Hacking Official Haxchi v2.5u2 - a persistent WiiU hack

[raphamotta]

The second sentence of the first post has a link to the list of useful games.

Sent from my KFFOWI using Tapatalk

I mean, from that list, any game is better for haxchi then others?

 

[thekarter104]

I mean, from that list, any game is better for haxchi then others?

Any game you never play. For me it was Brain Training.

 

[FIX94]

So I just got done doing my first tests with coldboothax using a hacked together signature patcher, normally my wiiu takes 25 seconds to boot up, now with my system.xml replaced and this special patcher it takes 40 seconds and there is no boot loop or anything going on and I dont need a sd inserted so that is pretty good I would say. My plan for this though is to not just boot into different things when holding down buttons but also have a little interface similar to preloader on the wii, I think that should be doable and make this already feel a lot better than right now. Anyways, all of that will probably take me quite some time testing and writing but I thought some people might be interested in hearing if anything has been going on

 

[Deleted User]

Wow, nice idea.
with something like that coldboothax would be awsome!
I d love it!

 

[peteruk]

Sounds great Fix94 looking forward to reading updates on the testing progress

 

[ItsKipz]

Wow, that sounds great! Are you going to put up the work you have with it so far on your github?

 

[angelus kun]

works great Thanks! @FIX94

 

[FIX94]

So today I did some more testing and while a few things are a bit odd in this you can do some neat things. while the ds games themselfs dont actually support wiimotes and wiiu pro controllers, this small selection menu will, I found the needed functions to get the full functionality back. also while this may sound a little silly, I found a controlling mechanism without having any controller - the sync button on the console itself, so clicking on it a single time could move the menu downwards, double-clicking it selects whatever is highlighted
Now that I have the controls figured out, I started looking at configuration saving and while I cant actually WRITE any data to the existing save file, I can open new files in write mode and directly close them again, this will of course leave them empty but they stay around, so I can just make a small config with just filenames, better than nothing I suppose
I guess my next step now is to actually look into writing that small selection menu, my thoughts on selection go into the direction of having sysnand, sysnand with signature patches, homebrew launcher, a fw.img on sd card and possibly an "emergency" wupserver if something really got messed up that can only be fixed on a pc.
Also I think I will leave the config.txt around and basically add its "default" case and the selections I just listed as a (cancelable) "autoboot" option for this little menu. Feel free to let me know what you think of these ideas so far.

 

[Billy Acuña]

So today I did some more testing and while a few things are a bit odd in this you can do some neat things. while the ds games themselfs dont actually support wiimotes and wiiu pro controllers, this small selection menu will, I found the needed functions to get the full functionality back. also while this may sound a little silly, I found a controlling mechanism without having any controller - the sync button on the console itself, so clicking on it a single time could move the menu downwards, double-clicking it selects whatever is highlighted
Now that I have the controls figured out, I started looking at configuration saving and while I cant actually WRITE any data to the existing save file, I can open new files in write mode and directly close them again, this will of course leave them empty but they stay around, so I can just make a small config with just filenames, better than nothing I suppose
I guess my next step now is to actually look into writing that small selection menu, my thoughts on selection go into the direction of having sysnand, sysnand with signature patches, homebrew launcher, a fw.img on sd card and possibly an "emergency" wupserver if something really got messed up that can only be fixed on a pc.
Also I think I will leave the config.txt around and basically add its "default" case and the selections I just listed as a (cancelable) "autoboot" option for this little menu. Feel free to let me know what you think of these ideas so far.

The only thing that I can say is... I love all of your ideas <3
Ok, to be honest, would be neat if you can add the gamepad as another option to control the menu and leave the sync button as a backdoor if somehow your gamepad gets dissync or damaged.

 

[FIX94]

Ok, to be honest, would be neat if you can add the gamepad as another option to control the menu and leave the sync button as a backdoor if somehow your gamepad gets dissync or damaged.

I was talking about the sync button on the console itself behind the sd cover, the gamepad is already an option with the way I thought about the controls, and that sync button is indeed just a fallback if things go really wrong.

 

[Billy Acuña]

I was talking about the sync button on the console itself behind the sd cover, the gamepad is already an option with the way I thought about the controls, and that sync button is indeed just a fallback if things go really wrong.

Ow, then I think that everything is perfect I don't know what other people think, as for me what you are proposing is perfect

 

[sabykos]

Now that I have the controls figured out, I started looking at configuration saving and while I cant actually WRITE any data to the existing save file, I can open new files in write mode and directly close them again, this will of course leave them empty but they stay around, so I can just make a small config with just filenames, better than nothing I suppose

I actually had to laugh when I read this. Anyway, how did you solve the double booting of iosuhax fw.img? And how was this double booting caused btw?

 

[FIX94]

I actually had to laugh when I read this. Anyway, how did you solve the double booting of iosuhax fw.img? And how was this double booting caused btw?

well even when you replace the system.xml you still launch the "menu" (which is haxchi) at least once before it actually reloads that xml so that causes that one loop, basically instead of calling the launch menu function I call a (probably overly complicated) 75 characters long function which will always load the actual system menu instead of using the system.xml title id. Now I did not actually test that with a fw.img itself yet though and only with signature patches but I'm pretty sure it'll work just as well.

 

[sabykos]

well even when you replace the system.xml you still launch the "menu" (which is haxchi) at least once before it actually reloads that xml so that causes that one loop, basically instead of calling the launch menu function I call a (probably overly complicated) 75 characters long function which will always load the actual system menu instead of using the system.xml title id. Now I did not actually test that with a fw.img itself yet though and only with signature patches but I'm pretty sure it'll work just as well.

Other question: You wanted to add an option to enter normal sysnand without sigpatches. I guess if you do that, you automatically rerun haxchi everytime you close an app, since vanilla sysnand relies on the changed system.xml? :/ And do I get this straight: If Ninty ever releases a new update and a colboothax console updates it is most likely bricked, even if Ninty doesnt patch haxchi, cause haxchi is hardcoded for 5.5.1 adresses currently?

 

[FIX94]

Other question: You wanted to add an option to enter normal sysnand without sigpatches. I guess if you do that, you automatically rerun haxchi everytime you close an app, since vanilla sysnand relies on the changed system.xml?

That is indeed correct, its again more of a backup option than anything if for whatever reason patched sysnand doesnt work correctly and from my tests it really does not take terribly long to let it reload haxchi anyways.

And do I get this straight: If Ninty ever releases a new update and a colboothax console updates it is most likely bricked, even if Ninty doesnt patch haxchi, cause haxchi is hardcoded for 5.5.1 adresses currently?

if you manage to get yourself updated there is a good chance of that happening, sure.

 

[YharnamBadass]

Can I install a ds vc game through cfwbooter and wupinstaller and then use this?

 

[sabykos]

Can I install a ds vc game through cfwbooter and wupinstaller and then use this?

No.

 

[::Phoenix::]

well even when you replace the system.xml you still launch the "menu" (which is haxchi) at least once before it actually reloads that xml so that causes that one loop, basically instead of calling the launch menu function I call a (probably overly complicated) 75 characters long function which will always load the actual system menu instead of using the system.xml title id. Now I did not actually test that with a fw.img itself yet though and only with signature patches but I'm pretty sure it'll work just as well.

As far as deep I could go through the disassembly fw.img, it seems the problem is that the MCP, loads fw.img from storage just after it loads system.xml. So at a first boot, haxchi runs, loads cfw_booter which changes the path of fw.img in memory and reboots. At this first reboot, the MCP in memory is still the original one. Now, instead of loading fw.img first and then loading system.xml, it does the inverse, so even if our fw.img gets loaded, the wrong xml has been laoded as well. At the second reboot, MCP is the one in the new fw.img and it can finally load syshax.xml

Dunno if that's correct, but that's what it seemed to me looking at the code on IDA.

 

[FIX94]

CBHC (ColdBoot HaxChi) will be a special version of the regular Haxchi payload which I am currently writing for ColdBootHax, while I am still far from done I decided to demonstrate here how long it takes in its current state to start up the console.

 

[Billy Acuña]

CBHC (ColdBoot HaxChi) will be a special version of the regular Haxchi payload which I am currently writing for ColdBootHax, while I am still far from done I decided to demonstrate here how long it takes in its current state to start up the console.

Impressive!!! That is actually pretty faster.
Thanks for all of your hard work, I can't wait to see how this becomes on the release