Hacking Why "adding or removing 2" from byte 0x0F of tiket.tik ? Answer and exact "formula".

cearp

瓜老外
Developer
Joined
May 26, 2008
Messages
8,724
Trophies
2
XP
8,499
Country
Tuvalu
maybe its possible they were planning some system like on the xbox 360 where you could install a game and run it from the HDD and just leave the disk into to verify your ownership......would kinda make sense then i guess
ahh, that would make sense to give you the eshop key...! thanks man
 

gamesquest1

Nabnut
Former Staff
Joined
Sep 23, 2013
Messages
15,153
Trophies
2
XP
12,247
ahh, that would make sense to give you the eshop key...! thanks man
*disclaimer* thats the only logical reason i could think of, there may be something im overlooking, but i cant see any other reason to just give every game a signed ticket to run the eshop version on any system......but then if that really was the case and it was just remnants of a scrapped feature, then why did they continue to make valid tickets for every game, if the feature was scrapped surely they could have just thrown in dummy tickets to fill the gap, or just removed them entirely

ahhh, nintendo logic :wacko:
 
  • Like
Reactions: cearp

Pachee

Well-Known Member
Member
Joined
Nov 3, 2015
Messages
480
Trophies
0
XP
562
Country
United States
do those tickets even install?
They don't seem to be used for installing, i think it is for some required sign checking on cafe2wii/wii mode.
Maybe they just kept the minimum necessary fields to avoid having to use retail signing tools on a production environment?
 
Last edited by Pachee,

paulogiygas91

Member
Newcomer
Joined
Oct 22, 2016
Messages
16
Trophies
0
Age
33
XP
59
Country
Brazil
I remember in the Wii era that tickets do in fact install in the console, when I used AnyTitleDeleter I see A LOT of tickets of various virtual console and wiiware titles that I deleted long ago still there.
 

cearp

瓜老外
Developer
Joined
May 26, 2008
Messages
8,724
Trophies
2
XP
8,499
Country
Tuvalu
I remember in the Wii era that tickets do in fact install in the console, when I used AnyTitleDeleter I see A LOT of tickets of various virtual console and wiiware titles that I deleted long ago still there.
wii disk games had tickets? :blink:i don't think so
if you just mean wiiware and stuff, sure, that's not surprising
 

paulogiygas91

Member
Newcomer
Joined
Oct 22, 2016
Messages
16
Trophies
0
Age
33
XP
59
Country
Brazil
wii disk games had tickets? :blink:i don't think so
if you just mean wiiware and stuff, sure, that's not surprising

I don't know, we can't install Wii games on the original Wii. If we are modding tiks of disc based games for the system to see then as eshop downloads, there must be some tiks storage like the wads did in the Wii era...or the systems are completely different and the tiks only exist for signature check and nothing is stored in the sysNand at all?
 

Cyan

GBATemp's lurking knight
Former Staff
Joined
Oct 27, 2002
Messages
23,749
Trophies
4
Age
45
Location
Engine room, learning
XP
15,648
Country
France
Wii disc games have ticket too.
that's what allowed the user to copy the savegame to the console. without inserting the disc (just inserting, even without launching it) you couldn't copy a savegame for that game.
or maybe I'm mistaking with another file where all played games are stored. but disc have tickets.

This method is basically inserting a "disc game" in the console, but altering these bytes makes the console see the game as a eshop title rather than a disc one?
If the tickets are bad when extracting the wud with current extractors, then it means the tickets are not installed as "eshop" games, but as disc games using the proper (fixed) ticket that the disc contains.
editing the ticket is actually fixing it, not modifying it to make the console accept it as an eshop game.

if you already played that game disc, the ticket is already on your console. but to install the game into the console you still need that ticket to validate the decryption of the encrypted files from nus.
 

gamesquest1

Nabnut
Former Staff
Joined
Sep 23, 2013
Messages
15,153
Trophies
2
XP
12,247
I don't know, we can't install Wii games on the original Wii. If we are modding tiks of disc based games for the system to see then as eshop downloads, there must be some tiks storage like the wads did in the Wii era...or the systems are completely different and the tiks only exist for signature check and nothing is stored in the sysNand at all?
the point is that the disks have the ticket for the full eshop game despite disks not using that decryption key and there being no real reason for them to be there, tbh i always wondered why they were there before this little revelation, its funny that a bug in the disk dumping tool left everyone unaware of this for months.....i wonder if it was intentional :ph34r:.....either way, i guess all those scene releases now ought to be nuked :P *kaboom*.....oh actually was it just a bug in the wud extracting tools....ok nevemind me thats more likely i guess XD

EDIT:- ok yeah it was the extracting that was done wrong....carry on, nothing to see here :P
 
Last edited by gamesquest1,
  • Like
Reactions: cearp and Cyan

cearp

瓜老外
Developer
Joined
May 26, 2008
Messages
8,724
Trophies
2
XP
8,499
Country
Tuvalu
but still, i read something that we mere public scene mortals can't get wud keys, we only have wud keys from the scene releases?
that's true? as i have said before i'm new to wiiu and i want to understand as much of it as i do the 3ds. :D thanks
 

paulogiygas91

Member
Newcomer
Joined
Oct 22, 2016
Messages
16
Trophies
0
Age
33
XP
59
Country
Brazil
Wii disc games have ticket too.
that's what allowed the user to copy the savegame to the console. without inserting the disc (just inserting, even without launching it) you couldn't copy a savegame for that game.
or maybe I'm mistaking with another file where all played games are stored. but disc have tickets, it's used to decrypt the disc!.

If the tickets are bad when extracting the wud with current extractors, then it means the tickets are not installed as "eshop" games, but as disc games using the proper (fixed) ticket that the disc contains.
editing the ticket is actually fixing it, not modifying it to make the console accept it as an eshop game.

if you already played that game disc, the ticket is already on your console. but to install the game into the console you still need that ticket to validate the decryption of the encrypted files from nus.

So I have Mario 3D World on disc, played it months ago, and when I started the game for the first time the tik are installed in the system as a "disc tik". Then, I installed 3D World on the system to have a digital backup (no more disc changes, yay), in this case nothing changed in the system at all because I already have tiks for 3D World inserted because of the disc. In another case, I installed Mario Party 10 too, but never inserted it the disc on it, so for the system it's like I inserted one because of the disk tiks stored for the game.

Thank you for the clarification and sorry for possible bad english (I don't write in this language too often).
 

Cyan

GBATemp's lurking knight
Former Staff
Joined
Oct 27, 2002
Messages
23,749
Trophies
4
Age
45
Location
Engine room, learning
XP
15,648
Country
France
but still, i read something that we mere public scene mortals can't get wud keys, we only have wud keys from the scene releases?
that's true? as i have said before i'm new to wiiu and i want to understand as much of it as i do the 3ds. :D thanks
yes, the WiiU dump need a disc key to decrypt it. they are usually provided with the dump (in the nfo, or in a binary file)
I don't know how this key is retrieved.
 
  • Like
Reactions: cearp

crediar

Possiblenator
Member
Joined
Mar 5, 2006
Messages
342
Trophies
2
XP
2,548
Country
Antarctica
So I looked into it and this what happened and how to do it right.

For all the parts you use the content ID as the IV over the 2nd byte, which all tools do here so you get 0x03.

Apparently for the "system" partition the block count is used on the 16th byte. Block size is 0x10000.

title.cert is always at offset 0 so the IV is all zero.
title.tik is always at offset 0x20000 because title.cert is fixed in size. so the IV is 0x00000000000000000000000000000002
title.tmd is always at offset 0x100000 because title.tik is also fixed in size. IV: 0x00000000000000000000000000000010

A new DiscU version with this fix and a content extractor is currently in testing.
So if you have the WUD lying around you don't have to download it from NUS.
 

asper

Well-Known Member
OP
Member
Joined
May 14, 2010
Messages
942
Trophies
1
XP
2,030
Country
United States
So I looked into it and this what happened and how to do it right.

For all the parts you use the content ID as the IV over the 2nd byte, which all tools do here so you get 0x03.

Apparently for the "system" partition the block count is used on the 16th byte. Block size is 0x10000.

title.cert is always at offset 0 so the IV is all zero.
title.tik is always at offset 0x20000 because title.cert is fixed in size. so the IV is 0x00000000000000000000000000000002
title.tmd is always at offset 0x100000 because title.tik is also fixed in size. IV: 0x00000000000000000000000000000010

A new DiscU version with this fix and a content extractor is currently in testing.
So if you have the WUD lying around you don't have to download it from NUS.

Great catch man! I will update my 1st post.
 

Toscanelli

Well-Known Member
Newcomer
Joined
Feb 4, 2016
Messages
67
Trophies
0
Age
91
XP
174
Country
Afghanistan
Maybe that was added after you logged into/created the NNID.
This seems to happen with pre-installed 3DS games. I recall some of them having console/account IDs in their tickets too.
No, that's not the case. I have a Wii U which came with Mario Kart 8 preinstalled. The console has never been connected with a NNID though the console ID at 0x1D8 isn't nulled.
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
    K3Nv2 @ K3Nv2: My therapy chair is padded