IOS_CRYPTO:04004714 loc_4004714
IOS_CRYPTO:04004714 LDR R4, =Wii_U_0x12_keyhandle_seed
IOS_CRYPTO:04004718 MOV R0, #0x87 ; 'ç' ; 0x04 bytes Wii U 0x12-keyhandle seed (only the last 0x04 bytes are used).
IOS_CRYPTO:0400471C MOV R1, R4
IOS_CRYPTO:04004720 MOV R2, #4
IOS_CRYPTO:04004724 BL read_otp ; int read_otp(u32 wordindex, void *out_buf, u32 size)
IOS_CRYPTO:04004724 ; Read data from the OTP, this can only be used from the IOS-CRYPTO process.
IOS_CRYPTO:04004724 ; -> 0 on success, -1 when IOUS PID isn't 3.
IOS_CRYPTO:04004724
IOS_CRYPTO:04004724
IOS_CRYPTO:04004728 MOV R0, #0x88 ; 'ê' ; 0x20 bytes vWii NG private key?
IOS_CRYPTO:0400472C LDR R1, =vWii_NG_private_key
IOS_CRYPTO:04004730 MOV R2, #0x20 ; ' '
IOS_CRYPTO:04004734 BL read_otp ; int read_otp(u32 wordindex, void *out_buf, u32 size)
IOS_CRYPTO:04004734 ; Read data from the OTP, this can only be used from the IOS-CRYPTO process.
IOS_CRYPTO:04004734 ; -> 0 on success, -1 when IOUS PID isn't 3.
IOS_CRYPTO:04004734 ;
IOS_CRYPTO:04004734
IOS_CRYPTO:04004738 MOV R0, #0x90 ; 'É' ; 0x20 bytes Unknown.
IOS_CRYPTO:0400473C LDR R1, =Unknown_Key_0
IOS_CRYPTO:04004740 MOV R2, #0x20 ; ' '
IOS_CRYPTO:04004744 BL read_otp ; int read_otp(u32 wordindex, void *out_buf, u32 size)
IOS_CRYPTO:04004744 ; Read data from the OTP, this can only be used from the IOS-CRYPTO process.
IOS_CRYPTO:04004744 ; -> 0 on success, -1 when IOUS PID isn't 3.
IOS_CRYPTO:04004744 ;
IOS_CRYPTO:04004744
IOS_CRYPTO:04004748 MOV R0, #0xD8 ; '+' ; 0x20 bytes Old Wii SEEPROM signature?
IOS_CRYPTO:0400474C LDR R1, =Old_Wii_SEEPROM_signature
IOS_CRYPTO:04004750 MOV R2, #0x20 ; ' '
IOS_CRYPTO:04004754 BL read_otp ; int read_otp(u32 wordindex, void *out_buf, u32 size)
IOS_CRYPTO:04004754 ; Read data from the OTP, this can only be used from the IOS-CRYPTO process.
IOS_CRYPTO:04004754 ; -> 0 on success, -1 when IOUS PID isn't 3.
IOS_CRYPTO:04004754 ;
IOS_CRYPTO:04004754
IOS_CRYPTO:04004758 MOV R0, #5 ; 0x10 bytes Wii common key.
IOS_CRYPTO:0400475C LDR R1, =Wii_common_key
IOS_CRYPTO:04004760 MOV R2, R7
IOS_CRYPTO:04004764 BL read_otp ; int read_otp(u32 wordindex, void *out_buf, u32 size)
IOS_CRYPTO:04004764 ; Read data from the OTP, this can only be used from the IOS-CRYPTO process.
IOS_CRYPTO:04004764 ; -> 0 on success, -1 when IOUS PID isn't 3.
IOS_CRYPTO:04004764 ;
IOS_CRYPTO:04004764
IOS_CRYPTO:04004768 LDR R3, [R4]
IOS_CRYPTO:0400476C CMP R3, #0
IOS_CRYPTO:04004770 BNE Get_wii_NAND_keys
IOS_CRYPTO:04004770
IOS_CRYPTO:04004774
IOS_CRYPTO:04004774 loc_4004774
IOS_CRYPTO:04004774 MOV R0, #0x5C ; '\' ; 0x10 bytes Wii U NAND key.
IOS_CRYPTO:04004778 LDR R1, =Wii_U_NAND_key
IOS_CRYPTO:0400477C MOV R2, R7
IOS_CRYPTO:04004780 BL read_otp ; int read_otp(u32 wordindex, void *out_buf, u32 size)
IOS_CRYPTO:04004780 ; Read data from the OTP, this can only be used from the IOS-CRYPTO process.
IOS_CRYPTO:04004780 ; -> 0 on success, -1 when IOUS PID isn't 3.
IOS_CRYPTO:04004780 ;
IOS_CRYPTO:04004780
IOS_CRYPTO:04004784 MOV R0, #0x78 ; 'x' ; 0x14 bytes Wii U NAND HMAC.
IOS_CRYPTO:04004788 LDR R1, =Wii_U_NAND_HMAC
IOS_CRYPTO:0400478C MOV R2, #0x14
IOS_CRYPTO:04004790 BL read_otp ; int read_otp(u32 wordindex, void *out_buf, u32 size)
IOS_CRYPTO:04004790 ; Read data from the OTP, this can only be used from the IOS-CRYPTO process.
IOS_CRYPTO:04004790 ; -> 0 on success, -1 when IOUS PID isn't 3.
IOS_CRYPTO:04004790 ;
IOS_CRYPTO:04004790
IOS_CRYPTO:04004794 MOV R0, #0x58 ; 'X' ; 0x10 bytes Wii U RNG key.
IOS_CRYPTO:04004798 LDR R1, =Wii_U_RNG_key
IOS_CRYPTO:0400479C MOV R2, R7
IOS_CRYPTO:040047A0 BL read_otp ; int read_otp(u32 wordindex, void *out_buf, u32 size)
IOS_CRYPTO:040047A0 ; Read data from the OTP, this can only be used from the IOS-CRYPTO process.
IOS_CRYPTO:040047A0 ; -> 0 on success, -1 when IOUS PID isn't 3.
IOS_CRYPTO:040047A0 ;
IOS_CRYPTO:040047A0
IOS_CRYPTO:040047A4 MOV R0, #0x24 ; '$' ; 0x10 bytes Wii U Starbuck ancast key.
IOS_CRYPTO:040047A8 LDR R1, =Wii_U_Starbuck_ancast_key
IOS_CRYPTO:040047AC MOV R2, R7
IOS_CRYPTO:040047B0 BL read_otp ; int read_otp(u32 wordindex, void *out_buf, u32 size)
IOS_CRYPTO:040047B0 ; Read data from the OTP, this can only be used from the IOS-CRYPTO process.
IOS_CRYPTO:040047B0 ; -> 0 on success, -1 when IOUS PID isn't 3.
IOS_CRYPTO:040047B0 ;
IOS_CRYPTO:040047B0
IOS_CRYPTO:040047B4 MOV R0, #0x28 ; '(' ; 0x10 bytes Wii U SEEPROM key.
IOS_CRYPTO:040047B8 LDR R1, =Wii_U_SEEPROM_key
IOS_CRYPTO:040047BC MOV R2, R7
IOS_CRYPTO:040047C0 BL read_otp ; int read_otp(u32 wordindex, void *out_buf, u32 size)
IOS_CRYPTO:040047C0 ; Read data from the OTP, this can only be used from the IOS-CRYPTO process.
IOS_CRYPTO:040047C0 ; -> 0 on success, -1 when IOUS PID isn't 3.
IOS_CRYPTO:040047C0 ;
IOS_CRYPTO:040047C0
IOS_CRYPTO:040047C4 MOV R0, #0x60 ; '`' ; 0x10 bytes Wii U devkit fallback key.
IOS_CRYPTO:040047C8 LDR R1, =Wii_U_devkit_fallback_key
IOS_CRYPTO:040047CC MOV R2, R7
IOS_CRYPTO:040047D0 BL read_otp ; int read_otp(u32 wordindex, void *out_buf, u32 size)
IOS_CRYPTO:040047D0 ; Read data from the OTP, this can only be used from the IOS-CRYPTO process.
IOS_CRYPTO:040047D0 ; -> 0 on success, -1 when IOUS PID isn't 3.
IOS_CRYPTO:040047D0 ;
IOS_CRYPTO:040047D0
IOS_CRYPTO:040047D4 MOV R0, #0x68 ; 'h' ; 0x10 bytes Wii RNG key.
IOS_CRYPTO:040047D8 LDR R1, =Wii_RNG_key
IOS_CRYPTO:040047DC MOV R2, R7
IOS_CRYPTO:040047E0 BL read_otp ; int read_otp(u32 wordindex, void *out_buf, u32 size)
IOS_CRYPTO:040047E0 ; Read data from the OTP, this can only be used from the IOS-CRYPTO process.
IOS_CRYPTO:040047E0 ; -> 0 on success, -1 when IOUS PID isn't 3.
IOS_CRYPTO:040047E0 ;
IOS_CRYPTO:040047E0
IOS_CRYPTO:040047E4 MOV R0, #0x34 ; '4' ; 0x10 bytes vWii_common_key
IOS_CRYPTO:040047E8 LDR R1, =vWii_common_key
IOS_CRYPTO:040047EC MOV R2, R7
IOS_CRYPTO:040047F0 BL read_otp ; int read_otp(u32 wordindex, void *out_buf, u32 size)
IOS_CRYPTO:040047F0 ; Read data from the OTP, this can only be used from the IOS-CRYPTO process.
IOS_CRYPTO:040047F0 ; -> 0 on success, -1 when IOUS PID isn't 3.
IOS_CRYPTO:040047F0 ;
IOS_CRYPTO:040047F0
IOS_CRYPTO:040047F4 MOV R0, #0x38 ; '8' ; 0x10 bytes Wii_U_common_key
IOS_CRYPTO:040047F8 LDR R1, =Wii_U_common_key
IOS_CRYPTO:040047FC MOV R2, R7
IOS_CRYPTO:04004800 BL read_otp ; int read_otp(u32 wordindex, void *out_buf, u32 size)
IOS_CRYPTO:04004800 ; Read data from the OTP, this can only be used from the IOS-CRYPTO process.
IOS_CRYPTO:04004800 ; -> 0 on success, -1 when IOUS PID isn't 3.
IOS_CRYPTO:04004800 ;
IOS_CRYPTO:04004800
IOS_CRYPTO:04004804 MOV R0, #0xD2 ; '-' ; 0x10 bytes Part of Old Wii SEEPROM certificate data. (maybe)
IOS_CRYPTO:04004808 LDR R1, =SEEPROM_certificate_data
IOS_CRYPTO:0400480C MOV R2, R7
IOS_CRYPTO:04004810 BL read_otp ; int read_otp(u32 wordindex, void *out_buf, u32 size)
IOS_CRYPTO:04004810 ; Read data from the OTP, this can only be used from the IOS-CRYPTO process.
IOS_CRYPTO:04004810 ; -> 0 on success, -1 when IOUS PID isn't 3.
IOS_CRYPTO:04004810 ;
IOS_CRYPTO:04004810
IOS_CRYPTO:04004814 MOV R0, #0x48 ; 'H' ; 0x10 bytes Key to encrypt/decrypt SSL RSA key.
IOS_CRYPTO:04004818 LDR R1, =Key_to_encrypt_decrypt_SSL_RSA_key
IOS_CRYPTO:0400481C MOV R2, R7
IOS_CRYPTO:04004820 BL read_otp ; int read_otp(u32 wordindex, void *out_buf, u32 size)
IOS_CRYPTO:04004820 ; Read data from the OTP, this can only be used from the IOS-CRYPTO process.
IOS_CRYPTO:04004820 ; -> 0 on success, -1 when IOUS PID isn't 3.
IOS_CRYPTO:04004820 ;
IOS_CRYPTO:04004820
IOS_CRYPTO:04004824 MOV R0, #0x90 ; 'É' ; 0x10 bytes Unknown. (wrong on wiiubrew.org)
IOS_CRYPTO:04004828 LDR R1, =Unknown_Key_3
IOS_CRYPTO:0400482C MOV R2, R7
IOS_CRYPTO:04004830 BL read_otp ; int read_otp(u32 wordindex, void *out_buf, u32 size)
IOS_CRYPTO:04004830 ; Read data from the OTP, this can only be used from the IOS-CRYPTO process.
IOS_CRYPTO:04004830 ; -> 0 on success, -1 when IOUS PID isn't 3.
IOS_CRYPTO:04004830 ;
IOS_CRYPTO:04004830
IOS_CRYPTO:04004834 MOV R0, #0x54 ; 'T' ; 0x10 bytes Wii U XOR key.
IOS_CRYPTO:04004838 LDR R1, =Wii_U_XOR_key
IOS_CRYPTO:0400483C MOV R2, R7
IOS_CRYPTO:04004840 BL read_otp ; int read_otp(u32 wordindex, void *out_buf, u32 size)
IOS_CRYPTO:04004840 ; Read data from the OTP, this can only be used from the IOS-CRYPTO process.
IOS_CRYPTO:04004840 ; -> 0 on success, -1 when IOUS PID isn't 3.
IOS_CRYPTO:04004840 ;
IOS_CRYPTO:04004840
IOS_CRYPTO:04004844 LDR R0, =dword_4025130
IOS_CRYPTO:04004848 MOV R2, R7
IOS_CRYPTO:0400484C SUB R1, R0, #0x10
IOS_CRYPTO:04004850 BL sub_40151C0
IOS_CRYPTO:04004850
IOS_CRYPTO:04004854 LDR R0, =dword_4025140
IOS_CRYPTO:04004858 MOV R2, #0x20 ; ' '
IOS_CRYPTO:0400485C SUB R1, R0, #0x20
IOS_CRYPTO:04004860 BL sub_40151C0
IOS_CRYPTO:04004860
IOS_CRYPTO:04004864 LDR R1, =Unknown_Key_4
IOS_CRYPTO:04004868 MOV R2, R7
IOS_CRYPTO:0400486C MOV R0, #0x50 ; 'P' ; 0x10 bytes Unknown.
IOS_CRYPTO:04004870 BL read_otp ; int read_otp(u32 wordindex, void *out_buf, u32 size)
IOS_CRYPTO:04004870 ; Read data from the OTP, this can only be used from the IOS-CRYPTO process.
IOS_CRYPTO:04004870 ; -> 0 on success, -1 when IOUS PID isn't 3.
IOS_CRYPTO:04004870 ;
IOS_CRYPTO:04004870
IOS_CRYPTO:04004874 BL sub_4014B58
IOS_CRYPTO:04006514 MOV R0, #0x20 ; ' ' ; 0x04 Security level flag.
IOS_CRYPTO:04006514 ; Retail: 0x90000000; Debug: 0x08000000; Factory: 0x00000000.
IOS_CRYPTO:04006514 ; Flag 0x40000000 causes an error in boot0.
IOS_CRYPTO:04006514 ; Flag 0x00000000 makes boot0 use empty SEEPROM and boot1 keys.
IOS_CRYPTO:04006514 ; Flag 0x08000000 tells boot0 to use rsa_pub0 (debug).
IOS_CRYPTO:04006514 ; Flag 0x90000000 or 0x10000000 tells boot0 to use rsa_pub1 (retail).
IOS_CRYPTO:04006518 BL read_otp ; int read_otp(u32 wordindex, void *out_buf, u32 size)
IOS_CRYPTO:04006518 ; Read data from the OTP, this can only be used from the IOS-CRYPTO process.
IOS_CRYPTO:04006518 ; -> 0 on success, -1 when IOUS PID isn't 3.
IOS_CRYPTO:0400FDE4 MOV R1, R6
IOS_CRYPTO:0400FDE8 MOV R0, #0x87 ; 'ç' ; 0x04 bytes Wii U 0x12-keyhandle seed.
IOS_CRYPTO:0400FDEC MOV R2, #4
IOS_CRYPTO:0400FDF0 BL read_otp ; int read_otp(u32 wordindex, void *out_buf, u32 size)
IOS_CRYPTO:0400FDF0 ; Read data from the OTP, this can only be used from the IOS-CRYPTO process.
IOS_CRYPTO:0400FDF0 ; -> 0 on success, -1 when IOUS PID isn't 3.
IOS_CRYPTO:0400FDF0 ;
IOS_CRYPTO:0400FDF0
IOS_CRYPTO:0400FDF4 MOV R0, #0x88 ; 'ê' ; 0x1E bytes vWii NG private key (wrong on wiiubrew.org)
IOS_CRYPTO:0400FDF8 LDR R1, =vWii_NG_private_key
IOS_CRYPTO:0400FDFC MOV R2, #0x1E
IOS_CRYPTO:0400FE00 BL read_otp ; int read_otp(u32 wordindex, void *out_buf, u32 size)
IOS_CRYPTO:0400FE00 ; Read data from the OTP, this can only be used from the IOS-CRYPTO process.
IOS_CRYPTO:0400FE00 ; -> 0 on success, -1 when IOUS PID isn't 3.
IOS_CRYPTO:0400FE00 ;
IOS_CRYPTO:0400FE00
IOS_CRYPTO:0400FE04 MOV R1, R4
IOS_CRYPTO:0400FE08 MOV R2, #0x40 ; '@'
IOS_CRYPTO:0400FE0C ADD R0, R5, #0xC4
IOS_CRYPTO:0400FE10 BL sub_401525C
IOS_CRYPTO:0400FE10
IOS_CRYPTO:0400FE14 LDR R3, [R6]
IOS_CRYPTO:0400FE18 MOV R1, #0x40 ; '@'
IOS_CRYPTO:0400FE1C LDR R2, =aNg08x ; "NG%08x"
IOS_CRYPTO:0400FE20 ADD R0, R5, #0xC4
IOS_CRYPTO:0400FE24 BL sub_4015C24
IOS_CRYPTO:0400FE24
IOS_CRYPTO:0400FE28 ADD R1, SP, #0x68+var_20
IOS_CRYPTO:0400FE2C MOV R0, #0xA0 ; 'á' ; 0x04 bytes Wii U/vWii Root-CA version (0x00000012)?
IOS_CRYPTO:0400FE30 MOV R2, #4
IOS_CRYPTO:0400FE34 BL read_otp ; int read_otp(u32 wordindex, void *out_buf, u32 size)
IOS_CRYPTO:0400FE34 ; Read data from the OTP, this can only be used from the IOS-CRYPTO process.
IOS_CRYPTO:0400FE34 ; -> 0 on success, -1 when IOUS PID isn't 3.
IOS_CRYPTO:0400FE34 ;
IOS_CRYPTO:0400FE34
IOS_CRYPTO:0400FE38 ADD R1, SP, #0x68+var_1C
IOS_CRYPTO:0400FE3C MOV R0, #0xA1 ; 'í' ; 0x04 bytes Wii U/vWii Root-CA MS (0x00000003)?
IOS_CRYPTO:0400FE40 MOV R2, #4
IOS_CRYPTO:0400FE44 BL read_otp ; int read_otp(u32 wordindex, void *out_buf, u32 size)
IOS_CRYPTO:0400FE44 ; Read data from the OTP, this can only be used from the IOS-CRYPTO process.
IOS_CRYPTO:0400FE44 ; -> 0 on success, -1 when IOUS PID isn't 3.
IOS_CRYPTO:0400FE44 ;