119
edits
Changes
Jump to navigation
Jump to search
Line 474:
Line 474: − + − |- − | 0x01FFB800 − | − | 0x3800 − | 0x4 − | This is always 0xDEADB00F. − |- − | 0x01FFB804 − | − | 0x3804 − | 0x4 − | This is the u32 DeviceId. − |- − | 0x01FFB808 − | − | 0x3808 − | 0x10 − | This is the fall-back keyY used for movable.sed keyY when movable.sed doesn't exist in NAND(the last two words here are used on retail for generating console-unique TWL keydata/etc). This is also used for "LocalFriendCodeSeed", etc. − |- − | 0x01FFB818 − | − | 0x3818 − | 0x1 − | ? − |- − | 0x01FFB819 − | − | 0x3819 − | 0x1 − | This is the [[CTCert]] issuer type: 0 = retail "Nintendo CA - G3_NintendoCTR2prod", non-zero = dev "Nintendo CA - G3_NintendoCTR2dev". − |- − | 0x01FFB81A − | − | 0x381A − | 0x6 − | Manufacturing date. Usually month(s) before the dates in the logs stored in [[Flash_Filesystem|TWLNAND]]. Each byte is one field: year, month, day, hour, minute, second. Year is encoded as year-1900 so that it fits in one byte. − |- − | 0x01FFB820 − | − | 0x3820 − | 0x4 − | This is the CTCert ECDSA exponent, this is byte-swapped when *((u8*)(0x01FFB800+0x18)) is >=5. − |- − | 0x01FFB824 − | − | 0x3824 − | 0x2 − | ? − |- − | 0x01FFB826 − | − | 0x3826 − | 0x1E − | This is the CTCert ECDSA privk. − |- − | 0x01FFB844 − | − | 0x3844 − | 0x3C − | This is the CTCert ECDSA signature. − + − + − +
→ARM9 ITCM: Removed redundant OTP layout description.
| 0x3800
| 0x3800
| 0x100
| 0x100
| This is the first 0x90-bytes of plaintext [[OTP_Registers|OTP]] when OTP hash verification is successful. The remaining 0x70-bytes are cleared.
| This is the first 0x90 bytes of [[OTP_Registers#Plaintext_OTP|plaintext OTP]] when OTP hash verification is successful. The remaining 0x70 bytes are cleared.
|-
|-
| 0x01FFB880
| 0x01FFB880
|
|
| 0x3880
| 0x3890
| 0x80
| 0x70
| This is all-zero.
| This is all zeros; boot ROM does not reveal the console-specific keys or the OTP hash in ITCM.
|-
|-
| 0x01FFB900
| 0x01FFB900