HackMii

Another nerdy post, sorry. I want to talk about this “unsoftmoddable Wii” crap, but I need to go into some background first.

I’ve written in the past about IOS — or at least I’ve meant to — but it seems especially relevant now.

IOS probably stands for “Input/Output System” — because that’s what it does. It regulates I/O between the Broadway (PPC) and most of the rest of the Wii’s peripherals. It seems to have been written mostly from scratch by BroadOn.

Generally, when we talk about IOS, we mean the “firmware” that runs while normal code (game, system menu, etc) is running on the PPC. However, the same codebase is used to build boot2, boot1 and arguably even boot0! You can almost think of it as a set of matroshka dolls:

• boot0 – ~1.4K
• boot1 / BC – ~ 17K
• boot2 – ~160K
• IOS (multiple versions) – ~ 1.8MB each

There are many other ways to describe this situation — boot2 is the “kernel” and IOS is kernel + modules; boot1 is a stripped-down version of boot2; boot0 is a stripped down version of boot1. The important part is that they are all compiled out of the same codebase. That’s why the same strncmp() bug was present in boot1, BC, boot2 and all versions of IOS.

IOS has changed forms quite a bit over time, and in the past, you could see this in the different versions of IOS installed on the system. The very first version of IOS (IOS4) was (is?) probably just used for factory work — it has USB, SD, DI and basic networking drivers (for the USB ethernet dongle), but lacked SSL / KD (WiiConnect24) / WiFi support; somehow, this fit into just 400K! It was once even up on Nintendo’s download servers, but then they took it down (and have since replaced it with a stub version).

One of the fun things we do is look for clues about the process behind all of this. Every version of IOS has a build date (or several) embedded in it. IOS 4 has a build date of 8/10/2006. Actually, it’s easiest to see if I take all of the version information I have and sort it by build date … here’s the first part:

I’ll let those of you out there fill in the timeline of outside events (24c3 presentation, Freeloader, Trucha Signer, Twilight Hack, HBC, etc). The interesting parts to note are the build dates of IOS37 and onwards. The version of BC that follows is the first version of BC with the strncmp bug fixed — which makes sense if they build all code out of the same source tree. BC is very similar to boot1, so Nintendo had a fixed boot1 at this time — it’s still not clear when they actually rolled that out in the factory. IOS30 and 31 were the rebuilt to block Freeloader (etc), and then shortly thereafter, boot2v4 was built.

boot2 does not actually check any signatures, so it doesn’t make sense for Nintendo to rebuild it just for the sake of fixing the signature-checking code. Instead, I think this probably was to support a PCB rev or two, but more about that later…

Edit: Please see the new FAQ up at bootmii.org.

Two weeks after beta 1 we bring you the first bugfix release: beta 2. Next to the usual metric ton of minor fixes and cleanups, here are the changes worth mentioning:

BootMii beta 2 (v0.9):

• SD card performance has been improved, decreasing the boot and the NAND backup / restore time
• backupmii accepts fragmented SD cards now, reformatting is not performed anymore. Old NAND dumps are still compatible.
• Introduced the INI variable “BOOTDELAY” to set the timeout for the auto boot feature

The Homebrew Channel v1.0.3:

• SDHC cards are working again
• SD performance has been increased again (regression was introduced in v1.0.2)
• HBC works on all system menu versions now
• Fixed rare hangs when exiting HBC

DVDX:

• Switched back to IOS < 37. While the SDHC problem for apps using DVDX has been fixed in libogc, there were also problems with USB keyboards under higher IOS versions

Installer v0.2:

• Installer now works on newer Wiis with boot2v4 (instead of rebooting at “Press 1”)
• Fixed reading of boot1/2 on Wiis with bad ECC data in that area
• BootMii as boot2 and IOS can now be uninstalled

Grab the new installer here. Don’t forget to read the README before running the installer.

Please link to this post instead of mirroring the binary, thanks.

Enjoy.

Without further ado… here.

Have fun! Any and all comments welcome.