Hacking Wii U Hacking & Homebrew Discussion

VinsCool · Aug 27, 2015

pedro702 said:
any chance you start a wiki with the games that are compatible and all settings need to be changed? i mean the ones you tryed that is.

I do plan to make a database of game config, but I need to get all the lines before. This was a quick test, because if I injected the rom only, it blackscreens.

At least I figured it out, So more games should work!

loco365 · Aug 27, 2015

Blarg now I'm kicking myself in the ass for not getting an N64 game. I still have SNES and DS though, so I can try those in the future.

VinsCool · Aug 27, 2015

Figured super mario 64 too, thanks to nintendo for making many config files for many games

Works now.

;Mario64
[RomOption]
;BackupType 0 Auto 1 SRAM 2 Flash 3 EEPROM
BackupType = 3
;BackupSize 2048 16K 4K 512
BackupSize = 512
Rumble = 0
UseTimer = 1

[Idle]
Count = 1
Address0 = 0x80317934
Inst0 = 0x01E4082A
Type0 = 1

[BreakBlockInst]
Count = 1
Address0 = 0x8027F578
Inst0 = 0x00000000
JmpPC0= 0x8027F500
Type0 = 1

[Render]
CalculateLOD = 1

[FilterHack]
Count = 1

TextureAddress0 = 0x1cb000
SumPixel0 = 0xd522f45e
Data2_0 = 0x801055
Data3_0 = 0x80000
AlphaTest0 = 250

[VertexHack]
Count = 21

;Fix Logo point
VertexCount0 = 15
VertexAddress0 = 0x84720
TextureAddress0 = 0x8ccc0
FirstVertex0 = a6:02 63 00 1f 00 1d
Value0 = a18:00 02
00 01 02 bc 00 67 ff f4
00 02 03 17 00 c8 ff bc

;Fix BTS No.405_1-a
VertexCount1 = 6
VertexAddress1 = 0x105a58
TextureAddress1 = 0x1c6800
FirstVertex1 = a6:06 00 00 66 fd 01
Value1 = a18:00 02
00 00 06 00 00 66 fc fe
00 05 fa 01 00 66 fc fe

;Fix BTS No.405_1-b
VertexCount2 = 15
VertexAddress2 = 0xff108
TextureAddress2 = 0x1c6000
FirstVertex2 = a6:04 5d 0e 00 f5 b1
Value2 = a18:00 02
00 03 10 02 02 00 10 00
00 06 10 02 01 00 10 00

;Fix BTS No.405_1-c
VertexCount3 = 11
VertexAddress3 = 0xffd08
TextureAddress3 = 0x1c6800
FirstVertex3 = a6:10 00 02 00 0f 00
Value3 = a26:00 03
00 00 10 02 02 00 0e fa
00 01 0c 9a 02 00 0e fa
00 03 10 02 02 00 10 00

;Fix BTS No.405_1-d
VertexCount4 = 16
VertexAddress4 = 0xfe018
TextureAddress4 = 0x1c5800
FirstVertex4 = a6:10 00 04 33 fe 01
Value4 = a34:00 04
00 07 10 02 00 fc fe 01
00 09 10 00 04 37 06 00
00 0a 10 00 02 00 0f 04
00 0b 10 02 00 fc 0c 00

;Fix BTS No.405_2
VertexCount5 = 7
VertexAddress5 = 0x10b410
TextureAddress5 = 0x1c3800
FirstVertex5 = a6:fc 24 f8 ef 00 4c
Value5 = a18:00 02
00 04 f8 70 f8 f4 00 1e
00 06 f7 fc fb 01 00 00

;Fix NOA BTS No.3
VertexCount6 = 16
VertexAddress6 = 0x15c2c8
TextureAddress6 = 0x1ca000
FirstVertex6 = a6:f6 34 fb 01 f5 01
Value6 = a18:00 02
00 0d f5 c4 fb 01 fb ce
00 0e f5 c4 fd ce fb ce

;Improve NOA BTS No.4
VertexCount7 = 16
VertexAddress7 = 0x116ce8
TextureAddress7 = 0xfc360
FirstVertex7 = a6:0c 00 ff 9b 0c 00
Value7 = a18:00 02
00 09 04 cf ff 9b 03 bf
00 06 08 cd ff 9b 03 bf

;Fix NOA BTS No.12-a
VertexCount8 = 15
VertexAddress8 = 0x100c60
TextureAddress8 = 0x1c2000
FirstVertex8 = a6:fd d7 03 23 f7 b1
Value8 = a18:00 02
00 03 0a 08 09 23 f5 4b
00 05 0a 08 fe 01 f5 4b

;Fix NOA BTS No.12-b
VertexCount9 = 15
VertexAddress9 = 0x1007a0
TextureAddress9 = 0x1c2000
FirstVertex9 = a6:00 9a 03 23 f3 e0
Value9 = a10:00 01
00 04 01 64 02 7b f7 b1

;Fix NOA BTS No.9
VertexCount10 = 16
VertexAddress10 = 0xfe8d0
TextureAddress10 = 0x1c4000
FirstVertex10 = a6:1a 00 f4 f0 20 00
Value10 = a10:00 01
00 0e 16 00 fe 01 ed fc

;Fix NOA BTS No.33
VertexCount11 = 14
VertexAddress11 = 0x128bc0
TextureAddress11 = 0x1c5000
FirstVertex11 = a6:fb 46 00 00 fb fd
Value11 = a10:00 01
00 03 f8 90 00 00 fc 03

;Fix NOA BTS No.27
VertexCount12 = 15
VertexAddress12 = 0x10b160
TextureAddress12 = 0x1c3000
FirstVertex12 = a6:04 fb 01 9a fb 9b
Value12 = a18:00 02
00 06 f8 01 fd 01 ff fc
00 07 f8 02 04 d2 04 69

;Fix NOA BTS No.8
VertexCount13 = 14
VertexAddress13 = 0xfe730
TextureAddress13 = 0x1c8800
FirstVertex13 = a6:07 36 0c 66 e8 0d
Value13 = a10:00 01
00 01 f8 ca 0c 66 e8 01

;Fix NOA BTS No.10-c_1
VertexCount14 = 15
VertexAddress14 = 0x10afc8
TextureAddress14 = 0x1c8000
FirstVertex14 = a6:fe 67 ff e7 fb e7
Value14 = a18:00 02
00 09 fe ce fe 4e 0a bd
00 0a 01 33 fe 4e 0a bd

;Fix NOA BTS No.10-c_2
VertexCount15 = 16
VertexAddress15 = 0x102ef8
TextureAddress15 = 0xfc1e0
FirstVertex15 = a6:02 cd 00 cd fe ce
Value15 = a18:00 02
00 08 fd 34 00 cd fe cc
00 09 fd 34 00 00 fe cc

;Fix NOA BTS No.10-a_1
VertexCount16 = 8
VertexAddress16 = 0x106708
TextureAddress16 = 0x1c8000
FirstVertex16 = a6:03 44 fe ce 01 91
Value16 = a18:00 02
00 05 03 46 00 01 fe 5f
00 07 03 46 00 01 01 91

;Fix NOA BTS No.10-a_2
VertexCount17 = 15
VertexAddress17 = 0x106788
TextureAddress17 = 0xfc1e0
FirstVertex17 = a6:03 44 00 00 fe 5f
Value17 = a18:00 02
00 00 03 44 00 01 fe 5f
00 06 03 44 00 01 01 91

;Fix NOA BTS No.10-b_1
VertexCount18 = 16
VertexAddress18 = 0x104238
TextureAddress18 = 0x1c2800
FirstVertex18 = a6:02 66 00 9a 03 33
Value18 = a18:00 02
00 09 fa 1c ff ea ff 44
00 0a fa 1c ff ea fd de

;Fix NOA BTS No.10-b_2
VertexCount19 = 16
VertexAddress19 = 0x104338
TextureAddress19 = 0x1c2800
FirstVertex19 = a6:ff 67 ff ce 02 9a
Value19 = a18:00 02
00 06 fa 1c ff ea fd de
00 07 fa 1c ff 1f fd de

;Fix NOA BTS No.10-b_3
VertexCount20 = 16
VertexAddress20 = 0x104518
TextureAddress20 = 0x1c2800
FirstVertex20 = a6:fa 20 ff ec ff 44
Value20 = a18:00 02
00 00 fa 1c ff ea ff 44
00 01 fa 1c ff 1f ff 44

gamesquest1 · Aug 27, 2015

does anything work with 4.1? been trying for a few hours now to get pygecko to work and seem it simply does not want to connect for me, i ran the kernel exploit fine, then ran pygecko2, started a game but tcpgecko simply refuses to connect and says "connection to the TCP Gecko has failed! do you want to retry?",i have done everything i can think of, disabled my firewall, changed the wiiu to a static IP etc etc

so is there just something wrong on my end or is compatibility with 4.1 not really there?

NWPlayer123 · Aug 28, 2015

gamesquest1 said:
does anything work with 4.1? been trying for a few hours now to get pygecko to work and seem it simply does not want to connect for me, i ran the kernel exploit fine, then ran pygecko2, started a game but tcpgecko simply refuses to connect and says "connection to the TCP Gecko has failed! do you want to retry?",i have done everything i can think of, disabled my firewall, changed the wiiu to a static IP etc etc

so is there just something wrong on my end or is compatibility with 4.1 not really there?

4.1 is the first one TCPGecko worked with, it's what Bean uses. You just need a different codehandler since OS offsets are different. I can get you set up later.

gamesquest1 · Aug 28, 2015

NWPlayer123 said:
4.1 is the first one TCPGecko worked with, it's what Bean uses. You just need a different codehandler since OS offsets are different. I can get you set up later.

thanks a lot

, is there a 4.1 version of cafiine too? just wanted to have a lil play about with NSMBU/NSLU and afaik the only game to update to 5.3 is mario part 10 which is like £30, gonna ask around if any friends/family have it, but would be cool if there was the tools for 4.1 as i don't really have need for 5.3 personally

NWPlayer123 · Aug 28, 2015

gamesquest1 said:
thanks a lot , is there a 4.1 version of cafiine too? just wanted to have a lil play about with NSMBU/NSLU and afaik the only game to update to 5.3 is mario part 10 which is like £30, gonna ask around if any friends/family have it, but would be cool if there was the tools for 4.1 as i don't really have need for 5.3 personally

Yea, both of them have version-specific offsets. Splatoon and Mario Party 10 have 5.3.2, yea, surprised how few do considering how long it was out.

Onion_Knight · Aug 28, 2015

Team Fail said:
I'm thinking soon, but not too soon. It'd be nice to get a status update so people stop asking every day about it, but people are busy so...

It seems the same user exploit that works for 5.4, works for 5.5; and the kxploit that is unpublished probably works for both as well with some ROP offsets that are different. Based on what we've seen MN1 won' t release the userland exploit till its patched since it makes zero sense to tell someone that you have it. Same for the other kxploit. So unless they find another one, which they probably aren't searching too hard for right now

NWPlayer123 said:
Yea, both of them have version-specific offsets. Splatoon and Mario Party 10 have 5.3.2, yea, surprised how few do considering how long it was out.

random question, is the rop chain the same? basically, if we knew the 1st offset of the rop chain, we could calculate the difference for all the rest of the instructions by subtracting doing this? rop1 (5.3.2) - rop1(4.1.0) = x and just subtract/add x to the rest?

NWPlayer123 · Aug 28, 2015

There is no ROP, that's only for setting up code in JIT for the initial userspace exploit. The code it runs is irrelevant, unless you're doing multi-core stuff since JIT is only on core 1.

Monado_III · Aug 28, 2015

moops44 said:
we immediately need a fwspoofer
it has more priority than emunand or other things to play online again
~~MK8~~ Splatoon on singleplayer sucks

I can't even do some fun hacking stuff either as I'm on 5.4, at least I have some good single player games to keep me occupied until then (Golden Sun?).

Onion_Knight · Aug 28, 2015

NWPlayer123 said:
There is no ROP, that's only for setting up code in JIT for the initial userspace exploit. The code it runs is irrelevant, unless you're doing multi-core stuff since JIT is only on core 1.

Is the offset for the beginning of the Kernel Syscall table then?

NWPlayer123 · Aug 28, 2015

Onion_Knight said:
Is the offset for the beginning of the Kernel Syscall table then?

That's to define where the table is for placing our kern_read/write because it depends on each version and AFAIK there's no easy way to get it.

pedro702 · Aug 28, 2015

VinsCool said:
Figured super mario 64 too, thanks to nintendo for making many config files for many games
Works now.

;Mario64
[RomOption]
;BackupType 0 Auto 1 SRAM 2 Flash 3 EEPROM
BackupType = 3
;BackupSize 2048 16K 4K 512
BackupSize = 512
Rumble = 0
UseTimer = 1

[Idle]
Count = 1
Address0 = 0x80317934
Inst0 = 0x01E4082A
Type0 = 1

[BreakBlockInst]
Count = 1
Address0 = 0x8027F578
Inst0 = 0x00000000
JmpPC0= 0x8027F500
Type0 = 1

[Render]
CalculateLOD = 1

[FilterHack]
Count = 1

TextureAddress0 = 0x1cb000
SumPixel0 = 0xd522f45e
Data2_0 = 0x801055
Data3_0 = 0x80000
AlphaTest0 = 250

[VertexHack]
Count = 21

;Fix Logo point
VertexCount0 = 15
VertexAddress0 = 0x84720
TextureAddress0 = 0x8ccc0
FirstVertex0 = a6:02 63 00 1f 00 1d
Value0 = a18:00 02
00 01 02 bc 00 67 ff f4
00 02 03 17 00 c8 ff bc

;Fix BTS No.405_1-a
VertexCount1 = 6
VertexAddress1 = 0x105a58
TextureAddress1 = 0x1c6800
FirstVertex1 = a6:06 00 00 66 fd 01
Value1 = a18:00 02
00 00 06 00 00 66 fc fe
00 05 fa 01 00 66 fc fe

;Fix BTS No.405_1-b
VertexCount2 = 15
VertexAddress2 = 0xff108
TextureAddress2 = 0x1c6000
FirstVertex2 = a6:04 5d 0e 00 f5 b1
Value2 = a18:00 02
00 03 10 02 02 00 10 00
00 06 10 02 01 00 10 00

;Fix BTS No.405_1-c
VertexCount3 = 11
VertexAddress3 = 0xffd08
TextureAddress3 = 0x1c6800
FirstVertex3 = a6:10 00 02 00 0f 00
Value3 = a26:00 03
00 00 10 02 02 00 0e fa
00 01 0c 9a 02 00 0e fa
00 03 10 02 02 00 10 00

;Fix BTS No.405_1-d
VertexCount4 = 16
VertexAddress4 = 0xfe018
TextureAddress4 = 0x1c5800
FirstVertex4 = a6:10 00 04 33 fe 01
Value4 = a34:00 04
00 07 10 02 00 fc fe 01
00 09 10 00 04 37 06 00
00 0a 10 00 02 00 0f 04
00 0b 10 02 00 fc 0c 00

;Fix BTS No.405_2
VertexCount5 = 7
VertexAddress5 = 0x10b410
TextureAddress5 = 0x1c3800
FirstVertex5 = a6:fc 24 f8 ef 00 4c
Value5 = a18:00 02
00 04 f8 70 f8 f4 00 1e
00 06 f7 fc fb 01 00 00

;Fix NOA BTS No.3
VertexCount6 = 16
VertexAddress6 = 0x15c2c8
TextureAddress6 = 0x1ca000
FirstVertex6 = a6:f6 34 fb 01 f5 01
Value6 = a18:00 02
00 0d f5 c4 fb 01 fb ce
00 0e f5 c4 fd ce fb ce

;Improve NOA BTS No.4
VertexCount7 = 16
VertexAddress7 = 0x116ce8
TextureAddress7 = 0xfc360
FirstVertex7 = a6:0c 00 ff 9b 0c 00
Value7 = a18:00 02
00 09 04 cf ff 9b 03 bf
00 06 08 cd ff 9b 03 bf

;Fix NOA BTS No.12-a
VertexCount8 = 15
VertexAddress8 = 0x100c60
TextureAddress8 = 0x1c2000
FirstVertex8 = a6:fd d7 03 23 f7 b1
Value8 = a18:00 02
00 03 0a 08 09 23 f5 4b
00 05 0a 08 fe 01 f5 4b

;Fix NOA BTS No.12-b
VertexCount9 = 15
VertexAddress9 = 0x1007a0
TextureAddress9 = 0x1c2000
FirstVertex9 = a6:00 9a 03 23 f3 e0
Value9 = a10:00 01
00 04 01 64 02 7b f7 b1

;Fix NOA BTS No.9
VertexCount10 = 16
VertexAddress10 = 0xfe8d0
TextureAddress10 = 0x1c4000
FirstVertex10 = a6:1a 00 f4 f0 20 00
Value10 = a10:00 01
00 0e 16 00 fe 01 ed fc

;Fix NOA BTS No.33
VertexCount11 = 14
VertexAddress11 = 0x128bc0
TextureAddress11 = 0x1c5000
FirstVertex11 = a6:fb 46 00 00 fb fd
Value11 = a10:00 01
00 03 f8 90 00 00 fc 03

;Fix NOA BTS No.27
VertexCount12 = 15
VertexAddress12 = 0x10b160
TextureAddress12 = 0x1c3000
FirstVertex12 = a6:04 fb 01 9a fb 9b
Value12 = a18:00 02
00 06 f8 01 fd 01 ff fc
00 07 f8 02 04 d2 04 69

;Fix NOA BTS No.8
VertexCount13 = 14
VertexAddress13 = 0xfe730
TextureAddress13 = 0x1c8800
FirstVertex13 = a6:07 36 0c 66 e8 0d
Value13 = a10:00 01
00 01 f8 ca 0c 66 e8 01

;Fix NOA BTS No.10-c_1
VertexCount14 = 15
VertexAddress14 = 0x10afc8
TextureAddress14 = 0x1c8000
FirstVertex14 = a6:fe 67 ff e7 fb e7
Value14 = a18:00 02
00 09 fe ce fe 4e 0a bd
00 0a 01 33 fe 4e 0a bd

;Fix NOA BTS No.10-c_2
VertexCount15 = 16
VertexAddress15 = 0x102ef8
TextureAddress15 = 0xfc1e0
FirstVertex15 = a6:02 cd 00 cd fe ce
Value15 = a18:00 02
00 08 fd 34 00 cd fe cc
00 09 fd 34 00 00 fe cc

;Fix NOA BTS No.10-a_1
VertexCount16 = 8
VertexAddress16 = 0x106708
TextureAddress16 = 0x1c8000
FirstVertex16 = a6:03 44 fe ce 01 91
Value16 = a18:00 02
00 05 03 46 00 01 fe 5f
00 07 03 46 00 01 01 91

;Fix NOA BTS No.10-a_2
VertexCount17 = 15
VertexAddress17 = 0x106788
TextureAddress17 = 0xfc1e0
FirstVertex17 = a6:03 44 00 00 fe 5f
Value17 = a18:00 02
00 00 03 44 00 01 fe 5f
00 06 03 44 00 01 01 91

;Fix NOA BTS No.10-b_1
VertexCount18 = 16
VertexAddress18 = 0x104238
TextureAddress18 = 0x1c2800
FirstVertex18 = a6:02 66 00 9a 03 33
Value18 = a18:00 02
00 09 fa 1c ff ea ff 44
00 0a fa 1c ff ea fd de

;Fix NOA BTS No.10-b_2
VertexCount19 = 16
VertexAddress19 = 0x104338
TextureAddress19 = 0x1c2800
FirstVertex19 = a6:ff 67 ff ce 02 9a
Value19 = a18:00 02
00 06 fa 1c ff ea fd de
00 07 fa 1c ff 1f fd de

;Fix NOA BTS No.10-b_3
VertexCount20 = 16
VertexAddress20 = 0x104518
TextureAddress20 = 0x1c2800
FirstVertex20 = a6:fa 20 ff ec ff 44
Value20 = a18:00 02
00 00 fa 1c ff ea ff 44
00 01 fa 1c ff 1f ff 44

Just wondering what happens to the saves? lets say you have a dk64 save and then inject mario 64 and save will both games have saves? or will mario 64 one overwrite the dk64 one?

NWPlayer123 · Aug 28, 2015

pedro702 said:
Just wondering what happens to the saves? lets say you have a dk64 save and then inject mario 64 and save will both games have saves? or will mario 64 one overwrite the dk64 one?

Um, not sure. I'm guessing they'll either have handled it so each ROM makes their each file based on like a Game ID, or they'll do it the stupid way and have it be one file, save.dat, and the new ROM doesn't know it exists so it just wipes it and overwrites it.

Cyan · Aug 28, 2015

it was tested few page back, the ROM correctly kept its savegame, it's not based on the installed TitleID.
it's maybe stored in the same folder though, but using the N64 savegame format? (I suppose it's doing like DIOS MIOS, saving the file which are normaly on the memory card drirectly to the folder, not using a binary emulated memcard). But it's just a supposition.
You still don't have NAND read access with kexploit to see the file system? does it need IOS exploit to unlock NAND?

JustPingo · Aug 28, 2015

Hi there.
So I really want to get into WiiU exploit finding and stuff.
The problem is that, event with WiiUbrew which is an awesome source material for what have already be done, I just can't find what to do next.
I mean, where can I find something that will tell me what is not found yet, and so to be able to work on it?
Learning the thing backward is much easier (especially when all of the "documentation" is in a wiki).
Thanks in advance!

AboodXD · Aug 28, 2015

Surprise Make Maker/NSMBU fans!

Yanda · Aug 28, 2015

Sorry to ask you such a basic question.
Now,we can't connection to online.
But Nikki was uploaded the video of Splatoon New Weapon Bamboozled.
Can't connection.
But done update...
How?

moops44 · Aug 28, 2015

Yanda said:
Sorry to ask you such a basic question.
Now,we can't connection to online.
But Nikki was uploaded the video of Splatoon New Weapon Bamboozled.
Can't connection.
But done update...
How?

thats the 1 Million $ question
How???

IbbyPlays · Aug 28, 2015

moops44 said:
thats the 1 Million $ question
How???

The data for the weapon was already in the game. Nikki just had to poke the right area of ram with the weapon's value.

Hacking Wii U Hacking & Homebrew Discussion

Silly Catgirl

Well-Known Member

Silly Catgirl

Nabnut

Well-Known Member

Nabnut

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

GBATemp's lurking knight

Well-Known Member

I hack NSMB games, and other shiz.

Well-Known Member

Prince of Darkness

Well-Known Member

Popular threads in this forum