Hacking RVT Development Key,RVT Disc Check,RVT Menu Uninstaller....

[Fudge]

I gotta get one of the SM changer discs. How do I re-encrypt the wads? I have the RVT key.

Try this tool if you're on Windows (untested on Vista/7). I originally wrote this for personal use, so it has no testing on computers beyond mine. I added some code to generate certs and common-key, and put a readme in. You need to provide rvtkey.bin.

Provided 'as-is', with no warranty whatsoever. I'm not responsible if the outputted files brick your wii. Brick protection is recommended. Use the tool and the resulting files at your own risk.

http://www.mediafire.com/?sfvhbyt7c1p8l39

Major bug. I ran through DiskCheck Channel and it outputted a SM 4.1 wad. I tried to run it through again and it destroyed my entire folder of Wii stuff, which included modified wads from years ago, most of which were custom made by me. I know its not your fault, but damn

 

[Deleted User]

boot2 isn't a normal title, it is somwhere in the blocks 1-7 on the NAND, so you have to dump those to get boot2.

How would I dump those blocks? Someone else told me they could dump Boot2v3, but they don't know how.

Or could you dump it fudgenuts64?

 

[techboy]

Major bug. I ran through DiskCheck Channel and it outputted a SM 4.1 wad. I tried to run it through again and it destroyed my entire folder of Wii stuff, which included modified wads from years ago, most of which were custom made by me. I know its not your fault, but damn

Ouch.

Look at the code now, I'm pretty sure your file deletion issue has something to do with this poorly written block of code (remember, this was a personal tool rushed to release):
CODEbin\bfgr_wadunpacker.exe .\incoming.wad

cd 0*
move /Y *.* ..\tmp > NUL
set dirkill=%cd%
echo.
echo RVT2RVL: Removing Empty Folder
cd..
rd /S /Q "%dirkill%"
set dirkill=
del .\incoming.wad

This code can do some nasty damage. If the wadunpacker line fails for any reason, no folder named (e.g. 0000000100000002) is created. The "cd 0*" subsequently fails, meaning %dirkill% will contain the path to the folder with the script in it, instead of the title ID folder. It then proceeds to remove whatever folder is indicated in %dirkill%, without checking that it's the right one.

As for getting SM 4.1 out of it...I'm clueless about that one. Did you have a 4.1 menu laying around?

I'll upload a bugfix release soon to eliminate the damage potential. I've also discovered another bug in the tool that I can fix as well.

EDIT: Bugfixed version 0.2: http://www.mediafire.com/?l881r1a10kjcnko The data loss bug described above is fixed. Full changelog is located in the readme.

 

[G0dLiKe]

Thx for the update.

 

[Deleted User]

Fudgenuts64, since you have Boot2v3, could you dump it?

Edit: I have the blocks extracted from someones wii, but how do I make it into a wad?

 

[xfcrowman]

Fudgenuts64, since you have Boot2v3, could you dump it?

Someone correct me if I'm wrong, but I believe that the only way to dump boot2 would be to use an infectus to dump the NAND. I don't think any currently available program (bootmii included) makes a backup of boot2.

 

[Deleted User]

Actually, getting the first 7 blocks from a nand dump (nand.bin) would dump it. See the third post here: http://forum.wiibrew.org/read.php?22,17002

Is thise valid? The dump I have has the blocks as "00 00 20 00 00 0f 00" in hex. And if so, how do I make it a wad?

Also, how do I run the RVT wads run through RVT2RVL on Dolphin? And if I can't, is there conformation they work on retail Wiis?

 

[techboy]

Actually, getting the first 7 blocks from a nand dump (nand.bin) would dump it. See the third post here: http://forum.wiibrew.org/read.php?22,17002

Is thise valid? The dump I have has the blocks as "00 00 20 00 00 0f 00" in hex. And if so, how do I make it a wad?
A block is not a byte. In those 7 blocks, there should be several copies of boot2...

QUOTE(Steveice10 @ Aug 31 2010, 07:41 PM) Also, how do I run the RVT wads run through RVT2RVL on Dolphin? And if I can't, is there conformation they work on retail Wiis?

Pass on Dolphin...why emulate a wii when you can use the real thing?

My advice when messing with the RVT titles? Use SNEEK. That way, you're free to play with the tools without risking a permanent brick. If you brick the SNEEK NAND, unbricking it takes 30 seconds on your PC...

As for the wads, the outputted files from RVT2RVL should install fine on retail. Just note though that RVT2RVL fakesigns the wads.

If you're curious, here's what I've found during my testing:
* Disc check v1.01 works fine. Install it, then run it like any channel. It even checks backups if you have CORP.
* The menu uninstaller will install fine and show up on the SM, but will brick if you actually run it and uninstall the menu. DO NOT MESS WITH THIS CHANNEL unless running it under SNEEK (or have bootmii/boot2 and a backup handy).
* NDEV System Menu: I tested v1.19. Runs fine. It needs IOS55, so be sure you have it unless you want a brick.
* The wads on the SM Changer discs: They work, but note that most of the titles on the discs can be gotten from NUS.

 

[Deleted User]

The link in my previous post said they were bytes. If not, then how big is a block?

How did you install the NDEV menu?

Also, no matter what advice or guide I use, using a dump from my Wii or a nand built with ModMii, SNEEK and UNEEK won't work for me. It just gives a black screen. I tried waiting 10 minutes and it still didn't work.

 

[techboy]

The link in my previous post said they were bytes. If not, then how big is a block?
I'm not sure exactly how big one is. Someone with more hardware expertise could likely tell you though.

How did you install the NDEV menu?
Get a wad of it and install it. NDEV is not available at the typical sites though. I got mine by unpacking the uninstaller channel. Unpack the Menu Uninstaller channel, then unpack the 7MB app file with a U8 extractor. Inside it are 3 wads. The one with "SystemMenu" in its name is the NDEV menu. Make sure you RVT2RVL it before using, and be sure you install IOS55.

QUOTE(Steveice10 @ Aug 31 2010, 09:28 PM)

Also, no matter what advice or guide I use, using a dump from my Wii or a nand built with ModMii, SNEEK and UNEEK won't work for me. It just gives a black screen. I tried waiting 10 minutes and it still didn't work.

Try a different SD card. Not all of them work with SNEEK. Try a 2GB Sandisk or Kingston card. I've had success with both.

As for building a NAND, ModMii never worked for me. I forget what the exact steps were to build mine, but I did it manually. Sadly, the guide for it has since been replaced...with guide for modmii.

 

[DarkMatterCore]

The link in my previous post said they were bytes. If not, then how big is a block?

I think the size is between 125 and 128KB per block,

. Correct me if I'm wrong.

QUOTE(techboy @ Aug 31 2010, 09:23 PM) If you're curious, here's what I've found during my testing:
* Disc check v1.01 works fine. Install it, then run it like any channel. It even checks backups if you have CORP.
* The menu uninstaller will install fine and show up on the SM, but will brick if you actually run it and uninstall the menu. DO NOT MESS WITH THIS CHANNEL unless running it under SNEEK (or have bootmii/boot2 and a backup handy).
* NDEV System Menu: I tested v1.19. Runs fine. It needs IOS55, so be sure you have it unless you want a brick.
* The wads on the SM Changer discs: They work, but note that most of the titles on the discs can be gotten from NUS.

1. The Disc Check Channel gives me a "FATAL ERROR" screen after a few seconds (using SNEEK+DI, btw). Does it work for you there? I can't use the real NAND because my disc reader died.
2. Same here, the channel shows a -1022 after a while. I don't know if that's because I'm using SNEEK, I haven't tried on the real NAND, but I do have BootMii as Boot2.

 

[Deleted User]

Problem is, I only have another as card which is 128mb. And my current one is a Sandisk 2gb.

Once I get the Blocks, how do I extract the data and make the wad?

 

[techboy]

1. The Disc Check Channel gives me a "FATAL ERROR" screen after a few seconds (using SNEEK+DI, btw). Does it work for you there? I can't use the real NAND because my disc reader died.
You need straight SNEEK and a DVD drive. SNEEK's DI doesn't work with it.

QUOTE(PabloACZ @ Aug 31 2010, 10:43 PM) 2. Same here, the channel shows a -1022 after a while. I don't know if that's because I'm using SNEEK, I haven't tried on the real NAND, but I do have BootMii as Boot2.

I'm assuming you mean the uninstaller channel. -1022 = bad content hash or bad ticket. This is due to the wads inside the channel being RVT encrypted. You'll need to unpack the channel, RVT2RVL the 3 wads inside, replace the originals with the RVT2RVL'd versions, and put it back together before the errors will go away. Even after this, you'll still brick...

Also, note that the uninstaller channel doesn't do what one thinks it does. This channel doesn't actually uninstall the SM. It does the following:
* Overwrite the SM with NDEV (this is what you see failing with -1022)
* Install IOS55 v4633 (also -1022's)
* Delete the .WMU and .DCK channels
* Delete system channels (Mii, News, Weather, etc.)

 

[DarkMatterCore]

1. The Disc Check Channel gives me a "FATAL ERROR" screen after a few seconds (using SNEEK+DI, btw). Does it work for you there? I can't use the real NAND because my disc reader died.
You need straight SNEEK and a DVD drive. SNEEK's DI doesn't work with it.

QUOTE(PabloACZ @ Aug 31 2010, 10:43 PM) 2. Same here, the channel shows a -1022 after a while. I don't know if that's because I'm using SNEEK, I haven't tried on the real NAND, but I do have BootMii as Boot2.

I'm assuming you mean the uninstaller channel. -1022 = bad content hash or bad ticket. This is due to the wads inside the channel being RVT encrypted. You'll need to unpack the channel, RVT2RVL the 3 wads inside, replace the originals with the RVT2RVL'd versions, and put it back together before the errors will go away. Even after this, you'll still brick...

Also, note that the uninstaller channel doesn't do what one thinks it does. This channel doesn't actually uninstall the SM. It does the following:
* Overwrite the SM with NDEV (this is what you see failing with -1022)
* Install IOS55 v4633 (also -1022's)
* Delete the .WMU and .DCK channels
* Delete system channels (Mii, News, Weather, etc.)

Thanks,

. It seems I won't be able to use the Disc Check Channel, anyway.

 

[Deleted User]

So, how do I use the blocks to make a wad?

 

[techboy]

So, how do I use the blocks to make a wad?

I spend a lot of time working with wads, but since boot2 isn't a normal title, I don't know.

 

[thesund0g]

I spend a lot of time working with wads

lol that's what she said...

(I know, I know but the opportunity was there

 

[warfab]

RVL.Systemmenu.v1.0.Wii-OneUp_iNT

> RVL.Systemmenu.v1.0.Wii-OneUp_iNT

> Region Free

> Wii System Menu v.1.0

ÂÂ> 2010-09-01

> 5 x 5MB

> http://no.url.available

> This is the Wii System Menu v.1.0 (NTSC-U) dumped from 
Wii Menu Changer v.2

Thanks to all our supporters!

 

[G0dLiKe]

Yah, finally its released

*rushes off to his usenet dl engine* xD

 

[Abkarino]

RVL.Systemmenu.v1.0.Wii-OneUp_iNT

> RVL.Systemmenu.v1.0.Wii-OneUp_iNT

> Region Free

> Wii System Menu v.1.0

ÂÂ> 2010-09-01

> 5 x 5MB

> http://no.url.available

> This is the Wii System Menu v.1.0 (NTSC-U) dumped from 
Wii Menu Changer v.2

Thanks to all our supporters!

Great news i hope that some one here or in any other place can run this DEV tool on any retail Wii so maybe that will help in fixing our bricked Wii also