Boot process

The Wii has two processors -- an ARM core (inside the Hollywood, known as "Starlet") and a PowerPC (Broadway). The boot process starts on the ARM, which eventually bootstraps the PPC.

The code components involved in the Wii's boot process are, in order:

• (ARM) boot0 A mask ROM (1.5K) which loads boot1 and verifies its SHA1 hash against that stored in OTP. If there is a mismatch, the system will halt.
• (ARM) boot1 Lives in the first block of NAND; loads one of two copies of boot2 from blocks 1-7 of NAND and verifies it using RSA / SHA1.
• (ARM) boot2 A stripped-down version of IOS. It reads the NAND filesystem to load the System Menu's IOS
• (ARM) IOS sees /sys/launch.sys containing System Menu info and loads the System Menu
• (PPC) System Menu The System Menu is the first visible user interface since it is the first code running on the PowerPC. It has higher access privileges compared to games (e.g. it can read and write to every savegame). Its signature is only checked upon installation. boot2 only makes sure that the HMAC signatures on the NAND's filesystem are valid.

Security

Because boot0 is in ROM, it cannot be modified, creating a trusted startup. Because of the boot1 verification against OTP, boot1 also cannot be modified. The first security hole occurs when boot2 is loaded, as older versions of boot1 have the signing bug, allowing certain modified versions of boot2 to be loaded. Because boot1 cannot be modified after the Wii has booted once, this left a number of vulnerable Wiis. Like most titles, however, IOS and the System Menu are not checked for signatures on launch, so they can be modified without bricking the Wii, which is done by a cIOS or Priiloader respectively.