Hacking Coldboothax - solving infinite loop with sysNAND CFW

[::Phoenix::]

Hello everyone, long time lurker, but did not write too much on the forum.

This thread started as a small mod of dimok's iosuhax to allow the sysNAND cfw to be booted via coldboothax.
But in the meanwhile, I added some other patch like region free.
So, I will use this thread to give updates on my contributions to iosuhax (hoping that some of them will be merged to dimok's main code base).

As for now, the following additional features are provided with my fork:

• [now available on dimok's repo] sysNAND cfw bootable via coldboothax (without bootloop). See tutorial below.
• [now available on dimok's repo] Region free game launch: Once iosuhax (sysNAND or redNAND) is loaded, you get region free launch, other than usual sig patches.

my fork on github: https://github.com/marco-calautti/iosuhax

HOWTO configure coldboothax for sysNAND cfw

I am NOT RESPONSABLE IF YOU BRICK YOUR WII U.

This is a very brief tutorial on how to get coldboothax working for sysNAND CFW. This is a very basic, non detailed tutorial, do it on your own risk!

1. Compile my fork of iosuhax (follow FIX94's guide here) but use the command make cfw-coldboot . Then, put the fw.img in the root of your sd card.
2. Install Haxchi on your sysNAND and configure it to boot the fw.img as the default in config.txt (please refer to this).
2.a (optional, but highly reccomended in case you mess something during this steps) Configure haxchi to also boot the homebrew launcher with some button press, for example the "a" button.
2.b Test your haxchi title is working before going to the next step! If you run the fw.IMG it should get stuck at the splash screen. This is normal since there is no syshax.XML yet in you Wii u. Reboot and proceed with the next steps.
3. Download your /vol/system/config/system.xml to PC
4. make a copy of system.xml and rename it to syshax.xml (you should now have two xml files, system.xml and syshax.xml).
5. Open system.xml (not syshax.xml) with a proper text editor like notepad++ and change the default_title_id to the id of your haxchi'd game as follows: 00050000XXXXXXXX, where the X's are your haxchi'd game title id.
6. Upload both system.xml and syshax.xml to /vol/system/config/ (you will need to replace the old system.xml)
7. (Don't know if needed) Give to syshax.xml in sysNAND the right permissions via w.chmod("/vol/system/config/syshax.xml",0x644)
8. Turn off your console and boot it up again.

HOWTO UNINSTALL

This is the only version of iosuhax for which it is possible to restore a coldboothaxed console to normal. Even with redNAND, the console is practically doomed to have coldboothax installed.

Once your Wii U has booted into iosuhax, just replace in /vol/system/config/system.xml the default_title_id with the original id (the Wii U System menu one). Removing the syshax.xml is optional.

 

[jailminer]

7000th thread. Good job.

 

[Conn0r]

Good work there m8.

 

[Goloki]

Woah, this is great. Hopefully you can provide some a more detailed explanation and some links to the github, so we can compile our own modified fw.img

 

[::Phoenix::]

This is my fork on github: https://github.com/marco-calautti/iosuhax

 

[Naendow]

If this will get a bit improved (not loading the cfw twice), I'll try this out. But for now, I will follow this thread and be lucky with my setup.

Btw: The haxchi fork of FIX94 doesn't need cfwbooter. Maybe it will work better with it.

 

[jorgehntx]

its great....

 

[Polarise]

So coldboothax is like A9LH for 3DS where it launches CFW from boot?

 

[Naendow]

Yes, it can be used to launch cfw from boot, but it is not as good as a9lh. You can kinda compare it with menuhax.

 

[Polarise]

Yes, it can be used to launch cfw from boot, but it is not as good as a9lh. You can kinda compare it with menuhax.

But with menuhax you have to press a button to boot it. I don't see any button presses in the video. (Unless I missed it)

 

[CuriousTommy]

But with menuhax you have to press a button to boot it. I don't see any button presses in the video. (Unless I missed it)

That's not true, you can do the reverse also (if you were to press a certain combination then you would be brought to the home screen otherwise you will load the homebrew menu).

 

[aaaq]

So I've made a mess of my build environment and just get error after error now. I'm working on repairing it, but can someone point me in the direction of a compiled fw.img for this one?

 

[Polarise]

l

So I've made a mess of my build environment and just get error after error now. I'm working on repairing it, but can someone point me in the direction of a compiled fw.img for this one?

look up darkflare on youtube. He has a video on it.

 

[jorgehntx]

This is my fork on github: https://github.com/marco-calautti/iosuhax

where i can get the fw img compiled?

 

[sabykos]

@::Phoenix::
I guess this is also revertable? I mean you can access the tempered system.xml with wupserver again? Where is the syshax.xml located in your case?

 

[Quantumcat]

where i can get the fw img compiled?

Better to compile it yourself, otherwise it could be malicious

 

[jorgehntx]

Better to compile it yourself, otherwise it could be malicious

tanx u right....i have compiled one all ready but i dont know about syshax.xml ...most be dangerous

 

[::Phoenix::]

@::Phoenix::
I guess this is also revertable? I mean you can access the tempered system.xml with wupserver again? Where is the syshax.xml located in your case?

Yes it is perfectly reversible. The syshax.XMl is located in the same directory of the original one, but this can be changed, for example to let the fw.IMG load the alternative syshax.XML from sdcard.

The idea is to temper the system.XML with the haxchi id and use the copy syshax.XML as secondary boot XML with the original sysmenu I'd.

 

[Goloki]

This is great. I'll try it as soon as someone else has made sure that it works as intended.

 

[::Phoenix::]

Updated the first post with a brief tutorial.