From iQueBrew
Revision as of 12:49, 6 February 2019 by Jbop (talk | contribs) (Some corrections; this page should really be cleaned up, and ideally a page for each of SK, SA1, and SA2 should be created.)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to navigation Jump to search

SKSA (Secure Kernel / System App) is the "Upgradeable Operating System" of the iQue Player, the main software that runs on the device.


As the name implies it consists of two parts: a secure kernel, and a system app. In later SKSAs the system-app area may also be divided into two sections: SA1 and SA2.

  • Secure Kernel: the 'boot1' of the iQue. Doesn't ever seem to change between SKSA versions, so might be similar to the Wii boot1; the hash of it is checked against a stored hash in Virage2.
  • System App 2: Also has a CMD, followed by SA2 data. Unknown purpose, in SKSAs that have an SA2 the SA1 size is greatly reduced compared to single-SA SKSAs, presumably they moved some data from SA1 into this, but it seems like dual-SA SA1s can run without needing the corresponding SA2. SA2 contains the iQue Menu in the two most recent SKSA versions.


The format of the SKSA is simple: a 64KiB SK, followed by SA1 (CMD + data), optionally followed by SA2 (CMD + data):

Offset Length Type Information
0x0 0x10000 encrypted bytes Secure Kernel
0x10000 0x4000 CMD SA1 CMD
0x14000 sa1CMD.ContentSize encrypted bytes SA1 data
0x14000 + sa1CMD.ContentSize 0x4000 CMD SA2 CMD
0x18000 + sa1CMD.ContentSize sa2CMD.ContentSize encrypted bytes SA2 data

NAND format

On NAND the format is slightly changed however: instead of storing the SA1 & SA2 data exactly as stored in the cached SKSA, the data is instead reversed in 0x4000 byte blocks (though tickets are unaffected). The NAND spare data is used to store pointers for these blocks, to allow for skipping any bad blocks in the SKSA area.

See SetSKSAData in iQueTool for an example on how the blocks are transformed, or see GenerateSpareData for how the SAData in the spare is set.

The BBFS FAT table also sets the SKSA blocks to 0xfffd (reserved), to ensure that no files will overwrite them.


A spreadsheet of the different SKSAs that have been tested (whether it boots, what happens when it boots, etc) is available here.

Official update log

Jan 2004 update

Added Settings(管理) menu and "i-Timer" Smart Clock, allowing parents to set time limit on gaming and allowing games to use real-world time.

Sept 2004 update

Added iQue@Home support to the console.

This update is most likely corresponds to the SKSA version 1095 as it is the first version to have iQue@Home USB support.