IOS254

IOS254
Release
System Update	3.4
Technical info
Type	Specialized IOS
Status	Mothballed
Stub variant	Unique

IOS254 is an IOS not used by retail software, which led to it being used by PatchMii and BootMii-IOS.

Scene history

On v2's release in 3.4, IOS254 was originally thought to be an attempt at stubbing some cIOS, although it was unclear at the time whether it was intended to overwrite PatchMii or if Nintendo intended to overwrite IOS249, but they assumed Nintendo did not understand how TMD versions work (which was probably designed by BroadOn), since v2 does not overwrite higher versions such as v2070.

As 4.0 was released, containing v3, HackMii members began to assume that this was indeed meant to kill PatchMii (and later, BootMii); marcan wrote an open letter to Nintendo about this suspected confusion, which led to IOS249 and related IOSes being stubbed in 4.2, although they also pushed v260 then, which people stopped paying attention to.

When 4.3 included v65280, people assumed Nintendo had finally figured out how to properly stub IOS254, and Nintendo never released any other IOS254 versions past that point.

This theory of Nintendo not understanding the TMD system remained the general idea for around 10 years (until May 2021), when it became obvious that v3 and v260 follow the same version number increments as the past versions, and were being updated together with IOS9. For the next 7 months, it was believed that v2 was meant to overwrite PatchMii due to the signing bug being present there, then the rest of the updates were only released because this IOS9 copy was a new IOS that could be used to gain control through exploits such as the STM Release Exploit.

This was finally busted in early 2022, when it was noticed that Revolution OS contains code that cancels the error 001 checks if the current IOS is below IOS30, or is IOS254 or higher. Both of these checks existed in late 2007 (seen in the IOS21 NAND Boot Program), before BootMii/PatchMii was released, which suggests that there is a real IOS254 used internally. On top of this, v2 uses content ID 1, so it became clear that there was a version before it, most likely v1, since it makes more sense to skip 0 than 1.

Titles using this IOS

No retail software uses IOS254, although it is likely that some development software uses IOS254.

Version history

Version	Signing bug?	/dev/flash access?	ES_Identify?	STM Release Exploit?	STM IOCTL overflow?	SDI register index bug?	Notes
v1	Yes	Yes	Yes	Yes	Yes	Yes	Never released. Most likely a copy of IOS9v516.
v2	No	No	No	Yes	Yes	Yes	Included in 3.4 and 3.5 updates to fix the signing bug.
v3	No	No	No	No	Yes	Yes	Included in 4.0 update. Copy of IOS9v521
v260	No	No	No	No	No	Yes	Included in 4.2 update. Copy of IOS9v778
v65280	No	No	No	N/A	N/A	N/A	Stub IOS in 4.3 update to remove this IOS branch. The modules are the same as those in IOS80.