Hacking Now that theres IOSUHAX - can my USB drive be swapped between my WiiU's?

tivu100 · Nov 23, 2016

dimok said:
Ehm....that's exactly what I said on here just using other words maybe:
https://gbatemp.net/threads/seeprom2sd-by-dimok.450172/page-2#post-6868333

I even gave some instructions how to do it on IRC yesterday. Since not everyone of you is on IRC probably, here is a log snippet:

Code:

[21:56] <@dimok> you have to decrypt the drive completely and re-encrypt it with the key of another console [21:57] <@dimok> use this to get the usb key [21:57] <@dimok> openssl enc -e -aes-128-cbc -nopad -K OTP_USB_KEY -iv 00000000000000000000000000000000 -in usb_seeprom_seed.bin -out usb_key.bin [21:59] <@dimok> then with the key you get in usb_key.bin you can decrypt the usb drive [21:59] <@dimok> and re-encrypt with another [22:00] <@dimok> on linux you can use this command to decrypt usb [22:00] <@dimok> sudo openssl enc -d -aes-128-cbc -nopad -K USB_KEY -iv 00000000000000000000000000000000 -in /dev/sdb -out output.img

LOL. So @Irastris only told half of what of you said (and @NWPlayer123 filled in the rest but didn't know about the readiness of the method). Half truth = misunderstanding

Great news.

cory1492 · Nov 23, 2016

Why not just disable encrypt/decrypt, format the drive with no crypto (or use some pc program and decrypt it) and have it work on any hacked console? Might even see a minor speed boost with encryption disabled.

edit:/ what file system is under the encryption anyway? Some custom one?

Irastris · Nov 23, 2016

tivu100 said:
LOL. So @Irastris only told half of what of you said (and @NWPlayer123 filled in the rest but didn't know about the readiness of the method). Half truth = misunderstanding

Great news.

I only told half of what he said because at the time, he hadn't said that.

That and the fact that I don't browse the IRC, though I have been meaning to. ~~Can someone share the channel?~~ Nevermind, found it.

Jow Banks · Nov 24, 2016

dimok said:
Ehm....that's exactly what I said on here just using other words maybe:
https://gbatemp.net/threads/seeprom2sd-by-dimok.450172/page-2#post-6868333

I even gave some instructions how to do it on IRC yesterday. Since not everyone of you is on IRC probably, here is a log snippet:

Code:

[21:56] <@dimok> you have to decrypt the drive completely and re-encrypt it with the key of another console [21:57] <@dimok> use this to get the usb key [21:57] <@dimok> openssl enc -e -aes-128-cbc -nopad -K OTP_USB_KEY -iv 00000000000000000000000000000000 -in usb_seeprom_seed.bin -out usb_key.bin [21:59] <@dimok> then with the key you get in usb_key.bin you can decrypt the usb drive [21:59] <@dimok> and re-encrypt with another [22:00] <@dimok> on linux you can use this command to decrypt usb [22:00] <@dimok> sudo openssl enc -d -aes-128-cbc -nopad -K USB_KEY -iv 00000000000000000000000000000000 -in /dev/sdb -out output.img

Why can't we modify what key redNAND and/or CFW to use to some other known value other than the console specific USB Key?
It would require a one-time re-encryption of the external drive, but... from then on all Wii-u's could read each others external drives.

I would have thought that even though we can't change what's read in the OTP/seeprom during boot-time, that wouldn't matter as we can change what "key" the ARM/IOSU fw.img uses when it encodes/decodes the USB to something that all Wii U's have in common, like the Common Key.

Maybe I'm still missing something here?

Mister_X · Nov 24, 2016

And what if you make a backup of your nand, create a rednand and later make a backup of this rednand and load it on the second wiiU?

bennyman123abc · Nov 24, 2016

Mister_X said:
And what if you make a backup of your nand, create a rednand and later make a backup of this rednand and load it on the second wiiU?

BRICK INCOMING! BRACE YOURSELVES PEOPLE! BRICKS ARE GOING TO KILL US ALL NOW!!!!!

Jow Banks said:
Why can't we modify what key redNAND and/or CFW to use to some other known value other than the console specific USB Key?
It would require a one-time re-encryption of the external drive, but... from then on all Wii-u's could read each others external drives.

I would have thought that even though we can't change what's read in the OTP/seeprom during boot-time, that wouldn't matter as we can change what "key" the ARM/IOSU fw.img uses when it encodes/decodes the USB to something that all Wii U's have in common, like the Common Key.

Maybe I'm still missing something here?

It might be *possible* to spoof the OTP key by having the system read the OTP key from the SD Card however, very unlikely and possibly not even worth it.

Mister_X · Nov 24, 2016

Brick? For load one emunand with cfw booter? Im not really sure, but i think this not true, we are only talking about load RedNand from 64Gb SD in other wiiu..... really brick? I dont think so.... but maybe im wrong....

bennyman123abc · Nov 24, 2016

Mister_X said:
Brick? For load one emunand with cfw booter? Im not really sure, but i think this not true, we are only talking about load RedNand from 64Gb SD in other wiiu..... really brick? I dont think so.... but maybe im wrong....

It's still possible to brick your Wii U from redNAND you know...

dimok · Nov 24, 2016

Jow Banks said:
Why can't we modify what key redNAND and/or CFW to use to some other known value other than the console specific USB Key?
It would require a one-time re-encryption of the external drive, but... from then on all Wii-u's could read each others external drives.

I would have thought that even though we can't change what's read in the OTP/seeprom during boot-time, that wouldn't matter as we can change what "key" the ARM/IOSU fw.img uses when it encodes/decodes the USB to something that all Wii U's have in common, like the Common Key.

Maybe I'm still missing something here?

That is also what I already mentioned on here in similar words (the part about ios crypto):
https://gbatemp.net/threads/seeprom2sd-by-dimok.450172/page-2#post-6868333

Mister_X · Nov 24, 2016

mmmm... interesting...

75mak · Nov 25, 2016

If the hard drive after decryption just uses fat32 type files structure then is it possible to......

Decrypt the hard drive (using unique key)
Put vWii backup launcher data on the hdd
Then encrypt the hard drive (using key)

The data might appear in Wii u data management as unnecessary data, but the main thing is the data will be available on the hard drive.

The final step would be to update the vWii backup launchers gxloader, cfg etc. To read the Wii u type drive. If required the Wii u key could be inserted in a config file.

Is this possible?

bennyman123abc · Nov 25, 2016

75mak said:
If the hard drive after decryption just uses fat32 type files structure then is it possible to......

Decrypt the hard drive (using unique key)
Put vWii backup launcher data on the hdd
Then encrypt the hard drive (using key)

The data might appear in Wii u data management as unnecessary data, but the main thing is the data will be available on the hard drive.

The final step would be to update the vWii backup launchers gxloader, cfg etc. To read the Wii u type drive. If required the Wii u key could be inserted in a config file.

Is this possible?

Sorry to rain on your parade but, the Wii U hard drive uses a WBFS file system which currently only has Read functionality on PC (Linux is the only OS supported I believe).

Irastris · Nov 25, 2016

bennyman123abc said:
Sorry to rain on your parade but, the Wii U hard drive uses a WBFS file system which currently only has Read functionality on PC (Linux is the only OS supported I believe).

You do realize that we know you're talking out of your ass, right? Wii U formatted drives do not use WBFS.

I'm not sure if you know this, but WBFS is not a Nintendo format. WBFS was created kwiirk and Waninkoko back in the original Wii days specifically for Wii backups.

bennyman123abc · Nov 25, 2016

Irastris said:
You do realize that we know you're talking out of your ass, right? Wii U formatted drives do not use WBFS.

I'm not sure if you know this, but WBFS is not a Nintendo format. WBFS was created kwiirk and Waninkoko back in the original Wii days specifically for Wii backups.

Sorry. I thought that that was the official Nintendo FS that they use for like, everything now. If it's not WBFS however, what is it?

Irastris · Nov 25, 2016

bennyman123abc said:
Sorry. I thought that that was the official Nintendo FS that they use for like, everything now. If it's not WBFS however, what is it?

For now, it's simply been dubbed NFS. Nintendo File System.

bennyman123abc · Nov 25, 2016

Irastris said:
For now, it's simply been dubbed NFS. Nintendo File System.

Do we currently have a way to at the least read it?

QuarkTheAwesome · Nov 25, 2016

The wiki hints at filesystem formats in a few places; most notably:

FST, which explains a bit about the format used for discs and eShop stuff
/dev/fsa, which name-drops "ISFS" as the system used for the internal storage (read: NAND?). This term seems to havve been coined by marionumber1.

I'd suspect ISFS would be the system used on USB drives as well.

Irastris · Nov 25, 2016

QuarkTheAwesome said:
I'd suspect ISFS would be the system used on USB drives as well.

If that's the case, wouldn't the term technically be ESFS?

bennyman123abc · Nov 26, 2016

QuarkTheAwesome said:
The wiki hints at filesystem formats in a few places; most notably:

FST, which explains a bit about the format used for discs and eShop stuff

/dev/fsa, which name-drops "ISFS" as the system used for the internal storage (read: NAND?). This term seems to havve been coined by marionumber1.

I'd suspect ISFS would be the system used on USB drives as well.

Sorry if I sound like a complete ass but, if we have the information on what calls are made in the filesystem for read, write, etc., then why the hell haven't we done anything with it yet?

QuarkTheAwesome · Nov 26, 2016

bennyman123abc said:
Sorry if I sound like a complete ass but, if we have the information on what calls are made in the filesystem for read, write, etc., then why the hell haven't we done anything with it yet?

If you're talking about the /dev/fsa stuff, that's because all that is on the Wii U itself. You hit the nail on the head when you said the calls were read/write etc: all the encryption is handled by the backend and not by homebrew; we just get to read and write the already-decrypted and interpreted content. It's literally "find this file"; no "decrypt the device, now loop through the filesystem table, now off I go to interpret that..."

Because of this, there's not much understanding of what actually happens behind the scenes, and certainly not much on the filesystem (ISFS/ESFS) itself. Somebody would have to reverse-engineer the IOSU's firmware to figure out what it actually does to find the files we ask for. While not impossible, ARM assembly is no PowerPC and reading that stuff is headache-inducing. Good luck convincing anyone, especially with libfat on the way (removing the need for homebrew to use ISFS/ESFS at all).

Hacking Now that theres IOSUHAX - can my USB drive be swapped between my WiiU's?

Would a Sharable Wii-U USB Drive be of any use?

Yes, I'd like to be able to move my USB Drive to another Wii U

No, this would be a useless feature.

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

🦊

Well-Known Member

Well-Known Member

🦊

Similar threads

Popular threads in this forum