Difference between revisions of "Boot process"
(not entirely sure this clarifies things...) |
Hallowizer (talk | contribs) (Security section and destubbed) |
||
| Line 1: | Line 1: | ||
The Wii has two processors -- an ARM core (inside the Hollywood, known as "[[Starlet]]") and a PowerPC (Broadway). The boot process starts on the ARM, which eventually bootstraps the PPC. | The Wii has two processors -- an ARM core (inside the Hollywood, known as "[[Starlet]]") and a PowerPC (Broadway). The boot process starts on the ARM, which eventually bootstraps the PPC. | ||
| − | The code components involved in the Wii's boot process are, in order: | + | The code components involved in the [[Wii]]'s boot process are, in order: |
* (ARM) [[boot0]] A mask ROM (1.5K) which loads boot1 and verifies its SHA1 hash against that stored in [[Hardware/OTP|OTP]]. If there is a mismatch, the system will halt. | * (ARM) [[boot0]] A mask ROM (1.5K) which loads boot1 and verifies its SHA1 hash against that stored in [[Hardware/OTP|OTP]]. If there is a mismatch, the system will halt. | ||
| Line 8: | Line 8: | ||
* (ARM) [[IOS]] sees its being booted thanks to the (lowmen?) writes of [[boot2]] and bootstraps the PPC to start the [[System Menu]] title (1-2). | * (ARM) [[IOS]] sees its being booted thanks to the (lowmen?) writes of [[boot2]] and bootstraps the PPC to start the [[System Menu]] title (1-2). | ||
* (PPC) [[System Menu]] The System Menu is the first visible user interface since it is the first code running on the PowerPC. It has higher access privileges compared to games (e.g. it can read and write to every savegame). Its signature is only checked upon installation. [[boot2]] only makes sure that the HMAC signatures on the NAND's filesystem are valid. | * (PPC) [[System Menu]] The System Menu is the first visible user interface since it is the first code running on the PowerPC. It has higher access privileges compared to games (e.g. it can read and write to every savegame). Its signature is only checked upon installation. [[boot2]] only makes sure that the HMAC signatures on the NAND's filesystem are valid. | ||
| − | + | ||
| + | == Security == | ||
| + | Because boot0 is in ROM, it cannot be modified, creating a trusted startup. Because of the boot1 verification against OTP, boot1 also cannot be modified. boot0 writes the hash to OTP if the boot1 hash is not programmed, so boot1 can be changed in the factory at any time. The first security hole occurs when boot2 is loaded, as older versions of boot1 have the [[signing bug]], allowing certain modified versions of boot2 to be loaded. Because boot1 cannot be modified after the Wii has booted once, this left a number of vulnerable Wiis. Like most titles, however, IOS and the System Menu are not checked for signatures on launch, so they can be modified without bricking the Wii, which is done by a [[cIOS]] or [[Priiloader]] respectively. | ||
Revision as of 01:32, 3 March 2021
The Wii has two processors -- an ARM core (inside the Hollywood, known as "Starlet") and a PowerPC (Broadway). The boot process starts on the ARM, which eventually bootstraps the PPC.
The code components involved in the Wii's boot process are, in order:
- (ARM) boot0 A mask ROM (1.5K) which loads boot1 and verifies its SHA1 hash against that stored in OTP. If there is a mismatch, the system will halt.
- (ARM) boot1 Lives in the first block of NAND; loads one of two copies of boot2 from blocks 1-7 of NAND and verifies it using RSA / SHA1.
- (ARM) boot2 A stripped-down version of IOS. It reads the NAND filesystem to load the System Menu's IOS
- (ARM) IOS sees its being booted thanks to the (lowmen?) writes of boot2 and bootstraps the PPC to start the System Menu title (1-2).
- (PPC) System Menu The System Menu is the first visible user interface since it is the first code running on the PowerPC. It has higher access privileges compared to games (e.g. it can read and write to every savegame). Its signature is only checked upon installation. boot2 only makes sure that the HMAC signatures on the NAND's filesystem are valid.
Security
Because boot0 is in ROM, it cannot be modified, creating a trusted startup. Because of the boot1 verification against OTP, boot1 also cannot be modified. boot0 writes the hash to OTP if the boot1 hash is not programmed, so boot1 can be changed in the factory at any time. The first security hole occurs when boot2 is loaded, as older versions of boot1 have the signing bug, allowing certain modified versions of boot2 to be loaded. Because boot1 cannot be modified after the Wii has booted once, this left a number of vulnerable Wiis. Like most titles, however, IOS and the System Menu are not checked for signatures on launch, so they can be modified without bricking the Wii, which is done by a cIOS or Priiloader respectively.