Wii EEPROM hacking & a wish list from Spark Fun Electronics

Spark Fun Electronics poked at the EPROM on the Wii, fun stuff–

“We just couldn’t not do it. We had to see what was on the Wii EEPROM. There’s surprising amount of 8051 instructions actually. How neat!

We hot-aired off the EEPROM and soldered it down to our SSOP breakout board. We then hooked up the unit to an AVR micro that could handle the I2C communication and clocked out all the I2C data from the M24128 into the AVR and down the serial pipe to the computer and captured it. You will find the binary file here. My bet was that the EEPROM contained all constants like Bluetooth ID, firmware revision, etc. And that all the fun Wii Remote functionality was burned into the Broadcom part. David’s bet was that the Broadcom part was just the Bluetooth HID stack and protocol and that it pinged the EEPROM during boot up for actual Wii Controller firmware. We were both right!

Looking at the binary file, the fun thing to note is the word ‘Nintendo’ a couple thousand bytes into the file. Boy would that be fun to alter. The real kicker was that we found unencrypted 8051 code in the file. We don’t know if it is checksumed or anything, but you should be able to hack away. This seems to indicate that the entire Wii Remote functionality is contained on this M24128 EEPROM. Nifty.” – Link.

Previous:

Wii-mote guts – Link.

And since today and the 20th (Weds) are the last days to order stuff from Spark Fun, I asked Nathan from Spark fun to put together a list of fun electronics to gift for the holidays, here they are – Get’em while you can! (MAKE is not affiliated with Spark Fun in any way, I just like their stuff).

THE phone – Link.