Difference between revisions of "IO"

From iQueBrew
Jump to: navigation, search
(add MI_RANDOM_BIT)
(Add some NAND info)
Line 46: Line 46:
 
| 0xA4600044 || 4? || ||
 
| 0xA4600044 || 4? || ||
 
|-
 
|-
| 0xA4600048 || 4? || || Many times used for read/write actions. (card data access register???)
+
| 0xA4600048 || 4? || || Writes to this address seem to indicate the address to read data into RAM from the NAND
 
|-
 
|-
 
| 0xA4600050 || 4? || ||
 
| 0xA4600050 || 4? || ||

Revision as of 23:33, 2 May 2018

Custom registers.

Address Size Description Note
0xA4300010 4
0xA4300014 4? Reading from this address within game code causes an exception; SK exception handler checks this address as well, and makes some decisions based on the value: bits 7-4 = ?, bit 3 = ?, bit 2 = SKC, the other bits seem unused. bit 9 = execute related? (isBb?), bit 8 = execute related?
0xA430002C 1 MI_RANDOM_BIT Hardware RNG? Seems to return 1 bit of randomness, SK function at 0x9FC03410 gets lots of entropy from this then hashes it with SHA1 (several times?), this function is used to get randomness used when ECC signing, and when creating key material for recrypt.sys.
0xA4300030 4?
0xA4300038 4?
0xA430003C 4?
0xA4400000 4?
0xA4500008 4?
0xA4600010 4?
0xA4600014 4?
0xA4600018 4?
0xA460001C 4?
0xA4600020 4?
0xA4600024 4?
0xA4600028 4?
0xA460002C 4?
0xA4600030 4?
0xA4600040 4?
0xA4600044 4?
0xA4600048 4? Writes to this address seem to indicate the address to read data into RAM from the NAND
0xA4600050 4?
0xA4600054 4?
0xA4600060 4 StatusField This register is used for RTC, error led and other things... (probably status register?, made-up name)
0xA4600070 4?
0xA4610000 4?
0xA4610200 4?
0xA4610420 176 PI_AES_EXPANDED_KEY AES-128 expanded key for hardware AES engine
0xA46104D0 16 PI_AES_IV AES-128-CBC initialisation vector for hardware AES engine
0xA4610500 4
0xA4610504 4? atb? (virtual address?)
0xA46E0400 4? or 2? rdb?
0xA4940010 4?
0xA4A40010 4?

StatusField

Bit(s) Description
 ?-15 Box Id
27 Power (on and off)
28 RTC related?
29 Unknown bit
30 Error led
31 Power (only on)

RTC

The iQue Player has a custom RTC functionality. The Nintendo 64 doesn't have a RTC, except the Nintendo 64 version of Animal Crossing which uses a special custom RTC chip instead of a built-in RTC. The RTC functionality is heavly used in the game Animal Crossing. The RTC can be accessed through 0xA4600060. (unknown how)