iQueBrew - User contributions [en]

Content ID

2018-04-06T15:54:17Z

Emoose: Add info about 4 & 8 digit IDs.

'''Content IDs''' are numerical codes used by the [[iQue Player]] and [[iQue@Home]] to uniquely identify each game, manual, app and [[SKSA|system update]].

There seem to be two different formats of Content IDs, a 4-digit format used to identify system updates, and a 7/8-digit format used for everything else.

== 4-digit / "Secure Content ID" format ==
Only used for SKSAs, where each update can have 3 different content IDs associated with it: a content ID to identify the update itself, and separate content IDs for the SA1 and SA2 parts included with it. (eg. SKSA 1106 contains SA1 1095 and SA2 1107)

With this format it seems the last 3 digits are used as the version number, with the first digit assumed to be the ID of the title (always 1).

Note that content IDs in this format can't be used by themselves to uniquely identify content, for example there are 3 different SA1s that all share the same 1095 content ID, but with differing content hashes.

This format is known as a "Secure Content ID" in the [[depot.sys|depot.sys structure]], though it still gets stored as a normal content ID in the [[Ticket|Ticket structure]].

== 7/8-digit format ==
Used for games, manuals and apps. Games and manuals always use the 7-digit form, while apps use 8-digits. The system used supports up to 100 versions of 100 titles in 100/1000 genres, and their respective manuals.

As an example of the format, [[Super Mario 64]]'s content ID is '''1101104''':

* The first, second characters ('''11'''01104) define the [[genre]].
* The third and fourth characters (11'''01'''104) actually identify the game, increasing by 1 with each new game in the genre.
* The fifth character (1101'''1'''04) determines the type of content - 1 for a game, 9 for a manual, (and possibly 0 for an app). Other types of content were likely planned.
* The sixth and seventh characters (11011'''04''') are thought to be the version of the content, though this isn't definitely confirmed.

(for 8-digit IDs, remove the first digit and assume the genre is "100" or "200" for the format above to work)

Internally, the iQue Player converts the content IDs to hexadecimal (e.g. '''0010cd30''' for Super Mario 64) for storing .app, .rec and .sta files.

Titles

2018-03-26T11:41:00Z

Emoose: add ticket status for each title

These are titles downloadable via http://cds.idc.ique.com:16963/cds/download?content_id=xxx, where xxx is replaced with one of the following IDs:

=== Apps ===
{| class="wikitable"
|-
! Content ID
! Name
! Have ticket?
|-
| 10000001
| ? (older iQue Club?)
| N
|-
| 10000002
| ? (older iQue Club?)
| N
|-
| 10000003
| iQue Club
| Y
|}

=== Games ===
{| class="wikitable"
|-
! Content ID
! Name
! Have ticket?
|-
| 1101104
| Super Mario 64
| Y
|-
| 1102101
| Yoshi Story
| Y
|-
| 1201105
| Smash Bros
| Y
|-
| 2101104
| TLoZ: OoT
| Y
|-
| 2102104
| Paper Mario
| Y
|-
| 21031??
| TLoZ: MM (not on CDS)
| N
|-
| 2104108
| Animal Crossing
| Y
|-
| 2105103
| Custom Robo
| Y
|-
| 2106101
| ?
| N
|-
| 4101104
| Star Fox 64 (v4)
| N
|-
| 4101105
| Star Fox 64 (v5)
| Y
|-
| 4102103
| Sin & Punishment
| Y
|-
| 5101104
| Wave Race 64
| Y
|-
| 5102108
| Excitebike
| Y
|-
| 5201104
| Mario Kart 64 (v4)
| Y
|-
| 5201105
| Mario Kart 64 (v5)
| Y
|-
| 5202103
| F-Zero X
| Y
|-
| 6101104
| Dr. Mario
| Y
|}

=== Game Manuals ===
{| class="wikitable"
|-
! Content ID
! Name
! Have ticket?
|-
| 1101902
| Super Mario 64 (v2)
| N
|-
| 1101906
| Super Mario 64 (v6)
| Y
|-
| 1102902
| Yoshi Story (v2)
| N
|-
| 1102904
| Yoshi Story (v4)
| N
|-
| 1102906
| Yoshi Story (v6)
| Y
|-
| 1201901
| Smash Bros
| Y
|-
| 2101902
| TLoZ: OoT (v2)
| N
|-
| 2101904
| TLoZ: OoT (v4)
| Y
|-
| 2102902
| Paper Mario (v2)
| N
|-
| 2102904
| Paper Mario (v4)
| Y
|-
| 4101902
| Star Fox 64 (v2)
| N
|-
| 4101904
| Star Fox 64 (v4)
| Y
|-
| 4102901
| Sin & Punishment
| Y
|-
| 5101902
| Wave Race 64 (v2)
| N
|-
| 5101904
| Wave Race 64 (v4)
| Y
|-
| 5102902
| Excitebike
| Y
|-
| 5201902
| Mario Kart 64 (v2)
| N
|-
| 5201906
| Mario Kart 64 (v6)
| Y
|-
| 5202902
| F-Zero X (v2)
| N
|-
| 5202904
| F-Zero X (v4)
| Y
|-
| 6101902
| Dr. Mario (v2)
| N
|-
| 6101904
| Dr. Mario (v4)
| Y
|}

IQue Player

2018-03-26T06:27:30Z

Emoose:

{{DISPLAYTITLE:iQue Player}}
[[File:iQue Player.png|thumb|An '''iQue Player'''.]]

The '''iQue Player''' (Chinese: 神游机, lit. "Divine gaming machine") is a game console created by iQue and BroadOn (formerly Routefree, later iGware, now Acer Cloud) in partnership with Nintendo, only released in China in late 2003. iQue company was co-founded by engineer [https://en.wikipedia.org/wiki/Wei_Yen Dr. Wei Yen], an USA-CHN scientist mainly involved in the development of the N64 GFX chip "Reality Engine"; he is also the founder of ArtX, a company that was commissioned by Nintendo to produce the Game Cube processor named "Flipper".

The reason for this union was dictated by the fact that, since 2000, the Chinese market "suffered" from a [https://en.wikipedia.org/wiki/Video_gaming_in_China#Changes_to_video_game_ban_in_China ban on gaming consoles] because they were considered harmful to the psyche of children (the ban ceased in 2015); Nintendo needed to circumvent the problem and to be able to insert its consoles in the vast market of China ([https://www.thegamesmachine.it/speciali/72045/time-machine-online-nintendo-cina-ique/ here it is a plausible explanation] on how it seems to have done). The opportunity came with iQue products, of which the "i Que Player" represents the progenitor and corresponds to the Chinese version of the Nintendo 64 (there are also iQue GBA, GBA SP, GB Micro, iQue DS, DS Lite, the iQue 3DS)!

This console is not a normal N64 but a "compressed" version of it in a single chip: based on the Nintendo 64, the iQue Player adds features like [[iQue Card|removable NAND flash]] memory, PC connectivity (via USB), slightly better performance, and 14 different [[games]] translated into Simplified Chinese.

[[Category:Hardware]]

IQue Player

2018-03-26T06:27:09Z

Emoose:

{{DISPLAYTITLE:iQue Player}}
[[File:iQue Player.png|thumb|An '''iQue Player'''.]]

The '''iQue Player''' (Chinese: 神游机, lit. "Divine gaming machine") is a game console created by iQue and BroadOn (formerly Routefree, later iGware, now Acer Cloud) in partnership with Nintendo, only released in China in late 2003. iQue company was co-founded by engineer [https://en.wikipedia.org/wiki/Wei_Yen Dr. Wei Yen], an USA-CHN scientist mainly involved in the development of the N64 GFX chip "Reality Engine"; he is also the founder of ArtX, a company that was commissioned by Nintendo to produce the Game Cube processor named "Flipper".

The reason for this union was dictated by the fact that, since 2000, the Chinese market "suffered" from a [https://en.wikipedia.org/wiki/Video_gaming_in_China#Changes_to_video_game_ban_in_China ban on gaming consoles] because they were considered harmful to the psyche of children (the ban ceased in 2015); Nintendo needed to circumvent the problem and to be able to insert its consoles in the vast market of China ([https://www.thegamesmachine.it/speciali/72045/time-machine-online-nintendo-cina-ique/ here it is a plausible explanation] on how it seems to have done). The opportunity came with iQue products, of which the "i Que Player" represents the progenitor and corresponds to the Chinese version of the Nintendo 64 (there are also iQue GBA, GBA SP, GB Micro, iQue DS, DS Lite, the iQue 3DS)!

This console, is not a normal N64 but a "compressed" version of it in a single chip: based on the Nintendo 64, the iQue Player adds features like [[iQue Card|removable NAND flash]] memory, PC connectivity (via USB), slightly better performance, and 14 different [[games]] translated into Simplified Chinese.

[[Category:Hardware]]

IQue Player

2018-03-26T06:24:35Z

Emoose:

{{DISPLAYTITLE:iQue Player}}
[[File:iQue Player.png|thumb|An '''iQue Player'''.]]

The '''iQue Player''' is a game console created by iQue and BroadOn (formerly Routefree, later iGware, now Acer Cloud) in partnership with Nintendo, only released in China in late 2003. iQUe company was co-founded by engineer [https://en.wikipedia.org/wiki/Wei_Yen Dr. Wei Yen], an USA-CHN scientist mainly involved in the development of the N64 GFX chip "Reality Engine"; he is also the founder of ArtX, a company that was commissioned by Nintendo to produce the Game Cube processor named "Flipper".

The reason for this union was dictated by the fact that, since 2000, the Chinese market "suffered" from a [https://en.wikipedia.org/wiki/Video_gaming_in_China#Changes_to_video_game_ban_in_China ban on gaming consoles] because they were considered harmful to the psyche of children (the ban ceased in 2015); Nintendo needed to circumvent the problem and to be able to insert its consoles in the vast market of China ([https://www.thegamesmachine.it/speciali/72045/time-machine-online-nintendo-cina-ique/ here it is a plausible explanation] on how it seems to have done). The opportunity came with iQue products, of which the "i Que Player" represents the progenitor and corresponds to the Chinese version of the Nintendo 64 (there are also iQue GBA, GBA SP, GB Micro, iQue DS, DS Lite, the iQue 3DS)!

This console, whose name in Chinese means "Divine gaming machine", is not a normal N64 but a "compressed" version of it in a single chip: based on the Nintendo 64, the iQue Player adds features like [[iQue Card|removable NAND flash]] memory, PC connectivity (via USB), slightly better performance, and 14 different [[games]] translated into Simplified Chinese.

[[Category:Hardware]]

IQue Player

2018-03-26T05:31:40Z

Emoose: link to iQue Card instead of NAND

IQue Card

2018-03-25T03:40:31Z

Emoose:

[[File:IQue_card_disassembled.jpg|thumb|A disassembled '''iQue Card'''.]]

The '''iQue Card''' is a removable memory card used to store games & the [[SKSA|"Upgradable Operating System"]].

The card is housed in a plastic shell, which contains a Samsung K9F1208U0M-YCB0 NAND chip on a special PCB codenamed "DOOKIE". The contents of the NAND are documented on the [[NAND]] page.

== DOOKIE ==
The DOOKIE board is very basic, containing the NAND flash, a few resistors, and an edge connector for connecting with the main system. The connector has a 1.1mm pitch and seems to be custom made, no other commonly-available connector appears to fit it, other than MicroSD.

[[Category:Hardware]]

File:IQue card disassembled.jpg

2018-03-25T03:39:59Z

Emoose:

Ticket

2018-03-24T23:54:37Z

Emoose:

An iQue '''Ticket''' is used to store data about a piece of content, such as the size, hash and ID. It's used as part of the [[SKSA]] (for info about the SA1/SA2) and also used as part of the [[Title Data]] structure (for info about the game title).

Each ticket is signed via RSA-2048 using a CP (content protection?) certificate, the method for signing/verifying has been found for SA1/SA2, but game tickets don't seem to work. It's likely that some part of the structure is changed in memory just before the iQue validates it.

== Format ==
The ticket format is similar to a [http://wiibrew.org/wiki/Ticket Wii ticket], though it seems the structure was reworked sometime between the iQue and Wii.

It's assumed that the title key needed to decrypt an SA / .app is part of the structure, though likely encrypted with a common-key that's yet to be dumped from the console.

{| class="wikitable"
|-
! Offset
! Length
! Type
! Information
|-
| 0x0
| 0x8
| bytes
| Unknown (always 0?)
|-
| 0x8
| 0x4
| int32
| Unknown (always 1?)
|-
| 0xC
| 0x4
| uint32
| Content Size
|-
| 0x10
| 0x4
| int32
| Unknown (0 for tickets, 1 for SA?)
|-
| 0x14
| 0x10
| bytes
| Unknown (possible title-key)
|-
| 0x24
| 0x14
| bytes
| Content hash (hash of the decrypted content)
|-
| 0x38
| 0x10
| bytes
| Unknown ('''very possible title-key''')
|-
| 0x48
| 0x4
| int32
| Unknown (2 for game tickets, 0 for SA/iQue Club ticket?)
|-
| 0x4C
| 0x4
| int32
| Unknown (0 for games, 0x13 for iQue Club, 0x1F7/0x1B3 for SA)
|-
| 0x50
| 0x4
| int32
| Unknown (0x4000 for games, 0x6001 for iQue Club, -1 for normal SAs, 0xE01 for weird SAs?)
|-
| 0x54
| 0x4
| int32
| Unknown (always 0?)
|-
| 0x58
| 0x40
| chars
| Authority (cert used to sign ticket)
|-
| 0x98
| 0x4
| uint32
| Content ID (can't be higher than 99999999, if (cid / 100) % 10 == 9, this is a game manual)
|-
| 0x9C
| 0x10
| bytes
| Unknown (possible title-key - contents change between devices, but signature remains the same???)
|-
| 0xAC
| 0x100
| bytes
| RSA-2048 signature
|}

In different SAs which seem to have matching bytes in the encrypted data, the field at 0x38 seems to be the only constant between them, likely our best suspect for the title-key.

== Signature ==
The signature is made from a SHA1 hash of 0x0 - 0xAC. In SA1/SA2 this hash seems to be valid for the given signature, but for some reason game tickets don't seem to validate.

Comparing tickets for the same game from two different devices, the area at 0x9C-0xAC seems to completely change, while the actual signature remains the same. It's likely that this area is probably decrypted using a per-device key just before verification.

=== Fake Signing ===
As the iQue is so similar to Wii it was guessed that fake-signing may be possible. Sadly tests done with SA1 tickets have all been unsuccessful, though it could be possible that the way SK validates signatures is completely different to how SA1/SA2 validates them (it may be that SK uses an Assembly version for validation, while SA1/SA2 use the C version shared with the Wii, though this is all just speculation at this point)

[[Category:File formats]]

Titles

2018-03-24T19:45:24Z

Emoose:

These are titles downloadable via http://cds.idc.ique.com:16963/cds/download?content_id=xxx, where xxx is replaced with one of the following IDs:

=== Apps ===
{| class="wikitable" style="width:30%"
|-
! Content ID
! Name
|-
| 10000001
| ? (older iQue Club?)
|-
| 10000002
| ? (older iQue Club?)
|-
| 10000003
| iQue Club
|}

=== Games ===
{| class="wikitable" style="width:30%"
|-
! Content ID
! Name
|-
| 1101104
| Super Mario 64
|-
| 1102101
| Yoshi Story
|-
| 1201105
| Smash Bros
|-
| 2101104
| TLoZ: OoT
|-
| 2102104
| Paper Mario
|-
| 21031
| TLoZ: MM
|-
| 2104108
| Animal Crossing
|-
| 2105103
| Custom Robo
|-
| 2106101
| ?
|-
| 4101104
| Star Fox 64 (v4)
|-
| 4101105
| Star Fox 64 (v5)
|-
| 4102103
| Sin & Punishment
|-
| 5101104
| Wave Race 64
|-
| 5102108
| Excitebike
|-
| 5201104
| Mario Kart 64 (v4)
|-
| 5201105
| Mario Kart 64 (v5)
|-
| 5202103
| F-Zero X
|-
| 6101104
| Dr. Mario
|}

=== Game Manuals ===
{| class="wikitable" style="width:30%"
|-
! Content ID
! Name
|-
| 1101902
| Super Mario 64 (v2)
|-
| 1101906
| Super Mario 64 (v6)
|-
| 1102902
| Yoshi Story (v2)
|-
| 1102904
| Yoshi Story (v4)
|-
| 1102906
| Yoshi Story (v6)
|-
| 1201901
| Smash Bros
|-
| 2101902
| TLoZ: OoT (v2)
|-
| 2101904
| TLoZ: OoT (v4)
|-
| 2102902
| Paper Mario (v2)
|-
| 2102904
| Paper Mario (v4)
|-
| 4101902
| Star Fox 64 (v2)
|-
| 4101904
| Star Fox 64 (v4)
|-
| 4102901
| Sin & Punishment
|-
| 5101902
| Wave Race 64 (v2)
|-
| 5101904
| Wave Race 64 (v4)
|-
| 5102902
| Excitebike
|-
| 5201902
| Mario Kart 64 (v2)
|-
| 5201906
| Mario Kart 64 (v6)
|-
| 5202902
| F-Zero X (v2)
|-
| 5202904
| F-Zero X (v4)
|-
| 6101902
| Dr. Mario (v2)
|-
| 6101904
| Dr. Mario (v4)
|}

Titles

2018-03-24T19:41:10Z

Emoose: reformat page

These are titles downloadable via http://cds.idc.ique.com:16963/cds/download?content_id=xxx, where xxx is replaced with one of the following IDs:

=== Apps ===
{| class="wikitable" style="width:30%"
|-
! Content ID
! Name
|-
| 10000001
| ? (older iQue Club?)
|-
| 10000002
| ? (older iQue Club?)
|-
| 10000003
| iQue Club
|}

=== Games ===
{| class="wikitable" style="width:30%"
|-
! Content ID
! Name
|-
| 1101104
| Super Mario 64
|-
| 1102101
| Yoshi Story
|-
| 1201105
| Smash Bros
|-
| 2101104
| TLoZ: OoT
|-
| 2102104
| Paper Mario
|-
| 21031
| TLoZ: MM
|-
| 2104108
| Animal Crossing
|-
| 2105103
| Custom Robo
|-
| 2106101
| ?
|-
| 4101104
| Star Fox 64 (v4)
|-
| 4101105
| Star Fox 64 (v5)
|-
| 4102103
| Sin & Punishment
|-
| 5101104
| Wave Race 64
|-
| 5102108
| Excitebike
|-
| 5201104
| Mario Kart 64 (v4)
|-
| 5201105
| Mario Kart 64 (v5)
|-
| 5202103
| F-Zero X
|-
| 6101104
| Dr. Mario
|}

=== Game Manuals ===
{| class="wikitable" style="width:30%"
|-
| 1101902
| Super Mario 64 (v2)
|-
| 1101906
| Super Mario 64 (v6)
|-
| 1102902
| Yoshi Story (v2)
|-
| 1102904
| Yoshi Story (v4)
|-
| 1102906
| Yoshi Story (v6)
|-
| 1201901
| Smash Bros
|-
| 2101902
| TLoZ: OoT (v2)
|-
| 2101904
| TLoZ: OoT (v4)
|-
| 2102902
| Paper Mario (v2)
|-
| 2102904
| Paper Mario (v4)
|-
| 4101902
| Star Fox 64 (v2)
|-
| 4101904
| Star Fox 64 (v4)
|-
| 4102901
| Sin & Punishment
|-
| 5101902
| Wave Race 64 (v2)
|-
| 5101904
| Wave Race 64 (v4)
|-
| 5102902
| Excitebike
|-
| 5201902
| Mario Kart 64 (v2)
|-
| 5201906
| Mario Kart 64 (v6)
|-
| 5202902
| F-Zero X (v2)
|-
| 5202904
| F-Zero X (v4)
|-
| 6101902
| Dr. Mario (v2)
|-
| 6101904
| Dr. Mario (v4)
|}

Main Page/Navigation

2018-03-24T19:27:25Z

Emoose:

{{Main page box|Navigation|:Navigation}}
<div style="margin: -.3em -1em -1em -1em;">
{| width="100%" bgcolor="#fff" border="0" cellpadding="2px" cellspacing="2px" style="margin:auto;"
|- align="center" bgcolor="#e7eef6"
! width="33%" | '''General''' 
! width="33%" | '''Homebrew''' 
! width="33%" | '''Hardware/Software''' 
|- valign="top" style="background: #F5FAFF;"
|
*[[Glossary]]
*[[Games]]
*[[:Category:PC utilities|PC Utilities]]
|
*[[Homebrew Exploits]]
*[[Homebrew Applications]]
*[[Homebrew Libraries and Tools]]
*[[System Flaws]]
|
*[[:Category:Hardware|Hardware]]
*[[IQue Player|Player Overview]] ([[IO|IO registers]])
*[[IQue Card|Memory Card]]
*[[:Category:File_formats|File Formats]]
|}
</div>
{{box-footer-empty}}

IQue Card

2018-03-24T19:26:21Z

Emoose: Created page with "The '''iQue Card''' is a removable memory card used to store games & the "Upgradable Operating System". The card is housed in a plastic shell, which contains a Samsu..."

The '''iQue Card''' is a removable memory card used to store games & the [[SKSA|"Upgradable Operating System"]].

The card is housed in a plastic shell, which contains a Samsung K9F1208U0M-YCB0 NAND chip on a special PCB codenamed "DOOKIE". The contents of the NAND are documented on the [[NAND]] page.

== DOOKIE ==
The DOOKIE board is very basic, containing the NAND flash, a few resistors, and an edge connector for connecting with the main system. The connector has a 1.1mm pitch and seems to be custom made, no other commonly-available connector appears to fit it, other than MicroSD.

[[Category:Hardware]]

IQue Depot

2018-03-24T19:03:41Z

Emoose:

https://i.imgur.com/nwQ8SNZ.jpg

The iQue depot is a physical kiosk that allows users to buy games and updates. Each game comes with a game code that can be used so the user can download the game. Players can also store their games on the iQue Depot network for free. Users must be a member of the iQue Club and have a special iQue Ticket to download games (source: [https://en.wikipedia.org/wiki/IQue_Player#iQue_Depot wikipedia]).

[[Category:Hardware]]

Category:Hardware

2018-03-24T19:02:33Z

Emoose: Created page with "Various pieces of hardware were released for the iQue, such as the player itself & the SWIM attachment (allowing for extra controllers to be connected to a single unit). Priva..."

Various pieces of hardware were released for the iQue, such as the player itself & the SWIM attachment (allowing for extra controllers to be connected to a single unit). Privately, devices like the iQue Depot were given (rented?) to certain stores, allowing users to buy and download games to their iQue Player Card.

Main Page/Navigation

2018-03-24T18:59:49Z

Emoose:

{{Main page box|Navigation|:Navigation}}
<div style="margin: -.3em -1em -1em -1em;">
{| width="100%" bgcolor="#fff" border="0" cellpadding="2px" cellspacing="2px" style="margin:auto;"
|- align="center" bgcolor="#e7eef6"
! width="33%" | '''General''' 
! width="33%" | '''Homebrew''' 
! width="33%" | '''Hardware/Software''' 
|- valign="top" style="background: #F5FAFF;"
|
*[[Glossary]]
*[[Games]]
*[[:Category:PC utilities|PC Utilities]]
|
*[[Homebrew Exploits]]
*[[Homebrew Applications]]
*[[Homebrew Libraries and Tools]]
*[[System Flaws]]
|
*[[:Category:Hardware|Hardware]]
*[[IQue Player|Player Overview]] ([[IO|IO registers]])
*[[Memory Cards]]
*[[:Category:File_formats|File Formats]]
|}
</div>
{{box-footer-empty}}

IQue Player

2018-03-24T18:59:33Z

Emoose: initial commit

The '''iQue Player''' is a game console created by iQue in partnership with Nintendo, released only in China. Based on the N64, it adds features like removable [[NAND]] flash memory, PC connectivity (via USB), slightly better performance & exclusive Chinese-translated games.

[[Category:Hardware]]

Main Page/Navigation

2018-03-24T18:56:44Z

Emoose: add hardware category to main page

{{Main page box|Navigation|:Navigation}}
<div style="margin: -.3em -1em -1em -1em;">
{| width="100%" bgcolor="#fff" border="0" cellpadding="2px" cellspacing="2px" style="margin:auto;"
|- align="center" bgcolor="#e7eef6"
! width="33%" | '''General''' 
! width="33%" | '''Homebrew''' 
! width="33%" | '''Hardware/Software''' 
|- valign="top" style="background: #F5FAFF;"
|
*[[Glossary]]
*[[Games]]
*[[:Category:PC utilities|PC Utilities]]
|
*[[Homebrew Exploits]]
*[[Homebrew Applications]]
*[[Homebrew Libraries and Tools]]
*[[System Flaws]]
|
*[[:Category:Hardware|Hardware]]
*[[Hardware|Player Overview]] ([[IO|IO registers]])
*[[Memory Cards]]
*[[:Category:File_formats|File Formats]]
|}
</div>
{{box-footer-empty}}

Ticket

2018-03-24T17:55:16Z

Emoose:

Ticket

2018-03-24T17:50:23Z

Emoose:

Ticket

2018-03-24T17:49:49Z

Emoose: Created page with "An iQue '''Ticket''' is used to store data about a piece of content, such as the size, hash and ID. It's used as part of the SKSA (for info about the SA1/SA2) and also used as..."

An iQue '''Ticket''' is used to store data about a piece of content, such as the size, hash and ID. It's used as part of the SKSA (for info about the SA1/SA2) and also used as part of the [Title Data] structure (for info about the game title).

Each ticket is signed via RSA-2048 using a CP (content protection?) certificate.

== Format ==
The ticket format is similar to a [http://wiibrew.org/wiki/Ticket Wii ticket], though it seems the structure was reworked sometime between the iQue and Wii.

It's assumed that the title key needed to decrypt an SA / .app is part of the structure, though likely encrypted with a common-key that's yet to be dumped from the console.

{| class="wikitable"
|-
! Offset
! Length
! Type
! Information
|-
| 0x0
| 0x8
| bytes
| Unknown (always 0?)
|-
| 0x8
| 0x4
| int32
| Unknown (always 1?)
|-
| 0xC
| 0x4
| uint32
| Content Size
|-
| 0x10
| 0x4
| int32
| Unknown (0 for tickets, 1 for SA?)
|-
| 0x14
| 0x10
| bytes
| Unknown (possible title-key)
|-
| 0x24
| 0x14
| bytes
| Content hash (hash of the decrypted content)
|-
| 0x38
| 0x10
| bytes
| Unknown ('''very possible title-key''')
|-
| 0x48
| 0x4
| int32
| Unknown (2 for game tickets, 0 for SA/iQue Club ticket?)
|-
| 0x4C
| 0x4
| int32
| Unknown (0 for games, 0x13 for iQue Club, 0x1F7/0x1B3 for SA)
|-
| 0x50
| 0x4
| int32
| Unknown (0x4000 for games, 0x6001 for iQue Club, -1 for normal SAs, 0xE01 for weird SAs?)
|-
| 0x54
| 0x4
| int32
| Unknown (always 0?)
|-
| 0x58
| 0x40
| chars
| Authority (cert used to sign ticket)
|-
| 0x98
| 0x4
| uint32
| Content ID (can't be higher than 99999999, if (cid / 0x64) % 0xA == 9, this is a game manual?)
|-
| 0x9C
| 0x10
| bytes
| Unknown (possible title-key - contents change between devices, but signature remains the same???)
|-
| 0xAC
| 0x100
| bytes
| RSA-2048 signature
|}

In different SAs which seem to have matching bytes in the encrypted data, the field at 0x38 seems to be the only constant between them, likely our best suspect for the title-key.

NAND

2018-03-24T17:28:08Z

Emoose: Add spare data info

The iQue uses a 64MiB '''NAND''' flash, which consists of 4096 logical blocks of 16384 bytes each (made up of 32 512-byte pages). Each page also has its own "spare" area, which is detailed below.

== Block Map ==
* '''0x0 - 0x40''' - SKSA area, marked in the BBFS FAT as reserved
* '''0x40 - 0xFF0''' - data area, used for files in the BBFS
* '''0xFF0 - 0x1000''' - BBFS area, each block holds a copy of the BBFS along with a 'sequence number', highest sequence number is the latest BBFS.

== BBFS ==
BBFS is the filesystem used on the iQue NAND, a very simple file-system used to store games and config data. The Wii NAND's SFFS is actually very similar to BBFS, though with many more features.

The BBFS is made up of three parts: a FAT (file-allocation table), an entry table and a footer:

=== FAT ===
The FAT is located at 0x0 in the BBFS block, made up of 4096 16-bit signed integers, one for each block in the NAND. This is used to specify if a block may be reserved, bad, available, or it might point to another block in the 'chain' (ie. file 0 points to block 0, block 0 points to block 2, block 2 points to block 15...), or signify the end of the chain.

Files make use of the FAT by simply pointing to a block in the FAT as its start block. Extracting the file is then just a matter of following the chain of pointers in the FAT, reading in each block until you reach an end-of-chain marker.

Possible FAT entries:

{| class="wikitable" style="width:30%"
|-
! Value
! Description
|-
| 0
| Free/unused block
|-
| -1
| End-of-chain marker
|-
| -2
| Bad block
|-
| -3
| Reserved block (used for SKSA area)
|}

=== Entry Table ===
File entries are stored from 0x2000 - 0x3FF4 in the BBFS block, allowing for 409 entries per BBFS.

Each entry has the format:
{| class="wikitable"
|-
! Offset
! Length
! Type
! Information
|-
| 0x0
| 0x8
| char
| File name
|-
| 0x8
| 0x3
| char
| File extension
|-
| 0xB
| 0x1
| byte
| Valid indicator (1 if file is valid)
|-
| 0xC
| 0x2
| int16
| Start block #
|-
| 0xE
| 0x2
| bytes
| Padding?
|-
| 0x10
| 0x4
| int32
| File size
|}

Files may be deleted by simply having the Valid indicator set to 0, or having a block number of -1, so when reading the entry table you should make sure to read all 409 entries first and then filter out any invalid ones.

=== Footer ===
From 0x3FF4 to 0x4000 is the BBFS footer, which simply contains a BBFS signature to identify it as a BBFS block, a sequence number used for finding the latest BBFS, and a checksum for verifying the BBFS contents.

{| class="wikitable"
|-
! Offset
! Length
! Type
! Information
|-
| 0x0
| 0x4
| char
| Magic (BBFS or BBFL)
|-
| 0x4
| 0x4
| int32
| Sequence number
|-
| 0x8
| 0x2
| int16
| Link block #
|-
| 0xA
| 0x2
| int16
| Checksum
|}

The "Link block #" field seems to be used for linking two BBFS blocks together, though this hasn't been seen in any NAND dumps so far (maybe meant for NANDs larger than 4096 blocks, or containing more than 409 entries?).

Checksum is a basic adder, the fields value is made by adding each uint16 from 0x0 - 0x3FFE, and taking the result away from 0xCAD7. For verifying, 0x0 - 0x4000 is added together, and if the result is 0xCAD7 the checksum is valid.

== Spare data ==
Each 512 page page in the NAND has a 16 byte "spare" area associated with it, which is used for bad-block markers, error-correction codes and block-pointers for the [[SKSA|SA]] area.

Unfortunately the I@H USB commands for reading/writing NAND can only access the last page-spare of each block, though hardware NAND writers can access all of them. It seems that writing a "block-spare" over USB will actually copy the spare data to all the page-spares in the block (besides the ECC section), and can also recalculate ECC itself if given ECC data of all 0xFF.

Blocks in the SA area (containing SA1/SA2 tickets or data) also have 3 bytes in the spare used for pointing toward the next SA block, ie. SA1 ticket block -> SA1 data block 1 -> SA1 data block n -> SA2 ticket block, it's guessed this is for working around any bad-blocks in the SA area.

ECC is calculated using a Hamming code, as documented in [https://www.kernel.org/doc/Documentation/mtd/nand_ecc.txt the Linux kernel nand_ecc documentation], a working iQue implementation is available inside [https://github.com/emoose/iQueTool/blob/master/iQueTool/Structs/iQueBlockSpare.cs#L56 the iQueTool source code].

So far the known spare format is:

{| class="wikitable"
|-
! Offset
! Length
! Type
! Information
|-
| 0x0
| 0x3
| bytes
| SA block data (1 byte, copied to all 3 bytes)
|-
| 0x3
| 0x2
| bytes
| Unknown (always 0xFF?)
|-
| 0x5
| 0x1
| byte
| Bad block indicator (0 if block is bad)
|-
| 0x6
| 0x2
| bytes
| Unknown (always 0xFF?)
|-
| 0x8
| 0x3
| bytes
| ECC data for 0x100-0x200 in the page
|-
| 0xB
| 0x2
| bytes
| Unknown (always 0xFF?)
|-
| 0xD
| 0x3
| bytes
| ECC data for 0x0-0x100 in the page
|}

[[Category:File formats]]

NAND

2018-03-24T17:12:58Z

Emoose: Finish BBFS section, TODO: spare data info

The iQue uses a 64MiB '''NAND''' flash, which consists of 4096 logical blocks of 16384 bytes each (made up of 32 512-byte pages)

Each page also has 16 bytes of spare data, which is used for bad-block markers, error-correction codes and block-pointers for the [[SKSA|SA]] area.

Unfortunately the I@H USB commands for reading/writing NAND can only access the last page-spare of each block, though hardware NAND writers can access all of them.

== Block Map ==
* '''0x0 - 0x40''' - SKSA area, marked in the BBFS FAT as reserved
* '''0x40 - 0xFF0''' - data area, used for files in the BBFS
* '''0xFF0 - 0x1000''' - BBFS area, each block holds a copy of the BBFS along with a 'sequence number', highest sequence number is the latest BBFS.

== BBFS ==
BBFS is the filesystem used on the iQue NAND, a very simple file-system used to store games and config data. The Wii NAND's SFFS is actually very similar to BBFS, though with many more features.

The BBFS is made up of three parts: a FAT (file-allocation table), an entry table and a footer:

=== FAT ===
The FAT is located at 0x0 in the BBFS block, made up of 4096 16-bit signed integers, one for each block in the NAND. This is used to specify if a block may be reserved, bad, available, or it might point to another block in the 'chain' (ie. file 0 points to block 0, block 0 points to block 2, block 2 points to block 15...), or signify the end of the chain.

Files make use of the FAT by simply pointing to a block in the FAT as its start block. Extracting the file is then just a matter of following the chain of pointers in the FAT, reading in each block until you reach an end-of-chain marker.

Possible FAT entries:

{| class="wikitable" style="width:30%"
|-
! Value
! Description
|-
| 0
| Free/unused block
|-
| -1
| End-of-chain marker
|-
| -2
| Bad block
|-
| -3
| Reserved block (used for SKSA area)
|}

=== Entry Table ===
File entries are stored from 0x2000 - 0x3FF4 in the BBFS block, allowing for 409 entries per BBFS.

Each entry has the format:
{| class="wikitable"
|-
! Offset
! Length
! Type
! Information
|-
| 0x0
| 0x8
| char
| File name
|-
| 0x8
| 0x3
| char
| File extension
|-
| 0xB
| 0x1
| byte
| Valid indicator (1 if file is valid)
|-
| 0xC
| 0x2
| int16
| Start block #
|-
| 0xE
| 0x2
| bytes
| Padding?
|-
| 0x10
| 0x4
| int32
| File size
|}

Files may be deleted by simply having the Valid indicator set to 0, or having a block number of -1, so when reading the entry table you should make sure to read all 409 entries first and then filter out any invalid ones.

=== Footer ===
From 0x3FF4 to 0x4000 is the BBFS footer, which simply contains a BBFS signature to identify it as a BBFS block, a sequence number used for finding the latest BBFS, and a checksum for verifying the BBFS contents.

{| class="wikitable"
|-
! Offset
! Length
! Type
! Information
|-
| 0x0
| 0x4
| char
| Magic (BBFS or BBFL)
|-
| 0x4
| 0x4
| int32
| Sequence number
|-
| 0x8
| 0x2
| int16
| Link block #
|-
| 0xA
| 0x2
| int16
| Checksum
|}

The "Link block #" field seems to be used for linking two BBFS blocks together, though this hasn't been seen in any NAND dumps so far (maybe meant for NANDs larger than 4096 blocks, or containing more than 409 entries?).

Checksum is a basic adder, the fields value is made by adding each uint16 from 0x0 - 0x3FFE, and taking the result away from 0xCAD7. For verifying, 0x0 - 0x4000 is added together, and if the result is 0xCAD7 the checksum is valid.

[[Category:File formats]]

Category:PC utilities

2018-03-24T15:38:39Z

Emoose: Created page with "The iQue allows connecting to a computer over USB, here are some of the PC-side tools used."

The iQue allows connecting to a computer over USB, here are some of the PC-side tools used.

IQueDiagExtend

2018-03-24T15:38:17Z

Emoose:

'''iQueDiagExtend''' is an extension for [[ique_diag.exe]] which adds additional commands to the ique_diag menu, such as reading the raw [[NAND]] or writing back modified data.

While ique_diag has functions in the exe that allow for reading/writing the raw NAND, unfortunately they're only ever used as part of other functions, with the raw NAND functions never exposed to the user.

iQueDiagExtend hooks into the ique_diag menu, allowing us to add our own custom commands that can make use of those functions.

Source code can be found on emoose's GitHub page [https://github.com/emoose/iQueDiagExtend], with read-only builds available in the releases section [https://github.com/emoose/iQueDiagExtend/releases].

= Dumping =
To dump a NAND, connect the iQue to a system (or an XP VM) which has the [[iQue@Home]] drivers installed and run ique_diag.exe, then press 'x'. If DiagExtend is working it should print a list of custom commands added by the hook.

To start reading simply press 'B' (uppercase) to connect ique_diag to your device, and then press '1', progress on the dump will be printed every 16 blocks.

If the dump is successful a nand.bin (67,108,864 bytes) & spare.bin (65,536 bytes) will appear next to the ique_diag.exe (you should move these files between dumps, so that new dumps can be written to a fresh file).

= Writing =
iQueDiagExtend also has support for writing back to the NAND, though the public iQueDiagExtend builds are missing these writing functions for safety reasons. You can easily compile a write-enabled build from source if you have VS2017 installed (or just ask for a build in the iQue Hacking discord)

To write back to the device, first put the nand.bin/spare.bin you want to write in the same folder as ique_diag.exe, then open ique_diag and press 'B' (uppercase) to connect.

If you want to write the full nand.bin/spare.bin to the device simply press '2', progress will be given as it writes.

Alternatively if you only wish to write certain blocks to the device you can add ranges. For example, typing '2 0-0x100,4075' will write from the nand.bin only blocks 0 through 256, and block 4075. This can be much faster than needing to write the whole NAND each time!

= Hotswapping =
Unfortunately there are many iQue Players that lack any kind of USB support, due to the [[SKSA]] on them being an older version.

Luckily, if you have another Player that does have USB support, you can use that one to upgrade the non-USB card to a later SKSA that supports USB.

* Make sure the unit is plugged into your machine over USB
* Power on your USB-compatible unit with the USB-compatible card inside (once booted, it should appear under device manager as "iQue Player", as usual)
* Now with the unit still powered on, take the USB-compatible card out, and plug in the non-USB card
* On the PC open ique_diag.exe, and follow the steps in the "Dumping" / "Writing" section.

Make sure not to power off the iQue during this process, as it'll then try to boot up from the non-USB card.

[[Category:PC utilities]]

NAND

2018-03-24T15:37:11Z

Emoose:

Category:File formats

2018-03-24T15:36:51Z

Emoose: Created page with "The various file formats used by the iQue Player, ique_diag and iQue@Home."

The various file formats used by the iQue Player, ique_diag and iQue@Home.

SKSA

2018-03-24T15:36:19Z

Emoose:

'''SKSA''' (Secure Kernel / System App) is the "Upgradable Operating System" of the iQue Player, the main software that runs on the device.

== Parts ==
As the name implies it consists of two parts: a "secure kernel", and a "system app". In later SKSAs the system-app area may also be divided into two sections: SA1 and SA2.

* '''Secure Kernel''': the 'boot1' of the iQue. Doesn't ever seem to change between SKSA versions, so might be similar to the Wii boot1 where the hash of it is checked against a stored hash in the CPU. Probably only stored in NAND as it's cheaper than storing in CPU.

* '''System App 1''': Consists of a [[Ticket|ticket]], followed by the actual SA1 data. Most SA1s are just the iQue Menu, though some seem to be factory/graphics tests. SA1 seems to be responsible for handling USB comms too.

* '''System App 2''': Also has a ticket, followed by SA2 data. Unknown purpose, in SKSAs that have an SA2 the SA1 size is greatly reduced compared to single-SA SKSAs, assumably they moved some data from SA1 into this, but it seems like dual-SA SA1s can run without needing the corresponding SA2?

== Format ==
The format of the SKSA is simple: a 64KiB SK, followed by SA1 (ticket + data), optionally followed by SA2 (ticket + data):
{| class="wikitable"
|-
! Offset
! Length
! Type
! Information
|-
| 0x0
| 0x10000
| encrypted bytes
| Secure Kernel
|-
| 0x10000
| 0x4000
| ticket
| SA1 ticket
|-
| 0x14000
| (sa1ticket.ContentSize)
| encrypted bytes
| SA1 data
|-
| 0x14000 + sa1ticket.ContentSize
| 0x4000
| ticket
| SA2 ticket
|-
| 0x18000 + sa1ticket.ContentSize
| sa2ticket.ContentSize
| encrypted bytes
| SA2 data
|}

== NAND format ==
On NAND the format is slightly changed however: instead of storing the SA1 & SA2 data exactly as stored in the cached SKSA, the data is instead reversed in 0x4000 byte blocks (though tickets are unaffected). The NAND spare data is used to store pointers for these blocks, to allow for skipping any bad blocks in the SKSA area.

See [https://github.com/emoose/iQueTool/blob/master/iQueTool/Files/iQueNand.cs#L207 SetSKSAData in iQueTool] for an example on how the blocks are transformed, or see [https://github.com/emoose/iQueTool/blob/master/iQueTool/Files/iQueNand.cs#L506 GenerateSpareData] for how the SAData in the spare is set.

The [[BBFS]] FAT table also sets the SKSA blocks to 0xfffd (reserved), to ensure that no files will overwrite them.

== Testing ==
A spreadsheet of the different SKSAs that have been tested (whether it boots, what happens when it boots, etc) is available [https://docs.google.com/spreadsheets/d/13wb-jwPEJ9HV2-XUbaLr3VVkGXTrX2LEf6cGce7WdU8/edit?usp=sharing here].

[[Category:File_formats]]

IQueDiagExtend

2018-03-24T15:33:33Z

Emoose: /* Hotswapping */

'''iQueDiagExtend''' is an extension for ique_diag.exe which adds additional commands to the ique_diag menu, such as reading the raw NAND or writing back modified data.

While ique_diag has functions in the exe that allow for reading/writing the raw NAND, unfortunately they're only ever used as part of other functions, with the raw NAND functions never exposed to the user.

iQueDiagExtend hooks into the ique_diag menu, allowing us to add our own custom commands that can make use of those functions.

Source code can be found at: https://github.com/emoose/iQueDiagExtend, with read-only builds available at https://github.com/emoose/iQueDiagExtend/releases.

= Dumping =
To dump a NAND, connect the iQue to a system (or an XP VM) which has the iQue@Home drivers installed and run ique_diag.exe, then press 'x'. If DiagExtend is working it should print a list of custom commands added by the hook.

To start reading simply press 'B' (uppercase) to connect ique_diag to your device, and then press '1', progress on the dump will be printed every 16 blocks.

If the dump is successful a nand.bin (67,108,864 bytes) & spare.bin (65,536 bytes) will appear next to the ique_diag.exe (you should move these files between dumps, so that new dumps can be written to a fresh file).

= Writing =
iQueDiagExtend also has support for writing back to the NAND, though the public iQueDiagExtend builds are missing these writing functions for safety reasons. You can easily compile a write-enabled build from source if you have VS2017 installed (or just ask for a build in the iQue Hacking discord)

To write back to the device, first put the nand.bin/spare.bin you want to write in the same folder as ique_diag.exe, then open ique_diag and press 'B' (uppercase) to connect.

If you want to write the full nand.bin/spare.bin to the device simply press '2', progress will be given as it writes.

Alternatively if you only wish to write certain blocks to the device you can add ranges. For example, typing '2 0-0x100,4075' will write from the nand.bin only blocks 0 through 256, and block 4075. This can be much faster than needing to write the whole NAND each time!

= Hotswapping =
Unfortunately there are many iQue Players that lack any kind of USB support, due to the [[SKSA]] on them being an older version.

Luckily, if you have another Player that does have USB support, you can use that one to upgrade the non-USB card to a later SKSA that supports USB.

* Make sure the unit is plugged into your machine over USB
* Power on your USB-compatible unit with the USB-compatible card inside (once booted, it should appear under device manager as "iQue Player", as usual)
* Now with the unit still powered on, take the USB-compatible card out, and plug in the non-USB card
* On the PC open ique_diag.exe, and follow the steps in the "Dumping" / "Writing" section.

Make sure not to power off the iQue during this process, as it'll then try to boot up from the non-USB card.

IQueDiagExtend

2018-03-24T15:31:35Z

Emoose:

'''iQueDiagExtend''' is an extension for ique_diag.exe which adds additional commands to the ique_diag menu, such as reading the raw NAND or writing back modified data.

While ique_diag has functions in the exe that allow for reading/writing the raw NAND, unfortunately they're only ever used as part of other functions, with the raw NAND functions never exposed to the user.

iQueDiagExtend hooks into the ique_diag menu, allowing us to add our own custom commands that can make use of those functions.

Source code can be found at: https://github.com/emoose/iQueDiagExtend, with read-only builds available at https://github.com/emoose/iQueDiagExtend/releases.

= Dumping =
To dump a NAND, connect the iQue to a system (or an XP VM) which has the iQue@Home drivers installed and run ique_diag.exe, then press 'x'. If DiagExtend is working it should print a list of custom commands added by the hook.

To start reading simply press 'B' (uppercase) to connect ique_diag to your device, and then press '1', progress on the dump will be printed every 16 blocks.

If the dump is successful a nand.bin (67,108,864 bytes) & spare.bin (65,536 bytes) will appear next to the ique_diag.exe (you should move these files between dumps, so that new dumps can be written to a fresh file).

= Writing =
iQueDiagExtend also has support for writing back to the NAND, though the public iQueDiagExtend builds are missing these writing functions for safety reasons. You can easily compile a write-enabled build from source if you have VS2017 installed (or just ask for a build in the iQue Hacking discord)

To write back to the device, first put the nand.bin/spare.bin you want to write in the same folder as ique_diag.exe, then open ique_diag and press 'B' (uppercase) to connect.

If you want to write the full nand.bin/spare.bin to the device simply press '2', progress will be given as it writes.

Alternatively if you only wish to write certain blocks to the device you can add ranges. For example, typing '2 0-0x100,4075' will write from the nand.bin only blocks 0 through 256, and block 4075. This can be much faster than needing to write the whole NAND each time!

= Hotswapping =
Unfortunately there are many iQue Players that lack any kind of USB support, due to the [[SKSA]] on them being an older version.

Luckily, if you have another Player that does have USB support, you can use that one to upgrade the non-USB card to a later SKSA that supports USB.

* Power on your USB-compatible unit with the USB-compatible card inside
* Once booted, plug in the unit to your machine over USB (it should appear under device manager as "iQue Player", as usual)
* Now with the unit still powered on, take the USB-compatible card out, and plug in the non-USB card
* On the PC open ique_diag.exe, and follow the steps in the "Dumping" / "Writing" section.

Make sure not to power off the iQue during this process, as it'll then try to boot up from the non-USB card.

IQueDiagExtend

2018-03-24T15:28:38Z

Emoose:

'''iQueDiagExtend''' is an extension for ique_diag.exe which adds additional commands to the ique_diag menu, such as reading the raw NAND or writing back modified data.

While ique_diag has functions in the exe that allow for reading/writing the raw NAND, unfortunately they're only ever used as part of other functions, with the raw NAND functions never exposed to the user.

iQueDiagExtend hooks into the ique_diag menu, allowing us to add our own custom commands that can make use of those functions.

Source code can be found at: https://github.com/emoose/iQueDiagExtend, with read-only builds available at https://github.com/emoose/iQueDiagExtend/releases.

= Dumping =
To dump a NAND, connect the iQue to a system (or an XP VM) which has the iQue@Home drivers installed and run ique_diag.exe, then press 'x'. If DiagExtend is working it should print a list of custom commands added by the hook.

To start reading simply press 'B' (uppercase) to connect ique_diag to your device, and then press '3', progress on the dump will be printed every 16 blocks.

If the dump is successful a nand.bin (67,108,864 bytes) & spare.bin (65,536 bytes) will appear next to the ique_diag.exe (you should move these files between dumps, so that new dumps can be written to a fresh file).

= Writing =
iQueDiagExtend also has support for writing back to the NAND, though the public iQueDiagExtend builds are missing these writing functions for safety reasons. You can easily compile a write-enabled build from source if you have VS2017 installed (or just ask for a build in the iQue Hacking discord)

To write back to the device, first put the nand.bin/spare.bin you want to write in the same folder as ique_diag.exe, then open ique_diag and press 'B' (uppercase) to connect.

If you want to write the full nand.bin/spare.bin to the device simply press '2', progress will be given as it writes.

Alternatively if you only wish to write certain blocks to the device you can add ranges. For example, typing '2 0-0x100,4075' will write from the nand.bin only blocks 0 through 256, and block 4075. This can be much faster than needing to write the whole NAND each time!

= Hotswapping =
Unfortunately there's many iQue devices that lack any kind of USB support, due to the [[SKSA]] on them being an older version.

Luckily, if you have another device that does have USB support, you can use that one to upgrade the non-USB card to a later USB-supporting SKSA version!

* Firstly, power on your USB-compatible unit with the USB-compatible card inside
* Once booted, plug in the unit to your machine over USB (it should appear under device manager as "iQue Player", as usual)
* Now with the unit still powered on, take the USB-compatible card out, and plug in the non-USB card
* On the PC open ique_diag.exe, and follow the steps in the "Dumping" / "Writing" section.

Make sure not to power off the iQue during this process, as it'll then try to boot up from the non-USB card.

IQueDiagExtend

2018-03-24T15:28:09Z

Emoose:

'''iQueDiagExtend''' is an extension for ique_diag.exe which adds additional commands to the ique_diag menu, such as reading the raw NAND or writing back modified data.

While ique_diag has functions in the exe that allow for reading/writing the raw NAND, unfortunately they're only ever used as part of other functions, with the raw NAND functions never exposed to the user.

iQueDiagExtend hooks into the ique_diag menu, allowing us to add our own custom commands that can make use of those functions.

Source code can be found at: https://github.com/emoose/iQueDiagExtend, with read-only builds available at https://github.com/emoose/iQueDiagExtend/releases.

= Dumping =
To dump a NAND, connect the iQue to a system (or an XP VM) which has the iQue@Home drivers installed and run the ique_diag.exe. Then press 'x', if DiagExtend is working it should print a list of custom commands added by the hook.

To start reading simply press 'B' (uppercase) to connect ique_diag to your device, and then press '3', progress on the dump will be printed every 16 blocks.

If the dump is successful a nand.bin (67,108,864 bytes) & spare.bin (65,536 bytes) will appear next to the ique_diag.exe. (you should move these files between dumps, so that new dumps can be written to a fresh file)

= Writing =
iQueDiagExtend also has support for writing back to the NAND, though the public iQueDiagExtend builds are missing these writing functions for safety reasons. You can easily compile a write-enabled build from source if you have VS2017 installed (or just ask for a build in the iQue Hacking discord)

To write back to the device, first put the nand.bin/spare.bin you want to write in the same folder as ique_diag.exe, then open ique_diag and press 'B' (uppercase) to connect.

If you want to write the full nand.bin/spare.bin to the device simply press '2', progress will be given as it writes.

Alternatively if you only wish to write certain blocks to the device you can add ranges. For example, typing '3 0-0x100,4075' will write from the nand.bin only blocks 0 through 256, and block 4075. This can be much faster than needing to write the whole NAND each time!

= Hotswapping =
Unfortunately there's many iQue devices that lack any kind of USB support, due to the [[SKSA]] on them being an older version.

Luckily, if you have another device that does have USB support, you can use that one to upgrade the non-USB card to a later USB-supporting SKSA version!

* Firstly, power on your USB-compatible unit with the USB-compatible card inside
* Once booted, plug in the unit to your machine over USB (it should appear under device manager as "iQue Player", as usual)
* Now with the unit still powered on, take the USB-compatible card out, and plug in the non-USB card
* On the PC open ique_diag.exe, and follow the steps in the "Dumping" / "Writing" section.

Make sure not to power off the iQue during this process, as it'll then try to boot up from the non-USB card.

NAND

2018-03-24T15:26:44Z

Emoose:

IQueDiagExtend

2018-03-24T15:24:28Z

Emoose:

'''iQueDiagExtend''' is an extension for ique_diag.exe which adds additional commands to the ique_diag menu, such as reading the raw NAND or writing back modified data.

While ique_diag has functions in the exe that allow for reading/writing the raw NAND, unfortunately they're only ever used as part of other functions, with the raw NAND functions never exposed to the user.

iQueDiagExtend hooks into the ique_diag menu, allowing us to add our own custom commands that can make use of those functions.

Source code can be found at: https://github.com/emoose/iQueDiagExtend, with read-only builds available at https://github.com/emoose/iQueDiagExtend/releases.

= Dumping =
To dump a NAND, connect the iQue to a system (or an XP VM) which has the iQue@Home drivers installed and run the ique_diag.exe. Then press 'x', if DiagExtend is working it should print a list of custom commands added by the hook.

To start reading simply press 'B' (uppercase) to connect ique_diag to your device, and then press '2', progress on the dump will be printed every 16 blocks.

If the dump is successful a nand.bin (67,108,864 bytes) & spare.bin (65,536 bytes) will appear next to the ique_diag.exe. (you should move these files between dumps, so that new dumps can be written to a fresh file)

= Writing =
iQueDiagExtend also has support for writing back to the NAND, though the public iQueDiagExtend builds are missing these writing functions for safety reasons. You can easily compile a write-enabled build from source if you have VS2017 installed (or just ask for a build in the iQue Hacking discord)

To write back to the device, first put the nand.bin/spare.bin you want to write in the same folder as ique_diag.exe, then open ique_diag and press 'B' (uppercase) to connect.

If you want to write the full nand.bin/spare.bin to the device simply press '3', progress will be given as it writes.

Alternatively if you only wish to write certain blocks to the device you can add ranges. For example, typing '3 0-0x100,4075' will write from the nand.bin only blocks 0 through 256, and block 4075. This can be much faster than needing to write the whole NAND each time!

= Hotswapping =
Unfortunately there's many iQue devices that lack any kind of USB support, due to the [[SKSA]] on them being an older version.

Luckily, if you have another device that does have USB support, you can use that one to upgrade the non-USB card to a later USB-supporting SKSA version!

* Firstly, power on your USB-compatible unit with the USB-compatible card inside
* Once booted, plug in the unit to your machine over USB (it should appear under device manager as "iQue Player", as usual)
* Now with the unit still powered on, take the USB-compatible card out, and plug in the non-USB card
* On the PC open ique_diag.exe, and follow the steps in the "Dumping" / "Writing" section.

Make sure not to power off the iQue during this process, as it'll then try to boot up from the non-USB card.

IQueDiagExtend

2018-03-24T15:19:18Z

Emoose:

'''iQueDiagExtend''' is an extension for ique_diag.exe which adds additional commands to the ique_diag menu, such as reading the raw NAND or writing back modified data.

While ique_diag has functions in the exe that allow for reading/writing the raw NAND, unfortunately they're only ever used as part of other functions, with the raw NAND functions never exposed to the user.

iQueDiagExtend hooks into the ique_diag menu, allowing us to add our own custom commands that can make use of those functions.

Source code can be found at: https://github.com/emoose/iQueDiagExtend, with read-only builds available at https://github.com/emoose/iQueDiagExtend/releases.

= Dumping =
To dump a NAND, connect the iQue to a system (or an XP VM) which has the iQue@Home drivers installed and run the ique_diag.exe. Then press 'x', if DiagExtend is working it should print a list of custom commands added by the hook.

To start reading simply press 'B' (uppercase) to connect ique_diag to your device, and then press '2', progress on the dump will be printed every 16 blocks.

If the dump is successful a nand.bin (67,108,864 bytes) & spare.bin (65,536 bytes) will appear next to the ique_diag.exe. (you should move these files between dumps, so that new dumps can be written to a fresh file)

= Writing =
iQueDiagExtend also has support for writing back to the NAND, though the public iQueDiagExtend builds are missing these writing functions for safety reasons. You can easily compile a write-enabled build from source if you have VS2017 installed (or just ask for a build in the iQue Hacking discord)

To write back to the device, first put the nand.bin/spare.bin you want to write in the same folder as ique_diag.exe, then open ique_diag and press 'B' (uppercase) to connect.

If you want to write the full nand.bin/spare.bin to the device simply press '3', progress will be given as it writes.

Alternatively if you only wish to write certain blocks to the device you can add ranges. For example, typing '3 0-0x100,4075' will write from the nand.bin only blocks 0 through 256, and block 4075. This can be much faster than needing to write the whole NAND each time!

= Hotswapping =
Unfortunately there's many iQue devices that lack any kind of USB support, due to the [[SKSA]] on them being an older version.

Luckily, if you have another device that does have USB support, you can use that one to upgrade the non-USB card to a later USB-supporting SKSA version!

* Firstly, power on your USB-compatible unit with the USB-compatible card inside
* Once booted, plug in the unit to your machine over USB (it should appear under device manager as "iQue Player", as usual)
* Now with the unit still powered on, take the USB-compatible card out, and plug in the non-USB card
* On the PC open ique_diag.exe, and follow the steps in the "Reading" / "Writing" section.

Make sure not to power off the iQue during this process, as it'll then try to boot up from the non-USB card.

IQueDiagExtend

2018-03-24T15:18:33Z

Emoose:

'''iQueDiagExtend''' is an extension for ique_diag.exe which adds additional commands to the ique_diag menu, such as reading the raw NAND or writing back modified data.

While ique_diag has functions in the exe that allow for reading/writing the raw NAND, unfortunately they're only ever used as part of other functions, with the raw NAND functions never exposed to the user.

iQueDiagExtend hooks into the ique_diag menu functions, allowing us to add our own custom commands that can make use of those functions.

Source code can be found at: https://github.com/emoose/iQueDiagExtend, with read-only builds available at https://github.com/emoose/iQueDiagExtend/releases

= Dumping =
To dump a NAND, connect the iQue to a system (or an XP VM) which has the iQue@Home drivers installed and run the ique_diag.exe. Then press 'x', if DiagExtend is working it should print a list of custom commands added by the hook.

To start reading simply press 'B' (uppercase) to connect ique_diag to your device, and then press '2', progress on the dump will be printed every 16 blocks.

If the dump is successful a nand.bin (67,108,864 bytes) & spare.bin (65,536 bytes) will appear next to the ique_diag.exe. (you should move these files between dumps, so that new dumps can be written to a fresh file)

= Writing =
iQueDiagExtend also has support for writing back to the NAND, though the public iQueDiagExtend builds are missing these writing functions for safety reasons. You can easily compile a write-enabled build from source if you have VS2017 installed (or just ask for a build in the iQue Hacking discord)

To write back to the device, first put the nand.bin/spare.bin you want to write in the same folder as ique_diag.exe, then open ique_diag and press 'B' (uppercase) to connect.

If you want to write the full nand.bin/spare.bin to the device simply press '3', progress will be given as it writes.

Alternatively if you only wish to write certain blocks to the device you can add ranges. For example, typing '3 0-0x100,4075' will write from the nand.bin only blocks 0 through 256, and block 4075. This can be much faster than needing to write the whole NAND each time!

= Hotswapping =
Unfortunately there's many iQue devices that lack any kind of USB support, due to the [[SKSA]] on them being an older version.

Luckily, if you have another device that does have USB support, you can use that one to upgrade the non-USB card to a later USB-supporting SKSA version!

* Firstly, power on your USB-compatible unit with the USB-compatible card inside
* Once booted, plug in the unit to your machine over USB (it should appear under device manager as "iQue Player", as usual)
* Now with the unit still powered on, take the USB-compatible card out, and plug in the non-USB card
* On the PC open ique_diag.exe, and follow the steps in the "Reading" / "Writing" section.

Make sure not to power off the iQue during this process, as it'll then try to boot up from the non-USB card.

IQueDiagExtend

2018-03-24T15:11:49Z

Emoose: TODO: maybe change these instructions into numbered lists?

'''iQueDiagExtend''' is an extension for ique_diag.exe which adds additional commands to the ique_diag menu, such as reading the raw NAND or writing back modified data.

While ique_diag has functions in the exe that allow for reading/writing the raw NAND, unfortunately they're only ever used as part of other functions, with the raw NAND functions never exposed to the user.

iQueDiagExtend hooks into the ique_diag menu functions, allowing us to add our own custom commands that can make use of those functions.

Source code can be found at: https://github.com/emoose/iQueDiagExtend, with read-only builds available at https://github.com/emoose/iQueDiagExtend/releases

= Dumping =
To dump a NAND, connect the iQue to a system (or an XP VM) which has the iQue@Home drivers installed and run the ique_diag.exe. Then press 'x', if DiagExtend is working it should print a list of custom commands added by the hook.

To start reading simply press 'b' to connect ique_diag to your device, and then press '2', progress on the dump will be printed every 16 blocks.

If the dump is successful a nand.bin (67,108,864 bytes) & spare.bin (65,536 bytes) will appear next to the ique_diag.exe. (you should move these files between dumps, so that new dumps can be written to a fresh file)

= Writing =
iQueDiagExtend also has support for writing back to the NAND, though the public iQueDiagExtend builds are missing these writing functions for safety reasons. You can easily compile a write-enabled build from source if you have VS2017 installed (or just ask for a build in the iQue Hacking discord)

To write back to the device, first put the nand.bin/spare.bin you want to write in the same folder as ique_diag.exe, then open ique_diag and press 'b' to connect.

If you want to write the full nand.bin/spare.bin to the device simply press '3', progress will be given as it writes.

Alternatively if you only wish to write certain blocks to the device you can add ranges. For example, typing '3 0-0x100,4075' will write from the nand.bin only blocks 0 through 256, and block 4075. This can be much faster than needing to write the whole NAND each time!

= Hotswapping =
Unfortunately there's many iQue devices that lack any kind of USB support, due to the [[SKSA]] on them being an older version.

Luckily, if you have another device that does have USB support, you can use that one to upgrade the non-USB card to a later USB-supporting SKSA version!

* Firstly, power on your USB-compatible unit with the USB-compatible card inside
* Once booted, plug in the unit to your machine over USB (it should appear under device manager as "iQue Player", as usual)
* Now with the unit still powered on, take the USB-compatible card out, and plug in the non-USB card
* On the PC open ique_diag.exe, and follow the steps in the "Reading" / "Writing" section.

Make sure not to power off the iQue during this process, as it'll then try to boot up from the non-USB card.

SKSA

2018-03-24T14:44:04Z

Emoose:

NAND

2018-03-24T13:39:16Z

Emoose: TODO: BBFS entry / footer / spare data formats

SKSA

2018-03-24T11:24:14Z

Emoose: Created page with "'''SKSA''' (Secure Kernel / System App) is the "Upgradable Operating System" of the iQue Player, the main software that runs on the device. == Parts == As the name implies it..."

'''SKSA''' (Secure Kernel / System App) is the "Upgradable Operating System" of the iQue Player, the main software that runs on the device.

== Parts ==
As the name implies it consists of two parts: a "secure kernel", and a "system app". In later SKSAs the system-app area may also be divided into two sections: SA1 and SA2.

* '''Secure Kernel''': the 'boot1' of the iQue. Doesn't ever seem to change between SKSA versions, so might be similar to the Wii boot1 where the hash of it is checked against a stored hash in the CPU. Probably only stored in NAND as it's cheaper than storing in CPU.

* '''System App 1''': Consists of a [[Ticket|ticket]], followed by the actual SA1 data. Most SA1s are just the iQue Menu, though some seem to be factory/graphics tests. SA1 seems to be responsible for handling USB comms too.

* '''System App 2''': Also has a ticket, followed by SA2 data. Unknown purpose, in SKSAs that have an SA2 the SA1 size is greatly reduced compared to single-SA SKSAs, assumably they moved some data from SA1 into this, but it seems like dual-SA SA1s can run without needing the corresponding SA2?

== Format ==
The format of the SKSA is simple: a 64KiB SK, followed by SA1 (ticket + data), optionally followed by SA2 (ticket + data):
{| border=1
|-
! Offset
! Length
! Type
! Information
|-
| 0x0
| 0x10000
| encrypted bytes
| Secure Kernel
|-
| 0x10000
| 0x4000
| ticket
| SA1 ticket
|-
| 0x14000
| (sa1ticket.ContentSize)
| encrypted bytes
| SA1 data
|-
| 0x14000 + sa1ticket.ContentSize
| 0x4000
| ticket
| SA2 ticket
|-
| 0x18000 + sa1ticket.ContentSize
| sa2ticket.ContentSize
| encrypted bytes
| SA2 data
|}

== NAND format ==
On NAND the format is slightly changed however: instead of storing the SA1 & SA2 data exactly as stored in the cached SKSA, the data is instead reversed in 0x4000 byte blocks (though tickets are unaffected). The NAND spare data is used to store pointers for these blocks, to allow for skipping any bad blocks in the SKSA area.

See [https://github.com/emoose/iQueTool/blob/master/iQueTool/Files/iQueNand.cs#L207 SetSKSAData in iQueTool] for an example on how the blocks are transformed, or see [https://github.com/emoose/iQueTool/blob/master/iQueTool/Files/iQueNand.cs#L506 GenerateSpareData] for how the SAData in the spare is set.

The [[BBFS]] FAT table also sets the SKSA blocks to 0xfffd (reserved), to ensure that no files will overwrite them.

== Testing ==
A spreadsheet of the different SKSAs that have been tested (whether it boots, what happens when it boots, etc) is available [https://docs.google.com/spreadsheets/d/13wb-jwPEJ9HV2-XUbaLr3VVkGXTrX2LEf6cGce7WdU8/edit?usp=sharing here].