Bootmii Boot2 List
- More title ID's blacklisted. HBC gets removed. The Hackmii installer exploit that uses Userland+Syscall IOS method no longer works. This is the reason why 4.3 exploits (Letterbomb, Mailbox Bomb) need your MAC address to hack the Wii. 4.3U release date is Jun 21, 2010. 4.3J/E/K release date is Jun 22, 2010. Menus run on IOS80v6943.
- Wii console with System Menu version 4.3 Method 2 only An SD card (Best results are with non-SDHC cards) formatted to FAT(32). Part 1: Launching the HackMii Installer. The HackMii installer is the installation tool that we can use to install the Homebrew Channel; which will allow us to launch Homebrew in a convenient way.
Installing Bootmii as boot2 requires the presence of a vulnerability in boot1 called the trucha bug. The trucha bug was fixed sometime in the 1st quarter of 2008. This means any Wii manufactured after the cut off date is not compatible with boot2 Bootmii and can only have Bootmii installed as IOS.
North America List LU Serial Numbers (Ranges)
The guide works on ALL system menu versions up to 4.3: Anything from 2.0 to 4.3 and regions U, E, J and K (for most parts). People who have a Wii with the 1.0 system menu version (which has no version number in the settings) need to update to a higher version. Choose what region of NAND you would like to have ('U' 'E' 'J' or 'K') and press enter. Choose which System Menu version you would like to have ('4.2' or '4.3') and press enter. Type 'D' and press enter (unless you would like to use your own setting.txt in which case either choice will work) 6. Choose whether to download Wii channels.
LU10305 – LU10954 – Compatible
LU1124 – LU1511 – Incompatible
LU304 – LU34428 – Compatible
LU3535 – LU4054 – Incompatible
LU5065 – LU5796 – Compatible
LU5880 – LU7400 – Incompatible
LEH, LEM, LEF, LAH, LJF, LKM Serial numbers
see the full Bootmii Boot2 Compatibily List
| NAND Interface | |
| Access | |
|---|---|
| Espresso | None |
| Starbuck | Full |
| Registers | |
| Base | 0x0d010000 |
| Length | 0x100 |
| Access size | 32 bits |
| Byte order | Big Endian |
| IRQs | |
| Espresso | None |
| Latte | 1 |
Register List
| NAND Interface | |||
|---|---|---|---|
| Address | Bits | Name | Description |
| 0x0d010000 | 32 | NAND_CTRL | NAND Control and Status |
| 0x0d010004 | 32 | NAND_CONFIG | NAND configuration register |
| 0x0d010008 | 32 | NAND_ADDR1 | Address bytes 1-2 (column) |
| 0x0d01000c | 32 | NAND_ADDR2 | Address bytes 3-5 (row) |
| 0x0d010010 | 32 | NAND_DATABUF | Memory address of the Data buffer |
| 0x0d010014 | 32 | NAND_ECCBUF | Memory address of the Spare buffer |
| 0x0d010018 | 32 | NAND_BANK | NAND bank swapping (WiiU/vWii) |
| 0x0d010030 | 32 | NAND_UNK_CTRL | Unknown |
| 0x0d010040...0x0d010100 | 32 | NAND_UNK | Eight 0x18-sized mirrors? |
Register Details
| NAND_CTRL (0x0d010000) | ||||||||||||||||
| 31 | 30 | 29 | 28 | 27 | 26 | 25 | 24 | 23 | 22 | 21 | 20 | 19 | 18 | 17 | 16 | |
| Access | R/W | R/W | R/W | R/W | R/W | R/W | R/W | R/W | R/W | |||||||
| Field | EXEC | IRQ | ERR | A5 | A4 | A3 | A2 | A1 | COMMAND | |||||||
| 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0 | |
| Access | R/W | R/W | R/W | R/W | W | |||||||||||
| Field | WAIT | WR | RD | ECC | DATALEN | |||||||||||
This register controls the state of the NAND interface.
| Field | Description |
| EXEC | Write 1: initiate NAND command Write 0: reset NAND interface Read: NAND interface busy |
| IRQ | Set to enable IRQ generation when command is complete |
| ERR | If set, NAND error occured (?)[check] |
| A5 | Send fifth address byte (typ. row address high) |
| A4 | Send fourth address byte (typ. row address mid) |
| A3 | Send third address byte (typ. row address low) |
| A2 | Send second address byte (typ. column address high) |
| A1 | Send first address byte (typ. column address low) |
| COMMAND | 8-bit NAND command |
| WAIT | Wait for R/B to go high between address and data phases (wait for read/write/erase/reset) |
| WR | Transfer data to the NAND chip |
| RD | Transfer data from the NAND chip |
| ECC | Calculate ECC or ?? [check] |
| DATALEN | Number of bytes to transfer during the data phase |
| NAND_CONFIG (0x0d010004) | |||||||||||||||||
| 31 | 30 | 29 | 28 | 27 | 26 | 25 | 24 | 23 | 22 | 21 | 20 | 19 | 18 | 17 | 16 | ||
| Access | R/W | R/W | R/W | R/W | |||||||||||||
| Field | ATTR0 | ENABLE | ATTR1 | ATTR2 | |||||||||||||
| 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0 | ||
| Access | R/W | R/W | |||||||||||||||
| Field | ATTR3 | ATTR4 | |||||||||||||||
This register probably configures certain aspects of the NAND interface (timings?)[check].
| Field | Description |
| ATTR0 | Set based on lookup table; set to 3 for 128MB NAND chips, 4 otherwise |
| ENABLE | Set to 1 before first command is sent to NAND, set to 0 when de-initializing the NAND driver. |
| ATTR1 | Set based on lookup table; always 0x3 |
| ATTR2 | Set based on lookup table; always 0x3e |
| ATTR3 | Set based on lookup table; always 0x0e |
| ATTR4 | Set based on lookup table; always 0x7f |
When IOSU initializes the NAND driver, it turns on the enable bit (writing 0x08000000) and then send the GET CHIP ID command (0x90). Based on the reply, it looks up the correct definitions of the other attributes and pokes them into this register. C2W changes this register twice during boot, once setting it to 0xCB3E0E7F and again setting it to 0x743E3EFF.
| NAND_ADDR1 (0x0d010008) | ||||||||||||||||
| 31 | 30 | 29 | 28 | 27 | 26 | 25 | 24 | 23 | 22 | 21 | 20 | 19 | 18 | 17 | 16 | |
| Access | U | |||||||||||||||
| Field | ||||||||||||||||
| 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0 | |
| Access | R/W | R/W | ||||||||||||||
| Field | ADDR2 | ADDR1 | ||||||||||||||
This register contains the first two address bytes that can be sent to the NAND chip. Normally it contains the column address (offset within a page).
| Field | Description |
| ADDR2 | Second address byte |
| ADDR1 | First address byte |
| NAND_ADDR2 (0x0d01000c) | ||||||||||||||||
| 31 | 30 | 29 | 28 | 27 | 26 | 25 | 24 | 23 | 22 | 21 | 20 | 19 | 18 | 17 | 16 | |
| Access | U | R/W | ||||||||||||||
| Field | ADDR5 | |||||||||||||||
| 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0 | |
| Access | R/W | R/W | ||||||||||||||
| Field | ADDR4 | ADDR3 | ||||||||||||||
This register contains the last three address bytes that can be sent to the NAND chip. Normally it contains the row address (page number).
Wii Nand 4.3 Volt
| Field | Description |
| ADDR5 | Fifth address byte |
| ADDR4 | Fourth address byte |
| ADDR3 | Third address byte |
| NAND_DATABUF (0x0d010010) | ||
| 314 | 30 | |
| Access | R/W | U |
This register contains the DMA address of the page data buffer (0x800 bytes). The address must be 16-byte aligned.If the spare data is being written alone (such as using a RANDOM DATA IN command with DMALEN=0x40), this points to it instead. Generally speaking, the first 0x800 bytes of data go here, whatever they may be.
Wii Nand 4.3 Amp
| NAND_ECCBUF (0x0d010014) | ||
| 314 | 30 | |
| Access | R/W | U |
This register contains the DMA address of the spare and ECC data buffer (0x40 spare bytes + 0x10 bytes of hardware-calculated ECC syndrome). The address must be 16-byte aligned.The hardware-calculated ECC is written to the address in this register XOR 0x40.
| NAND_BANK (0x0d010018) | |
| 310 | |
| Access | R/W |
This register contains a flag representing the currently active NAND bank. 0x00000001 is the vWii's bank and 0x00000002 is the Wii U's bank.