Hacking Successfully added corrupt Mii to WiiU

[maxsnipez]

Yup another VWii related post, but this time theres something interesting..

So I was reading through threads on multiple forum sites (including this site) and found something about a WiiU reading Miis from VWii to transfer them. I decided to corrupt a random mii and add it with MiiInstaller. What I found is actually pretty interesting..

Heres what I used

• WiiU (duh)
• 2GB SD Card (any size bigger than this works as well)
• Macbook Pro (works with windows. Just need to have a SD Slot)
• MiiInstaller
• MiiExtractor
• Homebrew Channel
• A corrupt Mii (crashes the WiiU out of VWii)
• Wii Remote (to get into VWii)

What I did and what happened. (Long)

Spoiler

• First, I installed the homebrew channel on the VWii part of my WiiU. This is allows me to import the corrupt Mii into the VWii Section.

• Then once I had the homebrew channel installed I made a Mii in the VWii Mii Channel I just used default mii settings and looks.

• After I created the Mii I added the apps MiiInstaller and MiiExtractor onto my SD card and put it in the the wii and booted up the homebrew channel then selected MiiExtractor, which will put the current Miis onto the SD card in a folder called "miis" in the root.

• When It was finished extracting the Miis to my SD card I put it back in my Mac and edited the Mii file changing the name to a 11 character string, causing the name of the Mii to exceed the 10 character limit set by Nintendo similar to the Twilight hack.

• Once the name was set to 11 out of 10 characters I saved it and put it back in the "miis" folder on my SD card, then put the SD back into the WiiU, then I booted up VWii again, launched the Homebrew Channel then started the MiiInstaller application. The Mii installed without a problem onto the VWii Mii Channel. (If you launch the Mii Channel with him in there it will crash or freeze the VWii if hes selected. I would avoid doing that because it waists time.)

• After the installation finished and the corrupt Mii was in the WVii Mii Channel I rebooted the WiiU and selected the WiiU "Mii Maker" Channel, then selected the "Send/Receive Mii" option then selected the "Copy from Wii Menu" Option, tapped "Check" on the popup that appears and it found the corrupt Mii from the VWii I added.

• I made the WiiU copy the corrupted Mii into the WiiU "Mii Maker" Channel, and it once again worked without error!

• After the Mii was added into the WiiU I rebooted it again then went back into the "Mii Maker" channel, then selected "Select Mii" and the Mii was in the Mii Library!

• Then I tapped the corrupt Mii and the WiiU froze then eventually shut off. So I tried it again and the WiiU crashed to a black error screen with white text saying the following "An error has occurred and the WiiU needs to shut down."

Anyway my point with this is I got a tampered file to be added into the WiiU outside of VWii mode and then cause the WiiU to crash..
Let me know what you think about this.

 

[crwys]

I doubt anything will come out of this, but its nice to see people trying.

 

[DillPo313]

Yup another VWii related post, but this time theres something interesting..


So I was reading through threads on multiple forum sites (including this site) and found something about a WiiU reading Miis from VWii to transfer them. I decided to corrupt a random mii and add it with MiiInstaller. What I found is actually pretty interesting..


Heres what I used

WiiU (duh)
2GB SD Card (any size bigger than this works as well)
Macbook Pro (works with windows. Just need to have a SD Slot)
MiiInstaller
MiiExtractor
Homebrew Channel
A corrupt Mii (crashes the WiiU out of VWii)
Wii Remote (to get into VWii)
What I did and what happened. (Long)

Spoiler

First, I installed the homebrew channel on the VWii part of my WiiU. This is allows me to import the corrupt Mii into the VWii Section.

Then once I had the homebrew channel installed I made a Mii in the VWii Mii Channel I just used default mii settings and looks.

After I created the Mii I added the apps MiiInstaller and MiiExtractor onto my SD card and put it in the the wii and booted up the homebrew channel then selected MiiExtractor, which will put the current Miis onto the SD card in a folder called "miis" in the root.

When It was finished extracting the Miis to my SD card I put it back in my Mac and edited the Mii file changing the name to a 11 character string, causing the name of the Mii to exceed the 10 character limit set by Nintendo similar to the Twilight hack.

Once the name was set to 11 out of 10 characters I saved it and put it back in the "miis" folder on my SD card, then put the SD back into the WiiU, then I booted up VWii again, launched the Homebrew Channel then started the MiiInstaller application. The Mii installed without a problem onto the VWii Mii Channel. (If you launch the Mii Channel with him in there it will crash or freeze the VWii if hes selected. I would avoid doing that because it waists time.)

After the installation finished and the corrupt Mii was in the WVii Mii Channel I rebooted the WiiU and selected the WiiU "Mii Maker" Channel, then selected the "Send/Receive Mii" option then selected the "Copy from Wii Menu" Option, tapped "Check" on the popup that appears and it found the corrupt Mii from the VWii I added.

I made the WiiU copy the corrupted Mii into the WiiU "Mii Maker" Channel, and it once again worked without error!

After the Mii was added into the WiiU I rebooted it again then went back into the "Mii Maker" channel, then selected "Select Mii" and the Mii was in the Mii Library!

Then I tapped the corrupt Mii and the WiiU froze then eventually shut off. So I tried it again and the WiiU crashed to a black error screen with white text saying the following "An error has occurred and the WiiU needs to shut down."
Anyway my point with this is I got a tampered file to be added into the WiiU outside of VWii mode and then cause the WiiU to crash..
Let me know what you think about this.

Great job! Hope someone at least looks into this!!!

 

[uyjulian]

new exploit? This is what I've thinking all along anyway...

 

[McHaggis]

The exception sounds like it was handled, which means it's likely not exploitable. Exploitable crashes usually dump data onto the screen, and don't normally switch off the console.

 

[uyjulian]

I wonder if the application is sandboxed...

 

[stomp_442]

maybe the Wii mini can be hacked in this manor.

 

[uyjulian]

maybe the Wii mini can be hacked in this manor.

No SD card, no internet...
how are you going to hack it?

 

[Sicklyboy]

maybe the Wii mini can be hacked in this manor.

The Wii Mini would need to be hacked in order to do this in the first place, you know...

 

[stomp_442]

No, ssbb can access the wii remote, I think that it is for save profile data.

I know that the hackmii installer only runs from SD card, if it were made to run from USB then a hack for wii mini just might be possible

No SD card, no internet...
how are you going to hack it?

No SD card I understand, why is internet required to hack a Wii.

 

[lismati]

The Error was handled, so this isn't a possible exploit vector.

 

[Sicklyboy]

No, ssbb can access the wii remote, I think that it is for save profile data.

I know that the hackmii installer only runs from SD card, if it were made to run from USB then a hack for wii mini just might be possible




No SD card I understand, why is internet required to hack a Wii.

Access the Wii remote how? This is the first I've heard of this.

Saves are stored to the console.

How do you plan to run it form USB when games don't load data off of USB and there's no file browser on the Wii?

Internet - you need a MAC address for Letterbomb/Wilbrand.

 

[uyjulian]

there's games that load data off the Wiimote
what happens if you could exploit that?

 

[stomp_442]

Access the Wii remote how? This is the first I've heard of this.

http://en.wikipedia.org/wiki/Wii_Remote#Memory

 

[blinkzane]

I'm SO glad somebody took my idea since I was too lazy to play with it, congrats on confirming my theory!
Once I actually get some time on my hands I will play with this more. props.

 

[Ray Lewis]

I guess this ended, lol. Cool idea, makes me wonder if something else to cause unhandled exception could be put into a mii;-)

 

[Isle41]

Er, I could be wrong, but I think this was tried on the wii...
http://mariokartcustom.niceboards.org/t468-longer-mii-name

I don't know if this was tried further (eg, with games), but I doubt it's harmful.

I suppose the Wii U just prepared for this (perhaps sincerr Ninty want's you to have the possibility to save it to your account)..

But on the WiiU did it display the full name? Can you use it in a game? Very curious.

 

[blinkzane]

Er, I could be wrong, but I think this was tried on the wii...
http://mariokartcustom.niceboards.org/t468-longer-mii-name

I don't know if this was tried further (eg, with games), but I doubt it's harmful.

I suppose the Wii U just prepared for this (perhaps sincerr Ninty want's you to have the possibility to save it to your account)..

But on the WiiU did it display the full name? Can you use it in a game? Very curious.

that would be a good test, maybe load the mii from nintendoland as a new character or something

 

[picano]

that would be a good test, maybe load the mii from nintendoland as a new character or something

Do miis import as favorites? If not, you would have to be able to edit the corrupt me to set it as such, otherwise it won't appear in NL's menus.

 

[maxsnipez]

I'm SO glad somebody took my idea since I was too lazy to play with it, congrats on confirming my theory!
Once I actually get some time on my hands I will play with this more. props.

Actually your post is what gave me the idea at first! So I decided to do some research on it then try it!