Difference between revisions of "Hardware/SEEPROM"

From WiiBrew
Jump to navigation Jump to search
(added nfoz)
 
m (Typo)
 
(7 intermediate revisions by 4 users not shown)
Line 1: Line 1:
The Hollywood package contains a [http://www.atmel.com/dyn/resources/prod_documents/doc0172.pdf 93C56] (or similar) SPI EEPROM, organized as 128 16-byte words. It is accessed by twiddling some of the Starlet GPIO lines.   Most of the data here is written once at the factory and never changed, but some fields are updated fairly frequently.
+
[[File:Wii_eep_10x.jpg|thumb|93C56 Serial EEPROM|Photo courtesy of Flylogic]]
 +
The Hollywood package contains a [http://www.atmel.com/Images/doc0172Z.pdf 93C56] (or similar) SPI EEPROM, organized as 128 16-bit words. It is accessed by twiddling some of the Starlet GPIO lines. Most of the data here is written once at the factory and never changed, but some fields are updated fairly frequently.
  
 
                 struct {
 
                 struct {
                         u32 ms_id;
+
                         u32 ms_id;             // 0x00
                         u32 ca_id;
+
                         u32 ca_id;             // 0x04
                         u32 ng_id;
+
                         u32 ng_key_id;         // 0x08
                         u8 ng_sig[60];  
+
                         u8 ng_sig[60];         // 0x0C
                         u16 counters[5];
+
                         struct {              // 0x48
                         u16 fill[5];
+
                                union {
                         u16 counters2[3];
+
                                      struct {
                         u8 korean_key[16];
+
                                              u8 boot2version;
 +
                                              u8 unknown1;
 +
                                              u8 unknown2;
 +
                                              u8 pad;
 +
                                              u32 update_tag;
 +
                                      } __attribute__((packed));
 +
                                      u16 data[4];
 +
                                };
 +
                                u16 checksum; // sum of data[] elements?
 +
                        } boot2_counters[2];
 +
                         struct {
 +
                                union {
 +
                                      u32 nand_gen; // matches offset 0x8 in nand SFFS blocks
 +
                                      u16 data[2];
 +
                                } __attribute__((packed));
 +
                                u16 checksum; // sum of data[] elements?
 +
                         } nand_counters[3]; // current slot rotates on each write
 +
                        u8 pad0[6];            // 0x6E
 +
                         u8 korean_key[16];     // 0x74
 +
                        u8 pad1[116];          // 0x84
 +
                        u16 prng_seed[2];      // 0xF8 u32 with lo word stored first, incremented every time IOS starts.
 +
                                              // Used with the PRNG key to setup IOS's PRNG (syscalls 73/74 etc.)
 +
                        u8 pad2[4];            // 0xFC
 
                 };
 
                 };
    fixme: there should be a checksum and a SFFS generation number in here somewhere, too
+
{{check}}

Latest revision as of 18:44, 21 March 2018

Photo courtesy of Flylogic

The Hollywood package contains a 93C56 (or similar) SPI EEPROM, organized as 128 16-bit words. It is accessed by twiddling some of the Starlet GPIO lines. Most of the data here is written once at the factory and never changed, but some fields are updated fairly frequently.

               struct {
                       u32 ms_id;             // 0x00
                       u32 ca_id;             // 0x04
                       u32 ng_key_id;         // 0x08
                       u8 ng_sig[60];         // 0x0C
                       struct {               // 0x48
                               union {
                                      struct {
                                             u8 boot2version;
                                             u8 unknown1;
                                             u8 unknown2;
                                             u8 pad;
                                             u32 update_tag;
                                      } __attribute__((packed));
                                      u16 data[4];
                               };
                               u16 checksum; // sum of data[] elements?
                       } boot2_counters[2];
                       struct {
                               union {
                                      u32 nand_gen; // matches offset 0x8 in nand SFFS blocks
                                      u16 data[2];
                               } __attribute__((packed));
                               u16 checksum; // sum of data[] elements?
                       } nand_counters[3]; // current slot rotates on each write
                       u8 pad0[6];            // 0x6E
                       u8 korean_key[16];     // 0x74
                       u8 pad1[116];          // 0x84
                       u16 prng_seed[2];      // 0xF8 u32 with lo word stored first, incremented every time IOS starts.
                                              // Used with the PRNG key to setup IOS's PRNG (syscalls 73/74 etc.)
                       u8 pad2[4];            // 0xFC
               };

[check]