From WiiBrew
The ES (ETicket Services) is responsible for the security of Wii, making it OUR enemy! Along with the rest of IOS, this is generally considered a "private interface" -- game developers never call any of these functions directly.
Most of these are now implemented in libogc -- see http://devkitpro.svn.sourceforge.net/viewvc/devkitpro/trunk/libogc/libogc/es.c?view=log.
Please feel free to submit patches to implement the remaining functions.
Known ES Functions
ios_ioctlv( fd, 0x01, 3, 0, vec); // ES_AddTicket(const signed_blob *stik, u32 stik_size, const signed_blob *certificates, u32 certificates_size, const signed_blob *crl, u32 crl_size)
ios_ioctlv( fd, 0x02, 4, 0, vec); // ES_AddTitleStart(const signed_blob *stmd, u32 tmd_size, const signed_blob *certificates, u32 certificates_size, const signed_blob *crl, u32 crl_size)
ios_ioctlv( fd, 0x03, 2, 0, vec); // ES_AddContentStart(u64 titleID, u32 cid)
ios_ioctlv( fd, 0x04, 2, 0, vec); // ES_AddContentData(s32 cfd, u8 *data, u32 data_size)
ios_ioctlv( fd, 0x05, 1, 0, vec); // ES_AddContentFinish(u32 cid)
ios_ioctlv( fd, 0x06, 0, 0, vec); // ES_AddTitleFinish(void)
ios_ioctlv( fd, 0x07, 0, 1, vec); // ES_GetDeviceID
ios_ioctlvReboot(fd, 0x08, 2, 0, vec); // ES_LaunchTitle(u64 titleID, const tikview *view)
ios_ioctlv( fd, 0x09, 1, 0, vec); // ES_OpenContent(u16 index)
ios_ioctlv( fd, 0x0A, 1, 1, vec); // ES_ReadContent(s32 cfd, u8 *data, u32 data_size)
ios_ioctlv( fd, 0x0B, 1, 0, vec); // ES_CloseContent(s32 cfd)
ios_ioctlv( fd, 0x0C, 0, 1, vec); // ES_GetOwnedTitlesCount
ios_ioctlv( fd, 0x0D, 1, 1, vec); // ES_GetOwnedTitles
ios_ioctlv( fd, 0x0E, 0, 1, vec); // ES_GetTitlesCount
ios_ioctlv( fd, 0x0F, 1, 1, vec); // ES_GetTitles
ios_ioctlv( fd, 0x10, 1, 1, vec); // ES_GetTitleContentsCount
ios_ioctlv( fd, 0x11, 2, 1, vec); // ES_GetTitleContent
ios_ioctlv( fd, 0x12, 1, 1, vec); // ES_GetNumTicketViews(u64 titleID, u32 *cnt)
ios_ioctlv( fd, 0x13, 2, 1, vec); // ES_GetTicketViews(u64 titleID, tikview *views, u32 cnt)
ios_ioctlv( fd, 0x14, 1, 1, vec); // ES_GetTmdViewSize
ios_ioctlv( fd, 0x15, 2, 1, vec); // ES_GetTmdView
ios_ioctlv( fd, 0x16, 1, 2, vec); // ES_GetConsumption
ios_ioctlv( fd, 0x17, 1, 0, vec); // ES_DeleteTitle
ios_ioctlv( fd, 0x18, 1, 0, vec); // ES_DeleteTicket
ios_ioctlv( fd, 0x19, 1, 1, vec); // ES_DIGetTmdViewSize( u8 *TMD, u32 *TMDViewSize )
ios_ioctlv( fd, 0x1A, 2, 1, vec); // ES_DiGetTmdView
ios_ioctlv( fd, 0x1B, 1, 1, vec); // ES_DiGetTicketView
ios_ioctlv( fd, 0x1C, 4, 2, vec); // ES_DiVerify
ios_ioctlv( fd, 0x1D, 1, 1, vec); // ES_GetDataDir
ios_ioctlv( fd, 0x1E, 0, 1, vec); // ES_GetDeviceCert(u8 *outbuf)
ios_ioctlv( fd, 0x1F, 6, 0, vec); // ES_ImportBoot( const signed_blob *tik, u32 tik_size, const signed_blob *tik_certs, u32 tik_certs_size, const signed_blob *tmd, u32 tmd_size, const signed_blob *tmd_certs, u32 tmd_certs_size, const u8 *content, u32 content_size )
ios_ioctlv( fd, 0x20, 0, 1, vec); // ES_GetTitleId
ios_ioctlv( fd, 0x21, 1, 0, vec); // ES_SetUid
ios_ioctlv( fd, 0x22, 1, 0, vec); // ES_DeleteTitleContent(u64 titleID) - deletes all files containing 'app' in a /title/xxxxxxxx/yyyyyyyy/content
ios_ioctlv( fd, 0x23, 3, 0, vec); // ES_SeekContent
ios_ioctlv( fd, 0x24, 3, 0, vec); // ES_OpenTitleContent(u64 titleID, const tikview *view, u16 index)
ios_ioctlv( fd, 0x25, 0, 0, vec); // ES_LaunchBC(void)
ios_ioctlv( fd, 0x26, 1, 1, vec); // ES_ExportTitleInit
ios_ioctlv( fd, 0x27, 2, 0, vec); // ES_ExportContentBegin
ios_ioctlv( fd, 0x28, 1, 1, vec); // ES_ExportContentData
ios_ioctlv( fd, 0x29, 1, 0, vec); // ES_ExportContentEnd
ios_ioctlv( fd, 0x2A, 0, 0, vec); // ES_ExportTitleDone(void)
ios_ioctlv( fd, 0x2B, 1, 0, vec); // ES_AddTmd
ios_ioctlv( fd, 0x2C, 3, 2, vec); // ES_Encrypt(u32 keynum, u8 *iv, u8 *source, u32 size, u8 *dest)
ios_ioctlv( fd, 0x2D, 3, 2, vec); // ES_Decrypt(u32 keynum, u8 *iv, u8 *source, u32 size, u8 *dest)
ios_ioctlv( fd, 0x2E, 0, 1, vec); // ES_GetBoot2Version(u32 *version)
ios_ioctlv( fd, 0x2F, 0, 0, vec); // ES_AddTitleCancel(void)
ios_ioctlv( fd, 0x30, 1, 2, vec); // ES_Sign(u8 *source, u32 size, u8 *sig, u8 *certs)
ios_ioctlv( fd, 0x31, 3, 0, vec); // ES_VerifySign
// the following functions are only available in IOS28+
ios_ioctlv( fd, 0x32, 1, 1, vec); // ES_GetStoredContentCount
ios_ioctlv( fd, 0x33, 2, 1, vec); // ES_GetStoredContent
ios_ioctlv( fd, 0x34, 1, 1, vec); // ES_GetStoredTmdSize
ios_ioctlv( fd, 0x35, 2, 1, vec); // ES_GetStoredTmd
ios_ioctlv( fd, 0x36, 0, 1, vec); // ES_GetSharedContentCount
ios_ioctlv( fd, 0x37, 1, 1, vec); // ES_GetSharedContents
ios_ioctlv( fd, 0x38, 1, 0, vec); // ?(ES_DeleteSharedContent)
ios_ioctlv( fd, 0x39, 0, 1, vec); // ES_GetDiTmdSize
ios_ioctlv( fd, 0x3A, 1, 1, vec); // ES_GetDiTmd
ios_ioctlv( fd, 0x3B, 4, 2, vec); // Unknown ... calls ES_DiVerify
ios_ioctlv( fd, 0x3C, 2, 1, vec); // ES_SetupStreamKey ... calls ES_DiVerify(tikview,tmd,u32)
ios_ioctlv( fd, 0x3D, 0, 1, vec); // ES_DeleteStreamKey ... wrapper for syscall 5c
// the following functions are only available in IOS37+ but not in IOS38
ios_ioctlv( fd, 0x3E, 2, 0, vec); // Unknown ... Deletes a content from a title's private directory
// the following functions are only available in IOS37v3609+ but not in IOS38
ios_ioctlv( fd, 0x3F, ?, ?, vec); // non-existant ioctl why? ... because.
ios_ioctlv( fd, 0x40, 1, 1, vec); // Unknown -- takes in a ticket?
// the following functions are only available in IOS56+
ios_ioctlv( fd, 0x41, 1, 1, vec); // Unknown -- retrieves a key?
ios_ioctlv( fd, 0x42, 2, 0, vec); // Unknown -- something with a key?
// the following functions are only available in IOS56v5405+/IOS57v5661+/IOS61v5405+/IOS70+ Please check (I thought it was a rule never add new functions existing IOS)
ios_ioctlv( fd, 0x43, 1, 1, vec); // Unknown -- something with a ticket and maybe a ".tv1" file?
ios_ioctlv( fd, 0x44, 2, 1, vec); // Unknown -- similar to ioctl 43
ios_ioctlv( fd, 0x45, 0, 0, vec); // Unknown ... korean-common-key check
/dev/es IOS_Ioctlv
| number
| name
| in count
| out count
| vec entry target
| vec entry size [bytes]
| libogc prototype
| Description
|
| 0x00
| ?
| ?
| ?
| ?
| ?
| ?
| returns -1017 non-existant ioctl
|
| 0x01
| ES_AddTicket
| 3
| 0
| ?
| 0x2A4
| ES_AddTicket(const signed_blob *stik, u32 stik_size, const signed_blob *certificates, u32 certificates_size, const signed_blob *crl, u32 crl_size)
| ?
|
| ?
| ?
|
| ?
| ?
|
| 0x02
| ES_AddTitleStart
| 4
| 0
| ?
| ?
| ES_AddTitleStart(const signed_blob *stmd, u32 tmd_size, const signed_blob *certificates, u32 certificates_size, const signed_blob *crl, u32 crl_size)
| ?
|
| ?
| ?
|
| ?
| ?
|
| ?
| 0x1c
|
| 0x03
| ES_AddContentStart
| 2
| 0
| ?
| 0x8
| ES_AddContentStart(u64 titleID, u32 cid)
| ?
|
| ?
| 0x4
|
| 0x04
| ES_AddContentData
| 2
| 0
| ?
| 0x4
| ES_AddContentData(s32 cfd, u8 *data, u32 data_size)
| ?
|
| ?
| ?
|
| 0x05
| ES_AddContentFinish
| 1
| 0
| ?
| 0x4
| ES_AddContentFinish(u32 cid)
| ?
|
| 0x06
| ES_AddTitleFinish
| 0
| 0
|
|
| ES_AddTitleFinish(void)
| ?
|
| 0x07
| ES_GetDeviceID
| 0
| 1
| ?
| 0x4
| ES_GetDeviceID(u32 *device_id)
| ?
|
| 0x08
| ES_LaunchTitle
| 2
| 0
| ?
| 0x8
| ES_LaunchTitleBackground(u64 titleID, const tikview *view); ES_LaunchTitle(u64 titleID, const tikview *view);
| ?
|
| ?
| 0xd8
|
| 0x09
| ES_OpenContent
| 1
| 0
| ?
| 0x4
| ES_OpenContent(u16 index)
| ?
|
| 0x0A
| ES_ReadContent
| 1
| 1
| ?
| 0x4
| ES_ReadContent(s32 cfd, u8 *data, u32 data_size)
| ?
|
| ?
| ?
|
| 0x0B
| ES_CloseContent
| 1
| 0
| ?
| 0x4
| ES_CloseContent(s32 cfd)
| ?
|
| 0x0C
| ES_GetOwnedTitlesCount
| 0
| 1
| u32* count
| 0x4
| ES_GetNumOwnedTitles(u32 *cnt)
| ?
|
| 0x0D
| ES_GetOwnedTitles
| 1
| 1
| u32* count
| 0x4
| ES_GetOwnedTitles(u64 *titles, u32 cnt)
| ?
|
| u64 titles[]
| [count]*0x8
|
| 0x0E
| ES_GetTitlesCount
| 0
| 1
| u32* count
| 0x4
| ES_GetNumTitles(u32 *cnt)
| Sets the u32 pointed to by count to the number of titles on the system under /title.
|
| 0x0F
| ES_GetTitles
| 1
| 1
| u32* count
| 0x4
| ES_GetTitles(u64 *titles, u32 cnt)
| Fills out buffer with at most count 8 byte title ids of titles on the system under /title. It also update count for the number of title its copied.
|
| u64 buffer[]
| [count]*0x8
|
| 0x10
| ES_GetTitleContentsCount
| 1
| 1
| u64 title_id
| 0x8
| ES_GetTitleContentsCount(u64 titleID, u32 *num)
| Gets the number of contents from the tmd. It checks that the contents are present in the title's private content directory or linked via /shared1/content.map
|
| u32* count
| 0x4
|
| 0x11
| ES_GetTitleContents
| 2
| 1
| u64 title_id
| 0x8
| No
| Fills out content_ids with the content ids from the title's tmd. It checks if the contents are present in the title's private content directory or linked via /shared1/content.map
|
| u32* count
| 0x4
|
| u32 content_ids[]
| [count]*0x4
|
| 0x12
| ES_GetNumTicketViews
| 1
| 1
| u64 title_id
| 0x8
| ES_GetNumTicketViews(u64 titleID, u32 *cnt)
| ?
|
| u32* count
| 0x4
|
| 0x13
| ES_GetTicketViews
| 2
| 1
| u64 title_id
| 0x8
| ES_GetTicketViews(u64 titleID, tikview *views, u32 cnt)
| ?
|
| u32* count
| 0x4
|
| tikview_t ticketviews[]
| [count]*0xd8
|
| 0x14
| ES_GetTmdViewSize
| 1
| 1
| u64 title_id
| 0x8
| ES_GetTMDViewSize(u64 titleID, u32 *size)
| ?
|
| u32* count
| 0x4
|
| 0x15
| ES_GetTmdView
| 2
| 1
| u64 title_id
| 0x8
| ES_GetTMDView(u64 titleID, u8 *data, u32 size)
| ?
|
| u32* count
| 0x4
|
| tmdiew_t tmdview
| [count]
|
| 0x16
| ES_GetConsumption
| 1
| 2
| ?
| ?
| No
| ?
|
| 0x17
| ES_DELETETITLE
| 1
| 0
| u64 titleID
| 0x8
| ES_DeleteTitle(u64 titleID)
| ?
|
| 0x18
| ES_DeleteTicket
| 1
| 0
| ?
| ?
| ES_DeleteTicket(const tikview *view)
| ?
|
| 0x19
| ES_DIGetTmdViewSize
| 1
| 0
| ?
| ?
| No
| ?
|
| 0x1A
| ES_DIGetTmdViewSize
| 2
| 1
| ?
| ?
| No
| ?
|
| 0x1B
| ES_DiGetTicketView
| 1
| 1
| ?
| ?
| No
| ?
|
| 0x1C
| ES_DiVerify
| 4
| 2
| ?
| ?
| ES_Identify(const signed_blob *certificates, u32 certificates_size, const signed_blob *stmd, u32 tmd_size, const signed_blob *sticket, u32 ticket_size, u32 *keyid)
| ?
|
| 0x1D
| ES_GetTitleDir
| 1
| 1
| ?
| ?
| ES_GetDataDir(u64 titleID,char *filepath)
| ?
|
| 0x1E
| ES_GetDeviceCert
| 1
| 0
| ?
| ?
| ES_GetDeviceCert(u8 *outbuf)
| ?
|
| 0x1F
| ES_GetDeviceCert
| 6
| 0
| ?
| ?
| ES_ImportBoot(const signed_blob *tik, u32 tik_size,const signed_blob *tik_certs,u32 tik_certs_size,const signed_blob *tmd,u32 tmd_size,const signed_blob *tmd_certs,u32 tmd_certs_size,const u8 *content,u32 content_size)
| ?
|
| 0x20
| ES_GetTitleId
| 0
| 1
| ?
| ?
| ES_GetTitleID(u64 *titleID)
| ?
|
| 0x21
| ES_SetUid
| 1
| 0
| ?
| ?
| ES_SetUID(u64 uid)
| ?
|
| 0x22
| ES_DeleteTitleContent
| 1
| 0
| ?
| ?
| ES_DeleteTitleContent(u64 titleID)
| Deletes all files containing the substring "app" in a title's content directory (/title/xxxxxxxx/yyyyyyyy/content).
|
| 0x23
| ES_SeekContent
| 3
| 0
| ?
| ?
| s32 ES_SeekContent(s32 cfd, s32 where, s32 whence)
| ?
|
| 0x24
| ES_OpenTitleContent
| 3
| 0
| ?
| ?
| s32 ES_OpenTitleContent(u64 titleID, tikview *views, u16 index)
| ?
|
| 0x25
| ES_LaunchBC
| 0
| 0
| ?
| ?
| No
| ?
|
| 0x38
| ? (ES_DeleteSharedContent)
| 1
| 0
| u8 sha1[]
| 0x14
| ?
| Deletes the content file from /shared1 with the given sha1 checksum. It aborts if the tmd of an essential system title references the content. It rebuilds content.map after, removing the entry for the deleted file.
|
| 0x3e
| ?
| 2
| 0
| u64 title_id
| 0x8
| ?
| Deletes a specific content from a title's private content directory.
|
| u32 content_id
| 0x4
|
| 0x3f
| ?
| 0
| 0
|
|
| ?
| returns -1017
|
| 0x40
| ?
| 1
| 1
| tikview_t ticketview
| 0xd8
| ?
| Copies the ticket associated with ticketview into ticket_buffer based on some access checks [currently unknown ticket offsets +0x1e8 to +0x1ef, +0x1f0.]
|
| tik_t ticket_buffer
| 0x2a4
|
| 0x45
| ?
| 0
| 0
|
|
| ?
| Used by system menu 4.2 to check if the wii is a region changed Korean wii. returns -1017 if the keys are not found. see Error_003
|
/dev/es error codes
| Error code
| POSIX equivalent
| Notes
|
| -106
| ?
| Invalid TMD when using ES_OpenContent or <marcan> HUGHLALUGH SOMETHING FUCKED UP AND I'M NOT TELLING, or access denied
|
| -1009
| EIO
| Read failure (short read)
|
| -1010
| EIO
| Write failure (short write)
|
| -1012
| ?
| Invalid signature type
|
| -1015
| ?
| Invalid value for byte at 0x180 in ticket (valid:0,1,2)
|
| -1017
| EINVAL
| Wrong IN or OUT size, wrong size for a part of the vector, vector alignment problems, non-existant ioctl
|
| -1020
| ?
| ConsoleID mismatch
|
| -1022
| ?
| Content did not match hash in TMD
|
| -1024
| ENOMEM
| Memory allocation failure
|
| -1026
| EACCESS
| Incorrect access rights
|
| -1028
| ENOENT
| No ticket installed
|
| -1029
| ?
| Installed Ticket/TMD is invalid
|
| -1035
| ?
| Title with a higher version is already installed
|
| -1036
| ?
| Required sysversion(IOS) is not installed
|
| -2008
| EINVAL
| Invalid parameter(s)
|
| -2011
| ?
| Signature check failed
|
| -2013
| ?
| Keyring is full (contains 0x20 keys)
|
| -2014
| ?
| Bad hash length (!= 20)
|
| -2016
| ?
| unaligned data
|
| -4100
| ?
| Wrong Ticket-, Cert size or invalid Ticket-, Cert data
|
