Play SSB, MK8 and other games All Unlocked on sysnand without CFW or AOCPtcher

DuoForce · Mar 20, 2017

Can you be a little more in-depth on step 9? Where is the legit ticket I am supposed to swap? I am using SSB4

DuoForce · Mar 20, 2017

raphamotta said:
This guide needs at least one legit DLC from each game you try. It works with FREE DLC too for other games like Mario Kart 8!!

In this tutorial I'll show you how to play Super Smash Bros with all DLCs unlocked without start a CFW or AOCPatcher for this. It should work with others games with multiple DLC like Wii Sports Club, Mario Kart 8, Hyrule Warriors and others. Of course you need a legit DLC from game you want to play.

For Mario kart 8 detail follow this link:
https://gbatemp.net/threads/tutoria...dlc-for-free-without-cfw.464407/#post-7173356

What you need:

At least one DLC bought in eshop. Anyone works. (needs a legit DLC)

Mocha CFW, Haxchi CFW, or any other SigPatcher (just in the beginning)

WiiU App Store (or Tik2SD + FTPiiU_Everywhere + WUP Installer GX2 +
Mocha CFW + Homebrew Launcher
)

WiiU USB Helper

SD Card

PC

Hex Editor (HxD for Windows)

1 - First if you have any illegitimate SSB DLC installed, just delete it using using Data manager on WiiU Config
2 - Buy any DLC on eshop (the cheaper one?)
3 - Make sure your SD card is formatted in FAT32
4 - Download the DLC of SSM of your region with WiiU USB Helper and put it in your SD card in na folder called "install" in the root.
5 - Go to Homebrew Launcher and choose App Store or go to wiiubru.com/go on you browser and choose App Store. If you don't know what's Homebrew Launcher is give a look in this guide (parts I, II and III) and choose start App Store.
6 - In App Store Download Tik2SD + FTPiiU_Everywhere + WUP Installer GX2 + Mocha CFW + Homebrew Launcher
7 - Launch Homebrew Launcher and go to Mocha_CFW (use default options). Then go to WUP Installer GX2 and choose install the DLC of SSB you just download wherever is your game (nand or USB).
8 - Back to Homebrew Launcher, go to Tik2SD and backup your tickets. Put your SD in PC and look at tik2sd folder. Open keys.txt and search where your SSB DLC is installed. The name you need to search is 0005000c10144f00 or 0005000c10145000 or 0005000c10110e00. In my case (US) it says "0002/00000012.tik".
9 - Now it time for hex editing.

Locate your ticket in your SD card according with keys.txt. Open with an hex editor (in my case it's on 0002 folder and the name is 00000012.tik. Backup the ticket.

Look that you gonna have 2x finds in the key.txt file. In my case 0002/00000012.tik@0x6a0 and 0002/00000012.tik@0x0. The number after the "@" shows where the ticket starts inside the tik file. It means probably the fake ticket is in beginning of tik (0x0) file and my legit ticket starts in 0x6a0 (note is in hexadecimal)

The fake ticket is like this, a lot of same numbers:

Pay attention in the blue highlight. It shows the game ID, it means this ticket is from SSM US version. If it says a number other than 0005000c10144f00, 0005000c10145000 or 0005000c10110e00 it means the ticket is from another game!

The trick here is swap the fake ticket with the legit ticket, that way the legit ticket always come first in the tik file! This picture can demonstrate what I mean:

Maybe there's another game ticket inside the tik file, maybe not. Anyway, just copy and past with your hex editor the fake ticket with the legit ticket. Pay attention and don't touch other game tickets in the tik file!

After the swap save your ticket in your PC.

10 - Now put your SD back in WiiU. Open Homebrew Launcher and launch FTPiiU_everywhere (make sure you had launch Mocha CFW or other CFW before that)
11 - Go to your SSBM ticket location inside WiiU memory using a FTP browser like FileZilla or even Windows Explorer with the IP of your WiiU. Its in "system_slc/rights/ticket/apps/xxxx/xxx.tik". Replace that ticket with the one you just modified.
12 - Open your SSB game and enjoy play with all contents without CFW!

TL;DR: Buy a cheap DLC, install all DLC packet with a fake ticket, locate your ticket inside WiiU, swap the legit ticket with the fake ticket inside the tik file so that the legit ticket appears first.

Thank to @nexusmtz, @Wuigi and @Madridi

raphamotta · Mar 20, 2017

DuoForce said:
Can you be a little more in-depth on step 9? Where is the legit ticket I am supposed to swap? I am using SSB4

You can see where your legit ticket starts inside the key.txt file after you dump your tickets with tik2sd. Like I said here:

"Look that you gonna have 2x finds in the key.txt file. In my case 0002/00000012.tik@0x6a0 and 0002/00000012.tik@0x0. The number after the "@" shows where the ticket starts inside the tik file. It means probably the fake ticket is in beginning of tik (0x0) file and my legit ticket starts in 0x6a0 (note is in hexadecimal)"

DuoForce · Mar 20, 2017

raphamotta said:
You can see where your legit ticket starts inside the key.txt file after you dump your tickets with tik2sd. Like I said here:

"Look that you gonna have 2x finds in the key.txt file. In my case 0002/00000012.tik@0x6a0 and 0002/00000012.tik@0x0. The number after the "@" shows where the ticket starts inside the tik file. It means probably the fake ticket is in beginning of tik (0x0) file and my legit ticket starts in 0x6a0 (note is in hexadecimal)"

It's fine, I found a much faster way of doing so

Madridi · Mar 20, 2017

DuoForce said:
It's fine, I found a much faster way of doing so

Except there is no faster way..

DuoForce · Mar 20, 2017

Madridi said:
Except there is no faster way..

Except there actually IS a faster way, use a sig patcher and you're good to go

Madridi · Mar 20, 2017

DuoForce said:
Except there actually IS a faster way, use a sig patcher and you're good to go

Which defies the purpose of the thread, which is to make them run WITHOUT a sigpatcher, cfw, or any kind of homebrew.

It was always possible to run sigpatcher to run fake signed content, whether it's dlc, VC, games, or anything else. In fact, that's why a sig patcher was created lol. So yeah, that's a completely different thing, not a "faster way" for this.

nexusmtz · Mar 20, 2017

Madridi said:
Which defies the purpose of the thread, which is to make them run WITHOUT a sigpatcher, cfw, or any kind of homebrew.

Faster:

Buy your DLC on eShop
Play

No hex editing, no sigpatcher, no CFW, no risk, no money left for rent.
But it's faster.

Next up: Running a game by inserting the disc. No download needed, so it's faster.

SupremeDevice · Apr 15, 2017

Hey, I tried this and I can't get it to work. I bought a mii costume for ssb4 and installed it, and then installed the fake dlc with wup installer gx2. I then switched the tickets and restored the tickets via ftpiiu everywhere, but it still says that the dlc is corrupt. I tried re doing it by deleting and reinstalling my legit dlc, however now the legit ticket won't even show up anymore, and I just see fake tickets.

raphamotta · Apr 15, 2017

SupremeDevice said:
Hey, I tried this and I can't get it to work. I bought a mii costume for ssb4 and installed it, and then installed the fake dlc with wup installer gx2. I then switched the tickets and restored the tickets via ftpiiu everywhere, but it still says that the dlc is corrupt. I tried re doing it by deleting and reinstalling my legit dlc, however now the legit ticket won't even show up anymore, and I just see fake tickets.

Well, it seems you did something wrong, did you backup your original tik file? It should be in your tik2sd folder. If you have a backup just try again, reading all the instructions carefully. If you don't have a backup, I believe you need to delete the tik file and reinstall the DLC using eshop. (and also reinstall whatever game, DLC or update are in the tik file too, if have any other than MK DLC)

SupremeDevice · Apr 15, 2017

I only have the tik file for after I installed the fake dlc (but before I hex-edited it), and retrying with that doesn't work for me (says dlc is corrupted). Currently I am completely reinstalling update+dlc. You only need to replace the fake ticket that is from 0x0 to 0x103, correct?

raphamotta · Apr 15, 2017

SupremeDevice said:
I only have the tik file for after I installed the fake dlc (but before I hex-edited it), and retrying with that doesn't work for me (says dlc is corrupted). Currently I am completely reinstalling update+dlc. You only need to replace the fake ticket that is from 0x0 to 0x103, correct?

I don't know where your fake ticket starts and where your legit ticket starts... it's in your keys.txt file, inside the tik2sd folder. If your ticket start on 0x0, then it ends on 0x34F, because the size is 350 (in hex). Maybe that's your error, you just replaced half of the ticket.

SupremeDevice · Apr 15, 2017

raphamotta said:
I don't know where your fake ticket starts and where your legit ticket starts... it's in your keys.txt file, inside the tik2sd folder. If your ticket start on 0x0, then it ends on 0x34F, because the size is 350 (in hex). Maybe that's your error, you just replaced half of the ticket.

Thought that might work, but no dice. My legit and fake tickets start at the same places as yours (0x0 and 0x6A0), but even after replacing the whole ticket, I'm still getting the "downloaded content is corrupted" error. I think something weird is going on with the console, as when I try to reinstall from the eshop, it tells me that dlc is still on the console and that I installed it from disc, even though I had just deleted it.

Final Edit: I'm definately a dumbass. Finally got it working, thanks for your help!

shadowharold · May 2, 2017

It works just did it with smash all DLC for .75 :rofl2:

SkilledDevil210 · May 2, 2017

Can someone help me I can't seem to get this right:

So I did every step until I got to Set #11. you said, "Go to your SSBM ticket location inside WiiU memory using a FTP browser like FileZilla or even Windows Explorer with the IP of your WiiU. Its in "system_slc/rights/ticket/apps/xxxx/xxx.tik". Replace that ticket with the one you just modified."

First of all where do I find the system_slc because I can't seem to find that and two can you give me some type of video that shows how to do this so that I can check where I did something wrong. I got my Mario Kart 8 Dlc the Mercedes one and did the rest, but can seen to find the system_slc.

HELP ME

shadowharold · May 2, 2017

SkilledDevil210 said:
Can someone help me I can't seem to get this right:

So I did every step until I got to Set #11. you said, "Go to your SSBM ticket location inside WiiU memory using a FTP browser like FileZilla or even Windows Explorer with the IP of your WiiU. Its in "system_slc/rights/ticket/apps/xxxx/xxx.tik". Replace that ticket with the one you just modified."

First of all where do I find the system_slc because I can't seem to find that and two can you give me some type of video that shows how to do this so that I can check where I did something wrong. I got my Mario Kart 8 Dlc the Mercedes one and did the rest, but can seen to find the system_slc.

HELP ME

you have to find on your usb o internal(which ever you use) m_slc( or something took me a while to find it) search the sub directories until you find rights/ticket/apps/XXX( this refers to the folder in which you found your ticket) and just swap your modified one with the one on the wiiu. Hope it helps don't have the wiiu now to show you where to look.

nexusmtz · May 2, 2017

SkilledDevil210 said:
First of all where do I find the system_slc because I can't seem to find that

Details that are missing, that would help someone help you: Which CFW solution did you run before running FTPiiU_Everwhere, which FTPiiU_Everywhere are you running, and what entries do you see at the root of your Wii U when you look at it with your FTP client?

That information is important because the usual reasons that someone can't see a system directory via FTP is that they're running the wrong FTP server, e.g. FTPiiU instead of FTPiiU_Everywhere, they haven't executed an ISOU hack since they booted, or they previously used another FTP server and their client cached the root directory.

raphamotta · May 2, 2017

SkilledDevil210 said:
Can someone help me I can't seem to get this right:

So I did every step until I got to Set #11. you said, "Go to your SSBM ticket location inside WiiU memory using a FTP browser like FileZilla or even Windows Explorer with the IP of your WiiU. Its in "system_slc/rights/ticket/apps/xxxx/xxx.tik". Replace that ticket with the one you just modified."

First of all where do I find the system_slc because I can't seem to find that and two can you give me some type of video that shows how to do this so that I can check where I did something wrong. I got my Mario Kart 8 Dlc the Mercedes one and did the rest, but can seen to find the system_slc.

HELP ME

Sorry the right folder is storage_slc. Already edited the first post. My bad.

SkilledDevil210 · May 2, 2017

raphamotta said:
Sorry the right folder is storage_slc. Already edited the first post. My bad.

Oh ok thank you now I can play dlc with mods! Thank you dude! You made my day

raphamotta · May 3, 2017

So... I believe the free language pack from Zelda BOTW is a DLC. I can't test because I bought the DLC. CN anyone test it for me? If I'm right we can use this method for BOTW too

Attachments

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Card Collector

Well-Known Member

Card Collector

Well-Known Member

Active Member

Well-Known Member

Active Member

Well-Known Member

Active Member

Well-Known Member

New Member

Well-Known Member

Well-Known Member

Well-Known Member

New Member

Well-Known Member

Similar threads

Popular threads in this forum