Interview with a Wii hacker

Atomic: Can you tell us more about the tweezer attack? What does it bridge exactly?
Bushing: With respect to the specific chips and the tweezer attack -- it might help to refer to this photo (the top one) -- you can see there U1, the Hollywood (note how it's the biggest chip - it contains the Starlet core), U2 is the Broadway (main CPU), and U3 is the RAM chip.

It's possible to run Gamecube games on the Wii, and people have long been able to run homebrew code in Gamecube mode -- unfortunately, this turns off most of the "interesting" hardware on the Wii, specifically anything that wasn't present on a Gamecube. However, this *does* allow you to see 25% of that RAM chip (U3) by shorting various address lines underneath U3 (on the opposite side of the board), we're able to fool the Hollywood into shifting that 16MB window of Gamecube memory around the 64MB space of that RAM chip.

It's notable that the Hollywood is the one that interfaces with the RAM chip, not the Broadway, because it's actually the Starlet doing this; the Starlet limits the amount of memory you can use in Gamecube mode.

The Starlet also happens to use some of that memory for its own purposes -- including storing the encryption keys. So, we tricked the Starlet into giving us part of its secret memory in Gamecube mode.

Atomic: Once you were able to access the higher memory, how did you actually get it out of the Wii?
Bushing: It involved sending it to tmbinc's computer via a serial port soldered onto the Gamecube controller connector, while he shorted the address lines.

Atomic: That's one of the more amusing hacks I've heard of.
Bushing: Yeah. It speaks well of their security that we had to go to such heroics. There have been other hacks since then, but that was the first crack in the wall that let us start prying it open.

Atomic: In a similar vein, could you tell us briefly about the disassembly process?
Bushing: Well, it's pretty tedious. Someone hands you a big blob of binary data -- first, you have to figure out what it is. Is it encrypted, or compressed? Is it a program, a picture, a savegame, a database?

From there -- okay, this is a program -- but what format? What processor?

Some of these you can answer ahead of time because you know what to expect. We knew that the Wii used a PowerPC chip, and its file formats are very much like that of the Gamecube, so that made things somewhat easier.

From there, you take a program and you load it up into your favourite disassembly program, and then you work on it for a few days, and then you can get a general idea of what the code does.

Atomic: I know your public key research is still secret, but what other interesting things did you find?
Bushing: Probably the most exciting thing was that we discovered a secret second microprocessor buried inside the graphics chip.