Changes

This article describes the process of how production Wii consoles are set up at the factory, from initial manufacturing of the chips to retail shipment.

This article describes the process of how production Wii consoles are set up at the factory, from initial manufacturing of the chips to retail shipment.

==Preloading==

==Preloading==

Every Wii is preloaded at the hardware level with a couple pieces of software; these are already present on the Wii and will run when the Wii is powered on at the factory. The first of these pieces of software is boot0, the first piece of code ran on the Wii after power-on (which will stay the same from when it is physically programmed onto the chip to after factory setup, since it cannot physically be modified), which will check the Wii's OTP (one-time programmable) memory chip, and seeing that it is blank (as it is written to later in the process, using up its one opportunity to program it), determines that it is in the factory and continues with boot by loading boot1 from the NAND; after factory setup, there are keys present within this area, which boot0 uses to verify your copy of boot1, but during first factory boot this is neither possible nor needed, so boot0 skips it. Next, boot1 loads from the NAND. Boot1 works as usual by verifying the signature of the boot2 on the NAND, then loading it; this process is identical as long as the console has a properly signed boot2, so there's no special factory behavior that boot1 has here.

Every Wii is preloaded at the hardware level with a few pieces of software; these are already present on the Wii and will run when the Wii is powered on at the factory. The first of these pieces of software is [[boot0]], the first piece of code ran on the Wii after power-on (which will stay the same from when it is physically programmed onto the chip to after factory setup, since it cannot physically be modified), which will check the stored [[boot1]] hash in the Wii's [[EFuse|eFuses]], and seeing that it is blank (as it is written to later in the process, using up its one opportunity to program it), determines that it is in the factory and continues with boot by loading boot1 from the NAND. boot1 works as usual by verifying the signature of the boot2 on the NAND, then loading it.

 

Next, [[boot2]] loads; the version of boot2 installed on a Wii once it comes out of the factory can only handle an encrypted NAND filesystem; the problem with that in the factory is that at this point the OTP has not been programmed, and since the OTP contains the console-unique NAND keys, it is impossible to have the NAND encrypted at this point. As such, the NAND is unencrypted, which the production version of boot2 cannot handle; presumably, a special factory version of boot2 (possibly boot2v0) is programmed on Wiis at this point, which can boot from unencrypted NAND filesystems and as such will continue boot as normal. The next thing to be loaded is the System Menu. While it isn't clear what exactly this System Menu is, it is most likely a version of the [[NDEV Menu]]. It's unknown what version of the NDEV menu is used or what IOS is associated with it; it is possible that this changed over the Wii's lifespan with updates to the menu and its associated IOS.

Next, [[boot2]] loads; the version of boot2 installed at the factory is "sd_boot", a special boot2 which does not read or write to NAND and instead boots from the SD card; a SD card (designated as SD#1) is prepared containing a number of [[BroadOn]]-format [[WAD]] files (stored raw with no filesystem); one of these files has its contents executed as an ARM binary on the [[IOP]], said file being an installer program which will install the other WADs on the SD card to the NAND. On production systems, this typically includes a [[NDEV Menu]], [[IOS]]4, and IOS9, although other variations have been seen such as images which install [[BC]] and [[MIOS]]. The NDEV Menu will then be booted, allowing for the next phase of setup to occur when a disc is inserted.

At this point, a disc would be inserted to begin the process of setting up the system. While this disc presumably has an official name which is currently unknown, it will be referred to as "123J", as 123J is the [[GameID]] of the disc (as evidenced by its presence in the [[uid.sys]] logs of all Wiis, as well as other NAND remnants). This disc most likely runs on IOS4 or IOS9 (it is possible that this changed over the Wii's lifecycle as well with updates to the disc), and, as far as we are aware, serves one main purpose; writing to the OTP chip and encrypting the NAND filesystem. However, there is one other possible task that 123J may have performed, which is updating boot1. As Nintendo issued various updates to boot1 throughout the Wii's lifecycle (most infamously the update that fixed the trucha bug within it, aka disabling bootmii/boot2 on newer Wiis), the most logical way to issue these updates would be by implementing a function to update boot1 within 123J before writing to the OTP area (since the OTP area contains the hash of boot1, if you want to update boot1, you have to update it before writing the hash). Nintendo also could have simply updated the boot1 version in their pre-prepared set of files programmed onto the system physically before it even hits the factory stations, although doing this through 123J seems more logical.

After writing data to the OTP (therefore locking boot1, and setting all of the sysem's console-unique encryption keys), 123J encrypts the console's NAND filesystem using the newly generated NAND keys; these are the very same keys you get in your keys.bin file along with a BootMii dump, which are needed to decrypt the NAND. Next, [[RVL_DIAG|a disc known as 100J, also titled 0000dead and RVL_DIAG]] is inserted. This disc contains several test programs which could be used to verify the Wii's hardware as part of a quality control process. However, it is unknown what purpose this disc serves exactly during the retail Wii manufacturing process, as the [[RVL_UJI_DIAG]] (121J) disc which runs next has almost all of the same content as 100J, with a few extra programs and more recent software revisions. As the publicly available copies of both of these discs were dumped from [[RVT-H Reader]] units, it could be that the manufacturing & testing process for development kits differs from that of retail units, and as such, this ID could represent a completely different disc during the retail manufacturing process.

At this point, a disc would be inserted to begin the process of setting up the system. While this disc presumably has an official name which is currently unknown, it will be referred to as "123J", as 123J is the [[GameID]] of the disc (as evidenced by its presence in the [[uid.sys]] logs of all Wiis, as well as other NAND remnants). This disc's exact purpose is unknown as no code from it has been recovered, but it is presumed that it plays the role of setting [[eFuse]] bits (which results in setting console-unique keys and finalizing the installed boot1 version), possibly also updating boot1 and boot2 to prepare for the Wii to boot from a production encrypted NAND filesystem. This process likely would be done using a [[Waikiki]] from a PC host. This disc may contain a second partition with ID "0000dead".

The next disc inserted is the aforementioned [[RVL_UJI_DIAG]], with [[GameID]] 121J. The copy of this disc obtained from an RVT-H Reader includes several testing programs which could be used to ensure the integrity of a unit's hardware, as well as programs that run pre-defined tests, the results of which are then written to [[testlog.txt]]. It also contains [[serNoReg]], the program which registers the console's serial number using a mentioned but unseen piece of PC software. The retail version of 121J appears to include an additional step not present in the RVT-H version, as it installs a WAD titled 'DataChk.wad' to the NAND via a second partition with the ID '0002'. While this title is normally deleted from NAND after it is used, it is left behind on some Wiis for unknown reasons, and as such it has been obtained publicly and its behavior is detailed below.

The next disc inserted is [[RVL_UJI_DIAG]], with [[GameID]] 121J. The copy of this disc obtained from an RVT-H Reader includes several testing programs which could be used to ensure the integrity of a unit's hardware, as well as programs that run pre-defined tests, the results of which are then written to [[testlog.txt]]. It also contains [[serNoReg]], the program which registers the console's serial number using a mentioned but unseen piece of PC software, and "PreWrite.dol", a program which seems to write data to NAND over [[EXI]] (Waikiki); it is unknown if this is used in retail system production or not.

==Data Check and Log Check's role==  

==122E==  

[[File:0002-2.png|thumb|PUSH SD CARD, THEN REMOVE IT]]

[[File:0002-2.png|thumb|PUSH SD CARD, THEN REMOVE IT]]

[[File:0002-3.png|thumb|PUSH RESET BUTTON]]

[[File:0002-3.png|thumb|PUSH RESET BUTTON]]

''See also: [[Data Check and Log Check]]''

''See also: [[Data Check and Log Check]]''

This disc and accompanying WAD file are known as "0002", but the in-program name is "DATA CHECK & LOG CHECK".  There are two known versions of this file, both dumped from separate Wiis; 1.5.0 and 1.5.1.

122E is a disc which has a game partition and an update partition; the game partition installs the title "0002" from the SD card (with filename "DataChk.wad"), and the update partition contains the final set of retail [[Wii System Menu]]/IOS/Channel data for production.

 

0002's exact purpose is unknown; it appears to verify the results of 121J by checking files on NAND as well as files from an SD card, in particular [[all.ini]]. all.ini is a list of tests near-identical to that which is present in 121J under the filename "master.dat"; it is unknown why 0002 requests this file, or why it was copied to NAND and therefore able to be retrieved from a retail Wii system.

 

Once 122E has finished installing the base set of titles, the system's initial manufacturing & testing process is complete, and on the next boot the system will be running the retail [[Wii Menu]] on the initial setup screen.

0002 ('''DATA CHECK & LOG CHECK''') is a program which checks the results of 121J to ensure that diagnostics passed and data was written correctly. While this program is meant to be deleted before the process finishes, for unknown reasons it is still present intact on some Wiis and versions 1.5.0 and 1.5.1 have been recovered.

{{Template:WiiNavbox}}

{{Template:WiiNavbox}}