Hacking Wii U disc/download format

Hiccup

Well-Known Member
OP
Member
Joined
Nov 21, 2009
Messages
1,000
Trophies
1
XP
1,806
Country
Is there info anywhere on the format of Wii U disc images, and the format(s) of Wii U download software.

Thanks
 

Twili

Banned!
Banned
Joined
Mar 20, 2014
Messages
208
Trophies
0
Age
29
XP
391
Country
United States
Is there info anywhere on the format of Wii U disc images, and the format(s) of Wii U download software.

Thanks
Yes.cs

http://svn.code.sf.net/p/vgmtoolbox/code/format/VGMToolbox/format/iso/NintendoWiiUOpticalDisc.cs

What scene releases and Cemu call a "title key" should actually be a "disc key." It's unique to the disc the title was dumped from, not to the title.

For tickets: http://www.3dbrew.org/wiki/Ticket (applies to Wii U)

So, you decrypt the title key using the common key and the title ID padded at the end with 0000000000000000 as the IV using AES-CBC.

Then for decrypting .app files, use the decrypted title key and the cIDX padded at the end with 0000000000000000000000000000 as the IV using AES-CBC.

The cIDX is obtained from the TMD; at 0xB04 are the content entries, each 0x30 bytes. The first 4 bytes are the content ID, essentially the filenames of the .app files. The next 2 are cIDX (content index.)
 
Last edited by Twili,

Hiccup

Well-Known Member
OP
Member
Joined
Nov 21, 2009
Messages
1,000
Trophies
1
XP
1,806
Country
Thanks, but I don't really understand the code. I'm particularly interested in:
what different partitions are there
what header info is there in a disc image
 

FaTaL_ErRoR

AKA ŦƕƎ ƠṀƐƝ
Member
Joined
Mar 9, 2014
Messages
491
Trophies
0
XP
443
Country
United States
Yes.cs

http://svn.code.sf.net/p/vgmtoolbox/code/format/VGMToolbox/format/iso/NintendoWiiUOpticalDisc.cs

What scene releases and Cemu call a "title key" should actually be a "disc key." It's unique to the disc the title was dumped from, not to the title.

For tickets: http://www.3dbrew.org/wiki/Ticket (applies to Wii U)

So, you decrypt the title key using the common key and the title ID padded at the end with 0000000000000000 as the IV using AES-CBC.

Then for decrypting .app files, use the decrypted title key and the cIDX padded at the end with 0000000000000000000000000000 as the IV using AES-CBC.

The cIDX is obtained from the TMD; at 0xB04 are the content entries, each 0x30 bytes. The first 4 bytes are the content ID, essentially the filenames of the .app files. The next 2 are cIDX (content index.)
This actually isn't as correct as you think it is. Take two of the exact same games and dump them from the same console. You should yield the same title key. Take two discs from two different consoles and you should yield two different title keys. As far as I can tell the title key is somehow being changed by the drive key. The only other way to have two different title keys would be if the two discs had different firmware updates contained in disc. Other than that it is your unique console that makes the ID change on the title key.
But by all means feel free to not listen to me at all. (I mean what do I know ;))
 

mixelpixx

hardware monkey
Member
Joined
Aug 10, 2014
Messages
133
Trophies
0
Location
y0uR m0mz b0x
XP
356
Country
United States
this info?
 

Attachments

  • disc_layout.png
    disc_layout.png
    8.3 KB · Views: 1,105
  • Like
Reactions: Hiccup and Vexiant

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • No one is chatting at the moment.
  • BigOnYa @ BigOnYa:
    I kept thinking jaws was gonna come up and attack
  • K3Nv2 @ K3Nv2:
    Jaws is on a diet
  • K3Nv2 @ K3Nv2:
    Damn power went out
  • BigOnYa @ BigOnYa:
    Ok xdqwerty, your little bro prob tripped On the cord and unplugged you
  • K3Nv2 @ K3Nv2:
    Ya I'm afraid of the dark hug me
  • BigOnYa @ BigOnYa:
    Grab and hold close your AncientBoi doll.
  • K3Nv2 @ K3Nv2:
    Damn didn't charge my external battery either
  • BigOnYa @ BigOnYa:
    Take the batteries out of your SuperStabber3000... Or is it gas powered?
  • K3Nv2 @ K3Nv2:
    I stole batteries from your black mamba
    +1
  • K3Nv2 @ K3Nv2:
    My frozen food better hold up for an hour I know that
  • BigOnYa @ BigOnYa:
    Or else gonna be a big lunch and dinner tomorrow.
  • BigOnYa @ BigOnYa:
    Did you pay your power bill? Or give all yo money to my wife, again.
  • K3Nv2 @ K3Nv2:
    Oh good the estimated time is the same exact time they just said
    +1
  • BigOnYa @ BigOnYa:
    Load up your pc and monitor, and head to a McDonalds dining room, they have free WiFi
  • K3Nv2 @ K3Nv2:
    Sir please watch your porn in the bathroom
    +2
  • BigOnYa @ BigOnYa:
    No sir we can not sell you anymore apple pies, after what you did with the last one.
  • K3Nv2 @ K3Nv2:
    We ran out
  • HiradeGirl @ HiradeGirl:
    for your life
    +1
  • K3Nv2 @ K3Nv2:
    My life has no value my fat ass is staying right here
  • K3Nv2 @ K3Nv2:
    Nearly 4 hours without power :(
  • Veho @ Veho:
    SO POWERLESS
  • K3Nv2 @ K3Nv2:
    Tell Kanye I need power
    K3Nv2 @ K3Nv2: Tell Kanye I need power