Hacking Please help me figure out how to install IOS/cIOS on a stubborn Wii

The Real Jdbye · Nov 22, 2017

Normally the install should go smoothly. I've hacked like 6 Wiis and a couple Wii Us and I can't say I've ever come across this issue.
Some WAD managers might not work (specifically older ones that don't include the AHB patches needed for trucha signed content) but the fact that you can't get any of them to work, not even d2x cIOS Installer and IOS236 Installer which should definitely work, is very strange.
If you could just get one trucha bugged IOS/cIOS installed that should enable all WAD managers etc. to work, but that would require that at least one of those installers/WAD managers actually work.
I don't really have any suggestions right now, but I will be watching this thread.

Edit:
@ningling12
You said you have BootMii as boot2. You may be able to use cboot2 to boot into a WAD manager and install a cIOS.
cboot2 is a pretty old method but essentially what it does is allow you to run a cIOS without actually having one installed, and boot into a homebrew. That should give you the needed access to install whatever you want.
I have successfully used cboot2 before to recover a Wii I thought was doomed. I don't remember if I had somehow managed to brick the Wii or I had just lost homebrew access on it, but it did have BootMii as boot2 (but no NAND backup) and I was able to fix whatever I had broke thanks to cboot2.

ningling12 · Nov 22, 2017

GreyWolf said:
It could be. -2011 is the error code for not having ES_DIVERIFY flag, meaning the app doesn't have permission to install a title. I don't understand how the HBC got installed in the first place if there's something wrong with the IOS. The syscheck report looks like a clean 4.3U with BootMii as IOS. It should be working.

block_ios_reload and ahb_access tags have the same functionality now as far as I remember from reading the WiiBrew article about them.

Official IOSes have a valid ticket file on NUS, so you could try reinstalling IOS58. There's no need to bypass the signature check on it.

So I reinstalled IOS58 successfully and rebooted, but the problem persists. I have noticed that Wad managers that say AHBPROT is enabled and use IOS58 WILL start installing IOS/cIOS but eventually hang when installing content 8. This is the same thing that happens when my apparently patched IOS236 is selected instead. In wad managers that don't mention AHBPROT but try to use IOS58, I get -2011 which seems to suggest that IOS58 with AHBPROT does seem to work like the patched IOS236 (both avoid -2011 but get stuck during the install).

What's interesting is that MMM was able to downgrade IOS15, install IOS36 and patch and install it to IOS236 (presumably using IOS58 v6176). It still seems to me that there is something different about the IOS56/57 wads like size, number of files within, or a specific file within that is causing the trouble for this wii's NAND.

--------------------- MERGED ---------------------------

The Real Jdbye said:
Normally the install should go smoothly. I've hacked like 6 Wiis and a couple Wii Us and I can't say I've ever come across this issue.
Some WAD managers might not work (specifically older ones that don't include the AHB patches needed for trucha signed content) but the fact that you can't get any of them to work, not even d2x cIOS Installer and IOS236 Installer which should definitely work, is very strange.
If you could just get one trucha bugged IOS/cIOS installed that should enable all WAD managers etc. to work, but that would require that at least one of those installers/WAD managers actually work.

That's just it. I think that I do have at least one, IOS236. But, it does not allow me to install anything.

GreyWolf · Nov 22, 2017

If it says it's enabled that's a problem. It needs to be disabled. AHB_PROT forces the app to go through the IOS to access the Wii's components. It needs to be disabled to be able to install a title.

ningling12 · Nov 22, 2017

D2x Custom IOS Installer forces me to

GreyWolf said:
If it says it's enabled that's a problem. It needs to be disabled. AHB_PROT forces the app to go through the IOS to access the Wii's components. It needs to be disabled to be able to install a title.

I guess I do not understand what AHBPROT means in these different contexts. In WiiMod v3.2 and WiiModLite there is an option to disableSetAhbprot which is explained in one of the text files:

; DisableSetAHBPROT : The new SetAHBPROT patch has a downside, it causes usb
; drives to not load. So this option allows you to disable the patch to reenable
; usb functionality.
; default =0(disabled), set =1 to disable SetAHBPROT patch and fix usb
DisableSetAHBPROT=0

I think when WiiMod v3.2 reports "AHDPROT enabled" it means the "SetAHBPROT patch" is enabled? Anyway, I tried it enabled and disabled with IOS58 and IOS236. Some combinations produced warnings about potential -2011 errors, but none resulted in completed downloads.

--------------------- MERGED ---------------------------

So I have switched to IOS236 in WiiModLite for Wii & Wiiu v1.7 and it reports "Current IOS: v65535 AHBPROT Disabled".

So I selected the 'Display System Information' option and here is what it shows:

System Information:

Hollywood v0x11 Console ID: 42753500
System menu 513
System menu v4.3U on IOS 80

Current Permissions on IOS 236 v65535:
Fakesign Bug (Trucha bug):[No]
EsIdentify (ES_DiVerify):[Yes] boot2:[No]
/dev/flash (Flash access):[No] USB2 Tree:[No]
NAND Permissions:[Yes] GetSystemMenuVersion:[Yes]
AHBPROT: 0

Is that normal for a patched IOS236 to have EsIdentify and NAND access but no Trucha bug or flash access?

GreyWolf · Nov 22, 2017

I'm not sure what that particular message means. I've only ever used Multi Mod Manager.

AHB_PROT is "Advanced Hardware Bus Protection". Normally it's enabled and restricts applications running on the console from communicating directly with the hardware. If it's turned off then the application has free access to everything. It should be disabled to allow a homebrew app to do whatever it needs to.

The enabled/disabled is a bit confusing, I admit.

Essentially "enabled" means the console is restricted, "disabled" means it is not. You need "disabled" to install titles to the NAND.

Another thought occurs: how many blocks does the system settings say are free? It's possible there could just be something wrong with the NAND chip on that console. A BootMiii test with more than just a few bad blocks could indicate that.

ningling12 · Nov 22, 2017

GreyWolf said:
I'm not sure what that particular message means. I've only ever used Multi Mod Manager.

AHB_PROT is "Advanced Hardware Bus Protection". Normally it's enabled and restricts applications running on the console from communicating directly with the hardware. If it's turned off then the application has free access to everything. It should be disabled to allow a homebrew app to do whatever it needs to.

The enabled/disabled is a bit confusing, I admit.

Essentially "enabled" means the console is restricted, "disabled" means it is not. You need "disabled" to install titles to the NAND.

Another thought occurs: how many blocks does the system settings say are free? It's possible there could just be something wrong with the NAND chip on that console. A BootMiii test with more than just a few bad blocks could indicate that.

Thank you for your help. When I made my earliest attempts to softmod the Wii I recall there being about 1500 blocks free. I later did a system format just in case there was not enough space, and it now says 2155 blocks are free. Last night's NAND dump showed only a few factory bad blocks and a few corrected pages I think.

UPDATE: I tried BootMii's information option and got the following:
SysMenu: 4.3U boot1b boot2v4
NAND FS usage: 34.1%

GreyWolf · Nov 22, 2017

Well, damn. I don't know what to tell you, then.

ningling12 · Nov 22, 2017

I just ran a system check with DOP-Mii v15 (SVN r161M) and it says that both IOS36 and IOS236 have FakeSign, ES_Identify and NAND [ENABLED] but Flash is [DISABLED]. If this is accurate, should it theoretically be possible to install a cIOS? Or, do I need flash to be enabled too?

wicksand420 · Nov 22, 2017

Yeah, I've hacked about 20 wii's in the last 10 years and have never used mmm or anything like that, i use bathaxx or letterbomb to gain entry, make a nand backup with bootmii, then install 236 with ios236 installer, then install the d2xcios's 247, 248, 249, 250, and 251, and that's about it.

GreyWolf · Nov 23, 2017

Flash is the /dev/flash device. It's access the whole (encrypted) NAND chip. It's not needed for installing. What's required for that is the ES_IDENTIFY flag in the title.tmd. The Homebrew channel has that and is able to pass it on to the mod manager when it runs it.

Maybe the HBC channel install fudged up?

ningling12 · Nov 24, 2017

I am thinking about returning this Wii as the drive never worked, and it has other problems like malfunctioning EDTV/HDTV support. It's a dud, though I am tempted to keep it just for the challenge; so I can finally answer the question of whether it is really "unhackable".

Anyway, thank you all for your valuable help!

UPDATE:

I ran into a small problem with another Wii and found a fix (and possibly a solution to the Wii above). This Wii was v3.3 and I wanted to update it to v4.1 and softmod it using ModMii. The problem came during the download stage since the bannerbomb site's certificate fails. So I downloaded copies from an archived version of the site and attempted to softmod it with each of the versions, unsuccessfully.

Next, I tried to update the system to v4.3 using the Wii's system menu. This failed repeatedly with error 32007. I also noticed that even though the system update failed fairly early, the system menu was now reporting v4.3U! So I tried to letterbomb it, but that failed too (prompt to press '1' never appeared). So I decided that my system must now be some bizarre mix of 3.3 and 4.3, immune to both banner and letterbombs.

With that I decided to keep trying to update to v4.3 and found the following settings, culled from various sources online. I temporarily set the wireless security to WPA with TKIP/AES, auto mode to ensure 802.11b compatibility and forced the router to use channel 11. This worked, and I was then able to letterbomb it and setup BootMii as IOS and boot2.

So... I am wondering if the other Wii has an incomplete update as well, albeit one with enough changes to allow letterbombing to have worked. OTOH, it might just be a dud with an aging NAND. Anyway, I am going to see if it can be re-updated to v4.3 or downgraded to v4.1. I'll report back with the result.

Hacking Please help me figure out how to install IOS/cIOS on a stubborn Wii

*is birb*

Active Member

Well-Known Member

Active Member

Well-Known Member

Active Member

Well-Known Member

Active Member

Well-Known Member

Well-Known Member

Active Member

Similar threads

Popular threads in this forum

is birb