Tutorial  Updated

5.5.2 Browser with 5.5.1 vulnerability [CFW required]

WARNING: DO NOT FOLLOW THIS GUIDE IF YOU DON'T HAVE HAXCHI OR CBHC INSTALLED!
You will lose all Homebrew entry points, the browser will not be usable anymore.

This guide has been written when there was no 5.5.2 exploit. CFW DOES NOT INCLUDE MOCHA, IF YOU LAUNCH MOCHA FROM THE BROWSER!
If you are on 5.5.2 you can use one of the new Homebrew entry points, such as https://stupiid.ovh, https://u.drg.li or https://sleepii.ovh.

This guide is NOT a 5.5.2 exploit, and will not get you Homebrew on 5.5.2, this is purely for those with CBHC or Haxchi who want the old browser exploit back for any reason.

Follow this guide only if you want both cfw and a relatively stable browserhax. (This is more stable than the 5.5.2 browser hax, but doesn't matter too much because it requires Haxchi or CBHC)

Downgraded browser's with NO CFW (Haxchi or CBHC) = no more Homebrew for you! (until a new update comes out, or a new exploit that doesn't require the browser comes out.)


Important note: BEFORE doing any permanent changes to your console's internal files, you should always make sure you have a backup (Seeprom and OTP is a my best option for this guide) (AppStore). if you don't make a full NAND backup, at least do a OTP/SEEPROM dump, that will save your console if you brick the browser, as you can install Haxchi with your Seeprom and OTP. Backing up your Seeprom and OTP will NOT fix full CBHC or FTPiiU bricks (Console not booting). Not necessarily only before following this guide, it's common advice for EVERY console's hacking projects. Always read and understand all the guide before starting it.


DISCLAIMER: This guide requires file transfers via FTPiiU Everywhere. If you mess up your Wii U, I am not liable for any damage. If you follow this properly and read everything, nothing harmful should happen.

-Beginning-

Hello, this is a guide on how to downgrade your Internet Browser as to use the old browser vulnerability.
This means you will be able to use https://loadiine.ovh on 5.5.2, but first read the requirements, your Wii U might not be supported depending on what Homebrew you use.

-Requirements and warnings-

This requires CBHC, or Haxchi (you should have either Haxchi or CBHC if you're on 5.5.2, and if not you're out of luck) an FTP client, FTPiiU Everywhere, and an encrypted version of the Wii U Internet Browser, which can be gained through JNUSTool.
(WARNING, IF YOU'RE USING JUST HAXCHI, TO ACCESS THE INTERNET BROWSER IT WILL REQUIRE SIGNATURE PATCHES, MEANING YOU HAVE TO LAUNCH HAXCHI, OR MOCHA OR ANY OTHER CFW / SIGNATURE PATCHING PROGRAM EACH TIME YOU WANT TO USE THE BROWSER!)
Also, if you want this as a backup method in case CBHC fails, don't bother, dump your Seeprom and OTP instead. Doing this will make your Internet Browser unusable if CBHC fails.

-Starting-

First off, you want to go to the directory where JNUSTool.jar is and open a Command Prompt window there by putting your mouse cursor in an open area, and holding shift and right clicking. You should see an option that says "Open command window here" and you want to click it. Then paste in this command to get the Internet Browser code folder.
"java -jar JNUSTool.jar 000500301001210A v241"
It should do a long string of things in the terminal and then a window should appear.
First, select the arrow that looks like this, next to code (make sure that you don't select the checkbox next to code)
upload_2017-8-11_1-32-20.png

Scroll down until you find mvplayer.rpl, and click the arrow next to it, and then hit download.
upload_2017-8-11_1-34-4.png
It should go through it's download process, and eventually finish. Once it's finished, find the output folder which should have the name "Internet Browser [HBAE01]" open the folder, and then open the "code" folder.

-Wii U Side-

Now, head over to your Wii U, and open the Homebrew Launcher with CFW on, otherwise known as signature patches. Load FTPiiU Everywhere, and open Filezilla or whatever FTP client you use.

-FTP and the Wii U-

In the box that says "host" type the IP address displayed on your gamepad screen and select "connect" on your FTP client.
If your console region is USA, go to /storage_mlc/sys/title/00050030/1001210a/code
If your console region is EUR, go to /storage_mlc/sys/title/00050030/1001220a/code
If your console region is JPN, go to /storage_mlc/sys/title/00050030/1001200a/code
Then, copy the mvplayer.rpl file from /Internet Browser [HBAE01]/code which you opened earlier to your FTP client that's open in the directory I told you to go to. It should prompt you to overwrite another file called mvplayer.rpl, and when it does, select yes. Once the file transfer is completed, press the home button on your gamepad, and do all the necessary steps to get to the home menu.

-Final steps!-

Once you're at the home menu, power down your console (TURNING OFF YOUR WII U IS REQUIRED, DO NOT SKIP THIS STEP OR THE DOWNGRADE WILL NOT WORK), then power it on, and navigate to the Internet Browser with CFW on. Go to https://loadiine.ovh on your Internet Browser, and if it redirects you to a page saying you're on 5.5.2, go to the URL that it redirects you to, and change the "l=552" to "l=551" and hit ok. Once you've done that, launch the browser exploit as you normally would and you should be good to go.
Now, to change your Internet Browser back to 5.5.2, for whatever reason, do the same steps, but when doing the JNUSTool section, do "java -jar JNUSTool.jar 000500301001210A v258" instead.

-Thanks-

I hope you enjoyed this tutorial! It's my first one on here, so I do understand it's not very helpful for a beginner, but I'll try my best, thanks.
 

Attachments

  • upload_2017-8-10_22-59-21.png
    upload_2017-8-10_22-59-21.png
    7.5 KB · Views: 686
  • upload_2017-8-10_22-59-42.png
    upload_2017-8-10_22-59-42.png
    7.5 KB · Views: 719
  • upload_2017-8-11_1-32-4.png
    upload_2017-8-11_1-32-4.png
    413 bytes · Views: 529
  • upload_2017-8-11_1-32-6.png
    upload_2017-8-11_1-32-6.png
    413 bytes · Views: 566
Last edited by Creatable,

Cyan

GBATemp's lurking knight
Former Staff
Joined
Oct 27, 2002
Messages
23,749
Trophies
4
Age
45
Location
Engine room, learning
XP
15,649
Country
France
So by replacing the rpl file of the player, we can access the 5.5.1 vulnerability in 5.5.2 without running signature patches before entering the browser? Or do we still need to run sigpatches before entering the browser to make it work?
You still need signature patch, as every file in the /code/ folder is checked at launch. if you have a modified file, signature will mismatch and it won't launch.
so, if you already have signpatch enabled, you don't really need the browser exploit again, unless you have specific homebrew which requires the browser exploit and are not in HBL format (elf). For example the "delete downloaded updates", it's only in browser exploit format, right?

Having the browser exploit back while having haxchi or CBHC installed is a little unnecessary, but more entry point choices is always good.


Sandmann, are you sure you didn't have signpatch enabled before running the browser? you don't have CBHC installed?
Did you try yourself, or just report what's in the first post? which I just said on previous page that he should change his wording because users will think CFW is not required while it still is. See, only page 3 and already that situation popup.
 
Last edited by Cyan,
  • Like
Reactions: ShadowOne333

Creatable

Well-Known Member
OP
Member
Joined
Jul 10, 2017
Messages
585
Trophies
0
Location
(insert wacky and amusing place here)
Website
hentaihaven.net
XP
1,623
Country
United States
You still need signature patch, as every file in the /code/ folder is checked at launch. if you have a modified file, signature will mismatch and it won't launch.
so, if you already have signpatch enabled, you don't really need the browser exploit again, unless you have specific homebrew which requires the browser exploit and are not in HBL format (elf). For example the "delete downloaded updates", it's only in browser exploit format, right?

Having the browser exploit back while having haxchi or CBHC installed is a little unnecessary, but more entry point choices is always good.


Sandmann, are you sure you didn't have signpatch enabled before running the browser? you don't have CBHC installed?
Did you try yourself, or just report what's in the first post? which I just said on previous page that he should change his wording because users will think CFW is not required while it still is. See, only page 3 and already that situation popup.
Cyan, would we be able to encrypt it into WUP files to make it read it as legit? I mean, it seems like it would work.
 

ShadowOne333

QVID PRO QVO
Editorial Team
Joined
Jan 17, 2013
Messages
12,184
Trophies
2
XP
33,690
Country
Mexico
Cyan, would we be able to encrypt it into WUP files to make it read it as legit? I mean, it seems like it would work.
Maybe modifying the requires files from the Browser, then making it a WUP and installing it via the Brazilian USB method?
Maybe that could work to avoid sigpatching everytime.
 

Creatable

Well-Known Member
OP
Member
Joined
Jul 10, 2017
Messages
585
Trophies
0
Location
(insert wacky and amusing place here)
Website
hentaihaven.net
XP
1,623
Country
United States
I just want to say this quickly. This is only an 'Internet Browser downgrade' due to how Nintendo handled 5.5.2.
Technically, this is just a downgrade of a module of the browser, nothing else. But if Nintendo considered an 'update' just modifying something as stupid as mvplayer, wouldn't changing it to a lower version be considered a downgrade?
I really don't know. Oh yeah, this method also doesn't work without custom firmware as I gave people the command to get the american version of the Internet Browser. You can easily fix that, but I thought it was something to note.
 

tunip3

[debugger active]
Banned
Joined
Oct 31, 2016
Messages
1,675
Trophies
0
XP
1,661
Country
United Kingdom
Yes mvplayer.rpl change!
Then everything works as with firmware 5.5.1

Browser open and go to www.loadiine.ovh then "l=552" to "l=551

Works WITHOUT sigpatches or CFW
Are you sure u weren't using cfw when testing

--------------------- MERGED ---------------------------

You still need signature patch, as every file in the /code/ folder is checked at launch. if you have a modified file, signature will mismatch and it won't launch.
so, if you already have signpatch enabled, you don't really need the browser exploit again, unless you have specific homebrew which requires the browser exploit and are not in HBL format (elf). For example the "delete downloaded updates", it's only in browser exploit format, right?

Having the browser exploit back while having haxchi or CBHC installed is a little unnecessary, but more entry point choices is always good.


Sandmann, are you sure you didn't have signpatch enabled before running the browser? you don't have CBHC installed?
Did you try yourself, or just report what's in the first post? which I just said on previous page that he should change his wording because users will think CFW is not required while it still is. See, only page 3 and already that situation popup.
Could you not swap every part of the browser to 5.5.1
 

Creatable

Well-Known Member
OP
Member
Joined
Jul 10, 2017
Messages
585
Trophies
0
Location
(insert wacky and amusing place here)
Website
hentaihaven.net
XP
1,623
Country
United States
Are you sure u weren't using cfw when testing

--------------------- MERGED ---------------------------


Could you not swap every part of the browser to 5.5.1
First off, I've tested. This requires cfw.
This method doesn't swap every part of the browser to 5.5.1, this only makes the 5.5.2 browser have the ability to use browserhax, which in turn makes it very similar to the 5.5.1 browser, but the meta info isn't the same as the 5.5.1 browser making it usable on 5.5.2.
 

Cyan

GBATemp's lurking knight
Former Staff
Joined
Oct 27, 2002
Messages
23,749
Trophies
4
Age
45
Location
Engine room, learning
XP
15,649
Country
France
for your question, making a wud doesn't make it legit.
we can create wud package, but we can't sign it, only nintendo has the private key.
that's why you need the signature patch to load any unofficial or modified program.
if a wud was enough, we could install all the homebrew and launch them without the need of cfw.

you could probably repack the extracted 5.5.2 browser + 5.5.1 movie player, to make it installable with WUP instead of using ftpiiu everywhere.
I don't know if it lets you re-install the same title version. You can't downgrade, but I don't know about same version.
Personally, I prefer using FTP than messing with a repacked system title. It's less dangerous to replace a module which is not always loaded than reinstalling a fully repacked system title.
 
Last edited by Cyan,

Creatable

Well-Known Member
OP
Member
Joined
Jul 10, 2017
Messages
585
Trophies
0
Location
(insert wacky and amusing place here)
Website
hentaihaven.net
XP
1,623
Country
United States
for your question, making a wud doesn't make it legit.
we can create wud package, but we can't sign it, only nintendo has the private key.
that's why you need the signature patch to load any unofficial or modified program.
if a wud was enough, we could install all the homebrew and launch them without the need of cfw.

you could probably repack the extracted 5.5.2 browser + 5.5.1 movie player, to make it installable with WUP instead of using ftpiiu everywhere.
I don't know if it lets you re-install the same title version. You can't downgrade, but I don't know about same version.
Personally, I prefer using FTP than messing with a repacked system title. It's less dangerous to replace a module which is not always loaded than reinstalling a fully repacked system title.
Even if I did repackage it, it wouldn't be allowed for posting on here. I thought that such a minor change wouldn't require any CFW. Hm, well thanks!
 

Dork

Member
Newcomer
Joined
Jul 7, 2017
Messages
20
Trophies
0
Age
74
XP
137
Country
United States
This thread is very confusing, even after restoring the vulnerability you still need signature patches to you use browserhax on 5.5.2? Sounds like a lot of work for something so useless.
 

Kleyon

Well-Known Member
Member
Joined
Jul 11, 2017
Messages
287
Trophies
0
Age
42
XP
213
Country
France
It could seems useless, but it's always good to have more entry points, it's like having an emergency exit...
 

Creatable

Well-Known Member
OP
Member
Joined
Jul 10, 2017
Messages
585
Trophies
0
Location
(insert wacky and amusing place here)
Website
hentaihaven.net
XP
1,623
Country
United States
This thread is very confusing, even after restoring the vulnerability you still need signature patches to you use browserhax on 5.5.2? Sounds like a lot of work for something so useless.
Diibugger requires it. BullyWiiPlaza's mod injector requires it. A lot of things require the browser vulnerability. Plus some people like it more.
 

Razor83

Well-Known Member
Member
Joined
Dec 23, 2009
Messages
391
Trophies
1
XP
1,758
Country
Is it not possible to spoof the version number of the 5.5.1 browser, so that the system thinks its the 5.5.2 browser?
I remember you could spoof the version number of IOS titles on the Wii, so am surprised something similar hasn't been done on Wii U.
 

Creatable

Well-Known Member
OP
Member
Joined
Jul 10, 2017
Messages
585
Trophies
0
Location
(insert wacky and amusing place here)
Website
hentaihaven.net
XP
1,623
Country
United States
Is it not possible to spoof the version number of the 5.5.1 browser, so that the system thinks its the 5.5.2 browser?
I remember you could spoof the version number of IOS titles on the Wii, so am surprised something similar hasn't been done on Wii U.
There actually is a guide on that, which focuses updating your system to 5.5.2 while keeping a lower version of the browser, however this tutorial is for those already on 5.5.2.
 

Razor83

Well-Known Member
Member
Joined
Dec 23, 2009
Messages
391
Trophies
1
XP
1,758
Country
There actually is a guide on that, which focuses updating your system to 5.5.2 while keeping a lower version of the browser, however this tutorial is for those already on 5.5.2.
Right, but it just keeps the old 5.5.1 browser and doesn't spoof the version number - so the system still says it requires an update.
If we could spoof the browser version number then the system would think it was fully up to date, plus it shouldn't require any patches/CFW to use the browser afterwards.
 
Last edited by Razor83,

Creatable

Well-Known Member
OP
Member
Joined
Jul 10, 2017
Messages
585
Trophies
0
Location
(insert wacky and amusing place here)
Website
hentaihaven.net
XP
1,623
Country
United States
Right, but it just keeps the old 5.5.1 browser and doesn't spoof the version number - so the system still says it requires an update.
If we could spoof the browser version number then the system would think it was fully up to date, plus it shouldn't require any patches/CFW to use the browser afterwards.
The issue is, this Wii U knows the version number when you downgrade your browser. The entire browser doesn't get downgraded, just one module of it. It detects a modified browser, and therefore you can't use it without signature patches. If we could modify any apps, we'd install loads of junk apps and then replace them with Homebrew type stuff.
 
Last edited by Creatable,

ShadowOne333

QVID PRO QVO
Editorial Team
Joined
Jan 17, 2013
Messages
12,184
Trophies
2
XP
33,690
Country
Mexico
No one said anything in my last post, but isn't there a way to install the 5.5.1 browser (or earlier) by modifying the tik file as if it were a digital game like the Brazilian USB method?

That would make it so that its legit and we dont require sigpatches to launch it.
 

Razor83

Well-Known Member
Member
Joined
Dec 23, 2009
Messages
391
Trophies
1
XP
1,758
Country
The issue is, this Wii U knows the version number when you downgrade your browser. The entire browser doesn't get downgraded, just one module of it. It detects a modified browser, and therefore you can't use it without signature patches. If we could modify any apps, we'd install loads of junk apps and then replace them with Homebrew type stuff.
Ok, so can I ask what part of mvplayer is being checked? and which system file is performing the check? I just dont understand why we cant edit the mvplayer file so it appears to match the 5.5.2 version, whilst still actually being the same version from 5.5.1.
 

Creatable

Well-Known Member
OP
Member
Joined
Jul 10, 2017
Messages
585
Trophies
0
Location
(insert wacky and amusing place here)
Website
hentaihaven.net
XP
1,623
Country
United States
Ok, so can I ask what part of mvplayer is being checked? and which system file is performing the check? I just dont understand why we cant edit the mvplayer file so it appears to match the 5.5.2 version, whilst still actually being the same version from 5.5.1.
The thing is, I really don't know.
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • No one is chatting at the moment.
    rvtr @ rvtr: Spam bots again.