Hacking Contenthax - a Vulnerability in Wii U File System Verification

[Maschell]

So I just found one weird behavior with my current redNAND modifications. It seems doing anything that causes the system to reload fw.bin (entering and exiting settings) from within redNAND will cause it to load back into sysNAND. I have no clue if it still has all the sig patches but is just reading sysNAND, and I am not going to test that. So for now be VERY careful with my currently released redNAND items until I can figure out what is causing this problem

Edit:
The issue is exactly what I was thinking it was. It seems reloading firmware causes it to read from the SD root again instead of /wiiu/boot, leading me to believe it is an issue with the fw.img this time. I'll have a look into the code to see if I can figure out what to change to fix this, but if someone wants to point me in the right direction I would sure appreciate that.

You need to change the path in the fw.img too!
https://github.com/dimok789/iosuhax/blob/master/patches/0x5000000.s#L121

 

[TheCyberQuake]

You need to change the path in the fw.img too!
https://github.com/dimok789/iosuhax/blob/master/patches/0x5000000.s#L121

That's what I was assuming was the issue. I was just taking a look at that patch and saw that line of code right before you posted that
Looks like I'll be creating a fork for iosuhax as well.

--------------------- MERGED ---------------------------

Okay I also modified dimok's iosuhax fw.img to properly load fw.img from /wiiu/boot when reloading firmware from redNAND.
https://github.com/TheCyberQuake/iosuhax
You will have to recompile fw.img using that in order for it to properly support the other modifications I've made, mainly moving fw.img from sd root to /wiiu/boot

 

[ThatNintendoNerd]

OK, so I am really confused on the multi-elf haxchi build that @Maschell made. So what do you do for the .elf's you wanna use before you build?

EDIT: Looked at the entry.c code and figured it out. So NVM I guess.

 

[moops44]

i really appreciate you for the work but i will wait for something from any group
and in that time lets play some pokemon sun / moon

Spoiler: waiiiiit

 

[Xuman]

To anyone still having trouble creating your own .tga's

bootDrcTex and bootTvTex have to be saved as 24bit uncompressed, while iconTex has to be saved as 32 bit uncompressed.

(Wasn't sure if this was said, I just know some of us had trouble)

 

[TheCyberQuake]

To anyone still having trouble creating your own .tga's

bootDrcTex and bootTvTex have to be saved as 24bit uncompressed, while iconTex has to be saved as 32 bit uncompressed.

(Wasn't sure if this was said, I just know some of us had trouble)

Thanks for that info. That should make it easier for me to do custom icons in the future, I just kinda guessed my way through until I got it last time.

 

[FIX94]

Just added one more thing to haxchi, new .zip files specifically to boot a fw.img from sd card using a included ported cfw booter.
https://github.com/FIX94/haxchi/releases/tag/v1.3

 

[VinsCool]

Just added one more thing to haxchi, new .zip files specifically to boot a fw.img from sd card using a included ported cfw booter.
https://github.com/FIX94/haxchi/releases/tag/v1.3

Wonderful! Thanks for your work man!

 

[Kohmei]

Can you have 2 copies of the same game, one with the CFWbooter and one with the HBL rom?

 

[TheCyberQuake]

Can you have 2 copies of the same game, one with the CFWbooter and one with the HBL rom?

They would have to be different games afaik

 

[VinsCool]

Can you have 2 copies of the same game, one with the CFWbooter and one with the HBL rom?

Well if you happen to own two different exploit games, yes

 

[Columbo2811]

Just added one more thing to haxchi, new .zip files specifically to boot a fw.img from sd card using a included ported cfw booter.
https://github.com/FIX94/haxchi/releases/tag/v1.3

Thanks. Is it safe to boot patched sysnand fw.img with the games?

 

[belisleian]

Anyone can send my in PM the meta.xml of Kirby US or tell me how to get it. It is for Homebrew Channel.

 

[VinsCool]

Thanks. Is it safe to boot patched sysnand fw.img with the games?

Yes it is, you need that to actually install the exploit lol.

 

[huma_dawii]

So with the new fix94 version I will be able to run CFW directly instead of HBL? Awesome!

 

[Columbo2811]

Yes it is, you need that to actually install the exploit lol.

Aware of that. Was making sure it just wasn't for booting rednand. Thanks

 

[xtheman]

tfw none of your game have been exploited but are exploitable.

 

[VinsCool]

tfw none of your game have been exploited but are exploitable.

One word: Patience

 

[xtheman]

One word: Patience

I will wait for the day I can use USA Explorers of Time ds as a homebrew hack.

 

[VinsCool]

I will wait for the day I can use USA Explorers of Time ds as a homebrew hack.

It's just a matter of time until it gets ported, don't worry