 0x04 bytes of this key must match the Wii U device ID.
|
| 0x0C0 (0x60 * 2) |
0x02 bytes |
DriveConfig
If the flag is 0x0000, the drive key is unencrypted.
If the flag is 0xFFFE, the drive key is empty.
If the flag is 0xFFFF, the drive key is encrypted with the SEEPROM key.
|
| 0x0C2 (0x61 * 2) |
0x02 bytes |
IvsConfig
If the flag is 0x0010, real IVS should be used.
|
| 0x0C4 (0x62 * 2) |
0x02 bytes |
ShddConfig
If the flag is 0x0000, the SHDD seed is empty.
If the flag is 0xFFFF, the SHDD seed is encrypted with the SHDD key from OTP.
|
| 0x0C6 (0x63 * 2) |
0x6A bytes |
Reserved
|
| 0x130 (0x98 * 2) |
0x04 bytes |
|
| 0x134 (0x9A * 2) |
0x02 bytes |
|
| 0x136 (0x9B * 2) |
0x02 bytes |
|
| 0x138 (0x9C * 2) |
0x08 bytes |
Reserved
|
| 0x140 (0xA0 * 2) |
0x40 bytes |
SysProd
|
| 0x180 (0xC0 * 2) |
0x12 bytes |
ProdInfo
|
| 0x192 (0xC9 * 2) |
0x02 bytes |
Always 0xAA55
|
| 0x194 (0xCA * 2) |
0x02 bytes |
|
| 0x196 (0xCB * 2) |
0x02 bytes |
|
| 0x198 (0xCC * 2) |
0x02 bytes |
|
| 0x19A (0xCD * 2) |
0x04 bytes |
|
| 0x19E (0xCF * 2) |
0x04 bytes |
|
| 0x1A2 (0xD1 * 2) |
0x02 bytes |
Always 0xBB66
|
| 0x1A4 (0xD2 * 2) |
0x02 bytes |
|
| 0x1A6 (0xD3 * 2) |
0x02 bytes |
|
| 0x1A8 (0xD4 * 2) |
0x08 bytes |
|
| 0x1B0 (0xD8 * 2) |
0x02 bytes |
|
| 0x1B2 (0xD9 * 2) |
0x02 bytes |
|
| 0x1B4 (0xDA * 2) |
0x08 bytes |
|
| 0x1BC (0xDE * 2) |
0x04 bytes |
StorageSize
|
| 0x1C0 (0xE0 * 2) |
0x30 bytes |
BootParams
|
| 0x1F0 (0xF8 * 2) |
0x10 bytes |
Reserved
|
EspressoPackageInfo
| Offset |
Size |
Description
|
| 0x0 |
0x4 |
PpcPvr (0x70010201)
|
| 0x4 |
0x6 |
EspressoPackageId
|
| 0xA |
0x2 |
|
LattePackageInfo
| Offset |
Size |
Description
|
| 0x0 |
0x2 |
LatteWaferX
|
| 0x2 |
0x2 |
LatteWaferY
|
| 0x4 |
0x8 |
LattePackageId
|
BoardConfig
| Offset |
Size |
Description
|
| 0x0 |
0x4 |
crc
|
| 0x4 |
0x2 |
size
|
| 0x6 |
0x2 |
version
|
| 0x8 |
0x2 |
author
|
| 0xA |
0x2 |
boardType
|
| 0xC |
0x2 |
boardRevision
|
| 0xE |
0x2 |
bootSource
|
| 0x10 |
0x2 |
ddr3Size
|
| 0x12 |
0x2 |
ddr3Speed
|
| 0x14 |
0x2 |
ppcClockMultiplier
|
| 0x16 |
0x2 |
iopClockMultiplier
|
| 0x18 |
0x2 |
video1080p
|
| 0x1A |
0x2 |
ddr3Vendor
|
| 0x1C |
0x2 |
movPassiveReset
|
| 0x20 |
0x2 |
sysPllSpeed
|
| 0x22 |
0x2 |
sataDevice
|
| 0x24 |
0x2 |
consoleType
|
| 0x26 |
0x4 |
devicePresence
|
| 0x28 |
0x20 |
Reserved
|
author
| Value
|
Description
|
| 0x404D
|
@M (Atmel?)
|
boardType
| Value
|
Description
|
| 0x4346
|
CF (CAFE: Production/Test)
|
| 0x4354
|
CT (CAT: Development)
|
| 0x4556
|
EV (EV: Evaluation)
|
| 0x4944
|
ID (WUIH_DEV)
|
| 0x4948
|
IH (WUIH)
|
bootSource
| Value
|
Description
|
| 0x4E31
|
N1 (NAND1)
|
| 0x5333
|
S3 (SDIO3)
|
ddr3Size
| Value
|
Description
|
| 0x0800
|
2GB (Production/Test)
|
| 0x1000
|
4GB (Development)
|
ddr3Vendor
| Value
|
Description
|
| 0x5521
|
U! (Micron?)
|
sataDevice
| Value
|
Description
|
| 0x0001
|
Default
|
| 0x0002
|
No device
|
| 0x0003
|
ROM drive (Production)
|
| 0x0004
|
R drive (CAT-R/CAT-I)
|
| 0x0005
|
MION (CAT-DEV)
|
| 0x0006
|
SES (CAT-SES)
|
| 0x0007
|
GEN2-HDD
|
| 0x0008
|
GEN1-HDD
|
consoleType
| Value
|
Description
|
| 0x0001
|
WUP (Production)
|
| 0x0002
|
CAT-R (Test)
|
| 0x0003
|
CAT-DEV (Development)
|
| 0x0004
|
EV board (Evaluation)
|
| 0x0005
|
Promotion (CAT-I/CAT-SES)
|
| 0x0006
|
OrchestraX
|
| 0x0007
|
WUIH
|
| 0x0008
|
WUIH_DEV
|
| 0x0009
|
CAT_DEV_WUIH
|
SysProd
| Offset |
Size |
Description
|
| 0x0 |
0x4 |
product_area
|
| 0x4 |
0x2 |
eeprom_version
|
| 0x6 |
0x2 |
Reserved
|
| 0x8 |
0x4 |
game_region
|
| 0xC |
0x4 |
Reserved
|
| 0x10 |
0x4 |
ntsc_pal
|
| 0x14 |
0x3 |
5ghz_country_code
|
| 0x17 |
0x1 |
5ghz_country_code_revision
|
| 0x18 |
0x8 |
code_id
|
| 0x20 |
0xC |
serial_id
|
| 0x2C |
0x4 |
Reserved
|
| 0x30 |
0x10 |
model_number
|
ProdInfo
This 0x12-byte structure is only present in production/test units. For development units, this structure is left empty.
| Offset |
Size |
Description
|
| 0x0 |
0x4 |
LotNumber
|
| 0x4 |
0x4 |
LotNumberEx (only available if boardRevision >= 0x0C)
|
| 0x8 |
0x2 |
ProdYear
|
| 0xA |
0x2 |
ProdMonthDay
|
| 0xC |
0x2 |
ProdHourMinute
|
| 0xE |
0x4 |
ProdInfoCrc (CRC32 over the previous 14 bytes)
|
StorageSize
| Value
|
Description
|
| 0x1000
|
8GB (MLC)
|
| 0x4000
|
32GB (MLC)
|
| 0x14000
|
320GB (MION)
|
BootParams
This 0x30-byte structure is AES-128-ECB encrypted with the SEEPROM key.
| Offset |
Size |
Description
|
| 0x0 |
0x2 |
MiscConfig
|
| 0x2 |
0x2 |
BootConfig
|
| 0x4 |
0x4 |
NandConfig (value for overwriting the NAND_CONFIG register)
|
| 0x8 |
0x4 |
NandBank (value for overwriting the NAND_BANK register)
|
| 0xC |
0x4 |
BootParamsCrc0 (CRC32 over the previous 12 bytes)
|
| 0x10 |
0x2 |
Boot1Version0
|
| 0x12 |
0x2 |
Boot1Sector0 (default: 0x1000 => 0x40000 pages = NAND bank 1, byte offset 0x0)
|
| 0x14 |
0x8 |
Reserved
|
| 0x1C |
0x4 |
BootParamsCrc1 (CRC32 over the previous 12 bytes)
|
| 0x20 |
0x2 |
Boot1Version1
|
| 0x22 |
0x2 |
Boot1Sector1 (default: 0x1001 => 0x40040 pages = NAND bank 1, byte offset 0x21000)
|
| 0x24 |
0x8 |
Reserved
|
| 0x2C |
0x4 |
BootParamsCrc2 (CRC32 over the previous 12 bytes)
|
MiscConfig
| Bits
|
Description
|
| 0-9
|
CPU speed in MHz used for delay calculations
|
| 10-14
|
Value for delaying before checking if the SD boot combo has been pressed
|
| 15
|
Causes 0x3 to be written to LT_IOP2X which increases the ARM CPU clock multiplier
|
BootConfig
| Bits
|
Description
|
| 0-7
|
SD card clock divider
|
| 8-9
|
Value for delaying before initializing the SD host controller
|
| 10
|
Enables SD card 4-bit bus through CMD55 (SD_APP_CMD) and CMD6 (SD_APP_SET_BUS_WIDTH)
|
| 11
|
Enables using the supplied value for the SD card clock divider
|
| 12
|
|
| 13
|
Enables using the supplied value for overwriting NAND_BANK
|
| 14
|
Enables using the supplied value for overwriting NAND_CONFIG
|
| 15
|
Forces NAND to validate ECC data
|