Hacking Homebrew Install a Unity 2017 Wii U built game ? ("repack" for retail Wii U)

[RetroAndDev]

Hi,

I want to dev some games for fun for my Wiii U.
I have the official Unity License Key and Dev Kit from the Nintendo Dev Interface.

Before making my game, I wanted to test with an empty project to install it on my Wii U. I built the game with success and I tried to run it on Cemu, but the game shows the "loading image" and Cemu crashes. I think it was due to the emulator itself. But when I tried to run it with Loadiine, I got a black screen and the game never load (I wait for 20 minutes max). I have seen that the dev kit encrypt the game with a different key that the retail console. So I used CDecrypt to decrypt the game (in Wup format) with the dev key stored int the Wii U SDK (CafeSDK\SDK\cafe_sdk\system\bin\tool\mastering\resources\makemaster\tik_sys**.bin) but same issue.
When I try to install it to USB from WUP Installer, I have the error "Not a game, update or dlc"

I saw in this an reddit comment : "All he has to do is repack the demos he made for retail, pretty easy. If you want to learn how, I recommend asking in r/WiiUHacks" (found from some searches) that I need to "repack" the game, I wanted to know how to do that and play it on my retail Wii U

Some technical information:

Unity 2017.1.2p3 with Wii U Build support

Cafe SDK : 2.13.01 EN

Cafe "GHS Multi" : 5.3.27 EN/JA

Cafe HostBridge Software : 3.2.6.8 EN/JA

Wii U Hardware : Wii U Deluxe 32go (Europe)

Wii U Version : 5.5.5 (Europe)

Wii U Hack Version : Last version I think... (I installed it quickly to back up my NAND)

Thank you for reading/or for your help

Post automatically merged: Apr 10, 2023

NEWS !
I tried with a different Title ID and other things (i don't know exactly what I do, it has been 4 hours of search of common keys, title ID, dev common key and many others) and the message in WUP Installer changed to "Verify WUP files are correct & complete. DLC/E-Shop require Sig Patch", so I installed Sig Patch 2 HBL from Homebrew App Store and the message stay.
Any idea how to install a Unity Wii U Build to a retail Wii U ?

 

[RetroAndDev]

New edit
I managed with the documentation to make a master from scratch with my Unity Build. I use System Config Tool to install it on my Retail Wii U, but I got the error -265152 : es_err_issuer_not_found
Any Unity Wii U devs to help me ?

 

[Deleted member 571007]

This was answered in another thread a while back.

Pack the game with Unity, and then unpack with something like CDECrypt, and then re-pack it for retail using NUSPacker.

The errors you're getting are because you're not on a devkit unit, which won't allow you to install the base Unity packed titles.

As stated in the other thread, this topic is technically illegal, so that's all the help I'm giving on the subject.

 

[RetroAndDev]

Yeah, I done that.
I generate a Wumad File from Unity and I extracted it with makefcmaster installarchive from Cafe SDK
After I use NUSPacker with the titleKey and TitleID to repack the games
After that, I use System Config Tool to install the game, managed to install my game due to my used keys while repacking.
But now if I start the game from System Config Tool I have a black screen. If I start it from the Wii U Menu I have the loading sound with the images but the game never loads
Any idea about that ?
Note : The game always crashes in CEMu....

 

[Deleted member 571007]

I've never done the process myself, and I never will because I don't even have the console anymore. I just described how other people got it to work, and as such I can't really provide any further help.

 

[RetroAndDev]

I found it this morning, It was due to my Unity Installation. I managed to got a crash report from System Config Tool and I saw that my Wii U Build Support was not targeting my Unity Version. I installed the good version I it worked !

 

[DomyGX]

how did you found that your unity installation was faulty? i managed to follow your steps and i'm stuck... the game won't boot in cemu and i got the black screen on the wii u

 

[RetroAndDev]

I dump the logs to my SD with System Config Tool. In the logs I had something like "Target Unity Install : 2017.2.1p3, actual target : Unity 2017.1.2f1" It's something like that at the end
I recommend to you to use System Config Tool to install/uninstall your dev games. Install/Uninstall in Data Manager -> Title Manager

 

[V10lator]

Why use such an dangerous tool like SCT when we have multiple (un)installer tools available? Also logs are easily grabable through FTP.

 

[RetroAndDev]

I love danger. No, i don't see any tools for that. When I make some games for N3DS I used the DevMenu and I wanted too for my Wii U. Moreover, With SCT, I can Install/Uninstall/Manage my games and see logs

 

[DomyGX]

it still won't start, i'm getting this error

Core1: Instruction at 0x0103657C (from SRR0) invalid access of 0x00000000 (value from DAR)

it's a new project in Unity 2017.4.15f1.
here the full log

-----------------------------
ROOT IS STARTING MASTER TITLE
-----------------------------

00;25;47;490: TEST COOKIE: YOSHI-1992-11-21-00-00-00
00:25:47:657: MCP: did not find 'preload.txt' at '/vol/storage_mlc01/usr/title/00050000/505a4b00/code', rval -196631
00:25:47:657: MCP: Preparing Unity-master.rpx
00:25:47:660: MCP: Mapping /vol/content to /vol/storage_mlc01/usr/title/00050000/505a4b00/content
00:25:47:661: MCP: 00050000505A4B00 is not a demo title, skip increment demo launch count
00:25:47:661: MCP: Mapping /vol/content to /vol/storage_mlc01/usr/title/00050000/505a4b00/content
00;25;47;539: DIAG:Result PrepareTitle(0x0000000000000000) came back with cosxml(0x00050000505A4B00)
00;25;47;542: TitleId 0x00050000505A4B00 Version 0x00000000 Built On SDK 21301
00;25;47;632: port 0 detached
00;25;47;673: ------------------PROCESS 1 LOST FOREGROUND--------------------
00;25;47;673: DIAG: PhysAlloc(15, 0x60000000, 0x00000000, 0x00000000, 0x0E000000, 0x00000001)
00;25;47;673: DIAG: InitAddrSpace
00;25;47;674: DIAG: Switch(New)
00;25;47;674: DIAG:+Loader(1, 7)
00;25;47;674: DIAG:+KiRPLLoaderSetup
00;25;47;674: DIAG:-KiRPLLoaderSetup: before no-return call to KiLoadContext (0xEFE09400) (0x01003FFC)
00;25;47;674: Title Loc is 0
00:25:49:231: MCP: PID 14 requested to enable power transitions
00;25;49;110: DIAG:-Loader(1, 7)
00;25;49;110: DIAG: SetFG(7)
00;25;49;110: KiCblRegisterBlocks() completed with status 0:-4.
00;25;49;110: ------------------PROCESS 15 GAIN FOREGROUND--------------------
00;25;49;165: SYSLOG_LEVEL 1: Warnings Enabled
00;25;49;165: UserMode Core & Thread Initialization (3 Cores)
00;25;49;165:   Core 1 Complete, Default Thread 0x100457E0
00;25;49;167:   Core 0 Complete, MSR 0x00005072, Default Thread 0x10045140
00;25;49;169:   Core 2 Complete, MSR 0x00005072, Default Thread 0x10045E80
00;25;49;191: UserMode OS library build date: Feb  4 2021 16:38:58
00;25;49;191: __AppFlags: 0x00000200

00;25;49;192: OSBlockThreadsOnExit default for sdk version 21301
00;25;49;495: > Unity 6113371 / 2017.4.15f1 (5d485b4897a7) preinit
00;25;49;495: MEM2 Reserved for OS heap: 4429120 bytes. Allocatable 0x135F0540:0x41FA0000 (781908672)
00;25;49;496: SYSAPP: RPL Load
00;25;49;496: mic_core0_thread: master init
00;25;49;515: OSSetting_SynchronousPrinting DISABLED
00;25;49;520: OSSetting_CrashDumpType 0, MINI dump after crash
00;25;49;553: TCL(15): init DONE
00:25:49:756: ccr_hid_input_start: idx 0 controller: 0, ep 3 int req --> 0
00;25;49;635: VPADInit() depricated, no need to call
00;25;49;635: port 0 attached
00;25;49;636: VPAD Init end, BPERF: (0/1549756907) Title PID=15
SPM: SetAutoModeForDebug
00;25;49;672: mic_drc_attach_cb: ch 0 reason 1 flags 0x00040100
00;25;49;673:    ACP_AutoInit: start
00;25;49;708:    ACP_AutoInit: ACPInitialize complete
00;25;49;709:    ACP_AutoInit: ACPSaveDataInit complete
00;25;49;712:    ACP_AutoInit: ACPNotifyPlayEvent complete
00;25;49;721:    ACP_AutoInit: NDMInitialize complete
00;25;49;735: ACP: initialized
00;25;49;736: MEM1 pool created of 33554356 bytes (32.00 MB)
00;25;49;736: MEM1 0xf400004c - 0xf6000000, MEM2 0x135f0540 - 0x41fa0000
00;25;49;737: > Unity 2017.4.15f1_5d485b4897a7, build: 6113371, Nov  2 2018-02:00:35 main (9 ms)
00;25;49;737:

Core1: Instruction at 0x0103657C (from SRR0) invalid access of 0x00000000 (value from DAR)
00;25;49;737:
--Proc15-Core1--------- OSContext 0x100457E0 --------------------

00;25;49;737: tag1  = 0x4F53436F (expecting 0x4F53436F)
00;25;49;737: tag2  = 0x6E747874 (expecting 0x6E747874)
00;25;49;737: TBR   = 0x00000016_5724000F
00;25;49;737: CR    = 0x80000022
00;25;49;737: CTR   = 0x01035FC8
00;25;49;737: LR    = 0x038EA2D8 unity-master|fread+0xFD74C374
00;25;49;769: SRR0  = 0x0103657C coreinit.rpl|OSBlockMove+0x298
00;25;49;769: SRR1  = 0x0000F072

00;25;49;769: state = 0x0006

00;25;49;769: r0   = 0x00000001 (             1)  r16  = 0x00000000 (             0)
00;25;49;769: r1   = 0x12e927d8 (     317269976)  r17  = 0x00000000 (             0)
00;25;49;769: r2   = 0x0479c3c0 (      75088832)  r18  = 0x00000000 (             0)
00;25;49;769: r3   = 0x1365221d (     325394973)  r19  = 0x00000000 (             0)
00;25;49;769: r4   = 0x00000000 (             0)  r20  = 0x00000000 (             0)
00;25;49;769: r5   = 0x13652227 (     325394983)  r21  = 0x00000000 (             0)
00;25;49;769: r6   = 0x13652227 (     325394983)  r22  = 0x00000000 (             0)
00;25;49;769: r7   = 0x10098c8c (     269061260)  r23  = 0x00000000 (             0)
00;25;49;769: r8   = 0x00000000 (             0)  r24  = 0x00040007 (        262151)
00;25;49;769: r9   = 0xe7ffffff (    -402653185)  r25  = 0x107c0668 (     276563560)
00;25;49;769: r10  = 0x00000000 (             0)  r26  = 0x00000006 (             6)
00;25;49;769: r11  = 0xffffffff (            -1)  r27  = 0x13652227 (     325394983)
00;25;49;769: r12  = 0x13652240 (     325395008)  r28  = 0x00000006 (             6)
00;25;49;769: r13  = 0x0479c3c0 (      75088832)  r29  = 0x00000001 (             1)
00;25;49;769: r14  = 0x00000000 (             0)  r30  = 0xfffffffc (            -4)
00;25;49;769: r15  = 0x00000000 (             0)  r31  = 0x13652221 (     325394977)
00;25;49;769:
--Stack Trace--------------------------
00;25;49;770:
Address:      Back Chain    LR Save
00;25;49;770: 0x12e927d8:   0x12e927f8    0x1005e060 coreinit.rpl|.bss+0xb1e0
00;25;49;770: 0x12e927f8:   0x12e92818    0x038ea2d8 unity-master|fread+0xd0
00;25;49;801: 0x12e92818:   0x12e92850    0x020fd434 unity-master|InitFromFile__Q2_10BootConfig4DataFPPCcUiPCc+0x114
00;25;49;811: 0x12e92850:   0x12e92900    0x020fca70 unity-master|InitFromFileFormatted__10BootConfigFPPCcUiPCce+0x114
00;25;49;821: 0x12e92900:   0x12e92938    0x020041b8 unity-master|PreInit__5unityFiPPc+0x64
00;25;49;830: 0x12e92938:   0x12e92960    0x020000d8 unity-master|main+0x98
00;25;49;840: 0x12e92960:   0x12e92978    0x02000424 unity-master|_start+0xac
00;25;49;849: 0x12e92978:   0x00000000    0x0101c570 coreinit.rpl|$TEXT+0x170
INFO: nn::ipc avoided busy close on /dev/acp_main (moduleId = 301, tag = 0) from pid = 21
00;25;49;849:

00;25;50;014: KiCblRegisterBlocks() completed with status 0:-4.
00:25:50:204: COS encountered unrecoverable error...

Pending Resource Request for COS processes...
        Title Id       Process Id -> RM Path            
exited...
[+-*APPLICATION EXITED 0*-+]
[+-*OUTPUT EOF*-+]

00:25:55:205: MCP: life time number of fatal errors - 41

 

[RetroAndDev]

How do you create your installation ? You are on a retail Wii U or CAT-Dev. It not seems to be your Unity Install. How do you have process it ?

 

[V10lator]

i'm getting this error

Null pointer access. Check your codes.

No, i don't see any tools for that.

NUSspli, for example.

 

[RetroAndDev]

Ok I take note, NUSspli.... I will look thanks !

 

[DomyGX]

Null pointer access. Check your codes.


NUSspli, for example.

it's a blank new project, maybe this version of the Unity wii u support is broken?

How do you create your installation ? You are on a retail Wii U or CAT-Dev. It not seems to be your Unity Install. How do you have process it ?

i'm on retail, i'm just building (master no network, nand, download image), unpacking with cdecrypt and packing it back with nusPacker using the wii u common key and a different title id

 

[RetroAndDev]

like me. When I go home I write how I make. My problem was my title Key who is used to install and decrypt the game. It can be a way to fix it

 

[V10lator]

Looked a bit more into the logs and what we see from the stacktrace is a normal app startup. Then it goes into Unity specific functions and there it tries to read some file which seems to fail, causing the Null pointer access later on.

it's a blank new project

I never worked with Unity but maybe this is the issue? Try to at least do a small hello world.

 

[DomyGX]

a blank unity project works on its own, it's just an empty scene with a camera

 

[RetroAndDev]

Short tutorial but it can work.
First, I use Unity 2017.1.2p3 with the WIi U Build Support (I use this version, because I didn't get any results with other versions)
In therms of tools I have CDecrypt with the tik_sys.bin of the dev kit (located in your cafe_sdk\system\bin\tool\mastering\resources\makemaster\tik_sys.bin), NUSPacker from rabisco and Kii U Generator with my title ID

Build the game & decrypt it
I build the game with Master [No Network] / Download Image / NAND.
After, I use CDecrypt to decrypt the dev files from your Unity Project/copyToSd/ with the DEV KEY (tik_sys.bin). Use the GUI version and select the tik_sys.bin (copy it to the CDecrypt GUI folder it better) and the title.tik from the in folder.

If you don't have a TitleID
The Wii U Title ID is different in one point : the UniqueID (normaly give by Nintendo, I think...).
Each Wii U TilteID is composed like that : 0x000500001 + UniqueID + VARIATION (don't know it's from Wii U App Config Tool)
So I just put random numbers to make my own UniqueID (note : it must be a HEX value) and check on This website if the TitleID was already used.

Generate the Title Key from TitleID with Kii U Generator
Start Kii U Generator.bat from my archive enter the WiiU Common Key (google it's somthing like D7B..........................656) enter your Title ID and generate. You will have 2 keys : Unencrypted title key and encrypted title key. We will use the unencrypted with NUSPacker.

Repack the game files
Place the code/meta/content folders from CDecrypte in /in/ in the NUSPacker. You will need to edit the file pack.bat. This file must contain the Title ID, Unencrypted Title Key & Wii U Common Key as arguments

Edit the file like that
java -jar NUSPacker.jar -in "in" -out "out" -skipXMLParsing -encryptWith "wiiucommonkey" -encryptionKey "your_unencrypted_titilekey" -tID your_title_id_here

After check if the encrypted title key shown by NUSPacker is the same as Kii U Generator, if yes, your game is ready to install to your WIi U. If not try a different Title ID in Kii U Generator and a different password (generally mypass or nintendo)

That the steps I used to install my own game on my Wii U.
I attach an archive with the tools CDecrypt and NUSPacker.
After launching on your Wii U be patient, sometimes I need to wait 30s-1minute on the startup screen before my game loads.
Just one question : Where do you get your Unity Install + licence and the Cafe SDK ?
Note : It has been one week I try that, and I managed to run my game this morning, I don't know the entire SDK, I just search for hours and hours.... If you need help, I am here.

 

[V10lator]

with the tik_sys.bin of the dev kit

That shouldn't be needed as CDEcrypt contains the dev key: https://github.com/VitaSmith/cdecrypt/blob/master/cdecrypt.c#L43-L44

Generate the Title Key from TitleID with Kii U Generator

This is completely overkill. Just use whatever key you want (or NUSPackers default). The Wii U won't calculate the key but just read it from the title.tik file.

This file must contain the Title ID, Unencrypted Title Key

NUSPacker should be able to read the title ID from the unencrypted files (when you don't use -skipXMLParsing). For the title key I would just leave it blank so NUSPacker uses its default. Will make it way more simple.

So correct, hassle free NUSpacker command:

java -jar NUSPacker.jar -in "in" -out "out" -encryptWith "wiiucommonkey"

//EDIT: Even when off-topic as unneeded:

password (generally mypass or nintendo)

Here's the full password list. Then again you won't need this as NUSPackers default title key or any hex value you can imagine will work just fine: "mypass", "nintendo", "test", "1234567890", "Lucy131211", "fbf10", "5678", "1234", ""

//EDIT²: Also the current issue is not a wrongly packed title but something wrong witht the codes. Just look at the logs:

invalid access of 0x00000000

00;25;49;770: 0x12e927d8:   0x12e927f8    0x1005e060 coreinit.rpl|.bss+0xb1e0
00;25;49;770: 0x12e927f8:   0x12e92818    0x038ea2d8 unity-master|fread+0xd0
00;25;49;801: 0x12e92818:   0x12e92850    0x020fd434 unity-master|InitFromFile__Q2_10BootConfig4DataFPPCcUiPCc+0x114
00;25;49;811: 0x12e92850:   0x12e92900    0x020fca70 unity-master|InitFromFileFormatted__10BootConfigFPPCcUiPCce+0x114
00;25;49;821: 0x12e92900:   0x12e92938    0x020041b8 unity-master|PreInit__5unityFiPPc+0x64
00;25;49;830: 0x12e92938:   0x12e92960    0x020000d8 unity-master|main+0x98
00;25;49;840: 0x12e92960:   0x12e92978    0x02000424 unity-master|_start+0xac
00;25;49;849: 0x12e92978:   0x00000000    0x0101c570 coreinit.rpl|$TEXT+0x170

So fread does a Null pointer access. My guess is that this is cause InitFromFile tries to open a file which isn't there (and unity is missing correct error handling). In case a empty project should really work (which I still doubt, can someone confirm this?) your best bet would be to open the .rpx in Ghidra and look at unity-master|PreInit__5unityFiPPc+0x64 and unity-master|InitFromFileFormatted__10BootConfigFPPCcUiPCce+0x114 to see what file it tries to open.