It's confirmed. It works!

This guide uses the FREE DLC "Language pack" to do the trick. You need download it on eshop.

In this tutorial I'll show you how to play Zelda BOTW with all DLCs unlocked without start a CFW or something for this. It should work with others games with multiple DLC like MK8, Wii Sports Club, Super Smash Bros, Hyrule Warriors and others. Of course you need a legit DLC from game you want to play.

For Super Smash Bros detail follow this link:

https://gbatemp.net/threads/tutoria...-without-cfw-or-aocpatcher-on-sysnand.464178/

For MK8 detail follow this link:

https://gbatemp.net/threads/tutorial-play-mario-kart-8-with-all-dlc-for-free-without-cfw.464407/#post-7173356

What you need:

Spoiler

• Zelda BOTW "Language Pack" downloaded from eshop. You need the latest update and download it from game options (needs a legit DLC)
• Mocha CFW, Haxchi CFW, or any other (just in the beginning)
• WiiU App Store (or Tik2SD + FTPiiU_Everywhere + WUP Installer GX2 +
  Mocha CFW + Homebrew Launcher)
• WiiU USB Helper
• SD Card
• PC
• Hex Editor (HxD for Windows)

1 - First if you have any illegitimate Zelda BOTW DLC installed, just delete it using using Data manager on WiiU Config
2 - Download the DLC on eshop
3 - Make sure your SD card is formatted in FAT32
4 - Download the DLC of Zelda BOTW of your region with WiiU USB Helper and put it in your SD card in na folder called "install" in the root.
5 - Go to Homebrew Launcher and choose App Store or go to wiiubru.com/go on you browser and choose App Store. If you don't know what's Homebrew Launcher is give a look in this guide (parts I, II and III) and choose start App Store.
6 - In App Store Download Tik2SD + FTPiiU_Everywhere + WUP Installer GX2 + Mocha CFW + Homebrew Launcher
7 - Launch Homebrew Launcher and go to Mocha_CFW (use default options). Then go to WUP Installer GX2 and choose install the DLC of Zelda BOTW you just download wherever is your game (nand or USB).
8 - Back to Homebrew Launcher, go to Tik2SD and backup your tickets. Put your SD in PC and look at tik2sd folder. Open keys.txt and search where your Zelda BOTW DLC is installed. The name you need to search is 0005000c101c9400 or 0005000c101c9500 or 0005000c101c9300.
9 - Now it's time for hex editing.
Use the link from www.marcrobledo.com/wiiu-tik-fixer/ (thanks @marc_max )
open the folder and in tik2sd wich the ticket from you game is , than drop on the site above, you gonna see 2 tickets, click in fix, and download the file , than go to step 10.

Spoiler

If you want to do manually, then thanks to @Rahzadan we have a VERY detailed tutorial for it. Go to this thread and after the hex editing go to step 10 below.

Spoiler

If you followed the @Rahzadan tutorial or used the @marc_max website above, go to step 10. I'll keep this part only for log
purpose.

Spoiler

Locate your ticket in your SD card according with keys.txt. Open with an hex editor (in my case it's on 0009 folder and the name is 00000015.tik. Backup the ticket.

Look that you gonna have 2x finds in the key.txt file. In my case 0009/00000015.tik@0x6a0 and 0009/00000015.tik@0x0. The number after the "@" shows where the ticket starts inside the tik file. It means probably the fake ticket is in beginning of tik (0x0) file and my legit ticket starts in 0x6a0 (note is in hexadecimal).

The fake ticket is like this, a lot of same numbers:

Spoiler

In this case it shows SSB ticket, but for Zelda BOTW ticket is the same thing, just another Game ID.

Pay attention in the blue highlight. It shows the game ID. If it says a number other than 0005000c101c9400 or 0005000c101c9500 or 0005000c101c9300 it means the ticket is from another game!

The trick here is swap the fake ticket with the legit ticket, that way the legit ticket always come first in the tik file! This picture can demonstrate what I mean:

Spoiler

In this case it shows SSB ticket, but for Zelda BOTW ticket is the same thing.

Maybe there's another game ticket inside the tik file, maybe not. Anyway, just copy and past with your hex editor the fake ticket with the legit ticket. Pay attention and don't touch other game tickets in the tik file!

If your legit ticket comes first you don't need swap the tickets! You already can play with all DLC unlocked! I believe it can happens if you download the free DLC after install the fake DLC.

After the swap save your ticket in your PC.

10 - Now put your SD back in WiiU. Open Homebrew Launcher and launch FTPiiU_everywhere (make sure you had launch Mocha CFW or other CFW before that)
11 - Go to your Zelda BOTW ticket location inside WiiU memory using a FTP browser like FileZilla or even Windows Explorer with the IP of your WiiU. Its in "storage_slc/rights/ticket/apps/xxxx/xxx.tik". Replace that ticket with the one you just modified.
12 - Open your Zelda BOTW game and enjoy play with all contents without CFW!

TL;DR: Download the free DLC, install all DLC packet with a fake ticket, locate your ticket inside WiiU, swap the legit ticket with the fake ticket inside the tik file so that the legit ticket appears first.

Thank to @nexusmtz and @Madridi

 

[RemixDeluxe]

Wow so does this exploit make the eShop think you purchased these DLC legitimately if you wanted to redownload or would it ask you to pay? I'll definitely try when I get home.

 

[JMP]

Yes just give a look in the ticket, both must be there (search the game ID inside)

thank you all work.

 

[Rahzadan]

Does this work to unlock the DLC that isn't even officially released yet?

 

[raphamotta]

Wow so does this exploit make the eShop think you purchased these DLC legitimately if you wanted to redownload or would it ask you to pay? I'll definitely try when I get home.

You don't need to pay anything, the game will think you're using a legit DLC

Does this work to unlock the DLC that isn't even officially released yet?

Yes. But you only can play it after release.

 

[Rahzadan]

You don't need to pay anything, the game will think you're using a legit DLC


Yes. But you only can play it after release.

Will we need to re-apply a newer copy of the DLC once its released or does this contain it already?

Better question, will we need to swap tickets again once DLC is released?

 

[ShadowOne333]

Okay so I just downloaded the Language pack DLC from the eShop, now how would I go about installing the three treasure chest DLC only? I believe that one was like 2.5MB or something, but USB Helper is downloading the whole 870MB pack again :/

 

[raphamotta]

Okay so I just downloaded the Language pack DLC from the eShop, now how would I go about installing the three treasure chest DLC only? I believe that one was like 2.5MB or something, but USB Helper is downloading the whole 870MB pack again :/

You are right it seems USB Helper download all DLC. I think unfortunately will need to download all package or find someone who have the first DLC (I don't have)

 

[ShadowOne333]

You are right it seems USB Helper download all DLC. I think unfortunately will need to download all package or find someone who have the first DLC (I don't have)

Yeah that's really a downsight or something.
There should be an option to select different versions of the DLC, as with the updates, but who knows if DLC works the same way.

If someone has the previous 2.5MB DLC, please let me know

 

[raphamotta]

Yeah that's really a downsight or something.
There should be an option to select different versions of the DLC, as with the updates, but who knows if DLC works the same way.

If someone has the previous 2.5MB DLC, please let me know

Yes it's the same with SSB, you can't download only one fighter, the DLC from USB Helper has all of then. Maybe there's an option in NUSgrabber, idk.

 

[wolf-snake]

I have the regular Season Pass DLC for Breath of the Wild, its been in my sd since march 3rd.

Edit: It seems Wup Installer doesn't let me install earlier DLC while i have the latest one installed on my console, meaning you can't install the season pass alone after you have downloaded the language pack off the Eshop.
Solution? I'll try to install the full DLC set off from Wii U Usb Helper on top of the already installed language pack to see what happens.

 

[suzsuzuki]

I have the regular Season Pass DLC for Breath of the Wild, its been in my sd since march 3rd.

Edit: It seems Wup Installer doesn't let me install earlier DLC while i have the latest one installed on my console, meaning you can't install the season pass alone after you have downloaded the language pack off the Eshop.
Solution? I'll try to install the full DLC set off from Wii U Usb Helper on top of the already installed language pack to see what happens.

My solution was download the Language pack from eshop, delete it on system menu, install fake dlc (all +800MB again), swap the tickets and that's it! Worked!

 

[wolf-snake]

My solution was download the Language pack from eshop, delete it on system menu, install fake dlc (all +800MB again), swap the tickets and that's it! Worked!

That's a good solution, that way the ticket stays on the console.

 

[ShadowOne333]

I got it to work with a different method.
I simply kept the official Language DLC, then started downloading it again in USB Helper.
Then I simply chose to install all but the 00000015 files (h3/app) and then installed the rest with WUP Installer.

Then dumped the ticket, switched the order and that's it, now the DLC appears as purchased in the game, and the chests where in the Plateau as well.

 

[wolf-snake]

Managed to get it to work with the method i mentioned earlier. I wonder why this exploit is not well known as other ones.

 

[nexusmtz]

I wonder why this exploit is not well known as other ones.

Probably because I'm not a Wii U developer, I have a total of two followers (I only see one), and I talked about it a couple times, but didn't write a thread on it. It wasn't until raphamotta wrote the tutorial that more than a few people were aware of it.

Plus, most people just don't have a need for it. They use CBHC or run Haxchi/Mocha when they start up, so they don't really get a benefit from it. And hex editing? What are we, Nerds?

 

[raphamotta]

Managed to get it to work with the method i mentioned earlier. I wonder why this exploit is not well known as other ones.

The hex editing scares most of people. It's an advanced tutorial. I'm to lazy to make a simple python programs to swap the tickets automatically. Maybe one day someone can fill this lack.

 

[TheBroCode]

Would it be possible to get a bit more detail/help with the hex editor part? I open it in an hex editor and have no idea where one ticket begins and ends so I don't know which part to copy/swap. Thanks!

 

[raphamotta]

Would it be possible to get a bit more detail/help with the hex editor part? I open it in an hex editor and have no idea where one ticket begins and ends so I don't know which part to copy/swap. Thanks!

Hi. Give a look on the ticket picture in the tutorial. It's the whole ticket there. It has size of 350, using HxD you can see the size below after selecting the characters.

 

[Rahzadan]

Hi. Give a look on the ticket picture in the tutorial. It's the whole ticket there. It has size of 350, using HxD you can see the size below after selecting the characters.

@raphamotta I'm actually pretty good at writing tutorials (I've done several for my daily job). Using your tutorial, I've successfully gotten this procedure to work for all games with free DLC (to unlock all DLC without using CFW).

I might do a more detailed / "for dummies" tutorial on this that has a very high amount of detail. I used "frhed" hex editor instead of HxD (frhed is also freeware), but any hex editor will do the trick.

I may do it in the form of a YouTube video instead.

Thoughts?

 

[ShadowOne333]

Would it be possible to get a bit more detail/help with the hex editor part? I open it in an hex editor and have no idea where one ticket begins and ends so I don't know which part to copy/swap. Thanks!

When you check in the keys.txt file, you have to look for 0005000c101c9400 in there, and you will find two matches, one with 0x0 and another with 0x???, in my case it was 0x350 for the second key.
So with that said, I opened up the .tik file in HxD (i believe its name was 0000001e.tik or something), and then looked at those addresses.

Indeed, the first key started at offset 000000, and the second one at 00000350.
Now, I looked at both of them, and noticed that the one at 0x350 was the legit key and the one at 0x0000 is the fake one, so I have to put that one at the beginning.
So I cut EVERYTHING starting from 350 all the way up to the end of the file, and pasted it at the beginning of the file.
If you do this correctly, now the legit key starts at 0x0000 and the fake one at 0x350, effectively making the console think it is legit as well.

Hope this helps you out.

@raphamotta I'm actually pretty good at writing tutorials (I've done several for my daily job). Using your tutorial, I've successfully gotten this procedure to work for all games with free DLC (to unlock all DLC without using CFW).

I might do a more detailed / "for dummies" tutorial on this that has a very high amount of detail. I used "frhed" hex editor instead of HxD since frhed is freeware, but any hex editor will do the trick.

I may do it in the form of a YouTube video instead.

Thoughts?

I was thinking about making a video tutorial myself, but I have yet to find the time to do so
I might do it this week hopefully.