3c33 Roundup (Wii U Only) - Exploits, boot1 and non-specificity, oh my!

Discussion in 'Wii U - Hacking & Backup Loaders' started by QuarkTheAwesome, Dec 27, 2016.

  1. QuarkTheAwesome
    OP

    QuarkTheAwesome Working for Hugs

    Member
    809
    1,990
    Apr 19, 2015
    Australia
    Stuck in the PowerPC
    Hey all!

    Well, I've just finished watching the Nintendo Hacking segment at this year's 3c33 - naehrwert, derrek and nedwill presented an hour-long talk on all things Wii U and 3DS. Actually, not all things. In fact, the Wii U section was kinda disappointing. Very much so.

    To start off, we got a recap of some exploits on the console. These include:

    • ioctlvhax - Published back in the kernel days but never publicly implemented, this exploit functions as a PowerPC and IOSU userspace exploit. It's patched in firmwares newer than 5.2.0.
    • mqhax - A bug in IOS_CreateMessageQueue allows getting control of the IOSU kernel. While this is a new exploit, we already have a bug in IOS_CreateThread that allows the same thing.
    • coldboothax - Identical to the public coldboothax implementation.
    Of course, what we're really interested in is what they managed with the boot process - boot1! Here's what they revealed:

    • boot1 reads system.xml, but the code to do it is pretty solid.
    • The only way to dump boot1 is to exploit boot0, but boot0 is also pretty solid.
    • One solution to this is a hardmod. This can be used to introduce bugs into boot0! This is similar to how it worked on the XBox 360 with RGH.
    • In this way, boot0 code execution was gained using a buffer overflow and a fake boot1.
    • They dumped and decrypted boot1!
    • They started looking for bugs in boot1, but "lost interest" and left it as-is. Quote:
    after all, it's just the Wii U

    This is very cool, but there's one problem.

    They were deliberately very vague about the specifics of the hardmod. Basically, all we know is that they used fault injection (an industry standard thing) to "glitch" boot0. I'm not simplifying - that's all they said. In fact someone asked for specifics and the response was "It's complicated, figure it out yourself".

    Um.

    Right after, the Wii U section ended. That's all they had to say on the matter; no "one more thing" or addendum. Unfortunately, the fact of the matter is that this is not enough information to perform the same exploit. While a pointer in the right direction, a hell of a lot of work is going to have to go into reverse-engineering the Wii U motherboard before we even have a vauge idea of how this would work in practice.

    They did, however, imply that there was a bug in boot1.

    Edit: formatting

    (Original was on Reddit, but seems to have been AutoModeratored. Ouch.)

    Read up about 3c33 on Reddit over here -> link
    @Maschell also made a YouTube upload of the full talk, although it's unlisted so we'd have to wait on his input before linking it out.
     
    Last edited by QuarkTheAwesome, Dec 27, 2016
    KiiWii, zeldaism, Quantumcat and 3 others like this.
  2. Nikolay

    Nikolay GBAtemp Fan

    Member
    424
    42
    Mar 19, 2010
    United States
    Reddit post is gone?
     
  3. xtheman

    xtheman GBAtemp Guru

    Member
    5,847
    5,275
    Jan 28, 2016
    United States
    [removed]

    To bad I can't read it :(
     
  4. lebrawurschd

    lebrawurschd GBAtemp Regular

    Member
    233
    45
    Jan 1, 2016
    Gambia, The
    gues nintendo is pissed off
     
    FlappyFalco and NoNAND like this.
  5. QuarkTheAwesome
    OP

    QuarkTheAwesome Working for Hugs

    Member
    809
    1,990
    Apr 19, 2015
    Australia
    Stuck in the PowerPC
    Updated with the full text of the post. I think I may have been shadowbanned.
     
  6. pcm720

    pcm720 GBAtemp Regular

    Member
    280
    228
    Jul 29, 2012
    Russia
    It's available on CCC's YouTube channel
    And here, too
     
    Last edited by pcm720, Dec 27, 2016
    yahoo and Net-KILLER like this.
  7. Billy Acuña

    Billy Acuña GBAtemp Addict

    Member
    2,245
    1,337
    Oct 10, 2015
    Mexico
    Well, that sucks :/ looks like not only Nintendo abandoned the wiiu.
     
  8. SirByte

    SirByte GBAtemp Fan

    Member
    494
    191
    Dec 30, 2012
    Canada
    Agreed, I was hoping for more too. As a 3DS owner there was still plenty of interesting stuff, but WiiU deserves much more attention, especially since they decided to dump the boot11 rom for 'completeness sake'. WiiU right now is a bunch of different hacks while we're still waiting for the Team SALT all-in-one solution.

    Still there were some hints in the talk. They had that whole rig (with a picture) to determine what was going on, then the clock and voltage lines were involved. So perhaps it's a matter of finding the correct timing, dropping the voltage at the right time and upping the clock ticks then quickly going back to normal?
     
  9. QuarkTheAwesome
    OP

    QuarkTheAwesome Working for Hugs

    Member
    809
    1,990
    Apr 19, 2015
    Australia
    Stuck in the PowerPC
    The picture, annoyingly, was of a totally different setup (NAND tracer). The actual setup they used to mess up boot0 remains a total mystery.
     
  10. iAqua

    iAqua GBAtemp Addict

    Member
    GBAtemp Patron
    iAqua is a Patron of GBAtemp and is helping us stay independent!

    Our Patreon
    2,754
    2,268
    Dec 7, 2015
    Antarctica
    Team SALT's solution will probably not be better then the current one.
    pretty sure they probably won't even release their redNAND stuff.
     
    Last edited by iAqua, Dec 28, 2016
  11. Ghassen-ga

    Ghassen-ga GBAtemp Advanced Fan

    Member
    570
    358
    Jul 21, 2016
    team salt has also given up on the scene apparently, don't hold your breath.
     
  12. C0mm4nd_

    C0mm4nd_ Aspirant Wii U homebrew dev :P

    Member
    697
    337
    Oct 9, 2016
    Italy
    BTW, it's 33c3 :)

    I watched the 33c3 live, and they talked <30mins 'bout Wii U...

    Basically: 1-explaining exploits 2-bootroms
     
  13. QuarkTheAwesome
    OP

    QuarkTheAwesome Working for Hugs

    Member
    809
    1,990
    Apr 19, 2015
    Australia
    Stuck in the PowerPC
    You're kidding, really? Dang.

    Watched it live too; had fun sharing the collective disappointment on IRC when they were like "well, it's just the Wii U, figure it out yourself!" (challenge accepted; it's on my list)
     
    vgmoose and TotalInsanity4 like this.
  14. C0mm4nd_

    C0mm4nd_ Aspirant Wii U homebrew dev :P

    Member
    697
    337
    Oct 9, 2016
    Italy
    asd
     
  15. Osakasan

    Osakasan GBAtemp Advanced Fan

    Member
    794
    446
    Sep 19, 2015
    Pathetic, and dissapointing.

    I though the scene found fun in the challenge and the break-in, and that this guys were kind of the head of it.

    Wii U offers lots of possibilities and there may be more that can be done, but it feels like they can't be bothered with it.

    Fuck, i feel kinda down now.
     
  16. Billy Acuña

    Billy Acuña GBAtemp Addict

    Member
    2,245
    1,337
    Oct 10, 2015
    Mexico
    Wow, everyones on IRC were watching the live talk? That actually surprises me :P
     
  17. QuarkTheAwesome
    OP

    QuarkTheAwesome Working for Hugs

    Member
    809
    1,990
    Apr 19, 2015
    Australia
    Stuck in the PowerPC
    Keep in mind that my list also contains a number of other high-profile projects that I've already started; I don't think I'll even start with this lark until mid-Jan (ofc things can change!) Whatever happens; I'll probably ending up waiting on a shipment of a dead console/tri-wing screwdriver. Will try to organise those asap.
    Of course, this says nothing of the other developers who may want to give this a go. Don't wait for me, I'll catch up! We allknow my track record with this sort of thing anyway ^_^
    We have fun :D
     
    Last edited by QuarkTheAwesome, Dec 28, 2016
    TotalInsanity4 likes this.
  18. DeslotlCL

    DeslotlCL GBAtemp's official dragon look-alike axolotl

    Member
    1,933
    2,134
    Oct 28, 2015
    Chile
    under your bed
    So, with team salt giving up and counting the latest "big" releases on the scene, this thing is heading to its end.

    You were a nice console, wii u, but not even developers want to waste their time on you at this point.

    gg.
     
  19. muskieratboi

    muskieratboi Rydian's got some competition!

    Member
    401
    235
    Sep 19, 2012
    They REALLY should have worded what they said differently, IMO. Not exactly happy with their attitude.
     
  20. bob4455

    bob4455 Member

    Newcomer
    30
    1
    Dec 8, 2016
    United States
    whats the irc channel/network?