sdboot (Wii)
 | This article is a stub. |
sdboot, also known as boot2v0, is a factory-only version of boot2 that is capable of launching a BroadOn-format WAD from an SD card.
It is used during the Wii Factory Process to install a limited set of titles (a newer version of boot2, the Wii Menu, several mandatory IOS versions, etc.) required for the next steps of the Wii's initialization.
Several development and production versions of sdboot leaked as part of the Zammis Clark Breach and can be found in wiidump.7z.
Exploit
sdboot contains an exploit in its SD reading code that allows arbitrary code execution. Since production versions have leaked, it theoretically allows restoring boot2 modifications and therefore gaining early control of the system on Bollywood units. However, it has not been widely adopted due to several critical requirements. Notably, it only works with SD (non-SDHC) cards, which are becoming increasingly rare, and it requires nullifying the boot2 counters in the serial EEPROM to prevent boot1 from halting the system when it detects that boot2 has been downgraded.
