Homebrew [RELEASE] Tiramisu Environment | Free CBHC

Dogbert8 · Jan 27, 2022

godreborn said:
are you using cbhc?

No, I am not. That was uninstalled (and verified as uninstalled) before doing anything with Tiramisu.

Edit: Also, in case it helps, I followed the same process, using the same files, on two other systems (yes, I have three) and it worked perfectly on the other two. This is the only system that doesn't allow me to access the boot options.

Maschell · Jan 27, 2022

Dogbert8 said:
I am having some difficulty getting it to autoboot to Tiramisu. When I go to Boot Options, it gives me this error message:

"Sorry, your system.xml file has not yet been tested with this tool. Boot options cannot be modified."

But checking the system is required to even get to the Boot options selection, so I can't figure out what is wrong here. This is a fresh install with files I downloaded from the official site just an hour ago.

This sounds like you've already modified your system.xml before (or used a tool that modified the system.xml). The installer only actually modifes the system.xml if the changes will result in a file with known hash.

Without a copy of your system.xml it's hard to tell whats going on though.

Dogbert8 · Jan 27, 2022

Maschell said:
This sounds like you've already modified your system.xml before (or used a tool that modified the system.xml). The installer only actually modifes the system.xml if the changes will result in a file with known hash.

This one is my "backup" system. I bought it second hand (saw a price I couldn't pass up), installed CBHC on it, stored it away, uninstalled CBHC, and installed Tiramisu. I didn't do anything else that would modify files. It was not hacked when I got it, though I suppose the previous owner could have hacked it, then deleted any obvious evidence of the hacking before selling it to me. The CBHC uninstall should have restored the system.xml to its original state (and did on my other consoles). Anything I can do to figure out what the problem is or fix it?

I assume it is possible to get a copy of system.xml via one of the FTP programs. I can run one and see if I can get a copy.

godreborn · Jan 27, 2022

Dogbert8 said:
This one is my "backup" system. I bought it second hand (saw a price I couldn't pass up), installed CBHC on it, stored it away, uninstalled CBHC, and installed Tiramisu. I didn't do anything else that would modify files. It was not hacked when I got it, though I suppose the previous owner could have hacked it, then deleted any obvious evidence of the hacking before selling it to me. The CBHC uninstall should have restored the system.xml to its original state (and did on my other consoles). Anything I can do to figure out what the problem is or fix it?

I assume it is possible to get a copy of system.xml via one of the FTP programs. I can run one and see if I can get a copy.

check title id of the system.xml. that's what would've been changed with cbhc. it's the same depending on region.

Maschell · Jan 27, 2022

godreborn said:
check title id of the system.xml. that's what would've been changed with cbhc. it's the same depending on region.

The titleid doesn't matter as the installer is overriding it anyway

godreborn · Jan 27, 2022

but wouldn't that make the checksum different?

Maschell · Jan 27, 2022

The installer is modifying the system.xml in-memory and then hashes the results. Only if this hash is known, it does the real thing

Dogbert8 · Jan 27, 2022

Here's my system.xml:

<?xml version="1.0" encoding="utf-8"?>
<system type="complex" access="777">
<version type="unsignedInt" length="4">21</version>
<cmdFlags type="unsignedInt" length="4">0</cmdFlags>
<default_os_id type="hexBinary" length="8">000500101000400a</default_os_id>

<default_title_id type="hexBinary" length="8">0005001010040100</default_title_id>

<log type="complex">
<enable type="unsignedInt" length="4">0</enable>
<max_size type="unsignedInt" length="4">8388607</max_size>
</log>
<standby type="complex">
<enable type="unsignedInt" length="4">0</enable></standby>
<ramdisk type="complex">
<cache_user_code type="unsignedInt" length="4">1</cache_user_code>
<max_file_size type="unsignedInt" length="4">10485760</max_file_size>

<cache_delay_ms type="unsignedInt" length="4">10000</cache_delay_ms>
</ramdisk>
<simulated_ppc_mem2_size type="hexBinary" length="4">00000000</simulated_ppc_mem2_size>

<dev_mode type="unsignedInt" length="4">0</dev_mode>
<prev_title_id type="hexBinary" length="8">0000000000000000</prev_title_id>

<prev_os_id type="hexBinary" length="8">0000000000000000</prev_os_id>
<default_app_type type="hexBinary" length="4">90000001</default_app_type>

<default_device_type type="string" length="16"></default_device_type>
<default_device_index type="unsignedInt" length="4">0</default_device_index>

<fast_relaunch_value type="unsignedInt" length="4">0</fast_relaunch_value>

<default_eco_title_id type="hexBinary" length="8">0005001010066000</default_eco_title_id>

</system>

godreborn · Jan 27, 2022

I think os id and title id are correct anyway. seems to be a US version of the console, I believe (i.e. 100). as for the rest of it, I'm not sure.

Maschell · Jan 27, 2022

Dogbert8 said:
Here's my system.xml:

<?xml version="1.0" encoding="utf-8"?>
<system type="complex" access="777">
<version type="unsignedInt" length="4">21</version>
<cmdFlags type="unsignedInt" length="4">0</cmdFlags>
<default_os_id type="hexBinary" length="8">000500101000400a</default_os_id>

<default_title_id type="hexBinary" length="8">0005001010040100</default_title_id>

<log type="complex">
<enable type="unsignedInt" length="4">0</enable>
<max_size type="unsignedInt" length="4">8388607</max_size>
</log>
<standby type="complex">
<enable type="unsignedInt" length="4">0</enable></standby>
<ramdisk type="complex">
<cache_user_code type="unsignedInt" length="4">1</cache_user_code>
<max_file_size type="unsignedInt" length="4">10485760</max_file_size>

<cache_delay_ms type="unsignedInt" length="4">10000</cache_delay_ms>
</ramdisk>
<simulated_ppc_mem2_size type="hexBinary" length="4">00000000</simulated_ppc_mem2_size>

<dev_mode type="unsignedInt" length="4">0</dev_mode>
<prev_title_id type="hexBinary" length="8">0000000000000000</prev_title_id>

<prev_os_id type="hexBinary" length="8">0000000000000000</prev_os_id>
<default_app_type type="hexBinary" length="4">90000001</default_app_type>

<default_device_type type="string" length="16"></default_device_type>
<default_device_index type="unsignedInt" length="4">0</default_device_index>

<fast_relaunch_value type="unsignedInt" length="4">0</fast_relaunch_value>

<default_eco_title_id type="hexBinary" length="8">0005001010066000</default_eco_title_id>

</system>

For some reason your `ramdisk>cache_user_code` is set to 1:

<cache_user_code type="unsignedInt" length="4">1</cache_user_code>

If you set this to

<cache_user_code type="unsignedInt" length="4">0</cache_user_code>

it should work. But keep in mind to be VERY careful when manually modifying your system.xml. I personally would just change this single byte of the file with a hex editor and double check that only this byte is different. Make sure to have slc + otp + seeprom backup so you can unbrick in worst case

I uploaded a copy with a known hash which coldboots into the Wii U Menu (USA, 0005001010040100) . But please make sure the SHA1 Hash of the downloaded system.xml still is "124562D41A02C7112DDD5F9A8F0EE5DF97E23471". (removed because the file could brick people from other regions)

Dogbert8 · Jan 27, 2022

That worked like a charm, Maschell. After replacing the file with the one you provided, I was able to turn on autoboot without a problem. Thank you so much for your quick work to help me, and for your work on this project in general. It is very much appreciated!

pressplay · Jan 27, 2022

Just for curiosity: which is the difference between payload.elf, payload.rpx and root.rpx in sd://wiiu? I guess payload.elf is the CustomRPXLoader, and payload.rpx is the EnvironmentLoader. What about root.rpx? Maybe is it the PayloadLoaderPayload recall when navigating to wiiuexploit.xyz?

Maschell · Jan 27, 2022

pressplay said:
Just for curiosity: which is the difference between payload.elf, payload.rpx and root.rpx in sd://wiiu? I guess payload.elf is the CustomRPXLoader, and payload.rpx is the EnvironmentLoader. What about root.rpx? Maybe is it the PayloadLoaderPayload recall when navigating to wiiuexploit.xyz?

The root.rpx is the PayloadLoader. It's the same .rpx that is injected into H&S. When you exit the system settings basically the whole console is rebooting but this time into the Wii U Menu instead of H&S. So still mantain code execution we redirect the Wii U Menu once to the sd card (=> the root.rpx) which allows us to relaunch the CustomRPXLoader (payload.elf) => reboot into EvironmentLoader (payload.rpx) => reboot into Tiramisu without actually rebooting into H&S

pressplay · Jan 27, 2022

Thanks Maschell, very clear and kind of you. Just to complete, I forgot to ask about the payload.elf in sd:/wiiu/payloads/default. From the documentation it is chainloaded by PayloadLoaderPayload. So maybe payload.elf in the root of the SD is the PayloadLoaderPayload, and payload.elf in payloads/default is the CustomRPXLoader. Correct?

Tebra · Jan 27, 2022

Hi,
I just installed Tiramisu and bluepair. Everything works fine. Thanks

MockyLock · Jan 28, 2022

Hello, me again !
So, following these advices:

mitgenuss said:
Hi MockyLock

This WiiU Forwarder to the vWii forwarder for USBLGX worked for me:
https://gbatemp.net/threads/usb-loader-gx-forwarder-channel-for-wii-u-menu.482595/

for the vWii Forwarder i used the UNEO Forwarder V 5.1 from here
https://sourceforge.net/projects/usbloadergx/files/Releases/Forwarders/

i had to reinstall/do a redump of USBLGX on the SD-Card before it worked. More details of my odyssey till it was working you will find here :
https://gbatemp.net/threads/usb-loader-gx.149922/post-9730164

I finally did this :
- copied back the 50_hbl_installer.rpx file in tis folder.
- kept the vWii forwarder to USBLGX (it was an [UNEO] one, not sure about its version.
- uninstalled my previous version of WiiU forwarder to vWii forwarder (using the Data Management in the System Settings app of the WiiU).
- installed the version above using Wup Installer Y Mod

And guess what, evrything is working again. My WiiU Forwarder lead me to USBLGX. Nice !
However, and just for the discussion with no complain, the process seems a bit more longer than my previous one. I'm pretty sure that before, once the WiiU forwarder started, waiting for a few secondes, USB Loarder booted pretty straight.
Now i can see the WiiU Forwarder channel screen fading, then the Wii "splashs creen" displayed, then USB Loader GX come on screen.

Thank you all for your work, thank you @Maschell @GaryOderNichts
Thank to @V10lator too

V10lator · Jan 28, 2022

MockyLock said:
@V10lator

Thanks but I'm not part of the team.

MockyLock · Jan 28, 2022

V10lator said:
Thanks but I'm not part of the team.

But you're part of the help in here

[Truth] · Jan 28, 2022

V10lator said:
Thanks but I'm not part of the team.

But you should be.

Donnie-Burger · Jan 28, 2022

Homebrew [RELEASE] Tiramisu Environment | Free CBHC

Active Member

Well-Known Member

Active Member

Welcome to the Machine

Well-Known Member

Welcome to the Machine

Well-Known Member

Active Member

Welcome to the Machine

Well-Known Member

Active Member

Member

Well-Known Member

Member

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Similar threads

Popular threads in this forum