Hacking Contenthax - a Vulnerability in Wii U File System Verification

TheCyberQuake

Certified Geek
Member
Joined
Dec 2, 2014
Messages
5,012
Trophies
1
Age
28
Location
Las Vegas, Nevada
XP
4,432
Country
United States
Here is my (hopefully) better script:
Code:
import sys
import os
import wupclient

"""Get low ID from user, assign to variable 'installid'"""
for retry in range(5):
    os.system('cls' if os.name == 'nt' else 'clear')
    installid = raw_input("VC lower ID (last 8 chars): ")
    os.system('cls' if os.name == 'nt' else 'clear')
    print("You chose '" + installid + "'")
    answer = raw_input("Are you sure?: " )
    if(answer.lower() == "y" or answer.lower() == "yes"):
        break
else:
    sys.exit(1)

"""Get location of game from user, assign to variable 'installLocation'"""
for retry in range(5):
    os.system('cls' if os.name == 'nt' else 'clear')
    installLocation = raw_input("VC Location (NAND, USB): ")
    if(installLocation.lower() == "nand"):
        os.system('cls' if os.name == 'nt' else 'clear')
        print("You selected 'NAND'")
        answer = raw_input("Are you sure?: ")
        if(answer.lower() == "y" or answer.lower() == "yes"):
            location = "mlc01"
            break
    elif(installLocation.lower() == "usb"):
        os.system('cls' if os.name == 'nt' else 'clear')
        print("You selected 'USB'")
        answer = raw_input("Are you sure?: " )
        if(answer.lower() == "y" or answer.lower() == "yes"):
            location = "usb01"
            break
    else:
        os.system('cls' if os.name == 'nt' else 'clear')
        print("'" + installLocation + "' is not a suitable answer")
else:
    sys.exit(1)

"""Connect to wupserver"""
print("Connecting to wupserver")
w = wupclient.wupclient()
if(w.s == None):
    print("Failed to connect to wupserver!")
    sys.exit(1)
print("Connected!")
wupclient.w = w

"""Mount SD in preparation for file transfers"""
print("Mounting SD")
ret = wupclient.mount_sd()
if(ret == 0):
    input("Failed to mount SD! Press enter to quit.")
    sys.exit(1)

"""Transfer rom.zip from sd:/haxchi to Wii U"""
print("Mounted! Installing Haxchi from SD")
ret = w.cp("/vol/storage_sdcard/haxchi/rom.zip", "/vol/storage_" + location + "/usr/title/00050000/" + installid + "/content/0010/rom.zip")
if(ret == 0):
    print("Failed to install Haxchi! Press enter to quit.")
    sys.exit(1)

"""Transfer meta files from sd:/haxchi/meta to Wii U"""
print("Installing Meta files")
ret = w.cpdir("/vol/storage_sdcard/haxchi/meta", "/vol/storage_" + location + "/usr/title/00050000/" + installid + "/meta")
if(ret == 0):
    print("Failed to install Meta files!")
    print("Not crucial, haxchi will still run without these files")

"""Download meta.xml for modification later"""
print("Downloading meta.xml for modification")
ret = w.dl("/vol/storage_" + location + "/usr/title/00050000/" + installid + "/meta/meta.xml")
if(ret == 0):
    input("Download failed! Press enter to quit.")
    sys.exit(1)

"""Get user input for custom longname, assign to variable 'customname'"""
for retry in range(5):
    os.system('cls' if os.name == 'nt' else 'clear')
    customname = raw_input("Custom title name: ")
    os.system('cls' if os.name == 'nt' else 'clear')
    print("You typed '" + customname + "'")
    answer = raw_input("Are you sure?: ")
    if(answer.lower() == "y" or answer.lower == "yes"):
        break
else:
    sys.exit(1)

"""Read each line from meta.xml, and write to meta.xml.tmp"""
"""Modify every longname to match user input 'customname'"""
print("Modifying meta.xml")
linecount = 0
f1 = open('meta.xml', 'r')
f2 = open('meta.xml.tmp', 'w')
for line in f1:
    linecount = linecount + 1
    if(72 <= linecount <= 77 or 79 <= linecount <= 82):
        customline = line[0:42] + customname + line[-15:]
        f2.write(customline)
    elif(linecount == 78 or linecount == 83):
        customline = line[0:43] + customname + line[-16:]
        f2.write(customline)
    else:
        f2.write(line)
f1.close()
f2.close()

"""Uploads the modified meta.xml.tmp to Wii U"""                   
print("Uploading modified meta.xml")
ret = w.up("meta.xml.tmp", "/vol/storage_" + location + "/usr/title/00050000/" + installid + "/meta/meta.xml")                  
if(ret == 0):
    input("Meta.xml upload failed! Press enter to quit.")
    sys.exit(1)

"""Attempts to upload config.txt, and if successful chmod it as well"""
print("Attempting to upload config.txt")
ret = w.cp("/vol/storage_sdcard/haxchi/config.txt", "/vol/storage_" + location + "/usr/title/00050000/" + installid + "/content/config.ini")
if(ret == 0):
    print("Config.txt upload failed, normal for older haxchi versions")
else:
    print("Applying chmod to config.txt")
    ret = w.chmod("/vol/storage_" + location + "/usr/title/00050000/" + installid + "/content/config.txt", 0x644)
    if(ret != 0):
        os.system('cls' if os.name == 'nt' else 'clear')
        input("Install complete! Press enter to quit.")
    else:
        os.system('cls' if os.name == 'nt' else 'clear')
        input("chmod failed! Press enter to quit.")

if(w.fsa_handle != None):
    w.close(w.fsa_handle)
    w.fsa_handle = None
if(w.s != None):
    w.s.close()
    w.s = None
This time I would prefer actual advice and tips on what I can change/improve, instead of the shitfest that occured yesterday. I am new to programming in general so I would appreciate being taught instead of being ridiculed.

Edit: this isn't meant to replace the better python script that already exists, rather this is more for power users who want more customization and want to test with games that aren't already supported.
That and I made mine install files from SD instead of uploading them from PC, saving time for the meta files (except meta.xml, which will be downloaded, edited given user input, then upload back to the Wii U)

Edit2: updated code to include comments that explain what each sections is doing.
 
Last edited by TheCyberQuake,

TheCyberQuake

Certified Geek
Member
Joined
Dec 2, 2014
Messages
5,012
Trophies
1
Age
28
Location
Las Vegas, Nevada
XP
4,432
Country
United States
@FIX94 does your haxchi somehow make fw.img work from any folder?
Last I checked they required a modified patch file (0x50000000.s) in order to properly soft-reset. Though I haven't really checked on everyone's latest fw.img commits so something may have changed.
 

Irastris

Well-Known Member
Member
Joined
May 3, 2015
Messages
1,116
Trophies
0
XP
895
Country
United States
Has anyone dumped their pre-modified haxchi 1.7 HBL or redNAND forwarder channels and used NUS packer to pack them up ready for easier installation for others yet?
What would be the point of that? If you're looking for a solution that's gonna need signature patches to use, might as well just use the RPX version of HBL and have a true application rather than Haxchi which still just injects HBL into Mii Maker.
 

KiiWii

Editorial Team
Editorial Team
Joined
Nov 17, 2008
Messages
16,581
Trophies
3
Website
defaultdnb.github.io
XP
26,913
Country
United Kingdom
What would be the point of that? If you're looking for a solution that's gonna need signature patches to use, might as well just use the RPX version of HBL and have a true application rather than Haxchi which still just injects HBL into Mii Maker.

There's an RPX channel of HBL?

Obviously it needs sig patching, but wouldn't it be easier to instal a WUD rather than a game and a zip and tga's and meta etc etc.
 
  • Like
Reactions: peteruk

TarkinMX

Well-Known Member
Member
Joined
Nov 4, 2009
Messages
197
Trophies
0
XP
325
Country
United States
Is there any way of changing the meta data in the quick start menu as well? I have brain age as my place holder for the hack, I successfully changed the meta data that shows in the OS but when starting my wii u and using the quick start menu it's still showing up at brain age.
 

Irastris

Well-Known Member
Member
Joined
May 3, 2015
Messages
1,116
Trophies
0
XP
895
Country
United States
Any screenshots, video, links to precompiled?

Jump to around 2:50 for the channel actually starting up.
That video was uploaded way before the channel package so things may be a little different now.

Here's the pre-NUSpacked release candidate that @dimok uploaded a few days ago: http://www13.zippyshare.com/v/uK72mpna/file.html
Simply install using WUPinstaller on redNAND or sigpatched sysNAND.
 
Last edited by Irastris,
  • Like
Reactions: KiiWii

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • No one is chatting at the moment.
    I @ idonthave: :)