Comments on: boot0 / skyeye

By: WiiGator

WiiGator — Tue, 29 Jul 2008 22:04:23 +0000

Hello Bushing,

can you provide the source code for the drivers (e.g. as patch for Skyeye)?

By: superdave

superdave — Fri, 13 Jun 2008 14:58:48 +0000

@bushing: Well, the difference between a 926 and 946 is generally in your favor, since you get rid of the Jazelle unit and dumb down the MMU to an MPU (and I wouldn’t lean towards the Wii having a 926, since that only comes in the EJ-S flavor and I can’t see Nintendo using the Jazelle stuff for an I/O processor). I would actually say that the 946 makes a whole lot more sense for what the Starlet is doing, since the entire Wii makes rather sparse use of VM as a whole.

If you wanna post or email me the asm (or even the binary, since I have IDA Pro), it might be fun to look at, but I’m pretty short on time these days (and having just waded through most of the System Menu looking for something, I’m in need of a bit of a break; hopefully IDA Pro’s ARM facilities are better than the PPC ones).

By: bushing

bushing — Fri, 13 Jun 2008 10:54:08 +0000

@Crinz: This is just to further our understanding, yes. While you could use this as a piece of a Wii emulator, it would silly — there are far easier ways to emulate IOS.

However, I *do* believe that we will be able to use this to “further our understanding” enough to eventually do boot2 patching.

@superdave: Well, that’s part of the problem. We don’t actually know exactly what kind of MMU it is. Segher believes the chip is an ARM926-derivative, based on code inspection. I now think it’s an NEC ARM SoC, and based on their offerings it might be an ARM946 (which Skyeye doesn’t even support, but we could add support in…)

I tried injecting some code into my Wii to read the Chip ID register, and got “00010000″ out of it, so … that wasn’t much help. I can post a disassembly of the MMU-related functions, if you think they’d help to understand what’s going on.

@SquidMan: Yup. I’ll post a bit more about that in my next post (about boot1).

By: SquidMan

SquidMan — Fri, 13 Jun 2008 05:53:00 +0000

Very nice work you guys! You are all just so amazing and work so hard and ask for nothing.
Also, would that key that is set for the AES be boot1′s key? I bet it is!

By: superdave

superdave — Fri, 13 Jun 2008 05:23:38 +0000

Not half bad! How complex is the Starlet’s MMU? I’ve seen ones that run the gamut with ARMs; I once worked with one particular chip where the vendor actually told us to just not use the MMU (it was their own hastily handcrafted IP), so I hope it’s not quite as buggy as that.

By: Crinz

Crinz — Thu, 12 Jun 2008 17:32:16 +0000

Is this just to further your understanding of the Wii or do you have any practical application in mind with the use of this?

unless you want to keep things close to your chest (for obvious reasons)

By: emrikol

emrikol — Thu, 12 Jun 2008 13:27:47 +0000

Once again, you are all amazing! I just wish there was some way I could help your endeavor.

Thanks for being the smart ones!

By: zeroZshadow

zeroZshadow — Thu, 12 Jun 2008 13:04:15 +0000

Nice progress bushing, keep it up i love reading these articles