.Z64 File Format – Boot code and check code

IPL3, the boot code

The 4032 bytes at ROM $0040–$0FFF are a program, the third stage of the console’s boot (IPL1 and IPL2 are in the PIF chip’s ROM). IPL2 copies it into the RSP’s data memory at $A4000040 (physical $04000040) and runs it; the mupen64plus emulator’s PIF boot code does exactly that (pifbootrom.c copies $FC0 bytes from ROM $40 to the RSP memory). IPL3 checks the header’s check code, then copies the program and jumps to it. The explorer disassembles it as the first code region.

It is one of a few known programs, because each is paired with a security chip in the cartridge, the CIC, which talks to the console’s PIF chip over a challenge and a seed byte. The pairing decides two things the file shows: how the check code is computed and, for two chips, the address the program really starts at.

The known variants

A boot code is named by two fingerprints of its 4032 bytes: the standard CRC-32, and the sum of its 1008 big-endian 32-bit words as a 64-bit number. They come from two different sources, so a variant seen in both has been identified twice. The CRC-32 values are from the cargo-n64 source (src/ipl3.rs); the sums are from the mupen64plus source (src/si/cic.c).

Where the list ends. The NTSC and PAL chips of a pair (6102 and 7101, 6103 and 7103, 6105 and 7105, 6106 and 7106) share one boot code (N64brew), so the file cannot tell them apart. The Aleck 64 chip 5101 is named on the N64brew page, but no fingerprint of its boot code was found; 8401 and 8501 (64DD IPL, development and retail) are named there too, with none either. A boot code in neither list is shown as “not in the list”, and the header’s check code is then tried under every algorithm below.

The check code ($10–$17)

Read the 1 MiB from ROM $1000 as big-endian 32-bit words w. Six 32-bit registers t1 to t6 all start at a seed. For each word:

1. r = w rotated left by (w AND 31)
2. if t6 + w overflows 32 bits, add 1 to t4; then t6 = t6 + w
3. t3 = t3 XOR w
4. t5 = t5 + r
5. if t2 > w then t2 = t2 XOR r, otherwise t2 = t2 XOR t6 XOR w
6. t1 = t1 + (t5 XOR w); for the 6105, t1 = t1 + (x XOR w), where x is the word of the ROM at $0750 + (the word’s offset AND $FF): a table of 64 words inside IPL3

All arithmetic is modulo 2³². The seeds, the registers and the combinations are from the cargo-n64 source’s description of the algorithm (the work of Parasyte’s n64sums, which the N64brew page does not describe). A ROM shorter than 1 MiB past $1000 counts the missing words as zero.

The boot process

1. The PIF boot ROM (IPL1 and IPL2) starts the console, takes the bus timing from the first word of the header and copies IPL3 into RSP data memory at $A4000040.
2. IPL3 verifies the header’s check code, then copies the first 1 MiB from ROM $1000 to RDRAM at the boot address.
3. IPL3 jumps to the boot address. The 6103 chip subtracts $100000 and the 6106 chip $200000 from the header’s value first (N64brew); that the copy goes to the same adjusted address is an inference, since the page states only the jump. The 7102 chip jumps to $80000480.
4. The program reads the rest of the ROM itself, through DMA on the peripheral interface (PI_CART_ADDR and PI_DRAM_ADDR, registers).

How this page was checked

The check code was computed on five real homebrew ROMs (the ones on this site’s Nintendo 64 emulator, all with the 6102 boot code) and equals the header’s values in every one; both fingerprints of their boot code name the 6102. The byte-order handling and the word sum were compared with a C program that contains mupen64plus’s swap_rom function (statement for statement) and its summing loop, run on the same files and on their .v64 and .n64 conversions: the swapped files read as the .z64 in every field. The algorithms of the 6103, 6105 and 6106 chips were not checked on a real ROM (none is on this machine): they were run on built ROMs against a second implementation written from the same description, which shows the two agree and nothing more.

Not described

Known, not yet covered

• Reference: the check code of the 64DD chips (5167, 8303 and the others) and of the Aleck 64 chip 5101; what each IPL3 does instruction by instruction; the CIC’s own challenge protocol.
• Viewer: a boot code that is not in the list is not named; the viewer then reports which of the four algorithms, if any, matches the header.

Links