Hacking Contenthax - a Vulnerability in Wii U File System Verification

tvall

Well-Known Member
Member
Joined
May 12, 2014
Messages
276
Trophies
0
Age
29
XP
348
Country
United States
i think you managed to sucessfully upload it in one of the countless previous attempts. based on the screenshots, it looks like you managed to do everything needed.

did it actually work? have you tried yet?
 

huma_dawii

Well-Known Member
Member
Joined
Apr 3, 2014
Messages
3,880
Trophies
2
Age
33
Location
Planet Earth
XP
4,275
Country
United States
Dude your wupclient.py folder should look like this with config.txt in the same folder as wupclient.py http://imgur.com/QmO9n5i
That makes sense, but I put that config.txt on the content folder, anyways somehow I got it working and I don't even know how :c

--------------------- MERGED ---------------------------

i think you managed to sucessfully upload it in one of the countless previous attempts. based on the screenshots, it looks like you managed to do everything needed.

did it actually work? have you tried yet?
Somehow I got it working but I don't know how :(
 

FIX94

Former Staff
Former Staff
Joined
Dec 3, 2009
Messages
7,284
Trophies
0
Age
30
Location
???
XP
11,248
Country
Germany
So I think in the end the best thing is to use that now released script to install haxchi, I wanted to make something far more complex directly on the wiiu itself but that would require a LOT of work. I've peeked at MCP_CopyTitle that smea originally suggested but for that to work you have to have the already fully extracted game on your sd card to copy it from sd back onto the internal storage so you'd need your ticket or a game wupclient dump already to even do that so in the end its just easier to use wupclient itself to also install it remotely.
 

TheCyberQuake

Certified Geek
Member
Joined
Dec 2, 2014
Messages
5,012
Trophies
1
Age
28
Location
Las Vegas, Nevada
XP
4,433
Country
United States
So I think in the end the best thing is to use that now released script to install haxchi, I wanted to make something far more complex directly on the wiiu itself but that would require a LOT of work. I've peeked at MCP_CopyTitle that smea originally suggested but for that to work you have to have the already fully extracted game on your sd card to copy it from sd back onto the internal storage so you'd need your ticket or a game wupclient dump already to even do that so in the end its just easier to use wupclient itself to also install it remotely.
I've made a script that basically automates the entire procoess.
Simply place the meta files (bootTvTex.tga, bootDrcTex.tga, iconTex.tga, and bootSound.btsnd) on the Wii U SD card within /haxchi/meta, then place the rom.zip and config.txt in /haxchi. Put SD card in Wii U, load wupserver, then load the install.py from the same directory as wupclient.py. Then input the low ID of the game you want to install to, and the install location.
The rest of the process is automated. It even will download meta.xml, ask for a custom name, and then modify and reupload meta.xml to change it's home menu name.
https://mega.nz/#!RMsn0TSL!RRk4W7dz-YnRvotnvUxUhg4YXT8u-jv-0vINEv5TOSs
Code:
import sys
import wupclient

if __name__ == '__main__':
    installid = raw_input("VC lower ID (last 8 chars): ")
    installLocation = raw_input("VC Location (NAND, USB): ")
    if(installLocation.lower() == "nand"):
        location = "mlc01"
    elif(installLocation.lower() == "usb"):
        location = "usb01"
    else:
        print("'" + installLocation + "' is not a suitable answer")
        input()
        sys.exit()
    print("Connecting to wupserver")
    w = wupclient.wupclient()
    if(w.s == None):
        print("Failed to connect to wupserver!")
        exit()
    print("Connected!")
    wupclient.w = w
    print("Mounting SD")
    ret = wupclient.mount_sd()
    if(ret == 0):
        print("Failed to mount SD!")
    else:
        print("Mounted! Installing Haxchi from SD")
        ret = w.cp("/vol/storage_sdcard/haxchi/rom.zip", "/vol/storage_" + location + "/usr/title/00050000/" + installid + "/content/0010/rom.zip")
        if(ret == 0):
            print("Failed to install Haxchi!")
        else:
            print("Installing Meta files")
            ret = w.cpdir("/vol/storage_sdcard/haxchi/meta", "/vol/storage_" + location + "/usr/title/00050000/" + installid + "/meta")
            if(ret == 0):
                print("Failed to install Meta files!")
            else:
                print("Downloading meta.xml for modification")
                ret = w.dl("/vol/storage_" + location + "/usr/title/00050000/" + installid + "/meta/meta.xml")
                if(ret == 0):
                    print("Download failed!")
                else:
                    customname = raw_input("Custom title name: ")
                    print("Modifying meta.xml")
                    linecount = 0
                    f1 = open('meta.xml', 'r')
                    f2 = open('meta.xml.tmp', 'w')
                    for line in f1:
                        linecount = linecount + 1
                        if(72 <= linecount <= 77 or 79 <= linecount <= 82):
                            customline = line[0:42] + customname + line[-15:]
                            f2.write(customline)
                        elif(linecount == 78 or linecount == 83):
                            customline = line[0:43] + customname + line[-16:]
                            f2.write(customline)
                        else:
                            f2.write(line)
                    f1.close()
                    f2.close()
                    print("Uploading modified meta.xml")
                    ret = w.up("meta.xml.tmp", "/vol/storage_" + location + "/usr/title/00050000/" + installid + "/meta/meta.xml")                   
                    if(ret == 0):
                        print("Meta.xml upload failed!")
                    else:
                        print("Attempting to upload config.txt")
                        ret = w.cp("/vol/storage_sdcard/haxchi/config.txt", "/vol/storage_" + location + "/usr/title/00050000/" + installid + "/content/config.ini")
                        if(ret == 0):
                            print("Config.ini upload failed, normal for older haxchi versions")
                        else:
                            print("Applying chmod to config.txt")
                            ret = w.chmod("/vol/storage_" + location + "/usr/title/00050000/" + installid + "/content/config.txt", 0x644)
                            if(ret != 0):
                                print("Install complete!")
                            else:
                                print("chmod failed!")
    if(w.fsa_handle != None):
        w.close(w.fsa_handle)
        w.fsa_handle = None
    if(w.s != None):
        w.s.close()
        w.s = None
print("Press enter to exit")
input()
 

TheCyberQuake

Certified Geek
Member
Joined
Dec 2, 2014
Messages
5,012
Trophies
1
Age
28
Location
Las Vegas, Nevada
XP
4,433
Country
United States
yea no, I'd much rather point people to this thread instead since its far cleaner and actually safe and readable.
While I do agree that one is cleaner and easier to read, I don't see how mine is "not safe". If you could please elaborate about how mine is not safe I could fix that problem.
I could easily spend time and make it cleaner and easier to read (which I probably will do once I get the time), but I don't like how the other version restricts basically everything, even the meta files. Absolute worst case when messing with the meta.xml and images is that the game doesn't boot and you have to reinstall or copy over corrected files.
 

dankzegriefer

Banned!
Banned
Joined
Aug 19, 2015
Messages
896
Trophies
0
Age
40
XP
560
Country
United States
While I do agree that one is cleaner and easier to read, I don't see how mine is "not safe". If you could please elaborate about how mine is not safe I could fix that problem.
I could easily spend time and make it cleaner and easier to read (which I probably will do once I get the time), but I don't like how the other version restricts basically everything, even the meta files. Absolute worst case when messing with the meta.xml and images is that the game doesn't boot and you have to reinstall or copy over corrected files.
Your code being ugly is dangerous. Ugly code causes problems. Problems cause bricks.
 

TheCyberQuake

Certified Geek
Member
Joined
Dec 2, 2014
Messages
5,012
Trophies
1
Age
28
Location
Las Vegas, Nevada
XP
4,433
Country
United States
Your code being ugly is dangerous. Ugly code causes problems. Problems cause bricks.
Except for the fact that I built this code off of one of FIX94's own python scripts from wuphax. The only thing I've really changed at this point was the commands being sent to wupserver and the code to edit the downloaded meta.xml. The basic format though was left how it was.

--------------------- MERGED ---------------------------

Your code being ugly is dangerous. Ugly code causes problems. Problems cause bricks.
And how about instead of just saying it's bad, be constructive and give advice on how I could make it better. It's basically the first thing I've written in python, so please instead of just dumping on it give me advice.
 

dankzegriefer

Banned!
Banned
Joined
Aug 19, 2015
Messages
896
Trophies
0
Age
40
XP
560
Country
United States
Except for the fact that I built this code off of one of FIX94's own python scripts from wuphax. The only thing I've really changed at this point was the commands being sent to wupserver and the code to edit the downloaded meta.xml. The basic format though was left how it was.

--------------------- MERGED ---------------------------


And how about instead of just saying it's bad, be constructive and give advice on how I could make it better. It's basically the first thing I've written in python, so please instead of just dumping on it give me advice.
Clean it up.
 

ShadowOne333

QVID PRO QVO
Editorial Team
Joined
Jan 17, 2013
Messages
12,242
Trophies
2
XP
34,822
Country
Mexico
Your code being ugly is dangerous. Ugly code causes problems. Problems cause bricks.
I just had to...
73198955.jpg
 
  • Like
Reactions: TotalInsanity4

Reecey

Mario 64 (favorite game of all time)
Member
Joined
Mar 7, 2010
Messages
5,870
Trophies
2
Location
At Home :)
XP
4,487
Country
Is it possible can anyone answer my question I have red you only need 1 bought legit vc title on systemnand to put the hack on and then you can put others on back ups is this correct so for example I have used Brain Training as my homebrew launcher and then could I use Mario Kart DS back up as my Rednand booter or does it have to be all legit bought games from eshop to use as a base game. Thanks.
 

ShadowOne333

QVID PRO QVO
Editorial Team
Joined
Jan 17, 2013
Messages
12,242
Trophies
2
XP
34,822
Country
Mexico
Is it possible can anyone answer my question I have red you only need 1 bought legit vc title on systemnand to put the hack on and then you can put others on back ups is this correct so for example I have used Brain Training as my homebrew launcher and then could I use Mario Kart DS back up as my Rednand booter or does it have to be all legit bought games from eshop to use as a base game. Thanks.
You can use the Homebrew LAuncher one with a config.txt to boot the Rednand by just pressing a button while the HBL is booting.
No need for a second DS game.
 

Reecey

Mario 64 (favorite game of all time)
Member
Joined
Mar 7, 2010
Messages
5,870
Trophies
2
Location
At Home :)
XP
4,487
Country
You can use the Homebrew LAuncher one with a config.txt to boot the Rednand by just pressing a button while the HBL is booting.
No need for a second DS game.
I have installed the latest brain training does that work like you mentioned then so I just press other buttons to load different contents or do you have to upload more content for it to work like you say?
 

ShadowOne333

QVID PRO QVO
Editorial Team
Joined
Jan 17, 2013
Messages
12,242
Trophies
2
XP
34,822
Country
Mexico
I have installed the latest brain training does that work like you mentioned then so I just press other buttons to load different contents or do you have to upload more content for it to work like you say?
Did you upload the config.txt file when you made the Haxchi installation?
If so then yeah, pressing A will load a fw.img from your SD's root and pressing B will load fw.img from inside a rednand folder (SD:/rednand/fw.img)
 

Reecey

Mario 64 (favorite game of all time)
Member
Joined
Mar 7, 2010
Messages
5,870
Trophies
2
Location
At Home :)
XP
4,487
Country
Did you upload the config.txt file when you made the Haxchi installation?
If so then yeah, pressing A will load a fw.img from your SD's root and pressing B will load fw.img from inside a rednand folder (SD:/rednand/fw.img)
No sorry I didnt where do I get the config txt from and instructions?
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • No one is chatting at the moment.
    SylverReZ @ SylverReZ: Dude just shat himself.