Mii Data Injection / Modification

Here is some info on the Mii data that is found in the wii-mote. There are 2 blocks of Mii Data, but we're not sure if it alternates between the two, or if it uses both. The data is a hash, so it's not as simple as changing the hex bits to change the look of your Mii. There is a way to update the CRC on the data and it's being investigated now. Here is some Mii Data from the WiiBrew Wiki thanks to Marcan and other hackers on IRC EFnet #wiidev:

Block format

Each block begins with a four-byte magic number / ID code 'RNCD'. Six unknown bytes (mostly zeroes) follow. Then follow the individual Mii data blocks. The last two bytes of the block are a CRC-16 CCITT of the previous 750 bytes (polynomial 0x1021, starting value 0x0000). C code to update CRC

Mii format

Strings are apparently stored in Unicode format (UTF-16), big-endian. Each Mii is 0x4a bytes:

1. 2 unknown bytes (sometimes zeroes)
2. 10 wide chars Mii Name (zero padded, non-terminated) (20 bytes)
3. 32 bytes Mii settings and info (not yet figured out)
4. 10 wide chars Mii creator (20 bytes)

You can test these codes using Simple HID Write. It's some sample program for Delphi programmers, but until someone else writes a more specific app for doing this stuff, it works. You can download it from here if you want to check out what your Wiimote's Mii data looks like.

To read Mii Data block 1:
Report ID: 17
Command: 00 0F CA 02 EF

To read Mii Data block 2:
Report ID: 17
Command: 00 12 BA 02 EF

Info for writing the data block is here:
http://www.ch0p.com/wiiki/index.php?title=Wiimote#Reading_and_Writing

Can someone put together a quick app that will read and write data from the wiimote mii data storage to a file on the computer? Big Red Pimp posted this Wii-Mote Test app which is close, but still does not fully support Mii Data.

Next step: figure out how to rewrite the hash to make our own mii with the info here, but this comes much later, for now it would be neat to be able to trade mii data block with other wii hackers as an easy way to bus multiple wii's around to other wii consoles without messing with friend codes and emails.

UPDATE: WDML Has cracked a good chunk of the Mii Data format off the Wii-Mote

Mii Data Structure (work in progress):

typedef unsigned char  u8;
typedef unsigned short u16;
typedef unsigned int   u32;

#define MII_NAME_LENGTH   10
#define MII_CREATOR_NAME_LENGTH  10

#define MII_HEIGHT_MIN   0x00
#define MII_HEIGHT_MAX   0x7F

#define MII_WEIGHT_MIN   0x00
#define MII_WEIGHT_MAX   0x7F

typedef struct
{
// addr: 0x00 & 0x01
u16 invalid:1;
u16 isGirl:1;
u16 month:4;
u16 day:5;
u16 favColor:4; 
// 0 - 11 (changing to 1111, along with setting the preceeding bit                                   
// results in a grey shirt, some values over 11 will crash the Wii
// when trying to change the favorite color).
u16 unknown:1;

// addr: 0x02 through 0x15
u16 name[MII_NAME_LENGTH];

// addr: 0x16
u8 height;

// addr: 0x17
u8 weight;

// addr: 0x18 - 0x1B
u8 miiID1;  // Unique Mii identifier
u8 miiID2;
u8 miiID3;
u8 miiID4;

// addr: 0x1C & 0x1D & 0x1E & 0x1F
u8 systemID0; // Checksum8 of first 3 bytes of mac addr
u8 systemID1; // mac addr 3rd-to-last byte
u8 systemID2; // mac addr 2nd-to-last byte
u8 systemID3; // mac addr last byte

// addr: 0x20
u16 faceshape:3;
u16 skinColor:3;     // 0 - 5
u16 unknown:?;
u16 facialFeature:4; // 0 - 11

// addr: 0x22 & 0x23
u16 unknown:7;       // Hair type falls in here
u16 hairColor:3;
u16 hairPart:1;

// addr: 0x24 & 0x25
u16 unknown:?;       // Eyebrow type falls in here
u16 eyebrowrotation:?;
u16 unknown:?;

// addr: 0x26 & 0x27
u16 eyebrowColor:3;
u16 eyebrowSize:5;  // min 0, max 16 (depends on eyebrow type?)
u16 eyebrowVOffset:?;
u16 eyebrowSpacing:?;

// addr: 0x28 & 0x29
u16 unknown:8;        // Eye type falls in here
u16 eyeRotation:3;
u16 unknown:1;
u16 eyeHeight:4;      // 12 == mid, 0 == highest

// addr: 0x2A & 0x2B
u16 eyeColor:3;
u16 unknown:13;

// addr: 0x2C & 0x2D
u16 noseType:4;   // 0 - 11
u16 noseSize:4;   // 0 - 8
u16 noseHeight:4;  // 0 - 9?
u16 unknown:3;

// addr: 0x2E & 2F
u16 lipType:5;
u16 unknown:11;

// addr: 0x30
u8 unknown:1;
u8 glassesType:3;
u8 glassesColor:3;
u8 unknown:1;

// addr: 0x31 & 32
u16 glassesSize:3;
u16 unknown:1;
u16 glassesHeight:4;
u16 mustacheType:2;
u16 beardType:2;
u16 facialHairColor:3;
u16 unknown:2;

// addr: 0x33
u8 mustacheSize:3; // 0 (max) - ? (min)
u8 unknown:1;
u8 mustacheHeight:4; // 0 (high) - 16 (low)

// addr: 0x34 & 0x35
u16 moleOn:1;
u16 moleSize:3;   // ? - 8
u16 moleHeight:5;  // 0 -
u16 unknown:4;
u16 moleHorizontal:3; // 0 (left) - ? (right)

// addr: 0x36
u16 creatorName[MII_CREATOR_NAME_LENGTH];
} MII_DATA_STRUCT;