The session key is used to decrypt some response data from the drive, using AES-128-CBC with a null IV. The disc drive uses a two-stage authentication handshake, first a simple CBC-MAC challenge-response authentication so the console can prove it possesses the correct drive key, and then a function to derive a shared session key. IOSU sets byte 4 to 8Ġx20000 bytes response data, encrypted with session key Must sum to 8 or less (subcommand 2 or 0x12 only). Response data is encrypted with session keyĠxF4 - ATAPI_CF_TEST_UNIT_READY_CMD CDB DescriptionĬommand seems to only communicate via error sense codesĠxF5 - ATAPI_CF_INQUIRY_CMD CDB DescriptionĠxF6 - Unknown ATAPI_CF command CDB DescriptionĠxFB - ATAPI_CF_FREC_READ_CMD CDB Description Sends or receives 32 bytes depending on stage (See #Authentication)ĠxF2 - ATAPI_CF_START_STOP_CMD CDB Description All CDBs appear to be 12 bytes long.ĠxDA - ATAPI_DI_READ_DISC_INFORMATION_CMD 0圎0 - ATAPI_DI_REQUEST_ERROR_ID_CMD 0圎D - ATAPI_DI_READ_CBC_CMD 0xF1 - ATAPI_CF_AUTHENTICATE_CMD CDB Description Instead, an entirely custom set of commands is used. In vWii mode, the AHCI controller is placed into a special compatibility mode, which causes it to emulate the Wii's DI and provide accurate backwards-compatibility for Wii software.ĭespite using normal SATAPI formatting for its commands (ATA PACKET, etc.), the Wii U disc drive doesn't appear to implement any of the required SCSI commands except for REQUEST SENSE. The drive identifies as a standard SATAPI disk drive, connected to port 0. The IOSU may communicate with the controller (and, by extension, the drive). The drive is connected to the Wii U via a normal SATA controller, using AHCI 1.2.
2.7 0xF4 - ATAPI_CF_TEST_UNIT_READY_CMD.