Hardware/OTP

	OTP
	Hollywood Registers
Access
Broadway	None
Starlet	Full
Registers
Base	0x0d8001ec
Length	0x8
Access size	32 bits
Byte order	Big Endian
	This box: view • talk • edit

The One Time Programmable memory is used to store 32 4byte words. It is programmed sometime during the factory process and can never be changed afterwards. Next to the Wii's shared and public keys it also contains a random number generation seed and the boot1 hash which basically makes it impossible for us to change boot1. This memory may or may not be described in claims 141 and 142 in http://www.freepatentsonline.com/y2005/0132217.html

Register List

Hollywood GPIOs
Address	Bits	Name	Description
0x0d8001ec	32	HW_OTP_COMMAND	OTP command
0x0d8001f0	32	HW_OTP_DATA	OTP data

General Registers

HW_OTP_COMMAND (0x0d8001ec)
	31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16
Access	R/W	U
Field	RD
	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
Access	U											R/W
Field												ADDR

Field	Description
RD	Set to one to execute a read command. If clear, then the data in HW_OTP_DATA is unchanged.
ADDR	Word address to read

This register contains the command sent to the OTP. It is unknown whether is register is also used during the factory process to program the OTP.

HW_OTP_DATA (0x0d8001f0)
	310
Access	R

This register contains the output data for the last issued OTP read command. The execution of a read operation via the HW_OTP_COMMAND register immediately changes this register without any delay.

OTP Contents

The following things are stored inside the OTP:

Word	Address	Size	Contents	Description
0x00	0x00	0x14	boot1 hash	Expected hash checked against actual boot1 hash by boot0
0x05 - 0x08	0x14	0x10	common key	Used to encrypt title keys in tickets
0x09	0x24	0x04	NG id	Used to name the NG certificate
0x0A - 0x11	0x28	0x1E	NG private key	Per-console key that signs save files
0x11 - 0x15	0x44	0x14	NAND HMAC (overlaps with NG private key)	Per-console key that signs NAND blocks
0x16 - 0x19	0x58	0x10	NAND key	Per-console key that encrypts the NAND
0x1A - 0x1D	0x68	0x10	RNG seed (aka PRNG key)	Used for crypto-related random number generation
0x1E - 0x1F	0x78	0x08	Unknown	Appears to vary between units