Hacking [Dev] Wii U File System

[PhusionDev]

First of all, I know that there is no PC software currently that lets us have access to the Wii U Filesystem, but instead I'd like to dive into some development of my own but am completely new to the 3DS/Wii/WiiU dev scene. With that being said, I'd like to ask some of the developers that frequent this site where (which files) I should begin looking at for information regarding how certain wiiu homebrew applications (wupinstaller, libwiiu, etc) access the file system.

Part B: I know that the filesystem itself is encrypted, but if we can access it (encrypted/decrypted) on the WiiU itself, would it possible to decrypt it using a key from within windows/mac/linux?

Anyways I am a complete noob to this dev scene like I said so this may look ridiculous to the more experienced developers and users on this site.

I appreciate all the hard work everybody has done to make this possible, and I'm loving wupinstaller y-mod, but I wish there was an easier way to install titles other than sucking the lifeblood from my SDCards. Thanks for your time and responses. <3

Also for clarification sakes: I am mostly interested in accessing Wii U formatted External Drives, and not the System Memory.

 

[proflayton123]

Well, there is wiiubrew

 

[PhusionDev]

I found this guide for Wii U development, and I'll probably spend a bunch of time looking this over. WiiUBrew also looks like a great source; thanks!

https://github.com/QuarkTheAwesome/ProgrammingOnTheU/

 

[EstPC13]

I love the Spirit, USB FST Decryption is the one thing that separates us from a completely open Wii U. I'm not a coder myself, but if you have a problem with an app, feel free to hit me up!

 

[Deleted User]

If you're looking for filesystem examples, I would take a look at FTPiiU Everywhere and the Haxchi installer, those invoke the IOSU exploit to mount and read the NAND and USB file systems.

It would indeed be possible to decrypt the Wii U's filesystem on a PC, there are keys in the Wii U's OTP and SEEPROM that handle the encryption of the USB drive. The OTP and SEEPROM can be dumped from your console, see the Homebrew App Store for the apps that allow you to do this.

 

[PhusionDev]

If you're looking for filesystem examples, I would take a look at FTPiiU Everywhere and the Haxchi installer, those invoke the IOSU exploit to mount and read the NAND and USB file systems.

It would indeed be possible to decrypt the Wii U's filesystem on a PC, there are keys in the Wii U's OTP and SEEPROM that handle the encryption of the USB drive. The OTP and SEEPROM can be dumped from your console, see the Homebrew App Store for the apps that allow you to do this.

Thanks a ton for this information! I greatly appreciate it

 

[QuarkTheAwesome]

The filesystem stuff (on Wii U-formatted drives) is all handled by the IOSU totally transparently to homebrew and the console in general. We tell it "get this file" and it comes back with the file; already decrypted and ready for use. What this means is that you probably won't see any low-level filesystem tomfoolery in homebrew apps; just FS functions.
In order to get down to the nitty-gritty, you'll need to start thinking about what the IOSU does behind the scenes. Here's what I can tell you off the top of my head:

• Wii U filesystems are encrypted with keys from the SEEPROM and OTP.
• @NWPlayer123 was able to decrypt a Wii U formatted USB, however she couldn't interpret the data because...
• Even once decrypted; the console uses a totally proprietary filesystem. It's not FAT or anything like that.
• That said, NWPlayer also screencapped a hex dump of a decrypted USB and it seemed to me that you could figure it out with a bit of work - readable filenames etc.
• The IOSU's code is available in an IDA database. This means a dedicated person who reads ARM Assembly or some seriously messed-up C could figure out the filesystem format that way, too.
• Nintendo doesn't know how partition tables work. Here be dragons.

Anyway, I hope some of that information can help in your quest to bring Wii U filesystems to the PC.

(Also, thanks for reminding me of that tutorial - better finish that. I'm actually really curious to see what code you'd come up with after learning through that)

 

[PhusionDev]

The filesystem stuff (on Wii U-formatted drives) is all handled by the IOSU totally transparently to homebrew and the console in general. We tell it "get this file" and it comes back with the file; already decrypted and ready for use. What this means is that you probably won't see any low-level filesystem tomfoolery in homebrew apps; just FS functions.
In order to get down to the nitty-gritty, you'll need to start thinking about what the IOSU does behind the scenes. Here's what I can tell you off the top of my head:

• Wii U filesystems are encrypted with keys from the SEEPROM and OTP.
• @NWPlayer123 was able to decrypt a Wii U formatted USB, however she couldn't interpret the data because...
• Even once decrypted; the console uses a totally proprietary filesystem. It's not FAT or anything like that.
• That said, NWPlayer also screencapped a hex dump of a decrypted USB and it seemed to me that you could figure it out with a bit of work - readable filenames etc.
• The IOSU's code is available in an IDA database. This means a dedicated person who reads ARM Assembly or some seriously messed-up C could figure out the filesystem format that way, too.
• Nintendo doesn't know how partition tables work. Here be dragons.

Anyway, I hope some of that information can help in your quest to bring Wii U filesystems to the PC.

(Also, thanks for reminding me of that tutorial - better finish that. I'm actually really curious to see what code you'd come up with after learning through that)

Hello there, thank you for the response and the guide/information in the guide. After reading through the first few chapters I was able to understand how the file system was accessed and indeed I started to realize that everything FS related was transparent and we'd have to reverse what IOSU does behind the scenes. However the information regarding NWPlayer having a decrypted dump is a pretty big step, and I think with a bit of work like you said it could be understood. To understand the filesystem, we'd likely have to get a decrypted dump, run a command on the wii U and get another dump immediately following the command to see what changes take place.

Anyways this may all be futile, but regardless I'd like to learn more about the Wii U and programming for it and breaking it down. Thanks all for your input!

With taking dumps of WiiU formatted USB drives, and running through comparison dumps after running commands it would obviously be much more manageable with a smaller drive. I'm going to dig around for a 512MB or smaller (not sure what the smallest allowed is). Do you happen to know how @NWPlayer123 got this dump? Was it software or some modified hardware?

 

[PhusionDev]

Also I love your guide @QuarkTheAwesome (so far)! It has been very helpful in beginning to understand Wii U development. Thanks for the time and effort you have put into it, and if you ever feel like continuing on with it, I would surely appreciate it and I'm sure other new adventurers would as well

 

[NWPlayer123]

Hello there, thank you for the response and the guide/information in the guide. After reading through the first few chapters I was able to understand how the file system was accessed and indeed I started to realize that everything FS related was transparent and we'd have to reverse what IOSU does behind the scenes. However the information regarding NWPlayer having a decrypted dump is a pretty big step, and I think with a bit of work like you said it could be understood. To understand the filesystem, we'd likely have to get a decrypted dump, run a command on the wii U and get another dump immediately following the command to see what changes take place.

Anyways this may all be futile, but regardless I'd like to learn more about the Wii U and programming for it and breaking it down. Thanks all for your input!

With taking dumps of WiiU formatted USB drives, and running through comparison dumps after running commands it would obviously be much more manageable with a smaller drive. I'm going to dig around for a 512MB or smaller (not sure what the smallest allowed is). Do you happen to know how @NWPlayer123 got this dump? Was it software or some modified hardware?

Nah, just Windows program to dump the raw data, someone suggested dd but that's a linux tool and gave me problems, just used HxD with admin to view the drive and save it as a file

 

[PhusionDev]

Nah, just Windows program to dump the raw data, someone suggested dd but that's a linux tool and gave me problems, just used HxD with admin to view the drive and save it as a file

I was thinking about doing this myself. Was your dump of the drive encrypted or decrypted? I assume it was encrypted unless you managed to decrypt it using the wiiu OTP/SEEPROM keys?

 

[NWPlayer123]

I was thinking about doing this myself. Was your dump of the drive encrypted or decrypted? I assume it was encrypted unless you managed to decrypt it using the wiiu OTP/SEEPROM keys?

Yes, it's encrypted on the drive and then I used the OTP encrypted seed to decrypt it with OpenSSL just like the Wii U does and then that's what you nerds saw was the raw FS, can tell cause it's mostly zeroes like everything else
oh, and the block size I think was 0x200

 

[PhusionDev]

Yes, it's encrypted on the drive and then I used the OTP encrypted seed to decrypt it with OpenSSL just like the Wii U does and then that's what you nerds saw was the raw FS, can tell cause it's mostly zeroes like everything else
oh, and the block size I think was 0x200

Thanks for this information, I will mess around with my USB raw dump and my OTP key!

 

[PhusionDev]

@NWPlayer123 was the data encrypted using AES-128? I have my dumped drive and I'm trying to decrypt it using openssl like you mentioned but I'm getting "bad magic number" Please forgive my noobiness here, but I feel like I'm getting steps closer to eventually making sense of this

 

[Mr Objection]

If this happens, it will be wonderful

 

[PhusionDev]

@NWPlayer123 after reading your post https://gbatemp.net/threads/what-we-know-about-rednand-so-far.447423/page-2#post-6807034 everything finally came together, and I'm decrypting my usb dump as we speak. Thanks for all of your work and help

 

[piratesephiroth]

Unfortunately right now we can only mount it read-only.
It will be great once we can actually modify the data directly, like moving files from the SD card to USB. All the current tools (ftpiiu and the mega slow wupclient) use the network and the PC as middle man instead of moving the files directly.

I wonder why no one has made a native file explorer for the Wii U yet.

 

[PhusionDev]

Unfortunately right now we can only mount it read-only.
It will be great once we can actually modify the data directly, like moving files from the SD card to USB. All the current tools (ftpiiu and the mega slow wupclient) use the network and the PC as middle man instead of moving the files directly.

I wonder why no one has made a native file explorer for the Wii U yet.

The Wii U file system is encrypted, and even once it's decrypted, we don't know how the file system actually works (on a low level bit-by-bit). Currently I am looking for patterns and anything peculiar to try and unravel the mysteries of the Wii U File System.

Then once we understand the file system, we still need to reverse engineer the way that the Wii U installs the titles onto the hard drive (including signing of the tickets) or instead develop a custom firmware or homebrew application that can load the titles in a non-standard way.

Also: I think that somebody has developed a file explorer (Wii U Homebrew) application. Which I plan to find/use to compare to my bit level decrypted dump, but as far as PC applications are concerned: we don't understand the file system that the Wii U formats the drives to yet. On the Wii U homebrew, we call functions that are exposed/hijacked from the Wii U itself to see the file system. So while we can call functions that nintendo wrote, we don't understand what they are doing exactly.

--------------------- MERGED ---------------------------

Currently I am mulling over the data on a freshly zero'd and freshly formatted (by the wii u) USB stick. I'm finding interesting patterns of data, but nothing conclusive yet. The data that I have to work with has exposed xml files pertaining to the users on my Wii U, and I am going to try and understand how this data gets arranged/placed as a starting point. I plan to also install a small title onto the usb stick and immediately after dump the drive and decrypt it; seeing which changes take place to the data on the drive as a comparison.

 

[piratesephiroth]

The Wii U file system is encrypted, and even once it's decrypted, we don't know how the file system actually works (on a low level bit-by-bit). Currently I am looking for patterns and anything peculiar to try and unravel the mysteries of the Wii U File System.

Then once we understand the file system, we still need to reverse engineer the way that the Wii U installs the titles onto the hard drive (including signing of the tickets) or instead develop a custom firmware or homebrew application that can load the titles in a non-standard way.

Also: I think that somebody has developed a file explorer (Wii U Homebrew) application. Which I plan to find/use to compare to my bit level decrypted dump, but as far as PC applications are concerned: we don't understand the file system that the Wii U formats the drives to yet. On the Wii U homebrew, we call functions that are exposed/hijacked from the Wii U itself to see the file system. So while we can call functions that nintendo wrote, we don't understand what they are doing exactly.

--------------------- MERGED ---------------------------

Currently I am mulling over the data on a freshly zero'd and freshly formatted (by the wii u) USB stick. I'm finding interesting patterns of data, but nothing conclusive yet. The data that I have to work with has exposed xml files pertaining to the users on my Wii U, and I am going to try and understand how this data gets arranged/placed as a starting point. I plan to also install a small title onto the usb stick and immediately after dump the drive and decrypt it; seeing which changes take place to the data on the drive as a comparison.

Yeah, I know that it's not an easy task to figure out the file system.That's the reason a native wii u file browser would be better.
We could just put our modified files on the SD and then transfer to the USB device directly.

 

[PhusionDev]

even with the file browser though.. we still don't know how the wii u signs and installs the titles