Homebrew (Question) Restore browser vulnerabilities on a 5.5.2 console that already has haxchi?

[piratesephiroth]

Yes, browser-only downgrade appears to be fine

I'm pretty sure that won't work outside of a CFW.

 

[Ryccardo]

I'm pretty sure that won't work outside of a CFW.

It doesn't, not like I've ever implied otherwise (and the video description on youtube explicitly says you need another entrypoint)

If you have Haxchi as mentioned the topic title, you have an entrypoint on 5.5.2

 

[piratesephiroth]

It doesn't, not like I've ever implied otherwise (and the video description on youtube explicitly says you need another entrypoint)

If you have Haxchi as mentioned the topic title, you have an entrypoint on 5.5.2

I don't mean the file replacing thing, I mean I think the modified browser won't run outside of a CFW

 

[Ryccardo]

I don't mean the file replacing thing, I mean I think the modified browser won't run outside of a CFW

It's not modified, it was downloaded directly from Nintendo and decrypted (the legit ticket already installed in your console isn't touched, the verified files - executable, bootlogo, etc - have the expected content)

If Mocha had a "no sigpatches" option I would have tried too

 

[piratesephiroth]

it would be nice if it worked without a CFW, so people at 5.5.2 could have the browser exploit back just in case they managed to break Haxchi.

 

[Madridi]

@Ryccardo

Cool work. I thought about doing this exact same thing, but I wanted to stay on 5.5.1 just in case. I also was not sure about any brick possibilities so I asked @Kafluke to try it out since he is able to hardmod, but he was busy. Glad to see this is proven to work.

Now my question is, what would happen if you manually attempt to system update? Wouldit tell you that you're on latest update because of version.bin, or will it recognize the browser to be on a lower version and update it?

it would be nice if it worked without a CFW, so people at 5.5.2 could have the browser exploit back just in case they managed to break Haxchi.

But that's exactly what it does.. haxchi is a mini-cfw in itself. If you're on a 5.5.2, and already have ANY method to access hbl, then this accessible to you.

It's only useless for those on 5.5.2 without any entry point

 

[Ryccardo]

Now my question is, what would happen if you manually attempt to system update? Wouldit tell you that you're on latest update because of version.bin, or will it recognize the browser to be on a lower version and update it?

Haven't tried to be honest: as you correctly know, it's only based on title version (even the title which provides the displayed version number has a separate title version for itself, that's why spoofing works)

Well, trying now

A more proper way, btw, is http://gbatemp.net/threads/updating-to-5-5-1-from-lower-versions.478867/

 

[Madridi]

A more proper way, btw, is http://gbatemp.net/threads/updating-to-5-5-1-from-lower-versions.478867/

That's for upgrading titles, not downgrading. Upgrading easily works by downloading the titles via nus, and installing them with the official whitelisted wupinstaller.

Downgrading won't work.

Edit: but I just realized he attached his own version of wupinstaller. Would that make downgrading work?

 

[Ryccardo]

That's for upgrading titles, not downgrading. Upgrading easily works by downloading the titles via nus, and installing them with the official whitelisted wupinstaller.

Downgrading won't work.

Not directly, but if you remove the older one first...


Yep, successfully updated my [FTP updated to 5.5.2 but with 5.5.1 browser and 5.5.1 verdata hacked to read 9.2.0], it took a long time (not like I remember a typical download and install speed), version number reads 5.5.2, so actual updates are based on title versions only

 

[Madridi]

Not directly, but if you remove the older one first...


Yep, successfully updated my [FTP updated to 5.5.2 but with 5.5.1 browser and 5.5.1 verdata hacked to read 9.2.0], it took a long time (not like I remember a typical download and install speed), version number reads 5.5.2, so actual updates are based on title versions only

How would you delete the older one though? Does wupinstaller have access to delete system files? I assume you are talking about delete and install new one before exiting to menu. That's how I did it with FBI on 3ds at least.

I'm not sure I get your second part. Did you change tmd via hex to read a different version number? Cause if that's the case, that would break the signature, and make the browser non-legit.

Also, when you did that, then ran system update manually, it still updated to the correct latest version??

 

[Ryccardo]

Also, when you did that, then ran system update manually, it still updated to the correct latest version??

Yep!

Did you change tmd via hex to read a different version number? Cause if that's the case, that would break the signature, and make the browser non-legit.

No, I only edited the displayed version number, which is possible on "unmodded" consoles due to "contenthax"
I'm not sure if code/app.xml (which holds the title version number) is verified when CFW isn't running
Never looked at a WiiU TMD to be honest

How would you delete the older one though? Does wupinstaller have access to delete system files?

System titles don't have any special protection, if you can remove an arbitrary game then you can uninstall the launcher!
Wupinstaller (all versions I know of) technically could remove titles, but none of them do
SystemConfigTool may be able to remove them nope
So removing it via FTP or a future homebrew are the only possible options if we really want to downgrade via title installation

 

[Madridi]

No, I only edited the displayed version number, which is possible on "unmodded" consoles due to "contenthax"
I'm not sure if code/app.xml (which holds the title version number) is verified when CFW isn't running
Never looked at a WiiU TMD to be honest

I thought contenthax was only for ds games? From what I understood, it's due to how the ds emulator works on the Wii U.
In that case, how would any change affect system titles?

From what I understand, system update checks the title versions through the version displayed in tmd (on the 3ds anyway) .. looks like it's the same for the Wii U

System titles don't have any special protection, if you can remove an arbitrary game then you can uninstall the launcher!
Wupinstaller (all versions I know of) technically could remove titles, but none of them do
SystemConfigTool may be able to remove them nope
So removing it via FTP or a future homebrew are the only possible options if we really want to downgrade via title installation

Sure I understand that. But I'm referring to the topic you linked, and to the comment you made afterwards, when you said not directly. That we need to remove the title first before installing another version.

You said above that all version of wup technically could remove system titles but none do.

So back to the main question, if none of them do, that still makes the topic you linked to not viable for downgrading titles, only updating. Right?

 

[Ryccardo]

I thought contenthax was only for ds games? From what I understood, it's due to how the ds emulator works on the Wii U.

No, "contenthax" is just a funny term for the fact that the system never verifies anything in the "content" subfolder of a title, any title (and neither some files under "code" or "meta"), in large part because it would be a significant waste of processing power

So back to the main question, if none of them do, that still makes the topic you linked to not viable for downgrading titles, only updating. Right?

Correct unless the newer version is manually removed first

 

[Madridi]

No, "contenthax" is just a funny term for the fact that the system never verifies anything in the "content" subfolder of a title, any title (and neither some files under "code" or "meta"), in large part because it would be a significant waste of processing power

I understand that, but I'm fairly certain that it's only for ds emulator.
If not, what's stopping us from getting haxchi on virtually anything?

 

[Ryccardo]

I understand that, but I'm fairly certain that it's only for ds emulator.
If not, what's stopping us from getting haxchi on virtually anything?

Haxchi is the exploitation of a vulnerability in the official DS emulator

Running Haxchi is possible without CFW being already started because contenthax exists, but it doesn't mean contenthax only applies to emulated DS titles

 

[Madridi]

Haxchi is the exploitation of a vulnerability in the official DS emulator

Running Haxchi is possible without CFW being already started because contenthax exists, but it doesn't mean contenthax only applies to emulated DS titles

I'm sounding noobish with every post.. sorry, but the concept of contenthax is a bit new to me so I'm still learning. Bear with me.

So here is how I understand it:
The system never verifies content of titles, and therefore, the content can be replaced. Haxchi was born by this. By replacing the actual content of the ds game with a programmed code that would be executed when the app is launched.
So initially I thought this was limited to ds games, since that's what haxchi uses, and since haxchi is basically contenthax.

So I'm still confused. If content are replaced and being able to run without sigpatches, why is it only limited to ds games? The exploit in the ds emulator IS contenthax, right? Or I misunderstanding this?

 

[Ryccardo]

I'm sounding noobish with every post.. sorry, but the concept of contenthax is a bit new to me so I'm still learning. Bear with me.

So here is how I understand it:
The system never verifies content of titles, and therefore, the content can be replaced. Haxchi was born by this. By replacing the actual content of the ds game with a programmed code that would be executed when the app is launched.
So initially I thought this was limited to ds games, since that's what haxchi uses, and since haxchi is basically contenthax.

So I'm still confused. If content are replaced and being able to run without sigpatches, why is it only limited to ds games? The exploit in the ds emulator IS contenthax, right? Or I misunderstanding this?

Even if contenthax didn't exist, Haxchi would still have been possible (but it would be way less important, since to run the modded DS game would require a CFW running first)

Other applications of contenthax outside of Haxchi are romhacks of installed games runnable without CFW (indeed, haxchi and the displayed version editing can be considered romhacks of a supported DS game and of the versiondata title!)

 

[Madridi]

Even if contenthax didn't exist, Haxchi would still have been possible (but it would be way less important, since to run the modded DS game would require a CFW running first)

Other applications of contenthax outside of Haxchi are romhacks of installed games runnable without CFW (indeed, haxchi and the displayed version editing can be considered romhacks of a supported DS game and of the versiondata title!)

Oh so you are saying haxchi is essentially 2 exploits?
Contenthax + vuln in ds emulator?

 

[Ryccardo]

Oh so you are saying haxchi is essentially 2 exploits?
Contenthax + vuln in ds emulator?

Yep!

 

[Madridi]

Yep!

Oh that makes the entire thing more clear to me now. Thanks for the explanation!

So essentially, that means if any other vc emulator gets exploited, or games and apps for that matter, the compatibility for haxchi can be expanded. Which means it's only limited to ds games "for now"

Thanks again