Skip to main content
The Wii runs IOS (Input/Output System), a microkernel-based operating system on the ARM coprocessor (Starlet). Dolphin uses high-level emulation (HLE) to replicate IOS functionality.

IOS Architecture

IOS consists of a kernel and system modules: Location: Source/Core/Core/IOS/
IOS/
├── IOS.cpp          # Main IOS kernel
├── ES/              # ES (ETicket Services) - title management
├── FS/              # FS (FileSystem) - NAND filesystem
├── DI/              # DI (Disc Interface) - DVD access
├── USB/             # USB device emulation
├── Network/         # Network services (KD, WD, NCD)
├── SDIO/            # SD card interface
├── STM/             # State Transition Manager (power)
└── Crypto/          # Encryption/decryption

IOS Kernel

Location: IOS/IOS.cpp The IOS kernel manages:
  • IPC (Inter-Process Communication): PowerPC ↔ ARM communication
  • Module Loading: Start/stop IOS modules
  • Request Handling: Route IOCTL commands to modules
  • Resource Management: File descriptors, memory

IPC Communication

PowerPC communicates with IOS via IPC registers:
// IPC request structure
struct IPCCommandRequest {
  u32 command;     // Open, Close, Read, Write, Seek, Ioctl, Ioctlv
  u32 fd;          // File descriptor
  u32 arg0, arg1, arg2, arg3, arg4;
};
Commands:
  • IPC_OPEN: Open device (/dev/es, /dev/fs, etc.)
  • IPC_CLOSE: Close file descriptor
  • IPC_READ/WRITE: Read/write data
  • IPC_IOCTL: Issue control command
  • IPC_IOCTLV: Vector IOCTL (multiple buffers)

ES Module (ETicket Services)

Location: IOS/ES/ Manages Wii titles, tickets, and content:

Responsibilities

  • Title installation and launching
  • Ticket and TMD (Title Metadata) verification
  • Content decryption (using title keys)
  • DLC and update management
  • NAND permissions

Key Functions

// Launch title
IOCTL_ES_LAUNCH(u64 title_id);  

// Get title info
IOCTL_ES_GETTITLEID(u64* title_id);
IOCTL_ES_GETTITLECONTENTS(u64 title_id, ...);

// Ticket operations
IOCTL_ES_GETTICKETVIEWS(u64 title_id, ...);
IOCTL_ES_ADDTICKET(const u8* ticket);

Title IDs

Wii titles are identified by 64-bit IDs:
// System titles (high 32 bits = 0x00000001)
0x0000000100000002  // System Menu
0x0000000100000009  // IOS9  
0x000000010000003A  // IOS58

// Game titles (high 32 bits = game code)
0x00010000524D4345  // Mario Kart Wii

FS Module (FileSystem)

Location: IOS/FS/ Provides NAND filesystem access:

NAND Structure

/
├── sys/           # System files
├── title/         # Installed titles
│   ├── 00000001/  # System titles
│   └── 00010000/  # Game titles
├── shared1/       # Shared save data
├── shared2/       # System data
├── tmp/           # Temporary files
└── meta/          # Metadata

File Operations

// Open file
fd = IOS_Open("/title/00010000/...", mode);

// Read/write
IOS_Read(fd, buffer, size);
IOS_Write(fd, buffer, size);

// Directory operations  
IOS_ReadDirectory("/title/00010000/", ...);
IOS_CreateDir("/tmp/foo");

FS Backend

Location: IOS/FS/HostBackend/ Maps NAND filesystem to host directory:
User/Wii/
└── title/
    └── 00010000/
        └── 524D4345/  # Title files
            ├── content/
            └── data/   # Save data
Dolphin stores the NAND filesystem in User/Wii/ on the host system. This allows easy backup and inspection of save data.

DI Module (Disc Interface)

Location: IOS/DI/ Handles DVD access for Wii games:

Features

  • Read disc sectors
  • Get disc status and info
  • Decrypt partition content
  • Handle disc changes

Disc Partitions

Wii discs have multiple partitions:
  • Update Partition: System updates
  • Game Partition: Main game content (encrypted)
  • Channel Partition: Wii Channels
DI handles decryption using per-partition title keys.

USB Module

Location: IOS/USB/ Emulates USB devices:

USB Subsystems

Wii Remote communication via Bluetooth:
  • Scan for Wii Remotes
  • Pair and connect remotes
  • HID input reporting
  • Sync button handling
  • Extension detection (Nunchuk, Classic Controller)
Emulated Devices: /dev/usb/oh1/57e/305
Generic USB HID devices:
  • Keyboards
  • Mice
  • Generic gamepads
Emulated Devices: /dev/usb/hid
Skylanders portal emulation:
  • Figure detection
  • RFID reading/writing
  • LED control
Emulated Devices: /dev/usb/lp0
Disney Infinity base emulation:
  • Figure placement detection
  • NFC communication
Emulated Devices: Custom USB device

Network Module

Location: IOS/Network/ Network services:

KD (Network/KD/)

NWC24 (Nintendo WiiConnect24) daemon:
  • Friend codes
  • WiiConnect24 messaging
  • Download management

WD (Network/WD/)

Wifi Driver:
  • Wifi configuration
  • Access point scanning
  • Connection management

NCD (Network/NCD/)

Network Configuration Daemon:
  • Connection settings
  • IP configuration (DHCP/static)

IP Stack (Network/IP/)

TCP/IP implementation:
  • Socket API
  • TCP/UDP protocols
  • DNS resolution

SDIO Module

Location: IOS/SDIO/ SD card interface:
// SD card operations
IOCTL_SDIO_READHCR(...);     // Read SD registers
IOCTL_SDIO_WRITEHCR(...);
IOCTL_SDIO_SENDCMD(...);     # Send SD command
Maps to User/Wii/sd.raw or host SD card folder.

STM Module

Location: IOS/STM/ State Transition Manager:
  • Power button handling
  • Reset button
  • System state transitions
  • LED control (slot LED, power LED)

Crypto Services

Location: IOS/Crypto/ Encryption and decryption:

AES Engine

Hardware AES for content decryption:
// Decrypt title content
AES128_CBC_Decrypt(key, iv, encrypted_data, decrypted_data, size);

Keys

  • Common Key: Encrypts all Wii content (Dolphin uses dumped key)
  • Title Keys: Per-title encryption (derived from tickets)
  • SD Key: SD card content encryption

IOS Versions

Multiple IOS versions exist:
IOSPurpose
IOS9Early system menu
IOS21System menu 3.0
IOS36System menu 3.2
IOS53System menu 4.0
IOS58System menu 4.3 (most common)
IOS80System menu 4.3K (Korea)
Games specify required IOS in TMD.
Dolphin HLE emulates all IOS versions with a unified implementation. The IOS version number mainly affects title permissions and available system calls.

Save Data

Game saves stored in NAND:
/title/00010000/GAMEID/data/
└── wii_save.bin  # Game save file
Dolphin location:
User/Wii/title/00010000/GAMEID/data/

WiiSave Format

Location: Core/HW/WiiSave.cpp Save files are encrypted:
  • AES-CBC encryption with SD key
  • SHA-1 HMAC for integrity
  • Banner image (96x32 RGB5A3)

See Also