Hacking Is it possible to dump a title key?

  • Thread starter Thread starter Net-KILLER
  • Start date Start date
  • Views Views 4,488
  • Replies Replies 10
you can use the WUPServer cfw (from fix94 branch).

then, insert a disc, and type that to the WUP server client :

Code:
mount_odd_tickets()
w.dldir("/vol/storage_odd_tickets")
unmount_odd_tickets()

it mounts the disc, dump the system folder, unmount the disc.
insert another disc and repeat.

The encrypted title key is located in /system/02/title.tik (or tik file if it's not renamed), at position 0x1BF
 
  • Like
Reactions: RealityNinja
you can use the WUPServer cfw (from fix94 branch).

then, insert a disc, and type that to the WUP server client :

Code:
mount_odd_tickets()
w.dldir("/vol/storage_odd_tickets")
unmount_odd_tickets()

it mounts the disc, dump the system folder, unmount the disc.
insert another disc and repeat.

The encrypted title key is located in /system/02/title.tik (or tik file if it's not renamed), at position 0x1BF
And do you know how to dump eShop tickets?
 
I'm trying to get a list of all useful commands for WUPServer, and I found this for eshop tickets:
Code:
w.dldir("/vol/system_slc/rights/ticket/apps/")

But also a report that the dumped tickets weren't the correct size, and couldn't be used to reinstall the game with WUP installer. so something might be wrong.
 
  • Like
Reactions: RealityNinja
but if we extract the key from a console, shouldn't it work to reinstall the same game on the same console? it's using the same signature and consoleID, it should work on sysNAND without sigpatch, right?
 
Yeah, all i want is just to install with wup installer an eShop game i bought (to have a backup on the PC, and be able to install it on the Wii U).
 
as long as you don't format your SysNAND, it should work again.
But I got 2 reports that it doesn't work...
I'm still reading and trying to catch all this recent hack progress to help users better.
 
  • Like
Reactions: RealityNinja

Site & Scene News

Popular threads in this forum