Hacking Contenthax - a Vulnerability in Wii U File System Verification

[Reecey]

No, Meta files go in titleid/meta/. Only the rom goes in content.

Like this for brain age..

w.up("rom.zip", "/vol/storage_usb01/usr/title/00050000/10179C00/meta/iconTex.tga")

Thanks, its a good job I didn't go ahead and do that.

 

[BIFFTAZ]

Thanks, its a good job I didn't go ahead and do that.

I edited my post because there was a mistake. Take a look.

 

[TheCyberQuake]

Just finished dumping the working meta files from my redNAND mod. This MEGA folder now includes:
- Modified rom.zip files that boot cfwboot.elf from /wiiu/boot, includes all 3 current exploit VC titles
- Modified cfwboot.elf that loads fw.img from /wiiu/boot instead of the SD root
- Meta files to theme VC titles into a custom redNAND app. meta.xml is only for Brain Age US
https://mega.nz/#F!QV8CgJIQ!yB0s5pzMtSXUV96CQ2rrRQ

 

[Cachuchin1]

which is the file we need to edit to get the correct name on the menu ? thanks !

 

[TheCyberQuake]

which is the file we need to edit to get the correct name on the menu ? thanks !

meta.xml, the name that shows up in the menu is longname, so just search for that in a text editor (I prefer Notepad++ on windows)

 

[BIFFTAZ]

Just finished dumping the working meta files from my redNAND mod. This MEGA folder now includes:
- Modified rom.zip files that boot cfwboot.elf from /wiiu/boot, includes all 3 current exploit VC titles
- Modified cfwboot.elf that loads fw.img from /wiiu/boot instead of the SD root
- Meta files to theme VC titles into a custom redNAND app. meta.xml is only for Brain Age US
https://mega.nz/#F!QV8CgJIQ!yB0s5pzMtSXUV96CQ2rrRQ

.tga's are working great now. Thanks for the reupload + the rest dude!!

 

[TheCyberQuake]

Here is a video showing the entire custom redNAND title working and booting redNAND, including showing that it boots a different fw.img than what HBL loads (redNAND title loads from /wiiu/boot to load redNAND, HBL will load from SD root to load sysNAND WUPServer)


Now time to figure out github.

 

[Reecey]

No, Meta files go in titleid/meta/. Only the rom goes in content.

Like this for brain age..

w.up("iconTex.tga", "/vol/storage_usb01/usr/title/00050000/10179C00/meta/iconTex.tga")

Thanks I was just trying but I kept getting an question mark so would I just keep changing the first bit and the last bit for each tag file for example:-
w.up("meta.xml", "/vol/storage_usb01/usr/title/00050000/10179C00/meta/meta.xml")
w.up("bootDrcTex.tga", "/vol/storage_usb01/usr/title/00050000/10179C00/meta/bootDrcTex.tga")
w.up("bootSound.tga", "/vol/storage_usb01/usr/title/00050000/10179C00/meta/.bootSoundtga")

and so on..

 

[Zamkad]

Guys, how you create tga's? I'm using Paint.NET, save picture as 24-bit non-compressed .tga, but when i upload it into /meta folder and reboot my console i got grey "?" icon and system sez me that game is corrupted. When I uploaded original iconTex.tga back - it perfectly works.

 

[BIFFTAZ]

Thanks I was just trying but I kept getting an question mark so would I just keep changing the first bit and the last bit for each tag file for example:-
w.up("meta.tga", "/vol/storage_usb01/usr/title/00050000/10179C00/meta/meta.tga")
w.up("bootDrcTex.tga", "/vol/storage_usb01/usr/title/00050000/10179C00/meta/bootDrcTex.tga")
w.up("bootSound.tga", "/vol/storage_usb01/usr/title/00050000/10179C00/meta/.bootSoundtga")

and so on..

Yes. BTW, You have meta.tga in your post. There's no such file named like that.

 

[Reecey]

Yes. BTW, You have meta.tga in your post. There's no such file named like that.

There was a cfw meta folder in the files I downloaded for the homebrew icon I thought maybe I had to upload that as well?

 

[BIFFTAZ]

There was a cfw meta folder in the files I downloaded for the homebrew icon I thought maybe I had to upload that as well?

Only file's you really need to upload/replace are...

meta.xml
iconTex.tga
bootTvTex.tga
bootSound.btsnd
bootDrcTex.tga

All go in the /meta folder.

 

[Reecey]

Only file's you really need to upload/replace are...

meta.xml
iconTex.tga
bootTvTex.tga
bootSound.btsnd
bootDrcTex.tga

All go in the /meta folder.

Ok, thankyou.

 

[TheCyberQuake]

-snip-
NVM figured everything out

Edit:
Here are the github forks for what I've modified in haxchi and cfw_booter:
https://github.com/TheCyberQuake/cfw_booter
https://github.com/TheCyberQuake/haxchi

 

[Xuman]

Guys, how you create tga's? I'm using Paint.NET, save picture as 24-bit non-compressed .tga, but when i upload it into /meta folder and reboot my console i got grey "?" icon and system sez me that game is corrupted. When I uploaded original iconTex.tga back - it perfectly works.

Same for me

 

[TheCyberQuake]

Guys, how you create tga's? I'm using Paint.NET, save picture as 24-bit non-compressed .tga, but when i upload it into /meta folder and reboot my console i got grey "?" icon and system sez me that game is corrupted. When I uploaded original iconTex.tga back - it perfectly works.

I used photoshop, but I don't know exactly what settings to use to get it to work. Sometimes when I use 24bit color no compression it works, and other times using the same exact settings and image it won't work for some reason.

 

[huma_dawii]

I used photoshop, but I don't know exactly what settings to use to get it to work. Sometimes when I use 24bit color no compression it works, and other times using the same exact settings and image it won't work for some reason.

Do you have a cfwbooter rom.zip so I can run that instead HBL?

Edit: I don't have rednand but I have wii VC games installed with fake Tik and they need iosuhax fw.img to run

 

[BIFFTAZ]

Do you have a cfwbooter rom.zip so I can run that instead HBL?

Edit: I don't have rednand but I have wii VC games installed with fake Tik and they need iosuhax fw.img to run

The files he posted last are for cfwbooter. You'll need to put cfwbooter.elf & ioshax fw.img in wiiu/boot to use his version though.

 

[TheCyberQuake]

So I just found one weird behavior with my current redNAND modifications. It seems doing anything that causes the system to reload fw.bin (entering and exiting settings) from within redNAND will cause it to load back into sysNAND. I have no clue if it still has all the sig patches but is just reading sysNAND, and I am not going to test that. So for now be VERY careful with my currently released redNAND items until I can figure out what is causing this problem

Edit:
The issue is exactly what I was thinking it was. It seems reloading firmware causes it to read from the SD root again instead of /wiiu/boot, leading me to believe it is an issue with the fw.img this time. I'll have a look into the code to see if I can figure out what to change to fix this, but if someone wants to point me in the right direction I would sure appreciate that.

 

[huma_dawii]

The files he posted last are for cfwbooter. You'll need to put cfwbooter.elf & ioshax fw.img in wiiu/boot to use his version though.

And where is the boot of the Wii U?