In Depth Information of Mii Client ID / System ID
The Client ID (aka System ID) is a 32-bit unsigned value that every Mii contains. Mii data (within the Mii Channel) is 74 (0x4A bytes) in length. The Client ID resides at offset 0x1C. It's used to prevent you from editing Miis that you didn't create on your own Wii. If you have a Mii on your Mii Channel and it doesn't have a Client ID that matches what your Wii would generate, you will be blocked from editing said Mii. For more info about Mii data, go HERE.
Let's look at an example Client ID.
C2540AFF
The 540AFF portion are the last 3 bytes of the MAC Address of the Wii for which the Mii which is was created on. The C2 byte is a checksum8 calculation of the first 3 bytes of the MAC Address. The first 3 bytes of a MAC Address is sometimes referred to as the "MAC Address Prefix".
The checksum8 algorithm used is not a standard XOR or Modulo-256 algorithm. It's custom. Here's a summary:
1. Data is broken apart into unsigned bytes
2. All the bytes are added up for a grand total.
3. The grand total is logically AND'd with the value of 0x7F
4. HOWEVER, if and only if the first 3 bytes of the data is 0x0017AB, then the logically AND'ing is omitted.
In other words, it is a Modulo-128 algorithm except in the one case where the data starts at 0x0017AB.
Nintendo has a list of MAC Address prefix values that they have reserved. Here's a list of all of them with their checksum8 algorithm result:
03 = 001AE9 Nintendo Co., Ltd.
04 = E84ECE Nintendo Co., Ltd.
05 = 001BEA Nintendo Co., Ltd.
0F = 34AF2C Nintendo Co., Ltd.
15 = 001B7A Nintendo Co., Ltd.
16 = 0019FD Nintendo Co., Ltd.
17 = 0024F3 Nintendo Co., Ltd.
18 = E0E751 Nintendo Co., Ltd.
27 = 8C56C5 Nintendo Co., Ltd.
27 = A45C27 Nintendo Co., Ltd.
30 = 002709 Nintendo Co., Ltd.
36 = 00191D Nintendo Co., Ltd.
37 = 9CE635 Nintendo Co., Ltd.
38 = 58BDA3 Nintendo Co., Ltd.
3A = 78A2A0 Nintendo Co., Ltd.
3A = D86BF7 Nintendo Co., Ltd.
3B = 40F407 Nintendo Co., Ltd.
3D = 182A7B Nintendo Co., Ltd.
41 = 8CCDE8 Nintendo Co., Ltd.
42 = 00241E Nintendo Co., Ltd.
45 = 0025A0 Nintendo Co., Ltd.
45 = A4C0E1 Nintendo Co., Ltd.
47 = 001EA9 Nintendo Co., Ltd.
48 = 0009BF Nintendo Co., Ltd.
4C = 0022AA Nintendo Co., Ltd.
51 = 001F32 Nintendo Co., Ltd.
53 = 001E35 Nintendo Co., Ltd.
54 = 002331 Nintendo Co., Ltd.
54 = B8AE6E Nintendo Co., Ltd.
59 = 001DBC Nintendo Co., Ltd.
5A = 001CBE Nintendo Co., Ltd.
5E = 0021BD Nintendo Co., Ltd.
64 = 001FC5 Nintendo Co., Ltd.
68 = 002147 Nintendo Co., Ltd.
68 = 002444 Nintendo Co., Ltd.
6A = CC9E00 Nintendo Co., Ltd.
6B = E00C7F Nintendo Co., Ltd.
6C = 001656 Nintendo Co., Ltd.
6E = 00224C Nintendo Co., Ltd.
6F = 0023CC Nintendo Co., Ltd.
79 = 0022D7 Nintendo Co., Ltd.
7D = 2C10C1 Nintendo Co., Ltd.
7F = 002659 Nintendo Co., Ltd.
C2 = 0017AB Nintendo Co., Ltd.
Using the list above, we know that Client ID value C2540AFF means the Mii was created on a Wii that has the MAC Address 00-17-AB-54-0A-FF. You will notice some Client ID's can represent two different MAC prefixes. Unfortunately, there's no way to know which one of the two it exactly is. But this does mean its possible for you to edit a Mii that wasn't made on your Wii.
For example, let's say your Wii has MAC Address 00-21-47-CC-BB-AA, and your friend's Wii has 00-24-44-CC-BB-AA. Then it is possible for you to import your friend's Miis into your Mii Channel and be able to edit them.
FAQ:
Hey Vega, I found a Client ID that contains a checksum8 value that is not on the list, what does that mean?
That means 1 of 3 things:
If you post this list somewhere else, please credit me. Thanks.
Technical Breakdown (For those familiar with PPC Assembly):
In the 4.1E (PAL) System Menu, the function that does the checksum8 algo is located at 0x8013F4EC. It accepts 1 argument with r3 being where to write the Client ID to. The func essentially does this..
1. Saves the arg
2. Check if arg is a null ptr, if null ptr, skip to step 9 (false bool)
2. Calls func that loads a ptr (relative to the rtoc), which points to your full MAC Address
2. Sets a ptr (subtraction from rtoc), that points to the value of 0x0017AB
3. Adds up the first 3 bytes of the MAC Address for a total
4. If first 3 bytes DID not match 0x0017AB, proceed to step 6
5. AND the step 3 total with 0x7F
6. Load up the last 3 bytes of the MAC Address
7. Logically OR the checksum8 byte with the last 3 bytes to "build" the client ID
8. Write Client ID to saved r3 (r31) arg
9. Return bool (will return true unless arg was a null ptr)
--
Here's my own handwritten optimized version of the func except I changed a few times~
r3 arg is now ptr to MAC Address
r3 arg returns Client ID as unsigned int
If you use the above code in your project, please credit me. Thanks.
The Client ID (aka System ID) is a 32-bit unsigned value that every Mii contains. Mii data (within the Mii Channel) is 74 (0x4A bytes) in length. The Client ID resides at offset 0x1C. It's used to prevent you from editing Miis that you didn't create on your own Wii. If you have a Mii on your Mii Channel and it doesn't have a Client ID that matches what your Wii would generate, you will be blocked from editing said Mii. For more info about Mii data, go HERE.
Let's look at an example Client ID.
C2540AFF
The 540AFF portion are the last 3 bytes of the MAC Address of the Wii for which the Mii which is was created on. The C2 byte is a checksum8 calculation of the first 3 bytes of the MAC Address. The first 3 bytes of a MAC Address is sometimes referred to as the "MAC Address Prefix".
The checksum8 algorithm used is not a standard XOR or Modulo-256 algorithm. It's custom. Here's a summary:
1. Data is broken apart into unsigned bytes
2. All the bytes are added up for a grand total.
3. The grand total is logically AND'd with the value of 0x7F
4. HOWEVER, if and only if the first 3 bytes of the data is 0x0017AB, then the logically AND'ing is omitted.
In other words, it is a Modulo-128 algorithm except in the one case where the data starts at 0x0017AB.
Nintendo has a list of MAC Address prefix values that they have reserved. Here's a list of all of them with their checksum8 algorithm result:
03 = 001AE9 Nintendo Co., Ltd.
04 = E84ECE Nintendo Co., Ltd.
05 = 001BEA Nintendo Co., Ltd.
0F = 34AF2C Nintendo Co., Ltd.
15 = 001B7A Nintendo Co., Ltd.
16 = 0019FD Nintendo Co., Ltd.
17 = 0024F3 Nintendo Co., Ltd.
18 = E0E751 Nintendo Co., Ltd.
27 = 8C56C5 Nintendo Co., Ltd.
27 = A45C27 Nintendo Co., Ltd.
30 = 002709 Nintendo Co., Ltd.
36 = 00191D Nintendo Co., Ltd.
37 = 9CE635 Nintendo Co., Ltd.
38 = 58BDA3 Nintendo Co., Ltd.
3A = 78A2A0 Nintendo Co., Ltd.
3A = D86BF7 Nintendo Co., Ltd.
3B = 40F407 Nintendo Co., Ltd.
3D = 182A7B Nintendo Co., Ltd.
41 = 8CCDE8 Nintendo Co., Ltd.
42 = 00241E Nintendo Co., Ltd.
45 = 0025A0 Nintendo Co., Ltd.
45 = A4C0E1 Nintendo Co., Ltd.
47 = 001EA9 Nintendo Co., Ltd.
48 = 0009BF Nintendo Co., Ltd.
4C = 0022AA Nintendo Co., Ltd.
51 = 001F32 Nintendo Co., Ltd.
53 = 001E35 Nintendo Co., Ltd.
54 = 002331 Nintendo Co., Ltd.
54 = B8AE6E Nintendo Co., Ltd.
59 = 001DBC Nintendo Co., Ltd.
5A = 001CBE Nintendo Co., Ltd.
5E = 0021BD Nintendo Co., Ltd.
64 = 001FC5 Nintendo Co., Ltd.
68 = 002147 Nintendo Co., Ltd.
68 = 002444 Nintendo Co., Ltd.
6A = CC9E00 Nintendo Co., Ltd.
6B = E00C7F Nintendo Co., Ltd.
6C = 001656 Nintendo Co., Ltd.
6E = 00224C Nintendo Co., Ltd.
6F = 0023CC Nintendo Co., Ltd.
79 = 0022D7 Nintendo Co., Ltd.
7D = 2C10C1 Nintendo Co., Ltd.
7F = 002659 Nintendo Co., Ltd.
C2 = 0017AB Nintendo Co., Ltd.
Using the list above, we know that Client ID value C2540AFF means the Mii was created on a Wii that has the MAC Address 00-17-AB-54-0A-FF. You will notice some Client ID's can represent two different MAC prefixes. Unfortunately, there's no way to know which one of the two it exactly is. But this does mean its possible for you to edit a Mii that wasn't made on your Wii.
For example, let's say your Wii has MAC Address 00-21-47-CC-BB-AA, and your friend's Wii has 00-24-44-CC-BB-AA. Then it is possible for you to import your friend's Miis into your Mii Channel and be able to edit them.
FAQ:
Hey Vega, I found a Client ID that contains a checksum8 value that is not on the list, what does that mean?
That means 1 of 3 things:
- The Mii was made on MyAvatarEditor/Hex Editor with a custom Client ID
- The Mii was edited on MyAvatarEditor/Hex Editor with a new (custom) Client ID
- The Mii was made on Dolphin with the user editing the MAC Address field to a custom MAC Address on his Dolphin.ini config settings
If you post this list somewhere else, please credit me. Thanks.
Technical Breakdown (For those familiar with PPC Assembly):
In the 4.1E (PAL) System Menu, the function that does the checksum8 algo is located at 0x8013F4EC. It accepts 1 argument with r3 being where to write the Client ID to. The func essentially does this..
1. Saves the arg
2. Check if arg is a null ptr, if null ptr, skip to step 9 (false bool)
2. Calls func that loads a ptr (relative to the rtoc), which points to your full MAC Address
2. Sets a ptr (subtraction from rtoc), that points to the value of 0x0017AB
3. Adds up the first 3 bytes of the MAC Address for a total
4. If first 3 bytes DID not match 0x0017AB, proceed to step 6
5. AND the step 3 total with 0x7F
6. Load up the last 3 bytes of the MAC Address
7. Logically OR the checksum8 byte with the last 3 bytes to "build" the client ID
8. Write Client ID to saved r3 (r31) arg
9. Return bool (will return true unless arg was a null ptr)
--
Here's my own handwritten optimized version of the func except I changed a few times~
r3 arg is now ptr to MAC Address
r3 arg returns Client ID as unsigned int
Code:
lis r4, 0x0017 #Set MAGIC first two bytes
lwz r5, 0 (r3) #Load MAC prefix + 1 extra byte
ori r4, r4, 0xAB00 #Finish Magic Mask, left aligned
clrrwi r5, r5, 8 #Clear out junk byte, r5 now is Mac prefix only, left aligned
cmplw r4, r5 #Compare MAGIC mask vs Prefix mask
rlwinm r6, r5, 8, 0xFF #Extract first byte, right justified
rlwinm r7, r5, 16, 0xFF #Extract 2nd
rlwinm r8, r5, 24, 0xFF #Extract 3rd
add r9, r6, r7 #Add 1st + 2nd byte
add r9, r9, r8 #Add subresult with 3rd byte
beq- 0x8 #Take branch based on MAGIC compare
rlwinm r9, r9, 0, 0x7F #MAGIC NOT met, AND with 0x7F
lwz r10, 0x3 (r3) #Load rest of MAC
slwi r9, r9, 24 #Left justify the Checksum8 byte
srwi r10, r10, 8 #Right justify the last 3 bytes of the MAC
or r3, r9, r10 #Create the whole Client ID
blr #ReturnIf you use the above code in your project, please credit me. Thanks.