Hardware/OTP

OTP
Access
Broadway	None
Starlet	Full
Registers
Base	0x0d8001ec
Length	0x8
Access size	32 bits
Byte order	Big Endian

General

The one time programmable memory is used to store 32 4byte words. It is programmed sometimes during the factory process and can never be changed afterwards. Next to the Wii's shared and public keys it also contains a random number generation seed and the boot1 hash which basically makes it impossible for us to change boot1.

Register List

Hollywood GPIOs
Address	Bits	Name	Description
0x0d8001ec	32	HW_OTP_COMMAND	OTP command
0x0d8001f0	32	HW_OTP_DATA	OTP data

Register descriptions

HW_OTP_COMMAND (0x0d8001ec)
	310
Access	R/W

This register contains the command sent to the OTP. Reading data is 0x8000_00aa where aa is the address of the 4byte word you want to read. It is unknown whether is register is also used during the factory process to program the OTP.

---

HW_OTP_DATA (0x0d8001f0)
	310
Access	R/W

This register contains the output data for the last issued OTP command. Changes of the HW_OTP_COMMAND register directly change this register without any delays.

---

OTP Contents

The following things are stored inside the OTP:

Address	Description
0-4	Boot1 hash
5-8	common key
9	NG id
a-10	NG private key
11-15	NAND HMAC
16-19	NAND key
1a-1d	RNG key
1e-1f	Unknown