{{DISPLAYTITLE:iQue Player System Flaws}}
==Hardware==
{| class="wikitable" border="1"
! Summary
! Description
! Timeframe this was discovered
! Discovered by
|-
| No known hardware exploits
|
|
|
|-
|}

==Secure Kernel==
{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Timeframe this was discovered
! Discovered by
|-
| psychic paper: Secure Kernel could incorrectly consider a self-signed certificate chain as valid
| The function for verifying certificate chains at <tt>0x9FC028BC</tt> is passed an array of pointers to certificates.
For the first 5 elements, it checks to see if the certificate was issued by <tt>Root</tt>, if so it checks if the certificate was signed by the hardcoded <tt>Root</tt> public key (and returns immediately with the result).

If the certificate wasn't signed by <tt>Root</tt>, it checks if the certificate was signed by the public key of the next certificate in the array.

If all 5 certificates verified correctly, the function will return success.
| Assuming this function can be called with an attacker-controlled array of certificates (this is possible, thanks to other (below) issues), self-signing of certificates (and thus, arbitrary code execution, with full non-Secure Mode privileges)
(This is not the case for Secure Applications, the code in SK for verifying those sets up a hardcoded array on the stack for the certificate verification function)
| April 2018
| [[User:Riley|Riley]]
|-
| skLaunchSetup and skRecryptBegin leave CMD in memory if its signature does not verify
| The function called by skLaunchSetup (and skRecryptBegin) at <tt>0x9FC00BAC</tt> verifies ticket and CMD, and decrypts the titlekey.
After verifying the ticket signature, it copies the CMD to another place in memory, derives the titlekey encryption key, decrypts the titlekey with the titlekek, then verifies the CMD signature.

If the CMD signature does not verify successfully, the function just returns an error, leaving the unsigned CMD in place.

Most of the code that uses a CMD in SK uses the CMD in that place in memory that this function copies the CMD to, and trusts that whatever data is there has been verified already.

The entire CMD is covered by the ticket signature anyway, so this isn't that useful really, besides potentially making psychic paper easier to exploit.
| With existing code execution with access to skLaunchSetup or skRecryptBegin and some other SKC that uses SK's internal CMD copy (only non-test SAs have this level of access), and the ability to sign a ticket but not a CMD:
Allowing the use of an unsigned CMD by SK, potentially leading to privilege escalation (by specifying arbitrary allowed hardware access/allowed SKCs).
| April 26, 2018
| [[User:Riley|Riley]]
|-
| skLaunch does not check content hash if recrypt flag is set in CMD
| skLaunch calculates the SHA1 hash of the content and compares it to the value in the CMD, returning an error if the hash doesn't match. This entire block of code is jumped over if the recrypt flag is set in the CMD.
| With plaintext of an application with the recrypt flag set in its CMD, arbitrary code execution (via, for example, implementation of the attack described in pocorgtfo17)
| Early 2018?
| Everyone
|-
| skVerifyHash signature pointer not validated
| skVerifyHash takes in a u8 pointer to a signature to verify, but does not actually validate this pointer is valid before treating the memory it points to as an RSA/ECC signature.
| Causing the Secure Kernel to data abort -- possibly usable as an infoleak, depending on the provided cert chain
| April 29, 2018
| [[User:SciresM|SciresM]]
|-
| SK's ECDH implementation does no validation of the other party's public key
| When deriving the titlekek using ECDH, SK does no validation whatsoever of the public key, which comes from the ticket. Because ECDH is just multiplication, passing in an all-zero public key would lead to an all-zero titlekek being used.
| With the ability to sign a ticket and CMD (for example, psychic paper): causing SK to use a constant titlekek; no need to know a console's ECC keypair.
| April 29, 2018
| [[User:Riley|Riley]]
|-
| skRecryptData insufficient checks
| skRecryptData allows for NULL to be passed in as a pointer, for supporting some alternate mode controlled by a u32 in SK .data.
However, if this u32 is 0 (which is the default), no further checks are done and recrypt operations are done starting from NULL with provided length (in 0x400 chunks).

Also, if skRecryptBegin wasn't called, the recrypt operation is done by decrypting using the current hardware AES engine state, then re-encrypting with a completely zero internal state (which is invalid, so nothing will be done).

If skRecryptBegin was called, the re-encryption will succeed as the internal state would have been set, and re-encrypted data would be written to the same area that the original data was read from. (To get to the SK code area with this, though, requires overwriting all of DRAM)
| Possible infoleak into the PI buffer. (without recrypt state set)
Possible secure mode code execution. (with recrypt state set)
| April 30, 2018
| [[User:Riley|Riley]]
|-
| SK's CRL checking function will not check a ticket CRL at all if the ticket CRL version in the ticket (as s32) is < 0
| The function in SK that checks provided CRLs at <tt>0x9FC02CB4</tt> checks the provided ticket CRL version first (which comes from the ticket.) If it's less than 0 as s32, it will not be checked at all, that call will be jumped over.

The first CRL in the list is the ticket CRL; thus this could provide a favourable situation for exploiting psychic paper.

Additionally, the required elements to craft a CRL such that SA believes it to be valid with the public key in the correct place for psychic paper do not overlap.

Furthermore, libultra function osBbSaGamePrelaunch (which calls skLaunchSetup/skRecryptBegin/etc), which is called by SA when launching a game, stores the CRL structure for those two SKCs directly after the ticket bundle structure in .data. This, plus other flaws (below) lead directly to the successful exploitation of psychic paper.
| Exploitation of psychic paper
| April 30, 2018
| [[User:Riley|Riley]]
|}

==System Applications==
{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Exploitable System Applications
! Timeframe this was discovered
! Discovered by
|-
| libultra _osBbSaVerifyTickets gets an entire ticket bundle then just uses skVerifyHash with the ticket cert-chain ptr
| _osBbVerifyTickets is called by osBbSaMetaGetTickets if argument 2 is not 0. (osBbSaMetaGetTickets, in turn, is called by a function in SA that appears to get the data for the game menu?)
This function calls osBbSaBundleTicket, which gets a "ticket bundle" (struct containing ticket + ticket+CMD cert chain + CRL pointers, pointer to which is used as an argument for skLaunchSetup and skRecryptBegin), then proceeds to call skVerifyHash passing a pointer to the ticket cert-chain pointer array from that structure.

Given that the CMD cert chain pointer array is directly after the ticket cert-chain pointer array in that structure, this gives a favourable situation for exploitation of psychic paper.
| Exploitation of psychic paper and self-signing tickets such that non-test SAs believe them to be valid.
| All non-test SAs?
| April 30, 2018
| [[User:Riley|Riley]]
|-
| libultra osBbSaCertCreateChain only uses the endmost certificate's issuer
| osBbSaCertCreateChain parses cert.sys to create a cert chain array for SK (first element points to the object's signer, second element points to its signer, etc.).
This function only uses the issuer of the endmost certificate (object's signer), to get a list of certificate names to obtain.

The rest of the certificates only have their name compared against the one currently being searched for. There are no checks that the chain being created ends in Root. This gives a favourable situation for exploitation of psychic paper.
| Exploitation of psychic paper
| All non-test SAs?
| April 30, 2018
| [[User:Riley|Riley]]
|}

IQue Player System Flaws

2018-04-30T17:14:35Z

Riley: dank memes

IQue Player System Flaws

2018-04-29T21:48:14Z

Riley: clarification

SKC

2018-04-29T14:41:08Z

Riley: removed dev-only SKCs

= Secure Kernel calls =

All secure kernel calls return a s32 error code in $v0. 0 means success, below zero means error.

{| class=wikitable
! Id || Name || In
|-
| 0x0 || skcGetBBID || $a0=u32* out_bbid
|-
| 0x1 || skcPrepareCMDAndTik || ???
|-
| 0x2 || skcStartContent || $a0=address where decrypted content has been loaded
|-
| 0x3 || skcVerifyRecryptSys || $a0=address of recrypt.sys contents
|-
| 0x4 || skRecryptBegin || ???
|-
| 0x5 || skRecryptData || ???
|-
| 0x6 || skRecryptComputeState || ???
|-
| 0x7 || skRecryptEnd || ???
|-
| 0x8 || skcECCSignSHA1Hash || $a0=u8* sha1hash, $a1=u8* out_signature
|-
| 0x9 || skcVerifySignature || $a0=u8* sha1hash, $a1=u8* signature, $a2=certificate** certificate_chain, $a3=crl** crls?
|-
| 0xA || skGetConsumption || ???
|-
| 0xB || skAdvanceTicketWindow || ???
|-
| 0xC || skSetLimit || ???
|-
| 0xD || skcReboot || void
|-
| 0xE || skcKeepAlive || void
|}

IQue Player System Flaws

2018-04-29T12:23:46Z

Riley: kekking at the titlekek, it's also useless

IQue Player System Flaws

2018-04-29T11:01:38Z

Riley:

IQue Player System Flaws

2018-04-26T23:05:50Z

Riley:

SKC

2018-04-26T22:04:14Z

Riley: /* Secure Kernel calls */

= Secure Kernel calls =

All secure kernel calls return a s32 error code in $v0. 0 means success, below zero means error.

{| class=wikitable
! Id || Name || In
|-
| 0x0 || skcGetBBID || $a0=u32* out_bbid
|-
| 0x1 || skcPrepareCMDAndTik || ???
|-
| 0x2 || skcStartContent || $a0=address where decrypted content has been loaded
|-
| 0x3 || skcVerifyRecryptSys || $a0=address of recrypt.sys contents
|-
| 0x4 || ??? || ???
|-
| 0x5 || ??? || ???
|-
| 0x6 || ??? || ???
|-
| 0x7 || ??? || ???
|-
| 0x8 || skcECCSignSHA1Hash || $a0=u8* sha1hash, $a1=u8* out_signature
|-
| 0x9 || skcVerifySignature || $a0=u8* sha1hash, $a1=u8* signature, $a2=certificate** certificate_chain, $a3=crl** crls?
|-
| 0xA || ??? || ???
|-
| 0xB || ??? || ???
|-
| 0xC || ??? || ???
|-
| 0xD || skcReboot || void
|-
| 0xE || ??? || ???
|}

SKC

2018-04-26T22:03:54Z

Riley: skcVerifySignature

= Secure Kernel calls =

All secure kernel calls return a s32 error code in $v0. 0 means success, below zero means error.

{| class=wikitable
! Id || Name || In
|-
| 0x0 || skcGetBBID || $a0=u32* out_bbid
|-
| 0x1 || skcPrepareCMDAndTik || ???
|-
| 0x2 || skcStartContent || $a0=address where decrypted content has been loaded
|-
| 0x3 || skcVerifyRecryptSys || $a0=address of recrypt.sys contents
|-
| 0x4 || ??? || ???
|-
| 0x5 || ??? || ???
|-
| 0x6 || ??? || ???
|-
| 0x7 || ??? || ???
|-
| 0x8 || skcECCSignSHA1Hash || $a0=u8* sha1hash, $a1=u8* out_signature
|-
| 0x9 || skcVerifySignature || $a0=u8* sha1hash, $a1=u8* signature, certificate** certificate_chain, crl** crls?
|-
| 0xA || ??? || ???
|-
| 0xB || ??? || ???
|-
| 0xC || ??? || ???
|-
| 0xD || skcReboot || void
|-
| 0xE || ??? || ???
|}

SKC

2018-04-26T19:20:36Z

Riley: skcECCSignSHA1Hash

= Secure Kernel calls =

All secure kernel calls return a s32 error code in $v0. 0 means success, below zero means error.

{| class=wikitable
! Id || Name || In
|-
| 0x0 || skcGetBBID || $a0=u32* out_bbid
|-
| 0x1 || skcPrepareCMDAndTik || ???
|-
| 0x2 || skcStartContent || $a0=address where decrypted content has been loaded
|-
| 0x3 || skcVerifyRecryptSys || $a0=address of recrypt.sys contents
|-
| 0x4 || ??? || ???
|-
| 0x5 || ??? || ???
|-
| 0x6 || ??? || ???
|-
| 0x7 || ??? || ???
|-
| 0x8 || skcECCSignSHA1Hash || $a0=u8* sha1hash, $a1=u8* out_signature
|-
| 0x9 || ??? || ???
|-
| 0xA || ??? || ???
|-
| 0xB || ??? || ???
|-
| 0xC || ??? || ???
|-
| 0xD || skcReboot || void
|-
| 0xE || ??? || ???
|}

SKC

2018-04-26T18:24:44Z

Main Page/Navigation

2018-04-26T12:00:44Z

Riley:

{{Main page box|Navigation|:Navigation}}
<div style="margin: -.3em -1em -1em -1em;">
{| width="100%" bgcolor="#fff" border="0" cellpadding="2px" cellspacing="2px" style="margin:auto;"
|- align="center" bgcolor="#e7eef6"
! width="33%" | '''General''' 
! width="33%" | '''Homebrew''' 
! width="33%" | '''Hardware/Software''' 
|- valign="top" style="background: #F5FAFF;"
|
*[[Glossary]]
*[[Games]]
*[[:Category:PC utilities|PC Utilities]]
|
*[[IQue Player System Flaws|System flaws]]
|
*[[:Category:Hardware|Hardware]]
*[[IQue Player|Player Overview]] ([[IO|IO registers]])
*[[IQue Card|Memory Card]]
*[[:Category:File_formats|File Formats]]
*[[SKC|Secure Kernel calls]]
|}
</div>
{{box-footer-empty}}

SKC

2018-04-26T11:59:57Z

Titles

2018-04-05T22:59:01Z

Riley: /* Videos */ adding Dr Mario trailer

These are titles downloadable via http://cds.idc.ique.com:16963/cds/download?content_id=xxx, where xxx is replaced with one of the following IDs:

=== [[SKSA]] ===
{| class="wikitable"
|-
! Content ID
! MD5
! Size (Bytes)
! Size (KiB)
|-
| 1009
| D458B4189DE60947AAA44ABC5C4235A3
| 999,424
| 976
|-
| 1010
| D6E171FC693F61B0456B1A6C187717B7
| 229,376
| 224
|-
| 1011
| C233D6C6972DE294B6B59D99FFD48695
| 3,751,936
| 3,664
|-
| 1012
| C520AAAED20B4371B2ED7BB1063ABA7A
| 229,376
| 224
|-
| 1013
| 134B0AB9AFD980E11B5CA983CE597699
| 3,817,472
| 3728
|}

=== Apps ===
{| class="wikitable"
|-
! Content ID
! Name
! Have ticket?
! MD5
! Size (Bytes)
! Size (KiB)
! Icon
! Title image
|-
| [http://cds.idc.ique.com:16963/cds/download?content_id=10000001 10000001]
| ? (older [[iQue Club]]?)
| N
| 99BF5E73BDE973481DF31DA37E0323C1
| 557,056
| 544
| [[File:10000001_thumb.png]]
| [[File:10000001_title.png]]
|-
| [http://cds.idc.ique.com:16963/cds/download?content_id=10000002 10000002]
| ? (older [[iQue Club]]?)
| N
| 998B226B8DB3C9EC33714311E5D4518F
| 557,056
| 544
| [[File:10000002_thumb.png]]
| [[File:10000002_title.png]]
|-
| [http://cds.idc.ique.com:16963/cds/download?content_id=10000003 10000003]
| [[iQue Club]]
| Y
| A872E4B02A6E878B0182078CD3CA7A54
| 573,440
| 560
| [[File:10000003_thumb.png]]
| [[File:10000003_title.png]]
|}

=== Games ===
{| class="wikitable"
|-
! Content ID
! Name
! Have ticket?
! MD5
! Size (Bytes)
! Size (MiB)
! Icon
! Title image
|-
| 1101104
| [[Super Mario 64]]
| Y
| C459BA45F0B0071ECF6B62DA70F3D0A2
| 8,060,928
| 7.68
| [[File:1101104_thumb.png]]
| [[File:1101104_title.png]]
|-
| 1102101
| [[Yoshi's Story]]
| Y
| F41DD4A1699C271725540B9E9B06905B
| 16,023,552
| 15.2
| [[File:1102101_thumb.png]]
| [[File:1102101_title.png]]
|-
| 1201105
| [[Super Smash Bros. | Smash Bros]]
| Y
| 49844CB8FE9A45BAE2A20837BDD273B8
| 16,793,600
| 16.0
| [[File:1201105_thumb.png]]
| [[File:1201105_title.png]]
|-
| 2101104
| [[The Legend of Zelda: Ocarina of Time | TLoZ: OoT]]
| Y
| 5AD50BA0418FEDE5975D8C5A9479026A
| 29,868,032
| 28.4
| [[File:2101104_thumb.png]]
| [[File:2101104_title.png]]
|-
| 2102104
| [[Paper Mario]]
| Y
| 0FA599E0C4572D01E0F27053A6C0E2C9
| 41,943,040
| 40.0
| [[File:2102104_thumb.png]]
| [[File:2102104_title.png]]
|-
| 21031??
| [[The Legend of Zelda: Majora's Mask | TLoZ: MM (not on CDS)]]
| N
| N/A
| N/A
| N/A
| N/A
| N/A
|-
| 2104108
| [[Animal Crossing]]
| Y
| ABB27076A1CA5632CBF2442F2FD761A0
| 16,138,240
| 15.3
| [[File:2104108_thumb.png]]
| [[File:2104108_title.png]]
|-
| 2105103
| [[Custom Robo]]
| Y
| 6A9BD38BC13CC294484F296C13455720
| 16,793,600
| 16.0
| [[File:2105103_thumb.png]]
| [[File:2105103_title.png]]
|-
| 2106101
| [["21061" | ?]]
| N
| 627DF063F2C7363B62104AF8136D1398
| 29,868,032
| 28.4
| N/A
| N/A
|-
| 4101104
| [[Star Fox 64]] (v4)
| N
| A35F74BBD3402BDDD5D9DE80B2DFE8D0
| 11,829,248
| 11.2
| [[File:4101104_thumb.png]]
| [[File:4101104_title.png]]
|-
| 4101105
| [[Star Fox 64]] (v5)
| Y
| 1DAF559E7FB63E2066C7CA8358B83EE9
| 11,829,248
| 11.2
| [[File:4101105_thumb.png]]
| [[File:4101105_title.png]]
|-
| 4102103
| [[Sin and Punishment: Successor of the Earth | Sin & Punishment]]
| Y
| CA2F78F45D8DC723C09A3305999C221F
| 33,636,352
| 32.0
| [[File:4102103_thumb.png]]
| [[File:4102103_title.png]]
|-
| 5101104
| [[Wave Race 64]]
| Y
| BFFF6C33FB58657D7EA4479C10F92C26
| 8,159,232
| 7.78
| [[File:5101104_thumb.png]]
| [[File:5101104_title.png]]
|-
| 5102108
| [[Excitebike 64 | Excitebike]]
| Y
| 5ADBA1EF5CFB3B5368D92CECFCCF3836
| 16,072,704
| 15.3
| [[File:5102108_thumb.png]]
| [[File:5102108_title.png]]
|-
| 5201104
| [[Mario Kart 64]] (v4)
| Y
| 9895E8288F822FEE67D4D19FD6BB2CAA
| 12,533,760
| 11.9
| [[File:5201104_thumb.png]]
| [[File:5201104_title.png]]
|-
| 5201105
| [[Mario Kart 64]] (v5)
| Y
| 539F1235E78AA9E01DEDEE13E9024DAA
| 12,533,760
| 11.9
| [[File:5201105_thumb.png]]
| [[File:5201105_title.png]]
|-
| 5202103
| [[F-Zero X]]
| Y
| F8AEAABEBCA1B0D228A5FE3C77740381
| 16,334,848
| 15.5
| [[File:5202103_thumb.png]]
| [[File:5202103_title.png]]
|-
| 6101104
| [[Dr. Mario 64 | Dr. Mario]]
| Y
| 514DCF24C3B6E777157D3F19FEBB253F
| 3,358,720
| 3.20
| [[File:6101104_thumb.png]]
| [[File:6101104_title.png]]

|}

=== Game Manuals ===
{| class="wikitable"
|-
! Content ID
! Name
! Have ticket?
! MD5
! Size (Bytes)
! Size (KiB)
! Icon
! Title image
|-
| 1101902
| [[Super Mario 64]] (v2)
| N
| 593DC3BDCE513B112784B20E2DD46347
| 212,992
| 208
| [[File:1101902_thumb.png]]
| [[File:1101902_title.png]]
|-
| 1101906
| [[Super Mario 64]] (v6)
| Y
| 216AD927DD016582EFD548AC0B71D97F
| 409,600
| 400
| [[File:1101906_thumb.png]]
| [[File:1101906_title.png]]
|-
| 1102902
| [[Yoshi's Story]] (v2)
| N
| 4CD568FA411F66FB251EB677F07E621B
| 196,608
| 192
| [[File:1102902_thumb.png]]
| [[File:1102902_title.png]]
|-
| 1102904
| [[Yoshi's Story]] (v4)
| N
|
|
|
| [[File:1102902_thumb.png]]
| [[File:1102902_title.png]]
|-
| 1102906
| [[Yoshi's Story]] (v6)
| Y
| 9AFFE75A1208BE881CB959F27AF51EE5
| 425,984
| 416
| [[File:1102906_thumb.png]]
| [[File:1102906_title.png]]
|-
| 1201901
| [[Super Smash Bros. | Smash Bros]]
| Y
| C9BDE191187EEC7CC8C9B3E693427443
| 294,912
| 288
| [[File:1201901_thumb.png]]
| [[File:1201901_title.png]]
|-
| 2101902
| [[The Legend of Zelda: Ocarina of Time | TLoZ: OoT]] (v2)
| N
| A5B9C4286D63A47311CDAE8CA52CC849
| 278,528
| 272
| [[File:2101902_thumb.png]]
| [[File:2101902_title.png]]
|-
| 2101904
| [[The Legend of Zelda: Ocarina of Time | TLoZ: OoT]] (v4)
| Y
| 262992B226C0C70A96613DFB4760804D
| 425,984
| 416
| [[File:2101904_thumb.png]]
| [[File:2101904_title.png]]
|-
| 2102902
| [[Paper Mario]] (v2)
| N
| 7372A3D86180167DFACCCB7BAC12CAD7
| 376,832
| 368
| [[File:2102902_thumb.png]]
| [[File:2102902_title.png]]
|-
| 2102904
| [[Paper Mario]] (v4)
| Y
| 178C6727790B36502E1F720EF1B02056
| 376,832
| 368
| [[File:2102904_thumb.png]]
| [[File:2102904_title.png]]
|-
| 4101902
| [[Star Fox 64]] (v2)
| N
| 8741C70E7EC966235E5CE15104FF6C48
| 163,840
| 160
| [[File:4101902_thumb.png]]
| [[File:4101902_title.png]]
|-
| 4101904
| [[Star Fox 64]] (v4)
| Y
|
|
|
| [[File:4101904_thumb.png]]
| [[File:4101904_title.png]]
|-
| 4102901
| [[Sin and Punishment: Successor of the Earth | Sin & Punishment]]
| Y
|
|
|
| [[File:4102901_thumb.png]]
| [[File:4102901_title.png]]
|-
| 5101902
| [[Wave Race 64]] (v2)
| N
| 6684F2014489AFD87D40753CC3D0D44F
| 311,296
| 304
| [[File:5101902_thumb.png]]
| [[File:5101902_title.png]]
|-
| 5101904
| [[Wave Race 64]] (v4)
| Y
|
|
|
| [[File:5101904_thumb.png]]
| [[File:5101904_title.png]]
|-
| 5102902
| [[Excitebike 64 | Excitebike]]
| Y
|
|
|
| [[File:5102902_thumb.png]]
| [[File:5102902_title.png]]
|-
| 5201902
| [[Mario Kart 64]] (v2)
| N
| AA2D45CED10179F32B74375EF8384A61
| 245,760
| 240
| [[File:5201902_thumb.png]]
| [[File:5201902_title.png]]
|-
| 5201906
| [[Mario Kart 64]] (v6)
| Y
| 072F79B24AF22B6363094630A9ED3C3D
| 425,984
| 416
| [[File:5201906_thumb.png]]
| [[File:5201906_title.png]]
|-
| 5202902
| [[F-Zero X]] (v2)
| N
| 0ED89CBDCD2F96C5C08B70EAAAFBC613
| 180,224
| 176
| [[File:5202902_thumb.png]]
| [[File:5202902_title.png]]
|-
| 5202904
| [[F-Zero X]] (v4)
| Y
| B2C723A6F625FB99F08DB09FC4F9DC60
| 294,912
| 288
| [[File:5202904_thumb.png]]
| [[File:5202904_title.png]]
|-
| 6101902
| [[Dr. Mario 64 | Dr. Mario]] (v2)
| N
| 0B98ABAF20F473D4BEE8E22F18920748
| 294,912
| 288
| [[File:6101902_thumb.png]]
| [[File:6101902_title.png]]
|-
| 6101904
| [[Dr. Mario 64 | Dr. Mario]] (v4)
| Y
| E7D1148BE9AC6149A35F0C22DDFE234E
| 393,216
| 384
| [[File:6101904_thumb.png]]
| [[File:6101904_title.png]]
|}

=== Videos ===
{| class="wikitable"
|-
! Content ID
! Name
! MD5
! Size (Bytes)
! Size (MiB)
! Format
! Resolution
|-
| 20000001
| [[Super Mario 64]] Trailer
|
|
|
| AVI
| 480p
|-
| 20000002
| [[Super Mario 64]] Trailer
|
|
|
| AVI
| 240p
|-
| 21000001
| [[Wave Race 64]] Trailer
|
|
|
| AVI
| 480p
|-
| 21000002
| [[Wave Race 64]] Trailer
|
|
|
| AVI
| 240p
|-
| 22000001
| [[Dr. Mario 64]] Trailer
| e19f4bfac77c82d949565ffea33b2be6
| 13,374,918
| 12.7
| AVI
| 240p
| -
| 23000001
| [[Star Fox 64]] Trailer
|
|
|
|
| 240p
|-
| 24000001
| Ocarina of Time Trailer
|
|
|
|
| 240p
|-
| 25000001
| [[Mario Kart 64]] Trailer
|
|
|
| AVI
| 240p
|-
| 26000001
| [[F-Zero X]] Trailer
|
|
|
| AVI
| 240p
|}

IQue Player

2018-03-26T10:38:19Z

Riley:

{{DISPLAYTITLE:iQue Player}}
[[File:iQue Player.png|thumb|An '''iQue Player'''.]]

The '''iQue Player''' (Chinese: 神游机, lit. "Divine gaming machine") is a game console created by iQue and BroadOn (formerly Routefree, later iGware, now Acer Cloud) in partnership with Nintendo, only released in China in late 2003. iQue company was co-founded by engineer [https://en.wikipedia.org/wiki/Wei_Yen Dr. Wei Yen], an USA-CHN scientist mainly involved in the development of the N64 GFX chip "Reality Engine"; he is also the founder of ArtX, a company that was commissioned by Nintendo to produce the GameCube GPU named "Flipper".

The reason for this union was dictated by the fact that, since 2000, the Chinese market "suffered" from a [https://en.wikipedia.org/wiki/Video_gaming_in_China#Changes_to_video_game_ban_in_China ban on gaming consoles] because they were considered harmful to the psyche of children (the ban ceased in 2015); Nintendo needed to circumvent the problem and to be able to insert its consoles in the vast market of China ([https://www.thegamesmachine.it/speciali/72045/time-machine-online-nintendo-cina-ique/ here it is a plausible explanation] on how it seems to have done). The opportunity came with iQue products, of which the "i Que Player" represents the progenitor and corresponds to the Chinese version of the Nintendo 64 (there are also iQue GBA, GBA SP, GB Micro, iQue DS, DS Lite, the iQue 3DS)!

This console is not a normal N64 but a "compressed" version of it in a single chip: based on the Nintendo 64, the iQue Player adds features like [[iQue Card|removable NAND flash]] memory, PC connectivity (via USB), slightly better performance, and 14 different [[games]] translated into Simplified Chinese.

[[Category:Hardware]]

IQue Player

2018-03-25T11:43:54Z

Riley:

The '''iQue Player''' is a game console created by iQue and BroadOn (formerly Routefree, later iGware, now Acer Cloud) in partnership with Nintendo, released only in China. Based on the N64, it adds features like removable [[NAND]] flash memory, PC connectivity (via USB), slightly better performance & exclusive Chinese-translated games.

[[Category:Hardware]]