iQueBrew - User contributions [en]

Libultra Boot Parameters

2018-05-12T20:29:21Z

Marshallh: /* Used by both N64 and BB */

Parameters set by the SA before booting a game. BB's modified libultra uses these values at runtime.

= Used by both N64 and BB =
{| class="wikitable"
|-
! Address
! Size
! Description
! Note
|-
| 0x800001a0|| 4 || leoBootID || not used on iQue, related to 64DD (which has codename Leo)
|-
| 0x80000300|| 4 || osTvType || 0: PAL, 1: NTSC, 2: MPAL
|-
| 0x80000304|| 4 || osRomType|| Determines if cartridge boot, or 64DD boot
|-
| 0x80000308|| 4 || osRomBase || Base uncached address of cartridge (PI) region
|-
| 0x8000030c || 4 || osResetType || Whether the system was cold-booted (0) or warm-resetted NMI (1). On iQue, this may be fixed one way or the another because all games are soft-booted.
|-
| 0x80000310|| 4 || osCicId || Contains result of PIF<>CIC interaction. Value on iQue is not yet known. Rareware games like to check this value. Depending on the CIC it may have the decimal number of CIC used, such as 0x17D9 (6105)
|-
| 0x80000314|| 4 || osVersion || Some version info created in N64 boot process. Unknown on iQue.
|-
| 0x80000318 || 4 || osMemSize || Contains number of bytes of physical memory installed. Games that check for expansion pak look at this value.
|-
| 0x8000031c|| 64 || osAppNMIBuffer || Buffer where application can put persistent information that is guaranteed not to be disturbed by a warm reset. Unknown behavior on iQue.
|}

= Used only by BB =
{| class="wikitable"
|-
! Address
! Size
! Description
! Note
|-
| 0x8000035c || 4 || __osBbEepromAddress ||
|-
| 0x80000360 || 4 || __osBbEepromSize ||
|-
| 0x80000364 || 4 || __osBbFlashAddress ||
|-
| 0x80000368 || 4 || __osBbFlashSize ||
|-
| 0x8000036c || 4 || __osBbSramAddress ||
|-
| 0x80000370 || 4 || __osBbSramSize ||
|-
| 0x80000374 || 16 || __osBbPakAddress || Array of 4 u32 pointers
|-
| 0x80000384 || 4 || __osBbPakSize ||
|-
| 0x80000388 || 4 || __osBbIsBb || Can be used to determine if running on vanilla N64, or BB. 
0: if (*0xa430003c & 0x140)!=0 
1: if (*0xa430003c & 0x140)==0 
2: if ((*0xa430003c & 0x140)==0) && ((*0xa4600060) & 0xc0000000)!=0
|-
| 0x8000038c || 4 || __osBbHackFlags ||
|-
| 0x80000390 || 4 || __osBbStashMagic ||
|-
| 0x80000394 || 16 || __osBbPakBindings || Array of 4 u32 pointers
|-
| 0x800003a4 || 16 || __osBbStateName ||
|-
| 0x800003b4 || 4 || __osBbStateDirty ||
|-
| 0x800003b8 || 4 || __osBbAuxDataLimit ||
|}

IO

2018-05-12T19:40:35Z

Marshallh: /* PI */

Memory mapped registers available on the iQue Player.

= MI =
{| class="wikitable"
|-
! Address
! Size
! Description
! Note
|-
| 0xA4300000 || 4 || MI_INIT_MODE_REG/MI_MODE_REG ||
|-
| 0xA4300004 || 4 || MI_VERSION_REG/MI_NOOP_REG ||
|-
| 0xA4300008 || 4 || MI_INTR_REG ||
|-
| 0xA430000C || 4 || MI_INTR_MASK_REG ||
|-
| 0xA4300010 || 4 || ||
|-
| 0xA4300014 || 4 || MI_SK_EXCEPTION_REG || Reading from this address within game code causes an exception; SK exception handler checks this address as well, and makes some decisions based on the value: bits 7-4 = ?, bit 3 = ?, bit 2 = SKC, the other bits seem unused. bit 9 = execute related? (isBb?), bit 8 = execute related?
|-
| 0xA4300028 || 4 || ||
|-
| 0xA430002C || 1 || MI_RANDOM_BIT || Hardware RNG? Seems to return 1 bit of randomness, SK function at <tt>0x9FC03410</tt> gets lots of entropy from this then hashes it with SHA1 (several times?), this function is used to get randomness used when ECC signing, and when creating key material for recrypt.sys.
|-
| 0xA4300030 || 4 || ||
|-
| 0xA4300038 || 4 || MI_HW_INTR_REG || Hardware interrupts (0x40 = NAND DMA, 0x80 = MD, 0x100 = RDB, 0x200 = AES, 0x400 = PI_ERR, 0x800 = USB0, 0x1000 = USB1, 0x2000 = NAND).
|-
| 0xA430003C || 4 || MI_HW_INTR_MASK_REG || Hardware interrupt mask.
|}

= VI =
{| class="wikitable"
|-
! Address
! Size
! Description
! Note
|-
| 0xA4400000 || 4 || VI_STATUS_REG/VI_CONTROL_REG ||
|-
| 0xA4400004 || 4 || VI_ORIGIN_REG/VI_DRAM_ADDR_REG ||
|-
| 0xA4400008 || 4 || VI_WIDTH_REG/VI_H_WIDTH_REG ||
|-
| 0xA440000C || 4 || VI_INTR_REG/VI_V_INTR_REG ||
|-
| 0xA4400010 || 4 || VI_CURRENT_REG/VI_V_CURRENT_LINE_REG ||
|-
| 0xA4400014 || 4 || VI_BURST_REG/VI_TIMING_REG ||
|-
| 0xA4400018 || 4 || VI_V_SYNC_REG ||
|-
| 0xA440001C || 4 || VI_V_SYNC_REG ||
|-
| 0xA4400020 || 4 || VI_LEAP_REG/VI_H_SYNC_LEAP_REG ||
|-
| 0xA4400024 || 4 || VI_H_START_REG/VI_H_VIDEO_REG ||
|-
| 0xA4400028 || 4 || VI_V_START_REG/VI_V_VIDEO_REG ||
|-
| 0xA440002C || 4 || VI_V_BURST_REG ||
|-
| 0xA4400030 || 4 || VI_X_SCALE_REG ||
|-
| 0xA4400034 || 4 || VI_Y_SCALE_REG ||
|}

= AI =
{| class="wikitable"
|-
! Address
! Size
! Description
! Note
|-
| 0xA4500000 || 4 || AI_DRAM_ADDR_REG ||
|-
| 0xA4500004 || 4 || AI_LEN_REG ||
|-
| 0xA4500008 || 4 || AI_CONTROL_REG ||
|-
| 0xA450000C || 4 || AI_STATUS_REG ||
|-
| 0xA4500010 || 4 || AI_DACRATE_REG ||
|-
| 0xA4500014 || 4 || AI_BITRATE_REG ||
|}

= PI =
{| class="wikitable"
|-
! Address
! Size
! Description
! Note
|-
| 0xA4600000 || 4 || PI_DRAM_ADDR_REG ||
|-
| 0xA4600004 || 4 || PI_CART_ADDR_REG ||
|-
| 0xA4600008 || 4 || PI_RD_LEN_REG ||
|-
| 0xA460000C || 4 || PI_WR_LEN_REG ||
|-
| 0xA4600010 || 4 || PI_STATUS_REG ||
|-
| 0xA4600014 || 4 || PI_BSD_DOM1_LAT_REG ||
|-
| 0xA4600018 || 4 || PI_BSD_DOM1_PWD_REG ||
|-
| 0xA460001C || 4 || PI_BSD_DOM1_PGS_REG ||
|-
| 0xA4600020 || 4 || PI_BSD_DOM1_RLS_REG ||
|-
| 0xA4600024 || 4 || PI_BSD_DOM2_LAT_REG ||
|-
| 0xA4600028 || 4 || PI_BSD_DOM2_PWD_REG ||
|-
| 0xA460002C || 4 || PI_BSD_DOM2_PGS_REG ||
|-
| 0xA4600030 || 4 || PI_BSD_DOM2_RLS_REG ||
|-
| 0xA4600038 || 4 || PI_CARD_STATUS_REG || Tells if the NAND card is present or not
|-
| 0xA4600040 || 4 || ||
|-
| 0xA4600044 || 4 || ||
|-
| 0xA4600048 || 4 || PI_CARD_ADDR_REG || Takes the device buffer address for RAM<->NAND DMA
|-
| 0xA460004C || 4 || PI_CARD_CONFIG_REG || Takes configuration parameters for the NAND card
|-
| 0xA4600050 || 4 || ||
|-
| 0xA4600054 || 4 || || Feature bitmask?
|-
| 0xA4600058 || 4 || PI_EX_RD_LEN_REG || Enhanced PI read length register
|-
| 0xA460005C || 4 || PI_EX_WR_LEN_REG || Enhanced PI write length register
|-
| 0xA4600060 || 4 || [[#PI_MISC_REG|PI_MISC_REG]] || This register is used for RTC, error led, power and more
|-
| 0xA4600070 || 4 || PI_CARD_BLK_OFFSET_REG || Takes the NAND card block offset for reading/writing
|-
| 0xA4610000 || 4 || ||
|-
| 0xA4610200 || 4 || ||
|-
| 0xA4610420 || 176 || PI_AES_EXPANDED_KEY || AES-128 expanded key for hardware AES engine
|-
| 0xA46104D0 || 16 || PI_AES_IV || AES-128-CBC initialisation vector for hardware AES engine
|-
| 0xA4610500 || 4 || || ATB?
|-
| 0xA4610504 || 4 || || ATB?
|-
| 0xA4620000 || 4 || ||
|-
| 0xA46E0000 || 2 || PI_RDB_REQ_HI_REG ||
|-
| 0xA46E0002 || 2 || PI_RDB_REQ_LO_REG ||
|-
| 0xA46E0004 || 2 || ||
|-
| 0xA46E0400 || 2 || || RDB related
|-
| 0xA46E0402 || 2 || || RDB related
|-
| 0xA46E8000 || 2 || PI_RDB_STATUS_REG ||
|}

== PI_MISC_REG ==
{| class="wikitable"
|-
! Bit(s)
! Description
|-
| 31-15 || Box Id
|-
| 6-7 || RTC mask
|-
| 5 || Error led mask (always 0x01)
|-
| 4 || Power mask (always 0x01)
|-
| 2-3 || RTC status
|-
| 1 || Error led
|-
| 0 || Power status (on or off)
|}

= USB =
The iQue Player has support for two USB controllers, one mapped at 0xA4900000 and another at 0xA4A00000.

{| class="wikitable"
|-
! Address
! Size
! Description
! Note
|-
| 0xA4900000 || 4 || ||
|-
| 0xA4940010 || 4 || USB0_STATUS_REG ||
|-
| 0xA4A00000 || 4 || ||
|-
| 0xA4A40010 || 4 || USB1_STATUS_REG ||
|}

CMD

2018-05-12T05:28:44Z

Marshallh: /* Format */ added animal forest hardware bitmask

An iQue '''Content MetaData (CMD)''' is used to store data about a piece of content, such as the size, hash and ID. It's used as part of the [[SKSA]] (for info about the SA1/SA2) and also used as part of the [[Title Data]] structure (for info about the game title).

Each ticket is signed via RSA-2048 using a CP (content protection?) certificate.

== Format ==
The CMD format is similar to a [http://wiibrew.org/wiki/Ticket Wii ticket], though it seems the structure was reworked sometime between the iQue and Wii.

{| class="wikitable"
|-
! Offset
! Length
! Type
! Description
! Information
|-
| 0x0
| 0x8
| bytes
| ca_crl_version
| Unknown (always 0?)
|-
| 0x8
| 0x4
| int32
| cmd_crl_version
| Unknown (always 1?)
|-
| 0xC
| 0x4
| uint32
| content_size
| Content Size
|-
| 0x10
| 0x4
| int32
| unused_flags
| bit 0 on if SA; nothing checks it though
|-
| 0x14
| 0x10
| bytes
| titlekey_iv
| IV used to encrypt titlekey (with common key)
|-
| 0x24
| 0x14
| bytes
| content_hash
| sha1 hash of plaintext content
|-
| 0x38
| 0x10
| bytes
| content_iv
| IV used to encrypt content
|-
| 0x48
| 0x4
| int32
| recrypt_flag
| if bit 1 on, content will be re-encrypted on first launch, using console-unique key stored in Virage2 in the SoC
|-
| 0x4C
| 0x4
| int32
| allowed_hardware
| bitfield, each bit enables access to some MMIO regs new to iQue Player:
* bits 0-7: new PI stuff
* bit 0: PI buffer used for aes/NAND read output and PI DMA (1KB at PI_BASE+0x10000)
* bit 1: NAND flash regs in PI
* bit 2: memory mapper for old PI dma
* bit 3: hardware AES-engine in PI
* bit 4: new PI dma engine, DMAs from/to PI buffer
* bit 5: new GPIO; power + LED
* bit 6: external IO bus stuff (debug?)
* bit 7: new PI error stuff
* bit 8: enables access to USB regs
* bit 9: enables access to internal ram used for SK stack
(0 for games except for Animal Forest which is 0x33, 0x13 for iQue Club, 0x1F7/0x1B3 for SA)
|-
| 0x50
| 0x4
| int32
| allowed_secure_kernel_calls
| one bit per syscall bit 0 allows skc 0, etc.
|-
| 0x54
| 0x4
| int32
| console_id
| can be zero; if not can only run on certain (used for SAs, not games)
|-
| 0x58
| 0x40
| chars
| signer
| Authority (cert used to sign ticket)
|-
| 0x98
| 0x4
| uint32
| content_id
| Content ID (can't be higher than 99999999, if (cid / 100) % 10 == 9, this is a game manual)
|-
| 0x9C
| 0x10
| bytes
| titlekey
| crypted with common key, and if this is not an SA, then crypted again with key derived using ECDH of console's privkey and pubkey in ticket
|-
| 0xAC
| 0x100
| bytes
| signature
| RSA-2048 signature
|}

== Signature ==
The signature is made from a SHA1 hash of 0x0 - 0xAC, prior to the titlekey being encrypted with the ECDH-derived titlekek.

[[Category:File formats]]

Libultra Boot Parameters

2018-05-06T22:36:02Z

Marshallh: /* Used by both N64 and BB */

Parameters set by the SA before booting a game. BB's modified libultra uses these values at runtime.

= Used by both N64 and BB =
{| class="wikitable"
|-
! Address
! Size
! Description
! Note
|-
| 0x800001a0|| 4 || leoBootID ||
|-
| 0x80000300|| 4 || osTvType || 0: NTSC, 1: PAL, 2: MPAL
|-
| 0x80000304|| 4 || osRomType|| Determines if cartridge boot, or 64DD boot
|-
| 0x80000308|| 4 || osRomBase || Base uncached address of cartridge (PI) region
|-
| 0x8000030c || 4 || osResetType || Whether the system was cold-booted (0) or warm-resetted NMI (1). On iQue, this may be fixed one way or the another because all games are soft-booted.
|-
| 0x80000310|| 4 || osCicId || Contains result of PIF<>CIC interaction. Value on iQue is not yet known. Rareware games like to check this value. Depending on the CIC it may have the decimal number of CIC used, such as 0x17D9 (6105)
|-
| 0x80000314|| 4 || osVersion || Some version info created in N64 boot process. Unknown on iQue.
|-
| 0x80000318 || 4 || osMemSize || Contains number of bytes of physical memory installed. Games that check for expansion pak look at this value.
|-
| 0x8000031c|| 64 || osAppNMIBuffer || Buffer where application can put persistent information that is guaranteed not to be disturbed by a warm reset. Unknown behavior on iQue.
|}

= Used only by BB =
{| class="wikitable"
|-
! Address
! Size
! Description
! Note
|-
| 0x8000035c || 4 || __osBbEepromAddress ||
|-
| 0x80000360 || 4 || __osBbEepromSize ||
|-
| 0x80000364 || 4 || __osBbFlashAddress ||
|-
| 0x80000368 || 4 || __osBbFlashSize ||
|-
| 0x8000036c || 4 || __osBbSramAddress ||
|-
| 0x80000370 || 4 || __osBbSramSize ||
|-
| 0x80000374 || 16 || __osBbPakAddress || Array of 4 u32 pointers
|-
| 0x80000384 || 4 || __osBbPakSize ||
|-
| 0x80000388 || 4 || __osBbIsBb || Can be used to determine if running on vanilla N64, or BB. 
0: if (*0xa430003c & 0x140)!=0 
1: if (*0xa430003c & 0x140)==0 
2: if ((*0xa430003c & 0x140)==0) && ((*0xa4600060) & 0xc0000000)!=0
|-
| 0x8000038c || 4 || __osBbHackFlags ||
|-
| 0x80000390 || 4 || __osBbStashMagic ||
|-
| 0x80000394 || 16 || __osBbPakBindings || Array of 4 u32 pointers
|-
| 0x800003a4 || 4 || __osBbStateName ||
|-
| 0x800003b4 || 4 || __osBbStateDirty ||
|-
| 0x800003b8 || 4 || __osBbAuxDataLimit ||
|}

Libultra Boot Parameters

2018-05-06T22:35:41Z

Marshallh: /* Used by both N64 and BB */

Parameters set by the SA before booting a game. BB's modified libultra uses these values at runtime.

= Used by both N64 and BB =
{| class="wikitable"
|-
! Address
! Size
! Description
! Note
|-
| 0x800001a0|| 4 || leoBootID ||
|-
| 0x80000300|| 4 || osTvType || 0: NTSC, 1: PAL, 2: MPAL
|-
| 0x80000304|| 4 || osRomType|| Determines if cartridge boot, or 64DD boot
|-
| 0x80000308|| 4 || osRomBase || Base uncached address of cartridge (PI) region
|-
| 0x8000030c || 4 || osResetType || Whether the system was cold-booted (0) or warm-resetted NMI (1). On iQue, this may be fixed one way or the another because all games are soft-booted.
|-
| 0x80000310|| 4 || osCicId || Contains result of PIF<>CIC interaction. Value on iQue is not yet known. Rareware games like to check this value. Depending on the CIC it may have the decimal number of CIC used, such as 0x17D9 (6105)
|-
| 0x80000314|| 4 || osVersion || Some version info created in N64 boot process. Unknown on iQue.
|-
| 0x80000318 || 4 || osMemSize || Contains number of bytes of physical memory installed. Games that check for expansion pak look at this value.
|-
| 0x8000031c|| 64 || osAppNMIBuffer || Buffer where application can put persistent information that is guaranteed not to be disturbed by a warm reset. Unknown behavior on iQue.
|}

= Used only by BB =
{| class="wikitable"
|-
! Address
! Size
! Description
! Note
|-
| 0x8000035c || 4 || __osBbEepromAddress ||
|-
| 0x80000360 || 4 || __osBbEepromSize ||
|-
| 0x80000364 || 4 || __osBbFlashAddress ||
|-
| 0x80000368 || 4 || __osBbFlashSize ||
|-
| 0x8000036c || 4 || __osBbSramAddress ||
|-
| 0x80000370 || 4 || __osBbSramSize ||
|-
| 0x80000374 || 16 || __osBbPakAddress || Array of 4 u32 pointers
|-
| 0x80000384 || 4 || __osBbPakSize ||
|-
| 0x80000388 || 4 || __osBbIsBb || Can be used to determine if running on vanilla N64, or BB. 
0: if (*0xa430003c & 0x140)!=0 
1: if (*0xa430003c & 0x140)==0 
2: if ((*0xa430003c & 0x140)==0) && ((*0xa4600060) & 0xc0000000)!=0
|-
| 0x8000038c || 4 || __osBbHackFlags ||
|-
| 0x80000390 || 4 || __osBbStashMagic ||
|-
| 0x80000394 || 16 || __osBbPakBindings || Array of 4 u32 pointers
|-
| 0x800003a4 || 4 || __osBbStateName ||
|-
| 0x800003b4 || 4 || __osBbStateDirty ||
|-
| 0x800003b8 || 4 || __osBbAuxDataLimit ||
|}

Libultra Boot Parameters

2018-05-06T22:22:48Z

Marshallh: /* Used only by BB */

Parameters set by the SA before booting a game. BB's modified libultra uses these values at runtime.

= Used by both N64 and BB =
{| class="wikitable"
|-
! Address
! Size
! Description
! Note
|-
| 0x800001a0|| 4 || leoBootID ||
|-
| 0x80000300|| 4 || osTvType || 0: NTSC, 1: PAL, 2: MPAL
|-
| 0x80000304|| 4 || osRomType|| Determines if cartridge boot, or 64DD boot
|-
| 0x80000308|| 4 || osRomBase || Base uncached address of cartridge (PI) region
|-
| 0x8000030c || 4 || osResetType || Whether the system was cold-booted (0) or warm-resetted NMI (1). On iQue, this may be fixed one way or the another because all games are soft-booted.
|-
| 0x80000310|| 4 || osCicId || Contains result of PIF<>CIC interaction. Value on iQue is not yet known. Rareware games like to check this value.
|-
| 0x80000314|| 4 || osVersion || Some version info created in N64 boot process. Unknown on iQue.
|-
| 0x80000318 || 4 || osMemSize || Contains number of bytes of physical memory installed. Games that check for expansion pak look at this value.
|-
| 0x8000031c|| 64 || osAppNMIBuffer || Buffer where application can put persistent information that is guaranteed not to be disturbed by a warm reset. Unknown behavior on iQue.
|}

= Used only by BB =
{| class="wikitable"
|-
! Address
! Size
! Description
! Note
|-
| 0x8000035c || 4 || __osBbEepromAddress ||
|-
| 0x80000360 || 4 || __osBbEepromSize ||
|-
| 0x80000364 || 4 || __osBbFlashAddress ||
|-
| 0x80000368 || 4 || __osBbFlashSize ||
|-
| 0x8000036c || 4 || __osBbSramAddress ||
|-
| 0x80000370 || 4 || __osBbSramSize ||
|-
| 0x80000374 || 16 || __osBbPakAddress || Array of 4 u32 pointers
|-
| 0x80000384 || 4 || __osBbPakSize ||
|-
| 0x80000388 || 4 || __osBbIsBb || Can be used to determine if running on vanilla N64, or BB. 0 if (*0xa430003c & 0x140)!=0
1 if (*0xa430003c & 0x140)==0
2 if ((*0xa430003c & 0x140)==0) && ((*0xa4600060) & 0xc0000000)!=0
|-
| 0x8000038c || 4 || __osBbHackFlags ||
|-
| 0x80000390 || 4 || __osBbStashMagic ||
|-
| 0x80000394 || 16 || __osBbPakBindings || Array of 4 u32 pointers
|-
| 0x800003a4 || 4 || __osBbStateName ||
|-
| 0x800003b4 || 4 || __osBbStateDirty ||
|-
| 0x800003b8 || 4 || __osBbAuxDataLimit ||
|}

Libultra Boot Parameters

2018-05-06T22:19:27Z

Marshallh: /* Used only by BB */

Parameters set by the SA before booting a game. BB's modified libultra uses these values at runtime.

= Used by both N64 and BB =
{| class="wikitable"
|-
! Address
! Size
! Description
! Note
|-
| 0x800001a0|| 4 || leoBootID ||
|-
| 0x80000300|| 4 || osTvType || 0: NTSC, 1: PAL, 2: MPAL
|-
| 0x80000304|| 4 || osRomType|| Determines if cartridge boot, or 64DD boot
|-
| 0x80000308|| 4 || osRomBase || Base uncached address of cartridge (PI) region
|-
| 0x8000030c || 4 || osResetType || Whether the system was cold-booted (0) or warm-resetted NMI (1). On iQue, this may be fixed one way or the another because all games are soft-booted.
|-
| 0x80000310|| 4 || osCicId || Contains result of PIF<>CIC interaction. Value on iQue is not yet known. Rareware games like to check this value.
|-
| 0x80000314|| 4 || osVersion || Some version info created in N64 boot process. Unknown on iQue.
|-
| 0x80000318 || 4 || osMemSize || Contains number of bytes of physical memory installed. Games that check for expansion pak look at this value.
|-
| 0x8000031c|| 64 || osAppNMIBuffer || Buffer where application can put persistent information that is guaranteed not to be disturbed by a warm reset. Unknown behavior on iQue.
|}

= Used only by BB =
{| class="wikitable"
|-
! Address
! Size
! Description
! Note
|-
| 0x8000035c || 4 || __osBbEepromAddress ||
|-
| 0x80000360 || 4 || __osBbEepromSize ||
|-
| 0x80000364 || 4 || __osBbFlashAddress ||
|-
| 0x80000368 || 4 || __osBbFlashSize ||
|-
| 0x8000036c || 4 || __osBbSramAddress ||
|-
| 0x80000370 || 4 || __osBbSramSize ||
|-
| 0x80000374 || 16 || __osBbPakAddress || Array of 4 u32 pointers
|-
| 0x80000384 || 4 || __osBbPakSize ||
|-
| 0x80000388 || 4 || __osBbIsBb || Can be used to determine if running on vanilla N64, or BB. 0 if (*0xa430003c & 0x140)!=0
1 if (*0xa430003c & 0x140)==0
2 if ((*0xa430003c & 0x140)==0) && ((*0xa4600060) & 0xc0000000)!=0
|-
| 0x8000038c || 4 || __osBbHackFlags ||
|-
| 0x80000390 || 4 || __osBbStashMagic ||
|-
| 0x80000394 || 4 || __osBbPakBindings || Array of 4 u32 pointers
|-
| 0x800003a4 || 4 || __osBbStateName ||
|-
| 0x800003b4 || 4 || __osBbStateDirty ||
|-
| 0x800003b8 || 4 || __osBbAuxDataLimit ||
|}

Libultra Boot Parameters

2018-05-06T22:16:39Z

Marshallh: Creation

Parameters set by the SA before booting a game. BB's modified libultra uses these values at runtime.

= Used by both N64 and BB =
{| class="wikitable"
|-
! Address
! Size
! Description
! Note
|-
| 0x800001a0|| 4 || leoBootID ||
|-
| 0x80000300|| 4 || osTvType || 0: NTSC, 1: PAL, 2: MPAL
|-
| 0x80000304|| 4 || osRomType|| Determines if cartridge boot, or 64DD boot
|-
| 0x80000308|| 4 || osRomBase || Base uncached address of cartridge (PI) region
|-
| 0x8000030c || 4 || osResetType || Whether the system was cold-booted (0) or warm-resetted NMI (1). On iQue, this may be fixed one way or the another because all games are soft-booted.
|-
| 0x80000310|| 4 || osCicId || Contains result of PIF<>CIC interaction. Value on iQue is not yet known. Rareware games like to check this value.
|-
| 0x80000314|| 4 || osVersion || Some version info created in N64 boot process. Unknown on iQue.
|-
| 0x80000318 || 4 || osMemSize || Contains number of bytes of physical memory installed. Games that check for expansion pak look at this value.
|-
| 0x8000031c|| 64 || osAppNMIBuffer || Buffer where application can put persistent information that is guaranteed not to be disturbed by a warm reset. Unknown behavior on iQue.
|}

= Used only by BB =
{| class="wikitable"
|-
! Address
! Size
! Description
! Note
|-
| 0x8000035c || 4 || __osBbEepromAddress ||
|-
| 0x80000360 || 4 || __osBbEepromSize ||
|-
| 0x80000364 || 4 || __osBbFlashAddress ||
|-
| 0x80000368 || 4 || __osBbFlashSize ||
|-
| 0x8000036c || 4 || __osBbSramAddress ||
|-
| 0x80000370 || 4 || __osBbSramSize ||
|-
| 0x80000374 || 4 || __osBbPakAddress ||
|-
| 0x80000384 || 4 || __osBbPakSize ||
|-
| 0x80000388 || 4 || __osBbIsBb || Can be used to determine if running on vanilla N64, or BB. 0 if (*0xa430003c & 0x140)!=0
1 if (*0xa430003c & 0x140)==0
2 if ((*0xa430003c & 0x140)==0) && ((*0xa4600060) & 0xc0000000)!=0
|-
| 0x8000038c || 4 || __osBbHackFlags ||
|-
| 0x80000390 || 4 || __osBbStashMagic ||
|-
| 0x80000394 || 4 || __osBbPakBindings ||
|-
| 0x800003a4 || 4 || __osBbStateName ||
|-
| 0x800003b4 || 4 || __osBbStateDirty ||
|-
| 0x800003b8 || 4 || __osBbAuxDataLimit ||
|}

Games

2018-04-28T18:31:36Z

Marshallh: Added OOT Trad. Chinese

== Released Games (14) ==

{| class="wikitable"
|-
! Title
! Chinese title
! Literal translation
! Release date
! Game CID
! Manual CID
|-
| ''[[Wave Race 64]]''
| 水上摩托
| Motorcycling on Water
| November 17, 2003
| [http://cds.idc.ique.com:16963/cds/download?content_id=5101104 51011]
| [http://cds.idc.ique.com:16963/cds/download?content_id=5101904 51019]
|-
| ''[[Star Fox 64]]''
| 星际火狐
| Interstellar Fire Fox
| November 17, 2003
| [http://cds.idc.ique.com:16963/cds/download?content_id=4101105 41011]
| [http://cds.idc.ique.com:16963/cds/download?content_id=4101904 41019]
|-
| ''[[Dr. Mario 64]]''
| 马力欧医生
| Dr. Mario
| November 17, 2003
| [http://cds.idc.ique.com:16963/cds/download?content_id=6101104 61011]
| [http://cds.idc.ique.com:16963/cds/download?content_id=6101904 61019]
|-
| ''[[Super Mario 64]]''
| 神游马力欧
| iQue Mario
| November 17, 2003
| [http://cds.idc.ique.com:16963/cds/download?content_id=1101104 11011]
| [http://cds.idc.ique.com:16963/cds/download?content_id=1101906 11019]
|-
| ''[[The Legend of Zelda: Ocarina of Time]]''
| 塞尔达传说-时光之笛-
| The Legend of Zelda: Ocarina of Time
| November 17, 2003
| [http://cds.idc.ique.com:16963/cds/download?content_id=2101104 21011]
| [http://cds.idc.ique.com:16963/cds/download?content_id=2101904 21019]
|-
| ''[[Mario Kart 64]]''
| 马力欧卡丁车
| Mario Kart
| December 25, 2003
| [http://cds.idc.ique.com:16963/cds/download?content_id=5201105 52011]
| [http://cds.idc.ique.com:16963/cds/download?content_id=5201906 52019]
|-
| ''[[F-Zero X]]''
| F-Zero X 未来赛车
| F-Zero X Future Racing
| February 25, 2004
| [http://cds.idc.ique.com:16963/cds/download?content_id=5202103 52021]
| [http://cds.idc.ique.com:16963/cds/download?content_id=5202904 52029]
|-
| ''[[Yoshi's Story]]''
| 耀西故事
| Yoshi Story
| March 25, 2004
| [http://cds.idc.ique.com:16963/cds/download?content_id=1102101 11021]
| [http://cds.idc.ique.com:16963/cds/download?content_id=1102906 11029]
|-
| ''[[Paper Mario]]''
| 纸片马力欧
| Paper Mario
| June 8, 2004
| [http://cds.idc.ique.com:16963/cds/download?content_id=2102104 21021]
| [http://cds.idc.ique.com:16963/cds/download?content_id=2102904 21029]
|-
| ''[[Sin and Punishment: Successor of the Earth]]''
| 罪与罚-地球的继承者-
| Sin and Punishment: Successor of the Earth
| September 25, 2004
| [http://cds.idc.ique.com:16963/cds/download?content_id=4102103 41021]
| [http://cds.idc.ique.com:16963/cds/download?content_id=4102901 41029]
|-
| ''[[Excitebike 64]]''
| 越野摩托
| Off-road Motorcycling
| June 15, 2005
| [http://cds.idc.ique.com:16963/cds/download?content_id=5102108 51021]
| [http://cds.idc.ique.com:16963/cds/download?content_id=5102902 51029]
|-
| ''[[Super Smash Bros.]]''
| 任天堂明星大乱斗
| Nintendo Stars Great Melee
| November 15, 2005
| [http://cds.idc.ique.com:16963/cds/download?content_id=1201105 12011]
| [http://cds.idc.ique.com:16963/cds/download?content_id=1201901 12019]
|-
| ''[[Custom Robo]]''
| 组合机器人
| Combination Robot
| May 1, 2006
| [http://cds.idc.ique.com:16963/cds/download?content_id=2105103 21051]
| N/A
|-
| ''[[Animal Crossing]]''
| 动物森林
| Animal Forest
| June 1, 2006
| [http://cds.idc.ique.com:16963/cds/download?content_id=2104108 21041]
| N/A
|}

== Cancelled Games (2) ==
{| class="wikitable"
|-
! Title
! Chinese title
! Literal translation
! Planned release date
! Game CID
! Manual CID
|-
| ''[[The Legend of Zelda: Majora's Mask]]''
| 塞尔达传说-魔力面具-
| The Legend of Zelda: The Magical Mask
| 2004/2005?
| 21031 (not on CDS)
| N/A
|-
| [["21061" |The Legend of Zelda: Ocarina of Time (Trad. Chinese)]]
| 塞爾達傳說：時光之笛
| The Legend of Zelda: Ocarina of Time
| 2006
| [http://cds.idc.ique.com:16963/cds/download?content_id=2106101 21061]
| N/A
|}