Hacking WFS USB Block Injector

[Valery0p]

Yes, they are.

Thank you so much. If more people could send me the last 12 bytes (or I can make that simple program), it would be very good.

I agree with you, dumping SEEPROM from vWii side (if it's possible) doesn't seem so easy.

Enviado de meu 6039J usando Tapatalk

Bad news: https://gbatemp.net/threads/dump-mi...umper-for-vwii-wii.358977/page-2#post-4853842
Read the next post...

 

[tomcaliser]

Help please,when i try this,Cmd say wrong usb key size...So please tell me what i have to do?...

 

[Corredor]

@Valery0p and I have observed that there are not common bytes in (three) different USB seeds. But, I noticed that all the three SEEPROMs had also different SEEPROM version codes. Maybe the last 12 bytes of the USB seeds are just random numbers, unique per console (worst case)... Or there is only one number for each SEEPROM version (best case). It may be interesting to compare many USB seeds (last 12 bytes) and SEEPROM version codes. Does anyone have a SEEPROM with version code 00 03, 00 15 or 00 08? If you have it or don't mind to share the last 12 bytes of your USB seed (without the Console ID) with us, please send me a PM.

 

[tomcaliser]

@Valery0p and I have observed that there are not common bytes in (three) different USB seeds. But, I noticed that all the three SEEPROMs had also different SEEPROM version codes. Maybe the last 12 bytes of the USB seeds are just random numbers, unique per console (worst case)... Or there is only one number for each SEEPROM version (best case). It may be interesting to compare many USB seeds (last 12 bytes) and SEEPROM version codes. Does anyone have a SEEPROM with version code 00 03, 00 15 or 00 08? If you have it or don't mind to share the last 12 bytes of your USB seed (without the Console ID) with us, please send me a PM.

Okay but what is the usb seed?

 

[C0mm4nd_]

Okay but what is the usb seed?

i won't give my seeprom away like that, it contains pretty sensible stuff

 

[tomcaliser]

Like?" i won't give my seeprom away like that, it contains pretty sensible stuff" but i have make a backup what is the problem?
What do you mean?

 

[C0mm4nd_]

Like?" i won't give my seeprom away like that, it contains pretty sensible stuff" but i have make a backup what is the problem?
What do you mean?

It contains some stuff that could ban your wii u (i could just pick some stuff from it, inject into my wii u, use some hacks and ban you)

 

[tomcaliser]

OK that coold....Thank to answer

--------------------- MERGED ---------------------------

Help please,when i try this,Cmd say wrong usb key size...So please tell me what i have to do?...

Anyone have solution please?
If someone can make a video tutorial step by step...it could be very helpful

 

[Valery0p]

It contains some stuff that could ban your wii u (i could just pick some stuff from it, inject into my wii u, use some hacks and ban you)

If you inject only a random and incomplete usb seed you can only ban your hard hard drive
I'm not like someone that screenshots his entire dump...

 

[tomcaliser]

I M a N0o0b so I don t know everithing,about advanced modification,i can t progaming a complex program

 

[C0mm4nd_]

If you inject only a random and incomplete usb seed you can only ban your hard hard drive
I'm not like someone that screenshots his entire dump...

you can't ban an hard drive lol, you can ban a console with the NG-ID tho

 

[tomcaliser]

nobody know how to fix my problem?

 

[Valery0p]

you can't ban an hard drive lol, you can ban a console with the NG-ID tho

But with editing the others 12 bytes you can make your HDD unreadable (=ban your hdd) xD

 

[wiiupoo]

If it is possible to derive the 4byte NGID, since it possbily is related to the serial or maybe the wiiu leaks it through network packets, bruteforcing the other 6bytes wouldn't be too farfetched.

2^48 combinations = 281 trillion = ~5 days to bruteforce the remaining 6 bytes since plain-text and AES ciphers are known.
GPU's can produce GPU's ~0.5-1 billion AES hashes a second.

Not the most elegant solution but within reach.

Not knowing the NGID bumps it up to 2^80 = two magnitudes higher than exa-combination prefix = 65,000 years

 

[EyeKey]

It is 0x10 bytes, not 10 bytes...

 

[wiiupoo]

It is 0x10 bytes, not 10 bytes...

and we are fucked, damn hex LOL. ~4trillion years for ~12 bytes if we knew NGID

 

[Corredor]

If it is possible to derive the 4byte NGID, since it possbily is related to the serial or maybe the wiiu leaks it through network packets, bruteforcing the other 6bytes wouldn't be too farfetched.

2^48 combinations = 281 trillion = ~5 days to bruteforce the remaining 6 bytes since plain-text and AES ciphers are known.
GPU's can produce GPU's ~0.5-1 billion AES hashes a second.

Not the most elegant solution but within reach.

Not knowing the NGID bumps it up to 2^80 = two magnitudes higher than exa-combination prefix = 65,000 years

The best we can do right now is to analyze some Wii U seeds (last 12 bytes) and SEEPROM version codes. Should I make a thread asking for collaboration?

Enviado de meu 6039J usando Tapatalk

 

[wiiupoo]

Actually, more interesting would be to check out how the wiiu "system transfer" works.

The "source" console formats an SD card meant for the "dest" console.

While it doesn't transfer content hax, the save game exploits look to be fairgame. The payloads within the save games will then be encrypted on the virgin console without a known encryption key during the transfer.

It should be possible to indentify where these payloads start and end even though they are encrypted. In essence it may be a way to use the encryption key to create valid files without actually knowing what it is.

 

[Valery0p]

Actually, more interesting would be to check out how the wiiu "system transfer" works.

The "source" console formats an SD card meant for the "dest" console.

While it doesn't transfer content hax, the save game exploits look to be fairgame. The payloads within the save games will then be encrypted on the virgin console without a known encryption key during the transfer.

It should be possible to indentify where these payloads start and end even though they are encrypted. In essence it may be a way to use the encryption key to create valid files without actually knowing what it is.

Afaik the seeprom usb seed is used only with...the usb encryption system.
How a sys transfer can help with that? Also, existing save exploits on wiiu are no functional for now (because: normal apps=no codegen=no kexploit=no HBL)...maybe you want to leak the plaintext, using the systransfer? Wiping a console only for that? Dx Dx Dx

Also, is pretty sure we can dump the NG ID from an hacked vWii, since wii and wii u ones are the same except for the first half byte (2 on wii, 4 on wiiu, see page 3 for more info); maybe there are better ways to obtain it, but sadly without the others 12 bytes it's useless...

Stupid question about plaintext: two wiiu formatted usb drives, of the same dimension, both empty/with the same continent, from two different consoles, don't generate the same/pretty similar plaintext after proper decryption?

 

[Glix]

Afaik the seeprom usb seed is used only with...the usb encryption system.
How a sys transfer can help with that?

When you do a system transfer, can you reuse usb sticks/hdd's from the source Wii U without formatting the drive?
If yes, then that is what he is talking about... the seeprom info has to be sent to the new Wii U to use the old drive without formatting it. And if that info is stored on the sd card, we can easily rip that info out and digest if we know what it is encrypted with which has to be something common between Wii U's.