Dandandin.net

 

What's inside the Wii

Did you know that inside a Wii there are 3 processors? Yes it is! The purpose is:

  1. A "normal" PowerPC CPU, similar to G4 of some Apple Macs, it is an evoloution of the one inside of the GameCube (codenamed: Broadway)
  2. A GPU from ATI, codenamed Hollywood, also this is an evolution from the GameCube one
  3. An ARM coprocessor, like the one inside some handhelds (codename: Starlet). This cpu manages all the "vital functions" inside the Wii. The IOS will be run on this CPU.

The boot of the Wii wil occur in three parts:

Boot0

Is loaded from a read only memory placed inside the CPU. When the Wii is turned on, is the first to be loaded, and initializes all the components, decripts the boot1 from another internal flash memory, it verifies it from a fixed hash, and runs it. So, since the hash is not modifiable, is not possible to replace the boot1 - any edit will result in killing the Wii.

Boot1

The boot1 decrypts and verifies boot2. Luckily, it will compare boot2 against an hash contained in the same boot2. So, thanks to the famous fake signature check bug, is possible to replace the boot2 with another - BootMii. Since the boot1 cannot be patched, Nintendo cannot patch the fake signature check bug . "Unfortunately", on newest Wii, Nintendo has patched both boot0 and boot1, so BootMii cannot replace boot2 on brand new Wiis. But can be installed as additional IOS...

Boot2

Boot2 loads an IOS, initializes the Broadway CPU, and loads the system menu. BootMii replaces the IOS that will be loaded, and also its behaviour: it will load a file from the SD card (if not present, will be loaded the normal menu)

With BootMii, you can do many interesting operations like:

  • Diractly load the Homebrew Channel
  • Safely edit the system menu, for example removing the useless health warning
  • Downgrade to a previous system version
  • and much more!

https://old.dandandin.net/what-is-boot2.aspx