Hacking SPECULATION: A strategy to load games off USB! (No loader)

[TheZander]

We kinda knew it never had something to do with IOSU since day one.

Yeah, I recall people saying that from the beginning. But it was posted in one of those threads. Kind of takes the majority of the interest out of this though. I mean all of these things have been available since forever. I doubt the people who just want to install games could care less about this, if they are capable of figuring whatever this is when it comes out. They had to be using loading already.

meh, it's something I suppose. but title patch I don't get. If it was a good patch couldn't one just install the title file and eshop would recognize it, and offer a download? can one rip there own title file from their console with that gecko dump program?

 

[Cyan]

I think it knows when the ticket is tampered with; in this instance, a replaced title key

the ticket is signed too, and you can't sign it back after tempering with it.

replacing the ticket with the correct key to use with Cdecrypt worked because Cdecrypt only needed the key. it is just a shortcut to always read the key at the same position.
You can make an empty dummy file with the key at the correct position and it will work.
Cdecrypt could have read the NUS key from a simple binary file or even a text file, it would have work too. it's just for convenience that it's using the real position.

The console is checking if the ticket has been modified or not before validating or using the key.
that's why Signature check needs to be disabled (with IOSU kernel hack) to install anything not properly signed.

 

[TheZander]

they ticket is signed too, and you can't sign it back after tempering with it.

what's it signed with? game title key or a per console key?

 

[Cyan]

with nintendo's private key, I suppose.

 

[wprpalmeida]

Literally, "em breve..." would be "in short", so he didn't say exactly "SOON"

that's a very literal translation. the correct translation is indeed SOON (All rights reserved)

 

[Kohmei]

This doesn't work unfortunately; I just tried with Pikmin 3 (replaced correct Title Key in title.tik, got it to extract with NUSGrabber, used Ryanrocks' WUP Installer mod, and everything). I think it knows when the ticket is tampered with; in this instance, a replaced title key. Hopefully the new modified tool bypasses this, or perhaps the tools he talked about generate legitimate tickets.

At the very least you need to change more than the key, the title ID needs to be changed too as does possibly the version and others. Luckily the structure of a Wii U ticket is mostly the same as that of the Wii ticket, which is already documented here: http://wiibrew.org/wiki/Ticket

note: these are from public game update tickets

The main problem is the signature which is what the Wii U checks before it allows you to install the packages. There is an initialization vector within the ticket files, so I can't help but wonder if changing this can make the RSA signature somehow predictable

 

[ScienceBETCH]

What did I fucking miss

 

[SomeGamer]

What did I fucking miss

Absolutely nothing.

 

[Kohmei]

I think I figured it out:

What if instead of modifying the ticket, you used an unmodified existing ticket for the title ID you wanted: say, a game update. This would leave the ticket legitimately signed.

Then, you take the unencrypted game files and encrypt them such that they will decrypt with the target title key. Can we reencrypt things with any title key? Or is that not possible

 

[ScienceBETCH]

Absolutely nothing.

Thank

--------------------- MERGED ---------------------------

I think I figured it out:

What if instead of modifying the ticket, you used an unmodified existing ticket for the title ID you wanted: say, a game update. This would leave the ticket legitimately signed.

Then, you take the unencrypted game files and encrypt them such that they will decrypt with the target title key. Can we reencrypt things with any title key? Or is that not possible

Yeah nice job on doing that.

Srsly tho noice job

 

[Patxinco]

I think I figured it out:

What if instead of modifying the ticket, you used an unmodified existing ticket for the title ID you wanted: say, a game update. This would leave the ticket legitimately signed.

Then, you take the unencrypted game files and encrypt them such that they will decrypt with the target title key. Can we reencrypt things with any title key? Or is that not possible

Phineas and ferb doesn' have an update, at last as i can see in wiiubrew, so how can he install it then?
That's not the way he does it, it probably uses the iOSU OTP keys for revalidate the tempered tickets.

 

[xstationbr]

Whatever. I don't think "IN SHORT" is trademarked like "SOON(tm)"

Wrong
"Soon" is exactly "Embreve", "in short" is wrong use of grammar.

 

[Kohmei]

Phineas and ferb doesn' have an update, at last as i can see in wiiubrew, so how can he install it then?
That's not the way he does it, it probably uses the iOSU OTP keys for revalidate the tempered tickets.

Well the first screenshots we saw of Phineas had a red (!) by the title which could possibly mean they installed Phineas data under a different title ID (such as another game's update)

 

[KiiWii]

Occam's razor people. Occam's razor.

 

[shinyquagsire23]

I think I figured it out:

What if instead of modifying the ticket, you used an unmodified existing ticket for the title ID you wanted: say, a game update. This would leave the ticket legitimately signed.

Then, you take the unencrypted game files and encrypt them such that they will decrypt with the target title key. Can we reencrypt things with any title key? Or is that not possible

Pretty sure that would break signatures because the TMD has SHA hashes of each .app and the TMD is signed.

 

[Olmectron]

Wrong
"Soon" is exactly "Embreve", "in short" is wrong use of grammar.

http://www.thefreedictionary.com/in+short

Well, you're right. It shouldn't be used for describing periods of time, just for saying something concisely.

 

[Kohmei]

Pretty sure that would break signatures because the TMD has SHA hashes of each .app and the TMD is signed.

Ah rats.

 

[Columbo2811]

Pretty sure that would break signatures because the TMD has SHA hashes of each .app and the TMD is signed.

Obviously most of us here know your skills in this area and others. So whats your view on all this then?

 

[Kohmei]

Occam's razor people. Occam's razor.

So it's a hoax then

 

[DarkenedMatter]

Pretty sure that would break signatures because the TMD has SHA hashes of each .app and the TMD is signed.

Who are you to grace us with your presence on such a toxic thread that has only been speculation and disappointment lol