Hacking Hijill 0.2 release

[Wentstorm]

I compiled it, i launched it (wrapper.dol) but it does nothing o.o
What this string mean (from makeit.sh)?

cp -f ./wrapper.dol ../myWad/00000002.app

I have to inject the dol into the HBC wad?

 

[person66]

I compiled it, i launched it (wrapper.dol) but it does nothing o.o
What this string mean (from makeit.sh)?

cp -f ./wrapper.dol ../myWad/00000002.app

I have to inject the dol into the HBC wad?

Yeah, I have the same problem. I compiled it fine, got the wrapper.dol file, but now, if I launch it from the homebrew channel it does nothing (starts, waits a few seconds then exits back to the homebrew channel without any of the patches applied), and if I launch it from a channel made with customizemii, it hangs at a black screen.

Any help?

 

[Etheboss]

Hehe, i knew it would not be that easy...

 

[lulwut]

im sure it works fine if you know what to do which for some is easy as hell

 

[XFlak]

I don't know if this is required, but have u tried launching the dol with ahbprot? Or injecting the dol into an ahbprot enabled base channel?

 

[SifJar]

You can do your own haxxoring and add your own patches. The best patch wins a prize.

Lets see what some of you kick ass people can come up with.

My wishlist:

• Direct launching of gamecube homebrew binaries (cMIOS support)
• xNEEK support
• Choose which IOS to use
• Custom music support
• Built-in sysCheck application (is that even doable with patches?)
• Built-in warez launcher (just kidding)

Most of those are pretty major changes. Patches to do those would be hard and time consuming to create.

EDIT: Did you all definitely compile it correctly? i.e. compile dumper.dol and loader.dol, rename to dumper.bin and loader.bin, move to the "data" directory then compile wrapper.dol? Once you've done that you should be able to run it. if you have a USB gecko, info is output over that. it probably wouldn't be that hard to modify it to output to the tv screen instead, but it wouldn't show up for long.

 

[JoostinOnline]

You can do your own haxxoring and add your own patches. The best patch wins a prize.

Lets see what some of you kick ass people can come up with.

My wishlist:

• Direct launching of gamecube homebrew binaries (cMIOS support)
• xNEEK support
• Choose which IOS to use
• Custom music support
• Built-in sysCheck application (is that even doable with patches?)
• Built-in warez launcher (just kidding)

Most of those are pretty major changes. Patches to do those would be hard and time consuming to create.

EDIT: Did you all definitely compile it correctly? i.e. compile dumper.dol and loader.dol, rename to dumper.bin and loader.bin, move to the "data" directory then compile wrapper.dol? Once you've done that you should be able to run it. if you have a USB gecko, info is output over that. it probably wouldn't be that hard to modify it to output to the tv screen instead, but it wouldn't show up for long.

ROFL! That explains why I couldn't get it to compile! XD

 

[G0dLiKe]

nice. this means hbc with swimming mario and luigi animation heh

 

[xfcrowman]

EDIT: Did you all definitely compile it correctly? i.e. compile dumper.dol and loader.dol, rename to dumper.bin and loader.bin, move to the "data" directory then compile wrapper.dol? Once you've done that you should be able to run it. if you have a USB gecko, info is output over that. it probably wouldn't be that hard to modify it to output to the tv screen instead, but it wouldn't show up for long.

@SifJar - I followed these instructions and I can compile wrapper.dol. Unfortunately, I get the same outcome as everyone else - I load it from HBC, and after a brief black screen it returns to the HBC. Clearly I am missing some step. Could someone who has done this successfully explain what is missing here?

Thanks!

 

[person66]

EDIT: Did you all definitely compile it correctly? i.e. compile dumper.dol and loader.dol, rename to dumper.bin and loader.bin, move to the "data" directory then compile wrapper.dol? Once you've done that you should be able to run it. if you have a USB gecko, info is output over that. it probably wouldn't be that hard to modify it to output to the tv screen instead, but it wouldn't show up for long.

@SifJar - I followed these instructions and I can compile wrapper.dol. Unfortunately, I get the same outcome as everyone else - I load it from HBC, and after a brief black screen it returns to the HBC. Clearly I am missing some step. Could someone who has done this successfully explain what is missing here?

Thanks!

Exact same issue with me. Although when I compile it, when I am compiling the worker I get two warnings in main.c:

main.c
c:/HiJill_CLEAN/worker/source/main.c: In function 'LoadElf':
c:/HiJill_CLEAN/worker/source/main.c:426:56: warning: unused variable 'addrEnd' [-Wunused-variable]
c:/HiJill_CLEAN/worker/source/main.c:426:38: warning: unused variable 'addr2' [-Wunused-variable]

Is that causing the problems?

 

[Thomas83Lin]

I'm getting the same problem as everyone else, Used my usb gecko to output the info

heres the error i'm getting running stright from HBC 1.0.8 IOS58 v24.32

hijill starting
loading patcher
loading loader
jump...
loader 1 starting up
ES_GetStoredTMDSize: -106

I don't know if this is required, but have u tried launching the dol with ahbprot? Or injecting the dol into an ahbprot enabled base channel?

Just tried this with a static ahbprot base channel and customizemii still got a error though its different

hijill starting
loading patcher
loading loader
jump...
loader 1 starting up
num_contents: 3
HBC content not found, followed by a code dump

 

[crwys]

Very nice work Pune.
I must say I have been around the Wii scene since it first started. And we had the first snake game made and the first exploit. (Twilight Hack)
And there are many great people in this community and in my opinion the best compared to 360 and PS3.
Even though Pune is just the creator of this. I want to say nice work to all the devs that have put their time and work into the Wii scene.

 

[giantpune]

the issue blackace is getting is probably because he doesn't make a change to the source code to tell it where to look to find the right content. look at line 180ish in the main.c in the loader dol. there is a line like "u64 tid = 0x1000143484243ull;". you have to change this according to how you are running it. some things to consider are:

1 - you need to use a TID that exists on your wii
2 - somewhere in that title, there should be a copy of the hbc executable
3 - however you run hijill, it must have permission to access the contents of whichever TID you use


the quickest way to see it work it to change all the occurrences of 43484243 into af1bf516 and build it. then run it via wiiload or using a xml file with the no_ios_reload. this way it will start up with the identity of HBC, which obviously contains a copy of the hbc executable. and it will be allowed to access this data.

 

[Thomas83Lin]

the issue blackace is getting is probably because he doesn't make a change to the source code to tell it where to look to find the right content. look at line 180ish in the main.c in the loader dol. there is a line like "u64 tid = 0x1000143484243ull;". you have to change this according to how you are running it. some things to consider are:

1 - you need to use a TID that exists on your wii
2 - somewhere in that title, there should be a copy of the hbc executable
3 - however you run hijill, it must have permission to access the contents of whichever TID you use

1. I used the title id CHBC for the channel is this not correct?
2. this i didn't do, so i'll try that
3. I understand that

 

[JoostinOnline]

This doesn't do any permanent patching, does it?

 

[giantpune]

my program does not make any permanent patches. but it does patch the HBC, which in turn writes to the nand. depending on how you use it, there might very well be some changes made to your nand. an example is like if you start this from a game exploit without first making it not create the save data. even though my program doesn't write anything to the nand, the patched hbc will write its save data in the data folder of whichever title it happens to be identified as.

 

[Thomas83Lin]

Using your edited instructions i got it working. Thanks

edit:Finally got it running from its own channel.sweet

 

[xfcrowman]

Using your edited instructions i got it working. Thanks

Giantpune's updated instructions worked for me as well - thanks!

I'm still trying to get the hbc.elf to dump so I can use it with neek2o, but no luck yet. As Snickerz suggested, I'm looking in worker/source/patches.c but I haven't figured out what needs to be changed so that hbc.elf can be dumped. I'm also going to look in main.c since that is where the patches are applied, but it looks like RemoveAntiHaxx() is already applied there. Any help with this would be greatly appreciated.

 

[Wentstorm]

YEEEAH!
Now it works properly!
Just one question, how to create patches? The disassembled code of the HBC is extremely encrypted

 

[person66]

OK, with pune's instructions I got it working. Nice job with this btw, only one problem that I have noticed; the power button on the wii itself doesn't work, but hitting home then shutdown, or using the power button on the wiimote both work fine.

You can actually use this to dump the HBC elf. If you apply the patches from RemoveAntiHaxx() in worker/source/patches.c, you get a hbc.elf that's bootable everywhere - in SNEEK, with a cIOS, even from a PPC side exploit (letterbomb etc) without installing anything.

Of course, there's no chance that I'm going to share it because of copyright issues. But it's not that hard.

Any chance you could tell me the size of the file? I thought I got it to dump right, but it doesn't seem to be loading so obviously I did something wrong.