Hacking Wii U Hacking & Homebrew Discussion

Etheboss

Official LULWUT supporter
Member
Joined
Feb 24, 2009
Messages
2,445
Trophies
0
Location
Around somewhere
XP
851
Country
Netherlands
But my XenoX is little incomplete cuz
I can't download these file and DLC
KZb86A.jpg
WOW, what a big picture, you could have put that in spoilers like i did above, this is much better for the eyes...and makes reading the thread much better.
 
  • Like
Reactions: MiZ J0K3R

Lory171

Well-Known Member
Newcomer
Joined
Jun 20, 2015
Messages
45
Trophies
0
Age
27
XP
170
Country
Italy
CN8q3SjUsAEGPPK.jpg

Making more progress on eShop update bypasses. 105-4260 was the old error, which just said the network was "busy" (aka nn::nim::NeedsNetworkUpdate returned 1). This is what happens when you remove the call from the app .text. I'm willing to bet this is a return from NNID sign in, so maybe patching NIM directly will yield results.

I already got to that point few days ago just using tcp gecko, but I could not still get to enter the eshop so I lost interest; my advice is to try messing around with the debug feture of tcp gecko, with which you can pause threads. There are some threads dedicated to update checking and maybe with a good timing you can go inside eshop (and maybe also online games). The only downside is that pausing the wrong thread or at a wrong time it will crash your console, so testing this is really a pain.
 

BullyWiiPlaza

Nintendo Hacking <3
Member
Joined
Aug 2, 2014
Messages
1,932
Trophies
0
XP
2,477
Country
Germany
The only downside is that pausing the wrong thread or at a wrong time it will crash your console, so testing this is really a pain.
True, I paused a random thread for fun and it already crashed so that's pretty retarded.
You have to use the unmodified codehandler:
Still not responding :(
Nevermind, it just finished. It just takes a long time :D
 
Last edited by BullyWiiPlaza,
  • Like
Reactions: TotalInsanity4

shinyquagsire23

SALT/Sm4sh Leak Guy
Member
Joined
Nov 18, 2012
Messages
1,977
Trophies
2
Age
26
Location
Las Vegas
XP
3,765
Country
United States
I already got to that point few days ago just using tcp gecko, but I could not still get to enter the eshop so I lost interest; my advice is to try messing around with the debug feture of tcp gecko, with which you can pause threads. There are some threads dedicated to update checking and maybe with a good timing you can go inside eshop (and maybe also online games). The only downside is that pausing the wrong thread or at a wrong time it will crash your console, so testing this is really a pain.
If I can't do it in code my plan is to take a look at the SSL content by using cafiine or similar (maybe alter the .text to read from SD?) to change the pem to allow me to MITM the SSL on the Wii U while in eShop. I've done it on 3DS so I see no reason for it to fail there, especially with it as modular as it is (3DS needed a reassembled module and modified rodata). It could be a check somewhere which consequently fails it. Or, there's a check somewhere for the error, so even if the actual call returns 0 it'll also check for an existing error. How were you altering the NIM module?
 

pedro702

Well-Known Member
Member
Joined
Mar 3, 2014
Messages
12,720
Trophies
2
Age
33
XP
8,698
Country
Portugal
If I can't do it in code my plan is to take a look at the SSL content by using cafiine or similar (maybe alter the .text to read from SD?) to change the pem to allow me to MITM the SSL on the Wii U while in eShop. I've done it on 3DS so I see no reason for it to fail there, especially with it as modular as it is (3DS needed a reassembled module and modified rodata). It could be a check somewhere which consequently fails it. Or, there's a check somewhere for the error, so even if the actual call returns 0 it'll also check for an existing error. How were you altering the NIM module?
the devs said several imes SD acess will be very hard if possible with kernel tough.
 

EpicLPer

Your friendly Austrian IT Guy
Member
Joined
Mar 13, 2015
Messages
1,060
Trophies
0
Age
28
Location
Austria
Website
epiclper.com
XP
1,141
Country
Austria
Man this thread was active for the past few weeks I was gone :wtf:

Uhm... Anyone willing to, in a nutshell, wrap things up here? Did anything "special" or "awesome" happen for 5.3.2 the last... let's say 3 weeks?
 

Lory171

Well-Known Member
Newcomer
Joined
Jun 20, 2015
Messages
45
Trophies
0
Age
27
XP
170
Country
Italy
Man this thread was active for the past few weeks I was gone :wtf:

Uhm... Anyone willing to, in a nutshell, wrap things up here? Did anything "special" or "awesome" happen for 5.3.2 the last... let's say 3 weeks?

Webkitexploit= userspace access
Pong= first homebrew
Kernel exploit=kernel access
Caffeine = Game files replacement like the old Riivolution
Tcp Gecko = Ram edit and cheats
Ability to dump game files
Online cheating and drama+
People complaining and drama++
Rom injection with Caffeine for VC games
NSMBU level editor
Hardware nand dump and restore
Music replacement for SSB4 and Mario Kart8
People working on IOSU exploit, firmware spoofing, backup loading and more stuff

EDIT: I forgot to mention DRAMA
 

VinsCool

Persona Secretiva Felineus
Global Moderator
Joined
Jan 7, 2014
Messages
14,600
Trophies
4
Location
Another World
Website
www.gbatemp.net
XP
25,207
Country
Canada
So I readjusted my patches so that it wouldn't get a chance to throw any errors, now it's not throwing an actual error but the update nags persist.
COAuMAaUsAAlZ4z.jpg
A step closer :)
 

Lory171

Well-Known Member
Newcomer
Joined
Jun 20, 2015
Messages
45
Trophies
0
Age
27
XP
170
Country
Italy
So I readjusted my patches so that it wouldn't get a chance to throw any errors, now it's not throwing an actual error but the update nags persist.
COAuMAaUsAAlZ4z.jpg

Check which threads are running during the startup of eshop with tcpgecko and see if you find one related to update check
 

FIX94

Former Staff
Former Staff
Joined
Dec 3, 2009
Messages
7,284
Trophies
0
Age
29
Location
???
XP
11,238
Country
Germany
ALRIGHT, got kernel exploit on 3.1.0 working, turns out the memory mapping is quite different, for you guys it physically started at 0x31000000 which maps to 0, for me it starts at 0x30000000 which maps to 0x10000000, my 0 is actually located at 0x4C000000 so where you guys write to 0xA0000000 I need to write to 0xBC000000 now, but hey all that aside its working pretty good, coreinit can be written over quite easly now as I just tried out by patching MCP_GetSystemVersion:
IMG_20150904_001727362.png

 

VinsCool

Persona Secretiva Felineus
Global Moderator
Joined
Jan 7, 2014
Messages
14,600
Trophies
4
Location
Another World
Website
www.gbatemp.net
XP
25,207
Country
Canada
ALRIGHT, got kernel exploit on 3.1.0 working, turns out the memory mapping is quite different, for you guys it physically started at 0x31000000 which maps to 0, for me it starts at 0x30000000 which maps to 0x10000000, my 0 is actually located at 0x4C000000 so where you guys write to 0xA0000000 I need to write to 0xBC000000 now, but hey all that aside its working pretty good, coreinit can be written over quite easly now as I just tried out by patching MCP_GetSystemVersion:
IMG_20150904_001727362.png

Is it a real firmware spoof, or is it a simple string edit?

(please, a real spoof!)
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • No one is chatting at the moment.
    SylverReZ @ SylverReZ: @Psionic Roshambo, Thats pretty cool.