Hacking Self-hosted payloads with only static HTML

[MockyLock]

While Hotspot is turned on the phone shouldn't be able to go online. Just check to open www.google.com or something.
If not you're good to go.
Wifi is automatically turned off when you launch your Hotspot. So only your sim card can be responsible for a Wii U update.

Yeah that's it ! AS a good noob, i was trying to turn on Hotspot AND WiFi, but you can't. Once your Hotspot is on, you can't enable WiFi.

 

[Jow Banks]

While Hotspot is turned on the phone shouldn't be able to go online. Just check to open www.google.com or something.
If not you're good to go.
Wifi is automatically turned off when you launch your Hotspot. So only your sim card can be responsible for a Wii U update.

But wouldn't it update if the phone has a Data Plan? (not WiFi)
If not, what good would a HotSpot be?

I use an old no longer subscribed phone, so I know mine can't connect no matter what.

 

[Xplic1T]

But wouldn't it update if the phone has a Data Plan? (not WiFi)
If not, what good would a HotSpot be?

I use an old no longer subscribed phone, so I know mine can't connect no matter what.

If you had a GSM based phone you can remove the data perminantly by removing the sim so it cant connect to the tower. With older CDMA based (Sprint/Verizon) phones, you just need to un-register the IMEI from your provider. Log in and remove the IMEI and wait till service is gone if you want to use an older phone so that you risk it not going online ...

But with a phone you are using, just make sure your data is turned off via toggle and try to go to the google.com or something ... Turn on hotspot (if rooted, it shouldn't fuss about no data being there). Connect to the AP and then run KWS ... connect the wii u to that AP and then put in the IP from KWS.

Make sure dev tools are on inside the browser menu if getting a lot of black crashes (with colored polys on both screens).

 

[mvmiranda]

Guys, I'm trying to host the "www" files in both my personal server and Android cellphone (using KWS Android Server) but it always freezes after loading the payload532.html file.
So, the browser detects my WiiU version (5.3.2) and tries to open the correct payload file but it freezes. Everytime!

I've tried the "original" Loadiine GX2 www files, some other mods, this one... everyone freezes for me. If I use other sites (like wiiubru) it works fine.
Am I doing something wrong?

 

[lordelan]

Guys, I'm trying to host the "www" files in both my personal server and Android cellphone (using KWS Android Server) but it always freezes after loading the payload532.html file.
So, the browser detects my WiiU version (5.3.2) and tries to open the correct payload file but it freezes. Everytime!

I've tried the "original" Loadiine GX2 www files, some other mods, this one... everyone freezes for me. If I use other sites (like wiiubru) it works fine.
Am I doing something wrong?

That sounds really strange. Cleared browser cache?

 

[Xplic1T]

On 5.3.2 and I'm having issues getting back into Homebrew Launcher or Loadine_GX after already loading a game. This has been an issue since gx was released are we supposed to just reset the console ?

I remember the legacy v2 being able to do this no problem.

 

[linuxares]

Huh, StageFright.A from Kaspersky? So does the exploit use the same algoritm?

 

[lordelan]

On 5.3.2 and I'm having issues getting back into Homebrew Launcher or Loadine_GX after already loading a game. This has been an issue since gx was released are we supposed to just reset the console ?

I remember the legacy v2 being able to do this no problem.

If I start the exploit HBL loads up instantly. Then I start Loadiine GX from there to launch a game.
Pressing the home button then gets me to the Wii U main menu where I'm accessing either Mii Maker (for Loadiine) or starting the exploit again to get into the HBL.
How's that behaving at your side?

 

[Xplic1T]

If I start the exploit HBL loads up instantly. Then I start Loadiine GX from there to launch a game.
Pressing the home button then gets me to the Wii U main menu where I'm accessing either Mii Maker (for Loadiine) or starting the exploit again to get into the HBL.
How's that behaving at your side?

Should I hit close software and then go back into browser ? Or go into browser right away ?

I've been closing Mii Maker each time... should I not of.

 

[lordelan]

Should I hit close software and then go back into browser ? Or go into browser right away ?

I've been closing Mii Maker each time... should I not of.

What's your goal? To get from a game into HBL again?

 

[Xplic1T]

What's your goal? To get from a game into HBL again?

Yea so I dont need to restart the system each time.

Back in Loadiine v2 days I could do it from the same static html file.

This goes into the Wii U loading splash screen and freezes about 5 seconds in.

 

[lordelan]

Mh that's unusual. For me it's:
Game -> home button -> Internet Browser -> HBL
or
Game -> home button -> close game -> Mii Maker -> Loadiine GX

 

[Xplic1T]

Mh that's unusual. For me it's:
Game -> home button -> Internet Browser -> HBL
or
Game -> home button -> close game -> Mii Maker -> Loadiine GX

Are you on 5.3.2. I have 2 consoles on it and it reacts the same way. Can you upload your sdcard binaries, maybe those are different.

 

[lordelan]

Yes, 5.3.2 here.
You want my two folders
SD:\wiiu\apps\loadiine_gx\
SD:\wiiu\apps\homebrew_launcher\
?

Or my www exploit folder?

 

[Xplic1T]

Yes, 5.3.2 here.
You want my two folders
SD:\wiiu\apps\loadiine_gx\
SD:\wiiu\apps\homebrew_launcher\
?

Or my www exploit folder?

Yes

SD:\wiiu\apps\loadiine_gx\
SD:\wiiu\apps\homebrew_launcher\

 

[lordelan]

Yes

D:\wiiu\apps\loadiine_gx\
SD:\wiiu\apps\homebrew_launcher\

Umm sure but it's nothing but what's included in the github zips of HBL and Loadiine:
apps.zip

What I recommend instead is:
Get SD:\wiiu\apps\homebrew_launcher\ from here:
https://github.com/dimok789/homebrew_launcher/releases (newest)

Get Loadiine GX2 v0.2 (because it's stable) from here:
https://github.com/dimok789/loadiine_gx2/releases/tag/v0.2
Put it on SD so you have SD:\wiiu\apps\loadiine_gx\

Then copy this folder inside your apps folder and rename it to loadiine_gx_nightly then open up the folder and edit the xml with a text editor. Change title and/or description to "Loadiine GX2 Nightly" so you know which one is stable and which one is newest nightly when you're inside the HBL.
Delete the *.elf file in the nightly folder.

Get the newest nightly from here:
https://github.com/dimok789/loadiine_gx2/releases
Put the *.elf file from the zip in your loadiine_gx_nightly folder and rename it to loadiine_gx_nightly.elf in order to have two versions of Loadiine on your SD card to try around with.

This is also a good tip since there are some games that are reported to work better with 0.2 while a few others work smoother with 0.3 nightlies.

Edit: Don't worry, since they're "the same app" (Loadiine) in both cases you can of course continue your savegames from one to another.
That means for games that run like a charm in both (0.2 and 0.3) like Mario Tennis: Ultra Smash it's no problem to start a savegame in 0.2, continue in 0.3, go back to 0.2 on next reboot and continue from there and so on.
Until Loadiine changes the way it handles savegames in a nightly there's no incompatibilites.

 

[Xplic1T]

Umm sure but it's nothing but what's included in the github zips of HBL and Loadiine:
apps.zip

What I recommend instead is:
Get SD:\wiiu\apps\homebrew_launcher\ from here:
https://github.com/dimok789/homebrew_launcher/releases (newest)

Get Loadiine GX2 v0.2 (because it's stable) from here:
https://github.com/dimok789/loadiine_gx2/releases/tag/v0.2
Put it on SD so you have SD:\wiiu\apps\loadiine_gx\

Then copy this folder inside your apps folder and rename it to loadiine_gx_nightly then open up the folder and edit the xml with a text editor. Change title and/or description to "Loadiine GX2 Nightly" so you know which one is stable and which one is newest nightly when you're inside the HBL.
Delete the *.elf file in the nightly folder.

Get the newest nightly from here:
https://github.com/dimok789/loadiine_gx2/releases
Put the *.elf file from the zip in your loadiine_gx_nightly folder and rename it to loadiine_gx_nightly.elf in order to have two versions of Loadiine on your SD card to try around with.

This is also a good tip since there are some games that are reported to work better with 0.2 while a few others work smoother with 0.3 nightlies.

Edit: Don't worry, since they're "the same app" (Loadiine) in both cases you can of course continue your savegames from one to another.
That means for games that run like a charm in both (0.2 and 0.3) like Mario Tennis: Ultra Smash it's no problem to start a savegame in 0.2, continue in 0.3, go back to 0.2 on next reboot and continue from there and so on.
Until Loadiine changes the way it handles savegames in a nightly there's no incompatibilites.

Used the files you provided and its the same thing ... First boot works great but getting back into HBL or GX is a no go.

 

[lordelan]

Used the files you provided and its the same thing ... First boot works great but getting back into HBL or GX is a no go.

You used the files I uploaded?

Please try my instructions nevertheless to be sure.

 

[mvmiranda]

That sounds really strange. Cleared browser cache?

I didn't try that yet... I'll try and report back!
Thx!

 

[mvmiranda]

That sounds really strange. Cleared browser cache?

I tried clearing the cache. It didn't help!

Also, I switched from KWS to Server for PHP (Android with PHP 5.4.45) and it didn't help.

In my several tests I've discovered that putting the exploit files in the root of my "server" does trigger it but if I put it in some folder (let's say 532) and call "/532/index.html" from a button/link inside my root/index.html it hangs after detecting my browser and calling the correct payload file.

Although I have a "working" portable exploit trigger now, with this setup I can only run one thing at a time: either Loadiine GX2 or HBL

Am I still missing some configuration?
What's wrong?

Thanks!

EDIT:
It still works even when I put the exploit files in the root of my "server" and call it from a button/link to, let's say index_lgx2.html. So the problem here is "redirecting" to a folder where the exploit files are.