Difference between revisions of "Hardware/NAND"

From WiiBrew
Jump to navigation Jump to search
(Undo revision 8118 by ProdigySim (Talk) - Actually, it was almost right -- the intention was "Mebibytes", abbreviated MiB.)
Line 23: Line 23:
 
  Samsung: ec 76 / ec f1 / ec da / ec dc (64M [http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=158&partnum=K9F1208U0C K9F1208U0C] /128 [http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=159&partnum=K9F1G08U0B K9F1G08U0B]/256 [http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=159&partnum=K9F2G08U0A K9F2G08U0A]/512 = [http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=159&partnum=K9F4G08U0A K9F4G08U0A])
 
  Samsung: ec 76 / ec f1 / ec da / ec dc (64M [http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=158&partnum=K9F1208U0C K9F1208U0C] /128 [http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=159&partnum=K9F1G08U0B K9F1G08U0B]/256 [http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=159&partnum=K9F2G08U0A K9F2G08U0A]/512 = [http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=159&partnum=K9F4G08U0A K9F4G08U0A])
 
  Toshiba: 98 76 / 98 f1 / 98 da (64/128 = TC58NVG0S3AFT05 or TC58NVG0S3ATG05 or TC58NVG0S3BFT00/256 = TC58NVG1D4BTG00 (?!))
 
  Toshiba: 98 76 / 98 f1 / 98 da (64/128 = TC58NVG0S3AFT05 or TC58NVG0S3ATG05 or TC58NVG0S3BFT00/256 = TC58NVG1D4BTG00 (?!))
 +
 +
 +
<H2>Files and data structure in NAND Flash</H2><BR>
 +
\SHARED2\MENU\FACELIB\RFL_DB.DAT = MII database, contains all users MII's<BR>
 +
\SHARED2\SYS\NET\DHCP.DAT = IP address, netmask, DNS information from DHCP (if used)<BR>
 +
\SHARED2\SYS\NET\02\CONFIG.DAT = WiFI config, WiFi keys are stored as plaintext in this file.<BR>
 +
\SHARED2\TEST2\NANDERR.LOG = wearleveling/badsector map for NAND flash<BR>
 +
\SHARED2\WC24\NWC24DL.BIN = URLS/configs for channels, weather and so on<BR>
 +
\SHARED2\WC24\NWC24FL.BIN = Addressbook/FriendList<BR>
 +
\SHARED2\WC24\MBOX\WC24RECV.MBX = mailbox, received messages<BR>
 +
\SHARED2\WC24\MBOX\WC24SEND.MBX = mailbox, sent messages<BR>
 +
\META\00010002\48414141\TITLE.MET = PhotoChannel, HAAA<BR>
 +
\META\00010002\48414241\TITLE.MET = ShoppingChannel, HABA<BR>
 +
\META\00010002\48414341\TITLE.MET = MiiChannel, HACA<BR>
 +
\META\00010002\48414641\TITLE.MET = ForcastChannel, HAFA<BR>
 +
\META\00010002\48414741\TITLE.MET = NewsChannel, HAGA<BR>

Revision as of 22:56, 19 April 2008

The Wii contains 512 MiB of NAND flash storage, which is used to store "system software", channels (including Virtual Console titles), game saves, and system settings.

The NAND flash device is divided into 4096 blocks of 64 pages. Each page is 2048 bytes of data and 64 bytes of "spare data" (used for ECC and some metadata).

  • Pages 0-0x3F: boot1
    • boot1 is the second-stage bootloader; it is decrypted by boot0, which resides on a mask rom inside the Starlet coprocessor. Its primary function is to load and decrypt boot2.
  • Pages 0x40 - 0x89: boot2 (first copy)
  • Pages 0x8a - 0x17f: unused (unformatted)
  • Pages 0x140 - 0x189 : boot2 (second copy)
  • Pages 0x18a - 0x1bf: unused (unformatted)
    • boot2 is the third-stage bootloader; it is stored in a modified WAD format, including a ticket that is encrypted with the common key and signed.
  • Pages 0x1c0 - 0x1ff: ?
  • Page 0x200: beginning of per-console unique data
  • Pages 0x200-0x3f7ff: Encrypted filesystem data. Data is encrypted with a per-console AES key, and then signed with a (separate, per-console) HMAC key.
  • Pages 0x3F800 - 0x40000: Filesystem metadata (SFFS, unencrypted). There are 16 superblocks contained therein -- one every 0x80 pages.

The NAND flash driver inside boot2 and IOS supports the following chip IDs:

Hynix: ad 76 / ad f1 / ad dc  (64MB = HY27US0812(1/2)B, 128MB = HY27UF081G2A, 512MB = HY27UF084G2M or HY27UG084G2M)
Samsung: ec 76 / ec f1 / ec da / ec dc (64M K9F1208U0C /128 K9F1G08U0B/256 K9F2G08U0A/512 = K9F4G08U0A)
Toshiba: 98 76 / 98 f1 / 98 da (64/128 = TC58NVG0S3AFT05 or TC58NVG0S3ATG05 or TC58NVG0S3BFT00/256 = TC58NVG1D4BTG00 (?!))


Files and data structure in NAND Flash


\SHARED2\MENU\FACELIB\RFL_DB.DAT = MII database, contains all users MII's
\SHARED2\SYS\NET\DHCP.DAT = IP address, netmask, DNS information from DHCP (if used)
\SHARED2\SYS\NET\02\CONFIG.DAT = WiFI config, WiFi keys are stored as plaintext in this file.
\SHARED2\TEST2\NANDERR.LOG = wearleveling/badsector map for NAND flash
\SHARED2\WC24\NWC24DL.BIN = URLS/configs for channels, weather and so on
\SHARED2\WC24\NWC24FL.BIN = Addressbook/FriendList
\SHARED2\WC24\MBOX\WC24RECV.MBX = mailbox, received messages
\SHARED2\WC24\MBOX\WC24SEND.MBX = mailbox, sent messages
\META\00010002\48414141\TITLE.MET = PhotoChannel, HAAA
\META\00010002\48414241\TITLE.MET = ShoppingChannel, HABA
\META\00010002\48414341\TITLE.MET = MiiChannel, HACA
\META\00010002\48414641\TITLE.MET = ForcastChannel, HAFA
\META\00010002\48414741\TITLE.MET = NewsChannel, HAGA