Hacking Hijill 0.2 release

ZRicky11 · Jan 5, 2012

It also works for me but the extracted channel hasn't got a 00000002.app (so there isn't a .dol file)...
How can we extract it?

EDIT for Windows users: to compile it without using the .sh file, copy and paste that in a .txt file and rename it "makeIt.bat"

http://pastebin.com/aD6Lt9Sb

xfcrowman · Jan 5, 2012

ZRicky11 said:
It also works for me but the extracted channel hasn't got a 00000002.app (so there isn't a .dol file)...
How can we extract it?

EDIT for Windows users: to compile it without using the .sh file, copy and paste that in a .txt file and rename it "makeIt.bat"
http://pastebin.com/aD6Lt9Sb

ZRicky11 - what did you modify in the source to get a hbc.elf? I know that your extracted elf doesn't work, but in my case I can't get it to extract anything, so you have definitely made some correct modifications to the source.

Thanks

JoostinOnline · Jan 5, 2012

Edit: Nvm.

ZRicky11 · Jan 5, 2012

xfcrowman said:
ZRicky11 said:

It also works for me but the extracted channel hasn't got a 00000002.app (so there isn't a .dol file)...
How can we extract it?

EDIT for Windows users: to compile it without using the .sh file, copy and paste that in a .txt file and rename it "makeIt.bat"
http://pastebin.com/aD6Lt9Sb

Click to expand...

ZRicky11 - what did you modify in the source to get a hbc.elf? I know that your extracted elf doesn't work, but in my case I can't get it to extract anything, so you have definitely made some correct modifications to the source.

Thanks

I used wiimod but it doesn't work...now i'm trying to extract it from Hijill

SifJar · Jan 5, 2012

this is from main.c in loader:

Code:

// place 1 copy in mem1 like the nandloader
void* addr;
s32 len;
len = LoadHbcHToMem1();
if( len < 0 )
{
EXIT();
}
addr = (void*)0x80004000;
ICInvalidateRange( addr, len );

// copy it to mem2 where it would copy itself if it started normally
addr = (void*)0x90010000;
memcpy( addr, (void*)0x80004000, len );
DCFlushRange( addr, len );

Presumably, at this point if you dumped len bytes from 0x80004000 (or 0x90010000) to SD card, you would get the hbc elf.

EDIT: No, I don't know how to do this. But if you look at some app that dumps stuff, you might be able to figure it out. How hard could it be?

Note that this hbc elf would be unpatched - you would probably have to manually apply the patches from patches.c to the elf to get it to boot at all.

xfcrowman · Jan 5, 2012

Pune just updated his site to include a modified version of HiJill that will dump a decrypted & unpatched HBC.elf on the SD card. As before, to run this from HBC you'll need no IOS reload enabled on a meta.xml.

Here's the site again:

http://giantpune.zzl.org/hijill.html

Thanks giantpune!

giantpune · Jan 5, 2012

you wouldnt get too much if you dumped the memory at that point. the way their nandloader works, it starts up and then copies itself somewhere and then jumps to execute inside the copied code. if you try to patch the code, it will mess up some cryptostuff and the elf wont be extracted correctly. so what the program does is to copy the code like it would normally do, and then patch the original copy of the code and the second copy can remain untouched. then it starts executing in the first copy where it would normally start in the second copy.

the whole point of that loader.dol is to let their nandloader extract its payload and then branch to the worker.dol instead of branching to execute the payload itself. rather than writing all the code to do this extraction and decryption stuff, it uses their existing code. so this memcpy you are seeing is still pushing around lots of encrypted stuff.

if you want to dump the elf, you would need to do it from the worker.dol. or you can try the download page for hijill. i put a dol on there that will take a dump for you.

JoostinOnline · Jan 5, 2012

Just because I'm weird, I created a meta.xml and icon.png for it. There isn't really a point in it since you will probably only run it once, but like I said, I'm weird.

http://www.mediafire.com/?i3s87yyg8umh5ci

XFlak · Jan 5, 2012

JoostinOnline said:
Just because I'm weird, [...snip...] but like I said, I'm weird.

Ain't no arguing with that

JoostinOnline · Jan 5, 2012

XFlak said:
JoostinOnline said:

Just because I'm weird, [...snip...] but like I said, I'm weird.

Click to expand...

Ain't no arguing with that

Hey, at least I'm not in a parking lot humping a Wii while wearing a Star Wars costume.

DeadlyFoez · Jan 5, 2012

JoostinOnline said:
Hey, at least I'm not in a parking lot humping a Wii while wearing a Star Wars costume.

No, but masturbating in the seclusion of your parents basement is not any better.

SifJar · Jan 5, 2012

JoostinOnline said:
Just because I'm weird, I created a meta.xml and icon.png for it. There isn't really a point in it since you will probably only run it once, but like I said, I'm weird.

http://www.mediafire.com/?i3s87yyg8umh5ci

It would make more sense to do one of Hijill, seeing as people may want to run it more often...although chances are someone wanting to run it regularly would make a channel of it, so that they wouldn't have to load HBC, then load it again via Hijill.

JoostinOnline · Jan 5, 2012

SifJar said:
JoostinOnline said:

Just because I'm weird, I created a meta.xml and icon.png for it. There isn't really a point in it since you will probably only run it once, but like I said, I'm weird.

http://www.mediafire...i3s87yyg8umh5ci

Click to expand...

It would make more sense to do one of Hijill, seeing as people may want to run it more often...although chances are someone wanting to run it regularly would make a channel of it, so that they wouldn't have to load HBC, then load it again via Hijill.

Well if giantpune wants one for Hijill, I'd be happy to make one. As for loading the HBC again, I think you could just do this add this to the beginning of main.c:

Code:

#define TITLE_ID(x,y) (((u64)(x)

giantpune · Jan 5, 2012

no. that wont work. i think you misunderstand how this works completely.

JoostinOnline · Jan 5, 2012

giantpune said:
no. that wont work. i think you misunderstand how this works completely.

Okay, it was just a guess. I gave up trying to understand how this works like 3 days ago, lol. I know it's way over my head. I still find it interesting though, which is why I have been reading this thread. I am a mediocre coder, and the only languages I have learned properly are Scheme and Java.

I'll just stick with what I am decent at. If you think you might want an icon, just ask. You have no obligation to use it if you don't like it. I'll probably make one anyway though, lol.

SifJar · Jan 5, 2012

Joostin: By my understanding anyway, what basically happens is you load Hijill, and it will load HBC with the patches. In other words, if you were loading it from regular HBC, you would load up HBC, select Hijill, then Hijill would load the patched HBC. Which is what I meant before by loading HBC again. In effect, you would load it twice by this method.

An alternative would be to create a custom channel and install it alongside HBC. This would mean that you could either load the regular HBC, or load the Hijill channel and it would directly boot the patched HBC.

Another option is dump the HBC elf with the HBC dumper version of Hijill, manually apply the patches you want, put it in a channel and install it - this way you wouldn't need the official HBC installed at all.

person66 · Jan 5, 2012

SifJar said:
this is from main.c in loader:

Code:

// place 1 copy in mem1 like the nandloader void* addr; s32 len; len = LoadHbcHToMem1(); if( len < 0 ) { EXIT(); } addr = (void*)0x80004000; ICInvalidateRange( addr, len ); // copy it to mem2 where it would copy itself if it started normally addr = (void*)0x90010000; memcpy( addr, (void*)0x80004000, len ); DCFlushRange( addr, len );

Presumably, at this point if you dumped len bytes from 0x80004000 (or 0x90010000) to SD card, you would get the hbc elf.

EDIT: No, I don't know how to do this. But if you look at some app that dumps stuff, you might be able to figure it out. How hard could it be? Note that this hbc elf would be unpatched - you would probably have to manually apply the patches from patches.c to the elf to get it to boot at all.

Ahh, that might be the problem, I was dumping from the wrong location. ~~Also, How do we know how many bytes to dump?~~ Never mind, you said that in the post.

SifJar · Jan 6, 2012

person66 said:
Ahh, that might be the problem, I was dumping from the wrong location. ~~Also, How do we know how many bytes to dump?~~ Never mind, you said that in the post.

Did you not see Giantpune's post? This wouldn't have worked anyway, and he has posted a working dumper on the Hijill page.

xfcrowman · Jan 6, 2012

SifJar said:
Another option is dump the HBC elf with the HBC dumper version of Hijill, manually apply the patches you want, put it in a channel and install it - this way you wouldn't need the official HBC installed at all.

I'm currently trying to do this, and I have been reading SifJar's guide for porting preloader patches to help me figure out how to manually apply the patches with a hex editor.

I think that for each patch, I need to find the correct offset by subtracting 0x8132FAE0 from each address, and then replace the existing values with the ones provided in the source.

For instance:

For the following patch:

// ticketview check
write32( 0x81331818, 0x38600001 );

0x81331818-0x8132FAE0 = 1D38 (that's the offset)

Go to offset 1D38 in HBC.elf with a hex editor, and you find: 48 02 AC B9

Replace this with: 38 60 00 01 and then you have manually applied the patch.

SifJar - is my understanding of this correct? If so I will try manually adding the RemoveAntiHaxx patches manually and then see if this modified hbc.elf works.

person66 · Jan 6, 2012

SifJar said:
person66 said:

Ahh, that might be the problem, I was dumping from the wrong location. ~~Also, How do we know how many bytes to dump?~~ Never mind, you said that in the post.

Click to expand...

Did you not see Giantpune's post? This wouldn't have worked anyway, and he has posted a working dumper on the Hijill page.

No, I didn't notice that, thanks!

EDIT: Hmm, looks like I was dumping the correct file originally, I was just missing a few bytes at the beginning and end

Hacking Hijill 0.2 release

Active Member

Well-Known Member

Certified Crash Test Dummy

Active Member

Not a pirate

Well-Known Member

Well-Known Member

Certified Crash Test Dummy

Wiitired but still kicking

Certified Crash Test Dummy

XFlak Fanboy

Not a pirate

Certified Crash Test Dummy

Well-Known Member

Certified Crash Test Dummy

Not a pirate

If it isn't edited, it isn't a true person66 post

Not a pirate

Well-Known Member

If it isn't edited, it isn't a true person66 post

Similar threads

Popular threads in this forum