Hacking Wii U Hacking & Homebrew Discussion

[loco365]

Well, the settings app for sure has SD access as it's the only place to copy Wii U saves to the SD card.

So does the binary that boots the vWii, seeing as the vWii also has SD access.

 

[WulfyStylez]

So does the binary that boots the vWii, seeing as the vWii also has SD access.

I don't imagine the binary that starts the process from Cafe OS does. Launching vWii is a whole separate thing, involving cafe2wii and such.

 

[Bug_Checker_]

mentioned @ 30c3 f0f talk by Marcan
CAFE2WII
The ARM Wii U Starbuck code that switches to vWii mode.
Contains interesting low-level code.
It doesn't have an IOS or kernel.It's just low level code it has all the modules it needs
Tells us what we have to undo.(to go from vWii mode to WiiU mode)

System control and security stuff MCP
MCP_HWSetAHBCompatMode
MCP_HWSetCompatMode
MCP_HWSetMEM1MapCompatMode
MCP_HWSetSysProt
C2W_LaunchWiiIOS
C2W_FinalizeCafe last thing that happens before WiiU mode
C2W_SetEspressoPLLConfigGPIO which is what persumably switches espresso freq multiplier espresso speed
change the fan speed and some other misc crap

 

[gudenau]

I think it's considered polite to credit your sources


Yes, you're quite right, we've run into this problem. No app we've tested has SD access, so we can't access it despite the PPC Kernel exploit. That said, we haven't finished our IPC experiments, we've not yet successfully impresonated the system, which may have sufficient privilege.

Oops, thought I credited you. Sorry! :-/

 

[filfat]

The website is temporarily down due to nameserver changes!

 

[rumblpak]

Not to thread hijack but since I'm getting the update pop-up even with every ip and website properly blocked I thought I'd give a much safer option at this point. this will effectively block any data that is going out of the local network, which is what I want it to function as. I can still access a local webserver to run rop but without any of the nasty possibilities of getting any updates. You will need to edit the mac to your wiiu's mac and remove the # symbols for it to run. This of course requires a router that will run iptables, which is pretty much any router capable of openwrt, ddwrt, etc.

#iptables -I FORWARD -p ALL -m mac --mac-source 34:af:2c:**:**:** -j DROP
 
#iptables -I OUTPUT -p ALL -m mac --mac-source 34:af:2c:**:**:** -j DROP

 

[NWPlayer123]

Not to thread hijack but since I'm getting the update pop-up even with every ip and website properly blocked I thought I'd give a much safer option at this point. this will effectively block any data that is going out of the local network, which is what I want it to function as. I can still access a local webserver to run rop but without any of the nasty possibilities of getting any updates. You will need to edit the mac to your wiiu's mac and remove the # symbols for it to run. This of course requires a router that will run iptables, which is pretty much any router capable of openwrt, ddwrt, etc.

#iptables -I FORWARD -p ALL -m mac --mac-source 34:af:2c:**:**:** -j DROP
 
#iptables -I OUTPUT -p ALL -m mac --mac-source 34:af:2c:**:**:** -j DROP

Yeah, I have literally every url Nintendo uses (*.wii.com, *.nintendo.net, *.akamaitechnologies.com, etc) blocked and yet I still get the update popup, so it has to be something on the local machine, nintendo stored some cookie or something that tells it to yell at you to update every time it does something. That's much more intuitive and straightforward for blocking though.

 

[Huntereb]

Yeah, I have literally every url Nintendo uses (*.wii.com, *.nintendo.net, *.akamaitechnologies.com, etc) blocked and yet I still get the update popup, so it has to be something on the local machine, nintendo stored some cookie or something that tells it to yell at you to update every time it does something. That's much more intuitive and straightforward for blocking though.

Once you get it the first time, it's stored forever. Probably like the 3DS and Updates when you put it in sleep mode.

 

[pelago]

Not to thread hijack but since I'm getting the update pop-up even with every ip and website properly blocked I thought I'd give a much safer option at this point. this will effectively block any data that is going out of the local network, which is what I want it to function as. I can still access a local webserver to run rop but without any of the nasty possibilities of getting any updates. You will need to edit the mac to your wiiu's mac and remove the # symbols for it to run. This of course requires a router that will run iptables, which is pretty much any router capable of openwrt, ddwrt, etc.

#iptables -I FORWARD -p ALL -m mac --mac-source 34:af:2c:**:**:** -j DROP
 
#iptables -I OUTPUT -p ALL -m mac --mac-source 34:af:2c:**:**:** -j DROP

Personally I would just give the Wii U a manual IP address (not using DHCP) in the same range as your LAN, but don't give it a default gateway, or give it a fake default gateway if you cannot leave it blank (e.g. set the default gateway to be the same as the IP address for the Wii U itself).

That way the Wii U can access your webserver on your LAN but cannot access the Internet, and you don't need to do anything fancy on your router.

 

[filfat]

The website is now live again, but please be aware that so far haven't we pushed the exploit to the website.

 

[celcodioc]

I just finished an early version of my new WiiUExplorer program, which combines the previous small tools into one (and replaces them). It is able to display both uncompressed and Yaz0-compressed SARC files in a browser, and extract either individual files/folders or the entire archive. Writing support and other file formats will be added in the future.

https://www.dropbox.com/sh/tfg2nd6q809oqn3/AADWk3SgQEsqnvlbplcWOfv5a

 

[filfat]

I just finished an early version of my new WiiUExplorer program, which combines the previous small tools into one (and replaces them). It is able to display both uncompressed and Yaz0-compressed SARC files in a browser, and extract either individual files/folders or the entire archive. Writing support and other file formats will be added in the future.

https://www.dropbox.com/sh/tfg2nd6q809oqn3/AADWk3SgQEsqnvlbplcWOfv5a

Added it to the OP

 

[Relys]

https://www.dropbox.com/sh/tfg2nd6q809oqn3/AADWk3SgQEsqnvlbplcWOfv5a

Nice release celcodioc!

 

[filfat]

I just finished an early version of my new WiiUExplorer program, which combines the previous small tools into one (and replaces them). It is able to display both uncompressed and Yaz0-compressed SARC files in a browser, and extract either individual files/folders or the entire archive. Writing support and other file formats will be added in the future.

https://www.dropbox.com/sh/tfg2nd6q809oqn3/AADWk3SgQEsqnvlbplcWOfv5a

wait a second... you use C#?
I... Think... I... I... Love You...

On a more serious note "Bra Gjort"

 

[celcodioc]

Hehe, thanks both of you!

 

[DanT1983]

Hehe, thanks both of you!

Thank you.

People like you give me the best hope to play my Japan bought games on my Wii U, as well as playing emulated SNES and N64 games (the games of my childhood).

I have unlimited access to the Japanese import market, having to go there multiple times/year for work, and not being able to play them is simply a slap in the face.
I never expected Nintendo to region lock, and that is the single GRAVEST travesty they are guilty of so far (IMHO, OFC).

The funny thing is if they removed region locking, I would happily update and ignore homebrew completely.

Honestly, why does a company region lock? If I buy games while in Japan, they still get my money. Why bother region locking? This really is pathetic.

 

[loco365]

I just finished an early version of my new WiiUExplorer program, which combines the previous small tools into one (and replaces them). It is able to display both uncompressed and Yaz0-compressed SARC files in a browser, and extract either individual files/folders or the entire archive. Writing support and other file formats will be added in the future.

https://www.dropbox.com/sh/tfg2nd6q809oqn3/AADWk3SgQEsqnvlbplcWOfv5a

Chrome is blocking me from downloading the WiiUExplorer_v1.0.1.0.zip file, as it claims it's malicious. The AntiVirus isn't detecting it because I'm attempting to download it into a whitelisted area. I'll try building the source code.

Edit: Oh, that's not the source for this. Oops.

 

[filfat]

Chrome is blocking me from downloading the WiiUExplorer_v1.0.1.0.zip file, as it claims it's malicious. The AntiVirus isn't detecting it because I'm attempting to download it into a whitelisted area. I'll try building the source code.

Edit: Oh, that's not the source for this. Oops.

otherwise click "Show Downloads" and then click "Restore File"

 

[loco365]

otherwise click "Show Downloads" and then click "Restore File"

I don't have that option, but I'll just toggle Chrome's settings and see if I can get it to not block the file.

 

[Bug_Checker_]

I don't have that option, but I'll just toggle Chrome's settings and see if I can get it to not block the file.

try control + j