Difference between revisions of "Boot1"
m (Unbolded the bold stuff that didn’t need to be bold.)
(→boot1 error codes: error 11 is bad TMD not ticket)
|Line 36:||Line 36:|
| (for boot2)
Revision as of 20:39, 24 November 2021
boot1 is the second stage loader for the Wii. It is loaded by boot0, which is stored inside a Mask ROM inside the Hollywood. boot1 is contained inside the first block of NAND flash and encrypted with a key stored in the Mask ROM as part of boot0. As part of the boot process, boot0 will decrypt and hash boot1, and then compare it to a SHA1 hash stored in on-die OTP memory; if they do not match, then boot1 will not be executed. This means that any attempt to modify boot1 on a Wii will cause it to fail to boot.
There is a hard limit on the size of boot1: 48 pages of 2K each, or 96K. Of that, approximately 17K is actually used.
boot1 runs entirely out of on-die SRAM and performs initialization of the external DDR3 memory. It then loads boot2 (from a special partition in NAND), decrypts it and performs an RSA verification on it. Splitting the first part of the bootloader into boot0 and boot1 allows Nintendo to change RAM chips and also to fix bugs in RSA verification without respinning the Starlet core; at least 5 known versions of boot1 exist, most of which only differ in small ways in the DDR3 initialization code.
boot1 will detect an attempt to downgrade boot2, comparing the version number of the TMD in flash against a value store in the serial EEPROM. If the value in flash is less than that in EEPROM, it will fail to boot with error 10.
boot1 error codes
|4||Misc error (valid blockmap not found)|
|5||Header error (length is not 0x20, or offset to data start is > 0x20000, or data start is not aligned to 64-byte boundary|
|8||RSA signature failure|
|9||Wrong key (CP used to sign ticket, etc)|
|10||EEPROM error (failure reading data from EEPROM, or EEPROM shows newer version of boot2 required)|
|11||TMD does not have title ID 1-1 (ID for boot2)|
Unfortunately, there is no build date encoded in boot1 anywhere, nor a version number. The labels have been chosen more or less in the order they were seen, and are just used as a shorthand when discussing different versions. (Feel free to add info on the differences between each version, as well as when each was first seen)
||Seen on some early Wiis; not very common|
||Most common version on launch-day Wiis|
||first version with fixed strncmp bug; first seen in 2008 (?)|
||Seemly the last publicly released Boot1 version. The Wii Mini uses this version too.|
For comparison, here is the version history of BC, which is very similar to boot1:
|version||length||build tag / date||notes|
|0||0x41be||Aug 11, 2006*||corresponds with boot1a?|
|1||0x412a||Sep 2, 2006*||corresponds with boot1b?|
|4||0x4d8c||bc.0803040819||corresponds with boot1c?|
|6||0x502c||bc.0908240243||corresponds with boot1d?|
- No build tags are included with early versions of BC, so approximate dates are listed from corresponding MIOS. These dates are likely very close (If not identical) to the actual BC build dates.