Hacking New free homebrew entry point. FlashHax

[Flashed]

It should have worked regardless. Do you have your console TV mode set to 60Hz? Others have reported that it only works with this setting on PAL versions.

Yes! That was the problem! I changed to 60Hz and worked like charm! Thanks!

--------------------- MERGED ---------------------------

neither with a usb - ethernet adapter?

Only way to hack a Wii Mini shoud be by using a DVD.
It has a USB port but nothing to do with it

 

[RosalinaFan573]

Only way to hack a Wii Mini shoud be by using a DVD.
It has a USB port but nothing to do with it

The Wiimote's 16kb of flash memory could be the key to a new entrypoint.
If it is flashed using another Wii it could be used to at least mount the USB and launch a payload file from there.

 

[Tweaker_Modding]

Does this fully work on 4.3E because idk if i should use this or LetterBomb

 

[Fullmetal5]

Does this fully work on 4.3E because idk if i should use this or LetterBomb

This does work on 4.3E but you need to set your TV mode to 60Hz for it to work.

--------------------- MERGED ---------------------------

If anyone would like to help test.
Please to visiting flashhax.com/test/ and trying that on console to see if it works.
Report if it worked or not, your software version, and if you know it your internet speed.

 

[Tweaker_Modding]

This does work on 4.3E but you need to set your TV mode to 60Hz for it to work.

--------------------- MERGED ---------------------------

If anyone would like to help test.
Please to visiting flashhax.com/test/ and trying that on console to see if it works.
Report if it worked or not, your software version, and if you know it your internet speed.

Alright my tv should work with 60hz i’ll give it a try when my wii arrives (i bought it on eBay and its still being delivered)

 

[Fullmetal5]

Alright my tv should work with 60hz i’ll give it a try when my wii arrives (i bought it on eBay and its still being delivered)

If your looking for a stable version just visit the main site flashhax.com. That test page is just for anyone that wants to help test a new version that still has some bugs to it. The success rate on the new one is really low right now but the fix should be simple. (hopefully)

 

[Tweaker_Modding]

If your looking for a stable version just visit the main site flashhax.com. That test page is just for anyone that wants to help test a new version that still has some bugs to it. The success rate on the new one is really low right now but the fix should be simple. (hopefully)

Since im new to wii modding i’ll stick to the stable version and if any of this doesn’t work i’ll use LetterBomb

 

[nino38]

When will NTSC-J come to be available?

 

[Jitoku]

The Wiimote's 16kb of flash memory could be the key to a new entrypoint.
If it is flashed using another Wii it could be used to at least mount the USB and launch a payload file from there.

Dude You Are An Intelligent!
If we can make a wad that we will load in dolphin emulator and make it store payload files in the WiiMote, Boom! New entry point for wii. And as my search, there are few apps that store files in wiimote and takes them back. So

--------------------- MERGED ---------------------------

 

[Jitoku]

I Made An Thread If You Want To Play Games From HDD (Also If You Can Not Open Shop Channel)

https://gbatemp.net/threads/guide-for-sd-less-wii-homebrewing.497626/

 

[MarioMasta64]

also i updated the https of the newer site (mariomasta64.me) but the older domain one should work http://old-school-gamer.tk/wii-hax/

 

[Deleted User]

The Wiimote's 16kb of flash memory could be the key to a new entrypoint.
If it is flashed using another Wii it could be used to at least mount the USB and launch a payload file from there.

Highly unlikely. The only way you could probably hack a wii mini is through an exploit of either WFS support (for that one game I can't remember that uses a USB HDD) or of the IOS USB stack itself (given how crap it is in IOS <58, very likely)

 

[Fullmetal5]

Highly unlikely. The only way you could probably hack a wii mini is through an exploit of either WFS support (for that one game I can't remember that uses a USB HDD) or of the IOS USB stack itself (given how crap it is in IOS <58, very likely)

Yeah the wii mote method is really unlikely.
I wanna try something like you described with the usb devices but unfortunately I don't know of any emulator for IOS.
I use dolphin for everything on the PPC side.
The only thing I can think of is using an existing IOS exploit to inject some kind of debugger into IOS in an unused memory region and hook the exception vectors.
Then at least you can get some kind of crash dump of it if you can actually find any usb crashes.
I haven't look at IOS at all so I'm not sure how hard static analysis is for it (fuck all the bctr instructions that the PPC side loves so much, they make static analysis annoying) but I hope it's as buggy as the rest of IOS
Unfortunately I have NO experience with ARM so I would both be learning ARM and doing blind injection with no debugger so I really just don't have the experience to pull anything like that off right now.

I have always been curious as to how Team Twizzers (now Fail0verflow) did this in the first place. How do you blindly exploit something like that?!?!
I can't imagine doing any of the work I have done without dolphin and its debugging stuff. And even then I had to add more debugging goodies (conditional breakpoints were a must for looping stuff) and it still took me months.
These guys pulled it off with such precision and in such a short amount of time it still amazes me.

As a side note no I'm not dead and I hope to have something new to show you guys soon.(TM)
ETA of maybe a week or so I nothing else goes wrong.

 

[ChampionLeake]

Yeah the wii mote method is really unlikely.
I wanna try something like you described with the usb devices but unfortunately I don't know of any emulator for IOS.
I use dolphin for everything on the PPC side.
The only thing I can think of is using an existing IOS exploit to inject some kind of debugger into IOS in an unused memory region and hook the exception vectors.
Then at least you can get some kind of crash dump of it if you can actually find any usb crashes.
I haven't look at IOS at all so I'm not sure how hard static analysis is for it (fuck all the bctr instructions that the PPC side loves so much, they make static analysis annoying) but I hope it's as buggy as the rest of IOS
Unfortunately I have NO experience with ARM so I would both be learning ARM and doing blind injection with no debugger so I really just don't have the experience to pull anything like that off right now.

I have always been curious as to how Team Twizzers (now Fail0verflow) did this in the first place. How do you blindly exploit something like that?!?!
I can't imagine doing any of the work I have done without dolphin and its debugging stuff. And even then I had to add more debugging goodies (conditional breakpoints were a must for looping stuff) and it still took me months.
These guys pulled it off with such precision and in such a short amount of time it still amazes me.

As a side note no I'm not dead and I hope to have something new to show you guys soon.(TM)
ETA of maybe a week or so I nothing else goes wrong.

I'll be looking forward to it. Tbh, I always wanted to do a browser exploit but I didn't know how to start lol. I actually never knew th wii browser, would be exploited since I thought if It's too old, it'll be a pain to hassle.

 

[Ryccardo]

I have always been curious as to how Team Twizzers (now Fail0verflow) did this in the first place. How do you blindly exploit something like that?!?!
I can't imagine doing any of the work I have done without dolphin and its debugging stuff. And even then I had to add more debugging goodies (conditional breakpoints were a must for looping stuff) and it still took me months.
These guys pulled it off with such precision and in such a short amount of time it still amazes me.

https://www.flickr.com/photos/micahdowty/3922329338/in/album-72157621023570420/ (watch the whole album, especially the first photos with "that red thing" and many wires)
Since the RAM is made of dedicated chips (as opposed to integrated in the CPU or soldered on top, like on the Raspberry or many phones), "nothing" prevents you from adding something in the middle that allows you to arbitrarily read or even edit memory; and this is by far the most reliable and least blockable way to get arbitrary code execution!

Of course, the fact martin/bushing/svpe and friends were already skilled in electronics engineering, working with machine code, reverse engineering, etc GREATLY contributed to the finding of multiple vulnerabilities and their exploits, which allowed people not owning such still-expensive-in-the-mid-2000s hardware to enjoy homebrew (and most of said vulnerabilities existed due to bugs in Nintendo/Broadon software)

Also, even arbitrary code execution doesn't mean too much if you don't know how to program for the platform (as in "write these bytes to this address to make this pixel green"), PC master race really shows here (large hardware backward compatibility, comparatively more accessories with public datasheets, operating systems with drivers already written, de facto standards at least for basic operation such as VGA text and framebuffer modes that most hardware designers respect...)




As for the wiimote storage idea, I don't think you can do enough in 16 kB (having to add mass storage and FAT drivers inside, as Mii channel, SSBB, etc don't have them... and as above, nobody proven those games exploitable)

 

[nino38]

Hey Fullmetal5
Please correspond to NTSC-J. I’m looking forward to it.　Please let me know if you can’t do that.

 

[Fullmetal5]

Hey Fullmetal5
Please correspond to NTSC-J. I’m looking forward to it.　Please let me know if you can’t do that.

Most of my attention right now is focused on the new thing I've been working on that I hope to obsolete FlashHax and work on all regions. However until it's done I'll try to get J support working as soon a possible. It almost certainly won't be today but maybe by the end of tomorrow I can get J support in. Just as a warning I have found no way to tell a console apart from the browser before hax happen and since they rely on the region type being know before hax it's going to have to have it's on page like flashhax.com/j/ or something. I'll cross that bridge when I come to it.

 

[Deleted User]

Most of my attention right now is focused on the new thing I've been working on that I hope to obsolete FlashHax and work on all regions. However until it's done I'll try to get J support working as soon a possible. It almost certainly won't be today but maybe by the end of tomorrow I can get J support in. Just as a warning I have found no way to tell a console apart from the browser before hax happen and since they rely on the region type being know before hax it's going to have to have it's on page like flashhax.com/j/ or something. I'll cross that bridge when I come to it.

Have you checked if the Accept-Language header changes based on system language?

 

[Fullmetal5]

Have you checked if the Accept-Language header changes based on system language?

Didn't think to check there and sure enough Opera reports ja as an available language. Thanks!

 

[Fullmetal5]

Just finished up the JP version but there is one big road block in the way.
Testing.
The Japanese internet channel like all other region locked titles only launches on a Japanese console.
So I just used priiloader with a region hack to boot it anyway and that almost worked except now the channel just crashes shortly after getting to the main menu and I can't tell why.
Thus I have been unable to actually test this on real hardware...

So if anybody would be so kind and if you have a working Japanese Internet Channel could you please visit http://flashhax.com/j/ and test if it launches correctly.
Please let me know in this thread if it worked and if there were any problems. It's been hard to judge the success rate in dolphin do to internet speeds being wildly different then on real hardware so any number on that would be great too.
Once testing has been done and if everything works ok I will integrate this into the home page.