Hacking Wii U Hacking & Homebrew Discussion

[uyjulian]

So in short we don't have any standard library's to work with?
Which means I can't use function such as "sprintf_s" or "string",
Because I really need at least "stdio.h"

No, you have to find OS function.

However you can use OS function to write a std c lib.

 

[Crewman]

Has someone successfully mounted the sd card or an usb stick yet?
This is an essential step for a homebrew channel, witch can be loaded using this exploit.

The FSAMount function looks very promising for this but where do I get all the parameters it requires?

 

[Ninja_Carver]

IOError: [Errno 2] No such file or directory: 'code.bin' <--- prrretty self-explanatory.

 

[filfat]

Yeah, because the code didn't compile...

 

[keine]

Can someone explain how we can be in userland and not have access to all functions provided?
So its a semi userland?

 

[NeKit]

Has someone successfully mounted the sd card or an usb stick yet?
This is an essential step for a homebrew channel, witch can be loaded using this exploit.

The FSAMount function looks very promising for this but where do I get all the parameters it requires?

We tried to mount SD card, but most likely browser isn't allowed to do this, so it doesn't see an SD card inserted.
Look at the docs and include files of the leaked SDK.

Can someone explain how we can be in userland and not have access to all functions provided?

So its a semi userland?

We have access to the all functions provided for the browser or regular app.

 

[m3hh]

Hi guys, this is my first post. Im trying to build the hello.c example on Mac OS X (10.9) so I can create a step by step guide for other Mac users, however I get the below error. Note that I already added devkitPPC and Python 3.x to the $PATH.

expr: syntax error
0+1 records in
0+1 records out
216 bytes transferred in 0.000343 secs (630021 bytes/sec)
powerpc-eabi-ld: warning: cannot find entry symbol _start; defaulting to 01800000
dyld: Library not loaded: @rpath/Python
  Referenced from: /Users/m3hh/Library/Enthought/Canopy_64bit/User/bin/python
  Reason: image not found
./build.sh: line 38:  755 Trace/BPT trap: 5      ./generate_html.py $ver > $HTDOCS/test$ver.html

 

[Ninja_Carver]

Hi guys, this is my first post. Im trying to build the hello.c example on Mac OS X (10.9) so I can create a step by step guide for other Mac users, however I get the below error. Note that I already added devkitPPC and Python 3.x to the $PATH.

expr: syntax error
0+1 records in
0+1 records out
216 bytes transferred in 0.000343 secs (630021 bytes/sec)
powerpc-eabi-ld: warning: cannot find entry symbol _start; defaulting to 01800000
dyld: Library not loaded: @rpath/Python
  Referenced from: /Users/m3hh/Library/Enthought/Canopy_64bit/User/bin/python
  Reason: image not found
./build.sh: line 38:  755 Trace/BPT trap: 5      ./generate_html.py $ver > $HTDOCS/test$ver.html

Reason: image not found

does /Users/m3hh/Library/Enthought/Canopy_64bit/User/bin/python exist?

Try this fix...

http://stackoverflow.com/questions/17568173/venv-python-uses-incorrect-sys-prefix

 

[m3hh]

Reason: image not found

does /Users/m3hh/Library/Enthought/Canopy_64bit/User/bin/python exist?

Try this fix...

http://stackoverflow.com/questions/17568173/venv-python-uses-incorrect-sys-prefix

Hmm, the referenced directory doesn't exist...

Where is this directory called from then?

 

[Ninja_Carver]

you have to set your python path apparently.

without looking at the code I'm not sure which ENV variable you need to set. But if that referenced directory does not exist, that surely could be an issue.

 

[filfat]

-snip-

 

[Helsionium]

Anyone here knows which type of file Cafe SDK generates?

According to the documentation, it generates RPL and RPX files.

 

[crediar]

By default no Wii U application can access the SD card, it has to be enabled in the per-application configuration.

 

[Marionumber1]

By default no Wii U application can access the SD card, it has to be enabled in the per-application configuration.

Yeah, I suspected something along those lines when we were unable to mount the SD card. I'm fairly sure Cafe OS has access to it, but only privileged code (definitely the kernel, possibly the loader as well) can do anything with it. This is another reason why a kernel or loader exploit is important.

 

[uyjulian]

According to the documentation, it generates RPL and RPX files.

RPL/RPX are based on ELF.

 

[arbiter34]

Marionumber1, have any attempts been made to mount /dev/mlc01 (NAND)? From reading some of the documentation, apps might be allowed access to it. It isn't clear however, whether that is indirectly thought the emulated file system, or directly.

 

[Marionumber1]

Marionumber1, have any attempts been made to mount /dev/mlc01 (NAND)? From reading some of the documentation, apps might be allowed access to it. It isn't clear however, whether that is indirectly thought the emulated file system, or directly.

I tried opening /dev/mlc (not /dev/mlc01) as part of a series of tests in ios.c. What I noticed was that opening some IOS device nodes (like /dev/drh) returned -6, which means the file didn't exist in old Wii IOS. However, opening /dev/mlc returned -1, which is still an error but a different one. I took this to mean that /dev/mlc, which is the raw eMMC flash, exists but cannot be opened by the browser. As for accessing the filesystem, not the raw flash, the browser can only access its own content directory.

 

[arbiter34]

I see, I was going off of the documentation which stated that NAND is mlc01. But if we can't mount at all, then it wouldn't matter much.

 

[Relys]

RPL/RPX are based on ELF.

RPL is a library and RPX is an executable.

There's a tool for converting RPL/RPX to normal elf files ELF: https://www.sendspace.com/file/ss5pn1

Here's a good writeup for reversing RPL/RPX Wii U files: http://devram0.blogspot.it/2014/01/reversing-wii-u-executables.html

 

[crediar]

-1 is access denied