Homebrew Official tik2sd - easily dump wiiu tickets to your sd card

[Madridi]

So a quick report. Had some time to try again yesterday. Redownloaded brain Age and placed my ticket in the folder (renamed of course). Couldn't install with or without CFW, same errror as before.

Then I tried to simply install a fake signed version. Worked perfectly. I then located the ticket on my Wii U and when I found it I noticed it had changed to a "multi ticket" with two brain age tickets. They had different title keys, one of them was my genuine ticket. I deleted this ticket and replaced it with my backup. Rebooted and tried to start. Success!

So let me give this hypothetical situation:
Assume I own part of DLC, (let's say, super smash).. Which means I have a ticket for the dlc.

Would dumping that ticket, downloading a fake signed dlc, replacing the fake ticket with mine, then installing the whole thing, unlock all dlc without any sig patch needed?

 

[nexusmtz]

So let me give this hypothetical situation:
Assume I own part of DLC, (let's say, super smash).. Which means I have a ticket for the dlc. Would dumping that ticket, downloading a fake signed dlc, replacing the fake ticket with mine, then installing the whole thing, unlock all dlc without any sig patch needed?

No. That gives you exactly what you had before: The DLC title with your ticket. The ticket knows which content is purchased. Changing it to say that everything is purchased OR taking out the console ID will cause the signature match to fail.

 

[Madridi]

No. That gives you exactly what you had before: The DLC title with your ticket. The ticket knows which content is purchased. Changing it to say that everything is purchased OR taking out the console ID will cause the signature match to fail.

Are you sure that's the case? While it's true that the tickets knows what's bought or not, going of memory from the 3ds, every content works with the ticket (even those that are not purchased). The ticket doesn't actually check what's bought and what's not until you access eshop.

As long as you one part of the dlc, it can be used to unlock everything else. @cearp can probably clarify on this though.

I would imagine the Wii U working in the same way. Do we have absolute confirmation on this?

 

[nexusmtz]

Are you sure that's the case? While it's true that the tickets knows what's bought or not, going of memory from the 3ds, every content works with the ticket (even those that are not purchased). The ticket doesn't actually check what's bought and what's not until you access eshop.

As long as you one part of the dlc, it can be used to unlock everything else. @cearp can probably clarify on this though.

I would imagine the Wii U working in the same way. Do we have absolute confirmation on this?

The first-found ticket can unlock any content that is specified in the tickets, but you need the fake ticket present in order for the unpurchased content to be enabled initially, and it must be present when you execute. In your scenario, you didn't run the install with the fake ticket, so that ticket never made it into /storage_slc/rights/ticket/apps. You'll only have what you bought, because none of the other flags are set.

To run Smash, where you own a single DLC, without sigpatches:

• Download the DLC and fake ticket.
• Run your sigpatcher.
• Use tik2sd to backup your tickets.
• Use WupInstaller to install the DLC title with the fake ticket.
• Run Smash and see the new content (press + after the first one to skip the rest).
• Exit Smash.
• In sd:/tik2sd/keys.txt, find the ticket location for Smash's DLC title (0005000c10144f00).
• Transfer that ticket bucket file from the SLC ticket dir, i.e. /storage_slc/rights/ticket/apps/0002/00000012.tik, to your PC.
• Hex edit the file and ensure that you see (at least) both the legit and fake tickets for 0005000c10144f00. If not, add whichever ticket is missing.
• Ensure that the legit ticket comes earlier in the file than the fake one. If you don't do this, you'll get the DLC corrupt message when you're not sigpatched.
• Transfer the file back if you made any changes.

Reboot without sigpatches and run the game. As long as both tickets are present, you'll have the content. If you want to entertain yourself, take the fake ticket out, and observe that the content goes away the next time you run the game.

Notes:
If you're not able to install the DLC due to a ticket problem, remove the legitimate ticket from the bucket .tik file and try the install again. I prefer to preload my tickets so I don't have to try and figure out which one the WiiU is actually using. I didn't follow exactly what I listed above, but the above steps would be more familiar than preloading.

I do the transfers with WinSCP while ftpiiu_everywhere is running on the WiiU. If you set up a custom editor in WinSCP that calls HxD, you can do the download/edit/upload in one step. WinSCP uploads the changed file when it sees a new time stamp.

Give it a shot and let us know how it goes.

EDIT: March 11, 2017 - @raphamotta wrote a more detailed tutorial for this.

 

[Madridi]

The first-found ticket can unlock any content that is specified in the tickets, but you need the fake ticket present in order for the unpurchased content to be enabled initially, and it must be present when you execute. In your scenario, you didn't run the install with the fake ticket, so that ticket never made it into /storage_slc/rights/ticket/apps. You'll only have what you bought, because none of the other flags are set.

To run Smash, where you own a single DLC, without sigpatches:

• Download the DLC and fake ticket.
• Run your sigpatcher.
• Use tik2sd to backup your tickets.
• Use WupInstaller to install the DLC title with the fake ticket.
• Run Smash and see the new content (press + after the first one to skip the rest).
• Exit Smash.
• In sd:/tik2sd/keys.txt, find the ticket location for Smash's DLC title (0005000c10144f00).
• Transfer that ticket bucket file from the SLC ticket dir, i.e. /storage_slc/rights/ticket/apps/0002/00000012.tik, to your PC.
• Hex edit the file and ensure that you see (at least) both the legit and fake tickets for 0005000c10144f00. If not, add whichever ticket is missing.
• Ensure that the legit ticket comes earlier in the file than the fake one. If you don't do this, you'll get the DLC corrupt message when you're not sigpatched.
• Transfer the file back if you made any changes.

Reboot without sigpatches and run the game. As long as both tickets are present, you'll have the content. If you want to entertain yourself, take the fake ticket out, and observe that the content goes away the next time you run the game.

Notes:
If you're not able to install the DLC due to a ticket problem, remove the legitimate ticket from the bucket .tik file and try the install again. I prefer to preload my tickets so I don't have to try and figure out which one the WiiU is actually using. I didn't follow exactly what I listed above, but the above steps would be more familiar than preloading.

I do the transfers with WinSCP while ftpiiu_everywhere is running on the WiiU. If you set up a custom editor in WinSCP that calls HxD, you can do the download/edit/upload in one step. WinSCP uploads the changed file when it sees a new time stamp.

Give it a shot and let us know how it goes.

Thanks for this. I might be hazy about some stuff (such as giving rights or how to ensure one comes before the other) but I'll check this out later when I'm in front of the Wii U and hit you back with questions or feedback

 

[Sumea]

I am interested in this too but can someone explain - Ticket bucket file? Hex edit it? Hex edit it in what manner exactly?

but thanks a lot for this info.

 

[nexusmtz]

I am interested in this too but can someone explain - Ticket bucket file? Hex edit it? Hex edit it in what manner exactly?

Maybe someone will write a tutorial some day. The ticket "buckets" are what I call the tik files that tik2sd backs up from /storage_slc/rights/ticket/apps. The WiiU sorts out the tickets into directories and files so it knows where to get the tickets related to a particular title. Multiple titles can be in each bucket file. I don't know how the WiiU makes its decision about which file the ticket goes in, but the file location is consistent across different WiiUs. In other words, The DLC tickets for the US version of SSB are in 0002/00000012.tik.

Your questions about hex editing are even farther off topic for this thread than the discussion you're responding to. Please start a topic with your questions if you're not able to find info about hex editing and tickets elsewhere.

 

[Sumea]

Maybe someone will write a tutorial some day. The ticket "buckets" are what I call the tik files that tik2sd backs up from /storage_slc/rights/ticket/apps. The WiiU sorts out the tickets into directories and files so it knows where to get the tickets related to a particular title. Multiple titles can be in each bucket file. I don't know how the WiiU makes its decision about which file the ticket goes in, but the file location is consistent across different WiiUs. In other words, The DLC tickets for the US version of SSB are in 0002/00000012.tik.

Your questions about hex editing are even farther off topic for this thread than the discussion you're responding to. Please start a topic with your questions if you're not able to find info about hex editing and tickets elsewhere.

I am just replying that I tested this and got it working right - it made sense once I opened the file and compared to singular ticket files I had around. I do know basic hex knowledge but the bucket file is basically several ticket files in a stream so for my fake installs every time the fake one became first entry and I made it the last one like in the guide. Nobody nooby can do it but they shouldn't I think. It is not destructive if you know what you do but I anything sysnand editing related should be handled with care.

 

[paulogiygas91]

It's possible in the future that we have a app like this that can backup and delete tickets on the console with a friendly UI? Instead of having numbers they are named with the game name using a database.

 

[drewby]

waiting for titlekeys dumper

 

[Columbo2811]

waiting for titlekeys dumper

That's what this is. The ticket contains the key.

 

[drewby]

That's what this is. The ticket contains the key.

Oh... Know how to extract titlekeys from tickets? I'm trying to upload titlekeys to "that titlekeys site."

 

[Columbo2811]

Oh... Know how to extract titlekeys from tickets? I'm trying to upload titlekeys to "that titlekeys site."

Using this program will dump them to a text file in the folder along with all the tickets. You can just upload that text file straight to that site and it'll sift through your keys to see if there are any new ones.

 

[tivu100]

The console ID is specified in the ticket. Whether some key to the NNID is in there also, I can't tell, but it doesn't seem so. I have no second console to test if moving the ticket between consoles with the same NNID lets the ticket work, but I wouldn't expect it to.

Yes. Deleting the ID associated with my NNID did not remove or invalidate my tickets, and I could reinstall and run without sigpatches. I thought the system might remove the tickets as part of deleting the ID, but it didn't. I haven't since created a new ID and reassociated my NNID (being that I haven't had a need to go back on eShop) so I don't know what happens at that point, but I suspect it won't have a negative effect.

Please bear with me.

So let say I bought an used Wii U that had many tickets on it (removed NNID of the original owner). I use this tool to dump the ticket & I can use the tickets to re download all the apps/games from the original owner with a newly created NNID?

 

[nexusmtz]

So let say I bought an used Wii U that had many tickets on it (removed NNID of the original owner). I use this tool to dump the ticket & I can use the tickets to re download all the apps/games from the original owner with a newly created NNID?

A ticket is not the same as a purchase. eShop lets you download the titles that have been purchased/redeemed under your NNID.

As I've said previously, it's not clear if there's any reference to NNID in a ticket, but that seems unlikely because of the one-console-per-id limitations. If tickets were controlled by NNID, they wouldn't need the restriction, because they could easily revoke the tickets belonging to an NNID when it is deleted from the console.

So although you can't download the ticketed titles from eShop, you can obtain them from NUS using a utility like WiiU USB Helper, JNUSTool, or FunkiiU, then install them using WUPInstaller. The one thing to keep in mind is that you want to delete any title.tik from your title's install directory before you try to install it. WiiU USB Helper (and FunkiiU, on request) create fake tickets, and you want your console to use your real ones.

 

[ivoyko]

I downloaded this but i press B says then dump tickets... in less than 10 second finish and then back to Wii U menu... then i turn it off enter my SD on my computer and i dont see any folder. What happened? Im using the last version.

 

[FelixWenig]

I always get the Error
Failed to mount ODD

 

[wicksand420]

@FIX94 was there ever a fix for using this on 5.0.2?

 

[FIX94]

@FIX94 was there ever a fix for using this on 5.0.2?

5.5.1 and 5.5.2 are identical, updated the post to reflect that.

 

[wicksand420]

5.5.1 and 5.5.2 are identical, updated the post to reflect that.

Ok, I'll try again, however, when I tried last time, It tried to back out to the homebrew menu and hung, I had to unplug and reboot. As always, thanks @FIX94

It worked, thanks