Thriller's Bricker
“It’s one of those days”, I whined. Someone named Thriller released a suspicious homebrew app out of nowhere that presumably will brick your Wii, which means it will render the console unusable. It’s ridiculous that someone is trying to brick a console that released 13 years ago. The app is called “Roblox for Wii”, and the description reads “A 1:1 port of the popular game known as Roblox to the Wii.” One thing I almost overlooked is the last line of the description, which reads: “Credit to Mikey for making this happen.” Quotation marks when you have dialogueW-what?!, I stutterstuttered. “Why are they giving me credit for this app, that I didn’t even make?”
Loading the app into the glorious Wii emulator Dolphin gives you a vague and suspicious message. “Roblox doesn’t work on Dolphin. Please try a real Wii. Sorry about that!”. Good thing my Wii is sitting right by my desk and it’s immune to bricks. After making a backup of the NAND memory, I opened the Homebrew Channel and loaded up the strange Roblox app. The screen faded to black, then all hell broke loose.
A message in small, white text on a plain black background read “Doing some magic. I hope you don’t get a seizure!” and the screen very rapidly switches to a solid blue screen, to a red screen, to a green screen. It does this for about 5 seconds, then a loud beeping noise was heard and a bunch of random pixels appear on the screen in different colors. The screen then flashed to white, then black. Finally, the Roblox loading screen appears, with some progress text. However, I can’t read the text because it looks like it’s garbled.
After about 15 seconds, the progress bar makes its way to 100%, and the screen flashed white then black once again. Rick Astley’s music video of “Never Gonna Give You Up” plays, and some red text in front of it read “ENJOY YOUR BRICK”. “Wow, not only does it brick the console as expected, but I get RICKROLLED”, I muttered mutter. After the song ends, the music video is replaced with a brick wall, and the “ENJOY YOUR BRICK” text turns white, making it easier to read.
The power button on the Wii console and the Wii Remote didn’t turn the system off, so I yanked the adapter supplying power to the console and plug it back in. After pressing the power button on the console, the “Health and Safety screen” that no one reads is shown. This is normal when you boot your Wii. Pressing the A Button doesn’t open up the Wii Menu as usual, instead showing another message with white text on a black background. It reads: The system files are corrupted. Please refer to the Wii Operations Manual for help troubleshooting.
I restarted the Wii, and on startup I held the reset button on the console down, which boots into the menu where I can restore the NAND memory from the backup I made earlier. After it let me go to the Wii Menu, everything seems to be working again as expected. As fortunate as I am to be able to fix my Wii so easily, others might not be as fortunate. You know how many kids will think they can play Roblox on their console? Their Wiis will not be able to be fixed if their console is one of the majority that cannot run software to access a recovery mode.
Time to log into Discord, my favorite messaging app. I’m pretty popular there. Some mornings I wake up to a couple dozen messages from a few people, and I think it’s gonna be one of those mornings. After I brew a cup of coffee, I sit at my computer desk and log in. There were 84 new messages from dozens of people. I groaned and start to dig into the messages.
The first few messages say the same thing: “Mikey, my Wii isn’t working. I opened up the Roblox game that just came out as a homebrew app and now my Wii is saying something about the system files being corrupted. Please help me, I’m scared”. As I read more and more messages referring to the Roblox game, more messages from other people start pouring in. I groanedd once more and logged out of Discord, but not before making an announcement in my Wii Discord server saying that we’re investigating the problem, not to send me any more messages, and not to open the Roblox game on the Wii.
There is no information about who Thriller might be. I haven’t heard someone with that username until today. That’s probably because someone created a username just to distribute this bricker. I was sure that as time progressed, we would find out who this person actually is, and would tell everyone about it so they can watch out for them.
We’ve seen people make homebrew apps before that solely exist just to brick people’s Wiis. One was just called “Wii Pong”, but no one ran it on their Wii because the news spread fast about it actually being a bricker. Another reason why it didn’t affect any Wiis is because no one was interested in trying a rendition of a game that was released in the 70s, one of the first video games ever.
Time to load the program into Ghidra. It’s an app that was released last year by the NSA (yes, THAT NSA that you’re thinking about). It’s a sophisticated tool that can take binary compiled code and output it into a somewhat readable format. A lot of security experts use Ghidra to reverse engineer malware to figure out how to patch security vulnerabilities and how the malware works. It’s hard work, but someone has to do it to keep others safe.
As soon as Ghidra processes the program, there’s a pop-up that shows all the graphics it was able to find inside the code. They match up to what I saw on my Wii, but they look a bit compressed. One is just just is an image of a creepy face on it that looks like it’s staring into your soul. I didn’t see on the app. Another one is just the brick wall background pattern.
Now the hard part - looking into the code. There’s not much code in the app, and the whole program is around 300 KB. The only thing of interest that I saw after digging around vigorously in the code were 2 functions that looked complex. You often need breaks when working with programs like Ghidra, and it takes a lot of brainpower to visualize what’s going on in the code. I was almost about to take a break when I realized that the code is actually encrypting something. After a bit of reading into some encryption standards documentation, I learned that the encryption used is AES-256-CBC, one of the many formats of AES encryption.
It’s evident that the code is encrypting lots of files on the Wii NAND memory, and the Wii doesn’t know how to read them. This is like a widespread virus that went around a few years ago named WannaCry. When it was distributed to a computer through other computers in a network, it encrypted most of the files on your computer’s hard drive. It asked you to pay a lot of money in Bitcoin form in order to decrypt the files. Even if you did that, it was unlikely that you would get your files decrypted.
WannaCry was stopped when a security researcher had found a killswitch in the code that checked if a site with a domain name full of gibberish was online. If it was, then the virus would not encrypt files. This was probably implemented in case the virus creator would want to stop the virus from causing harm if they wanted to. Thankfully, the researcher bought the website that was registered, which stopped the virus from spreading.
Another thing that stopped the virus was an emergency security patch that Microsoft released for their operating system. It even had a patch on Windows XP, which was unexpected because that version of Windows hadn’t had a patch in years. It’s believed that the creator of WannaCry was someone working for North Korea’s government, and was also responsible for hacking Sony Pictures and also hacking a bank.
If people could stop WannaCry from spreading, then we could surely stop the fake Roblox app from spreading too. The problem is that the nature of the Wii is different. How would we fix the 100-ish Wiis that were bricked? Could we fix them? Or could we figure out who is behind all of this?
…
After taking a deep breath, I logged back into Discord. It looks like my announcement helped. While my Discord server hads some people freaking out about the bricker in the chat, it looks like I haven’t received that many messages from other people. All of the messages that I didn’t read were marked as read, as I don’t have the time nor patience to respond to all of them. Many of the messages were from people I’ve never even talked to.
I wanted to focus on investigating who Thriller is, so I took it a step further and opened Discord’s drop-down menu for statuses and clicked Do Not Disturb so I wouldn’t get more notifications from random people. Before I started to dig in, I sipped the last sip of my coffee before it was empty and then satisfyingly cracked my knuckles.
There’s a site called WiiBrew, which is a wiki about Wii Homebrew. Maybe Thriller posted the link to the supposed game there and that’s one of the places it spread. After going to the site and clicking Recent Changes on the sidebar, I found the article - simply called Roblox.
The obvious thing we would want to do is take the link to the game down. Only problem is that the wiki’s moderators are rarely online and moved on to other consoles to run homebrew on, such as the Switch. There’s of course the site operator that I could contact. Unfortunately he rarely is on IRC (Internet Relay Chat) to talk to. So I ran the WHOIS command on his IRC nickname, and found his actual first name.
Googling his nickname and first name allowed me to find his phone number, which is registered to Sweden. I texted him a paragraph about what’s happening with Thriller and his Roblox bricker. There wasn’t a response immediately, so I went back on Discord to investigate some more. It felt like I was jumping back and forth from one messaging platform to another.
There was one place I forgot to look at - the member log. Whenever a new member joins our Discord server, their username gets logged in the channel. And that’s where I found Thriller’s Discord account. “What was he doing in our server?!”, I said to myself.
Searching their messages using Discord’s handy search bar just showed them acting like a jerk to people, shoving this Roblox game into their face to try to get everyone to try it out. He said stuff like he needed beta testers for the game, and was asking people “Why not?” when they responded to his message saying they were not interested.
I tried to send him a direct message, and was about to regret it when I saw that it didn’t go through. This is because they were banned from the server by a moderator. Going into the staff channel in the chat, there were 2 or 3 moderators talking about Thriller. One was also looking into who Thriller is, and I tell them that I’m doing the same.
Right after I did that, my phone buzzed. It was a message from the wiki operator. They told me they removed the page, banned Thriller from the wiki, and gave me their IP address so I could look it up. “Good luck”, they said.
After quickly Googling an IP address lookup site, I used one that I found and put the IP the wiki operator gave me inside of it. The address led to somewhere in Scotland. “Ooh, that could be someone in our Discord server”, I thought. Out of the many people that regularly talk in the server, 3 or 4 people came to mind that live in Scotland. I’ve noticed the Scottish people in the server sometimes kind of act like jerks to people. Except SevenEight, he’s cool.
My phone buzzed again. It’s a notification from Tapatalk about an article that popped up on the front page of the popular hacking forum GBAtemp. It read: ATTENTION: Wii brickers disguised as Roblox are popping up. The article just has some information that someone took from my announcement in the Discord server. It’s both good and bad that this was posted on the site, good because it warns people about what’s going on and bad because it gives Thriller more attention. If he gets more attention, then he might try to make more Wii brickers.
Someone pointed out in the thread that Thriller made a GBAtemp account overnight when I was sleeping, which I guess is when the virus was posted. The only post that was made was a thread about the Roblox for Wii game. A moderator of the site soon quoted their message to say that they banned Thriller. I could already see that before I read that post, because the profile picture of banned users has a grey background and a red stamp on it that says “BANNED”.
The next thing that I see is the website WiiDatabase, a German site about homebrew, reporting on Thriller’s bricker. The site isn’t big as GBAtemp, but people outside of Germany use the site to download reputable homebrew, so it still was significant. A link to Thriller’s GitHub page was posted. GitHub is the most popular site to share open-source code.
There was one repository in Thriller’s GitHub. It was the source code for the Roblox bricker. It wasn’t labeled as a virus, and it was unusual to release source code to a virus. If it was released, then that defeats the whole purpose of making something malicious! As fast as I could, I sent GitHub an email asking them to take down Thriller’s GitHub. I mostly used the paragraph that I texted to the wiki operator. 5 minutes later, I received a generic response about them investigating the account.
I went back on Discord, and one of the moderators was trying to ping me (which is supposed to give me notifications to notice them) saying they made a discovery. That was a few minutes ago, but I only saw it then because I don’t get notifications when I’m in Do Not Disturb mode. They found, by looking up Thriller’s Discord ID, they actually joined the server a week ago with a different name: Jupiter. That’s a big clue to finding Thriller’s identity.
Jupiter was the name of Bobobo’s supposed crush. He would often show a picture of a cartoon character that had the head of the actual planet of Jupiter and a face and stick body drawn on it. There were debates if Jupiter actually existed, which Bobobo always said they did.
So Bobobo must have made the Discord account as a joke at first, then reused it for another purpose. They also lived in Scotland too, so I was pretty sure that he was the one who was making the Roblox bricker. After agreements with other moderators, Bobobo got banned from our chat too.
A day or two later, the GitHub and Discord accounts for Thriller and Bobobo got deleted. I didn’t get a response back from GitHub about banning Thriller. The only question left was why they wanted to brick people’s Wiis. A screenshot of someone asking Thriller after he got banned from my Discord server said he wanted to do it for attention. And that’s what he got. Something tells me that if enough people hear about something such as a virus, they always get the attention they intended for.
“It’s one of those days”, I whined. Someone named Thriller released a suspicious homebrew app out of nowhere that presumably will brick your Wii, which means it will render the console unusable. It’s ridiculous that someone is trying to brick a console that released 13 years ago. The app is called “Roblox for Wii”, and the description reads “A 1:1 port of the popular game known as Roblox to the Wii.” One thing I almost overlooked is the last line of the description, which reads: “Credit to Mikey for making this happen.” Quotation marks when you have dialogueW-what?!, I stutterstuttered. “Why are they giving me credit for this app, that I didn’t even make?”
Loading the app into the glorious Wii emulator Dolphin gives you a vague and suspicious message. “Roblox doesn’t work on Dolphin. Please try a real Wii. Sorry about that!”. Good thing my Wii is sitting right by my desk and it’s immune to bricks. After making a backup of the NAND memory, I opened the Homebrew Channel and loaded up the strange Roblox app. The screen faded to black, then all hell broke loose.
A message in small, white text on a plain black background read “Doing some magic. I hope you don’t get a seizure!” and the screen very rapidly switches to a solid blue screen, to a red screen, to a green screen. It does this for about 5 seconds, then a loud beeping noise was heard and a bunch of random pixels appear on the screen in different colors. The screen then flashed to white, then black. Finally, the Roblox loading screen appears, with some progress text. However, I can’t read the text because it looks like it’s garbled.
After about 15 seconds, the progress bar makes its way to 100%, and the screen flashed white then black once again. Rick Astley’s music video of “Never Gonna Give You Up” plays, and some red text in front of it read “ENJOY YOUR BRICK”. “Wow, not only does it brick the console as expected, but I get RICKROLLED”, I muttered mutter. After the song ends, the music video is replaced with a brick wall, and the “ENJOY YOUR BRICK” text turns white, making it easier to read.
The power button on the Wii console and the Wii Remote didn’t turn the system off, so I yanked the adapter supplying power to the console and plug it back in. After pressing the power button on the console, the “Health and Safety screen” that no one reads is shown. This is normal when you boot your Wii. Pressing the A Button doesn’t open up the Wii Menu as usual, instead showing another message with white text on a black background. It reads: The system files are corrupted. Please refer to the Wii Operations Manual for help troubleshooting.
I restarted the Wii, and on startup I held the reset button on the console down, which boots into the menu where I can restore the NAND memory from the backup I made earlier. After it let me go to the Wii Menu, everything seems to be working again as expected. As fortunate as I am to be able to fix my Wii so easily, others might not be as fortunate. You know how many kids will think they can play Roblox on their console? Their Wiis will not be able to be fixed if their console is one of the majority that cannot run software to access a recovery mode.
Time to log into Discord, my favorite messaging app. I’m pretty popular there. Some mornings I wake up to a couple dozen messages from a few people, and I think it’s gonna be one of those mornings. After I brew a cup of coffee, I sit at my computer desk and log in. There were 84 new messages from dozens of people. I groaned and start to dig into the messages.
The first few messages say the same thing: “Mikey, my Wii isn’t working. I opened up the Roblox game that just came out as a homebrew app and now my Wii is saying something about the system files being corrupted. Please help me, I’m scared”. As I read more and more messages referring to the Roblox game, more messages from other people start pouring in. I groanedd once more and logged out of Discord, but not before making an announcement in my Wii Discord server saying that we’re investigating the problem, not to send me any more messages, and not to open the Roblox game on the Wii.
There is no information about who Thriller might be. I haven’t heard someone with that username until today. That’s probably because someone created a username just to distribute this bricker. I was sure that as time progressed, we would find out who this person actually is, and would tell everyone about it so they can watch out for them.
We’ve seen people make homebrew apps before that solely exist just to brick people’s Wiis. One was just called “Wii Pong”, but no one ran it on their Wii because the news spread fast about it actually being a bricker. Another reason why it didn’t affect any Wiis is because no one was interested in trying a rendition of a game that was released in the 70s, one of the first video games ever.
Time to load the program into Ghidra. It’s an app that was released last year by the NSA (yes, THAT NSA that you’re thinking about). It’s a sophisticated tool that can take binary compiled code and output it into a somewhat readable format. A lot of security experts use Ghidra to reverse engineer malware to figure out how to patch security vulnerabilities and how the malware works. It’s hard work, but someone has to do it to keep others safe.
As soon as Ghidra processes the program, there’s a pop-up that shows all the graphics it was able to find inside the code. They match up to what I saw on my Wii, but they look a bit compressed. One is just just is an image of a creepy face on it that looks like it’s staring into your soul. I didn’t see on the app. Another one is just the brick wall background pattern.
Now the hard part - looking into the code. There’s not much code in the app, and the whole program is around 300 KB. The only thing of interest that I saw after digging around vigorously in the code were 2 functions that looked complex. You often need breaks when working with programs like Ghidra, and it takes a lot of brainpower to visualize what’s going on in the code. I was almost about to take a break when I realized that the code is actually encrypting something. After a bit of reading into some encryption standards documentation, I learned that the encryption used is AES-256-CBC, one of the many formats of AES encryption.
It’s evident that the code is encrypting lots of files on the Wii NAND memory, and the Wii doesn’t know how to read them. This is like a widespread virus that went around a few years ago named WannaCry. When it was distributed to a computer through other computers in a network, it encrypted most of the files on your computer’s hard drive. It asked you to pay a lot of money in Bitcoin form in order to decrypt the files. Even if you did that, it was unlikely that you would get your files decrypted.
WannaCry was stopped when a security researcher had found a killswitch in the code that checked if a site with a domain name full of gibberish was online. If it was, then the virus would not encrypt files. This was probably implemented in case the virus creator would want to stop the virus from causing harm if they wanted to. Thankfully, the researcher bought the website that was registered, which stopped the virus from spreading.
Another thing that stopped the virus was an emergency security patch that Microsoft released for their operating system. It even had a patch on Windows XP, which was unexpected because that version of Windows hadn’t had a patch in years. It’s believed that the creator of WannaCry was someone working for North Korea’s government, and was also responsible for hacking Sony Pictures and also hacking a bank.
If people could stop WannaCry from spreading, then we could surely stop the fake Roblox app from spreading too. The problem is that the nature of the Wii is different. How would we fix the 100-ish Wiis that were bricked? Could we fix them? Or could we figure out who is behind all of this?
…
After taking a deep breath, I logged back into Discord. It looks like my announcement helped. While my Discord server hads some people freaking out about the bricker in the chat, it looks like I haven’t received that many messages from other people. All of the messages that I didn’t read were marked as read, as I don’t have the time nor patience to respond to all of them. Many of the messages were from people I’ve never even talked to.
I wanted to focus on investigating who Thriller is, so I took it a step further and opened Discord’s drop-down menu for statuses and clicked Do Not Disturb so I wouldn’t get more notifications from random people. Before I started to dig in, I sipped the last sip of my coffee before it was empty and then satisfyingly cracked my knuckles.
There’s a site called WiiBrew, which is a wiki about Wii Homebrew. Maybe Thriller posted the link to the supposed game there and that’s one of the places it spread. After going to the site and clicking Recent Changes on the sidebar, I found the article - simply called Roblox.
The obvious thing we would want to do is take the link to the game down. Only problem is that the wiki’s moderators are rarely online and moved on to other consoles to run homebrew on, such as the Switch. There’s of course the site operator that I could contact. Unfortunately he rarely is on IRC (Internet Relay Chat) to talk to. So I ran the WHOIS command on his IRC nickname, and found his actual first name.
Googling his nickname and first name allowed me to find his phone number, which is registered to Sweden. I texted him a paragraph about what’s happening with Thriller and his Roblox bricker. There wasn’t a response immediately, so I went back on Discord to investigate some more. It felt like I was jumping back and forth from one messaging platform to another.
There was one place I forgot to look at - the member log. Whenever a new member joins our Discord server, their username gets logged in the channel. And that’s where I found Thriller’s Discord account. “What was he doing in our server?!”, I said to myself.
Searching their messages using Discord’s handy search bar just showed them acting like a jerk to people, shoving this Roblox game into their face to try to get everyone to try it out. He said stuff like he needed beta testers for the game, and was asking people “Why not?” when they responded to his message saying they were not interested.
I tried to send him a direct message, and was about to regret it when I saw that it didn’t go through. This is because they were banned from the server by a moderator. Going into the staff channel in the chat, there were 2 or 3 moderators talking about Thriller. One was also looking into who Thriller is, and I tell them that I’m doing the same.
Right after I did that, my phone buzzed. It was a message from the wiki operator. They told me they removed the page, banned Thriller from the wiki, and gave me their IP address so I could look it up. “Good luck”, they said.
After quickly Googling an IP address lookup site, I used one that I found and put the IP the wiki operator gave me inside of it. The address led to somewhere in Scotland. “Ooh, that could be someone in our Discord server”, I thought. Out of the many people that regularly talk in the server, 3 or 4 people came to mind that live in Scotland. I’ve noticed the Scottish people in the server sometimes kind of act like jerks to people. Except SevenEight, he’s cool.
My phone buzzed again. It’s a notification from Tapatalk about an article that popped up on the front page of the popular hacking forum GBAtemp. It read: ATTENTION: Wii brickers disguised as Roblox are popping up. The article just has some information that someone took from my announcement in the Discord server. It’s both good and bad that this was posted on the site, good because it warns people about what’s going on and bad because it gives Thriller more attention. If he gets more attention, then he might try to make more Wii brickers.
Someone pointed out in the thread that Thriller made a GBAtemp account overnight when I was sleeping, which I guess is when the virus was posted. The only post that was made was a thread about the Roblox for Wii game. A moderator of the site soon quoted their message to say that they banned Thriller. I could already see that before I read that post, because the profile picture of banned users has a grey background and a red stamp on it that says “BANNED”.
The next thing that I see is the website WiiDatabase, a German site about homebrew, reporting on Thriller’s bricker. The site isn’t big as GBAtemp, but people outside of Germany use the site to download reputable homebrew, so it still was significant. A link to Thriller’s GitHub page was posted. GitHub is the most popular site to share open-source code.
There was one repository in Thriller’s GitHub. It was the source code for the Roblox bricker. It wasn’t labeled as a virus, and it was unusual to release source code to a virus. If it was released, then that defeats the whole purpose of making something malicious! As fast as I could, I sent GitHub an email asking them to take down Thriller’s GitHub. I mostly used the paragraph that I texted to the wiki operator. 5 minutes later, I received a generic response about them investigating the account.
I went back on Discord, and one of the moderators was trying to ping me (which is supposed to give me notifications to notice them) saying they made a discovery. That was a few minutes ago, but I only saw it then because I don’t get notifications when I’m in Do Not Disturb mode. They found, by looking up Thriller’s Discord ID, they actually joined the server a week ago with a different name: Jupiter. That’s a big clue to finding Thriller’s identity.
Jupiter was the name of Bobobo’s supposed crush. He would often show a picture of a cartoon character that had the head of the actual planet of Jupiter and a face and stick body drawn on it. There were debates if Jupiter actually existed, which Bobobo always said they did.
So Bobobo must have made the Discord account as a joke at first, then reused it for another purpose. They also lived in Scotland too, so I was pretty sure that he was the one who was making the Roblox bricker. After agreements with other moderators, Bobobo got banned from our chat too.
A day or two later, the GitHub and Discord accounts for Thriller and Bobobo got deleted. I didn’t get a response back from GitHub about banning Thriller. The only question left was why they wanted to brick people’s Wiis. A screenshot of someone asking Thriller after he got banned from my Discord server said he wanted to do it for attention. And that’s what he got. Something tells me that if enough people hear about something such as a virus, they always get the attention they intended for.
