119
edits
Changes
→ARM9 ITCM: Removed redundant OTP layout description.
Line 474:
Line 474:
|-
−| 0x01FFB800
−|
−| 0x3800
−| 0x4
−| This is always 0xDEADB00F.
−|-
−| 0x01FFB804
−|
−| 0x3804
−| 0x4
−| This is the u32 DeviceId.
−|-
−| 0x01FFB808
−|
−| 0x3808
−| 0x10
−| This is the fall-back keyY used for movable.sed keyY when movable.sed doesn't exist in NAND(the last two words here are used on retail for generating console-unique TWL keydata/etc). This is also used for "LocalFriendCodeSeed", etc.
−|-
−| 0x01FFB818
−|
−| 0x3818
−| 0x1
−| ?
−|-
−| 0x01FFB819
−|
−| 0x3819
−| 0x1
−| This is the [[CTCert]] issuer type: 0 = retail "Nintendo CA - G3_NintendoCTR2prod", non-zero = dev "Nintendo CA - G3_NintendoCTR2dev".
−|-
−| 0x01FFB81A
−|
−| 0x381A
−| 0x6
−| Manufacturing date. Usually month(s) before the dates in the logs stored in [[Flash_Filesystem|TWLNAND]]. Each byte is one field: year, month, day, hour, minute, second. Year is encoded as year-1900 so that it fits in one byte.
−|-
−| 0x01FFB820
−|
−| 0x3820
−| 0x4
−| This is the CTCert ECDSA exponent, this is byte-swapped when *((u8*)(0x01FFB800+0x18)) is >=5.
−|-
−| 0x01FFB824
−|
−| 0x3824
−| 0x2
−| ?
−|-
−| 0x01FFB826
−|
−| 0x3826
−| 0x1E
−| This is the CTCert ECDSA privk.
−|-
−| 0x01FFB844
−|
−| 0x3844
−| 0x3C
−| This is the CTCert ECDSA signature.
| 0x3800
| 0x3800
| 0x100
| 0x100
−| This is the first 0x90-bytes of plaintext [[OTP_Registers|OTP]] when OTP hash verification is successful. The remaining 0x70-bytes are cleared.
+| This is the first 0x90 bytes of [[OTP_Registers#Plaintext_OTP|plaintext OTP]] when OTP hash verification is successful. The remaining 0x70 bytes are cleared.
−|-
|-
| 0x01FFB880
| 0x01FFB880
|
|
−| 0x3880
+| 0x3890
−| 0x80
+| 0x70
−| This is all-zero.
+| This is all zeros; boot ROM does not reveal the console-specific keys or the OTP hash in ITCM.
|-
|-
| 0x01FFB900
| 0x01FFB900