Hacking Injecting into Wii VC on Wii U

CeeDee

fuckin dork
OP
Member
Joined
May 4, 2014
Messages
5,357
Trophies
2
XP
9,870
Country
United States
Alright, I've got nothing on this.

I've got a decrypted copy of an eShop Wii VC game (Mario Galaxy 2) and apparently, the Galaxy 2 game itself is in some some strange split file format, with files named "hif_000000.nfs" through "hif_000005.nfs"
All except hif_000005 are 250MB, with the last one being the remainder of the game, like a standard split RAR archive, but it's not.
The beginning of the first file starts with "EGGS" which I'm unsure if it's a reference to Yoshi, or something else entirely, but nothing I've tried can open these.

I'll probably upload it somewhere, if anyone else wants to take a look at it.
Here's what the file system looks like:

upload_2016-11-28_20-31-18.png
 

Irastris

Well-Known Member
Member
Joined
May 3, 2015
Messages
1,116
Trophies
0
XP
883
Country
United States
Sorry, but as of my writing this, no one has reverse-enginerred the .nfs format in order to be capable of creating Wii VC injects.

However, someone has been working hard at figuring out exactly how OSv1 works, and from what I've read of his findings, it may be possible to create a sort of forwarder that could load Wii games in the SNEEK (extracted filesystem) format. Don't get your hopes up, though.
 
  • Like
Reactions: CeeDee

CeeDee

fuckin dork
OP
Member
Joined
May 4, 2014
Messages
5,357
Trophies
2
XP
9,870
Country
United States
Sorry, but as of my writing this, no one has reverse-enginerred the .nfs format in order to be capable of creating Wii VC injects.

However, someone has been working hard at figuring out exactly how OSv1 works, and from what I've read of his findings, it may be possible to create a sort of forwarder that could load Wii games in the SNEEK (extracted filesystem) format. Don't get your hopes up, though.
Can I get a link to this? It'd be rather nice to read into.
 

ItsKipz

l33t hax0r
Member
Joined
Sep 9, 2016
Messages
1,930
Trophies
0
Location
The C: drive
XP
1,625
Country
United States
Alright, I've got nothing on this.

I've got a decrypted copy of an eShop Wii VC game (Mario Galaxy 2) and apparently, the Galaxy 2 game itself is in some some strange split file format, with files named "hif_000000.nfs" through "hif_000005.nfs"
All except hif_000005 are 250MB, with the last one being the remainder of the game, like a standard split RAR archive, but it's not.
The beginning of the first file starts with "EGGS" which I'm unsure if it's a reference to Yoshi, or something else entirely, but nothing I've tried can open these.

I'll probably upload it somewhere, if anyone else wants to take a look at it.
Here's what the file system looks like:

View attachment 70658
Woah, whats that fw.img up there?
 
  • Like
Reactions: CeeDee

C0mm4nd_

Aspirant Wii U homebrew dev :P
Member
Joined
Oct 9, 2016
Messages
697
Trophies
0
Website
127.0.0.1
XP
540
Country
Italy
Woah, whats that fw.img up there?
Probably a custom fw.img(vWii).
Someone said that he can launch Wii VC title from redNAND. This can be an explaination (dunno)

--------------------- MERGED ---------------------------

Probably a custom fw.img(vWii).
Someone said that he can launch Wii VC title from redNAND. This can be an explaination (dunno)
I decrypted a game too for seeing these things
 
  • Like
Reactions: CeeDee

CatmanFan

Anxious and regretful
Member
Joined
Aug 14, 2016
Messages
1,962
Trophies
0
Website
www.youtube.com
XP
2,546
Country
Morocco
Is it possible to open the fw.ing?
From where? PC or Wii U?

If you try opening it with WiiXplorer from vWii itself, probably won't work. Try opening the file from Windows Explorer on PC and it give you the prompt to burn it to CD/DVD, which isn't really useful unless you're making a SNES Station PS2 disc or trying to make (v)Wii backup discs.
 
  • Like
Reactions: CeeDee

C0mm4nd_

Aspirant Wii U homebrew dev :P
Member
Joined
Oct 9, 2016
Messages
697
Trophies
0
Website
127.0.0.1
XP
540
Country
Italy
Ok... opened the img and found these intersting bytes
2F 64 65 76 2F 75 73 62 2F 6F 68 30 00 00 00 00 6F 6C 64 20 68 75 62 20 69 6E 73 74 0A 00 00 00 13 8A 1E 2C 13 8A 1D A6 13 8A 1D AE 13 8A 1E 3C 13 8A 1E 58 13 8A 1E 8A 13 8A 1C CC 13 8A 1C CC 13 8A 1C CC 13 8A 1C CC 13 8A 1C CC 13 8A 1C CC 13 8A 1C CC 13 8A 1C CC 13 8A 1C CC 13 8A 1C CC 13 8A 1D 28 13 8A 1D EC 13 8A 1D 9E 13 8A 1D B6 13 8A 1D 9E 65 72 72 6F 72 3A 20 61 62 6F 72 74 65 64 20 67 65 74 20 64 65 76 20 64 73 63 0A 00 28 6E 75 6C 6C 29 00 00 28 6E 69 6C 29 00 00 00 13
 
  • Like
Reactions: CeeDee

ihaveahax

Well-Known Member
Member
Joined
Apr 20, 2015
Messages
6,069
Trophies
2
XP
7,804
Country
United States
Ok... opened the img and found these intersting bytes
2F 64 65 76 2F 75 73 62 2F 6F 68 30 00 00 00 00 6F 6C 64 20 68 75 62 20 69 6E 73 74 0A 00 00 00 13 8A 1E 2C 13 8A 1D A6 13 8A 1D AE 13 8A 1E 3C 13 8A 1E 58 13 8A 1E 8A 13 8A 1C CC 13 8A 1C CC 13 8A 1C CC 13 8A 1C CC 13 8A 1C CC 13 8A 1C CC 13 8A 1C CC 13 8A 1C CC 13 8A 1C CC 13 8A 1C CC 13 8A 1D 28 13 8A 1D EC 13 8A 1D 9E 13 8A 1D B6 13 8A 1D 9E 65 72 72 6F 72 3A 20 61 62 6F 72 74 65 64 20 67 65 74 20 64 65 76 20 64 73 63 0A 00 28 6E 75 6C 6C 29 00 00 28 6E 69 6C 29 00 00 00 13
might be useful to show what the bytes are in text, too
Code:
00000000: 2f64 6576 2f75 7362 2f6f 6830 0000 0000  /dev/usb/oh0....
00000010: 6f6c 6420 6875 6220 696e 7374 0a00 0000  old hub inst....
00000020: 138a 1e2c 138a 1da6 138a 1dae 138a 1e3c  ...,...........<
00000030: 138a 1e58 138a 1e8a 138a 1ccc 138a 1ccc  ...X............
00000040: 138a 1ccc 138a 1ccc 138a 1ccc 138a 1ccc  ................
00000050: 138a 1ccc 138a 1ccc 138a 1ccc 138a 1ccc  ................
00000060: 138a 1d28 138a 1dec 138a 1d9e 138a 1db6  ...(............
00000070: 138a 1d9e 6572 726f 723a 2061 626f 7274  ....error: abort
00000080: 6564 2067 6574 2064 6576 2064 7363 0a00  ed get dev dsc..
00000090: 286e 756c 6c29 0000 286e 696c 2900 0000  (null)..(nil)...
000000a0: 13                                       .
 

C0mm4nd_

Aspirant Wii U homebrew dev :P
Member
Joined
Oct 9, 2016
Messages
697
Trophies
0
Website
127.0.0.1
XP
540
Country
Italy
might be useful to show what the bytes are in text, too
Code:
00000000: 2f64 6576 2f75 7362 2f6f 6830 0000 0000  /dev/usb/oh0....
00000010: 6f6c 6420 6875 6220 696e 7374 0a00 0000  old hub inst....
00000020: 138a 1e2c 138a 1da6 138a 1dae 138a 1e3c  ...,...........<
00000030: 138a 1e58 138a 1e8a 138a 1ccc 138a 1ccc  ...X............
00000040: 138a 1ccc 138a 1ccc 138a 1ccc 138a 1ccc  ................
00000050: 138a 1ccc 138a 1ccc 138a 1ccc 138a 1ccc  ................
00000060: 138a 1d28 138a 1dec 138a 1d9e 138a 1db6  ...(............
00000070: 138a 1d9e 6572 726f 723a 2061 626f 7274  ....error: abort
00000080: 6564 2067 6574 2064 6576 2064 7363 0a00  ed get dev dsc..
00000090: 286e 756c 6c29 0000 286e 696c 2900 0000  (null)..(nil)...
000000a0: 13                                       .
This text:
/dev/usb/oh0..../dev/usb/ehc.............Üàïþÿ..[USB] %s....0.9-svn-r590..../dev/usb/usb...........G.....................................................................j................1......~......exit(%d) called.....exit() printing usage information.......(null)..(nil)....m.X.m.&.m.&.m.&.m.&.m.&.m.&.m.š.m. .m.&.m.¦.m.&.m.&.m.¬.m.¶.m.r.m.r.m.r.m.r.m.r.m.r.m.r.m.r.m.r.m.r.m.¼.m...m.r.m.r.m.r.m.r.m.r.m.r.m.r.m.r.m.r.m.r.m.r.m.¶.m.r.m.r.m.ä.m.r.m...m.r.m.r.m.¶
From 0x00002E90 to 0x0000305F

/dev/usb/usb.....m...m.>.m.8.m.2.m.,.m.&.m. .m...m...m...m...m...m...m...m...m...m...m..[USB_HID] %s....0.9-svn-r590..../dev/usb/hid.....m.ð.m‘..m‘..m.ð.m.ð.m.ð.m‘ .m‘(.m‘0.......Fexit(%d) called.....exit() printing usage information.......(null)..(nil)....m˜ô.m˜Â.m˜Â.m˜Â.m˜Â.m˜Â.m˜Â.m™6.m™<.m˜Â.m™B.m˜Â.m˜Â.m™H.mšR.m™..m™..m™..m™..m™..m™..m™..m™..m™..m™..m™X.m™º.m™..m™..m™..m™..m™..m™..m™..m™..m™..m™..m™..mšR.m™..m™..m™€.m™..m™º
From 0x00004E90 to 0x0000502F

From 0x00006FD0 to 0x0000725F and others

--------------------- MERGED ---------------------------

In frisbiiU this: [SDK+Nintendo:Error_2_4_0]
Code:
5B 53 44 4B 2B 4E 69 6E 74 65 6E 64 6F 3A 45 72 72 6F 72 5F 32 5F 34 5F 30 5D
 
Last edited by C0mm4nd_,
  • Like
Reactions: CeeDee

ItsKipz

l33t hax0r
Member
Joined
Sep 9, 2016
Messages
1,930
Trophies
0
Location
The C: drive
XP
1,625
Country
United States
might be useful to show what the bytes are in text, too
Code:
00000000: 2f64 6576 2f75 7362 2f6f 6830 0000 0000  /dev/usb/oh0....
00000010: 6f6c 6420 6875 6220 696e 7374 0a00 0000  old hub inst....
00000020: 138a 1e2c 138a 1da6 138a 1dae 138a 1e3c  ...,...........<
00000030: 138a 1e58 138a 1e8a 138a 1ccc 138a 1ccc  ...X............
00000040: 138a 1ccc 138a 1ccc 138a 1ccc 138a 1ccc  ................
00000050: 138a 1ccc 138a 1ccc 138a 1ccc 138a 1ccc  ................
00000060: 138a 1d28 138a 1dec 138a 1d9e 138a 1db6  ...(............
00000070: 138a 1d9e 6572 726f 723a 2061 626f 7274  ....error: abort
00000080: 6564 2067 6574 2064 6576 2064 7363 0a00  ed get dev dsc..
00000090: 286e 756c 6c29 0000 286e 696c 2900 0000  (null)..(nil)...
000000a0: 13                                       .
aborted get dev disk? usb/oh0? hmmm...
 
  • Like
Reactions: CeeDee

jose1209

Well-Known Member
Member
Joined
Jul 2, 2007
Messages
117
Trophies
0
XP
698
Country
Burkina Faso
've got a decrypted copy of an eShop Wii VC game (Mario Galaxy 2) and apparently, the Galaxy 2 game itself is in some some strange split file format, with files named "hif_000000.nfs" through "hif_000005.nfs"
All except hif_000005 are 250MB, with the last one being the remainder of the game, like a standard split RAR archive, but it's not.
The beginning of the first file starts with "EGGS" which I'm unsure if it's a reference to Yoshi, or something else entirely, but nothing I've tried can open these.


this is interesting,
i'v seen a .wbfs file of galaxy2 and the size was 1355776 bytes, this looks close to the 5X250 mb +l ast smaller .nfs file.

have you compare the iso wbfs with the ""splitted files"" joined (1+2+3+4+5) ? maybe it's not encrypted...

a vc n64 decrypted have folders: code, meta, content, in content you can find a folder ROM, with a rom image (non crypted) of the game allowing injecting in a easy way roms.
so why the NFS file should be encrypted ? the others files seems to be a "basic" loader, that mount the wbfs and lunch the game via the channel VWII.

it could be interesting to swap 2 VCWII NFS files (brick risk anyway !) to see if the loader cares what it runs.
 

C0mm4nd_

Aspirant Wii U homebrew dev :P
Member
Joined
Oct 9, 2016
Messages
697
Trophies
0
Website
127.0.0.1
XP
540
Country
Italy
this is interesting,
i'v seen a .wbfs file of galaxy2 and the size was 1355776 bytes, this looks close to the 5X250 mb +l ast smaller .nfs file.

have you compare the iso wbfs with the ""splitted files"" joined (1+2+3+4+5) ? maybe it's not encrypted...

a vc n64 decrypted have folders: code, meta, content, in content you can find a folder ROM, with a rom image (non crypted) of the game allowing injecting in a easy way roms.
so why the NFS file should be encrypted ? the others files seems to be a "basic" loader, that mount the wbfs and lunch the game via the channel VWII.

it could be interesting to swap 2 VCWII NFS files (brick risk anyway !) to see if the loader cares what it runs.
Another thing is trying to load a vWii VC with loadiine

--------------------- MERGED ---------------------------

Tried to load fw.img and nothing. It doesn't load
 
  • Like
Reactions: TotalInsanity4

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • No one is chatting at the moment.
  • ZeroT21 @ ZeroT21:
    it wasn't a question, it was fact
  • BigOnYa @ BigOnYa:
    He said he had 3 different doctors apt this week, so he prob there. Something about gerbal extraction, I don't know.
    +1
  • ZeroT21 @ ZeroT21:
    bored, guess i'll spread more democracy
  • LeoTCK @ LeoTCK:
    @K3Nv2 one more time you say such bs to @BakerMan and I'll smack you across the whole planet
  • K3Nv2 @ K3Nv2:
    Make sure you smack my booty daddy
    +1
  • LeoTCK @ LeoTCK:
    telling him that my partner is luke...does he look like someone with such big ne
    eds?
  • LeoTCK @ LeoTCK:
    do you really think I could stand living with someone like luke?
  • LeoTCK @ LeoTCK:
    I suppose luke has "special needs" but he's not my partner, did you just say that to piss me off again?
  • LeoTCK @ LeoTCK:
    besides I had bigger worries today
  • LeoTCK @ LeoTCK:
    but what do you know about that, you won't believe me anyways
  • K3Nv2 @ K3Nv2:
    @BigOnYa can answer that
  • BigOnYa @ BigOnYa:
    BigOnYa already left the chat
  • K3Nv2 @ K3Nv2:
    Biginya
  • BigOnYa @ BigOnYa:
    Auto correct got me, I'm on my tablet, i need to turn that shit off
  • K3Nv2 @ K3Nv2:
    With other tabs open you perv
  • BigOnYa @ BigOnYa:
    I'm actually in my shed, bout to cut 2-3 acres of grass, my back yard.
  • K3Nv2 @ K3Nv2:
    I use to have a guy for that thanks richard
  • BigOnYa @ BigOnYa:
    I use my tablet to stream to a bluetooth speaker when in shed. iHeartRadio, FlyNation
  • K3Nv2 @ K3Nv2:
    While the victims are being buried
  • K3Nv2 @ K3Nv2:
    Grave shovel
  • BigOnYa @ BigOnYa:
    Nuh those goto the edge of the property (maybe just on the other side of)
  • K3Nv2 @ K3Nv2:
    On the neighbors side
    +1
  • BigOnYa @ BigOnYa:
    Yup, by the weird smelly green bushy looking plants.
    K3Nv2 @ K3Nv2: https://www.the-sun.com/news/10907833/self-checkout-complaints-new-target-dollar-general-policies...