# iQue Player hacking possibility with ique_diag.exe?



## HNKii (Apr 7, 2017)

ique_diag.exe is a diagnosis software for the iQue Player, bundled with the latest [email protected] update V1.4.2 2005101909. (The latest version has a "diagnosis" feature, which probably uses ique_diag.exe
The latest version is neither downloadable here:http://ique.com/products/M_athome.htm, nor is it included on any disk. It can only be aquired after running the update utility.
(The update server went defunct even before the iQue Player shop shutdown, so there's no way to obtain the update officially now. My [email protected] was updated to the latest version in mid-2013)
The executable is located at [email protected]/pkgs/diag.
The software requires hooking an iQue Player to it(not possible if your computer/virtual machine is 64-bit as iQue Player only has a 32-bit driver)but can actually be run without running the entire [email protected] software, though.
Here are all the commands for ique_diag.exe:





*This exe might be helpful for iQue Player hacking because it extracts tickets and other stuff from the iQue Player, and I've not yet seen any attempts to hack the iQue Player tried using this tool.


Download:http://www.mediafire.com/file/g1xaf6q9k84y5ah/ique_diag.exe*


----------



## HNKii (Apr 7, 2017)

I played around with ique_diag.exe and found out what some of the commands do:
B: Initializes the iQue Player (Called BB Controller internally) hooked to the PC. No commands can be run without initializing.
A: Possibly uses to check if the iQue card is inserted into the iQue Player.
C: Prints stats of the iQue Player:




These "blocks" are not the same unit as the blocks presented to the user at [email protected] My iQue card has 28 free blocks out of all 240 blocks in terms of the "blocks" displayed on [email protected] client.
I: Gets player identity




GI~GU: writes the corresponding info from the iQue Player into a file. Say, if I use GT tickets.dat, a ticket.dat file will be created in the same directory as ique_diag.
H ledval: I didn't figure out what LED pattern comes from what LED value yet.
J: Possibly syncs the iQue Player's internal clock to that of the PC as there is no time setting option for this command. I cannot test it as my iQue Player's clock battery is dead.
L: Gets all the contents *currenly installed* on iQue Player.
Here's mine:




The content id is in Hex. Translate to Dec to get the original ID.
For instance, the largest file has id 201358, which is 2102104 in Dec.
21012104 is the game Paper Mario. (21021 is Paper Mario's internal code, as can be seen on iQue's website&Game Manual.)
The game size matches the size of the corresponding size of the encrypted cache file for that game( Unit: Bytes)
[Paper Mario occupies 160 blocks shown on iQue Player client.]
For the smaller games, say 201678, is 2101904 in Dec.
That's Paper Mario's on-console manual. (The first four digits are the same, the fifth digit changes into 9 for manuals) Size matches that of its corresponding cache file.
[Paper Mario Manual occupies 2 blocks shown on client]
*On-console manuals can be executed as games on iQue Player, and the're recoginized always as purchased titles.*

 *The last two digits don't have to be the same for manuals and games, but there's still a pattern:
Encrypted cache files with only the last two digits different have almost, if not 100%, identical sizes, and only the caches with the largest ending digit gets downloaded from the server if a user is sending a request to purchase, trial or retrieve a games from server.
So I guess the last 2 digits might be the version indicator.

U\M\R: Gets, restores and removes the corresponding game/manual from/to iQue Player.
<del>Getting a game to file will create a file that's identical to the corresponding cache downloaded from server and included in [email protected] download.
(Files match on MD5)</del>
*Edit: they do not match with server downloads. I am terribly sorry for this error.*


----------



## HNKii (Apr 7, 2017)

Some useful information on game id and their encrypted caches:

Download link for encrypted game cache from server
http://cds.idc.ique.com:16963/cds/download?content_id=x
(*old version is guessed, not 100% sure)

x:
10000003-Unknown, included in [email protected] download from iQue.com
1082-Unknown, included in [email protected] download from iQue.com
1101104-Super Mario 64
1101902-SM64 Manual(old version)
1101906-SM64 Manual
1102101-Yoshi's Story
1102902-Yoshi's Story manual(old version)
1102904-Yoshi's Story manual(old version)
1102906-Yoshi's Story manual
1106-Unknown,not included in older versions of [email protected], and only available in the update version(like ique_diag.exe?)
1201105 - Super Smash Bros.
1201901- SSB manual
2101104-Ocarina of Time
2101902-OOT manual (old)
2101904-OOT manual
2102104-Paper Mario
2102902-PM manual (old)
2102904-PM manual
2104108 - Animal Crossing
2105103 - Custom Robo
4101104-Star Fox (old version)
4101105-Star Fox
4101902-Star Fox manual(old version)
4101904-Star Fox manual
4102103-Sin&Punishment
4102901-Sin&Punishment manual
5101104-Wave Race
5101902-WR manual(old)
5101904-WR manual
5102108 - Excitebike 64
5102902- EB64 manual
5201104-Mario Kart 64(old version)
5201105-Mario Kart 64
5201902-MK64 manual(old)
5201906-MK64 manual
5202103-F-Zero
5202902-F-Zero Manual(old)
5202904-F-Zero Manual
6101104-Dr.Mario
6101902-Dr.Mario Manual(old version)
6101904-Dr.Mario Manual

*I'm not sure if this list is complete! If anyone can make a crawler for http://cds.idc.ique.com:16963/cds/download?content_id=, please do find all the files!

Other files found:
10XX&11XXes: Unknown, possibly for iQue Player Firmware updates:
1009
1010
1011
1012
1013

1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054

1062

1071
1072

1091

1095

1099*

*1101

10000000+s: Unknown, also possibly for iQue Player Firmware updates:
10000001
10000002

*
**Explanations on Game IDs:


Spoiler



iQue Player games/server notes from HNK, Kenny, and DKL3:

cds.idc.ique.com:16963/cds/download?content_id=x

* 1000-1100 are probably firmware updates, as are 10000001-10000003
* 2106101 ID is an all new game...
* The first digit in the numbers defines the game's genre. Use this pic for reference: https://files.catbox.moe/uq3hl1.png
** 11 titles are platformers
** 12 titles are fighting games
** 21 titles are RPGs
** 41 titles are shooters
** 51 titles are sports games
** 52 titles are racing games (subgenre)
** 61 titles are puzzle games

* The 2106101 ID falls under the RPG, like Ocarina of Time. Could this be the lost 15th iQue game--Majora's Mask?
* In addition, 2106101 cannot be purchased:
** Super Mario 64 page: http://osc.idc.ique.com:16976/osc/public/htm?OscAction=purchase_title&playerID=undefined&titleID=11011&locale=&OscSessId=""
** Mysterious game: http://osc.idc.ique.com:16976/osc/public/htm?OscAction=purchase_title&playerID=undefined&titleID=21061&locale=&OscSessId=""

*The manuals have the 5th digit as a '9', whereas the games would have a '1'. Refer here again: https://files.catbox.moe/uq3hl1.png . Often, the very last digit is either 1-6, never 7-9.


----------



## Kevinpuerta (Apr 7, 2017)

Hope this works. The fact that it can get the games tickets means we can probably use it with the unknown formatted game files for it.

--------------------- MERGED ---------------------------

Im wondering, the ique can be read from the video and power cord that im buying, but it also has a separate usb plug thst was used for the [email protected] I dont have time now but tomorrow im going to check if using the usb cord to the pc with this program, if it can read and write to the Ique. Ill post the results tomorrow.


----------



## Byokugen (Apr 7, 2017)

2-3 years ago, se dude managed to dump and upload some games to the iQue. I can't remember where the post was, i think i have it stashed on my home server somewhere. Will have to dig it up, I know I saved all data he uploaded


----------



## Sliter (Apr 7, 2017)

this is really interesting!
do it have any acess to the FW? like, I was thinking if it gonna be possible do something like NES/Famicom mini that they found a way to add games there or even a cfw that let it even play more games? hahaha
(I should get a Ique before that, because I'm sure it's price gonna increase crazily after that e3e)


----------



## Kevinpuerta (Apr 7, 2017)

So im back. Found the usb wire for the ique. Time to test it out.


----------



## ScarletDreamz (Apr 7, 2017)

A win32 console program which allows for reading and writing data to the iQue flash chip has been created using Cypress USB drivers and it is possible to construct a cartridge emulator for the machine.  More information  [Dead Link]

@HNKii here: http://nintendoage.com/forum/messageview.cfm?catid=22&threadid=63348
Try to contact : That Old Au Guy

Some extra info ;D
https://blogs.fsfe.org/stefan.a/2008/12/23/the_chinese_nintendo_64_ique/


----------



## Sliter (Apr 7, 2017)

ScarletDreamz said:


> . More information [Dead Link]


I remind looking tis site times ago ....
but well we sitll can have a look (everybody remember to make a backup just in case xD)
https://web.archive.org/web/20130803171347/http://www.crazynation.org/N64/IQUE/ique.htm


----------



## ScarletDreamz (Apr 7, 2017)

Sliter said:


> I remind looking tis site times ago ....
> but well we sitll can have a look (everybody remember to make a backup just in case xD)
> https://web.archive.org/web/20130803171347/http://www.crazynation.org/N64/IQUE/ique.htm



Yeah, i use web archive for this kind of situation lol.


----------



## Sliter (Apr 7, 2017)

right XD
well a strange idea come up here since they don't produce this or sell the games any more, what if we ask the iQue guys about it? lololol

by the way I'm curious about the multiplayer .. I know that the IQue have an acessory to add "just controllers" and be abe to play it in multiplayer, also saw a guy that used the Ique as a common n64 controller... so it would be so much complex to connect the common controllers on a Ique or better look the accessory for that? XD
I'm not sure if it have any hardware


----------



## Kevinpuerta (Apr 7, 2017)

Keep getting BADHANDLE errors


----------



## Byokugen (Apr 7, 2017)

Kevinpuerta said:


> Keep getting BADHANDLE errors


What commands did you try? Also, windows version?


----------



## Kevinpuerta (Apr 7, 2017)

First (B) to sync the system
Then (L) to cooy the contents.


----------



## Zhongtiao1 (Apr 7, 2017)

HNKii said:


> Some useful information on game id and their encrypted caches:
> 
> Download link for encrypted game cache from server
> http://cds.idc.ique.com:16963/cds/download?content_id=x
> ...



If you replace the contentid=x with the contentid of the game it automatically downloads it for you


----------



## Kevinpuerta (Apr 7, 2017)

Zhongtiao1 said:


> If you replace the contentid=x with the contentid of the game it automatically downloads it for you


Ill try that.


----------



## Byokugen (Apr 7, 2017)

Did you update? @HNKii posted some usefull stuff


----------



## Kevinpuerta (Apr 7, 2017)

Sliter said:


> right XD
> well a strange idea come up here since they don't produce this or sell the games any more, what if we ask the iQue guys about it? lololol
> 
> by the way I'm curious about the multiplayer .. I know that the IQue have an acessory to add "just controllers" and be abe to play it in multiplayer, also saw a guy that used the Ique as a common n64 controller... so it would be so much complex to connect the common controllers on a Ique or better look the accessory for that? XD
> I'm not sure if it have any hardware


Ive seen that too. Im going to try and open my ique swim box and see if I can solder some n64 controller extension cords to it.
Also I found this wierd port at the back of it


----------



## Zhongtiao1 (Apr 7, 2017)

Kevinpuerta said:


> Ive seen that too. Im going to try and open my ique swim box and see if I can solder some n64 controller extension cords to it.
> Also I found this wierd port at the back of it




A serial or parallel port variant?

Sent from my Q5 using Tapatalk 2


----------



## Kevinpuerta (Apr 7, 2017)

Zhongtiao1 said:


> A serial or parallel port variant?
> 
> Sent from my Q5 using Tapatalk 2


Do you think its for the swim controllers pinout?


----------



## Zhongtiao1 (Apr 7, 2017)

Kevinpuerta said:


> Do you think its for the swim controllers pinout?



Probably, or for a planned accessory.

Sent from my Q5 using Tapatalk 2


----------



## Zhongtiao1 (Apr 8, 2017)

HNKii said:


> ique_diag.exe is a diagnosis software for the iQue Player, bundled with the latest [email protected] update V1.4.2 2005101909. (The latest version has a "diagnosis" feature, which probably uses ique_diag.exe
> The latest version is neither downloadable here:http://ique.com/products/M_athome.htm, nor is it included on any disk. It can only be aquired after running the update utility.
> (The update server went defunct even before the iQue Player shop shutdown, so there's no way to obtain the update officially now. My [email protected] was updated to the latest version in mid-2013)
> The executable is located at [email protected]/pkgs/diag.
> ...



What happens if you try to store a game downloaded from the servers using the BBCStoreContent?


----------



## Kevinpuerta (Apr 8, 2017)

Zhongtiao1 said:


> What happens if you try to store a game downloaded from the servers using the BBCStoreContent?


I havent tried that. I dont know where the game files are or where I can download them.

--------------------- MERGED ---------------------------



Zhongtiao1 said:


> What happens if you try to store a game downloaded from the servers using the BBCStoreContent?


OP afaik doesnt have the files either.


----------



## Kevinpuerta (Apr 8, 2017)

Found this video a while back and it looks like the guy modded the card with a 4 way dip switch and it allows for every dip switch combo to act like a different memory card. I remeber at some point he offered this as a service and installed games.
Cant understand chinese. Can anyone find out what hes saying

Video:

http://m.youku.com/video/id_XNjg4OTg0MzUy.html?from=s1.8-1-1.2


----------



## Sliter (Apr 8, 2017)

Kevinpuerta said:


> Found this video a while back and it looks like the guy modded the card with a 4 way dip switch and it allows for every dip switch combo to act like a different memory card. I remeber at some point he offered this as a service and installed games.
> Cant understand chinese. Can anyone find out what hes saying
> 
> Video:
> ...


it want me do download an apk õ3o I cant just watch idk




Kevinpuerta said:


> Ive seen that too. Im going to try and open my ique swim box and see if I can solder some n64 controller extension cords to it.
> Also I found this wierd port at the back of it



interesting XD maybe an "HD" port to be able to put more game sor something? I don't think it would get something like 64DD , right? hahaha


----------



## HNKii (Apr 8, 2017)

Zhongtiao1 said:


> What happens if you try to store a game downloaded from the servers using the BBCStoreContent?


I have tried that, and I think it works just as if you write the game onto card on client.
However, if you're trying to store a game into a slot other than the one it was intended for, the game won't show up on iQue(Say, writing paper Mario (2102104) into empty slot 2103104


----------



## Sliter (Apr 8, 2017)

HNKii said:


> I have tried that, and I think it works just as if you write the game onto card on client.
> However, if you're trying to store a game into a slot other than the one it was intended for, the game won't show up on iQue(Say, writing paper Mario (2102104) into empty slot 2103104


you can't edit the file to place another game instead ?


----------



## HNKii (Apr 8, 2017)

Sliter said:


> you can't edit the file to place another game instead ?


The files are encrypted. Not sure what kind of editing would work.


----------



## Sliter (Apr 8, 2017)

HNKii said:


> The files are encrypted. Not sure what kind of editing would work.


oh right :x


----------



## HNKii (Apr 8, 2017)

Kevinpuerta said:


> Found this video a while back and it looks like the guy modded the card with a 4 way dip switch and it allows for every dip switch combo to act like a different memory card. I remeber at some point he offered this as a service and installed games.
> Cant understand chinese. Can anyone find out what hes saying
> 
> Video:
> ...


I don't think there's anything technical in there. It's just a demonstration on how it would work.
If anyone can't view the video w/o downloading APK, here it is:
http://v.youku.com/v_show/id_XNjg4OTg0MzUy.html?from=s1.8-1-1.2&spm=a2h0k.8191407.0.0

Edit: Modding iQue card into a combo-4 version probably probably doesn't mean hacking the iQue Player is successful. Otherwise, why didn't he make a single 256-MB card instead?


----------



## Sliter (Apr 8, 2017)

HNKii said:


> I don't think there's anything technical in there. It's just a demonstration on how it would work.
> If anyone can't view the video w/o downloading APK, here it is:
> http://v.youku.com/v_show/id_XNjg4OTg0MzUy.html?from=s1.8-1-1.2&spm=a2h0k.8191407.0.0
> 
> Edit: Modding iQue card into a combo-4 version probably probably doesn't mean hacking the iQue Player is successful. Otherwise, why didn't he make a single 256-MB card instead?


so it's possible to get games that you haven't bought there ?but to edit games to make them work there nothing yet, right ? his card had some mod? what was that red thing ?


----------



## HNKii (Apr 8, 2017)

Sliter said:


> so it's possible to get games that you haven't bought there ?but to edit games to make them work there nothing yet, right ? his card had some mod? what was that red thing ?


I'm not sure if writing unpurchased games would work( I already owned all 14 games when I tried out this tool.
He hacked the card to work like 4 individual cards. The red stuff is a switch that switches between the 4 individual cards in the iQue Player.


----------



## Sliter (Apr 8, 2017)

HNKii said:


> I'm not sure if writing unpurchased games would work( I already owned all 14 games when I tried out this tool.
> He hacked the card to work like 4 individual cards. The red stuff is a switch that switches between the 4 individual cards in the iQue Player.


hmm well you coult try to dump them and then send to Kevin so he can try doing it? xD also me if I get one ...


----------



## Kevinpuerta (Apr 8, 2017)

HNKii said:


> I'm not sure if writing unpurchased games would work( I already owned all 14 games when I tried out this tool.
> He hacked the card to work like 4 individual cards. The red stuff is a switch that switches between the 4 individual cards in the iQue Player.


Do you know why the program isnt letting me do anything with the ique? It detects it when typing (B) into the command line

The guy flashed the cart to work as 4 different carts. The ique is linked to one cart and its locked. You cant share an ique memory card with another ique system. The one that included with the system cant be used on ther systems.


----------



## HNKii (Apr 8, 2017)

Sliter said:


> hmm well you coult try to dump them and then send to Kevin so he can try doing it? xD also me if I get one ...


Dump the games? Like I mentioned in my earlier posts, the games dumped from iQue card with iQue_diag are all encrypted files identical to download from http://cds.idc.ique.com:16963/cds/download?content_id=x
(x=content id in Dec)
I do have identity, cert, privatedata,crls, tickets and userdata dumped, if you're interested.

--------------------- MERGED ---------------------------



Kevinpuerta said:


> Do you know why the program isnt letting me do anything with the ique? It detects it when typing (B) into the command line
> 
> The guy flashed the cart to work as 4 different carts. The ique is linked to one cart and its locked. You cant share an ique memory card with another ique system. The one that included with the system cant be used on ther systems.


Are you using a 32-bit Windows operating system? If you can't get ique_diag to work, try if the [email protected] software itself detects your iQue Player.


----------



## Kevinpuerta (Apr 8, 2017)

It is a 32 bit system. The ique is recognized in my drivers as (Ique player) in the unidentified tab

--------------------- MERGED ---------------------------

Actually I just remembered that its 64 bit, but I do have an old 32 bit one. Im going to check. Also i thought the operating system had to be windows xp for it to be read? I guess not since it works with 7 and 8.


----------



## Krem Quay (Apr 8, 2017)

Hello, I'm a contact of HNK's. It's been almost 3 years since my last post, and I'm about to do another. While I'm not good at hex editing, I am able to look for human-readable strings.

HNK shared the dumped info, including the encrypted titlekeys, for the games on his iQue system. Download here: https://files.catbox.moe/3n5np9.zip

The tickets file has all the good stuff--most of the text is not readable but I have a few interesting things to note:

After each key, the ISBN for the game is listed. Every iQue product has an ISBN, and if you can identify them, figuring out which title key is which will be easy.

After the ISBN is listed, it's followed by a lot of zeroes (until you get to the next title key): https://files.catbox.moe/do4ca2.png





After all the zeroes, another title key will come up. It seems to start with the encrypted title keys (at least I figure). It is then followed by the Root-CPCA00000108-CP0000011 text (whatever that is). For example:






That's all the hex editing of the tickets file I've done thus far, but i've left the files above for you guys to dig through.

--------------------- MERGED ---------------------------

https://archive.org/details/iQuePlayerEncryptedGames

Additionally, the encrypted titles for every title can be downloaded from here. I uploaded this to IA last month.

--------------------- MERGED ---------------------------

Ok, sorry for a triple post but on that page, I recommend downloading the Gamecache.zip since the titles are easily identifiable. HnKii also provided this to me--we've been doing a lot of iQue archiving together.

Download link: https://archive.org/download/iQuePlayerEncryptedGames/GAMECACHE.zip


----------



## Kevinpuerta (Apr 8, 2017)

Krem Quay said:


> Hello, I'm a contact of HNK's. It's been almost 3 years since my last post, and I'm about to do another. While I'm not good at hex editing, I am able to look for human-readable strings.
> 
> HNK shared the dumped info, including the encrypted titlekeys, for the games on his iQue system. Download here: https://files.catbox.moe/3n5np9.zip
> 
> ...


Thankyou to both of you


----------



## Krem Quay (Apr 8, 2017)

You're most welcome. It surprises me how the iQue Player games have not been cracked, and since support for the system has ended, I think now is the perfect time to crack the system.


----------



## Kevinpuerta (Apr 8, 2017)

Krem Quay said:


> You're most welcome. It surprises me how the iQue Player games have not been cracked, and since support for the system has ended, I think now is the perfect time to crack the system.


I think if more people owned the ique, then it someone would have cracked it long ago. I guess there just isnt enough interest in the system.


----------



## Krem Quay (Apr 8, 2017)

Alright, so any updates? I cannot figure out the whole title key thing--how do you get like the common key and then decrypt further?


----------



## Zhongtiao1 (Apr 8, 2017)

Krem Quay said:


> Alright, so any updates? I cannot figure out the whole title key thing--how do you get like the common key and then decrypt further?



Is there any difference between a dumped game and a downloaded game from the ique site?

Sent from my Q5 using Tapatalk 2


----------



## Sliter (Apr 8, 2017)

Kevinpuerta said:


> It is a 32 bit system. The ique is recognized in my drivers as (Ique player) in the unidentified tab
> 
> --------------------- MERGED ---------------------------
> 
> Actually I just remembered that its 64 bit, but I do have an old 32 bit one. Im going to check. Also i thought the operating system had to be windows xp for it to be read? I guess not since it works with 7 and 8.


I heard somewhere that it had to be XP, but maybe someone did something for it on new systems ?



Krem Quay said:


> You're most welcome. It surprises me how the iQue Player games have not been cracked, and since support for the system has ended, I think now is the perfect time to crack the system.


I wish I could help here more ... maybe if I get one but I still a nothing for these programing stuff :x
The iQue Palyer was planned to go more on third world countries(probably with other names XD), I think we just don't had this is Brazil because The nintendo representative we had here where giving up about nintendo products :/ well I wanted one since I head about it and was a long time ago, I think it still had support? (well, I remind talking about it first time at MSN lolol)


Kevinpuerta said:


> I think if more people owned the ique, then it someone would have cracked it long ago. I guess there just isnt enough interest in the system.


yeah if it gave got more popular, of course a lot of hacking could have come, just like the nes/famicom mini
But I'm sure it could have get some attention if we can do something about it now ...for these without a USB connection, selling/trading carts with gasmes for example, and those with USB making it for them :v 
...
btw ... if I got borrowed from someone a card that he have bought his games, it gonna work on my system? or it was system signed like wii/U, DSi and 3DS stuff?


----------



## Krem Quay (Apr 8, 2017)

I don't think I know if there was much difference except the language. I do know Ocarina of Time speedrunners prefer the iQue version, which is faster,  if I'm correct.


----------



## Sliter (Apr 8, 2017)

Krem Quay said:


> I don't think I know if there was much difference except the language. I do know Ocarina of Time speedrunners prefer the iQue version, which is faster,  if I'm correct.


I think he meant if dumping a game and downloading with a download code you get exactly the same file, or if there are any difference.
and sadly, I don't know :x


----------



## Zhongtiao1 (Apr 8, 2017)

Sliter said:


> I think he meant if dumping a game and downloading with a download code you get exactly the same file, or if there are any difference.
> and sadly, I don't know :x





Krem Quay said:


> I don't think I know if there was much difference except the language. I do know Ocarina of Time speedrunners prefer the iQue version, which is faster,  if I'm correct.



I meant download from the cds server that @HNKii linked to and one already on the ique.

Sent from my Q5 using Tapatalk 2


----------



## Kevinpuerta (Apr 9, 2017)

Sliter said:


> I heard somewhere that it had to be XP, but maybe someone did something for it on new systems ?
> 
> 
> I wish I could help here more ... maybe if I get one but I still a nothing for these programing stuff :x
> ...



Yes the sytem can only be used with one memory card. If you lose the memory card or damage it, you cannot replace it.


----------



## Krem Quay (Apr 9, 2017)

Ouch, that's no good. So then you'd have to buy a new iQue system?


----------



## Sliter (Apr 9, 2017)

Kevinpuerta said:


> Yes the sytem can only be used with one memory card. If you lose the memory card or damage it, you cannot replace it.


well.. until now :v hhaah


----------



## Kevinpuerta (Apr 9, 2017)

So my package containing the ique depot usb cable should arrive in 2-4 days. Really hope it does something, not just be an alternative port for usb connection.


----------



## Krem Quay (Apr 9, 2017)

What's your plan again, Kevin?


----------



## Kevinpuerta (Apr 9, 2017)

Use this cable to see if it can read the ique as a storage device or at least give more access to it, or something. Not sure what im expecting to happen.
Just hope the ending outcome of all this is to be able to add unpurchased games or mod games into the ique.

--------------------- MERGED ---------------------------

Or if a different software is included on the disc that can read the ique. I doubt it though.


----------



## Krem Quay (Apr 9, 2017)

All three iQue discs have been dumped already. HNKii actually provided copies of all three--the iQue GBA SP CD-ROM was not dumped by him but rather the dir listing was shared. We're all still waiting for an iso of the iQue GBA SP CD-ROM:

https://archive.org/details/iQuehomeCDROM - [email protected] CD-ROM
https://archive.org/details/iQueGBASP-CDROM - iQue GBA SP CD-ROM
https://archive.org/details/iQueDSCD - iQue DS CD-ROM


----------



## Kevinpuerta (Apr 9, 2017)

Krem Quay said:


> All three iQue discs have been dumped already. HNKii actually provided copies of all three--the iQue GBA SP CD-ROM was not dumped by him but rather the dir listing was shared. We're all still waiting for an iso of the iQue GBA SP CD-ROM:
> 
> https://archive.org/details/iQuehomeCDROM - [email protected] CD-ROM
> https://archive.org/details/iQueGBASP-CDROM - iQue GBA SP CD-ROM
> https://archive.org/details/iQueDSCD - iQue DS CD-ROM



Do you know why my ique isnt being read in the diag.exe? I thought it was, but even when its disconnected it still mounts to something on my pc. This is whats causing the badhandle error I keep getting.


----------



## Krem Quay (Apr 9, 2017)

I don't have an iQue Player to test it out with, but you will need to hook up your iQue Player to your PC as well. You need to type B to sync the iQue Player to the program--at least according to HNKii's post: http://gbatemp.net/threads/ique-player-hacking-possibility-with-ique_diag-exe.466906/#post-7225738

Let me how it works out.


----------



## Zhongtiao1 (Apr 9, 2017)

Kevinpuerta said:


> Do you know why my ique isnt being read in the diag.exe? I thought it was, but even when its disconnected it still mounts to something on my pc. This is whats causing the badhandle error I keep getting.



Do you plug the data cable in after the power cable, or before? That could be it. It's a diagnostic tool, so it may have strict requirements.


----------



## Krem Quay (Apr 10, 2017)

I don't know--there are two options, like you said, and it doesn't hurt to try either


----------



## Sliter (Apr 10, 2017)

Krem Quay said:


> All three iQue discs have been dumped already. HNKii actually provided copies of all three--the iQue GBA SP CD-ROM was not dumped by him but rather the dir listing was shared. We're all still waiting for an iso of the iQue GBA SP CD-ROM:
> 
> https://archive.org/details/iQuehomeCDROM - [email protected] CD-ROM
> https://archive.org/details/iQueGBASP-CDROM - iQue GBA SP CD-ROM
> https://archive.org/details/iQueDSCD - iQue DS CD-ROM


wait, but why are these CD for? for Ique Player ok, I was a idea that it was the program that you use do buy/download games and demos ... but why for gbasp and ds?


----------



## Kevinpuerta (Apr 10, 2017)

Ique gba and ds used cartridges. What do the discs do or contain?


----------



## raulpica (Apr 10, 2017)

I own an iQue GBA SP - now that I think of it, I'm pretty sure that CD is still in the box...


----------



## HNKii (Apr 10, 2017)

Zhongtiao1 said:


> Do you plug the data cable in after the power cable, or before? That could be it. It's a diagnostic tool, so it may have strict requirements.


I plug the power cable, turn the power on, then plug the data cable to my laptop. Otherwise my laptop will force shutdown.

--------------------- MERGED ---------------------------



Sliter said:


> wait, but why are these CD for? for Ique Player ok, I was a idea that it was the program that you use do buy/download games and demos ... but why for gbasp and ds?


The GBASP CD contains a promo movie for 2 GBA games, and has an unused 4-MB file, which is actually a GBA ROM that works as a eBook/manga reader.
The DS CD has a Pictochat promo video, 2 Chinese classic music, and an unused 16-MB file, which is actually a GBA ROM that works as a media player.
In the readme file of the DS CD, iQue mentioned a "Safety cartridge", that players are supposed to hook it to the PC and download the file into the cartridge to play media on GBASP/GBM/DS.
Some people believe it was iQue's plan to make their own media player, until the plan got scrapped and they began to sell the Japanese Play-yan instead.

--------------------- MERGED ---------------------------



Zhongtiao1 said:


> Is there any difference between a dumped game and a downloaded game from the ique site?
> 
> Sent from my Q5 using Tapatalk 2


No, there isn't. The files match in MD5.


----------



## Kevinpuerta (Apr 10, 2017)

raulpica said:


> I own an iQue GBA SP - now that I think of it, I'm pretty sure that CD is still in the box...


Can you check?

--------------------- MERGED ---------------------------



HNKii said:


> I plug the power cable, turn the power on, then plug the data cable to my laptop. Otherwise my laptop will force shutdown.




Alright il check. Do you know why my second I que isnt even dedected as usb? Nothing happens when its pluged in. Could it be that I never pluged it into a card machine and never downloaded games to it?[/QUOTE]


----------



## Sliter (Apr 11, 2017)

I've found the image but not the site or infos :T





but loos very easy to make an adapter like this XD
Is just a iQue controller without a system "ported" to a common 64 entry... well :B


oh look, more stuff but just photos again :x
seems like hacked? õ3o
http://s36.photobucket.com/user/DarthCloud/library/ique?sort=3&page=1


----------



## Byokugen (Apr 11, 2017)

@Kevinpuerta what's the status?


----------



## Kevinpuerta (Apr 11, 2017)

Sliter said:


> I've found the image but not the site or infos :T
> 
> 
> 
> ...



He also tried what we are trying(dumping and hacking ique) He also moded the controller to work with the n64 and he also soldered a memory card to it.
Im going to try the opposite, im going to see if I can open a 2nd swim box im getting in an hour or so to see if can solder a n64 extension cord to it and see if n64 controllers work on ique.

--------------------- MERGED ---------------------------



Byokugen said:


> @Kevinpuerta what's the status?


I didnt have time to try it but in an 1 hour or 2 i should get my ique depot wires. Ill try then and post later.


----------



## Kevinpuerta (Apr 11, 2017)

Arrived
Ique depot disc,cable,box
Swim box
Ique extension


----------



## Kevinpuerta (Apr 12, 2017)

Heres the page, it has the ique pinout. It unavailable since assembler.com is being rebuilt. 

http://assemblergames.com/l/threads/ique-player-s-video-cable-mod-d-ique-pinout.32934/


----------



## Kevinpuerta (Apr 12, 2017)

I managed to open my swim box


----------



## Krem Quay (Apr 12, 2017)

raulpica said:


> I own an iQue GBA SP - now that I think of it, I'm pretty sure that CD is still in the box...



Would you like to make an iso dump of the disc?


----------



## Krem Quay (Apr 12, 2017)

Kevinpuerta said:


> Heres the page, it has the ique pinout. It unavailable since assembler.com is being rebuilt.
> 
> http://assemblergames.com/l/threads/ique-player-s-video-cable-mod-d-ique-pinout.32934/



https://archive.is/VTsV2 - Bing Cache is your friend


----------



## Kevinpuerta (Apr 12, 2017)

Krem Quay said:


> https://archive.is/VTsV2 - Bing Cache is your friend


Thanks, wayback machine wasn't working. Im about to try the controller right now.


----------



## Krem Quay (Apr 12, 2017)

You're welcome. So what are you attempting?


----------



## Krem Quay (Apr 12, 2017)

http://club.tgfcer.com/viewthread.php?tid=7143235 - Also, I found this thread, which links to that AssemblerGames thread. It's a Chinese forum thread on the iQue Player.


----------



## Kevinpuerta (Apr 12, 2017)

Krem Quay said:


> You're welcome. So what are you attempting?


I couldnt get the ique to work on my pcs so I gave up. I did get an original n64 control to work with the ique. Ill post pics and video later


----------



## Krem Quay (Apr 12, 2017)

Whoa, nice. I'd love to see photos, thanks.

Is it possible to somehow dump the iQue BIOS from that n64 you've hooked it to?


----------



## Kevinpuerta (Apr 12, 2017)

Pictures


----------



## Krem Quay (Apr 12, 2017)

Wow! That's incredible! Are you a hardware engineer or something?


----------



## HNKii (Apr 12, 2017)

Kevinpuerta said:


> Can you check?
> 
> --------------------- MERGED ---------------------------
> 
> ...


[/QUOTE]
iQue Players should have a paid game and some trial titles installed by default. iQue players sometimes do fail to connect, though


----------



## Kevinpuerta (Apr 12, 2017)

Krem Quay said:


> Wow! That's incredible! Are you a hardware engineer or something?





Krem Quay said:


> Whoa, nice. I'd love to see photos, thanks.
> 
> Is it possible to somehow dump the iQue BIOS from that n64 you've hooked it to?


If you are talking about the multiplayer box,then I dont know. Maybe its possible


----------



## Krem Quay (Apr 12, 2017)

I meant the iQue menu where you can select games from


----------



## Kevinpuerta (Apr 12, 2017)

Krem Quay said:


> Wow! That's incredible! Are you a hardware engineer or something?




hahaha nah all it took was a little bit of soldering and knowing where the wires had to go.

--------------------- MERGED ---------------------------



Krem Quay said:


> I meant the iQue menu where you can select games from


I remember someone trying and they broke there Ique. I dont know if id risk breaking it.


----------



## Krem Quay (Apr 12, 2017)

http://retroactive.be/personal/ique/ - I don't know if I linked this already but this is a detailed notes page on the iQue


----------



## Kevinpuerta (Apr 12, 2017)

Krem Quay said:


> http://club.tgfcer.com/viewthread.php?tid=7143235 - Also, I found this thread, which links to that AssemblerGames thread. It's a Chinese forum thread on the iQue Player.



I found something similar earlier today, the poster also included a nand dump of his ique along with files and icons.

http://lacklustre.net/n64/ique/


----------



## Sliter (Apr 12, 2017)

Kevinpuerta said:


> Pictures


"an expansion port? so let's expand it"
well done! haha


----------



## Kevinpuerta (Apr 12, 2017)

Sliter said:


> "an expansion port? so let's expand it"
> well done! haha


Lol yeah I took advantage of the unused port so I could have the n64 contol plugs


----------



## Krem Quay (Apr 12, 2017)

what is a nand dump again?


----------



## Kevinpuerta (Apr 12, 2017)

Pretty much the whole sytems memory is in the nand dump. I think bios too.


----------



## Krem Quay (Apr 12, 2017)

Yeah, well the guy said it was a partial dump.


----------



## Kevinpuerta (Apr 12, 2017)

Not sure if it matters or not but when I inserted the depot disc it started download game files and those files were put in a cache folder.


----------



## Krem Quay (Apr 12, 2017)

Those are the same encrypted games we've been trying to crack.


----------



## Kevinpuerta (Apr 12, 2017)

Krem Quay said:


> Those are the same encrypted games we've been trying to crack.


Oh

--------------------- MERGED ---------------------------

Video


----------



## Krem Quay (Apr 12, 2017)

You know, i'm pretty sure that text before the ROOT CPCA is the encrypted titlekey or something.


----------



## Kevinpuerta (Apr 12, 2017)

Those random symbols might be it.


----------



## Krem Quay (Apr 12, 2017)

It's a little over 32 characters, and from what I know, Wii/Wii U title keys are around that size.


----------



## Kevinpuerta (Apr 12, 2017)

Krem Quay said:


> It's a little over 32 characters, and from what I know, Wii/Wii U title keys are around that size.


Yeah but how would we decrypt those or what would we need to do?


----------



## Krem Quay (Apr 12, 2017)

Extensive research on title keys (tickets) of Nintendo systems, especially the Wii, which probably has the most similar encryption method.


----------



## Kevinpuerta (Apr 12, 2017)

Couldnt we see if someone on here could help. If it similar to wii or other systems, then someone with the experience could probably do it. 
We need to reach out to someone who has the experience on these kind of things.


----------



## Krem Quay (Apr 12, 2017)

Yes, i agree. This is just leaving me really confused when i try to tfigure this out.


----------



## Byokugen (Apr 12, 2017)

I dont why you are unable to sync it with pc, I would love to help somehow. I will dl all the archives and start probing around. I need to get my hands on one asap


----------



## asper (Apr 12, 2017)

Well, .rec file is the game that, reading the above link, is encrypted with a per-console specific key that probably is inside recrypt.sys. Keys are usually 16bytes and Nintendo encryption formats are (read here and here for more info):

0x010000 RSA_4096 SHA1 (Unused for 3DS) 0x200 0x3C
0x010001 RSA_2048 SHA1 (Unused for 3DS) 0x100 0x3C
0x010002 Elliptic Curve with SHA1 (Unused for 3DS) 0x3C 0x40
0x010003 RSA_4096 SHA256 0x200 0x3C
0x010004 RSA_2048 SHA256 0x100 0x3C
0x010005 ECDSA with SHA256 0x3C 0x40

Also more info about Nintendo ticket system can be read here.

Then the decrypted game must be decrypted again with a "common key" that must stored somewhere in the system dump.

Can someone post a screenshot of the 1st bytes (at least 0x200) .sys files opened with an hex editor ?

EDIT: 0-8192 partial dump taken from one of the above posted-link is surely encrypted.


----------



## Byokugen (Apr 12, 2017)

So it is possible to do it. Hmmm


----------



## Sliter (Apr 12, 2017)

Kevinpuerta said:


> Lol yeah I took advantage of the unused port so I could have the n64 contol plugs


whenyou told, I was thinking something like the the image I sent, an individual adaptor per controller, but going inside and making a "second option" slot was nice hehhe

Now let's see about the games... there where was any progress?:x and about the one I gonna get from you? XD


----------



## Krem Quay (Apr 12, 2017)

asper said:


> Well, .rec file is the game that, reading the above link, is encrypted with a per-console specific key that probably is inside recrypt.sys. Keys are usually 16bytes and Nintendo encryption formats are (read here and here for more info):
> 
> 0x010000 RSA_4096 SHA1 (Unused for 3DS) 0x200 0x3C
> 0x010001 RSA_2048 SHA1 (Unused for 3DS) 0x100 0x3C
> ...



Sure, I can help with that.

recrypt.sys (the rest is followed by zeroes):







recrypt-marsh.sys (the rest is followed by zeroes):





timer.sys:


----------



## asper (Apr 12, 2017)

Krem Quay said:


> You know, i'm pretty sure that text before the ROOT CPCA is the encrypted titlekey or something.



what is the name of this file? Can you screenshot the 1st 0x800 bytes?


----------



## Krem Quay (Apr 12, 2017)

asper, the filename is "tickets", and it was a part from HNKii's dump diagnostics dump. Download here: -snip-

--------------------- MERGED ---------------------------

Also, how do I screencap that many bytes? Wouldn't it be easier if you reviewed the file yourself?


----------



## asper (Apr 13, 2017)

It is copyrighted material, you shouldn't post those files here I suppose.


----------



## Krem Quay (Apr 13, 2017)

Ok sorry, well I just wanted you download, since it's easier if you can have a look at it yourself. I cannot screencap 0x800 bytes though.


----------



## GHANMI (Apr 13, 2017)

If I may ask, were the iQue N64 games ever converted to regular ROM files?
And that "mystery game" might be Majora's Mask, considering its iQue version was cancelled very late in development.


----------



## Krem Quay (Apr 13, 2017)

GHANMI said:


> If I may ask, were the iQue N64 games ever converted to regular ROM files?
> And that "mystery game" might be Majora's Mask, considering its iQue version was cancelled very late in development.



Yeah, I agree that it's Majora's Mask. And no, that's what the thread is for--figuring out how to crack the files.


----------



## GHANMI (Apr 13, 2017)

Can't they be sniffed out of the hardware during runtime?
Kind of like the Wii U universal keys were obtained, or Wii U discs were dumped using a modded optical drive as it's running. (though this would be destructive to an already dwindling supply of iQue's)

Aside from this (not so informed) question, I wish you success. I find these versions quite intriguing.


----------



## Krem Quay (Apr 13, 2017)

I made some comments earlier in the thread with some discoveries that I made. I can't hex edit well, so I did all that I could really.

Me and others agree that the encryption is similar to Wii & 3DS titles.


----------



## Zhongtiao1 (Apr 13, 2017)

Krem Quay said:


> I made some comments earlier in the thread with some discoveries that I made. I can't hex edit well, so I did all that I could really.
> 
> Me and others agree that the encryption is similar to Wii & 3DS titles.



Have the commands had any success pushing a game to the ique? 

Also, if you could route the network traffic from the [email protected] software when you download a game to the unknown one, it may trick it into loading the unknown game onto the ique. Then we could see what it is.

Sent from my Q5 using Tapatalk 2


----------



## Krem Quay (Apr 17, 2017)

asper said:


> It is copyrighted material, you shouldn't post those files here I suppose.



Did you get to decrypting the titles yet?


----------



## asper (Apr 18, 2017)

Krem Quay said:


> Did you get to decrypting the titles yet?


I had just a quick look and found the following stuff (far away from being correct, just speculations):

1 - Crls file starts with 00000001 while Wii tickets starts with 00010001 and I think signature type is
RSA_2048 SHA1 with signature size 0x100 (it matches) even if zero-padding size is not matching.

2 - downloaded games are identical to games found in GAMECACHE.zip so I suppose they are encrypted just 1 time because when I download a file the server cannot know my ique id because I am downloading from a device different from ique: maybe someone can check if a game inside gamechache is different or identical compared to a game present in another ique folder (are there other ique folders? http://retroactive.be/personal/ique/): if it is the case we have the same file with a second encryption and GAMECAHCE files are already decrypted against this second encryption. Reading HERE those double-encrypted files should be .rec files. If so you have a single-encrypted game and the same game double-encrypted, this can be useful to get the encryption algorythm (maybe debugging the .exe ? In the above link it is stated that the second encryption is made by the clien using device pubkey). Files inside 3n5np9.zip "should" be the following if compared to the above link information:
cert = cert.sys
Crls = crl.sys
identity = id.sys
PrivateData = depot.sys
tickets = ticket.sys
(you can find more files to compare in the same above link)

3 - Another good thing is that, if my above statement about 1st and 2nd encryption is true (i do not have an ique unit to test), you can also have a full decrypted game downloading it form some N64 rom sites so you can have all the 3 form of the same file:
- unencrypted form (from rom sites),
- single-encrypted form (from http://cds.idc.ique.com)
- double-encrypted form (from single console unit under .rec file form)
to test some encryption algorythms !

4 - in my humble opinion tickets (or tickets.sys) is encrypted.

Now the "only" missing thing seems to be the encryption key (or encryption keys).

@crediar and/or @FIX94 and/or @dimok may help.


EDIT: there is the possibility about an sqlinjection "problem" in cds.idc.ique ...


----------



## Krem Quay (Apr 18, 2017)

asper said:


> EDIT: there is the possibility about an sqlinjection "problem" in cds.idc.ique ...



Whoa, sqlinjection problem? What do you mean by that?


----------



## raulpica (Apr 22, 2017)

Krem Quay said:


> Would you like to make an iso dump of the disc?


Yep, sure. I'll just have to dig the box out. Not sure where I placed it...


----------



## Krem Quay (Apr 30, 2017)

Any updates yet?


----------



## comix88 (May 17, 2017)

About *ique_diag.exe  ，*How to ues the GI~GU？？


----------



## Matts (Jun 21, 2017)

Hey guys I'm new to this forum. I've wanted a ique forever and now I realize that they've taken down the online service. I read this whole thread and it goes over my head but has anyone figured out how to get these games on the system?
Thanks Matt


----------



## Kevinpuerta (Jun 26, 2017)

Matts said:


> Hey guys I'm new to this forum. I've wanted a ique forever and now I realize that they've taken down the online service. I read this whole thread and it goes over my head but has anyone figured out how to get these games on the system?
> Thanks Matt


No, we haven't yet.


----------



## Krem Quay (Jun 27, 2017)

Yeah, and the frustrating thing is that I've been on #n64dev. A handful of members there have an iQue Player but are not interesting in cracking it.

Even this page (linked from n64dev.org) lists everything except for the iQue Player: https://jrra.zone/n64/

I wonder, what if these encrypted iQue Player games can be added on the Wii as Virtual Console titles? That might be worth something to think about


----------



## Sliter (Jun 27, 2017)

Krem Quay said:


> Yeah, and the frustrating thing is that I've been on #n64dev. A handful of members there have an iQue Player but are not interesting in cracking it.
> 
> Even this page (linked from n64dev.org) lists everything except for the iQue Player: https://jrra.zone/n64/
> 
> I wonder, what if these encrypted iQue Player games can be added on the Wii as Virtual Console titles? That might be worth something to think about


if his is possible, maybe the inverse and inject gonna be possible :/


----------



## Zhongtiao1 (Jun 27, 2017)

Krem Quay said:


> Yeah, and the frustrating thing is that I've been on #n64dev. A handful of members there have an iQue Player but are not interesting in cracking it.
> 
> Even this page (linked from n64dev.org) lists everything except for the iQue Player: https://jrra.zone/n64/
> 
> I wonder, what if these encrypted iQue Player games can be added on the Wii as Virtual Console titles? That might be worth something to think about



Easy enough to try, there are tutorials for injecting. Personally, I don't think it will work as the virtual console titles are just emulators and emulators like mupen64 don't run iQue games

Edit: Also, the iQue Player isn't actually an n64. It's a plug-and-play console.

Sent from my Q5 using Tapatalk 2


----------



## Krem Quay (Jun 29, 2017)

I talked to an individual (who I'll keep anonymous) about the iQue Player, and he said that glitching the system could be a possibility.

Basically what he means is the system on chip should have a reset button. Here is what he said (i don't know a handful of the jargon used here):

"Sometimes if you reset the chip while booting a lot of times really fast or during some stage of loading or code execution"
"The person doing it will need to cut a trace on the board, the light green lines under the solder mask with the copper." 
"And they will need to use a beaglebone or rpi or something. And solder it to the trace to trigger resets."
"It might be on.the reset button it would have to be traced, the reset line to the chip."
"It would be good to look for a jtag interface. That might be where data would come out. Otherwise any type of ttl or uart."
"There is a chance of irreparable damage. I would say 50% or so. Also lowering the voltage may help that would require modifying the power block on the circuit board."


----------



## Zhongtiao1 (Jun 29, 2017)

Krem Quay said:


> I talked to an individual (who I'll keep anonymous) about the iQue Player, and he said that glitching the system could be a possibility.
> 
> Basically what he means is the system on chip should have a reset button. Here is what he said (i don't know a handful of the jargon used here):
> 
> ...



How about trying to find a serial port first?


----------



## Krem Quay (Jun 29, 2017)

What is a serial port?

And yeah, also I'm not an engineer--like I said, this was advice someone gave to me.


----------



## Zhongtiao1 (Jun 29, 2017)

Krem Quay said:


> What is a serial port?
> 
> And yeah, also I'm not an engineer--like I said, this was advice someone gave to me.



It's a low level port used mainly nowadays for debug purposes. Connect it to a terminal and everything that the device is doing will be output

Sent from my Q5 using Tapatalk 2


----------



## Krem Quay (Jun 29, 2017)

Do you have an iQue Player to test it on? To be honest, I might try and get an iQue Player some day.


----------



## Zhongtiao1 (Jun 29, 2017)

Krem Quay said:


> Do you have an iQue Player to test it on? To be honest, I might try and get an iQue Player some day.



I've looked into it, but I can't justify getting one since I bought a switch a couple months ago

Sent from my Q5 using Tapatalk 2


----------



## asper (Jun 30, 2017)

I see something like "test pads" (jtag?) in the lower part of this side of the pcb (T7, T8, T9, T10, T12, T13, T14)... if so this will be better than serial 
source


----------



## Zhongtiao1 (Jun 30, 2017)

asper said:


> I see something like "test pads" (jtag?) in the lower part of this side of the pcb (T7, T8, T9, T10, T12, T13, T14)... if so this will be better than serial
> source



I hope you have better soldering skills than me 

Sent from my Q5 using Tapatalk 2


----------



## Sliter (Jul 1, 2017)

Hey Guys, let's back to the start on the simple part
the program used (on the past) to download the games and transfer to the iQue(and backup them from the iQue was possible?), if I'm not wrong we have  someone that got the files for all the games available, right?
but we can't transfer them with the program to any iQue because they where bought for another, right?
We can't hack/ make another program to transfer the files we have instead? I think it would be simpler than hacking the console right now...
About injecting a game, we still can't decompress to see where are the rom, not at least rip the rom from there, right?
I think the way to be possible here is like... if I inject, for example Mario Kart over a Dr. Mario, not having both together  hmmm



Krem Quay said:


> I talked to an individual (who I'll keep anonymous) about the iQue Player, and he said that glitching the system could be a possibility.
> 
> Basically what he means is the system on chip should have a reset button. Here is what he said (i don't know a handful of the jargon used here):
> 
> ...


it's looks like a tutorial to fry the board xAx


----------



## Sliter (Jul 3, 2017)

kinda offtopic but looks what I've found XD 
https://world.taobao.com/item/54450...1.14.79.ebb2eb23eAfyi&ns=1&abbucket=15#detail
kinda of an " portable" iQue hahaha


----------



## Zhongtiao1 (Jul 3, 2017)

Sliter said:


> kinda offtopic but looks what I've found XD
> https://world.taobao.com/item/54450...1.14.79.ebb2eb23eAfyi&ns=1&abbucket=15#detail
> kinda of an " portable" iQue hahaha
> View attachment 91973



It even says Gameboy on the screen


----------



## Sliter (Jul 3, 2017)

Zhongtiao1 said:


> It even says Gameboy on the screen


yeah, looks like they amd eit out of an GB housing +stuff XD  not sure about portability like battery and stuff ...  I don't know chinese OTL


----------



## Kevinpuerta (Jul 3, 2017)

Sliter said:


> yeah, looks like they amd eit out of an GB housing +stuff XD  not sure about portability like battery and stuff ...  I don't know chinese OTL


Yep, ive seen that months ago. Its an lcd screen thats been rewired to work when directly into where the power and video come off of. I was going to try to do it, but I dont want to damage my only video cables.


----------



## Krem Quay (Jul 5, 2017)

Wow, I want that thing.


----------



## Zhongtiao1 (Jul 6, 2017)

If anyone is interested, a swim controller is on sale on ebay

Sent from my Q5 using Tapatalk 2


----------



## Sliter (Jul 6, 2017)

Zhongtiao1 said:


> If anyone is interested, a swim controller is on sale on ebay
> 
> Sent from my Q5 using Tapatalk 2


how much? I wanted to try making one as a normal n64 controller  õ3o


----------



## Zhongtiao1 (Jul 6, 2017)

Sliter said:


> how much? I wanted to try making one as a normal n64 controller  õ3o



$300

http://www.ebay.com/itm/IQUE-Ninten...120342?hash=item1c85b20396:g:MkwAAOSwjL5ZHRnP


----------



## Sliter (Jul 6, 2017)

Zhongtiao1 said:


> $300
> 
> http://www.ebay.com/itm/IQUE-Ninten...120342?hash=item1c85b20396:g:MkwAAOSwjL5ZHRnP


... ok forget it XD an iQue coust less than this .. right? :v


----------



## Kevinpuerta (Jul 6, 2017)

Zhongtiao1 said:


> $300
> 
> http://www.ebay.com/itm/IQUE-Ninten...120342?hash=item1c85b20396:g:MkwAAOSwjL5ZHRnP


$300? Got mine for $30


----------



## Zhongtiao1 (Jul 6, 2017)

Just out of curiosity, can you use someone else's card points on the full offline version of ique at home if someone else (not you) has used it?

Sent from my Q5 using Tapatalk 2


----------



## Kevinpuerta (Jul 6, 2017)

Once the code is used it is unusable or shareable.

--------------------- MERGED ---------------------------

Or are you asking if I connect an ique that has all games bought on iquehome could I disconect and plug one withought games bought and redownload them to that one?

If so, answer is no. Each ique has a unique id and so when they are plugged in the information is transferred to ique at home and when disconnected the information is removed.


----------



## Sliter (Jul 6, 2017)

Kevinpuerta said:


> Once the code is used it is unusable or shareable.
> 
> --------------------- MERGED ---------------------------
> 
> ...


but we cant make another program/ hack the actuall one to transfer a game for an iQue that haven't bought that ?


----------



## Tw3ek (Jul 10, 2017)

Zhongtiao1 said:


> Just out of curiosity, can you use someone else's card points on the full offline version of ique at home if someone else (not you) has used it?
> 
> Sent from my Q5 using Tapatalk 2


I do not think there is a way to still use the points cards at all? You are talking about for purchasing games right?


----------



## Zhongtiao1 (Jul 11, 2017)

Tw3ek said:


> I do not think there is a way to still use the points cards at all? You are talking about for purchasing games right?



Yes.

Sent from my Q5 using Tapatalk 2


----------



## Tw3ek (Jul 11, 2017)

Zhongtiao1 said:


> Yes.
> 
> Sent from my Q5 using Tapatalk 2



The service for the iQue was discontinued at the start of the year. Can you actually still redeem codes? I thought that was gone with the online service.


----------



## Kevinpuerta (Jul 11, 2017)

Tw3ek said:


> The service for the iQue was discontinued at the start of the year. Can you actually still redeem codes? I thought that was gone with the online service.


You cannot redeem points anymore.


----------



## Sliter (Jul 11, 2017)

what about backups/the files downloaded from the program before sent to the console?


----------



## Tw3ek (Jul 11, 2017)

Kevinpuerta said:


> You cannot redeem points anymore.


Ok, that's what I thought. It would be nice if you could still redeem them though.


----------



## asper (Aug 18, 2017)

I had a look at encrypted (1 time only) roms downloaded from online service: they are smaller than the real-web-found .z64 dumps so hypothesis can be 2:

1) final FFFFFFFF padding was removed from the iQue ROMs;
2) iQue ROMs are encrypted but also compressed before encryption (probably using zip looking at the compression rate of original-web-found .z64 dumps)

No more news on that front.


----------



## emoose (Dec 22, 2017)

Hi all, I've been working on reversing the PC side client but think it might be missing some things due to it being such an early version... Does anyone know if the latest client can be found anywhere? The only links I can find are for the earliest version, and seems the updater doesn't work anymore 

Or does anyone here still have the updated client installed and could post the files for it somewhere? Would be appreciated a lot!

Also many thanks to OP (can't post your name due to spam filter?) for the ique_diag  Managed to reverse most of it, you can see some of the work here:  i.imgur dot com/IiQVxjP.png

ATM I'm waiting on some parts to arrive so I can try updating my unit to enable the USB interface, crossing my fingers hoping it'll work!


----------



## Zhongtiao1 (Dec 22, 2017)

emoose said:


> Hi all, I've been working on reversing the PC side client but think it might be missing some things due to it being such an early version... Does anyone know if the latest client can be found anywhere? The only links I can find are for the earliest version, and seems the updater doesn't work anymore
> 
> Or does anyone here still have the updated client installed and could post the files for it somewhere? Would be appreciated a lot!
> 
> ...



Good job on the ique_diag project! I'm looking forward to seeing what happens next. Unfortunately, I do not have the updated [email protected] so I cannot help you with that. Good luck though!


----------



## Krem Quay (Dec 23, 2017)

https://archive.org/details/iquehomelatest

Here's the latest @Zhongtiao1 @emoose

--------------------- MERGED ---------------------------

http://web.archive.org/web/20171223...m/viewthread.php?action=printable&tid=6021027

Sorry for double post but HNKii said that linking the ISBNs could help. The names are in Chinese though. Yo @HNKii , want to translate these and explain how you know the ISBNs are important to remember?


----------



## HNKii (Dec 23, 2017)

emoose said:


> Hi all, I've been working on reversing the PC side client but think it might be missing some things due to it being such an early version... Does anyone know if the latest client can be found anywhere? The only links I can find are for the earliest version, and seems the updater doesn't work anymore
> 
> Or does anyone here still have the updated client installed and could post the files for it somewhere? Would be appreciated a lot!
> 
> ...


Hi there! Thank you so much for reverse engineering the client! It seems that you've done quite a lot of progress! 
And yes, I do have the updated (V1.4.2) version, here is it:http://www.mediafire.com/file/t6gka8a9n2nv03c/[email protected] V1.4.2.zip

I'll try my best to explain what each directory and folder does:
/root:
SERVER: A file with only the string "rms.idc.ique.com" Possibly the server domain of the [email protected] service?
VERSION: A file with only the string "104022005101909". (The iQue Player's client version is V1.4.2 2005101909)
神游在线([email protected]): Opens the index page of iQue. (www.ique.com)
uninst.exe: Uninstalls the [email protected] application. Nothing special here.

/root/data:
/cache: Contains all the files and encrypted game cache obtained from http://cds.idc.ique.com:16963/cds/download?content_id=x  (x is the content ID, also the file name of the downloaded cache). The ones bundled with the full [email protected] client download are identical to the ones obtained from the server. I deleted the 11~61 folders to save from space.
/etc: Contains 2 config files that are also included in the [email protected] client download.(Full or simple version) Not sure what they do.
/incoming: Temporary storage for any downloading cache files. Once downloaded they will be moved to the corresponding folders in /cache, but the folders created in the /incoming directory will not be deleted.
/logs: record of all the link visited and purchases made by the user, and store them in the file "error-YYMMDD.log" (Everything will be recorded, not just errors)
The logsnote file seem to record the user's iQue Club user name (In my case, HNK)
/tmp: Stores thumbnails of games and manuals. These images are used both on the iQue Player and on the [email protected] client. The file name of the image matches the content ID of the game/manual.

/root/pkgs:
/base: Contains an executable called POSTINST.exe. Purpose of the executable is unknown.
/core/bin: The [email protected] main program.
/core/share/xlate: Contains a file called GB2312 (GB2312 is the registered internet name for a key official character set of the People's Republic of China, used for simplified Chinese characters.)
Possibly an open-source GB2312 to Unicode table included to make sure the app uses Simplified Chinese characters properly.
/core: Contains a VERSION file with only the string "104022005101909"
/diag: Contains the iQue_diag.exe diagnosis tool as well as a diag.cont file that contains cycles of HEX values. Not sure what the txt files are.
The VERSION file here has the string "103042005031806"(Possibly meaning V1.3.4 2005031806)--older than the version of the client (V1.4.2 2005101909) but newer than the version of the [email protected] client download (V1.3.2 2004092411)
/driver: Contains only a VERSION file with version (V1.3.2 2004092411). It could be that this file remain unmodified as I updated my V1.4.2 from the V1.3.2 Client.
/loc: VERSION file says version V1.4.2 2005101909
/loc/res: Contains DLL files that seemed to contain web pages for offline usage (Thus the directory name /loc (local)). Not sure what's different between iqahc409 and iqahc804.
/update: Contains an updater executable and a VERSION file V1.3.2 2004092411 It could be that this file remain unmodified as I updated my V1.4.2 from the V1.3.2 Client.


----------



## emoose (Dec 23, 2017)

Many thanks for the help guys! Will take a look into this client now, hopefully they added some more things to look into.

Anyway if anyone's interested here's what I've figured out so far:
- around ~50% of ticket.sys format
- NAND (ique card) filesystem format (+ a working implementation, but only have a single non-properly dumped NAND to test with atm... hopefully can dump something from mine soon)
- cert.sys & cert revocation list format (VERY similar to the Wii's cert format)
- learnt a little about the 'system-app'/'secure-kernel' NAND section (basically the encrypted code for the game menu afaik, games with codes 1009-1106 are this system-app, I suppose different revisions of it, unlike other apps it has a signature block at 0x10000 which is the same format signature used in ticket.sys, got a feeling that block probably contains encryption keys too but not really sure atm)
- small parts of the USB protocol (could be useful for fuzzing perhaps?)

Also a few things I'm planning on trying soon:
- hooking up my NAND to a RPi so I can try updating that 'system-app' section, which should hopefully enable USB support on my unit (will probably write up a guide for this if successful since there's not really any other way to update non-USB models anymore)
- modding the ique_diag.exe to allow NAND r/w through USB (most of the ique_diag functions interact with the NAND directly via USB already, so all the code for it is there, just have to hook the exe and write something to use that code)
- maybe some old Wii bugs could work, since the cert/signature related things seem really similar to the Wii
- also thinking of tracing some of the AV-output pins too, seems the depot USB cable connects to the device through here, maybe some of the pins go straight to the NAND or something?

Sadly no progress on the encryption front right now, PC client doesn't seem to have anything related to it, looks like all the re-encrypting/decrypting is handled on the device itself


----------



## Krem Quay (Dec 23, 2017)

if you do manage to decrypt the games, where would you post them? I don't think you can link them here--oor are they being added to a non-good N64 set?

--------------------- MERGED ---------------------------

Don't know if you also saw this but these are all the encrypted titles for iQue Player: https://archive.org/details/iQuePlayerEncryptedGames

If you read the earlier posts, there's even a mystery 15th game that me and HNKii found. Really happy to see what happens next


----------



## Kevinpuerta (Dec 23, 2017)

Krem Quay said:


> if you do manage to decrypt the games, where would you post them? I don't think you can link them here--oor are they being added to a non-good N64 set?
> 
> --------------------- MERGED ---------------------------
> 
> ...


Might be majoras mask


----------



## emoose (Dec 23, 2017)

Krem Quay said:


> if you do manage to decrypt the games, where would you post them? I don't think you can link them here--oor are they being added to a non-good N64 set?
> 
> [..]
> 
> If you read the earlier posts, there's even a mystery 15th game that me and HNKii found. Really happy to see what happens next



Hmm, I guess if the encryption is figured out I'd probably just post a tool for it and let others decide how to release them, that'd probably be the safest option (we're not anywhere near that yet though  but I'm hoping Kevinpuerta's CD could have some surprises for us)

Yeah I did see talk about that mystery game, would be sweet if we can get somewhere with that.
Right now I'm not sure if we'd be able to just decrypt any app using a common key or if we'd need a matching eticket for it though... with Wii/3DS the eticket contains the encryption key IIRC, could be the same here too but I'm not really sure.



Kevinpuerta said:


> Might be majoras mask


Most likely, I saw you guys work out that it was an RPG, and since they only released first-party games I can't really think of any other first-party RPG besides MM that isn't already on there.

(but who knows, perhaps cracking the iQue crypto and decrypting that mystery game is how Miyamoto wanted Ura Zelda to be released? )


----------



## Krem Quay (Dec 23, 2017)

Kevinpuerta's CD?


----------



## emoose (Dec 23, 2017)

hxxp://gbatemp.net/threads/so-im-going-to-buy-an-ique-64-depot-machine-possibility-of-dumping-or-modding-the-ique-with-this.465442/

Not sure if that's just a normal [email protected] CD or not, interested in finding out about it though.


----------



## Krem Quay (Dec 23, 2017)

https://archive.org/details/iQuehomeCDROM

You did see this one, right?


----------



## emoose (Dec 23, 2017)

Yeah I only saw that just after posting lel, grabbing it now. Do you know if this disc came as a pack-in with USB iQues?

Kevins looks like it could be the "iQue USB Cable Upgrade", saw that mentioned in a few places (hxxp://www.gamespot.com/articles/nintendo-ique-goes-online/1100-6111231/) but haven't seen any pics of it before, makes sense though since his USB connects to the AV instead of the miniUSB, maybe his disc has something extra on it for doing the upgrade through that AV port.


----------



## Krem Quay (Dec 23, 2017)

I'm not entirely sure about the origin of the disc but I know that when I talked to HNKii on Tieba Baidu for uploading the iQue CD-ROMs, he willingly posted it. iQue only produced three CD-ROMs, and they all circulated online by now. It probably is included with that thing he posted (iQue Player?). I'd say it most likely is the same, but we never know, so maybe he can dump an iso of that disc.


----------



## HNKii (Dec 23, 2017)

emoose said:


> Hmm, I guess if the encryption is figured out I'd probably just post a tool for it and let others decide how to release them, that'd probably be the safest option (we're not anywhere near that yet though  but I'm hoping Kevinpuerta's CD could have some surprises for us)
> 
> Yeah I did see talk about that mystery game, would be sweet if we can get somewhere with that.
> Right now I'm not sure if we'd be able to just decrypt any app using a common key or if we'd need a matching eticket for it though... with Wii/3DS the eticket contains the encryption key IIRC, could be the same here too but I'm not really sure.
> ...


21061 Is not the cancelled game Majora's Mask. Krem Quay found a number of Majora's Mask related images under the ID 21031














Also, I made a few interesting discoveries from the ticket file dumped from iQue Player contents dumped using the diag tool:
https://imgur.com/a/Dpk1q





 (These are all the files dumped using commands GI thru GU)
The ticket file is the largest, and there are a significant number of lines of zeroes between blocks of non zero HEX values.
The ticket data seems messy, but is actually quite easy to locate each game.
To do that, you will need to convert the official name of the games(Chinese) into HEX values using the GB2312 formula.
(Conversion tool avaliable here: http://tool.haooyou.com/code?group=convert&type=strToHex&charset=GB2312. Type/paste the game name on the top textbox and click the blue button)
For instance, the game name "神游马力欧" (Super Mario 64) is C9F1 D3CE C2ED C1A6 C5B7 in HEX.
Search for the HEX value in the entire ticket file and you will find two results: One at the end of a non-zero HEX collection (Followed by nothing or just the game's ISBN), or followed by the HEX values B2D9 D7F7 D6B8 C4CF --That's the GB2312 code for “操作指南” (Control guide)--As I mentioned before, all manuals are considered paid(non-trial licence) games on the iQue Player.

I'm now working on splitting the non-zero region of the ticket file into individual ticket files. The ticket region for each individual game seems to be unequal in Length, but they all seem to have the same strings "Root-CPCA00000108-CP00000110" and "Root-XSCA00000107-XS0000010". Also, most game and manual ticket files end in an ISBN (Right after the game's name in GB2312), but some do not have that (Ending right in the game's name)
In case anyone's interested, I'm sharing the files obtained by using the GET command: http://www.mediafire.com/file/k7p8b9k8efvr56y/iQuePlayerHNKrar.zip
For your information, I have all 14 iQue Player games purchased, so there should be 26 permanent(non-trial) tickets. (Every game except Custom Robo and Animal Crossing has a manual)

--------------------- MERGED ---------------------------



emoose said:


> hxxp://gbatemp.net/threads/so-im-going-to-buy-an-ique-64-depot-machine-possibility-of-dumping-or-modding-the-ique-with-this.465442/
> 
> Not sure if that's just a normal [email protected] CD or not, interested in finding out about it though.


I believe it's just an [email protected] CD.
I doubt the disk has varying contents as a new disk would require a new ISBN from the government, and AFAIK iQue only has 3 ISBN numbers for CD-ROMs: The iQue GBASP disk, the iQue DS disk, and the [email protected] CD.
I'll try to ask about the iQue player cable that connect both the AV and the USB input. I personally don't have one of them but I know a number of people that do.
Edit: It's likely that the cable is just for power supply purposes. The AV input for the iQue Player is also the power input.


----------



## emoose (Dec 23, 2017)

Oh right, doesn't look like there's any content available to download under that 21031 ID neither 

Wonder what other game 21061 could be then, can't really think of any other Nintendo-developed RPGs that could fit, but I admit I'm not really much of an N64 enthusiast so maybe I'm missing something.

Also individual tickets are different sizes because of the compressed images inside, if you go to 0x44 in the ticket (0x48 in tickets.sys, because of 4 byte numTickets field) the next 4 bytes are the thumb image length and title image length (2 bytes for each, big-endian), add those together + 0x1586 should be the ticket length.

If you have hex workshop installed I've wrote up some structures for it here: hxxp://pastebin.com/V1RRpgqh
To open in hex workshop save that as tickets.hsl, then click the 'select structure library' button, choose the tickets.hsl, go to 0x0 in the tickets file and click the 'add structure' button (the + icon in the pic) then choose tagETICKET_DB (pic: hxxp://i.imgur.com/Te9faLn.png)

I also wrote up a C# tool for reading them, the code is a bit messy to release atm but I'll probably be open-sourcing it soon, seems to work well though  (output for your tickets file: hxxp://pastebin.com/YDZF9BJf)

Also many thanks for the share, I grabbed it before from a different link you posted, was extremely helpful 



Krem Quay said:


> I'm not entirely sure about the origin of the disc but I know that when I talked to HNKii on Tieba Baidu for uploading the iQue CD-ROMs, he willingly posted it. iQue only produced three CD-ROMs, and they all circulated online by now. It probably is included with that thing he posted (iQue Player?). I'd say it most likely is the same, but we never know, so maybe he can dump an iso of that disc.


Hmm, yeah it's probably the same like you said, would be best to make sure though.. could just be a rare disc or something (can barely find anything about the USB Upgrade Kit thing besides news sites anyway, but I haven't tried searching in chinese though)

(edit: just saw HNKii's edit too, that kinda sucks about the CDs, was really hoping it could be something special  But still I wouldn't mind a dump just to be sure though 
I didn't actually notice it was USB+AV hah, looked like it was just AV to me but now I see the miniUSB connector, I guess USB+AV does make more sense too
I wonder how the USB-update gets sent to it though, doesn't seem like there's any signal coming through the USB on my non-updated unit, hm..)

(edit2: if anyone's interested in what I'm working on atm: hxxp://i.imgur.com/2xgTnBJ.png - still a lot more work to go though!)

(edit3: related to above, is there anyone here who can connect to their iQue with the ique_diag tool, and could do a quick test with my DiagExtender mod?
It won't affect your iQue at all, all it does is print some values that I need from ique_diag.exe memory after using BBCInit.
If you don't mind testing it please PM me!)


----------



## Krem Quay (Dec 24, 2017)

Why doesn't your unit work, @emoose ? Also, thank you very much for helping us work on this. This is like the perfect Christmas present. 

--------------------- MERGED ---------------------------

ALso, i talked to @HNKii via QQ (China of Skype), and he told me that iQue Players only connect to 32-bit Windows systems. A workaround could be using Windows XP on VMware. I assume you're using 64-bit, @emoose ?


----------



## emoose (Dec 24, 2017)

AFAIK it's one of the early ones without USB support, Taobao seller failed to mention it 
Gonna try seeing if I can update it manually soon, saw a few things about connecting an RPi to a NAND, and seems most NANDs work the same way so it should work out hopefully.

Only thing I'm kinda worried about is the ECC code (a sorta checksum on every 512 bytes in the NAND), no idea what algorithm they use and I haven't found anything in the exes about recalculating it yet...
Could mean it gets calculated by the iQue itself, which would mean no way of modifying the NAND externally ; _ ;

But if I can get a raw NAND dump of an updated iQue it should have all the correct ECC codes already, so I'm hoping I can get this DiagExtend mod working soonish so that someone might help me out with a dump.

And no problem, glad I can be of help 
I've actually been working on this stuff on and off for the past month or so, probably should have posted about it sooner, but I guess this is perfect timing really 

Also yeah I'm on Win10 x64, plugging it in doesn't show any new devices for me, did try using an XP VM but even then there's no option for a passthrough or anything showing up...
Actually I haven't even tried a different USB cable yet lol, I probably should before I go getting out the soldering iron.

Pretty sure this is an early model though, card mentions 181003 which I guess is Oct 2003, kinda weird that it wouldn't be updated already though since there's 5 unlocked games on here...


----------



## Krem Quay (Dec 24, 2017)

@emoose Are you sure it's a hardware fault? Have you tried installing the latest [email protected] on your 32-bit XP (like from the installer and not just launching [email protected]) with all the drivers included? HNK doesn't believe that the iQue Player  doesn't have USB support. Does it have a USB port?


----------



## emoose (Dec 24, 2017)

Krem Quay said:


> @emoose Are you sure it's a hardware fault? Have you tried installing the latest [email protected] on your 32-bit XP (like from the installer and not just launching [email protected]) with all the drivers included? HNK doesn't believe that the iQue Player  doesn't have USB support. Does it have a USB port?


Yeah it does have the port, saw a few places mention that it needs an update for USB though, hxxp://retroactive.be/personal/ique/ says


> Here's how you put games onto it:
> 
> - Kiosk/depot in China
> - USB standard cable and custom software on Windows PC
> ...


IIRC I also saw somewhere that said only 2004+ models came with USB support built in, also just checked my manual and it doesn't even mention a USB cable being included neither 
Maybe I just got unlucky with the iQue lottery... (did just look up the iQue release date though and it looks like mine could be part of the first batch  )

I didn't actually try installing [email protected] on the XP VM though, figured it'd show a "found new hardware" thing if it was working, I'll have to try it out properly later.


----------



## HNKii (Dec 24, 2017)

emoose said:


> Yeah it does have the port, saw a few places mention that it needs an update for USB though, hxxp://retroactive.be/personal/ique/ says
> 
> IIRC I also saw somewhere that said only 2004+ models came with USB support built in, also just checked my manual and it doesn't even mention a USB cable being included neither
> Maybe I just got unlucky with the iQue lottery... (did just look up the iQue release date though and it looks like mine could be part of the first batch  )
> ...


When you turn on the iQue Player, what is displayed on the main menu?




This is from my iQue Player when I made the screenshot earlier this year(I don't have access to it now) If you have the 4 colored characters 神游在线 on the top left corner then your iQue Player is bundled with [email protected] support.
According to iQue updates can be done from the user. The disk contents from the [email protected] CD （神游加油装）should work as an updator.


----------



## Kevinpuerta (Dec 24, 2017)

My ique disc seems to be the [email protected] from their website, put on a disc. 

Yes, the av port cable is to get power using the usb cable.

--------------------- MERGED ---------------------------

And I do recall there being and exe program for updating. Crashes for me. Probably cause my pc is 64 bit


----------



## emoose (Dec 24, 2017)

HNKii said:


> When you turn on the iQue Player, what is displayed on the main menu?
> 
> 
> 
> ...



Yeah looks like mine is missing that  also no date display on the top right, instead looks like mine is showing space used on the bottom where yours doesn't? hxxp://i.imgur.com/bFQJNZ3.jpg

Guess my iQue really never has been updated, which is weird because it has 5 unlocked games...

I'll have to try out the [email protected] CD later, how do updates work with [email protected] anyway? I just open the client and it'll ask or should I run the updater.exe?



Kevinpuerta said:


> My ique disc seems to be the [email protected] from their website, put on a disc.
> 
> Yes, the av port cable is to get power using the usb cable.


Ah dang, well thanks for the offer to dump it earlier anyway


----------



## Krem Quay (Dec 24, 2017)

I don't know how they work. I thought since you had the latest, it wouldn't matter?


----------



## emoose (Dec 24, 2017)

Krem Quay said:


> I don't know how they work. I thought since you had the latest, it wouldn't matter?


Oh I meant system updates lol, I guess the client will tell me if it can update my iQue, updater.exe looks like its for the client itself


----------



## Krem Quay (Dec 24, 2017)

Will your unit have working USB support soon? To me, it sounds like you're making progress


----------



## emoose (Dec 24, 2017)

I'll try testing out that CD with the VM tomorrow (pretty late here atm), hope that'll work so I won't have to go messing with the raw NAND and crap...

If not though I probably won't try anything else till after christmas, probably after boxing day (27th or so)

and if I can't get anywhere with that I guess I'll have to order another one from Taobao, I did see a few there which were actually dated in 2004 but none of them had AV cables etc, only one I could find that did was this one and it just had to be an early model ; _ ;

Anyway thanks for all the help again guys  hope we can get somewhere with this soon!


----------



## Krem Quay (Dec 24, 2017)

Yeah, and even if it takes a while, it will be worth it. I hope we get somewhere soon as well.


----------



## HNKii (Dec 24, 2017)

emoose said:


> Yeah looks like mine is missing that  also no date display on the top right, instead looks like mine is showing space used on the bottom where yours doesn't? hxxp://i.imgur.com/bFQJNZ3.jpg
> 
> Guess my iQue really never has been updated, which is weird because it has 5 unlocked games...
> 
> ...


Man, that is sure an old version... that's quite rare.
The second option is the old iQue Club registration tool which is not available on the newer version anymore.
Since my iQue Player has the newest version pre-installed, I do not know how to do the update exactly. But I once read that the purpose of the 神游加油装 is to update iQue Player systems to the latest version without the use of a depot system(In other words, [email protected] should be able to detect an un-updated model)


----------



## HNKii (Dec 24, 2017)

Some Random Updates about the ticket file:
I figured out the order the ticket for each game is presented: They are presented in the alphabetical order of the Pinyin of the Chinese characters, and games starting with English letters precede games starting with Chinese Names.

Order of files in ticket:
(F-Zero)Ｆ＿ＺＥＲＯＸ未来赛车
(F-Zero Manual)Ｆ＿ＺＥＲＯＸ未来赛车操作指南 ISBN 7-900381-10-4
Dong Wu Sen Lin(Animal Crossing)动物森林 ISBN 7-900427-30-9 025-2005-009 [2006]080
Ma Li Ou Ka Ding Che(Mario Kart 64)马力欧卡丁车 ISBN 7-900381-05-8
Ma Li Ou Ka Ding Che Cao Zuo Zhi Nan(Mario Kart 64 Manual)马力欧卡丁车操作指南 ISBN 7-900381-05-8
Ma Li Ou Yi Sheng(Dr. Mario 64)马力欧医生 N/A
Ma Li Ou Yi Sheng Cao Zuo Zhi Nan(Dr. Mario 64 Manual)马力欧医生操作指南 ISBN 7-900381-04-X
Ren Tian Tang Min Xing Da Luan Dou （Super Smash Bros) 任天堂明星大乱斗 ISBN 7-900381-67-8 025-2004-017 [2005]065号
Ren Tian Tang Min Xing Da Luan Dou Cao Zuo Zhi Nan (Super Smash Bros Manual)任天堂明星大乱斗操作指南 ISBN 7-900381-05-8
Sai Er Da De Chuan Shuo(Zelda OOT)塞尔达的传说 N/A
Sai Er Da De Chuan Shuo Cao Zuo Zhi Nan(Zelda OOT Manual)塞尔达的传说操作指南 ISBN 7-900381-07-4
Shen You Ma Li Ou(Super Mario 64) 神游马力欧 N/A
Shen You Ma Li Ou Cao Zuo Zhi Nan(Super Mario 64 Manual)神游马力欧操作指南 ISBN 7-900381-06-6
Shen You Zu He Ji Qi Ren (Custom Robo)神游组合机器人 ISBN 7-900381-82-1 025-2004-017 [2006]052
Shui Shang Mo Tuo (Wave Race)水上摩托 N/A
Shui Shang Mo Tuo Cao Zuo Zhi Nan(Wave Race Manual)水上摩托操作指南 ISBN 7-900381-08-2
Xing Ji Huo Hu (Star Fox 64)星际火狐 N/A
Xing Ji Huo Hu Cao Zuo Zhi Nan (Star Fox 64 Manual)星际火狐操作指南 ISBN 7-900381-09-0
Yao Xi Gu Shi(Yoshi's Story)耀西故事 ISBN 7-900381-16-3
Yao Xi Gu Shi Cao Zuo Zhi Nan(Yoshi's Story Manual)耀西故事操作指南 ISBN 7-900381-16-3
Yue Ye Mo Tuo (Excite Bike 64)越野摩托 ISBN 7-900381-62-7 025-2004-017 [2005]065号
Yue Ye Mo Tuo Cao Zuo Zhi Nan(Excite Bike 64 Manual)越野摩托操作指南 ISBN 7-900381-05-8 025-2004-017 [2005]065号
Zhi Pian Ma Li Ou (Paper Mario)纸片马力欧 ISBN 7-900381-30-9
Zhi Pian Ma Li Ou Cao Zuo Zhi Nan(Paper Mario Manual)纸片马力欧操作指南 ISBN 7-900381-30-9
Zui Yu Fa: Di Qiu De Ji Cheng Zhe (Sin And Punishment)罪与罚：地球的继承者 ISBN 7-900381-40-6
Zui Yu Fa: Di Qiu De Ji Cheng Zhe Cao Zuo Zhi Nan(Sin And Punishment Manual)罪与罚：地球的继承者操作指南 ISBN 7-900381-40-6

*Notes:
N/A Means the ISBN is not included with the ticket
*Zelda OOT's internal name 塞尔达的传说 is not the same as its official name “塞尔达传说-时光之笛- ”

I have 26 titles "purchased" on my iQue Player, yet, there are 27 chunks of non-zero data.
There is one extra chunk of data after S&P manual, and it's relatively small(Smaller than other ticket data of games/manuals), and it also has the strings "Root-CPCA00000108-CP00000110" and "Root-XSCA00000107-XS0000010b".
Maybe a ticket for System Menu, like the Nintendo Wii?


----------



## Zhongtiao1 (Dec 24, 2017)

HNKii said:


> Some Random Updates about the ticket file:
> I figured out the order the ticket for each game is presented: They are presented in the alphabetical order of the Pinyin of the Chinese characters, and games starting with English letters precede games starting with Chinese Names.
> 
> Order of files in ticket:
> ...



I still believe that the mysterious game is Majoras mask, iQue could have quite easily just changed the id number. Otherwise, it could possibly be one of the Mario party games. Not really an rpg, but it's somewhat close.


----------



## Sliter (Dec 24, 2017)

wow guys, sudden come with a huge progress on everything! XD 
UI'm kinda sad I haven't looked for getting a  iQue myself yet, I don't have skills to help hacking out but idk ... I even anted an iQue player since I heard of it hahah and now it's being revived! what a great thing XD


----------



## Kevinpuerta (Dec 25, 2017)

Here's my IQue disc just in case there are some differences
2 files on disc are corrupted and couldn't be ripped
ISO Format
http://www.mediafire.com/file/rwfwa96xdz0whcd/IQUE+神游在线.ISO


----------



## Krem Quay (Dec 25, 2017)

Actually doesn't seem to be different from the provided one, sorry.


----------



## Kevinpuerta (Dec 25, 2017)

Krem Quay said:


> Actually doesn't seem to be different from the provided one, sorry.


Well at least now we know


----------



## kane159 (Dec 25, 2017)

Hey i just saw this thread ,really want to help but have no knowledge to hack or crack something....
But i have a iQue player that can connect to pc via usb cable!
If anything i can help please tell me 


從我的iPhone使用Tapatalk Pro 發送


----------



## Krem Quay (Dec 25, 2017)

@kane159 

Hi thank you for trying to help us. 

Here's a post you might like to read-- @emoose wants to get the BBCInit function from some dump or something: https://gbatemp.net/threads/ique-pl...with-ique_diag-exe.466906/page-9#post-7748968


----------



## Sliter (Dec 25, 2017)

kane159 said:


> Hey i just saw this thread ,really want to help but have no knowledge to hack or crack something....
> But i have a iQue player that can connect to pc via usb cable!
> If anything i can help please tell me
> 
> ...


how much is one of these nowadays? I rally want one too XD


----------



## Zhongtiao1 (Dec 25, 2017)

Sliter said:


> how much is one of these nowadays? I rally want one too XD



Currently $150 USD on ebay


----------



## Sliter (Dec 25, 2017)

Zhongtiao1 said:


> Currently $150 USD on ebay


oh .. I think from now its going only to rise :v


----------



## emoose (Dec 25, 2017)

Merry Christmas everyone, hope you all have some happy holidays 
Still haven't had a chance to try updating my unit since I ended up leaving earlier than I thought, should be back by Thursday or Friday though.



HNKii said:


> Man, that is sure an old version... that's quite rare.
> The second option is the old iQue Club registration tool which is not available on the newer version anymore.
> Since my iQue Player has the newest version pre-installed, I do not know how to do the update exactly. But I once read that the purpose of the 神游加油装 is to update iQue Player systems to the latest version without the use of a depot system(In other words, [email protected] should be able to detect an un-updated model)


Whoa neat! I probably should have been more careful with it then, already broke off the tabs on the card trying to open it (didn't realize it had screws >.<), it was practically mint condition too...
Guess I can always swap that out with another one though.

That iQue Club is interesting, I guess you would setup your details on the device and it would upload them when you use a kiosk?
I saw some things in the PC clients which would check for the "iQue Club" string inside the tickets.sys file, maybe that means the device itself would create it's own ticket after you register your details? (gives some hope for us making our own 21061 ticket )

Yeah hopefully [email protected] will work to get it updated, really don't want to mess with reading the NAND manually if I don't have to.
That gives me another idea to add to DiagExtend though, a function that lets you flash your own sys-update.
AFAIK there's nothing stopping you from downgrading or anything (besides the sys-update contentid being stored in depot.sys/PrivateData)
All the code for uploading a sys-update is already there too, so should be pretty simple to setup.

Also neat that it stores tickets alphabetical, you would think it would just store newer tickets last, guess it must be recreating the whole file instead.
I also didn't notice that extra chunk in your tickets, will have to check it out later, maybe it could just be a remnant of a ticket that was removed but not nulled out?



Kevinpuerta said:


> Well at least now we know


Yeah was best to double-check really, thanks for doing it for us 
Would have been cool if it was special.. that makes me wonder though, whatever happened to all the iQue kiosks in stores?
I do remember hearing in one place, that they just made the store destroy it instead of sending it back  Can't remember where I heard that though, really hope it's untrue...
If one of them ever gets out I'm sure it'd be extremely useful though.



kane159 said:


> Hey i just saw this thread ,really want to help but have no knowledge to hack or crack something....
> But i have a iQue player that can connect to pc via usb cable!
> If anything i can help please tell me


Do you have it working with [email protected]? You need a 32bit system or an XP virtual-machine AFAIK. Once I get back I can probably help you set it up if you like.



Sliter said:


> how much is one of these nowadays? I rally want one too XD


For mine I bought it from a seller on Taobao, using a 3rd party reshipping place in China to receive it and send it internationally to me.
Unit cost about £30, and shipping was about £30 also, so about ~£60 in total.
Not too bad I suppose, kinda wish I'd bought more and sent them over in bulk though, shipping probably would have worked out cheaper that way.
(edit: that's for a used system though, the $150 ones on ebay are all new untouched AFAIK)


----------



## HNKii (Dec 26, 2017)

emoose said:


> Merry Christmas everyone, hope you all have some happy holidays
> Still haven't had a chance to try updating my unit since I ended up leaving earlier than I thought, should be back by Thursday or Friday though.
> 
> 
> ...



You can log in to iQue Club on the PC client just like you can do so on a browser. I am not sure what the iQue Club tickets do.
If older iQue Player models had iQue Club registration credentials, newer ones wouldn't.
P.S. I don't think iQue Players are not downgradable as the Wii isn't. I think the 10XX and 11XX contents might be the encrypted files for system menu, and that last chunk of ticket might be the ticket for system components.
As for the depot systems, I doubt they've been destroyed as each store has to pay a deposit of 15000 RMB to install it. The depot system was said to be sold at a price of 300 RMB to employees.


----------



## Krem Quay (Dec 26, 2017)

Hey @emoose , had a good Christmas? Do you have any updates to share on the iQue Player?


----------



## emoose (Dec 26, 2017)

HNKii said:


> You can log in to iQue Club on the PC client just like you can do so on a browser. I am not sure what the iQue Club tickets do.
> If older iQue Player models had iQue Club registration credentials, newer ones wouldn't.
> P.S. I don't think iQue Players are not downgradable as the Wii isn't. I think the 10XX and 11XX contents might be the encrypted files for system menu, and that last chunk of ticket might be the ticket for system components.
> As for the depot systems, I doubt they've been destroyed as each store has to pay a deposit of 15000 RMB to install it. The depot system was said to be sold at a price of 300 RMB to employees.


Ah, so they basically moved the iQue Club stuff from the device itself into the [email protected] client?
I think you're right about the 10XX/11XX being system related also, BTW if you look at 0x10000 in them they also have a sort of ticket built in (known as 'T1' in the diag exe, the area 0x0 - 0x10000 is also called 'SA1', meaning either 'system-app' or 'system-area'), there should be another ticket at 0x30000 too (called 'T2', with 0x14000 - 0x30000 being 'SA2', I think it might just a backup system menu in case the first is corrupted)
The tagSK_SIGAREA struct in my tickets.hsl file should let you read those areas.

Yeah that stuff about destroying them was just a rumour I hope, but if the kiosks did get sold to employees I really hope one of them shows up one day (maybe it'd be worth posting about this recent research into iQue on some chinese forums? )
I'm sure if we could look at a kiosk more closely we could find out much more than from the public PC clients.



Krem Quay said:


> Hey @emoose , had a good Christmas? Do you have any updates to share on the iQue Player?


Yeah it's been pretty fun... but almost the whole time all I've been thinking about is ways I could look into the iQue haha, too bad none of my family know anything about 14-year-old China-exclusive game consoles 

No updates yet, still away atm but I should be back pretty soon.
Really hope I can get this unit upgraded though, since I think USB is probably our best bet of getting a break into the system. Even if we can just get a memory leak that'd still be really helpful.
I just hope the crypto stuff is done via software instead of hardware only, haven't got any experience with hardware cracking really, and afaik decapping a chip like the one in iQue can be pretty difficult/expensive


----------



## Kevinpuerta (Dec 26, 2017)

Im going to setup a vm for windows xp 32 bit. And try to see if It can read my ique. I think the last time I tried it was on 64bit.


----------



## MockyLock (Dec 26, 2017)

Once again, glad to see it's moving in the iQue scene 
Funny thing, it's moving elsewhere too :
https://assemblergames.com/threads/ique-player-question.67885/#post-959052


----------



## Kevinpuerta (Dec 26, 2017)

MockyLock said:


> Once again, glad to see it's moving in the iQue scene
> Funny thing, it's moving elsewhere too :
> https://assemblergames.com/threads/ique-player-question.67885/#post-959052



HAHA I actually bought an Ique because of "subbie" on assembler. I saw his older post on the Ique from a couple years ago and he is the reason I bought one and am attempting to help out with the Ique hacking. Also he mentioned where to buy them.


----------



## Kevinpuerta (Dec 26, 2017)

Im on a 32bit vm and this happens when attempting to read the ique in the iquediag.exe

the ique shows up on plugged in devices
not sure what to do now


----------



## emoose (Dec 29, 2017)

Kevinpuerta said:


> Im on a 32bit vm and this happens when attempting to read the ique in the iquediag.exe
> 
> the ique shows up on plugged in devices
> not sure what to do now
> View attachment 109302View attachment 109303


Did you try installing the [email protected] from the CD? That should install drivers for it I think (but not 100% on that)
Not sure if the [email protected] from the net has those drivers, didn't seem to install them for me anyway, you can get the CD iso from https://archive.org/details/iQuehomeCDROM


----------



## Kevinpuerta (Dec 29, 2017)

emoose said:


> Did you try installing the [email protected] from the CD? That should install drivers for it I think (but not 100% on that)
> Not sure if the [email protected] from the net has those drivers, didn't seem to install them for me anyway, you can get the CD iso from https://archive.org/details/iQuehomeCDROM


Will try


----------



## Krem Quay (Jan 4, 2018)

Looks like there's not been any updates in a while now. Any news?


----------



## Zhongtiao1 (Jan 4, 2018)

Krem Quay said:


> Looks like there's not been any updates in a while now. Any news?



Its been a week


----------



## Krem Quay (Jan 4, 2018)

That's true--I just wonder if all the silence means this reattempt at cracking the iQue Player has been cancelled.


----------



## Wack0 (Feb 10, 2018)

Dusting off this old account to post here 

I recently noticed some iQue references in certain things, and noticed how the iQue Player, security-wise, sounded very familiar.. it looked like a prototype WiI!

Some further investigation showed that the founder of iQue also founded BroadOn (the company that did a lot of security-related stuff for the Wii; designed the Starlet, coded IOS etc).

More investigation (getting exceptions out of the iQue Player webservices) showed BroadOn was definitely involved here as well.


Check an SASK you have to hand. Then look at the page on wiibrew about NAND (128KB of boot1, then 1MB-128KB of two copies of boot2, stored in a modified WAD format).
Then double check the SASK and see how close the two are. 64KB of presumably boot1 (this is the same across all known SASKs! by the way, the boot1 key is different from the Wii's), 16KB of presumably boot2 header (ticket, certs, CRL, much like a WAD -- WADs can contain a CRL but no WAD ever did; and the "TMD" isn't a thing with iQue), then boot2 content (size described by the boot2 ticket); then 16KB of presumably system menu header, then system menu content.

And notice that two SASKs stop after the boot2 header (and even have zero content length in the ticket!) ; and only the latest 5 SASKs (1091, 1095, 1099, 1101, 1106) have a second boot-title.

I quickly hacked together a ticket dumper based on emoose's research (a couple of the fields are probably wrong though, I took a guess at what they were based on a few tickets): https://pastebin.com/2NHCde84
It can handle SASKs, ticket.sys files, raw ticket.sys tickets, and raw tickets.

Using it, you can see that with the SASKs with two titles, the contentIDs are different.
1091: first ticket has contentID=1091, second ticket has contentID=1092
1095: first ticket has contentID=1095, second ticket has contentID=1096
1099: first ticket has contentID=1095, second ticket has contentID=1100 (and this SASK only differs from 1095 starting at the second ticket!)
1101: first ticket has contentID=1095, second ticket has contentID=1102 (and *parts of the first ticket and the first contents (starting at offset 0x1000 of the content) differ from 1099/1095!*)
1106: first ticket has contentID=1095, second ticket has contentID=1107 (and *parts of the first ticket and the first contents (starting at offset 0x15300 of the content) differs from 1101!*)

I'm working on reversing the PC-side applications; that's about the only thing I can do, as I don't actually have an iQue Player. (Anyone willing to sell me one at a reasonable price? I'm located in the UK.)


----------



## Kevinpuerta (Feb 10, 2018)

Wack0 said:


> Dusting off this old account to post here
> 
> I recently noticed some iQue references in certain things, and noticed how the iQue Player, security-wise, sounded very familiar.. it looked like a prototype WiI!
> 
> ...


Nice work. You can get one of taobao, just make sure it has at least one full game besides the dr mario game, to ensure the ique been updated to use on a home pc.


----------



## Wack0 (Feb 10, 2018)

Kevinpuerta said:


> Nice work. You can get one of taobao, just make sure it has at least one full game besides the dr mario game, to ensure the ique been updated to use on a home pc.


If it hasn't had that update, does it just not show up when you connect it to USB?

I'd be interested in writing some of those other SASKs to NAND, but I guess it'd be best to have two carts for that. Has anyone tried dumping a full NAND image and then restoring it to the cart of some other iQue, by the way?


----------



## Kevinpuerta (Feb 10, 2018)

Wack0 said:


> If it hasn't had that update, does it just not show up when you connect it to USB?
> 
> I'd be interested in writing some of those other SASKs to NAND, but I guess it'd be best to have two carts for that. Has anyone tried dumping a full NAND image and then restoring it to the cart of some other iQue, by the way?



It wont show up as a usb device unless updated. I think someone on assembler games forums dumped the nand and rewrote it to the ique. He ended up bricking it. The memory cards arnt shareable. Meaning the ique will only work with the memory card it was assigned to.


----------



## Kevinpuerta (Feb 10, 2018)

Wack0 said:


> If it hasn't had that update, does it just not show up when you connect it to USB?
> 
> I'd be interested in writing some of those other SASKs to NAND, but I guess it'd be best to have two carts for that. Has anyone tried dumping a full NAND image and then restoring it to the cart of some other iQue, by the way?



It wont show up as a usb device unless updated. I think someone on assembler games forums dumped the nand and rewrote it to the ique. He ended up bricking it. The memory cards arnt shareable. Meaning the ique will only work with the memory card it was assigned to.


----------



## Wack0 (Feb 10, 2018)

Kevinpuerta said:


> It wont show up as a usb device unless updated. I think someone on assembler games forums dumped the nand and rewrote it to the ique. He ended up bricking it. The memory cards arnt shareable. Meaning the ique will only work with the memory card it was assigned to.


I'm aware the NAND has console unique crypto.

I meant, can you write one NAND image to another cart and use the second cart in the console where the first cart's NAND dump came from?


----------



## Kevinpuerta (Feb 10, 2018)

Wack0 said:


> I'm aware the NAND has console unique crypto.
> 
> I meant, can you write one NAND image to another cart and use the second cart in the console where the first cart's NAND dump came from?


Im not sure about that other than the card would brick when being rewritten, so i assume it would also when doing it to a seperate card


----------



## asper (Feb 11, 2018)

Wack0 said:


> Dusting off this old account to post here
> 
> I recently noticed some iQue references in certain things, and noticed how the iQue Player, security-wise, sounded very familiar.. it looked like a prototype WiI!
> 
> ...


Yeah, I gave some other "speculations" about Wii similarities some posts back (end of page 5 and 6 of this thread), I think you have the skills to solve this thing


----------



## Jhynjhiruu (Feb 11, 2018)

Given the SERVER file in the [email protected] folder, would it, with a lot of research, be possible to create a custom server to download games? I don't have an iQue, but I find this really interesting and I installed the software.


----------



## Krem Quay (Feb 12, 2018)

is this the revival of the iQue Player hacking scene (after a month of silence)?


----------



## Zhongtiao1 (Feb 12, 2018)

Krem Quay said:


> is this the revival of the iQue Player hacking scene (after a month of silence)?



We can only hope


----------



## Krem Quay (Feb 12, 2018)

This guy is also looking for an IQue Player unit, but those units are hard to come across. With Taobao you'd need an agent because it's only made for Chinese-speaking areas @Wack0


----------



## Zhongtiao1 (Feb 12, 2018)

Krem Quay said:


> This guy is also looking for an IQue Player unit, but those units are hard to come across. With Taobao you'd need an agent because it's only made for Chinese-speaking areas @Wack0



Taobao does ship to the US now though which is good.


----------



## Krem Quay (Feb 12, 2018)

listings for iQue Player tend to pop up on Ebay and Amazon at times.


----------



## HNKii (Feb 12, 2018)

Wack0 said:


> Dusting off this old account to post here
> 
> I recently noticed some iQue references in certain things, and noticed how the iQue Player, security-wise, sounded very familiar.. it looked like a prototype WiI!
> 
> ...


Awesome! Just as I expected, the iQue Player data/security system should be very similar to that of the Wii. After all, Yen helped Nintendo on hardware development for the original N64 all the way to Wii. Guess the team just recycled iQue Player protection as they didn't found anyone exploiting it.
Also, have you also considered the ISBN and game name of each game's ticket? The game name part can be confusing for anyone who doesn't know much Chinese as the names are store in GB2312 in hex (For instance, Super Mario 64 （神游马力欧） as C9F1 D3CE C2ED C1A6 C5B7, and instruction guide （操作指南） as B2D9 D7F7 D6B8 C4CF(You'll see these HEX values for any game manual title)


----------



## HNKii (Feb 12, 2018)

Jhynjhiruu said:


> Given the SERVER file in the [email protected] folder, would it, with a lot of research, be possible to create a custom server to download games? I don't have an iQue, but I find this really interesting and I installed the software.


I don't think the custom server is even necessary. All of iQue's encrypted game cache are downloadable straight from a browser: http://cds.idc.ique.com:16963/cds/download?content_id=x 
(With X replacing the ID for the game data wanted).
We can basically make a file host for all those cache files, and that would probably be enough.
Extracting the game from the iQue Player using the diagnosis tool only gives you the same file as the one gained from downloading from iQue server. This is as if you ask to extract a Wiiware from the Wii and the Wii spits back a generic encrypted game data from the NUS.
Even if the iQue Player client is completely offline, as long as the cache files are located in the right directory, the client can still detect and retrieve the game (Provided that they are purchased first)


----------



## Jhynjhiruu (Feb 12, 2018)

HNKii said:


> I don't think the custom server is even necessary. All of iQue's encrypted game cache are downloadable straight from a browser: http://cds.idc.ique.com:16963/cds/download?content_id=x
> (With X replacing the ID for the game data wanted).
> We can basically make a file host for all those cache files, and that would probably be enough.
> Extracting the game from the iQue Player using the diagnosis tool only gives you the same file as the one gained from downloading from iQue server. This is as if you ask to extract a Wiiware from the Wii and the Wii spits back a generic encrypted game data from the NUS.
> Even if the iQue Player client is completely offline, as long as the cache files are located in the right directory, the client can still detect and retrieve the game (Provided that they are purchased first)


Once we (who am I kidding?) you guys have worked out how to add games to an iQue/dumped the master key (tweezer attack anyone?  And yes, I know that wouldn't work...)/whatever, it might be an interesting idea to encrypt other N64 games and try to install those. We you could use a custom server for that - I'd be happy to host files on http://jhynjhiruu.uk/ and I might be able to hack together a Python program to do... stuff (maybe). Also, that iQue server will _eventually_ be taken down, like the Wii, DS etc. servers before it, so getting a custom solution in place for when that does happen would be beneficial.
Has anyone tried decompiling the .exes? Figuring out how that works would be really useful, and a lot of people would really like an English translation.
I don't think I can get an iQue Player myself, unless I can import one cheaply enough. But, you know, I like this stuff, so...


----------



## Jhynjhiruu (Feb 12, 2018)

You wanted a crawler, you just got a (very slow) crawler. Type in the start and end IDs (don't try and break it, the only error handling it has is ignoring content IDs that don't exist) and it'll increment the counter by 1, try and download the file, and repeat. It requires Python 3, and I'll probably update it later to be able to ignore URLs from a file. https://pastebin.com/0jFNjSUt

The first results of crawling are in: between 1000 and 1100, you only missed one, http://cds.idc.ique.com:16963/cds/download?content_id=1082 - good job!
Edit: Oh derp derp derp derp, didn't read it properly... read that as 'you didn't miss any between 1000 and 1100'...

--------------------- MERGED ---------------------------

You were saying the latest update of [email protected] can't be downloaded any more; with a custom server, could we do this?


----------



## Jhynjhiruu (Feb 12, 2018)

Sorry for the triple post, but I've now updated the program to save which files exist and don't exist. It only checks for them after trying to download, so it isn't any faster, but this should make it easier to tell which files do exist. Pastebin link is the same, but here's the new executable, and my do.txt and dont.txt.
Here's a spreadsheet to keep track of them - PM me to get edit access.


----------



## Jhynjhiruu (Feb 12, 2018)

Hopefully final post before someone else notices: using a proxy, I found that the [email protected] updater is trying to connect to http://rms.idc.ique.com/hr_update/e...rev=4096&Release_rev=104022005101909 HTTP/1.0 - changing the server in the SERVER file lets me point this to any URL on the internet, so spoofing an update should be super simple. I'm on proper Wi-Fi now, so I'll try and do a full crawl of the site.


----------



## Jhynjhiruu (Feb 12, 2018)

OK, I fixed the error where it would write each number an increasing number of times - but I just noticed, after crawling all the way to 1576, that Python apparently has a limit on line numbers in files! Luckily, the program still works, it just won't output all the numbers. Ones that do exist are fine, as there are far fewer of those. I'll upload the improved program eventually.


----------



## Jhynjhiruu (Feb 12, 2018)

Wack0 said:


> Dusting off this old account to post here
> 
> I recently noticed some iQue references in certain things, and noticed how the iQue Player, security-wise, sounded very familiar.. it looked like a prototype WiI!
> 
> ...


Looking on eBay (I might get one, actually) there's one person selling them - including shipping, it comes to about £120, and there are 2 left.


----------



## Jhynjhiruu (Feb 12, 2018)

OK, I've crawled from x = 0 to x = 9999, and, as none of them were valid, I think I'm gonna make a new version that uses game IDs - can I get some more info on that?
Edit: Crawled all the way to 14999, none except the ones we already knew, keeping going though - and yes, my program tested 15000 IDs. What happened to my life??
Edit 2: Current count is (more than) 38843


----------



## Jhynjhiruu (Feb 12, 2018)

Here's the version I'm using, which handles a few more errors, and logs to a file.


----------



## Krem Quay (Feb 12, 2018)

Damn dude you posted so many times. I'm glad it's in the name of progress though. 

Also, I realize some Chinese resellers for iQue Players on eBay are away on vacation--I hear that it's because it's Chinese New Year or something over there.


----------



## Jhynjhiruu (Feb 12, 2018)

Krem Quay said:


> Damn dude you posted so many times. I'm glad it's in the name of progress though.
> 
> Also, I realize some Chinese resellers for iQue Players on eBay are away on vacation--I hear that it's because it's Chinese New Year or something over there.


Yup, probably something like that. I'm considering making a Discord server for this, it might work a little better than Temp.


----------



## Zhongtiao1 (Feb 12, 2018)

Is there anything preventing us from hosting the ique files on notabug? If they host freeshop, they may be fine with us hosting the ique games there


----------



## Jhynjhiruu (Feb 12, 2018)

Zhongtiao1 said:


> Is there anything preventing us from hosting the ique files on notabug? If they host freeshop, they may be fine with us hosting the ique games there


No, there isn't anything really. https://discord.gg/SeZ3RPb


----------



## emoose (Feb 15, 2018)

Sorry for the extended absence, been meaning to post an update on things but some personal issues came up, haven't had all that much free time unfortunately.

Did try upgrading my unit in a VM but sadly the client didn't seem to detect it...
I'm hoping to try r/wing the nand with my rPi soon (as soon as I get around to soldering the wires on.. or paying someone to do it for me since I'm awful at soldering)
It's probably best that I get a dump before upgrading anyway seeing as this OS version seems to be rare.

@Wack0 Nice to see you here! Very interesting info about the SKSA, I noticed things were similar to Wii but didn't think the similarity went that deep. Gives me even more hope the signing bug might be in here.

To that end I tried looking into how the signatures work, managed to write some code (https://pastebin.com/qg4jDVyY) that works to verify the signatures inside SKSA (the signature only covers the ETICKET_SIG struct/TICKET struct, there's probably a hash of the actual data in there somewhere)
Basically 0x0 - 0xAC of that struct is hashed with SHA1, and checked against signature at 0xAC - 0x1AC with the public key specified by cert_name (which should be in the cert chain area of SKSA)

Oddly enough the same ETICKET_SIG struct inside ticket.sys tickets fails to verify. Comparing tickets between units it seems most of the struct matches (even including the signature) except for a 0x10 byte area (the unkHash289C in ETICKET_SIG / unk_94 in your TICKET struct) which differs between devices.
My guess is this is an encrypted title-key of sorts, except instead of being encrypted with a common key like Wii/WiiU it uses a per-device one instead, I'd guess it decrypts that 0x10 area using the device-key and then the signature is checked with that decrypted 0x10 area in-place.
Only explanation I can think of for that area being different between units while signature remains static.
(also no luck with the ETICKET_XS_SIG struct signature neither, I'm guessing it probably has something similar)

I think it's funny the SKSA signature verified fine though - I guess the 0x10 area in that is already decrypted?
Anyway seeing as we can calculate the signature hash for it we should be able to fake-sign SKSAs now... but that's kind of useless unless we figure out the SKSA crypto/hashing.
(I was really hoping to get ticket.sys fake-signing to work since that would have been a lot easier to test if fake-signing even works, but seems we can't go anywhere with that until we get that title-key business sorted )

Also what console-unique parts have you seen in the NAND? From the single dump I've had to look at the SKSA area seemed to match up with the one from the cache (except for some spots where I think the NAND wasn't dumped properly)
AFAIK the only console-unique parts are the apps themselves, and a few config-related files (there's files like id.sys & depot.sys which contain the BBID of the device, I'd guess it refuses to boot if those don't match the BBID in the CPU)

I'd really like to look at other dumps to be sure though, I still have my ique_diag extension mod here that should be able to dump over USB, which sadly hasn't been actually tried out yet ;_;
(If anybody has [email protected] setup and working with their device, and wouldn't mind trying it out, please PM me!)


----------



## Jhynjhiruu (Feb 15, 2018)

emoose said:


> Sorry for the extended absence, been meaning to post an update on things but some personal issues came up, haven't had all that much free time unfortunately.
> 
> Did try upgrading my unit in a VM but sadly the client didn't seem to detect it...
> I'm hoping to try r/wing the nand with my rPi soon (as soon as I get around to soldering the wires on.. or paying someone to do it for me since I'm awful at soldering)
> ...


Come join the Discord server, we all wanna discuss stuff and GBATemp isn't the best nor fastest way to do it.


----------



## Krem Quay (Feb 15, 2018)

@emoose Hey, nice to hear from you again.

I ordered an iQUe Player yesterday (or day before), and it should arrive soon. I'm pretty sure it has [email protected] support because a screenshot showed like 5 titles on it (i think 4 are demos, idk). So if that arrives, I can help do testing. Kevinpuerta has an [email protected] iQue Player though


----------



## emoose (Mar 14, 2018)

Status update for anyone lurking (and because Discord servers aren't exactly indexed in search engines )

We've made the ique_diag extension I mentioned before (adding support for ique nand dumping etc), big thanks to Normmatt for the main dumping code!
You can grab the compiled version + patched ique_diag.exe here: https://github.com/emoose/iQueDiagExtend/releases (code at https://github.com/Normmatt/iQueDiagExtend)
Confirmed working with USB-compatible units, I think you might need an XP system/VM to make use of it though. If you have both of those I really recommend you make a dump of your unit ASAP.

Thanks to the dumps from this I've also been able to fix up my iQueTool to parse NANDs properly, so I've released it here: https://github.com/emoose/iQueTool
It'll let you view & extract all kinds of info from your iQue NAND, eg. ticket information, SKSA (iQue firmware) info, NAND filesystem extracting...
For people who want to try tinkering with their unit iQueTool can also repair the spare data of the NAND (correcting ECCs, setting SA block info data..)

Note that all of the released tools are read-only, so there's no risk to bricking your device by using them.
DiagExtend does have code to write files back to NAND, but you'll have to compile it yourself to add it.
But really if you're interested in that you should just join us on Discord, so that we can help you out


----------



## MockyLock (Mar 15, 2018)

'llo
i try to follow your very intereting work with my little knowledge.
i have an iQue that have an issue, it can't be turned off, and freezes each time i press "Power".
This issue came after i tried to connect my iQue to my computer, running the iQue soft. (die it maybe more 10 years ago, i can't remember the details).
See https://gbatemp.net/threads/ique-player-wont-switch-on.483197/#post-7571044
I was wondering if your tool could help me to fix my console, maybe by writing/fixing part of its own NAND.
Waiting for your help !


----------



## emoose (Mar 15, 2018)

MockyLock said:


> 'llo
> i try to follow your very intereting work with my little knowledge.
> i have an iQue that have an issue, it can't be turned off, and freezes each time i press "Power".
> This issue came after i tried to connect my iQue to my computer, running the iQue soft. (die it maybe more 10 years ago, i can't remember the details).
> ...



Haven't heard of that issue before.. I'd guess maybe the kernel-area didn't write properly, or it could be the filesystem that got corrupt.
If your unit can still use USB we might be able to help you out though 
Join the discord https://discord.gg/SeZ3RPb and we can walk you through getting a NAND dump, once you have a dump hopefully we can figure out whats wrong with it.
(I might not be online when you join, but if you ask about getting a dump someone should help you)


----------



## Deleted User (Mar 15, 2018)

The most obvious next question would be: Is it vulnerable to the Trucha/fakesign bug? It seems to be an early version of ES from the Wii, so probably.


----------



## emoose (Mar 15, 2018)

parrotgeek1 said:


> The most obvious next question would be: Is it vulnerable to the Trucha/fakesign bug? It seems to be an early version of ES from the Wii, so probably.



I'm hoping so, but for that we need to figure out how they actually check the signatures first... I found out how it works for the SKSA/kernel signature, but nothing I try seems to work for the 2 game ticket signatures 

I'm thinking it might be changing some part of the ticket just before it validates it, like decrypting the title key first or something. There's work on getting a RAM sniffer setup, so hopefully that'll reveal more of it to us.


----------



## MockyLock (Mar 15, 2018)

emoose said:


> Haven't heard of that issue before.. I'd guess maybe the kernel-area didn't write properly, or it could be the filesystem that got corrupt.
> If your unit can still use USB we might be able to help you out though
> Join the discord https://discord.gg/SeZ3RPb and we can walk you through getting a NAND dump, once you have a dump hopefully we can figure out whats wrong with it.
> (I might not be online when you join, but if you ask about getting a dump someone should help you)



Thank you for your offer.
i'll try to get there, hopefully this WE, as i have a lot of work.
See you soon !


----------



## emoose (Mar 24, 2018)

Another status update: with the latest iQueTool we're now able to write any valid SKSAs (system updates) to the player!
There doesn't seem to be any protection against downgrading, so it should work with most of the SKSAs available to us.

There's some very strange SKSAs we can try too: a normal SKSA is around 944KiB, with the NAND only reserving a ~1MiB area for it.
But some SKSAs have way different sizes, eg an 80KiB one (which is missing a system-app entirely, but is still signed & valid...), 3MiB ones which seem too large for the iQue Player...

Sadly most weird-sized ones won't boot, my guess is they might be expecting some input over USB/probe points, or in the worst case they might be encrypted with a different key to retail iQues.

Most interesting are the 224KiB ones though... @Kevinpuerta tried the 224KiB 1010 SKSA out, and well: https://cdn.discordapp.com/attachme...2/425147639533666304/JPEG_20180318_212448.jpg
I'd bet its the first time anyones seen that screen in years 

@Normmatt also got another interesting one to boot: https://cdn.discordapp.com/attachments/412682242490630162/426546583065329674/IMG_0544.JPG
Apparently that's a demo included with the N64 SDK, but they turned it into a whole system-update... pretty neat stuff!

We've also opened up our own dev-wiki for the iQue now too! You can find it at iquebrew.org.
It's a little rough around the edges atm, but we're hoping to fill it up pretty soon with everything we've learned so far.


----------



## Makapak (Apr 26, 2018)

Some scary thing:

htttps://pastebin.comm/wYgcwELR

Zzz forum won't allow to post link, just remove that extta t and m from above link (probably need 20 or higher iq to know which ones)

Oh also I see this:

htttps://gbatemp.nett/threads/ique-game-dumps-courtesy-of-suxxors.501944/

Edit: oh I see there's a thead already in this forum about suxxors releasing decrypted star fox from ique player


----------



## Jhynjhiruu (Apr 27, 2018)

Makapak said:


> Some scary thing:
> 
> htttps://pastebin.comm/wYgcwELR
> 
> ...


I recommend that you don't link to that, it has copyrighted stuff in it


----------



## Makapak (Apr 27, 2018)

Ah yes I forgot we are supposed to act like piracy is a bad thing.


----------

