/dev/es

The ES (ETicket Services) is responsible for the security of Wii, making it OUR enemy! Along with the rest of IOS, this is generally considered a "private interface" -- game developers never call any of these functions directly.

Most of these are now implemented in libogc -- see http://devkitpro.svn.sourceforge.net/viewvc/devkitpro/trunk/libogc/libogc/es.c?view=log.

Please feel free to submit patches to implement the remaining functions.

Known ES Functions

ios_ioctlv( fd, 0x01, 3, 0, vec); // ES_AddTicket(const signed_blob *stik, u32 stik_size, const signed_blob *certificates, u32 certificates_size, const signed_blob *crl, u32 crl_size)
ios_ioctlv( fd, 0x02, 4, 0, vec); // ES_AddTitleStart(const signed_blob *stmd, u32 tmd_size, const signed_blob *certificates, u32 certificates_size, const signed_blob *crl, u32 crl_size)
ios_ioctlv( fd, 0x03, 2, 0, vec); // ES_AddContentStart(u64 titleID, u32 cid)
ios_ioctlv( fd, 0x04, 2, 0, vec); // ES_AddContentData(s32 cfd, u8 *data, u32 data_size)
ios_ioctlv( fd, 0x05, 1, 0, vec); // ES_AddContentFinish(u32 cid)
ios_ioctlv( fd, 0x06, 0, 0, vec); // ES_AddTitleFinish(void)
ios_ioctlv( fd, 0x07, 0, 1, vec); // ES_GetDeviceID
ios_ioctlvReboot(fd, 0x08, 2, 0, vec); // ES_LaunchTitle(u64 titleID, const tikview *view)
ios_ioctlv( fd, 0x09, 1, 0, vec);  // ES_OpenContent(u16 index)
ios_ioctlv( fd, 0x0A, 1, 1, vec); // ES_ReadContent(s32 cfd, u8 *data, u32 data_size)
ios_ioctlv( fd, 0x0B, 1, 0, vec); // ES_CloseContent(s32 cfd)
ios_ioctlv( fd, 0x0C, 0, 1, vec); // ES_GetOwnedTitlesCount
ios_ioctlv( fd, 0x0D, 1, 1, vec); // ES_GetOwnedTitles
ios_ioctlv( fd, 0x0E, 0, 1, vec); // ES_GetTitlesCount
ios_ioctlv( fd, 0x0F, 1, 1, vec); // ES_GetTitles
ios_ioctlv( fd, 0x10, 1, 1, vec); // ES_GetTitleContentsCount
ios_ioctlv( fd, 0x11, 2, 1, vec); // ES_GetTitleContent
ios_ioctlv( fd, 0x12, 1, 1, vec); // ES_GetNumTicketViews(u64 titleID, u32 *cnt)
ios_ioctlv( fd, 0x13, 2, 1, vec); // ES_GetTicketViews(u64 titleID, tikview *views, u32 cnt)
ios_ioctlv( fd, 0x14, 1, 1, vec); // ES_GetTmdViewSize
ios_ioctlv( fd, 0x15, 2, 1, vec); // ES_GetTmdView
ios_ioctlv( fd, 0x16, 1, 2, vec); // ES_GetConsumption
ios_ioctlv( fd, 0x17, 1, 0, vec); // ES_DeleteTitle
ios_ioctlv( fd, 0x18, 1, 0, vec); // ES_DeleteTicket
ios_ioctlv( fd, 0x19, 1, 1, vec); // ES_DIGetTmdViewSize( u8 *TMD, u32 *TMDViewSize )
ios_ioctlv( fd, 0x1A, 2, 1, vec); // ES_DiGetTmdView
ios_ioctlv( fd, 0x1B, 1, 1, vec); // ES_DiGetTicketView
ios_ioctlv( fd, 0x1C, 4, 2, vec); // ES_DiVerify
ios_ioctlv( fd, 0x1D, 1, 1, vec); // ES_GetDataDir
ios_ioctlv( fd, 0x1E, 0, 1, vec); // ES_GetDeviceCert(u8 *outbuf)
ios_ioctlv( fd, 0x1F, 6, 0, vec); // ES_ImportBoot( const signed_blob *tik, u32 tik_size, const signed_blob *tik_certs, u32 tik_certs_size, const signed_blob *tmd, u32 tmd_size, const signed_blob *tmd_certs, u32 tmd_certs_size, const u8 *content, u32 content_size )
ios_ioctlv( fd, 0x20, 0, 1, vec); // ES_GetTitleId
ios_ioctlv( fd, 0x21, 1, 0, vec); // ES_SetUid
ios_ioctlv( fd, 0x22, 1, 0, vec); // ES_DeleteTitleContent(u64 titleID) - deletes all files containing 'app' in a /title/xxxxxxxx/yyyyyyyy/content
ios_ioctlv( fd, 0x23, 3, 0, vec); // ES_SeekContent
ios_ioctlv( fd, 0x24, 3, 0, vec); // ES_OpenTitleContent(u64 titleID, const tikview *view, u16 index)
ios_ioctlv( fd, 0x25, 0, 0, vec); // ES_LaunchBC(void)
ios_ioctlv( fd, 0x26, 1, 1, vec); // ES_ExportTitleInit
ios_ioctlv( fd, 0x27, 2, 0, vec); // ES_ExportContentBegin
ios_ioctlv( fd, 0x28, 1, 1, vec); // ES_ExportContentData
ios_ioctlv( fd, 0x29, 1, 0, vec); // ES_ExportContentEnd
ios_ioctlv( fd, 0x2A, 0, 0, vec); // ES_ExportTitleDone(void)
ios_ioctlv( fd, 0x2B, 1, 0, vec); // ES_AddTmd
ios_ioctlv( fd, 0x2C, 3, 2, vec); // ES_Encrypt(u32 keynum, u8 *iv, u8 *source, u32 size, u8 *dest)
ios_ioctlv( fd, 0x2D, 3, 2, vec); // ES_Decrypt(u32 keynum, u8 *iv, u8 *source, u32 size, u8 *dest)
ios_ioctlv( fd, 0x2E, 0, 1, vec); // ES_GetBoot2Version(u32 *version)
ios_ioctlv( fd, 0x2F, 0, 0, vec); // ES_AddTitleCancel(void)
ios_ioctlv( fd, 0x30, 1, 2, vec); // ES_Sign(u8 *source, u32 size, u8 *sig, u8 *certs)
ios_ioctlv( fd, 0x31, 3, 0, vec); // ES_VerifySign
// the following functions are only available in IOS28+
ios_ioctlv( fd, 0x32, 1, 1, vec); // ES_GetStoredContentCount
ios_ioctlv( fd, 0x33, 2, 1, vec); // ES_GetStoredContent
ios_ioctlv( fd, 0x34, 1, 1, vec); // ES_GetStoredTmdSize
ios_ioctlv( fd, 0x35, 2, 1, vec); // ES_GetStoredTmd
ios_ioctlv( fd, 0x36, 0, 1, vec); // ES_GetSharedContentCount
ios_ioctlv( fd, 0x37, 1, 1, vec); // ES_GetSharedContents
ios_ioctlv( fd, 0x38, 1, 0, vec); // ?(ES_DeleteSharedContent)
ios_ioctlv( fd, 0x39, 0, 1, vec); // ES_GetDiTmdSize
ios_ioctlv( fd, 0x3A, 1, 1, vec); // ES_GetDiTmd
ios_ioctlv( fd, 0x3B, 4, 2, vec); // Unknown ... calls ES_DiVerify 
ios_ioctlv( fd, 0x3C, 2, 1, vec); // ES_SetupStreamKey ... calls ES_DiVerify(tikview,tmd,u32) 
ios_ioctlv( fd, 0x3D, 0, 1, vec); // ES_DeleteStreamKey ... wrapper for syscall 5c
// the following functions are only available in IOS37+ but not in IOS38
ios_ioctlv( fd, 0x3E, 2, 0, vec); // Unknown ... Deletes a content from a title's private directory
// the following functions are only available in IOS37v3609+ but not in IOS38
ios_ioctlv( fd, 0x3F, ?, ?, vec); // non-existant ioctl why? ... because.
ios_ioctlv( fd, 0x40, 1, 1, vec); // Unknown -- takes in a ticket?
// the following functions are only available in IOS56+
ios_ioctlv( fd, 0x41, 1, 1, vec); // Unknown -- retrieves a key?
ios_ioctlv( fd, 0x42, 2, 0, vec); // Unknown -- something with a key?
// the following functions are only available in IOS56v5405+/IOS57v5661+/IOS61v5405+/IOS70+ Please check (I thought it was a rule never add new functions existing IOS)
ios_ioctlv( fd, 0x43, 1, 1, vec); // Unknown -- something with a ticket and maybe a ".tv1" file?
ios_ioctlv( fd, 0x44, 2, 1, vec); // Unknown -- similar to ioctl 43
ios_ioctlv( fd, 0x45, 0, 0, vec); // Unknown ... korean-common-key check

/dev/es IOS_Ioctlv

number	name	in count	out count	vec entry target	vec entry size [bytes]	libogc prototype	Description
0x00	?	?	?	?	?	?	returns -1017 non-existant ioctl
0x01	ES_AddTicket	3	0	?	0x2A4	ES_AddTicket(const signed_blob *stik, u32 stik_size, const signed_blob *certificates, u32 certificates_size, const signed_blob *crl, u32 crl_size)	?
				?	?
				?	?
0x02	ES_AddTitleStart	4	0	?	?	ES_AddTitleStart(const signed_blob *stmd, u32 tmd_size, const signed_blob *certificates, u32 certificates_size, const signed_blob *crl, u32 crl_size)	?
				?	?
				?	?
				?	0x1c
0x03	ES_AddContentStart	2	0	?	0x8	ES_AddContentStart(u64 titleID, u32 cid)	?
				?	0x4
0x04	ES_AddContentData	2	0	?	0x4	ES_AddContentData(s32 cfd, u8 *data, u32 data_size)	?
				?	?
0x05	ES_AddContentFinish	1	0	?	0x4	ES_AddContentFinish(u32 cid)	?
0x06	ES_AddTitleFinish	0	0			ES_AddTitleFinish(void)	?
0x07	ES_GetDeviceID	0	1	?	0x4	ES_GetDeviceID(u32 *device_id)	?
0x08	ES_LaunchTitle	2	0	?	0x8	ES_LaunchTitleBackground(u64 titleID, const tikview *view); ES_LaunchTitle(u64 titleID, const tikview *view);	?
				?	0xd8
0x09	ES_OpenContent	1	0	?	0x4	ES_OpenContent(u16 index)	?
0x0A	ES_ReadContent	1	1	?	0x4	ES_ReadContent(s32 cfd, u8 *data, u32 data_size)	?
				?	?
0x0B	ES_CloseContent	1	0	?	0x4	ES_CloseContent(s32 cfd)	?
0x0C	ES_GetOwnedTitlesCount	0	1	u32* count	0x4	ES_GetNumOwnedTitles(u32 *cnt)	?
0x0D	ES_GetOwnedTitles	1	1	u32* count	0x4	ES_GetOwnedTitles(u64 *titles, u32 cnt)	?
				u64 titles[]	[count]*0x8
0x0E	ES_GetTitlesCount	0	1	u32* count	0x4	ES_GetNumTitles(u32 *cnt)	Sets the u32 pointed to by count to the number of titles on the system under /title.
0x0F	ES_GetTitles	1	1	u32* count	0x4	ES_GetTitles(u64 *titles, u32 cnt)	Fills out buffer with at most count 8 byte title ids of titles on the system under /title. It also update count for the number of title its copied.
				u64 buffer[]	[count]*0x8
0x10	ES_GetTitleContentsCount	1	1	u64 title_id	0x8	ES_GetTitleContentsCount(u64 titleID, u32 *num)	Gets the number of contents from the tmd. It checks that the contents are present in the title's private content directory or linked via /shared1/content.map
				u32* count	0x4
0x11	ES_GetTitleContents	2	1	u64 title_id	0x8	No	Fills out content_ids with the content ids from the title's tmd. It checks if the contents are present in the title's private content directory or linked via /shared1/content.map
				u32* count	0x4
				u32 content_ids[]	[count]*0x4
0x12	ES_GetNumTicketViews	1	1	u64 title_id	0x8	ES_GetNumTicketViews(u64 titleID, u32 *cnt)	?
				u32* count	0x4
0x13	ES_GetTicketViews	2	1	u64 title_id	0x8	ES_GetTicketViews(u64 titleID, tikview *views, u32 cnt)	?
				u32* count	0x4
				tikview_t ticketviews[]	[count]*0xd8
0x14	ES_GetTmdViewSize	1	1	u64 title_id	0x8	ES_GetTMDViewSize(u64 titleID, u32 *size)	?
				u32* count	0x4
0x15	ES_GetTmdView	2	1	u64 title_id	0x8	ES_GetTMDView(u64 titleID, u8 *data, u32 size)	?
				u32* count	0x4
				tmdiew_t tmdview	[count]
0x16	ES_GetConsumption	1	2	?	?	No	?
0x17	ES_DELETETITLE	1	0	u64 titleID	0x8	ES_DeleteTitle(u64 titleID)	?
0x18	ES_DeleteTicket	1	0	?	?	ES_DeleteTicket(const tikview *view)	?
0x19	ES_DIGetTmdViewSize	1	0	?	?	No	?
0x1A	ES_DIGetTmdViewSize	2	1	?	?	No	?
0x1B	ES_DiGetTicketView	1	1	?	?	No	?
0x1C	ES_DiVerify	4	2	?	?	ES_Identify(const signed_blob *certificates, u32 certificates_size, const signed_blob *stmd, u32 tmd_size, const signed_blob *sticket, u32 ticket_size, u32 *keyid)	?
0x1D	ES_GetTitleDir	1	1	?	?	ES_GetDataDir(u64 titleID,char *filepath)	?
0x1E	ES_GetDeviceCert	1	0	?	?	ES_GetDeviceCert(u8 *outbuf)	?
0x1F	ES_GetDeviceCert	6	0	?	?	ES_ImportBoot(const signed_blob *tik, u32 tik_size,const signed_blob *tik_certs,u32 tik_certs_size,const signed_blob *tmd,u32 tmd_size,const signed_blob *tmd_certs,u32 tmd_certs_size,const u8 *content,u32 content_size)	?
0x20	ES_GetTitleId	0	1	?	?	ES_GetTitleID(u64 *titleID)	?
0x21	ES_SetUid	1	0	?	?	ES_SetUID(u64 uid)	?
0x22	ES_DeleteTitleContent	1	0	?	?	ES_DeleteTitleContent(u64 titleID)	Deletes all files containing the substring "app" in a title's content directory (/title/xxxxxxxx/yyyyyyyy/content).
0x23	ES_SeekContent	3	0	?	?	s32 ES_SeekContent(s32 cfd, s32 where, s32 whence)	?
0x24	ES_OpenTitleContent	3	0	?	?	s32 ES_OpenTitleContent(u64 titleID, tikview *views, u16 index)	?
0x25	ES_LaunchBC	0	0	?	?	No	?
0x38	? (ES_DeleteSharedContent)	1	0	u8 sha1[]	0x14	?	Deletes the content file from /shared1 with the given sha1 checksum. It aborts if the tmd of an essential system title references the content. It rebuilds content.map after, removing the entry for the deleted file.
0x3e	?	2	0	u64 title_id	0x8	?	Deletes a specific content from a title's private content directory.
				u32 content_id	0x4
0x3f	?	0	0			?	returns -1017
0x40	?	1	1	tikview_t ticketview	0xd8	?	Copies the ticket associated with ticketview into ticket_buffer based on some access checks [currently unknown ticket offsets +0x1e8 to +0x1ef, +0x1f0.]
				tik_t ticket_buffer	0x2a4
0x45	?	0	0			?	Used by system menu 4.2 to check if the wii is a region changed Korean wii. returns -1017 if the keys are not found. see Error_003

/dev/es error codes

Error code	POSIX equivalent	Notes
-106	?	Invalid TMD when using ES_OpenContent or <marcan> HUGHLALUGH SOMETHING FUCKED UP AND I'M NOT TELLING, or access denied
-1009	EIO	Read failure (short read)
-1010	EIO	Write failure (short write)
-1012	?	Invalid signature type
-1015	?	Invalid value for byte at 0x180 in ticket (valid:0,1,2)
-1017	EINVAL	Wrong IN or OUT size, wrong size for a part of the vector, vector alignment problems, non-existant ioctl
-1020	?	ConsoleID mismatch
-1022	?	Content did not match hash in TMD
-1024	ENOMEM	Memory allocation failure
-1026	EACCESS	Incorrect access rights
-1028	ENOENT	No ticket installed
-1029	?	Installed Ticket/TMD is invalid
-1035	?	Title with a higher version is already installed
-1036	?	Required sysversion(IOS) is not installed
-2008	EINVAL	Invalid parameter(s)
-2011	?	Signature check failed
-2013	?	Keyring is full (contains 0x20 keys)
-2014	?	Bad hash length (!= 20)
-2016	?	unaligned data
-4100	?	Wrong Ticket-, Cert size or invalid Ticket-, Cert data