Wii Hacks


Sunday, December 10, 2006

Mii Data Injection / Modification

Here is some info on the Mii data that is found in the wii-mote. There are 2 blocks of Mii Data, but we're not sure if it alternates between the two, or if it uses both. The data is a hash, so it's not as simple as changing the hex bits to change the look of your Mii. There is a way to update the CRC on the data and it's being investigated now. Here is some Mii Data from the WiiBrew Wiki thanks to Marcan and other hackers on IRC EFnet #wiidev:

Block format

Each block begins with a four-byte magic number / ID code 'RNCD'. Six unknown bytes (mostly zeroes) follow. Then follow the individual Mii data blocks. The last two bytes of the block are a CRC-16 CCITT of the previous 750 bytes (polynomial 0x1021, starting value 0x0000). C code to update CRC

Mii format

Strings are apparently stored in Unicode format (UTF-16), big-endian. Each Mii is 0x4a bytes:

  1. 2 unknown bytes (sometimes zeroes)
  2. 10 wide chars Mii Name (zero padded, non-terminated) (20 bytes)
  3. 32 bytes Mii settings and info (not yet figured out)
  4. 10 wide chars Mii creator (20 bytes)

You can test these codes using Simple HID Write. It's some sample program for Delphi programmers, but until someone else writes a more specific app for doing this stuff, it works. You can download it from here if you want to check out what your Wiimote's Mii data looks like.

To read Mii Data block 1:
Report ID: 17
Command: 00 0F CA 02 EF

To read Mii Data block 2:
Report ID: 17
Command: 00 12 BA 02 EF

Info for writing the data block is here:

Can someone put together a quick app that will read and write data from the wiimote mii data storage to a file on the computer? Big Red Pimp posted this Wii-Mote Test app which is close, but still does not fully support Mii Data.

Next step: figure out how to rewrite the hash to make our own mii with the info here, but this comes much later, for now it would be neat to be able to trade mii data block with other wii hackers as an easy way to bus multiple wii's around to other wii consoles without messing with friend codes and emails.

UPDATE: WDML Has cracked a good chunk of the Mii Data format off the Wii-Mote

Mii Data Structure (work in progress):

typedef unsigned char u8;
typedef unsigned short u16;
typedef unsigned int u32;

#define MII_NAME_LENGTH 10

#define MII_HEIGHT_MIN 0x00
#define MII_HEIGHT_MAX 0x7F

#define MII_WEIGHT_MIN 0x00
#define MII_WEIGHT_MAX 0x7F

typedef struct
// addr: 0x00 & 0x01
u16 invalid:1;
u16 isGirl:1;
u16 month:4;
u16 day:5;
u16 favColor:4;
// 0 - 11 (changing to 1111, along with setting the preceeding bit
// results in a grey shirt, some values over 11 will crash the Wii
// when trying to change the favorite color).
u16 unknown:1;

// addr: 0x02 through 0x15
u16 name[MII_NAME_LENGTH];

// addr: 0x16
u8 height;

// addr: 0x17
u8 weight;

// addr: 0x18 - 0x1B
u8 miiID1; // Unique Mii identifier
u8 miiID2;
u8 miiID3;
u8 miiID4;

// addr: 0x1C & 0x1D & 0x1E & 0x1F
u8 systemID0; // Checksum8 of first 3 bytes of mac addr
u8 systemID1; // mac addr 3rd-to-last byte
u8 systemID2; // mac addr 2nd-to-last byte
u8 systemID3; // mac addr last byte

// addr: 0x20
u16 faceshape:3;
u16 skinColor:3; // 0 - 5
u16 unknown:?;
u16 facialFeature:4; // 0 - 11

// addr: 0x22 & 0x23
u16 unknown:7; // Hair type falls in here
u16 hairColor:3;
u16 hairPart:1;

// addr: 0x24 & 0x25
u16 unknown:?; // Eyebrow type falls in here
u16 eyebrowrotation:?;
u16 unknown:?;

// addr: 0x26 & 0x27
u16 eyebrowColor:3;
u16 eyebrowSize:5; // min 0, max 16 (depends on eyebrow type?)
u16 eyebrowVOffset:?;
u16 eyebrowSpacing:?;

// addr: 0x28 & 0x29
u16 unknown:8; // Eye type falls in here
u16 eyeRotation:3;
u16 unknown:1;
u16 eyeHeight:4; // 12 == mid, 0 == highest

// addr: 0x2A & 0x2B
u16 eyeColor:3;
u16 unknown:13;

// addr: 0x2C & 0x2D
u16 noseType:4; // 0 - 11
u16 noseSize:4; // 0 - 8
u16 noseHeight:4; // 0 - 9?
u16 unknown:3;

// addr: 0x2E & 2F
u16 lipType:5;
u16 unknown:11;

// addr: 0x30
u8 unknown:1;
u8 glassesType:3;
u8 glassesColor:3;
u8 unknown:1;

// addr: 0x31 & 32
u16 glassesSize:3;
u16 unknown:1;
u16 glassesHeight:4;
u16 mustacheType:2;
u16 beardType:2;
u16 facialHairColor:3;
u16 unknown:2;

// addr: 0x33
u8 mustacheSize:3; // 0 (max) - ? (min)
u8 unknown:1;
u8 mustacheHeight:4; // 0 (high) - 16 (low)

// addr: 0x34 & 0x35
u16 moleOn:1;
u16 moleSize:3; // ? - 8
u16 moleHeight:5; // 0 -
u16 unknown:4;
u16 moleHorizontal:3; // 0 (left) - ? (right)

// addr: 0x36



Bob Somers said...

Do we necessarily need to go through all the CRC checks, etc. to just simply store non-Mii data on the remote?

Nesboy said...

Is it possible to do this.....
Please read this Question

ajBailey said...

any chance of getting an alternate mirror of the files at http://liquidice629.googlepages.com/hidwrite.zip

Dan said...

@NesBoy: No way. The Mii interface on the Wii will only display what it knows how to display. You'd have to hack the Mii application on the Wii firmware itself to add completely new features.

The Wii maps the values for each feature to a specific graphic/model which is stored in the firmware.

leo said...

Hi, thanks for this.
Would you put a link to the Wiikly newsletter on your site? http://www.wiikly.net

We'll be happy to link you back.

Wetflame said...

Does anyone know if there are more hair colours than the one provided? Maybe there's some override?

I can't believe there is no option for red heads! The colour that looks red turns blonde.

This is incredibly racist against gingers.

Ari said...

It isn't racism...as the ginger hair color isn't a race...but...it still is descrimination

MadCatMk2 said...

Hello everyone!
I was wondering if someone knew a program or a way I could use my mobile phone (A sony ericcsson V630i) as a Bluetooth adapter for my pc.
Please help me!! I'd love to hear any piece of information you've got!

Click Here to Post a Comment

Subscribe to the Nintendo Wii Hacks Blog RSS Feed

Also see:
PSP Hacks
PS3 Hacks
Zune Hacks
iPhone Hacks
Apple TV Hacks