Difference between revisions of "Hardware/OTP"
| Line 6: | Line 6: | ||
| bits = 32 | | bits = 32 | ||
}} | }} | ||
| − | {| border="1" | + | |
| − | ! | + | == General == |
| + | The '''o'''ne '''t'''ime '''p'''rogrammable memory is used to store 32 4byte words. It is programmed sometimes during the factory process and can never be changed afterwards. Next to the Wii's shared and public keys it also contains a random number generation seed and the boot1 hash which basically makes it impossible for us to change boot1. | ||
| + | |||
| + | == Register List == | ||
| + | {{reglist|Hollywood GPIOs}} | ||
| + | {{rla|0x0d8001ec|32|HW_OTP_COMMAND|OTP command}} | ||
| + | {{rla|0x0d8001f0|32|HW_OTP_DATA|OTP data}} | ||
| + | |} | ||
| + | |||
| + | == Register descriptions == | ||
| + | {{regsimple|HW_OTP_COMMAND|addr=0x0d8001ec|bits=32|access=R/W}} | ||
| + | This register contains the command sent to the OTP. Reading data is 0x8000_00aa where aa is the address of the 4byte word you want to read. It is unknown whether is register is also used during the factory process to program the OTP. | ||
| + | |||
| + | ---- | ||
| + | {{regsimple|HW_OTP_DATA|addr=0x0d8001f0|bits=32|access=R/W}} | ||
| + | This register contains the output data for the last issued OTP command. Changes of the HW_OTP_COMMAND register directly change this register without any delays. | ||
| + | ---- | ||
| + | |||
| + | == OTP Contents == | ||
| + | The following things are stored inside the OTP: | ||
| + | {| style="border: 1px solid #bbb; border-collapse: collapse; background-color: #eef; padding: 0.2em 0.2em 0.2em 0.2em;" border="1" cellpadding="2" | ||
| + | |- style="background-color: #ddd;" | ||
| + | ! Address | ||
| + | ! Description | ||
|- | |- | ||
| − | || | + | | 0-4 || Boot1 hash |
|- | |- | ||
| − | | | + | | 5-8 || common key |
|- | |- | ||
| − | || | + | | 9 || NG id |
|- | |- | ||
| − | || | + | | a-10 || NG private key |
|- | |- | ||
| − | || | + | | 11-15 || NAND HMAC |
|- | |- | ||
| − | || | + | | 16-19 || NAND key |
|- | |- | ||
| − | || | + | | 1a-1d || RNG key |
|- | |- | ||
| − | || | + | | 1e-1f || Unknown |
|- | |- | ||
| − | |||
|} | |} | ||
{{hwstub}} | {{hwstub}} | ||
Revision as of 12:10, 28 February 2009
| OTP | |
| Hollywood Registers | |
| Access | |
|---|---|
| Broadway | None |
| Starlet | Full |
| Registers | |
| Base | 0x0d8001ec |
| Length | 0x8 |
| Access size | 32 bits |
| Byte order | Big Endian |
General
The one time programmable memory is used to store 32 4byte words. It is programmed sometimes during the factory process and can never be changed afterwards. Next to the Wii's shared and public keys it also contains a random number generation seed and the boot1 hash which basically makes it impossible for us to change boot1.
Register List
| Hollywood GPIOs | |||
|---|---|---|---|
| Address | Bits | Name | Description |
| 0x0d8001ec | 32 | HW_OTP_COMMAND | OTP command |
| 0x0d8001f0 | 32 | HW_OTP_DATA | OTP data |
Register descriptions
| HW_OTP_COMMAND (0x0d8001ec) | |
| 310 | |
| Access | R/W |
This register contains the command sent to the OTP. Reading data is 0x8000_00aa where aa is the address of the 4byte word you want to read. It is unknown whether is register is also used during the factory process to program the OTP.
| HW_OTP_DATA (0x0d8001f0) | |
| 310 | |
| Access | R/W |
This register contains the output data for the last issued OTP command. Changes of the HW_OTP_COMMAND register directly change this register without any delays.
OTP Contents
The following things are stored inside the OTP:
| Address | Description |
|---|---|
| 0-4 | Boot1 hash |
| 5-8 | common key |
| 9 | NG id |
| a-10 | NG private key |
| 11-15 | NAND HMAC |
| 16-19 | NAND key |
| 1a-1d | RNG key |
| 1e-1f | Unknown |
| This Hardware-related article is a stub. You can help WiiBrew by expanding it. |