Hacking Contenthax - a Vulnerability in Wii U File System Verification

[Deleted User]

this are the files I made
For everyone who wants to download my Metafiles.

Can you (or someone else) please upload this data to a site other than MEGA? MEGA doesn't seem to like my internet connection.

 

[FIX94]

Just to be sure we're talking about the same screen corruption, I'm talking about the row that occurs in this video:

yes we are, that is fixed, if it isnt for you you are doing it wrong.

 

[subcon959]

The corruption is fixed... nice job @FIX94

Crappy video proof..

 

[roots]

someone knows what and where the hash is checked for bootlogo.tex?

 

[Deleted User]

someone knows what and where the hash is checked for bootlogo.tex?

Not sure where in the boot cycle this is hashed, but it is possible to work around this by using a CFW that supports signature patches.

 

[Kohmei]

Ahhhh I done goofed
Forgot the 0010 folder

 

[TheCyberQuake]

Just a bit of knowledge for those who were interested:
You can place any files you want to copy to the wii u (rom.zip, meta files, etc.) onto the SD card. From there you can use the mount_sd() command to mount it from wupclient, and then you can use the w.cp command to copy a single file from SD to NAND/USB, something like this:
w.cp("/vol/storage_sdcard/rom.zip", "/vol/storage_usb01/usr/title/00050000/10179B00/content/0010/rom.zip")

Another thing you could do is place any meta files you want to change for a VC game, and then use the w.cpdir command to move them all at once:
w.cpdir("/vol/storage_sdcard/meta", "/vol/storage_usb01/usr/title/00050000/10179B00/meta")

That's a much faster way to copy over modified meta files.

Edit: Also the same thing can be done in reverse to dump files faster than doing so over the network.
Also looking into it, you can use the same technique to dump a 1:1 decrypted (loadiine-ready) copy of a game if you use mount_odd_content() and then w.cpdir from /vol/storage_odd_content to SD. Not of much use now, but for games that are disc only it would allow us to dump the game, encrypt it to install-ready files using other software, and then with a forged ticket install to sig-patched redNAND

 

[JimmyZ]

Just a bit of knowledge for those who were interested:
You can place any files you want to copy to the wii u (rom.zip, meta files, etc.) onto the SD card. From there you can use the mount_sd() command to mount it from wupclient, and then you can use the w.cp command to copy a single file from SD to NAND/USB, something like this:
w.cp("/vol/storage_sdcard/rom.zip", "/vol/storage_usb01/usr/title/00050000/10179B00/content/0010/rom.zip")

Another thing you could do is place any meta files you want to change for a VC game, and then use the w.cpdir command to move them all at once:
w.cpdir("/vol/storage_sdcard/meta", "/vol/storage_usb01/usr/title/00050000/10179B00/meta")

That's a much faster way to copy over modified meta files.

Or just write a py script to upload? At least no SD card swap needed.

 

[TheCyberQuake]

Or just write a py script to upload? At least no SD card swap needed.

I know you can, and I've done it already. But my key point is speed difference. you can use the same exact commands I listed before to instead upload directly from a computer, but the transfer speed is barely more than old dialup speed. If you instead use the SD as the transfer method, the speeds are much greater because it isn't limited by the wupserver speed, but rather the actual transfer speeds of the devices.

 

[JimmyZ]

I know you can, and I've done it already. But my key point is speed difference. you can use the same exact commands I listed before to instead upload directly from a computer, but the transfer speed is barely more than old dialup speed. If you instead use the SD as the transfer method, the speeds are much greater because it isn't limited by the wupserver speed, but rather the actual transfer speeds of the devices.

https://xkcd.com/303/

 

[Cachuchin1]

might sound a little bit wrong but want to confirm .... is it possible to use wupserver to inject savegames ? (saviine is not working for me )

 

[ThatNintendoNerd]

So I'm editing entry.c in the sd_loader in @FIX94's haxchi. So after I run make, it succeeded, but what do I do now?

 

[daxtsu]

might sound a little bit wrong but want to confirm .... is it possible to use wupserver to inject savegames ? (saviine is not working for me )

Not sure, but System Config Tool can extract and inject game saves (but this would only really help if you're on redNAND, since it's not really usable on sysNAND).

 

[Supster131]

might sound a little bit wrong but want to confirm .... is it possible to use wupserver to inject savegames ? (saviine is not working for me )

I was able to extract save games with WUPServer, so you might be able to inject them as well.
Like Daxtsu stated, you can give sysconfigtool a try if you're on redNAND.

 

[Maschell]

someone knows what and where the hash is checked for bootlogo.tex?

https://github.com/dimok789/iosuhax/commit/7f8796ab6e76c1f2a0c2dbf93829dec3ae850cad

 

[Cachuchin1]

Not sure, but System Config Tool can extract and inject game saves (but this would only really help if you're on redNAND, since it's not really usable on sysNAND).

I was able to extract save games with WUPServer, so you might be able to inject them as well.
Like Daxtsu stated, you can give sysconfigtool a try if you're on redNAND.

I'm working with sysnand ... and it worked ! .... just need to change specific files .... and my game was on the usb ... I'm doubting of doing the same with the game I have in my WiiU memory

 

[roots]

https://github.com/dimok789/iosuhax/commit/7f8796ab6e76c1f2a0c2dbf93829dec3ae850cad

thanks a lot man!
great work

 

[ManuelKoegler]

Hmm, buy a compatible title, or wait for it to be ported to my game?
Decisions decisions.


Sent from my iPhone using Tapatalk

 

[Intronaut]

There will be a version of contenthax for n64 VC in the near future or should I buy brain age in the eshop?

 

[Zamkad]

I'm working with sysnand ... and it worked ! .... just need to change specific files .... and my game was on the usb ... I'm doubting of doing the same with the game I have in my WiiU memory

Is there any method to inject loadiine save(with c and u folders) into game, installed on USB? Except Saviine, of cource.