Hacking Please help me figure out how to install IOS/cIOS on a stubborn Wii

[ningling12]

Hello everyone, this is my first post. I bought two used 4.3U Wiis last week and successfully letter bombed, installed homebrew, bootmii as IOS, cIOS 56/249 57/250 and priiloader on one of them following the google softmodding guide for 4.3.

The second Wii, however, cannot be taken any further than letter-bombing, HBC install, Bootmii as boot2. There does not appear to be any way to install ANY IOS/cIOS on this Wii. I have tried D2X Custom IOS Installer, ModMii, DOPMii, IOS36 Installer v6, etc. They all hang during the IOS install phase, whether from offline NUS-downloaded IOS or with the Wii connected to wifi. It seems that there are no exploitable IOSes (except perhaps IOS15 which I can't seem to do anything with) on this Wii or any way to add one.

Here is one of the system check report:

Spoiler: SysCheck Report

SysCheck HDE v2.4.0 HacksDen Edition by JoostinOnline, Double_A, R2-D2199, and Nano
...runs on IOS58 (rev 6176).

Region: NTSC-U
System Menu 4.3U (v513)
Priiloader installed
Drive date: 09.07.2006
Homebrew Channel 1.1.2 running on IOS58

Hollywood v0x11
Console ID: 42753500
Console Type: Wii
Shop Channel Country: United States (49)
Boot2 v4
Found 61 titles.
Found 45 IOS on this console. 15 of them are stubs.

IOS4 (rev 65280): Stub
IOS9 (rev 1034): No Patches
IOS10 (rev 768): Stub
IOS11 (rev 256): Stub
IOS12 (rev 526): No Patches
IOS13 (rev 1032): No Patches
IOS14 (rev 1032): No Patches
IOS15 (rev 257): Trucha Bug, ES Identify, Flash Access, NAND Access
IOS16 (rev 512): Stub
IOS17 (rev 1032): No Patches
IOS20 (rev 256): Stub
IOS21 (rev 1039): No Patches
IOS22 (rev 1294): No Patches
IOS28 (rev 1807): No Patches
IOS30 (rev 2816): Stub
IOS31 (rev 3608): No Patches
IOS33 (rev 3608): No Patches
IOS34 (rev 3608): No Patches
IOS35 (rev 3608): No Patches
IOS36 (rev 0): No Patches
IOS37 (rev 5663): No Patches
IOS38 (rev 4124): No Patches
IOS40 (rev 3072): Stub
IOS41 (rev 3607): No Patches
IOS43 (rev 3607): No Patches
IOS45 (rev 3607): No Patches
IOS46 (rev 3607): No Patches
IOS48 (rev 4124): No Patches
IOS50 (rev 5120): Stub
IOS51 (rev 4864): Stub
IOS52 (rev 5888): Stub
IOS53 (rev 5663): No Patches
IOS55 (rev 5663): No Patches
IOS56 (rev 5662): No Patches
IOS57 (rev 5919): No Patches
IOS58 (rev 6176): USB 2.0
IOS60 (rev 6400): Stub
IOS61 (rev 5662): No Patches
IOS62 (rev 6430): No Patches
IOS70 (rev 6912): Stub
IOS80 (rev 6944): No Patches
IOS222 (rev 65280): Stub
IOS223 (rev 65280): Stub
IOS250 (rev 65280): Stub
IOS254 (rev 65281): BootMii
BC v6
MIOS v10
Report generated on 11/21/2017.

I formatted the internal memory before my most recent attempt to softmod it to ensure there were enough blocks available. I also never updated it after connecting it to the internet.

Any ideas on how I should proceed or why this is happening? Thank you.

 

[GreyWolf]

If you have the latest HBC installed already you don't really need an exploitable IOS. The default IOS58 along with the "<ahb_access/>" tag in the mod manager's meta.xml should work.

 

[ningling12]

Thank you GreyWolf. I just downloaded YAWMM v1 and checked its meta.xml for that tag (has it). However, when trying to install a WAD I have the same problem where it hangs at installing Content 08 (YAWMM) or Content 00000008 in D2X Custom IOS Installer.

EDIT: I just checked YAWMM again and noticed that it reads "HW_AHBPROT is disabled"

System Information from WiiMod Lite v1.7...

System Menu 513
System Menu v4.3U on IOS 80

Current Permissions on IOS 58 v6176:
Fakesign Bug (Trucha bug): [no]
EsIdentify (ES_DiVerify): [no] boot2: [no]
/dev/flash (Flash access): [no] USB2 Tree: [no]
NAND Permissions: [yes]
GetSystemMenuVersion: [yes]
AHBPROT: 0

 

[GreyWolf]

You want AHB_PROT disabled. It stands for "Advanced Hardware Bus Protection."

If it's failing on a specific content file then there may be something wrong with that file.

This is a WAD you built using ModMii? That's odd that it's packing a file that fails hash validation.

 

[ningling12]

You want AHB_PROT disabled. It stands for "Advanced Hardware Bus Protection."

If it's failing on a specific content file then there may be something wrong with that file.

This is a WAD you built using ModMii? That's odd that it's packing a file that fails hash validation.

No, I have tried wads downloaded and packed by NUS Downloader (worked for the first Wii) and have also tried allowing the apps to get the wads themselves. I think the wads may be fine.

I also just deleted the stubbed IOSes 222, 223, 249 and 250 and tried again with no luck. This Wii seems to be able to block installation of any IOS wads.

I tried trucha restore app which downloaded IOS15 v1031 and v257, checked their hashes, then displayed this error:

Spoiler

"Step 1: Set the revision to 0
Step 2: Install IOS with low revision
Preparations complete, press A to start step 1...

Installing ticket...
Setting revision to 0...
Error: ES_AddTitleFinish returned -1017
Error: Could not set the revision to 0
Downgrade failed"

 

[ningling12]

So I tried again, using the ModMii "first time" wizard. I still get stuck at step 3 of the guide "Install a patched IOS236". I tried both methods (IOS236 Installer v5/v6 and Simple IOS Patcher v1.14). Both get stuck on the "Installing..........." step and I have to reboot.

 

[GreyWolf]

You do not need a patched IOS36. You only need IOS58 and AHB_PROT turned off.

Just go to page 4 in ModMii and enter "24956" then "D". That should download the proper files and make a WAD for d2x slot 249 based on IOS56.

If you're using MMM it should show at the bottom of the screen that the AHB is available as long as the ahb_access tag is in the meta file.

 

[ningling12]

You do not need a patched IOS36. You only need IOS58 and AHB_PROT turned off.

Just go to page 4 in ModMii and enter "24956" then "D". That should download the proper files and make a WAD for d2x slot 249 based on IOS56.

If you're using MMM it should show at the bottom of the screen that the AHB is available as long as the ahb_access tag is in the meta file.

I will try that first, thank you.

I did manage to install a patched IOS36 into IOS236 using MMM v13.4's "Install IOS236" option (I think.) It said that it successfully downgraded IOS15, and patched and installed IOS36 as IOS236. The ISO viewer seems to confirm this.

So if the AHB approach fails again, I will try some other tools with the hopefully patched IOS236.

 

[ningling12]

I tried the MMM v13.4 Wad manager to install the ModMii 24956 file and I got this error:
Installing 1/1: cIOS249[56]-d2x-v10-beta53-alt.wad - Ticket (-2011)

Here is MMM's meta.xml:

Spoiler

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<app>
<name> Multi-Mod Manager 13.4</name>
<coder>[email protected]</coder>
<version>v13.4</version>
<release_date>20100920001304</release_date>
<short_description> A multipurpose all-in-one tool</short_description>
<long_description>
- Nice 1 glance view of all IOS to manage
- Fast 1 button install of all WADs in a folder
- Launch your homebrew apps from SD
- Launch Priiloader or manage its hacks
- Express 1-click Install and Patch IOS36
- View Wii System Information
- Flexible IOS reload via easy selection screen
- Fast D-PAD navigation and shortcut buttons
- Easy to use menu interface
- No forced loading of IOS

Note: To enable AHBPROT mode, add a "no_ios_reload/" line below.

</long_description>
<ahb_access/>
</app>

I called Wii System Information up by pressing '2' and saw at the bottom "AHBPROT: 00000000". No where on the main screen does it say that AHB is available.

I am going to try adding <no_ios_reload/> with and without <ahb_access/>

UPDATE
I tried that and still got "AHBPROT: 00000000" and ticket -2011 so I tried Wii Mod v3.2 which said that AHDPROT was enabled and used IOS58 v6176 to try to install the ModMii wad. I got the same result as earlier attempts with D2x Custom IOS Installer. Various "contents" are installed until #8/#9 are reached. Most programs appear to be getting stuck on #8, but one (I forget which) gets past 8 and sticks at 9 which makes me believe that content 9 is the problem install.

Any idea what content 9 in 24956 is and why it cannot be installed on this early Wii?

 

[ningling12]

The MD5 of my cIOS249[56]-d2x-v10-beta53-alt.wad file is: 021871027856fbc085a0dcc604e6bcb3
and the SHA1 is: ebf585e8f75c5c988266894ad5b850908959f066

 

[wicksand420]

did you use the same sd for both installs or different ones? Some sd's aren't compatible

 

[ningling12]

did you use the same sd for both installs or different ones? Some sd's aren't compatible

I used the same SD card, a Lexar 256MB. I moved all of the important files to a 4GB SDHC card for the first Wii after successfully softmodding it, then reformatted the SD card to FAT32 using MiniTool Partition Wizard. I might try a mini SDHC + adapter to see if that makes a difference.

Is there a preferred format for the card, like FAT16/32 cluster size etc.?

Also, is it possible that the previous owner hardmodded it and that is what is preventing the softmod? The DVD drive won't read original discs like Play and Sports.

 

[wicksand420]

I used the same SD card, a Lexar 256MB. I moved all of the important files to a 4GB SDHC card for the first Wii after successfully softmodding it, then reformatted the SD card to FAT32 using MiniTool Partition Wizard. I might try a mini SDHC + adapter to see if that makes a difference.

Is there a preferred format for the card, like FAT16/32 cluster size etc.?

Also, is it possible that the previous owner hardmodded it and that is what is preventing the softmod? The DVD drive won't read original discs like Play and Sports.

I believe the correct format for sd is fat32 with 32kb clusters, there is a possibility that the previous owner may have messed something up, have you tried to do a factory reset? Was the system factory reset before you got it? was there save data on the console when you got it?

 

[ningling12]

I believe the correct format for sd is fat32 with 32kb clusters, there is a possibility that the previous owner may have messed something up, have you tried to do a factory reset? Was the system factory reset before you got it? was there save data on the console when you got it?

I don't see an option for 32kb clusters when formatting the Lexar (perhaps because it is only 256MB). I will try it to do that in bash though.

The unit had lots of game saves for wii/N64/SNES etc. I originally tried to softmod it with them intact, but decided to free up some blocks and formatted the internal memory from the system menu. Is this the same thing as a factory reset? I would love to try a full reset if it is possible.

EDIT: I used "Format Wii System Memory" from the Wii System Settings earlier today, but I am still stuck.

 

[wicksand420]

I don't see an option for 32kb clusters when formatting the Lexar (perhaps because it is only 256MB). I will try it to do that in bash though.

The unit had lots of game saves for wii/N64/SNES etc. I originally tried to softmod it with them intact, but decided to free up some blocks and formatted the internal memory from the system menu. Is this the same thing as a factory reset? I would love to try a full reset if it is possible.

EDIT: I used "Format Wii System Memory" from the Wii System Settings earlier today, but I am still stuck.

try a bigger sd card with d2x cios installer first before wiping the console, if there where alot of saves but no games installed it might mean that the console was in fact hacked before you bought it, if changing the sd don't work, or you have already tried this before i asked, go into the system settings and factory reset the console.

Also on a side note i have found that micro sd's don't work so well on wii

 

[ningling12]

try a bigger sd card with d2x cios installer first before wiping the console, if there where alot of saves but no games installed it might mean that the console was in fact hacked before you bought it, if changing the sd don't work, or you have already tried this before i asked, go into the system settings and factory reset the console.

Also on a side note i have found that micro sd's don't work so well on wii

The only microSD card I have is corrupt so I am instead going to temporarily remove the files from the 4GB card and set it up for softmodding the second one (and get the NAND backup I was unable to make with the smaller SD card). Thank you for your help.

 

[wicksand420]

The only microSD card I have is corrupt so I am instead going to temporarily remove the files from the 4GB card and set it up for softmodding the second one (and get the NAND backup I was unable to make with the smaller SD card). Thank you for your help.

No problem, let me know how it goes.

 

[ningling12]

No problem, let me know how it goes.

The 4GB SDHC made no difference (I did manage to backup the NAND though) and neither did the FAT16-formatted 256MB SD. ALL wad managers/installers with either IOS236 approach or IOS58/AHDPROT approach choke when trying to install "content #8", "content 00000008" etc of ANY IOS/cIOS that has it.

I have run out of ideas. Is there a more extreme way to reset this old wii? To unhack it?

 

[wicksand420]

@GreyWolf , do you think his ios58 is fucked up? If so, can you just download a clean one from NUSD and re-install it?

 

[GreyWolf]

It could be. -2011 is the error code for not having ES_DIVERIFY flag, meaning the app doesn't have permission to install a title. I don't understand how the HBC got installed in the first place if there's something wrong with the IOS. The syscheck report looks like a clean 4.3U with BootMii as IOS. It should be working.

block_ios_reload and ahb_access tags have the same functionality now as far as I remember from reading the WiiBrew article about them.

Official IOSes have a valid ticket file on NUS, so you could try reinstalling IOS58. There's no need to bypass the signature check on it.