Tutorial  Updated

fwpatcher: fw.img patcher for WiiU WiiVC firmware image

fwpatcher: fw.img patcher for WiiU WiiVC firmware image

Since about two weeks, it is possible to inject custom ISO files and homebrew into the WiiU WiiVC games, as seen in this thread: https://gbatemp.net/threads/wii-on-wii-u-virtual-console-injecting-games.483007/

The main piece of software that is responsible for handling all the differences between WiiU mode and vWii is a file called "fw.img". That file has been released by Nintendo in three different versions: r569, r570 and r590.

Because there are now quite a few different patches for this file, including a Trucha patch for non-signed content, all hidden in some posts in the thread above, I have decided to create a small tool called "fwpatcher". I have read the whole thread and other related threads and embedded all the patching info into that tool. Most patches have also been ported to it doesn't matter which version of the fw.img you use (although I still recommend using r590. The ported patches are not tested yet, and not all patches are ported).

How does this work?

For an exact description on how to edit the WiiU VC game contents, please refer to the thread linked above. This thread is only about patching the fw.img file.

To patch that file, first download my tool: https://download.florian-bach.de/fwpatcher_0.01_current.zip

If you have followed the tutorial above until step 1, you should have a "fw.img" somewhere. Open a command line and execute "fwpatcher-win64.exe INTERACTIVE fw.img" (obviously replace program name if you use another OS).

The patcher will give you a list of patches and ask which ones you want to apply. If you don't understand a patch, press "h" for help and it will be explained. Otherwise, press "y" or "n" to select the patches you want to apply. The patched file will be stored as "fw-new.img".

The tool also supports the command CHECK ("fwpatcher-win64.exe CHECK fw.img"), that command analyzes an fw.img and tells you which patches have been applied.

Supported patches

- Trucha (all versions)
- ES_Identify (all versions)
- HW_AHBPROT (all versions)
- HW_MEMPROT (all versions)
- Wiimotes in Gamepad mode (all versions)
- Gamepad Cache flush (r590 only) to use Gamepad in homebrew
- Emulate Wiimote only instead of Classic Controller (all versions)
- Emulate sideways Wiimote (all versions)
- Swap L&R with ZL&ZR buttons (r590 only)
- Nintendont patches (r590 only)

Changelog

Code:
fwpatcher v0.01 r20-31a911a2 - 2017-09-16:
- Unknown patches will be recognized by the CHECK command and a warning
  message will be printed.

fwpatcher v0.01 r19-16520666 - 2017-09-16:
- Help and recommended value for each patch added.
- Patch combinations are now validated (some patches require another,
  some are incompatible)

fwpatcher v0.01 r17-ea6c6acd - 2017-09-15:
- New Nintendont patch (fix94) added
- Bugfix where certain patches weren't always recognized

fwpatcher v0.01 r16-3108dffd - 2017-09-15:
- Initial release
- Can patch an fw.img file
- Can check which patches have been applied
- "Gamepad Cache flush" and "L-R -> ZL-ZR" patch are not ported to all versions
  yet (r590) needed for those.
- Not all ported patches have been tested.
 
Last edited by leseratte,

leseratte

Wiimmfi Team
OP
Member
Joined
Jun 2, 2012
Messages
453
Trophies
1
XP
1,859
Country
Germany
What parameters do I have to activate and deactivate in order to play games like DBZ: BT3 and RE4 through the gamepad?
If these gamers support the classic controller, the edits in the meta.xml should be enough. If it doesn't, "Emulate Wiimote only" and maybe "Wiimote sideways" may help.

Any documentation on the format of the FW images?
There is not much to say about these.

They have a header of 0x10 bytes.
At 0x00 is the header length (0x10)
At 0x04 is the length of an unknown data block (identical in all three versions)
At 0x08 is the length of the ELF file
0x0c is empty.

Then, there is the unknown block, and then an ARM ELF file.
 

TeconMoon

Well-Known Member
Member
Joined
Aug 7, 2007
Messages
749
Trophies
1
XP
2,617
Country
United States
Very nice to have all these patches in one place! I tried applying the Wiimotes in Gamepad mode patch to a Super Smash Bros Brawl injection (r590), and although it still asked me if I wanted to use the GamePad, only the Wii Remotes would connect (no GamePad) but I suppose this will be like using GamePad emulation on games where lots of games just won't be compatible.
 

CatmanFan

Anxious and regretful
Member
Joined
Aug 14, 2016
Messages
1,962
Trophies
0
Website
www.youtube.com
XP
2,595
Country
Morocco
Which Wii VC games have rev 590 in them?
Here:
Note: You should get a game that contains the latest revision of fw.img (r590), that's the only version supported by @FIX94's patches.
Here's some info you can use to verify that you have a good file:
Size: 1785497 bytes.
CRC32: E2F27E9B
MD5: 3CAF52A9A440EEE4F125A3AD22E305C8
SHA: A5A75EBF3164874830A1D5992495DE510AB3F74E

Now here's a list of some titles that contain the preferred fw.img (verified mostly by @fejich and @markehmus)
DONKEY KONG JUNGLE BEAT [VBXE01]
Kirby's Epic Yarn [VARE01]
Lost in Shadow [VA8E01]
Mario Strikers Charged [VBFE01]
Mario Super Sluggers [VBHE01]
Pandora's Tower [VAPE01]
PIKMIN 2 [VBTE01]
PIKMIN [VBUE01]
Resident Evil 4 Wii Edition [VBDE01]
Resident Evil The Umbrella Chronicles [VBWE01]
Rhythm Heaven Fever [VAKE01]
Sin and Punishment Star Successor [VALE01]
Super Mario Galaxy [VBKJ01]
Super Paper Mario [VBBE01]
The Legend of Zelda Skyward Sword [VANE01]
Trauma Team [VA6E01]
Wario Land Shake It [VBGE01]
WARIO WARE SMOOTH MOVES [VBVE01]
 
  • Like
Reactions: CeeDee

Xyphoseos

Hack or no games
Member
Joined
Jun 29, 2016
Messages
1,834
Trophies
0
Age
23
Location
Rivière
XP
3,265
Country
France
how can i get fw.img ? there is long time ago I compiled mine with my otp, and source file of dimok I believe, but I get an error when i want to patch it
 

CatmanFan

Anxious and regretful
Member
Joined
Aug 14, 2016
Messages
1,962
Trophies
0
Website
www.youtube.com
XP
2,595
Country
Morocco
how can i get fw.img ? there is long time ago I compiled mine with my otp, and source file of dimok I believe, but I get an error when i want to patch it
Use JNUSTool and that title keys site to get a decrypted Wii VC title.
Code:
java -jar JNUSTool.jar TITLEID TITLEKEY
The fw.img file should be in the code folder.
 

CatmanFan

Anxious and regretful
Member
Joined
Aug 14, 2016
Messages
1,962
Trophies
0
Website
www.youtube.com
XP
2,595
Country
Morocco
can i use ftp everywhere to dump a fw.img of a game in my wiiu ?
If you want, yes, but make sure that the fw.img is the latest version (r590).
Now here's a list of some titles that contain the preferred fw.img (verified mostly by @fejich and @markehmus)
DONKEY KONG JUNGLE BEAT [VBXE01]
Kirby's Epic Yarn [VARE01]
Lost in Shadow [VA8E01]
Mario Strikers Charged [VBFE01]
Mario Super Sluggers [VBHE01]
Pandora's Tower [VAPE01]
PIKMIN 2 [VBTE01]
PIKMIN [VBUE01]
Resident Evil 4 Wii Edition [VBDE01]
Resident Evil The Umbrella Chronicles [VBWE01]
Rhythm Heaven Fever [VAKE01]
Sin and Punishment Star Successor [VALE01]
Super Mario Galaxy [VBKJ01]
Super Paper Mario [VBBE01]
The Legend of Zelda Skyward Sword [VANE01]
Trauma Team [VA6E01]
Wario Land Shake It [VBGE01]
WARIO WARE SMOOTH MOVES [VBVE01]
 

Cyan

GBATemp's lurking knight
Former Staff
Joined
Oct 27, 2002
Messages
23,749
Trophies
4
Age
46
Location
Engine room, learning
XP
15,662
Country
France
When I have this fw.img, I must launch him at boot with CBHC ?
please, don't do that.
you are mixing the virtual console "fw.img" used by Wii games with the WiiU firmware "fw.img" used by CFW booter.
they just have the same filename, but are not the same thing, not used the same way.

if you don't understand what this is for, please, just don't try random things with random homebrew.
read first.
if you still don't understand why you need this new fw.img, then you don't need it.

hint: Virtual console Wii games injection.
 
Last edited by Cyan,

Cyan

GBATemp's lurking knight
Former Staff
Joined
Oct 27, 2002
Messages
23,749
Trophies
4
Age
46
Location
Engine room, learning
XP
15,662
Country
France
ignore it
you don't need it to launch nintendont, you need it to "generate" nintendont channel on your computer. but this is not required anymore.
the channel is already generated by someone else, you don't need to do it again.
if all you want is nintendont, install this one :
https://drive.google.com/file/d/0BzEB8f_rxW-oUXEyX2tWOTQxTjQ/view
it's a forwarder which will load sd:/apps/nintendont/boot.dol


You need to patch the fw.img of a virtual console if you want to generate another new virtual console channel with another game or homebrew (for example, you want to play Naruto Shippuden: Clash of Ninja Revolution 3, which doesn't exist yet, then you need it for this thread : https://gbatemp.net/threads/wii-on-wii-u-virtual-console-injecting-games.483007/)
 
Last edited by Cyan,
  • Like
Reactions: Xyphoseos

Cyan

GBATemp's lurking knight
Former Staff
Joined
Oct 27, 2002
Messages
23,749
Trophies
4
Age
46
Location
Engine room, learning
XP
15,662
Country
France
Please! Not64 on vWii!!!!!
I think the developer has been contacted, and he is aware of this new launch method. let's wait to see if he will do anything with it.

So wait, is it finally possible to play and inject Newer SMB Wii with this?
yes.
but some games still have compatibility issues with the gamepad, even if they support the classic controller natively.
http://wiki.gbatemp.net/wiki/WiiU_VC_Wii_inject_compatibility_list

Newer Super Mario Bros. Wii (Hack) : Classic Control does not work cannot be patched either
 
Last edited by Cyan,
  • Like
Reactions: bonoboy

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • BakerMan
    I rather enjoy a life of taking it easy. I haven't reached that life yet though.
  • BigOnYa @ BigOnYa:
    I don't trust the free ones, but ipvanish I've used for couple years now, n like
  • Psionic Roshambo @ Psionic Roshambo:
    I wonder if they could get CPUs to run that hot then use the heat to power a steam turbine to power the CPUs....
  • BigOnYa @ BigOnYa:
    Good idea, or at least power the GPU
  • Psionic Roshambo @ Psionic Roshambo:
    It's not the movies or games downloads that I would worry about, like breaking into networks, downloading encrypted things, spying on network traffic. I have seen so many "Top Secret" seals on files when I was a kid
  • Psionic Roshambo @ Psionic Roshambo:
    I was obsessed with finding UFOs, a surprising amount of US files where stashed on computers in other countries, China back in the early 90s omg sooo much
  • BigOnYa @ BigOnYa:
    Yea that crazy, I've never tried hack into anything, I just pirate, and my ISP have send me 3-4 letters, so had to VPN it
  • Psionic Roshambo @ Psionic Roshambo:
    Ship to ship communication software for the Navy although without access to the encrypting chips it was mostly useless
  • Psionic Roshambo @ Psionic Roshambo:
    I bet now a 4090 could probably crack it? Hmmm maybe not even back then I'm pretty sure they where using like 1024 bit encryption
  • Psionic Roshambo @ Psionic Roshambo:
    Yayyy the one set finished 324GBs lol
  • Psionic Roshambo @ Psionic Roshambo:
    Compressed....
  • Psionic Roshambo @ Psionic Roshambo:
    I wonder how many years that would have taken on a 56K modem lol
  • Psionic Roshambo @ Psionic Roshambo:
    18000 hours lol
  • Psionic Roshambo @ Psionic Roshambo:
    750 days lol
    +1
  • Psionic Roshambo @ Psionic Roshambo:
    So Internet is very much faster now lol
  • BigOnYa @ BigOnYa:
    "Time Remaining- 2 years, 9 girlfriends, 6 hairstyles, please standby..."
    +1
  • Psionic Roshambo @ Psionic Roshambo:
    I remember one time I downloaded like a 500MB ISO file on 56K and that literally took like 2 days
  • Psionic Roshambo @ Psionic Roshambo:
    I had some sort of resume thing, I remember the software had chains
  • Psionic Roshambo @ Psionic Roshambo:
    Damned if I can't remember.the name though
  • Psionic Roshambo @ Psionic Roshambo:
    Some sort of download management app
  • BigOnYa @ BigOnYa:
    Ok good chatting, I'm off to the bar, to shoot some pool, nighty night.
    +1
  • BakerMan @ BakerMan:
    hey psi
  • BakerMan @ BakerMan:
    i call your girl lyndon the way she b on my johnson
    BakerMan @ BakerMan: i call your girl lyndon the way she b on my johnson