Hacking Dump Mii NAND - a BootMii format (nand.bin) NAND dumper for vWii/Wii

[TheChield]

Can you convert a FS dump into a nand.bin ?

Why for ?

 

[flo]

Just in case you need to restore it

 

[TheChield]

Just a paraphrase : Why for ?

 

[flo]

Just a paraphrase : Why for ?

In case you brick from a bad WAD and you need to restore the nand with a hardware flasher ?

 

[TheChield]

In case you brick from a bad WAD and you need to restore the nand with a hardware flasher ?

Ok, so like I said some post ago, but If you're in such a trouble, you had managed to do so by yourself ! And you wouldn't ask for such a question..

 

[JoostinOnline]

In case you brick from a bad WAD and you need to restore the nand with a hardware flasher ?

No, you cannot. However, xyzzy lets you dump the keys, which is what you really need.

 

[TheChield]

No, you cannot. However, xyzzy lets you dump the keys, which is what you really need.

Well, it's the bases, I think that flo has already this in mind...

 

[Bug_Checker_]

This probably will be the day/week this app gets the most use.

 

[pelago]

I would like the option to be able to restore a NAND dump in software, if possible. I realise that this would only be possible to run if the vWii is still in a state such that it can run unsigned code (and so wouldn't help to restore a bricked vWii for example), but it would still be helpful if you wanted to revert a vWii to a near-virgin state before sending off to Nintendo for repair for example. See Is it possible to have a virgin vWii nand dump?

 

[jammybudga777]

why would we not want the option to re-write back to nand? writing to the nand would mean any problems could be resolved by taking a copy of your original vwii nand and then you have a fresh nand again??? or am i missin the point of writing to the nand?

 

[pelago]

Hi Maxternal. I'm trying to run Dump Mii NAND on a virgin vWii. My intention is to dump the NAND before loading Homebrew Channel or any cIOS's. See my posts in the thread:
"Is it possible to have a virgin vWii nand dump?" where you'll see how I'm using Smash Stack, and have converted your boot.dol to a boot.elf so that Smash Stack will load it. I've got to the point where Dump Mii NAND boots but only displays:

Will dump NAND to sd:/nand.bin
Loading IOS 254.

and seems to freeze at that point. I guess the problem is that I have no IOS 254 installed.

Is there a way to run Dump Mii NAND successfully from Smash Stack on a virgin vWii?

 

[JoostinOnline]

Hi Maxternal. I'm trying to run Dump Mii NAND on a virgin vWii. My intention is to dump the NAND before loading Homebrew Channel or any cIOS's. See my posts in the thread:
"Is it possible to have a virgin vWii nand dump?" where you'll see how I'm using Smash Stack, and have converted your boot.dol to a boot.elf so that Smash Stack will load it. I've got to the point where Dump Mii NAND boots but only displays:

Will dump NAND to sd:/nand.bin
Loading IOS 254.

and seems to freeze at that point. I guess the problem is that I have no IOS 254 installed.

Is there a way to run Dump Mii NAND successfully from Smash Stack on a virgin vWii?

Nope, but there isn't an point. You can't restore a vWii NAND.

 

[pelago]

Nope, but there isn't an point. You can't restore a vWii NAND.

Not with the current Dump Mii NAND code, I agree, but Maxternal indicated that it would be possible to code writing to the NAND if he wanted to. Or it could be written back in hardware.

In any case, whatever my reasons are, I would very much like to have a copy of my virgin vWii NAND if it was possible to do so, and I feel like I must be close. If nothing else, it would be a good base for sneek-type EmuNand.

 

[JoostinOnline]

Not with the current Dump Mii NAND code, I agree, but Maxternal indicated that it would be possible to code writing to the NAND if he wanted to. Or it could be written back in hardware.

In any case, whatever my reasons are, I would very much like to have a copy of my virgin vWii NAND if it was possible to do so, and I feel like I must be close. If nothing else, it would be a good base for sneek-type EmuNand.

Well you can't make a NAND dump without installing the HBC or BootMii. Installing IOS254 won't change anything on vSNEEK either.
Compiling a vWii compatible version of SNEEK

 

[rumblpak]

Well you can't make a NAND dump without installing the HBC or BootMii. Installing IOS254 won't change anything on vSNEEK either.
Compiling a vWii compatible version of SNEEK

Theoretically, and as far as I understand it, the reason for needing HBC or BootMii is because they handle disabling AHBPROT which is needed for NAND access. In the version of the small block of code by Crediar, if AHBPROT is disabled by HBC or BootMii (which is set by the flag in meta.xml), it works by editing memory. If the app handled requesting access from ES to get it rather than rely on BootMii, HBC, or IOS254, it should work. If someone with more knowledge of Wii subsystems knows of a reason why this wouldn't work, please tell me because when I get time I may look into doing something along these lines.

 

[Bug_Checker_]

Theoretically, and as far as I understand it, the reason for needing HBC or BootMii is because they handle disabling AHBPROT which is needed for NAND access. In the version of the small block of code by Crediar, if AHBPROT is disabled by HBC or BootMii (which is set by the flag in meta.xml), it works by editing memory. If the app handled requesting access from ES to get it rather than rely on BootMii, HBC, or IOS254, it should work. If someone with more knowledge of Wii subsystems knows of a reason why this wouldn't work, please tell me because when I get time I may look into doing something along these lines.

I was thinking a live memory patch might work and if riivolution does not need to be installed and does not have a bunch of anti-tampering crap, a patch might be possible. But it would need AHBPROT / MEMPROT / usb /sd /nand and probably a couple more. Almost like bootmii but as replacement/patch for riivolution. IF you added wifi, then you could dump without usbgecko like Devolution loader with netcat.

 

[rumblpak]

I was thinking a live memory patch might work and if riivolution does not need to be installed and does not have a bunch of anti-tampering crap, a patch might be possible. But it would need AHBPROT / MEMPROT / usb /sd /nand and probably a couple more. Almost like bootmii but as replacement/patch for riivolution.

To my knowledge, if you have AHBPROT, you get the rest, you just have to request it. And as far as I know, getting AHBPROT is just using syscall 0x54.

 

[Bug_Checker_]

To my knowledge, if you have AHBPROT, you get the rest, you just have to request it. And as far as I know, getting AHBPROT is just using syscall 0x54.

I thought you had to use hardware registers good to know. only thing holding back appears to be requirement of ES.
54 int set_ahbprot(u32 enable) Enable/Disable PPC AHBPROT setting (can only be called from ES) 0 on success, -1 on error

btw, to be clear, when I said AHBPROT I meant the register HW_AHBPROT (0x0d800064)

 

[JoostinOnline]

To my knowledge, if you have AHBPROT, you get the rest, you just have to request it. And as far as I know, getting AHBPROT is just using syscall 0x54.

AHBPROT and MEMPROT: A basic explanation

 

[rumblpak]

Just saying, if its something this simple, a short inline asm would make this a distinct possibility.

[Edit] I'm not quite sure whether nintendont disables AHB or just takes the setting from HBC as it seems to do both. [End Edit]

from the nintendont source: svn/trunk/kernel/

syscall.h:
#define EnableAHBProt(a) syscall_54(a)
void syscall_54( u32 a );

syscall.s:
.global syscall_54
.type syscall_54 STT_FUNC
syscall_54:
.long 0xe6000a90
bx lr

main.c:
EnableAHBProt(-1); //Disable AHBPROT