IOS emulation

Wii operating system high-level emulation for system software and hardware interfaces

The Wii runs IOS (Input/Output System), a microkernel-based operating system on the ARM coprocessor (Starlet). Dolphin uses high-level emulation (HLE) to replicate IOS functionality.

IOS Architecture

IOS consists of a kernel and system modules:

Location: Source/Core/Core/IOS/

IOS/
├── IOS.cpp          # Main IOS kernel
├── ES/              # ES (ETicket Services) - title management
├── FS/              # FS (FileSystem) - NAND filesystem
├── DI/              # DI (Disc Interface) - DVD access
├── USB/             # USB device emulation
├── Network/         # Network services (KD, WD, NCD)
├── SDIO/            # SD card interface
├── STM/             # State Transition Manager (power)
└── Crypto/          # Encryption/decryption

IOS Kernel

Location: IOS/IOS.cpp

The IOS kernel manages:

• IPC (Inter-Process Communication): PowerPC ↔ ARM communication
• Module Loading: Start/stop IOS modules
• Request Handling: Route IOCTL commands to modules
• Resource Management: File descriptors, memory

IPC Communication

PowerPC communicates with IOS via IPC registers:

// IPC request structure
struct IPCCommandRequest {
  u32 command;     // Open, Close, Read, Write, Seek, Ioctl, Ioctlv
  u32 fd;          // File descriptor
  u32 arg0, arg1, arg2, arg3, arg4;
};

Commands:

• IPC_OPEN: Open device (/dev/es, /dev/fs, etc.)
• IPC_CLOSE: Close file descriptor
• IPC_READ/WRITE: Read/write data
• IPC_IOCTL: Issue control command
• IPC_IOCTLV: Vector IOCTL (multiple buffers)

ES Module (ETicket Services)

Location: IOS/ES/

Manages Wii titles, tickets, and content:

Responsibilities

• Title installation and launching
• Ticket and TMD (Title Metadata) verification
• Content decryption (using title keys)
• DLC and update management
• NAND permissions

Key Functions

// Launch title
IOCTL_ES_LAUNCH(u64 title_id);  

// Get title info
IOCTL_ES_GETTITLEID(u64* title_id);
IOCTL_ES_GETTITLECONTENTS(u64 title_id, ...);

// Ticket operations
IOCTL_ES_GETTICKETVIEWS(u64 title_id, ...);
IOCTL_ES_ADDTICKET(const u8* ticket);

Title IDs

Wii titles are identified by 64-bit IDs:

// System titles (high 32 bits = 0x00000001)
0x0000000100000002  // System Menu
0x0000000100000009  // IOS9  
0x000000010000003A  // IOS58

// Game titles (high 32 bits = game code)
0x00010000524D4345  // Mario Kart Wii

FS Module (FileSystem)

Location: IOS/FS/

Provides NAND filesystem access:

NAND Structure

/
├── sys/           # System files
├── title/         # Installed titles
│   ├── 00000001/  # System titles
│   └── 00010000/  # Game titles
├── shared1/       # Shared save data
├── shared2/       # System data
├── tmp/           # Temporary files
└── meta/          # Metadata

File Operations

// Open file
fd = IOS_Open("/title/00010000/...", mode);

// Read/write
IOS_Read(fd, buffer, size);
IOS_Write(fd, buffer, size);

// Directory operations  
IOS_ReadDirectory("/title/00010000/", ...);
IOS_CreateDir("/tmp/foo");

FS Backend

Location: IOS/FS/HostBackend/

Maps NAND filesystem to host directory:

User/Wii/
└── title/
    └── 00010000/
        └── 524D4345/  # Title files
            ├── content/
            └── data/   # Save data

Dolphin stores the NAND filesystem in User/Wii/ on the host system. This allows easy backup and inspection of save data.

DI Module (Disc Interface)

Location: IOS/DI/

Handles DVD access for Wii games:

Features

• Read disc sectors
• Get disc status and info
• Decrypt partition content
• Handle disc changes

Disc Partitions

Wii discs have multiple partitions:

• Update Partition: System updates
• Game Partition: Main game content (encrypted)
• Channel Partition: Wii Channels

DI handles decryption using per-partition title keys.

USB Module

Location: IOS/USB/

Emulates USB devices:

USB Subsystems

Bluetooth (USB/Bluetooth/)

Wii Remote communication via Bluetooth:

• Scan for Wii Remotes
• Pair and connect remotes
• HID input reporting
• Sync button handling
• Extension detection (Nunchuk, Classic Controller)

Emulated Devices: /dev/usb/oh1/57e/305

USB HID (USB/USB_HID/)

Generic USB HID devices:

• Keyboards
• Mice
• Generic gamepads

Emulated Devices: /dev/usb/hid

Skylanders Portal (USB/Emulated/)

Skylanders portal emulation:

• Figure detection
• RFID reading/writing
• LED control

Emulated Devices: /dev/usb/lp0

Infinity Base (USB/Emulated/)

Disney Infinity base emulation:

• Figure placement detection
• NFC communication

Emulated Devices: Custom USB device

Network Module

Location: IOS/Network/

Network services:

KD (Network/KD/)

NWC24 (Nintendo WiiConnect24) daemon:

• Friend codes
• WiiConnect24 messaging
• Download management

WD (Network/WD/)

Wifi Driver:

• Wifi configuration
• Access point scanning
• Connection management

NCD (Network/NCD/)

Network Configuration Daemon:

• Connection settings
• IP configuration (DHCP/static)

IP Stack (Network/IP/)

TCP/IP implementation:

• Socket API
• TCP/UDP protocols
• DNS resolution

SDIO Module

Location: IOS/SDIO/

SD card interface:

// SD card operations
IOCTL_SDIO_READHCR(...);     // Read SD registers
IOCTL_SDIO_WRITEHCR(...);
IOCTL_SDIO_SENDCMD(...);     # Send SD command

Maps to User/Wii/sd.raw or host SD card folder.

STM Module

Location: IOS/STM/

State Transition Manager:

• Power button handling
• Reset button
• System state transitions
• LED control (slot LED, power LED)

Crypto Services

Location: IOS/Crypto/

Encryption and decryption:

AES Engine

Hardware AES for content decryption:

// Decrypt title content
AES128_CBC_Decrypt(key, iv, encrypted_data, decrypted_data, size);

Keys

• Common Key: Encrypts all Wii content (Dolphin uses dumped key)
• Title Keys: Per-title encryption (derived from tickets)
• SD Key: SD card content encryption

IOS Versions

Multiple IOS versions exist:

IOS	Purpose
IOS9	Early system menu
IOS21	System menu 3.0
IOS36	System menu 3.2
IOS53	System menu 4.0
IOS58	System menu 4.3 (most common)
IOS80	System menu 4.3K (Korea)

Games specify required IOS in TMD.

Dolphin HLE emulates all IOS versions with a unified implementation. The IOS version number mainly affects title permissions and available system calls.

Save Data

Game saves stored in NAND:

/title/00010000/GAMEID/data/
└── wii_save.bin  # Game save file

Dolphin location:

User/Wii/title/00010000/GAMEID/data/

WiiSave Format

Location: Core/HW/WiiSave.cpp

Save files are encrypted:

• AES-CBC encryption with SD key
• SHA-1 HMAC for integrity
• Banner image (96x32 RGB5A3)

See Also

• Core Emulation
• Disc I/O
• Wii Configuration