Hacking Contenthax - a Vulnerability in Wii U File System Verification

[ThatNintendoNerd]

OK, new problem. After I build Maschell's haxchi, IDK what to do with the outcome. The nds or zip doesn't become affected. So any idea's?

 

[Daggot]

Are you using latest FIX94's version? I have python 3 and it works perfectly.

Thank you both for trying to help me, the syntax error was a problem on my end and was a result of of trying the gui instead of wupserver itself. When I run the newest wupserver.py I get something like this.

Spoiler

Traceback (most recent call last):
File "C:\Users\Daggot\Desktop\wuphax-v1.0 (1)\wupclient.py", line 753, in <module>
mount_sd()
File "C:\Users\Daggot\Desktop\wuphax-v1.0 (1)\wupclient.py", line 601, in mount_sd
handle = w.open("/dev/fsa", 0)
File "C:\Users\Daggot\Desktop\wuphax-v1.0 (1)\wupclient.py", line 131, in open
address = self.load_string(device)
File "C:\Users\Daggot\Desktop\wuphax-v1.0 (1)\wupclient.py", line 128, in load_string
return self.load_buffer(bytearray(s + "\0", "ascii"), align)
File "C:\Users\Daggot\Desktop\wuphax-v1.0 (1)\wupclient.py", line 123, in load_buffer
address = self.alloc(len(b), align)
File "C:\Users\Daggot\Desktop\wuphax-v1.0 (1)\wupclient.py", line 111, in alloc
return self.svc(0x27, [0xCAFF, size])
File "C:\Users\Daggot\Desktop\wuphax-v1.0 (1)\wupclient.py", line 77, in svc
ret, data = self.send(2, data)
File "C:\Users\Daggot\Desktop\wuphax-v1.0 (1)\wupclient.py", line 48, in send
self.s.send(request)
AttributeError: 'NoneType' object has no attribute 'send'

EDIT:

I fucked up and the error was my fault. Remember kids it goes cd Wupclient location and then Drive Letter:\Python directory\python.exe -i wupclient.py

 

[FIX94]

here is something neat: the files for yoshis island ds actually work in wario ware touched so I've added that into my haxchi fork

 

[VinsCool]

here is something neat: the files for yoshis island ds actually work in wario ware touched so I've added that into my haxchi fork

Oh pretty nice! Just wondering, do the rpx's match?

 

[huma_dawii]

here is something neat: the files for yoshis island ds actually work in wario ware touched so I've added that into my haxchi fork

What if we put those files in MK DS

 

[VinsCool]

What if we put those files in MK DS

There's only one way to know

 

[FIX94]

What if we put those files in MK DS

it'll crash because the rpx has nothing to do with it.

 

[huma_dawii]

it'll crash because the rpx has nothing to do with it.

I mean I could test anything xDDDDDD

 

[AboodXD]

Those meta files are just beautiful :3

 

[FIX94]

if somebody happens to actually have yoshi touch and go, from what I've seen it might be possible to use the brain age zip in it, thats also something I may want to mention, I only have a extracted copy of it so I cant test it.

 

[AboodXD]

Just setup redNAND, install all the titles you want to test.

 

[TheCyberQuake]

Has anyone figured how to edit bootLogoTex.tga? No matter what settings I use to render it, it always seems to cause the file to not be accepted by the Wii U.

 

[the_randomizer]

Those meta files are just beautiful :3

I hope for the day we don't need to use the CFW launcher and install titles to SysNAND safely. Not sure if that's even feasible though.

Seeing so many people ahead, doing things like this, it makes me want to try, but I can't risk bricking my Wii U.

 

[VinsCool]

if somebody happens to actually have yoshi touch and go, from what I've seen it might be possible to use the brain age zip in it, thats also something I may want to mention, I only have a extracted copy of it so I cant test it.

This is getting interesting. I'm tempted to try one of the current zip versions over Zelda Phantom Hourglass. Who knows if it could work.

 

[FIX94]

This is getting interesting. I'm tempted to try one of the current zip versions over Zelda Phantom Hourglass. Who knows if it could work.

I have that key and its different.

 

[the_randomizer]

This is getting interesting. I'm tempted to try one of the current zip versions over Zelda Phantom Hourglass. Who knows if it could work.

Will there be a more simplified tutorial on how to actually use this hack, or is it still far too risky and easy to brick Wii U consoles. I really want HBL installed to SysNAND, but I dare not do it as I can't afford to brick my Wii U

I can't make any sense out of the instructions on the OP, sorry.

 

[TheCyberQuake]

I hope for the day we don't need to use the CFW launcher and install titles to SysNAND safely. Not sure if that's even feasible though.

Seeing so many people ahead, doing things like this, it makes me want to try, but I can't risk bricking my Wii U.

Even for the 3ds installing to sysNAND was not safe without hardmod until we got arm9loaderhax.
A similar boot-exploit would need to be found for wiiu. We would need code execution before most of the system even loads in order to dump and restore mlc/slc/slccmpt before any bad data is loaded and locks the system.
Until then, redNAND is the only "safe" way to mess with files that involve the system. The 3ds was the exact same up till the beginning of this year. Contenthax is safe to do, and that's why we are doing it on sysNAND. Even if we mess up a file for contenthax, worst case we just can't boot that title.

--------------------- MERGED ---------------------------

Will there be a more simplified tutorial on how to actually use this hack, or is it still far too risky and easy to brick Wii U consoles. I really want HBL installed to SysNAND, but I dare not do it as I can't afford to brick my Wii U

I can't make any sense out of the instructions on the OP, sorry.

As long as you only touch the rom.zip (which is as easy as copy-pasting a command) then it's completely safe. Worst case you will have to delete and reinstall the app, not possible to brick with contenthax atm

 

[the_randomizer]

Even for the 3ds installing to sysNAND was not safe without hardmod until we got arm9loaderhax.
A similar boot-exploit would need to be found for wiiu. We would need code execution before most of the system even loads in order to dump and restore mlc/slc/slccmpt before any bad data is loaded and locks the system.
Until then, redNAND is the only "safe" way to mess with files that involve the system. The 3ds was the exact same up till the beginning of this year. Contenthax is safe to do, and that's why we are doing it on sysNAND. Even if we mess up a file for contenthax, worst case we just can't boot that title.

I thought RedNAND was still "unsafe" to use, as there have been people who bricked their Wii U, right? I did create a fw.img with Fix94's tutorial, but other than that, the instructions on how to do this hack are unclear, the instructions are confusing on the OP, are those CLI commands? Are those for Python, what are they?

I can't make any sense on how to use it

install process
haxchi can be very easily installed using iosuhax's wupclient. for example, if hachihachi is installed to the MLC, it suffices to do:

w.up("rom.zip", "/vol/storage_mlc01/usr/title/00050000/101A5600/content/0010/rom.zip")

of course, using wupclient to install haxchi permanently requires that redNAND be disabled, unless hachihachi is installed to USB, in which case it can be installed from redNAND using:

w.up("rom.zip", "/vol/storage_usb01/usr/title/00050000/101A5600/content/0010/rom.zip")

Obviously it seems to require WUP Client, but other than that...

 

[AboodXD]

I have that key and its different.

I don't know if you have overlooked this:

Just setup redNAND, install all the titles you want to test.

 

[FIX94]

I obviously know this, thats how I could test and port it to other versions. Now there are just not enough DS keys around for me to take a look at certain ones like yoshi touch and go for example.