Hacking Wii U audio dumping research thread

[ShonenJump]

Well, I can tell you that I've found FSAR formats and FSEQ formats in a ram dump I was given anonymously. I presume they're the proprietary formats Nintendo use, so I'm going to document on their header formats and start working on either a branch of my 3DS application, or combine them all into one program and have separate tabs for the Wii U formats. I might just branch it off though.

Edit: Also found the FWAV format as well. Once I can find the filesize bytes, I'll begin working on the ripping of the files. I also found (What I think is) a WAV file stored in memory, but I'm not sure yet.

Edit 2: Yeah, it's a .wav file, however, the file is, for some odd reason, 0 bytes in size. Only the WAV header exists.

Edit 3: Does anyone have any clue with what the F stands for? I know that on the 3DS, everything had C (CWAV, CSEQ) and it meant CTR, and the Wii had R (RSTM) and it meant RVL, but I'm not sure what the F means at all.

Edit 4: File sizes are stored in Big Endian, I should be able to begin coding in the scanner to reflect this and get Wii U RAM file ripping working soon.

Flac?

 

[loco365]

Flac?

No, it wouldn't be. Nintendo's proprietary formats aren't FLAC for sure.

Anyways, I've created a branch of my application to dump from Wii U RAM dumps, I have support for FSEQ, FWAV, and FSAR, although I'm not 100% sure on FSAR because it seems to be dumping either too much or too little. I'm not entirely sure on it, but the other two should be correct. I'll post a binary later.

 

[iNFiNiTY]

It's wav with microsoft changed out for 'nintendo' for 'their wav' format. Flac is open source isn't it, would make sense to actually use it on blu-ray storage these days. But it's nintendo.

Ok wait i just actually went and looked and it sounds the same audio formats as 3DS for samples at least, maybe not music. You'll understand better than me: http://3dbrew.org/wiki/BCWAV the raw wavs itself sounds the same in both. It's pretty well documented there, i wouldn't spend your time on that part, and the music may well be the same too just CSTRM also documented on there. What about the actual executables of the games, are they able to be pulled out?

If thats another memory section it might need some other trick using the game files to be able to get privilege as if you were running as a game. (the king kong shader exploit on 360 comes to mind?)

Is there any timeframe on a public release of the ram dumper, that would be nice. Even just raw dump of all available areas.

 

[naxil]

Idk if that pic can help U
http://i.imgur.com/vVdDK.png

http://i2.wp.com/wiiuhax.com/wp-content/uploads/2013/01/8359089113_e763e3db65_c.jpg

i think f0f bad use it in the famous 30 firts day. the point on the mainboard is clear and replicable

 

[iNFiNiTY]

Here's a partial bit of info straight out of the SDK, more detail if you grab it and have a read:

Then DSPADPCM tool compresses audio files into DSP-ADPCM format. The DSP tool in Cafe supports decompression of this format, so the DSP can take the decompression processing load off the CPU.

Judging from the explanation this complicates things for simply finding all the files easily. you need to be looking for .pcm8 .dsp and .pcm16 and sometimes they are solely left or right channels.

 

[loco365]

Here's a partial bit of info straight out of the SDK, more detail if you grab it and have a read:

Then DSPADPCM tool compresses audio files into DSP-ADPCM format. The DSP tool in Cafe supports decompression of this format, so the DSP can take the decompression processing load off the CPU.

Judging from the explanation this complicates things for simply finding all the files easily. you need to be looking for .pcm8 .dsp and .pcm16 and sometimes they are solely left or right channels.

I think those are joined together to make the streaming formats the system uses, but I'm not entirely sure.

 

[iNFiNiTY]

Its one method the whole sound section is quite extensive though, have a look if you can what the game calls for it's libraries. Even a MIDI engine is included, although not inthe production wiiu's... must be for people who make the music .. on the wii-u itself? i dont know. someone make an exploit using a MIDI KEYBOARD maybe it'll get confused like ps3 and its usb shit and give you kernel access! i'll put that in the hacking suggestions thread asap

 

[loco365]

Anyways, perhaps I'll do this right now, but for anyone that can dump their memory and analyse it, here's 0.1 of the Wii U Ripping utility. Perhaps it may be of use to you now and in the future (Chadderz and Marionumber1 may find this of use) :

https://dl.dropboxusercontent.com/u/34957059/Wii U Audio Ripper.exe

As you may be able to tell, it's basically a clone of the 3DS version, but has Wii U formats instead.

 

[Relys]

Anyways, perhaps I'll do this right now, but for anyone that can dump their memory and analyse it, here's 0.1 of the Wii U Ripping utility. Perhaps it may be of use to you now and in the future (Chadderz and Marionumber1 may find this of use) :

https://dl.dropboxusercontent.com/u/34957059/Wii U Audio Ripper.exe

As you may be able to tell, it's basically a clone of the 3DS version, but has Wii U formats instead.

That's really cool. Thanks. Put this in OP.

 

[soneek]

BFWAV support will be in vgmstream shortly.

 

[loco365]

Thanks to soneek I have successfully converted some audio to standard WAV files. So far, this would probably be the most recognisable Wii U sound:

https://dl.dropboxusercontent.com/u/34957059/Wii U OS Warning Sound.wav

 

[Celice]

Here's hoping we get some stuff for TCRF soon

 

[Kargaroc]

Once we get the common key and the ability to decrypt games the value of this program will decrease quite a bit.

 

[WulfyStylez]

Once we get the common key and the ability to decrypt games the value of this program will decrease quite a bit.

Even if you have the files on their own without dumping RAM, it still helps to have an app to parse and actually make something of them.

 

[loco365]

Once we get the common key and the ability to decrypt games the value of this program will decrease quite a bit.

That may be true, but you'd also have to be able to parse the filesystem somehow, so unless the file fs can be dumped as is, then it'd still be useful.

 

[WulfyStylez]

That may be true, but you'd also have to be able to parse the filesystem somehow, so unless the file fs can be dumped as is, then it'd still be useful.

Oh derp, my bad. I thought your tool handled converting stuff to normal audio formats too. Something to add, I guess!

 

[loco365]

Oh derp, my bad. I thought your tool handled converting stuff to normal audio formats too. Something to add, I guess!

There's an application you can get alongside the VGMstream plugin that does that for you.

 

[chrrox]

Thanks to soneek I have successfully converted some audio to standard WAV files. So far, this would probably be the most recognisable Wii U sound:

https://dl.dropboxusercontent.com/u/34957059/Wii U OS Warning Sound.wav

Is there a tool like the 3ds that lets you dump ram from your games?
I want to convert the 3d models.

 

[loco365]

Is there a tool like the 3ds that lets you dump ram from your games?
I want to convert the 3d models.

I don't have one myself (Although I wish I did, because I'd be working left, right, and center doing music rips and working on formats...), but the fact that I have a RAM dump shows that there is, whether it be a hardware solution or a software ROP chain.

 

[loco365]

So, I've set up the RPC client and whatnot, and am working on software RAM dumping within the shared area between devices (0xE0000000 to 0xE4000000), although at least it's a start, but I'm not having the success that I was hoping for. It only dumps around 0x7AA bytes (1962 bytes, or 0.00187110900878906 MB) of data out of the almost 16MB that the dumps actually create. I'm not sure what's going on there, but I hope to rectify it soon.

(All of that was mentioned in this post)